Commit Graph

378 Commits

Author SHA1 Message Date
Sukchan Lee 8484a5af60 [GTP] Incorrect destination TEID=0 (#3043)
If eg. PCRF or AAA diameter link is not yet ready (eg. PCRF crashed),
and a client sends a CreateSessionRequest announcing its ow F-TEID,
then open5gs-smfd answers with Create Session Response Cause=
"Remote peer not responding", but it is not setting the received F-TEID
in the header of the response, instead it sends with TEI=0.

As a result, the peer cannot match the CreateSessionResponse,
and needs to rely on its own timeout timer to figure out
that specific request failed.

To address this issue, I modified the GTP Response message to check
the Sender F-TEID and send it accordingly, setting the destination TEID
to the value of the Sender F-TEID.

I've made this modification only for SMF, but MME and SGW-C have not done so;
if you need to, you can work from the examples in SMF.

Similarly, the same situation can happen with PFCP. If anyone needs to do this
in the future, I think you can work on it this way.
2024-04-06 16:39:32 +09:00
Sukchan Lee e8a3b76af3 [SMF] Crash SMF when no GTP-C config (#3094)
When GTP-C secition of smf.yaml is deleted as follows to run smf as 5G,
it crashed.

```diff
--- smf.yaml.orig       2024-03-26 14:13:12.000000000 +0900
+++ smf.yaml    2024-03-26 14:29:40.701508424 +0900
@@ -23,9 +23,6 @@
     client:
       upf:
         - address: 127.0.0.7
-  gtpc:
-    server:
-      - address: 127.0.0.4
   gtpu:
     server:
       - address: 127.0.0.4
@@ -47,7 +44,7 @@
 #    - ::1
 #  ctf:
 #    enabled: auto   # auto(default)|yes|no
-  freeDiameter: /root/open5gs/install/etc/freeDiameter/smf.conf
+#  freeDiameter: /root/open5gs/install/etc/freeDiameter/smf.conf

 ################################################################################
 # SMF Info
Open5GS daemon v2.7.0-119-g581d255

03/26 14:39:42.844: [app] INFO: Configuration: 'install/etc/open5gs/smf.yaml' (../lib/app/ogs-init.c:130)
03/26 14:39:42.845: [app] INFO: File Logging: '/root/open5gs/install/var/log/open5gs/smf.log' (../lib/app/ogs-init.c:133)
03/26 14:39:42.913: [metrics] INFO: metrics_server() [http://127.0.0.4]:9090 (../lib/metrics/prometheus/context.c:299)
03/26 14:39:42.913: [smf] WARNING: No diameter configuration (../src/smf/fd-path.c:30)
03/26 14:39:42.913: [smf] FATAL: smf_gtp_open: Assertion `ogs_gtp_self()->gtpc_sock || ogs_gtp_self()->gtpc_sock6' failed. (../src/smf/gtp-path.c:253)
03/26 14:39:42.913: [core] FATAL: backtrace() returned 8 addresses (../lib/core/ogs-abort.c:37)
./install/bin/open5gs-smfd(+0x391ab) [0x55d28319b1ab]
./install/bin/open5gs-smfd(+0x10046) [0x55d283172046]
./install/bin/open5gs-smfd(+0xf3de) [0x55d2831713de]
./install/bin/open5gs-smfd(+0xfcf9) [0x55d283171cf9]
/lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f0a145f9d90]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f0a145f9e40]
./install/bin/open5gs-smfd(+0xf305) [0x55d283171305]
Aborted (core dumped)
```

So, Fixed to run SMF with GTP-C disabled for 5G.
2024-03-31 20:25:25 +09:00
Sukchan Lee 581d255c53 Revert "[GTP/PFCP]] incorrect dst TEI=0/SEID=0 (#3043)"
This reverts commit a667525041.
2024-03-26 08:04:26 +09:00
Sukchan Lee a667525041 [GTP/PFCP]] incorrect dst TEI=0/SEID=0 (#3043)
If eg. PCRF or AAA diameter link is not yet ready (eg. PCRF crashed), and
a client sends a CreateSessionRequest announcing its ow F-TEID,
then open5gs-smfd answers with Create Session Response Cause=
"Remote peer not responding", but it is not setting the received F-TEID
in the header of the response, instead it sends with TEI=0.

As a result, the peer cannot match the CreateSessionResponse, and needs
to rely on its own timeout timer to figure out that specific request failed.

This also happens in PFCP, so to solve this problem, I added teid/seid_presence
to the interface that sends the error message as shown below.

void ogs_gtp2_send_error_message(ogs_gtp_xact_t *xact,
        int teid_presence, uint32_t teid, uint8_t type, uint8_t cause_value);
void ogs_pfcp_send_error_message(
    ogs_pfcp_xact_t *xact, int seid_presence, uint64_t seid, uint8_t type,
    uint8_t cause_value, uint16_t offending_ie_value);
2024-03-23 10:06:16 +09:00
Sukchan Lee 9a515e9b1d [GTP-U] Fixed a stack overflow bug (#3003) 2024-02-23 19:59:04 +00:00
Pau Espin a613be8c4c [SMF,MME] Gn: Set Delivery of erroneous SDUs QoS field to No
Before this patch, it was set as 0, which is Reserved in Network to MS
direction.
2024-01-27 07:11:44 +09:00
Pau Espin d95c82b21c [SMF,MME] Gn: Set Delivery order QoS field to No
Before this patch, it was set as 0, which is Reserved in Network to MS
direction.
2024-01-27 07:11:44 +09:00
Bostjan Meglic e650b66305 fix mismatch of parameters between prototype and declaration 2024-01-22 17:34:59 +09:00
Pau Espin 60691b02d2 [MME] Gn: Introduce initial support for 2G->4G cell reselection
In an Inter-RAT setup a UE could perform a TAU coming from a 2G/3G network.
In that case the UE/MS is unknown to the MME and it should request the
SGSN context (MM, PDP) from the old SGSN. This is done through the following
GTPv1C message exchange on the Gn interface of SGSN and MME:
SGSN <- MME: SGSN Context Request
SGSN -> MME: SGSN Context Response
SGSN <- MME: SGSN Context Acknowledge

Diagram with full set of steps can be found at 3GPP TS 23.401 D.3.6.

This commit doesn't aim to be a complete implementation of the mentioned
procedure, since it's quite a complex one, with lots of fields and logic
required. This so far only implements in general the minimally
successful case by filling as much as possible the required set of
fields.
This will allow for a base onto which do incremental improvements and
fixes while testing against UEs and SGSNs (such as osmo-sgsn, which
doesn't yet support this procedure but will potentially earn it soon).

The reverse direction, aka UE issuing cell reselection 4G->2G was
already implemented (same as here, initial non-complete implementation)
in open5gs-mmed in commit 3d693da73e.

Related: https://osmocom.org/issues/6294
2024-01-17 23:05:19 +09:00
Pau Espin 078bfc90da [GTPv1] Introduce APIs to decode MM Context and PDP Context IEs
They will be used in a follow-up patch implementing GERAN->EUTRAN idle
mobility.
2024-01-16 06:37:10 +09:00
Pau Espin feaa86fc9c [GTPv1] Fix encoding of MM Context IE if NRSNRA bit not set
The len byte, describing the length of the field coming after it,
is always expected according to the struct definition.
2024-01-16 06:37:10 +09:00
Pau Espin 4ab275ad70 Rename and move ogs_gtp2_paa_to_ip() to lib/proto/conv
Both types are defined under lib/proto/type.h, and the conversion
function is used in several different protocols, so let's better move it
to generic lib/proto/conv.h and remove the "gtp2" prefix.
2024-01-06 07:44:14 +09:00
Pau Espin 27d2f86103 lib/gtp/xact: Fix tx of SGSN Context Acknowledge 2024-01-04 06:57:18 +09:00
Pau Espin 389ccaed16 lib/gtp/xact: Fix rx of SGSN Context Response 2024-01-04 06:57:18 +09:00
Pau Espin 3d693da73e [MME] Gn: Introduce initial support for 4G->2G cell reselection
In an Inter-RAT setup a UE could perform a RAU coming from a 4G network.
In that case the UE/MS is unknown to the SGSN and it should request the
SGSN context (MM, PDP) from the MME. This is done through the following
GTPv1C message exchange on the Gn interface of SGSN and MME:
SGSN -> MME: SGSN Context Request
SGSN <- MME: SGSN Context Response
SGSN -> MME: SGSN Context Acknowledge

This commit doesn't aim to be a complete implementation of the mentioned
procedure, since it's quite a complex one, with lots of fields and logic
required. This so far only implements in general the minimally
successful case by filling as much as possible the required set of
fields.
This will allow for a base onto which do incremental improvements and
fixes while testing against UEs and SGSNs (such as osmo-sgsn, which
doesn't yet support this procedure but will potentially earn it soon).

This commit doesn't implement the reverse direction, aka UE issuing cell
reselection 2G->4G. Initial support for this scenario will hopefully be
added soon as a follow-up patch, similar to this one.

Related: https://osmocom.org/issues/6294
2023-12-23 09:56:55 +09:00
Pau Espin ea7708bcfc lib/gtp: Fix xact logic for gtp1 messages with intermediate stage
As per TS 29.060:
The Initial/request message is "SGSN Context Request", sent by peer A.
Peer B sends a response message "SGSN Context Response" with same SeqNr.
Peer A sends a response message "SGSN Context Acknowledge" with same
SeqNr.
If Peer B doesn't see a "SGSN Context Acknowlegde", it should keep
retransmitting "SGSN Context Response" as usual.
2023-12-22 06:04:18 +09:00
Pau Espin 6a9c7f16c1 Revert "[MME] Gn: Introduce initial support for 4G->2G cell reselection"
This reverts commit 5a31af36e0.
2023-12-22 06:02:11 +09:00
Pau Espin 75f32e07de xact: Fix debug message printed when not needed 2023-12-21 22:13:45 +09:00
Pau Espin 5a31af36e0 [MME] Gn: Introduce initial support for 4G->2G cell reselection
In an Inter-RAT setup a UE could perform a RAU coming from a 4G network.
In that case the UE/MS is unknown to the SGSN and it should request the
SGSN context (MM, PDP) from the MME. This is done through the following
GTPv1C message exchange on the Gn interface of SGSN and MME:
SGSN -> MME: SGSN Context Request
SGSN <- MME: SGSN Context Response
SGSN -> MME: SGSN Context Acknowledge

This commit doesn't aim to be a complete implementation of the mentioned
procedure, since it's quite a complex one, with lots of fields and logic
required. This so far only implements in general the minimally
successful case by filling as much as possible the required set of
fields.
This will allow for a base onto which do incremental improvements and
fixes while testing against UEs and SGSNs (such as osmo-sgsn, which
doesn't yet support this procedure but will potentially earn it soon).

This commit doesn't implement the reverse direction, aka UE issuing cell
reselection 2G->4G. Initial support for this scenario will hopefully be
added soon as a follow-up patch, similar to this one.

Related: https://osmocom.org/issues/6294
2023-12-21 22:11:49 +09:00
Pau Espin b0f381416b gtp/v1: Specify 'P-TMSI Signature' as uint24_t 2023-12-12 08:14:40 +09:00
Pau Espin 204ac35a66 gtp/v1: Specify 'MS Validated' IE as uint8
This field is a fixed size 1 byte with all bits set as spare (1) and the
lsb set as 0 ("No") or 1 ("Yes").
2023-12-12 08:14:40 +09:00
Sukchan Lee e92293e0af
[SEPP] Initial Update for 5G Roaming (#2739)
[SEPP] Initial Update for 5G Roaming
2023-11-19 19:34:51 +09:00
Sukchan Lee aa746794e7 [GTPU] Fixed Stack-Buffer-Overflow in GTPU (#2609) 2023-09-15 07:17:04 +09:00
Sukchan Lee 05ed95d623 [GTPU] Fixed PDCP SN handling (#2584, #2477)
Scenario is handover on S1AP, data forwarding is enabled, and
the Source ENB is forwarding DL PDCP packets to EPC(SGWU)
with PDCP SN included. SGWU is also forwarding these packets
to the Target ENB.

However the PDCP SN is not present in the forwarded packets
from SGWU to Target ENB.

I modified this part, and there was the same problem in 5GC, fixed it as well.

A lot of code in GTP-U has been modified,
so if you have any problems, please let us know right away.
2023-09-10 22:37:42 +09:00
Sukchan Lee 7a3d551752 [TLV] Oops! Fixed my mistake on pull #2549 2023-08-26 16:35:27 +09:00
Sukchan Lee 5c726684b3 [TLV] GTP parser crashg from FuzzingLabs
See below for details
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61780#c1
2023-08-26 16:30:29 +09:00
Sukchan Lee e01f46eb6c
Use x1000 multiplier for Kbps, Mbps, ... etc. (#2515)
NAS, GTP, PFCP, SBI, all except S1AP/NGAP use x1000 multiplier for Kbps, Mbps, Gbps ... etc.

From now on in WebUI all units also use a multiplier of x1000.
2023-08-13 18:19:45 +09:00
Pau Espin a7898cb26c gtp1: Add missing RAN INFORMATION RELAY msg
The RAN INFORMATION RELAY message has no associated response, and hence
it should not start T3-RESPONSE timer to retrigger retransmissions.

 TS 29.060 11.1:
 "The Error Indication, Version Not Supported, RAN Information Relay,
 Supported Extension Headers Notification and the SGSN Context Acknowledge
 messages shall be considered as Responses for the purpose of this clause"

 TS 29.060 7.5.14.1:
 "For handling of protocol errors the RAN Information Relay message is treated as a
 Response message."
2023-07-14 07:50:27 +09:00
Pau Espin fa5d9003d7 gtp: xact: Fix unneeded conditionals
The xarg->org is set to a specific value above in the same function, so
no need to check for its value.
2023-07-13 22:25:18 +09:00
Sukchan Lee aed52a9ad8 [GTP-U] Send Error Indication for unknown PDR 2023-04-16 12:30:36 +09:00
Sukchan Lee 642d9e2e18 [PFCP/GTP] SEID/TEID Randomness (#1303) 2023-04-16 12:30:36 +09:00
Sukchan Lee 69c080c8f2 [NAS/GTP/PFCP] Upgrade IE to Release-17
As raised in #2147, AMF fails to decode S1 UE Network Capability.

So I reviewed all IE in NAS, GTP and PFCP and fixed it for Release-17.
2023-03-11 18:42:30 +09:00
Sukchan Lee a8790713d7 [Release-17] Upgrade PFCP to v17.7.1 2023-03-05 22:33:01 +09:00
Sukchan Lee 3b8a1386e4 [Release-17] Upgrade GTPv1/v2 to v17.4.0/v17.7.0 2023-03-05 12:37:14 +09:00
Sukchan Lee fd9c211005 [PFCP/GTP] Fixed security bug (#2127,#2128,#2129) 2023-03-05 08:35:30 +09:00
Sukchan Lee 82e9016164 [AMF/SMF] Fixed a crash (#2030, #2074, #2085) 2023-02-20 20:49:48 +09:00
Sukchan Lee b80db453e8 [GTP/PFCP] Follow-up on #2073 2023-02-17 06:55:22 +09:00
Sukchan Lee c6fd4ae6b8 [LOG] remove ogs_expect_or_return()/return_val() 2023-01-24 00:01:36 +09:00
Sukchan Lee 01a7b3c9b8 Follow-up on #1991 2023-01-14 09:20:52 +09:00
jmasterfunk84 3fd7ecc9a2
[MME] Add Purge-UE Capability (#1991)
* [MME] Add Purge-UE Capability

* Add OGS_GTP_..._PURGE_AND_REMOVE to split CLR case
2023-01-14 09:13:48 +09:00
Sukchan Lee 0861a045ef [UPF] Fixed an infinte loop when ext_len is 0 2022-11-30 16:40:57 +09:00
Sukchan Lee dc6ca962bb Follow-up on #1797 2022-10-06 10:10:31 +09:00
Sukchan Lee 6d27fbb8cc Follow-up on #1797 2022-10-05 14:50:52 +09:00
jmasterfunk84 15680003b5
[MME] Cancel Location while Idle (#1797)
* Cancel Location while Idle Fix

* Forgot about SGSAP on MME Change.

Added "action" to sgsap_send_detach..

* Make handle_clr uniform with other handlers

* Added Robustness for Any Detach Type

* Memory wasn't freed upon CLR for unknown IMSIs

* Moving MME Detach to new PR
2022-10-05 11:06:01 +09:00
Bostjan Meglic 87cd34d300 Minor typo fix 2022-09-07 18:01:21 +09:00
Sukchan Lee 9b10d70c77 [NRF] Fixed library load error 2022-08-26 10:57:11 +09:00
Sukchan Lee a9694d6474 [MME] Follow-up Cancel Location Handling (#1698) 2022-08-19 16:52:39 +09:00
jmasterfunk84 c98333bbfe
[MME] Cancel Location Handling (#1698)
* CLR while idle is broken after 7031856cd7

Cancel Location Request arriving while UE is idle will not proceed to paging due to this check for S1 connection.  Using new flag "isAnswer" to bypass this check to allow paging to occur when we are not doing a AIA/ULA related procedure.

* No Context Setup is required when sending the detach request.  If the paging was due to wanting to send a Detach Request to the UE, then we fast track to sending the detach request.

* emm-sm.c:
In the case of MME initiated detach while UE is idle, there is no initial conext setup.  We go right from the service request after paging into sending the detach request.  TS23.401

mme-path.c:
Using nas_eps.type in the case of MME Initiated Detach while UE is idle does not work.  nas_eps.type would represent the service request.

mme-s11-handler.c:
After S11 action, no action should be taken.  We want to wait for the detach accept from the UE before proceeding with the S1 release (detach).

* InitialContextSetup should occur for detach.
2022-08-19 16:44:06 +09:00
Sukchan Lee e6a14cb73d Move src/../nf-sm.[ch] to lib/sbi/nf-sm.[ch] 2022-08-12 14:03:53 +09:00
Sukchan Lee da20b2d035 [GTP] gtp_peer override the pool size of GTP node 2022-08-06 13:54:05 +09:00