Upon failure, the error message was saying that something failed (i.e.,
the reason), but not parameters of the getaddrinfo(). Simplify root
cause analysis by providing the parameters for the attempted
getaddrinfo() call.
This function is needed also in upcoming NGAP
libraries (i.e. N2 Handover) and therefore is moved
to the NGAP utilities file. The function converts
transport_layer_addr_t data struct to BIT_STRING_t
by copying the content of its members. The naming
is also updated to tnl_to_bitstring.
* Functions added:
decode_ngap_guami
decode_ngap_UEAggregateMaximumBitRate
decode_ngap_nssai
decode_ngap_security_capabilities
decode_ngap_mobility_restriction
* Adopt these functions in the common NGAP library
Enhance UE identity management in Initial UE Message and other NGAP improvements
This MR improves the Initial UE Message procedures by supporting simultaneous
presence of both 5G-S-TMSI and GUAMI. Previously, only one identity could be
used, leading to potential AMF selection failures. Now the presenceMask allows
both identities. The AMF selection is prioritizing GUAMI first, then falling
back to 5G-S-TMSI, and finally using PLMN or highest capacity.
Also, fix handling of selected PLMN identity in NGAP.
Refactoring:
- Select the AMF based on (1) absence of UE Identity (2) Presence of GUAMI
(3) Presence of 5G-S-TMSI
- Also refactored the AMF selection logic for better readability and reliability.
- Refactor and cleanup rrc_gNB_send_NGAP_NAS_FIRST_REQ
- Replace ngap_pdu_t with byte_array_t
- Add guami_t to ngran_types.h: refactor NGAP and RRC code to use one common
GUAMI type instead of two identical ones
Also:
- Bugfix in ngap_gNB_handle_ng_setup_response: use correct count for PLMNSupportList
Closes issue #801
GUAMI fields (Set ID, Pointer and Region ID) were decoded as Octet String,
however they are encoded as BIT STRING. Therefore, the GUAMI value was wrongly decoded.
In the AMF logs the AMF IDs are 1,1,1, however in gNB logs we had 1,64,4
Quick local test confirmed that:
---- TESTING AMF IDs = 1 ----
Region ID (OCTET STRING): 1
Region ID (BIT STRING): 1
Set ID (OCTET STRING): 64
Set ID (BIT STRING): 1
Pointer (OCTET STRING): 4
Pointer (BIT STRING): 1
The difference arises because:
- OCTET STRING treats the buffer as raw bytes, with all bits used.
- BIT STRING includes a `bits_unused` field, which tells how many padding bits
are present in the least significant end. This is especially important in
3GPP ASN.1 definitions like AMF Set ID (10 bits), AMF Region ID (8 bits),
AMF Pointer (6 bits), where the full byte(s) may contain unused bits that
must be masked out.
selectedPLMN-Identity IE in RRCSetupComplete is an Index (long) of the PLMN selected
by the UE from the plmn-IdentityInfoList (SIB1) (see 3GPP TS 38.331)
while
Selected PLMN Identity in NGAP INITIAL UE MESSAGE Indicates the selected PLMN
id for the non-3GPP access (PLMN Identity ID carrying MNC, MCC and MNC size,
9.2.5.1 3GPP TS 38.413)
The legacy code was setting Selected PLMN Identity in the latter to an ID
value as the former, however in NGAP the IE to be encoded is PLMN Identity 9.3.3.5
therefore:
* set plmn type plmn_id_t in ngap_nas_first_req_t
* check whether received selectedPLMN-Identity is within bounds
* select PLMN from gNB_RrcConfigurationReq by selectedPLMN-Identity ID
note: this commit is assuming that the plmn-IdentityInfoList in SIB1
is matching the PLMN list in gNB_RrcConfigurationReq
* in NGAP: store the PLMN in the NGAP UE context, no need to fetch the PLMN
in the NGAP instance since the UE context already tells what PLMN
was selected
Closes#801
* use bitmask to select presence of either 5G-S-TMSI or GUAMI
* select the AMF based on
(1) absence of UE Identity (2) Presence of GUAMI (3) Presence of 5G-S-TMSI
Related to #801
* add function to process AMF Identifier
* add function to select AMF
* set const parameters in utility nnsf functions
* adopt utilities for memory allocation
* improve readability and maintainability
* improve logging
ngap_pdu_t has the same definition as byte_array_t, so it is
replaced by the latter. This simplify the stack and reduces
duplicated code.
Also, add function create_byte_array to copy from an
existing buffer to a new byte_array_t and replaced
allocCopy with create_byte_array, and adopted
OCTET_STRING_fromBuf whenever possible.
The UE shall use the currently stored UL NAS count to derive the
KgNB. Hardcoding the UL count to 0 is wrong, if there is a reset
to be done it should be explicitly done elsewhere.
Closes#832
The Security Mode Command is the only NAS message sending a security header
type "integrity protected with new 5G NAS security context". Such header
type is indicating that there is no valid security context and it is
indicating the current one configured by the AMF.
When receiving a Security Mode Command the "AMF shall reset the downlink NAS COUNT"
and use it to integrity protect the initial Security Mode Command. "The AMF shall
send the SECURITY MODE COMMAND message unciphered, but shall integrity protect [...]
The AMF shall set the security header type of the message to
"integrity protected with new 5G NAS security context".
See 5.4.2.2 3GPP TS 24.501.
This commit is ensuring the NAS DL count is reset when the relevant security header
is received. Also, the security container is deleted since no more valid and
NAS_SECURITY_NO_SECURITY_CONTEXT is returned. The setup of the new security context
is done by "handle_security_mode_command",
NAS 3GPP TS 24.501 clause 4.4.4.2 specify which NAS messages
are an exception to the integrity protection. All the other
scenarios are expected to be integrity protected. The
nas_security_rx_process function is returning:
1) NAS_SECURITY_NO_SECURITY_CONTEXT if no security context is established
2) NAS_SECURITY_UNPROTECTED for the messages listed in 4.4.4.2
3) NAS_SECURITY_INTEGRITY_PASSED if the integrity check is successful
These 3 results can be all considered successful. The other not.
Also, add a function to check whether a message is allowed to be
integrity unprotected, as per clause 4.2.2.2.
* trigger Identity Response callback from the handler
* process decoded message
According to 4.4.4.2 3GPP TS 24.501, Identity Request
with Identity Type SUCI is not expected to be
integrity protected.
The information about the payload carried by NAS DOWNLINK is helpful
in the logging and also for debugging purposes, therefore it was
added in this commit by enabling the already existing relevant function.
This commit restores the behaviour before the changes introduced in 611c0554. The NAS
Deregistration Accept message is unprotected, therefore the function will return
NAS_SECURITY_UNPROTECTED that would then be considered as NAS_SECURITY_INTEGRITY_PASSED
Unprotected message have a plain header of 3 octets, however security protected messages
have a 7 octets header.
This change adds lengths checks to the received registration reject
message and also performs a bounds check for the received cause.
Since the cause is not checked, any string in the memory can be
dereferenced, possibly leading to DoS.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
The change addresses the SM message type retrieval for DL NAS Transport
messages. The assumption of an offset 17 = 7 (MM Sec) + 3 (MM Plain) + 1
(IEI) + 2 (Len) + 4 (SM) is correct.
However, if the DL NAS Transport is received in a plain header, the
lengths would not add up anymore. (This is not complying with the
standard, so not allowed, but possible). The check for the length is
necessary to not process arbitrary memory contents beyond the
`pdu_buffer`.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
Add 5GMM Authentication Failure enc/dec lib and unit test
This MR is introducing the 5GMM Authentication Failure message library as per
8.2.4 of 3GPP TS 24.501. This message is sent from UE to network under certain
conditions. The message is also introduced in stack and is send if the received
ngKSI already in use.
- add new library for 5GMM Authentication Failure enc/dec and unit test
- introduce handler and generate function for NAS Authentication Failure
store ngKSI
- send Authentication Failure if ngKSI is already associated with one of
the 5G security contexts stored in the UE
Closes#852
Follow up on NAS Registration Accept lib
This MR is a follow up on !2984 (merged).
The goal is to enhance the NAS Registration Accept lib:
- Add regression test for NAS Registration Accept: the goal of this test is to
prevent on the decoding of the NAS Registration Accept sent by the OAI CN5G
- Add equality check and free utility functions to NAS Registration Accept
library
- Free NAS Registration Accept after use: heap memory is allocated for this
message during decoding and shall be free after processing
- Remove harcoded Slice Differentiator (SD) in NAS decode_nssai_ie and update
the processing logic: The SD stored in the allowed S-NSSAI list was hardcoded
in the decoding function, however this IE is not mandatory but optional.
Therefore, the check of the decoded message contents should take into account
the presence of the field in the received message and in that scenario, check
the stored value against the one from the UICC. If no SD was received, consider
the UICC SD a valid one.
- Cleanup and other fixes to decode_registration_accept: (1) adopt byte array
(2) move registration result enc/dec to registration accept library (3) check
on buffer lengths (4) add defines whenever necessary (5) simplify the code
fix IP address in 4G UE
The following error was appearing when running LTE UE:
inet_pton(): cannot convert -64.-74.0.2 to IPv4 network address
The allocated address by the core actually is 192.182.0.2.
On my host "char" is signed, leading to the above error (192 and 182
are seen as signed).
Let's force "ip_addr" unsigned and everyone is happy.
Cleanup and refactor initial gNB configuration
This is follow-up on !3048 (merged). Major changes in this MR:
- Add config functions to reduce redundant code repeated in multiple places in the file
- Add macros to reduce redundant code in gNB configuration
- Refactor RCconfig_NR_NG
- Cleanup obsolete and commented out code
- Refactor includes in executables/nr-gnb.c
- Introduce platform type plmn_id_t for consistency across the stack: F1AP, NGAP can now use the same struct type
- And other minor formatting
The following error was appearing when running LTE UE:
inet_pton(): cannot convert -64.-74.0.2 to IPv4 network address
The allocated address by the core actually is 192.182.0.2.
On my host "char" is signed, leading to the above error (192 and 182
are seen as signed).
Let's force "ip_addr" unsigned and everyone is happy.
This commit refactors the TUN interface management by moving its creation
and configuration from the PDCP layer to the SDAP layer for UE.
Key changes include:
- Introduced `tun_generate_ue_ifname` and `tun_destroy` functions for better
TUN interface lifecycle management.
- Added support for creating and destroying UE-specific TUN interfaces in SDAP.
- Refactored `nr_pdcp_module_init` to remove TUN-related logic and moved it
to SDAP.
- Updated NAS and SDAP layers to handle PDU session-specific TUN interface
creation and configuration.
- Enhanced SDAP entity management to include TUN socket handling and thread
lifecycle.
- Updated NAS message handling to initialize default PDU session TUN
interfaces in NOS1 mode.
- Use a single SDAP thread function for gNB and UE
- Allow noS1 mode also in SA on gNB
These changes improve modularity by isolating TUN interface management within
the SDAP layer, aligning with the 3GPP architecture, and simplifying the PDCP
layer.
Co-Authored-By: Robert Schmidt <robert.schmidt@openairinterface.org>
This test verifies that a NAS Registration Accept message, as received
from the OAI CN5G, is correctly decoded and matches the expected output
structure. It ensures that future changes to the NAS decoder do not
break compatibility or correctness with existing decoding behavior.
The SD stored in the allowed S-NSSAI list was hardcoded in the decoding
function, however this IE is not mandatory but optional, therefore
the check of the decoded message contents should take into account
this and check the stored value against the one from the UICC only when the field is present.
If no SD was received, consider the UICC SD a valid one.
Also, add free function to Registration Accept library and adopt in stack to free NAS
Registration Accept after use: heap memory is allocated for this message during decoding
and shall be free after processing.
Encapsulate the asn1c call from cmake in a cmake function run_asn1c().
As a notable change to the previous manual add_custom_command()
invocation, in suppresses the output of asn1c by default [1] and stores
it in a log file. In case of asn1c4 error, the output will output on
stdout.
Use the new run_asn1c() in all occasions for code generation.
[1] it is quite verbose, with many warnings that we cannot influence nor
suppress, and lists all generated files which is verified by the build
system automatically, anyway.
Guido Casati