Commit Graph

1764 Commits

Author SHA1 Message Date
Sukchan Lee 420c1d5ad3 [SMF] fix the PCO bug (#1357, #1358)
- SMF can handle PCO ID PAP (0xc023)
- SMF adds DNS servers to PCO IPCP only if UE requested
2022-02-19 16:05:07 +09:00
Sukchan Lee b4f382d360 [MEM] fix pkbuf problem in multi-threads (#1353)
We should use talloc in multi-threads instead of pkbuf.
Now, pkbuf library only uses single-thread environment.
2022-02-19 09:47:44 +09:00
Pau Espin 137ed99dd5
[GTPv1C] Send conditional IE Reordering Required in CreatePDPCtxResp (#1374)
It seems to be actually mandatory in GGSN->SGN directon, though it is
ignored in Release99 upwards. Let's hardcode it to 0 for now, should be
fine in the majority of cases.
2022-02-19 06:36:54 +09:00
Pau Espin 2056a5b500
[PCRF] Fix trailing whitespace (#1372) 2022-02-19 06:33:46 +09:00
Pau Espin 8b1bdf42a2
[SMF] Fix adding 2 IP addresses to one GSN Address IE (#1371)
In the event we have 2 local IP addresses available for use, put the one
having same IP version in "GGSN Address *" IE, and the one with the
other IP version in "Alternative GGSN Address *" IE.
2022-02-19 06:33:19 +09:00
Pau Espin 8cc70694db
Introduce Gn interface (GTPv1C) Support to PGW (#1351)
* [CORE] tlv: Store mode in ogs_tlv_t

This allows specifying the format of the IE for each individual IE,
hence allowing messages containing IEs formatted in different ways.

This is needed in order to support parsing GTPv1-C, since messages
contain IEs with different structure (TLV vs TV). Hence, this is a
preparation patch to add support for parsing TVs in ogs-tlv.c/.h.

* [CORE] tlv: Support parsing msg with both TLV and TV in it

IEs of type TV are sometimes used in GTPv1-C. Current tlv parser/builder
doesn't provide with ways to parse messages which contain TV formatted
IEs. This patch adds the relevant types and ways to encode/decode them.

Furthermore, the current parser/builder allows parsing/building messages
containing the exact same format in all its IEs. A new parser function
is added which allows parsing messages of different types (TV, TLV)
mixed in the same message. In order to be able to do so, it uses the
general msg_mode passed to it in order to know the general TLV format
(in essence, the length of the Tag field, and also the length of the
Length field if applicable each IE).

Looking up the instance in the TLV description is left undone and
hadcoded to 0, since the only user so far requiring this API is GTPv1-C,
which has no instances.

* [CORE] tlv: Support repeated tag+instance parsing TLV message

In GTPv2C, repeated IEs (same tag) are easily differentiated by the
Instance byte, which provides info to match different decoded
structures. In GTPv1C though, there's no Instance byte, and we still
encounter repeated IEs (like GSN Address in Create PDP Context Request).
Hence, the TLV decoder needs to be updated to track count of IEs found
(identified by tag+instance, where instance is always 0 in GTPv1C) and
get the proper description index + offset into the decoded structure.

* [GTP]: Move GTPv2-C specifics to its own libgtp subdir

This will allow adding GTPv1-C code by the side. Most GTPv2 code is left
in this patch as "gtp" instead of renaming it to "gtp2" in order to
avoid massive changes. It can be done at a later stage if wanted.

* [GTP] Support generating GTPv1-C messages

* [SMF] Add Gn interface support

This patch introduces GTPv1C support to open5gs-smfd. With it,
open5gs-becomes a GGSN too, where SGSN can connect to, hence supporting
GERAN and UTRAN networks.
2022-02-18 22:23:45 +09:00
Sukchan Lee 3eab4be135 fix MacOSX compile error (#1354, #1355) 2022-02-18 22:00:57 +09:00
Pau Espin 757285bf25
Fix trailing whitespace (#1365)
* [SMF] Fix trailing whitespace

* [CORE] Fix trailing whitespace

* [GTP] Fix trailing whitespace
2022-02-14 20:11:04 +09:00
Sukchan Lee 906e7c5046 [UPF] Consider RS message for IP spoofing (#1354) 2022-02-14 20:07:08 +09:00
Sukchan Lee 0e1ab26ee5 Check if Source IP address spoofing (#1354, #1355) 2022-02-14 17:34:22 +09:00
Pau Espin 5fff69306f
logging improvements (#1348)
* [SMF] Fix typo in debug message

* [SMF] Add debug messages to follow messages received in N4
2022-02-02 23:23:12 +09:00
Sukchan Lee a7d164c28d [NRF] fix the crash (#1347)
`reqNfInstanceId` is optional in the Subscription.
So, we need to consider it.
2022-01-31 23:19:26 +09:00
Sukchan Lee 83d56fe40d [ALL] Fix the memory leak (#1282) 2022-01-31 22:58:52 +09:00
Sukchan Lee 340b23af94 [SMF] Fixed case without transportLayerAddr(#1341)
Fixed the crash if TransportLayerAddress in GTPTunnel does not exist
2022-01-26 08:09:26 +09:00
Sukchan Lee 3b275edec7 [SBI] Remove one octet length in FQDN (#1333) 2022-01-23 13:49:03 +09:00
Sukchan Lee 866ae78f5e [NRF] fix the crash for invalid FQDN (#1333) 2022-01-22 09:34:38 +09:00
Sukchan Lee 8955fdcd5d [SBI] FQDN bug from talloc (#1328) 2022-01-19 17:10:39 +09:00
Pau Espin b3ac5b35eb
[SMF] Fix potential null pointer dereference (#1324)
* [SMF] Fix potential null pointer dereference

Pointer "sess" was first dereferenced and later on checked for nullness.
This is clearly wrong. Rearrange the code path to make sure the check is
done first, then dereferenced.

* gitignore: Add subprojects/libtins

* cosmetic: Fix whitespace
2022-01-18 11:23:40 +09:00
Sukchan Lee 79239d8eff [IMPORTANT] changed network_access_mode: 0 (#1323)
The network access mode of HSS has been changed to 0 (Packet and Circuit).

Versions of MME prior to v2.4.2 did not use this value. Open5GS set
the attach result of Attach Complete message as it is by looking
at the attach type of the Attach Request message.

Now, if the network access mode of HSS is set to 2 (Only Packet),
this value is affected by MME from v2.4.3. Regardless of the attach type
of the Attach Request, the MME will set EPS Only to the attach result
of Attach Complete.
2022-01-16 12:35:55 +09:00
Sukchan Lee bbd1412a9e [SMF] change log-level from WARN to ERR (#1313) 2022-01-12 20:06:26 +09:00
Sukchan Lee cfd0193bbd [PCRF] fix the crash in flow->description (#1313) 2022-01-12 10:15:36 +09:00
Sukchan Lee 715e4c0b50 Shall cipher in the NAS message container IE
3GPP TS 24.501 version 16.6.0 Release 16
4.4 NAS security
4.4.6 Protection of initial NAS signalling messages

1) the UE needs to send non-cleartext IEs in a REGISTRATION REQUEST
or SERVICE REQUEST message, the UE includes the entire REGISTRATION
REQUEST or SERVICE REQUEST message (i.e. containing both cleartext IEs
and non-cleartext IEs) in the NAS message container IE and shall cipher
the value part of the NAS message container IE. The UE shall then send
a REGISTRATION REQUEST or SERVICE REQUEST message containing
the cleartext IEs and the NAS message container IE;
2022-01-05 22:39:06 +09:00
Sukchan Lee b988e7edce Use talloc for all memory pool (#1263) 2022-01-04 08:29:18 +09:00
Sukchan Lee 49d9ed03c7 [MME] fix the crash (#1263)
- Change memory pool using talloc library
- Apply ASN1 with r16.7.0
2021-12-28 17:38:11 +09:00
Sukchan Lee a0f2535cb5 A crafted packet from UE can crash SGW-U/UPF 2021-12-22 20:55:48 +09:00
Sukchan Lee 6f62839ad3 [MME] apply coding convention (#1295)
- limit 80 column
- Use space instead of tab
2021-12-20 23:25:04 +09:00
EugeneBogush ead9f380a9
update s1ap_handle_e_rab_setup_response (#1295)
* Update s1ap-handler.c

* Update s1ap-handler.c

* update for parse e_rab_setup_response

* Update s1ap-handler.c

* Update s1ap-handler.c

* Update s1ap-handler.c
2021-12-20 23:21:29 +09:00
Sukchan Lee d87d7c12c2 [MME] fix the crash with unknown S-NSSAI (#1287) 2021-12-17 21:42:26 +09:00
Sukchan Lee 54b919f65f Remove error message (#1294) 2021-12-17 20:51:11 +09:00
Supreeth Herle 1d496e92cd
[SMF] Use fe80::1 if link-local address is not available (#1294) 2021-12-17 20:48:22 +09:00
Kenny Barlee d02507e90a
print cellID in hex for consistency (#1292) 2021-12-17 11:37:36 +09:00
Sukchan Lee a3166ab537 Find link-local address in SMF-All address (#1291) 2021-12-17 11:33:54 +09:00
Supreeth Herle 232c387276
[SMF] Fix router advertisement as per rfc 4861 (#1291)
As per RFC 4861 Router advertisement message
format, Source Address MUST be the link-local address
assigned to the interface from which this message is sent.

Since SMF was not sending it as per RFC, certain
phones were not completing the procedure of stateless
IPv6 address autoconfiguration mentioned in
3GPP TS 23.401 version 15.12.0 Release 15, section 5.3.1.2.2
2021-12-17 10:38:37 +09:00
Sukchan Lee e302f727fd [Cx] Fix the HSS crash (#1264)
Use Visited-Network-Identifier(Cx) instead of Visited-PLMN-ID(s6a)
2021-12-12 14:33:42 +09:00
Sukchan Lee 07a61018b2 [AMF] fix the crash (#1280)
During PDU Session Establishment,
if gNB sends PDUSessionResourceReleaseResponse,
AMF was crashed.

In this case, AMF/SMF remove Session Context and sends ErrorIndication.
2021-12-11 20:35:16 +09:00
Sukchan Lee 74bbc6ecbf [MME] Add S1AP debug (#1263) 2021-12-11 17:28:05 +09:00
Sukchan Lee d7e23b7f6a [AMF] Registration reject for foreign IMSI (#1281) 2021-12-08 21:05:16 +09:00
Kenny Barlee 1a691e1d4a
change reject cause to 11 (#1281) 2021-12-08 20:57:54 +09:00
Sukchan Lee 561f1ac2f3 This always true. So I fixed it (#1266) 2021-12-08 20:56:26 +09:00
Sukchan Lee a5a5c424c1 Added AMF-initiated AM Policy Termination 2021-12-04 19:31:36 +09:00
Sukchan Lee aab8286401 [MME] fix the crash issue if enb_ue is NULL(#1275)
An assert occurs when a NAS message retransmission occurs.

Because there is no `enb_ue` context.

Therefore, before removing enb_ue, all Timers must be stopped
to prevent retransmission of NAS messages.
2021-12-04 10:53:49 +09:00
Sukchan Lee 6ae9ecc697 [MME] check PDN mismatch (#1263)
if PDN mismatched between UE and HSS, PDN connectivitiy reject message
will be sent to eNB.
2021-12-02 22:40:47 +09:00
Sukchan Lee b18cf1bce8 Update Coding rule (#1272) 2021-12-02 22:03:52 +09:00
Daniele 758cf9dd72
bsf bind delete possible fix (#1272)
Avoid to delete bsf binding when there are multiple pdu session associated to the same (s-nssai,dnn) tuple)
2021-12-02 22:00:01 +09:00
Sukchan Lee 448e07d5a9 [AMF/MME] fix the crash during reset (#1268) 2021-11-30 22:22:41 +09:00
Sukchan Lee 00a296a1de update log message (#1266)
1. rollback ogs_error() to ogs_warn()
To remove the print-out in the test code,
8/13 open5gs:epc / attach                    OK      10.60 s
bearer-test         : SUCCESS
session-test        : /11/30 15:59:34.556: [esm] ERROR: Invalid APN[ims2] (../src/mme/esm-handler.c:71)
SUCCESS

2. if( to if (
Coding standard in open5gs
2021-11-30 16:01:37 +09:00
EugeneBogush 4f8c34c7aa
Update esm-handler.c (#1266)
added more log info in case problem with APN
2021-11-30 15:52:20 +09:00
Sukchan Lee acd67c7aa6 [5GC] Service Request Race Condition(#1226)
When UE-triggered and Network-triggered Service Request was occurred at
the same time, we need UPF deactivation and UEContextRelease
2021-11-28 20:54:51 +09:00
Sukchan Lee d8655e07c6 Oops! fix the mistake in previous commit (83aac49) 2021-11-28 17:54:33 +09:00
Sukchan Lee 83aac49fd0 [MME] Add log (#1263) 2021-11-28 17:05:31 +09:00
Sukchan Lee ffc15a7d3d Update IPv6 configuration (#1250) 2021-11-28 16:42:47 +09:00
Sukchan Lee fc8c807da2 [SMF] fix the crash during IMS calls (#1238)
If PFCP is not deactivated, some eNBs send an GTP error indication.
To solve the problem, SMF deactivates the bearer that will be deleted.
2021-11-23 14:19:30 +09:00
Sukchan Lee d919b2744c [AMF] fix the memory problem (#1247)
1. memory corruption
- Overflow num_of_part in SBI message
2. null pointer dereference
- n2InfoContent->ngap_ie_type
2021-11-17 08:09:16 +09:00
Sukchan Lee 6a6f214785 [AMF/MME] stop timer when radio failure (#1242) 2021-11-16 12:59:04 +09:00
Sukchan Lee bfa34be222 fix the buffer overflow (CVE-2021-41794) 2021-11-15 15:49:58 +09:00
Sukchan Lee 0fb8279e36 VoNR added but not tested! 2021-11-14 21:07:56 +09:00
Sukchan Lee 0ea2142ba6 [MME] fix the crash bug (#1205)
If UE is in Authentication-EMM State and eNB is disconnected,
MME could be crashed.
2021-11-06 22:39:09 +09:00
Sukchan Lee 7567659a29 [UPF] remove link-local (#1217) 2021-10-30 22:34:47 +09:00
Sukchan Lee 5d234cb108 [GTPv2-C] Fix the Create Bearer Request (#1201)
Use instance 2 instead of instance 1
2021-10-26 15:26:10 +09:00
Balint Cristian 13bba81227
Minor fixes: instance extraction & python generator (#1212) 2021-10-24 08:37:11 +09:00
Sukchan Lee 489b633e08 Update Supported-Feature AVP (#1202)
Add the Vendor-Id AVP in Supported-Features AVP in
CCR(Credit-Control-Request)
2021-10-16 17:41:53 +09:00
Sukchan Lee 9ba4b317d2 Improve GTP message (#1201)
Extended Indication
Add Delay Value
2021-10-16 17:26:30 +09:00
Sukchan Lee b35febd9c4 [MME] fix the crash during GTP no context (#1205)
This bug occurs when SGW-C restarts and the next signal occurs
between MME and SGW-C
- Create Session Request/Response
- Modify Bearer Request/Response
2021-10-16 14:11:43 +09:00
Spencer Sevilla b600ab5724
removing diameter includes from upf (#1193) 2021-10-06 07:01:05 +09:00
Sukchan Lee 5e016937c7 Update URR contribution (#1190) 2021-10-04 22:28:32 +09:00
Sukchan Lee 13f1b390ae CVE-2021-41794 from NCC Group by Mark Tedman
When connecting to the UPF port for the PFCP protocol (8805) and sending
an association setup request followed by a session establishment request
with a PDI Network Instance set to ‘internet’, it causes a stack corruption
to occur.

So, ogs_fqdn_parse() fixed.
2021-10-01 22:41:03 +09:00
Sukchan Lee 127685f908 [SGW-C] fix the crash after restarting UPF (#1177) 2021-09-26 20:25:51 +09:00
Sukchan Lee 9c589ac584 [PFCP] include outer header removal(ext-deletion) 2021-09-04 18:03:04 +09:00
Sukchan Lee e730530f7b [SMF] Exception handling in session release(#1155)
- UE changes the airplain-mode. However, it does not send PDU
    session complete message
    - Added exception handling for PDU session release
2021-09-04 16:14:18 +09:00
Sukchan Lee 233db575ea [SMF] fix crash when BSF is not running [#1149] 2021-08-29 00:02:39 +09:00
Sukchan Lee e2fe15d2ae [SMF] TAI/ECGI is not required in WLAN (#1039) 2021-08-27 11:40:58 +09:00
Sukchan Lee ab7f565dd6 [MME/AMF] Use Non-UE signalling in Paging (#1134) 2021-08-18 19:42:27 +09:00
Sukchan Lee 3564fe5c8c [SMF/UPF] Clarify FALLBACK SUBNET [#1128] 2021-08-14 16:52:53 +09:00
Sukchan Lee e5594a57b9 [AMF] fix an invalid GSM reject aligungr#375
TS24.501
8.2.11 DL NAS transport
8.2.11.4 5GMM cause

The AMF shall include this IE when the Payload container IE
contains an uplink payload which was not forwarded and
the Payload container type IE is not set to "Multiple payloads".

-0-
As such, this function 'nas_5gs_send_gsm_reject()' must be used
only when an N1 SM message has been forwarded to the SMF.
2021-08-14 12:01:13 +09:00
Sukchan Lee af5b3aa931 [MME/AMF] fix the crash during timeout (#1122) 2021-08-08 12:38:15 +09:00
Sukchan Lee 831b29973f [PCF] fix the 'NULL' AfEvent in VoNR (#1120) 2021-08-08 09:10:37 +09:00
Sukchan Lee 68edcd6438 fix the SMF crash when num of flow > 8 (#1108) 2021-08-07 14:23:20 +09:00
Sukchan Lee 7e5a5d7511 fix the SMF/PCRF crash when bearer > 8 (#1108) 2021-07-29 18:10:28 +09:00
Sukchan Lee acb4db5dd1 Fix the crash when number of flow > 8 (#1108) 2021-07-28 14:00:03 +09:00
Sukchan Lee c6b13be92a do the finishing touches (#1108) 2021-07-27 20:33:46 +09:00
herlesupreeth bd6eea4fa5 Introduce checks for maximum accepted flow rules for a bearer in Gx path 2021-07-23 14:22:55 +02:00
Sukchan Lee e1c79647e2 [SMF] session data was accessed when NULL (#1105) 2021-07-23 16:24:59 +09:00
Supreeth Herle 362393d0ff
fix: session data was accessed when NULL resulting in crash (#1105) 2021-07-23 16:22:46 +09:00
Sukchan Lee 039b9d0aaa SBI updated
- openapi-generator version 5.2.0
- add priority/capacity/load in NFProfile/NFService
- add AllowedNfTypes in NFProfile/NFService
2021-07-16 17:02:33 +09:00
Sukchan Lee 1326fc85dc [MME] fix the bug when GTPv2 conflict (#1095) 2021-07-15 21:20:56 +09:00
Sukchan Lee 4667b99c92 fix the BUG in SWx diameter (#1039) 2021-07-13 22:00:04 +09:00
Sukchan Lee 7cfeb2e9f9 Change SIGWINCH log-level from ERROR to INFO 2021-07-12 19:52:28 +09:00
Sukchan Lee 005cd30e02 fix the bug for Real PCF unable to PATCH (#1086) 2021-07-12 17:30:45 +09:00
Sukchan Lee f278d58a69 Upgrade SBI(Service-based Interface)
* OpenAPI Generator version: 4.3.1 ==> 5.5.1
* Specification : r16.8.0 (20210629)
2021-07-07 17:32:55 +09:00
Sukchan Lee 65e96dd75c [AMF] fix the bug for making allowed NSSAI (#910) 2021-07-01 16:23:27 +09:00
Sukchan Lee 997554bbb7 Avoid defining variables in the middle (#1068) 2021-06-24 12:42:31 +09:00
Josh Bailey 38ff2dc6f7
trim buffer to correct size after creating ARP or ND reply. (#1068) 2021-06-24 12:37:58 +09:00
Sukchan Lee a396ea8fc1 [AMF] NG Setup Failure with proper cause (#1064) 2021-06-22 17:56:45 +09:00
Sukchan Lee 50f403279a [AMF/MME] fix the crash bug (#1061) 2021-06-22 16:13:06 +09:00
Sukchan Lee 4537142929 [EPC] Support ePDG Interface (#1039) 2021-06-21 22:36:38 +09:00
Sukchan Lee e0869104c6 [PCF] fix the crash during UE attach (#1059) 2021-06-17 21:26:34 +09:00
Sukchan Lee c48f107520 [MME] fix the crash when release a UE (#1058) 2021-06-17 17:16:16 +09:00
Sukchan Lee 9e664a744b [MME] refine the pull request #1049 2021-06-13 12:03:36 +09:00
R. Medeiros a252fae84f
Indication Dual Address Bearer for create session request. (#1049)
* Update mme-s11-build.c

Add indication Dual Address Bearer in the create session request when the PDN is IPv4v6 Type, Info: 3GPP TS 29.274

* Update mme-s11-build.c
2021-06-13 11:52:23 +09:00
Sukchan Lee e31a8474b2 [SMF/UPF] fix the crash bug (#1034, #1006) 2021-06-08 21:14:18 +09:00