A maximum RRC buffer size of 1024 might be very small. We should
increase it, but then the 5G RRC_BUF_SIZE does conflict with other
definitions. To make it unique, also rename to NR_RRC_BUF_SIZE.
Pass consistently the NR_timer_t object through a pointer. Since we have
to modify all occurrences of is_nr_timer_active(), we use that occasion
and rename that function to nr_timer_is_active() to make it consistent
with all other functions, starting with nr_timer.
* Data buffer for NAS Registration Complete and Authentication Response is malloced in
the NAS thread and transfered with ITTI message to RRC, where needs to be freed
Direct leak of 24 byte(s) in 1 object(s) allocated from:
>0 0x7ffff74b4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
>1 0x5555572b0607 in generateAuthenticationResp /repo/openairinterface5g/develop/openair3/NAS/NR_UE/nr_nas_msg_sim.c:608
>2 0x5555572b0607 in nas_nrue /repo/openairinterface5g/develop/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1402
>3 0x5555572baef6 in nas_nrue_task /repo/openairinterface5g/develop/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1198
>4 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
Direct leak of 10 byte(s) in 1 object(s) allocated from:
>0 0x7ffff74b4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
>1 0x55555729754e in generateRegistrationComplete /repo/openairinterface5g/develop/openair3/NAS/NR_UE/nr_nas_msg_sim.c:782
>2 0x555557299ad3 in handle_registration_accept /repo/openairinterface5g/develop/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1212
>3 0x5555572b06a0 in nas_nrue /repo/openairinterface5g/develop/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1411
>4 0x5555572baef6 in nas_nrue_task /repo/openairinterface5g/develop/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1198
>5 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
- Save nas instance id in nr_ue_nas_t and use that for instance determination.
- Use correct field in itti message (destinationInstance instead of originInstance) to determine instance
- Make sure both destinationInstance and originInstance fields are correct in NAS interface functions.
* buffer is allocated but not freed after use by PDCP
> Direct leak of 192 byte(s) in 3 object(s) allocated from:
> 0 0x7ffff74b4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
> 1 0x55555775ee74 in encode_dyn_cb /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/per_encoder.c:23
> 2 0x55555774776e in _uper_encode_flush_outp /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:126
> 3 0x55555774776e in uper_encode /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:36
> 4 0x555557747c91 in uper_encode_to_new_buffer /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:85
> 5 0x5555576c5172 in do_NR_ULInformationTransfer /openair2/RRC/NR/MESSAGES/asn1_msg.c:965
> 6 0x555556fba691 in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:1819
> 7 0x555556fc4d2e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:1717
> 8 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
* bcch_message is malloced by ASN.1 decoder and needs to be always freed after use along with its contents
> Direct leak of 64 byte(s) in 1 object(s) allocated from:
>0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
>1 0x555557737ecd in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:37
>2 0x555557746f81 in uper_decode /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_decoder.c:83
>3 0x5555577471fe in uper_decode_complete /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_decoder.c:16
>4 0x555556f8b1c9 in nr_rrc_ue_decode_NR_BCCH_DL_SCH_Message /openair2/RRC/NR_UE/rrc_UE.c:732
>5 0x555556fbc365 in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:1775
>6 0x555556fc4c2e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:1718
>7 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
* local dl_dcch_msg shall be freed after use
> Direct leak of 384 byte(s) in 6 object(s) allocated from:
>0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
>1 0x555557737ced in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:37
>2 0x555557746da1 in uper_decode /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_decoder.c:83
>3 0x555556fa4b31 in nr_rrc_ue_decode_dcch /openair2/RRC/NR_UE/rrc_UE.c:1612
>4 0x555556fbb25c in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:1792
>5 0x555556fc4a4e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:1718
>6 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
* The RRC task is freeing the ITTI message but the message members that are allocated separetely still need to be freed
> Direct leak of 470 byte(s) in 6 object(s) allocated from:
>0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
>1 0x55555721f117 in itti_malloc /common/utils/ocp_itti/intertask_interface.cpp:64
>2 0x555556f2356c in deliver_sdu_srb /openair2/LAYER2/nr_pdcp/nr_pdcp_oai_api.c:775
>3 0x555556f4e10e in nr_pdcp_entity_recv_pdu /openair2/LAYER2/nr_pdcp/nr_pdcp_entity.c:184
>4 0x555556f278ad in do_pdcp_data_ind /openair2/LAYER2/nr_pdcp/nr_pdcp_oai_api.c:285
>5 0x555556f278ad in pdcp_data_ind_thread /openair2/LAYER2/nr_pdcp/nr_pdcp_oai_api.c:307
>6 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
* allocate memory in heap for the struct ue_CapabilityRAT_Container used locally for buffer encoding
* free the struct members only for the ul_dcch_msg allocated on the stack
> Direct leak of 40 byte(s) in 1 object(s) allocated from:
> 0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
> 1 0x555556f7a89f in nr_rrc_ue_process_ueCapabilityEnquiry /openair2/RRC/NR_UE/rrc_UE.c:1861
> 2 0x555556fa4d85 in nr_rrc_ue_decode_dcch /openair2/RRC/NR_UE/rrc_UE.c:1650
> 3 0x555556fbb33c in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:1790
> 4 0x555556fc4b2e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:1716
> 5 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
- make it work for SRB or DRB
- adapt callers of this function
- cleanup key derivation: the User Plane keys are generated at some places
but are not used, remove the generation
The starting point was the function do_NR_DLInformationTransfer() which
may deal with more than 256 bytes.
Then why not cleanup all the functions in the same file.
(And do a bit of formattting fixing while we're here.)
Then cleanup the callers of those functions.
Then, because of do_SIB23_NR() let's also cleanup in some
structures.
Not all the codebase was cleaned up, there surely remain some uint8_t
(and char/short/uint16_t) which are wrong.
Introduce the structure nr_pdcp_integrity_data_t and adapt code to use it.
Note: in nr_pdcp_sdu_t we keep the 'count' variable (which is also present
in nr_pdcp_integrity_data_t). They represent the same value, but 'count'
in nr_pdcp_integrity_data_t is to be specifically used for integrity while
the other one has other uses, so it's better to keep it.
The case securityModeFailure didn't seem to be implemented
properly, so I just removed it entirely.
The variable 'securityMode' did not make much sense, removed as well.
Plus for integrity, there was: securityMode |= 1 << 5 for nea1
and << 6 for nea2, which does not seem correct (I would expect << 4
and << 5 respectively), so it was properly incorrect.
'securityModeCommand->criticalExtensions.choice.securityModeCommand'
was accessed before checking that
'securityModeCommand->criticalExtensions.present'
is 'NR_SecurityModeCommand__criticalExtensions_PR_securityModeCommand',
which is wrong.
The tests 'securityMode >= NO_SECURITY_MODE' and 'securityMode != 0xff'
don't make sense/are unclear, so removed too.
So let's simplify this function, wrong in several places. And put
some AssertFatal() so that the code won't do weird things. The
AssertFatal() can be removed later and the function improved later
if needed. The case securityModeFailure can also be handled later,
but I think there is more work to do than just encoding the message
and send it to the gNB, so it's not bad to remove it for the moment.
The use of security_mode_completed in the PDCP entity was a hack.
Plus it was not working at all with the deregistration request
when nea2 is used, sent when doing ctrl+c in the nrUE.
So let's remove it.
And let's handle activation of integrity and ciphering more in
accordance with what 38.331 says. SecurityModeComplete has to
be sent integrity protected, but not ciphered. Only after should
the ciphering be activated. (See 38.331 5.3.4.3.)
Laurent THOMAS