Review TC_5GNAS_AMF_AUT_REQ_02 (1738e681) · Commits · INT - Core Network and Interoperability Testing / 5G Core / NAS

captures/TC_5GNAS_AMF_AUT_REQ_02.pcap

−1.43 KiB (4.48 KiB)

File changed.

No diff preview for this file type.

ttcn/Ats_NG_NAS/NG_NAS_Steps.ttcn

+9 −5

Changes for ttcn/Ats_NG_NAS/NG_NAS_Steps.ttcn: 9 added lines, 5 removed lines.
Original line number	Diff line number	Diff line
		@@ -126,14 +126,18 @@ module NG_NAS_Steps {
		}
		} // End of function f_NG_NAS_amf_UE_Authentication

		function f_NG_NAS_amf_UE_Authentication_with_invalid_response() runs on aMF_NGNAS_NGAPComponent {
		log(">>> f_NG_NAS_amf_UE_Authentication_with_invalid_response");
		/**
		* @desc Trigger of TC_5GNAS_AMF_AUT_REQ_02: AUTHENTICATION RESPONSE with a wrong RES* (offline: read from the
		* capture). The AUTHENTICATION REQUEST was received before (f_await_authentication_request).
		*/
		function f_NG_NAS_amf_UE_AuthenticationResponse_with_invalid_res() runs on aMF_NGNAS_NGAPComponent {
		log(">>> f_NG_NAS_amf_UE_AuthenticationResponse_with_invalid_res");
		if (PICS_OFFLINE_MODE) {
		f_await_authentication_request_await_authentication_reject();
		f_await_authentication_response();
		} else {
		f_await_authentication_request_send_authentication_response_with_invalid_response();
		f_send_authentication_response_with_invalid_res();
		}
		} // End of function f_NG_NAS_amf_UE_Authentication
		} // End of function f_NG_NAS_amf_UE_AuthenticationResponse_with_invalid_res

		function f_NG_NAS_amf_UE_SecurityMode() runs on aMF_NGNAS_NGAPComponent {
		log(">>> f_NG_NAS_amf_UE_SecurityMode");

ttcn/Ats_NG_NAS/NG_NAS_TCFunctions.ttcn

+23 −8

Changes for ttcn/Ats_NG_NAS/NG_NAS_TCFunctions.ttcn: 23 added lines, 8 removed lines.
Original line number	Diff line number	Diff line
		@@ -129,46 +129,61 @@ module NG_NAS_TCFunctions {

		/**
		* @desc Testcase function for TC_5GNAS_AMF_AUT_REQ_02
		* @see TP_5GNAS_AMF_AUT_REQ_02: after an initial REGISTRATION REQUEST with a SUCI and the AUTHENTICATION
		* REQUEST, an AUTHENTICATION RESPONSE with a wrong RES* is answered by a plain AUTHENTICATION REJECT.
		*/
		function f_TC_5GNAS_AMF_AUT_REQ_02() runs on aMF_NGNAS_NGAPComponent {
		// Local variables
		var NG_NAS_DL_Message_Type v_message;

		// Preamble
		// Preamble: NG SETUP, initial REGISTRATION REQUEST with the SUCI, AUTHENTICATION REQUEST
		f_NGNAS_amf_init();
		f_NG_NAS_amf_UE_Register();
		f_await_authentication_request();
		f_selfOrClientSyncAndVerdict(c_prDone, f_getVerdict());
		log("* " & __SCOPE__ & ": INFO: Preamble done. *");

		// Test Body
		f_NG_NAS_amf_UE_Authentication_with_invalid_response();

		f_NG_NAS_amf_UE_AuthenticationResponse_with_invalid_res();
		f_recv_NGAP_PDU(
		mw_ngap_initMsg(
		mw_n2_DownlinkNASTransport(
		vc_AMF_UE_ID,
		vc_RAN_UE_ID,
		? // AuthorizationReject
		? // AuthenticationReject
		)));
		f_NASPDU_Get(vc_recvNGAP_PDU);
		var NG_NAS_DL_Message_Type v_message;
		if (f_Check_5GAKA_NAS_DL_Message(
		vc_recvNAS_PDU,
		mw_NG_AUTHENTICATION_REJECT,
		mw_NG_AUTHENTICATION_REJECT(omit), // 5G AKA: no EAP message
		vc_ng_nas_security_params_type,
		vc_previous_nas_count_dl,
		v_message,
		vc_inner_message
		) == false) {
		log("* " & __SCOPE__ & ": FAIL: NG_AUTHENTICATION_REJECT mismatch. *");
		setverdict(fail);
		setverdict(fail, "* " & __SCOPE__ & ": FAIL: plain AUTHENTICATION REJECT without EAP message expected *");
		} else {
		log("* " & __SCOPE__ & ": PASS: Expected NG_AUTHENTICATION_REJECT *");
		setverdict(pass);
		}
		// The IUT releases the UE context right after the AUTHENTICATION REJECT: the UE CONTEXT RELEASE COMMAND
		// is received before the synchronisation, where a_defaultNGAP would discard it (not checked, see the TP)
		f_recv_NGAP_PDU(mw_ngap_initMsg_anyProcedure(id_UEContextRelease));
		f_selfOrClientSyncAndVerdict(c_tbDone, f_getVerdict());
		log("* " & __SCOPE__ & ": INFO: Testbody done. *");

		// Postamble
		// Postamble: UE CONTEXT RELEASE COMPLETE
		if (PICS_OFFLINE_MODE) {
		f_recv_NGAP_PDU(mw_ngap_succMsg_anyProcedure(id_UEContextRelease));
		} else {
		f_send_NGAP_PDU(
		m_ngap_succMsg(
		f_m_n2_UEContextReleaseComplete(
		vc_AMF_UE_ID,
		vc_RAN_UE_ID
		)));
		}
		f_postamble_NGAP_AMF();
		f_selfOrClientSyncAndVerdict(c_poDone, f_getVerdict());
		log("* " & __SCOPE__ & ": INFO: Postamble done. *");

ttcn/Ats_NG_NAS/NG_NAS_TestCases.ttcn

+2 −2

Changes for ttcn/Ats_NG_NAS/NG_NAS_TestCases.ttcn: 2 added lines, 2 removed lines.
Original line number	Diff line number	Diff line
		@@ -102,8 +102,8 @@ module NG_NAS_TestCases {
		var aMF_NGNAS_NGAPComponent v_ngnas_ngap_gnb;

		// Test control
		if (not PICS_NGNAS) {
		log("* " & __SCOPE__ & ": ERROR: 'PICS_NGNAS' shall be set to true for executing the TC. *");
		if (not PICS_NGNAS or not PICS_NAS_A4_1_2) {
		log("* " & __SCOPE__ & ": ERROR: 'PICS_NGNAS' and 'PICS_NAS_A4_1_2' shall be set to true for executing the TC. *");
		stop;
		}

ttcn/LibNGAP/lib_system/LibNGAP_Functions.ttcn

+32 −88

Changes for ttcn/LibNGAP/lib_system/LibNGAP_Functions.ttcn: 32 added lines, 88 removed lines.
Original line number	Diff line number	Diff line
		@@ -905,27 +905,27 @@ module LibNGAP_Functions {
		}

		/**
		* @brief Await the AUTHENTICATION REQUEST and answer with a wrong AUTHENTICATION RESPONSE (test system = UE).
		* @details Like f_await_authentication_request_send_authentication_response, but the RES is altered
		* before being sent, to test the rejection by the AMF.
		* @brief Await the AUTHENTICATION REQUEST (test system = UE) and keep what the AUTHENTICATION RESPONSE needs.
		* @details The AUTHENTICATION REQUEST is checked with f_Check_5GAKA_NAS_DL_Message (plain, RAND and AUTN
		* present); vc_ngKSI, vc_AMF_UE_ID and vc_RAN_UE_ID are taken from it. Online, RES* is computed
		* (f_5g_aka_compute_res_xres, vc_ng_nas_security_params_type.AuthParams.XRES).
		*/
		function f_await_authentication_request_send_authentication_response_with_invalid_response() runs on NGNASComponent {
		log(">>> f_await_authentication_request_send_authentication_response_with_invalid_response");
		function f_await_authentication_request() runs on NGNASComponent {
		log(">>> f_await_authentication_request");

		// Await request for DOWNLINK_NAS_TRANSPORT
		f_recv_NGAP_PDU(
		mw_ngap_initMsg(
		mw_n2_DownlinkNASTransport(
		?,
		vc_RAN_UE_ID,
		? // AuthorizationRequest
		? // AuthenticationRequest
		)));
		f_NASPDU_Get(vc_recvNGAP_PDU);
		var NG_NAS_DL_Message_Type v_message;
		if (f_Check_5GAKA_NAS_DL_Message(
		vc_recvNAS_PDU,
		mw_NG_AUTHENTICATION_REQUEST(
		?,//'100'B,
		?,
		-,
		mw_GMM_AuthRAND,
		mw_GSM_AUTN
		@@ -935,12 +935,7 @@ module LibNGAP_Functions {
		v_message,
		vc_inner_message
		) == false) {
		log("*** " & __SCOPE__ & ": FAIL: Unexpected NG_AUTHENTICATION_REQUEST");
		setverdict(fail, "*** " & __SCOPE__ & ": FAIL: Unexpected NG_AUTHENTICATION_REQUEST");
		}
		log("v_message: ", v_message);
		if (not(isbound(v_message))) {
		setverdict(fail, "*** " & __SCOPE__ & ": FAIL: Unbound inner message");
		return;
		}
		vc_ngKSI := v_message.authentication_Request.ngNasKeySetId.nasKeySetId;
		@@ -953,18 +948,28 @@ module LibNGAP_Functions {
		vc_RAN_UE_ID := vc_recvNGAP_PDU.initiatingMessage.value_.downlinkNASTransport.protocolIEs[1].value_.rAN_UE_NGAP_ID;
		log("vc_RAN_UE_ID: ", vc_RAN_UE_ID);

		if (not PICS_OFFLINE_MODE) {
		// Compute RES/XRES
		if (f_5g_aka_compute_res_xres(-, v_message.authentication_Request.rand.randValue, v_message.authentication_Request.autn.aUTN, v_message.authentication_Request.abba, fl_NasNN_MCC2PlmnId(PX_NAS_MCC, PX_NAS_MNC), -/oct2hex(PX_SUPI_DIGITS)/, px_IMSI_Def, vc_ng_nas_security_params_type) == false) {
		if (f_5g_aka_compute_res_xres(-, v_message.authentication_Request.rand.randValue, v_message.authentication_Request.autn.aUTN, v_message.authentication_Request.abba, fl_NasNN_MCC2PlmnId(PX_NAS_MCC, PX_NAS_MNC), -, px_IMSI_Def, vc_ng_nas_security_params_type) == false) {
		setverdict(fail, "*** " & __SCOPE__ & ": FAIL: Failed to compute RES/XRES");
		return;
		}
		}
		setverdict(pass, "Received AUTHENTICATION_REQUEST NAS message");
		} // End of function f_await_authentication_request

		// Send invalid response for AUTHENTICATION_RESPONSE
		vc_ng_nas_security_params_type.AuthParams.XRES := vc_ng_nas_security_params_type.AuthParams.XRES xor4b vc_ng_nas_security_params_type.AuthParams.XRES; // Invalidate the authentication response value by flipping all bits with the value of the 7th byte of XRES
		log("Invalidated XRES values: ", bit2oct(vc_ng_nas_security_params_type.AuthParams.XRES));
		/**
		* @brief Send an AUTHENTICATION RESPONSE with a wrong RES* (test system = UE), to test the rejection by the AMF.
		* @details The RES* computed by f_await_authentication_request is inverted bit by bit: the value sent differs
		* from the expected RES* in every bit, whatever the authentication vector.
		*/
		function f_send_authentication_response_with_invalid_res() runs on NGNASComponent {
		log(">>> f_send_authentication_response_with_invalid_res");

		var bitstring v_invalidRes := not4b vc_ng_nas_security_params_type.AuthParams.XRES;
		log("f_send_authentication_response_with_invalid_res: RES* ", bit2oct(vc_ng_nas_security_params_type.AuthParams.XRES), ", sent ", bit2oct(v_invalidRes));
		vt_NgNasUl_Msg := m_NG_AUTHENTICATION_RESPONSE(
		{ iei := '2d'O, iel := '10'O, res := vc_ng_nas_security_params_type.AuthParams.XRES }
		{ iei := '2d'O, iel := '10'O, res := v_invalidRes }
		);
		vc_sendNAS_PDU := bit2oct(encvalue(valueof(vt_NgNasUl_Msg)));
		f_send_NGAP_PDU(
		@@ -978,85 +983,24 @@ module LibNGAP_Functions {
		m_nR_CGI,
		m_tAI
		)))));

		setverdict(pass, "Sent AUTHENTICATION_RESPONSE NAS message with invalid RES");
		}
		} // End of function f_send_authentication_response_with_invalid_res

		/**
		* @brief Await the AUTHENTICATION REQUEST, then the AUTHENTICATION REJECT.
		* @details The AUTHENTICATION REQUEST is checked with f_Check_5GAKA_NAS_DL_Message (RAND and AUTN
		* present); vc_ngKSI, vc_AMF_UE_ID and vc_RAN_UE_ID are taken from it.
		* The AUTHENTICATION REJECT, a downlink message (TS 24.501 clause 8.2.5), is awaited in a
		* DOWNLINK NAS TRANSPORT and checked with f_Check_5GAKA_NAS_DL_Message against
		* mw_NG_AUTHENTICATION_REJECT.
		* @brief Offline mode: read the AUTHENTICATION RESPONSE sent by the test system (UPLINK NAS TRANSPORT of the capture).
		* @details The message was sent by the test system, it is only read, not checked.
		*/
		function f_await_authentication_request_await_authentication_reject() runs on NGNASComponent {
		log(">>> f_await_authentication_request_await_authentication_reject");

		// Await request for DOWNLINK_NAS_TRANSPORT
		f_recv_NGAP_PDU(
		mw_ngap_initMsg(
		mw_n2_DownlinkNASTransport(
		?,
		vc_RAN_UE_ID,
		? // AuthorizationRequest
		)));
		var NG_NAS_DL_Message_Type v_message;
		if (f_Check_5GAKA_NAS_DL_Message(
		vc_recvNAS_PDU,
		mw_NG_AUTHENTICATION_REQUEST(
		?,//'100'B,
		-,
		mw_GMM_AuthRAND,
		mw_GSM_AUTN
		),
		vc_ng_nas_security_params_type,
		vc_previous_nas_count_dl,
		v_message,
		vc_inner_message
		) == false) {
		log("*** " & __SCOPE__ & ": FAIL: Unexpected NG_AUTHENTICATION_REQUEST");
		setverdict(fail, "*** " & __SCOPE__ & ": FAIL: Unexpected NG_AUTHENTICATION_REQUEST");
		}
		log("v_message: ", v_message);
		if (not(isbound(v_message))) {
		setverdict(fail, "*** " & __SCOPE__ & ": FAIL: Unbound inner message");
		return;
		}
		vc_ngKSI := v_message.authentication_Request.ngNasKeySetId.nasKeySetId;
		log("vc_ngKSI: ", vc_ngKSI);

		// Extract AMF_UE_NGAP_ID
		vc_AMF_UE_ID := vc_recvNGAP_PDU.initiatingMessage.value_.downlinkNASTransport.protocolIEs[0].value_.aMF_UE_NGAP_ID;
		log("vc_AMF_UE_ID: ", vc_AMF_UE_ID);
		// Extract RAN_UE_NGAP_ID
		vc_RAN_UE_ID := vc_recvNGAP_PDU.initiatingMessage.value_.downlinkNASTransport.protocolIEs[1].value_.rAN_UE_NGAP_ID;
		log("vc_RAN_UE_ID: ", vc_RAN_UE_ID);
		setverdict(pass, "Received AUTHENTICATION_REQUEST NAS message");
		function f_await_authentication_response() runs on NGNASComponent {
		log(">>> f_await_authentication_response");

		// Await the AUTHENTICATION_REJECT, sent by the AMF in a DOWNLINK NAS TRANSPORT
		f_recv_NGAP_PDU(
		mw_ngap_initMsg(
		mw_n2_DownlinkNASTransport(
		mw_n2_UplinkNASTransport(
		vc_AMF_UE_ID,
		vc_RAN_UE_ID,
		?
		vc_RAN_UE_ID
		)));
		f_NASPDU_Get(vc_recvNGAP_PDU);
		if (f_Check_5GAKA_NAS_DL_Message(
		vc_recvNAS_PDU,
		mw_NG_AUTHENTICATION_REJECT,
		vc_ng_nas_security_params_type,
		vc_previous_nas_count_dl,
		v_message,
		vc_inner_message
		) == false) {
		log("*** " & __SCOPE__ & ": FAIL: Unexpected NG_AUTHENTICATION_REJECT: ", v_message);
		setverdict(fail, "*** " & __SCOPE__ & ": FAIL: Unexpected NG_AUTHENTICATION_REJECT");
		return;
		}
		setverdict(pass, "Received AUTHENTICATION_REJECT NAS message");
		}
		log("f_await_authentication_response: AUTHENTICATION RESPONSE read");
		} // End of function f_await_authentication_response

		/**
		* @brief Offline mode: await the AUTHENTICATION REQUEST and the AUTHENTICATION RESPONSE.