2197 lines
69 KiB
Plaintext
2197 lines
69 KiB
Plaintext
module SGSN_Tests {
|
|
|
|
import from General_Types all;
|
|
import from Osmocom_Types all;
|
|
import from Native_Functions all;
|
|
import from NS_Types all;
|
|
import from NS_Emulation all;
|
|
import from BSSGP_Types all;
|
|
import from BSSGP_Emulation all;
|
|
import from Osmocom_Gb_Types all;
|
|
|
|
import from MobileL3_CommonIE_Types all;
|
|
import from MobileL3_GMM_SM_Types all;
|
|
import from MobileL3_Types all;
|
|
import from L3_Templates all;
|
|
import from L3_Common all;
|
|
|
|
import from GSUP_Emulation all;
|
|
import from GSUP_Types all;
|
|
import from IPA_Emulation all;
|
|
|
|
import from GTP_Emulation all;
|
|
import from GTP_Templates all;
|
|
import from GTP_CodecPort all;
|
|
import from GTPC_Types all;
|
|
import from GTPU_Types all;
|
|
|
|
import from LLC_Types all;
|
|
import from LLC_Templates all;
|
|
|
|
import from SNDCP_Types all;
|
|
|
|
import from TELNETasp_PortType all;
|
|
import from Osmocom_VTY_Functions all;
|
|
|
|
import from GSM_RR_Types all;
|
|
|
|
import from MobileL3_MM_Types all;
|
|
|
|
|
|
modulepar {
|
|
/* IP/port on which we run our internal GSUP/HLR emulation */
|
|
charstring mp_hlr_ip := "127.0.0.1";
|
|
integer mp_hlr_port := 4222;
|
|
charstring mp_ggsn_ip := "127.0.0.2";
|
|
|
|
NSConfigurations mp_nsconfig := {
|
|
{
|
|
local_udp_port := 21010,
|
|
local_ip := "127.0.0.1",
|
|
remote_udp_port := 23000,
|
|
remote_ip := "127.0.0.1",
|
|
nsvci := 97,
|
|
nsei := 96
|
|
},
|
|
{
|
|
local_udp_port := 21011,
|
|
local_ip := "127.0.0.1",
|
|
remote_udp_port := 23000,
|
|
remote_ip := "127.0.0.1",
|
|
nsvci := 98,
|
|
nsei := 97
|
|
},
|
|
{
|
|
local_udp_port := 21012,
|
|
local_ip := "127.0.0.1",
|
|
remote_udp_port := 23000,
|
|
remote_ip := "127.0.0.1",
|
|
nsvci := 99,
|
|
nsei := 98
|
|
}
|
|
};
|
|
};
|
|
|
|
type record GbInstance {
|
|
NS_CT vc_NS,
|
|
BSSGP_CT vc_BSSGP,
|
|
BssgpConfig cfg
|
|
};
|
|
|
|
type record length(3) of GbInstance GbInstances;
|
|
type record length(3) of NSConfiguration NSConfigurations;
|
|
type record length(3) of BssgpCellId BssgpCellIds;
|
|
|
|
type component test_CT {
|
|
var GbInstances g_gb;
|
|
|
|
var GSUP_Emulation_CT vc_GSUP;
|
|
var IPA_Emulation_CT vc_GSUP_IPA;
|
|
/* only to get events from IPA underneath GSUP */
|
|
port IPA_CTRL_PT GSUP_IPA_EVENT;
|
|
|
|
var GTP_Emulation_CT vc_GTP;
|
|
|
|
port TELNETasp_PT SGSNVTY;
|
|
|
|
var boolean g_initialized := false;
|
|
var boolean g_use_echo := false;
|
|
};
|
|
|
|
type component BSSGP_ConnHdlr extends BSSGP_Client_CT, GSUP_ConnHdlr, GTP_ConnHdlr {
|
|
var BSSGP_ConnHdlrPars g_pars;
|
|
timer g_Tguard;
|
|
var LLC_Entities llc;
|
|
}
|
|
|
|
type record SGSN_ConnHdlrNetworkPars {
|
|
boolean expect_ptmsi,
|
|
boolean expect_auth,
|
|
boolean expect_ciph
|
|
};
|
|
|
|
type record BSSGP_ConnHdlrPars {
|
|
/* IMEI of the simulated ME */
|
|
hexstring imei,
|
|
/* IMSI of the simulated MS */
|
|
hexstring imsi,
|
|
/* MSISDN of the simulated MS (probably unused) */
|
|
hexstring msisdn,
|
|
/* P-TMSI allocated to the simulated MS */
|
|
OCT4 p_tmsi optional,
|
|
OCT3 p_tmsi_sig optional,
|
|
/* TLLI of the simulated MS */
|
|
OCT4 tlli,
|
|
OCT4 tlli_old optional,
|
|
RoutingAreaIdentificationV ra optional,
|
|
BssgpCellIds bssgp_cell_id,
|
|
AuthVector vec optional,
|
|
SGSN_ConnHdlrNetworkPars net,
|
|
float t_guard
|
|
};
|
|
|
|
private function f_cellid_to_RAI(in BssgpCellId cell_id) return RoutingAreaIdentificationV {
|
|
var BcdMccMnc mcc_mnc := cell_id.ra_id.lai.mcc_mnc;
|
|
|
|
var RoutingAreaIdentificationV ret := {
|
|
mccDigit1 := mcc_mnc[0],
|
|
mccDigit2 := mcc_mnc[1],
|
|
mccDigit3 := mcc_mnc[2],
|
|
mncDigit3 := mcc_mnc[5],
|
|
mncDigit1 := mcc_mnc[3],
|
|
mncDigit2 := mcc_mnc[4],
|
|
lac := int2oct(cell_id.ra_id.lai.lac, 16),
|
|
rac := int2oct(cell_id.ra_id.rac, 8)
|
|
}
|
|
return ret;
|
|
};
|
|
|
|
private function f_init_gb(inout GbInstance gb, charstring id, integer offset) runs on test_CT {
|
|
gb.vc_NS := NS_CT.create(id & "-NS" & int2str(offset));
|
|
gb.vc_BSSGP := BSSGP_CT.create(id & "-BSSGP" & int2str(offset));
|
|
/* connect lower end of BSSGP emulation with NS upper port */
|
|
connect(gb.vc_BSSGP:BSCP, gb.vc_NS:NS_SP);
|
|
/* connect lower end of NS emulation to NS codec port (on top of IPL4) */
|
|
map(gb.vc_NS:NSCP, system:NS_CODEC_PORT);
|
|
|
|
gb.vc_NS.start(NSStart(mp_nsconfig[offset]));
|
|
gb.vc_BSSGP.start(BssgpStart(gb.cfg));
|
|
}
|
|
|
|
private function f_init_gsup(charstring id) runs on test_CT {
|
|
id := id & "-GSUP";
|
|
var GsupOps ops := {
|
|
create_cb := refers(GSUP_Emulation.ExpectedCreateCallback)
|
|
};
|
|
|
|
vc_GSUP_IPA := IPA_Emulation_CT.create(id & "-IPA");
|
|
vc_GSUP := GSUP_Emulation_CT.create(id);
|
|
|
|
map(vc_GSUP_IPA:IPA_PORT, system:IPA_CODEC_PT);
|
|
connect(vc_GSUP:GSUP, vc_GSUP_IPA:IPA_GSUP_PORT);
|
|
/* we use this hack to get events like ASP_IPA_EVENT_UP */
|
|
connect(vc_GSUP_IPA:IPA_CTRL_PORT, self:GSUP_IPA_EVENT);
|
|
|
|
vc_GSUP.start(GSUP_Emulation.main(ops, id));
|
|
vc_GSUP_IPA.start(IPA_Emulation.main_server(mp_hlr_ip, mp_hlr_port));
|
|
|
|
/* wait for incoming connection to GSUP port before proceeding */
|
|
timer T := 10.0;
|
|
T.start;
|
|
alt {
|
|
[] GSUP_IPA_EVENT.receive(t_ASP_IPA_EVT_UD(ASP_IPA_EVENT_UP)) { }
|
|
[] T.timeout {
|
|
setverdict(fail, "No connection to GSUP Port");
|
|
mtc.stop;
|
|
}
|
|
}
|
|
}
|
|
|
|
private function f_init_gtp(charstring id) runs on test_CT {
|
|
id := id & "-GTP";
|
|
|
|
var GtpEmulationCfg gtp_cfg := {
|
|
gtpc_bind_ip := mp_ggsn_ip,
|
|
gtpc_bind_port := GTP1C_PORT,
|
|
gtpu_bind_ip := mp_ggsn_ip,
|
|
gtpu_bind_port := GTP1U_PORT,
|
|
sgsn_role := false
|
|
};
|
|
|
|
vc_GTP := GTP_Emulation_CT.create(id);
|
|
vc_GTP.start(GTP_Emulation.main(gtp_cfg));
|
|
}
|
|
|
|
private function f_init_vty() runs on test_CT {
|
|
map(self:SGSNVTY, system:SGSNVTY);
|
|
f_vty_set_prompts(SGSNVTY);
|
|
f_vty_transceive(SGSNVTY, "enable");
|
|
f_vty_transceive(SGSNVTY, "reset sgsn state");
|
|
f_vty_config(SGSNVTY, "sgsn", "auth-policy remote");
|
|
}
|
|
|
|
private function f_vty_enable_echo_interval(boolean enable) runs on test_CT {
|
|
if (enable) {
|
|
f_vty_config(SGSNVTY, "sgsn", "ggsn 0 echo-interval 5");
|
|
} else {
|
|
f_vty_config(SGSNVTY, "sgsn", "ggsn 0 no echo-interval");
|
|
}
|
|
}
|
|
|
|
|
|
function f_init(BcdMccMnc mcc_mnc := '26242F'H) runs on test_CT {
|
|
if (g_initialized == true) {
|
|
return;
|
|
}
|
|
g_initialized := true;
|
|
g_gb[0].cfg := {
|
|
nsei := 96,
|
|
bvci := 196,
|
|
cell_id := {
|
|
ra_id := {
|
|
lai := {
|
|
mcc_mnc := mcc_mnc, lac := 13135},
|
|
rac := 0
|
|
},
|
|
cell_id := 20960
|
|
},
|
|
sgsn_role := false
|
|
};
|
|
g_gb[1].cfg := {
|
|
nsei := 97,
|
|
bvci := 210,
|
|
cell_id := {
|
|
ra_id := {
|
|
lai := {
|
|
mcc_mnc := mcc_mnc, lac := 13200},
|
|
rac := 0
|
|
},
|
|
cell_id := 20961
|
|
},
|
|
sgsn_role := false
|
|
};
|
|
g_gb[2].cfg := {
|
|
nsei := 98,
|
|
bvci := 220,
|
|
cell_id := {
|
|
ra_id := {
|
|
lai := {
|
|
mcc_mnc := mcc_mnc, lac := 13300},
|
|
rac := 0
|
|
},
|
|
cell_id := 20962
|
|
},
|
|
sgsn_role := false
|
|
};
|
|
|
|
f_init_vty();
|
|
f_init_gb(g_gb[0], "SGSN_Test-Gb0", 0);
|
|
f_init_gb(g_gb[1], "SGSN_Test-Gb1", 1);
|
|
f_init_gb(g_gb[2], "SGSN_Test-Gb2", 2);
|
|
f_init_gsup("SGSN_Test");
|
|
f_init_gtp("SGSN_Test");
|
|
f_vty_enable_echo_interval(g_use_echo);
|
|
}
|
|
|
|
type function void_fn(charstring id) runs on BSSGP_ConnHdlr;
|
|
|
|
/* helper function to create, connect and start a BSSGP_ConnHdlr component */
|
|
function f_start_handler(void_fn fn, charstring id, GbInstances gb, integer imsi_suffix,
|
|
float t_guard := 30.0)
|
|
runs on test_CT return BSSGP_ConnHdlr {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
var SGSN_ConnHdlrNetworkPars net_pars := {
|
|
expect_ptmsi := true,
|
|
expect_auth := true,
|
|
expect_ciph := false
|
|
};
|
|
var BSSGP_ConnHdlrPars pars := {
|
|
imei := f_gen_imei(imsi_suffix),
|
|
imsi := f_gen_imsi(imsi_suffix),
|
|
msisdn := f_gen_msisdn(imsi_suffix),
|
|
p_tmsi := omit,
|
|
p_tmsi_sig := omit,
|
|
tlli := f_gprs_tlli_random(),
|
|
tlli_old := omit,
|
|
ra := omit,
|
|
bssgp_cell_id := { gb[0].cfg.cell_id, gb[1].cfg.cell_id, gb[2].cfg.cell_id },
|
|
vec := omit,
|
|
net := net_pars,
|
|
t_guard := t_guard
|
|
};
|
|
|
|
vc_conn := BSSGP_ConnHdlr.create(id);
|
|
connect(vc_conn:BSSGP[0], gb[0].vc_BSSGP:BSSGP_SP);
|
|
connect(vc_conn:BSSGP_PROC[0], gb[0].vc_BSSGP:BSSGP_PROC);
|
|
connect(vc_conn:BSSGP[1], gb[1].vc_BSSGP:BSSGP_SP);
|
|
connect(vc_conn:BSSGP_PROC[1], gb[1].vc_BSSGP:BSSGP_PROC);
|
|
connect(vc_conn:BSSGP[2], gb[2].vc_BSSGP:BSSGP_SP);
|
|
connect(vc_conn:BSSGP_PROC[2], gb[2].vc_BSSGP:BSSGP_PROC);
|
|
|
|
connect(vc_conn:GSUP, vc_GSUP:GSUP_CLIENT);
|
|
connect(vc_conn:GSUP_PROC, vc_GSUP:GSUP_PROC);
|
|
|
|
connect(vc_conn:GTP, vc_GTP:CLIENT);
|
|
connect(vc_conn:GTP_PROC, vc_GTP:CLIENT_PROC);
|
|
|
|
vc_conn.start(f_handler_init(fn, id, pars));
|
|
return vc_conn;
|
|
}
|
|
|
|
private altstep as_Tguard() runs on BSSGP_ConnHdlr {
|
|
[] g_Tguard.timeout {
|
|
setverdict(fail, "Tguard timeout");
|
|
mtc.stop;
|
|
}
|
|
}
|
|
|
|
/* first function called in every ConnHdlr */
|
|
private function f_handler_init(void_fn fn, charstring id, BSSGP_ConnHdlrPars pars)
|
|
runs on BSSGP_ConnHdlr {
|
|
/* do some common stuff like setting up g_pars */
|
|
g_pars := pars;
|
|
|
|
llc := f_llc_create(false);
|
|
|
|
/* register with BSSGP core */
|
|
f_bssgp_client_register(g_pars.imsi, g_pars.tlli, g_pars.bssgp_cell_id[0]);
|
|
/* tell GSUP dispatcher to send this IMSI to us */
|
|
f_create_gsup_expect(hex2str(g_pars.imsi));
|
|
/* tell GTP dispatcher to send this IMSI to us */
|
|
f_gtp_register_imsi(g_pars.imsi);
|
|
|
|
g_Tguard.start(pars.t_guard);
|
|
activate(as_Tguard());
|
|
|
|
/* call the user-supplied test case function */
|
|
fn.apply(id);
|
|
f_bssgp_client_unregister(g_pars.imsi);
|
|
}
|
|
|
|
/* TODO:
|
|
* Detach without Attach
|
|
* SM procedures without attach / RAU
|
|
* ATTACH / RAU
|
|
** with / without authentication
|
|
** with / without P-TMSI allocation
|
|
* re-transmissions of LLC frames
|
|
* PDP Context activation
|
|
** with different GGSN config in SGSN VTY
|
|
** with different PDP context type (v4/v6/v46)
|
|
** timeout from GGSN
|
|
** multiple / secondary PDP context
|
|
*/
|
|
|
|
testcase TC_wait_ns_up() runs on test_CT {
|
|
f_init();
|
|
f_sleep(20.0);
|
|
}
|
|
|
|
function f_send_l3_gmm_llc(template PDU_L3_MS_SGSN l3_mo, integer gb_index := 0) runs on BSSGP_ConnHdlr {
|
|
var octetstring l3_enc := enc_PDU_L3_MS_SGSN(valueof(l3_mo));
|
|
var BIT4 sapi := f_llc_sapi_by_l3_mo(valueof(l3_mo));
|
|
var integer n_u := f_llc_get_n_u_tx(llc[bit2int(sapi)]);
|
|
var octetstring llc_enc := enc_PDU_LLC(valueof(ts_LLC_UI(l3_enc, sapi, '0'B, n_u)));
|
|
BSSGP[gb_index].send(ts_BSSGP_UL_UD(g_pars.tlli, g_pars.bssgp_cell_id[gb_index], llc_enc));
|
|
}
|
|
|
|
altstep as_mm_identity() runs on BSSGP_ConnHdlr {
|
|
var MobileL3_CommonIE_Types.MobileIdentityLV mi;
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ID_REQ('001'B))) {
|
|
mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
|
|
f_send_l3_gmm_llc(ts_GMM_ID_RESP(mi));
|
|
repeat;
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ID_REQ('010'B))) {
|
|
mi := valueof(ts_MI_IMEI_LV(g_pars.imei));
|
|
f_send_l3_gmm_llc(ts_GMM_ID_RESP(mi));
|
|
repeat;
|
|
}
|
|
}
|
|
|
|
/* perform GMM authentication (if expected).
|
|
* Note, for umts_aka_challenge to work, the revisionLevelIndicatior needs to
|
|
* be 1 to mark R99 capability, in the GMM Attach Request, see f_gmm_attach(). */
|
|
function f_gmm_auth (boolean umts_aka_challenge := false, boolean force_gsm_sres := false) runs on BSSGP_ConnHdlr {
|
|
var BssgpDecoded bd;
|
|
var PDU_L3_MS_SGSN l3_mo;
|
|
var PDU_L3_SGSN_MS l3_mt;
|
|
var default di := activate(as_mm_identity());
|
|
if (g_pars.net.expect_auth) {
|
|
var GSUP_IE auth_tuple;
|
|
var template AuthenticationParameterAUTNTLV autn;
|
|
|
|
if (umts_aka_challenge) {
|
|
g_pars.vec := f_gen_auth_vec_3g();
|
|
autn := {
|
|
elementIdentifier := '28'O,
|
|
lengthIndicator := lengthof(g_pars.vec.autn),
|
|
autnValue := g_pars.vec.autn
|
|
};
|
|
|
|
auth_tuple := valueof(ts_GSUP_IE_AuthTuple2G3G(g_pars.vec.rand,
|
|
g_pars.vec.sres,
|
|
g_pars.vec.kc,
|
|
g_pars.vec.ik,
|
|
g_pars.vec.ck,
|
|
g_pars.vec.autn,
|
|
g_pars.vec.res));
|
|
log("GSUP sends 2G and 3G auth tuples", auth_tuple);
|
|
} else {
|
|
g_pars.vec := f_gen_auth_vec_2g();
|
|
autn := omit;
|
|
auth_tuple := valueof(ts_GSUP_IE_AuthTuple2G(g_pars.vec.rand,
|
|
g_pars.vec.sres,
|
|
g_pars.vec.kc));
|
|
log("GSUP sends only 2G auth tuple", auth_tuple);
|
|
}
|
|
GSUP.receive(tr_GSUP_SAI_REQ(g_pars.imsi));
|
|
GSUP.send(ts_GSUP_SAI_RES(g_pars.imsi, auth_tuple));
|
|
|
|
var template PDU_L3_SGSN_MS auth_ciph_req := tr_GMM_AUTH_REQ(g_pars.vec.rand);
|
|
auth_ciph_req.msgs.gprs_mm.authenticationAndCipheringRequest.authenticationParameterAUTN := autn;
|
|
BSSGP[0].receive(tr_BD_L3_MT(auth_ciph_req)) -> value bd;
|
|
l3_mt := bd.l3_mt;
|
|
var BIT4 ac_ref := l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.acReferenceNumber.valueField;
|
|
var template PDU_L3_MS_SGSN auth_ciph_resp := ts_GMM_AUTH_RESP_2G(ac_ref, g_pars.vec.sres);
|
|
|
|
if (umts_aka_challenge and not force_gsm_sres) {
|
|
/* set UMTS response instead */
|
|
auth_ciph_resp.msgs.gprs_mm.authenticationAndCipheringResponse.authenticationParResp := {
|
|
valueField := substr(g_pars.vec.res, 0, 4)
|
|
};
|
|
auth_ciph_resp.msgs.gprs_mm.authenticationAndCipheringResponse.authenticationRespParExt := {
|
|
elementIdentifier := '21'O,
|
|
lengthIndicator := lengthof(g_pars.vec.res) - 4,
|
|
valueField := substr(g_pars.vec.res, 4, lengthof(g_pars.vec.res) - 4)
|
|
};
|
|
}
|
|
|
|
l3_mo := valueof(auth_ciph_resp);
|
|
if (ispresent(l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.imeisvRequest) and
|
|
l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.imeisvRequest.valueField == '001'B) {
|
|
l3_mo.msgs.gprs_mm.authenticationAndCipheringResponse.imeisv :=
|
|
valueof(ts_MI_IMEISV_TLV(g_pars.imei & '0'H));
|
|
}
|
|
f_send_l3_gmm_llc(l3_mo);
|
|
} else {
|
|
/* wait for identity procedure */
|
|
f_sleep(1.0);
|
|
}
|
|
|
|
deactivate(di);
|
|
}
|
|
|
|
function f_upd_ptmsi_and_tlli(OCT4 p_tmsi, integer bssgp_index := 0) runs on BSSGP_ConnHdlr {
|
|
g_pars.p_tmsi := p_tmsi;
|
|
/* update TLLI */
|
|
g_pars.tlli_old := g_pars.tlli;
|
|
g_pars.tlli := g_pars.p_tmsi or4b 'c0000000'O;
|
|
f_bssgp_client_llgmm_assign(g_pars.tlli_old, g_pars.tlli, BSSGP_PROC[bssgp_index]);
|
|
}
|
|
|
|
function f_process_attach_accept(PDU_GMM_AttachAccept aa) runs on BSSGP_ConnHdlr {
|
|
/* mandatory IE */
|
|
var hexstring aa_plmn := f_RAI_to_plmn_hexstr(aa.routingAreaIdentification);
|
|
if (not (g_pars.bssgp_cell_id[0].ra_id.lai.mcc_mnc == aa_plmn)) {
|
|
setverdict(fail, "mismatching PLMN in Attach Accept: " & hex2str(aa_plmn)
|
|
& "; expected " & hex2str(g_pars.bssgp_cell_id[0].ra_id.lai.mcc_mnc));
|
|
mtc.stop;
|
|
}
|
|
g_pars.ra := aa.routingAreaIdentification;
|
|
if (ispresent(aa.allocatedPTMSI)) {
|
|
if (not g_pars.net.expect_ptmsi) {
|
|
setverdict(fail, "unexpected P-TMSI allocation");
|
|
mtc.stop;
|
|
}
|
|
f_upd_ptmsi_and_tlli(aa.allocatedPTMSI.mobileIdentityLV.mobileIdentityV.oddEvenInd_identity.tmsi_ptmsi.octets);
|
|
}
|
|
if (ispresent(aa.msIdentity)) {
|
|
setverdict(fail, "unexpected TMSI allocation in non-combined attach");
|
|
mtc.stop;
|
|
}
|
|
/* P-TMSI.sig */
|
|
if (ispresent(aa.ptmsiSignature)) {
|
|
g_pars.p_tmsi_sig := aa.ptmsiSignature.valueField;
|
|
}
|
|
/* updateTimer */
|
|
// aa.readyTimer
|
|
/* T3302, T3319, T3323, T3312_ext, T3324 */
|
|
}
|
|
|
|
function f_process_rau_accept(PDU_GMM_RoutingAreaUpdateAccept ra, integer bssgp_index := 0) runs on BSSGP_ConnHdlr {
|
|
/* mandatory IE */
|
|
g_pars.ra := ra.routingAreaId;
|
|
if (ispresent(ra.allocatedPTMSI)) {
|
|
if (not g_pars.net.expect_ptmsi) {
|
|
setverdict(fail, "unexpected P-TMSI allocation");
|
|
mtc.stop;
|
|
}
|
|
f_upd_ptmsi_and_tlli(ra.allocatedPTMSI.mobileIdentityLV.mobileIdentityV.oddEvenInd_identity.tmsi_ptmsi.octets, bssgp_index);
|
|
}
|
|
if (ispresent(ra.msIdentity)) {
|
|
setverdict(fail, "unexpected TMSI allocation in non-combined attach");
|
|
mtc.stop;
|
|
}
|
|
/* P-TMSI.sig */
|
|
if (ispresent(ra.ptmsiSignature)) {
|
|
g_pars.p_tmsi_sig := ra.ptmsiSignature.valueField;
|
|
}
|
|
/* updateTimer */
|
|
// aa.readyTimer
|
|
/* T3302, T3319, T3323, T3312_ext, T3324 */
|
|
}
|
|
|
|
|
|
function f_random_RAI(HEX0_3n mcc := '262'H, HEX0_3n mnc := '42'H) return RoutingAreaIdentificationV {
|
|
return f_RAI(mcc, mnc, f_rnd_octstring(2), f_rnd_octstring(1));
|
|
}
|
|
|
|
/* return a MobileIdentityLV: P-TMSI if we have one, IMSI otherwise */
|
|
private function f_mi_get_lv() runs on BSSGP_ConnHdlr return MobileL3_CommonIE_Types.MobileIdentityLV {
|
|
if (ispresent(g_pars.p_tmsi)) {
|
|
return valueof(ts_MI_TMSI_LV(g_pars.p_tmsi));
|
|
} else {
|
|
return valueof(ts_MI_IMSI_LV(g_pars.imsi));
|
|
}
|
|
}
|
|
|
|
private function f_gmm_gsup_lu_isd() runs on BSSGP_ConnHdlr {
|
|
var GSUP_PDU gsup;
|
|
/* Expect MSC to perform LU with HLR */
|
|
GSUP.receive(tr_GSUP_UL_REQ(g_pars.imsi));
|
|
gsup := valueof(ts_GSUP_ISD_REQ(g_pars.imsi, g_pars.msisdn));
|
|
gsup.ies := gsup.ies & { valueof(ts_GSUP_IE_PdpInfo(char2oct("*"), '0121'O, ''O)) };
|
|
GSUP.send(gsup);
|
|
GSUP.receive(tr_GSUP_ISD_RES(g_pars.imsi));
|
|
GSUP.send(ts_GSUP_UL_RES(g_pars.imsi));
|
|
}
|
|
|
|
private function f_gmm_attach(boolean umts_aka_challenge, boolean force_gsm_sres) runs on BSSGP_ConnHdlr {
|
|
var BssgpDecoded bd;
|
|
var RoutingAreaIdentificationV old_ra := f_random_RAI();
|
|
var template PDU_L3_MS_SGSN attach_req := ts_GMM_ATTACH_REQ(f_mi_get_lv(), old_ra, false, false, omit, omit);
|
|
|
|
/* indicate R99 capability of the MS to enable UMTS AKA in presence of
|
|
* 3G auth vectors */
|
|
attach_req.msgs.gprs_mm.attachRequest.msNetworkCapability.msNetworkCapabilityV.revisionLevelIndicatior := '1'B;
|
|
/* The thing is, if the solSACapability is 'omit', then the
|
|
* revisionLevelIndicatior is at the wrong place! */
|
|
attach_req.msgs.gprs_mm.attachRequest.msNetworkCapability.msNetworkCapabilityV.solSACapability := '0'B;
|
|
|
|
f_send_l3_gmm_llc(attach_req);
|
|
f_gmm_auth(umts_aka_challenge, force_gsm_sres);
|
|
/* Expect SGSN to perform LU with HLR */
|
|
f_gmm_gsup_lu_isd();
|
|
|
|
BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_ACCEPT('001'B, ?, ?))) -> value bd {
|
|
f_process_attach_accept(bd.l3_mt.msgs.gprs_mm.attachAccept);
|
|
}
|
|
/* FIXME: Extract P-TMSI, if any. Only send Complete if necessary */
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_COMPL);
|
|
}
|
|
|
|
private function f_TC_attach(charstring id) runs on BSSGP_ConnHdlr {
|
|
f_gmm_attach(false, false);
|
|
setverdict(pass);
|
|
}
|
|
|
|
testcase TC_attach() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach), testcasename(), g_gb, 1);
|
|
vc_conn.done;
|
|
}
|
|
|
|
testcase TC_attach_mnc3() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init('023042'H);
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach), testcasename(), g_gb, 1001);
|
|
vc_conn.done;
|
|
}
|
|
|
|
private function f_TC_attach_umts_aka_umts_res(charstring id) runs on BSSGP_ConnHdlr {
|
|
f_gmm_attach(true, false);
|
|
setverdict(pass);
|
|
}
|
|
testcase TC_attach_umts_aka_umts_res() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach_umts_aka_umts_res), testcasename(), g_gb, 1002);
|
|
vc_conn.done;
|
|
}
|
|
|
|
private function f_TC_attach_umts_aka_gsm_sres(charstring id) runs on BSSGP_ConnHdlr {
|
|
f_gmm_attach(true, true);
|
|
setverdict(pass);
|
|
}
|
|
testcase TC_attach_umts_aka_gsm_sres() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach_umts_aka_gsm_sres), testcasename(), g_gb, 1003);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* MS never responds to ID REQ, expect ATTACH REJECT */
|
|
private function f_TC_attach_auth_id_timeout(charstring id) runs on BSSGP_ConnHdlr {
|
|
var RoutingAreaIdentificationV old_ra := f_random_RAI();
|
|
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_REQ(f_mi_get_lv(), old_ra, false, false, omit, omit));
|
|
alt {
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ID_REQ(?))) {
|
|
/* don't send ID Response */
|
|
repeat;
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_REJECT('09'O))) {
|
|
setverdict(pass);
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_REJECT(?))) {
|
|
setverdict(fail, "Wrong Attach Reject Cause");
|
|
mtc.stop;
|
|
}
|
|
}
|
|
}
|
|
testcase TC_attach_auth_id_timeout() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
vc_conn := f_start_handler(refers(f_TC_attach_auth_id_timeout), testcasename(), g_gb, 2, 40.0);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* HLR never responds to SAI REQ, expect ATTACH REJECT */
|
|
private function f_TC_attach_auth_sai_timeout(charstring id) runs on BSSGP_ConnHdlr {
|
|
var RoutingAreaIdentificationV old_ra := f_random_RAI();
|
|
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_REQ(f_mi_get_lv(), old_ra, false, false, omit, omit));
|
|
alt {
|
|
[] as_mm_identity();
|
|
[] GSUP.receive(tr_GSUP_SAI_REQ(g_pars.imsi)); { }
|
|
}
|
|
/* don't send SAI-response from HLR */
|
|
BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_REJECT(?)));
|
|
setverdict(pass);
|
|
}
|
|
testcase TC_attach_auth_sai_timeout() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
vc_conn := f_start_handler(refers(f_TC_attach_auth_sai_timeout), testcasename(), g_gb, 3);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* HLR rejects SAI, expect ATTACH REJECT */
|
|
private function f_TC_attach_auth_sai_reject(charstring id) runs on BSSGP_ConnHdlr {
|
|
var RoutingAreaIdentificationV old_ra := f_random_RAI();
|
|
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_REQ(f_mi_get_lv(), old_ra, false, false, omit, omit));
|
|
alt {
|
|
[] as_mm_identity();
|
|
[] GSUP.receive(tr_GSUP_SAI_REQ(g_pars.imsi)); {
|
|
GSUP.send(ts_GSUP_SAI_ERR(g_pars.imsi, 23));
|
|
}
|
|
}
|
|
BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_REJECT(?)));
|
|
setverdict(pass);
|
|
}
|
|
testcase TC_attach_auth_sai_reject() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
vc_conn := f_start_handler(refers(f_TC_attach_auth_sai_reject), testcasename(), g_gb, 4);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* HLR never responds to UL REQ, expect ATTACH REJECT */
|
|
private function f_TC_attach_gsup_lu_timeout(charstring id) runs on BSSGP_ConnHdlr {
|
|
var BssgpDecoded bd;
|
|
var RoutingAreaIdentificationV old_ra := f_random_RAI();
|
|
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_REQ(f_mi_get_lv(), old_ra, false, false, omit, omit));
|
|
f_gmm_auth();
|
|
/* Expect MSC to perform LU with HLR */
|
|
GSUP.receive(tr_GSUP_UL_REQ(g_pars.imsi));
|
|
/* Never follow-up with ISD_REQ or UL_RES */
|
|
alt {
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_REJECT(?))) {
|
|
setverdict(pass);
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_ACCEPT('001'B, ?, ?))) -> value bd {
|
|
f_process_attach_accept(bd.l3_mt.msgs.gprs_mm.attachAccept);
|
|
setverdict(fail);
|
|
mtc.stop;
|
|
}
|
|
}
|
|
}
|
|
testcase TC_attach_gsup_lu_timeout() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach_gsup_lu_timeout), testcasename(), g_gb, 5);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* HLR rejects UL REQ, expect ATTACH REJECT */
|
|
private function f_TC_attach_gsup_lu_reject(charstring id) runs on BSSGP_ConnHdlr {
|
|
var BssgpDecoded bd;
|
|
var RoutingAreaIdentificationV old_ra := f_random_RAI();
|
|
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_REQ(f_mi_get_lv(), old_ra, false, false, omit, omit));
|
|
f_gmm_auth();
|
|
/* Expect MSC to perform LU with HLR */
|
|
GSUP.receive(tr_GSUP_UL_REQ(g_pars.imsi)) {
|
|
GSUP.send(ts_GSUP_UL_ERR(g_pars.imsi, 0));
|
|
}
|
|
alt {
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_REJECT(?))) {
|
|
setverdict(pass);
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_ACCEPT('001'B, ?, ?))) -> value bd {
|
|
f_process_attach_accept(bd.l3_mt.msgs.gprs_mm.attachAccept);
|
|
setverdict(fail);
|
|
mtc.stop;
|
|
}
|
|
}
|
|
}
|
|
testcase TC_attach_gsup_lu_reject() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach_gsup_lu_reject), testcasename(), g_gb, 6);
|
|
vc_conn.done;
|
|
}
|
|
|
|
|
|
/* Attempt of combined GPRS + IMSI attach: network should ACK only GPRS attach */
|
|
private function f_TC_attach_combined(charstring id) runs on BSSGP_ConnHdlr {
|
|
var BssgpDecoded bd;
|
|
var RoutingAreaIdentificationV old_ra := f_random_RAI();
|
|
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_REQ(f_mi_get_lv(), old_ra, true, false, omit, omit));
|
|
f_gmm_auth();
|
|
/* Expect MSC to perform LU with HLR */
|
|
f_gmm_gsup_lu_isd();
|
|
|
|
BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_ACCEPT('001'B, ?, ?))) -> value bd {
|
|
f_process_attach_accept(bd.l3_mt.msgs.gprs_mm.attachAccept);
|
|
}
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_COMPL);
|
|
setverdict(pass);
|
|
}
|
|
testcase TC_attach_combined() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach_combined), testcasename(), g_gb, 7);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* Attempt of GPRS ATTACH in 'accept all' mode */
|
|
private function f_TC_attach_accept_all(charstring id) runs on BSSGP_ConnHdlr {
|
|
var BssgpDecoded bd;
|
|
var RoutingAreaIdentificationV old_ra := f_random_RAI();
|
|
|
|
g_pars.net.expect_auth := false;
|
|
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_REQ(f_mi_get_lv(), old_ra, false, false, omit, omit));
|
|
f_gmm_auth();
|
|
BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_ACCEPT('001'B, ?, ?))) -> value bd {
|
|
f_process_attach_accept(bd.l3_mt.msgs.gprs_mm.attachAccept);
|
|
}
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_COMPL);
|
|
setverdict(pass);
|
|
}
|
|
testcase TC_attach_accept_all() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
f_vty_config(SGSNVTY, "sgsn", "auth-policy accept-all");
|
|
vc_conn := f_start_handler(refers(f_TC_attach_accept_all), testcasename(), g_gb, 8);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* Attempt of GPRS ATTACH in 'accept all' mode */
|
|
private function f_TC_attach_closed_foreign(charstring id) runs on BSSGP_ConnHdlr {
|
|
var RoutingAreaIdentificationV old_ra := f_random_RAI();
|
|
|
|
/* Simulate a foreign IMSI */
|
|
g_pars.imsi := '001010123456789'H;
|
|
f_bssgp_client_register(g_pars.imsi, g_pars.tlli, g_pars.bssgp_cell_id[0]);
|
|
|
|
g_pars.net.expect_auth := false;
|
|
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_REQ(f_mi_get_lv(), old_ra, false, false, omit, omit));
|
|
alt {
|
|
[] as_mm_identity();
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_REJECT('07'O))) {
|
|
setverdict(pass);
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_REJECT(?))) {
|
|
setverdict(pass);
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_ACCEPT(*, *, *))) {
|
|
setverdict(fail);
|
|
mtc.stop;
|
|
}
|
|
}
|
|
}
|
|
testcase TC_attach_closed() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
f_vty_config(SGSNVTY, "sgsn", "auth-policy closed");
|
|
/* test with foreign IMSI: Must Reject */
|
|
vc_conn := f_start_handler(refers(f_TC_attach_closed_foreign), testcasename(), g_gb, 9);
|
|
vc_conn.done;
|
|
/* test with home IMSI: Must Accept */
|
|
vc_conn := f_start_handler(refers(f_TC_attach_accept_all), testcasename(), g_gb, 10);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* Routing Area Update from Unknown TLLI -> REJECT */
|
|
private function f_TC_rau_unknown(charstring id) runs on BSSGP_ConnHdlr {
|
|
var RoutingAreaIdentificationV old_ra := f_random_RAI();
|
|
|
|
f_send_l3_gmm_llc(ts_GMM_RAU_REQ(f_mi_get_lv(), GPRS_UPD_T_RA, old_ra, false, omit, omit));
|
|
alt {
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_RAU_REJECT('0a'O))) {
|
|
setverdict(pass);
|
|
}
|
|
/* FIXME: Expect XID RESET? */
|
|
[] BSSGP[0].receive { repeat; }
|
|
}
|
|
}
|
|
testcase TC_rau_unknown() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_rau_unknown), testcasename(), g_gb, 11);
|
|
vc_conn.done;
|
|
}
|
|
|
|
private function f_TC_attach_rau(charstring id) runs on BSSGP_ConnHdlr {
|
|
var BssgpDecoded bd;
|
|
|
|
/* first perform regular attach */
|
|
f_TC_attach(id);
|
|
|
|
f_routing_area_update(g_pars.ra);
|
|
|
|
}
|
|
testcase TC_attach_rau() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach_rau), testcasename(), g_gb, 12);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* general GPRS DETACH helper */
|
|
function f_detach_mo(BIT3 detach_type, boolean power_off, boolean expect_purge, integer bssgp_index := 0) runs on BSSGP_ConnHdlr {
|
|
var BssgpDecoded bd;
|
|
timer T := 5.0;
|
|
f_send_l3_gmm_llc(ts_GMM_DET_REQ_MO(detach_type, power_off), bssgp_index);
|
|
if (expect_purge) {
|
|
GSUP.receive(tr_GSUP_PURGE_MS_REQ(g_pars.imsi, OSMO_GSUP_CN_DOMAIN_PS));
|
|
GSUP.send(ts_GSUP_PURGE_MS_RES(g_pars.imsi));
|
|
}
|
|
T.start;
|
|
alt {
|
|
[not expect_purge] GSUP.receive(tr_GSUP_PURGE_MS_REQ(?)) {
|
|
setverdict(fail, "Unexpected GSUP PURGE MS for unregistered TLLI");
|
|
mtc.stop;
|
|
}
|
|
[power_off] BSSGP[bssgp_index].receive(tr_BD_L3_MT(tr_GMM_DET_ACCEPT_MT)) -> value bd {
|
|
g_pars.ra := omit;
|
|
setverdict(fail, "Unexpected ATTACH ACCEPT in no-power-off DETACH");
|
|
mtc.stop;
|
|
/* TODO: check if any PDP contexts are deactivated on network side? */
|
|
}
|
|
[power_off] T.timeout {
|
|
setverdict(pass);
|
|
}
|
|
[not power_off] BSSGP[bssgp_index].receive(tr_BD_L3_MT(tr_GMM_DET_ACCEPT_MT)) -> value bd {
|
|
g_pars.ra := omit;
|
|
setverdict(pass);
|
|
/* TODO: check if any PDP contexts are deactivated on network side? */
|
|
}
|
|
[] BSSGP[bssgp_index].receive { repeat; }
|
|
}
|
|
}
|
|
|
|
/* IMSI DETACH (non-power-off) for unknown TLLI */
|
|
private function f_TC_detach_unknown_nopoweroff(charstring id) runs on BSSGP_ConnHdlr {
|
|
f_detach_mo(c_GMM_DTT_MO_GPRS, false, false);
|
|
}
|
|
testcase TC_detach_unknown_nopoweroff() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_detach_unknown_nopoweroff), testcasename(), g_gb, 13);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* IMSI DETACH (power-off) for unknown TLLI */
|
|
private function f_TC_detach_unknown_poweroff(charstring id) runs on BSSGP_ConnHdlr {
|
|
f_detach_mo(c_GMM_DTT_MO_GPRS, true, false);
|
|
}
|
|
testcase TC_detach_unknown_poweroff() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_detach_unknown_poweroff), testcasename(), g_gb, 14);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* IMSI DETACH (non-power-off) for known TLLI */
|
|
private function f_TC_detach_nopoweroff(charstring id) runs on BSSGP_ConnHdlr {
|
|
/* first perform regular attach */
|
|
f_TC_attach(id);
|
|
|
|
f_detach_mo(c_GMM_DTT_MO_GPRS, false, true);
|
|
}
|
|
testcase TC_detach_nopoweroff() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_detach_nopoweroff), testcasename(), g_gb, 15);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* IMSI DETACH (power-off) for known TLLI */
|
|
private function f_TC_detach_poweroff(charstring id) runs on BSSGP_ConnHdlr {
|
|
/* first perform regular attach */
|
|
f_TC_attach(id);
|
|
|
|
f_detach_mo(c_GMM_DTT_MO_GPRS, true, true);
|
|
}
|
|
testcase TC_detach_poweroff() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_detach_poweroff), testcasename(), g_gb, 16);
|
|
vc_conn.done;
|
|
}
|
|
|
|
type record PdpActPars {
|
|
BIT3 tid, /* L3 Transaction ID */
|
|
BIT4 nsapi, /* SNDCP NSAPI */
|
|
BIT4 sapi, /* LLC SAPI */
|
|
QoSV qos, /* QoS parameters */
|
|
PDPAddressV addr, /* IP address */
|
|
octetstring apn optional, /* APN name */
|
|
ProtocolConfigOptionsV pco optional, /* protoco config opts */
|
|
OCT1 exp_rej_cause optional, /* expected SM reject cause */
|
|
OCT1 gtp_resp_cause, /* GTP response cause */
|
|
OCT4 chg_id, /* GTP Charging Identifier */
|
|
|
|
OCT4 ggsn_tei_c, /* GGSN TEI Control*/
|
|
OCT4 ggsn_tei_u, /* GGSN TEI User */
|
|
octetstring ggsn_ip_c, /* GGSN IP Control */
|
|
octetstring ggsn_ip_u, /* GGSN IP User */
|
|
OCT1 ggsn_restart_ctr, /* GGSN Restart Counter */
|
|
|
|
OCT4 sgsn_tei_c optional, /* SGSN TEI Control */
|
|
OCT4 sgsn_tei_u optional, /* SGSN TEI User */
|
|
octetstring sgsn_ip_c optional, /* SGSN IP Control */
|
|
octetstring sgsn_ip_u optional /* SGSN IP USer */
|
|
};
|
|
|
|
|
|
private function f_process_gtp_ctx_act_req(inout PdpActPars apars, PDU_GTPC gtpc) runs on BSSGP_ConnHdlr {
|
|
var GTPC_PDUs gtpc_rx := gtpc.gtpc_pdu;
|
|
apars.sgsn_tei_c := gtpc_rx.createPDPContextRequest.teidControlPlane.teidControlPlane;
|
|
apars.sgsn_tei_u := gtpc_rx.createPDPContextRequest.teidDataI.teidDataI;
|
|
apars.sgsn_ip_c := gtpc_rx.createPDPContextRequest.sgsn_addr_signalling.addressf;
|
|
apars.sgsn_ip_u := gtpc_rx.createPDPContextRequest.sgsn_addr_traffic.addressf;
|
|
f_gtp_register_teid(apars.ggsn_tei_c);
|
|
f_gtp_register_teid(apars.ggsn_tei_u);
|
|
}
|
|
|
|
function f_pdp_ctx_act(inout PdpActPars apars, boolean send_recovery := false) runs on BSSGP_ConnHdlr {
|
|
var boolean exp_rej := ispresent(apars.exp_rej_cause);
|
|
var Gtp1cUnitdata g_ud;
|
|
var template Recovery_gtpc recovery := omit;
|
|
|
|
if (send_recovery) {
|
|
recovery := ts_Recovery(apars.ggsn_restart_ctr);
|
|
}
|
|
|
|
f_send_l3_gmm_llc(ts_SM_ACT_PDP_REQ(apars.tid, apars.nsapi, apars.sapi, apars.qos, apars.addr,
|
|
apars.apn, apars.pco));
|
|
GTP.receive(tr_GTPC_MsgType(?, createPDPContextRequest, ?)) -> value g_ud {
|
|
f_process_gtp_ctx_act_req(apars, g_ud.gtpc);
|
|
var integer seq_nr := oct2int(g_ud.gtpc.opt_part.sequenceNumber);
|
|
GTP.send(ts_GTPC_CreatePdpResp(g_ud.peer, seq_nr,
|
|
apars.sgsn_tei_c, apars.gtp_resp_cause,
|
|
apars.ggsn_tei_c, apars.ggsn_tei_u,
|
|
apars.nsapi,
|
|
apars.ggsn_ip_c, apars.ggsn_ip_u, apars.chg_id,
|
|
omit, recovery));
|
|
}
|
|
alt {
|
|
[exp_rej] BSSGP[0].receive(tr_BD_L3_MT(tr_SM_ACT_PDP_REJ(apars.tid, apars.exp_rej_cause))) {
|
|
setverdict(pass);
|
|
}
|
|
[exp_rej] BSSGP[0].receive(tr_BD_L3_MT(tr_SM_ACT_PDP_ACCEPT)) {
|
|
setverdict(fail, "Unexpected PDP CTX ACT ACC");
|
|
mtc.stop;
|
|
}
|
|
[not exp_rej] BSSGP[0].receive(tr_BD_L3_MT(tr_SM_ACT_PDP_REJ(apars.tid, ?))) {
|
|
setverdict(fail, "Unexpected PDP CTX ACT FAIL");
|
|
mtc.stop;
|
|
}
|
|
[not exp_rej] BSSGP[0].receive(tr_BD_L3_MT(tr_SM_ACT_PDP_ACCEPT(apars.tid, apars.sapi))) {
|
|
setverdict(pass);
|
|
}
|
|
[] as_xid(apars);
|
|
}
|
|
}
|
|
|
|
function f_pdp_ctx_deact_mo(inout PdpActPars apars, OCT1 cause) runs on BSSGP_ConnHdlr {
|
|
var boolean exp_rej := ispresent(apars.exp_rej_cause);
|
|
var Gtp1cUnitdata g_ud;
|
|
|
|
f_send_l3_gmm_llc(ts_SM_DEACT_PDP_REQ_MO(apars.tid, cause, false, omit));
|
|
GTP.receive(tr_GTPC_MsgType(?, deletePDPContextRequest, apars.ggsn_tei_c)) -> value g_ud {
|
|
var integer seq_nr := oct2int(g_ud.gtpc.opt_part.sequenceNumber);
|
|
BSSGP[0].clear;
|
|
GTP.send(ts_GTPC_DeletePdpResp(g_ud.peer, seq_nr, apars.sgsn_tei_c, '7F'O));
|
|
}
|
|
alt {
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_SM_DEACT_PDP_ACCEPT_MT(apars.tid))) {
|
|
setverdict(pass);
|
|
}
|
|
[] as_xid(apars);
|
|
}
|
|
}
|
|
|
|
function f_pdp_ctx_deact_mt(inout PdpActPars apars, boolean error_ind := false) runs on BSSGP_ConnHdlr {
|
|
var Gtp1cUnitdata g_ud;
|
|
var integer seq_nr := 23;
|
|
var GtpPeer peer := valueof(ts_GtpPeerC(apars.sgsn_ip_c));
|
|
|
|
BSSGP[0].clear;
|
|
if (error_ind) {
|
|
GTP.send(ts_GTPU_ErrorIndication(peer, 0 /* seq */, apars.ggsn_tei_u, apars.ggsn_ip_u));
|
|
} else {
|
|
GTP.send(ts_GTPC_DeletePDP(peer, seq_nr, apars.sgsn_tei_c, apars.nsapi, '1'B));
|
|
}
|
|
|
|
timer T := 5.0;
|
|
T.start;
|
|
|
|
alt {
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_SM_DEACT_PDP_REQ_MT(apars.tid, ?, true))) {
|
|
f_send_l3_gmm_llc(ts_SM_DEACT_PDP_ACCEPT_MO(apars.tid));
|
|
}
|
|
[not error_ind] GTP.receive(tr_GTPC_MsgType(?, deletePDPContextResponse, apars.ggsn_tei_c)) {
|
|
repeat;
|
|
}
|
|
[] T.timeout {
|
|
setverdict(fail, "Waiting for SM_DEACT_PDP_REQ_MT");
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
/* Table 10.5.156/3GPP TS 24.008 */
|
|
template (value) QoSV t_QosDefault := {
|
|
reliabilityClass := '011'B, /* unacknowledged GTP+LLC, acknowledged RLC */
|
|
delayClass := '100'B, /* best effort */
|
|
spare1 := '00'B,
|
|
precedenceClass := '010'B, /* normal */
|
|
spare2 := '0'B,
|
|
peakThroughput := '0000'B, /* subscribed */
|
|
meanThroughput := '00000'B, /* subscribed */
|
|
spare3 := '000'B,
|
|
deliverErroneusSDU := omit,
|
|
deliveryOrder := omit,
|
|
trafficClass := omit,
|
|
maxSDUSize := omit,
|
|
maxBitrateUplink := omit,
|
|
maxBitrateDownlink := omit,
|
|
sduErrorRatio := omit,
|
|
residualBER := omit,
|
|
trafficHandlingPriority := omit,
|
|
transferDelay := omit,
|
|
guaranteedBitRateUplink := omit,
|
|
guaranteedBitRateDownlink := omit,
|
|
sourceStatisticsDescriptor := omit,
|
|
signallingIndication := omit,
|
|
spare4 := omit,
|
|
maxBitrateDownlinkExt := omit,
|
|
guaranteedBitRateDownlinkExt := omit,
|
|
maxBitrateUplinkExt := omit,
|
|
guaranteedBitRateUplinkExt := omit,
|
|
maxBitrateDownlinkExt2 := omit,
|
|
guaranteedBitRateDownlinkExt2 := omit,
|
|
maxBitrateUplinkExt2 := omit,
|
|
guaranteedBitRateUplinkExt2 := omit
|
|
}
|
|
|
|
/* 10.5.6.4 / 3GPP TS 24.008 */
|
|
template (value) PDPAddressV t_AddrIPv4dyn := {
|
|
pdpTypeOrg := '0001'B, /* IETF */
|
|
spare := '0000'B,
|
|
pdpTypeNum := '21'O, /* IPv4 */
|
|
addressInfo := omit
|
|
}
|
|
template (value) PDPAddressV t_AddrIPv6dyn := {
|
|
pdpTypeOrg := '0001'B, /* IETF */
|
|
spare := '0000'B,
|
|
pdpTypeNum := '53'O, /* IPv6 */
|
|
addressInfo := omit
|
|
}
|
|
|
|
template (value) PdpActPars t_PdpActPars(charstring ggsn_ip) := {
|
|
tid := '000'B,
|
|
nsapi := '0101'B, /* < 5 are reserved */
|
|
sapi := '0011'B, /* 3/5/9/11 */
|
|
qos := t_QosDefault,
|
|
addr := t_AddrIPv4dyn,
|
|
apn := omit,
|
|
pco := omit,
|
|
exp_rej_cause := omit,
|
|
gtp_resp_cause := int2oct(128, 1),
|
|
chg_id := f_rnd_octstring(4),
|
|
|
|
/* FIXME: make below dynamic !! */
|
|
ggsn_tei_c := f_rnd_octstring(4),
|
|
ggsn_tei_u := f_rnd_octstring(4),
|
|
ggsn_ip_c := f_inet_addr(ggsn_ip),
|
|
ggsn_ip_u := f_inet_addr(ggsn_ip),
|
|
ggsn_restart_ctr := int2oct(2, 1),
|
|
|
|
sgsn_tei_c := omit,
|
|
sgsn_tei_u := omit,
|
|
sgsn_ip_c := omit,
|
|
sgsn_ip_u := omit
|
|
}
|
|
|
|
template (value) GtpPeer ts_GtpPeerU(octetstring ip) := {
|
|
connId := 1,
|
|
remName := f_inet_ntoa(ip),
|
|
remPort := GTP1U_PORT
|
|
}
|
|
|
|
template (value) GtpPeer ts_GtpPeerC(octetstring ip) := {
|
|
connId := 1,
|
|
remName := f_inet_ntoa(ip),
|
|
remPort := GTP1C_PORT
|
|
}
|
|
|
|
private function f_gtpu_send(inout PdpActPars apars, octetstring payload) runs on BSSGP_ConnHdlr {
|
|
var GtpPeer peer := valueof(ts_GtpPeerU(apars.sgsn_ip_u));
|
|
GTP.send(ts_GTP1U_GPDU(peer, 0 /*seq*/, apars.sgsn_tei_u, payload));
|
|
}
|
|
|
|
private altstep as_xid(PdpActPars apars) runs on BSSGP_ConnHdlr {
|
|
[] BSSGP[0].receive(tr_BD_LLC(tr_LLC_XID(?, apars.sapi))) {
|
|
repeat;
|
|
}
|
|
}
|
|
|
|
template PDU_SN tr_SN_UD(template BIT4 nsapi, template octetstring payload) := {
|
|
pDU_SN_UNITDATA := {
|
|
nsapi := nsapi,
|
|
moreBit := ?,
|
|
snPduType := '1'B,
|
|
firstSegmentIndicator := ?,
|
|
spareBit := ?,
|
|
pcomp := ?,
|
|
dcomp := ?,
|
|
npduNumber := ?,
|
|
segmentNumber := ?,
|
|
npduNumberContinued := ?,
|
|
dataSegmentSnUnitdataPdu := payload
|
|
}
|
|
}
|
|
|
|
/* simple case: single segment, no compression */
|
|
template (value) PDU_SN ts_SN_UD(BIT4 nsapi, octetstring payload) := {
|
|
pDU_SN_UNITDATA := {
|
|
nsapi := nsapi,
|
|
moreBit := '0'B,
|
|
snPduType := '1'B,
|
|
firstSegmentIndicator := '1'B,
|
|
spareBit := '0'B,
|
|
pcomp := '0000'B,
|
|
dcomp := '0000'B,
|
|
npduNumber := '0000'B,
|
|
segmentNumber := '0000'B,
|
|
npduNumberContinued := '00'O,
|
|
dataSegmentSnUnitdataPdu := payload
|
|
}
|
|
}
|
|
|
|
/* Transceive given 'payload' as MT message from GTP -> OsmoSGSN -> Gb */
|
|
private function f_gtpu_xceive_mt(inout PdpActPars apars, octetstring payload) runs on BSSGP_ConnHdlr {
|
|
/* Send PDU via GTP from our simulated GGSN to the SGSN */
|
|
f_gtpu_send(apars, payload);
|
|
/* Expect PDU via BSSGP/LLC on simulated PCU from SGSN */
|
|
alt {
|
|
[] as_xid(apars);
|
|
[] BSSGP[0].receive(tr_BD_SNDCP(apars.sapi, tr_SN_UD(apars.nsapi, payload)));
|
|
}
|
|
}
|
|
|
|
/* Transceive given 'payload' as MT message from Gb -> OsmoSGSN -> GTP */
|
|
private function f_gtpu_xceive_mo(inout PdpActPars apars, octetstring payload) runs on BSSGP_ConnHdlr {
|
|
/* Send PDU via SNDCP/LLC/BSSGP/NS via simulated MS/PCU to the SGSN */
|
|
var GtpPeer peer := valueof(ts_GtpPeerU(apars.sgsn_ip_u));
|
|
var PDU_SN sndcp := valueof(ts_SN_UD(apars.nsapi, payload));
|
|
BSSGP[0].send(ts_LLC_UI(enc_PDU_SN(sndcp), apars.sapi, '0'B, 0));
|
|
/* Expect PDU via GTP from SGSN on simulated GGSN */
|
|
alt {
|
|
[] GTP.receive(tr_GTPU_GPDU(peer, apars.ggsn_tei_u, payload));
|
|
}
|
|
}
|
|
|
|
private function f_TC_attach_pdp_act(charstring id) runs on BSSGP_ConnHdlr {
|
|
var PdpActPars apars := valueof(t_PdpActPars(mp_ggsn_ip));
|
|
|
|
/* first perform regular attach */
|
|
f_TC_attach(id);
|
|
|
|
f_pdp_ctx_act(apars);
|
|
}
|
|
testcase TC_attach_pdp_act() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
vc_conn := f_start_handler(refers(f_TC_attach_pdp_act), testcasename(), g_gb, 17);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* PDP Context activation for not-attached subscriber; expect fail */
|
|
private function f_TC_pdp_act_unattached(charstring id) runs on BSSGP_ConnHdlr {
|
|
var PdpActPars apars := valueof(t_PdpActPars(mp_ggsn_ip));
|
|
f_send_l3_gmm_llc(ts_SM_ACT_PDP_REQ(apars.tid, apars.nsapi, apars.sapi, apars.qos, apars.addr,
|
|
apars.apn, apars.pco));
|
|
alt {
|
|
/* We might want toalso actually expect a PDPC CTX ACT REJ? */
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_DET_REQ_MT(?, ?))) {
|
|
setverdict(pass);
|
|
}
|
|
[] GTP.receive(tr_GTPC_MsgType(?, createPDPContextRequest, ?)) {
|
|
setverdict(fail, "Unexpected GTP PDP CTX ACT");
|
|
mtc.stop;
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_SM_ACT_PDP_ACCEPT(?, ?))) {
|
|
setverdict(fail, "Unexpected SM PDP CTX ACT ACK");
|
|
mtc.stop;
|
|
}
|
|
[] BSSGP[0].receive { repeat; }
|
|
}
|
|
}
|
|
testcase TC_pdp_act_unattached() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
vc_conn := f_start_handler(refers(f_TC_pdp_act_unattached), testcasename(), g_gb, 18);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* ATTACH + PDP CTX ACT + user plane traffic */
|
|
private function f_TC_attach_pdp_act_user(charstring id) runs on BSSGP_ConnHdlr {
|
|
var PdpActPars apars := valueof(t_PdpActPars(mp_ggsn_ip));
|
|
|
|
/* first perform regular attach */
|
|
f_TC_attach(id);
|
|
/* then activate PDP context */
|
|
f_pdp_ctx_act(apars);
|
|
/* then transceive a downlink PDU */
|
|
f_gtpu_xceive_mt(apars, f_rnd_octstring(100));
|
|
f_gtpu_xceive_mo(apars, f_rnd_octstring(200));
|
|
}
|
|
testcase TC_attach_pdp_act_user() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
vc_conn := f_start_handler(refers(f_TC_attach_pdp_act_user), testcasename(), g_gb, 19);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* ATTACH + PDP CTX ACT; reject from GGSN */
|
|
private function f_TC_attach_pdp_act_ggsn_reject(charstring id) runs on BSSGP_ConnHdlr {
|
|
var PdpActPars apars := valueof(t_PdpActPars(mp_ggsn_ip));
|
|
|
|
apars.gtp_resp_cause := int2oct(199, 1); /* no resources available */
|
|
apars.exp_rej_cause := '1a'O; /* insufficient resources */
|
|
|
|
/* first perform regular attach */
|
|
f_TC_attach(id);
|
|
/* then activate PDP context */
|
|
f_pdp_ctx_act(apars);
|
|
}
|
|
testcase TC_attach_pdp_act_ggsn_reject() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
vc_conn := f_start_handler(refers(f_TC_attach_pdp_act_ggsn_reject), testcasename(), g_gb, 20);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* ATTACH + PDP CTX ACT + user plane traffic + PDP CTX DEACT in MO direction */
|
|
private function f_TC_attach_pdp_act_user_deact_mo(charstring id) runs on BSSGP_ConnHdlr {
|
|
var PdpActPars apars := valueof(t_PdpActPars(mp_ggsn_ip));
|
|
|
|
/* first perform regular attach */
|
|
f_TC_attach(id);
|
|
/* then activate PDP context */
|
|
f_pdp_ctx_act(apars);
|
|
/* then transceive a downlink PDU */
|
|
f_gtpu_xceive_mt(apars, f_rnd_octstring(100));
|
|
f_gtpu_xceive_mo(apars, f_rnd_octstring(200));
|
|
|
|
f_pdp_ctx_deact_mo(apars, '00'O);
|
|
}
|
|
testcase TC_attach_pdp_act_user_deact_mo() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
vc_conn := f_start_handler(refers(f_TC_attach_pdp_act_user_deact_mo), testcasename(), g_gb, 21);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* ATTACH + PDP CTX ACT + user plane traffic + PDP CTX DEACT in MT direction */
|
|
private function f_TC_attach_pdp_act_user_deact_mt(charstring id) runs on BSSGP_ConnHdlr {
|
|
var PdpActPars apars := valueof(t_PdpActPars(mp_ggsn_ip));
|
|
|
|
/* first perform regular attach */
|
|
f_TC_attach(id);
|
|
/* then activate PDP context */
|
|
f_pdp_ctx_act(apars);
|
|
/* then transceive a downlink PDU */
|
|
f_gtpu_xceive_mt(apars, f_rnd_octstring(100));
|
|
f_gtpu_xceive_mo(apars, f_rnd_octstring(200));
|
|
|
|
f_pdp_ctx_deact_mt(apars, false);
|
|
}
|
|
testcase TC_attach_pdp_act_user_deact_mt() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
vc_conn := f_start_handler(refers(f_TC_attach_pdp_act_user_deact_mt), testcasename(), g_gb, 22);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* ATTACH + ATTACH (2nd) */
|
|
private function f_TC_attach_forget_tlli_attach(charstring id) runs on BSSGP_ConnHdlr {
|
|
g_pars.t_guard := 5.0;
|
|
|
|
/* first perform regular attach */
|
|
f_TC_attach(id);
|
|
|
|
/* second to perform regular attach */
|
|
f_TC_attach(id);
|
|
}
|
|
|
|
|
|
testcase TC_attach_second_attempt() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
vc_conn := f_start_handler(refers(f_TC_attach_forget_tlli_attach), testcasename(), g_gb, 22);
|
|
vc_conn.done;
|
|
}
|
|
|
|
private function f_TC_attach_restart_ctr_echo(charstring id) runs on BSSGP_ConnHdlr {
|
|
var Gtp1cUnitdata g_ud;
|
|
var PdpActPars apars := valueof(t_PdpActPars(mp_ggsn_ip));
|
|
|
|
/* first perform regular attach */
|
|
f_TC_attach(id);
|
|
/* Activate a pdp context against the GGSN */
|
|
f_pdp_ctx_act(apars);
|
|
/* Wait to receive first echo request and send initial Restart counter */
|
|
GTP.receive(tr_GTPC_MsgType(?, echoRequest, ?)) -> value g_ud {
|
|
var integer seq_nr := oct2int(g_ud.gtpc.opt_part.sequenceNumber);
|
|
GTP.send(ts_GTPC_PONG(g_ud.peer, seq_nr, apars.ggsn_restart_ctr));
|
|
}
|
|
/* Wait to receive second echo request and send incremented Restart
|
|
counter. This will fake a restarted GGSN, and pdp ctx allocated
|
|
should be released by SGSN */
|
|
apars.ggsn_restart_ctr := int2oct(oct2int(apars.ggsn_restart_ctr) + 1, 1);
|
|
GTP.receive(tr_GTPC_MsgType(?, echoRequest, ?)) -> value g_ud {
|
|
var integer seq_nr := oct2int(g_ud.gtpc.opt_part.sequenceNumber);
|
|
GTP.send(ts_GTPC_PONG(g_ud.peer, seq_nr, apars.ggsn_restart_ctr));
|
|
}
|
|
var OCT1 cause_network_failure := int2oct(38, 1)
|
|
alt {
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_SM_DEACT_PDP_REQ_MT(apars.tid, cause_network_failure, true))) {
|
|
f_send_l3_gmm_llc(ts_SM_DEACT_PDP_ACCEPT_MO(apars.tid));
|
|
setverdict(pass);
|
|
}
|
|
[] as_xid(apars);
|
|
}
|
|
setverdict(pass);
|
|
}
|
|
/* ATTACH + trigger Recovery procedure through EchoResp */
|
|
testcase TC_attach_restart_ctr_echo() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
g_use_echo := true
|
|
f_init();
|
|
vc_conn := f_start_handler(refers(f_TC_attach_restart_ctr_echo), testcasename(), g_gb, 23, 30.0);
|
|
vc_conn.done;
|
|
g_use_echo := false
|
|
}
|
|
|
|
private function f_TC_attach_restart_ctr_create(charstring id) runs on BSSGP_ConnHdlr {
|
|
var Gtp1cUnitdata g_ud;
|
|
var PdpActPars apars := valueof(t_PdpActPars(mp_ggsn_ip));
|
|
var integer seq_nr := 23;
|
|
var GtpPeer peer;
|
|
/* first perform regular attach */
|
|
f_TC_attach(id);
|
|
|
|
/* Use this CTX ACT to send initial Restart counter to SGSN. */
|
|
apars.gtp_resp_cause := int2oct(199, 1); /* no resources available */
|
|
apars.exp_rej_cause := '1a'O; /* insufficient resources */
|
|
f_pdp_ctx_act(apars, true);
|
|
|
|
/* Increment restart_ctr. This will fake a restarted GGSN when CreatePdpResp is
|
|
/* received. */
|
|
apars.ggsn_restart_ctr := int2oct(oct2int(apars.ggsn_restart_ctr) + 1, 1);
|
|
|
|
/* FIXME: Once we can easily handle different pdp ctx simultaneously, it
|
|
would be great to have an active pdp context here before triggering
|
|
Recovery, and making sure the the DEACT request is sent by the SGSN.
|
|
*/
|
|
|
|
/* Activate a pdp context against the GGSN, send incremented Recovery
|
|
IE. This should trigger the recovery path, but still this specific
|
|
CTX activation should work. */
|
|
apars.exp_rej_cause := omit; /* default value for tests */
|
|
apars.gtp_resp_cause := int2oct(128, 1); /* default value for tests */
|
|
f_pdp_ctx_act(apars, true);
|
|
|
|
setverdict(pass);
|
|
}
|
|
/* ATTACH + trigger Recovery procedure through CreatePdpResp */
|
|
testcase TC_attach_restart_ctr_create() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
vc_conn := f_start_handler(refers(f_TC_attach_restart_ctr_create), testcasename(), g_gb, 24, 30.0);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* ATTACH + PDP CTX ACT + user plane traffic + PDP CTX DEACT in MT direction + trigger T3395 */
|
|
private function f_TC_attach_pdp_act_deact_mt_t3395_expire(charstring id) runs on BSSGP_ConnHdlr {
|
|
var PdpActPars apars := valueof(t_PdpActPars(mp_ggsn_ip));
|
|
var integer seq_nr := 23;
|
|
var GtpPeer peer;
|
|
var integer i;
|
|
|
|
/* first perform regular attach */
|
|
f_TC_attach(id);
|
|
/* then activate PDP context */
|
|
f_pdp_ctx_act(apars);
|
|
|
|
BSSGP[0].clear;
|
|
peer := valueof(ts_GtpPeerC(apars.sgsn_ip_c));
|
|
GTP.send(ts_GTPC_DeletePDP(peer, seq_nr, apars.sgsn_tei_c, apars.nsapi, '1'B));
|
|
|
|
for (i := 0; i < 5; i := i+1) {
|
|
alt {
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_SM_DEACT_PDP_REQ_MT(apars.tid, ?, true))) {}
|
|
[] as_xid(apars);
|
|
}
|
|
}
|
|
|
|
GTP.receive(tr_GTPC_MsgType(?, deletePDPContextResponse, apars.ggsn_tei_c)) {}
|
|
|
|
f_send_l3_gmm_llc(ts_SM_DEACT_PDP_ACCEPT_MO(apars.tid));
|
|
setverdict(pass);
|
|
}
|
|
testcase TC_attach_pdp_act_deact_mt_t3395_expire() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach_pdp_act_deact_mt_t3395_expire), testcasename(), g_gb, 25, 60.0);
|
|
vc_conn.done;
|
|
}
|
|
|
|
private function f_TC_hlr_location_cancel_request_update(charstring id) runs on BSSGP_ConnHdlr {
|
|
/* MS: perform regular attach */
|
|
f_TC_attach(id);
|
|
|
|
/* HLR: cancel the location request */
|
|
GSUP.send(ts_GSUP_CL_REQ(g_pars.imsi, OSMO_GSUP_CANCEL_TYPE_UPDATE));
|
|
GSUP.receive(tr_GSUP_CL_RES(g_pars.imsi));
|
|
|
|
/* ensure no Detach Request got received */
|
|
timer T := 5.0;
|
|
T.start;
|
|
alt {
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_DET_REQ_MT(*, *, *))) {
|
|
T.stop;
|
|
setverdict(fail, "Unexpected GMM Detach Request");
|
|
mtc.stop;
|
|
}
|
|
[] T.timeout {
|
|
setverdict(pass);
|
|
mtc.stop;
|
|
}
|
|
[] BSSGP[0].receive {
|
|
repeat;
|
|
}
|
|
}
|
|
}
|
|
|
|
/* ATTACH + PDP CTX ACT + user plane traffic + ERROR IND in MT direction */
|
|
private function f_TC_attach_pdp_act_user_error_ind_ggsn(charstring id) runs on BSSGP_ConnHdlr {
|
|
var PdpActPars apars := valueof(t_PdpActPars(mp_ggsn_ip));
|
|
|
|
/* first perform regular attach */
|
|
f_TC_attach(id);
|
|
/* then activate PDP context */
|
|
f_pdp_ctx_act(apars);
|
|
/* then transceive a downlink PDU */
|
|
f_gtpu_xceive_mo(apars, f_rnd_octstring(200));
|
|
|
|
/* Send Error indication as response from upload PDU and expect deact towards MS */
|
|
f_pdp_ctx_deact_mt(apars, true);
|
|
}
|
|
testcase TC_attach_pdp_act_user_error_ind_ggsn() runs on test_CT {
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
vc_conn := f_start_handler(refers(f_TC_attach_pdp_act_user_error_ind_ggsn), testcasename(), g_gb, 26);
|
|
vc_conn.done;
|
|
}
|
|
|
|
testcase TC_hlr_location_cancel_request_update() runs on test_CT {
|
|
/* MS <-> SGSN: GMM Attach
|
|
* HLR -> SGSN: Cancel Location Request
|
|
* HLR <- SGSN: Cancel Location Ack
|
|
*/
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_hlr_location_cancel_request_update), testcasename(), g_gb, 31);
|
|
vc_conn.done;
|
|
}
|
|
|
|
|
|
private function f_TC_hlr_location_cancel_request_withdraw(charstring id) runs on BSSGP_ConnHdlr {
|
|
/* MS: perform regular attach */
|
|
f_TC_attach(id);
|
|
|
|
/* HLR: cancel the location request */
|
|
GSUP.send(ts_GSUP_CL_REQ(g_pars.imsi, OSMO_GSUP_CANCEL_TYPE_WITHDRAW));
|
|
GSUP.receive(tr_GSUP_CL_RES(g_pars.imsi));
|
|
GSUP.send(ts_GSUP_UL_RES(g_pars.imsi));
|
|
|
|
/* MS: receive a Detach Request */
|
|
BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_DET_REQ_MT(c_GMM_DTT_MT_IMSI_DETACH, ?, ?)));
|
|
f_send_l3_gmm_llc(ts_GMM_DET_ACCEPT_MO);
|
|
|
|
setverdict(pass);
|
|
}
|
|
|
|
testcase TC_hlr_location_cancel_request_withdraw() runs on test_CT {
|
|
/* MS <-> SGSN: GMM Attach
|
|
* HLR -> SGSN: Cancel Location Request
|
|
* HLR <- SGSN: Cancel Location Ack
|
|
* MS <- SGSN: Detach Request
|
|
* SGSN-> MS: Detach Complete
|
|
*/
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_hlr_location_cancel_request_withdraw), testcasename(), g_gb, 29);
|
|
vc_conn.done;
|
|
}
|
|
|
|
|
|
private function f_hlr_location_cancel_request_unknown_subscriber(
|
|
charstring id,
|
|
GSUP_CancelType canceltype) runs on BSSGP_ConnHdlr {
|
|
|
|
/* HLR: cancel the location request */
|
|
GSUP.send(ts_GSUP_CL_REQ(g_pars.imsi, canceltype));
|
|
|
|
/* cause 2 = IMSI_UNKNOWN */
|
|
GSUP.receive(tr_GSUP_CL_ERR(g_pars.imsi, 2));
|
|
|
|
setverdict(pass);
|
|
}
|
|
|
|
private function f_TC_hlr_location_cancel_request_unknown_subscriber_withdraw(charstring id) runs on BSSGP_ConnHdlr {
|
|
f_hlr_location_cancel_request_unknown_subscriber(id, OSMO_GSUP_CANCEL_TYPE_WITHDRAW);
|
|
}
|
|
|
|
testcase TC_hlr_location_cancel_request_unknown_subscriber_withdraw() runs on test_CT {
|
|
/* HLR -> SGSN: Cancel Location Request
|
|
* HLR <- SGSN: Cancel Location Error
|
|
*/
|
|
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_hlr_location_cancel_request_unknown_subscriber_withdraw), testcasename(), g_gb, 30);
|
|
vc_conn.done;
|
|
}
|
|
|
|
private function f_TC_hlr_location_cancel_request_unknown_subscriber_update(charstring id) runs on BSSGP_ConnHdlr {
|
|
f_hlr_location_cancel_request_unknown_subscriber(id, OSMO_GSUP_CANCEL_TYPE_WITHDRAW);
|
|
}
|
|
|
|
testcase TC_hlr_location_cancel_request_unknown_subscriber_update() runs on test_CT {
|
|
/* HLR -> SGSN: Cancel Location Request
|
|
* HLR <- SGSN: Cancel Location Error
|
|
*/
|
|
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_hlr_location_cancel_request_unknown_subscriber_update), testcasename(), g_gb, 30);
|
|
vc_conn.done;
|
|
}
|
|
|
|
private function f_TC_attach_detach_check_subscriber_list(charstring id) runs on BSSGP_ConnHdlr {
|
|
f_TC_attach(id);
|
|
f_detach_mo(c_GMM_DTT_MO_GPRS, true, true);
|
|
}
|
|
|
|
testcase TC_attach_detach_check_subscriber_list() runs on test_CT {
|
|
/* MS <-> SGSN: Attach
|
|
* MS -> SGSN: Detach Req (Power off)
|
|
* VTY -> SGSN: Check if MS is NOT in subscriber cache
|
|
*/
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
var integer id := 33;
|
|
var charstring imsi := hex2str(f_gen_imsi(id));
|
|
|
|
f_init();
|
|
vc_conn := f_start_handler(refers(f_TC_attach_detach_check_subscriber_list), testcasename(), g_gb, id);
|
|
vc_conn.done;
|
|
|
|
f_vty_transceive_not_match(SGSNVTY, "show subscriber cache", pattern "* IMSI: {imsi}*");
|
|
}
|
|
|
|
/* Attempt an attach, but loose the Identification Request (IMEI) */
|
|
private function f_TC_attach_no_imei_response(charstring id) runs on BSSGP_ConnHdlr {
|
|
var integer count_req := 0;
|
|
var MobileL3_CommonIE_Types.MobileIdentityLV mi;
|
|
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_REQ(f_mi_get_lv(), f_random_RAI(), true, false, omit, omit));
|
|
|
|
alt {
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_REJECT(?))) {
|
|
/* break */
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ID_REQ('001'B))) {
|
|
mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
|
|
f_send_l3_gmm_llc(ts_GMM_ID_RESP(mi));
|
|
repeat;
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ID_REQ('010'B))) {
|
|
/* ignore ID REQ IMEI */
|
|
count_req := count_req + 1;
|
|
repeat;
|
|
}
|
|
}
|
|
if (count_req != 5) {
|
|
setverdict(fail, "Did not received GMM ID Request Type IMEI 5 times!");
|
|
mtc.stop;
|
|
}
|
|
setverdict(pass);
|
|
}
|
|
|
|
testcase TC_attach_no_imei_response() runs on test_CT {
|
|
/* MS -> SGSN: Attach Request IMSI
|
|
* MS <- SGSN: Identity Request IMSI (optional)
|
|
* MS -> SGSN: Identity Response IMSI (optional)
|
|
* MS <- SGSN: Identity Request IMEI
|
|
* MS -x SGSN: no response
|
|
* MS <- SGSN: re-send: Identity Request IMEI 4x
|
|
* MS <- SGSN: Attach Reject
|
|
*/
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach_no_imei_response), testcasename(), g_gb, 32, 60.0);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* Attempt an attach, but loose the Identification Request (IMSI) */
|
|
private function f_TC_attach_no_imsi_response(charstring id) runs on BSSGP_ConnHdlr {
|
|
var integer count_req := 0;
|
|
var MobileL3_CommonIE_Types.MobileIdentityLV mi;
|
|
|
|
/* set p_tmsi to use it in Attach Req via f_mi_get_lv() */
|
|
g_pars.p_tmsi := 'c0000035'O;
|
|
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_REQ(f_mi_get_lv(), f_random_RAI(), true, false, omit, omit));
|
|
|
|
alt {
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_REJECT(?))) {
|
|
/* break */
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ID_REQ('001'B))) {
|
|
/* ignore ID REQ IMSI */
|
|
count_req := count_req + 1;
|
|
repeat;
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ID_REQ('010'B))) {
|
|
mi := valueof(ts_MI_IMEI_LV(g_pars.imei));
|
|
f_send_l3_gmm_llc(ts_GMM_ID_RESP(mi));
|
|
repeat;
|
|
}
|
|
}
|
|
if (count_req != 5) {
|
|
setverdict(fail, "Did not received GMM ID Request Type IMSI 5 times!");
|
|
mtc.stop;
|
|
}
|
|
setverdict(pass);
|
|
}
|
|
|
|
testcase TC_attach_no_imsi_response() runs on test_CT {
|
|
/* MS -> SGSN: Attach Request TMSI (unknown)
|
|
* MS <- SGSN: Identity Request IMEI (optional)
|
|
* MS -> SGSN: Identity Response IMEI (optional)
|
|
* MS <- SGSN: Identity Request IMSI
|
|
* MS -x SGSN: no response
|
|
* MS <- SGSN: re-send: Identity Request IMSI 4x
|
|
* MS <- SGSN: Attach Reject
|
|
*/
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach_no_imsi_response), testcasename(), g_gb, 35, 60.0);
|
|
vc_conn.done;
|
|
}
|
|
|
|
private function f_sgsn_vty_destroy_subscriber_imsi(TELNETasp_PT pt, charstring imsi) {
|
|
f_vty_transceive(pt, "update-subscriber imsi " & imsi & " destroy");
|
|
}
|
|
|
|
testcase TC_attach_check_subscriber_list() runs on test_CT {
|
|
/* MS <-> SGSN: Attach
|
|
* VTY -> SGSN: Check if MS is in subscriber cache
|
|
*/
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
var integer id := 34;
|
|
var charstring imsi := hex2str(f_gen_imsi(id));
|
|
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach), testcasename(), g_gb, id);
|
|
vc_conn.done;
|
|
|
|
f_vty_transceive_match(SGSNVTY, "show subscriber cache", pattern "* IMSI: {imsi}*");
|
|
f_sgsn_vty_destroy_subscriber_imsi(SGSNVTY, imsi);
|
|
}
|
|
|
|
private function f_TC_attach_closed_imsi_added(charstring id) runs on BSSGP_ConnHdlr {
|
|
var RoutingAreaIdentificationV old_ra := f_random_RAI();
|
|
var BssgpDecoded bd;
|
|
|
|
/* unregister the old IMSI */
|
|
f_bssgp_client_unregister(g_pars.imsi);
|
|
/* Simulate a foreign IMSI */
|
|
g_pars.imsi := '001010123456700'H;
|
|
f_bssgp_client_register(g_pars.imsi, g_pars.tlli, g_pars.bssgp_cell_id[0]);
|
|
|
|
/* there is no auth */
|
|
g_pars.net.expect_auth := false;
|
|
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_REQ(f_mi_get_lv(), old_ra, false, false, omit, omit));
|
|
f_gmm_auth();
|
|
alt {
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_REJECT(?))) {
|
|
setverdict(fail, "Received unexpected GMM Attach REJECT");
|
|
mtc.stop;
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_ACCEPT(*, *, *))) -> value bd {
|
|
f_process_attach_accept(bd.l3_mt.msgs.gprs_mm.attachAccept);
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_COMPL);
|
|
setverdict(pass);
|
|
}
|
|
}
|
|
}
|
|
|
|
private function f_TC_attach_closed_add_vty(charstring id) runs on BSSGP_ConnHdlr {
|
|
|
|
f_TC_attach_closed_foreign(id);
|
|
f_TC_attach_closed_imsi_added(id);
|
|
|
|
}
|
|
|
|
|
|
testcase TC_attach_closed_add_vty() runs on test_CT {
|
|
/* VTY-> SGSN: policy close
|
|
* MS -> SGSN: Attach Request
|
|
* MS <- SGSN: Identity Request IMSI
|
|
* MS -> SGSN: Identity Response IMSI
|
|
* MS <- SGSN: Attach Reject
|
|
* VTY-> SGSN: policy imsi-acl add IMSI
|
|
* MS -> SGSN: Attach Request
|
|
* MS <- SGSN: Identity Request IMSI
|
|
* MS -> SGSN: Identity Response IMSI
|
|
* MS <- SGSN: Identity Request IMEI
|
|
* MS -> SGSN: Identity Response IMEI
|
|
* MS <- SGSN: Attach Accept
|
|
*/
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
f_vty_config(SGSNVTY, "sgsn", "auth-policy closed");
|
|
f_vty_config(SGSNVTY, "sgsn", "imsi-acl del 001010123456789");
|
|
f_vty_config(SGSNVTY, "sgsn", "imsi-acl del 001010123456700");
|
|
f_vty_config(SGSNVTY, "sgsn", "imsi-acl add 001010123456700");
|
|
/* test with foreign IMSI: Must Reject */
|
|
vc_conn := f_start_handler(refers(f_TC_attach_closed_add_vty), testcasename(), g_gb, 9);
|
|
vc_conn.done;
|
|
}
|
|
|
|
/* Attempt an attach, but never answer a Attach Complete */
|
|
private function f_TC_attach_check_complete_resend(charstring id) runs on BSSGP_ConnHdlr {
|
|
var integer count_req := 0;
|
|
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_REQ(f_mi_get_lv(), f_random_RAI(), true, false, omit, omit));
|
|
f_gmm_auth();
|
|
|
|
timer T := 10.0;
|
|
T.start;
|
|
alt {
|
|
[] T.timeout {
|
|
/* break */
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_ACCEPT(*, *, *))) {
|
|
/* ignore */
|
|
count_req := count_req + 1;
|
|
T.start;
|
|
repeat;
|
|
}
|
|
}
|
|
if (count_req != 5) {
|
|
setverdict(fail, "Did not received GMM Attach Complete.");
|
|
mtc.stop;
|
|
}
|
|
setverdict(pass);
|
|
}
|
|
|
|
testcase TC_attach_check_complete_resend() runs on test_CT {
|
|
/* MS -> SGSN: Attach Request IMSI
|
|
* MS <- SGSN: Identity Request *
|
|
* MS -> SGSN: Identity Response *
|
|
* MS <- SGSN: Attach Complete 5x
|
|
*/
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach_check_complete_resend), testcasename(), g_gb, 36, 60.0);
|
|
vc_conn.done;
|
|
}
|
|
|
|
private function f_routing_area_update(RoutingAreaIdentificationV ra, integer bssgp := 0) runs on BSSGP_ConnHdlr {
|
|
var BssgpDecoded bd;
|
|
|
|
/* then send RAU */
|
|
f_send_l3_gmm_llc(ts_GMM_RAU_REQ(f_mi_get_lv(), GPRS_UPD_T_RA, g_pars.ra, false, omit, omit), bssgp);
|
|
alt {
|
|
[] BSSGP[bssgp].receive(tr_BD_L3_MT(tr_GMM_RAU_ACCEPT)) -> value bd {
|
|
f_process_rau_accept(bd.l3_mt.msgs.gprs_mm.routingAreaUpdateAccept, bssgp);
|
|
f_send_l3_gmm_llc(ts_GMM_RAU_COMPL, bssgp);
|
|
setverdict(pass);
|
|
}
|
|
[] BSSGP[bssgp].receive(tr_BD_L3_MT(tr_GMM_RAU_REJECT)) {
|
|
setverdict(fail, "Unexpected RAU Reject");
|
|
mtc.stop;
|
|
}
|
|
[] BSSGP[bssgp].receive { repeat; }
|
|
}
|
|
}
|
|
|
|
private function f_TC_attach_rau_a_a(charstring id) runs on BSSGP_ConnHdlr {
|
|
var BssgpDecoded bd;
|
|
|
|
/* first perform regular attach */
|
|
f_TC_attach(id);
|
|
|
|
/* then send RAU */
|
|
f_routing_area_update(g_pars.ra);
|
|
|
|
/* do another RAU */
|
|
f_routing_area_update(g_pars.ra);
|
|
|
|
f_detach_mo(c_GMM_DTT_MO_GPRS, true, true);
|
|
}
|
|
|
|
testcase TC_attach_rau_a_a() runs on test_CT {
|
|
/* MS <-> SGSN: Successful Attach
|
|
* MS -> SGSN: Routing Area Update Request
|
|
* MS <- SGSN: Routing Area Update Accept
|
|
* MS -> SGSN: Routing Area Update Request
|
|
* MS <- SGSN: Routing Area Update Accept
|
|
* MS -> SGSN: Detach (PowerOff)
|
|
*/
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach_rau_a_a), testcasename(), g_gb, 37);
|
|
vc_conn.done;
|
|
}
|
|
|
|
private function f_TC_attach_rau_a_b(charstring id) runs on BSSGP_ConnHdlr {
|
|
var BssgpDecoded bd;
|
|
|
|
f_TC_attach(id);
|
|
|
|
log("attach complete sending rau");
|
|
f_routing_area_update(g_pars.ra, 0);
|
|
|
|
log("rau complete unregistering");
|
|
f_bssgp_client_unregister(g_pars.imsi);
|
|
f_bssgp_client_register(g_pars.imsi, g_pars.tlli, g_pars.bssgp_cell_id[1], BSSGP_PROC[1]);
|
|
|
|
log("sending second RAU via different RA");
|
|
f_routing_area_update(f_cellid_to_RAI(g_pars.bssgp_cell_id[1]), 1);
|
|
|
|
f_detach_mo(c_GMM_DTT_MO_GPRS, true, true, 1);
|
|
}
|
|
|
|
testcase TC_attach_rau_a_b() runs on test_CT {
|
|
/* MS <-> SGSN: Successful Attach
|
|
* MS -> SGSN: Routing Area _a_ Update Request
|
|
* MS <- SGSN: Routing Area _a_ Update Accept
|
|
* MS -> SGSN: Routing Area _b_ Update Request
|
|
* MS <- SGSN: Routing Area _b_ Update Accept
|
|
* MS -> SGSN: Detach (PowerOff)
|
|
*/
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach_rau_a_b), testcasename(), g_gb, 38);
|
|
vc_conn.done;
|
|
}
|
|
|
|
private function f_TC_attach_gmm_attach_req_while_gmm_attach(charstring id) runs on BSSGP_ConnHdlr {
|
|
var integer count_req := 0;
|
|
var MobileL3_CommonIE_Types.MobileIdentityLV mi;
|
|
var RoutingAreaIdentificationV rand_rai := f_random_RAI();
|
|
var BssgpDecoded bd;
|
|
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_REQ(f_mi_get_lv(), rand_rai, true, false, omit, omit));
|
|
|
|
alt {
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_REJECT(?))) {
|
|
setverdict(fail, "Unexpected GMM ATTACH REJECT");
|
|
mtc.stop;
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ID_REQ('001'B))) {
|
|
mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
|
|
f_send_l3_gmm_llc(ts_GMM_ID_RESP(mi));
|
|
repeat;
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ID_REQ('010'B))) {
|
|
/* send out a second GMM_Attach Request.
|
|
* If the SGSN follows the rules, this 2nd ATTACH REQ should be ignored, because
|
|
* of the same content */
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_REQ(f_mi_get_lv(), rand_rai, true, false, omit, omit));
|
|
mi := valueof(ts_MI_IMEI_LV(g_pars.imei));
|
|
f_send_l3_gmm_llc(ts_GMM_ID_RESP(mi));
|
|
}
|
|
}
|
|
f_sleep(1.0);
|
|
|
|
/* we've sent already a IMEI answer, we should NOT asked again for IMEI */
|
|
alt {
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ID_REQ('001'B))) {
|
|
mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
|
|
f_send_l3_gmm_llc(ts_GMM_ID_RESP(mi));
|
|
repeat;
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ID_REQ('010'B))) {
|
|
setverdict(fail, "Unexpected GMM ID REQ (IMEI).");
|
|
mtc.stop;
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_REJECT(?))) {
|
|
setverdict(fail, "Unexpected GMM ATTACH REJECT");
|
|
mtc.stop;
|
|
}
|
|
[] BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_ACCEPT('001'B, ?, ?))) -> value bd {
|
|
f_process_attach_accept(bd.l3_mt.msgs.gprs_mm.attachAccept);
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_COMPL);
|
|
setverdict(pass);
|
|
/* FIXME: Extract P-TMSI, if any. Only send Complete if necessary */
|
|
}
|
|
}
|
|
}
|
|
|
|
testcase TC_attach_gmm_attach_req_while_gmm_attach() runs on test_CT {
|
|
/* Testing if the SGSN ignore Attach Request with the exact same content */
|
|
/* MS -> SGSN: Attach Request IMSI
|
|
* MS <- SGSN: Identity Request IMSI (optional)
|
|
* MS -> SGSN: Identity Response IMSI (optional)
|
|
* MS <- SGSN: Identity Request IMEI
|
|
* MS -> SGSN: Attach Request (2nd)
|
|
* MS <- SGSN: Identity Response IMEI
|
|
* MS <- SGSN: Attach Accept
|
|
* MS -> SGSN: Attach Complete
|
|
*/
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
f_vty_config(SGSNVTY, "sgsn", "auth-policy accept-all");
|
|
vc_conn := f_start_handler(refers(f_TC_attach_gmm_attach_req_while_gmm_attach), testcasename(), g_gb, 39);
|
|
vc_conn.done;
|
|
}
|
|
|
|
private function f_TC_attach_usim_resync(charstring id) runs on BSSGP_ConnHdlr {
|
|
var BssgpDecoded bd;
|
|
var RoutingAreaIdentificationV old_ra := f_random_RAI();
|
|
|
|
var template PDU_L3_MS_SGSN attach_req := ts_GMM_ATTACH_REQ(f_mi_get_lv(), old_ra, false, false, omit, omit);
|
|
|
|
/* send Attach Request */
|
|
/* indicate R99 capability of the MS to enable UMTS AKA in presence of
|
|
* 3G auth vectors */
|
|
attach_req.msgs.gprs_mm.attachRequest.msNetworkCapability.msNetworkCapabilityV.revisionLevelIndicatior := '1'B;
|
|
/* The thing is, if the solSACapability is 'omit', then the
|
|
* revisionLevelIndicatior is at the wrong place! */
|
|
attach_req.msgs.gprs_mm.attachRequest.msNetworkCapability.msNetworkCapabilityV.solSACapability := '0'B;
|
|
f_send_l3_gmm_llc(attach_req);
|
|
|
|
/* do the auth */
|
|
var PDU_L3_MS_SGSN l3_mo;
|
|
var PDU_L3_SGSN_MS l3_mt;
|
|
var default di := activate(as_mm_identity());
|
|
|
|
var GSUP_IE auth_tuple;
|
|
var template AuthenticationParameterAUTNTLV autn;
|
|
|
|
g_pars.vec := f_gen_auth_vec_3g();
|
|
autn := {
|
|
elementIdentifier := '28'O,
|
|
lengthIndicator := lengthof(g_pars.vec.autn),
|
|
autnValue := g_pars.vec.autn
|
|
};
|
|
auth_tuple := valueof(ts_GSUP_IE_AuthTuple2G3G(g_pars.vec.rand,
|
|
g_pars.vec.sres,
|
|
g_pars.vec.kc,
|
|
g_pars.vec.ik,
|
|
g_pars.vec.ck,
|
|
g_pars.vec.autn,
|
|
g_pars.vec.res));
|
|
log("GSUP sends 2G and 3G auth tuples", auth_tuple);
|
|
GSUP.receive(tr_GSUP_SAI_REQ(g_pars.imsi));
|
|
GSUP.send(ts_GSUP_SAI_RES(g_pars.imsi, auth_tuple));
|
|
|
|
var template PDU_L3_SGSN_MS auth_ciph_req := tr_GMM_AUTH_REQ(g_pars.vec.rand);
|
|
auth_ciph_req.msgs.gprs_mm.authenticationAndCipheringRequest.authenticationParameterAUTN := autn;
|
|
BSSGP[0].receive(tr_BD_L3_MT(auth_ciph_req)) -> value bd;
|
|
|
|
/* send the gmm auth failure with resync IE */
|
|
f_send_l3_gmm_llc(ts_GMM_AUTH_FAIL_UMTS_AKA_RESYNC(g_pars.vec.auts));
|
|
|
|
/* wait for the GSUP resync request */
|
|
GSUP.receive(tr_GSUP_SAI_REQ_UMTS_AKA_RESYNC(
|
|
g_pars.imsi,
|
|
g_pars.vec.auts,
|
|
g_pars.vec.rand));
|
|
|
|
/* generate new key material */
|
|
g_pars.vec := f_gen_auth_vec_3g();
|
|
autn := {
|
|
elementIdentifier := '28'O,
|
|
lengthIndicator := lengthof(g_pars.vec.autn),
|
|
autnValue := g_pars.vec.autn
|
|
};
|
|
|
|
auth_tuple := valueof(ts_GSUP_IE_AuthTuple2G3G(g_pars.vec.rand,
|
|
g_pars.vec.sres,
|
|
g_pars.vec.kc,
|
|
g_pars.vec.ik,
|
|
g_pars.vec.ck,
|
|
g_pars.vec.autn,
|
|
g_pars.vec.res));
|
|
/* send new key material */
|
|
GSUP.send(ts_GSUP_SAI_RES(g_pars.imsi, auth_tuple));
|
|
|
|
/* wait for the new Auth Request */
|
|
auth_ciph_req := tr_GMM_AUTH_REQ(g_pars.vec.rand);
|
|
auth_ciph_req.msgs.gprs_mm.authenticationAndCipheringRequest.authenticationParameterAUTN := autn;
|
|
BSSGP[0].receive(tr_BD_L3_MT(auth_ciph_req)) -> value bd;
|
|
l3_mt := bd.l3_mt;
|
|
var BIT4 ac_ref := l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.acReferenceNumber.valueField;
|
|
var template PDU_L3_MS_SGSN auth_ciph_resp := ts_GMM_AUTH_RESP_2G(ac_ref, g_pars.vec.sres);
|
|
auth_ciph_resp := ts_GMM_AUTH_RESP_2G(ac_ref, g_pars.vec.sres);
|
|
auth_ciph_resp.msgs.gprs_mm.authenticationAndCipheringResponse.authenticationParResp := {
|
|
valueField := substr(g_pars.vec.res, 0, 4)
|
|
};
|
|
auth_ciph_resp.msgs.gprs_mm.authenticationAndCipheringResponse.authenticationRespParExt := {
|
|
elementIdentifier := '21'O,
|
|
lengthIndicator := lengthof(g_pars.vec.res) - 4,
|
|
valueField := substr(g_pars.vec.res, 4, lengthof(g_pars.vec.res) - 4)
|
|
};
|
|
l3_mo := valueof(auth_ciph_resp);
|
|
if (ispresent(l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.imeisvRequest) and
|
|
l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.imeisvRequest.valueField == '001'B) {
|
|
l3_mo.msgs.gprs_mm.authenticationAndCipheringResponse.imeisv :=
|
|
valueof(ts_MI_IMEISV_TLV(g_pars.imei & '0'H));
|
|
}
|
|
f_send_l3_gmm_llc(l3_mo);
|
|
deactivate(di);
|
|
|
|
/* Expect SGSN to perform LU with HLR */
|
|
f_gmm_gsup_lu_isd();
|
|
|
|
BSSGP[0].receive(tr_BD_L3_MT(tr_GMM_ATTACH_ACCEPT('001'B, ?, ?))) -> value bd {
|
|
f_process_attach_accept(bd.l3_mt.msgs.gprs_mm.attachAccept);
|
|
}
|
|
f_send_l3_gmm_llc(ts_GMM_ATTACH_COMPL);
|
|
setverdict(pass);
|
|
}
|
|
|
|
testcase TC_attach_usim_resync() runs on test_CT {
|
|
/* MS -> SGSN: Attach Request
|
|
* MS <- SGSN: Identity Request IMSI
|
|
* MS -> SGSN: Identity Response IMSI
|
|
* MS <- SGSN: Identity Request IMEI
|
|
* MS -> SGSN: Identity Response IMEI
|
|
* HLR<- SGSN: SAI Request
|
|
* HLR-> SGSN: SAI Response
|
|
* MS <- SGSN: Auth Request
|
|
* MS -> SGSN: Auth Failure (with AUTS)
|
|
* HLR<- SGSN: SAI Request (with AUTS & RAND)
|
|
* HLR-> SGSN: SAI Response (new key material)
|
|
* MS <- SGSN: Auth Request (new key material)
|
|
* MS -> SGSN: Auth Response
|
|
* MS <- SGSN: Attach Accept
|
|
* MS -> SGSN: Attach Complete
|
|
*/
|
|
var BSSGP_ConnHdlr vc_conn;
|
|
f_init();
|
|
f_sleep(1.0);
|
|
vc_conn := f_start_handler(refers(f_TC_attach_usim_resync), testcasename(), g_gb, 40);
|
|
vc_conn.done;
|
|
}
|
|
|
|
control {
|
|
execute( TC_attach() );
|
|
execute( TC_attach_mnc3() );
|
|
execute( TC_attach_umts_aka_umts_res() );
|
|
execute( TC_attach_umts_aka_gsm_sres() );
|
|
execute( TC_attach_auth_id_timeout() );
|
|
execute( TC_attach_auth_sai_timeout() );
|
|
execute( TC_attach_auth_sai_reject() );
|
|
execute( TC_attach_gsup_lu_timeout() );
|
|
execute( TC_attach_gsup_lu_reject() );
|
|
execute( TC_attach_combined() );
|
|
execute( TC_attach_accept_all() );
|
|
execute( TC_attach_closed() );
|
|
execute( TC_attach_no_imei_response() );
|
|
execute( TC_attach_no_imsi_response() );
|
|
execute( TC_attach_closed_add_vty(), 20.0 );
|
|
execute( TC_attach_check_subscriber_list(), 20.0 );
|
|
execute( TC_attach_detach_check_subscriber_list(), 20.0 );
|
|
execute( TC_attach_check_complete_resend() );
|
|
execute( TC_hlr_location_cancel_request_update(), 20.0 );
|
|
execute( TC_hlr_location_cancel_request_withdraw(), 20.0 );
|
|
execute( TC_hlr_location_cancel_request_unknown_subscriber_withdraw(), 20.0 );
|
|
execute( TC_hlr_location_cancel_request_unknown_subscriber_update(), 20.0 );
|
|
execute( TC_rau_unknown() );
|
|
execute( TC_attach_rau() );
|
|
execute( TC_attach_rau_a_a() );
|
|
execute( TC_attach_rau_a_b() );
|
|
execute( TC_attach_usim_resync() );
|
|
execute( TC_detach_unknown_nopoweroff() );
|
|
execute( TC_detach_unknown_poweroff() );
|
|
execute( TC_detach_nopoweroff() );
|
|
execute( TC_detach_poweroff() );
|
|
execute( TC_attach_pdp_act() );
|
|
execute( TC_pdp_act_unattached() );
|
|
execute( TC_attach_pdp_act_user() );
|
|
execute( TC_attach_pdp_act_ggsn_reject() );
|
|
execute( TC_attach_pdp_act_user_deact_mo() );
|
|
execute( TC_attach_pdp_act_user_deact_mt() );
|
|
execute( TC_attach_second_attempt() );
|
|
execute( TC_attach_restart_ctr_echo() );
|
|
execute( TC_attach_restart_ctr_create() );
|
|
execute( TC_attach_pdp_act_deact_mt_t3395_expire() );
|
|
execute( TC_attach_pdp_act_user_error_ind_ggsn() );
|
|
execute( TC_attach_gmm_attach_req_while_gmm_attach() );
|
|
}
|
|
|
|
|
|
|
|
}
|