@@ -2,7 +2,7 @@

 Source: open5gs

 Binary: open5gs-common, open5gs-mme, open5gs-sgwc, open5gs-smf, open5gs-amf, open5gs-sgwu, open5gs-upf, open5gs-hss, open5gs-pcrf, open5gs-nrf, open5gs-scp, open5gs-sepp, open5gs-ausf, open5gs-udm, open5gs-pcf, open5gs-nssf, open5gs-bsf, open5gs-udr, open5gs, open5gs-dbg

 Architecture: any

-Version: 2.7.0.57.52be.202401162026

+Version: 2.7.0.59.6069.202401172026

 Maintainer: Harald Welte <laforge@gnumonks.org>

 Uploaders: Sukchan Lee <acetcom@gmail.com>

 Homepage: https://open5gs.org

@@ -32,8 +32,8 @@

  open5gs-udr deb net optional arch=any

  open5gs-upf deb net optional arch=any

 Checksums-Sha1:

- d3db571edb7717440f4572c3e58e0ad88ba4b261 14467112 open5gs_2.7.0.57.52be.202401162026.tar.xz

+ 52206bc6d1ca933aac036557d901f2b5439a60ed 14470084 open5gs_2.7.0.59.6069.202401172026.tar.xz

 Checksums-Sha256:

- 420441ecaa4cab69449ccd5faae3c272d92f355c37127d10333b18bf819b69d7 14467112 open5gs_2.7.0.57.52be.202401162026.tar.xz

+ c309f70407d60b65f94ddd3bbe712475f3dc29637e6499e2571bc8a625a0f15b 14470084 open5gs_2.7.0.59.6069.202401172026.tar.xz

 Files:

- b8d34e8345cae44cfd70c2423c2499fa 14467112 open5gs_2.7.0.57.52be.202401162026.tar.xz

+ 842328d001ac2a84e350f13656f19a5e 14470084 open5gs_2.7.0.59.6069.202401172026.tar.xz

​

@@ -1 +1 @@

-2.7.0.57-52be.202401162026

+2.7.0.59-6069.202401172026

​

@@ -1,8 +1,8 @@

-open5gs (2.7.0.57.52be.202401162026) unstable; urgency=medium

+open5gs (2.7.0.59.6069.202401172026) unstable; urgency=medium

   * Automatically generated changelog entry for building the Osmocom nightly feed

- -- Osmocom OBS scripts <info@osmocom.org>  Tue, 16 Jan 2024 20:27:30 +0000

+ -- Osmocom OBS scripts <info@osmocom.org>  Wed, 17 Jan 2024 20:27:39 +0000

 open5gs (2.7.0) unstable; urgency=medium

​

@@ -206,6 +206,19 @@

     return i;

 }

+static ogs_inline bool ogs_list_exists(const ogs_list_t *list, void *lnode)

+{

+    ogs_list_t *node = (ogs_list_t *)lnode;

+    void *iter = NULL;

+

+    ogs_list_for_each(list, iter) {

+        if (node == (ogs_list_t *)iter)

+            return true;

+    }

+

+    return false;

+}

+

 #ifdef __cplusplus

 }

 #endif

​

@@ -121,6 +121,7 @@

 #define OGS_GTP_CREATE_IN_ATTACH_REQUEST 1

 #define OGS_GTP_CREATE_IN_UPLINK_NAS_TRANSPORT 2

 #define OGS_GTP_CREATE_IN_PATH_SWITCH_REQUEST 3

+#define OGS_GTP_CREATE_IN_TRACKING_AREA_UPDATE 4 /* 3GPP TS 33.401 9.1.2 */

     int             create_action;

 #define OGS_GTP_MODIFY_IN_PATH_SWITCH_REQUEST 1

​

@@ -398,6 +398,18 @@

     imeisv_request->type = OGS_NAS_IMEISV_TYPE;

     imeisv_request->value = OGS_NAS_IMEISV_REQUESTED;

+    if (mme_ue->nonceue) {

+        security_mode_command->presencemask |=

+            OGS_NAS_EPS_SECURITY_MODE_COMMAND_REPLAYED_NONCEUE_PRESENT;

+            security_mode_command->replayed_nonceue = mme_ue->nonceue;

+    }

+

+    if (mme_ue->noncemme) {

+        security_mode_command->presencemask |=

+            OGS_NAS_EPS_SECURITY_MODE_COMMAND_NONCEMME_PRESENT;

+            security_mode_command->noncemme = mme_ue->noncemme;

+    }

+

     /*

      * TS24.301

      * 5.4.3.2 NAS security mode control initiation by the network

​

@@ -549,6 +549,36 @@

     return OGS_OK;

 }

+bool emm_tau_request_ue_comes_from_gb_or_iu(const ogs_nas_eps_tracking_area_update_request_t *tau_request)

+{

+    /* "When the tracking area updating procedure is initiated in EMM-IDLE mode

+     * to perform an inter-system change from A/Gb mode or Iu mode to S1 mode

+     * and the TIN is set to "P-TMSI", the UE shall include the GPRS ciphering

+     * key sequence number applicable for A/Gb mode or Iu mode and a nonce UE in

+     * the TRACKING AREA UPDATE REQUEST message."

+     */

+    if (!(tau_request->presencemask &

+            OGS_NAS_EPS_TRACKING_AREA_UPDATE_REQUEST_NONCEUE_PRESENT))

+            return false;

+

+    if (tau_request->presencemask &

+        OGS_NAS_EPS_TRACKING_AREA_UPDATE_REQUEST_OLD_GUTI_TYPE_PRESENT) {

+            /* 0 = Native, 1 = Mapped */

+            return tau_request->old_guti_type.guti_type;

+    } else {

+        /* TS 23.003 2.8.2.2.2:

+            * "The most significant bit of the <LAC> shall be set to zero;

+            * and the most significant bit of <MME group id> shall be set to

+            * one. Based on this definition, the most significant bit of the

+            * <MME group id> can be used to distinguish the node type, i.e.

+            * whether it is an MME or SGSN */

+        const ogs_nas_eps_mobile_identity_t *eps_mobile_identity = &tau_request->old_guti;

+        if (eps_mobile_identity->imsi.type != OGS_NAS_EPS_MOBILE_IDENTITY_GUTI)

+            return false;

+        return !(eps_mobile_identity->guti.mme_gid & 0x8000);

+    }

+}

+

 int emm_handle_tau_request(mme_ue_t *mme_ue,

     ogs_nas_eps_tracking_area_update_request_t *tau_request, ogs_pkbuf_t *pkbuf)

 {

@@ -660,6 +690,19 @@

                 sizeof(tau_request->ms_network_capability));

     }

+    if (tau_request->presencemask &

+            OGS_NAS_EPS_TRACKING_AREA_UPDATE_REQUEST_NONCEUE_PRESENT) {

+        mme_ue->gprs_ciphering_key_sequence_number = tau_request->gprs_ciphering_key_sequence_number.key_sequence;

+    } else {

+        /* Mark as unavailable, Table 10.5.2/3GPP TS 24.008 */

+        mme_ue->gprs_ciphering_key_sequence_number = OGS_NAS_CIPHERING_KEY_SEQUENCE_NUMBER_NO_KEY_FROM_MS;

+    }

+

+    if (tau_request->presencemask &

+            OGS_NAS_EPS_TRACKING_AREA_UPDATE_REQUEST_NONCEUE_PRESENT) {

+        mme_ue->nonceue = tau_request->nonceue;

+    }

+

     /* TODO:

      *   1) Consider if MME is changed or not.

      *   2) Consider if SGW is changed or not.

@@ -679,6 +722,10 @@

                 nas_guti.m_tmsi,

                 MME_UE_HAVE_IMSI(mme_ue)

                     ? mme_ue->imsi_bcd : "Unknown");

+

+        memcpy(&mme_ue->next.guti,

+           &nas_guti, sizeof(ogs_nas_eps_guti_t));

+

         break;

     default:

         ogs_error("Not implemented%d", eps_mobile_identity->imsi.type);

​

@@ -50,6 +50,9 @@

 int emm_handle_security_mode_complete(mme_ue_t *mme_ue,

     ogs_nas_eps_security_mode_complete_t *security_mode_complete);

+bool emm_tau_request_ue_comes_from_gb_or_iu(

+    const ogs_nas_eps_tracking_area_update_request_t *tau_request);

+

 #ifdef __cplusplus

 }

 #endif

​

@@ -20,6 +20,7 @@

 #include "mme-event.h"

 #include "mme-timer.h"

 #include "s1ap-handler.h"

+#include "mme-gn-handler.h"

 #include "mme-fd-path.h"

 #include "emm-handler.h"

 #include "emm-build.h"

@@ -286,7 +287,9 @@

     mme_ue_t *mme_ue = NULL;

     enb_ue_t *enb_ue = NULL;

+    mme_sgsn_t *sgsn = NULL;

     ogs_nas_eps_message_t *message = NULL;

+    ogs_nas_rai_t rai;

     ogs_nas_security_header_type_t h;

     ogs_assert(e);

@@ -489,6 +492,26 @@

                 break;

             }

+            if (emm_tau_request_ue_comes_from_gb_or_iu(&message->emm.tracking_area_update_request)) {

+                ogs_info("TAU request : UE comes from SGSN, attempt retrieving context");

+                guti_to_rai_ptmsi(&mme_ue->next.guti, &rai, NULL, NULL);

+                sgsn = mme_sgsn_find_by_routing_address(&rai, 0xffff);

+                if (!sgsn) {

+                    ogs_plmn_id_t plmn_id;

+                    ogs_nas_to_plmn_id(&plmn_id, &rai.lai.nas_plmn_id);

+                    ogs_warn("No SGSN route matching RAIMCC:%u MNC:%u LAC:%u RAC:%u",

+                             ogs_plmn_id_mcc(&plmn_id), ogs_plmn_id_mnc(&plmn_id),

+                             rai.lai.lac, rai.rac);

+                    r = nas_eps_send_tau_reject(mme_ue,

+                    OGS_NAS_EMM_CAUSE_UE_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK);

+                    OGS_FSM_TRAN(s, &emm_state_exception);

+                    break;

+                }

+                mme_gtp1_send_sgsn_context_request(sgsn, mme_ue);

+                /* FIXME: use a specific FSM state here to state we are waiting for resolution from Gn? */

+                break;

+            }

+

             if (!MME_UE_HAVE_IMSI(mme_ue)) {

                 ogs_info("TAU request : Unknown UE");

                 r = nas_eps_send_tau_reject(mme_ue,

​

@@ -3184,6 +3184,11 @@

     /* Clear Next GUTI */

     mme_ue->next.m_tmsi = NULL;

+

+    ogs_debug("Confirm GUTIG:%d,C:%d,M_TMSI:0x%x",

+              mme_ue->current.guti.mme_gid,

+              mme_ue->current.guti.mme_code,

+              mme_ue->current.guti.m_tmsi);

 }

 static bool compare_ue_info(mme_sgw_t *node, enb_ue_t *enb_ue)

​

@@ -489,6 +489,8 @@

     } ul_count;

     uint8_t         kenbOGS_SHA256_DIGEST_SIZE;

     uint8_t         hash_mmeOGS_HASH_MME_LEN;

+    uint32_t        nonceue, noncemme;

+    uint8_t gprs_ciphering_key_sequence_number;

     struct {

     ED2(uint8_t nhcc_spare:5;,

​

@@ -20,11 +20,11 @@

 #include "mme-context.h"

 #include "mme-gn-build.h"

+#include "mme-gn-handler.h"

 static int sess_fill_mm_context_decoded(mme_sess_t *sess, ogs_gtp1_mm_context_decoded_t *mmctx_dec)

 {

     mme_ue_t *mme_ue = sess->mme_ue;

-    mme_bearer_t *bearer = NULL;

     *mmctx_dec = (ogs_gtp1_mm_context_decoded_t) {

         .gupii = 1, /* Integrity Protection not required */

         .ugipai = 1, /* Ignore "Used GPRS integrity protection algorithm" field" */

@@ -40,7 +40,6 @@

         .nrsrna = 0,

     };

-    //TODO: derive cK Ki from mme_ue->kasme

     ogs_kdf_ck_ik_idle_mobility(mme_ue->ul_count.i32, mme_ue->kasme, &mmctx_dec->ck0, &mmctx_dec->ik0);

     mmctx_dec->imeisv_len = sizeof(mme_ue->nas_mobile_identity_imeisv);

@@ -49,12 +48,6 @@

     mmctx_dec->ms_network_capability_len = mme_ue->ms_network_capability.length;

     memcpy(&mmctx_dec->ms_network_capability0, ((uint8_t*)&mme_ue->ms_network_capability)+1, sizeof(mme_ue->ms_network_capability) - 1);

-    ogs_list_for_each(&sess->bearer_list, bearer) {

-

-        /* FIXME: only 1 PDP Context supported in the message so far. */

-        break;

-    }

-

     return OGS_OK;

 }

@@ -177,6 +170,103 @@

     return OGS_OK;

 }

+/* 3GPP TS 29.060 7.5.3 SGSN Context Request */

+ogs_pkbuf_t *mme_gn_build_sgsn_context_request(

+                mme_ue_t *mme_ue)

+{

+    ogs_gtp1_message_t gtp1_message;

+    ogs_gtp1_sgsn_context_request_t *req = NULL;

+    ogs_nas_rai_t rai;

+    mme_p_tmsi_t ptmsi;

+    uint32_t ptmsi_sig;

+    ogs_gtp1_gsn_addr_t mme_gnc_gsnaddr, mme_gnc_alt_gsnaddr;

+    int gsn_len;

+    int rv;

+

+    ogs_debug("Gn build SGSN Context Request");

+

+    ogs_assert(mme_ue);

+

+    req = &gtp1_message.sgsn_context_request;

+    memset(&gtp1_message, 0, sizeof(ogs_gtp1_message_t));

+

+    guti_to_rai_ptmsi(&mme_ue->next.guti, &rai, &ptmsi, &ptmsi_sig);

+

+    req->imsi.presence = 0;

+

+    req->routeing_area_identity.presence = 1;

+    req->routeing_area_identity.data = &rai;

+    req->routeing_area_identity.len = sizeof(ogs_nas_rai_t);

+

+    req->temporary_logical_link_identifier.presence = 0;

+

+    req->packet_tmsi.presence = 1;

+    req->packet_tmsi.u32 = be32toh(ptmsi);

+

+    req->p_tmsi_signature.presence = 1;

+    req->p_tmsi_signature.u24 = ptmsi_sig;

+

+    req->ms_validated.presence = 0;

+

+    req->tunnel_endpoint_identifier_control_plane.presence = 1;

+    req->tunnel_endpoint_identifier_control_plane.u32 = mme_ue->gn.mme_gn_teid;

+

+    /* SGSN Address for Control Plane */

+    if (ogs_gtp_self()->gtpc_addr && ogs_gtp_self()->gtpc_addr6) {

+        rv = ogs_gtp1_sockaddr_to_gsn_addr(NULL, ogs_gtp_self()->gtpc_addr6,

+                &mme_gnc_gsnaddr, &gsn_len);

+        if (rv != OGS_OK) {

+            ogs_error("ogs_gtp1_sockaddr_to_gsn_addr() failed");

+            return NULL;

+        }

+        req->sgsn_address_for_control_plane.presence = 1;

+        req->sgsn_address_for_control_plane.data = &mme_gnc_gsnaddr;

+        req->sgsn_address_for_control_plane.len = gsn_len;

+

+        rv = ogs_gtp1_sockaddr_to_gsn_addr(ogs_gtp_self()->gtpc_addr, NULL,

+                &mme_gnc_alt_gsnaddr, &gsn_len);

+        if (rv != OGS_OK) {

+            ogs_error("ogs_gtp1_sockaddr_to_gsn_addr() failed");

+            return NULL;

+        }

+        req->sgsn_address_for_control_plane.presence = 1;

+        req->sgsn_address_for_control_plane.data = &mme_gnc_alt_gsnaddr;

+        req->sgsn_address_for_control_plane.len = gsn_len;

+    } else if (ogs_gtp_self()->gtpc_addr6) {

+        rv = ogs_gtp1_sockaddr_to_gsn_addr(NULL, ogs_gtp_self()->gtpc_addr6,

+                &mme_gnc_gsnaddr, &gsn_len);

+        if (rv != OGS_OK) {

+            ogs_error("ogs_gtp1_sockaddr_to_gsn_addr() failed");

+            return NULL;

+        }

+        req->sgsn_address_for_control_plane.presence = 1;

+        req->sgsn_address_for_control_plane.data = &mme_gnc_gsnaddr;

+        req->sgsn_address_for_control_plane.len = gsn_len;

+        req->alternative_sgsn_address_for_control_plane.presence = 0;

+    } else {

+        rv = ogs_gtp1_sockaddr_to_gsn_addr(ogs_gtp_self()->gtpc_addr, NULL,

+                &mme_gnc_gsnaddr, &gsn_len);

+        if (rv != OGS_OK) {

+            ogs_error("ogs_gtp1_sockaddr_to_gsn_addr() failed");

+            return NULL;

+        }

+        req->sgsn_address_for_control_plane.presence = 1;

+        req->sgsn_address_for_control_plane.data = &mme_gnc_gsnaddr;

+        req->sgsn_address_for_control_plane.len = gsn_len;

+        req->alternative_sgsn_address_for_control_plane.presence = 0;

+    }

+

+    req->sgsn_number.presence = 0;

+

+    req->rat_type.presence = 1;

+    req->rat_type.u8 = OGS_GTP1_RAT_TYPE_EUTRAN;

+

+    req->hop_counter.presence = 0;

+

+    gtp1_message.h.type = OGS_GTP1_SGSN_CONTEXT_REQUEST_TYPE;

+    return ogs_gtp1_build_msg(&gtp1_message);

+}

+

 /* 3GPP TS 29.060 7.5.4 SGSN Context Response */

 ogs_pkbuf_t *mme_gn_build_sgsn_context_response(

                 mme_ue_t *mme_ue, uint8_t cause)

@@ -276,6 +366,67 @@

 build_ret:

+    return ogs_gtp1_build_msg(&gtp1_message);

+}

+

+/* 3GPP TS 29.060 7.5.5 SGSN Context Acknowledge */

+ogs_pkbuf_t *mme_gn_build_sgsn_context_ack(

+                mme_ue_t *mme_ue, uint8_t cause)

+{

+    ogs_gtp1_message_t gtp1_message;

+    ogs_gtp1_sgsn_context_acknowledge_t *ack = NULL;

+    mme_sess_t *sess = NULL;

+    ogs_gtp1_gsn_addr_t reserved_gnc_gsnaddr;

+    ogs_gtp1_teidII_t teidII;

+

+    ogs_debug("Gn build SGSN Context Acknowledge");

+

+    ack = &gtp1_message.sgsn_context_acknowledge;

+    memset(&gtp1_message, 0, sizeof(ogs_gtp1_message_t));

+    gtp1_message.h.type = OGS_GTP1_SGSN_CONTEXT_ACKNOWLEDGE_TYPE;

+

+    /* 3GPP TS 29.060 7.7.1 Cause, Mandatory */

+    ack->cause.presence = 1;

+    ack->cause.u8 = cause;

+

+    if (cause != OGS_GTP1_CAUSE_REQUEST_ACCEPTED)

+        goto build_ret;

+

+    ogs_list_for_each(&mme_ue->sess_list, sess) {

+        mme_bearer_t *bearer = NULL;

+        if (!MME_HAVE_SGW_S1U_PATH(sess))

+            continue;

+        ogs_list_for_each(&sess->bearer_list, bearer) {

+            /* MME, acting as a new SGSN, shall send the following values in the SGSN Context

+             * Acknowledge message in order to discard the packets received from the old SGSN

+             * (because the MME and the S4-SGSN do not have user plane):

+             * - any reserved TEID (e.g. all 0's, or all 1's) for Tunnel Endpoint Identifier

+             *   Data II value;

+             * - any reserved (implementation dependent) IP address for SGSN Address for user

+                 traffic value.

+             */

+            /* 3GPP TS 29.060 7.7.15 Tunnel Endpoint Identifier Data II, Conditional */

+            teidII.nsapi = bearer->ebi;

+            teidII.teid = 0xffffffff;

+            ack->tunnel_endpoint_identifier_data_ii.presence = 1;

+            ack->tunnel_endpoint_identifier_data_ii.data = &teidII;

+            ack->tunnel_endpoint_identifier_data_ii.len = sizeof(teidII);

+

+            /* Use IPv4 0.0.0.0 as reserved address: */

+            reserved_gnc_gsnaddr.addr = 0;

+            ack->sgsn_address_for_user_traffic.presence = 1;

+            ack->sgsn_address_for_user_traffic.data = &reserved_gnc_gsnaddr;

+            ack->sgsn_address_for_user_traffic.len = OGS_GTP_GSN_ADDRESS_IPV4_LEN;

+

+            /* FIXME: only 1 PDP Context supported in the message so far. */

+            break;

+        }

+        /* FIXME: right now we only support encoding 1 context in the message. */

+        break;

+    }

​

@@ -30,9 +30,15 @@

 }

 #endif

+ogs_pkbuf_t *mme_gn_build_sgsn_context_request(

+                mme_ue_t *mme_ue);

+

 ogs_pkbuf_t *mme_gn_build_sgsn_context_response(

                 mme_ue_t *mme_ue, uint8_t cause);

+ogs_pkbuf_t *mme_gn_build_sgsn_context_ack(

+                mme_ue_t *mme_ue, uint8_t cause);

+

 ogs_pkbuf_t *mme_gn_build_ran_information_relay(

                 uint8_t type, const uint8_t *buf, size_t len,

                 const ogs_nas_rai_t *rai, uint16_t cell_id);

​

@@ -30,6 +30,7 @@

 #include "mme-gn-handler.h"

 #include "s1ap-path.h"

+#include "nas-path.h"

 void mme_gn_handle_echo_request(

         ogs_gtp_xact_t *xact, ogs_gtp1_echo_request_t *req)

@@ -68,12 +69,26 @@

     return OGS_OK;

 }

-/* 3GPP TS 23.003 2.8.2.2 Mapping from RAI and P-TMSI to GUT */

+/* 3GPP TS 23.003 2.8.2.1 Mapping from GUTI to RAI, P-TMSI and P-TMSI signature */

+void guti_to_rai_ptmsi(const ogs_nas_eps_guti_t *nas_guti, ogs_nas_rai_t *rai, mme_p_tmsi_t *ptmsi, uint32_t *ptmsi_sig)

+{

+    rai->lai.nas_plmn_id = nas_guti->nas_plmn_id;

+    rai->lai.lac = nas_guti->mme_gid;

+    rai->rac = nas_guti->mme_code;

+    if (ptmsi)

+        *ptmsi = 0xC0000000 |

+                (nas_guti->m_tmsi & 0x3f000000) |

+                (nas_guti->mme_code & 0x0ff) << 16 |

+                (nas_guti->m_tmsi & 0x0000ffff);

+    if (ptmsi_sig)

+        *ptmsi_sig = (nas_guti->m_tmsi & 0x00ff0000);

+}

+

+/* 3GPP TS 23.003 2.8.2.2 Mapping from RAI and P-TMSI to GUTI */

 static void rai_ptmsi_to_guti(const ogs_nas_rai_t *rai, mme_p_tmsi_t ptmsi, uint32_t ptmsi_sig, ogs_nas_eps_guti_t *nas_guti)

 {

-    uint16_t lac = be16toh(rai->lai.lac);;

-    nas_guti->nas_plmn_id =rai->lai.nas_plmn_id;

-    nas_guti->mme_gid = lac;

+    nas_guti->nas_plmn_id = rai->lai.nas_plmn_id;

+    nas_guti->mme_gid = rai->lai.lac;

     nas_guti->mme_code = rai->rac;

     nas_guti->m_tmsi = 0xC0000000 | (ptmsi & 0x3f000000) | (ptmsi_sig & 0x00ff0000) | (ptmsi & 0x0000ffff);

 }

@@ -83,7 +98,8 @@

         ogs_gtp_xact_t *xact, ogs_gtp1_sgsn_context_request_t *req)

 {

     ogs_nas_eps_guti_t nas_guti;

-    ogs_nas_rai_t *rai;

+    ogs_plmn_id_t plmn_id;

+    ogs_nas_rai_t rai;

     mme_ue_t *mme_ue = NULL;

     int rv;

@@ -94,9 +110,10 @@

         mme_gtp1_send_sgsn_context_response(NULL, OGS_GTP1_CAUSE_MANDATORY_IE_MISSING, xact);

         return;

     }

-    if (req->routeing_area_identity.len != sizeof(*rai)) {

+

+    if (req->routeing_area_identity.len != sizeof(rai)) {

         ogs_warn("Gn Rx SGSN Context Request RAI wrong size %u vs exp %zu!",

-                 req->routeing_area_identity.len, sizeof(*rai));

+                 req->routeing_area_identity.len, sizeof(rai));

         mme_gtp1_send_sgsn_context_response(NULL, OGS_GTP1_CAUSE_MANDATORY_IE_INCORRECT, xact);

         return;

     }

@@ -126,17 +143,35 @@

         return;

     }

-    rai = req->routeing_area_identity.data;

+    memcpy(&rai, req->routeing_area_identity.data, sizeof(rai));

+    rai.lai.lac = be16toh(rai.lai.lac);

+    ogs_nas_to_plmn_id(&plmn_id, &rai.lai.nas_plmn_id);

+    ogs_debug("    RAIMCC:%u MNC:%u LAC:%u RAC:%u",

+             ogs_plmn_id_mcc(&plmn_id), ogs_plmn_id_mnc(&plmn_id),

+             rai.lai.lac, rai.rac);

     if (req->imsi.presence) {

+        char imsi_bcdOGS_MAX_IMSI_BCD_LEN+1;

+        ogs_buffer_to_bcd(req->imsi.data, req->imsi.len, imsi_bcd);

+        ogs_debug("    IMSI%s", imsi_bcd);

         mme_ue = mme_ue_find_by_imsi(req->imsi.data, req->imsi.len);

+        if (!mme_ue)

+            ogs_warn("Gn Rx SGSN Context Request: Unknown UE with IMSI%s", imsi_bcd);

     } else if (req->packet_tmsi.presence) { /* P-TMSI */

         if (!req->p_tmsi_signature.presence) {

             ogs_warn("Gn Rx SGSN Context Request with 'P-TMSI' but no P-TMSI Signature! Assuming value 0.");

             req->p_tmsi_signature.u24 = 0;

         }

-        rai_ptmsi_to_guti(rai, req->packet_tmsi.u32, req->p_tmsi_signature.u24, &nas_guti);

+        rai_ptmsi_to_guti(&rai, req->packet_tmsi.u32, req->p_tmsi_signature.u24, &nas_guti);

+        ogs_debug("    PTMSI0x%08x PTMSI_SIG0x%06x -> GUTIG:%d,C:%d,M_TMSI:0x%x",

+                  req->packet_tmsi.u32, req->p_tmsi_signature.u24,

+                  nas_guti.mme_gid, nas_guti.mme_code, nas_guti.m_tmsi);

         mme_ue = mme_ue_find_by_guti(&nas_guti);

+        if (!mme_ue)

+            ogs_warn("Gn Rx SGSN Context Request: Unknown UE with RAIMCC:%u MNC:%u LAC:%u RAC:%u PTMSI0x%08x PTMSI_SIG0x%06x -> GUTIG:%d,C:%d,M_TMSI:0x%x",

+                     ogs_plmn_id_mcc(&plmn_id), ogs_plmn_id_mnc(&plmn_id), rai.lai.lac, rai.rac,

+                     req->packet_tmsi.u32, req->p_tmsi_signature.u24,

+                     nas_guti.mme_gid, nas_guti.mme_code, nas_guti.m_tmsi);

     } else if (req->temporary_logical_link_identifier.presence) {

         if (!req->p_tmsi_signature.presence) {

             ogs_warn("Gn Rx SGSN Context Request with 'TLLI' but no P-TMSI Signature! Assuming value 0.");

@@ -145,8 +180,16 @@

         /* TS 29.060 7.5.3 "The TLLI/P-TMSI and RAI is a foreign TLLI/P-TMSI and an RAI in the old SGSN."

          * A foregin TLLI is "tlli = (p_tmsi & 0x3fffffff) | 0x80000000", and since we only use 0x3fffffff

          * bits of P-TMSI to derive the GUTI, it's totally fine passing the TLLI as P-TMSI. */

-        rai_ptmsi_to_guti(rai, req->temporary_logical_link_identifier.u32, req->p_tmsi_signature.u24, &nas_guti);

+        rai_ptmsi_to_guti(&rai, req->temporary_logical_link_identifier.u32, req->p_tmsi_signature.u24, &nas_guti);

+        ogs_debug("    TLLI0x%08x PTMSI_SIG0x%06x -> GUTIG:%d,C:%d,M_TMSI:0x%x",

+                  req->temporary_logical_link_identifier.u32, req->p_tmsi_signature.u24,

+                  nas_guti.mme_gid, nas_guti.mme_code, nas_guti.m_tmsi);

         mme_ue = mme_ue_find_by_guti(&nas_guti);

+        if (!mme_ue)

+            ogs_warn("Gn Rx SGSN Context Request: Unknown UE with RAIMCC:%u MNC:%u LAC:%u RAC:%u TLLI0x%08x PTMSI_SIG0x%06x -> GUTIG:%d,C:%d,M_TMSI:0x%x",

+                     ogs_plmn_id_mcc(&plmn_id), ogs_plmn_id_mnc(&plmn_id), rai.lai.lac, rai.rac,

+                     req->temporary_logical_link_identifier.u32, req->p_tmsi_signature.u24,

+                     nas_guti.mme_gid, nas_guti.mme_code, nas_guti.m_tmsi);

     }

     if (!mme_ue) {

@@ -177,6 +220,223 @@

     mme_gtp1_send_sgsn_context_response(mme_ue, OGS_GTP1_CAUSE_REQUEST_ACCEPTED, xact);

 }

+static mme_sess_t *mme_ue_session_from_gtp1_pdp_ctx(mme_ue_t *mme_ue, const ogs_gtp1_pdp_context_decoded_t *gtp1_pdp_ctx)

+{

+    mme_sess_t *sess = NULL;

+    mme_bearer_t *bearer = NULL;

+    const ogs_gtp1_qos_profile_decoded_t *qos_pdec = &gtp1_pdp_ctx->qos_sub;

+    uint8_t pti = gtp1_pdp_ctx->trans_id;

+    uint8_t qci = 0;

+    ogs_session_t *ogs_sess;

+

+    ogs_sess = mme_session_find_by_apn(mme_ue, gtp1_pdp_ctx->apn);

+    if (!ogs_sess) {

+        ogs_assert(mme_ue->num_of_session < OGS_MAX_NUM_OF_SESS);

+        ogs_sess = &mme_ue->sessionmme_ue->num_of_session;

+        mme_ue->num_of_session++;

+        ogs_sess->name = ogs_strdup(gtp1_pdp_ctx->apn);

+    }

+    ogs_sess->smf_ip = gtp1_pdp_ctx->ggsn_address_c;

+    ogs_sess->context_identifier = gtp1_pdp_ctx->pdp_ctx_id;

+    ogs_sess->session_type = gtp1_pdp_ctx->pdp_type_num0;

+    ogs_sess->ue_ip = gtp1_pdp_ctx->pdp_address0;

+    /* TODO: sess->paa with gtp1_pdp_ctx->pdp_address0,

+     using/implementing ogs_gtp2_ip_to_paa ? */

+    ogs_ip_to_paa(&ogs_sess->ue_ip, &ogs_sess->paa);

+

+    /* 3GPP TS 23.060 section 9.2.1A: "The QoS profiles of the PDP context and EPS bearer are mapped as specified in TS 23.401"

+     * 3GPP TS 23.401 Annex E: "Mapping between EPS and Release 99 QoS parameters"

+     */

+    ogs_gtp1_qos_profile_to_qci(qos_pdec, &qci);

+    ogs_sess->qos.index = qci;

+    ogs_sess->qos.arp.priority_level = qos_pdec->qos_profile.arp; /* 3GPP TS 23.401 Annex E Table E.2 */

+    ogs_sess->qos.arp.pre_emption_capability = 0; /* ignored as per 3GPP TS 23.401 Annex E */

+    ogs_sess->qos.arp.pre_emption_vulnerability = 0; /* ignored as per 3GPP TS 23.401 Annex E */

+    if (qos_pdec->data_octet6_to_13_present) {

+        ogs_sess->ambr.downlink = qos_pdec->dec_mbr_kbps_dl * 1000;

+        ogs_sess->ambr.uplink = qos_pdec->dec_mbr_kbps_ul * 1000;

+    }

+

+    sess = mme_sess_find_by_pti(mme_ue, pti);

+    if (!sess) {

+        sess = mme_sess_add(mme_ue, pti);

+        ogs_assert(sess);

+    }

+

+    sess->session = ogs_sess;

+    sess->pgw_s5c_teid = gtp1_pdp_ctx->ul_teic;

+    sess->pgw_s5c_ip = gtp1_pdp_ctx->ggsn_address_c;

+    switch (ogs_sess->session_type) {

+    case OGS_PDU_SESSION_TYPE_IPV4:

+        sess->request_type.type = OGS_NAS_EPS_PDN_TYPE_IPV4;

+        break;

+    case OGS_PDU_SESSION_TYPE_IPV6:

+        sess->request_type.type = OGS_NAS_EPS_PDN_TYPE_IPV6;

+        break;

+    case OGS_PDU_SESSION_TYPE_IPV4V6:

+        sess->request_type.type = OGS_NAS_EPS_PDN_TYPE_IPV4V6;

+        break;

+    }

+    sess->request_type.value = OGS_NAS_EPS_REQUEST_TYPE_INITIAL;

+

+    bearer = mme_bearer_find_by_sess_ebi(sess, gtp1_pdp_ctx->nsapi);

+    if (!bearer) {

+        bearer = mme_default_bearer_in_sess(sess);

+        if (!bearer) {

+            bearer = mme_bearer_add(sess);

+            ogs_assert(bearer);

+        }

+    }

+    bearer->pgw_s5u_teid = gtp1_pdp_ctx->ul_teid;

+    bearer->pgw_s5u_ip = gtp1_pdp_ctx->ggsn_address_u;

+    /* Send invalid Remote Address and TEID since it makes no sense that SGW

+     * forwards GTPUv2 traffic to SGSN: */

+    bearer->enb_s1u_ip.ipv4 = 1;

+    bearer->enb_s1u_ip.addr = 0;

+    bearer->enb_s1u_teid = 0xffffffff;

+

+    return sess;

+}

+

​

@@ -35,12 +35,18 @@

 void mme_gn_handle_sgsn_context_request(

         ogs_gtp_xact_t *xact, ogs_gtp1_sgsn_context_request_t *req);

+int mme_gn_handle_sgsn_context_response(

+        ogs_gtp_xact_t *xact, mme_ue_t *mme_ue, ogs_gtp1_sgsn_context_response_t *resp);

+

 void mme_gn_handle_sgsn_context_acknowledge(

         ogs_gtp_xact_t *xact, mme_ue_t *mme_ue, ogs_gtp1_sgsn_context_acknowledge_t *req);

 void mme_gn_handle_ran_information_relay(

         ogs_gtp_xact_t *xact, ogs_gtp1_ran_information_relay_t *req);

+void guti_to_rai_ptmsi(const ogs_nas_eps_guti_t *nas_guti, ogs_nas_rai_t *rai,

+        mme_p_tmsi_t *ptmsi, uint32_t *ptmsi_sig);

+

 #ifdef __cplusplus

 }

 #endif

​

@@ -758,6 +758,45 @@

     return rv;

 }

+/*************************

+ * GTPv1C (Gn interface):

+ *************************/

+

+int mme_gtp1_send_sgsn_context_request(

+        mme_sgsn_t *sgsn, mme_ue_t *mme_ue)

+{

+    int rv;

+    ogs_gtp1_header_t h;

+    ogs_pkbuf_t *pkbuf = NULL;

+    ogs_gtp_xact_t *xact = NULL;

+

+    ogs_assert(sgsn);

+

+    memset(&h, 0, sizeof(ogs_gtp1_header_t));

+    h.type = OGS_GTP1_SGSN_CONTEXT_REQUEST_TYPE;

+    h.teid = 0;

+

+    pkbuf = mme_gn_build_sgsn_context_request(mme_ue);

+    if (!pkbuf) {

+        ogs_error("mme_gn_build_ran_information_relay() failed");

+        return OGS_ERROR;

+    }

+

+    xact = ogs_gtp1_xact_local_create(&sgsn->gnode, &h, pkbuf, NULL, NULL);

+    if (!xact) {

+        ogs_error("ogs_gtp1_xact_local_create() failed");

+        return OGS_ERROR;

+    }

+    /* TS 29.060 8.2: "The SGSN Context Request message, where the Tunnel

+     * Endpoint Identifier shall be set to all zeroes." */

+    xact->local_teid = 0;

+

+    rv = ogs_gtp_xact_commit(xact);

+    ogs_expect(rv == OGS_OK);

+

+    return rv;

+}

+

 int mme_gtp1_send_sgsn_context_response(

         mme_ue_t *mme_ue, uint8_t cause, ogs_gtp_xact_t *xact)

 {

@@ -778,6 +817,38 @@

     rv = ogs_gtp1_xact_update_tx(xact, &h, pkbuf);

     if (rv != OGS_OK) {

+        ogs_error("ogs_gtp1_xact_update_tx() failed");

+        return OGS_ERROR;

+    }

+

+    rv = ogs_gtp_xact_commit(xact);

+    ogs_expect(rv == OGS_OK);

+

+    return rv;

+}

+

+int mme_gtp1_send_sgsn_context_ack(

+        mme_ue_t *mme_ue, uint8_t cause, ogs_gtp_xact_t *xact)

+{

+    int rv;

+    ogs_gtp1_header_t h;

+    ogs_pkbuf_t *pkbuf = NULL;

+

+    ogs_assert(mme_ue);

+

+    memset(&h, 0, sizeof(ogs_gtp1_header_t));

+    h.type = OGS_GTP1_SGSN_CONTEXT_ACKNOWLEDGE_TYPE;

+    h.teid = mme_ue->gn.sgsn_gn_teid;

+

+    pkbuf = mme_gn_build_sgsn_context_ack(mme_ue, cause);

+    if (!pkbuf) {

+        ogs_error("mme_gn_build_sgsn_context_response() failed");

+        return OGS_ERROR;

+    }

+    xact->local_teid = mme_ue->gn.mme_gn_teid;

+

+    rv = ogs_gtp1_xact_update_tx(xact, &h, pkbuf);

+    if (rv != OGS_OK) {

         ogs_error("ogs_gtp1_xact_update_tx() failed");

         return OGS_ERROR;

     }

​

@@ -55,9 +55,15 @@

 int mme_gtp_send_bearer_resource_command(

         mme_bearer_t *bearer, ogs_nas_eps_message_t *nas_message);

+int mme_gtp1_send_sgsn_context_request(

+        mme_sgsn_t *sgsn, mme_ue_t *mme_ue);

+

 int mme_gtp1_send_sgsn_context_response(

         mme_ue_t *mme_ue, uint8_t cause, ogs_gtp_xact_t *xact);

+int mme_gtp1_send_sgsn_context_ack(

+        mme_ue_t *mme_ue, uint8_t cause, ogs_gtp_xact_t *xact);

+

 int mme_gtp1_send_ran_information_relay(

         mme_sgsn_t *sgsn, const uint8_t *buf, size_t len,

         const ogs_nas_rai_t *rai, uint16_t cell_id);

​

@@ -219,7 +219,8 @@

     if (sess->request_type.value == OGS_NAS_EPS_REQUEST_TYPE_HANDOVER)

         indication.handover_indication = 1;

-    if (create_action == OGS_GTP_CREATE_IN_PATH_SWITCH_REQUEST)

+    if (create_action == OGS_GTP_CREATE_IN_PATH_SWITCH_REQUEST ||

+        create_action == OGS_GTP_CREATE_IN_TRACKING_AREA_UPDATE)

         indication.operation_indication = 1;

     session->paa.session_type = req->pdn_type.u8;

@@ -288,6 +289,10 @@

                 &enb_s1u_teidi;

             req->bearer_contexts_to_be_createdi.s1_u_enodeb_f_teid.len =

                 enb_s1u_leni;

+        }

+

+        if (create_action == OGS_GTP_CREATE_IN_PATH_SWITCH_REQUEST ||

+            create_action == OGS_GTP_CREATE_IN_TRACKING_AREA_UPDATE) {

             /* Data Plane(DL) : PGW-S5U */

             memset(&pgw_s5u_teidi, 0, sizeof(ogs_gtp2_f_teid_t));

​

@@ -232,6 +232,12 @@

                     OGS_NAS_ESM_CAUSE_NETWORK_FAILURE);

             ogs_expect(r == OGS_OK);

             ogs_assert(r != OGS_ERROR);

+        } else if (create_action == OGS_GTP_CREATE_IN_TRACKING_AREA_UPDATE) {

+            ogs_error("%s TAU reject Cause:%d",

+                    mme_ue->imsi_bcd, session_cause);

+            r = nas_eps_send_tau_reject(mme_ue, OGS_NAS_EMM_CAUSE_NETWORK_FAILURE);

+            ogs_expect(r == OGS_OK);

+            ogs_assert(r != OGS_ERROR);

         }

         mme_send_delete_session_or_mme_ue_context_release(mme_ue);

         return;

@@ -342,6 +348,10 @@

         ogs_debug("    ENB_S1U_TEID%d SGW_S1U_TEID%d PGW_S5U_TEID%d",

             bearer->enb_s1u_teid, bearer->sgw_s1u_teid, bearer->pgw_s5u_teid);

+

+        if (create_action == OGS_GTP_CREATE_IN_TRACKING_AREA_UPDATE &&

+            !OGS_FSM_CHECK(&bearer->sm, esm_state_active))

+            OGS_FSM_TRAN(&bearer->sm, esm_state_active);

     }

     /* Bearer Level QoS */

@@ -428,6 +438,9 @@

             ogs_assert(r != OGS_ERROR);

         }

+    } else if (create_action == OGS_GTP_CREATE_IN_TRACKING_AREA_UPDATE) {

+        /* 3GPP TS 23.401 D.3.6 step 13, 14: */

+        mme_s6a_send_ulr(mme_ue);

     } else if (create_action == OGS_GTP_CREATE_IN_UPLINK_NAS_TRANSPORT) {

         ogs_assert(OGS_PDU_SESSION_TYPE_IS_VALID(session->paa.session_type));

         r = nas_eps_send_activate_default_bearer_context_request(

​

@@ -674,6 +674,17 @@

         case OGS_GTP1_SGSN_CONTEXT_REQUEST_TYPE:

             mme_gn_handle_sgsn_context_request(xact, &gtp1_message.sgsn_context_request);

             break;

+        case OGS_GTP1_SGSN_CONTEXT_RESPONSE_TYPE:

+            /* 3GPP TS 23.401 Figure D.3.6-1 step 5 */

+            rv = mme_gn_handle_sgsn_context_response(xact, mme_ue, &gtp1_message.sgsn_context_response);

+            if (rv == OGS_GTP1_CAUSE_ACCEPT) {

+                OGS_FSM_TRAN(&mme_ue->sm, &emm_state_initial_context_setup);

+            } else if (rv == OGS_GTP1_CAUSE_REQUEST_IMEI) {

+                OGS_FSM_TRAN(&mme_ue->sm, &emm_state_security_mode);

+            } else {

+                OGS_FSM_TRAN(&mme_ue->sm, &emm_state_exception);

+            }

+            break;

         case OGS_GTP1_SGSN_CONTEXT_ACKNOWLEDGE_TYPE:

             mme_gn_handle_sgsn_context_acknowledge(xact, mme_ue, &gtp1_message.sgsn_context_acknowledge);

             break;

​

@@ -1046,8 +1046,14 @@

                     ogs_debug("    ### ULI PRESENT ###");

                     uli_presence = 1;

                 }

-                ogs_list_add(&mme_ue->bearer_to_modify_list,

-                                &bearer->to_modify_node);

+                if (ogs_list_exists(

+                            &mme_ue->bearer_to_modify_list,

+                            &bearer->to_modify_node) == false)

+                    ogs_list_add(

+                            &mme_ue->bearer_to_modify_list,

+                            &bearer->to_modify_node);

+                else

+                    ogs_warn("Bearer %d Duplicated", (int)e_rab->e_RAB_ID);

             }

         }

@@ -2195,7 +2201,13 @@

             return;

         }

-        ogs_list_add(&mme_ue->bearer_to_modify_list, &bearer->to_modify_node);

+        if (ogs_list_exists(

+                    &mme_ue->bearer_to_modify_list,

+                    &bearer->to_modify_node) == false)

+            ogs_list_add(

+                    &mme_ue->bearer_to_modify_list, &bearer->to_modify_node);

+        else

+            ogs_warn("Bearer %d Duplicated", (int)e_rab->e_RAB_ID);

     }

     if (ogs_list_count(&mme_ue->bearer_to_modify_list)) {

@@ -2623,8 +2635,13 @@

             return;

         }

-        ogs_list_add(

-                &mme_ue->bearer_to_modify_list, &bearer->to_modify_node);

+        if (ogs_list_exists(

+                    &mme_ue->bearer_to_modify_list,

+                    &bearer->to_modify_node) == false)

+            ogs_list_add(

+                    &mme_ue->bearer_to_modify_list, &bearer->to_modify_node);

+        else

+            ogs_warn("Bearer %d Duplicated", (int)e_rab->e_RAB_ID);

     }

     relocation = sgw_ue_check_if_relocated(mme_ue);

​

@@ -370,11 +370,268 @@

     test_ue_remove(test_ue);

 }

+static void test2_func(abts_case *tc, void *data)

+{

+    int rv;

+    ogs_socknode_t *s1ap1, *s1ap2;

+    ogs_socknode_t *gtpu1, *gtpu2;

+    ogs_pkbuf_t *emmbuf;

+    ogs_pkbuf_t *esmbuf;

+    ogs_pkbuf_t *sendbuf;

+    ogs_pkbuf_t *recvbuf;

+    ogs_s1ap_message_t message;

+

+    ogs_nas_5gs_mobile_identity_suci_t mobile_identity_suci;

+    test_ue_t *test_ue = NULL;

+    test_sess_t *sess = NULL;

+    test_bearer_t *bearer = NULL;

+

+    bson_t *doc = NULL;

+

+    /* Setup Test UE & Session Context */

+    memset(&mobile_identity_suci, 0, sizeof(mobile_identity_suci));

+

+    mobile_identity_suci.h.supi_format = OGS_NAS_5GS_SUPI_FORMAT_IMSI;

+    mobile_identity_suci.h.type = OGS_NAS_5GS_MOBILE_IDENTITY_SUCI;

+    mobile_identity_suci.routing_indicator1 = 0;

+    mobile_identity_suci.routing_indicator2 = 0xf;

+    mobile_identity_suci.routing_indicator3 = 0xf;

+    mobile_identity_suci.routing_indicator4 = 0xf;

+    mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;

+    mobile_identity_suci.home_network_pki_value = 0;

+

+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "3746000006");

+    ogs_assert(test_ue);

+

+    test_ue->e_cgi.cell_id = 0x1234560;

+    test_ue->nas.ksi = OGS_NAS_KSI_NO_KEY_IS_AVAILABLE;

+    test_ue->nas.value = OGS_NAS_ATTACH_TYPE_COMBINED_EPS_IMSI_ATTACH;

+

+    test_ue->k_string = "465b5ce8b199b49faa5f0a2ee238a6bc";

+    test_ue->opc_string = "e8ed289deba952e4283b54e88e6183ca";

+

+    sess = test_sess_add_by_apn(test_ue, "internet", OGS_GTP2_RAT_TYPE_EUTRAN);

+    ogs_assert(sess);

+

+    /* Two eNB connects to MME */

+    s1ap1 = tests1ap_client(AF_INET);

+    ABTS_PTR_NOTNULL(tc, s1ap1);

+

+    s1ap2 = tests1ap_client(AF_INET);

+    ABTS_PTR_NOTNULL(tc, s1ap2);

+

+    /* Two eNB connects to SGW */

+    gtpu1 = test_gtpu_server(1, AF_INET);

+    ABTS_PTR_NOTNULL(tc, gtpu1);

+

+    gtpu2 = test_gtpu_server(2, AF_INET);

+    ABTS_PTR_NOTNULL(tc, gtpu2);

+

+    /* S1-Setup Reqeust/Response for Source eNB */

+    sendbuf = test_s1ap_build_s1_setup_request(

+            S1AP_ENB_ID_PR_macroENB_ID, 0x54f64);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap1, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    recvbuf = testenb_s1ap_read(s1ap1);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(NULL, recvbuf);

+

+    /* S1-Setup Reqeust/Response for Target eNB */

+    sendbuf = test_s1ap_build_s1_setup_request(

+            S1AP_ENB_ID_PR_macroENB_ID, 0x54f65);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap2, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    recvbuf = testenb_s1ap_read(s1ap2);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(NULL, recvbuf);

+

+    /********** Insert Subscriber in Database */

+    doc = test_db_new_qos_flow(test_ue);

+    ABTS_PTR_NOTNULL(tc, doc);

+    ABTS_INT_EQUAL(tc, OGS_OK, test_db_insert_ue(test_ue, doc));

+

+    /* Send Attach Request */

+    memset(&sess->pdn_connectivity_param,

+            0, sizeof(sess->pdn_connectivity_param));

+    sess->pdn_connectivity_param.eit = 1;

+    sess->pdn_connectivity_param.pco = 1;

+    sess->pdn_connectivity_param.request_type =

+        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;

+    esmbuf = testesm_build_pdn_connectivity_request(sess, false);

+    ABTS_PTR_NOTNULL(tc, esmbuf);

+

+    memset(&test_ue->attach_request_param,

+            0, sizeof(test_ue->attach_request_param));

+    test_ue->attach_request_param.drx_parameter = 1;

+    test_ue->attach_request_param.tmsi_status = 1;

+    test_ue->attach_request_param.mobile_station_classmark_2 = 1;

+    test_ue->attach_request_param.additional_update_type = 1;

+    test_ue->attach_request_param.ue_usage_setting = 1;

+    emmbuf = testemm_build_attach_request(test_ue, esmbuf, false, false);

+    ABTS_PTR_NOTNULL(tc, emmbuf);

+

+    memset(&test_ue->initial_ue_param, 0, sizeof(test_ue->initial_ue_param));

+    sendbuf = test_s1ap_build_initial_ue_message(

+            test_ue, emmbuf, S1AP_RRC_Establishment_Cause_mo_Signalling, false);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+    rv = testenb_s1ap_send(s1ap1, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Receive Authentication Request */

+    recvbuf = testenb_s1ap_read(s1ap1);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(test_ue, recvbuf);

+

+    /* Send Authentication response */

+    emmbuf = testemm_build_authentication_response(test_ue);

+    ABTS_PTR_NOTNULL(tc, emmbuf);

+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap1, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Receive Security mode Command */

+    recvbuf = testenb_s1ap_read(s1ap1);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(test_ue, recvbuf);

+

+    /* Send Security mode complete */

+    test_ue->mobile_identity_imeisv_presence = true;

+    emmbuf = testemm_build_security_mode_complete(test_ue);

+    ABTS_PTR_NOTNULL(tc, emmbuf);

+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap1, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Receive ESM Information Request */

+    recvbuf = testenb_s1ap_read(s1ap1);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(test_ue, recvbuf);

+

+    /* Send ESM Information Response */

+    esmbuf = testesm_build_esm_information_response(sess);

+    ABTS_PTR_NOTNULL(tc, esmbuf);

+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap1, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Receive Initial Context Setup Request +

+     * Attach Accept +

+     * Activate Default Bearer Context Request */

+    recvbuf = testenb_s1ap_read(s1ap1);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(test_ue, recvbuf);

+

+    /* Send UE Capability Info Indication */

+    sendbuf = tests1ap_build_ue_radio_capability_info_indication(test_ue);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap1, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Send Initial Context Setup Response */

+    sendbuf = test_s1ap_build_initial_context_setup_response(test_ue);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap1, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Send Attach Complete + Activate default EPS bearer cotext accept */

+    test_ue->nr_cgi.cell_id = 0x1234502;

+    bearer = test_bearer_find_by_ue_ebi(test_ue, 5);

+    ogs_assert(bearer);

+    esmbuf = testesm_build_activate_default_eps_bearer_context_accept(

+            bearer, false);

+    ABTS_PTR_NOTNULL(tc, esmbuf);

+    emmbuf = testemm_build_attach_complete(test_ue, esmbuf);

+    ABTS_PTR_NOTNULL(tc, emmbuf);

+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap1, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Receive EMM information */

+    recvbuf = testenb_s1ap_read(s1ap1);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(test_ue, recvbuf);

+

+    /* Receive E-RAB Setup Request +

+     * Activate dedicated EPS bearer context request */

+    recvbuf = testenb_s1ap_read(s1ap1);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(test_ue, recvbuf);

+

+    /* Send E-RAB Setup Response */

​