Harald Welte | a49e36e | 2018-01-21 19:29:33 +0100 | [diff] [blame] | 1 | module BSC_ConnectionHandler { |
| 2 | |
| 3 | import from General_Types all; |
| 4 | import from Osmocom_Types all; |
| 5 | import from GSM_Types all; |
| 6 | import from SCCPasp_Types all; |
| 7 | import from BSSAP_Types all; |
| 8 | import from BSSMAP_Emulation all; |
| 9 | import from BSSMAP_Templates all; |
| 10 | |
| 11 | import from GSUP_Types all; |
| 12 | import from GSUP_Emulation all; |
| 13 | |
| 14 | import from MNCC_Types all; |
| 15 | import from MNCC_Emulation all; |
| 16 | |
| 17 | import from MobileL3_Types all; |
| 18 | import from MobileL3_CommonIE_Types all; |
| 19 | import from MobileL3_MM_Types all; |
| 20 | import from L3_Templates all; |
| 21 | |
| 22 | /* this component represents a single subscriber connection */ |
| 23 | type component BSC_ConnHdlr extends BSSAP_ConnHdlr, MNCC_ConnHdlr, GSUP_ConnHdlr { |
| 24 | var BSC_ConnHdlrPars g_pars; |
| 25 | } |
| 26 | |
| 27 | type record BSC_ConnHdlrPars { |
| 28 | SCCP_PAR_Address sccp_addr_own, |
| 29 | SCCP_PAR_Address sccp_addr_peer, |
| 30 | BSSMAP_IE_CellIdentifier cell_id, |
Harald Welte | 256571e | 2018-01-24 18:47:19 +0100 | [diff] [blame^] | 31 | hexstring imei, |
Harald Welte | a49e36e | 2018-01-21 19:29:33 +0100 | [diff] [blame] | 32 | hexstring imsi, |
Harald Welte | 8260057 | 2018-01-21 20:54:08 +0100 | [diff] [blame] | 33 | hexstring msisdn, |
Harald Welte | 256571e | 2018-01-24 18:47:19 +0100 | [diff] [blame^] | 34 | OCT4 tmsi optional, |
Harald Welte | 8260057 | 2018-01-21 20:54:08 +0100 | [diff] [blame] | 35 | BSSMAP_IE_ClassmarkInformationType2 cm2, |
| 36 | BSSMAP_IE_ClassmarkInformationType3 cm3 optional |
Harald Welte | a49e36e | 2018-01-21 19:29:33 +0100 | [diff] [blame] | 37 | }; |
| 38 | |
| 39 | |
| 40 | /* Callback function from general BSSMAP_Emulation whenever a connectionless |
| 41 | * BSSMAP message arrives. Canreturn a PDU_BSSAPthat should be sent in return */ |
| 42 | private function BscUnitdataCallback(PDU_BSSAP bssap) |
| 43 | runs on BSSMAP_Emulation_CT return template PDU_BSSAP { |
| 44 | var template PDU_BSSAP resp := omit; |
| 45 | |
| 46 | log("BSSMAP_BscUnitdataCallback"); |
| 47 | /* answer all RESET with RESET ACK */ |
| 48 | if (match(bssap, tr_BSSMAP_Reset)){ |
| 49 | log("BSSMAP_BscUnitdataCallback: Responding to RESET with RESET-ACK"); |
| 50 | resp := ts_BSSMAP_ResetAck; |
| 51 | } |
| 52 | |
| 53 | /* FIXME: Handle paging, etc. */ |
| 54 | return resp; |
| 55 | } |
| 56 | |
| 57 | const BssmapOps BSC_BssmapOps := { |
| 58 | /* Create call-back for inbound connections from MSC (hand-over) */ |
| 59 | create_cb := refers(BSSMAP_Emulation.ExpectedCreateCallback), |
| 60 | unitdata_cb := refers(BscUnitdataCallback), |
| 61 | decode_dtap := true, |
| 62 | role_ms := true |
| 63 | } |
| 64 | |
| 65 | |
| 66 | private function MnccUnitdataCallback(MNCC_PDU mncc) |
| 67 | runs on MNCC_Emulation_CT return template MNCC_PDU { |
| 68 | log("Ignoring MNCC", mncc); |
| 69 | return omit; |
| 70 | } |
| 71 | |
| 72 | const MnccOps BCC_MnccOps := { |
| 73 | create_cb := refers(MNCC_Emulation.ExpectedCreateCallback), |
| 74 | unitdata_cb := refers(MnccUnitdataCallback) |
| 75 | } |
| 76 | |
| 77 | |
| 78 | |
| 79 | template BSSAP_Conn_Req ts_BSSAP_Conn_Req(SCCP_PAR_Address peer, SCCP_PAR_Address own, PDU_BSSAP bssap) := { |
| 80 | addr_peer := peer, |
| 81 | addr_own := own, |
| 82 | bssap := bssap |
| 83 | }; |
| 84 | |
Harald Welte | a49e36e | 2018-01-21 19:29:33 +0100 | [diff] [blame] | 85 | /* Encode 'l3' and ask BSSMAP_Emulation to create new connection with COMPL L3 INFO */ |
| 86 | function f_bssap_compl_l3(PDU_ML3_MS_NW l3) |
| 87 | runs on BSC_ConnHdlr { |
| 88 | log("Sending COMPL L3: ", l3); |
| 89 | var octetstring l3_enc := enc_PDU_ML3_MS_NW(l3); |
| 90 | BSSAP.send(ts_BSSAP_Conn_Req(g_pars.sccp_addr_peer, g_pars.sccp_addr_own, |
| 91 | valueof(ts_BSSMAP_ComplL3(g_pars.cell_id, l3_enc)))); |
Harald Welte | 71b6933 | 2018-01-21 20:43:53 +0100 | [diff] [blame] | 92 | alt { |
| 93 | [] BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_CONF_IND) {} |
| 94 | [] BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND) { |
| 95 | setverdict(fail, "DISC.ind from SCCP"); |
| 96 | self.stop; |
| 97 | } |
| 98 | } |
Harald Welte | a49e36e | 2018-01-21 19:29:33 +0100 | [diff] [blame] | 99 | } |
| 100 | |
| 101 | /* helper function to fully establish a dedicated channel */ |
| 102 | function f_establish_fully(MobileIdentityLV mi, boolean expect_auth) |
| 103 | runs on BSC_ConnHdlr { |
| 104 | var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ('0001'B, mi)); |
| 105 | var PDU_DTAP_MT dtap_mt; |
| 106 | |
| 107 | /* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */ |
| 108 | f_bssap_compl_l3(l3_info); |
| 109 | |
| 110 | if (expect_auth) { |
| 111 | /* FIXME */ |
| 112 | } |
| 113 | BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_ACC)); |
| 114 | } |
| 115 | |
| 116 | /* build a PDU_ML3_MS_NW containing a Location Update by IMSI */ |
| 117 | function f_build_lu_imsi(hexstring imsi) return PDU_ML3_MS_NW |
| 118 | { |
| 119 | var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(imsi)); |
| 120 | return f_build_lu(mi); |
| 121 | } |
Harald Welte | ba7b6d9 | 2018-01-23 21:32:34 +0100 | [diff] [blame] | 122 | function f_build_lu_imei(hexstring imei) return PDU_ML3_MS_NW |
| 123 | { |
| 124 | var MobileIdentityLV mi := valueof(ts_MI_IMEI_LV(imei)); |
| 125 | return f_build_lu(mi); |
| 126 | } |
| 127 | function f_build_lu_tmsi(OCT4 tmsi) return PDU_ML3_MS_NW |
| 128 | { |
| 129 | var MobileIdentityLV mi := valueof(ts_MI_TMSI_LV(tmsi)); |
| 130 | return f_build_lu(mi); |
| 131 | } |
Harald Welte | a49e36e | 2018-01-21 19:29:33 +0100 | [diff] [blame] | 132 | private function f_build_lu(MobileIdentityLV mi) return PDU_ML3_MS_NW |
| 133 | { |
| 134 | var LocationAreaIdentification_V old_lai := { '62F220'O, '9999'O }; |
| 135 | var PDU_ML3_MS_NW l3_info := valueof(ts_ML3_MO_LU_Req(valueof(ts_ML3_IE_LuType_Attach), |
| 136 | old_lai, mi, valueof(ts_CM1))); |
| 137 | return l3_info; |
| 138 | } |
| 139 | |
Harald Welte | cf66d5a | 2018-01-23 19:24:28 +0100 | [diff] [blame] | 140 | type record AuthVector { |
| 141 | OCT16 rand, |
| 142 | OCT4 sres, |
| 143 | OCT8 kc |
| 144 | /* FIXME: 3G elements */ |
| 145 | } |
| 146 | |
| 147 | private function f_rnd_oct(integer len) return octetstring { |
| 148 | var integer i; |
| 149 | var octetstring res; |
| 150 | for (i := 0; i < len; i := i + 1) { |
| 151 | res[i] := int2oct(float2int(rnd()*256.0), 1); |
| 152 | } |
| 153 | return res; |
| 154 | } |
| 155 | |
| 156 | function f_gen_auth_vec_2g() return AuthVector { |
| 157 | var AuthVector vec; |
| 158 | vec.rand := f_rnd_oct(16); |
| 159 | vec.sres := f_rnd_oct(4); |
| 160 | vec.kc := f_rnd_oct(8); |
| 161 | return vec; |
| 162 | } |
| 163 | |
Harald Welte | 8a121b3 | 2018-01-22 03:00:41 +0100 | [diff] [blame] | 164 | function f_perform_lu(boolean expect_auth, boolean expect_tmsi, boolean send_early_cm) |
Harald Welte | a49e36e | 2018-01-21 19:29:33 +0100 | [diff] [blame] | 165 | runs on BSC_ConnHdlr { |
| 166 | var PDU_ML3_MS_NW l3_lu := f_build_lu_imsi(g_pars.imsi) |
| 167 | var PDU_DTAP_MT dtap_mt; |
| 168 | |
| 169 | /* tell GSUP dispatcher to send this IMSI to us */ |
| 170 | f_create_gsup_expect(hex2str(g_pars.imsi)); |
| 171 | |
| 172 | /* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */ |
| 173 | f_bssap_compl_l3(l3_lu); |
| 174 | |
Harald Welte | 8a121b3 | 2018-01-22 03:00:41 +0100 | [diff] [blame] | 175 | if (send_early_cm) { |
| 176 | BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3)); |
| 177 | } |
Harald Welte | 5c2622c | 2018-01-21 20:45:20 +0100 | [diff] [blame] | 178 | |
Harald Welte | a49e36e | 2018-01-21 19:29:33 +0100 | [diff] [blame] | 179 | if (expect_auth) { |
Harald Welte | cf66d5a | 2018-01-23 19:24:28 +0100 | [diff] [blame] | 180 | var AuthVector vec := f_gen_auth_vec_2g(); |
| 181 | var GSUP_IE auth_tuple := valueof(ts_GSUP_IE_AuthTuple2G(vec.rand, vec.sres, vec.kc)); |
Harald Welte | ef9fa87 | 2018-01-22 03:00:17 +0100 | [diff] [blame] | 182 | GSUP.receive(tr_GSUP_SAI_REQ(g_pars.imsi)); |
Harald Welte | 7b1b281 | 2018-01-22 21:23:06 +0100 | [diff] [blame] | 183 | GSUP.send(ts_GSUP_SAI_RES(g_pars.imsi, auth_tuple)); |
| 184 | |
Harald Welte | cf66d5a | 2018-01-23 19:24:28 +0100 | [diff] [blame] | 185 | BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_MM_AUTH_REQ(vec.rand))); |
| 186 | BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MT_MM_AUTH_RESP_2G(vec.sres))); |
Harald Welte | a49e36e | 2018-01-21 19:29:33 +0100 | [diff] [blame] | 187 | } |
| 188 | |
| 189 | /* Expect MSC to perform LU with HLR */ |
| 190 | GSUP.receive(tr_GSUP_UL_REQ(g_pars.imsi)); |
| 191 | GSUP.send(ts_GSUP_ISD_REQ(g_pars.imsi, g_pars.msisdn)); |
| 192 | GSUP.receive(tr_GSUP_ISD_RES(g_pars.imsi)); |
| 193 | GSUP.send(ts_GSUP_UL_RES(g_pars.imsi)); |
| 194 | |
| 195 | alt { |
| 196 | [] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Acc)) -> value dtap_mt { |
| 197 | var PDU_ML3_LocationUpdateAccept lu_acc := dtap_mt.dtap.msgs.mm.locationUpdateAccept; |
| 198 | if (expect_tmsi) { |
| 199 | if (not ispresent(lu_acc.mobileIdentityTLV) or |
| 200 | not ischosen(lu_acc.mobileIdentityTLV.mobileIdentityLV.mobileIdentityV.oddEvenInd_identity.tmsi_ptmsi)) { |
| 201 | setverdict(fail, "Expected TMSI but no TMSI was allocated"); |
| 202 | self.stop; |
| 203 | } else { |
Harald Welte | 256571e | 2018-01-24 18:47:19 +0100 | [diff] [blame^] | 204 | g_pars.tmsi := lu_acc.mobileIdentityTLV.mobileIdentityLV.mobileIdentityV.oddEvenInd_identity.tmsi_ptmsi.octets; |
Harald Welte | a49e36e | 2018-01-21 19:29:33 +0100 | [diff] [blame] | 205 | BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_TmsiRealloc_Cmpl)); |
| 206 | } |
| 207 | } else { |
| 208 | if (ispresent(lu_acc.mobileIdentityTLV) and |
| 209 | ischosen(lu_acc.mobileIdentityTLV.mobileIdentityLV.mobileIdentityV.oddEvenInd_identity.tmsi_ptmsi)) { |
| 210 | setverdict(fail, "Expected no TMSI but TMSI was allocated"); |
| 211 | self.stop; |
| 212 | } |
| 213 | } |
| 214 | } |
| 215 | [] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) { |
| 216 | setverdict(fail, "Expected LU ACK, but received LU REJ"); |
| 217 | self.stop; |
| 218 | } |
| 219 | } |
| 220 | /* FIXME: there could be pending SMS or other common procedures by the MSC, let's ignore them */ |
| 221 | BSSAP.receive(tr_BSSMAP_ClearCommand); |
| 222 | BSSAP.send(ts_BSSMAP_ClearComplete); |
| 223 | BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND); |
| 224 | setverdict(pass); |
| 225 | } |
| 226 | |
| 227 | function f_foo() runs on BSC_ConnHdlr{ |
| 228 | /* SCCP CC handled by BSSMAP_Emulation_CT.main() */ |
| 229 | /* Expect auth, if enabled */ |
| 230 | |
| 231 | /* TODO: ISD */ |
| 232 | /* Expect encr, if enabled */ |
| 233 | /* Expect encr, if enabled */ |
| 234 | /* Expect ASS CMD, if chan_type != requested */ |
| 235 | /* Send ASS CMPL in successful case */ |
| 236 | |
| 237 | /* Expect AoIP port/ip information for RTP stream */ |
| 238 | /* Expect MSC-originated MGCP to our simulated MGW */ |
| 239 | /* Verify Counters via CTRL */ |
| 240 | /* re-configure MSC behaviour via VTY */ |
| 241 | } |
| 242 | |
| 243 | |
| 244 | |
| 245 | |
| 246 | |
| 247 | } |
| 248 | |
| 249 | |