[Bug]: S1SetupRequest with random MCC/MNC is not rejected

[pmaier-sysmo]

Open5GS Release, Revision, or Tag

v2.6.4-60-g5764f72

Steps to reproduce

To reproduce the problem, perform a S1SetupRequest that uses an mcc/mnc that is not configured at the MME. (The TAs should match the configuration)

----------8<----------

Frame 148: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.2
Stream Control Transmission Protocol, Src Port: 50000 (50000), Dst Port: 36412 (36412)
S1 Application Protocol
    S1AP-PDU: initiatingMessage (0)
        initiatingMessage
            procedureCode: id-S1Setup (17)
            criticality: reject (0)
            value
                S1SetupRequest
                    protocolIEs: 2 items
                        Item 0: id-Global-ENB-ID
                            ProtocolIE-Field
                                id: id-Global-ENB-ID (59)
                                criticality: ignore (1)
                                value
                                    Global-ENB-ID
                                        pLMNidentity: 62f224
                                        Mobile Country Code (MCC): Germany (262)
                                        Mobile Network Code (MNC): Vodafone GmbH (42)
                                        eNB-ID: macroENB-ID (0)
                                            macroENB-ID: 000000 [bit length 20, 4 LSB pad bits, 0000 0000  0000 0000  0000 .... decimal value 0]
                        Item 1: id-SupportedTAs
                            ProtocolIE-Field
                                id: id-SupportedTAs (64)
                                criticality: reject (0)
                                value
                                    SupportedTAs: 1 item
                                        Item 0
                                            SupportedTAs-Item
                                                tAC: 12345 (0x3039)
                                                broadcastPLMNs: 1 item
                                                    Item 0
                                                        PLMNidentity: 00f110
                                                        Mobile Country Code (MCC): Unknown (1)
                                                        Mobile Network Code (MNC): Unknown (01)

----------8<----------

For configuration details see [1]. There I have configured a plmn-id of mcc: 001, mnc: 01. The S1SetupRequest that triggers the problem contains mcc: 262, mnc: 42. This obviously mismatches the configuration but it is still accepted by the MME.

To trigger this, the TTCN3 testcase TC_s1ap_setup_wrong_plmn can be used [2]

[1] https://gitea.osmocom.org/osmocom/docker-playground/src/branch/master/ttcn3-mme-test-ogs/ogs/open5gs-mme.yaml#L321
[2] https://jenkins.osmocom.org/jenkins/view/TTCN3/job/ttcn3-mme-test-ogs/test_results_analyzer/

Logs

08/04 19:14:50.252: [mme] DEBUG: mme_state_operational(): MME_EVENT_S1AP_MESSAGE
 (../src/mme/mme-sm.c:88)
InitiatingMessage ::= {
    procedureCode: 17
    criticality: 0 (reject)
    value: S1SetupRequest ::= {
        protocolIEs: ProtocolIE-Container ::= {
            S1SetupRequestIEs ::= {
                id: 59
                criticality: 1 (ignore)
                value: Global-ENB-ID ::= {
                    pLMNidentity: 62 F2 24
                    eNB-ID: 00 00 00 (4 bits unused)
                }
            }
            S1SetupRequestIEs ::= {
                id: 64
                criticality: 0 (reject)
                value: SupportedTAs ::= {
                    SupportedTAs-Item ::= {
                        tAC: 30 39
                        broadcastPLMNs: BPLMNs ::= {
                            00 F1 10
                        }
                    }
                }
            }
        }
    }
}
08/04 19:14:50.252: [mme] DEBUG: s1ap_state_operational(): MME_EVENT_S1AP_MESSAGE
 (../src/mme/s1ap-sm.c:60)
08/04 19:14:50.252: [mme] DEBUG: S1SetupRequest (../src/mme/s1ap-handler.c:94)
08/04 19:14:50.252: [mme] DEBUG:     IP[127.0.0.1] ENB_ID[0] (../src/mme/s1ap-handler.c:116)
08/04 19:14:50.252: [mme] DEBUG:     PLMN_ID[MCC:1 MNC:1] TAC[12345] (../src/mme/s1ap-handler.c:155)
08/04 19:14:50.252: [mme] DEBUG:     SERVED_TAI_INDEX[0] (../src/mme/s1ap-handler.c:46)
08/04 19:14:50.252: [mme] DEBUG: S1-Setup response (../src/mme/s1ap-path.c:268)
08/04 19:14:50.252: [mme] DEBUG: S1SetupResponse (../src/mme/s1ap-build.c:38)
08/04 19:14:50.252: [mme] DEBUG:     PLMN_ID[MCC:1 MNC:1] (../src/mme/s1ap-build.c:102)
08/04 19:14:50.252: [mme] DEBUG:     MME Group[2] (../src/mme/s1ap-build.c:113)
08/04 19:14:50.252: [mme] DEBUG:     MME Code[1] (../src/mme/s1ap-build.c:123)
SuccessfulOutcome ::= {
    procedureCode: 17
    criticality: 0 (reject)
    value: S1SetupResponse ::= {
        protocolIEs: ProtocolIE-Container ::= {
            S1SetupResponseIEs ::= {
                id: 61
                criticality: 1 (ignore)
                value: open5gs-mme0
            }
            S1SetupResponseIEs ::= {
                id: 105
                criticality: 0 (reject)
                value: ServedGUMMEIs ::= {
                    ServedGUMMEIsItem ::= {
                        servedPLMNs: ServedPLMNs ::= {
                            00 F1 10
                        }
                        servedGroupIDs: ServedGroupIDs ::= {
                            00 02
                        }
                        servedMMECs: ServedMMECs ::= {
                            01
                        }
                    }
                }
            }
            S1SetupResponseIEs ::= {
                id: 87
                criticality: 1 (ignore)
                value: 255
            }
        }
    }
}
08/04 19:14:50.252: [mme] DEBUG:     IP[127.0.0.1] ENB_ID[0] (../src/mme/s1ap-path.c:71)

Expected behaviour

To my understanding the MME should reject eNBs that try to negotiate with a foreigen mcc/mnc.

Observed Behaviour

(see also above). The MME happily accepts S1SetupRequests that contain Global-ENB-IDs with random MNC/MCC.

eNodeB/gNodeB

(no real eNB, just a TTCN3 testsuite that speaks S1AP)

UE Models and versions

No response

[acetcom]

@pmaier-sysmo

I've fixed it and update it in the main branch.

Please let me know if you have any other problem.

Thanks a lot!
Sukchan

[pmaier-sysmo]

Hello Sukchan,

thanks for fixing the problem. The S1SetupRequest now fails as expected but I believe the cause code should be "unknown-PLMN" rather than "unspecified" (see also 3GPP TS 36.413, section 8.7.3.4)

Here is the response I got:

S1 Application Protocol
    S1AP-PDU: unsuccessfulOutcome (2)
        unsuccessfulOutcome
            procedureCode: id-S1Setup (17)
            criticality: reject (0)
            value
                S1SetupFailure
                    protocolIEs: 2 items
                        Item 0: id-Cause
                            ProtocolIE-Field
                                id: id-Cause (2)
                                criticality: ignore (1)
                                value
                                    Cause: misc (4)
                                        misc: unspecified (4)
                        Item 1: id-TimeToWait
                            ProtocolIE-Field
                                id: id-TimeToWait (65)
                                criticality: ignore (1)
                                value
                                    TimeToWait: v10s (3)

Before the change I was getting cause code "unknown-PLMN" when only the supported TAs were invalid. This has also changed to "unspecified" now.

You can see the latest test results here:
https://jenkins.osmocom.org/jenkins/view/TTCN3/job/ttcn3-mme-test-ogs/test_results_analyzer/

TC_s1ap_setup_wrong_plmn and TC_s1ap_setup_wrong_tac should pass when the cause code is changed to "unknown-PLMN"

Best regards.
Philipp

[acetcom]

@pmaier-sysmo

I've modified it again based on your guide.

Please let me know if you have any other idea.

Thanks a lot!
Sukchan

[pmaier-sysmo]

Hello Sukchan,

now both tests pass. Thank you very much for fixing this.

Best regards.
Philipp