bsc: Add TC_{early,late}_conn_fail()

Those test cases simulate a BTS-originated RLL CONN FAIL IND at
"unusual" time:

a) before we actually establish any RLL
b) after / while we're tearing down the RLL

This is triggering an osmo-bsc segfault, see OS#3182.

Change-Id: I324c410d7565c189dbc91df577d92b87c036732c
Related: OS#3182

1 files changed, 61 insertions, 0 deletions

diff --git a/bsc/BSC_Tests.ttcn b/bsc/BSC_Tests.ttcn
index a5509fd6..2f99bcb2 100644
--- a/bsc/BSC_Tests.ttcn
+++ b/bsc/BSC_Tests.ttcn
@@ -739,6 +739,62 @@ testcase TC_chan_rel_conn_fail() runs on test_CT {
 	setverdict(pass);
 }
 
+/* Test behavior of early CONN FAIL IND from BTS (before EST IND!) */
+/* See also https://www.osmocom.org/issues/3182 */
+testcase TC_early_conn_fail() runs on test_CT {
+	var RSL_Message rx_rsl;
+	var DchanTuple dt;
+
+	f_init(1);
+
+	/* BTS->BSC: Send CHAN RQD and wait for allocation; acknowledge it */
+	dt.rsl_chan_nr := f_chreq_act_ack(f_rnd_octstring(1), 23);
+
+	/* BTS->BSC: simulate CONN FAIL IND */
+	f_ipa_tx(0, ts_RSL_CONN_FAIL_IND(dt.rsl_chan_nr, RSL_ERR_RADIO_LINK_FAIL));
+
+	/* BTS->BSC: Expect RF channel release from BSC on Abis */
+	rx_rsl := f_exp_ipa_rx(0, tr_RSL_MsgTypeD(RSL_MT_RF_CHAN_REL), 10.0);
+
+	/* BTS<-BSC: respond with CHAN REL ACK */
+	f_ipa_tx(0, ts_RSL_RF_CHAN_REL_ACK(dt.rsl_chan_nr));
+
+	setverdict(pass);
+}
+
+/* Test behavior of late CONN FAIL IND from BTS (ater REL IND!) */
+/* See also https://www.osmocom.org/issues/3182 */
+testcase TC_late_conn_fail() runs on test_CT {
+	var RSL_Message rx_rsl;
+	var DchanTuple dt;
+
+	f_init(1);
+
+	dt := f_est_dchan('23'O, 23, '00010203040506'O);
+
+	/* BSC<-MSC: Instruct BSC to clear connection */
+	BSSAP.send(ts_BSSAP_DATA_req(dt.sccp_conn_id, ts_BSSMAP_ClearCommand(0)));
+
+	/* BTS->BSC: expect BSC to deactivate SACCH */
+	rx_rsl := f_exp_ipa_rx(0, tr_RSL_DEACT_SACCH(dt.rsl_chan_nr));
+
+	/* BTS->BSC: simulate a late CONN FAIL IND from BTS */
+	f_ipa_tx(0, ts_RSL_CONN_FAIL_IND(dt.rsl_chan_nr, RSL_ERR_RADIO_LINK_FAIL));
+
+	/* BTS<-BSC: Expect RF channel release from BSC on Abis */
+	rx_rsl := f_exp_ipa_rx(0, tr_RSL_MsgTypeD(RSL_MT_RF_CHAN_REL), 10.0);
+	/* BTS->BSC: respond with CHAN REL ACK */
+	f_ipa_tx(0, ts_RSL_RF_CHAN_REL_ACK(dt.rsl_chan_nr));
+
+	/* BSC->MSC: expect Clear Complete from BSC */
+	BSSAP.receive(tr_BSSAP_DATA_ind(dt.sccp_conn_id, tr_BSSMAP_ClearComplete));
+
+	/* BSC<-MSC: MSC disconnects as requested. */
+	BSSAP.send(ts_BSSAP_DISC_req(dt.sccp_conn_id, 0));
+
+	setverdict(pass);
+}
+
 function f_expect_chan_rel(integer bts_nr, RslChannelNr rsl_chan_nr, boolean flush := true,
 			   boolean handle_rll_rel := true) runs on test_CT {
 
@@ -2515,6 +2571,11 @@ control {
 	execute( TC_dyn_pdch_ipa_act_nack() );
 	execute( TC_dyn_pdch_osmo_act_deact() );
 	execute( TC_dyn_pdch_osmo_act_nack() );
+
+	/* at bottom as they might crash OsmoBSC before OS#3182 is fixed */
+	execute( TC_early_conn_fail() );
+	execute( TC_late_conn_fail() );
+
 }
 
 }