| module MSC_Tests { |
| |
| import from General_Types all; |
| import from Osmocom_Types all; |
| |
| import from M3UA_Types all; |
| import from M3UA_Emulation all; |
| |
| import from MTP3asp_Types all; |
| import from MTP3asp_PortType all; |
| |
| import from SCCPasp_Types all; |
| import from SCCP_Types all; |
| import from SCCP_Emulation all; |
| |
| import from SCTPasp_Types all; |
| import from SCTPasp_PortType all; |
| |
| import from Osmocom_CTRL_Functions all; |
| import from Osmocom_CTRL_Types all; |
| import from Osmocom_CTRL_Adapter all; |
| |
| import from TELNETasp_PortType all; |
| import from Osmocom_VTY_Functions all; |
| |
| import from MNCC_Emulation all; |
| import from MNCC_Types all; |
| |
| import from MGCP_Emulation all; |
| import from MGCP_Types all; |
| import from MGCP_Templates all; |
| import from SDP_Types all; |
| |
| import from GSUP_Emulation all; |
| import from GSUP_Types all; |
| import from IPA_Emulation all; |
| |
| import from BSSAP_Types all; |
| import from BSSAP_Adapter all; |
| import from BSSAP_CodecPort all; |
| import from BSSMAP_Templates all; |
| import from BSSMAP_Emulation all; |
| import from BSC_ConnectionHandler all; |
| |
| import from MobileL3_Types all; |
| import from MobileL3_CommonIE_Types all; |
| import from L3_Templates all; |
| import from L3_Common all; |
| |
| const integer NUM_BSC := 2; |
| type record of BSSAP_Configuration BSSAP_Configurations; |
| |
| type component MTC_CT extends CTRL_Adapter_CT { |
| var boolean g_initialized := false; |
| |
| var BSSAP_Adapter g_bssap[NUM_BSC]; |
| |
| /* no 'adapter_CT' for MNCC or GSUP */ |
| var MNCC_Emulation_CT vc_MNCC; |
| var MGCP_Emulation_CT vc_MGCP; |
| var GSUP_Emulation_CT vc_GSUP; |
| var IPA_Emulation_CT vc_GSUP_IPA; |
| |
| /* only to get events from IPA underneath GSUP */ |
| port IPA_CTRL_PT GSUP_IPA_EVENT; |
| /* VTY to MSC */ |
| port TELNETasp_PT MSCVTY; |
| |
| /* A port to directly send BSSAP messages. This port is used for |
| * tests that require low level access to sen arbitrary BSSAP |
| * messages. Run f_init_bssap_direct() to connect and initialize */ |
| port BSSAP_CODEC_PT BSSAP_DIRECT; |
| |
| /* When BSSAP messages are directly sent, then the connection |
| * handler is not active, which means that also no guard timer is |
| * set up. The following timer will serve as a replacement */ |
| timer Tguard_direct := 60.0; |
| } |
| |
| modulepar { |
| /* remote parameters of IUT */ |
| charstring mp_msc_ip := "127.0.0.1"; |
| integer mp_msc_ctrl_port := 4255; |
| integer mp_msc_vty_port := 4254; |
| |
| /* local parameters of emulated HLR */ |
| charstring mp_hlr_ip := "127.0.0.1"; |
| integer mp_hlr_port := 4222; |
| charstring mp_mgw_ip := "127.0.0.1"; |
| integer mp_mgw_port := 2427; |
| |
| charstring mp_msc_mncc := "/tmp/mncc"; |
| |
| BSSAP_Configurations mp_bssap_cfg := { |
| { |
| sccp_service_type := "mtp3_itu", |
| sctp_addr := { 23905, "127.0.0.1", 2905, "127.0.0.1" }, |
| own_pc := 185, |
| own_ssn := 254, |
| peer_pc := 187, |
| peer_ssn := 254, |
| sio := '83'O, |
| rctx := 0 |
| }, |
| { |
| sccp_service_type := "mtp3_itu", |
| sctp_addr := { 23906, "127.0.0.1", 2905, "127.0.0.1" }, |
| own_pc := 186, |
| own_ssn := 254, |
| peer_pc := 187, |
| peer_ssn := 254, |
| sio := '83'O, |
| rctx := 1 |
| } |
| }; |
| } |
| |
| /* altstep for the global guard timer (only used when BSSAP_DIRECT |
| * is used for communication */ |
| private altstep as_Tguard_direct() runs on MTC_CT { |
| [] Tguard_direct.timeout { |
| setverdict(fail, "Tguard timeout"); |
| self.stop; |
| } |
| } |
| |
| function f_init_mncc(charstring id) runs on MTC_CT { |
| id := id & "-MNCC"; |
| var MnccOps ops := { |
| create_cb := refers(MNCC_Emulation.ExpectedCreateCallback), |
| unitdata_cb := refers(MNCC_Emulation.DummyUnitdataCallback) |
| } |
| |
| vc_MNCC := MNCC_Emulation_CT.create(id); |
| map(vc_MNCC:MNCC, system:MNCC_CODEC_PT); |
| vc_MNCC.start(MNCC_Emulation.main(ops, id, mp_msc_mncc)); |
| } |
| |
| function f_init_mgcp(charstring id) runs on MTC_CT { |
| id := id & "-MGCP"; |
| var MGCPOps ops := { |
| create_cb := refers(MGCP_Emulation.ExpectedCreateCallback), |
| unitdata_cb := refers(MGCP_Emulation.DummyUnitdataCallback) |
| } |
| var MGCP_conn_parameters pars := { |
| callagent_ip := mp_msc_ip, |
| callagent_udp_port := -1, |
| mgw_ip := mp_mgw_ip, |
| mgw_udp_port := mp_mgw_port |
| } |
| |
| vc_MGCP := MGCP_Emulation_CT.create(id); |
| map(vc_MGCP:MGCP, system:MGCP_CODEC_PT); |
| vc_MGCP.start(MGCP_Emulation.main(ops, pars, id)); |
| } |
| |
| function f_init_gsup(charstring id) runs on MTC_CT { |
| id := id & "-GSUP"; |
| var GsupOps ops := { |
| create_cb := refers(GSUP_Emulation.ExpectedCreateCallback) |
| } |
| |
| vc_GSUP_IPA := IPA_Emulation_CT.create(id & "-IPA"); |
| vc_GSUP := GSUP_Emulation_CT.create(id); |
| |
| map(vc_GSUP_IPA:IPA_PORT, system:IPA_CODEC_PT); |
| connect(vc_GSUP:GSUP, vc_GSUP_IPA:IPA_GSUP_PORT); |
| /* we use this hack to get events like ASP_IPA_EVENT_UP */ |
| connect(vc_GSUP_IPA:IPA_CTRL_PORT, self:GSUP_IPA_EVENT); |
| |
| vc_GSUP.start(GSUP_Emulation.main(ops, id)); |
| vc_GSUP_IPA.start(IPA_Emulation.main_server(mp_hlr_ip, mp_hlr_port)); |
| |
| /* wait for incoming connection to GSUP port before proceeding */ |
| timer T := 10.0; |
| T.start; |
| alt { |
| [] GSUP_IPA_EVENT.receive(t_ASP_IPA_EVT_UD(ASP_IPA_EVENT_UP)) { } |
| [] T.timeout { |
| setverdict(fail, "No connection to GSUP Port"); |
| self.stop |
| } |
| } |
| } |
| |
| function f_init(integer num_bsc := 1) runs on MTC_CT { |
| |
| if (g_initialized == true) { |
| return; |
| } |
| g_initialized := true; |
| |
| if (num_bsc > NUM_BSC) { |
| setverdict(fail, "excess number of BSC instances requested"); |
| } |
| |
| for (var integer i := 0; i < num_bsc; i := i + 1) { |
| if (isbound(mp_bssap_cfg[i])) { |
| f_bssap_init(g_bssap[0], mp_bssap_cfg[i], "MSC_Test_" & int2str(i), BSC_BssmapOps); |
| } else { |
| setverdict(fail, "missing BSSAP configuration"); |
| } |
| } |
| |
| f_ipa_ctrl_start(mp_msc_ip, mp_msc_ctrl_port); |
| f_init_mncc("MSC_Test"); |
| f_init_mgcp("MSC_Test"); |
| f_init_gsup("MSC_Test"); |
| |
| map(self:MSCVTY, system:MSCVTY); |
| f_vty_set_prompts(MSCVTY); |
| f_vty_transceive(MSCVTY, "enable"); |
| |
| /* set some defaults */ |
| f_vty_config(MSCVTY, "network", "authentication optional"); |
| f_vty_config(MSCVTY, "msc", "assign-tmsi"); |
| f_vty_config(MSCVTY, "network", "encryption a5 0"); |
| } |
| |
| /* Initialize for a direct connection to BSSAP. This function is an alternative |
| * to f_init() when the high level functions of the BSC_ConnectionHandler are |
| * not needed. */ |
| function f_init_bssap_direct() runs on MTC_CT { |
| f_bssap_init(g_bssap[0], mp_bssap_cfg[0], "MSC_Test", omit); |
| connect(g_bssap[0].vc_SCCP:SCCP_SP_PORT, self:BSSAP_DIRECT); |
| |
| /* Start guard timer and activate it as default */ |
| Tguard_direct.start |
| activate(as_Tguard_direct()); |
| } |
| |
| template PDU_BSSAP ts_BSSAP_BSSMAP := { |
| discriminator := '0'B, |
| spare := '0000000'B, |
| dlci := omit, |
| lengthIndicator := 0, /* overwritten by codec */ |
| pdu := ? |
| } |
| |
| template PDU_BSSAP tr_BSSAP_BSSMAP := { |
| discriminator := '0'B, |
| spare := '0000000'B, |
| dlci := omit, |
| lengthIndicator := ?, |
| pdu := { |
| bssmap := ? |
| } |
| } |
| |
| |
| type integer BssmapCause; |
| |
| template (value) BSSMAP_IE_Cause ts_BSSMAP_IE_Cause(BssmapCause val) := { |
| elementIdentifier := '04'O, |
| lengthIndicator := 0, |
| causeValue := int2bit(val, 7), |
| extensionCauseValue := '0'B, |
| spare1 := omit |
| } |
| |
| template (value) PDU_BSSAP ts_BSSMAP_Reset(BssmapCause cause) modifies ts_BSSAP_BSSMAP := { |
| pdu := { |
| bssmap := { |
| reset := { |
| messageType := '30'O, |
| cause := ts_BSSMAP_IE_Cause(cause), |
| a_InterfaceSelectorForReset := omit |
| } |
| } |
| } |
| } |
| |
| template (value) PDU_BSSAP ts_BSSMAP_ResetAck modifies ts_BSSAP_BSSMAP := { |
| pdu := { |
| bssmap := { |
| resetAck := { |
| messageType := '31'O, |
| a_InterfaceSelectorForReset := omit |
| } |
| } |
| } |
| } |
| |
| template PDU_BSSAP tr_BSSMAP_ResetAck modifies tr_BSSAP_BSSMAP := { |
| pdu := { |
| bssmap := { |
| resetAck := { |
| messageType := '31'O, |
| a_InterfaceSelectorForReset := * |
| } |
| } |
| } |
| } |
| |
| template BSSMAP_IE_CellIdentifier ts_BSSMAP_IE_CellID := { |
| elementIdentifier := '05'O, |
| lengthIndicator := 0, |
| cellIdentifierDiscriminator := '0000'B, |
| spare1_4 := '0000'B, |
| cellIdentification := ? |
| } |
| |
| type uint16_t BssmapLAC; |
| type uint16_t BssmapCI; |
| |
| /* |
| template BSSMAP_IE_CellIdentifier ts_CellId_CGI(mcc, mnc, lac, ci) |
| modifies ts_BSSMAP_IE_CellID := { |
| cellIdentification := { |
| cI_LAC_CGI := { |
| mnc_mcc := FIXME, |
| lac := int2oct(lac, 2), |
| ci := int2oct(ci, 2) |
| } |
| } |
| } |
| */ |
| |
| template BSSMAP_IE_CellIdentifier ts_CellID_LAC_CI(BssmapLAC lac, BssmapCI ci) |
| modifies ts_BSSMAP_IE_CellID := { |
| cellIdentification := { |
| cI_LAC_CI := { |
| lac := int2oct(lac, 2), |
| ci := int2oct(ci, 2) |
| } |
| } |
| } |
| |
| template BSSMAP_IE_CellIdentifier ts_CellId_CI(BssmapCI ci) |
| modifies ts_BSSMAP_IE_CellID := { |
| cellIdentification := { |
| cI_CI := int2oct(ci, 2) |
| } |
| } |
| |
| template BSSMAP_IE_CellIdentifier ts_CellId_none |
| modifies ts_BSSMAP_IE_CellID := { |
| cellIdentification := { |
| cI_noCell := ''O |
| } |
| } |
| |
| |
| template BSSMAP_IE_Layer3Information ts_BSSMAP_IE_L3Info(octetstring l3info) := { |
| elementIdentifier := '17'O, |
| lengthIndicator := 0, |
| layer3info := l3info |
| } |
| |
| template PDU_BSSAP ts_BSSMAP_ComplL3(BSSMAP_IE_CellIdentifier cell_id, octetstring l3_info) |
| modifies ts_BSSAP_BSSMAP := { |
| pdu := { |
| bssmap := { |
| completeLayer3Information := { |
| messageType := '57'O, |
| cellIdentifier := cell_id, |
| layer3Information := ts_BSSMAP_IE_L3Info(l3_info), |
| chosenChannel := omit, |
| lSAIdentifier := omit, |
| aPDU := omit, |
| codecList := omit, |
| redirectAttemptFlag := omit, |
| sendSequenceNumber := omit, |
| iMSI := omit |
| } |
| } |
| } |
| } |
| |
| template PDU_BSSAP ts_BSSMAP_HandoReq(BssmapCause cause, BSSMAP_IE_CellIdentifierList cid_list) |
| modifies ts_BSSAP_BSSMAP := { |
| pdu := { |
| bssmap := { |
| handoverRequired := { |
| messageType := '11'O, |
| cause := ts_BSSMAP_IE_Cause(cause), |
| responseRequest := omit, |
| cellIdentifierList := cid_list, |
| circuitPoolList := omit, |
| currentChannelType1 := omit, |
| speechVersion := omit, |
| queueingIndicator := omit, |
| oldToNewBSSInfo := omit, |
| sourceToTargetRNCTransparentInfo := omit, |
| sourceToTargetRNCTransparentInfoCDMA := omit, |
| gERANClassmark := omit, |
| talkerPriority := omit, |
| speechCodec := omit, |
| cSG_Identifier := omit |
| } |
| } |
| } |
| } |
| |
| type function void_fn(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr; |
| |
| /* FIXME: move into BSC_ConnectionHandler? */ |
| function f_init_pars(integer imsi_suffix) runs on MTC_CT return BSC_ConnHdlrPars { |
| var BSC_ConnHdlrNetworkPars net_pars := { |
| kc_support := '0A'O, /* A5/1 and A5/3 enabled */ |
| expect_tmsi := true, |
| expect_auth := false, |
| expect_ciph := false |
| }; |
| var BSC_ConnHdlrPars pars := { |
| sccp_addr_own := g_bssap[0].sccp_addr_own, |
| sccp_addr_peer := g_bssap[0].sccp_addr_peer, |
| cell_id := valueof(ts_CellId_CGI('262'H, '42'H, 23, 42)), |
| imei := f_gen_imei(imsi_suffix), |
| imsi := f_gen_imsi(imsi_suffix), |
| msisdn := f_gen_msisdn(imsi_suffix), |
| tmsi := omit, |
| cm1 := valueof(ts_CM1), |
| cm2 := valueof(ts_CM2_default), |
| cm3 := omit, |
| vec := omit, |
| net := net_pars, |
| send_early_cm := true |
| }; |
| return pars; |
| } |
| |
| function f_start_handler_with_pars(void_fn fn, BSC_ConnHdlrPars pars) runs on MTC_CT return BSC_ConnHdlr { |
| var BSC_ConnHdlr vc_conn; |
| var charstring id := testcasename(); |
| |
| vc_conn := BSC_ConnHdlr.create(id); |
| /* BSSMAP part / A interface */ |
| connect(vc_conn:BSSAP, g_bssap[0].vc_BSSMAP:CLIENT); |
| connect(vc_conn:BSSAP_PROC, g_bssap[0].vc_BSSMAP:PROC); |
| /* MNCC part */ |
| connect(vc_conn:MNCC, vc_MNCC:MNCC_CLIENT); |
| connect(vc_conn:MNCC_PROC, vc_MNCC:MNCC_PROC); |
| /* MGCP part */ |
| connect(vc_conn:MGCP, vc_MGCP:MGCP_CLIENT); |
| connect(vc_conn:MGCP_PROC, vc_MGCP:MGCP_PROC); |
| /* GSUP part */ |
| connect(vc_conn:GSUP, vc_GSUP:GSUP_CLIENT); |
| connect(vc_conn:GSUP_PROC, vc_GSUP:GSUP_PROC); |
| |
| /* We cannot use vc_conn.start(f_init_handler(fn, id, pars)); as we cannot have |
| * a stand-alone 'derefers()' call, see https://www.eclipse.org/forums/index.php/t/1091364/ */ |
| vc_conn.start(derefers(fn)(id, pars)); |
| return vc_conn; |
| } |
| |
| function f_start_handler(void_fn fn, integer imsi_suffix) runs on MTC_CT return BSC_ConnHdlr { |
| return f_start_handler_with_pars(fn, f_init_pars(imsi_suffix)); |
| } |
| |
| private function f_tc_lu_imsi_noauth_tmsi(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| f_perform_lu(); |
| } |
| testcase TC_lu_imsi_noauth_tmsi() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_imsi_noauth_tmsi), 1); |
| vc_conn.done; |
| } |
| |
| private function f_tc_lu_imsi_noauth_notmsi(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| pars.net.expect_tmsi := false; |
| f_init_handler(pars); |
| f_perform_lu(); |
| } |
| testcase TC_lu_imsi_noauth_notmsi() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| f_vty_config(MSCVTY, "msc", "no assign-tmsi"); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_imsi_noauth_notmsi), 2); |
| vc_conn.done; |
| } |
| |
| /* Do LU by IMSI, refuse it on GSUP and expect LU REJ back to MS */ |
| private function f_tc_lu_imsi_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| var PDU_ML3_MS_NW l3_lu := f_build_lu_imsi(g_pars.imsi); |
| |
| f_create_gsup_expect(hex2str(g_pars.imsi)); |
| f_bssap_compl_l3(l3_lu); |
| GSUP.receive(tr_GSUP_UL_REQ(g_pars.imsi)); |
| GSUP.send(ts_GSUP_UL_ERR(g_pars.imsi, 23)); |
| alt { |
| [] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej(int2oct(23,1)))) { |
| f_expect_clear(); |
| } |
| [] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Acc)) { |
| setverdict(fail, "Expecting LU REJ, but got ACCEPT"); |
| self.stop; |
| } |
| } |
| f_expect_clear(); |
| } |
| testcase TC_lu_imsi_reject() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_imsi_reject), 3); |
| vc_conn.done; |
| } |
| |
| /* Do LU by IMSI, timeout on GSUP */ |
| private function f_tc_lu_imsi_timeout_gsup(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| var PDU_ML3_MS_NW l3_lu := f_build_lu_imsi(g_pars.imsi); |
| |
| f_create_gsup_expect(hex2str(g_pars.imsi)); |
| f_bssap_compl_l3(l3_lu); |
| GSUP.receive(tr_GSUP_UL_REQ(g_pars.imsi)); |
| /* Normally the HLR would need to respond here, but we decide to force a timeout here */ |
| alt { |
| /* FIXME: Expect specific reject cause */ |
| [] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) { |
| f_expect_clear(); |
| } |
| [] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Acc)) { |
| setverdict(fail, "Expecting LU REJ, but got ACCEPT"); |
| self.stop; |
| } |
| } |
| f_expect_clear(); |
| } |
| testcase TC_lu_imsi_timeout_gsup() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_imsi_timeout_gsup), 4); |
| vc_conn.done; |
| } |
| |
| private function f_tc_lu_imsi_auth_tmsi(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| pars.net.expect_auth := true; |
| f_init_handler(pars); |
| f_perform_lu(); |
| } |
| testcase TC_lu_imsi_auth_tmsi() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| f_vty_config(MSCVTY, "network", "authentication required"); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi), 5); |
| vc_conn.done; |
| } |
| |
| |
| /* Send CM SERVICE REQ for IMSI that has never performed LU before */ |
| private function f_tc_cmserv_imsi_unknown(charstring id, BSC_ConnHdlrPars pars) |
| runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi)); |
| var BSSMAP_IE_CellIdentifier cell_id := valueof(ts_CellId_CGI('262'H, '42'H, 23, 42)); |
| var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ(CM_TYPE_MO_CALL, mi)); |
| |
| f_create_gsup_expect(hex2str(g_pars.imsi)); |
| |
| /* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */ |
| f_bssap_compl_l3(l3_info); |
| |
| timer T := 10.0; |
| T.start; |
| alt { |
| [] BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ)) { } |
| //[] BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_ACC)) { } |
| [] BSSAP.receive { setverdict(fail, "Received unexpected BSSAP"); } |
| [] GSUP.receive(tr_GSUP_UL_REQ(g_pars.imsi)) { |
| setverdict(fail, "Unexpected GSUP UL REQ"); |
| } |
| [] T.timeout { setverdict(fail, "Timeout waiting for CM SERV REQ"); } |
| } |
| |
| f_expect_clear(); |
| } |
| testcase TC_cmserv_imsi_unknown() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| vc_conn := f_start_handler(refers(f_tc_cmserv_imsi_unknown), 6); |
| vc_conn.done; |
| } |
| |
| private function f_tc_lu_and_mo_call(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| var CallParameters cpars := valueof(t_CallParams('12345'H, 0)); |
| cpars.bss_rtp_port := 1110; |
| cpars.mgcp_connection_id_bss := '22222'H; |
| cpars.mgcp_connection_id_mss := '33333'H; |
| cpars.mgcp_ep := "rtpbridge/1@mgw"; |
| |
| f_perform_lu(); |
| f_mo_call(cpars); |
| } |
| testcase TC_lu_and_mo_call() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_and_mo_call), 7); |
| vc_conn.done; |
| } |
| |
| /* Test LU (with authentication enabled), where HLR times out sending SAI response */ |
| private function f_tc_lu_auth_sai_timeout(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| var PDU_ML3_MS_NW l3_lu := f_build_lu_imsi(g_pars.imsi) |
| var PDU_DTAP_MT dtap_mt; |
| |
| /* tell GSUP dispatcher to send this IMSI to us */ |
| f_create_gsup_expect(hex2str(g_pars.imsi)); |
| |
| /* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */ |
| f_bssap_compl_l3(l3_lu); |
| |
| /* Send Early Classmark, just for the fun of it */ |
| BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3)); |
| |
| GSUP.receive(tr_GSUP_SAI_REQ(g_pars.imsi)); |
| /* The HLR would normally return an auth vector here, but we fail to do so. */ |
| |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)); |
| f_expect_clear(); |
| } |
| testcase TC_lu_auth_sai_timeout() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| f_vty_config(MSCVTY, "network", "authentication required"); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_auth_sai_timeout), 8); |
| vc_conn.done; |
| } |
| |
| /* Test LU (with authentication enabled), where HLR rejects sending SAI error */ |
| private function f_tc_lu_auth_sai_err(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| var PDU_ML3_MS_NW l3_lu := f_build_lu_imsi(g_pars.imsi) |
| var PDU_DTAP_MT dtap_mt; |
| |
| /* tell GSUP dispatcher to send this IMSI to us */ |
| f_create_gsup_expect(hex2str(g_pars.imsi)); |
| |
| /* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */ |
| f_bssap_compl_l3(l3_lu); |
| |
| /* Send Early Classmark, just for the fun of it */ |
| BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3)); |
| |
| GSUP.receive(tr_GSUP_SAI_REQ(g_pars.imsi)); |
| GSUP.send(ts_GSUP_SAI_ERR(g_pars.imsi, 13)); |
| |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)); |
| f_expect_clear(); |
| } |
| testcase TC_lu_auth_sai_err() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| f_vty_config(MSCVTY, "network", "authentication required"); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_auth_sai_err), 9); |
| vc_conn.done; |
| } |
| |
| /* Test LU but BSC will send a clear request in the middle */ |
| private function f_tc_lu_clear_request(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| var PDU_ML3_MS_NW l3_lu := f_build_lu_imsi(g_pars.imsi) |
| var PDU_DTAP_MT dtap_mt; |
| |
| /* tell GSUP dispatcher to send this IMSI to us */ |
| f_create_gsup_expect(hex2str(g_pars.imsi)); |
| |
| /* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */ |
| f_bssap_compl_l3(l3_lu); |
| |
| /* Send Early Classmark, just for the fun of it */ |
| BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3)); |
| |
| f_sleep(1.0); |
| /* send clear request in the middle of the LU */ |
| BSSAP.send(ts_BSSMAP_ClearRequest(0)); |
| BSSAP.receive(tr_BSSMAP_ClearCommand); |
| BSSAP.send(ts_BSSMAP_ClearComplete); |
| alt { |
| /* See https://osmocom.org/issues/2862 */ |
| [] BSSAP.receive(tr_BSSMAP_ClearCommand) { repeat; } |
| [] BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND) {} |
| } |
| setverdict(pass); |
| } |
| testcase TC_lu_clear_request() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_clear_request), 10); |
| vc_conn.done; |
| } |
| |
| /* Test LU but BSC will send a clear request in the middle */ |
| private function f_tc_lu_disconnect(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| var PDU_ML3_MS_NW l3_lu := f_build_lu_imsi(g_pars.imsi) |
| var PDU_DTAP_MT dtap_mt; |
| |
| /* tell GSUP dispatcher to send this IMSI to us */ |
| f_create_gsup_expect(hex2str(g_pars.imsi)); |
| |
| /* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */ |
| f_bssap_compl_l3(l3_lu); |
| |
| /* Send Early Classmark, just for the fun of it */ |
| BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3)); |
| |
| f_sleep(1.0); |
| /* send clear request in the middle of the LU */ |
| BSSAP.send(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_REQ); |
| setverdict(pass); |
| } |
| testcase TC_lu_disconnect() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_disconnect), 11); |
| vc_conn.done; |
| } |
| |
| |
| /* Test LU but with illegal mobile identity type = IMEI */ |
| private function f_tc_lu_by_imei(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| var PDU_ML3_MS_NW l3_lu := f_build_lu_imei(g_pars.imei) |
| var PDU_DTAP_MT dtap_mt; |
| |
| /* tell GSUP dispatcher to send this IMSI to us */ |
| f_create_gsup_expect(hex2str(g_pars.imsi)); |
| |
| /* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */ |
| f_bssap_compl_l3(l3_lu); |
| |
| /* Send Early Classmark, just for the fun of it */ |
| BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3)); |
| /* wait for LU reject, ignore any ID REQ */ |
| alt { |
| [] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) { } |
| [] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_MM_ID_Req)) { repeat; } |
| } |
| /* wait for normal teardown */ |
| f_expect_clear(); |
| } |
| testcase TC_lu_by_imei() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_by_imei), 12); |
| vc_conn.done; |
| } |
| |
| /* Test LU by TMSI with unknown TMSI, expect (and answer) ID REQ. */ |
| private function f_tc_lu_tmsi_noauth_unknown(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| var PDU_ML3_MS_NW l3_lu := f_build_lu_tmsi('01020304'O); /* FIXME: Random */ |
| var PDU_DTAP_MT dtap_mt; |
| |
| /* tell GSUP dispatcher to send this IMSI to us */ |
| f_create_gsup_expect(hex2str(g_pars.imsi)); |
| |
| /* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */ |
| f_bssap_compl_l3(l3_lu); |
| |
| /* Send Early Classmark, just for the fun of it */ |
| BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3)); |
| |
| /* Wait for + respond to ID REQ (IMSI) */ |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_MM_ID_Req('001'B))); |
| BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_MM_ID_Rsp_IMSI(g_pars.imsi))); |
| |
| /* Expect MSC to do UpdateLocation to HLR; respond to it */ |
| GSUP.receive(tr_GSUP_UL_REQ(g_pars.imsi)); |
| GSUP.send(ts_GSUP_ISD_REQ(g_pars.imsi, g_pars.msisdn)); |
| GSUP.receive(tr_GSUP_ISD_RES(g_pars.imsi)); |
| GSUP.send(ts_GSUP_UL_RES(g_pars.imsi)); |
| |
| alt { |
| [] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Acc)) { |
| BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_TmsiRealloc_Cmpl)); |
| } |
| [] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) { |
| setverdict(fail, "Expected LU ACK, but received REJ"); |
| } |
| } |
| |
| /* wait for normal teardown */ |
| f_expect_clear(); |
| } |
| testcase TC_lu_by_tmsi_noauth_unknown() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_tmsi_noauth_unknown), 13); |
| vc_conn.done; |
| } |
| |
| |
| /* Test IMSI DETACH (MI=IMSI) */ |
| private function f_tc_imsi_detach_by_imsi(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi)); |
| |
| /* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */ |
| f_bssap_compl_l3(valueof(ts_ML3_MO_MM_IMSI_DET_Ind(mi))); |
| |
| /* Send Early Classmark, just for the fun of it? */ |
| BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3)); |
| |
| /* wait for normal teardown */ |
| f_expect_clear(); |
| } |
| testcase TC_imsi_detach_by_imsi() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_imsi_detach_by_imsi), 14); |
| vc_conn.done; |
| } |
| |
| /* Test IMSI DETACH (MI=TMSI) */ |
| private function f_tc_imsi_detach_by_tmsi(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| var MobileIdentityLV mi := valueof(ts_MI_TMSI_LV('01020304'O)); |
| |
| /* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */ |
| f_bssap_compl_l3(valueof(ts_ML3_MO_MM_IMSI_DET_Ind(mi))); |
| |
| /* Send Early Classmark, just for the fun of it? */ |
| BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3)); |
| |
| /* wait for normal teardown */ |
| f_expect_clear(); |
| } |
| testcase TC_imsi_detach_by_tmsi() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_imsi_detach_by_tmsi), 15); |
| vc_conn.done; |
| } |
| |
| /* Test IMSI DETACH (MI=IMEI), which is illegal */ |
| private function f_tc_imsi_detach_by_imei(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| var MobileIdentityLV mi := valueof(ts_MI_IMEI_LV(g_pars.imei)); |
| |
| /* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */ |
| f_bssap_compl_l3(valueof(ts_ML3_MO_MM_IMSI_DET_Ind(mi))); |
| |
| /* Send Early Classmark, just for the fun of it? */ |
| BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3)); |
| |
| /* wait for normal teardown */ |
| f_expect_clear(); |
| } |
| testcase TC_imsi_detach_by_imei() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_imsi_detach_by_imei), 16); |
| vc_conn.done; |
| } |
| |
| |
| /* helper function for an emergency call. caller passes in mobile identity to use */ |
| private function f_emerg_call(MobileIdentityLV mi) runs on BSC_ConnHdlr { |
| var CallParameters cpars := valueof(t_CallParams('112'H, 0)); |
| cpars.emergency := true; |
| cpars.mgcp_ep := "rtpbridge/1@mgw"; |
| |
| f_mo_call(cpars); |
| } |
| |
| /* establish an emergency call by IMEI, no SIM inserted (and hence no IMSI) */ |
| private function f_tc_emerg_call_imei_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| var MobileIdentityLV mi := valueof(ts_MI_IMEI_LV(g_pars.imei)); |
| var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ(CM_TYPE_EMERG_CALL, mi)); |
| f_bssap_compl_l3(l3_info); |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ('05'O))); |
| f_expect_clear(); |
| } |
| testcase TC_emerg_call_imei_reject() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_emerg_call_imei_reject), 17); |
| vc_conn.done; |
| } |
| |
| /* establish an emergency call by IMSI, SIM inserted (and hence IMSI) */ |
| private function f_tc_emerg_call_imsi(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| /* First perform location update to ensure subscriber is known */ |
| f_perform_lu(); |
| /* Then issue emergency call identified by IMSI */ |
| f_emerg_call(valueof(ts_MI_IMSI_LV(g_pars.imsi))); |
| } |
| testcase TC_emerg_call_imsi() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_emerg_call_imsi), 18); |
| vc_conn.done; |
| } |
| |
| /* CM Service Request for VGCS -> reject */ |
| private function f_tc_cm_serv_req_vgcs_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| /* First perform location update to ensure subscriber is known */ |
| f_perform_lu(); |
| |
| var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi)); |
| var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ(CM_TYPE_VGCS, mi)); |
| f_bssap_compl_l3(l3_info); |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ(int2oct(32,1)))); |
| f_expect_clear(); |
| } |
| testcase TC_cm_serv_req_vgcs_reject() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_cm_serv_req_vgcs_reject), 19); |
| vc_conn.done; |
| } |
| |
| /* CM Service Request for VBS -> reject */ |
| private function f_tc_cm_serv_req_vbs_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| /* First perform location update to ensure subscriber is known */ |
| f_perform_lu(); |
| |
| var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi)); |
| var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ(CM_TYPE_VBS, mi)); |
| f_bssap_compl_l3(l3_info); |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ(int2oct(32,1)))); |
| f_expect_clear(); |
| } |
| testcase TC_cm_serv_req_vbs_reject() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_cm_serv_req_vbs_reject), 20); |
| vc_conn.done; |
| } |
| |
| /* CM Service Request for LCS -> reject */ |
| private function f_tc_cm_serv_req_lcs_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| /* First perform location update to ensure subscriber is known */ |
| f_perform_lu(); |
| |
| var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi)); |
| var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ(CM_TYPE_LCS, mi)); |
| f_bssap_compl_l3(l3_info); |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ(int2oct(32,1)))); |
| f_expect_clear(); |
| } |
| testcase TC_cm_serv_req_lcs_reject() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_cm_serv_req_lcs_reject), 21); |
| vc_conn.done; |
| } |
| |
| /* CM Re-Establishment Request */ |
| private function f_tc_cm_reest_req_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| /* First perform location update to ensure subscriber is known */ |
| f_perform_lu(); |
| |
| var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi)); |
| var PDU_ML3_MS_NW l3_info := valueof(ts_CM_REEST_REQ(0, mi)); |
| f_bssap_compl_l3(l3_info); |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ(int2oct(32,1)))); |
| f_expect_clear(); |
| } |
| testcase TC_cm_reest_req_reject() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_cm_reest_req_reject), 22); |
| vc_conn.done; |
| } |
| |
| /* Test LU (with authentication enabled), with wrong response from MS */ |
| private function f_tc_lu_auth_2G_fail(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| var PDU_ML3_MS_NW l3_lu := f_build_lu_imsi(g_pars.imsi) |
| |
| /* tell GSUP dispatcher to send this IMSI to us */ |
| f_create_gsup_expect(hex2str(g_pars.imsi)); |
| |
| /* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */ |
| f_bssap_compl_l3(l3_lu); |
| |
| /* Send Early Classmark, just for the fun of it */ |
| BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3)); |
| |
| var AuthVector vec := f_gen_auth_vec_2g(); |
| var GSUP_IE auth_tuple := valueof(ts_GSUP_IE_AuthTuple2G(vec.rand, vec.sres, vec.kc)); |
| GSUP.receive(tr_GSUP_SAI_REQ(g_pars.imsi)); |
| GSUP.send(ts_GSUP_SAI_RES(g_pars.imsi, auth_tuple)); |
| |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_MM_AUTH_REQ(vec.rand))); |
| /* Send back wrong auth response */ |
| BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MT_MM_AUTH_RESP_2G('00000000'O))); |
| |
| /* Expect GSUP AUTH FAIL REP to HLR */ |
| GSUP.receive(tr_GSUP_AUTH_FAIL_IND(g_pars.imsi)); |
| |
| /* Expect LU REJECT with Cause == Illegal MS */ |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej('03'O))); |
| f_expect_clear(); |
| } |
| testcase TC_lu_auth_2G_fail() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| f_vty_config(MSCVTY, "network", "authentication required"); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_auth_2G_fail), 23); |
| vc_conn.done; |
| } |
| |
| /* A5/1 + A5/3 permitted on network side, and MS capable to do it */ |
| private function f_tc_lu_imsi_auth_tmsi_encr_13_13(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| pars.net.expect_auth := true; |
| pars.net.expect_ciph := true; |
| f_init_handler(pars); |
| f_perform_lu(); |
| } |
| testcase TC_lu_imsi_auth_tmsi_encr_13_13() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| f_vty_config(MSCVTY, "network", "authentication required"); |
| f_vty_config(MSCVTY, "network", "encryption a5 1 3"); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_encr_13_13), 24); |
| vc_conn.done; |
| } |
| |
| /* Test Complete L3 without payload */ |
| private function f_tc_cl3_no_payload(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| /* Send Complete L3 Info with empty L3 frame */ |
| BSSAP.send(ts_BSSAP_Conn_Req(g_pars.sccp_addr_peer, g_pars.sccp_addr_own, |
| valueof(ts_BSSMAP_ComplL3(g_pars.cell_id, ''O)))); |
| |
| timer T := 5.0; |
| T.start; |
| alt { |
| [] BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND) {} |
| /* Expect LU REJECT with Cause == Illegal MS */ |
| [] BSSAP.receive(tr_PDU_DTAP_MT(?)) { repeat; } |
| [] BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_CONF_IND) { repeat; } |
| [] as_clear_cmd_compl_disc(); |
| [] T.timeout { |
| setverdict(fail, "Timeout waiting for ClearCommand or SCCP Release"); |
| self.stop; |
| } |
| } |
| setverdict(pass); |
| } |
| testcase TC_cl3_no_payload() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_cl3_no_payload), 25); |
| vc_conn.done; |
| } |
| |
| /* Test Complete L3 with random payload */ |
| private function f_tc_cl3_rnd_payload(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| var integer len := float2int(rnd() * 256.0); |
| var octetstring payl := f_rnd_octstring(len); |
| |
| /* Send Complete L3 Info with empty L3 frame */ |
| BSSAP.send(ts_BSSAP_Conn_Req(g_pars.sccp_addr_peer, g_pars.sccp_addr_own, |
| valueof(ts_BSSMAP_ComplL3(g_pars.cell_id, payl)))); |
| |
| timer T := 5.0; |
| T.start; |
| alt { |
| /* Immediate disconnect */ |
| [] BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND) {} |
| [] BSSAP.receive(tr_PDU_DTAP_MT(?)) { repeat; } |
| [] BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_CONF_IND) { repeat; } |
| [] as_clear_cmd_compl_disc(); |
| [] T.timeout { |
| setverdict(fail, "Timeout waiting for ClearCommand or SCCP Release"); |
| self.stop; |
| } |
| } |
| setverdict(pass); |
| } |
| testcase TC_cl3_rnd_payload() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_cl3_rnd_payload), 26); |
| vc_conn.done; |
| } |
| |
| /* Test Complete L3 with random payload */ |
| private function f_tc_establish_and_nothing(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| f_perform_lu(); |
| |
| f_establish_fully(valueof(ts_MI_IMSI_LV(g_pars.imsi))); |
| f_expect_clear(); |
| } |
| testcase TC_establish_and_nothing() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_establish_and_nothing), 27); |
| vc_conn.done; |
| } |
| |
| /* Test MO Call SETUP with no response from MNCC */ |
| private function f_tc_mo_setup_and_nothing(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| |
| var CallParameters cpars := valueof(t_CallParams('12345'H, 0)); |
| |
| f_perform_lu(); |
| |
| f_establish_fully(valueof(ts_MI_IMSI_LV(g_pars.imsi))); |
| f_create_mncc_expect(hex2str(cpars.called_party)); |
| f_create_mgcp_expect(ExpectCriteria:{omit,omit,omit}); |
| |
| BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_CC_SETUP(cpars.transaction_id, cpars.called_party))); |
| |
| f_expect_clear(30.0); |
| } |
| testcase TC_mo_setup_and_nothing() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_mo_setup_and_nothing), 28); |
| vc_conn.done; |
| } |
| |
| /* Test MO Call with no response to RAN-side CRCX */ |
| private function f_tc_mo_crcx_ran_timeout(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| var CallParameters cpars := valueof(t_CallParams('12345'H, 0)); |
| var MNCC_PDU mncc; |
| var MgcpCommand mgcp_cmd; |
| |
| f_perform_lu(); |
| |
| f_establish_fully(valueof(ts_MI_IMSI_LV(g_pars.imsi))); |
| f_create_mncc_expect(hex2str(cpars.called_party)); |
| f_create_mgcp_expect(ExpectCriteria:{omit,omit,omit}); |
| |
| BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_CC_SETUP(cpars.transaction_id, cpars.called_party))); |
| MNCC.receive(tr_MNCC_SETUP_ind(?, tr_MNCC_number(hex2str(cpars.called_party)))) -> value mncc; |
| cpars.mncc_callref := mncc.u.signal.callref; |
| MNCC.send(ts_MNCC_CALL_PROC_req(cpars.mncc_callref, cpars.mncc_bearer_cap)); |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_CALL_PROC(cpars.transaction_id))); |
| |
| MGCP.receive(tr_CRCX) -> value mgcp_cmd; |
| cpars.mgcp_call_id := f_MgcpCmd_extract_call_id(mgcp_cmd); |
| cpars.mgcp_ep := mgcp_cmd.line.ep; |
| /* never respond to this */ |
| |
| /* When the connection with the MGW fails, the MSC will first request |
| * a release via call control. We will answer this request normally. */ |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_RELEASE(cpars.transaction_id))); |
| BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_CC_REL_COMPL(cpars.transaction_id))); |
| |
| f_expect_clear(30.0); |
| } |
| testcase TC_mo_crcx_ran_timeout() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_mo_crcx_ran_timeout), 29); |
| vc_conn.done; |
| } |
| |
| /* Test MO Call with reject to RAN-side CRCX */ |
| private function f_tc_mo_crcx_ran_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| var CallParameters cpars := valueof(t_CallParams('12345'H, 0)); |
| var MNCC_PDU mncc; |
| var MgcpCommand mgcp_cmd; |
| |
| f_perform_lu(); |
| |
| f_establish_fully(valueof(ts_MI_IMSI_LV(g_pars.imsi))); |
| f_create_mncc_expect(hex2str(cpars.called_party)); |
| f_create_mgcp_expect(ExpectCriteria:{omit,omit,omit}); |
| |
| BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_CC_SETUP(cpars.transaction_id, cpars.called_party))); |
| MNCC.receive(tr_MNCC_SETUP_ind(?, tr_MNCC_number(hex2str(cpars.called_party)))) -> value mncc; |
| cpars.mncc_callref := mncc.u.signal.callref; |
| MNCC.send(ts_MNCC_CALL_PROC_req(cpars.mncc_callref, cpars.mncc_bearer_cap)); |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_CALL_PROC(cpars.transaction_id))); |
| |
| MGCP.receive(tr_CRCX) -> value mgcp_cmd; |
| |
| /* Detect if the received CRCX is a wildcarded CRCX request. If yes, |
| * set an endpoint name that fits the pattern. If not, just use the |
| * endpoint name from the request */ |
| if (match(mgcp_cmd.line.ep, t_MGCP_EP_wildcard)) { |
| cpars.mgcp_ep := "rtpbridge/1@mgw"; |
| } else { |
| cpars.mgcp_ep := mgcp_cmd.line.ep; |
| } |
| |
| cpars.mgcp_call_id := f_MgcpCmd_extract_call_id(mgcp_cmd); |
| |
| /* Respond to CRCX with error */ |
| var MgcpResponse mgcp_rsp := { |
| line := { |
| code := "542", |
| trans_id := mgcp_cmd.line.trans_id, |
| string := "FORCED_FAIL" |
| }, |
| sdp := omit |
| } |
| var MgcpParameter mgcp_rsp_param := { |
| code := "Z", |
| val := cpars.mgcp_ep |
| }; |
| mgcp_rsp.params[0] := mgcp_rsp_param; |
| MGCP.send(mgcp_rsp); |
| |
| timer T := 30.0; |
| T.start; |
| alt { |
| [] T.timeout { setverdict(fail, "Timeout waiting for channel release"); self.stop; } |
| [] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_RELEASE(cpars.transaction_id))) { |
| BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_CC_REL_COMPL(cpars.transaction_id))); |
| repeat; |
| } |
| [] BSSAP.receive { |
| repeat; |
| } |
| [] MNCC.receive { repeat; } |
| [] GSUP.receive { repeat; } |
| [] MGCP.receive(tr_DLCX(?)) -> value mgcp_cmd { |
| MGCP.send(ts_DLCX_ACK2(mgcp_cmd.line.trans_id)); |
| f_create_mgcp_delete_ep(cpars.mgcp_ep); |
| repeat; |
| } |
| [] MGCP.receive { repeat; } |
| [] as_clear_cmd_compl_disc(); |
| } |
| } |
| testcase TC_mo_crcx_ran_reject() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_mo_crcx_ran_reject), 30); |
| vc_conn.done; |
| } |
| |
| |
| /* helper function to start a MT call: MNCC SETUP; Paging; DChan est.; DTAP SETUP */ |
| private function f_mt_call_start(inout CallParameters cpars) runs on BSC_ConnHdlr { |
| var MNCC_PDU mncc; |
| var MgcpCommand mgcp_cmd; |
| var OCT4 tmsi; |
| |
| f_perform_lu(); |
| if (isvalue(g_pars.tmsi)) { |
| tmsi := g_pars.tmsi; |
| } else { |
| tmsi := 'FFFFFFFF'O; |
| } |
| f_bssmap_register_imsi(g_pars.imsi, tmsi); |
| |
| /* Allocate call reference and send SETUP via MNCC to MSC */ |
| cpars.mncc_callref := f_rnd_int(2147483648); |
| MNCC.send(ts_MNCC_SETUP_req(cpars.mncc_callref, hex2str(g_pars.msisdn), |
| hex2str(cpars.called_party), hex2str(g_pars.imsi))); |
| |
| /* MSC->BSC: expect PAGING from MSC */ |
| BSSAP.receive(tr_BSSMAP_Paging(g_pars.imsi)); |
| /* MS -> MSC: PAGING RESPONSE */ |
| f_establish_fully(valueof(ts_MI_IMSI_LV(g_pars.imsi)), EST_TYPE_PAG_RESP); |
| |
| f_create_mgcp_expect(ExpectCriteria:{omit,omit,omit}); |
| |
| /* MSC->MS: SETUP */ |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_SETUP(cpars.transaction_id, *, cpars.called_party))); |
| } |
| |
| /* Test MT Call */ |
| private function f_tc_mt_crcx_ran_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| var CallParameters cpars := valueof(t_CallParams('123456'H, 0)); |
| var MNCC_PDU mncc; |
| var MgcpCommand mgcp_cmd; |
| |
| f_mt_call_start(cpars); |
| |
| /* MS->MSC: CALL CONFIRMED */ |
| BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_CC_CALL_CONF(cpars.transaction_id))); |
| |
| MNCC.receive(tr_MNCC_CALL_CONF_ind(cpars.mncc_callref)); |
| |
| MGCP.receive(tr_CRCX) -> value mgcp_cmd; |
| cpars.mgcp_call_id := f_MgcpCmd_extract_call_id(mgcp_cmd); |
| |
| /* Detect if the received CRCX is a wildcarded CRCX request. If yes, |
| * set an endpoint name that fits the pattern. If not, just use the |
| * endpoint name from the request */ |
| if (match(mgcp_cmd.line.ep, t_MGCP_EP_wildcard)) { |
| cpars.mgcp_ep := "rtpbridge/1@mgw"; |
| } else { |
| cpars.mgcp_ep := mgcp_cmd.line.ep; |
| } |
| |
| /* Respond to CRCX with error */ |
| var MgcpResponse mgcp_rsp := { |
| line := { |
| code := "542", |
| trans_id := mgcp_cmd.line.trans_id, |
| string := "FORCED_FAIL" |
| }, |
| sdp := omit |
| } |
| var MgcpParameter mgcp_rsp_param := { |
| code := "Z", |
| val := cpars.mgcp_ep |
| }; |
| mgcp_rsp.params[0] := mgcp_rsp_param; |
| MGCP.send(mgcp_rsp); |
| |
| timer T := 30.0; |
| T.start; |
| alt { |
| [] T.timeout { setverdict(fail, "Timeout waiting for channel release"); self.stop; } |
| [] BSSAP.receive { repeat; } |
| [] MNCC.receive { repeat; } |
| [] GSUP.receive { repeat; } |
| [] MGCP.receive(tr_DLCX(?)) -> value mgcp_cmd { |
| MGCP.send(ts_DLCX_ACK2(mgcp_cmd.line.trans_id)); |
| f_create_mgcp_delete_ep(cpars.mgcp_ep); |
| repeat; |
| } |
| [] MGCP.receive { repeat; } |
| [] as_clear_cmd_compl_disc(); |
| } |
| } |
| testcase TC_mt_crcx_ran_reject() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_mt_crcx_ran_reject), 31); |
| vc_conn.done; |
| } |
| |
| |
| /* Test MT Call T310 timer */ |
| private function f_tc_mt_t310(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars, 200.0); |
| var CallParameters cpars := valueof(t_CallParams('123456'H, 0)); |
| var MNCC_PDU mncc; |
| var MgcpCommand mgcp_cmd; |
| |
| f_mt_call_start(cpars); |
| |
| /* MS->MSC: CALL CONFIRMED */ |
| BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_CC_CALL_CONF(cpars.transaction_id))); |
| MNCC.receive(tr_MNCC_CALL_CONF_ind(cpars.mncc_callref)); |
| |
| MGCP.receive(tr_CRCX) -> value mgcp_cmd; |
| cpars.mgcp_call_id := f_MgcpCmd_extract_call_id(mgcp_cmd); |
| cpars.mgcp_ep := mgcp_cmd.line.ep; |
| /* FIXME: Respond to CRCX */ |
| |
| /* old libosmocore T310 default timeout is 180s. so let's wait 190 */ |
| timer T := 190.0; |
| T.start; |
| alt { |
| [] T.timeout { setverdict(fail, "Timeout waiting for T310"); self.stop; } |
| [] MNCC.receive(tr_MNCC_DISC_ind(cpars.mncc_callref)) { |
| MNCC.send(ts_MNCC_REL_req(cpars.mncc_callref, valueof(ts_MNCC_cause(23)))); |
| } |
| } |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_DISC(cpars.transaction_id))); |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_RELEASE(cpars.transaction_id))); |
| /* FIXME: We're sending this with TIflag 0: allocated by sender, which is wrong */ |
| BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_CC_REL_COMPL(cpars.transaction_id))); |
| |
| alt { |
| [] MGCP.receive(tr_DLCX(?)) -> value mgcp_cmd { |
| MGCP.send(ts_DLCX_ACK2(mgcp_cmd.line.trans_id)); |
| f_create_mgcp_delete_ep(cpars.mgcp_ep); |
| repeat; |
| } |
| [] as_clear_cmd_compl_disc(); |
| } |
| } |
| testcase TC_mt_t310() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_mt_t310), 32); |
| vc_conn.done; |
| } |
| |
| /* Perform successful LU + MO call, then GSUP LocationCancel. Subscriber must be denied CM SERV */ |
| private function f_tc_gsup_cancel(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| var CallParameters cpars := valueof(t_CallParams('12345'H, 0)); |
| cpars.bss_rtp_port := 1110; |
| cpars.mgcp_connection_id_bss := '22222'H; |
| cpars.mgcp_connection_id_mss := '33333'H; |
| |
| /* Location Update to make subscriber known */ |
| f_perform_lu(); |
| |
| /* First MO call should succeed */ |
| f_mo_call(cpars); |
| |
| /* Cancel the subscriber in the VLR */ |
| GSUP.send(ts_GSUP_CL_REQ(g_pars.imsi, OSMO_GSUP_CANCEL_TYPE_WITHDRAW)); |
| alt { |
| [] GSUP.receive(tr_GSUP_CL_RES(g_pars.imsi)) { } |
| [] GSUP.receive(tr_GSUP_CL_ERR(g_pars.imsi)) { |
| setverdict(fail, "Received GSUP Location Cancel Error"); |
| self.stop; |
| } |
| } |
| |
| /* Follow-up transactions should fail */ |
| var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi)); |
| var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ(CM_TYPE_MO_CALL, mi)); |
| f_bssap_compl_l3(l3_info); |
| alt { |
| [] BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ)) { } |
| [] BSSAP.receive { |
| setverdict(fail, "Received unexpected BSSAP instead of CM SERV REJ"); |
| self.stop; |
| } |
| } |
| setverdict(pass); |
| } |
| testcase TC_gsup_cancel() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_gsup_cancel), 33); |
| vc_conn.done; |
| } |
| |
| /* A5/1 only permitted on network side, and MS capable to do it */ |
| private function f_tc_lu_imsi_auth_tmsi_encr_1_13(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| pars.net.expect_auth := true; |
| pars.net.expect_ciph := true; |
| pars.net.kc_support := '02'O; /* A5/1 only */ |
| f_init_handler(pars); |
| f_perform_lu(); |
| } |
| testcase TC_lu_imsi_auth_tmsi_encr_1_13() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| f_vty_config(MSCVTY, "network", "authentication required"); |
| f_vty_config(MSCVTY, "network", "encryption a5 1"); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_encr_1_13), 34); |
| vc_conn.done; |
| } |
| |
| /* A5/3 only permitted on network side, and MS capable to do it */ |
| private function f_tc_lu_imsi_auth_tmsi_encr_3_13(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| pars.net.expect_auth := true; |
| pars.net.expect_ciph := true; |
| pars.net.kc_support := '08'O; /* A5/3 only */ |
| f_init_handler(pars); |
| f_perform_lu(); |
| } |
| testcase TC_lu_imsi_auth_tmsi_encr_3_13() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| f_vty_config(MSCVTY, "network", "authentication required"); |
| f_vty_config(MSCVTY, "network", "encryption a5 3"); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_encr_3_13), 35); |
| vc_conn.done; |
| } |
| |
| /* A5/3 only permitted on network side, and MS with only A5/1 support */ |
| private function f_tc_lu_imsi_auth_tmsi_encr_3_1(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| pars.net.expect_auth := true; |
| pars.net.expect_ciph := true; |
| pars.net.kc_support := '08'O; /* A5/3 only */ |
| pars.cm2.classmarkInformationType2_oct5.a5_3 := '0'B; |
| f_init_handler(pars, 15.0); |
| |
| /* cannot use f_perform_lu() as we expect a reject */ |
| var PDU_ML3_MS_NW l3_lu := f_build_lu_imsi(g_pars.imsi); |
| f_create_gsup_expect(hex2str(g_pars.imsi)); |
| f_bssap_compl_l3(l3_lu); |
| if (pars.send_early_cm) { |
| BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3)); |
| } else { |
| pars.cm1.esind := '0'B; |
| } |
| f_mm_auth(); |
| alt { |
| [] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) { |
| f_expect_clear(); |
| } |
| [] BSSAP.receive(tr_BSSMAP_CipherModeCmd(?,?)) { |
| setverdict(fail, "CipherModeCommand despite no A5 intersection"); |
| self.stop; |
| } |
| [] BSSAP.receive { |
| setverdict(fail, "Unknown/unexpected BSSAP received"); |
| self.stop; |
| } |
| } |
| setverdict(pass); |
| } |
| testcase TC_lu_imsi_auth_tmsi_encr_3_1() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| f_vty_config(MSCVTY, "network", "authentication required"); |
| f_vty_config(MSCVTY, "network", "encryption a5 3"); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_encr_3_1), 360); |
| vc_conn.done; |
| } |
| testcase TC_lu_imsi_auth_tmsi_encr_3_1_no_cm() runs on MTC_CT { |
| var BSC_ConnHdlrPars pars; |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| f_vty_config(MSCVTY, "network", "authentication required"); |
| f_vty_config(MSCVTY, "network", "encryption a5 3"); |
| |
| pars := f_init_pars(361); |
| pars.send_early_cm := false; |
| vc_conn := f_start_handler_with_pars(refers(f_tc_lu_imsi_auth_tmsi_encr_3_1), pars); |
| vc_conn.done; |
| } |
| testcase TC_lu_imsi_auth_tmsi_encr_3_1_log_msc_debug() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| f_vty_config(MSCVTY, "network", "authentication required"); |
| f_vty_config(MSCVTY, "network", "encryption a5 3"); |
| |
| /* Make sure the MSC category is on DEBUG level to trigger the log |
| * message that is reported in OS#2947 to trigger the segfault */ |
| f_vty_config(MSCVTY, "log stderr", "logging level msc debug"); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_encr_3_1), 362); |
| vc_conn.done; |
| } |
| |
| /* A5/1 + A5/3 only permitted on network side, and MS with only A5/2 support */ |
| private function f_tc_lu_imsi_auth_tmsi_encr_13_2(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| pars.net.expect_auth := true; |
| pars.net.expect_ciph := true; |
| pars.net.kc_support := '0A'O; /* A5/1 + A5/3 */ |
| pars.cm1.a5_1 := '1'B; |
| pars.cm2.a5_1 := '1'B; |
| pars.cm2.classmarkInformationType2_oct5.a5_3 := '0'B; |
| pars.cm2.classmarkInformationType2_oct5.a5_2 := '1'B; |
| f_init_handler(pars, 15.0); |
| |
| /* cannot use f_perform_lu() as we expect a reject */ |
| var PDU_ML3_MS_NW l3_lu := f_build_lu_imsi(g_pars.imsi); |
| f_create_gsup_expect(hex2str(g_pars.imsi)); |
| f_bssap_compl_l3(l3_lu); |
| BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3)); |
| f_mm_auth(); |
| alt { |
| [] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) { |
| f_expect_clear(); |
| } |
| [] BSSAP.receive(tr_BSSMAP_CipherModeCmd(?,?)) { |
| setverdict(fail, "CipherModeCommand despite no A5 intersection"); |
| self.stop; |
| } |
| [] BSSAP.receive { |
| setverdict(fail, "Unknown/unexpected BSSAP received"); |
| self.stop; |
| } |
| } |
| setverdict(pass); |
| } |
| testcase TC_lu_imsi_auth_tmsi_encr_13_2() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| f_vty_config(MSCVTY, "network", "authentication required"); |
| f_vty_config(MSCVTY, "network", "encryption a5 1 3"); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_encr_13_2), 37); |
| vc_conn.done; |
| } |
| |
| /* A5/0 + A5/1 + A5/3 only permitted on network side, and MS with only A5/2 support */ |
| private function f_tc_lu_imsi_auth_tmsi_encr_013_2(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| pars.net.expect_auth := true; |
| pars.net.expect_ciph := true; |
| pars.net.kc_support := '0B'O; /* A5/1 + A5/3 */ |
| pars.cm1.a5_1 := '1'B; |
| pars.cm2.a5_1 := '1'B; |
| pars.cm2.classmarkInformationType2_oct5.a5_3 := '0'B; |
| pars.cm2.classmarkInformationType2_oct5.a5_2 := '1'B; |
| f_init_handler(pars, 15.0); |
| f_perform_lu(); |
| } |
| testcase TC_lu_imsi_auth_tmsi_encr_013_2() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| f_vty_config(MSCVTY, "network", "authentication required"); |
| f_vty_config(MSCVTY, "network", "encryption a5 0 1 3"); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_encr_013_2), 38); |
| vc_conn.done; |
| } |
| |
| /* LU followed by MT call (including paging) */ |
| private function f_tc_lu_and_mt_call(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| //FIXME: odd digits var CallParameters cpars := valueof(t_CallParams('12345'H, 0)); |
| var CallParameters cpars := valueof(t_CallParams('123456'H, 0)); |
| cpars.bss_rtp_port := 1110; |
| cpars.mgcp_connection_id_bss := '10004'H; |
| cpars.mgcp_connection_id_mss := '10005'H; |
| |
| /* Note: This is an optional parameter. When the call-agent (MSC) does |
| * supply a full endpoint name this setting will be overwritten. */ |
| cpars.mgcp_ep := "rtpbridge/1@mgw"; |
| |
| f_perform_lu(); |
| f_mt_call(cpars); |
| } |
| testcase TC_lu_and_mt_call() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_lu_and_mt_call), 39); |
| vc_conn.done; |
| } |
| |
| /* Test MO Call SETUP with DTMF */ |
| private function f_tc_mo_setup_dtmf_dup(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| var CallParameters cpars := valueof(t_CallParams('12345'H, 0)); |
| cpars.bss_rtp_port := 1110; |
| cpars.mgcp_connection_id_bss := '22222'H; |
| cpars.mgcp_connection_id_mss := '33333'H; |
| |
| f_perform_lu(); |
| f_mo_seq_dtmf_dup(cpars); |
| } |
| testcase TC_mo_setup_and_dtmf_dup() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_mo_setup_dtmf_dup), 39); |
| vc_conn.done; |
| } |
| |
| testcase TC_cr_before_reset() runs on MTC_CT { |
| timer T := 4.0; |
| var boolean reset_ack_seen := false; |
| f_init_bssap_direct(); |
| |
| /* Make a blind connection attemt, to trigger the deadlock condition */ |
| BSSAP_DIRECT.send(ts_BSSAP_CONNECT_req(g_bssap[0].sccp_addr_peer, g_bssap[0].sccp_addr_own, 1, omit)); |
| |
| /* Send a BSSMAP reset */ |
| BSSAP_DIRECT.send(ts_BSSAP_UNITDATA_req(g_bssap[0].sccp_addr_peer, g_bssap[0].sccp_addr_own, ts_BSSMAP_Reset(0))); |
| T.start |
| alt { |
| [] BSSAP_DIRECT.receive(tr_BSSAP_UNITDATA_ind(?, ?, tr_BSSMAP_ResetAck)) { |
| reset_ack_seen := true; |
| repeat; |
| } |
| |
| /* Acknowledge MSC sided reset requests */ |
| [] BSSAP_DIRECT.receive(tr_BSSAP_UNITDATA_ind(?, ?, tr_BSSMAP_Reset)) { |
| BSSAP_DIRECT.send(ts_BSSAP_UNITDATA_req(g_bssap[0].sccp_addr_peer, g_bssap[0].sccp_addr_own, ts_BSSMAP_ResetAck)); |
| repeat; |
| } |
| |
| /* Ignore all other messages (e.g CR from the connection request) */ |
| [] BSSAP_DIRECT.receive { repeat } |
| |
| /* If we got no BSSMAP RESET ACK back, then the MSC entered the |
| * deadlock situation. The MSC is then unable to respond to any |
| * further BSSMAP RESET or any other sort of traffic. */ |
| [reset_ack_seen == true] T.timeout { setverdict(pass) } |
| [reset_ack_seen == false] T.timeout { |
| setverdict(fail, "no BSSMAP RESET ACK seen!"); |
| } |
| } |
| } |
| |
| /* Test MO Call with no response to RAN-side CRCX or DTAP Release */ |
| private function f_tc_mo_release_timeout(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| var CallParameters cpars := valueof(t_CallParams('12345'H, 0)); |
| var MNCC_PDU mncc; |
| var MgcpCommand mgcp_cmd; |
| |
| f_perform_lu(); |
| |
| f_establish_fully(valueof(ts_MI_IMSI_LV(g_pars.imsi))); |
| f_create_mncc_expect(hex2str(cpars.called_party)); |
| f_create_mgcp_expect(ExpectCriteria:{omit,omit,omit}); |
| |
| BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_CC_SETUP(cpars.transaction_id, cpars.called_party))); |
| MNCC.receive(tr_MNCC_SETUP_ind(?, tr_MNCC_number(hex2str(cpars.called_party)))) -> value mncc; |
| cpars.mncc_callref := mncc.u.signal.callref; |
| MNCC.send(ts_MNCC_CALL_PROC_req(cpars.mncc_callref, cpars.mncc_bearer_cap)); |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_CALL_PROC(cpars.transaction_id))); |
| |
| /* Drop CRCX */ |
| MGCP.receive(tr_CRCX) -> value mgcp_cmd; |
| |
| /* Drop DTAP Release */ |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_RELEASE(cpars.transaction_id))); |
| |
| /* Drop resent DTAP Release */ |
| BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_RELEASE(cpars.transaction_id))); |
| |
| f_expect_clear(60.0); |
| } |
| testcase TC_mo_release_timeout() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| vc_conn := f_start_handler(refers(f_tc_mo_release_timeout), 40); |
| vc_conn.done; |
| } |
| |
| |
| /* LU followed by MT call (including paging) */ |
| private function f_tc_lu_and_mt_call_no_dlcx_resp(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { |
| f_init_handler(pars); |
| //FIXME: odd digits var CallParameters cpars := valueof(t_CallParams('12345'H, 0)); |
| var CallParameters cpars := valueof(t_CallParams('123456'H, 0)); |
| cpars.bss_rtp_port := 1110; |
| cpars.mgcp_connection_id_bss := '10004'H; |
| cpars.mgcp_connection_id_mss := '10005'H; |
| |
| /* Note: This is an optional parameter. When the call-agent (MSC) does |
| * supply a full endpoint name this setting will be overwritten. */ |
| cpars.mgcp_ep := "rtpbridge/1@mgw"; |
| |
| /* Intentionally disable the CRCX response */ |
| cpars.mgw_drop_dlcx := true; |
| |
| /* Perform location update and call */ |
| f_perform_lu(); |
| f_mt_call(cpars); |
| } |
| testcase TC_lu_and_mt_call_no_dlcx_resp() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(); |
| |
| /* Perform an almost normal looking locationupdate + mt-call, but do |
| * not respond to the DLCX at the end of the call */ |
| vc_conn := f_start_handler(refers(f_tc_lu_and_mt_call_no_dlcx_resp), 41); |
| vc_conn.done; |
| |
| /* Wait a guard period until the MGCP layer in the MSC times out, |
| * if the MSC is vulnerable to the use-after-free situation that is |
| * fixed by I78f1b6a9149488a4ad3f120c1e190a83c07d4b89 then it should |
| * segfault now */ |
| f_sleep(6.0); |
| |
| /* Run the init procedures once more. If the MSC has crashed, this |
| * this will fail */ |
| f_init(); |
| } |
| |
| /* Two BSSMAP resets from two different BSCs */ |
| testcase TC_reset_two() runs on MTC_CT { |
| var BSC_ConnHdlr vc_conn; |
| f_init(2); |
| f_sleep(2.0); |
| setverdict(pass); |
| } |
| |
| /* TODO: |
| * continue to send repeated MO signalling messages to keep channel open: does MSC tmeout? |
| * malformed messages (missing IE, invalid message type): properly rejected? |
| * MT call while LU or is ongoing: Do we use existing lchan or page while lchan active? |
| * 3G/2G auth permutations |
| * encryption algorithms vs. classmark vs. vty config |
| * send new transaction after/during clear (like SMS, ...) |
| * too long L3 INFO in DTAP |
| * too long / padded BSSAP |
| * too long / short TLV values |
| */ |
| |
| |
| control { |
| execute( TC_cr_before_reset() ); |
| execute( TC_lu_imsi_noauth_tmsi() ); |
| execute( TC_lu_imsi_noauth_notmsi() ); |
| execute( TC_lu_imsi_reject() ); |
| execute( TC_lu_imsi_timeout_gsup() ); |
| execute( TC_lu_imsi_auth_tmsi() ); |
| execute( TC_cmserv_imsi_unknown() ); |
| execute( TC_lu_and_mo_call() ); |
| execute( TC_lu_auth_sai_timeout() ); |
| execute( TC_lu_auth_sai_err() ); |
| execute( TC_lu_clear_request() ); |
| execute( TC_lu_disconnect() ); |
| execute( TC_lu_by_imei() ); |
| execute( TC_lu_by_tmsi_noauth_unknown() ); |
| execute( TC_imsi_detach_by_imsi() ); |
| execute( TC_imsi_detach_by_tmsi() ); |
| execute( TC_imsi_detach_by_imei() ); |
| execute( TC_emerg_call_imei_reject() ); |
| execute( TC_emerg_call_imsi() ); |
| execute( TC_cm_serv_req_vgcs_reject() ); |
| execute( TC_cm_serv_req_vbs_reject() ); |
| execute( TC_cm_serv_req_lcs_reject() ); |
| execute( TC_cm_reest_req_reject() ); |
| execute( TC_lu_auth_2G_fail() ); |
| execute( TC_lu_imsi_auth_tmsi_encr_13_13() ); |
| execute( TC_cl3_no_payload() ); |
| execute( TC_cl3_rnd_payload() ); |
| execute( TC_establish_and_nothing() ); |
| execute( TC_mo_setup_and_nothing() ); |
| execute( TC_mo_crcx_ran_timeout() ); |
| execute( TC_mo_crcx_ran_reject() ); |
| execute( TC_mt_crcx_ran_reject() ); |
| execute( TC_mo_setup_and_dtmf_dup() ); |
| //execute( TC_mt_t310() ); |
| execute( TC_gsup_cancel() ); |
| execute( TC_lu_imsi_auth_tmsi_encr_1_13() ); |
| execute( TC_lu_imsi_auth_tmsi_encr_3_13() ); |
| execute( TC_lu_imsi_auth_tmsi_encr_3_1() ); |
| execute( TC_lu_imsi_auth_tmsi_encr_3_1_no_cm() ); |
| execute( TC_lu_imsi_auth_tmsi_encr_13_2() ); |
| execute( TC_lu_imsi_auth_tmsi_encr_013_2() ); |
| execute( TC_mo_release_timeout() ); |
| execute( TC_lu_and_mt_call_no_dlcx_resp() ); |
| execute( TC_reset_two() ); |
| |
| execute( TC_lu_and_mt_call() ); |
| |
| /* Run this last: at the time of writing this test crashes the MSC */ |
| execute( TC_lu_imsi_auth_tmsi_encr_3_1_log_msc_debug() ); |
| } |
| |
| |
| } |