Commit Graph

1697 Commits

Author SHA1 Message Date
Pau Espin b3ac5b35eb
[SMF] Fix potential null pointer dereference (#1324)
* [SMF] Fix potential null pointer dereference

Pointer "sess" was first dereferenced and later on checked for nullness.
This is clearly wrong. Rearrange the code path to make sure the check is
done first, then dereferenced.

* gitignore: Add subprojects/libtins

* cosmetic: Fix whitespace
2022-01-18 11:23:40 +09:00
Sukchan Lee 79239d8eff [IMPORTANT] changed network_access_mode: 0 (#1323)
The network access mode of HSS has been changed to 0 (Packet and Circuit).

Versions of MME prior to v2.4.2 did not use this value. Open5GS set
the attach result of Attach Complete message as it is by looking
at the attach type of the Attach Request message.

Now, if the network access mode of HSS is set to 2 (Only Packet),
this value is affected by MME from v2.4.3. Regardless of the attach type
of the Attach Request, the MME will set EPS Only to the attach result
of Attach Complete.
2022-01-16 12:35:55 +09:00
Sukchan Lee bbd1412a9e [SMF] change log-level from WARN to ERR (#1313) 2022-01-12 20:06:26 +09:00
Sukchan Lee cfd0193bbd [PCRF] fix the crash in flow->description (#1313) 2022-01-12 10:15:36 +09:00
Sukchan Lee 715e4c0b50 Shall cipher in the NAS message container IE
3GPP TS 24.501 version 16.6.0 Release 16
4.4 NAS security
4.4.6 Protection of initial NAS signalling messages

1) the UE needs to send non-cleartext IEs in a REGISTRATION REQUEST
or SERVICE REQUEST message, the UE includes the entire REGISTRATION
REQUEST or SERVICE REQUEST message (i.e. containing both cleartext IEs
and non-cleartext IEs) in the NAS message container IE and shall cipher
the value part of the NAS message container IE. The UE shall then send
a REGISTRATION REQUEST or SERVICE REQUEST message containing
the cleartext IEs and the NAS message container IE;
2022-01-05 22:39:06 +09:00
Sukchan Lee b988e7edce Use talloc for all memory pool (#1263) 2022-01-04 08:29:18 +09:00
Sukchan Lee 49d9ed03c7 [MME] fix the crash (#1263)
- Change memory pool using talloc library
- Apply ASN1 with r16.7.0
2021-12-28 17:38:11 +09:00
Sukchan Lee a0f2535cb5 A crafted packet from UE can crash SGW-U/UPF 2021-12-22 20:55:48 +09:00
Sukchan Lee 6f62839ad3 [MME] apply coding convention (#1295)
- limit 80 column
- Use space instead of tab
2021-12-20 23:25:04 +09:00
EugeneBogush ead9f380a9
update s1ap_handle_e_rab_setup_response (#1295)
* Update s1ap-handler.c

* Update s1ap-handler.c

* update for parse e_rab_setup_response

* Update s1ap-handler.c

* Update s1ap-handler.c

* Update s1ap-handler.c
2021-12-20 23:21:29 +09:00
Sukchan Lee d87d7c12c2 [MME] fix the crash with unknown S-NSSAI (#1287) 2021-12-17 21:42:26 +09:00
Sukchan Lee 54b919f65f Remove error message (#1294) 2021-12-17 20:51:11 +09:00
Supreeth Herle 1d496e92cd
[SMF] Use fe80::1 if link-local address is not available (#1294) 2021-12-17 20:48:22 +09:00
Kenny Barlee d02507e90a
print cellID in hex for consistency (#1292) 2021-12-17 11:37:36 +09:00
Sukchan Lee a3166ab537 Find link-local address in SMF-All address (#1291) 2021-12-17 11:33:54 +09:00
Supreeth Herle 232c387276
[SMF] Fix router advertisement as per rfc 4861 (#1291)
As per RFC 4861 Router advertisement message
format, Source Address MUST be the link-local address
assigned to the interface from which this message is sent.

Since SMF was not sending it as per RFC, certain
phones were not completing the procedure of stateless
IPv6 address autoconfiguration mentioned in
3GPP TS 23.401 version 15.12.0 Release 15, section 5.3.1.2.2
2021-12-17 10:38:37 +09:00
Sukchan Lee e302f727fd [Cx] Fix the HSS crash (#1264)
Use Visited-Network-Identifier(Cx) instead of Visited-PLMN-ID(s6a)
2021-12-12 14:33:42 +09:00
Sukchan Lee 07a61018b2 [AMF] fix the crash (#1280)
During PDU Session Establishment,
if gNB sends PDUSessionResourceReleaseResponse,
AMF was crashed.

In this case, AMF/SMF remove Session Context and sends ErrorIndication.
2021-12-11 20:35:16 +09:00
Sukchan Lee 74bbc6ecbf [MME] Add S1AP debug (#1263) 2021-12-11 17:28:05 +09:00
Sukchan Lee d7e23b7f6a [AMF] Registration reject for foreign IMSI (#1281) 2021-12-08 21:05:16 +09:00
Kenny Barlee 1a691e1d4a
change reject cause to 11 (#1281) 2021-12-08 20:57:54 +09:00
Sukchan Lee 561f1ac2f3 This always true. So I fixed it (#1266) 2021-12-08 20:56:26 +09:00
Sukchan Lee a5a5c424c1 Added AMF-initiated AM Policy Termination 2021-12-04 19:31:36 +09:00
Sukchan Lee aab8286401 [MME] fix the crash issue if enb_ue is NULL(#1275)
An assert occurs when a NAS message retransmission occurs.

Because there is no `enb_ue` context.

Therefore, before removing enb_ue, all Timers must be stopped
to prevent retransmission of NAS messages.
2021-12-04 10:53:49 +09:00
Sukchan Lee 6ae9ecc697 [MME] check PDN mismatch (#1263)
if PDN mismatched between UE and HSS, PDN connectivitiy reject message
will be sent to eNB.
2021-12-02 22:40:47 +09:00
Sukchan Lee b18cf1bce8 Update Coding rule (#1272) 2021-12-02 22:03:52 +09:00
Daniele 758cf9dd72
bsf bind delete possible fix (#1272)
Avoid to delete bsf binding when there are multiple pdu session associated to the same (s-nssai,dnn) tuple)
2021-12-02 22:00:01 +09:00
Sukchan Lee 448e07d5a9 [AMF/MME] fix the crash during reset (#1268) 2021-11-30 22:22:41 +09:00
Sukchan Lee 00a296a1de update log message (#1266)
1. rollback ogs_error() to ogs_warn()
To remove the print-out in the test code,
8/13 open5gs:epc / attach                    OK      10.60 s
bearer-test         : SUCCESS
session-test        : /11/30 15:59:34.556: [esm] ERROR: Invalid APN[ims2] (../src/mme/esm-handler.c:71)
SUCCESS

2. if( to if (
Coding standard in open5gs
2021-11-30 16:01:37 +09:00
EugeneBogush 4f8c34c7aa
Update esm-handler.c (#1266)
added more log info in case problem with APN
2021-11-30 15:52:20 +09:00
Sukchan Lee acd67c7aa6 [5GC] Service Request Race Condition(#1226)
When UE-triggered and Network-triggered Service Request was occurred at
the same time, we need UPF deactivation and UEContextRelease
2021-11-28 20:54:51 +09:00
Sukchan Lee d8655e07c6 Oops! fix the mistake in previous commit (83aac49) 2021-11-28 17:54:33 +09:00
Sukchan Lee 83aac49fd0 [MME] Add log (#1263) 2021-11-28 17:05:31 +09:00
Sukchan Lee ffc15a7d3d Update IPv6 configuration (#1250) 2021-11-28 16:42:47 +09:00
Sukchan Lee fc8c807da2 [SMF] fix the crash during IMS calls (#1238)
If PFCP is not deactivated, some eNBs send an GTP error indication.
To solve the problem, SMF deactivates the bearer that will be deleted.
2021-11-23 14:19:30 +09:00
Sukchan Lee d919b2744c [AMF] fix the memory problem (#1247)
1. memory corruption
- Overflow num_of_part in SBI message
2. null pointer dereference
- n2InfoContent->ngap_ie_type
2021-11-17 08:09:16 +09:00
Sukchan Lee 6a6f214785 [AMF/MME] stop timer when radio failure (#1242) 2021-11-16 12:59:04 +09:00
Sukchan Lee bfa34be222 fix the buffer overflow (CVE-2021-41794) 2021-11-15 15:49:58 +09:00
Sukchan Lee 0fb8279e36 VoNR added but not tested! 2021-11-14 21:07:56 +09:00
Sukchan Lee 0ea2142ba6 [MME] fix the crash bug (#1205)
If UE is in Authentication-EMM State and eNB is disconnected,
MME could be crashed.
2021-11-06 22:39:09 +09:00
Sukchan Lee 7567659a29 [UPF] remove link-local (#1217) 2021-10-30 22:34:47 +09:00
Sukchan Lee 5d234cb108 [GTPv2-C] Fix the Create Bearer Request (#1201)
Use instance 2 instead of instance 1
2021-10-26 15:26:10 +09:00
Balint Cristian 13bba81227
Minor fixes: instance extraction & python generator (#1212) 2021-10-24 08:37:11 +09:00
Sukchan Lee 489b633e08 Update Supported-Feature AVP (#1202)
Add the Vendor-Id AVP in Supported-Features AVP in
CCR(Credit-Control-Request)
2021-10-16 17:41:53 +09:00
Sukchan Lee 9ba4b317d2 Improve GTP message (#1201)
Extended Indication
Add Delay Value
2021-10-16 17:26:30 +09:00
Sukchan Lee b35febd9c4 [MME] fix the crash during GTP no context (#1205)
This bug occurs when SGW-C restarts and the next signal occurs
between MME and SGW-C
- Create Session Request/Response
- Modify Bearer Request/Response
2021-10-16 14:11:43 +09:00
Spencer Sevilla b600ab5724
removing diameter includes from upf (#1193) 2021-10-06 07:01:05 +09:00
Sukchan Lee 5e016937c7 Update URR contribution (#1190) 2021-10-04 22:28:32 +09:00
Sukchan Lee 13f1b390ae CVE-2021-41794 from NCC Group by Mark Tedman
When connecting to the UPF port for the PFCP protocol (8805) and sending
an association setup request followed by a session establishment request
with a PDI Network Instance set to ‘internet’, it causes a stack corruption
to occur.

So, ogs_fqdn_parse() fixed.
2021-10-01 22:41:03 +09:00
Sukchan Lee 127685f908 [SGW-C] fix the crash after restarting UPF (#1177) 2021-09-26 20:25:51 +09:00