From 032d4fc9ff544503adf37c389ce51dcf400104d6 Mon Sep 17 00:00:00 2001 From: Robert Schmidt Date: Wed, 17 Jul 2024 16:40:46 +0200 Subject: [PATCH 1/3] RRC: reject PDU sessions if security is not active OAI 5GC seems to have a bug, and occasionally might send a PDU session setup request without having sent a UE context setup request, resulting in no security context activated for a UE. This lead to an assertion in rrc_gNB_process_e1_bearer_context_setup_resp(). To prevent the gNB from stopping, check if security is active before triggering PDU sessions. If not, the gNB will reject PDU sessions. --- openair2/RRC/NR/rrc_gNB.c | 2 -- openair2/RRC/NR/rrc_gNB_NGAP.c | 22 ++++++++++++++++++++-- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/openair2/RRC/NR/rrc_gNB.c b/openair2/RRC/NR/rrc_gNB.c index 420b31e662..db737823fe 100644 --- a/openair2/RRC/NR/rrc_gNB.c +++ b/openair2/RRC/NR/rrc_gNB.c @@ -2200,8 +2200,6 @@ void rrc_gNB_process_e1_bearer_context_setup_resp(e1ap_bearer_setup_resp_t *resp } } - AssertFatal(UE->as_security_active, "logic bug: security should be active when activating DRBs\n"); - if (!UE->f1_ue_context_active) rrc_gNB_generate_UeContextSetupRequest(rrc, ue_context_p, nb_drb, drbs); else diff --git a/openair2/RRC/NR/rrc_gNB_NGAP.c b/openair2/RRC/NR/rrc_gNB_NGAP.c index e1395ce6cd..6f3341bc6b 100644 --- a/openair2/RRC/NR/rrc_gNB_NGAP.c +++ b/openair2/RRC/NR/rrc_gNB_NGAP.c @@ -342,6 +342,7 @@ static int decodePDUSessionResourceSetup(pdusession_t *session) void trigger_bearer_setup(gNB_RRC_INST *rrc, gNB_RRC_UE_t *UE, int n, pdusession_t *sessions, uint64_t ueAggMaxBitRateDownlink) { + AssertFatal(UE->as_security_active, "logic bug: security should be active when activating DRBs\n"); e1ap_bearer_setup_req_t bearer_req = {0}; e1ap_nssai_t cuup_nssai = {0}; @@ -813,7 +814,6 @@ void rrc_gNB_process_NGAP_PDUSESSION_SETUP_REQ(MessageDef *msg_p, instance_t ins gNB_RRC_UE_t *UE = &ue_context_p->ue_context; PROTOCOL_CTXT_SET_BY_MODULE_ID(&ctxt, 0, GNB_FLAG_YES, UE->rnti, 0, 0, 0); gNB_RRC_INST *rrc = RC.nrrrc[ctxt.module_id]; - LOG_I(NR_RRC, "[gNB %ld] gNB_ue_ngap_id %u \n", instance, msg->gNB_ue_ngap_id); if (ue_context_p == NULL) { MessageDef *msg_fail_p = NULL; @@ -825,7 +825,25 @@ void rrc_gNB_process_NGAP_PDUSESSION_SETUP_REQ(MessageDef *msg_p, instance_t ins return ; } - AssertFatal(UE->rrc_ue_id == msg->gNB_ue_ngap_id, "logic bug\n"); + DevAssert(UE->rrc_ue_id == msg->gNB_ue_ngap_id); + LOG_I(NR_RRC, "UE %d: received PDU session setup request\n", UE->rrc_ue_id); + + if (!UE->as_security_active) { + LOG_E(NR_RRC, "UE %d: no security context active for UE, rejecting PDU session setup request\n", UE->rrc_ue_id); + MessageDef *msg_resp = itti_alloc_new_message(TASK_RRC_GNB, 0, NGAP_PDUSESSION_SETUP_RESP); + ngap_pdusession_setup_resp_t *resp = &NGAP_PDUSESSION_SETUP_RESP(msg_resp); + resp->gNB_ue_ngap_id = UE->rrc_ue_id; + resp->nb_of_pdusessions_failed = msg->nb_pdusessions_tosetup; + for (int i = 0; i < resp->nb_of_pdusessions_failed; ++i) { + pdusession_failed_t *f = &resp->pdusessions_failed[i]; + f->pdusession_id = msg->pdusession_setup_params[i].pdusession_id; + f->cause = NGAP_CAUSE_PROTOCOL; + f->cause_value = 3; // NGAP_CauseProtocol_message_not_compatible_with_receiver_state + } + itti_send_msg_to_task(TASK_NGAP, instance, msg_resp); + return; + } + UE->amf_ue_ngap_id = msg->amf_ue_ngap_id; trigger_bearer_setup(rrc, UE, msg->nb_pdusessions_tosetup, msg->pdusession_setup_params, msg->ueAggMaxBitRateDownlink); return; From d581c671e98d0cf0e8b09dfee85174b728cbc5d6 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Thu, 25 Jul 2024 13:48:03 +0200 Subject: [PATCH 2/3] Add enum for NGAP protocol cause IEs --- openair2/COMMON/ngap_messages_types.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/openair2/COMMON/ngap_messages_types.h b/openair2/COMMON/ngap_messages_types.h index 29ea48294a..faeb11d377 100644 --- a/openair2/COMMON/ngap_messages_types.h +++ b/openair2/COMMON/ngap_messages_types.h @@ -409,6 +409,19 @@ typedef enum ngap_Cause_radio_network_e { NGAP_CAUSE_RADIO_NETWORK_MULTIPLE_LOCATION_REPORTING_REFERENCE_ID_INSTANCES } ngap_Cause_radio_network_t; +/** + * NGAP protocol cause values as per 9.3.1.2 `Cause` section in 3GPP TS 38.413. + */ +typedef enum ngap_cause_protocol_e { + NGAP_CAUSE_PROTOCOL_TRANSFER_SYNTAX_ERROR, + NGAP_CAUSE_PROTOCOL_ABSTRACT_SYNTAX_ERROR_REJECT, + NGAP_CAUSE_PROTOCOL_ABSTRACT_SYNTAX_ERROR_IGNORE, + NGAP_CAUSE_PROTOCOL_MSG_NOT_COMPATIBLE_WITH_RECEIVER_STATE, + NGAP_CAUSE_PROTOCOL_SEMANTIC_ERROR, + NGAP_CAUSE_PROTOCOL_ABSTRACT_SYNTAX_ERROR_FCM, + NGAP_CAUSE_PROTOCOL_UNSPECIFIED +} ngap_cause_protocol_t; + typedef struct pdusession_failed_s { /* Unique pdusession_id for the UE. */ uint8_t pdusession_id; From 869b78efe2531a2e364a5ea14561ca4ed93477b5 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Thu, 25 Jul 2024 13:48:29 +0200 Subject: [PATCH 3/3] Use NGAP protocol cause IE in the stack --- openair2/RRC/NR/rrc_gNB_NGAP.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair2/RRC/NR/rrc_gNB_NGAP.c b/openair2/RRC/NR/rrc_gNB_NGAP.c index 6f3341bc6b..590cfcfecc 100644 --- a/openair2/RRC/NR/rrc_gNB_NGAP.c +++ b/openair2/RRC/NR/rrc_gNB_NGAP.c @@ -838,7 +838,7 @@ void rrc_gNB_process_NGAP_PDUSESSION_SETUP_REQ(MessageDef *msg_p, instance_t ins pdusession_failed_t *f = &resp->pdusessions_failed[i]; f->pdusession_id = msg->pdusession_setup_params[i].pdusession_id; f->cause = NGAP_CAUSE_PROTOCOL; - f->cause_value = 3; // NGAP_CauseProtocol_message_not_compatible_with_receiver_state + f->cause_value = NGAP_CAUSE_PROTOCOL_MSG_NOT_COMPATIBLE_WITH_RECEIVER_STATE; } itti_send_msg_to_task(TASK_NGAP, instance, msg_resp); return;