Review TP_5GNAS_AMF_SEC_ACC_01 and TC_5GNAS_AMF_SEC_ACC_01 (f43090d2) · Commits · INT - Core Network and Interoperability Testing / 5G Core / NAS

captures/TC_5GNAS_AMF_SEC_ACC_01.pcap

0 → 100644

+5.3 KiB

File added.

No diff preview for this file type.

etc/Ats_NG_NAS/Ats_NG_NAS_AMF_open5gs.cfg_

+7 −2

Changes for etc/Ats_NG_NAS/Ats_NG_NAS_AMF_open5gs.cfg_: 7 added lines, 2 removed lines.
Original line number	Diff line number	Diff line
		@@ -16,6 +16,8 @@ NG_NAS_Pics.PICS_NAS_A4_1_2 := true # 5G AKA based primary authentication a
		NG_NAS_Pics.PICS_NAS_A4_1_2_2_1 := false # open5gs: AUTHENTICATION REJECT on #20 MAC failure, no identification (TC_5GNAS_AMF_AUT_REQ_04)
		NG_NAS_Pics.PICS_NAS_A4_1_2_3_1 := false # open5gs: AUTHENTICATION REJECT on #26 non-5G authentication unacceptable, no identification (TC_5GNAS_AMF_AUT_ABN_01)
		NG_NAS_Pics.PICS_NAS_A4_1_2_4 := true # open5gs re-authenticates on #71 ngKSI already in use (TC_5GNAS_AMF_AUT_REQ_05)
		NG_NAS_Pics.PICS_NAS_A4_2_1 := true # security mode control (TC_5GNAS_AMF_SEC_COM_01)
		NG_NAS_Pics.PICS_NAS_A4_2 := true # security mode control procedure (TC_5GNAS_AMF_SEC_ACC_01)

		LibNGAP_Pics.PICS_OFFLINE_MODE := false # true to use offline mode with pcap files, false to use online mode with real network functions
		LibNGAP_Pics.PICS_USE_OPEN5GS := false # true to start open5gs, false to not start them
		@@ -66,6 +68,9 @@ LibNGAP_Pixits.PX_OPEN5GS_BINARY_FILE := "/home/yann/dev/open5gs/build/tests/app
		# open5gs AMF: T3522 is 3 s (TS 24.501 default 6 s), TC_5GNAS_AMF_DRG_REQ_02
		Lib_NG_NAS_Pixits.PX_T3522 := 3.0
		Lib_NG_NAS_Pixits.PX_T3560 := 6.0 # open5gs AMF: T3560 is 6 s, 4 retransmissions (TC_5GNAS_AMF_AUT_REQ_03)
		# open5gs amf.security: integrity_order [NIA2, NIA1, NIA0], ciphering_order [NEA0, NEA1, NEA2], UE capabilities 'f0'O (TC_5GNAS_AMF_SEC_COM_01)
		Lib_NG_NAS_Pixits.PX_SELECTED_NAS_CIPHERING_ALGORITHM := '0000'B # 5G-EA0
		Lib_NG_NAS_Pixits.PX_SELECTED_NAS_INTEGRITY_ALGORITHM := '0010'B # 128-5G-IA2
		# HTTP upper tester (upper_tester_http, config/open5gs.toml): python3.13 -m upper_tester_http --config upper_tester_http/config/open5gs.toml
		# The network-initiated de-registrations of TC_5GNAS_AMF_DRG_REQ_01/02/03 (the UDM notifies the AMF)
		LibUpperTesterHttp_Pics.PICS_USE_UT_HTTP := true
		@@ -181,11 +186,11 @@ system.utHttpPort.params := "HTTP/TCP(server=127.0.0.1,port=12200,use_ssl=0,debu
		# Verify that the IUT sends a new AUTHENTICATION_REQUEST message with new ngKSI value to re-initiate the 5G AKA based primary authentication upon receipt of an AUTHENTICATION_FAILURE message indicating a 5GMM cause value #71 - ngKSI already in use
		#NG_NAS_TestCases.TC_5GNAS_AMF_AUT_REQ_05
		# Verify that the IUT sends an IDENTITY_REQUEST message to obtain the SUCI from the UE upon receipt of an AUTHENTICATION_FAILURE message indicating a 5GMM cause value #26 - non-5G authentication unacceptable
		NG_NAS_TestCases.TC_5GNAS_AMF_AUT_ABN_01
		#NG_NAS_TestCases.TC_5GNAS_AMF_AUT_ABN_01
		# Verify that the IUT sends a SECURITY MODE COMMAND message correctly to indicate NAS security mode procedure upon receipt of a NAS AUTHENTICATION RESPONSE
		#NG_NAS_TestCases.TC_5GNAS_AMF_SEC_COM_01
		# Verify that the IUT, upon receiving the NAS SECURITY MODE COMPLETE message after completing the NAS Authentication and Security procedure, successfully completes the registration process by accepting the registration
		#NG_NAS_TestCases.TC_5GNAS_AMF_SEC_ACC_01
		NG_NAS_TestCases.TC_5GNAS_AMF_SEC_ACC_01
		# Verify that the IUT, upon receiving the NAS SECURITY MODE REJECT Message after a failed NAS Authentication and security procedure, successfully aborts the registration process by rejecting the registration
		#NG_NAS_TestCases.TC_5GNAS_AMF_SEC_REJ_01
		#NG_NAS_TestCases.TC_5GNAS_AMF_DLN_ACC_01

test_purposes/TP_AMF_NGNAS.tdltx

+14 −3

Changes for test_purposes/TP_AMF_NGNAS.tdltx: 14 added lines, 3 removed lines.
Original line number	Diff line number	Diff line
		@@ -376,7 +376,17 @@ Package TP_AMF_NGNAS {

		Initial conditions
		with {
		the UE entity isNotRegisteredToAMF
		the UE entity isNotRegisteredToAMF and
		event AUTHENTICATION_REQUEST occurs and
		the IUT entity receives an UPLINK_NAS_TRANSPORT containing {
		NAS_PDU containing {
		extended_protocol_discriminator set to 5GS_MOBILITY_MANAGEMENT_MESSAGES,
		security_header_type set to NOT_SECURITY_PROTECTED,
		message_type set to AUTHENTICATION_RESPONSE,
		authentication_response_parameter containing {
		RES set to RV_RES_STAR}}} //!the valid RES*
		from the GNB entity and
		event SECURITY_MODE_COMMAND occurs
		}


		@@ -387,14 +397,15 @@ Package TP_AMF_NGNAS {
		NAS_PDU containing {
		extended_protocol_discriminator set to 5GS_MOBILITY_MANAGEMENT_MESSAGES,
		security_header_type set to INTEGRITY_PROTECTED_AND_CIPHERED_WITH_NEW_5G_NAS_SECURITY_CONTEXT,
		message_type set to SECURITY_MODE_COMPLETE}}
		message_type set to SECURITY_MODE_COMPLETE,
		NAS_message_container set to the complete REGISTRATION_REQUEST}} //!the initial REGISTRATION_REQUEST carried only cleartext IEs (ETSI TS 124 501 clause 4.4.6)
		from the GNB entity
		}
		then {
		the IUT entity sends a INITIAL_CONTEXT_SETUP_REQUEST containing {
		NAS_PDU containing {
		extended_protocol_discriminator set to 5GS_MOBILITY_MANAGEMENT_MESSAGES,
		security_header_type set to INTEGRITY_PROTECTED_AND_CIPHERED,
		security_header_type set to INTEGRITY_PROTECTED_AND_CIPHERED, //!with the new 5G NAS security context: MAC verified and message deciphered with its keys
		message_type set to REGISTRATION_ACCEPT,
		5GS_registration_result containing {
		5GS_registration_result_value set to 3GPP_ACCESS},

ttcn/Ats_NG_NAS/NG_NAS_Pics.ttcn

+6 −0

Changes for ttcn/Ats_NG_NAS/NG_NAS_Pics.ttcn: 6 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -52,6 +52,12 @@ module NG_NAS_Pics {
		*/
		modulepar boolean PICS_NAS_A4_2_1 := true;

		/**
		* @desc Does the IUT support the NAS security mode control procedure? (TS 24.501 clause 5.4.2)
		* @see ETSI TS 103 921-1 Table A.4 (PICS_NAS_A4_2)
		*/
		modulepar boolean PICS_NAS_A4_2 := true;

		} // End of group PICS_

		} // End of module NG_NAS_Pics
		No newline at end of file

ttcn/Ats_NG_NAS/NG_NAS_Steps.ttcn

+57 −0

Changes for ttcn/Ats_NG_NAS/NG_NAS_Steps.ttcn: 57 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -223,6 +223,63 @@ module NG_NAS_Steps {
		}
		} // End of function f_NG_NAS_amf_UE_AuthenticationResponse

		/**
		* @desc SECURITY MODE COMPLETE with the complete REGISTRATION REQUEST in its NAS message container, integrity
		* protected and ciphered with the new 5G NAS security context (offline: read from the capture). The SECURITY
		* MODE COMMAND was received before (f_await_security_mode_command).
		*/
		function f_NG_NAS_amf_UE_SecurityModeComplete() runs on aMF_NGNAS_NGAPComponent {
		if (PICS_OFFLINE_MODE) {
		f_await_security_mode_complete();
		} else {
		f_send_security_mode_complete();
		}
		} // End of function f_NG_NAS_amf_UE_SecurityModeComplete

		/**
		* @desc Does the TAI list of a REGISTRATION ACCEPT contain the TAI p_plmnId/p_tac? (TS 24.501 clause 9.11.3.9: type 00
		* lists TACs of one PLMN, type 01 consecutive TACs of one PLMN starting from a TAC, type 10 TAIs)
		*/
		function f_NG_NAS_taiListContains(
		in NG_TrackingAreaIdList p_taiList,
		in NAS_PlmnId p_plmnId,
		in O3_Type p_tac
		) return boolean {
		for (var integer i := 0; i < lengthof(p_taiList.lvPart.listOfPartialTais); i := i + 1) {
		var NG_ListOfPartialTaiList v_list := p_taiList.lvPart.listOfPartialTais[i];
		if (ischosen(v_list.partialTaiList.type0List)) {
		for (var integer j := 0; j < lengthof(v_list.partialTaiList.type0List); j := j + 1) {
		if (v_list.partialTaiList.type0List[j].plmnId == p_plmnId) {
		for (var integer k := 0; k < lengthof(v_list.partialTaiList.type0List[j].tacList); k := k + 1) {
		if (v_list.partialTaiList.type0List[j].tacList[k] == p_tac) {
		return true;
		}
		}
		}
		}
		} else if (ischosen(v_list.partialTaiList.type1List)) {
		for (var integer j := 0; j < lengthof(v_list.partialTaiList.type1List); j := j + 1) {
		var NG_PartialTai v_first := v_list.partialTaiList.type1List[j].partialTac;
		var integer v_offset := oct2int(p_tac) - oct2int(v_first.tac);
		// numberOfElements: number of TAIs minus 1
		if ((v_first.plmnId == p_plmnId) and (v_offset >= 0) and (v_offset <= bit2int(v_list.numberOfElements))) {
		return true;
		}
		}
		} else if (ischosen(v_list.partialTaiList.type2List)) {
		for (var integer j := 0; j < lengthof(v_list.partialTaiList.type2List); j := j + 1) {
		for (var integer k := 0; k < lengthof(v_list.partialTaiList.type2List[j].plmnAndTacs); k := k + 1) {
		if ((v_list.partialTaiList.type2List[j].plmnAndTacs[k].plmnId == p_plmnId) and
		(v_list.partialTaiList.type2List[j].plmnAndTacs[k].tac == p_tac)) {
		return true;
		}
		}
		}
		}
		}
		return false;
		} // End of function f_NG_NAS_taiListContains

		/**
		* @desc Test body of the AUTHENTICATION FAILURE / identification test cases (TC_5GNAS_AMF_AUT_REQ_04 cause #20,
		* TC_5GNAS_AMF_AUT_ABN_01 cause #26): AUTHENTICATION FAILURE with the 5GMM cause p_cause, then a plain IDENTITY