`ogs_pfcp_pdr_rule_find_by_packet()` compares `addr_len` bytes of the rule's
address, where `addr_len` is the *packet's* length. The rule's own family flags
(`ipv4_src`, `ipv4_dst`, `ipv6_src`, `ipv6_dst`) were never consulted, so the
memcmp compared only the first four bytes of an IPv6 address against an IPv4
packet, and the first four bytes of an IPv4 address against an IPv6 packet.
The SMF installs `permit out 58 from ff02::2/128 to assigned` for every session,
so an IPv4 packet whose source begins ff 02 00 00 — 255.2.0.0 — matched that RS
rule and was forwarded to the CP function's TEID instead of the N6 interface,
dropping out of the default flow's usage statistics.
Skip a rule whose address family differs from the packet's. Rules that name no
address (both flags zero) still match either family.
Suppress expected diagnostics around individual test calls instead of
muting entire suites. Preserve FATAL messages and debug/trace output,
and restore the original log level before continuing.
Initialize unit-test log domains before applying command-line options
and remove redundant overrides that reset the configured log levels.
hss_cx_download_user_data() registers one Public Identity per MSISDN as
sip:<msisdn>@<visited-network> and tel:<msisdn>. TS 23.003 13.4 requires the canonical form of
a Tel URI to be "tel:+<CC><NDC><SN>", and RFC 3966 3 says a tel URI without the "+" is a local
number that needs a phone-context, so an I-CSCF asking for the canonical form -- which is what
the Cx interface is specified to carry -- does not match the identity the HSS stored.
impu_find_by_id() matches a Public Identity as a whole string, so the LIR for tel:+<msisdn>
finds no IMPU, hss_cx_get_server_name() returns NULL, and the HSS answers
DIAMETER_SUCCESS_SERVER_NAME_NOT_STORED (2004) with no Server-Name. The subscriber then sees
480 Temporarily Unavailable. The bytes in msisdn[].bcd come from ogs_buffer_to_bcd(), so they
are digits only and the "+" is never already there.
The volte client sent the same identity it expects the HSS to have registered, which is why the
test passed with the non-canonical form. Both move together, so the test now pins the form:
test_cx_lia_cb asserts Result-Code DIAMETER_SUCCESS with no Experimental-Result-Code, which the
HSS only produces when the identity matches.
Reported in #4841.
The parser recorded the peer-supplied lengths while clamping the copy, so the builder read past ms_network_capability[] and imeisv[]. Size the MS Network Capability buffer to the 8 octets it is documented to hold.
Use sample.yaml for EIR integration tests and share equipment fixtures
across integration suites. Enable EIR in SEPP examples and configure
gNB tests to use the serving EIR and NRF.
Remove the misleading warning on successful EIR lookups and log
generic equipment fallback at info level.# Please enter the commit message for your changes. Lines starting
Issues: #4577
Use eir.yaml as the single default configuration and select tests through
ABTS arguments, following the handover runner. Remove mode/policy
environment variables, eir-allow.yaml, and duplicate integration runs.
Move direct SBI endpoint parsing and readiness checks into service-test.
Always provision GUTI equipment fixtures and run EIR rejection cases.
Add eir-fsm to the eir suite and extend AMF/MME state-machine coverage for
policy outcomes and deferred session cleanup. Cover EIR-disabled and
allow-policy paths in FSM tests instead of separate integration runs.
An unprotected Registration Request using a registered UE's GUTI could
release its existing PDU sessions before authentication.
Defer session release until authentication, Security Mode Control and
the optional EIR check complete. Wait for all release responses before
continuing UDM registration, and prevent stale responses from resuming
a cancelled procedure.
Restore the previous NAS security context on authentication or SMC
failure, and ignore unverified Deregistration Requests during these
procedures.
Add unit and EIR integration regressions for session preservation and
replacement with EIR enabled or disabled and one or two PDU sessions.
Complete the SMF/BSF SBI configuration and make EIR fixtures safe to rerun.
An unverified Attach using a registered UE's GUTI could delete its
existing PDN sessions before authentication.
Keep the sessions through AKA, Security Mode Control and the optional
S13 EIR check. Delete them before ULR, and resume Attach only after
the last Delete Session Response.
Restore the saved NAS security context on authentication or SMC failure,
and discard unverified Detach requests during AKA and SMC. On deletion
timeout, cancel Attach continuation and retain the existing
UE_CONTEXT_REMOVE cleanup path.
Add EPC integration tests under tests/eir with S13 enabled and disabled,
covering one and two PDNs. Add focused unit coverage for restoration,
deletion ordering, cancellation and late responses.
A non-hex character after '%' made ogs_from_hex() return a negative
value, which was then shifted left (UBSan, OSS-Fuzz sbi_request_fuzz).
Decode the escape only when both characters are hex digits. Otherwise
the '%' is dropped, as a truncated escape at the end already was.
Malformed IMEISV, IMSI, SGsAP and PCO fields could trigger
out-of-bounds accesses or assertions on peer-controlled input.
- Require a 9-octet, even-parity IMEISV before writing its 16 digits
and terminator. Leave the output unchanged on failure and have
MME/AMF skip storing rejected identities. Preserve the existing
filler and digit acceptance policy.
- Check the AMF IMEISV length before reading its identity type,
including when the received IE has zero length.
- Validate the SGWC IMSI before UE lookup, which asserts on an
empty hash key, and reject nonpositive lengths in UE creation.
- Replace SGsAP DOWNLINK-UNITDATA assertions on received IMSI and
NAS container fields with error logging and early returns.
- Check the original GTP PCO length against the NAS destination
size before narrowing or copying. Omit an oversized optional
PCO instead of failing the builder, since callers assert on
message-build failure.
UEContextReleaseComplete and SGsAP-Paging-Request are sent over different
SCTP associations, so sending them in sequence does not guarantee that
the MME processes the release before the paging request.
If SGs paging is handled first, the UE can still be ECM-CONNECTED. The
MME then follows the connected-mode handling path instead of sending the
S1AP Paging expected by these tests, causing them to block until the
Meson timeout expires.
Add a short delay after UEContextReleaseComplete in the MT idle, MT SMS,
and crash CSFB tests to allow the asynchronous S1 release processing to
complete before starting the SGs paging sequence.
Return INT64_MAX directly when clamping SBI bitrates, avoiding an
intermediate double conversion that rounds the value to 2^63.
Cast Diameter test host identities to uint8_t * when assigning AVP
octet-string data to resolve pointer-sign warnings.
Log skipped hash removal at warning level when the entry belongs to
another context, since this can occur during context replacement.
A gNB/eNB can register the same node ID on a new SCTP association before
the old association's shutdown is processed. Removing the old context
can then delete the replacement's ID mapping. This caused the macOS N2
handover test to hang: the AMF could not find the target gNB despite its
successful NG Setup, while the test waited for a Handover Request.
Owner-checked removal alone is insufficient. ogs_hash_set() replaces
only the value of an existing entry, retaining the key pointer into
the old context. Subsequent ID reassignment or pool reuse can therefore
break lookups even when the replacement's mapping is not deleted.
Add ogs_hash_set_rekey() to remove and reinsert an entry with the
supplied key pointer, leaving ordinary ogs_hash_set() semantics intact.
Use it for gNB-ID and eNB-ID registration, and use the existing
ogs_hash_unset_if_owner() when removing contexts or unindexing their
previous IDs before reassignment.
Document why both operations are needed and the caller's responsibility
for key lifetime and access serialization. Keep the existing ID
replacement policy and association lifetime unchanged.
Add core and AMF/MME regression tests covering key replacement,
displaced-owner cleanup, old key storage changes, ID reassignment,
repeated registration and ID 0.
- macOS: install MongoDB 8.0 (mongodb/brew) and wait until ready,
add loopback aliases used by tests, use brew --prefix paths,
run the full test suite
- Use meson test -t 3 (timeout multiplier) on macOS and Ubuntu
- usrsctp: set infolen before usrsctp_recvv() so that PPID is
returned; sctp-test now checks PPID with usrsctp as well
- Reject absolute URIs without a path to prevent the NULL dereference
found by CIFuzz, and add regression coverage.
- Reset reserved EIR fixtures and subscribers before each test case
to recover from interrupted runs, and stop setup on database errors.
- Add regression coverage for stale EIR fixture recovery.
- Wait for pending AMF responses and preserve NGAP IDs in deregistration
and GUTI tests.
- Log events for finalized NF instance FSMs as warnings.
- Enable SCTP PPID checks for usrsctp.
- Parenthesize concatenated JSON literals to fix Clang warnings.
Make intentional string literal concatenation explicit in the SBI
message tests to avoid -Wstring-concatenation.
Wait for the Configuration Update Command and the old connection's
PDU Session Resource Setup Request before starting mobility registration.
Preserve the old and new NGAP IDs for context release and setup.
This stabilizes test sequencing; the AMF event-queue race remains.
Share the AMF/MME action type and parser in lib/app, and length-aware
BCD validation in lib/proto. Validate S13 User-Name before conversion
to reject embedded NUL bytes while preserving existing length rules.
Add unit tests for policy parsing and bounded digit validation.
Related PR: #4802#4795#4708
Skip emergency registration while preserving checks for other registrations
that complete SMC. Share PEI validation and apply missing_pei_action to
unusable identities.
Add unit tests for check eligibility and exercise both allow and reject
policies in the AMF and MME integration tests.
Related PR: #4802#4795#4708
Run the S13 attach cases in the eir suite on the app harness, so one
open5gs-eird serves N5g-eir to the AMF and S13 to the MME out of the
same eir collection.
Fold the EPC side of s13.yaml into eir.yaml and drop s13.yaml. The
attach cases use SVN 09 of the test IMEI to stay clear of the SVN 00-07
used by registration-test.c.
Related PR: #4802#4795#4708
Extend transform.py to handle all-reference oneOf schemas with distinct
JSON types and preserve nullable alternatives in the union template.
Regenerate affected models and adapt AMF/AUSF 5G-AKA handlers to the
Av5gAka union member. Add transform and JSON roundtrip regression tests.
Related PR: #4807
Move missing-IMEISV policy handling out of the Diameter sender and
require an active attach with a matching serving S1 context before
processing an ECA.
Remove unreachable branches, simplify unit test setup, extend guard
coverage, and tidy license headers, formatting, and documentation.
Related PR: #4802
- Fix duplicate eir_thread in tests/app/app-init.c after the upstream merge
- Remove the IMEISV cache and the attach pre-check; check after Security
Mode Complete as the AMF does, without forcing re-authentication on the
valid-security-context path
- Ignore stale ECA responses, so a delayed answer cannot trigger ULR or
Attach Reject after the procedure has been cancelled or replaced
- Make User-Name optional in the ECR
- Keep S13 disabled by default in eir.yaml.in
- Ship eir.conf and the EIR TLS key/certificate in the Debian package
The CP2UP QER association was disabled together with UP2CP QFI matching,
causing IPv6 Router Advertisements to be forwarded over N3 without a
PDU Session Container.
Restore the association with the default QoS flow's QER so the UPF adds
a DL PDU Session Container with the configured QFI. Keep UP2CP QFI
matching disabled and preserve EPC forwarding, where no 5GS QFI is
assigned.
Update the RA receive tests to require a DL PDU Session Container and
a QFI belonging to an established QoS flow in the matching 5GC session.
This makes the existing SLAAC tests fail when PSC/QFI is missing.
Add header and RA length checks without requiring PSC/QFI for EPC.
Issues #4804
tests/s13 attaches a UE through the MME against open5gs-eird over S13
and checks what follows Security Mode Complete: ESM Information Request
when the device is admitted, Attach Reject #6 when it is not. Seven
cases cover the three statuses, an unknown device, and the per-subscriber
overrides of the eir collection. The EPC test harness starts the EIR
when an eir section is present, and the test UE now records the Attach
Reject cause.
Query an EIR over S13 (TS 29.272) after Security Mode Complete on an
initial attach, before the S6a ULR. The decision table mirrors the AMF's
N5g-eir handling: WHITELISTED and GREYLISTED are admitted, BLACKLISTED is
rejected with #6 Illegal ME, DIAMETER_ERROR_EQUIPMENT_UNKNOWN follows
unknown_action (#7), a missing IMEISV follows missing_pei_action (#7) and
any other failure follows failure_action (#17). Verdicts are cached per
IMEISV with an LRU and a configurable TTL, so the attach fast path with a
valid security context can apply a fresh verdict without an SMC.
An invalid policy value is a configuration error, as in the AMF.
Update dict.c
Update meson.build
8-byte TBCD input without the 0xF filler needs 17 bytes, but the
IMSI/MSISDN BCD buffers are 16.
Take the output size and return NULL when the digits do not fit,
without writing anything. Callers reject the message or keep the
stored identity instead of storing a truncated one. SGWC now rejects
an IMSI longer than OGS_MAX_IMSI_LEN, as SMF already does.
MSISDN and IMEI(SV) are still truncated to their maximum length
before decoding, as before.
AF resPrio/preemptCap/preemptVuln in MediaComponent now update the
ARP of the PCC rule and the SMF modifies the QoS flow when only the
ARP has changed.
- resPrio is mapped through the new pcf.reservation_priorities config
(no standard mapping); an unmapped resPrio leaves the priority level
unchanged and is logged.
- preemptCap/preemptVuln are applied directly.
- An update whose media component carries only ARP keeps the bitrates
negotiated so far. This is decided by field presence on the parsed
MediaComponentRm, so an unmapped resPrio or "0 bps" is handled.
Related PR: #4793
Encode Framed-Route and Framed-IPv6-Route values as
"<prefix> <gateway> <metric>" at Gx and PFCP boundaries while keeping
route prefixes in session data.
Add shared build/parse helpers and accept legacy bare prefixes on
receipt. Validate IPv4 addresses before applying class A/B/C default
prefix lengths, using ogs_inet_pton() and be32toh() from lib/core.
Leave IPv6 addresses without a prefix length unchanged.
Reject empty prefixes and embedded NULs, then use ogs_strndup() for
bounded copying without requiring NUL-terminated input.
Send framed routes in CCA-Initial only and convert both EPC and 5GC
PDR paths. Use ERROR-level logs for rejected routes and document
subscriber-data delivery and wire-format compatibility.
Add regression tests for format conversion, classful defaults,
invalid inputs and non-NUL-terminated buffers.
Upgrade UPFs before SMFs and PCRFs: older UPFs cannot parse the new
wire-format strings.
Related PR: #4757
Include the string declarations used by the harness and suppress
expected core error logs from rejected fuzz inputs.
Clarify the flow-description path and input-length comment.
Related PR: #4752
Fix undefined behavior caused by shifting a negative value while
building IPv4 prefix masks.
Reject port numbers with leading zeros to prevent the decimal
validator and the base-detecting ipfw parser from interpreting the
same input differently.
Related PR: #4752
Pass short GTPv1 inputs to ogs_gtp1_parse_msg() so the fuzzer also
exercises header-length validation. Rename the GTPv2 message variable
to distinguish it from the GTPv1 counterpart.
The fuzzer exposed undefined behavior in 32-bit TLV decoding when the
first octet has its high bit set. It was promoted to int before being
shifted by 24, which can overflow a signed int.
Cast the first octet to uint32_t before shifting in both decoding paths
and add regression coverage for high-bit values.
Related PR: #4751
* Move UPF loop variable declarations outside for statements.
* Support older MongoDB C drivers in EIR tests.
* Remove an unused cleanup label and fix a misspelled default label.
* Save the H-SMF modification stream ID before sending or queuing N1N2
to handle NAS completion arriving before the AMF response.
* Clear the stream ID even if the stream has expired, and prevent
late AMF responses from restoring a consumed ID.
Related PR : #4708
Handle EIR checks within the AMF security mode state, preserve failure
policies, and clean up pending transactions when leaving the state.
Prepare missing database constraints at EIR startup while preserving
existing settings. Log setup failures and continue with runtime validation.
Centralize numeric identity validation and improve failure diagnostics.
Move EIR tests into a dedicated suite with its own configuration, covering
database queries, HTTP/2 responses, and registration outcomes.
Update configuration defaults, packaging, and documentation.
PR: #4708
