The previously used net_ip_address_t type is limited to some bytes, but
the CU name might be longer. Use char * to allow longer DNS names.
Also, this type separates IPv4/v6, which is not necessary, as it is now
handled by the same C API (getaddrinfo()), since !2635.
Co-authored-by: Guido Casati <hello@guidocasati.com>
User of the SCTP module use the assoc_id for connection identification.
The previous code set the assoc_id to -1, so there is no way of telling
which connection broke. Use the assoc_id instead
>Direct leak of 7 byte(s) in 1 object(s) allocated from:
>0 0x7ffff74b4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
>1 0x55555819ab3c in generatePduSessionEstablishRequest /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:938
>2 0x5555581a8a9f in nas_nrue /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1295
>3 0x5555581a3078 in nas_nrue_task /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1215
>4 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
> Direct leak of 4 byte(s) in 1 object(s) allocated from:
>0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
>1 0x55555819c025 in generatePduSessionEstablishRequest /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:993
>2 0x5555581a8a9f in nas_nrue /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1295
>3 0x5555581a3078 in nas_nrue_task /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1215
>4 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
> Direct leak of 1 byte(s) in 1 object(s) allocated from:
>0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
>1 0x55555819c8f7 in generatePduSessionEstablishRequest /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:987
>2 0x5555581a9b75 in nas_nrue /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1299
>3 0x5555581a414e in nas_nrue_task /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1219
>4 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
> Direct leak of 16 byte(s) in 1 object(s) allocated from:
>0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
>1 0x55555818ef1c in generateAuthenticationResp /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:588
>2 0x5555581b0fca in nas_nrue /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1405
>3 0x5555581a3069 in nas_nrue_task /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1213
>4 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
Before this commit, the following will trigger a complete rebuild:
- create another git name (git checkout -b test)
- run cmake again manually (cmake ..)
- run ninja again
The top-level CMakeLists.txt uses add_definitions() to add git
information to all targets; if some git information changes, this will
mark all command lines as dirty, triggering the build.
There is an easy solution: instead of passing this information on the
command line, pass it in a header. This commit uses configure_file() to
generate a file oai_version.h in the build directory with the same
information. Various sources files, e.g., main executables, use this to
output the same information as before. It is then also not necessary to
use header guards, as cmake takes care to create this file.
If cmake is re-run, it will update the header, and trigger only files
including this header will be rebuilt (which can be shown with the above
stpes). The information passed is the same as before, and updates the
information when the old method would have updated it.
This commit resolves undefined behaviour runtime errors related
to misaligned memory access. E.g.
> openair3/NAS/COMMON/IES/FGSMobileIdentity.c:193:3:
> runtime error: store to misaligned address 0x608000021e2b for type 'uint16_t',
> which requires 2 byte alignment 0x608000021e2b: note: pointer points here 00 f1 ...
* ENCODE_U24: safely encode 24-bit values into a buffer
by using memcpy to copy 3 bytes in network byte order (big-endian).
* ENCODE_U16: safely encodes a 16-bit value into a buffer, handling
misalignment by memcpy 2 bytes to buffer in network byte order (big-endian).
- Save nas instance id in nr_ue_nas_t and use that for instance determination.
- Use correct field in itti message (destinationInstance instead of originInstance) to determine instance
- Make sure both destinationInstance and originInstance fields are correct in NAS interface functions.
Handle IPv6 (and IPv4v6) PDU sessions by correctly instructing
nas_config() to set up the interface with provided IP addresses.
Note that as of now, IPv6 PDU sessions have not been fully tested.
Remove a useless assert at the gNB; to my understanding the gNB does not
care about the IP session type (at least for IP), as it just
transparently tunnels the IP packets from/to GTP.
I added a comment in the code where to change to request a PDU session
different from IPv4. Currently it is hardcoded to IPv4, and it seems
that a default OAI 5GC config would reject a PDU session type different
from IPv4.
These rules & route are necessary to properly send packets on oaitun_ue1
interface:
1. This forces the packets coming from a subnet different than the UE's
subnet to go back through oaitun_ue1 rather than via what the default
route defined on the system (e.g., important if ping from the
internet arrives).
2. On machines setting net.ipv4.conf.oaitun_ue1.rp_filter=1 (e.g.
RHEL), this prevents that source filtering for packets coming back is
applied and those packets be dropped. By default, many hosts have
rp_filter=2, so no strict source filtering is applied, and it would
work; on others, this rule prevents source filter dropping.
Prior to this commit, there was a global variable baseNetAddress that
could be set independently through a setter and also through the
configuration module. This baseNetAddress (16 bits IPv4) would then be
complemented with two more bytes in nas_config().
However, this is counter-productive, as not only we have a global
variable that is avoidable (we can give the entire address to
nas_config() directly), but it also would not work with IPv6. Hence,
modify to give nas_config() the entire address. A follow-up commit will
add IPv6 support.
Instead of implicitly using a hardcoded prefix "oaitun_" interface
name, move that out to the callers of these functions to make it clear.
The ID still remains outside.
The "sister functions" nas_config_mbms()/netlink_init_tun_mbms() will do
the same change in the next commit.
Compiling the nrUE with -fsanitize=undefined leads to a crash
because the function nas_stream_encrypt_eia1() accesses the data
as uint32_t but the data is not aligned.
Actually this function wants 64 bits (big-endian) of data, so let's
introduce a simple function to read a big-endian 64 bits value.
It may seem bad (unoptimized), but looking at the output of gcc
without -fsanitize=undefined this will be translated as just one
movbeq instruction (on the machine where I did the test), which is
actually less instructions than the previous version which was doing
too movbel plus orq.
Moreover, after the main loop we need to process the last remaining
bytes (so less than 8). The code was wrong, reading past the input
data (and also not caring about alignment). It may work, it may fail,
it depends on many things. But it's plain wrong. So this was replaced
for something better, simpler. No need for mask32bit() anymore, only
one call to U64() is needed.
And now -fsanitize=undefined is happy, so all is good.
We also restrict the input length to be multiple of 8 bits. I don't
think it's a problem. To be refined if I'm wrong. (I think RRC and
NAS messages are 8-bits aligned, so it shouldn't be a problem.)
It should not be > 0xffffff.
Normally the core network would prevent this case from happening.
Plus to reach this value means to send a lot of NAS messages, which
is very doubtful in practice.
Anyway, it's better to deal with the case.
We exit if that happens. To be refined if needed (very doubtful).
This function was very wrong, now it's just wrong.
(It does not sanitize the input properly. Some bad input may have
unexpected effects on the nrUE.)
It needs a serious rewrite.
I just wanted to "fix" it so that it processes correctly some
correct input data.
OAI core network is sending Deregistation Accept in clear, even
after security context activation.
The standards is not clear to me, so let's accept it.
To be removed if incorrect with respect to the standards.
(The core network will need to be fixed then.)
The version before this commit is wrong, taking wrong byte for msg_type
in some cases.
I don't have much time to implement a proper NAS PDU parser, so let's go
with hardcoded values.
Some later work will be done to have a cleaner solution. As of now, it's
too much work.
Get the security algorithms from SecurityModeCommand.
Restructure the code a bit: add the function handle_security_mode_command()
and adapt the code to use it.
Derive also knas_enc (not used yet).
Do the derivation for knas_enc and knas_int only after reception
of SecurityModeCommand. We need the algorithms configured by core
network to derive those keys.
Taking the example of the AMF Set ID, the previous version of the macro
used another macro to encode the number, then marked the last 6 bits in
the bit string (of length 16/2 bytes) as unused. This is wrong, because,
assuming AMF Set ID=3, it basically truncates the number by encoding all
16 bits and cutting off the last 6, like this:
------------------- encode 16 bits
0000 0000 0000 0011
------------ take these 10 bits
So what remains is these bit positions of the number:
(16,15,14,13,12,11,10,9,8,7) -- the last 6 bits are cut (and the first 6
are either 0 or garbage, because they don't exist).
Instead, manually encode bits (10,9,8,7,6,5,4,3) in the first byte, and
(2,1) in the second byte of the bit string, like so:
------------ encode 10 bits
0000 0000 1100 0000
------------ take these 10 bits
Do the same with the pointer.
The AMF Region ID above is correct, as it is exactly 8 bits.
By using a struct we may have warnings at compilation time in some
cases if the type is not used properly.
The type definition becomes a bit weird, so we need to properly
comment.
If too strange, we can revert to the classical "void" definition.
Guido Casati