bsc: Submit valid l3 payload

OsmoBSC does some minimal parsing of l3 content to select MSC target,
match paging response to paging request, etc.
Since tests right now use potentially invalid data, osmo-bsc is not
rejecting conns providing invalid l3 content.

This commit makes sure TTCN3 tests pass valid l3 payloads to osmo-bsc,
so that they keep working once osmo-bsc starts rejecting invalid IEs it
parses.

Related: SYS#6280
Change-Id: I6e99ac39f32c9a981420b73f8d7d1568d2fa1c54
diff --git a/bsc/BSC_Tests.ttcn b/bsc/BSC_Tests.ttcn
index aebb64c..106f8b4 100644
--- a/bsc/BSC_Tests.ttcn
+++ b/bsc/BSC_Tests.ttcn
@@ -115,8 +115,6 @@
 private const RSL_IE_Body c_mr_conf_5_90 :=
 	valueof(RSL_IE_Body:{multirate_cfg := ts_RSL_MultirateCfg(true, 0, '00000100'B /* 5,90k */)});
 
-friend const octetstring c_l3_payload := '00010203040506'O;
-
 /* per-BTS state which we keep */
 type record BTS_State {
 	/* component reference to the IPA_Client component used for RSL */
@@ -609,6 +607,15 @@
 	}
 }
 
+friend function gen_l3_valid_payload(hexstring imsi := ''H) return octetstring {
+	var octetstring l3_payload;
+	if (lengthof(imsi) == 0) {
+		imsi := f_rnd_imsi('00101'H);
+	}
+	l3_payload := enc_PDU_ML3_MS_NW(valueof(ts_LU_REQ(LU_Type_IMSI_Attach, ts_MI_LV(ts_MI_IMSI(imsi)))));
+	return l3_payload;
+}
+
 type component test_CT extends CTRL_Adapter_CT {
 	/* Array of per-BTS/TRX state */
 	var BTS_State bts[NUM_BTS][NUM_TRX];
@@ -1517,15 +1524,16 @@
 	var IpaStreamId sid := IPAC_PROTO_RSL_TRX0;
 	var RSL_Message rx_rsl;
 	var ASP_RSL_Unitdata rx_rsl_ud;
+	var octetstring l3_payload := gen_l3_valid_payload();
 
 	f_init(1);
 
 	/* Send CHAN RQD and wait for allocation; acknowledge it */
 	var RslChannelNr chan_nr := f_chreq_act_ack();
 
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload)));
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload)));
 
 	/* expect BSC to disable the channel again if there's no response from MSC */
 	/* MS waits 20s (T3210) at LU; 10s (T3230) at CM SERV REQ and 5s (T3220) AT detach */
@@ -1537,15 +1545,16 @@
 testcase TC_chan_act_ack_est_ind_refused() runs on test_CT {
 	var BSSAP_N_CONNECT_ind rx_c_ind;
 	var RSL_Message rx_rsl;
+	var octetstring l3_payload := gen_l3_valid_payload();
 
 	f_init(1);
 
 	/* Send CHAN RQD and wait for allocation; acknowledge it */
 	var RslChannelNr chan_nr := f_chreq_act_ack();
 
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) -> value rx_c_ind;
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) -> value rx_c_ind;
 	BSSAP.send(ts_BSSAP_DISC_req(rx_c_ind.connectionId, 0));
 
 	/* expect BSC to disable the channel */
@@ -1680,7 +1689,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 	if (mp_bssap_cfg[bssap_idx].transport == BSSAP_TRANSPORT_AoIP) {
 		/* send assignment without AoIP IEs */
 		BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSMAP_AssignmentReq(ts_BSSMAP_IE_CIC(0, 1))));
@@ -1806,7 +1815,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 	/* send assignment without AoIP IEs */
 	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ass_cmd));
 	alt {
@@ -1946,7 +1955,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* simulate RLL REL IND */
 	f_ipa_tx(ts_RSL_REL_IND(dt.rsl_chan_nr, valueof(ts_RslLinkID_DCCH(0))));
@@ -1974,7 +1983,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* Sending CONN FAIL IND immediately may trigger a race condition.
 	 * Give the BSC some time to process a new SCCP connection (OS#5823). */
@@ -2031,7 +2040,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* BSC<-MSC: Instruct BSC to clear connection */
 	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSMAP_ClearCommand(0)));
@@ -2198,7 +2207,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* Instruct BSC to clear channel */
 	var BssmapCause cause := 0;
@@ -2220,7 +2229,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 	/* Send CommonID with some random PLMN (BSC doesn't take it into account
 	/* yet when generating the EUTRAN neigh list in RR CHannel Release) */
 	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSMAP_CommonId('001019876543210'H, '323454'O)));
@@ -2276,7 +2285,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* Instruct BSC to clear channel */
 	var BssmapCause cause := 0;
@@ -2298,7 +2307,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* release the SCCP connection */
 	BSSAP.send(ts_BSSAP_DISC_req(dt.sccp_conn_id, 0));
@@ -2313,7 +2322,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* release the SCCP connection */
 	BSSAP.send(ts_BSSAP_DISC_req(dt.sccp_conn_id, 0));
@@ -2328,7 +2337,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* Clear the queue, it might still contain stuff like IMMEDIATE ASSIGN */
 	IPA_RSL[0][0].clear;
@@ -2356,7 +2365,7 @@
 
 	f_init(1);
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 	f_expect_chan_rel(dt.rsl_chan_nr, expect_rll_rel_req := false);
 	f_shutdown_helper();
 }
@@ -2367,7 +2376,7 @@
 {
 	var DchanTuple dt;
 
-	dt := f_est_dchan('23'O, 23, c_l3_payload);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 	var BssmapCause cause := 0;
 	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSMAP_ClearCommand(enum2int(clear_cmd_cause))));
 	BSSAP.receive(tr_BSSAP_DATA_ind(dt.sccp_conn_id, tr_BSSMAP_ClearComplete)) {
@@ -2398,11 +2407,12 @@
 	f_init(1);
 
 	var RslChannelNr chan_nr := valueof(t_RslChanNr_Bm(6));
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	var octetstring l3_payload := gen_l3_valid_payload();
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
 	T.start;
 	alt {
-	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) {
+	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) {
 		setverdict(fail, "MSC received COMPL L3 for non-active lchan");
 		}
 	[] BSSAP.receive {}
@@ -2416,17 +2426,19 @@
 /* Test behavior if RSL EST IND for invalid SAPI */
 testcase TC_rll_est_ind_inval_sapi1() runs on test_CT {
 	var RslChannelNr chan_nr;
+	var octetstring l3_payload;
 
 	f_init(1);
 
-	chan_nr := f_chreq_act_ack()
+	chan_nr := f_chreq_act_ack();
+	l3_payload := gen_l3_valid_payload();
 
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(1)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(1)), l3_payload));
 
 	timer T := 2.0;
 	T.start;
 	alt {
-	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) {
+	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) {
 		setverdict(fail, "MSC received COMPL L3 for invalid SAPI 1");
 		}
 	[] BSSAP.receive { repeat; }
@@ -2444,12 +2456,13 @@
 	f_init(1);
 
 	var RslChannelNr chan_nr := f_chreq_act_ack();
+	var octetstring l3_payload := gen_l3_valid_payload();
 
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(3)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(3)), l3_payload));
 
 	T.start;
 	alt {
-	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) {
+	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) {
 		setverdict(fail, "MSC received COMPL L3 for invalid SAPI 3");
 		}
 	[] BSSAP.receive { repeat; }
@@ -2467,12 +2480,13 @@
 	f_init(1);
 
 	var RslChannelNr chan_nr := f_chreq_act_ack();
+	var octetstring l3_payload := gen_l3_valid_payload();
 
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_SACCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_SACCH(0)), l3_payload));
 
 	T.start;
 	alt {
-	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) {
+	[] BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) {
 		setverdict(fail, "MSC received COMPL L3 for invalid Link SACCH");
 		}
 	[] BSSAP.receive { repeat; }
@@ -2587,10 +2601,10 @@
 	f_init(1);
 
 	/* MS establishes a SAPI=0 link on DCCH */
-	dt := f_est_dchan(f_rnd_ra_cs(), 23, c_l3_payload);
+	dt := f_est_dchan(f_rnd_ra_cs(), 23, gen_l3_valid_payload());
 
 	/* MSC sends some data on (not yet established) SAPI=3 link */
-	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(c_l3_payload, '03'O)));
+	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(gen_l3_valid_payload(), '03'O)));
 	/* BSC attempts to establish a SAPI=3 link on DCCH */
 	rx_rsl := f_exp_ipa_rx(tr_RSL_EST_REQ(dt.rsl_chan_nr, tr_RslLinkID_DCCH(3)));
 
@@ -2614,10 +2628,10 @@
 	f_init(1);
 
 	/* MS establishes a SAPI=0 link on DCCH */
-	dt := f_est_dchan(f_rnd_ra_cs(), 23, c_l3_payload);
+	dt := f_est_dchan(f_rnd_ra_cs(), 23, gen_l3_valid_payload());
 
 	/* MSC sends some data on (not yet established) SAPI=3 link */
-	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(c_l3_payload, '03'O)));
+	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(gen_l3_valid_payload(), '03'O)));
 	/* BSC attempts to establish a SAPI=3 link on DCCH */
 	rx_rsl := f_exp_ipa_rx(tr_RSL_EST_REQ(dt.rsl_chan_nr, tr_RslLinkID_DCCH(3)));
 
@@ -2641,10 +2655,10 @@
 	f_init(1);
 
 	/* MS establishes a SAPI=0 link on DCCH */
-	dt := f_est_dchan(f_rnd_ra_cs(), 23, c_l3_payload);
+	dt := f_est_dchan(f_rnd_ra_cs(), 23, gen_l3_valid_payload());
 
 	/* MSC sends some data on (not yet established) SAPI=3 link */
-	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(c_l3_payload, '03'O)));
+	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(gen_l3_valid_payload(), '03'O)));
 	/* BSC attempts to establish a SAPI=3 link on DCCH */
 	rx_rsl := f_exp_ipa_rx(tr_RSL_EST_REQ(dt.rsl_chan_nr, tr_RslLinkID_DCCH(3)));
 
@@ -2666,10 +2680,10 @@
 	f_init(1);
 
 	/* MS establishes a SAPI=0 link on DCCH */
-	dt := f_est_dchan(f_rnd_ra_cs(), 23, c_l3_payload);
+	dt := f_est_dchan(f_rnd_ra_cs(), 23, gen_l3_valid_payload());
 
 	/* MSC sends some data on (not yet established) SAPI=3 link */
-	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(c_l3_payload, '03'O)));
+	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSAP_DTAP(gen_l3_valid_payload(), '03'O)));
 	/* BSC attempts to establish a SAPI=3 link on DCCH */
 	rx_rsl := f_exp_ipa_rx(tr_RSL_EST_REQ(dt.rsl_chan_nr, tr_RslLinkID_DCCH(3)));
 
@@ -2733,7 +2747,7 @@
 		var BSSAP_N_DATA_ind rx_di;
 		var DchanTuple dt;
 
-		dt := f_est_dchan('23'O, 23, c_l3_payload);
+		dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 		/* Send CommonID with some random PLMN (BSC doesn't take it into account
 		 * yet when generating the EUTRAN neigh list in RR CHannel Release) */
 		BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSMAP_CommonId('001019876543210'H, '323454'O)));
@@ -7547,7 +7561,7 @@
 		/* Setup a BSSAP connection and clear it right away. This is
 		 * the MSC telling the BSC about a planned release, it's not an
 		 * erratic loss of a connection. */
-		dt := f_est_dchan(int2oct(i,1), 23+i, c_l3_payload);
+		dt := f_est_dchan(int2oct(i,1), 23+i, gen_l3_valid_payload());
 
 		/* MSC disconnects (RLSD). */
 		BSSAP.send(ts_BSSAP_DISC_req(dt.sccp_conn_id, 0));
@@ -7591,7 +7605,7 @@
 		/* Setup a BSSAP connection and clear it right away. This is
 		 * the MSC telling the BSC about a planned release, it's not an
 		 * erratic loss of a connection. */
-		dt := f_est_dchan(int2oct(i,1), 23+i, c_l3_payload);
+		dt := f_est_dchan(int2oct(i,1), 23+i, gen_l3_valid_payload());
 
 		/* Instruct BSC to clear channel */
 		BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSMAP_ClearCommand(cause)));
@@ -7637,7 +7651,7 @@
 		/* Setup a BSSAP connection and clear it right away. This is
 		 * the MSC telling the BSC about a planned release, it's not an
 		 * erratic loss of a connection. */
-		dt := f_est_dchan('23'O, 23, c_l3_payload);
+		dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 		/* simulate RLL REL IND */
 		f_ipa_tx(ts_RSL_REL_IND(dt.rsl_chan_nr, valueof(ts_RslLinkID_DCCH(0))));
@@ -7951,7 +7965,7 @@
 	var DchanTuples sdcch_cleanup := {};
 	var integer i;
 	for (i := 0; i < NUM_SDCCH_PER_BTS; i := i + 1) {
-		dt := f_est_dchan('23'O, i, c_l3_payload);
+		dt := f_est_dchan('23'O, i, gen_l3_valid_payload());
 		sdcch_cleanup := sdcch_cleanup & { dt };
 	}
 
@@ -8028,14 +8042,14 @@
 	 */
 	var DchanTuples chan_cleanup := {};
 	for (i := 0; i < NUM_SDCCH_PER_BTS; i := i+1) {
-		chan_cleanup := chan_cleanup & { f_est_dchan('13'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+		chan_cleanup := chan_cleanup & { f_est_dchan('13'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	}
 
 	/* Only the dyn TS is still available. Its first lchan gets converted to SDCCH8 */
-	chan_cleanup := chan_cleanup & { f_est_dchan_dyn('33'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+	chan_cleanup := chan_cleanup & { f_est_dchan_dyn('33'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	/* Also occupy the seven other SDCCH of the dyn TS */
 	for (i := 0; i < 7; i := i+1) {
-		chan_cleanup := chan_cleanup & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+		chan_cleanup := chan_cleanup & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	}
 
 	/* Clean up SDCCH lchans */
@@ -8089,7 +8103,7 @@
 	var DchanTuples chan_cleanup := {};
 	var OCT1 ra := '43'O; /* RA containing reason=originating speech call*/
 	for (i := 0; i < NUM_SDCCH_PER_BTS; i := i + 1) {
-		dt := f_est_dchan(ra, i, c_l3_payload);
+		dt := f_est_dchan(ra, i, gen_l3_valid_payload());
 		chan_cleanup := chan_cleanup & { dt };
 	}
 
@@ -8167,7 +8181,7 @@
 	var DchanTuples chan_cleanup := {};
 	var integer i;
 	for (i := 0; i < NUM_SDCCH_PER_BTS; i := i + 1) {
-		dt := f_est_dchan('23'O, i, c_l3_payload);
+		dt := f_est_dchan('23'O, i, gen_l3_valid_payload());
 		chan_cleanup := chan_cleanup & { dt };
 	}
 
@@ -9207,6 +9221,7 @@
 	var integer i;
 	var integer chreq_total, chreq_nochan;
 	var RSL_Message rx_rsl;
+	var octetstring l3_payload := gen_l3_valid_payload();
 
 	f_init(1);
 	f_sleep(1.0);
@@ -9226,11 +9241,11 @@
 
 	/* Send EST IND for the first TCH, so we get to test the RR release cause */
 	var RslChannelNr first_tch := valueof(t_RslChanNr_Bm(1));
-	f_ipa_tx(ts_RSL_EST_IND(first_tch, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(first_tch, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
 	/* Accept BSSAP conn, so we get to test the Clear Request cause */
 	var BSSAP_N_CONNECT_ind rx_c_ind;
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) -> value rx_c_ind;
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) -> value rx_c_ind;
 	var integer sccp_conn_id := rx_c_ind.connectionId;
 	BSSAP.send(ts_BSSAP_CONNECT_res(rx_c_ind.connectionId));
 
@@ -9615,7 +9630,7 @@
 	 * NOTE: only 3 SDCCH/4 channels are available on CCCH+SDCCH4+CBCH */
 	for (var integer i := 0; i < 3; i := i + 1) {
 		/* Establish a dedicated channel, so we can trigger (late) TCH assignment */
-		var DchanTuple dt := f_est_dchan(f_rnd_ra_cs(), 23, c_l3_payload);
+		var DchanTuple dt := f_est_dchan(f_rnd_ra_cs(), 23, gen_l3_valid_payload());
 
 		/* Send a BSSMAP Assignment Command, expect CHANnel ACTIVation */
 		BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ass_cmd));
@@ -9681,7 +9696,7 @@
 	var DchanTuple dt;
 
 	/* Establish a dedicated channel, so we can trigger handover */
-	dt := f_est_dchan(f_rnd_ra_cs(), 23, c_l3_payload);
+	dt := f_est_dchan(f_rnd_ra_cs(), 23, gen_l3_valid_payload());
 	f_sleep(0.5);
 
 	/* Trigger handover from BTS0 to BTS1 */
@@ -11022,6 +11037,7 @@
 testcase TC_imm_ass_post_chan_ack() runs on test_CT {
 	var RSL_Message chan_act;
 	var RSL_Message imm_ass;
+	var octetstring l3_payload := gen_l3_valid_payload();
 
 	f_init(1, false);
 	f_sleep(1.0);
@@ -11054,10 +11070,10 @@
 			 chan_ident_ie.chan_ident.ch_desc.v.tsc);
 
 	/* Check that the lchan is working */
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
 	var BSSAP_N_CONNECT_ind rx_c_ind;
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) -> value rx_c_ind;
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) -> value rx_c_ind;
 	dt.sccp_conn_id := rx_c_ind.connectionId;
 	BSSAP.send(ts_BSSAP_CONNECT_res(rx_c_ind.connectionId));
 
@@ -11069,6 +11085,7 @@
 testcase TC_imm_ass_pre_chan_ack() runs on test_CT {
 	var RSL_Message chan_act;
 	var RSL_Message imm_ass;
+	var octetstring l3_payload := gen_l3_valid_payload();
 
 	f_init(1, false);
 	f_sleep(1.0);
@@ -11101,10 +11118,10 @@
 	f_ipa_tx(ts_RSL_CHAN_ACT_ACK(chan_nr, fn+10));
 
 	/* Check that the lchan is working */
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
 	var BSSAP_N_CONNECT_ind rx_c_ind;
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) -> value rx_c_ind;
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) -> value rx_c_ind;
 	dt.sccp_conn_id := rx_c_ind.connectionId;
 	BSSAP.send(ts_BSSAP_CONNECT_res(rx_c_ind.connectionId));
 
@@ -11116,6 +11133,7 @@
 testcase TC_imm_ass_pre_ts_ack() runs on test_CT {
 	var RSL_Message chan_act;
 	var RSL_Message imm_ass;
+	var octetstring l3_payload := gen_l3_valid_payload();
 
 	f_init(1, false);
 	f_sleep(1.0);
@@ -11148,10 +11166,10 @@
 	f_ipa_tx(ts_RSL_CHAN_ACT_ACK(chan_nr, fn+10));
 
 	/* Check that the lchan is working */
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
 	var BSSAP_N_CONNECT_ind rx_c_ind;
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) -> value rx_c_ind;
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) -> value rx_c_ind;
 	dt.sccp_conn_id := rx_c_ind.connectionId;
 	BSSAP.send(ts_BSSAP_CONNECT_res(rx_c_ind.connectionId));
 
@@ -11169,6 +11187,7 @@
 	f_init(1, false);
 	f_sleep(1.0);
 
+	var octetstring l3_payload := gen_l3_valid_payload();
 	var RslChannelNr chan_nr := valueof(t_RslChanNr_PDCH(6));
 	/* The BSC will activate the dynamic PDCH by default, so confirm that */
 	f_exp_ipa_rx(tr_RSL_CHAN_ACT_PDCH(chan_nr));
@@ -11216,10 +11235,10 @@
 	f_ipa_tx(ts_RSL_CHAN_ACT_ACK(chan_nr, fn+10));
 
 	/* Check that the lchan is working */
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
 	var BSSAP_N_CONNECT_ind rx_c_ind;
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) -> value rx_c_ind;
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) -> value rx_c_ind;
 	dt.sccp_conn_id := rx_c_ind.connectionId;
 	BSSAP.send(ts_BSSAP_CONNECT_res(rx_c_ind.connectionId));
 
@@ -11240,6 +11259,7 @@
 	f_init(1, false);
 	f_sleep(1.0);
 
+	var octetstring l3_payload := gen_l3_valid_payload();
 	var RslChannelNr chan_nr := valueof(t_RslChanNr_PDCH(6));
 	/* The BSC will activate the dynamic PDCH by default, so confirm that */
 	f_exp_ipa_rx(tr_RSL_CHAN_ACT_PDCH(chan_nr));
@@ -11288,10 +11308,10 @@
 			 chan_ident_ie.chan_ident.ch_desc.v.tsc);
 
 	/* Check that the lchan is working */
-	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	f_ipa_tx(ts_RSL_EST_IND(chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_payload));
 
 	var BSSAP_N_CONNECT_ind rx_c_ind;
-	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(c_l3_payload))) -> value rx_c_ind;
+	BSSAP.receive(tr_BSSAP_CONNECT_ind(?, ?, tr_BSSMAP_ComplL3(l3_payload))) -> value rx_c_ind;
 	dt.sccp_conn_id := rx_c_ind.connectionId;
 	BSSAP.send(ts_BSSAP_CONNECT_res(rx_c_ind.connectionId));
 
@@ -11567,7 +11587,7 @@
 	 */
 	var DchanTuples chan_cleanup := {};
 	for (i := 0; i < NUM_SDCCH_PER_BTS; i := i+1) {
-		chan_cleanup := chan_cleanup & { f_est_dchan('13'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+		chan_cleanup := chan_cleanup & { f_est_dchan('13'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	}
 
 	/* Since only bts 0 is connected, expecting all_allocated to become true for both bts 0 and the "global" bsc
@@ -11577,7 +11597,7 @@
 
 	/* Also fill up all remaining (TCH) channels */
 	for (i := 0; i < NUM_TCHF_PER_BTS + NUM_TCHH_PER_BTS; i := i+1) {
-		chan_cleanup := chan_cleanup & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+		chan_cleanup := chan_cleanup & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	}
 
 	/* All TCH are now also occupied */
@@ -11617,7 +11637,7 @@
 	 */
 	var DchanTuples chan_cleanup := {};
 	for (i := 0; i < NUM_SDCCH_PER_BTS; i := i+1) {
-		chan_cleanup := chan_cleanup & { f_est_dchan('13'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+		chan_cleanup := chan_cleanup & { f_est_dchan('13'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	}
 
 	/* The static SDCCH should now be occupied, while still 3x8 dynamic SDCCH potentially remain. So only
@@ -11627,11 +11647,11 @@
 	/* Request more SDCCH, hence convert the first dyn TS to SDCCH8.
 	 * Will release them later, so remember all the DchanTuples. */
 	var DchanTuples dyn_sddch := {};
-	dyn_sddch := dyn_sddch & { f_est_dchan_dyn('33'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+	dyn_sddch := dyn_sddch & { f_est_dchan_dyn('33'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 
 	/* Also occupy the seven other SDCCH of the dyn TS */
 	for (i := 0; i < 7; i := i+1) {
-		dyn_sddch := dyn_sddch & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+		dyn_sddch := dyn_sddch & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	}
 
 	/* Now all dynamic SDCCH are also occupied, so for the first time all_allocated:sdcch will trigger... */
@@ -11639,7 +11659,7 @@
 
 	/* occupy the remaining TCH, three TCH/F and two TCH/H lchans */
 	for (i := 0; i < 5; i := i+1) {
-		chan_cleanup := chan_cleanup & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, c_l3_payload) };
+		chan_cleanup := chan_cleanup & { f_est_dchan('33'O, NUM_SDCCH_PER_BTS + i, gen_l3_valid_payload()) };
 	}
 
 	/* All TCH lchans are now also occupied, both static and dynamic */
@@ -11713,7 +11733,7 @@
 
 	/* Expect the BSC to allocate 4 x TCH/F channels on BTS2/TRX0 */
 	for (var integer i := 0; i < 4; i := i + 1) {
-		var DchanTuple dt := f_est_dchan('23'O, 23, c_l3_payload, {2, 0});
+		var DchanTuple dt := f_est_dchan('23'O, 23, gen_l3_valid_payload(), {2, 0});
 		f_TC_chan_alloc_algo(dt, {2, 0});
 		f_perform_clear_test_ct(dt);
 	}
@@ -11736,7 +11756,7 @@
 
 	/* Expect the BSC to allocate 5 x TCH/F channels on BTS2/TRX3 */
 	for (var integer i := 0; i < 5; i := i + 1) {
-		var DchanTuple dt := f_est_dchan('23'O, 23, c_l3_payload, {2, 0});
+		var DchanTuple dt := f_est_dchan('23'O, 23, gen_l3_valid_payload(), {2, 0});
 		f_TC_chan_alloc_algo(dt, {2, 3});
 		f_perform_clear_test_ct(dt);
 	}
@@ -11765,12 +11785,12 @@
 	var DchanTuple dt;
 
 	f_logp(BSCVTY, "Case a) Unknown Uplink RxLev, fall-back to ascending");
-	dt := f_est_dchan('23'O, 23, c_l3_payload, TRX0);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload(), TRX0);
 	f_TC_chan_alloc_algo(dt, TRX0);
 	f_perform_clear_test_ct(dt);
 
 	f_logp(BSCVTY, "Case b) Not enough RxLev samples, use ascending");
-	dt := f_est_dchan('23'O, 23, c_l3_payload, TRX0);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload(), TRX0);
 	f_ipa_tx(ts_RSL_MEAS_RES_EMPTY(dt.rsl_chan_nr, 0,
 				       ts_RSL_IE_UplinkMeas(30, 0),
 				       ts_RSL_IE_BS_Power(0)), TRX0);
@@ -11779,7 +11799,7 @@
 	f_perform_clear_test_ct(dt);
 
 	f_logp(BSCVTY, "Case c) Uplink RxLev below the threshold, use ascending");
-	dt := f_est_dchan('23'O, 23, c_l3_payload, TRX0);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload(), TRX0);
 	f_ipa_tx(ts_RSL_MEAS_RES_EMPTY(dt.rsl_chan_nr, 0,
 				       ts_RSL_IE_UplinkMeas(45, 0),
 				       ts_RSL_IE_BS_Power(0)), TRX0);
@@ -11791,7 +11811,7 @@
 	f_perform_clear_test_ct(dt);
 
 	f_logp(BSCVTY, "Case d) Uplink RxLev above the threshold, use descending");
-	dt := f_est_dchan('23'O, 23, c_l3_payload, TRX0);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload(), TRX0);
 	f_ipa_tx(ts_RSL_MEAS_RES_EMPTY(dt.rsl_chan_nr, 0,
 				       ts_RSL_IE_UplinkMeas(50, 0),
 				       ts_RSL_IE_BS_Power(0)), TRX0);
@@ -11807,7 +11827,7 @@
 	f_vty_transceive(BSCVTY, "end");
 
 	f_logp(BSCVTY, "Case e) Uplink RxLev above the threshold, but C0 load is not");
-	dt := f_est_dchan('23'O, 23, c_l3_payload, TRX0);
+	dt := f_est_dchan('23'O, 23, gen_l3_valid_payload(), TRX0);
 	f_ipa_tx(ts_RSL_MEAS_RES_EMPTY(dt.rsl_chan_nr, 0,
 				       ts_RSL_IE_UplinkMeas(50, 0),
 				       ts_RSL_IE_BS_Power(0)), TRX0);
diff --git a/bsc/BSC_Tests_CBSP.ttcn b/bsc/BSC_Tests_CBSP.ttcn
index ae77ac8..3f1eff0 100644
--- a/bsc/BSC_Tests_CBSP.ttcn
+++ b/bsc/BSC_Tests_CBSP.ttcn
@@ -1005,7 +1005,7 @@
 	cell_list := ts_BSSMAP_CIL_CGI({bssmap_cgi(mp_cgi_bts0)});
 
 	/* first establish a dedicated channel */
-	var DchanTuple dt := f_est_dchan('23'O, 23, c_l3_payload);
+	var DchanTuple dt := f_est_dchan('23'O, 23, gen_l3_valid_payload());
 
 	/* then send ETWS PN */
 	f_cbsp_write_emerg(g_cbsp_msg_id, g_cbsp_ser_no, cell_list);
diff --git a/bsc/BSC_Tests_VAMOS.ttcn b/bsc/BSC_Tests_VAMOS.ttcn
index 3ebcaaa..1dc4910 100644
--- a/bsc/BSC_Tests_VAMOS.ttcn
+++ b/bsc/BSC_Tests_VAMOS.ttcn
@@ -280,12 +280,12 @@
 private function f_verify_dtap() runs on MSC_ConnHdlr
 {
 	var PDU_BSSAP rx_bssap_dtap;
-	var octetstring l3_data;
+	var octetstring l3_data := gen_l3_valid_payload();
 
 	/* MS to NW */
-	RSL.send(ts_RSL_DATA_IND(g_chan_nr, valueof(ts_RslLinkID_DCCH(0)), c_l3_payload));
+	RSL.send(ts_RSL_DATA_IND(g_chan_nr, valueof(ts_RslLinkID_DCCH(0)), l3_data));
 	BSSAP.receive(tr_BSSAP_DTAP) -> value rx_bssap_dtap;
-	if (not match(rx_bssap_dtap.pdu.dtap, c_l3_payload)) {
+	if (not match(rx_bssap_dtap.pdu.dtap, l3_data)) {
 		setverdict(fail, "unexpected L3 data");
 		mtc.stop;
 	}