msc: add check IMEI testsosmith/check-imei-msc

Extend BSC_ConnHdlr with new check IMEI related parameters. Add tests
for check IMEI and check IMEI early for multiple auth variations, as
well as variants where the HLR would respond with NOK or ERR.

Note that we can safely set "check-imei-rqd 0" in f_init(), because the
latest OsmoMSC version already suppors this VTY command.

Two tests do not always pass, sometimes the RAN connection breaks
before the test finishes (TC_lu_imsi_auth_tmsi_check_imei_err and
TC_lu_imsi_auth_tmsi_check_imei_nack). I have added them as expected
errors in the expected-results.xml.

Related: OS#2542
Change-Id: Ic34bb8dc8547cafb5a53df03884554dd4f72956d

4 files changed, 420 insertions, 3 deletions

diff --git a/library/GSUP_Types.ttcn b/library/GSUP_Types.ttcn
index e6275388..74fbfc41 100644
--- a/library/GSUP_Types.ttcn
+++ b/library/GSUP_Types.ttcn
@@ -538,10 +538,30 @@ template (value) GSUP_PDU ts_GSUP_CHECK_IMEI_REQ(hexstring imsi, hexstring imei)
 	ts_GSUP(OSMO_GSUP_MSGT_CHECK_IMEI_REQUEST, {
 			valueof(ts_GSUP_IE_IMSI(imsi)), valueof(ts_GSUP_IE_IMEI(imei)) });
 
+template GSUP_PDU tr_GSUP_CHECK_IMEI_REQ(
+	template hexstring imsi,
+	template hexstring imei
+) := tr_GSUP(
+	OSMO_GSUP_MSGT_CHECK_IMEI_REQUEST,
+	{
+		tr_GSUP_IE_IMSI(imsi),
+		tr_GSUP_IE_IMEI(imei),
+		tr_GSUP_IE_Message_Class(OSMO_GSUP_MESSAGE_CLASS_SUBSCRIBER_MANAGEMENT)
+	}
+);
+
+template (value) GSUP_PDU ts_GSUP_CHECK_IMEI_RES(hexstring imsi, GSUP_IMEIResult result) :=
+	ts_GSUP(OSMO_GSUP_MSGT_CHECK_IMEI_RESULT, {
+		valueof(ts_GSUP_IE_IMSI(imsi)), valueof(ts_GSUP_IE_IMEI_Result(result)) });
+
 template GSUP_PDU tr_GSUP_CHECK_IMEI_RES(template hexstring imsi, template GSUP_IMEIResult result) :=
 	tr_GSUP(OSMO_GSUP_MSGT_CHECK_IMEI_RESULT, {
 		tr_GSUP_IE_IMSI(imsi), tr_GSUP_IE_IMEI_Result(result) });
 
+template (value) GSUP_PDU ts_GSUP_CHECK_IMEI_ERR(hexstring imsi, integer cause) :=
+	ts_GSUP(OSMO_GSUP_MSGT_CHECK_IMEI_ERROR, {
+		valueof(ts_GSUP_IE_IMSI(imsi)), valueof(ts_GSUP_IE_Cause(cause)) });
+
 template GSUP_PDU tr_GSUP_CHECK_IMEI_ERR(template hexstring imsi, template integer cause) :=
 	tr_GSUP(OSMO_GSUP_MSGT_CHECK_IMEI_ERROR, {
 		tr_GSUP_IE_IMSI(imsi), tr_GSUP_IE_Cause(cause) });
diff --git a/msc/BSC_ConnectionHandler.ttcn b/msc/BSC_ConnectionHandler.ttcn
index 1dd4d059..a5a110d1 100644
--- a/msc/BSC_ConnectionHandler.ttcn
+++ b/msc/BSC_ConnectionHandler.ttcn
@@ -70,7 +70,11 @@ type record BSC_ConnHdlrNetworkPars {
 	OCT1	kc_support,
 	boolean expect_tmsi,
 	boolean	expect_auth,
-	boolean	expect_ciph
+	boolean	expect_ciph,
+	boolean expect_imei,
+	boolean expect_imei_early,
+	GSUP_IMEIResult check_imei_result,
+	boolean check_imei_error
 }
 
 type record BSC_ConnHdlrPars {
@@ -433,6 +437,82 @@ function f_mm_auth() runs on BSC_ConnHdlr
 	}
 }
 
+function f_mm_imei() runs on BSC_ConnHdlr
+{
+	var PDU_DTAP_MT dtap_mt;
+	var GSUP_PDU gsup_msg;
+	var MobileL3_CommonIE_Types.MobileIdentityLV mi;
+
+	if (not g_pars.net.expect_imei) {
+		return
+	}
+
+	/* MSC <-> BSC: ID req/rsp for IMEI */
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_MM_ID_Req('010'B /* IMEI */))) {
+		mi := valueof(ts_MI_IMEI_LV(g_pars.imei));
+		BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_MM_ID_Rsp(mi)));
+		}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(?)) -> value dtap_mt {
+		setverdict(fail, "Expected ID REQ for IMEI DTAP MT message, but got: ", dtap_mt);
+		mtc.stop;
+		}
+	}
+
+	/* MSC <-> HLR: Check IMEI req/res/err */
+	alt {
+	[g_pars.net.check_imei_error] GSUP.receive(tr_GSUP_CHECK_IMEI_REQ(g_pars.imsi, g_pars.imei)) {
+		GSUP.send(ts_GSUP_CHECK_IMEI_ERR(g_pars.imsi, 96 /* Invalid Mandatory Information */));
+		}
+	[not g_pars.net.check_imei_error] GSUP.receive(tr_GSUP_CHECK_IMEI_REQ(g_pars.imsi, g_pars.imei)) {
+		GSUP.send(ts_GSUP_CHECK_IMEI_RES(g_pars.imsi, g_pars.net.check_imei_result));
+		}
+	[] GSUP.receive(?) -> value gsup_msg {
+		setverdict(fail, "Expected CHECK IMEI REQ GSUP message (with IMEI:", g_pars.imei, " and IMSI: ",
+			   g_pars.imsi, "), but got: ", gsup_msg);
+		mtc.stop;
+		}
+	}
+}
+
+function f_mm_imei_early() runs on BSC_ConnHdlr
+{
+	var PDU_DTAP_MT dtap_mt;
+	var GSUP_PDU gsup_msg;
+	var MobileL3_CommonIE_Types.MobileIdentityLV mi;
+
+	if (not g_pars.net.expect_imei_early) {
+		return
+	}
+
+	/* MSC <-> BSC: ID req/rsp for IMEISV */
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_MM_ID_Req('011'B /* IMEISV */))) {
+		mi := valueof(ts_MI_IMEISV_LV(g_pars.imei));
+		BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_MM_ID_Rsp(mi)));
+		}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(?)) -> value dtap_mt {
+		setverdict(fail, "Expected ID REQ for IMEISV DTAP MT message, but got: ", dtap_mt);
+		mtc.stop;
+		}
+	}
+
+	/* MSC <-> HLR: Check IMEI req/res/err */
+	alt {
+	[g_pars.net.check_imei_error] GSUP.receive(tr_GSUP_CHECK_IMEI_REQ(g_pars.imsi, g_pars.imei)) {
+		GSUP.send(ts_GSUP_CHECK_IMEI_ERR(g_pars.imsi, 96 /* Invalid Mandatory Information */));
+		}
+	[not g_pars.net.check_imei_error] GSUP.receive(tr_GSUP_CHECK_IMEI_REQ(g_pars.imsi, g_pars.imei)) {
+		GSUP.send(ts_GSUP_CHECK_IMEI_RES(g_pars.imsi, g_pars.net.check_imei_result));
+		}
+	[] GSUP.receive(?) -> value gsup_msg {
+		setverdict(fail, "Expected CHECK IMEI REQ GSUP message (with IMEI:", g_pars.imei, " and IMSI: ",
+			   g_pars.imsi, "), but got: ", gsup_msg);
+		mtc.stop;
+		}
+	}
+}
+
 function f_mm_common() runs on BSC_ConnHdlr
 {
 	f_mm_auth();
@@ -508,8 +588,10 @@ runs on BSC_ConnHdlr {
 		f_ranap_initial_ue(l3_lu);
 	}
 
+	f_mm_imei_early();
 	f_mm_common();
 	f_msc_lu_hlr();
+	f_mm_imei();
 	f_accept_reject_lu();
 	/* FIXME: there could be pending SMS or other common procedures by the MSC, let's ignore them */
 	f_expect_clear();
diff --git a/msc/MSC_Tests.ttcn b/msc/MSC_Tests.ttcn
index 4b00e345..7df2e76e 100644
--- a/msc/MSC_Tests.ttcn
+++ b/msc/MSC_Tests.ttcn
@@ -335,6 +335,7 @@ function f_init(integer num_bsc := 1, boolean sgsap := false, boolean gsup := tr
 	/* set some defaults */
 	f_vty_config(MSCVTY, "network", "authentication optional");
 	f_vty_config(MSCVTY, "msc", "assign-tmsi");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd 0");
 	f_vty_config(MSCVTY, "network", "encryption a5 0");
 	if (mp_enable_osmux_test) {
 		if (osmux) {
@@ -367,7 +368,11 @@ runs on MTC_CT return BSC_ConnHdlrPars {
 		kc_support := '0A'O,	/* A5/1 and A5/3 enabled */
 		expect_tmsi := true,
 		expect_auth := false,
-		expect_ciph := false
+		expect_ciph := false,
+		expect_imei := false,
+		expect_imei_early := false,
+		check_imei_result := OSMO_GSUP_IMEI_RESULT_ACK,
+		check_imei_error := false
 	};
 	var BSC_ConnHdlrPars pars := {
 		sccp_addr_own := g_bssap[ran_idx].sccp_addr_own,
@@ -5531,6 +5536,287 @@ testcase TC_ho_inter_msc_out() runs on MTC_CT {
 	vc_conn.done;
 }
 
+private function f_tc_lu_imsi_auth_tmsi_check_imei(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_auth := true;
+	pars.net.expect_imei := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_auth_tmsi_check_imei() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd 1");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_check_imei), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_auth3g_tmsi_check_imei(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_auth := true;
+	pars.use_umts_aka := true;
+	pars.net.expect_imei := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_auth3g_tmsi_check_imei() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd 1");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth3g_tmsi_check_imei), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_noauth_tmsi_check_imei(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_imei := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_noauth_tmsi_check_imei() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd 1");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_noauth_tmsi_check_imei), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_noauth_notmsi_check_imei(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_tmsi := false;
+	pars.net.expect_imei := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_noauth_notmsi_check_imei() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "msc", "no assign-tmsi");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd 1");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_noauth_notmsi_check_imei), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_auth_tmsi_check_imei_nack(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	var PDU_ML3_MS_NW l3_lu;
+	var PDU_DTAP_MT dtap_mt;
+
+	pars.net.expect_auth := true;
+	pars.net.expect_imei := true;
+	pars.net.check_imei_result := OSMO_GSUP_IMEI_RESULT_NACK;
+	f_init_handler(pars);
+
+	/* Cannot use f_perform_lu() as we expect a reject */
+	l3_lu := f_build_lu_imsi(g_pars.imsi)
+	f_create_gsup_expect(hex2str(g_pars.imsi));
+	f_bssap_compl_l3(l3_lu);
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	f_mm_common();
+	f_msc_lu_hlr();
+	f_mm_imei();
+
+	/* Expect reject. As of writing, sometimes it passes, sometimes we get a broken pipe (race condition)! */
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) {
+		setverdict(pass);
+		}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(?)) -> value dtap_mt {
+		setverdict(fail, "Expected LU reject BSSAP message, got: ", dtap_mt);
+		mtc.stop;
+		}
+	}
+}
+testcase TC_lu_imsi_auth_tmsi_check_imei_nack() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd 1");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_check_imei_nack), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_auth_tmsi_check_imei_err(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	var PDU_ML3_MS_NW l3_lu;
+	var PDU_DTAP_MT dtap_mt;
+
+	pars.net.expect_auth := true;
+	pars.net.expect_imei := true;
+	pars.net.check_imei_error := true;
+	f_init_handler(pars);
+
+	/* Cannot use f_perform_lu() as we expect a reject */
+	l3_lu := f_build_lu_imsi(g_pars.imsi)
+	f_create_gsup_expect(hex2str(g_pars.imsi));
+	f_bssap_compl_l3(l3_lu);
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	f_mm_common();
+	f_msc_lu_hlr();
+	f_mm_imei();
+
+	/* Expect reject. As of writing, sometimes it passes, sometimes we get a broken pipe (race condition)! */
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) {
+		setverdict(pass);
+		}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(?)) -> value dtap_mt {
+		setverdict(fail, "Expected LU reject BSSAP message, got: ", dtap_mt);
+		mtc.stop;
+		}
+	}
+}
+testcase TC_lu_imsi_auth_tmsi_check_imei_err() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd 1");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_check_imei_err), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_auth_tmsi_check_imei_early(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_auth := true;
+	pars.net.expect_imei_early := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_auth_tmsi_check_imei_early() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd early");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_check_imei_early), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_auth3g_tmsi_check_imei_early(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_auth := true;
+	pars.use_umts_aka := true;
+	pars.net.expect_imei_early := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_auth3g_tmsi_check_imei_early() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd early");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth3g_tmsi_check_imei_early), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_noauth_tmsi_check_imei_early(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_imei_early := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_noauth_tmsi_check_imei_early() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd early");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_noauth_tmsi_check_imei_early), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_noauth_notmsi_check_imei_early(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_tmsi := false;
+	pars.net.expect_imei_early := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_noauth_notmsi_check_imei_early() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "msc", "no assign-tmsi");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd early");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_noauth_notmsi_check_imei_early), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_auth_tmsi_check_imei_early_nack(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	var PDU_ML3_MS_NW l3_lu;
+	var PDU_DTAP_MT dtap_mt;
+
+	pars.net.expect_auth := true;
+	pars.net.expect_imei_early := true;
+	pars.net.check_imei_result := OSMO_GSUP_IMEI_RESULT_NACK;
+	f_init_handler(pars);
+
+	/* Cannot use f_perform_lu() as we expect a reject */
+	l3_lu := f_build_lu_imsi(g_pars.imsi)
+	f_create_gsup_expect(hex2str(g_pars.imsi));
+	f_bssap_compl_l3(l3_lu);
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	f_mm_imei_early();
+
+	/* Expect reject */
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) {
+		setverdict(pass);
+		}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(?)) -> value dtap_mt {
+		setverdict(fail, "Expected LU reject BSSAP message, got: ", dtap_mt);
+		mtc.stop;
+		}
+	}
+}
+testcase TC_lu_imsi_auth_tmsi_check_imei_early_nack() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd early");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_check_imei_early_nack), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_auth_tmsi_check_imei_early_err(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	var PDU_ML3_MS_NW l3_lu;
+	var PDU_DTAP_MT dtap_mt;
+
+	pars.net.expect_auth := true;
+	pars.net.expect_imei_early := true;
+	pars.net.check_imei_error := true;
+	f_init_handler(pars);
+
+	/* Cannot use f_perform_lu() as we expect a reject */
+	l3_lu := f_build_lu_imsi(g_pars.imsi)
+	f_create_gsup_expect(hex2str(g_pars.imsi));
+	f_bssap_compl_l3(l3_lu);
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	f_mm_imei_early();
+
+	/* Expect reject */
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) {
+		setverdict(pass);
+		}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(?)) -> value dtap_mt {
+		setverdict(fail, "Expected LU reject BSSAP message, got: ", dtap_mt);
+		mtc.stop;
+		}
+	}
+}
+testcase TC_lu_imsi_auth_tmsi_check_imei_early_err() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd early");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_check_imei_early_err), 5);
+	vc_conn.done;
+}
 
 control {
 	execute( TC_cr_before_reset() );
@@ -5641,6 +5927,19 @@ control {
 
 	execute( TC_ho_inter_msc_out() );
 
+	execute( TC_lu_imsi_auth_tmsi_check_imei() );
+	execute( TC_lu_imsi_auth3g_tmsi_check_imei() );
+	execute( TC_lu_imsi_noauth_tmsi_check_imei() );
+	execute( TC_lu_imsi_noauth_notmsi_check_imei() );
+	execute( TC_lu_imsi_auth_tmsi_check_imei_nack() );
+	execute( TC_lu_imsi_auth_tmsi_check_imei_err() );
+	execute( TC_lu_imsi_auth_tmsi_check_imei_early() );
+	execute( TC_lu_imsi_auth3g_tmsi_check_imei_early() );
+	execute( TC_lu_imsi_noauth_tmsi_check_imei_early() );
+	execute( TC_lu_imsi_noauth_notmsi_check_imei_early() );
+	execute( TC_lu_imsi_auth_tmsi_check_imei_early_nack() );
+	execute( TC_lu_imsi_auth_tmsi_check_imei_early_err() );
+
 	/* Run this last: at the time of writing this test crashes the MSC */
 	execute( TC_lu_imsi_auth_tmsi_encr_3_1_log_msc_debug() );
 	execute( TC_gsup_mt_multi_part_sms() );
diff --git a/msc/expected-results.xml b/msc/expected-results.xml
index a60e2ec6..ca8edd2d 100644
--- a/msc/expected-results.xml
+++ b/msc/expected-results.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0"?>
-<testsuite name='Titan' tests='84' failures='2' errors='1' skipped='0' inconc='0' time='MASKED'>
+<testsuite name='Titan' tests='96' failures='2' errors='3' skipped='0' inconc='0' time='MASKED'>
   <testcase classname='MSC_Tests' name='TC_cr_before_reset' time='MASKED'/>
   <testcase classname='MSC_Tests' name='TC_lu_imsi_noauth_tmsi' time='MASKED'/>
   <testcase classname='MSC_Tests' name='TC_lu_imsi_noauth_notmsi' time='MASKED'/>
@@ -97,4 +97,20 @@
   <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_encr_3_1_log_msc_debug' time='MASKED'/>
   <testcase classname='MSC_Tests' name='TC_gsup_mt_multi_part_sms' time='MASKED'/>
   <testcase classname='MSC_Tests' name='TC_mo_cc_bssmap_clear' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_check_imei' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth3g_tmsi_check_imei' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_noauth_tmsi_check_imei' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_noauth_notmsi_check_imei' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_check_imei_nack' time='MASKED'/>
+    <error type='DTE'></error>
+  </testcase>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_check_imei_err' time='MASKED'/>
+    <error type='DTE'></error>
+  </testcase>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_check_imei_early' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth3g_tmsi_check_imei_early' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_noauth_tmsi_check_imei_early' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_noauth_notmsi_check_imei_early' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_check_imei_early_nack' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_check_imei_early_err' time='MASKED'/>
 </testsuite>