Integration: `2025.w24`
Closes#965
See merge request oai/openairinterface5g!3476
* !3354 Preparation Work for N2 Handover
* !3383 Add configurable values of NR RLC and NR PDCP to the configuration file
* !3468 Resolve "SSB frequency at gnb.sa.band78.fr1.24PRB.usrpb210.conf is invalid"
* !3466 YAML related updates
* !3460 SRS configuration
* !3474 Fix AMF selection fallback by PLMN ID when no UE identity is present or matching
* !3473 Fix various bugs and inconsistencies in config read, SCTP, ITTI, GTP
* !3169 NR RU improvements for analog beamforming
* !3456 CI: update config for AW2S pipeline
* !3369 Add Security Mode Reject lib/unit test and adopt in stack
* !3457 Fix NR reestablishment
* !3412 [E2 agent] E2AP README update and OAI-FlexRIC CI pipeline improvements
[E2 agent] E2AP README update and OAI-FlexRIC CI pipeline improvements
- E2AP README - add OSC nearRT-RIC section; update with proper FlexRIC
links, and explanations on prerequisites, as well as for xApps
- OAI-FlexRIC CI - use separate containers for xApps
- add reference files for CU-UP/CU-CP
- add logging for KPM NSSAI condition
Fix NR reestablishment by implementing the "DRB-suspend" at the MAC.
This means that the during reestablishment, gNB MAC discards received
DRB packets, and does not schedule DRB. Fix a couple of additional
issues in reestablishment. # Please enter a commit message to explain
why this merge is necessary,
For additional information, see
https://gitlab.eurecom.fr/oai/openairinterface5g/-/merge_requests/2668#note_119369
The spCellConfig is to be dropped during reestablishment and to be
applied after reconfiguration. Implement this using the
RRCReconfigurationComplete acknowledgment from the CU to the DU,
applying the spCellConfig if present (which signals a prior
reestablishment). Remove a prior flag that is not needed anymore, and
do not "guess" when is the reconfiguration, because it is now handled in
the case of the ack.
The spCellConfig is not relevant as long as we use a common search space
for DCIs (and the activation of dedicated search space happens after
applying spCellConfig). For PUCCH, there is the PDSCH transmission of
RRCReconfiguration which gets ack'ed in the default PUCCH.
RRCReconfigurationComplete is sent in PUSCH (again through common
search space). In theory, there cannot be another PUCCH before the
application of spCellConfig, as all bearers are still suspended, and
there should not be another SRB1 transmission in the meantime, as only
one RRC transaction can be active at a time.
Co-authored-by: francescomani <email@francescomani.it>
Add a flag for each RB that tracks suspension state. Mark all RBs
(except SRB1) as suspended on reestablishment, and de-suspend on
reconfiguration. Only check RLC status for non-suspended RBs. For UL
data traffic, check that DRB/SRB2 exist (SRB1 should be there as soon as
the UE context exists).
Add Security Mode Reject lib/unit test and adopt in stack
This MR is adding the library for the NAS Security Mode Reject, and
relevant unit test.
The UE shall send a SECURITY MODE REJECT containing a 5GMM cause that
typically indicates one of the following cause values: (23) UE security
capabilities mismatch. (24) security mode rejected, unspecified
- The message shall be protected if a security context is available.
- The message is adopted in the handling of Security Mode Command failure.
See 3GPP TS 24.501 5.4.2.5 "NAS security mode command not accepted by
the UE".
This MR includes changes from !3262:
> This patch series addresses a security issue where the UE improperly
> accepts a Security Mode Command (SMC) without an authentication header
> (Security Header 0). This behavior violates TS 24.501 and enables an
> attacker to bypass authentication, set integrity protection to NULL
> (NIA0), and reconfigure the UE without proper verification.
>
> We identified the following issues:
>
> 1. The UE currently accepts unauthenticated SMC messages, even
> allowing NIA0 and EIA0 to be set outside emergency mode.
> 2. When applying NIA0, the MAC field remains uninitialized,
> consistently containing the sequence 0xFF3F0000, making it feasible
> to bypass authentication and enforce insecure configurations.
> 3. The UE does not properly signal security mode failures to the Core
> Network.
>
> This patch series tries to address the above-mentioned issues:
>
> 1. Reject unauthenticated SMC messages, enforcing the requirement that
> they must be integrity-protected.
> 2. Validate MAC before applying security settings, ensuring that only
> authenticated messages are accepted.
> 3. Tear down the security context if an integrity check fails.
> 4. Introduce the Security Mode Reject message to inform the Core
> Network of failed SMC procedures, as required by TS 24.501.
This change performs the algorithm rejection in the corresponding NAS
handler for 5G, since the protocol definitions differ between LTE and
5G, regarding NIA0/EIA0 user plane traffic.
Therefore, for 5G NIA0 is rejected, since it is not allowed under normal
circumstances, while LTE user plane traffic can indeed have EIA0
selected.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
It is not allowed to accept an unauthenticated SMC message,
as this effectively bypasses all security measures and
enables a malicioius attacker to compromise the confidentiality
and integrity of exchanged messages.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
Co-authored-by: Guido Casati <hello@guidocasati.com>
Retrieving the mac is necessary during the handling of the SMC, since the
context is generated from the specified keys therein. Therefore, it is
necessary to check the MAC right after generation and ensure the authenticity
of the message. If it is not given, the message must be rejected.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
Co-authored-by: Guido Casati <hello@guidocasati.com>
This is necessary to indicate to the Core network, that
the security mode command procedure has failed.
Check for the security context presence when generating the Security Mode
reject message: according to 3GPP TS 24.501 5.4.2.5 "NAS security mode command
not accepted by the UE" The UE shall send a SECURITY MODE REJECT containing
a 5GMM cause that typically indicates one of the following cause values:
(23) UE security capabilities mismatch
(24) security mode rejected, unspecified
The message shall be protected if a security context is available
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
Co-authored-by: Guido Casati <hello@guidocasati.com>
This 5GMM message is required for an invalid security mode command,
e.g. when the MAC integrity fails, or the wrong Security Header is set.
* Add encode/decode functions for common IEs in fgmm_lib: this library
provides encoding/decoding helpers for IEs shared across multiple
NAS messages. The goal is to avoid the legacy approach of creating
separate files per IE
* add NAS Cause enc/dec lib
* Adopted byte_array_t to handle the buffer
Co-authored-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
Fix various bugs and inconsistencies in config read, SCTP, ITTI, GTP
Fix bugs across various layers, mostly layer 3, including memory leaks.
See the commits for more details.
Fix AMF selection fallback by PLMN ID when no UE identity is present or matching
If a mask is present (i.e., not zero), AMF selection by PLMN ID may
still fail, causing the AMF selection process to skip the fallback
option, i.e. selection by PLMN ID, when no UE identity is available or
when no match is found.
This MR adds also warnings in case there's a match for the AMF is not
found.
SRS configuration
- Fix segmentation fault, a memory leak, and LOGs for SRS usage
NFAPI_NR_SRS_BEAMMANAGEMENT
- Refactor SRS configuration;
- Add SRS ResourceSet to get the SNR measurements at MAC layer
In this MR we have 2 SRS ResourceSet, for the same SRS Resource. This
way, in addition to obtaining the UL-RI, we also obtain the SNR in the
MAC and fill the PRB Black list.
This branch has been tested with COTS UE and with RFSim. The measured
values seem correct.
Using the USIM interface in the MAC is non-sensical (violates layer
separation). Add header include in nr-softmodem.c, which previously came
through nr_mac_gNB.h -> usim_interface.h.
Avoid leaking memory upon failed socket binding by calling
freeaddrinfo() before exiting in error cases.
Fixes leak:
Direct leak of 64 byte(s) in 1 object(s) allocated from:
#0 0x0000004ac038 in malloc (/home/richie/oai/cmake_targets/ran_build/build/nr-softmodem+0x4ac038) (BuildId: 875d6e5bc54d7c89bdcf151452f12703cb6fd110)
#1 0x7f0fdd92e2a6 in getaddrinfo (/lib64/libc.so.6+0x1202a6) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#2 0x00000043d7ad in getaddrinfo (/home/richie/oai/cmake_targets/ran_build/build/nr-softmodem+0x43d7ad) (BuildId: 875d6e5bc54d7c89bdcf151452f12703cb6fd110)
#3 0x000000700c73 in udpServerSocket(openAddr_s) /home/richie/oai/openair3/ocp-gtpu/gtp_itf.cpp:486:17
#4 0x000000700c73 in gtpv1Init /home/richie/oai/openair3/ocp-gtpu/gtp_itf.cpp:546:10
#5 0x000000c692b8 in cuup_init_n3 /home/richie/oai/openair2/E1AP/e1ap.c:744:61
#6 0x000000549ea1 in create_gNB_tasks /home/richie/oai/executables/nr-softmodem.c:320:7
#7 0x000000549ea1 in main /home/richie/oai/executables/nr-softmodem.c:619:15
#8 0x7f0fdd8115f4 in __libc_start_call_main (/lib64/libc.so.6+0x35f4) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#9 0x7f0fdd8116a7 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x36a7) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#10 0x000000408524 in _start (/home/richie/oai/cmake_targets/ran_build/build/nr-softmodem+0x408524) (BuildId: 875d6e5bc54d7c89bdcf151452f12703cb6fd110)
This printf just shows which config sections are being read, but this
has no useful information for a user. It was introduced in 7731f5bd2d
but was not present prior to this commit, either.
YAML related updates
- Add common function config_common_getdefault
- Handle exceptions from the yaml-cpp library, transform them into
understandable errors written to stderr
- Add some unit tests.
Add configurable values of NR RLC and NR PDCP to the configuration file
This is for the gNB (the UE gets the values from the gNB).
The physical simulators were also adapted (we put the previously
hardcoded values that were everywhere in the code into the simulators
themselves). I don't think we need to have those values configurable for
the simulators, but I can study the possibility to add this if someone
tells me it's important (if not important I prefer not to do it, I am
not sure if it is trivial to do or not).
Preparation Work for N2 Handover
This MR introduces preliminary improvements to support !3334.
Refactored utility NGAP functions
- Moved allocAddrCopy to NGAP utilities
Decoding Functions for NGAP IEs:
- Added common decoding functions (decode_ngap_guami,
decode_ngap_UEAggregateMaximumBitRate, decode_ngap_nssai, etc.)
- Adopted these functions across the NGAP stack
Improvements to RRC and Handover Handling:
- Enhanced get_neighbour_cell_information and get_neighbour_config to
differentiate input parameters (cell by NR Cell ID vs. gNB by PCI)
- Used byte_array_t in nr_initiate_handover
- Introduced RRCReconfigurationParams_t to structure RRCReconfiguration
IEs
- Added a function to build NR_RRCReconfiguration_IEs_t
- Adopted this approach in do_RRCReconfiguration and refactored the
function
- Refactored the handling of Dedicated NAS message list
- Add masterKeyUpdate handling in RRCReconfiguration generation
PDCP Re-Establishment Improvements:
- Enabled PDCP re-establishment for SRB1/SRB2 based on a bitmap in
createSRBlist (3GPP TS 38.331 RadioBearerConfig)
NH & KgNB Key Management:
- Added NH derivation function as per 3GPP TS 33.501 A.10
- Moved KgNB derivation function to key_nas_deriver utilities
Add the ability to pack/unpack 2 new TLVs for analog beamforming
total_num_beams_vendor_ext and analog_beam_list
Add the unpack related changes for the first 2 vendor extension TLVs introduced related to beamforming.
For the moment the packing is guarded by an Assert to ensure it is not used.
Add the necessary utility function changes to support these VE TLVs
Add the necessary changes to the corresponding unitary test for pack/unpack,
commented for the moment, since the packing is disabled with an Assert.
The mask could be present, .e.g not zero, but the selection of the AMF could
fail. This would lead to a skipping the selection of the AMF by PLMN ID,
which is the last option when no UE identity is present and/or matching.
Free memory allocated in NGAP after use in RRC.
Direct leak of 29 byte(s) in 1 object(s) allocated from:
> #0 0x7f11200b4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
> #1 0x558b7fcd0137 in malloc_or_fail /n2-handover-preparation/common/utils/utils.h:86
> #2 0x558b7fcd0137 in create_byte_array /n2-handover-preparation/common/utils/ds/byte_array.c:32
> #3 0x558b7fdb7a5c in rrc_gNB_send_NGAP_NAS_FIRST_REQ /n2-handover-preparation/openair2/RRC/NR/rrc_gNB_NGAP.c:183
> #4 0x558b7fd2ab30 in rrc_gNB_process_RRCSetupComplete /n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:439
> #5 0x558b7fd2ab30 in handle_rrcSetupComplete /n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:1715
> #6 0x558b7fd63e23 in rrc_gNB_decode_dcch /n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:1851
> #7 0x558b7fd8b4c3 in rrc_gnb_task /n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2718
> #8 0x7f111ea94ac2 in start_thread nptl/pthread_create.c:442
ASN_SEQUENCE_ADD is calling realloc which is allocating memory for the
'array' which was not freed.
> Direct leak of 32 byte(s) in 1 object(s) allocated from:
> #0 0x7ce97deb4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
> #1 0x5813fba02574 in asn_set_add /openairinterface5g/n2-handover-preparation/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/asn_SET_OF.c:27
> #2 0x5813faf6c672 in createSRBlist /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:331
> #3 0x5813faf9aa78 in rrc_gNB_generate_RRCSetup /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:421
> #4 0x5813fafba2ee in rrc_handle_RRCSetupRequest /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:1243
> #5 0x5813fafba2ee in rrc_gNB_process_initial_ul_rrc_message /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2019
> #6 0x5813fafcdc3a in rrc_gnb_task /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2761
> #7 0x7ce97c894ac2 in start_thread nptl/pthread_create.c:442
> Direct leak of 32 byte(s) in 1 object(s) allocated from:
> #0 0x7ce97deb4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
> #1 0x5813fba02574 in asn_set_add /openairinterface5g/n2-handover-preparation/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/asn_SET_OF.c:27
> #2 0x5813faf6c672 in createSRBlist /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:331
> #3 0x5813faf7d89d in get_RRCReconfiguration_params /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:660
> #4 0x5813faf914b3 in rrc_gNB_generate_dedicatedRRCReconfiguration /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:716
> #5 0x5813faf96856 in rrc_CU_process_ue_context_setup_response /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2190
> #6 0x5813fafcd3ed in rrc_gnb_task /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2796
> #7 0x7ce97c894ac2 in start_thread nptl/pthread_create.c:442
Robert Schmidt