sysmocom
/
open5gs
forked from acouzens/open5gs
11
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[SGWU/UPF] Fixed crashed by gTPTunnel (#2313) 

SGWU/UPF crashes with ogs_pfcp_setup_far_gtpu_node
by a special crafted gTPTunnel.transportLayerAddress
This commit is contained in:
Sukchan Lee 2023-05-14 10:19:37 +09:00
parent 16387078cd
commit e567a01ae8
2 changed files with 26 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/sgwu/sxa-handler.c
View File

@ -103,7 +103,11 @@ void sgwu_sxa_handle_session_establishment_request(
/* Setup GTP Node */
ogs_list_for_each(&sess->pfcp.far_list, far) {
ogs_assert(OGS_ERROR != ogs_pfcp_setup_far_gtpu_node(far));
if (OGS_ERROR == ogs_pfcp_setup_far_gtpu_node(far)) {
ogs_fatal("CHECK CONFIGURATION: sgwu.gtpu");
ogs_fatal("ogs_pfcp_setup_far_gtpu_node() failed");
goto cleanup;
}
if (far->gnode)
ogs_pfcp_far_f_teid_hash_set(far);
}
@ -268,7 +272,11 @@ void sgwu_sxa_handle_session_modification_request(
/* Setup GTP Node */
ogs_list_for_each(&sess->pfcp.far_list, far) {
ogs_assert(OGS_ERROR != ogs_pfcp_setup_far_gtpu_node(far));
if (OGS_ERROR == ogs_pfcp_setup_far_gtpu_node(far)) {
ogs_fatal("CHECK CONFIGURATION: sgwu.gtpu");
ogs_fatal("ogs_pfcp_setup_far_gtpu_node() failed");
goto cleanup;
}
if (far->gnode)
ogs_pfcp_far_f_teid_hash_set(far);
}

24
src/upf/n4-handler.c
View File

@ -131,6 +131,17 @@ void upf_n4_handle_session_establishment_request(
if (cause_value != OGS_PFCP_CAUSE_REQUEST_ACCEPTED)
goto cleanup;
/* Setup GTP Node */
ogs_list_for_each(&sess->pfcp.far_list, far) {
if (OGS_ERROR == ogs_pfcp_setup_far_gtpu_node(far)) {
ogs_fatal("CHECK CONFIGURATION: upf.gtpu");
ogs_fatal("ogs_pfcp_setup_far_gtpu_node() failed");
goto cleanup;
}
if (far->gnode)
ogs_pfcp_far_f_teid_hash_set(far);
}
/* PFCPSEReq-Flags */
if (sereq_flags.restoration_indication == 1) {
for (i = 0; i < num_of_created_pdr; i++) {
@ -143,13 +154,6 @@ void upf_n4_handle_session_establishment_request(
restoration_indication = true;
}
/* Setup GTP Node */
ogs_list_for_each(&sess->pfcp.far_list, far) {
ogs_assert(OGS_ERROR != ogs_pfcp_setup_far_gtpu_node(far));
if (far->gnode)
ogs_pfcp_far_f_teid_hash_set(far);
}
for (i = 0; i < num_of_created_pdr; i++) {
pdr = created_pdr[i];
ogs_assert(pdr);
@ -372,7 +376,11 @@ void upf_n4_handle_session_modification_request(
/* Setup GTP Node */
ogs_list_for_each(&sess->pfcp.far_list, far) {
ogs_assert(OGS_ERROR != ogs_pfcp_setup_far_gtpu_node(far));
if (OGS_ERROR == ogs_pfcp_setup_far_gtpu_node(far)) {
ogs_fatal("CHECK CONFIGURATION: upf.gtpu");
ogs_fatal("ogs_pfcp_setup_far_gtpu_node() failed");
goto cleanup;
}
if (far->gnode)
ogs_pfcp_far_f_teid_hash_set(far);
}