Fix the negative left shift reported by sbi_request_fuzz in
ogs_ascii_to_hex(). Mask converted digits to a nibble and pass
unsigned char values to ctype functions.
Log missing buffers, invalid lengths and non-hex characters in the
checked decoder. Delegate the string wrapper to it without duplicate
logs or an additional header dependency.
Require exactly six hex digits for AMF IDs and propagate conversion
failures through GUAMI discovery, NF profiles and AMF/UDM/SMF/PCF
handlers, with contextual error logs.
Validate UDM registration GUAMI before replacing the stored callback
URI. Include an INVALID_MANDATORY_INFORMATION N1 reject when SMF
rejects an invalid GUAMI, matching the existing No Guami path.
The specs clearly state SEID must be zero in this case:
"""
3GPP TS 29.244 7.2.2.4.2 Conditions for Sending SEID=0 in PFCP Header
If a peer's SEID is not available, the SEID field shall still be present in the header and its value shall be set to "0" in the
following messages:
- PFCP Session Establishment Request message on Sxa/Sxb/Sxc/N4;
"""
Before this patch, open5gs-smfd (and probably also open5gs-swgc though I
didn't check) were sending SEID!=0 (the previous existing SEID) during
PFCP session restoration after Recovery Timestamp increase quicked in.
This is wrong imho, because at that time the UPF is believed to be
disassociated and hence PFCP Association Setup procedure is run before
attempting PFCP session restoring. Which means, in practice, after a
PFCP Association Setup the previous sessions (SEID) lose any kind of
meaning, and hence they are all considered as not available.
Inform the OCS that "a service termination has happened, e.g. PDP
context, IP CAN bearer termination or service data flow termination.",
as per 3GPP TS 32.299 7.2.175.
PR #4863 adds Delete Bearer Request handling to release EPC sessions
when their UPF becomes unavailable, addressing the stale-session
problem reported in issue #4860.
However, reselect_upf() iterates over all sessions associated with the
failed UPF, including sessions that have not completed establishment.
For example, a Create Session Request rejected because UE IP allocation
fails can leave a session in the initial state with pfcp_node set but
an empty bearer list. A subsequent heartbeat timeout then reaches the
new ogs_assert(linked_bearer), causing the SMF to abort.
Restrict the EPC release handling to smf_gsm_state_operational before
looking up the default bearer. This excludes failed initial sessions
and avoids sending Delete Bearer Request for sessions still being
established or already being released.
The operational state is also the state that handles Delete Bearer
Response and continues the session release procedure.
Related PR: https://github.com/open5gs/open5gs/pull/4863
Related issue: https://github.com/open5gs/open5gs/issues/4860
A GTP-U packet ending right after a non-zero Next Extension Header
Type was read one byte past its end. Such packets were rejected
anyway, so only the over-read is removed.
Found by gtpu_header_fuzz.
Nothing records whether a UE's handovers work. The AMF sees every step and
knows the SUPI throughout, so it is the one place that can say both what
happened and who it happened to - the gNB has the outcome but no notion of
subscriber identity, and correlating the two would mean joining on a
RAN_UE_NGAP_ID that is reused as soon as a UE re-attaches.
Three counters, incremented only where the AMF is certain:
attempted HandoverRequired accepted for this UE
completed HandoverNotification arrived
rejected the target refused, or the source cancelled
A handover that is commanded and then never resolves is deliberately not
counted. The AMF has no guard timer for one - there is no T304 equivalent -
so the only later event is the UE re-attaching, which is indistinguishable
from an ordinary power cycle: the same HOLDING_NG_CONTEXT path serves both,
and exists for the power-cycle case. Inferring a failure there would mean
carrying a pending flag that must be cleared on every resolution and aged
out when a UE simply vanishes, and getting that wrong reports failures that
never happened. attempted less completed less rejected gives the same number
without the risk of attributing it to the wrong UE.
Reported in /5gc/amf/ue-info beside the identity already there, so a caller
can show per-subscriber handover health without a second source.
The counters are cleared on the way out of the de-registered state. The UE
context outlives a de-registration and is found again by 5G-S-TMSI, so
without that a UE would carry its previous registration's handovers into
the next one.
Tested-by: Pau Espin Pedrol <pespin@sysmocom.de>
Suppress expected diagnostics around individual test calls instead of
muting entire suites. Preserve FATAL messages and debug/trace output,
and restore the original log level before continuing.
Initialize unit-test log domains before applying command-line options
and remove redundant overrides that reset the configured log levels.
Replace natoi() and atoi() with a shared checked port parser.
Reject empty, non-numeric, and out-of-range ports before accumulation,
while preserving port 0 and leading zeros.
Issues: #4867
hss_cx_download_user_data() registers one Public Identity per MSISDN as
sip:<msisdn>@<visited-network> and tel:<msisdn>. TS 23.003 13.4 requires the canonical form of
a Tel URI to be "tel:+<CC><NDC><SN>", and RFC 3966 3 says a tel URI without the "+" is a local
number that needs a phone-context, so an I-CSCF asking for the canonical form -- which is what
the Cx interface is specified to carry -- does not match the identity the HSS stored.
impu_find_by_id() matches a Public Identity as a whole string, so the LIR for tel:+<msisdn>
finds no IMPU, hss_cx_get_server_name() returns NULL, and the HSS answers
DIAMETER_SUCCESS_SERVER_NAME_NOT_STORED (2004) with no Server-Name. The subscriber then sees
480 Temporarily Unavailable. The bytes in msisdn[].bcd come from ogs_buffer_to_bcd(), so they
are digits only and the "+" is never already there.
The volte client sent the same identity it expects the HSS to have registered, which is why the
test passed with the non-canonical form. Both move together, so the test now pins the form:
test_cx_lia_cb asserts Result-Code DIAMETER_SUCCESS with no Experimental-Result-Code, which the
HSS only produces when the identity matches.
Reported in #4841.
In ngap_handle_handover_required_transfer() the per-PDU-session flag
sess->handover.data_forwarding_not_possible is only ever set to true
(when the source gNB's HandoverRequiredTransfer omits the
directForwardingPathAvailability IE) and is never cleared. For a
PDU session that survives multiple N2 handovers this means the flag
latches at true after any single handover where the source didn't
advertise direct forwarding, and every subsequent handover emits
"Data Forwarding Not Possible" in the target gNB's
PDUSessionResourceSetupRequestTransfer regardless of what the source
advertised.
Observable symptom: HandoverRequired from the source carries
Direct Forwarding Path Availability = direct path available for a
PDU session, but the subsequent HandoverRequest to the target gNB
still contains:
Item N: id-DataForwardingNotPossible (127)
criticality: reject
value: data-forwarding-not-possible (0)
Effect: target gNB cannot accept forwarded DL bytes from the source
during the cutover and the in-flight window is dropped on every N2
handover after the first that didn't advertise direct forwarding.
Fix: derive the flag from the current source's IE on every HO prep
so it tracks the state being signalled now, not the high-water-mark
of previous handovers. When directForwardingPathAvailability is
present the flag is cleared; when absent it is set, matching the
prior behaviour for the first-handover case.
No new state machine paths, no new helpers; existing call sites in
ngap-build.c (which condition the IE emission on the flag) are
unchanged.
Tested-by: Pau Espin Pedrol <pespin@sysmocom.de>
The parser recorded the peer-supplied lengths while clamping the copy, so the builder read past ms_network_capability[] and imeisv[]. Size the MS Network Capability buffer to the 8 octets it is documented to hold.
sess_5gc_timeout() aborts the whole SMF (ogs_assert on a NULL stream)
when a PFCP Session Deletion Request times out and the associated SBI
stream has already been released (e.g. the AMF gave up, or the UE
context was cleaned up during churn). The modification branch a few
lines above already guards with `if (stream)`; apply the same handling
to the deletion branch: report 504 only when the stream is still alive,
otherwise log and continue with the existing SMF_EVT_N4_TIMER session
cleanup.
Without this the SMF process dies on a recoverable protocol timeout, and
the restart loses all in-memory UE address allocations (duplicate UE IPs
and broken downlink for half of the sessions). Observed 4-6 restarts in
one afternoon under session churn; zero restarts with this change across
a full-stack reset + 600-UE attach/detach churn + mass UE kills.
Fixes#4833
Correct the UPLINK GENERIC NAS TRANSPORT message type from 101 (0x65)
to 105 (0x69) in the NAS generator and regenerate the EPS NAS files.
Remove the obsolete cache entry for message type 101.
Ignore a PFCP REMOVE response whose bearer has already been removed by
an earlier REMOVE, instead of asserting. This happens e.g. when Create
Bearer and Delete Bearer both fail for the same bearer.
Pass the session ID to the timeout callback of the Modify Bearer PFCP
transaction, and mark it session-level so that the response handler
does not treat the ID as a bearer ID.
Not addressed: the Delete Bearer Request sent before Create Bearer
completes still carries EBI 0, and a late Delete Bearer Response for
a removed bearer still releases the whole session.
Issues: #4850
Retained PDN sessions reference subscription entries owned by the old
MME UE context. Removing that context frees APN data still in use.
Transfer subscription ownership to the new UE context and rebind
retained PDN references before removing the old context.
Use sample.yaml for EIR integration tests and share equipment fixtures
across integration suites. Enable EIR in SEPP examples and configure
gNB tests to use the serving EIR and NRF.
Remove the misleading warning on successful EIR lookups and log
generic equipment fallback at info level.# Please enter the commit message for your changes. Lines starting
Issues: #4577
Use eir.yaml as the single default configuration and select tests through
ABTS arguments, following the handover runner. Remove mode/policy
environment variables, eir-allow.yaml, and duplicate integration runs.
Move direct SBI endpoint parsing and readiness checks into service-test.
Always provision GUTI equipment fixtures and run EIR rejection cases.
Add eir-fsm to the eir suite and extend AMF/MME state-machine coverage for
policy outcomes and deferred session cleanup. Cover EIR-disabled and
allow-policy paths in FSM tests instead of separate integration runs.
An unprotected Registration Request using a registered UE's GUTI could
release its existing PDU sessions before authentication.
Defer session release until authentication, Security Mode Control and
the optional EIR check complete. Wait for all release responses before
continuing UDM registration, and prevent stale responses from resuming
a cancelled procedure.
Restore the previous NAS security context on authentication or SMC
failure, and ignore unverified Deregistration Requests during these
procedures.
Add unit and EIR integration regressions for session preservation and
replacement with EIR enabled or disabled and one or two PDU sessions.
Complete the SMF/BSF SBI configuration and make EIR fixtures safe to rerun.
An unverified Attach using a registered UE's GUTI could delete its
existing PDN sessions before authentication.
Keep the sessions through AKA, Security Mode Control and the optional
S13 EIR check. Delete them before ULR, and resume Attach only after
the last Delete Session Response.
Restore the saved NAS security context on authentication or SMC failure,
and discard unverified Detach requests during AKA and SMC. On deletion
timeout, cancel Attach continuation and retain the existing
UE_CONTEXT_REMOVE cleanup path.
Add EPC integration tests under tests/eir with S13 enabled and disabled,
covering one and two PDNs. Add focused unit coverage for restoration,
deletion ordering, cancellation and late responses.
A non-hex character after '%' made ogs_from_hex() return a negative
value, which was then shifted left (UBSan, OSS-Fuzz sbi_request_fuzz).
Decode the escape only when both characters are hex digits. Otherwise
the '%' is dropped, as a truncated escape at the end already was.
Malformed IMEISV, IMSI, SGsAP and PCO fields could trigger
out-of-bounds accesses or assertions on peer-controlled input.
- Require a 9-octet, even-parity IMEISV before writing its 16 digits
and terminator. Leave the output unchanged on failure and have
MME/AMF skip storing rejected identities. Preserve the existing
filler and digit acceptance policy.
- Check the AMF IMEISV length before reading its identity type,
including when the received IE has zero length.
- Validate the SGWC IMSI before UE lookup, which asserts on an
empty hash key, and reject nonpositive lengths in UE creation.
- Replace SGsAP DOWNLINK-UNITDATA assertions on received IMSI and
NAS container fields with error logging and early returns.
- Check the original GTP PCO length against the NAS destination
size before narrowing or copying. Omit an oversized optional
PCO instead of failing the builder, since callers assert on
message-build failure.
UEContextReleaseComplete and SGsAP-Paging-Request are sent over different
SCTP associations, so sending them in sequence does not guarantee that
the MME processes the release before the paging request.
If SGs paging is handled first, the UE can still be ECM-CONNECTED. The
MME then follows the connected-mode handling path instead of sending the
S1AP Paging expected by these tests, causing them to block until the
Meson timeout expires.
Add a short delay after UEContextReleaseComplete in the MT idle, MT SMS,
and crash CSFB tests to allow the asynchronous S1 release processing to
complete before starting the SGs paging sequence.
Return INT64_MAX directly when clamping SBI bitrates, avoiding an
intermediate double conversion that rounds the value to 2^63.
Cast Diameter test host identities to uint8_t * when assigning AVP
octet-string data to resolve pointer-sign warnings.
Log skipped hash removal at warning level when the entry belongs to
another context, since this can occur during context replacement.
A gNB/eNB can register the same node ID on a new SCTP association before
the old association's shutdown is processed. Removing the old context
can then delete the replacement's ID mapping. This caused the macOS N2
handover test to hang: the AMF could not find the target gNB despite its
successful NG Setup, while the test waited for a Handover Request.
Owner-checked removal alone is insufficient. ogs_hash_set() replaces
only the value of an existing entry, retaining the key pointer into
the old context. Subsequent ID reassignment or pool reuse can therefore
break lookups even when the replacement's mapping is not deleted.
Add ogs_hash_set_rekey() to remove and reinsert an entry with the
supplied key pointer, leaving ordinary ogs_hash_set() semantics intact.
Use it for gNB-ID and eNB-ID registration, and use the existing
ogs_hash_unset_if_owner() when removing contexts or unindexing their
previous IDs before reassignment.
Document why both operations are needed and the caller's responsibility
for key lifetime and access serialization. Keep the existing ID
replacement policy and association lifetime unchanged.
Add core and AMF/MME regression tests covering key replacement,
displaced-owner cleanup, old key storage changes, ID reassignment,
repeated registration and ID 0.
- macOS: install MongoDB 8.0 (mongodb/brew) and wait until ready,
add loopback aliases used by tests, use brew --prefix paths,
run the full test suite
- Use meson test -t 3 (timeout multiplier) on macOS and Ubuntu
- usrsctp: set infolen before usrsctp_recvv() so that PPID is
returned; sctp-test now checks PPID with usrsctp as well
A PDU session resource setup response can be followed immediately by
a UE deregistration request. The AMF sends a /modify request carrying
PDU_RES_SETUP_RSP, then a /release request for the same session,
without waiting for the /modify response.
The apparent ordering reversal does not require /release to arrive
before /modify. It can occur inside the SMF event queue:
1. The SMF handles /modify first. Its N2 SM information is copied into
a separate SMF_EVT_NGAP_MESSAGE event and appended to the queue.
The HTTP response is deferred until that event is processed.
2. If /release is already queued, it is processed before the newly
appended NGAP event. The session enters wait_pfcp_deletion and
starts PFCP session deletion.
3. The queued PDU_RES_SETUP_RSP event is then dispatched to
wait_pfcp_deletion instead of the operational state.
Thus, the HTTP requests can be handled in arrival order while the
actual setup-response processing is overtaken by session release.
Previously, wait_pfcp_deletion did not handle SMF_EVT_NGAP_MESSAGE.
The setup response was therefore discarded without replying to the
original /modify request, leaving an outstanding SBI transaction in
the AMF and causing resource-leak warnings at shutdown.
Return 204 No Content for PDU_RES_SETUP_RSP in this state, matching
the existing behavior in wait_5gc_n1_n2_release. Acknowledge the
obsolete setup report without activating the session or changing
the ongoing PFCP deletion procedure.
- Reject absolute URIs without a path to prevent the NULL dereference
found by CIFuzz, and add regression coverage.
- Reset reserved EIR fixtures and subscribers before each test case
to recover from interrupted runs, and stop setup on database errors.
- Add regression coverage for stale EIR fixture recovery.
- Wait for pending AMF responses and preserve NGAP IDs in deregistration
and GUTI tests.
- Log events for finalized NF instance FSMs as warnings.
- Enable SCTP PPID checks for usrsctp.
- Parenthesize concatenated JSON literals to fix Clang warnings.
Make intentional string literal concatenation explicit in the SBI
message tests to avoid -Wstring-concatenation.
Wait for the Configuration Update Command and the old connection's
PDU Session Resource Setup Request before starting mobility registration.
Preserve the old and new NGAP IDs for context release and setup.
This stabilizes test sequencing; the AMF event-queue race remains.
smf_qos_flow_binding() checked pf_to_add_list before rebuilding it,
so the GBR decision used the packet filters of the previous binding.
A re-sent rule without changes triggered QOS_MODIFY, and a rule that
added packet filters could be sent without the GBR QoS.
Move the ARP/MBR/GBR comparison after the rebuild. The comparison
itself is unchanged.
This does not address the other points raised in #4526.
Issues: #4526
TS 24.008 10.5.6.5 places the downlink extended octets before the
uplink ones, but the struct declared them uplink-first. As a result,
a QoS Profile IE of length 15 or 19 read 1-2 bytes past the IE, and
lengths 17/21 swapped the uplink and downlink extended rates on both
decode and encode.
Issues: #4183
ogs_gtp2_parse_uli() read the flags octet without checking
octet->len, causing a 1-byte over-read on a zero-length ULI IE.
Check the length before reading the flags and return 0.
SGW-C and SMF callers now treat a 0 return as an invalid ULI.
Also remove the ogs_assert() on ULI presence in the SMF
E-UTRAN Create Session Request path, so a missing ULI is
rejected with Mandatory IE missing instead of aborting.
A ULI with only the flags octet (no location fields) is
still accepted as before.
Issues: #4812
Check the combined public key, ciphertext, and MAC tag length for the
selected protection profile before allocation and copying, preventing
out-of-bounds reads when extracting the MAC tag.
Use size_t for the scheme-output length to avoid integer truncation.
Reject empty boundary strings before initializing the multipart parser
to prevent out-of-bounds writes to its lookbehind buffer.
Free the allocated boundary and return a parse error.
Share the AMF/MME action type and parser in lib/app, and length-aware
BCD validation in lib/proto. Validate S13 User-Name before conversion
to reject embedded NUL bytes while preserving existing length rules.
Add unit tests for policy parsing and bounded digit validation.
Related PR: #4802#4795#4708
Skip emergency registration while preserving checks for other registrations
that complete SMC. Share PEI validation and apply missing_pei_action to
unusable identities.
Add unit tests for check eligibility and exercise both allow and reject
policies in the AMF and MME integration tests.
Related PR: #4802#4795#4708
Run the S13 attach cases in the eir suite on the app harness, so one
open5gs-eird serves N5g-eir to the AMF and S13 to the MME out of the
same eir collection.
Fold the EPC side of s13.yaml into eir.yaml and drop s13.yaml. The
attach cases use SVN 09 of the test IMEI to stay clear of the SVN 00-07
used by registration-test.c.
Related PR: #4802#4795#4708
Extend transform.py to handle all-reference oneOf schemas with distinct
JSON types and preserve nullable alternatives in the union template.
Regenerate affected models and adapt AMF/AUSF 5G-AKA handlers to the
Av5gAka union member. Add transform and JSON roundtrip regression tests.
Related PR: #4807
Move missing-IMEISV policy handling out of the Diameter sender and
require an active attach with a matching serving S1 context before
processing an ECA.
Remove unreachable branches, simplify unit test setup, extend guard
coverage, and tidy license headers, formatting, and documentation.
Related PR: #4802
