sysmocom
/
open5gs
forked from acouzens/open5gs
11
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
open5gs/src/mme/nas-path.c

976 lines
26 KiB
C
Raw Normal View History

fix indentation in MME
2019-07-11 12:53:54 +00:00
/*
* Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
*
* This file is part of Open5GS.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
rename filename for s1ap-path
2019-06-01 09:52:38 +00:00
#include "s1ap-path.h"
rename project done
2019-06-11 13:10:47 +00:00
#include "s1ap-build.h"
#include "esm-build.h"
#include "emm-build.h"
#include "nas-path.h"
#include "mme-event.h"
[#220] T3460 done
2019-07-20 12:28:36 +00:00
#include "mme-timer.h"
rename project done
2019-06-11 13:10:47 +00:00
#include "mme-sm.h"
missing files
2017-08-10 08:02:53 +00:00
NGAP is added
2020-05-23 02:24:48 +00:00
int nas_eps_send_to_enb(mme_ue_t *mme_ue, ogs_pkbuf_t *pkbuf)
missing files
2017-08-10 08:02:53 +00:00
{
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
int rv;
[SGsAP] Changed message if Paging failed (#1701) The problem occurred in the following scenario: 1. VLR sent PAGING-REQUEST to the MME 2. MME sent S1-Paging to the UE 3. Paging failed 4. MME responded SERVICE-REQUEST to the VLR 5. VLR sent DOWNLINK-UNITDATA to the MME 6. Even though there is no S1 Context, MME try to sent DownlinkNASTransport message to the UE. 7. So, the problem occurred. I've changed the number 4 PAGING-REJECT instead of SERVICE-REQUEST.
2022-08-19 09:58:55 +00:00
ogs_assert(pkbuf);
missing files
2017-08-10 08:02:53 +00:00
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_error("UE(mme-ue) context has already been removed");
[SGsAP] Changed message if Paging failed (#1701) The problem occurred in the following scenario: 1. VLR sent PAGING-REQUEST to the MME 2. MME sent S1-Paging to the UE 3. Paging failed 4. MME responded SERVICE-REQUEST to the VLR 5. VLR sent DOWNLINK-UNITDATA to the MME 6. Even though there is no S1 Context, MME try to sent DownlinkNASTransport message to the UE. 7. So, the problem occurred. I've changed the number 4 PAGING-REJECT instead of SERVICE-REQUEST.
2022-08-19 09:58:55 +00:00
ogs_pkbuf_free(pkbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
return OGS_NOTFOUND;
[SGsAP] Changed message if Paging failed (#1701) The problem occurred in the following scenario: 1. VLR sent PAGING-REQUEST to the MME 2. MME sent S1-Paging to the UE 3. Paging failed 4. MME responded SERVICE-REQUEST to the VLR 5. VLR sent DOWNLINK-UNITDATA to the MME 6. Even though there is no S1 Context, MME try to sent DownlinkNASTransport message to the UE. 7. So, the problem occurred. I've changed the number 4 PAGING-REJECT instead of SERVICE-REQUEST.
2022-08-19 09:58:55 +00:00
}
missing files
2017-08-10 08:02:53 +00:00
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
rv = s1ap_send_to_enb_ue(mme_ue->enb_ue, pkbuf);
ogs_expect(rv == OGS_OK);
return rv;
missing files
2017-08-10 08:02:53 +00:00
}
NGAP is added
2020-05-23 02:24:48 +00:00
int nas_eps_send_emm_to_esm(mme_ue_t *mme_ue,
Re-factoring the all library
2019-09-13 12:07:47 +00:00
ogs_nas_esm_message_container_t *esm_message_container)
update it
2017-09-07 06:56:31 +00:00
{
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
int rv;
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_pkbuf_t *esmbuf = NULL;
update it
2017-09-07 06:56:31 +00:00
[SEC] Several vulnerabilities have been resolved. 1. Reachable assertion in ogs_nas_5gmm_decode Location: lib/nas/5gs/decoder.c:4445 ```c int ogs_nas_5gmm_decode(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf) { int size = 0; int decoded = 0; ogs_assert(pkbuf); ogs_assert(pkbuf->data); ogs_assert(pkbuf->len); ``` When a NAS payload is received over `src/amf/context.c:1675`NGAP that has no data, the ogs_assert(pkbuf->len) assertion will be triggered. 2.Reachable assertion in ogs_nas_emm_decode ``` int ogs_nas_emm_decode(ogs_nas_eps_message_t *message, ogs_pkbuf_t *pkbuf) { int size = 0; int decoded = 0; ogs_assert(pkbuf); ogs_assert(pkbuf->data); ogs_assert(pkbuf->len); ``` Nearly identical to (1), but for LTE. 3. Reachable assertion in nas_eps_send_emm_to_esm ``` int nas_eps_send_emm_to_esm(mme_ue_t *mme_ue, ogs_nas_esm_message_container_t *esm_message_container) { int rv; ogs_pkbuf_t *esmbuf = NULL; if (!mme_ue_cycle(mme_ue)) { ogs_error("UE(mme-ue) context has already been removed"); return OGS_NOTFOUND; } ogs_assert(esm_message_container); ogs_assert(esm_message_container->length); ``` The ESM message payload may be 0-length, as the length is determined by a field in the NAS payload (which can be chosen arbitrarily by an attacker). This leads to the length assertion above being triggered. 5. Reachable assertion and incorrect hash calculation in ogs_kdf_hash_mme ``` void ogs_kdf_hash_mme(const uint8_t *message, uint8_t message_len, uint8_t *hash_mme) { uint8_t key[32]; uint8_t output[OGS_SHA256_DIGEST_SIZE]; ogs_assert(message); ogs_assert(message_len); ogs_assert(hash_mme); memset(key, 0, 32); ogs_hmac_sha256(key, 32, message, message_len, output, OGS_SHA256_DIGEST_SIZE); memcpy(hash_mme, output+24, OGS_HASH_MME_LEN); } ``` When handling NAS attach requests or TAU requests, the ogs_kdf_hash_mme function is passed the NAS payload. However, the length field is represented as an unsigned 8-bit integer, which the passed length of the packet may overflow. This leads to the passed value being truncated. When the passed value is a multiple of 256, the above assertion (ogs_assert(message_len)) is triggered. Otherwise, the hash is computed on only the first n bits of the message (where n = actual_message_len % 256).
2024-02-03 01:37:36 +00:00
ogs_assert(esm_message_container);
if (!esm_message_container->length) {
ogs_error("Invalid ESM Message Container");
return OGS_ERROR;
}
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
update it
2017-09-07 06:56:31 +00:00
/* The Packet Buffer(pkbuf_t) for NAS message MUST make a HEADROOM.
* When calculating AES_CMAC, we need to use the headroom of the packet. */
Re-factoring the all library
2019-09-13 12:07:47 +00:00
esmbuf = ogs_pkbuf_alloc(NULL,
OGS_NAS_HEADROOM+esm_message_container->length);
fix overflow bug in the packet memory pool
2020-09-07 03:53:38 +00:00
ogs_assert(esmbuf);
Re-factoring the all library
2019-09-13 12:07:47 +00:00
ogs_pkbuf_reserve(esmbuf, OGS_NAS_HEADROOM);
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_pkbuf_put_data(esmbuf,
update it
2017-09-07 06:56:31 +00:00
esm_message_container->buffer, esm_message_container->length);
Distinguish the type of session creation
2022-04-14 08:34:55 +00:00
rv = s1ap_send_to_esm(mme_ue, esmbuf, 0, OGS_GTP_CREATE_IN_ATTACH_REQUEST);
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
ogs_expect(rv == OGS_OK);
update it
2017-09-07 06:56:31 +00:00
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
return rv;
update it
2017-09-07 06:56:31 +00:00
}
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
int nas_eps_send_to_downlink_nas_transport(
enb_ue_t *enb_ue, ogs_pkbuf_t *pkbuf)
missing files
2017-08-10 08:02:53 +00:00
{
Integration with OGSLib
2019-04-27 14:54:30 +00:00
int rv;
ogs_pkbuf_t *s1apbuf = NULL;
missing files
2017-08-10 08:02:53 +00:00
Remove S1 check in Downlink NAS transport (#201)
2019-06-23 11:17:44 +00:00
ogs_assert(pkbuf);
[SGsAP] Changed message if Paging failed (#1701) The problem occurred in the following scenario: 1. VLR sent PAGING-REQUEST to the MME 2. MME sent S1-Paging to the UE 3. Paging failed 4. MME responded SERVICE-REQUEST to the VLR 5. VLR sent DOWNLINK-UNITDATA to the MME 6. Even though there is no S1 Context, MME try to sent DownlinkNASTransport message to the UE. 7. So, the problem occurred. I've changed the number 4 PAGING-REJECT instead of SERVICE-REQUEST.
2022-08-19 09:58:55 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
if (!enb_ue_cycle(enb_ue)) {
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_error("S1 context has already been removed");
Remove S1 check in Downlink NAS transport (#201)
2019-06-23 11:17:44 +00:00
ogs_pkbuf_free(pkbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
return OGS_NOTFOUND;
[SGsAP] Changed message if Paging failed (#1701) The problem occurred in the following scenario: 1. VLR sent PAGING-REQUEST to the MME 2. MME sent S1-Paging to the UE 3. Paging failed 4. MME responded SERVICE-REQUEST to the VLR 5. VLR sent DOWNLINK-UNITDATA to the MME 6. Even though there is no S1 Context, MME try to sent DownlinkNASTransport message to the UE. 7. So, the problem occurred. I've changed the number 4 PAGING-REJECT instead of SERVICE-REQUEST.
2022-08-19 09:58:55 +00:00
}
missing files
2017-08-10 08:02:53 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
s1apbuf = s1ap_build_downlink_nas_transport(enb_ue, pkbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!s1apbuf) {
ogs_error("s1ap_build_downlink_nas_transport() failed");
return OGS_ERROR;
}
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = s1ap_send_to_enb_ue(enb_ue, s1apbuf);
[SGsAP] Changed message if Paging failed (#1701) The problem occurred in the following scenario: 1. VLR sent PAGING-REQUEST to the MME 2. MME sent S1-Paging to the UE 3. Paging failed 4. MME responded SERVICE-REQUEST to the VLR 5. VLR sent DOWNLINK-UNITDATA to the MME 6. Even though there is no S1 Context, MME try to sent DownlinkNASTransport message to the UE. 7. So, the problem occurred. I've changed the number 4 PAGING-REJECT instead of SERVICE-REQUEST.
2022-08-19 09:58:55 +00:00
ogs_expect(rv == OGS_OK);
return rv;
missing files
2017-08-10 08:02:53 +00:00
}
update it
2017-09-07 06:56:31 +00:00
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_attach_accept(mme_ue_t *mme_ue)
update it
2017-09-07 06:56:31 +00:00
{
Integration with OGSLib
2019-04-27 14:54:30 +00:00
int rv;
update it
2017-09-07 06:56:31 +00:00
mme_sess_t *sess = NULL;
fix the bug Initial Context Setup Request
2017-09-11 05:01:11 +00:00
mme_bearer_t *bearer = NULL;
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_pkbuf_t *s1apbuf = NULL;
ogs_pkbuf_t *esmbuf = NULL, *emmbuf = NULL;
update it
2017-09-07 06:56:31 +00:00
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
update it
2017-09-07 06:56:31 +00:00
sess = mme_sess_first(mme_ue);
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_assert(sess);
Fix MME crash when VoLTE is enabled [#619]
2020-10-22 21:53:13 +00:00
ogs_assert(mme_sess_next(sess) == NULL);
fix the bug Initial Context Setup Request
2017-09-11 05:01:11 +00:00
bearer = mme_default_bearer_in_sess(sess);
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_assert(bearer);
Fix MME crash when VoLTE is enabled [#619]
2020-10-22 21:53:13 +00:00
ogs_assert(mme_bearer_next(bearer) == NULL);
update it
2017-09-07 06:56:31 +00:00
[AMF/MME] Add retransmission for accept message Registration accept with GUTI Attach accept Tracking area update request with GUTI
2021-04-23 06:16:18 +00:00
ogs_debug("[%s] Attach accept", mme_ue->imsi_bcd);
Distinguish the type of session creation
2022-04-14 08:34:55 +00:00
esmbuf = esm_build_activate_default_bearer_context_request(
sess, OGS_GTP_CREATE_IN_ATTACH_REQUEST);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!esmbuf) {
ogs_error("esm_build_activate_default_bearer_context_request() failed");
return OGS_ERROR;
}
update it
2017-09-07 06:56:31 +00:00
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
emmbuf = emm_build_attach_accept(mme_ue, esmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!emmbuf) {
ogs_error("emm_build_attach_accept() failed");
return OGS_ERROR;
}
update it
2017-09-07 06:56:31 +00:00
[AMF/MME] Add retransmission for accept message Registration accept with GUTI Attach accept Tracking area update request with GUTI
2021-04-23 06:16:18 +00:00
CLEAR_MME_UE_TIMER(mme_ue->t3450);
mme_ue->t3450.pkbuf = ogs_pkbuf_copy(emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!mme_ue->t3450.pkbuf) {
ogs_error("ogs_pkbuf_copy(mme_ue->t3450.pkbuf) failed");
[CORE] Rollback ogs_pkbuf_copy() from (#2012) In the previous #2012 working, I've added ogs_pkbuf_free() for original buffer. But, this rasied double free. So, I've rollback it,
2023-01-23 15:17:10 +00:00
ogs_pkbuf_free(emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
return OGS_ERROR;
}
[AMF/MME] Add retransmission for accept message Registration accept with GUTI Attach accept Tracking area update request with GUTI
2021-04-23 06:16:18 +00:00
ogs_timer_start(mme_ue->t3450.timer,
mme_timer_cfg(MME_TIMER_T3450)->duration);
[AMF/MME] Delete UERadioCapability (#2040, #1917) o TS24.301(4G/LTE) 5.5.1 Attach procedure 5.5.1.2 Attach procedure for EPS services 5.5.1.2.4 Attach accepted by the network If the attach request is accepted by the network, the MME shall delete the stored UE radio capability information or the UE radio capability ID, if any. o TS24.501(5G) 5.5.2 De-registration procedure 5.5.2.1 General When the AMF enters the state 5GMM-DEREGISTERED for 3GPP access, the AMF shall delete the stored UE radio capability information or the UE radio capability ID, if any.
2023-02-05 03:03:00 +00:00
/*
* Issue #2040
*
* TS24.301
* 5.5.1 Attach procedure
* 5.5.1.2 Attach procedure for EPS services
* 5.5.1.2.4 Attach accepted by the network
*
* If the attach request is accepted by the network,
* the MME shall delete the stored UE radio capability information
* or the UE radio capability ID, if any.
*/
OGS_ASN_CLEAR_DATA(&mme_ue->ueRadioCapability);
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
s1apbuf = s1ap_build_initial_context_setup_request(mme_ue, emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!s1apbuf) {
ogs_error("s1ap_build_initial_context_setup_request() failed");
return OGS_ERROR;
}
update it
2017-09-07 06:56:31 +00:00
NGAP is added
2020-05-23 02:24:48 +00:00
rv = nas_eps_send_to_enb(mme_ue, s1apbuf);
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
ogs_expect(rv == OGS_OK);
return rv;
update it
2017-09-07 06:56:31 +00:00
}
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
int nas_eps_send_attach_reject(enb_ue_t *enb_ue, mme_ue_t *mme_ue,
Re-factoring the all library
2019-09-13 12:07:47 +00:00
ogs_nas_emm_cause_t emm_cause, ogs_nas_esm_cause_t esm_cause)
update it
2017-09-07 06:56:31 +00:00
{
Integration with OGSLib
2019-04-27 14:54:30 +00:00
int rv;
update it
2017-09-07 06:56:31 +00:00
mme_sess_t *sess = NULL;
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_pkbuf_t *esmbuf = NULL, *emmbuf = NULL;
update it
2017-09-07 06:56:31 +00:00
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
update it
2017-09-07 06:56:31 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
if (!enb_ue_cycle(enb_ue)) {
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
[AMF/MME] Add retransmission for accept message Registration accept with GUTI Attach accept Tracking area update request with GUTI
2021-04-23 06:16:18 +00:00
ogs_debug("[%s] Attach reject", mme_ue->imsi_bcd);
ogs_debug(" Cause[%d]", emm_cause);
update trace log for S1AP/NAS
2018-01-22 14:14:20 +00:00
update it
2017-09-07 06:56:31 +00:00
sess = mme_sess_first(mme_ue);
fix indentation in MME
2019-07-11 12:53:54 +00:00
if (sess) {
Distinguish the type of session creation
2022-04-14 08:34:55 +00:00
esmbuf = esm_build_pdn_connectivity_reject(
sess, esm_cause, OGS_GTP_CREATE_IN_ATTACH_REQUEST);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!esmbuf) {
ogs_error("esm_build_pdn_connectivity_reject() failed");
return OGS_ERROR;
}
update it
2017-09-07 06:56:31 +00:00
}
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
emmbuf = emm_build_attach_reject(emm_cause, esmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!emmbuf) {
ogs_error("emm_build_attach_reject() failed");
return OGS_ERROR;
}
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(enb_ue, emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
add Handover test code
2017-09-11 09:41:14 +00:00
}
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_identity_request(mme_ue_t *mme_ue)
refine attached/detached state handler
2018-01-22 07:35:12 +00:00
{
Fix the connection refused bug [#568, #551]
2020-09-25 01:29:48 +00:00
int rv;
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_pkbuf_t *emmbuf = NULL;
refine attached/detached state handler
2018-01-22 07:35:12 +00:00
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
refine attached/detached state handler
2018-01-22 07:35:12 +00:00
Fix release access bearer #592
2020-10-01 17:27:58 +00:00
ogs_debug("Identity request");
[#220] T3470 done
2019-07-20 12:49:47 +00:00
if (mme_ue->t3470.pkbuf) {
emmbuf = mme_ue->t3470.pkbuf;
} else {
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
emmbuf = emm_build_identity_request(mme_ue);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!emmbuf) {
ogs_error("emm_build_identity_request() failed");
return OGS_ERROR;
}
[#220] T3470 done
2019-07-20 12:49:47 +00:00
}
mme_ue->t3470.pkbuf = ogs_pkbuf_copy(emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!mme_ue->t3470.pkbuf) {
ogs_error("ogs_pkbuf_copy(mme_ue->t3470.pkbuf) failed");
[CORE] Rollback ogs_pkbuf_copy() from (#2012) In the previous #2012 working, I've added ogs_pkbuf_free() for original buffer. But, this rasied double free. So, I've rollback it,
2023-01-23 15:17:10 +00:00
ogs_pkbuf_free(emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
return OGS_ERROR;
}
[#220] T3470 done
2019-07-20 12:49:47 +00:00
ogs_timer_start(mme_ue->t3470.timer,
mme_timer_cfg(MME_TIMER_T3470)->duration);
refine attached/detached state handler
2018-01-22 07:35:12 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(mme_ue->enb_ue, emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
[MEM] fix the pkbuf problem (#1431)
2022-03-22 13:47:45 +00:00
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
refine attached/detached state handler
2018-01-22 07:35:12 +00:00
}
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_authentication_request(mme_ue_t *mme_ue)
add Handover test code
2017-09-11 09:41:14 +00:00
{
Integration with OGSLib
2019-04-27 14:54:30 +00:00
int rv;
ogs_pkbuf_t *emmbuf = NULL;
add Handover test code
2017-09-11 09:41:14 +00:00
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
add Handover test code
2017-09-11 09:41:14 +00:00
[AMF/MME] Add retransmission for accept message Registration accept with GUTI Attach accept Tracking area update request with GUTI
2021-04-23 06:16:18 +00:00
ogs_debug("[%s] Authentication request", mme_ue->imsi_bcd);
update trace log for S1AP/NAS
2018-01-22 14:14:20 +00:00
[#220] T3460 done
2019-07-20 12:28:36 +00:00
if (mme_ue->t3460.pkbuf) {
emmbuf = mme_ue->t3460.pkbuf;
} else {
Use GTP-U Buffering instead of Deletion[#592,#568]
2020-10-08 01:21:48 +00:00
emmbuf = emm_build_authentication_request(mme_ue);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!emmbuf) {
ogs_error("emm_build_authentication_request() failed");
return OGS_ERROR;
}
[#220] T3460 done
2019-07-20 12:28:36 +00:00
}
mme_ue->t3460.pkbuf = ogs_pkbuf_copy(emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!mme_ue->t3460.pkbuf) {
ogs_error("ogs_pkbuf_copy(mme_ue->t3460.pkbuf) failed");
[CORE] Rollback ogs_pkbuf_copy() from (#2012) In the previous #2012 working, I've added ogs_pkbuf_free() for original buffer. But, this rasied double free. So, I've rollback it,
2023-01-23 15:17:10 +00:00
ogs_pkbuf_free(emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
return OGS_ERROR;
}
[#220] T3460 done
2019-07-20 12:28:36 +00:00
ogs_timer_start(mme_ue->t3460.timer,
mme_timer_cfg(MME_TIMER_T3460)->duration);
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(mme_ue->enb_ue, emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
[MEM] fix the pkbuf problem (#1431)
2022-03-22 13:47:45 +00:00
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
[#220] T3460 done
2019-07-20 12:28:36 +00:00
}
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_security_mode_command(mme_ue_t *mme_ue)
[#220] T3460 done
2019-07-20 12:28:36 +00:00
{
int rv;
ogs_pkbuf_t *emmbuf = NULL;
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
[#220] T3460 done
2019-07-20 12:28:36 +00:00
[AMF/MME] Add retransmission for accept message Registration accept with GUTI Attach accept Tracking area update request with GUTI
2021-04-23 06:16:18 +00:00
ogs_debug("[%s] Security mode command", mme_ue->imsi_bcd);
[#220] T3460 done
2019-07-20 12:28:36 +00:00
if (mme_ue->t3460.pkbuf) {
emmbuf = mme_ue->t3460.pkbuf;
} else {
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
emmbuf = emm_build_security_mode_command(mme_ue);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!emmbuf) {
ogs_error("emm_build_security_mode_command() failed");
return OGS_ERROR;
}
[#220] T3460 done
2019-07-20 12:28:36 +00:00
}
mme_ue->t3460.pkbuf = ogs_pkbuf_copy(emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!mme_ue->t3460.pkbuf) {
ogs_error("ogs_pkbuf_copy(mme_ue->t3460.pkbuf) failed");
[CORE] Rollback ogs_pkbuf_copy() from (#2012) In the previous #2012 working, I've added ogs_pkbuf_free() for original buffer. But, this rasied double free. So, I've rollback it,
2023-01-23 15:17:10 +00:00
ogs_pkbuf_free(emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
return OGS_ERROR;
}
[#220] T3460 done
2019-07-20 12:28:36 +00:00
ogs_timer_start(mme_ue->t3460.timer,
mme_timer_cfg(MME_TIMER_T3460)->duration);
add Handover test code
2017-09-11 09:41:14 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(mme_ue->enb_ue, emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
[MEM] fix the pkbuf problem (#1431)
2022-03-22 13:47:45 +00:00
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
add Handover test code
2017-09-11 09:41:14 +00:00
}
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_authentication_reject(mme_ue_t *mme_ue)
add Handover test code
2017-09-11 09:41:14 +00:00
{
Integration with OGSLib
2019-04-27 14:54:30 +00:00
int rv;
ogs_pkbuf_t *emmbuf = NULL;
add Handover test code
2017-09-11 09:41:14 +00:00
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
add Handover test code
2017-09-11 09:41:14 +00:00
[AMF/MME] Add retransmission for accept message Registration accept with GUTI Attach accept Tracking area update request with GUTI
2021-04-23 06:16:18 +00:00
ogs_debug("[%s] Authentication reject", mme_ue->imsi_bcd);
update trace log for S1AP/NAS
2018-01-22 14:14:20 +00:00
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
emmbuf = emm_build_authentication_reject();
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!emmbuf) {
ogs_error("emm_build_authentication_reject() failed");
return OGS_ERROR;
}
add Handover test code
2017-09-11 09:41:14 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(mme_ue->enb_ue, emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
[MME] Introduce support for S6a Cancel Location Request - Added diameter dictionary definitions for Cancel Location - Cancel Location will completely remove UE from MME, allow for a fresh IMSI attach to occur on next attempt. - T3422 is used for detach request. - Added new handling for s6a events in mme-sm, as not all s6a messages are at attach now. Maybe there's something in a state machine I should've been using here instead of a new flag? - Testing was completed with UE in idle and connected. With CLR flags indicating re-attach required and without. Also sending CLR after UE detach. And then sending again when mme_ue is empty.
2022-07-26 14:54:47 +00:00
return rv;
}
[MME] Follow-up Cancel Location Handling (#1698)
2022-08-19 07:52:39 +00:00
int nas_eps_send_detach_request(mme_ue_t *mme_ue)
[MME] Introduce support for S6a Cancel Location Request - Added diameter dictionary definitions for Cancel Location - Cancel Location will completely remove UE from MME, allow for a fresh IMSI attach to occur on next attempt. - T3422 is used for detach request. - Added new handling for s6a events in mme-sm, as not all s6a messages are at attach now. Maybe there's something in a state machine I should've been using here instead of a new flag? - Testing was completed with UE in idle and connected. With CLR flags indicating re-attach required and without. Also sending CLR after UE detach. And then sending again when mme_ue is empty.
2022-07-26 14:54:47 +00:00
{
int rv;
ogs_pkbuf_t *emmbuf = NULL;
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
[MME] Introduce support for S6a Cancel Location Request - Added diameter dictionary definitions for Cancel Location - Cancel Location will completely remove UE from MME, allow for a fresh IMSI attach to occur on next attempt. - T3422 is used for detach request. - Added new handling for s6a events in mme-sm, as not all s6a messages are at attach now. Maybe there's something in a state machine I should've been using here instead of a new flag? - Testing was completed with UE in idle and connected. With CLR flags indicating re-attach required and without. Also sending CLR after UE detach. And then sending again when mme_ue is empty.
2022-07-26 14:54:47 +00:00
ogs_debug("[%s] Detach request to UE", mme_ue->imsi_bcd);
if (mme_ue->t3422.pkbuf) {
emmbuf = mme_ue->t3422.pkbuf;
} else {
[MME] Follow-up Cancel Location Handling (#1698)
2022-08-19 07:52:39 +00:00
emmbuf = emm_build_detach_request(mme_ue);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!emmbuf) {
ogs_error("emm_build_detach_request() failed");
return OGS_ERROR;
}
[MME] Introduce support for S6a Cancel Location Request - Added diameter dictionary definitions for Cancel Location - Cancel Location will completely remove UE from MME, allow for a fresh IMSI attach to occur on next attempt. - T3422 is used for detach request. - Added new handling for s6a events in mme-sm, as not all s6a messages are at attach now. Maybe there's something in a state machine I should've been using here instead of a new flag? - Testing was completed with UE in idle and connected. With CLR flags indicating re-attach required and without. Also sending CLR after UE detach. And then sending again when mme_ue is empty.
2022-07-26 14:54:47 +00:00
}
mme_ue->t3422.pkbuf = ogs_pkbuf_copy(emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!mme_ue->t3422.pkbuf) {
ogs_error("ogs_pkbuf_copy(mme_ue->t3422.pkbuf) failed");
[CORE] Rollback ogs_pkbuf_copy() from (#2012) In the previous #2012 working, I've added ogs_pkbuf_free() for original buffer. But, this rasied double free. So, I've rollback it,
2023-01-23 15:17:10 +00:00
ogs_pkbuf_free(emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
return OGS_ERROR;
}
[MME] Introduce support for S6a Cancel Location Request - Added diameter dictionary definitions for Cancel Location - Cancel Location will completely remove UE from MME, allow for a fresh IMSI attach to occur on next attempt. - T3422 is used for detach request. - Added new handling for s6a events in mme-sm, as not all s6a messages are at attach now. Maybe there's something in a state machine I should've been using here instead of a new flag? - Testing was completed with UE in idle and connected. With CLR flags indicating re-attach required and without. Also sending CLR after UE detach. And then sending again when mme_ue is empty.
2022-07-26 14:54:47 +00:00
ogs_timer_start(mme_ue->t3422.timer,
mme_timer_cfg(MME_TIMER_T3422)->duration);
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(mme_ue->enb_ue, emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
update it
2017-09-07 06:56:31 +00:00
}
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_detach_accept(mme_ue_t *mme_ue)
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
{
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int rv;
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_pkbuf_t *emmbuf = NULL;
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
[AMF/MME] Add retransmission for accept message Registration accept with GUTI Attach accept Tracking area update request with GUTI
2021-04-23 06:16:18 +00:00
ogs_debug("[%s] Detach accept", mme_ue->imsi_bcd);
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
/* reply with detach accept */
fix indentation in MME
2019-07-11 12:53:54 +00:00
if (mme_ue->nas_eps.detach.switch_off == 0) {
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
emmbuf = emm_build_detach_accept(mme_ue);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!emmbuf) {
ogs_error("emm_build_detach_accept() failed");
return OGS_ERROR;
}
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(mme_ue->enb_ue, emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (rv != OGS_OK) {
ogs_error("nas_eps_send_to_downlink_nas_transport() failed");
return rv;
}
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
}
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
rv = s1ap_send_ue_context_release_command(mme_ue->enb_ue,
[MME] Changed CauseNas_detach in DETACH (#1676)
2022-08-06 05:00:54 +00:00
S1AP_Cause_PR_nas, S1AP_CauseNas_detach,
[MME] UE-initiated detach removes S1 only (#1698)
2022-08-19 16:08:20 +00:00
S1AP_UE_CTX_REL_S1_REMOVE_AND_UNLINK, 0);
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
ogs_expect(rv == OGS_OK);
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
}
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_pdn_connectivity_reject(
Distinguish the type of session creation
2022-04-14 08:34:55 +00:00
mme_sess_t *sess, ogs_nas_esm_cause_t esm_cause, int create_action)
add PDN connectivity reject
2017-09-08 09:50:27 +00:00
{
Integration with OGSLib
2019-04-27 14:54:30 +00:00
int rv;
add PDN connectivity reject
2017-09-08 09:50:27 +00:00
mme_ue_t *mme_ue;
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_pkbuf_t *esmbuf = NULL;
add PDN connectivity reject
2017-09-08 09:50:27 +00:00
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_assert(sess);
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
add PDN connectivity reject
2017-09-08 09:50:27 +00:00
mme_ue = sess->mme_ue;
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
add PDN connectivity reject
2017-09-08 09:50:27 +00:00
Distinguish the type of session creation
2022-04-14 08:34:55 +00:00
if (create_action == OGS_GTP_CREATE_IN_ATTACH_REQUEST) {
Fix the bug GUTI not present case [#551]
2020-09-10 18:04:26 +00:00
/* During the UE-attach process, we'll send Attach-Reject
* with pyggybacking PDN-connectivity-Reject */
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_attach_reject(mme_ue->enb_ue, mme_ue,
[MME] Clear UE Context for Attach Reject (#1848) Attach Reject + PDN Connectivity Reject need to clear UE Context
2022-12-27 12:06:44 +00:00
OGS_NAS_EMM_CAUSE_ESM_FAILURE, esm_cause);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (rv != OGS_OK) {
ogs_error("nas_eps_send_attach_reject() failed");
return rv;
}
[MME] Clear UE Context for Attach Reject (#1848) Attach Reject + PDN Connectivity Reject need to clear UE Context
2022-12-27 12:06:44 +00:00
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
rv = s1ap_send_ue_context_release_command(mme_ue->enb_ue,
[MME] Clear UE Context for Attach Reject (#1848) Attach Reject + PDN Connectivity Reject need to clear UE Context
2022-12-27 12:06:44 +00:00
S1AP_Cause_PR_nas, S1AP_CauseNas_normal_release,
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
S1AP_UE_CTX_REL_UE_CONTEXT_REMOVE, 0);
ogs_expect(rv == OGS_OK);
Fix the bug GUTI not present case [#551]
2020-09-10 18:04:26 +00:00
} else {
Distinguish the type of session creation
2022-04-14 08:34:55 +00:00
esmbuf = esm_build_pdn_connectivity_reject(
sess, esm_cause, create_action);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!esmbuf) {
ogs_error("esm_build_pdn_connectivity_reject() failed");
return OGS_ERROR;
}
add PDN connectivity reject
2017-09-08 09:50:27 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(mme_ue->enb_ue, esmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
Update it
2019-05-26 03:57:29 +00:00
}
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
add PDN connectivity reject
2017-09-08 09:50:27 +00:00
}
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_esm_information_request(mme_bearer_t *bearer)
ESM State Machine re-designed for sending ESM information based ESM trasfer flag
2017-09-23 15:59:51 +00:00
{
Integration with OGSLib
2019-04-27 14:54:30 +00:00
int rv;
ESM State Machine re-designed for sending ESM information based ESM trasfer flag
2017-09-23 15:59:51 +00:00
mme_ue_t *mme_ue = NULL;
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_pkbuf_t *esmbuf = NULL;
ESM State Machine re-designed for sending ESM information based ESM trasfer flag
2017-09-23 15:59:51 +00:00
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_assert(bearer);
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
ESM State Machine re-designed for sending ESM information based ESM trasfer flag
2017-09-23 15:59:51 +00:00
mme_ue = bearer->mme_ue;
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
ESM State Machine re-designed for sending ESM information based ESM trasfer flag
2017-09-23 15:59:51 +00:00
[#220] T3489 done
2019-07-20 14:06:54 +00:00
if (bearer->t3489.pkbuf) {
esmbuf = bearer->t3489.pkbuf;
} else {
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
esmbuf = esm_build_information_request(bearer);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!esmbuf) {
ogs_error("esm_build_information_request() failed");
return OGS_ERROR;
}
[#220] T3489 done
2019-07-20 14:06:54 +00:00
}
bearer->t3489.pkbuf = ogs_pkbuf_copy(esmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!bearer->t3489.pkbuf) {
ogs_error("ogs_pkbuf_copy(bearer->t3489) failed");
[CORE] Rollback ogs_pkbuf_copy() from (#2012) In the previous #2012 working, I've added ogs_pkbuf_free() for original buffer. But, this rasied double free. So, I've rollback it,
2023-01-23 15:17:10 +00:00
ogs_pkbuf_free(esmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
return OGS_ERROR;
}
[#220] T3489 done
2019-07-20 14:06:54 +00:00
ogs_timer_start(bearer->t3489.timer,
mme_timer_cfg(MME_TIMER_T3489)->duration);
ESM State Machine re-designed for sending ESM information based ESM trasfer flag
2017-09-23 15:59:51 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(mme_ue->enb_ue, esmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
[MEM] fix the pkbuf problem (#1431)
2022-03-22 13:47:45 +00:00
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
ESM State Machine re-designed for sending ESM information based ESM trasfer flag
2017-09-23 15:59:51 +00:00
}
Distinguish the type of session creation
2022-04-14 08:34:55 +00:00
int nas_eps_send_activate_default_bearer_context_request(
mme_bearer_t *bearer, int create_action)
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
{
Integration with OGSLib
2019-04-27 14:54:30 +00:00
int rv;
ogs_pkbuf_t *s1apbuf = NULL;
ogs_pkbuf_t *esmbuf = NULL;
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
mme_sess_t *sess = NULL;
mme_ue_t *mme_ue = NULL;
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_assert(bearer);
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
sess = bearer->sess;
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_assert(sess);
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
mme_ue = bearer->mme_ue;
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
Distinguish the type of session creation
2022-04-14 08:34:55 +00:00
esmbuf = esm_build_activate_default_bearer_context_request(
sess, create_action);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!esmbuf) {
ogs_error("esm_build_activate_default_bearer_context_request() failed");
return OGS_ERROR;
}
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
s1apbuf = s1ap_build_e_rab_setup_request(bearer, esmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!s1apbuf) {
ogs_error("s1ap_build_e_rab_setup_request() failed");
return OGS_ERROR;
}
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
NGAP is added
2020-05-23 02:24:48 +00:00
rv = nas_eps_send_to_enb(mme_ue, s1apbuf);
ogs_assert to ogs_expects (#314) * HACK: Don't retransmit InitialContextSetupReq Related: #256 * HACK: Don't use buggy sa1p_copy() in eNBConfigTransfer Related: #257 * mme: don't reject with 'IMSI is unknown in HLR' (permanent reject) * MME: Implement S6a result -> EMM cause code mapping Closes: #263 * Spencer: modification to Haralds fix because macros are now renamed * MME: don't assert on MAC failures of uplink NAS frames Closes: #267 * MME: Avoid ogs_assert() in many situations We don't want to crash the entire program just because a message received from an external entity didn't match some of our expectations. * compiles fine, checked DIFFs and only difference is the ogs_assert -> ogs_expect
2019-11-29 06:31:22 +00:00
ogs_expect(rv == OGS_OK);
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
}
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_activate_dedicated_bearer_context_request(
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
mme_bearer_t *bearer)
update it
2017-09-07 06:56:31 +00:00
{
Integration with OGSLib
2019-04-27 14:54:30 +00:00
int rv;
ogs_pkbuf_t *s1apbuf = NULL;
ogs_pkbuf_t *esmbuf = NULL;
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
mme_ue_t *mme_ue = NULL;
update it
2017-09-07 06:56:31 +00:00
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_assert(bearer);
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
mme_ue = bearer->mme_ue;
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
update it
2017-09-07 06:56:31 +00:00
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
esmbuf = esm_build_activate_dedicated_bearer_context_request(bearer);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!esmbuf) {
ogs_error(
"esm_build_activate_dedicated_bearer_context_request() failed");
return OGS_ERROR;
}
update it
2017-09-07 06:56:31 +00:00
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
s1apbuf = s1ap_build_e_rab_setup_request(bearer, esmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!s1apbuf) {
ogs_error("s1ap_build_e_rab_setup_request() failed");
return OGS_ERROR;
}
update it
2017-09-07 06:56:31 +00:00
NGAP is added
2020-05-23 02:24:48 +00:00
rv = nas_eps_send_to_enb(mme_ue, s1apbuf);
ogs_assert to ogs_expects (#314) * HACK: Don't retransmit InitialContextSetupReq Related: #256 * HACK: Don't use buggy sa1p_copy() in eNBConfigTransfer Related: #257 * mme: don't reject with 'IMSI is unknown in HLR' (permanent reject) * MME: Implement S6a result -> EMM cause code mapping Closes: #263 * Spencer: modification to Haralds fix because macros are now renamed * MME: don't assert on MAC failures of uplink NAS frames Closes: #267 * MME: Avoid ogs_assert() in many situations We don't want to crash the entire program just because a message received from an external entity didn't match some of our expectations. * compiles fine, checked DIFFs and only difference is the ogs_assert -> ogs_expect
2019-11-29 06:31:22 +00:00
ogs_expect(rv == OGS_OK);
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
update it
2017-09-07 06:56:31 +00:00
}
add PDN disconnect
2017-09-07 14:41:05 +00:00
NGAP is added
2020-05-23 02:24:48 +00:00
void nas_eps_send_activate_all_dedicated_bearers(mme_bearer_t *default_bearer)
refine code
2018-02-01 12:38:59 +00:00
{
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
int r;
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_assert(default_bearer);
refine code
2018-02-01 12:38:59 +00:00
mme_bearer_t *dedicated_bearer = mme_bearer_next(default_bearer);
fix indentation in MME
2019-07-11 12:53:54 +00:00
while (dedicated_bearer) {
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
r = nas_eps_send_activate_dedicated_bearer_context_request(
refine code
2018-02-01 12:38:59 +00:00
dedicated_bearer);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(r == OGS_OK);
ogs_assert(r != OGS_ERROR);
refine code
2018-02-01 12:38:59 +00:00
dedicated_bearer = mme_bearer_next(dedicated_bearer);
}
}
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_modify_bearer_context_request(
NAS modify bearer request/accept is done
2018-01-17 06:41:45 +00:00
mme_bearer_t *bearer, int qos_presence, int tft_presence)
{
Integration with OGSLib
2019-04-27 14:54:30 +00:00
int rv;
ogs_pkbuf_t *s1apbuf = NULL;
ogs_pkbuf_t *esmbuf = NULL;
NAS modify bearer request/accept is done
2018-01-17 06:41:45 +00:00
mme_ue_t *mme_ue = NULL;
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_assert(bearer);
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
NAS modify bearer request/accept is done
2018-01-17 06:41:45 +00:00
mme_ue = bearer->mme_ue;
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
NAS modify bearer request/accept is done
2018-01-17 06:41:45 +00:00
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
esmbuf = esm_build_modify_bearer_context_request(
bearer, qos_presence, tft_presence);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!esmbuf) {
ogs_error("esm_build_modify_bearer_context_request() failed");
return OGS_ERROR;
}
NAS modify bearer request/accept is done
2018-01-17 06:41:45 +00:00
fix indentation in MME
2019-07-11 12:53:54 +00:00
if (qos_presence == 1) {
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
s1apbuf = s1ap_build_e_rab_modify_request(bearer, esmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!s1apbuf) {
ogs_error("s1ap_build_e_rab_modify_request() failed");
return OGS_ERROR;
}
NAS modify bearer request/accept is done
2018-01-17 06:41:45 +00:00
NGAP is added
2020-05-23 02:24:48 +00:00
rv = nas_eps_send_to_enb(mme_ue, s1apbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
fix indentation in MME
2019-07-11 12:53:54 +00:00
} else {
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(mme_ue->enb_ue, esmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
NAS modify bearer request/accept is done
2018-01-17 06:41:45 +00:00
}
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
NAS modify bearer request/accept is done
2018-01-17 06:41:45 +00:00
}
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_deactivate_bearer_context_request(mme_bearer_t *bearer)
add PDN disconnect
2017-09-07 14:41:05 +00:00
{
Integration with OGSLib
2019-04-27 14:54:30 +00:00
int rv;
ogs_pkbuf_t *s1apbuf = NULL;
ogs_pkbuf_t *esmbuf = NULL;
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
mme_ue_t *mme_ue = NULL;
add PDN disconnect
2017-09-07 14:41:05 +00:00
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_assert(bearer);
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
mme_ue = bearer->mme_ue;
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
add PDN disconnect
2017-09-07 14:41:05 +00:00
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
esmbuf = esm_build_deactivate_bearer_context_request(
[AMF] Fixed 5GMM cause in Reject message (#1660) When a UE that requests slices tries to connect and there are no slices configured, the reject message is: 5GMM cause = 0x7 (5GS Services not allowed) however it should be: 5GMM cause = 0x3e (No network slices available) All 5GMM cause value in reject message is reviewed in this commit
2022-07-19 03:42:02 +00:00
bearer, OGS_NAS_ESM_CAUSE_REGULAR_DEACTIVATION);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!esmbuf) {
ogs_error("esm_build_deactivate_bearer_context_request() failed");
return OGS_ERROR;
}
add PDN disconnect
2017-09-07 14:41:05 +00:00
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
s1apbuf = s1ap_build_e_rab_release_command(bearer, esmbuf,
update it
2018-03-05 14:01:07 +00:00
S1AP_Cause_PR_nas, S1AP_CauseNas_normal_release);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!s1apbuf) {
ogs_error("s1ap_build_e_rab_release_command() failed");
return OGS_ERROR;
}
add PDN disconnect
2017-09-07 14:41:05 +00:00
NGAP is added
2020-05-23 02:24:48 +00:00
rv = nas_eps_send_to_enb(mme_ue, s1apbuf);
ogs_assert to ogs_expects (#314) * HACK: Don't retransmit InitialContextSetupReq Related: #256 * HACK: Don't use buggy sa1p_copy() in eNBConfigTransfer Related: #257 * mme: don't reject with 'IMSI is unknown in HLR' (permanent reject) * MME: Implement S6a result -> EMM cause code mapping Closes: #263 * Spencer: modification to Haralds fix because macros are now renamed * MME: don't assert on MAC failures of uplink NAS frames Closes: #267 * MME: Avoid ogs_assert() in many situations We don't want to crash the entire program just because a message received from an external entity didn't match some of our expectations. * compiles fine, checked DIFFs and only difference is the ogs_assert -> ogs_expect
2019-11-29 06:31:22 +00:00
ogs_expect(rv == OGS_OK);
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
add PDN disconnect
2017-09-07 14:41:05 +00:00
}
tracking area update for multiple MME
2017-09-08 07:46:37 +00:00
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_bearer_resource_allocation_reject(
fix: Derive ESM cause from GTP-Cause (#755)
2021-01-11 04:36:12 +00:00
mme_ue_t *mme_ue, uint8_t pti, ogs_nas_esm_cause_t esm_cause)
Add Bearer Resource Modification feature (#336)
2019-12-28 12:46:30 +00:00
{
int rv;
ogs_pkbuf_t *esmbuf = NULL;
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
fix: Derive ESM cause from GTP-Cause (#755)
2021-01-11 04:36:12 +00:00
ogs_assert(pti != OGS_NAS_PROCEDURE_TRANSACTION_IDENTITY_UNASSIGNED);
Add Bearer Resource Modification feature (#336)
2019-12-28 12:46:30 +00:00
fix: Derive ESM cause from GTP-Cause (#755)
2021-01-11 04:36:12 +00:00
esmbuf = esm_build_bearer_resource_allocation_reject(
mme_ue, pti, esm_cause);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!esmbuf) {
ogs_error("esm_build_bearer_resource_allocation_reject() failed");
return OGS_ERROR;
}
Add Bearer Resource Modification feature (#336)
2019-12-28 12:46:30 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(mme_ue->enb_ue, esmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
Add Bearer Resource Modification feature (#336)
2019-12-28 12:46:30 +00:00
}
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_bearer_resource_modification_reject(
fix: Derive ESM cause from GTP-Cause (#755)
2021-01-11 04:36:12 +00:00
mme_ue_t *mme_ue, uint8_t pti, ogs_nas_esm_cause_t esm_cause)
Add Bearer Resource Modification feature (#336)
2019-12-28 12:46:30 +00:00
{
int rv;
ogs_pkbuf_t *esmbuf = NULL;
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
fix: Derive ESM cause from GTP-Cause (#755)
2021-01-11 04:36:12 +00:00
ogs_assert(pti != OGS_NAS_PROCEDURE_TRANSACTION_IDENTITY_UNASSIGNED);
Add Bearer Resource Modification feature (#336)
2019-12-28 12:46:30 +00:00
fix: Derive ESM cause from GTP-Cause (#755)
2021-01-11 04:36:12 +00:00
esmbuf = esm_build_bearer_resource_modification_reject(
mme_ue, pti, esm_cause);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!esmbuf) {
ogs_error("esm_build_bearer_resource_modification_reject() failed");
return OGS_ERROR;
}
Add Bearer Resource Modification feature (#336)
2019-12-28 12:46:30 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(mme_ue->enb_ue, esmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
Add Bearer Resource Modification feature (#336)
2019-12-28 12:46:30 +00:00
}
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_tau_accept(
update it
2018-03-05 14:01:07 +00:00
mme_ue_t *mme_ue, S1AP_ProcedureCode_t procedureCode)
tracking area update for multiple MME
2017-09-08 07:46:37 +00:00
{
Integration with OGSLib
2019-04-27 14:54:30 +00:00
int rv;
ogs_pkbuf_t *emmbuf = NULL;
tracking area update for multiple MME
2017-09-08 07:46:37 +00:00
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
tracking area update for multiple MME
2017-09-08 07:46:37 +00:00
[AMF/MME] Add retransmission for accept message Registration accept with GUTI Attach accept Tracking area update request with GUTI
2021-04-23 06:16:18 +00:00
ogs_debug("[%s] Tracking area update accept", mme_ue->imsi_bcd);
Error Indication is added
2018-02-03 02:48:15 +00:00
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
emmbuf = emm_build_tau_accept(mme_ue);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!emmbuf) {
ogs_error("emm_build_tau_accept() failed");
return OGS_ERROR;
}
add to trace for testing tracking area update
2018-02-02 04:46:49 +00:00
[MEM] fix the pkbuf problem (#1431)
2022-03-22 13:47:45 +00:00
if (mme_ue->next.m_tmsi) {
CLEAR_MME_UE_TIMER(mme_ue->t3450);
mme_ue->t3450.pkbuf = ogs_pkbuf_copy(emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!mme_ue->t3450.pkbuf) {
ogs_error("ogs_pkbuf_copy(mme_ue->t3450.pkbuf) failed");
[CORE] Rollback ogs_pkbuf_copy() from (#2012) In the previous #2012 working, I've added ogs_pkbuf_free() for original buffer. But, this rasied double free. So, I've rollback it,
2023-01-23 15:17:10 +00:00
ogs_pkbuf_free(emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
return OGS_ERROR;
}
[MEM] fix the pkbuf problem (#1431)
2022-03-22 13:47:45 +00:00
ogs_timer_start(mme_ue->t3450.timer,
mme_timer_cfg(MME_TIMER_T3450)->duration);
}
fix indentation in MME
2019-07-11 12:53:54 +00:00
if (procedureCode == S1AP_ProcedureCode_id_InitialContextSetup) {
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_pkbuf_t *s1apbuf = NULL;
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
s1apbuf = s1ap_build_initial_context_setup_request(mme_ue, emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!s1apbuf) {
ogs_error("s1ap_build_initial_context_setup_request() failed");
return OGS_ERROR;
}
propose TAU process when Unknown GUTI or MAC Faield of Security Context
2017-09-10 14:03:24 +00:00
NGAP is added
2020-05-23 02:24:48 +00:00
rv = nas_eps_send_to_enb(mme_ue, s1apbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
fix indentation in MME
2019-07-11 12:53:54 +00:00
} else if (procedureCode == S1AP_ProcedureCode_id_downlinkNASTransport) {
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(mme_ue->enb_ue, emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
fix indentation in MME
2019-07-11 12:53:54 +00:00
} else
Integration with OGSLib
2019-04-27 14:54:30 +00:00
ogs_assert_if_reached();
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
tracking area update for multiple MME
2017-09-08 07:46:37 +00:00
}
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
int nas_eps_send_tau_reject(
enb_ue_t *enb_ue, mme_ue_t *mme_ue, ogs_nas_emm_cause_t emm_cause)
tracking area update for multiple MME
2017-09-08 07:46:37 +00:00
{
Integration with OGSLib
2019-04-27 14:54:30 +00:00
int rv;
ogs_pkbuf_t *emmbuf = NULL;
tracking area update for multiple MME
2017-09-08 07:46:37 +00:00
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
if (!enb_ue_cycle(enb_ue)) {
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
tracking area update for multiple MME
2017-09-08 07:46:37 +00:00
[AMF/MME] Add retransmission for accept message Registration accept with GUTI Attach accept Tracking area update request with GUTI
2021-04-23 06:16:18 +00:00
ogs_debug("[%s] Tracking area update reject", mme_ue->imsi_bcd);
tracking area update for multiple MME
2017-09-08 07:46:37 +00:00
/* Build TAU reject */
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
emmbuf = emm_build_tau_reject(emm_cause, mme_ue);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!emmbuf) {
ogs_error("emm_build_tau_reject() failed");
return OGS_ERROR;
}
Update state machine
2017-09-08 22:56:42 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(enb_ue, emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
Update state machine
2017-09-08 22:56:42 +00:00
}
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
int nas_eps_send_service_reject(
enb_ue_t *enb_ue, mme_ue_t *mme_ue, ogs_nas_emm_cause_t emm_cause)
Update state machine
2017-09-08 22:56:42 +00:00
{
Integration with OGSLib
2019-04-27 14:54:30 +00:00
int rv;
ogs_pkbuf_t *emmbuf = NULL;
Update state machine
2017-09-08 22:56:42 +00:00
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
if (!enb_ue_cycle(enb_ue)) {
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
Update state machine
2017-09-08 22:56:42 +00:00
[AMF/MME] Add retransmission for accept message Registration accept with GUTI Attach accept Tracking area update request with GUTI
2021-04-23 06:16:18 +00:00
ogs_debug("[%s] Service reject", mme_ue->imsi_bcd);
service request procedure updated
2017-09-11 05:18:18 +00:00
/* Build Service Reject */
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
emmbuf = emm_build_service_reject(emm_cause, mme_ue);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!emmbuf) {
ogs_error("emm_build_service_reject() failed");
return OGS_ERROR;
}
tracking area update for multiple MME
2017-09-08 07:46:37 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(enb_ue, emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
tracking area update for multiple MME
2017-09-08 07:46:37 +00:00
}
[CSFB] MT-Active-Mode (Not Done)
2019-07-11 09:14:32 +00:00
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_cs_service_notification(mme_ue_t *mme_ue)
[CSFB] MT-Active-Mode (Not Done)
2019-07-11 09:14:32 +00:00
{
int rv;
ogs_pkbuf_t *emmbuf = NULL;
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
[CSFB] MT-Active-Mode (Not Done)
2019-07-11 09:14:32 +00:00
[AMF/MME] Add retransmission for accept message Registration accept with GUTI Attach accept Tracking area update request with GUTI
2021-04-23 06:16:18 +00:00
ogs_debug("[%s] CS Service Notification", mme_ue->imsi_bcd);
[CSFB] MT-Active-Mode (Not Done)
2019-07-11 09:14:32 +00:00
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
emmbuf = emm_build_cs_service_notification(mme_ue);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!emmbuf) {
ogs_error("emm_build_cs_service_notification() failed");
return OGS_ERROR;
}
[CSFB] MT-Active-Mode (Not Done)
2019-07-11 09:14:32 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(mme_ue->enb_ue, emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
[CSFB] MT-Active-Mode (Not Done)
2019-07-11 09:14:32 +00:00
}
[Done] SMS over SGs
2019-07-13 13:52:50 +00:00
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
int nas_eps_send_downlink_nas_transport(
[Done] SMS over SGs
2019-07-13 13:52:50 +00:00
mme_ue_t *mme_ue, uint8_t *buffer, uint8_t length)
{
int rv;
ogs_pkbuf_t *emmbuf = NULL;
[AMF/SMF] Fixed a crash (#2030, #2074, #2085)
2023-02-20 11:49:48 +00:00
if (!mme_ue_cycle(mme_ue)) {
ogs_error("UE(mme-ue) context has already been removed");
return OGS_NOTFOUND;
}
if (!enb_ue_cycle(mme_ue->enb_ue)) {
ogs_error("S1 context has already been removed");
return OGS_NOTFOUND;
}
[Done] SMS over SGs
2019-07-13 13:52:50 +00:00
ogs_assert(buffer);
ogs_assert(length);
[AMF/MME] Add retransmission for accept message Registration accept with GUTI Attach accept Tracking area update request with GUTI
2021-04-23 06:16:18 +00:00
ogs_debug("[%s] Downlink NAS transport", mme_ue->imsi_bcd);
[Done] SMS over SGs
2019-07-13 13:52:50 +00:00
Review ogs_expect() (#314)
2019-11-30 07:45:09 +00:00
emmbuf = emm_build_downlink_nas_transport(mme_ue, buffer, length);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
if (!emmbuf) {
ogs_error("emm_build_downlink_nas_transport() failed");
return OGS_ERROR;
}
[Done] SMS over SGs
2019-07-13 13:52:50 +00:00
[MME] Race condition between S1AP and S6A Assume the UE has Attached, the session has been created, and is in the IDLE state with the UEContextRelease process. This could result in the following call flow. 1. TAU request without Integrity Protected 2. Authentication request/response 3. Security-mode command/complete MME can be performed simultaneously by the HSS(S6A) and UE(S1AP). Update-Location-Request Service request Service reject Delete Session Request Delete Session Response Update-Location-Answer UEContextReleaseCommand for Service reject TAU reject UEContextReleaseCommand for TAU reject UEContextReleaseComplete UEContextReleaseComplete MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS, which has been fixed.
2024-03-16 13:59:36 +00:00
rv = nas_eps_send_to_downlink_nas_transport(mme_ue->enb_ue, emmbuf);
[AMF/MME] Fixed crash when no NG/S1 context(#2012)
2023-01-23 01:37:22 +00:00
ogs_expect(rv == OGS_OK);
[ALL] Add protection of message encoding (#991) All process will be forcely exited if it failed to encode the S1AP/NGAP/GTP/PFCP message. It is to make sure there was no problem with the encoding of open5gs.
2021-05-16 03:22:10 +00:00
return rv;
[Done] SMS over SGs
2019-07-13 13:52:50 +00:00
}