Cellular Network Infrastructure » Core Network (CN) » OsmoMSC

related, the VLR accepts any LAI (MCC-MNC-LAC), see vlr_lu_fsm.c:

/* Determine if given location area is served by this VLR */
static bool lai_in_this_vlr(struct vlr_instance *vlr,
                            const struct osmo_location_area_id *lai)
{
        /* TODO: VLR needs to keep a locally configued list of LAIs */
        return true;
}

vlr_proc_acc_req() stores a LAI in struct proc_arq_priv but it is never used.

We shouldn't allow arbitrary non matching MCC/MNC. Please add a ttcn3 test for it whose failure wil be a reminder

I have written a small test case:

private const Cell_Identity unknown_cid := { '678'H, 'f90'H, 1, 0 };

/* Paging by CGI with unknown MCC/MNC: Verify nothing is paged. */
testcase TC_paging_imsi_nochan_cgi_unknown_cid() runs on test_CT {
       var template BSSMAP_FIELD_CellIdentificationList cid_list;
       cid_list := { cIl_CGI := { ts_BSSMAP_CI_CGI(unknown_cid.mcc, unknown_cid.mnc, unknown_cid.lac, unknown_cid.ci) } };
       f_pageing_helper('001010000000006'H, cid_list, c_BtsId_none);
       f_shutdown_helper();
}

However, I cannot verify it because my ttcn3 setup no longer works. It keeps failing with

Dynamic test case error: Port IPA_CTRL has neither connections nor mappings. Message cannot be sent on it.

I might eventually need support to figure this out to make progress on this issue.
I have been trying to figure out the problem but haven't gotten anywhere.

Regression test proposed in https://gerrit.osmocom.org/#/c/7403/

Above change has been merged. Looks like we're all good now.

Sorry, but this issue is not about paging and not about ttcn3, it is about l3_compl and the VLR,
i.e. when a subscriber comes in with a LU, CM Service Request or a paging response, that we look at what PLMN it is sending along.
I'm not actually entirely sure of the meaning of the PLMN sent in those l3 compl messages:
if it's just the SIM card's home PLMN we may not need to validate it at all.
The VLR has a comment that we need a local list of LAIs managed by the VLR...
This issue is thus about clarifying those questions and actually implementing things in our code base if needed.
Reopening.

For Location Update Requests, the value is obtained from the SIM:

(GSM 04.08)

9.2.15.1 Location area identification
The location area identification stored in the SIM is used.

CM Service Requests do not contain a PLMN.
The LAI is derived from the subscriber connection in libmsc/gsm_04_08.c:gsm48_rx_mm_serv_req().

Paging responses do not contain a PLMN either.
The LAI is derived from the subscriber connection in libmsc/gsm_04_08.c:gsm48_rx_mm_pag_resp().

Does this information help?

Additionally, vlr_proc_acc_req() receives a LAI but does nothing with it.

I notice that this patch of yours https://gerrit.osmocom.org/#/c/7281/ actually fixes the part in bssmap_rx_l3_compl() to match the cell identifier to the network's PLMN. That's certainly interesting to note here.

The open question is whether we want to validate that the SIM card's PLMN matches the current network.
I assume "disallow mismatching PLMN" vs. "allow this list of PLMN" vs. "allow all PLMN".
Adding this feature is certainly not urgent. A nice thing to do would be to log the mismatch, but then again we also log the IMSI all the time...

Slightly confusing here is that I've created the issue to talk about two completely separate aspects,

• one is the cell identity of the BSC/RNC during L3 complete,
• and the other is the SIM card's PLMN to be validated in the VLR.

Remaining now is the SIM<->VLR part.
So, do we have a SIM <-> Network PLMN mismatch test in ttcn3 yet?

To avoid cross-discussing separate issues, I've created the following issues to replace this one:
#3162 #3163 #3164 #3165