MME: Gn: Fill PDP Context requested from SGSN with IP allocated by SMF

IP assigned from SMF: session->paa Static IP read from the Subscriber DB: session->ue_ip When passing the PDP context information to the SGSN, we actually wanna provide it with the IP address currently in use.
Revert "[MME] Fixed ttcn3-mme-test-ogs (#2806 ) (#315 )"
2024-05-22 07:14:53 +09:00 · 2024-05-22 07:14:53 +09:00 · 2024-05-21 21:06:17 +09:00 · 2024-05-18 21:37:28 +09:00 · 2024-05-18 21:37:28 +09:00 · 2024-05-18 21:37:28 +09:00
102 changed files with 1201 additions and 623 deletions
--- a/.github/workflows/meson-ci.yml
+++ b/.github/workflows/meson-ci.yml
@ -2,51 +2,51 @@ name: Meson Continuous Integration
 on: [push, pull_request]

 jobs:
-  macos-latest:
-    name: Build and Test on MacOS Latest
-    runs-on: macos-latest
-    steps:
-#    - name: Install MongoDB with Package Manager
+#  macos-latest:
+#    name: Build and Test on MacOS Latest
+#    runs-on: macos-latest
+#    steps:
+##    - name: Install MongoDB with Package Manager
+##      run: |
+##          brew tap mongodb/brew
+##          brew install mongodb-community
+##          brew services start mongodb-community
+#    - name: Create the TUN device with the interface name `ogstun`.
 #      run: |
-#          brew tap mongodb/brew
-#          brew install mongodb-community
-#          brew services start mongodb-community
-    - name: Create the TUN device with the interface name `ogstun`.
-      run: |
-          sudo ifconfig lo0 alias 127.0.0.2 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.3 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.4 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.5 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.5 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.6 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.7 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.8 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.9 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.10 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.11 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.12 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.13 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.14 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.15 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.16 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.17 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.18 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.19 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.0.20 netmask 255.255.255.255
-          sudo ifconfig lo0 alias 127.0.1.10 netmask 255.255.255.255
-    - name: Install the dependencies for building the source code.
-      run: brew install mongo-c-driver libidn libmicrohttpd nghttp2 bison libusrsctp libtins talloc meson
-    - name: Check out repository code
-      uses: actions/checkout@main
-    - name: Setup Meson Build
-      run: PATH="/usr/local/opt/bison/bin:$PATH" PKG_CONFIG_PATH="/usr/local/opt/openssl/lib/pkgconfig:$PKG_CONFIG_PATH" meson setup build
-      env:
-        CC: gcc
-    - name : Build Open5GS
-      run: ninja -C build
-    - name: Test Open5GS
-      run: sudo meson test -C build -v crypt unit
-
+#          sudo ifconfig lo0 alias 127.0.0.2 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.3 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.4 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.5 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.5 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.6 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.7 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.8 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.9 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.10 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.11 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.12 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.13 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.14 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.15 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.16 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.17 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.18 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.19 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.0.20 netmask 255.255.255.255
+#          sudo ifconfig lo0 alias 127.0.1.10 netmask 255.255.255.255
+#    - name: Install the dependencies for building the source code.
+#      run: brew install mongo-c-driver libidn libmicrohttpd nghttp2 bison libusrsctp libtins talloc meson
+#    - name: Check out repository code
+#      uses: actions/checkout@main
+#    - name: Setup Meson Build
+#      run: PATH="/usr/local/opt/bison/bin:$PATH" PKG_CONFIG_PATH="/usr/local/opt/openssl/lib/pkgconfig:$PKG_CONFIG_PATH" meson setup build
+#      env:
+#        CC: gcc
+#    - name : Build Open5GS
+#      run: ninja -C build
+#    - name: Test Open5GS
+#      run: sudo meson test -C build -v crypt unit
+#
  ubuntu-latest:
    name: Build and Test on Ubuntu Latest
    runs-on: ubuntu-latest
--- a/configs/systemd/99-open5gs.network
+++ b/configs/systemd/99-open5gs.network
@ -5,6 +5,14 @@ Name=ogstun
 Address=10.45.0.1/16
 Address=2001:db8:cafe::1/48

+[Route]
+Gateway=0.0.0.0
+Destination=10.45.0.0/16
+
+[Route]
+Gateway=::
+Destination=2001:db8:cafe::0/48
+
 [Link]
 MTUBytes=1400
 RequiredForOnline=false
--- a/debian/changelog
+++ b/debian/changelog
@ -1,3 +1,33 @@
+open5gs (2.7.1) unstable; urgency=medium
+
+  * Bug Fixed
+
+ -- Sukchan Lee <acetcom@gmail.com>  Fri, 19 Apr 2024 21:21:46 +0900
+
+open5gs (2.7.1~mantic) mantic; urgency=medium
+
+  * Bug Fixed
+
+ -- Sukchan Lee <acetcom@gmail.com>  Fri, 19 Apr 2024 21:18:53 +0900
+
+open5gs (2.7.1~bionic) bionic; urgency=medium
+
+  * Bug Fixed
+
+ -- Sukchan Lee <acetcom@gmail.com>  Fri, 19 Apr 2024 21:16:21 +0900
+
+open5gs (2.7.1~jammy) jammy; urgency=medium
+
+  * Bug Fixed
+
+ -- Sukchan Lee <acetcom@gmail.com>  Fri, 19 Apr 2024 21:11:30 +0900
+
+open5gs (2.7.1~focal) focal; urgency=medium
+
+  * Bug Fixed
+
+ -- Sukchan Lee <acetcom@gmail.com>  Fri, 19 Apr 2024 21:08:46 +0900
+
 open5gs (2.7.0) unstable; urgency=medium

  * 5G Roaming with SEPP
--- a/docker/alpine/latest/dev/Dockerfile
+++ b/docker/alpine/latest/dev/Dockerfile
@ -13,7 +13,7 @@ RUN apk update && \
        sudo

 ARG username=acetcom
-RUN adduser -u 1000 acetcom -D && \
+RUN adduser -u 2000 acetcom -D && \
    echo "${username} ALL=(root) NOPASSWD:ALL" > /etc/sudoers.d/${username} && \
    chmod 0440 /etc/sudoers.d/${username}

--- a/docker/debian/latest/dev/Dockerfile
+++ b/docker/debian/latest/dev/Dockerfile
@ -27,7 +27,7 @@ RUN apt-get update && \
 COPY setup.sh /root

 ARG username=acetcom
-RUN useradd -m --uid=1000 ${username} && \
+RUN useradd -m --uid=2000 ${username} && \
    echo "${username} ALL=(root) NOPASSWD:ALL" > /etc/sudoers.d/${username} && \
    chmod 0440 /etc/sudoers.d/${username}

--- a/docker/fedora/latest/dev/Dockerfile
+++ b/docker/fedora/latest/dev/Dockerfile
@ -16,7 +16,7 @@ RUN dnf -y install \
 COPY setup.sh /root

 ARG username=acetcom
-RUN useradd -m --uid=1000 ${username} && \
+RUN useradd -m --uid=2000 ${username} && \
    echo "${username} ALL=(root) NOPASSWD:ALL" > /etc/sudoers.d/${username} && \
    chmod 0440 /etc/sudoers.d/${username}

--- a/docker/ubuntu/latest/dev/Dockerfile
+++ b/docker/ubuntu/latest/dev/Dockerfile
@ -33,7 +33,7 @@ RUN apt-get update && \
 COPY setup.sh /root

 ARG username=acetcom
-RUN useradd -m --uid=1000 ${username} && \
+RUN useradd -m --uid=2000 ${username} && \
    echo "${username} ALL=(root) NOPASSWD:ALL" > /etc/sudoers.d/${username} && \
    chmod 0440 /etc/sudoers.d/${username}

--- a/docs/_pages/docs.md
+++ b/docs/_pages/docs.md
@ -75,8 +75,10 @@ head_inline: "<style> ul { padding-bottom: 1em; } </style>"
  - [srsRAN with eUPF(eBPF/XDP UPF)](https://github.com/s5uishida/open5gs_epc_srsran_eupf_sample_config)
 
 - @gradiant helm charts
-  - [Open5GS EPC and SRS LTE in kubernetes](https://gradiant.github.io/openverso-charts/open5gs-srslte.html)
-  - [Open5GS NGC and UERANSIM in kubernetes](https://gradiant.github.io/openverso-charts/open5gs-ueransim-gnb.html)
-  - [Open5GS NGC and OpenAirInterface GNB with ettus USRP in kubernetes](https://gradiant.github.io/openverso-charts/open5gs-oaignb.html)
-  - [Open5GS EPC and SRS ENB with ettus USRP in kubernetes](https://gradiant.github.io/openverso-charts/open5gs-srsenb.html)
-  - [Open5GS with Service Communication Proxy in kubernetes](https://gradiant.github.io/openverso-charts/open5gs-scp.html)
+  - [Open5GS and srsRAN-5G in kubernetes](https://gradiant.github.io/5g-charts/open5gs-srsran-5g-zmq.html)
+  - [Open5GS and srsLTE in kubernetes](https://gradiant.github.io/5g-charts/open5gs-srslte.html)
+  - [Open5GS and UERANSIM](https://gradiant.github.io/5g-charts/open5gs-ueransim-gnb.html)
+  - [Open5GS and PacketRusher](https://gradiant.github.io/5g-charts/open5gs-packetrusher.html)
+  - [Open5GS and OAI-GNB](https://gradiant.github.io/5g-charts/open5gs-oaignb.html)
+  - [Open5GS and srsenb](https://gradiant.github.io/5g-charts/open5gs-srsenb.html)
+  - [Open5GS with SCP(Service Communication Proxy](https://gradiant.github.io/5g-charts/open5gs-scp.html)
--- a/docs/_posts/2024-04-19-release-v2.7.1.md
+++ b/docs/_posts/2024-04-19-release-v2.7.1.md
@ -0,0 +1,15 @@
+---
+title: "v2.7.1 - Bug Fixed"
+date: 2024-04-19 21:23:00 +0900
+categories:
+  - Release
+tags:
+  - News
+  - Release
+head_inline: "<style> ul { padding-bottom: 1em; } .blue { color: blue; }</style>"
+---
+
+See [Release Note](https://github.com/open5gs/open5gs/releases/tag/v2.7.1)
+
+Download -- [v2.7.1.tar.gz](https://github.com/open5gs/open5gs/archive/v2.7.1.tar.gz)
+{: .notice--info}
--- a/lib/app/ogs-config.c
+++ b/lib/app/ogs-config.c
@ -408,8 +408,8 @@ static int local_conf_prepare(void)
     *  Heartbeat Interval(e.g: 10 seconds) + No Heartbeat Margin(1 second) */
    local_conf.time.nf_instance.no_heartbeat_margin = 1;

-    /* 3600 seconds = 1 hour */
-    local_conf.time.nf_instance.validity_duration = 3600;
+    /* 30 seconds */
+    local_conf.time.nf_instance.validity_duration = 30;

    /* 86400 seconds = 1 day */
    local_conf.time.subscription.validity_duration = 86400;
--- a/lib/gtp/v2/types.c
+++ b/lib/gtp/v2/types.c
@ -629,7 +629,11 @@ int16_t ogs_gtp2_parse_uli(ogs_gtp2_uli_t *uli, ogs_tlv_octet_t *octet)
    size++;

    if (uli->flags.cgi) {
-        ogs_assert(size + sizeof(uli->cgi) <= octet->len);
+        if (size + sizeof(uli->cgi) > octet->len) {
+            ogs_error("size[%d]+sizeof(uli->cgi)[%d] > IE Length[%d]",
+                    size, (int)sizeof(uli->cgi), octet->len);
+            return 0;
+        }
        memcpy(&uli->cgi,
                (unsigned char *)octet->data + size, sizeof(uli->cgi));
        uli->cgi.lac = be16toh(uli->cgi.lac);
@ -637,7 +641,11 @@ int16_t ogs_gtp2_parse_uli(ogs_gtp2_uli_t *uli, ogs_tlv_octet_t *octet)
        size += sizeof(uli->cgi);
    }
    if (uli->flags.sai) {
-        ogs_assert(size + sizeof(uli->sai) <= octet->len);
+        if (size + sizeof(uli->sai) > octet->len) {
+            ogs_error("size[%d]+sizeof(uli->sai)[%d] > IE Length[%d]",
+                    size, (int)sizeof(uli->sai), octet->len);
+            return 0;
+        }
        memcpy(&uli->sai,
                (unsigned char *)octet->data + size, sizeof(uli->sai));
        uli->sai.lac = be16toh(uli->sai.lac);
@ -645,7 +653,11 @@ int16_t ogs_gtp2_parse_uli(ogs_gtp2_uli_t *uli, ogs_tlv_octet_t *octet)
        size += sizeof(uli->sai);
    }
    if (uli->flags.rai) {
-        ogs_assert(size + sizeof(uli->rai) <= octet->len);
+        if (size + sizeof(uli->rai) > octet->len) {
+            ogs_error("size[%d]+sizeof(uli->lai)[%d] > IE Length[%d]",
+                    size, (int)sizeof(uli->lai), octet->len);
+            return 0;
+        }
        memcpy(&uli->rai,
                (unsigned char *)octet->data + size, sizeof(uli->rai));
        uli->rai.lac = be16toh(uli->rai.lac);
@ -653,28 +665,44 @@ int16_t ogs_gtp2_parse_uli(ogs_gtp2_uli_t *uli, ogs_tlv_octet_t *octet)
        size += sizeof(uli->rai);
    }
    if (uli->flags.tai) {
-        ogs_assert(size + sizeof(uli->tai) <= octet->len);
+        if (size + sizeof(uli->tai) > octet->len) {
+            ogs_error("size[%d]+sizeof(uli->tai)[%d] > IE Length[%d]",
+                    size, (int)sizeof(uli->tai), octet->len);
+            return 0;
+        }
        memcpy(&uli->tai,
                (unsigned char *)octet->data + size, sizeof(uli->tai));
        uli->tai.tac = be16toh(uli->tai.tac);
        size += sizeof(uli->tai);
    }
    if (uli->flags.e_cgi) {
-        ogs_assert(size + sizeof(uli->e_cgi) <= octet->len);
+        if (size + sizeof(uli->e_cgi) > octet->len) {
+            ogs_error("size[%d]+sizeof(uli->e_cgi)[%d] > IE Length[%d]",
+                    size, (int)sizeof(uli->e_cgi), octet->len);
+            return 0;
+        }
        memcpy(&uli->e_cgi,
                (unsigned char *)octet->data + size, sizeof(uli->e_cgi));
        uli->e_cgi.cell_id = be32toh(uli->e_cgi.cell_id);
        size += sizeof(uli->e_cgi);
    }
    if (uli->flags.lai) {
-        ogs_assert(size + sizeof(uli->lai) <= octet->len);
+        if (size + sizeof(uli->lai) > octet->len) {
+            ogs_error("size[%d]+sizeof(uli->lai)[%d] > IE Length[%d]",
+                    size, (int)sizeof(uli->lai), octet->len);
+            return 0;
+        }
        memcpy(&uli->lai,
                (unsigned char *)octet->data + size, sizeof(uli->lai));
        uli->lai.lac = be16toh(uli->lai.lac);
        size += sizeof(uli->lai);
    }
    if (uli->flags.enodeb_id) {
-        ogs_assert(size + sizeof(uli->enodeb_id) <= octet->len);
+        if (size + sizeof(uli->enodeb_id) > octet->len) {
+            ogs_error("size[%d]+sizeof(uli->enodeb_id)[%d] > IE Length[%d]",
+                    size, (int)sizeof(uli->enodeb_id), octet->len);
+            return 0;
+        }
        memcpy(&uli->enodeb_id,
                (unsigned char *)octet->data + size, sizeof(uli->enodeb_id));
        uli->enodeb_id.enodeb_id = be16toh(uli->enodeb_id.enodeb_id);
@ -684,7 +712,8 @@ int16_t ogs_gtp2_parse_uli(ogs_gtp2_uli_t *uli, ogs_tlv_octet_t *octet)
        ogs_error("Extended Macro eNodeB ID in ULI not implemented! see 3GPP TS 29.274 8.21.8");
    }

-    ogs_assert(size == octet->len);
+    if (size != octet->len)
+        ogs_error("Mismatch IE Length[%d] != Decoded[%d]", octet->len, size);

    return size;
 }
--- a/lib/pfcp/handler.c
+++ b/lib/pfcp/handler.c
@ -94,6 +94,7 @@ bool ogs_pfcp_cp_handle_association_setup_request(
        ogs_pfcp_association_setup_request_t *req)
 {
    int i;
+    int16_t decoded;

    ogs_assert(xact);
    ogs_assert(node);
@ -112,8 +113,11 @@ bool ogs_pfcp_cp_handle_association_setup_request(
        if (message->presence == 0)
            break;

-        ogs_pfcp_parse_user_plane_ip_resource_info(&info, message);
-        ogs_gtpu_resource_add(&node->gtpu_resource_list, &info);
+        decoded = ogs_pfcp_parse_user_plane_ip_resource_info(&info, message);
+        if (message->len == decoded)
+            ogs_gtpu_resource_add(&node->gtpu_resource_list, &info);
+        else
+            ogs_error("Invalid User Plane IP Resource Info");
    }

    if (req->up_function_features.presence) {
@ -143,6 +147,7 @@ bool ogs_pfcp_cp_handle_association_setup_response(
        ogs_pfcp_association_setup_response_t *rsp)
 {
    int i;
+    int16_t decoded;

    ogs_assert(xact);
    ogs_pfcp_xact_commit(xact);
@ -160,8 +165,11 @@ bool ogs_pfcp_cp_handle_association_setup_response(
        if (message->presence == 0)
            break;

-        ogs_pfcp_parse_user_plane_ip_resource_info(&info, message);
-        ogs_gtpu_resource_add(&node->gtpu_resource_list, &info);
+        decoded = ogs_pfcp_parse_user_plane_ip_resource_info(&info, message);
+        if (message->len == decoded)
+            ogs_gtpu_resource_add(&node->gtpu_resource_list, &info);
+        else
+            ogs_error("Invalid User Plane IP Resource Info");
    }

    if (rsp->up_function_features.presence) {
@ -424,7 +432,10 @@ ogs_pfcp_pdr_t *ogs_pfcp_handle_create_pdr(ogs_pfcp_sess_t *sess,

        len = ogs_pfcp_parse_sdf_filter(
                &sdf_filter, &message->pdi.sdf_filter[i]);
-        ogs_assert(message->pdi.sdf_filter[i].len == len);
+        if (message->pdi.sdf_filter[i].len != len) {
+            ogs_error("Invalid SDF Filter");
+            break;
+        }

        /* Check Previous SDF Filter ID */
        if (sdf_filter.bid) {
@ -518,12 +529,13 @@ ogs_pfcp_pdr_t *ogs_pfcp_handle_create_pdr(ogs_pfcp_sess_t *sess,
    if (message->pdi.network_instance.presence) {
        char dnn[OGS_MAX_DNN_LEN+1];

-        ogs_assert(0 < ogs_fqdn_parse(dnn,
-            message->pdi.network_instance.data,
-            ogs_min(message->pdi.network_instance.len, OGS_MAX_DNN_LEN)));
-
-        pdr->dnn = ogs_strdup(dnn);
-        ogs_assert(pdr->dnn);
+        if (ogs_fqdn_parse(dnn, message->pdi.network_instance.data,
+            ogs_min(message->pdi.network_instance.len, OGS_MAX_DNN_LEN)) > 0) {
+            pdr->dnn = ogs_strdup(dnn);
+            ogs_assert(pdr->dnn);
+        } else {
+            ogs_error("Invalid pdi.network_instance");
+        }
    }

    pdr->chid = false;
@ -765,7 +777,10 @@ ogs_pfcp_pdr_t *ogs_pfcp_handle_update_pdr(ogs_pfcp_sess_t *sess,

            len = ogs_pfcp_parse_sdf_filter(
                    &sdf_filter, &message->pdi.sdf_filter[i]);
-            ogs_assert(message->pdi.sdf_filter[i].len == len);
+            if (message->pdi.sdf_filter[i].len != len) {
+                ogs_error("Invalid SDF Filter");
+                break;
+            }

            /* Check Previous SDF Filter ID */
            if (sdf_filter.bid) {
@ -855,14 +870,16 @@ ogs_pfcp_pdr_t *ogs_pfcp_handle_update_pdr(ogs_pfcp_sess_t *sess,
        if (message->pdi.network_instance.presence) {
            char dnn[OGS_MAX_DNN_LEN+1];

-            ogs_assert(0 < ogs_fqdn_parse(dnn,
-                message->pdi.network_instance.data,
-                ogs_min(message->pdi.network_instance.len, OGS_MAX_DNN_LEN)));
-
-            if (pdr->dnn)
-                ogs_free(pdr->dnn);
-            pdr->dnn = ogs_strdup(dnn);
-            ogs_assert(pdr->dnn);
+            if (ogs_fqdn_parse(dnn, message->pdi.network_instance.data,
+                ogs_min(message->pdi.network_instance.len,
+                    OGS_MAX_DNN_LEN)) > 0) {
+                if (pdr->dnn)
+                    ogs_free(pdr->dnn);
+                pdr->dnn = ogs_strdup(dnn);
+                ogs_assert(pdr->dnn);
+            } else {
+                ogs_error("Invalid pdi.network_instance");
+            }
        }

        if (message->pdi.local_f_teid.presence) {
@ -964,13 +981,15 @@ ogs_pfcp_far_t *ogs_pfcp_handle_create_far(ogs_pfcp_sess_t *sess,
        if (message->forwarding_parameters.network_instance.presence) {
            char dnn[OGS_MAX_DNN_LEN+1];

-            ogs_assert(0 < ogs_fqdn_parse(dnn,
+            if (ogs_fqdn_parse(dnn,
                message->forwarding_parameters.network_instance.data,
-                    ogs_min(message->forwarding_parameters.network_instance.len,
-                        OGS_MAX_DNN_LEN)));
-
-            far->dnn = ogs_strdup(dnn);
-            ogs_assert(far->dnn);
+                ogs_min(message->forwarding_parameters.network_instance.len,
+                    OGS_MAX_DNN_LEN)) > 0) {
+                far->dnn = ogs_strdup(dnn);
+                ogs_assert(far->dnn);
+            } else {
+                ogs_error("Invalid forwarding_parameters.network_instance");
+            }
        }

        if (message->forwarding_parameters.outer_header_creation.presence) {
@ -1069,15 +1088,18 @@ ogs_pfcp_far_t *ogs_pfcp_handle_update_far(ogs_pfcp_sess_t *sess,
        if (message->update_forwarding_parameters.network_instance.presence) {
            char dnn[OGS_MAX_DNN_LEN+1];

-            ogs_assert(0 < ogs_fqdn_parse(dnn,
+            if (ogs_fqdn_parse(dnn,
                message->update_forwarding_parameters.network_instance.data,
-                    ogs_min(message->update_forwarding_parameters.
-                        network_instance.len, OGS_MAX_DNN_LEN)));
-
-            if (far->dnn)
-                ogs_free(far->dnn);
-            far->dnn = ogs_strdup(dnn);
-            ogs_assert(far->dnn);
+                ogs_min(message->update_forwarding_parameters.
+                    network_instance.len, OGS_MAX_DNN_LEN)) > 0) {
+                if (far->dnn)
+                    ogs_free(far->dnn);
+                far->dnn = ogs_strdup(dnn);
+                ogs_assert(far->dnn);
+            } else {
+                ogs_error("Invalid "
+                        "update_forwarding_parameters.network_instance");
+            }
        }

        if (message->update_forwarding_parameters.
@ -1307,6 +1329,7 @@ ogs_pfcp_urr_t *ogs_pfcp_handle_create_urr(ogs_pfcp_sess_t *sess,
        ogs_pfcp_tlv_create_urr_t *message,
        uint8_t *cause_value, uint8_t *offending_ie_value)
 {
+    int16_t decoded;
    ogs_pfcp_urr_t *urr = NULL;

    ogs_assert(message);
@ -1355,12 +1378,26 @@ ogs_pfcp_urr_t *ogs_pfcp_handle_create_urr(ogs_pfcp_sess_t *sess,

    if (message->volume_threshold.presence &&
        (urr->meas_method & OGS_PFCP_MEASUREMENT_METHOD_VOLUME)) {
-        ogs_pfcp_parse_volume(&urr->vol_threshold, &message->volume_threshold);
+        decoded = ogs_pfcp_parse_volume(
+                &urr->vol_threshold, &message->volume_threshold);
+        if (message->volume_threshold.len != decoded) {
+            ogs_error("Invalid Volume Threshold");
+            *cause_value = OGS_PFCP_CAUSE_MANDATORY_IE_INCORRECT;
+            *offending_ie_value = OGS_PFCP_VOLUME_THRESHOLD_TYPE;
+            return NULL;
+        }
    }

    if (message->volume_quota.presence &&
        (urr->meas_method & OGS_PFCP_MEASUREMENT_METHOD_VOLUME)) {
-        ogs_pfcp_parse_volume(&urr->vol_quota, &message->volume_quota);
+        decoded = ogs_pfcp_parse_volume(
+                &urr->vol_quota, &message->volume_quota);
+        if (message->volume_quota.len != decoded) {
+            ogs_error("Invalid Volume Quota");
+            *cause_value = OGS_PFCP_CAUSE_MANDATORY_IE_INCORRECT;
+            *offending_ie_value = OGS_PFCP_VOLUME_QUOTA_TYPE;
+            return NULL;
+        }
    }

    if (message->event_threshold.presence &&
@ -1409,6 +1446,7 @@ ogs_pfcp_urr_t *ogs_pfcp_handle_update_urr(ogs_pfcp_sess_t *sess,
        ogs_pfcp_tlv_update_urr_t *message,
        uint8_t *cause_value, uint8_t *offending_ie_value)
 {
+    int16_t decoded;
    ogs_pfcp_urr_t *urr = NULL;

    ogs_assert(message);
@ -1447,12 +1485,26 @@ ogs_pfcp_urr_t *ogs_pfcp_handle_update_urr(ogs_pfcp_sess_t *sess,

    if (message->volume_threshold.presence &&
        (urr->meas_method & OGS_PFCP_MEASUREMENT_METHOD_VOLUME)) {
-        ogs_pfcp_parse_volume(&urr->vol_threshold, &message->volume_threshold);
+        decoded = ogs_pfcp_parse_volume(
+                &urr->vol_threshold, &message->volume_threshold);
+        if (message->volume_threshold.len != decoded) {
+            ogs_error("Invalid Volume Threshold");
+            *cause_value = OGS_PFCP_CAUSE_MANDATORY_IE_INCORRECT;
+            *offending_ie_value = OGS_PFCP_VOLUME_THRESHOLD_TYPE;
+            return NULL;
+        }
    }

    if (message->volume_quota.presence &&
        (urr->meas_method & OGS_PFCP_MEASUREMENT_METHOD_VOLUME)) {
-        ogs_pfcp_parse_volume(&urr->vol_quota, &message->volume_quota);
+        decoded = ogs_pfcp_parse_volume(
+                &urr->vol_quota, &message->volume_quota);
+        if (message->volume_quota.len != decoded) {
+            ogs_error("Invalid Volume Quota");
+            *cause_value = OGS_PFCP_CAUSE_MANDATORY_IE_INCORRECT;
+            *offending_ie_value = OGS_PFCP_VOLUME_QUOTA_TYPE;
+            return NULL;
+        }
    }

    if (message->event_threshold.presence &&
--- a/lib/pfcp/types.c
+++ b/lib/pfcp/types.c
@ -149,14 +149,22 @@ int16_t ogs_pfcp_parse_user_plane_ip_resource_info(
    size++;

    if (info->teidri) {
-        ogs_assert(size + sizeof(info->teid_range) <= octet->len);
+        if (size + sizeof(info->teid_range) > octet->len) {
+            ogs_error("size[%d]+sizeof(info->teid_range)[%d] > IE Length[%d]",
+                    size, (int)sizeof(info->teid_range), octet->len);
+            return 0;
+        }
        memcpy(&info->teid_range, (unsigned char *)octet->data + size,
                sizeof(info->teid_range));
        size += sizeof(info->teid_range);
    }

    if (info->v4) {
-        ogs_assert(size + sizeof(info->addr) <= octet->len);
+        if (size + sizeof(info->addr) > octet->len) {
+            ogs_error("size[%d]+sizeof(info->addr)[%d] > IE Length[%d]",
+                    size, (int)sizeof(info->addr), octet->len);
+            return 0;
+        }
        memcpy(&info->addr,
                (unsigned char *)octet->data + size,
                sizeof(info->addr));
@ -164,30 +172,51 @@ int16_t ogs_pfcp_parse_user_plane_ip_resource_info(
    }

    if (info->v6) {
-        ogs_assert(size + OGS_IPV6_LEN <= octet->len);
+        if (size + OGS_IPV6_LEN > octet->len) {
+            ogs_error("size[%d]+OGS_IPV6_LEN[%d] > IE Length[%d]",
+                    size, (int)OGS_IPV6_LEN, octet->len);
+            return 0;
+        }
        memcpy(&info->addr6, (unsigned char *)octet->data + size, OGS_IPV6_LEN);
        size += OGS_IPV6_LEN;
    }

    if (info->assoni) {
        int len = octet->len - size;
-        if (info->assosi) len--;
+        if (len <= 0) {
+            ogs_error("len[%d] octect->len[%d] size[%d]", len, octet->len, size);
+            return 0;
+        }

-        ogs_assert(0 < ogs_fqdn_parse(
-                    info->network_instance, (char *)octet->data + size,
-                    ogs_min(len, OGS_MAX_APN_LEN)));
+        if (info->assosi) len--;
+        if (len <= 0) {
+            ogs_error("info->assosi[%d] len[%d] octect->len[%d] size[%d]",
+                    info->assosi, len, octet->len, size);
+            return 0;
+        }
+
+        if (ogs_fqdn_parse(info->network_instance, (char *)octet->data + size,
+            ogs_min(len, OGS_MAX_APN_LEN)) <= 0) {
+            ogs_error("Invalid info->network_instance");
+            info->network_instance[0] = 0;
+        }
        size += len;
    }

    if (info->assosi) {
-        ogs_assert(size + sizeof(info->source_interface) <=
-                octet->len);
+        if (size + sizeof(info->source_interface) > octet->len) {
+            ogs_error("size[%d]+sizeof(info->source_interface)[%d] > "
+                    "IE Length[%d]",
+                    size, (int)sizeof(info->source_interface), octet->len);
+            return 0;
+        }
        memcpy(&info->source_interface, (unsigned char *)octet->data + size,
                sizeof(info->source_interface));
        size += sizeof(info->source_interface);
    }

-    ogs_assert(size == octet->len);
+    if (size != octet->len)
+        ogs_error("Mismatch IE Length[%d] != Decoded[%d]", octet->len, size);

    return size;
 }
@ -282,18 +311,32 @@ int16_t ogs_pfcp_parse_sdf_filter(

    memset(filter, 0, sizeof(ogs_pfcp_sdf_filter_t));

-    ogs_assert(size + sizeof(filter->flags) <= octet->len);
+    if (size + sizeof(filter->flags) > octet->len) {
+        ogs_error("size[%d]+sizeof(filter->flags)[%d] > IE Length[%d]",
+                size, (int)sizeof(filter->flags), octet->len);
+        return 0;
+    }
    memcpy(&filter->flags,
            (unsigned char *)octet->data + size, sizeof(filter->flags));
    size++;

-    ogs_assert(size + sizeof(filter->spare2) <= octet->len);
+    if (size + sizeof(filter->spare2) > octet->len) {
+        ogs_error("size[%d]+sizeof(filter->spare2)[%d] > IE Length[%d]",
+                size, (int)sizeof(filter->spare2), octet->len);
+        return 0;
+    }
    memcpy(&filter->spare2,
            (unsigned char *)octet->data + size, sizeof(filter->flags));
    size++;

    if (filter->fd) {
-        ogs_assert(size + sizeof(filter->flow_description_len) <= octet->len);
+        if (size + sizeof(filter->flow_description_len) > octet->len) {
+            ogs_error("size[%d]+sizeof(filter->flow_description_len)[%d] "
+                    "> IE Length[%d]",
+                    size, (int)sizeof(filter->flow_description_len),
+                    octet->len);
+            return 0;
+        }
        memcpy(&filter->flow_description_len,
                (unsigned char *)octet->data + size,
                sizeof(filter->flow_description_len));
@ -305,7 +348,12 @@ int16_t ogs_pfcp_parse_sdf_filter(
    }

    if (filter->ttc) {
-        ogs_assert(size + sizeof(filter->tos_traffic_class) <= octet->len);
+        if (size + sizeof(filter->tos_traffic_class) > octet->len) {
+            ogs_error("size[%d]+sizeof(filter->tos_traffic_class)[%d] "
+                    "> IE Length[%d]",
+                    size, (int)sizeof(filter->tos_traffic_class), octet->len);
+            return 0;
+        }
        memcpy(&filter->tos_traffic_class,
                (unsigned char *)octet->data + size,
                sizeof(filter->tos_traffic_class));
@ -314,8 +362,13 @@ int16_t ogs_pfcp_parse_sdf_filter(
    }

    if (filter->spi) {
-        ogs_assert(size + sizeof(filter->security_parameter_index) <=
-                octet->len);
+        if (size + sizeof(filter->security_parameter_index) > octet->len) {
+            ogs_error("size[%d]+sizeof(filter->security_parameter_index)[%d] "
+                    "> IE Length[%d]",
+                    size, (int)sizeof(filter->security_parameter_index),
+                    octet->len);
+            return 0;
+        }
        memcpy(&filter->security_parameter_index,
                (unsigned char *)octet->data + size,
                sizeof(filter->security_parameter_index));
@ -326,7 +379,11 @@ int16_t ogs_pfcp_parse_sdf_filter(

    if (filter->fl) {
        int bit24_len = 3;
-        ogs_assert(size + bit24_len <= octet->len);
+        if (size + bit24_len > octet->len) {
+            ogs_error("size[%d]+bit24_len[%d] > IE Length[%d]",
+                    size, bit24_len, octet->len);
+            return 0;
+        }
        memcpy(&filter->flow_label,
                (unsigned char *)octet->data + size, bit24_len);
        filter->flow_label = be32toh(filter->flow_label);
@ -334,14 +391,20 @@ int16_t ogs_pfcp_parse_sdf_filter(
    }

    if (filter->bid) {
-        ogs_assert(size + sizeof(filter->sdf_filter_id) <= octet->len);
+        if (size + sizeof(filter->sdf_filter_id) > octet->len) {
+            ogs_error("size[%d]+sizeof(filter->sdf_filter_id)[%d]"
+                    "> IE Length[%d]",
+                    size, (int)sizeof(filter->sdf_filter_id), octet->len);
+            return 0;
+        }
        memcpy(&filter->sdf_filter_id, (unsigned char *)octet->data + size,
                sizeof(filter->sdf_filter_id));
        filter->sdf_filter_id = be32toh(filter->sdf_filter_id);
        size += sizeof(filter->sdf_filter_id);
    }

-    ogs_assert(size == octet->len);
+    if (size != octet->len)
+        ogs_error("Mismatch IE Length[%d] != Decoded[%d]", octet->len, size);

    return size;
 }
@ -479,25 +542,44 @@ int16_t ogs_pfcp_parse_volume(
    size += sizeof(volume->flags);

    if (volume->tovol) {
+        if (size + sizeof(volume->total_volume) > octet->len) {
+            ogs_error("size[%d]+sizeof(volume->total_volume)[%d] "
+                    "> IE Length[%d]",
+                    size, (int)sizeof(volume->total_volume), octet->len);
+            return 0;
+        }
        memcpy(&volume->total_volume, (unsigned char *)octet->data + size,
                sizeof(volume->total_volume));
        volume->total_volume = be64toh(volume->total_volume);
        size += sizeof(volume->total_volume);
    }
    if (volume->ulvol) {
+        if (size + sizeof(volume->uplink_volume) > octet->len) {
+            ogs_error("size[%d]+sizeof(volume->uplink_volume)[%d] "
+                    "> IE Length[%d]",
+                    size, (int)sizeof(volume->uplink_volume), octet->len);
+            return 0;
+        }
        memcpy(&volume->uplink_volume, (unsigned char *)octet->data + size,
                sizeof(volume->uplink_volume));
        volume->uplink_volume = be64toh(volume->uplink_volume);
        size += sizeof(volume->uplink_volume);
    }
    if (volume->dlvol) {
+        if (size + sizeof(volume->downlink_volume) > octet->len) {
+            ogs_error("size[%d]+sizeof(volume->downlink_volume)[%d] "
+                    "> IE Length[%d]",
+                    size, (int)sizeof(volume->downlink_volume), octet->len);
+            return 0;
+        }
        memcpy(&volume->downlink_volume, (unsigned char *)octet->data + size,
                sizeof(volume->downlink_volume));
        volume->downlink_volume = be64toh(volume->downlink_volume);
        size += sizeof(volume->downlink_volume);
    }

-    ogs_assert(size == octet->len);
+    if (size != octet->len)
+        ogs_error("Mismatch IE Length[%d] != Decoded[%d]", octet->len, size);

    return size;
 }
--- a/lib/proto/types.c
+++ b/lib/proto/types.c
@ -419,8 +419,8 @@ int ogs_fqdn_parse(char *dst, const char *src, int length)
    while (i+1 < length) {
        len = src[i++];
        if ((j + len + 1) > length) {
-            ogs_error("Invalid FQDN encoding[len:%d] + 1 > length[%d]",
-                    len, length);
+            ogs_error("Invalid FQDN encoding[j:%d+len:%d] + 1 > length[%d]",
+                    j, len, length);
            ogs_log_hexdump(OGS_LOG_ERROR, (unsigned char *)src, length);
            return 0;
        }
--- a/lib/proto/types.h
+++ b/lib/proto/types.h
@ -379,11 +379,6 @@ ED2(uint8_t spare:4;,
 typedef struct ogs_paa_s {
 ED2(uint8_t spare:5;,
 /* 8.34 PDN Type  */
-#define OGS_PDU_SESSION_TYPE_IS_VALID(x) \
-        ((x) == OGS_PDU_SESSION_TYPE_IPV4 || \
-         (x) == OGS_PDU_SESSION_TYPE_IPV6 || \
-         (x) == OGS_PDU_SESSION_TYPE_IPV4V6) \
-
    uint8_t session_type:3;)
    union {
        /* PDU_SESSION_TYPE_IPV4 */
--- a/lib/sbi/client.h
+++ b/lib/sbi/client.h
@ -57,6 +57,19 @@ extern "C" {
        OGS_OBJECT_REF(__pClient); \
        ((__cTX)->client) = (__pClient); \
        ogs_debug("CLIENT Ref [%d]", (__pClient)->reference_count); \
+        if ((__pClient)->fqdn) { \
+            ogs_info("NF EndPoint(fqdn) setup [%s:%d]", \
+                    (__pClient)->fqdn, (__pClient)->fqdn_port); \
+        } \
+        if ((__pClient)->addr) { \
+            ogs_info("NF EndPoint(addr) setup [%s:%d]", \
+                OGS_ADDR((__pClient)->addr, buf), OGS_PORT((__pClient)->addr)); \
+        } \
+        if ((__pClient)->addr6) { \
+            ogs_info("NF EndPoint(addr6) setup [%s:%d]", \
+                OGS_ADDR((__pClient)->addr6, buf), \
+                OGS_PORT((__pClient)->addr6)); \
+        } \
    } while(0)

 typedef int (*ogs_sbi_client_cb_f)(
--- a/lib/sbi/context.c
+++ b/lib/sbi/context.c
@ -1085,8 +1085,6 @@ ogs_sbi_nf_instance_t *ogs_sbi_nf_instance_add(void)
    ogs_assert(nf_instance);
    memset(nf_instance, 0, sizeof(ogs_sbi_nf_instance_t));

-    OGS_OBJECT_REF(nf_instance);
-
    nf_instance->time.heartbeat_interval =
            ogs_local_conf()->time.nf_instance.heartbeat_interval;

@ -1096,10 +1094,10 @@ ogs_sbi_nf_instance_t *ogs_sbi_nf_instance_add(void)

    ogs_list_add(&ogs_sbi_self()->nf_instance_list, nf_instance);

-    ogs_debug("[%s] NFInstance added with Ref [%s:%d]",
+    ogs_debug("[%s] NFInstance added with Ref [%s]",
            nf_instance->nf_type ?
                OpenAPI_nf_type_ToString(nf_instance->nf_type) : "NULL",
-            nf_instance->id, nf_instance->reference_count);
+            nf_instance->id);

    return nf_instance;
 }
@ -1196,20 +1194,10 @@ void ogs_sbi_nf_instance_remove(ogs_sbi_nf_instance_t *nf_instance)
 {
    ogs_assert(nf_instance);

-    ogs_debug("[%s] NFInstance UnRef [%s:%d]",
+    ogs_debug("[%s] NFInstance removed [%s]",
            nf_instance->nf_type ?
                OpenAPI_nf_type_ToString(nf_instance->nf_type) : "NULL",
-            nf_instance->id, nf_instance->reference_count);
-
-    if (OGS_OBJECT_IS_REF(nf_instance)) {
-        OGS_OBJECT_UNREF(nf_instance);
-        return;
-    }
-
-    ogs_debug("[%s] NFInstance removed [%s:%d]",
-            nf_instance->nf_type ?
-                OpenAPI_nf_type_ToString(nf_instance->nf_type) : "NULL",
-            nf_instance->id, nf_instance->reference_count);
+            nf_instance->id);

    ogs_list_remove(&ogs_sbi_self()->nf_instance_list, nf_instance);

@ -2130,9 +2118,6 @@ bool ogs_sbi_discovery_param_is_matched(
    if (NF_INSTANCE_EXCLUDED_FROM_DISCOVERY(nf_instance))
        return false;

-    if (!OGS_FSM_CHECK(&nf_instance->sm, ogs_sbi_nf_state_registered))
-        return false;
-
    if (nf_instance->nf_type != target_nf_type)
        return false;

@ -2202,10 +2187,10 @@ void ogs_sbi_client_associate(ogs_sbi_nf_instance_t *nf_instance)
    client = nf_instance_find_client(nf_instance);
    ogs_assert(client);

-    ogs_debug("[%s] NFInstance associated [%s:%d]",
+    ogs_debug("[%s] NFInstance associated [%s]",
            nf_instance->nf_type ?
                OpenAPI_nf_type_ToString(nf_instance->nf_type) : "NULL",
-            nf_instance->id, nf_instance->reference_count);
+            nf_instance->id);

    OGS_SBI_SETUP_CLIENT(nf_instance, client);

@ -2260,30 +2245,15 @@ ogs_sbi_client_t *ogs_sbi_client_find_by_service_type(
            return nf_service->client;
    }

-    return nf_instance->client;
+    return NULL;
 }

 void ogs_sbi_object_free(ogs_sbi_object_t *sbi_object)
 {
-    int i;
-
    ogs_assert(sbi_object);

    if (ogs_list_count(&sbi_object->xact_list))
        ogs_error("SBI running [%d]", ogs_list_count(&sbi_object->xact_list));
-
-    for (i = 0; i < OGS_SBI_MAX_NUM_OF_SERVICE_TYPE; i++) {
-        ogs_sbi_nf_instance_t *nf_instance =
-            sbi_object->service_type_array[i].nf_instance;
-        if (nf_instance)
-            ogs_sbi_nf_instance_remove(nf_instance);
-    }
-    for (i = 0; i < OGS_SBI_MAX_NUM_OF_NF_TYPE; i++) {
-        ogs_sbi_nf_instance_t *nf_instance =
-            sbi_object->nf_type_array[i].nf_instance;
-        if (nf_instance)
-            ogs_sbi_nf_instance_remove(nf_instance);
-    }
 }

 ogs_sbi_xact_t *ogs_sbi_xact_add(
--- a/lib/sbi/context.h
+++ b/lib/sbi/context.h
@ -175,7 +175,6 @@ typedef struct ogs_sbi_nf_instance_s {
 #define NF_INSTANCE_CLIENT(__nFInstance) \
    ((__nFInstance) ? ((__nFInstance)->client) : NULL)
    void *client;                       /* only used in CLIENT */
-    unsigned int reference_count;       /* reference count for memory free */
 } ogs_sbi_nf_instance_t;

 typedef enum {
@ -194,6 +193,16 @@ typedef struct ogs_sbi_object_s {

    struct {
        ogs_sbi_nf_instance_t *nf_instance;
+
+        /*
+         * Search.Result stored in nf_instance->time.validity_duration;
+         *
+         * validity_timeout = nf_instance->validity->timeout =
+         *     ogs_get_monotonic_time() + nf_instance->time.validity_duration;
+         *
+         * if no validityPeriod in SearchResult, validity_timeout is 0.
+         */
+        ogs_time_t validity_timeout;
    } nf_type_array[OGS_SBI_MAX_NUM_OF_NF_TYPE],
      service_type_array[OGS_SBI_MAX_NUM_OF_SERVICE_TYPE];

@ -462,18 +471,47 @@ int ogs_sbi_default_client_port(OpenAPI_uri_scheme_e scheme);
 #define OGS_SBI_SETUP_NF_INSTANCE(__cTX, __nFInstance) \
    do { \
        ogs_assert(__nFInstance); \
+        ogs_assert((__nFInstance)->id); \
+        ogs_assert((__nFInstance)->t_validity); \
        \
        if ((__cTX).nf_instance) { \
-            ogs_warn("NF Instance [%s] updated [%s]", \
-                    OpenAPI_nf_type_ToString((__nFInstance)->nf_type), \
-                    (__nFInstance)->id); \
-            ogs_sbi_nf_instance_remove((__cTX).nf_instance); \
+            ogs_warn("[%s] NF Instance updated [type:%s validity:%ds]", \
+                    ((__cTX).nf_instance)->id, \
+                    OpenAPI_nf_type_ToString(((__cTX).nf_instance)->nf_type), \
+                    ((__cTX).nf_instance)->time.validity_duration); \
        } \
        \
-        OGS_OBJECT_REF(__nFInstance); \
-        ((__cTX).nf_instance) = (__nFInstance); \
+        ((__cTX).nf_instance) = __nFInstance; \
+        if ((__nFInstance)->time.validity_duration) { \
+            ((__cTX).validity_timeout) = (__nFInstance)->t_validity->timeout; \
+        } else { \
+            ((__cTX).validity_timeout) = 0; \
+        } \
+        ogs_info("[%s] NF Instance setup [type:%s validity:%ds]", \
+                (__nFInstance)->id, \
+                OpenAPI_nf_type_ToString((__nFInstance)->nf_type), \
+                (__nFInstance)->time.validity_duration); \
    } while(0)

+/*
+ * Search.Result stored in nf_instance->time.validity_duration;
+ *
+ * validity_timeout = nf_instance->validity->timeout =
+ *     ogs_get_monotonic_time() + nf_instance->time.validity_duration;
+ *
+ * if no validityPeriod in SearchResult, validity_timeout is 0.
+ */
+#define OGS_SBI_GET_NF_INSTANCE(__cTX) \
+    ((__cTX).validity_timeout == 0 || \
+     (__cTX).validity_timeout > ogs_get_monotonic_time() ? \
+        ((__cTX).nf_instance) : NULL)
+
+#define OGS_SBI_NF_INSTANCE_VALID(__nFInstance) \
+    (((__nFInstance) && ((__nFInstance)->t_validity) && \
+     ((__nFInstance)->time.validity_duration == 0 || \
+      (__nFInstance)->t_validity->timeout > ogs_get_monotonic_time())) ? \
+         true : false)
+
 bool ogs_sbi_discovery_param_is_matched(
        ogs_sbi_nf_instance_t *nf_instance,
        OpenAPI_nf_type_e target_nf_type,
--- a/lib/sbi/nf-sm.c
+++ b/lib/sbi/nf-sm.c
@ -32,19 +32,6 @@ void ogs_sbi_nf_fsm_init(ogs_sbi_nf_instance_t *nf_instance)
            ogs_sbi_nf_state_initial, ogs_sbi_nf_state_final, &e);
 }

-void ogs_sbi_nf_fsm_tran(ogs_sbi_nf_instance_t *nf_instance, void *state)
-{
-    ogs_event_t e;
-
-    ogs_assert(nf_instance);
-    ogs_assert(OGS_FSM_STATE(&nf_instance->sm));
-
-    memset(&e, 0, sizeof(e));
-    e.sbi.data = nf_instance;
-
-    ogs_fsm_tran(&nf_instance->sm, state, &e);
-}
-
 void ogs_sbi_nf_fsm_fini(ogs_sbi_nf_instance_t *nf_instance)
 {
    ogs_event_t e;
@ -307,7 +294,7 @@ void ogs_sbi_nf_state_registered(ogs_fsm_t *s, ogs_event_t *e)
            break;

        case OGS_TIMER_NF_INSTANCE_NO_HEARTBEAT:
-            ogs_error("[%s:%s] No heartbeat",
+            ogs_error("[%s] No heartbeat [type:%s]",
                    NF_INSTANCE_ID(ogs_sbi_self()->nf_instance),
                    OpenAPI_nf_type_ToString(
                        NF_INSTANCE_TYPE(ogs_sbi_self()->nf_instance)));
@ -318,22 +305,24 @@ void ogs_sbi_nf_state_registered(ogs_fsm_t *s, ogs_event_t *e)
            ogs_assert(!NF_INSTANCE_TYPE_IS_NRF(nf_instance));
            ogs_assert(nf_instance->id);

-            ogs_info("[%s] NF expired", nf_instance->id);
+            ogs_info("[%s] NF expired [type:%s]",
+                    nf_instance->id,
+                    OpenAPI_nf_type_ToString(nf_instance->nf_type));
            OGS_FSM_TRAN(s, &ogs_sbi_nf_state_de_registered);
            break;

        default:
-            ogs_error("[%s:%s] Unknown timer[%s:%d]",
-                    OpenAPI_nf_type_ToString(nf_instance->nf_type),
+            ogs_error("[%s] Unknown timer [type:%s timer:%s:%d]",
                    nf_instance->id ? nf_instance->id : "Undefined",
+                    OpenAPI_nf_type_ToString(nf_instance->nf_type),
                    ogs_timer_get_name(e->timer_id), e->timer_id);
        }
        break;

    default:
-        ogs_error("[%s:%s] Unknown event %s",
-                OpenAPI_nf_type_ToString(nf_instance->nf_type),
+        ogs_error("[%s] Unknown event [type:%s event:%s]",
                nf_instance->id ? nf_instance->id : "Undefined",
+                OpenAPI_nf_type_ToString(nf_instance->nf_type),
                ogs_event_get_name(e));
        break;
    }
@ -353,19 +342,20 @@ void ogs_sbi_nf_state_de_registered(ogs_fsm_t *s, ogs_event_t *e)

    switch (e->id) {
    case OGS_FSM_ENTRY_SIG:
-        if (NF_INSTANCE_TYPE_IS_NRF(nf_instance)) {
-            ogs_info("[%s] NF de-registered",
-                    NF_INSTANCE_ID(ogs_sbi_self()->nf_instance));
-        }
+        ogs_info("[%s] NF de-registered [type:%s]",
+                nf_instance->id,
+                OpenAPI_nf_type_ToString(nf_instance->nf_type));
+        ogs_sbi_nf_fsm_fini(nf_instance);
+        ogs_sbi_nf_instance_remove(nf_instance);
        break;

    case OGS_FSM_EXIT_SIG:
        break;

    default:
-        ogs_error("[%s:%s] Unknown event %s",
-                OpenAPI_nf_type_ToString(nf_instance->nf_type),
+        ogs_error("[%s] Unknown event [type:%s event:%s]",
                nf_instance->id ? nf_instance->id : "Undefined",
+                OpenAPI_nf_type_ToString(nf_instance->nf_type),
                ogs_event_get_name(e));
        break;
    }
@ -409,9 +399,9 @@ void ogs_sbi_nf_state_exception(ogs_fsm_t *s, ogs_event_t *e)
            break;

        default:
-            ogs_error("[%s:%s] Unknown timer[%s:%d]",
-                    OpenAPI_nf_type_ToString(nf_instance->nf_type),
+            ogs_error("[%s] Unknown timer[type:%s timer:%s:%d]",
                    nf_instance->id ? nf_instance->id : "Undefined",
+                    OpenAPI_nf_type_ToString(nf_instance->nf_type),
                    ogs_timer_get_name(e->timer_id), e->timer_id);
        }
        break;
@ -437,9 +427,9 @@ void ogs_sbi_nf_state_exception(ogs_fsm_t *s, ogs_event_t *e)
        break;

    default:
-        ogs_error("[%s:%s] Unknown event %s",
-                OpenAPI_nf_type_ToString(nf_instance->nf_type),
+        ogs_error("[%s] Unknown event [type:%s event:%s]",
                nf_instance->id ? nf_instance->id : "Undefined",
+                OpenAPI_nf_type_ToString(nf_instance->nf_type),
                ogs_event_get_name(e));
        break;
    }
--- a/lib/sbi/nf-sm.h
+++ b/lib/sbi/nf-sm.h
@ -29,7 +29,6 @@ extern "C" {
 #endif

 void ogs_sbi_nf_fsm_init(ogs_sbi_nf_instance_t *nf_instance);
-void ogs_sbi_nf_fsm_tran(ogs_sbi_nf_instance_t *nf_instance, void *state);
 void ogs_sbi_nf_fsm_fini(ogs_sbi_nf_instance_t *nf_instance);

 void ogs_sbi_nf_state_initial(ogs_fsm_t *s, ogs_event_t *e);
--- a/lib/sbi/nnrf-handler.c
+++ b/lib/sbi/nnrf-handler.c
@ -54,6 +54,15 @@ void ogs_nnrf_nfm_handle_nf_register(
        OpenAPI_list_for_each(NFProfile->plmn_list, node) {
            OpenAPI_plmn_id_t *PlmnId = node->data;
            if (PlmnId) {
+                if (ogs_local_conf()->num_of_serving_plmn_id >=
+                        OGS_ARRAY_SIZE(ogs_local_conf()->serving_plmn_id)) {
+                    ogs_error("OVERFLOW NFProfile->plmn_list [%d:%d:%d]",
+                            ogs_local_conf()->num_of_serving_plmn_id,
+                            OGS_MAX_NUM_OF_PLMN,
+                            (int)OGS_ARRAY_SIZE(
+                                ogs_local_conf()->serving_plmn_id));
+                    break;
+                }
                ogs_sbi_parse_plmn_id(
                    &ogs_local_conf()->serving_plmn_id[
                        ogs_local_conf()->num_of_serving_plmn_id], PlmnId);
@ -96,6 +105,13 @@ void ogs_nnrf_nfm_handle_nf_profile(
    OpenAPI_list_for_each(NFProfile->plmn_list, node) {
        OpenAPI_plmn_id_t *PlmnId = node->data;
        if (PlmnId) {
+            if (nf_instance->num_of_plmn_id >=
+                    OGS_ARRAY_SIZE(nf_instance->plmn_id)) {
+                ogs_error("OVERFLOW NFProfile->plmn_list [%d:%d:%d]",
+                        nf_instance->num_of_plmn_id, OGS_MAX_NUM_OF_PLMN,
+                        (int)OGS_ARRAY_SIZE(nf_instance->plmn_id));
+                break;
+            }
            ogs_sbi_parse_plmn_id(
                &nf_instance->plmn_id[nf_instance->num_of_plmn_id], PlmnId);
            nf_instance->num_of_plmn_id++;
@ -467,8 +483,12 @@ static void handle_smf_info(
        TaiRangeItem = node->data;
        if (TaiRangeItem && TaiRangeItem->plmn_id &&
                TaiRangeItem->tac_range_list) {
-            ogs_assert(nf_info->smf.num_of_nr_tai_range <
-                    OGS_MAX_NUM_OF_TAI);
+
+            if (nf_info->smf.num_of_nr_tai_range >= OGS_MAX_NUM_OF_TAI) {
+                ogs_error("OVERFLOW TaiRangeItem [%d:%d]",
+                        nf_info->smf.num_of_nr_tai_range, OGS_MAX_NUM_OF_TAI);
+                break;
+            }

            ogs_sbi_parse_plmn_id(
                &nf_info->smf.nr_tai_range
@ -709,7 +729,13 @@ static void handle_amf_info(
        TaiItem = node->data;
        if (TaiItem && TaiItem->plmn_id && TaiItem->tac) {
            ogs_5gs_tai_t *nr_tai = NULL;
-            ogs_assert(nf_info->amf.num_of_nr_tai < OGS_MAX_NUM_OF_TAI);
+
+            if (nf_info->amf.num_of_nr_tai >= OGS_MAX_NUM_OF_TAI) {
+                ogs_error("OVERFLOW TaiItem [%d:%d]",
+                        nf_info->amf.num_of_nr_tai, OGS_MAX_NUM_OF_TAI);
+                break;
+            }
+
            nr_tai = &nf_info->amf.nr_tai[nf_info->amf.num_of_nr_tai];
            ogs_assert(nr_tai);
            ogs_sbi_parse_plmn_id(&nr_tai->plmn_id, TaiItem->plmn_id);
@ -726,6 +752,12 @@ static void handle_amf_info(
            ogs_assert(nf_info->amf.num_of_nr_tai_range <
                    OGS_MAX_NUM_OF_TAI);

+            if (nf_info->amf.num_of_nr_tai_range >= OGS_MAX_NUM_OF_TAI) {
+                ogs_error("OVERFLOW TaiRangeItem [%d:%d]",
+                        nf_info->amf.num_of_nr_tai_range, OGS_MAX_NUM_OF_TAI);
+                break;
+            }
+
            ogs_sbi_parse_plmn_id(
                &nf_info->amf.nr_tai_range
                    [nf_info->amf.num_of_nr_tai_range].plmn_id,
@ -1055,24 +1087,23 @@ bool ogs_nnrf_nfm_handle_nf_status_notify(
                    nf_instance, message.h.resource.component[1]);
            ogs_sbi_nf_fsm_init(nf_instance);

-            ogs_info("(NRF-notify) NF registered [%s:%d]",
-                    nf_instance->id, nf_instance->reference_count);
+            ogs_info("[%s] (NRF-notify) NF registered", nf_instance->id);
        } else {
-            ogs_warn("[%s] (NRF-notify) NF has already been added [%s:%d]",
-                    nf_instance->nf_type ?
-                        OpenAPI_nf_type_ToString(nf_instance->nf_type) : "NULL",
-                    nf_instance->id, nf_instance->reference_count);
-
-            ogs_assert(OGS_FSM_STATE(&nf_instance->sm));
-            ogs_sbi_nf_fsm_tran(nf_instance, ogs_sbi_nf_state_registered);
+            ogs_warn("[%s] (NRF-notify) NF has already been added [type:%s]",
+                    nf_instance->id,
+                    OpenAPI_nf_type_ToString(nf_instance->nf_type));
+            if (!OGS_FSM_CHECK(&nf_instance->sm, ogs_sbi_nf_state_registered)) {
+                ogs_error("[%s] (NRF-notify) NF invalid state [type:%s]",
+                        nf_instance->id,
+                        OpenAPI_nf_type_ToString(nf_instance->nf_type));
+            }
        }

        ogs_nnrf_nfm_handle_nf_profile(nf_instance, NFProfile);

-        ogs_info("[%s] (NRF-notify) NF Profile updated [%s:%d]",
-                    nf_instance->nf_type ?
-                        OpenAPI_nf_type_ToString(nf_instance->nf_type) : "NULL",
-                    nf_instance->id, nf_instance->reference_count);
+        ogs_info("[%s] (NRF-notify) NF Profile updated [type:%s]",
+                    nf_instance->id,
+                    OpenAPI_nf_type_ToString(nf_instance->nf_type));

        ogs_sbi_client_associate(nf_instance);

@ -1088,27 +1119,11 @@ bool ogs_nnrf_nfm_handle_nf_status_notify(
            OpenAPI_notification_event_type_NF_DEREGISTERED) {
        nf_instance = ogs_sbi_nf_instance_find(message.h.resource.component[1]);
        if (nf_instance) {
-            if (OGS_OBJECT_IS_REF(nf_instance)) {
-                /* There are references to other contexts. */
-                ogs_warn("[%s] (NRF-notify) NF was referenced "
-                        "in other contexts [%s:%d]",
-                        nf_instance->nf_type ?
-                            OpenAPI_nf_type_ToString(nf_instance->nf_type) :
-                            "NULL",
-                        nf_instance->id, nf_instance->reference_count);
-
-                ogs_assert(OGS_FSM_STATE(&nf_instance->sm));
-                ogs_sbi_nf_fsm_tran(
-                        nf_instance, ogs_sbi_nf_state_de_registered);
-            } else {
-                ogs_info("[%s] (NRF-notify) NF_DEREGISTERED event [%s:%d]",
-                        nf_instance->nf_type ?
-                            OpenAPI_nf_type_ToString(nf_instance->nf_type) :
-                            "NULL",
-                        nf_instance->id, nf_instance->reference_count);
-                ogs_sbi_nf_fsm_fini((nf_instance));
-                ogs_sbi_nf_instance_remove(nf_instance);
-            }
+            ogs_info("[%s] (NRF-notify) NF_DEREGISTERED event [type:%s]",
+                    nf_instance->id,
+                    OpenAPI_nf_type_ToString(nf_instance->nf_type));
+            ogs_sbi_nf_fsm_fini(nf_instance);
+            ogs_sbi_nf_instance_remove(nf_instance);
        } else {
            ogs_warn("[%s] (NRF-notify) Not found",
                    message.h.resource.component[1]);
@ -1184,18 +1199,18 @@ void ogs_nnrf_disc_handle_nf_discover_search_result(
            ogs_sbi_nf_instance_set_id(nf_instance, NFProfile->nf_instance_id);
            ogs_sbi_nf_fsm_init(nf_instance);

-            ogs_info("[%s] (NRF-discover) NF registered [%s:%d]",
-                    nf_instance->nf_type ?
-                        OpenAPI_nf_type_ToString(nf_instance->nf_type) : "NULL",
-                    nf_instance->id, nf_instance->reference_count);
+            ogs_info("[%s] (NRF-discover) NF registered [type:%s]",
+                    nf_instance->id,
+                    OpenAPI_nf_type_ToString(nf_instance->nf_type));
        } else {
-            ogs_warn("[%s] (NRF-discover) NF has already been added [%s:%d]",
-                    nf_instance->nf_type ?
-                        OpenAPI_nf_type_ToString(nf_instance->nf_type) : "NULL",
-                    nf_instance->id, nf_instance->reference_count);
-
-            ogs_assert(OGS_FSM_STATE(&nf_instance->sm));
-            ogs_sbi_nf_fsm_tran(nf_instance, ogs_sbi_nf_state_registered);
+            ogs_warn("[%s] (NRF-discover) NF has already been added [type:%s]",
+                    nf_instance->id,
+                    OpenAPI_nf_type_ToString(nf_instance->nf_type));
+            if (!OGS_FSM_CHECK(&nf_instance->sm, ogs_sbi_nf_state_registered)) {
+                ogs_error("[%s] (NRF-notify) NF invalid state [type:%s]",
+                        nf_instance->id,
+                        OpenAPI_nf_type_ToString(nf_instance->nf_type));
+            }
        }

        if (NF_INSTANCE_ID_IS_OTHERS(nf_instance->id)) {
@ -1222,15 +1237,18 @@ void ogs_nnrf_disc_handle_nf_discover_search_result(
                    ogs_time_from_sec(nf_instance->time.validity_duration));

            } else
-                ogs_warn("[%s] NF Instance validity-time should not 0 [%s:%d]",
+                ogs_warn("[%s] NF Instance validity-time should not 0 "
+                        "[type:%s]",
+                    nf_instance->id,
                    nf_instance->nf_type ?
-                        OpenAPI_nf_type_ToString(nf_instance->nf_type) : "NULL",
-                    nf_instance->id, nf_instance->reference_count);
+                        OpenAPI_nf_type_ToString(nf_instance->nf_type) :
+                        "NULL");

-            ogs_info("[%s] (NF-discover) NF Profile updated [%s:%d]",
-                    nf_instance->nf_type ?
-                        OpenAPI_nf_type_ToString(nf_instance->nf_type) : "NULL",
-                    nf_instance->id, nf_instance->reference_count);
+            ogs_info("[%s] (NF-discover) NF Profile updated "
+                    "[type:%s validity:%ds]",
+                    nf_instance->id,
+                    OpenAPI_nf_type_ToString(nf_instance->nf_type),
+                    nf_instance->time.validity_duration);
        }
    }
 }
--- a/lib/sbi/path.c
+++ b/lib/sbi/path.c
@ -208,18 +208,19 @@ static int client_discover_cb(

            ogs_sbi_nf_fsm_init(nf_instance);

-            ogs_info("[%s] (SCP-discover) NF registered [%s:%d]",
+            ogs_info("[%s] (SCP-discover) NF registered [%s]",
                    nf_instance->nf_type ?
                        OpenAPI_nf_type_ToString(nf_instance->nf_type) : "NULL",
-                    nf_instance->id, nf_instance->reference_count);
+                    nf_instance->id);
        } else {
-            ogs_warn("[%s] (SCP-discover) NF has already been added [%s:%d]",
-                    nf_instance->nf_type ?
-                        OpenAPI_nf_type_ToString(nf_instance->nf_type) : "NULL",
-                    nf_instance->id, nf_instance->reference_count);
-
-            ogs_assert(OGS_FSM_STATE(&nf_instance->sm));
-            ogs_sbi_nf_fsm_tran(nf_instance, ogs_sbi_nf_state_registered);
+            ogs_warn("[%s] (SCP-discover) NF has already been added [%s]",
+                    OpenAPI_nf_type_ToString(nf_instance->nf_type),
+                    nf_instance->id);
+            if (!OGS_FSM_CHECK(&nf_instance->sm, ogs_sbi_nf_state_registered)) {
+                ogs_error("[%s] (SCP-discover) NF invalid state [%s]",
+                        OpenAPI_nf_type_ToString(nf_instance->nf_type),
+                        nf_instance->id);
+            }
        }

        OGS_SBI_SETUP_NF_INSTANCE(
@ -281,7 +282,8 @@ int ogs_sbi_discover_and_send(ogs_sbi_xact_t *xact)
    }

    /* Target NF-Instance */
-    nf_instance = sbi_object->service_type_array[service_type].nf_instance;
+    nf_instance = OGS_SBI_GET_NF_INSTANCE(
+            sbi_object->service_type_array[service_type]);
    if (!nf_instance) {
        nf_instance = ogs_sbi_nf_instance_find_by_discovery_param(
                        target_nf_type, requester_nf_type, discovery_option);
--- a/meson.build
+++ b/meson.build
@ -16,7 +16,7 @@
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.

 project('open5gs', 'c', 'cpp',
-    version : '2.7.0',
+    version : '2.7.1',
    license : 'AGPL-3.0-or-later',
    meson_version : '>= 0.43.0',
    default_options : [
@ -25,7 +25,7 @@ project('open5gs', 'c', 'cpp',
    ],
 )

-libogslib_version = '2.7.0'
+libogslib_version = '2.7.1'

 prefix = get_option('prefix')
 bindir = join_paths(prefix, get_option('bindir'))
--- a/src/amf/gmm-handler.c
+++ b/src/amf/gmm-handler.c
@ -1305,8 +1305,8 @@ int gmm_handle_ul_nas_transport(ran_ue_t *ran_ue, amf_ue_t *amf_ue,
                ogs_sbi_discovery_option_set_tai(
                        discovery_option, &amf_ue->nr_tai);

-                nf_instance = sess->sbi.
-                    service_type_array[service_type].nf_instance;
+                nf_instance = OGS_SBI_GET_NF_INSTANCE(
+                        sess->sbi.service_type_array[service_type]);
                if (!nf_instance) {
                    OpenAPI_nf_type_e requester_nf_type =
                                NF_INSTANCE_TYPE(ogs_sbi_self()->nf_instance);
@ -1317,8 +1317,8 @@ int gmm_handle_ul_nas_transport(ran_ue_t *ran_ue, amf_ue_t *amf_ue,
                            OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION,
                            requester_nf_type,
                            discovery_option);
-                    nf_instance = sess->sbi.
-                        service_type_array[service_type].nf_instance;
+                    nf_instance = OGS_SBI_GET_NF_INSTANCE(
+                            sess->sbi.service_type_array[service_type]);

                    if (!nf_instance)
                        ogs_info("No SMF Instance");
--- a/src/amf/init.c
+++ b/src/amf/init.c
@ -38,6 +38,10 @@ int amf_initialize(void)
    ogs_sbi_context_init(OpenAPI_nf_type_AMF);
    amf_context_init();

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_sbi_context_parse_config(APP_NAME, "nrf", "scp");
    if (rv != OGS_OK) return rv;

@ -50,10 +54,6 @@ int amf_initialize(void)
    rv = amf_context_nf_info();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    ogs_metrics_context_open(ogs_metrics_self());

    rv = amf_sbi_open();
--- a/src/amf/namf-handler.c
+++ b/src/amf/namf-handler.c
@ -1333,6 +1333,8 @@ int amf_namf_comm_handle_ue_context_transfer_request(

    OpenAPI_ue_context_transfer_rsp_data_t UeContextTransferRspData;

+    ogs_sbi_nf_instance_t *pcf_nf_instance = NULL;
+
    char *ue_context_id = NULL;
    char *encoded_gmm_capability = NULL;
    int status = OGS_SBI_HTTP_STATUS_OK;
@ -1416,8 +1418,14 @@ int amf_namf_comm_handle_ue_context_transfer_request(
    encoded_gmm_capability = amf_namf_comm_base64_encode_5gmm_capability(amf_ue);
    UeContext._5g_mm_capability = encoded_gmm_capability;

-    UeContext.pcf_id = amf_ue->sbi.service_type_array[
-        OGS_SBI_SERVICE_TYPE_NPCF_AM_POLICY_CONTROL].nf_instance->id;
+    pcf_nf_instance = OGS_SBI_GET_NF_INSTANCE(
+            amf_ue->sbi.service_type_array[
+            OGS_SBI_SERVICE_TYPE_NPCF_AM_POLICY_CONTROL]);
+    if (pcf_nf_instance) {
+        UeContext.pcf_id = pcf_nf_instance->id;
+    } else {
+        ogs_warn("No PCF NF Instnace");
+    }

    /* TODO UeContext.pcfAmPolicyUri */
    /* TODO UeContext.pcfUePolicyUri */
--- a/src/amf/ngap-handler.c
+++ b/src/amf/ngap-handler.c
@ -209,6 +209,16 @@ void ngap_handle_ng_setup_request(amf_gnb_t *gnb, ogs_ngap_message_t *message)
            i++) {
        NGAP_SupportedTAItem_t *SupportedTAItem = NULL;

+        if (gnb->num_of_supported_ta_list >=
+                OGS_ARRAY_SIZE(gnb->supported_ta_list)) {
+            ogs_error("OVERFLOW GNB->num_of_supported_ta_list "
+                    "[%d:%d:%d]",
+                    gnb->num_of_supported_ta_list,
+                    OGS_MAX_NUM_OF_SUPPORTED_TA,
+                    (int)OGS_ARRAY_SIZE(gnb->supported_ta_list));
+            break;
+        }
+
        SupportedTAItem = (NGAP_SupportedTAItem_t *)
                SupportedTAList->list.array[i];
        if (!SupportedTAItem) {
@ -235,6 +245,17 @@ void ngap_handle_ng_setup_request(amf_gnb_t *gnb, ogs_ngap_message_t *message)
            NGAP_BroadcastPLMNItem_t *BroadcastPLMNItem = NULL;
            NGAP_PLMNIdentity_t *pLMNIdentity = NULL;

+            if (gnb->supported_ta_list[i].num_of_bplmn_list >=
+                    OGS_ARRAY_SIZE(gnb->supported_ta_list[i].bplmn_list)) {
+                ogs_error("OVERFLOW GNB->supported_ta_list.num_of_bplmn_list "
+                        "[%d:%d:%d]",
+                        gnb->supported_ta_list[i].num_of_bplmn_list,
+                        OGS_MAX_NUM_OF_BPLMN,
+                        (int)OGS_ARRAY_SIZE(
+                            gnb->supported_ta_list[i].bplmn_list));
+                break;
+            }
+
            BroadcastPLMNItem = (NGAP_BroadcastPLMNItem_t *)
                    SupportedTAItem->broadcastPLMNList.list.array[j];
            if (!BroadcastPLMNItem) {
@ -268,6 +289,19 @@ void ngap_handle_ng_setup_request(amf_gnb_t *gnb, ogs_ngap_message_t *message)
                NGAP_SliceSupportItem_t *SliceSupportItem = NULL;
                NGAP_S_NSSAI_t *s_NSSAI = NULL;

+                if (gnb->supported_ta_list[i].bplmn_list[j].num_of_s_nssai >=
+                        OGS_ARRAY_SIZE(
+                            gnb->supported_ta_list[i].bplmn_list[j].s_nssai)) {
+                    ogs_error("OVERFLOW GNB->supported_ta_list."
+                            "bplmn_list.num_of_s_nssai [%d:%d:%d]",
+                            gnb->supported_ta_list[i].bplmn_list[j].
+                                num_of_s_nssai,
+                            OGS_MAX_NUM_OF_SLICE_SUPPORT,
+                            (int)OGS_ARRAY_SIZE(gnb->
+                                supported_ta_list[i].bplmn_list[j].s_nssai));
+                    break;
+                }
+
                SliceSupportItem = (NGAP_SliceSupportItem_t *)
                        BroadcastPLMNItem->tAISliceSupportList.list.array[k];
                if (!SliceSupportItem) {
@ -4272,6 +4306,16 @@ void ngap_handle_ran_configuration_update(
                    i++) {
            NGAP_SupportedTAItem_t *SupportedTAItem = NULL;

+            if (gnb->num_of_supported_ta_list >=
+                    OGS_ARRAY_SIZE(gnb->supported_ta_list)) {
+                ogs_error("OVERFLOW GNB->num_of_supported_ta_list "
+                        "[%d:%d:%d]",
+                        gnb->num_of_supported_ta_list,
+                        OGS_MAX_NUM_OF_SUPPORTED_TA,
+                        (int)OGS_ARRAY_SIZE(gnb->supported_ta_list));
+                break;
+            }
+
            SupportedTAItem = (NGAP_SupportedTAItem_t *)
                    SupportedTAList->list.array[i];
            if (!SupportedTAItem) {
@ -4299,6 +4343,17 @@ void ngap_handle_ran_configuration_update(
                NGAP_BroadcastPLMNItem_t *BroadcastPLMNItem = NULL;
                NGAP_PLMNIdentity_t *pLMNIdentity = NULL;

+                if (gnb->supported_ta_list[i].num_of_bplmn_list >=
+                        OGS_ARRAY_SIZE(gnb->supported_ta_list[i].bplmn_list)) {
+                    ogs_error("OVERFLOW GNB->supported_ta_list."
+                            "num_of_bplm_list [%d:%d:%d]",
+                            gnb->supported_ta_list[i].num_of_bplmn_list,
+                            OGS_MAX_NUM_OF_BPLMN,
+                            (int)OGS_ARRAY_SIZE(
+                                gnb->supported_ta_list[i].bplmn_list));
+                    break;
+                }
+
                BroadcastPLMNItem = (NGAP_BroadcastPLMNItem_t *)
                        SupportedTAItem->broadcastPLMNList.list.array[j];
                if (!BroadcastPLMNItem) {
@ -4333,6 +4388,21 @@ void ngap_handle_ran_configuration_update(
                    NGAP_SliceSupportItem_t *SliceSupportItem = NULL;
                    NGAP_S_NSSAI_t *s_NSSAI = NULL;

+                    if (gnb->supported_ta_list[i].
+                            bplmn_list[j].num_of_s_nssai >=
+                            OGS_ARRAY_SIZE(gnb->supported_ta_list[i].
+                                bplmn_list[j].s_nssai)) {
+                        ogs_error("OVERFLOW GNB->num_of_supported_ta_list."
+                                "bplmn_list.num_of_s_nssai"
+                                "[%d:%d:%d]",
+                                gnb->supported_ta_list[i].bplmn_list[j].
+                                    num_of_s_nssai,
+                                OGS_MAX_NUM_OF_SLICE_SUPPORT,
+                                (int)OGS_ARRAY_SIZE(gnb->supported_ta_list[i].
+                                    bplmn_list[j].s_nssai));
+                        break;
+                    }
+
                    SliceSupportItem = (NGAP_SliceSupportItem_t *)
                        BroadcastPLMNItem->tAISliceSupportList.list.array[k];
                    if (!SliceSupportItem) {
--- a/src/amf/nnrf-handler.c
+++ b/src/amf/nnrf-handler.c
@ -57,7 +57,9 @@ void amf_nnrf_handle_nf_discover(
    amf_sbi_select_nf(sbi_object,
            service_type, requester_nf_type, discovery_option);

-    nf_instance = sbi_object->service_type_array[service_type].nf_instance;
+    nf_instance = OGS_SBI_GET_NF_INSTANCE(
+            sbi_object->service_type_array[service_type]);
+
    if (!nf_instance) {
        amf_ue_t *amf_ue = NULL;
        amf_sess_t *sess = NULL;
--- a/src/amf/nsmf-build.c
+++ b/src/amf/nsmf-build.c
@ -190,8 +190,9 @@ ogs_sbi_request_t *amf_nsmf_pdusession_build_create_sm_context(
        goto end;
    }

-    pcf_nf_instance = amf_ue->sbi.service_type_array[
-        OGS_SBI_SERVICE_TYPE_NPCF_AM_POLICY_CONTROL].nf_instance;
+    pcf_nf_instance = OGS_SBI_GET_NF_INSTANCE(
+            amf_ue->sbi.service_type_array[
+            OGS_SBI_SERVICE_TYPE_NPCF_AM_POLICY_CONTROL]);
    if (!pcf_nf_instance) {
        ogs_error("No pcf_nf_instance");
        goto end;
--- a/src/amf/sbi-path.c
+++ b/src/amf/sbi-path.c
@ -313,7 +313,8 @@ static int client_discover_cb(
    amf_sbi_select_nf(&sess->sbi,
            service_type, requester_nf_type, discovery_option);

-    if (!sess->sbi.service_type_array[service_type].nf_instance) {
+    if (!OGS_SBI_GET_NF_INSTANCE(
+                sess->sbi.service_type_array[service_type])) {
        ogs_error("[%s:%d] (NF discover) No [%s]",
                    amf_ue->supi, sess->psi,
                    ogs_sbi_service_type_to_name(service_type));
--- a/src/ausf/init.c
+++ b/src/ausf/init.c
@ -34,16 +34,16 @@ int ausf_initialize(void)
    ogs_sbi_context_init(OpenAPI_nf_type_AUSF);
    ausf_context_init();

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_sbi_context_parse_config(APP_NAME, "nrf", "scp");
    if (rv != OGS_OK) return rv;

    rv = ausf_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    rv = ausf_sbi_open();
    if (rv != OGS_OK) return rv;

--- a/src/bsf/init.c
+++ b/src/bsf/init.c
@ -36,16 +36,16 @@ int bsf_initialize(void)
    ogs_sbi_context_init(OpenAPI_nf_type_BSF);
    bsf_context_init();

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_sbi_context_parse_config(APP_NAME, "nrf", "scp");
    if (rv != OGS_OK) return rv;

    rv = bsf_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    rv = bsf_sbi_open();
    if (rv != 0) return OGS_ERROR;

--- a/src/hss/hss-init.c
+++ b/src/hss/hss-init.c
@ -41,16 +41,16 @@ int hss_initialize(void)
    hss_context_init();
    hss_event_init();

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_metrics_context_parse_config(APP_NAME);
    if (rv != OGS_OK) return rv;

    rv = hss_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    ogs_metrics_context_open(ogs_metrics_self());

    rv = ogs_dbi_init(ogs_app()->db_uri);
--- a/src/hss/hss-s6a-path.c
+++ b/src/hss/hss-s6a-path.c
@ -180,7 +180,8 @@ static int hss_ogs_diam_s6a_air_cb( struct msg **msg, struct avp *avp,
    ogs_assert(ret == 0);
    ret = fd_msg_avp_hdr(avp, &hdr);
    ogs_assert(ret == 0);
-    memcpy(&visited_plmn_id, hdr->avp_value->os.data, hdr->avp_value->os.len);
+    memcpy(&visited_plmn_id, hdr->avp_value->os.data,
+            ogs_min(hdr->avp_value->os.len, sizeof(visited_plmn_id)));

    milenage_generate(opc, auth_info.amf, auth_info.k,
        ogs_uint64_to_buffer(auth_info.sqn, OGS_SQN_LEN, sqn), auth_info.rand,
@ -910,7 +911,8 @@ static int hss_ogs_diam_s6a_ulr_cb( struct msg **msg, struct avp *avp,
    ogs_assert(ret == 0);
    ret = fd_msg_avp_hdr(avp, &hdr);
    ogs_assert(ret == 0);
-    memcpy(&visited_plmn_id, hdr->avp_value->os.data, hdr->avp_value->os.len);
+    memcpy(&visited_plmn_id, hdr->avp_value->os.data,
+            ogs_min(hdr->avp_value->os.len, sizeof(visited_plmn_id)));

    ret = fd_msg_search_avp(qry, ogs_diam_s6a_ulr_flags, &avp);
    ogs_assert(ret == 0);
--- a/src/mme/esm-handler.c
+++ b/src/mme/esm-handler.c
@ -231,8 +231,7 @@ int esm_handle_information_response(mme_sess_t *sess,
            ogs_assert_if_reached();
        }

-        if (SESSION_CONTEXT_IS_AVAILABLE(mme_ue) &&
-            OGS_PDU_SESSION_TYPE_IS_VALID(sess->session->paa.session_type)) {
+        if (SESSION_CONTEXT_IS_AVAILABLE(mme_ue)) {
            mme_csmap_t *csmap = mme_csmap_find_by_tai(&mme_ue->tai);
            mme_ue->csmap = csmap;

--- a/src/mme/mme-fd-path.c
+++ b/src/mme/mme-fd-path.c
@ -80,9 +80,9 @@ static int mme_s6a_subscription_data_from_avp(struct avp *avp,
        ret = fd_msg_avp_hdr(avpch1, &hdr);
        ogs_assert(ret == 0);
        if (hdr->avp_value->os.data && hdr->avp_value->os.len) {
-            mme_ue->msisdn_len = hdr->avp_value->os.len;
-            memcpy(mme_ue->msisdn, hdr->avp_value->os.data,
-                    ogs_min(mme_ue->msisdn_len, OGS_MAX_MSISDN_LEN));
+            mme_ue->msisdn_len =
+                ogs_min(hdr->avp_value->os.len, OGS_MAX_MSISDN_LEN);
+            memcpy(mme_ue->msisdn, hdr->avp_value->os.data, mme_ue->msisdn_len);
            ogs_buffer_to_bcd(mme_ue->msisdn,
                    mme_ue->msisdn_len, mme_ue->msisdn_bcd);
            *subdatamask = (*subdatamask | OGS_DIAM_S6A_SUBDATA_MSISDN);
@ -103,9 +103,10 @@ static int mme_s6a_subscription_data_from_avp(struct avp *avp,
        ret = fd_msg_avp_hdr(avpch1, &hdr);
        ogs_assert(ret == 0);
        if (hdr->avp_value->os.data && hdr->avp_value->os.len) {
-            mme_ue->a_msisdn_len = hdr->avp_value->os.len;
+            mme_ue->a_msisdn_len =
+                ogs_min(hdr->avp_value->os.len, OGS_MAX_MSISDN_LEN);
            memcpy(mme_ue->a_msisdn, hdr->avp_value->os.data,
-                    ogs_min(mme_ue->a_msisdn_len, OGS_MAX_MSISDN_LEN));
+                    mme_ue->a_msisdn_len);
            ogs_buffer_to_bcd(mme_ue->a_msisdn,
                    mme_ue->a_msisdn_len, mme_ue->a_msisdn_bcd);
            *subdatamask = (*subdatamask | OGS_DIAM_S6A_SUBDATA_A_MSISDN);
@ -378,34 +379,27 @@ static int mme_s6a_subscription_data_from_avp(struct avp *avp,
                        ogs_assert(ret == 0);

                        if (addr.ogs_sa_family == AF_INET) {
+                            session->ue_ip.addr = addr.sin.sin_addr.s_addr;
                            if (session->session_type ==
                                    OGS_PDU_SESSION_TYPE_IPV4) {
-                                session->paa.addr =
-                                    addr.sin.sin_addr.s_addr;
                            } else if (session->session_type ==
                                    OGS_PDU_SESSION_TYPE_IPV4V6) {
-                                session->paa.both.addr =
-                                    addr.sin.sin_addr.s_addr;
                            } else {
                                ogs_error("Warning: Received a static IPv4 "
-                                    "address but PDN-Type does not include "
-                                    "IPv4. Ignoring...");
+                                    "address but PDN-Type[%d] does not include "
+                                    "IPv4. Ignoring...", session->session_type);
                            }
                        } else if (addr.ogs_sa_family == AF_INET6) {
+                            memcpy(session->ue_ip.addr6,
+                                    addr.sin6.sin6_addr.s6_addr, OGS_IPV6_LEN);
                            if (session->session_type ==
                                    OGS_PDU_SESSION_TYPE_IPV6) {
-                                memcpy(session->paa.addr6,
-                                    addr.sin6.sin6_addr.s6_addr,
-                                    OGS_IPV6_LEN);
                            } else if (session->session_type ==
                                    OGS_PDU_SESSION_TYPE_IPV4V6) {
-                                memcpy(session->paa.both.addr6,
-                                    addr.sin6.sin6_addr.s6_addr,
-                                    OGS_IPV6_LEN);
                            } else {
                                ogs_error("Warning: Received a static IPv6 "
-                                    "address but PDN-Type does not include "
-                                    "IPv6. Ignoring...");
+                                    "address but PDN-Type[%d] does not include "
+                                    "IPv6. Ignoring...", session->session_type);
                            }
                        } else {
                            ogs_error("Invalid family[%d]",
@ -986,9 +980,11 @@ static void mme_s6a_aia_cb(void *data, struct msg **msg)
    if (avp) {
        ret = fd_msg_avp_hdr(avp_xres, &hdr);
        ogs_assert(ret == 0);
+        e_utran_vector->xres_len =
+            ogs_min(hdr->avp_value->os.len,
+                    OGS_ARRAY_SIZE(e_utran_vector->xres));
        memcpy(e_utran_vector->xres,
-                hdr->avp_value->os.data, hdr->avp_value->os.len);
-        e_utran_vector->xres_len = hdr->avp_value->os.len;
+                hdr->avp_value->os.data, e_utran_vector->xres_len);
    } else {
        ogs_error("no_XRES");
        error++;
@ -999,8 +995,9 @@ static void mme_s6a_aia_cb(void *data, struct msg **msg)
    if (avp) {
        ret = fd_msg_avp_hdr(avp_kasme, &hdr);
        ogs_assert(ret == 0);
-        memcpy(e_utran_vector->kasme,
-                hdr->avp_value->os.data, hdr->avp_value->os.len);
+        memcpy(e_utran_vector->kasme, hdr->avp_value->os.data,
+                ogs_min(hdr->avp_value->os.len,
+                    OGS_ARRAY_SIZE(e_utran_vector->kasme)));
    } else {
        ogs_error("no_KASME");
        error++;
@ -1010,8 +1007,9 @@ static void mme_s6a_aia_cb(void *data, struct msg **msg)
    ret = fd_avp_search_avp(avp_e_utran_vector, ogs_diam_s6a_rand, &avp_rand);
    if (avp) {
        ret = fd_msg_avp_hdr(avp_rand, &hdr);
-        memcpy(e_utran_vector->rand,
-                hdr->avp_value->os.data, hdr->avp_value->os.len);
+        memcpy(e_utran_vector->rand, hdr->avp_value->os.data,
+                ogs_min(hdr->avp_value->os.len,
+                    OGS_ARRAY_SIZE(e_utran_vector->rand)));
    } else {
        ogs_error("no_RAND");
        error++;
@ -1022,8 +1020,9 @@ static void mme_s6a_aia_cb(void *data, struct msg **msg)
    if (avp) {
        ret = fd_msg_avp_hdr(avp_autn, &hdr);
        ogs_assert(ret == 0);
-        memcpy(e_utran_vector->autn,
-                hdr->avp_value->os.data, hdr->avp_value->os.len);
+        memcpy(e_utran_vector->autn, hdr->avp_value->os.data,
+                ogs_min(hdr->avp_value->os.len,
+                    OGS_ARRAY_SIZE(e_utran_vector->autn)));
    } else {
        ogs_error("no_AUTN");
        error++;
--- a/src/mme/mme-gn-build.c
+++ b/src/mme/mme-gn-build.c
@ -140,6 +140,7 @@ static void build_qos_profile_from_session(ogs_gtp1_qos_profile_decoded_t *qos_p
 static int sess_fill_pdp_context_decoded(mme_sess_t *sess, ogs_gtp1_pdp_context_decoded_t *pdpctx_dec)
 {
    mme_bearer_t *bearer = NULL;
+    int rv;

    *pdpctx_dec = (ogs_gtp1_pdp_context_decoded_t){
        .ea = OGS_GTP1_PDPCTX_EXT_EUA_NO,
@ -156,14 +157,17 @@ static int sess_fill_pdp_context_decoded(mme_sess_t *sess, ogs_gtp1_pdp_context_
        .receive_npdu_nr = 0,
        .ul_teic = sess->pgw_s5c_teid,
        .pdp_type_org = OGS_PDP_EUA_ORG_IETF,
-        .pdp_type_num = {sess->session->session_type, },
-        .pdp_address = {sess->session->ue_ip, },
+        .pdp_type_num = {sess->session->paa.session_type, },
        .ggsn_address_c = sess->pgw_s5c_ip,
        .trans_id = sess->pti,
    };

    ogs_cpystrn(pdpctx_dec->apn, sess->session->name, sizeof(pdpctx_dec->apn));

+    rv = ogs_paa_to_ip(&sess->session->paa, &pdpctx_dec->pdp_address[0]);
+    if (rv != OGS_OK)
+        return rv;
+
    ogs_list_for_each(&sess->bearer_list, bearer) {
        pdpctx_dec->nsapi = bearer->ebi; /* 3GPP TS 23.401 5.2.1, TS 23.060 14.4 */
        pdpctx_dec->sapi = 3; /* FIXME. Using 3 = default for now. Maybe use 0 = UNASSIGNED ?*/
--- a/src/mme/mme-init.c
+++ b/src/mme/mme-init.c
@ -52,6 +52,10 @@ int mme_initialize(void)
    rv = ogs_gtp_xact_init();
    if (rv != OGS_OK) return rv;

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_gtp_context_parse_config(APP_NAME, "sgwc");
    if (rv != OGS_OK) return rv;

@ -61,10 +65,6 @@ int mme_initialize(void)
    rv = mme_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    ogs_metrics_context_open(ogs_metrics_self());

    rv = mme_fd_init();
--- a/src/mme/mme-s11-build.c
+++ b/src/mme/mme-s11-build.c
@ -171,10 +171,14 @@ ogs_pkbuf_t *mme_s11_build_create_session_request(
    req->selection_mode.u8 =
        OGS_GTP2_SELECTION_MODE_MS_OR_NETWORK_PROVIDED_APN;

+    ogs_debug("sess->request_type.type = %d", sess->request_type.type);
+
    ogs_assert(sess->request_type.type == OGS_NAS_EPS_PDN_TYPE_IPV4 ||
            sess->request_type.type == OGS_NAS_EPS_PDN_TYPE_IPV6 ||
            sess->request_type.type == OGS_NAS_EPS_PDN_TYPE_IPV4V6);

+    ogs_debug("session->session_type = %d", session->session_type);
+
    if (session->session_type == OGS_PDU_SESSION_TYPE_IPV4 ||
        session->session_type == OGS_PDU_SESSION_TYPE_IPV6 ||
        session->session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
@ -185,25 +189,12 @@ ogs_pkbuf_t *mme_s11_build_create_session_request(
            ogs_assert_if_reached();
        }
    } else {
-        ogs_fatal("Invalid PDN_TYPE[%d]", session->session_type);
-        ogs_assert_if_reached();
+        ogs_error("Invalid PDN-TYPE[%d]", session->session_type);
+        return NULL;
    }
    req->pdn_type.presence = 1;

-    /* If we started with both addrs (IPV4V6) but the above code
-     * (pdn_type & sess->request_type) truncates us down to just one,
-     * we need to change position of addresses in struct. */
-    if (req->pdn_type.u8 == OGS_PDU_SESSION_TYPE_IPV4 &&
-        session->session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
-        uint32_t addr = session->paa.both.addr;
-        session->paa.addr = addr;
-    }
-    if (req->pdn_type.u8 == OGS_PDU_SESSION_TYPE_IPV6 &&
-        session->session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
-        uint8_t addr[16];
-        memcpy(&addr, session->paa.both.addr6, OGS_IPV6_LEN);
-        memcpy(session->paa.addr6, &addr, OGS_IPV6_LEN);
-    }
+    ogs_debug("req->pdn_type.u8 = %d", req->pdn_type.u8);

    memset(&indication, 0, sizeof(ogs_gtp2_indication_t));
    req->indication_flags.presence = 1;
@ -224,15 +215,23 @@ ogs_pkbuf_t *mme_s11_build_create_session_request(
        indication.operation_indication = 1;

    session->paa.session_type = req->pdn_type.u8;
+    ogs_debug("session->paa.session_type = %d", session->paa.session_type);
    req->pdn_address_allocation.data = &session->paa;
-    if (req->pdn_type.u8 == OGS_PDU_SESSION_TYPE_IPV4)
+    if (req->pdn_type.u8 == OGS_PDU_SESSION_TYPE_IPV4) {
        req->pdn_address_allocation.len = OGS_PAA_IPV4_LEN;
-    else if (req->pdn_type.u8 == OGS_PDU_SESSION_TYPE_IPV6)
+        session->paa.addr = session->ue_ip.addr;
+    } else if (req->pdn_type.u8 == OGS_PDU_SESSION_TYPE_IPV6) {
        req->pdn_address_allocation.len = OGS_PAA_IPV6_LEN;
-    else if (req->pdn_type.u8 == OGS_PDU_SESSION_TYPE_IPV4V6)
+        memcpy(session->paa.addr6, session->ue_ip.addr6, OGS_IPV6_LEN);
+    } else if (req->pdn_type.u8 == OGS_PDU_SESSION_TYPE_IPV4V6) {
        req->pdn_address_allocation.len = OGS_PAA_IPV4V6_LEN;
-    else
-        ogs_assert_if_reached();
+        session->paa.both.addr = session->ue_ip.addr;
+        memcpy(session->paa.both.addr6, session->ue_ip.addr6, OGS_IPV6_LEN);
+    } else {
+        ogs_error("Invalid PDN-TYPE[%d:%d:%d]", req->pdn_type.u8,
+                session->session_type, sess->request_type.type);
+        return NULL;
+    }
    req->pdn_address_allocation.presence = 1;

    req->maximum_apn_restriction.presence = 1;
--- a/src/mme/mme-s11-handler.c
+++ b/src/mme/mme-s11-handler.c
@ -181,38 +181,21 @@ void mme_s11_handle_create_session_response(
        cause_value = OGS_GTP2_CAUSE_CONDITIONAL_IE_MISSING;
    }

-    if (create_action == OGS_GTP_CREATE_IN_PATH_SWITCH_REQUEST) {
-
-        /* No need S5C TEID in PathSwitchRequest */
-
-    } else {
-
+    switch (create_action) {
+    case OGS_GTP_CREATE_IN_PATH_SWITCH_REQUEST:
+        /* No need for PAA or S5C TEID in PathSwitchRequest */
+        break;
+    case OGS_GTP_CREATE_IN_TRACKING_AREA_UPDATE:
+        /* No need for PAA or S5C TEID in 2G->4G mobility, it was already provided by SGSN peer */
+        break;
+    default:
        if (rsp->pgw_s5_s8__s2a_s2b_f_teid_for_pmip_based_interface_or_for_gtp_based_control_plane_interface.presence == 0) {
            ogs_error("[%s] No S5C TEID [Cause:%d]",
                    mme_ue->imsi_bcd, session_cause);
            cause_value = OGS_GTP2_CAUSE_CONDITIONAL_IE_MISSING;
        }

-    }
-
-    if (create_action == OGS_GTP_CREATE_IN_PATH_SWITCH_REQUEST) {
-
-        /* No need S5C TEID in PathSwitchRequest */
-
-    } else {
-
-        if (rsp->pdn_address_allocation.presence) {
-            ogs_paa_t paa;
-
-            memcpy(&paa, rsp->pdn_address_allocation.data,
-                    rsp->pdn_address_allocation.len);
-
-            if (!OGS_PDU_SESSION_TYPE_IS_VALID(paa.session_type)) {
-                ogs_error("[%s] Unknown PDN Type [Session:%u, Cause:%d]",
-                        mme_ue->imsi_bcd, paa.session_type, session_cause);
-                cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
-            }
-        } else {
+        if (rsp->pdn_address_allocation.presence == 0) {
            ogs_error("[%s] No PDN Address Allocation [Cause:%d]",
                    mme_ue->imsi_bcd, session_cause);
            cause_value = OGS_GTP2_CAUSE_CONDITIONAL_IE_MISSING;
@ -386,9 +369,23 @@ void mme_s11_handle_create_session_response(
    if (rsp->pdn_address_allocation.presence) {
        memcpy(&session->paa, rsp->pdn_address_allocation.data,
                rsp->pdn_address_allocation.len);
+        /*
+         * Issue #3209
+         *
+         * The Session-Type in the Subscriber DB should not be changed
+         * in case the UE can change the PDN-Type for the APN.
+         * (e.g IPv4v6 -> IPv4 -> IPv4v6)
+         *
+         * For resolving this problem,
+         * session->session_type and session->ue_ip should not be modified.
+         *
+         * Therefore, the code below will be deleted.
+         */
+#if 0 /* WILL BE DELETED */
        session->session_type = session->paa.session_type;
        ogs_assert(OGS_OK ==
                ogs_paa_to_ip(&session->paa, &session->ue_ip));
+#endif
    }

    /* ePCO */
@ -432,14 +429,10 @@ void mme_s11_handle_create_session_response(
                OGS_NETWORK_ACCESS_MODE_ONLY_PACKET ||
            mme_ue->nas_eps.attach.value ==
                OGS_NAS_ATTACH_TYPE_EPS_ATTACH) {
-            ogs_assert(OGS_PDU_SESSION_TYPE_IS_VALID(
-                        session->paa.session_type));
            r = nas_eps_send_attach_accept(mme_ue);
            ogs_expect(r == OGS_OK);
            ogs_assert(r != OGS_ERROR);
        } else {
-            ogs_assert(OGS_PDU_SESSION_TYPE_IS_VALID(
-                        session->paa.session_type));
            ogs_assert(OGS_OK == sgsap_send_location_update_request(mme_ue));
        }

@ -447,7 +440,6 @@ void mme_s11_handle_create_session_response(
        /* 3GPP TS 23.401 D.3.6 step 13, 14: */
        mme_s6a_send_ulr(mme_ue->enb_ue, mme_ue);
    } else if (create_action == OGS_GTP_CREATE_IN_UPLINK_NAS_TRANSPORT) {
-        ogs_assert(OGS_PDU_SESSION_TYPE_IS_VALID(session->paa.session_type));
        r = nas_eps_send_activate_default_bearer_context_request(
                bearer, create_action);
        ogs_expect(r == OGS_OK);
--- a/src/mme/mme-s6a-handler.c
+++ b/src/mme/mme-s6a-handler.c
@ -355,8 +355,8 @@ static uint8_t mme_ue_session_from_slice_data(mme_ue_t *mme_ue,
                ogs_free(mme_ue->session[i].name);
            break;
        }
-        memcpy(&mme_ue->session[i].paa, &slice_data->session[i].paa,
-                sizeof(mme_ue->session[i].paa));
+        memcpy(&mme_ue->session[i].ue_ip, &slice_data->session[i].ue_ip,
+                sizeof(mme_ue->session[i].ue_ip));

        memcpy(&mme_ue->session[i].qos, &slice_data->session[i].qos,
                sizeof(mme_ue->session[i].qos));
--- a/src/mme/s1ap-handler.c
+++ b/src/mme/s1ap-handler.c
@ -178,6 +178,16 @@ void s1ap_handle_s1_setup_request(mme_enb_t *enb, ogs_s1ap_message_t *message)
                SupportedTAs_Item->broadcastPLMNs.list.array[j];
            ogs_assert(pLMNidentity);

+            if (enb->num_of_supported_ta_list >=
+                    OGS_ARRAY_SIZE(enb->supported_ta_list)) {
+                ogs_error("OVERFLOW ENB->num_of_supported_ta_list "
+                        "[%d:%d:%d]",
+                        enb->num_of_supported_ta_list,
+                        OGS_MAX_NUM_OF_SUPPORTED_TA,
+                        (int)OGS_ARRAY_SIZE(enb->supported_ta_list));
+                break;
+            }
+
            memcpy(&enb->supported_ta_list[enb->num_of_supported_ta_list].tac,
                    tAC->buf, sizeof(uint16_t));
            enb->supported_ta_list[enb->num_of_supported_ta_list].tac =
@ -310,6 +320,16 @@ void s1ap_handle_enb_configuration_update(
                    SupportedTAs_Item->broadcastPLMNs.list.array[j];
                ogs_assert(pLMNidentity);

+                if (enb->num_of_supported_ta_list >=
+                        OGS_ARRAY_SIZE(enb->supported_ta_list)) {
+                    ogs_error("OVERFLOW ENB->num_of_supported_ta_list "
+                            "[%d:%d:%d]",
+                            enb->num_of_supported_ta_list,
+                            OGS_MAX_NUM_OF_SUPPORTED_TA,
+                            (int)OGS_ARRAY_SIZE(enb->supported_ta_list));
+                    break;
+                }
+
                memcpy(&enb->supported_ta_list[
                        enb->num_of_supported_ta_list].tac,
                        tAC->buf, sizeof(uint16_t));
--- a/src/mme/sgsap-handler.c
+++ b/src/mme/sgsap-handler.c
@ -332,9 +332,11 @@ void sgsap_handle_paging_request(mme_vlr_t *vlr, ogs_pkbuf_t *pkbuf)
            nas_mobile_identity_imsi_len = iter->length;
            break;
        case SGSAP_IE_VLR_NAME_TYPE:
-            ogs_assert(0 < ogs_fqdn_parse(
-                    vlr_name, iter->value,
-                    ogs_min(iter->length, SGSAP_IE_VLR_NAME_LEN)));
+            if (ogs_fqdn_parse(vlr_name, iter->value,
+                ogs_min(iter->length, SGSAP_IE_VLR_NAME_LEN)) <= 0) {
+                ogs_error("Invalid VLR-Name");
+                return;
+            }
            break;
        case SGSAP_IE_LAI_TYPE:
            lai = iter->value;
--- a/src/nrf/init.c
+++ b/src/nrf/init.c
@ -34,16 +34,16 @@ int nrf_initialize(void)
    ogs_sbi_context_init(OpenAPI_nf_type_NRF);
    nrf_context_init();

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_sbi_context_parse_config(APP_NAME, NULL, NULL);
    if (rv != OGS_OK) return rv;

    rv = nrf_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    rv = nrf_sbi_open();
    if (rv != OGS_OK) return rv;

--- a/src/nrf/nnrf-handler.c
+++ b/src/nrf/nnrf-handler.c
@ -1176,12 +1176,12 @@ static void handle_nf_discover_search_result(
             * is not executed later in nrf_context_final().
             */

-            ogs_info("[%s:%s] (NF-discover) NF registered",
+            ogs_info("[%s] (NF-discover) NF registered [type:%s]",
                    NFProfile->nf_instance_id,
                    OpenAPI_nf_type_ToString(NFProfile->nf_type));
        } else {

-            ogs_warn("[%s:%s] (NF-discover) NF has already been added",
+            ogs_warn("[%s] (NF-discover) NF has already been added [type:%s]",
                    NFProfile->nf_instance_id,
                    OpenAPI_nf_type_ToString(NFProfile->nf_type));
        }
@ -1199,7 +1199,7 @@ static void handle_nf_discover_search_result(
                break;
            }

-            ogs_info("[%s:%s] (NF-discover) NF Profile updated",
+            ogs_info("[%s] (NF-discover) NF Profile updated [type:%s]",
                        nf_instance->id,
                        OpenAPI_nf_type_ToString(nf_instance->nf_type));
        }
--- a/src/nrf/nrf-sm.c
+++ b/src/nrf/nrf-sm.c
@ -165,9 +165,7 @@ void nrf_state_operational(ogs_fsm_t *s, nrf_event_t *e)
                        ogs_fsm_dispatch(&nf_instance->sm, e);
                        if (OGS_FSM_CHECK(&nf_instance->sm,
                                    nrf_nf_state_de_registered)) {
-                            ogs_info("[%s:%d] NF de-registered",
-                                    nf_instance->id,
-                                    nf_instance->reference_count);
+                            ogs_info("[%s] NF de-registered", nf_instance->id);
                            nrf_nf_fsm_fini(nf_instance);
                            ogs_sbi_nf_instance_remove(nf_instance);
                        } else if (OGS_FSM_CHECK(&nf_instance->sm,
--- a/src/nssf/init.c
+++ b/src/nssf/init.c
@ -34,16 +34,16 @@ int nssf_initialize(void)
    ogs_sbi_context_init(OpenAPI_nf_type_NSSF);
    nssf_context_init();

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_sbi_context_parse_config(APP_NAME, "nrf", "scp");
    if (rv != OGS_OK) return rv;

    rv = nssf_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    rv = nssf_sbi_open();
    if (rv != OGS_OK) return rv;

--- a/src/nssf/nssf-sm.c
+++ b/src/nssf/nssf-sm.c
@ -97,6 +97,35 @@ void nssf_state_operational(ogs_fsm_t *s, nssf_event_t *e)
        }

        SWITCH(message.h.service.name)
+        CASE(OGS_SBI_SERVICE_NAME_NNRF_NFM)
+
+            SWITCH(message.h.resource.component[0])
+            CASE(OGS_SBI_RESOURCE_NAME_NF_STATUS_NOTIFY)
+                SWITCH(message.h.method)
+                CASE(OGS_SBI_HTTP_METHOD_POST)
+                    ogs_nnrf_nfm_handle_nf_status_notify(stream, &message);
+                    break;
+
+                DEFAULT
+                    ogs_error("Invalid HTTP method [%s]", message.h.method);
+                    ogs_assert(true ==
+                        ogs_sbi_server_send_error(stream,
+                            OGS_SBI_HTTP_STATUS_FORBIDDEN, &message,
+                            "Invalid HTTP method", message.h.method, NULL));
+                END
+                break;
+
+            DEFAULT
+                ogs_error("Invalid resource name [%s]",
+                        message.h.resource.component[0]);
+                ogs_assert(true ==
+                    ogs_sbi_server_send_error(stream,
+                        OGS_SBI_HTTP_STATUS_BAD_REQUEST, &message,
+                        "Invalid resource name",
+                        message.h.resource.component[0], NULL));
+            END
+            break;
+
        CASE(OGS_SBI_SERVICE_NAME_NNSSF_NSSELECTION)

            SWITCH(message.h.resource.component[0])
--- a/src/pcf/init.c
+++ b/src/pcf/init.c
@ -37,6 +37,10 @@ int pcf_initialize(void)
    ogs_sbi_context_init(OpenAPI_nf_type_PCF);
    pcf_context_init();

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_sbi_context_parse_config(APP_NAME, "nrf", "scp");
    if (rv != OGS_OK) return rv;

@ -46,10 +50,6 @@ int pcf_initialize(void)
    rv = pcf_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    ogs_metrics_context_open(ogs_metrics_self());

    if (ogs_app()->db_uri) {
--- a/src/pcf/npcf-handler.c
+++ b/src/pcf/npcf-handler.c
@ -505,7 +505,8 @@ bool pcf_npcf_smpolicycontrol_handle_create(pcf_sess_t *sess,

        service_type = OGS_SBI_SERVICE_TYPE_NPCF_POLICYAUTHORIZATION;

-        nf_instance = sess->sbi.service_type_array[service_type].nf_instance;
+        nf_instance = OGS_SBI_GET_NF_INSTANCE(
+                sess->sbi.service_type_array[service_type]);
        if (!nf_instance) {
            OpenAPI_nf_type_e requester_nf_type =
                        NF_INSTANCE_TYPE(ogs_sbi_self()->nf_instance);
@ -752,6 +753,15 @@ bool pcf_npcf_policyauthorization_handle_create(pcf_sess_t *sess,
        if (MediaComponentMap) {
            MediaComponent = MediaComponentMap->value;
            if (MediaComponent) {
+                if (ims_data.num_of_media_component >=
+                        OGS_ARRAY_SIZE(ims_data.media_component)) {
+                    ogs_error("OVERFLOW ims_data.num_of_media_component "
+                            "[%d:%d:%d]",
+                            ims_data.num_of_media_component,
+                            OGS_MAX_NUM_OF_MEDIA_COMPONENT,
+                            (int)OGS_ARRAY_SIZE(ims_data.media_component));
+                    break;
+                }
                media_component = &ims_data.
                    media_component[ims_data.num_of_media_component];
                media_component->media_component_number =
@ -779,6 +789,15 @@ bool pcf_npcf_policyauthorization_handle_create(pcf_sess_t *sess,

                SubComponentList = MediaComponent->med_sub_comps;
                OpenAPI_list_for_each(SubComponentList, node2) {
+                    if (media_component->num_of_sub >=
+                            OGS_ARRAY_SIZE(media_component->sub)) {
+                        ogs_error("OVERFLOW media_component->num_of_sub "
+                                "[%d:%d:%d]",
+                                media_component->num_of_sub,
+                                OGS_MAX_NUM_OF_MEDIA_SUB_COMPONENT,
+                                (int)OGS_ARRAY_SIZE(media_component->sub));
+                        break;
+                    }
                    sub = &media_component->sub[media_component->num_of_sub];

                    SubComponentMap = node2->data;
@ -792,8 +811,15 @@ bool pcf_npcf_policyauthorization_handle_create(pcf_sess_t *sess,
                            OpenAPI_list_for_each(fDescList, node3) {
                                ogs_flow_t *flow = NULL;

-                                ogs_assert(sub->num_of_flow <
-                                    OGS_MAX_NUM_OF_FLOW_IN_MEDIA_SUB_COMPONENT);
+                                if (sub->num_of_flow >=
+                                        OGS_ARRAY_SIZE(sub->flow)) {
+                                    ogs_error(
+                                        "OVERFLOW sub->num_of_flow [%d:%d:%d]",
+                                        sub->num_of_flow,
+                                        OGS_MAX_NUM_OF_FLOW_IN_MEDIA_SUB_COMPONENT,
+                                        (int)OGS_ARRAY_SIZE(sub->flow));
+                                    break;
+                                }
                                flow = &sub->flow[sub->num_of_flow];
                                if (node3->data) {
                                    flow->description = ogs_strdup(node3->data);
@ -1200,6 +1226,15 @@ bool pcf_npcf_policyauthorization_handle_update(
        if (MediaComponentMap) {
            MediaComponent = MediaComponentMap->value;
            if (MediaComponent) {
+                if (ims_data.num_of_media_component >=
+                        OGS_ARRAY_SIZE(ims_data.media_component)) {
+                    ogs_error("OVERFLOW ims_data.num_of_media_component "
+                            "[%d:%d:%d]",
+                            ims_data.num_of_media_component,
+                            OGS_MAX_NUM_OF_MEDIA_COMPONENT,
+                            (int)OGS_ARRAY_SIZE(ims_data.media_component));
+                    break;
+                }
                media_component = &ims_data.
                    media_component[ims_data.num_of_media_component];

@ -1228,6 +1263,15 @@ bool pcf_npcf_policyauthorization_handle_update(

                SubComponentList = MediaComponent->med_sub_comps;
                OpenAPI_list_for_each(SubComponentList, node2) {
+                    if (media_component->num_of_sub >=
+                            OGS_ARRAY_SIZE(media_component->sub)) {
+                        ogs_error("OVERFLOW media_component->num_of_sub "
+                                "[%d:%d:%d]",
+                                media_component->num_of_sub,
+                                OGS_MAX_NUM_OF_MEDIA_SUB_COMPONENT,
+                                (int)OGS_ARRAY_SIZE(media_component->sub));
+                        break;
+                    }
                    sub = &media_component->sub[media_component->num_of_sub];

                    SubComponentMap = node2->data;
@ -1241,8 +1285,15 @@ bool pcf_npcf_policyauthorization_handle_update(
                            OpenAPI_list_for_each(fDescList, node3) {
                                ogs_flow_t *flow = NULL;

-                                ogs_assert(sub->num_of_flow <
-                                    OGS_MAX_NUM_OF_FLOW_IN_MEDIA_SUB_COMPONENT);
+                                if (sub->num_of_flow >=
+                                        OGS_ARRAY_SIZE(sub->flow)) {
+                                    ogs_error(
+                                        "OVERFLOW sub->num_of_flow [%d:%d:%d]",
+                                        sub->num_of_flow,
+                                        OGS_MAX_NUM_OF_FLOW_IN_MEDIA_SUB_COMPONENT,
+                                        (int)OGS_ARRAY_SIZE(sub->flow));
+                                    break;
+                                }
                                flow = &sub->flow[sub->num_of_flow];
                                if (node3->data) {
                                    flow->description = ogs_strdup(node3->data);
--- a/src/pcf/nudr-handler.c
+++ b/src/pcf/nudr-handler.c
@ -215,7 +215,8 @@ bool pcf_nudr_dr_handle_query_sm_data(

        service_type = OGS_SBI_SERVICE_TYPE_NPCF_POLICYAUTHORIZATION;

-        nf_instance = sess->sbi.service_type_array[service_type].nf_instance;
+        nf_instance = OGS_SBI_GET_NF_INSTANCE(
+                sess->sbi.service_type_array[service_type]);
        if (!nf_instance) {
            OpenAPI_nf_type_e requester_nf_type =
                        NF_INSTANCE_TYPE(ogs_sbi_self()->nf_instance);
--- a/src/pcrf/pcrf-init.c
+++ b/src/pcrf/pcrf-init.c
@ -32,13 +32,13 @@ int pcrf_initialize(void)

    pcrf_context_init();

-    rv = pcrf_context_parse_config();
-    if (rv != OGS_OK) return rv;
-
    rv = ogs_log_config_domain(
            ogs_app()->logger.domain, ogs_app()->logger.level);
    if (rv != OGS_OK) return rv;

+    rv = pcrf_context_parse_config();
+    if (rv != OGS_OK) return rv;
+
    if (ogs_app()->db_uri) {
        rv = ogs_dbi_init(ogs_app()->db_uri);
        if (rv != OGS_OK) return rv;
--- a/src/pcrf/pcrf-rx-path.c
+++ b/src/pcrf/pcrf-rx-path.c
@ -229,6 +229,16 @@ static int pcrf_rx_aar_cb( struct msg **msg, struct avp *avp,
            break;
        /* Gwt Media-Component-Description */
        case OGS_DIAM_RX_AVP_CODE_MEDIA_COMPONENT_DESCRIPTION:
+            if (rx_message.ims_data.num_of_media_component >=
+                    OGS_ARRAY_SIZE(rx_message.ims_data.media_component)) {
+                ogs_error("OVERFLOW rx_message.ims_data.num_of_media_component "
+                        "[%d:%d:%d]",
+                        rx_message.ims_data.num_of_media_component,
+                        OGS_MAX_NUM_OF_MEDIA_COMPONENT,
+                        (int)OGS_ARRAY_SIZE(
+                            rx_message.ims_data.media_component));
+                break;
+            }
            media_component = &rx_message.ims_data.
                    media_component[rx_message.ims_data.num_of_media_component];

@ -271,6 +281,15 @@ static int pcrf_rx_aar_cb( struct msg **msg, struct avp *avp,
                    media_component->flow_status = hdr->avp_value->i32;
                    break;
                case OGS_DIAM_RX_AVP_CODE_MEDIA_SUB_COMPONENT:
+                    if (media_component->num_of_sub >=
+                            OGS_ARRAY_SIZE(media_component->sub)) {
+                        ogs_error("OVERFLOW media_component->num_of_sub "
+                                "[%d:%d:%d]",
+                                media_component->num_of_sub,
+                                OGS_MAX_NUM_OF_MEDIA_SUB_COMPONENT,
+                                (int)OGS_ARRAY_SIZE(media_component->sub));
+                        break;
+                    }
                    sub = &media_component->sub[media_component->num_of_sub];

                    ret = fd_msg_browse(avpch2, MSG_BRW_FIRST_CHILD,
@ -300,8 +319,14 @@ static int pcrf_rx_aar_cb( struct msg **msg, struct avp *avp,
                            }
                            break;
                        case OGS_DIAM_RX_AVP_CODE_FLOW_DESCRIPTION:
-                            ogs_assert(sub->num_of_flow <
-                                    OGS_MAX_NUM_OF_FLOW_IN_MEDIA_SUB_COMPONENT);
+                            if (sub->num_of_flow >= OGS_ARRAY_SIZE(sub->flow)) {
+                                ogs_error(
+                                    "OVERFLOW sub->num_of_flow [%d:%d:%d]",
+                                    sub->num_of_flow,
+                                    OGS_MAX_NUM_OF_FLOW_IN_MEDIA_SUB_COMPONENT,
+                                    (int)OGS_ARRAY_SIZE(sub->flow));
+                                break;
+                            }
                            flow = &sub->flow[sub->num_of_flow];
                            flow->description = ogs_strndup(
                                    (char*)hdr->avp_value->os.data,
--- a/src/scp/init.c
+++ b/src/scp/init.c
@ -36,16 +36,16 @@ int scp_initialize(void)
    ogs_sbi_context_init(OpenAPI_nf_type_SCP);
    scp_context_init();

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_sbi_context_parse_config(APP_NAME, "nrf", "next_scp");
    if (rv != OGS_OK) return rv;

    rv = scp_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    rv = scp_sbi_open();
    if (rv != 0) return OGS_ERROR;

--- a/src/scp/sbi-path.c
+++ b/src/scp/sbi-path.c
@ -283,9 +283,10 @@ static int request_handler(ogs_sbi_request_t *request, void *data)
                    client = ogs_sbi_client_find_by_service_type(
                                nf_instance, service_type);
                    if (!client) {
-                        ogs_error("[%s:%s] Cannot find client [%s:%s]",
-                                OpenAPI_nf_type_ToString(nf_instance->nf_type),
+                        ogs_error("[%s] Cannot find client "
+                                "[type:%s target_nf_type:%s service_name:%s]",
                                nf_instance->id,
+                                OpenAPI_nf_type_ToString(nf_instance->nf_type),
                                OpenAPI_nf_type_ToString(target_nf_type),
                                ogs_sbi_service_type_to_name(service_type));
                    }
--- a/src/sepp/init.c
+++ b/src/sepp/init.c
@ -36,16 +36,16 @@ int sepp_initialize(void)
    ogs_sbi_context_init(OpenAPI_nf_type_SEPP);
    sepp_context_init();

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_sbi_context_parse_config(APP_NAME, "nrf", "scp");
    if (rv != OGS_OK) return rv;

    rv = sepp_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    rv = sepp_sbi_open();
    if (rv != 0) return OGS_ERROR;

--- a/src/sepp/n32c-handler.c
+++ b/src/sepp/n32c-handler.c
@ -118,6 +118,14 @@ bool sepp_n32c_handshake_handle_security_capability_request(
    OpenAPI_list_for_each(SecNegotiateReqData->plmn_id_list, node) {
        OpenAPI_plmn_id_t *PlmnId = node->data;
        if (PlmnId) {
+            if (sepp_node->num_of_plmn_id >=
+                    OGS_ARRAY_SIZE(sepp_node->plmn_id)) {
+                ogs_error("OVERFLOW SecNegotiateReqData->plmn_id_list "
+                        "[%d:%d:%d]",
+                        sepp_node->num_of_plmn_id, OGS_MAX_NUM_OF_PLMN,
+                        (int)OGS_ARRAY_SIZE(sepp_node->plmn_id));
+                break;
+            }
            ogs_sbi_parse_plmn_id(
                &sepp_node->plmn_id[sepp_node->num_of_plmn_id], PlmnId);
            sepp_node->num_of_plmn_id++;
@ -185,6 +193,14 @@ bool sepp_n32c_handshake_handle_security_capability_response(
    OpenAPI_list_for_each(SecNegotiateRspData->plmn_id_list, node) {
        OpenAPI_plmn_id_t *PlmnId = node->data;
        if (PlmnId) {
+            if (sepp_node->num_of_plmn_id >=
+                    OGS_ARRAY_SIZE(sepp_node->plmn_id)) {
+                ogs_error("OVERFLOW SecNegotiateRspData->plmn_id_list "
+                        "[%d:%d:%d]",
+                        sepp_node->num_of_plmn_id, OGS_MAX_NUM_OF_PLMN,
+                        (int)OGS_ARRAY_SIZE(sepp_node->plmn_id));
+                break;
+            }
            ogs_sbi_parse_plmn_id(
                &sepp_node->plmn_id[sepp_node->num_of_plmn_id], PlmnId);
            sepp_node->num_of_plmn_id++;
--- a/src/sgwc/context.c
+++ b/src/sgwc/context.c
@ -226,7 +226,7 @@ sgwc_ue_t *sgwc_ue_add(uint8_t *imsi, int imsi_len)
            &sgwc_ue->sgw_s11_teid, sizeof(sgwc_ue->sgw_s11_teid), sgwc_ue);

    /* Set IMSI */
-    sgwc_ue->imsi_len = imsi_len;
+    sgwc_ue->imsi_len = ogs_min(imsi_len, OGS_MAX_IMSI_LEN);
    memcpy(sgwc_ue->imsi, imsi, sgwc_ue->imsi_len);
    ogs_buffer_to_bcd(sgwc_ue->imsi, sgwc_ue->imsi_len, sgwc_ue->imsi_bcd);

--- a/src/sgwc/init.c
+++ b/src/sgwc/init.c
@ -47,6 +47,10 @@ int sgwc_initialize(void)
    rv = ogs_pfcp_xact_init();
    if (rv != OGS_OK) return rv;

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_gtp_context_parse_config(APP_NAME, "sgwu");
    if (rv != OGS_OK) return rv;

@ -56,10 +60,6 @@ int sgwc_initialize(void)
    rv = sgwc_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    rv = sgwc_gtp_open();
    if (rv != OGS_OK) return rv;

--- a/src/sgwc/s11-handler.c
+++ b/src/sgwc/s11-handler.c
@ -203,6 +203,12 @@ void sgwc_s11_handle_create_session_request(
    if (req->access_point_name.presence == 0) {
        ogs_error("No APN");
        cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_MISSING;
+    } else {
+        if (ogs_fqdn_parse(apn, req->access_point_name.data,
+            ogs_min(req->access_point_name.len, OGS_MAX_APN_LEN)) <= 0) {
+            ogs_error("Invalid APN");
+            cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+        }
    }
    if (req->sender_f_teid_for_control_plane.presence == 0) {
        ogs_error("No Sender F-TEID");
@ -221,9 +227,6 @@ void sgwc_s11_handle_create_session_request(
    }

    /* Add Session */
-    ogs_assert(0 < ogs_fqdn_parse(apn,
-            req->access_point_name.data,
-            ogs_min(req->access_point_name.len, OGS_MAX_APN_LEN)));
    sess = sgwc_sess_find_by_ebi(sgwc_ue,
            req->bearer_contexts_to_be_created[0].eps_bearer_id.u8);
    if (sess) {
@ -239,21 +242,22 @@ void sgwc_s11_handle_create_session_request(
    /* Set User Location Information */
    if (req->user_location_information.presence == 1) {
        decoded = ogs_gtp2_parse_uli(&uli, &req->user_location_information);
-        ogs_assert(req->user_location_information.len == decoded);
+        if (req->user_location_information.len == decoded) {
+            sgwc_ue->uli_presence = true;

-        sgwc_ue->uli_presence = true;
+            ogs_nas_to_plmn_id(&sgwc_ue->e_tai.plmn_id, &uli.tai.nas_plmn_id);
+            sgwc_ue->e_tai.tac = uli.tai.tac;
+            ogs_nas_to_plmn_id(&sgwc_ue->e_cgi.plmn_id, &uli.e_cgi.nas_plmn_id);
+            sgwc_ue->e_cgi.cell_id = uli.e_cgi.cell_id;

-        ogs_nas_to_plmn_id(&sgwc_ue->e_tai.plmn_id, &uli.tai.nas_plmn_id);
-        sgwc_ue->e_tai.tac = uli.tai.tac;
-        ogs_nas_to_plmn_id(&sgwc_ue->e_cgi.plmn_id, &uli.e_cgi.nas_plmn_id);
-        sgwc_ue->e_cgi.cell_id = uli.e_cgi.cell_id;
-
-        ogs_debug("    TAI[PLMN_ID:%06x,TAC:%d]",
-                ogs_plmn_id_hexdump(&sgwc_ue->e_tai.plmn_id),
-                sgwc_ue->e_tai.tac);
-        ogs_debug("    E_CGI[PLMN_ID:%06x,CELL_ID:0x%x]",
-                ogs_plmn_id_hexdump(&sgwc_ue->e_cgi.plmn_id),
-                sgwc_ue->e_cgi.cell_id);
+            ogs_debug("    TAI[PLMN_ID:%06x,TAC:%d]",
+                    ogs_plmn_id_hexdump(&sgwc_ue->e_tai.plmn_id),
+                    sgwc_ue->e_tai.tac);
+            ogs_debug("    E_CGI[PLMN_ID:%06x,CELL_ID:0x%x]",
+                    ogs_plmn_id_hexdump(&sgwc_ue->e_cgi.plmn_id),
+                    sgwc_ue->e_cgi.cell_id);
+        } else
+            ogs_error("Invalid User Location Info(ULI)");
    }

    /* Select SGW-U based on UE Location Information */
@ -539,21 +543,22 @@ void sgwc_s11_handle_modify_bearer_request(

    if (req->user_location_information.presence == 1) {
        decoded = ogs_gtp2_parse_uli(&uli, &req->user_location_information);
-        ogs_assert(req->user_location_information.len == decoded);
+        if (req->user_location_information.len == decoded) {
+            sgwc_ue->uli_presence = true;

-        sgwc_ue->uli_presence = true;
+            ogs_nas_to_plmn_id(&sgwc_ue->e_tai.plmn_id, &uli.tai.nas_plmn_id);
+            sgwc_ue->e_tai.tac = uli.tai.tac;
+            ogs_nas_to_plmn_id(&sgwc_ue->e_cgi.plmn_id, &uli.e_cgi.nas_plmn_id);
+            sgwc_ue->e_cgi.cell_id = uli.e_cgi.cell_id;

-        ogs_nas_to_plmn_id(&sgwc_ue->e_tai.plmn_id, &uli.tai.nas_plmn_id);
-        sgwc_ue->e_tai.tac = uli.tai.tac;
-        ogs_nas_to_plmn_id(&sgwc_ue->e_cgi.plmn_id, &uli.e_cgi.nas_plmn_id);
-        sgwc_ue->e_cgi.cell_id = uli.e_cgi.cell_id;
-
-        ogs_debug("    TAI[PLMN_ID:%06x,TAC:%d]",
-                ogs_plmn_id_hexdump(&sgwc_ue->e_tai.plmn_id),
-                sgwc_ue->e_tai.tac);
-        ogs_debug("    E_CGI[PLMN_ID:%06x,CELL_ID:0x%x]",
-                ogs_plmn_id_hexdump(&sgwc_ue->e_cgi.plmn_id),
-                sgwc_ue->e_cgi.cell_id);
+            ogs_debug("    TAI[PLMN_ID:%06x,TAC:%d]",
+                    ogs_plmn_id_hexdump(&sgwc_ue->e_tai.plmn_id),
+                    sgwc_ue->e_tai.tac);
+            ogs_debug("    E_CGI[PLMN_ID:%06x,CELL_ID:0x%x]",
+                    ogs_plmn_id_hexdump(&sgwc_ue->e_cgi.plmn_id),
+                    sgwc_ue->e_cgi.cell_id);
+        } else
+            ogs_error("Invalid User Location Info(ULI)");
    }

    ogs_debug("    MME_S11_TEID[%d] SGW_S11_TEID[%d]",
@ -842,21 +847,22 @@ void sgwc_s11_handle_create_bearer_response(

    if (rsp->user_location_information.presence == 1) {
        decoded = ogs_gtp2_parse_uli(&uli, &rsp->user_location_information);
-        ogs_assert(rsp->user_location_information.len == decoded);
+        if (rsp->user_location_information.len == decoded) {
+            sgwc_ue->uli_presence = true;

-        sgwc_ue->uli_presence = true;
+            ogs_nas_to_plmn_id(&sgwc_ue->e_tai.plmn_id, &uli.tai.nas_plmn_id);
+            sgwc_ue->e_tai.tac = uli.tai.tac;
+            ogs_nas_to_plmn_id(&sgwc_ue->e_cgi.plmn_id, &uli.e_cgi.nas_plmn_id);
+            sgwc_ue->e_cgi.cell_id = uli.e_cgi.cell_id;

-        ogs_nas_to_plmn_id(&sgwc_ue->e_tai.plmn_id, &uli.tai.nas_plmn_id);
-        sgwc_ue->e_tai.tac = uli.tai.tac;
-        ogs_nas_to_plmn_id(&sgwc_ue->e_cgi.plmn_id, &uli.e_cgi.nas_plmn_id);
-        sgwc_ue->e_cgi.cell_id = uli.e_cgi.cell_id;
-
-        ogs_debug("    TAI[PLMN_ID:%06x,TAC:%d]",
-                ogs_plmn_id_hexdump(&sgwc_ue->e_tai.plmn_id),
-                sgwc_ue->e_tai.tac);
-        ogs_debug("    E_CGI[PLMN_ID:%06x,CELL_ID:0x%x]",
-                ogs_plmn_id_hexdump(&sgwc_ue->e_cgi.plmn_id),
-                sgwc_ue->e_cgi.cell_id);
+            ogs_debug("    TAI[PLMN_ID:%06x,TAC:%d]",
+                    ogs_plmn_id_hexdump(&sgwc_ue->e_tai.plmn_id),
+                    sgwc_ue->e_tai.tac);
+            ogs_debug("    E_CGI[PLMN_ID:%06x,CELL_ID:0x%x]",
+                    ogs_plmn_id_hexdump(&sgwc_ue->e_cgi.plmn_id),
+                    sgwc_ue->e_cgi.cell_id);
+        } else
+            ogs_error("Invalid User Location Info(ULI)");
    }

    ogs_assert(OGS_OK ==
--- a/src/sgwc/s5c-handler.c
+++ b/src/sgwc/s5c-handler.c
@ -137,19 +137,7 @@ void sgwc_s5c_handle_create_session_response(
        ogs_error("No GTP TEID [Cause:%d]", session_cause);
        cause_value = OGS_GTP2_CAUSE_CONDITIONAL_IE_MISSING;
    }
-    if (rsp->pdn_address_allocation.presence) {
-        ogs_paa_t paa;
-
-        memcpy(&paa, rsp->pdn_address_allocation.data,
-                ogs_min(sizeof(paa), rsp->pdn_address_allocation.len));
-
-        if (!OGS_PDU_SESSION_TYPE_IS_VALID(paa.session_type)) {
-            ogs_error("Unknown PDN Type %u, Cause:%d",
-                    paa.session_type, session_cause);
-            cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
-        }
-
-    } else {
+    if (rsp->pdn_address_allocation.presence == 0) {
        ogs_error("No PDN Address Allocation [Cause:%d]", session_cause);
        cause_value = OGS_GTP2_CAUSE_CONDITIONAL_IE_MISSING;
    }
--- a/src/sgwu/context.c
+++ b/src/sgwu/context.c
@ -252,6 +252,10 @@ sgwu_sess_t *sgwu_sess_add_by_message(ogs_pfcp_message_t *message)
        ogs_error("No CP F-SEID");
        return NULL;
    }
+    if (f_seid->ipv4 == 0 && f_seid->ipv6 == 0) {
+        ogs_error("No IPv4 or IPv6");
+        return NULL;
+    }
    f_seid->seid = be64toh(f_seid->seid);

    sess = sgwu_sess_find_by_sgwc_sxa_f_seid(f_seid);
--- a/src/sgwu/init.c
+++ b/src/sgwu/init.c
@ -44,6 +44,10 @@ int sgwu_initialize(void)
    rv = ogs_pfcp_xact_init();
    if (rv != OGS_OK) return rv;

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_gtp_context_parse_config(APP_NAME, "sgwc");
    if (rv != OGS_OK) return rv;

@ -53,10 +57,6 @@ int sgwu_initialize(void)
    rv = sgwu_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    rv = sgwu_pfcp_open();
    if (rv != OGS_OK) return rv;

--- a/src/smf/context.c
+++ b/src/smf/context.c
@ -1049,7 +1049,7 @@ smf_ue_t *smf_ue_add_by_imsi(uint8_t *imsi, int imsi_len)
    if ((smf_ue = smf_ue_add()) == NULL)
        return NULL;;

-    smf_ue->imsi_len = imsi_len;
+    smf_ue->imsi_len = ogs_min(imsi_len, OGS_MAX_IMSI_LEN);
    memcpy(smf_ue->imsi, imsi, smf_ue->imsi_len);
    ogs_buffer_to_bcd(smf_ue->imsi, smf_ue->imsi_len, smf_ue->imsi_bcd);
    ogs_hash_set(self.imsi_hash, smf_ue->imsi, smf_ue->imsi_len, smf_ue);
@ -1278,7 +1278,14 @@ smf_sess_t *smf_sess_add_by_gtp1_message(ogs_gtp1_message_t *message)
    if (req->access_point_name.presence == 0) {
        ogs_error("No APN");
        return NULL;
+    } else {
+        if (ogs_fqdn_parse(apn, req->access_point_name.data,
+            ogs_min(req->access_point_name.len, OGS_MAX_APN_LEN)) <= 0) {
+            ogs_error("Invalid APN");
+            return NULL;
+        }
    }
+
    if (req->sgsn_address_for_signalling.presence == 0) {
        ogs_error("No SGSN Address for signalling");
        return NULL;
@ -1296,12 +1303,6 @@ smf_sess_t *smf_sess_add_by_gtp1_message(ogs_gtp1_message_t *message)
        return NULL;
    }

-    if ((ogs_fqdn_parse(apn, req->access_point_name.data,
-            ogs_min(req->access_point_name.len, OGS_MAX_APN_LEN+1))) <= 0) {
-        ogs_error("No APN");
-        return NULL;
-    }
-
    ogs_trace("smf_sess_add_by_message() [APN:%s]", apn);

    /*
@ -1349,15 +1350,18 @@ smf_sess_t *smf_sess_add_by_gtp2_message(ogs_gtp2_message_t *message)
    if (req->access_point_name.presence == 0) {
        ogs_error("No APN");
        return NULL;
+    } else {
+        if (ogs_fqdn_parse(apn, req->access_point_name.data,
+            ogs_min(req->access_point_name.len, OGS_MAX_APN_LEN)) <= 0) {
+            ogs_error("Invalid APN");
+            return NULL;
+        }
    }
    if (req->rat_type.presence == 0) {
        ogs_error("No RAT Type");
        return NULL;
    }

-    ogs_assert(0 < ogs_fqdn_parse(apn, req->access_point_name.data,
-            ogs_min(req->access_point_name.len, OGS_MAX_APN_LEN)));
-
    ogs_trace("smf_sess_add_by_message() [APN:%s]", apn);

    /*
--- a/src/smf/fd-path.c
+++ b/src/smf/fd-path.c
@ -100,7 +100,10 @@ void smf_fd_msg_avp_add_3gpp_uli(smf_sess_t *sess, struct msg *req)
    /* GTPv2C and Diameter 3GPP-User-Location-Information encoding don't match */
    uli_len = ogs_gtp2_parse_uli(
            &uli, &sess->gtp.user_location_information);
-    ogs_assert(sess->gtp.user_location_information.len == uli_len);
+    if (sess->gtp.user_location_information.len != uli_len) {
+        ogs_error("Invalid User Location Information(ULI)");
+        return;
+    }

    ogs_assert(sess->gtp.user_location_information.data);
    ogs_assert(sess->gtp.user_location_information.len);
--- a/src/smf/init.c
+++ b/src/smf/init.c
@ -51,6 +51,10 @@ int smf_initialize(void)
    rv = ogs_pfcp_xact_init();
    if (rv != OGS_OK) return rv;

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_gtp_context_parse_config(APP_NAME, "upf");
    if (rv != OGS_OK) return rv;

@ -66,10 +70,6 @@ int smf_initialize(void)
    rv = smf_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    rv = ogs_pfcp_ue_pool_generate();
    if (rv != OGS_OK) return rv;

--- a/src/smf/s5c-handler.c
+++ b/src/smf/s5c-handler.c
@ -207,7 +207,15 @@ uint8_t smf_s5c_handle_create_session_request(
    if (sess->gtp_rat_type == OGS_GTP2_RAT_TYPE_EUTRAN) {
        /* User Location Inforation is mandatory only for E-UTRAN */
        ogs_assert(req->user_location_information.presence);
-        ogs_gtp2_parse_uli(&uli, &req->user_location_information);
+        if (req->user_location_information.presence == 0) {
+            ogs_error("No User Location Information(ULI)");
+            return OGS_GTP2_CAUSE_MANDATORY_IE_MISSING;
+        }
+        decoded = ogs_gtp2_parse_uli(&uli, &req->user_location_information);
+        if (req->user_location_information.len != decoded) {
+            ogs_error("Invalid User Location Information(ULI)");
+            return OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+        }
        memcpy(&sess->e_tai, &uli.tai, sizeof(sess->e_tai));
        memcpy(&sess->e_cgi, &uli.e_cgi, sizeof(sess->e_cgi));

@ -410,16 +418,15 @@ uint8_t smf_s5c_handle_create_session_request(

    /* Set MSISDN */
    if (req->msisdn.presence && req->msisdn.len && req->msisdn.data) {
-        smf_ue->msisdn_len = req->msisdn.len;
-        memcpy(smf_ue->msisdn, req->msisdn.data,
-                ogs_min(smf_ue->msisdn_len, OGS_MAX_MSISDN_LEN));
+        smf_ue->msisdn_len = ogs_min(req->msisdn.len, OGS_MAX_MSISDN_LEN);
+        memcpy(smf_ue->msisdn, req->msisdn.data, smf_ue->msisdn_len);
        ogs_buffer_to_bcd(smf_ue->msisdn,
                smf_ue->msisdn_len, smf_ue->msisdn_bcd);
    }

    /* Set IMEI(SV) */
    if (req->me_identity.presence && req->me_identity.len > 0) {
-        smf_ue->imeisv_len = req->me_identity.len;
+        smf_ue->imeisv_len = ogs_min(req->me_identity.len, OGS_MAX_IMEISV_LEN);
        memcpy(smf_ue->imeisv,
            (uint8_t*)req->me_identity.data, smf_ue->imeisv_len);
        ogs_buffer_to_bcd(
--- a/src/udm/init.c
+++ b/src/udm/init.c
@ -34,16 +34,16 @@ int udm_initialize(void)
    ogs_sbi_context_init(OpenAPI_nf_type_UDM);
    udm_context_init();

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_sbi_context_parse_config(APP_NAME, "nrf", "scp");
    if (rv != OGS_OK) return rv;

    rv = udm_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    rv = udm_sbi_open();
    if (rv != OGS_OK) return rv;

--- a/src/udr/init.c
+++ b/src/udr/init.c
@ -34,16 +34,16 @@ int udr_initialize(void)
    ogs_sbi_context_init(OpenAPI_nf_type_UDR);
    udr_context_init();

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_sbi_context_parse_config(APP_NAME, "nrf", "scp");
    if (rv != OGS_OK) return rv;

    rv = udr_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    rv = ogs_dbi_init(ogs_app()->db_uri);
    if (rv != OGS_OK) return rv;

--- a/src/upf/context.c
+++ b/src/upf/context.c
@ -365,6 +365,10 @@ upf_sess_t *upf_sess_add_by_message(ogs_pfcp_message_t *message)
        ogs_error("No CP F-SEID");
        return NULL;
    }
+    if (f_seid->ipv4 == 0 && f_seid->ipv6 == 0) {
+        ogs_error("No IPv4 or IPv6");
+        return NULL;
+    }
    f_seid->seid = be64toh(f_seid->seid);

    sess = upf_sess_find_by_smf_n4_f_seid(f_seid);
--- a/src/upf/init.c
+++ b/src/upf/init.c
@ -47,6 +47,10 @@ int upf_initialize(void)
    rv = ogs_pfcp_xact_init();
    if (rv != OGS_OK) return rv;

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    rv = ogs_gtp_context_parse_config(APP_NAME, "smf");
    if (rv != OGS_OK) return rv;

@ -59,10 +63,6 @@ int upf_initialize(void)
    rv = upf_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    rv = ogs_pfcp_ue_pool_generate();
    if (rv != OGS_OK) return rv;

--- a/src/upf/n4-handler.c
+++ b/src/upf/n4-handler.c
@ -107,8 +107,12 @@ void upf_n4_handle_session_establishment_request(
    if (req->apn_dnn.presence) {
        char apn_dnn[OGS_MAX_DNN_LEN+1];

-        ogs_assert(0 < ogs_fqdn_parse(apn_dnn, req->apn_dnn.data,
-                ogs_min(req->apn_dnn.len, OGS_MAX_DNN_LEN)));
+        if (ogs_fqdn_parse(apn_dnn, req->apn_dnn.data,
+            ogs_min(req->apn_dnn.len, OGS_MAX_DNN_LEN)) <= 0) {
+            ogs_error("Invalid APN");
+            cause_value = OGS_PFCP_CAUSE_MANDATORY_IE_INCORRECT;
+            goto cleanup;
+        }

        if (sess->apn_dnn)
            ogs_free(sess->apn_dnn);
--- a/tests/310014/epc-test.c
+++ b/tests/310014/epc-test.c
@ -95,7 +95,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    test_ue->attach_request_param.ms_network_feature_support = 1;
--- a/tests/af/init.c
+++ b/tests/af/init.c
@ -37,6 +37,10 @@ int af_initialize(void)
    ogs_sbi_context_init(OpenAPI_nf_type_AF);
    af_context_init();

+    rv = ogs_log_config_domain(
+            ogs_app()->logger.domain, ogs_app()->logger.level);
+    if (rv != OGS_OK) return rv;
+
    no_scp = ogs_global_conf()->parameter.no_scp;
    no_nrf = ogs_global_conf()->parameter.no_nrf;

@ -52,10 +56,6 @@ int af_initialize(void)
    rv = af_context_parse_config();
    if (rv != OGS_OK) return rv;

-    rv = ogs_log_config_domain(
-            ogs_app()->logger.domain, ogs_app()->logger.level);
-    if (rv != OGS_OK) return rv;
-
    rv = af_sbi_open();
    if (rv != 0) return OGS_ERROR;

--- a/tests/attach/auth-test.c
+++ b/tests/attach/auth-test.c
@ -97,7 +97,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -202,7 +203,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -277,7 +279,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -352,7 +355,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -445,7 +449,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/attach/crash-test.c
+++ b/tests/attach/crash-test.c
@ -180,7 +180,8 @@ static void test4_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/attach/emm-status-test.c
+++ b/tests/attach/emm-status-test.c
@ -96,7 +96,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/attach/guti-test.c
+++ b/tests/attach/guti-test.c
@ -96,7 +96,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -233,7 +234,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.epco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -374,7 +376,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -522,7 +525,8 @@ static void test2_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -627,7 +631,8 @@ static void test2_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -764,7 +769,8 @@ static void test2_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -959,7 +965,8 @@ static void test3_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -1309,7 +1316,8 @@ static void test4_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -1392,7 +1400,8 @@ static void test4_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -1522,7 +1531,8 @@ static void test4_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/attach/idle-test.c
+++ b/tests/attach/idle-test.c
@ -97,7 +97,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -426,7 +427,8 @@ static void test2_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -711,7 +713,8 @@ static void test3_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/attach/issues-test.c
+++ b/tests/attach/issues-test.c
@ -99,7 +99,8 @@ static void issues_1431_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -215,7 +216,8 @@ static void issues_1431_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
@ -245,7 +247,8 @@ static void issues_1431_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -648,7 +651,8 @@ static void issues_2287_v263_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue[0]->attach_request_param,
@ -786,7 +790,8 @@ static void issues_2287_v263_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue[1]->attach_request_param,
@ -928,7 +933,8 @@ static void issues_2287_v263_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.epco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue[0]->attach_request_param,
@ -994,7 +1000,8 @@ static void issues_2287_v263_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.epco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue[1]->attach_request_param,
@ -1080,7 +1087,8 @@ static void issues_2287_v263_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue[1], esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
@ -1450,7 +1458,8 @@ static void issues_2287_v264_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue[1]->attach_request_param,
@ -1588,7 +1597,8 @@ static void issues_2287_v264_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue[0]->attach_request_param,
@ -1724,7 +1734,8 @@ static void issues_2287_v264_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue[1]->attach_request_param,
--- a/tests/attach/reset-test.c
+++ b/tests/attach/reset-test.c
@ -121,7 +121,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -369,7 +370,8 @@ static void test2_func(abts_case *tc, void *data)
        sess->pdn_connectivity_param.pco = 1;
        sess->pdn_connectivity_param.request_type =
            OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-        esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+        esmbuf = testesm_build_pdn_connectivity_request(
+                sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
        ABTS_PTR_NOTNULL(tc, esmbuf);

        memset(&test_ue[i]->attach_request_param,
@ -605,7 +607,8 @@ static void test3_func(abts_case *tc, void *data)
        sess->pdn_connectivity_param.pco = 1;
        sess->pdn_connectivity_param.request_type =
            OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-        esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+        esmbuf = testesm_build_pdn_connectivity_request(
+                sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
        ABTS_PTR_NOTNULL(tc, esmbuf);

        memset(&test_ue[i]->attach_request_param,
--- a/tests/attach/simple-test.c
+++ b/tests/attach/simple-test.c
@ -96,7 +96,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/attach/ue-context-test.c
+++ b/tests/attach/ue-context-test.c
@ -93,7 +93,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -257,7 +258,8 @@ static void test2_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -340,7 +342,8 @@ static void test2_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -556,7 +559,8 @@ static void test3_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -639,7 +643,8 @@ static void test3_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/common/context.c
+++ b/tests/common/context.c
@ -1551,6 +1551,11 @@ bson_t *test_db_new_simple(test_ue_t *test_ue)
                            "unit", BCON_INT32(3),
                        "}",
                    "}",
+#if 0 /* For static-IP test */
+                    "ue", "{", "ipv4", "1.1.1.1", "ipv6", "::1", "}",
+                    "ue", "{", "ipv4", "1.1.1.1", "}",
+                    "ue", "{", "ipv6", "::1", "}",
+#endif
                    "qos", "{",
                        "index", BCON_INT32(9),
                        "arp", "{",
--- a/tests/common/esm-build.c
+++ b/tests/common/esm-build.c
@ -20,7 +20,7 @@
 #include "test-common.h"

 ogs_pkbuf_t *testesm_build_pdn_connectivity_request(
-        test_sess_t *sess, bool integrity_protected)
+        test_sess_t *sess, bool integrity_protected, uint8_t pdn_type)
 {
    ogs_nas_eps_message_t message;
    ogs_nas_eps_pdn_connectivity_request_t *pdn_connectivity_request =
@ -72,7 +72,7 @@ ogs_pkbuf_t *testesm_build_pdn_connectivity_request(

    message.esm.h.message_type = OGS_NAS_EPS_PDN_CONNECTIVITY_REQUEST;

-    request_type->type = OGS_NAS_EPS_PDN_TYPE_IPV4V6;
+    request_type->type = pdn_type;
    request_type->value = sess->pdn_connectivity_param.request_type;
    ogs_assert(request_type->value);

--- a/tests/common/esm-build.h
+++ b/tests/common/esm-build.h
@ -25,7 +25,7 @@ extern "C" {
 #endif

 ogs_pkbuf_t *testesm_build_pdn_connectivity_request(
-        test_sess_t *sess, bool integrity_protected);
+        test_sess_t *sess, bool integrity_protected, uint8_t pdn_type);
 ogs_pkbuf_t *testesm_build_pdn_disconnect_request(test_sess_t *sess);
 ogs_pkbuf_t *testesm_build_esm_information_response(test_sess_t *sess);
 ogs_pkbuf_t *testesm_build_activate_default_eps_bearer_context_accept(
--- a/tests/csfb/crash-test.c
+++ b/tests/csfb/crash-test.c
@ -96,7 +96,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/csfb/mo-active-test.c
+++ b/tests/csfb/mo-active-test.c
@ -96,7 +96,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/csfb/mo-idle-test.c
+++ b/tests/csfb/mo-idle-test.c
@ -96,7 +96,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -380,7 +381,8 @@ static void test_issues3072_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -647,7 +649,8 @@ static void test2_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -915,7 +918,8 @@ static void test3_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -1196,7 +1200,8 @@ static void test4_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/csfb/mo-sms-test.c
+++ b/tests/csfb/mo-sms-test.c
@ -96,7 +96,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/csfb/mt-active-test.c
+++ b/tests/csfb/mt-active-test.c
@ -96,7 +96,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/csfb/mt-idle-test.c
+++ b/tests/csfb/mt-idle-test.c
@ -96,7 +96,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/csfb/mt-sms-test.c
+++ b/tests/csfb/mt-sms-test.c
@ -96,7 +96,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/handover/epc-s1-test.c
+++ b/tests/handover/epc-s1-test.c
@ -114,7 +114,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -708,7 +709,8 @@ static void test2_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -1030,7 +1032,8 @@ static void test3_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/handover/epc-x2-test.c
+++ b/tests/handover/epc-x2-test.c
@ -110,7 +110,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -461,7 +462,8 @@ static void test2_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/non3gpp/epdg-test.c
+++ b/tests/non3gpp/epdg-test.c
@ -433,7 +433,8 @@ static void test3_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_HANDOVER;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -557,7 +558,8 @@ static void test3_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
@ -657,7 +659,8 @@ static void test3_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_HANDOVER;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
--- a/tests/volte/bearer-test.c
+++ b/tests/volte/bearer-test.c
@ -93,7 +93,8 @@ static void uni_directional_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -336,7 +337,8 @@ static void bi_directional_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
--- a/tests/volte/cx-test.c
+++ b/tests/volte/cx-test.c
@ -104,7 +104,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -221,7 +222,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
--- a/tests/volte/rx-test.c
+++ b/tests/volte/rx-test.c
@ -99,7 +99,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -216,7 +217,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
@ -609,7 +611,8 @@ static void test2_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -717,7 +720,8 @@ static void test2_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
@ -958,7 +962,8 @@ static void test3_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -1075,7 +1080,8 @@ static void test3_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
@ -1160,7 +1166,8 @@ static void test3_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
@ -1303,7 +1310,8 @@ static void test4_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -1420,7 +1428,8 @@ static void test4_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
@ -1503,7 +1512,8 @@ static void test4_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
@ -1639,7 +1649,8 @@ static void test4_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -1827,7 +1838,8 @@ static void test5_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -1944,7 +1956,8 @@ static void test5_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
@ -2328,7 +2341,8 @@ static void test6_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -2445,7 +2459,8 @@ static void test6_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
@ -2748,7 +2763,8 @@ static void test7_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -2865,7 +2881,8 @@ static void test7_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
@ -3148,7 +3165,8 @@ static void test_issues3109_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -3265,7 +3283,8 @@ static void test_issues3109_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
--- a/tests/volte/session-test.c
+++ b/tests/volte/session-test.c
@ -93,7 +93,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.eit = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, false);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);

    memset(&test_ue->attach_request_param,
@ -201,7 +202,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
@ -317,7 +319,8 @@ static void test1_func(abts_case *tc, void *data)
    sess->pdn_connectivity_param.pco = 1;
    sess->pdn_connectivity_param.request_type =
        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
-    esmbuf = testesm_build_pdn_connectivity_request(sess, true);
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
    ABTS_PTR_NOTNULL(tc, esmbuf);
    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
    ABTS_PTR_NOTNULL(tc, sendbuf);
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Pau Espin	c6c73c1f70	MME: Gn: Fill PDP Context requested from SGSN with IP allocated by SMF IP assigned from SMF: session->paa Static IP read from the Subscriber DB: session->ue_ip When passing the PDP context information to the SGSN, we actually wanna provide it with the IP address currently in use.	2024-05-22 07:14:53 +09:00
Pau Espin	f401e7df14	Revert "[MME] Fixed ttcn3-mme-test-ogs (#2806 ) (#315 )" This reverts commit `87d9cdf569`.	2024-05-22 07:14:53 +09:00
Sukchan Lee	87d9cdf569	[MME] Fixed ttcn3-mme-test-ogs (#2806 ) (#315 ) Try to fix the following error "MME_Tests.ttcn:955 : no SGSN Context Response from MME" MME_Tests.ttcn:1572 MME_Tests control part MME_Tests.ttcn:1457 TC_ue_cell_reselect_eutran_to_geran testcase	2024-05-21 21:06:17 +09:00
Sukchan Lee	02d302b15a	[SEC] Fix Assertion ogs_pfcp_parse_volume (#3207 )	2024-05-18 21:37:28 +09:00
Sukchan Lee	15ff23de75	[SEC] Fix Assertion ogs_pfcp_parse_sdf_filter (#3207 )	2024-05-18 21:37:28 +09:00
Sukchan Lee	b1bf2b10e2	[SEC] Fix Assertion ogs_pfcp_f_seid_to_ip (#3207 )	2024-05-18 21:37:28 +09:00
Sukchan Lee	bd4d925f0f	[SEC] Fix Assertion ogs_pfcp_parse_user_plane_ip_resource_info() (#3207 )	2024-05-18 21:37:28 +09:00
Sukchan Lee	5f425445a8	[SEC] Fix Assertion ogs_gtp2_parse_uli (#3209 )	2024-05-18 21:37:28 +09:00
Sukchan Lee	05deed616c	[SEC] fix Assertion `0 < ogs_fadn_parse` (#3207 )	2024-05-18 21:37:28 +09:00
Sukchan Lee	4599b273fa	[MME] Problem keep changing PDN-Type (#3209 ) If the UE continuously attempts to Attach while changing PDN Type, it will cause the wrong IP to be assigned. (e.g PDU-Type : IPv4v6 -> IPv4 -> IPv4v6) This is because we use two variables at the same time, one to read and store the Static IP from the Subscriber DB and one to store the IP assigned from SMF, called session->paa. When the UE attaches with PDN-Type set to IPv4v6, MME saves the allocated IP in session->paa. However, MME thinks it has been assigned a static IP based on the information in session->paa, so changing the PDN-Type may result in the wrong IP being assigned. To solve this problem, I separated the variable(session->paa) that stores the allocated IP received from SMF and the variable(session->ue_ip) that stores the Static IP read from the Subscriber DB. Therefore, the information read from the Subscriber DB (session->session_type and session->ue_ip) should not be modified.	2024-05-18 14:01:00 +09:00
Sukchan Lee	bba0ebe6a4	[SEC] crash for IMSI/MSISDN/IMEI overflow (#3207 ) When using ogs_buffer_to_bcd(), an overflow occurs if the input buffer length is larger than the output bcd size, causing a crash. We adjusted the size of the input buffer length using ogs_min as follows. ``` sgwc_ue->imsi_len = ogs_min(imsi_len, OGS_MAX_IMSI_LEN); memcpy(sgwc_ue->imsi, imsi, sgwc_ue->imsi_len); ogs_buffer_to_bcd(sgwc_ue->imsi, sgwc_ue->imsi_len, sgwc_ue->imsi_bcd); ```	2024-05-17 20:25:49 +09:00
Sukchan Lee	80ab4c4a1b	[NF] Move ogs_log_config_domain() location (#3210 ) When we run the test, for example, ./tests/registration/registration simple-init, wee get an INFO message like the one below. ``` 05/17 14:24:03.933: [sbi] INFO: NF EndPoint(addr) setup [127.0.0.200:7777] (../lib/sbi/context.c:474) ``` When we run the code in Open5GS, the log level initially defaults to INFO. However, for test code, we change the log level to ERROR by automatically inserting the -e error option into argv. The reason for this is to prevent WARNING and INFO messages from appearing when the test code is run. However, the log level to ERROR is changed at the bottom of the initialize routine, which caused the above message to be printed during testing. To prevent this from being printed, I modified the code to change that log level to ERROR a little earlier.	2024-05-17 14:54:32 +09:00
Sukchan Lee	95de14c72b	[SBI] SearchResult.validityPeriod 3600->30s (#3210 ) The validity time for NF Instances obtained through NF Discovery was not properly implemented. Since the validity was 3600 seconds(1 hour), which caused 5G Core to not work properly after 3600 seconds(1 hour). There was an issue where an NF Instance should be deleted when its validity time expired, but it was not working correctly due to incorrect use of reference count. Therefore, I have modified the Validity of NF Instances obtained through NF Discovery to work properly. I also changed the default value of valdityPeriod to 30 seconds.	2024-05-17 14:54:32 +09:00
Sukchan Lee	7a9fea8aec	[SBI] Re-factor NF Instance Context (#3093 ) Fixed not using Reference Count for adding/deleting NF Instances. Up until now, NF Instances have been managed by referencing the Reference Count. Initially, when an NF Instance is added, the Reference Count is incremented and when it is deleted, the Reference Count is decremented. If a UE discovers another NF Instance through the NF Discovery function, the Reference Count is incremented. And if a UE de-registers, the Reference Count of the discovered NF is decremented. However, there's a problem with this approach. When other NF is de-registered, there is no guarantee that it will be 100% notified. For example, if a UDM is de-registered, but an SCP is de-registered before it, the AMF will not be notified that the UDM has been de-registered. In situations where this is not clear, Reference Count cannot be used. Therefore, we have modified it to not use the Reference Count method. Also, when a UE connects, it is modified to always search whether an NF Instance exists by NF Instance ID whenever it is discovered. To do this, we modified lib/sbi/path.c as shown below. ```diff @@ -281,13 +281,15 @@ int ogs_sbi_discover_and_send(ogs_sbi_xact_t xact) } / Target NF-Instance */ - nf_instance = sbi_object->service_type_array[service_type].nf_instance; + nf_instance = ogs_sbi_nf_instance_find( + sbi_object->service_type_array[service_type].nf_instance_id); if (!nf_instance) { nf_instance = ogs_sbi_nf_instance_find_by_discovery_param( target_nf_type, requester_nf_type, discovery_option); - if (nf_instance) - OGS_SBI_SETUP_NF_INSTANCE( - sbi_object->service_type_array[service_type], nf_instance); + if (nf_instance) { + OGS_SBI_SETUP_NF_INSTANCE_ID( + sbi_object->service_type_array[service_type], nf_instance->id); + } } ```	2024-05-12 10:24:15 +09:00
Sukchan Lee	9d8d560be7	[DOCKER] Change UID from 1000 to 2000 The ubuntu docker image defaults to UID 1000 as the ubuntu username, so change the UID of the open5gs default user acetcom to 2000.	2024-05-11 16:26:04 +09:00
Daniel Willmann	eb28c514ea	[MME] s11: Allow CreateSessionResponse with no S5c TEID IE The TEID is already known (provided by SGSN through Gn SGSNContextResponse), so not mandatory for it to be set.	2024-05-11 01:07:45 +02:00
Pau Espin	f16f6e3c6c	[MME] s11: Allow CreateSessionResponse with no PAA IE The PAA is already known (provided by SGSN through Gn SGSNContextResponse), so not mandatory for it to be set.	2024-05-11 01:07:45 +02:00
Pau Espin	190b39a75c	cosmetic: [MME] Fix wrong content in comment line	2024-05-11 01:07:45 +02:00
Sukchan Lee	87b4e4535c	[SEC] Stack overflow in PCRF/PCF (#3157 ) The indexes rx_message.ims_data.num_of_media_component and media_component->num_of_sub can overflow. ``` static int pcrf_rx_aar_cb( struct msg *msg, struct avp avp, struct session sess, void opaque, enum disp_action act) .. / Gwt Specific-Action / case OGS_DIAM_RX_AVP_CODE_SPECIFIC_ACTION: break; / Gwt Media-Component-Description */ case OGS_DIAM_RX_AVP_CODE_MEDIA_COMPONENT_DESCRIPTION: media_component = &rx_message.ims_data. media_component[rx_message.ims_data.num_of_media_component]; ret = fd_msg_browse(avpch1, MSG_BRW_FIRST_CHILD, &avpch2, NULL); ogs_assert(ret == 0); while (avpch2) { ret = fd_msg_avp_hdr(avpch2, &hdr); .. } fd_msg_browse(avpch2, MSG_BRW_NEXT, &avpch2, NULL); } rx_message.ims_data.num_of_media_component++; break; default: ogs_warn("Not supported(%d)", hdr->avp_code); break; } .. } ```	2024-05-01 16:52:10 +09:00
Sukchan Lee	b57722178a	[SEC] Heap overflow in open5gs-mmed/s1ap (#3153 ) Assert shall be triggered if the mme_enb_t object is corrupted. ``` $ gdb -q -p `pidof open5gs-mmed` .. Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1". 0x0000ffff90deb46c in __GI___sigtimedwait (set=set@entry=0xfffffe63be68, info=info@entry=0xfffffe63bda8, timeout=timeout@entry=0x0) at ../sysdeps/unix/sysv/linux/sigtimedwait.c:61 61 ../sysdeps/unix/sysv/linux/sigtimedwait.c: No such file or directory. Breakpoint 1 at 0xaaaabef69250: file ../src/mme/s1ap-handler.c, line 199. [Switching to Thread 0xffff1efdef00 (LWP 20348)] Thread 38 "open5gs-mmed" hit Breakpoint 1, s1ap_handle_s1_setup_request (enb=0xffff9029b5a0, message=0xffff1efdc498) at ../src/mme/s1ap-handler.c:199 warning: Source file is more recent than executable. 199 if (maximum_number_of_enbs_is_reached()) { (gdb) p enb.supported_ta_list $1 = {{plmn_id = {mcc1 = 0 '\000', mcc2 = 0 '\000', mcc3 = 1 '\001', mnc1 = 15 '\017', mnc2 = 0 '\000', mnc3 = 1 '\001'}, tac = 1} <repeats 256 times>} (gdb) p enb $2 = (mme_enb_t ) 0xffff9029b5a0 (gdb) p enb $3 = {lnode = {prev = 0x0, next = 0x0}, sm = {init = 0xaaaabef66540 <s1ap_state_initial>, fini = 0xaaaabef66640 <s1ap_state_final>, state = 0xaaaabef66730 <s1ap_state_operational>}, enb_id = 1, plmn_id = { mcc1 = 1 '\001', mcc2 = 2 '\002', mcc3 = 3 '\003', mnc1 = 15 '\017', mnc2 = 4 '\004', mnc3 = 5 '\005'}, sctp = {type = 1, sock = 0xfffedc000bd0, addr = 0xfffedc000e70, poll = {read = 0xffff9032a0f0, write = 0x0}, write_queue = {prev = 0x0, next = 0x0}}, state = {s1_setup_success = false}, max_num_of_ostreams = 30, ostream_id = 0, num_of_supported_ta_list = 258, supported_ta_list = {{plmn_id = { mcc1 = 0 '\000', mcc2 = 0 '\000', mcc3 = 1 '\001', mnc1 = 15 '\017', mnc2 = 0 '\000', mnc3 = 1 '\001'}, tac = 1} <repeats 256 times>}, s1_reset_ack = 0x10f100000110f100, enb_ue_list = {prev = 0x1, next = 0x0}} pwndbg> vmmap enb LEGEND: STACK \| HEAP \| CODE \| DATA \| RWX \| RODATA Start End Perm Size Offset File 0xffff8edd4000 0xffff8ede4000 ---p 10000 0 [anon_ffff8edd4] ► 0xffff8ede4000 0xffff90650000 rw-p 186c000 0 [anon_ffff8ede4] +0x1517010 0xffff90650000 0xffff90659000 r-xp 9000 0 /usr/lib/aarch64-linux-gnu/libffi.so.8.1.0 ``` The value s1_reset_ack = 0x10f100000110f100 shall contain a function pointer, but has been corrupted. The following patch will abort the process: ```diff $ diff --git a/src/mme/s1ap-handler.c b/src/mme/s1ap-handler.c index dff401ded..55a1f7e1b 100644 --- a/src/mme/s1ap-handler.c +++ b/src/mme/s1ap-handler.c @@ -178,6 +178,7 @@ void s1ap_handle_s1_setup_request(mme_enb_t enb, ogs_s1ap_message_t message) SupportedTAs_Item->broadcastPLMNs.list.array[j]; ogs_assert(pLMNidentity); + ogs_assert(enb->num_of_supported_ta_list < OGS_ARRAY_SIZE(enb->supported_ta_list)); memcpy(&enb->supported_ta_list[enb->num_of_supported_ta_list].tac, tAC->buf, sizeof(uint16_t)); enb->supported_ta_list[enb->num_of_supported_ta_list].tac = @@ -310,6 +311,7 @@ void s1ap_handle_enb_configuration_update( SupportedTAs_Item->broadcastPLMNs.list.array[j]; ogs_assert(pLMNidentity); + ogs_assert(enb->num_of_supported_ta_list < OGS_ARRAY_SIZE(enb->supported_ta_list)); memcpy(&enb->supported_ta_list[ enb->num_of_supported_ta_list].tac, tAC->buf, sizeof(uint16_t)); ```	2024-05-01 16:25:33 +09:00
Sukchan Lee	7ea82cb87b	[SEC] Heap overflow in open5gs-mmed/s6a (#3156 ) An assert shall be triggered. The vulnerable code path is in src/mme/mme-fd-path.c: ``` /* s6a process Subscription-Data from avp / static int mme_s6a_subscription_data_from_avp(struct avp avp, ogs_subscription_data_t subscription_data, mme_ue_t mme_ue, uint32_t subdatamask) { ... / AVP: 'MSISDN'( 701 ) * The MSISDN AVP is of type OctetString. This AVP contains an MSISDN, * in international number format as described in ITU-T Rec E.164 [8], * encoded as a TBCD-string, i.e. digits from 0 through 9 are encoded * 0000 to 1001; 1111 is used as a filler when there is an odd number * of digits; bits 8 to 5 of octet n encode digit 2n; bits 4 to 1 of * octet n encode digit 2(n-1)+1. * Reference: 3GPP TS 29.329 / ret = fd_avp_search_avp(avp, ogs_diam_s6a_msisdn, &avpch1); ogs_assert(ret == 0); if (avpch1) { ret = fd_msg_avp_hdr(avpch1, &hdr); ogs_assert(ret == 0); if (hdr->avp_value->os.data && hdr->avp_value->os.len) { mme_ue->msisdn_len = hdr->avp_value->os.len; / 1 / memcpy(mme_ue->msisdn, hdr->avp_value->os.data, ogs_min(mme_ue->msisdn_len, OGS_MAX_MSISDN_LEN)); / 2 / ogs_buffer_to_bcd(mme_ue->msisdn, mme_ue->msisdn_len, mme_ue->msisdn_bcd); / 3 / subdatamask = (*subdatamask \| OGS_DIAM_S6A_SUBDATA_MSISDN); } } ```	2024-05-01 14:51:11 +09:00
Sukchan Lee	e89aa79efe	[SEC] Stack overflow in open5gs-hssd/s6a (#3155 ) An assert shall be triggered if a stack corruption occurs. The vulnerable code path is in src/hss/hss-s6a-path.c: ``` static int hss_ogs_diam_s6a_air_cb( struct msg *msg, struct avp avp, struct session session, void opaque, enum disp_action *act) { .. ogs_plmn_id_t visited_plmn_id; .. ret = fd_msg_search_avp(qry, ogs_diam_visited_plmn_id, &avp); ogs_assert(ret == 0); ret = fd_msg_avp_hdr(avp, &hdr); ogs_assert(ret == 0); memcpy(&visited_plmn_id, hdr->avp_value->os.data, hdr->avp_value->os.len); ```	2024-04-30 22:25:52 +09:00
Sukchan Lee	048a74005b	[SEC] Heap overflow in parse PLMN-ID (#3154 ) An assert shall be triggered if sepp_node is corrupted. ``` pwndbg> p *sepp_node $5 = { lnode = { prev = 0x0, next = 0xaaaac920c638 }, receiver = 0xaaaac9230990 "sepp2.localdomain", negotiated_security_scheme = OpenAPI_security_capability_TLS, target_apiroot_supported = true, plmn_id = {{ mcc1 = 6 '\006', mcc2 = 6 '\006', mcc3 = 6 '\006', mnc1 = 6 '\006', mnc2 = 6 '\006', mnc3 = 6 '\006' } <repeats 12 times>}, num_of_plmn_id = 6710887, target_plmn_id_presence = false, target_plmn_id = { mcc1 = 0 '\000', mcc2 = 0 '\000', mcc3 = 0 '\000', mnc1 = 0 '\000', mnc2 = 0 '\000', mnc3 = 0 '\000' }, supported_features = 1, sm = { init = 0xaaaaada181fc <sepp_handshake_state_initial>, fini = 0xaaaaada18390 <sepp_handshake_state_final>, state = 0xaaaaada194b4 <sepp_handshake_state_established> }, t_establish_interval = 0xffffa7d6c4e0, client = 0xaaaac91af010, n32f = { client = 0xaaaac91af090 } } pwndbg> p/x sepp_node.num_of_plmn_id $6 = 0x666667 ```	2024-04-30 22:10:45 +09:00
Sukchan Lee	f6c0ded7b4	[NSSF] Added POST nnrf-nfm/nf-status-notify When NSSF was first implemented, nf-status-notify was not required. This is because there was no need to be notified if other NFs were registered or de-registered in the NRF. However, this situation changed with the addition of SEPP. NSSFs can be notified whenever a SEPP registers or de-registers an NRF. Therefore, we added nf-status-notify, which was not implemented when the NSSF was originally created.	2024-04-30 21:35:42 +09:00
Sukchan Lee	819861be2f	[DOCS] Update Helm Chars Links (#3173 )	2024-04-27 09:18:11 +09:00
Sukchan Lee	4c00edd839	Update document for v2.7.1	2024-04-19 21:24:08 +09:00
Sukchan Lee	426fa3f84a	Release v2.7.1	2024-04-19 21:22:24 +09:00
Pau Espin	c0a520f32a	systemd: network: Add explicit routes towards tundev for UE pool of addresses When running the open5gs package with systemd network config, the 1st IP address of the UE pool configured in open5gs-upfd config file for ogstun is being assigned to the interface through this file. That was discussed as being a desirable default setup. However, in the event a user wants a setup where no IP address is assigned to the tundev, then it's not enough removing the IP address, because then the implicit routing rules regarding the subnet of the IP address added automatically by the kernel are also removed. This patch adds config sections to set up the routing explicitly, with the aim to get the routing still applied if the user decides to comment out the IP address, so that packets are still forwarded properly in that case. Related: https://osmocom.org/issues/6361	2024-04-19 08:32:19 +09:00