Osmocom Open Build Service

Changes of Revision 27

open5gs_2.7.6.dsc -> open5gs_2.7.7.dsc Changed

@@ -2,7 +2,7 @@
 Source: open5gs
 Binary: open5gs-common, open5gs-mme, open5gs-sgwc, open5gs-smf, open5gs-amf, open5gs-sgwu, open5gs-upf, open5gs-hss, open5gs-pcrf, open5gs-nrf, open5gs-scp, open5gs-sepp, open5gs-ausf, open5gs-udm, open5gs-pcf, open5gs-nssf, open5gs-bsf, open5gs-udr, open5gs, open5gs-dbg
 Architecture: any
-Version: 2.7.6
+Version: 2.7.7
 Maintainer: Harald Welte <laforge@gnumonks.org>
 Uploaders: Sukchan Lee <acetcom@gmail.com>
 Homepage: https://open5gs.org
@@ -32,8 +32,8 @@
  open5gs-udr deb net optional arch=any
  open5gs-upf deb net optional arch=any
 Checksums-Sha1:
- 49912f74beb3e8889e2cf7c526503a1d31948a41 14540076 open5gs_2.7.6.tar.xz
+ f40e763fa9fca8df7d61e83ae162fa2b848210e5 15135584 open5gs_2.7.7.tar.xz
 Checksums-Sha256:
- 5334ed63073cced86ecd63ddc015df48706cbe1d808e2a6e0893d578fcdf6d49 14540076 open5gs_2.7.6.tar.xz
+ 6b5cddeb0d44bae891b90a5c12017b7b15cef82d0139a70b3b056dde4ba1eed0 15135584 open5gs_2.7.7.tar.xz
 Files:
- 4c16b1e03d884aa35e7499c4d2f19f71 14540076 open5gs_2.7.6.tar.xz
+ 58da00226b22692369d1bbec8df3b83f 15135584 open5gs_2.7.7.tar.xz

open5gs_2.7.6.tar.xz/.tarball-version -> open5gs_2.7.7.tar.xz/.tarball-version Changed

open5gs_2.7.6.tar.xz/README.md -> open5gs_2.7.7.tar.xz/README.md Changed

open5gs_2.7.7.tar.xz/configs/examples/5gc-no-scp-sepp1-999-70.yaml.in Added

@@ -0,0 +1,530 @@
+db_uri: mongodb://localhost/open5gs
+
+logger:
+
+global:
+  parameter:
+#    no_nrf: true
+    no_scp: true
+#    no_sepp: true
+#    no_amf: true
+#    no_smf: true
+#    no_upf: true
+#    no_ausf: true
+#    no_udm: true
+#    no_pcf: true
+#    no_nssf: true
+#    no_bsf: true
+#    no_udr: true
+    no_mme: true
+    no_sgwc: true
+    no_sgwu: true
+    no_pcrf: true
+    no_hss: true
+
+mme:
+  freeDiameter:
+    identity: mme.localdomain
+    realm: localdomain
+    listen_on: 127.0.1.2
+    no_fwd: true
+    load_extension:
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dbg_msg_dumps.fdx
+        conf: 0x8888
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_rfc5777.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_mip6i.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nasreq.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nas_mipv6.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca_3gpp/dict_dcca_3gpp.fdx
+    connect:
+      - identity: hss.localdomain
+        address: 127.0.1.8
+
+  s1ap:
+    server:
+      - address: 127.0.1.2
+  gtpc:
+    server:
+      - address: 127.0.1.2
+    client:
+      sgwc:
+        - address: 127.0.1.3
+      smf:
+        - address: 127.0.1.4
+  metrics:
+    server:
+      - address: 127.0.1.2
+        port: 9090
+  gummei:
+    - plmn_id:
+        mcc: 999
+        mnc: 70
+      mme_gid: 2
+      mme_code: 1
+  tai:
+    - plmn_id:
+        mcc: 999
+        mnc: 70
+      tac: 1
+  security:
+    integrity_order :  EIA2, EIA1, EIA0 
+    ciphering_order :  EEA0, EEA1, EEA2 
+  network_name:
+    full: Open5GS
+  time:
+    t3412:
+      value: 3240
+
+sgwc:
+  gtpc:
+    server:
+      - address: 127.0.1.3
+  pfcp:
+    server:
+      - address: 127.0.1.3
+    client:
+      sgwu:
+        - address: 127.0.1.6
+
+smf:
+  sbi:
+    server:
+#      - address: 127.0.1.4
+#        port: 7777
+      - address: smf.5gc.mnc070.mcc999.3gppnetwork.org
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc070.mcc999.3gppnetwork.org
+  pfcp:
+    server:
+      - address: 127.0.1.4
+    client:
+      upf:
+        - address: 127.0.1.7
+  gtpc:
+    server:
+      - address: 127.0.1.4
+  gtpu:
+    server:
+      - address: 127.0.1.4
+  metrics:
+    server:
+      - address: 127.0.1.4
+        port: 9090
+  session:
+    - subnet: 10.45.0.0/16
+      gateway: 10.45.0.1
+    - subnet: 2001:db8:cafe::/48
+      gateway: 2001:db8:cafe::1
+  dns:
+    - 8.8.8.8
+    - 8.8.4.4
+    - 2001:4860:4860::8888
+    - 2001:4860:4860::8844
+  mtu: 1400
+  freeDiameter:
+    identity: smf.localdomain
+    realm: localdomain
+    listen_on: 127.0.1.4
+    no_fwd: true
+    load_extension:
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dbg_msg_dumps.fdx
+        conf: 0x8888
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_rfc5777.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_mip6i.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nasreq.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nas_mipv6.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca_3gpp/dict_dcca_3gpp.fdx
+    connect:
+      - identity: pcrf.localdomain
+        address: 127.0.1.9
+
+amf:
+  sbi:
+    server:
+      - address: 127.0.1.5
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc070.mcc999.3gppnetwork.org
+  ngap:
+    server:
+      - address: 127.0.1.5
+  metrics:
+    server:
+      - address: 127.0.1.5
+        port: 9090
+  access_control:
+    - plmn_id:
+        mcc: 999
+        mnc: 70
+    - plmn_id:
+        mcc: 001
+        mnc: 01
+    - plmn_id:
+        mcc: 315
+        mnc: 010
+  guami:
+    - plmn_id:
+        mcc: 999
+        mnc: 70
+      amf_id:
+        region: 2
+        set: 1
+  tai:
+    - plmn_id:
+        mcc: 999
+        mnc: 70
+      tac: 1
+  plmn_support:
+    - plmn_id:
+        mcc: 999
+        mnc: 70
+      s_nssai:
+        - sst: 1
+  security:
+    integrity_order :  NIA2, NIA1, NIA0 
+    ciphering_order :  NEA0, NEA1, NEA2 
+  network_name:
+    full: Open5GS
+  amf_name: open5gs-amf0
+  time:
+    t3512:
+      value: 540     # 9 mintues * 60 = 540 seconds
+
+sgwu:
+  pfcp:
+    server:
+      - address: 127.0.1.6
+  gtpu:
+    server:
+      - address: 127.0.1.6
+
+upf:
+  pfcp:
+    server:
+      - address: 127.0.1.7
+  gtpu:
+    server:
+      - address: 127.0.1.7
+  session:
+    - subnet: 10.45.0.0/16
+      gateway: 10.45.0.1
+    - subnet: 2001:db8:cafe::/48
+      gateway: 2001:db8:cafe::1
+  metrics:
+    server:
+      - address: 127.0.1.7
+        port: 9090
+
+hss:
+  freeDiameter:
+    identity: hss.localdomain
+    realm: localdomain
+    listen_on: 127.0.1.8
+    no_fwd: true
+    load_extension:
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dbg_msg_dumps.fdx
+        conf: 0x8888
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_rfc5777.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_mip6i.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nasreq.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nas_mipv6.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca_3gpp/dict_dcca_3gpp.fdx
+    connect:
+      - identity: mme.localdomain
+        address: 127.0.1.2
+pcrf:
+  freeDiameter:
+    identity: pcrf.localdomain
+    realm: localdomain
+    listen_on: 127.0.1.9
+    no_fwd: true
+    load_extension:
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dbg_msg_dumps.fdx
+        conf: 0x8888
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_rfc5777.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_mip6i.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nasreq.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nas_mipv6.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca_3gpp/dict_dcca_3gpp.fdx
+    connect:
+      - identity: smf.localdomain
+        address: 127.0.1.4
+
+nrf:
+  serving:
+    - plmn_id:
+        mcc: 999
+        mnc: 70
+  sbi:
+    server:
+#      - address: 127.0.1.10
+#        port: 7777
+      - address: nrf.5gc.mnc070.mcc999.3gppnetwork.org
+
+sepp:
+  default:
+    tls:
+      server:
+        private_key: @build_configs_dir@/open5gs/tls/sepp1.key
+        cert: @build_configs_dir@/open5gs/tls/sepp1.crt
+      client:
+        cacert: @build_configs_dir@/open5gs/tls/ca.crt
+  sbi:
+    server:
+      - address: 127.0.1.250
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc070.mcc999.3gppnetwork.org
+  n32:
+    server:
+      - sender: sepp1.localdomain
+        address: 127.0.1.251
+        port: 7777
+        n32f:
+          address: 127.0.1.252
+          port: 7777
+    client:
+      sepp:
+        - receiver: sepp2.localdomain
+          uri: http://127.0.2.251:7777
+          n32f:
+            uri: http://127.0.2.252:7777
+        - receiver: sepp3.localdomain
+          uri: http://127.0.3.251:7777
+          n32f:
+            uri: http://127.0.3.252:7777
+
+ausf:
+  sbi:
+    server:
+#      - address: 127.0.1.11
+#        port: 7777
+      - address: ausf.5gc.mnc070.mcc999.3gppnetwork.org
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc070.mcc999.3gppnetwork.org
+
+udm:
+  hnet:
+    - id: 1
+      scheme: 1
+      key: @build_configs_dir@/open5gs/hnet/curve25519-1.key
+    - id: 2
+      scheme: 2
+      key: @build_configs_dir@/open5gs/hnet/secp256r1-2.key
+  sbi:
+    server:
+#        - address: 127.0.1.12
+#          port: 7777
+      - address: udm.5gc.mnc070.mcc999.3gppnetwork.org
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc070.mcc999.3gppnetwork.org
+
+pcf:
+  sbi:
+    server:
+      - address: 127.0.1.13
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc070.mcc999.3gppnetwork.org
+  metrics:
+    server:
+      - address: 127.0.1.13
+        port: 9090
+  policy:
+    - plmn_id:
+        mcc: 001
+        mnc: 01
+      slice:
+        - sst: 1  # 1,2,3,4
+          default_indicator: true
+          session:
+            - name: internet
+              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
+              ambr:
+                downlink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                uplink:
+                  value: 1
+                  unit: 3
+              qos:
+                index: 9  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                arp:
+                  priority_level: 8  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
+                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
+            - name: ims
+              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
+              ambr:
+                downlink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                uplink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+              qos:
+                index: 5  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                arp:
+                  priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
+                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
+              pcc_rule:
+                - qos:
+                    index: 1  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                    arp:
+                      priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                      pre_emption_vulnerability: 1   # 1: Disabled, 2:Enabled
+                      pre_emption_capability: 1   # 1: Disabled, 2:Enabled
+                    mbr:
+                      downlink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                    gbr:
+                      downlink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                - qos:
+                    index: 2  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                    arp:
+                      priority_level: 4  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                      pre_emption_vulnerability: 2   # 1: Disabled, 2:Enabled
+                      pre_emption_capability: 2   # 1: Disabled, 2:Enabled
+                    mbr:
+                      downlink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                    gbr:
+                      downlink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+    - plmn_id:
+        mcc: 315
+        mnc: 010
+      slice:
+        - sst: 1  # 1,2,3,4
+          default_indicator: true
+          session:
+            - name: internet
+              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
+              ambr:
+                downlink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                uplink:
+                  value: 1
+                  unit: 3
+              qos:
+                index: 9  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                arp:
+                  priority_level: 8  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
+                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
+            - name: ims
+              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
+              ambr:
+                downlink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                uplink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+              qos:
+                index: 5  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                arp:
+                  priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
+                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
+              pcc_rule:
+                - qos:
+                    index: 1  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                    arp:
+                      priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                      pre_emption_vulnerability: 1   # 1: Disabled, 2:Enabled
+                      pre_emption_capability: 1   # 1: Disabled, 2:Enabled
+                    mbr:
+                      downlink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                    gbr:
+                      downlink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                - qos:
+                    index: 2  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                    arp:
+                      priority_level: 4  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                      pre_emption_vulnerability: 2   # 1: Disabled, 2:Enabled
+                      pre_emption_capability: 2   # 1: Disabled, 2:Enabled
+                    mbr:
+                      downlink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                    gbr:
+                      downlink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+
+nssf:
+  sbi:
+    server:
+#      - address: 127.0.1.14
+#        port: 7777
+      - address: nssf.5gc.mnc070.mcc999.3gppnetwork.org
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc070.mcc999.3gppnetwork.org
+      nsi:
+        - uri: http://nrf.5gc.mnc070.mcc999.3gppnetwork.org
+          s_nssai:
+            sst: 1
+bsf:
+  sbi:
+    server:
+      - address: 127.0.1.15
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc070.mcc999.3gppnetwork.org
+
+udr:
+  sbi:
+    server:
+      - address: 127.0.1.20
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc070.mcc999.3gppnetwork.org

open5gs_2.7.7.tar.xz/configs/examples/5gc-no-scp-sepp2-001-01.yaml.in Added

@@ -0,0 +1,532 @@
+db_uri: mongodb://localhost/open5gs
+
+logger:
+
+global:
+  parameter:
+#    no_nrf: true
+    no_scp: true
+#    no_sepp: true
+#    no_amf: true
+#    no_smf: true
+#    no_upf: true
+#    no_ausf: true
+#    no_udm: true
+#    no_pcf: true
+#    no_nssf: true
+#    no_bsf: true
+#    no_udr: true
+    no_mme: true
+    no_sgwc: true
+    no_sgwu: true
+    no_pcrf: true
+    no_hss: true
+
+mme:
+  freeDiameter:
+    identity: mme.localdomain
+    realm: localdomain
+    listen_on: 127.0.2.2
+    no_fwd: true
+    load_extension:
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dbg_msg_dumps.fdx
+        conf: 0x8888
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_rfc5777.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_mip6i.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nasreq.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nas_mipv6.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca_3gpp/dict_dcca_3gpp.fdx
+    connect:
+      - identity: hss.localdomain
+        address: 127.0.2.8
+
+  s1ap:
+    server:
+      - address: 127.0.2.2
+  gtpc:
+    server:
+      - address: 127.0.2.2
+    client:
+      sgwc:
+        - address: 127.0.2.3
+      smf:
+        - address: 127.0.2.4
+  metrics:
+    server:
+      - address: 127.0.2.2
+        port: 9090
+  gummei:
+    - plmn_id:
+        mcc: 001
+        mnc: 01
+      mme_gid: 2
+      mme_code: 1
+  tai:
+    - plmn_id:
+        mcc: 001
+        mnc: 01
+      tac: 1
+  security:
+    integrity_order :  EIA2, EIA1, EIA0 
+    ciphering_order :  EEA0, EEA1, EEA2 
+  network_name:
+    full: Open5GS
+  time:
+    t3412:
+      value: 3240
+
+sgwc:
+  gtpc:
+    server:
+      - address: 127.0.2.3
+  pfcp:
+    server:
+      - address: 127.0.2.3
+    client:
+      sgwu:
+        - address: 127.0.2.6
+
+smf:
+  sbi:
+    server:
+#      - address: 127.0.2.4
+#        port: 7777
+      - address: smf.5gc.mnc001.mcc001.3gppnetwork.org
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc001.mcc001.3gppnetwork.org
+  pfcp:
+    server:
+      - address: 127.0.2.4
+    client:
+      upf:
+        - address: 127.0.2.7
+  gtpc:
+    server:
+      - address: 127.0.2.4
+  gtpu:
+    server:
+      - address: 127.0.2.4
+  metrics:
+    server:
+      - address: 127.0.2.4
+        port: 9090
+  session:
+    - subnet: 10.46.0.0/16
+      gateway: 10.46.0.1
+    - subnet: 2001:db8:babe::/48
+      gateway: 2001:db8:babe::1
+  dns:
+    - 8.8.8.8
+    - 8.8.4.4
+    - 2001:4860:4860::8888
+    - 2001:4860:4860::8844
+  mtu: 1400
+  freeDiameter:
+    identity: smf.localdomain
+    realm: localdomain
+    listen_on: 127.0.2.4
+    no_fwd: true
+    load_extension:
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dbg_msg_dumps.fdx
+        conf: 0x8888
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_rfc5777.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_mip6i.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nasreq.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nas_mipv6.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca_3gpp/dict_dcca_3gpp.fdx
+    connect:
+      - identity: pcrf.localdomain
+        address: 127.0.2.9
+
+amf:
+  sbi:
+    server:
+      - address: 127.0.2.5
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc001.mcc001.3gppnetwork.org
+  ngap:
+    server:
+      - address: 127.0.2.5
+  metrics:
+    server:
+      - address: 127.0.2.5
+        port: 9090
+  access_control:
+    - plmn_id:
+        mcc: 999
+        mnc: 70
+    - plmn_id:
+        mcc: 001
+        mnc: 01
+    - plmn_id:
+        mcc: 315
+        mnc: 010
+  guami:
+    - plmn_id:
+        mcc: 001
+        mnc: 01
+      amf_id:
+        region: 2
+        set: 1
+  tai:
+    - plmn_id:
+        mcc: 001
+        mnc: 01
+      tac: 1
+  plmn_support:
+    - plmn_id:
+        mcc: 001
+        mnc: 01
+      s_nssai:
+        - sst: 1
+  security:
+    integrity_order :  NIA2, NIA1, NIA0 
+    ciphering_order :  NEA0, NEA1, NEA2 
+  network_name:
+    full: Open5GS
+  amf_name: open5gs-amf0
+  time:
+    t3512:
+      value: 540     # 9 mintues * 60 = 540 seconds
+
+sgwu:
+  pfcp:
+    server:
+      - address: 127.0.2.6
+  gtpu:
+    server:
+      - address: 127.0.2.6
+
+upf:
+  pfcp:
+    server:
+      - address: 127.0.2.7
+  gtpu:
+    server:
+      - address: 127.0.2.7
+  session:
+    - subnet: 10.46.0.0/16
+      gateway: 10.46.0.1
+      dev: ogstun2
+    - subnet: 2001:db8:babe::/48
+      gateway: 2001:db8:babe::1
+      dev: ogstun2
+  metrics:
+    server:
+      - address: 127.0.2.7
+        port: 9090
+
+hss:
+  freeDiameter:
+    identity: hss.localdomain
+    realm: localdomain
+    listen_on: 127.0.2.8
+    no_fwd: true
+    load_extension:
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dbg_msg_dumps.fdx
+        conf: 0x8888
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_rfc5777.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_mip6i.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nasreq.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nas_mipv6.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca_3gpp/dict_dcca_3gpp.fdx
+    connect:
+      - identity: mme.localdomain
+        address: 127.0.2.2
+pcrf:
+  freeDiameter:
+    identity: pcrf.localdomain
+    realm: localdomain
+    listen_on: 127.0.2.9
+    no_fwd: true
+    load_extension:
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dbg_msg_dumps.fdx
+        conf: 0x8888
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_rfc5777.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_mip6i.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nasreq.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nas_mipv6.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca_3gpp/dict_dcca_3gpp.fdx
+    connect:
+      - identity: smf.localdomain
+        address: 127.0.2.4
+
+nrf:
+  serving:
+    - plmn_id:
+        mcc: 001
+        mnc: 01
+  sbi:
+    server:
+#      - address: 127.0.2.10
+#        port: 7777
+      - address: nrf.5gc.mnc001.mcc001.3gppnetwork.org
+
+sepp:
+  default:
+    tls:
+      server:
+        private_key: @build_configs_dir@/open5gs/tls/sepp2.key
+        cert: @build_configs_dir@/open5gs/tls/sepp2.crt
+      client:
+        cacert: @build_configs_dir@/open5gs/tls/ca.crt
+  sbi:
+    server:
+      - address: 127.0.2.250
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc001.mcc001.3gppnetwork.org
+  n32:
+    server:
+      - sender: sepp2.localdomain
+        address: 127.0.2.251
+        port: 7777
+        n32f:
+          address: 127.0.2.252
+          port: 7777
+    client:
+      sepp:
+        - receiver: sepp1.localdomain
+          uri: http://127.0.1.251:7777
+          n32f:
+            uri: http://127.0.1.252:7777
+        - receiver: sepp3.localdomain
+          uri: http://127.0.3.251:7777
+          n32f:
+            uri: http://127.0.3.252:7777
+
+ausf:
+  sbi:
+    server:
+#      - address: 127.0.2.11
+#        port: 7777
+      - address: ausf.5gc.mnc001.mcc001.3gppnetwork.org
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc001.mcc001.3gppnetwork.org
+
+udm:
+  hnet:
+    - id: 1
+      scheme: 1
+      key: @build_configs_dir@/open5gs/hnet/curve25519-1.key
+    - id: 2
+      scheme: 2
+      key: @build_configs_dir@/open5gs/hnet/secp256r1-2.key
+  sbi:
+    server:
+#        - address: 127.0.2.12
+#          port: 7777
+      - address: udm.5gc.mnc001.mcc001.3gppnetwork.org
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc001.mcc001.3gppnetwork.org
+
+pcf:
+  sbi:
+    server:
+      - address: 127.0.2.13
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc001.mcc001.3gppnetwork.org
+  metrics:
+    server:
+      - address: 127.0.2.13
+        port: 9090
+  policy:
+    - plmn_id:
+        mcc: 999
+        mnc: 70
+      slice:
+        - sst: 1  # 1,2,3,4
+          default_indicator: true
+          session:
+            - name: internet
+              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
+              ambr:
+                downlink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                uplink:
+                  value: 1
+                  unit: 3
+              qos:
+                index: 9  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                arp:
+                  priority_level: 8  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
+                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
+            - name: ims
+              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
+              ambr:
+                downlink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                uplink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+              qos:
+                index: 5  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                arp:
+                  priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
+                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
+              pcc_rule:
+                - qos:
+                    index: 1  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                    arp:
+                      priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                      pre_emption_vulnerability: 1   # 1: Disabled, 2:Enabled
+                      pre_emption_capability: 1   # 1: Disabled, 2:Enabled
+                    mbr:
+                      downlink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                    gbr:
+                      downlink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                - qos:
+                    index: 2  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                    arp:
+                      priority_level: 4  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                      pre_emption_vulnerability: 2   # 1: Disabled, 2:Enabled
+                      pre_emption_capability: 2   # 1: Disabled, 2:Enabled
+                    mbr:
+                      downlink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                    gbr:
+                      downlink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+    - plmn_id:
+        mcc: 315
+        mnc: 010
+      slice:
+        - sst: 1  # 1,2,3,4
+          default_indicator: true
+          session:
+            - name: internet
+              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
+              ambr:
+                downlink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                uplink:
+                  value: 1
+                  unit: 3
+              qos:
+                index: 9  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                arp:
+                  priority_level: 8  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
+                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
+            - name: ims
+              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
+              ambr:
+                downlink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                uplink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+              qos:
+                index: 5  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                arp:
+                  priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
+                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
+              pcc_rule:
+                - qos:
+                    index: 1  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                    arp:
+                      priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                      pre_emption_vulnerability: 1   # 1: Disabled, 2:Enabled
+                      pre_emption_capability: 1   # 1: Disabled, 2:Enabled
+                    mbr:
+                      downlink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                    gbr:
+                      downlink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                - qos:
+                    index: 2  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                    arp:
+                      priority_level: 4  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                      pre_emption_vulnerability: 2   # 1: Disabled, 2:Enabled
+                      pre_emption_capability: 2   # 1: Disabled, 2:Enabled
+                    mbr:
+                      downlink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                    gbr:
+                      downlink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+
+nssf:
+  sbi:
+    server:
+#      - address: 127.0.2.14
+#        port: 7777
+      - address: nssf.5gc.mnc001.mcc001.3gppnetwork.org
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc001.mcc001.3gppnetwork.org
+      nsi:
+        - uri: http://nrf.5gc.mnc001.mcc001.3gppnetwork.org
+          s_nssai:
+            sst: 1
+bsf:
+  sbi:
+    server:
+      - address: 127.0.2.15
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc001.mcc001.3gppnetwork.org
+
+udr:
+  sbi:
+    server:
+      - address: 127.0.2.20
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc001.mcc001.3gppnetwork.org

open5gs_2.7.7.tar.xz/configs/examples/5gc-no-scp-sepp3-315-010.yaml.in Added

@@ -0,0 +1,532 @@
+db_uri: mongodb://localhost/open5gs
+
+logger:
+
+global:
+  parameter:
+#    no_nrf: true
+    no_scp: true
+#    no_sepp: true
+#    no_amf: true
+#    no_smf: true
+#    no_upf: true
+#    no_ausf: true
+#    no_udm: true
+#    no_pcf: true
+#    no_nssf: true
+#    no_bsf: true
+#    no_udr: true
+    no_mme: true
+    no_sgwc: true
+    no_sgwu: true
+    no_pcrf: true
+    no_hss: true
+
+mme:
+  freeDiameter:
+    identity: mme.localdomain
+    realm: localdomain
+    listen_on: 127.0.3.2
+    no_fwd: true
+    load_extension:
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dbg_msg_dumps.fdx
+        conf: 0x8888
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_rfc5777.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_mip6i.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nasreq.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nas_mipv6.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca_3gpp/dict_dcca_3gpp.fdx
+    connect:
+      - identity: hss.localdomain
+        address: 127.0.3.8
+
+  s1ap:
+    server:
+      - address: 127.0.3.2
+  gtpc:
+    server:
+      - address: 127.0.3.2
+    client:
+      sgwc:
+        - address: 127.0.3.3
+      smf:
+        - address: 127.0.3.4
+  metrics:
+    server:
+      - address: 127.0.3.2
+        port: 9090
+  gummei:
+    - plmn_id:
+        mcc: 315
+        mnc: 010
+      mme_gid: 2
+      mme_code: 1
+  tai:
+    - plmn_id:
+        mcc: 315
+        mnc: 010
+      tac: 1
+  security:
+    integrity_order :  EIA2, EIA1, EIA0 
+    ciphering_order :  EEA0, EEA1, EEA2 
+  network_name:
+    full: Open5GS
+  time:
+    t3412:
+      value: 3240
+
+sgwc:
+  gtpc:
+    server:
+      - address: 127.0.3.3
+  pfcp:
+    server:
+      - address: 127.0.3.3
+    client:
+      sgwu:
+        - address: 127.0.3.6
+
+smf:
+  sbi:
+    server:
+#      - address: 127.0.3.4
+#        port: 7777
+      - address: smf.5gc.mnc010.mcc315.3gppnetwork.org
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc010.mcc315.3gppnetwork.org
+  pfcp:
+    server:
+      - address: 127.0.3.4
+    client:
+      upf:
+        - address: 127.0.3.7
+  gtpc:
+    server:
+      - address: 127.0.3.4
+  gtpu:
+    server:
+      - address: 127.0.3.4
+  metrics:
+    server:
+      - address: 127.0.3.4
+        port: 9090
+  session:
+    - subnet: 10.47.0.0/16
+      gateway: 10.47.0.1
+    - subnet: 2001:db8:face::/48
+      gateway: 2001:db8:face::1
+  dns:
+    - 8.8.8.8
+    - 8.8.4.4
+    - 2001:4860:4860::8888
+    - 2001:4860:4860::8844
+  mtu: 1400
+  freeDiameter:
+    identity: smf.localdomain
+    realm: localdomain
+    listen_on: 127.0.3.4
+    no_fwd: true
+    load_extension:
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dbg_msg_dumps.fdx
+        conf: 0x8888
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_rfc5777.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_mip6i.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nasreq.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nas_mipv6.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca_3gpp/dict_dcca_3gpp.fdx
+    connect:
+      - identity: pcrf.localdomain
+        address: 127.0.3.9
+
+amf:
+  sbi:
+    server:
+      - address: 127.0.3.5
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc010.mcc315.3gppnetwork.org
+  ngap:
+    server:
+      - address: 127.0.3.5
+  metrics:
+    server:
+      - address: 127.0.3.5
+        port: 9090
+  access_control:
+    - plmn_id:
+        mcc: 999
+        mnc: 70
+    - plmn_id:
+        mcc: 001
+        mnc: 01
+    - plmn_id:
+        mcc: 315
+        mnc: 010
+  guami:
+    - plmn_id:
+        mcc: 315
+        mnc: 010
+      amf_id:
+        region: 2
+        set: 1
+  tai:
+    - plmn_id:
+        mcc: 315
+        mnc: 010
+      tac: 1
+  plmn_support:
+    - plmn_id:
+        mcc: 315
+        mnc: 010
+      s_nssai:
+        - sst: 1
+  security:
+    integrity_order :  NIA2, NIA1, NIA0 
+    ciphering_order :  NEA0, NEA1, NEA2 
+  network_name:
+    full: Open5GS
+  amf_name: open5gs-amf0
+  time:
+    t3512:
+      value: 540     # 9 mintues * 60 = 540 seconds
+
+sgwu:
+  pfcp:
+    server:
+      - address: 127.0.3.6
+  gtpu:
+    server:
+      - address: 127.0.3.6
+
+upf:
+  pfcp:
+    server:
+      - address: 127.0.3.7
+  gtpu:
+    server:
+      - address: 127.0.3.7
+  session:
+    - subnet: 10.47.0.0/16
+      gateway: 10.47.0.1
+      dev: ogstun3
+    - subnet: 2001:db8:face::/48
+      gateway: 2001:db8:face::1
+      dev: ogstun3
+  metrics:
+    server:
+      - address: 127.0.3.7
+        port: 9090
+
+hss:
+  freeDiameter:
+    identity: hss.localdomain
+    realm: localdomain
+    listen_on: 127.0.3.8
+    no_fwd: true
+    load_extension:
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dbg_msg_dumps.fdx
+        conf: 0x8888
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_rfc5777.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_mip6i.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nasreq.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nas_mipv6.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca_3gpp/dict_dcca_3gpp.fdx
+    connect:
+      - identity: mme.localdomain
+        address: 127.0.3.2
+pcrf:
+  freeDiameter:
+    identity: pcrf.localdomain
+    realm: localdomain
+    listen_on: 127.0.3.9
+    no_fwd: true
+    load_extension:
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dbg_msg_dumps.fdx
+        conf: 0x8888
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_rfc5777.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_mip6i.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nasreq.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_nas_mipv6.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca.fdx
+      - module: @build_subprojects_freeDiameter_extensions_dir@/dict_dcca_3gpp/dict_dcca_3gpp.fdx
+    connect:
+      - identity: smf.localdomain
+        address: 127.0.3.4
+
+nrf:
+  serving:
+    - plmn_id:
+        mcc: 315
+        mnc: 010
+  sbi:
+    server:
+#      - address: 127.0.3.10
+#        port: 7777
+      - address: nrf.5gc.mnc010.mcc315.3gppnetwork.org
+
+sepp:
+  default:
+    tls:
+      server:
+        private_key: @build_configs_dir@/open5gs/tls/sepp3.key
+        cert: @build_configs_dir@/open5gs/tls/sepp3.crt
+      client:
+        cacert: @build_configs_dir@/open5gs/tls/ca.crt
+  sbi:
+    server:
+      - address: 127.0.3.250
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc010.mcc315.3gppnetwork.org
+  n32:
+    server:
+      - sender: sepp3.localdomain
+        address: 127.0.3.251
+        port: 7777
+        n32f:
+          address: 127.0.3.252
+          port: 7777
+    client:
+      sepp:
+        - receiver: sepp1.localdomain
+          uri: http://127.0.1.251:7777
+          n32f:
+            uri: http://127.0.1.252:7777
+        - receiver: sepp2.localdomain
+          uri: http://127.0.2.251:7777
+          n32f:
+            uri: http://127.0.2.252:7777
+
+ausf:
+  sbi:
+    server:
+#      - address: 127.0.3.11
+#        port: 7777
+      - address: ausf.5gc.mnc010.mcc315.3gppnetwork.org
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc010.mcc315.3gppnetwork.org
+
+udm:
+  hnet:
+    - id: 1
+      scheme: 1
+      key: @build_configs_dir@/open5gs/hnet/curve25519-1.key
+    - id: 2
+      scheme: 2
+      key: @build_configs_dir@/open5gs/hnet/secp256r1-2.key
+  sbi:
+    server:
+#      - address: 127.0.3.12
+#        port: 7777
+      - address: udm.5gc.mnc010.mcc315.3gppnetwork.org
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc010.mcc315.3gppnetwork.org
+
+pcf:
+  sbi:
+    server:
+      - address: 127.0.3.13
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc010.mcc315.3gppnetwork.org
+  metrics:
+    server:
+      - address: 127.0.3.13
+        port: 9090
+  policy:
+    - plmn_id:
+        mcc: 999
+        mnc: 70
+      slice:
+        - sst: 1  # 1,2,3,4
+          default_indicator: true
+          session:
+            - name: internet
+              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
+              ambr:
+                downlink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                uplink:
+                  value: 1
+                  unit: 3
+              qos:
+                index: 9  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                arp:
+                  priority_level: 8  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
+                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
+            - name: ims
+              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
+              ambr:
+                downlink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                uplink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+              qos:
+                index: 5  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                arp:
+                  priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
+                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
+              pcc_rule:
+                - qos:
+                    index: 1  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                    arp:
+                      priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                      pre_emption_vulnerability: 1   # 1: Disabled, 2:Enabled
+                      pre_emption_capability: 1   # 1: Disabled, 2:Enabled
+                    mbr:
+                      downlink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                    gbr:
+                      downlink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                - qos:
+                    index: 2  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                    arp:
+                      priority_level: 4  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                      pre_emption_vulnerability: 2   # 1: Disabled, 2:Enabled
+                      pre_emption_capability: 2   # 1: Disabled, 2:Enabled
+                    mbr:
+                      downlink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                    gbr:
+                      downlink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+    - plmn_id:
+        mcc: 001
+        mnc: 01
+      slice:
+        - sst: 1  # 1,2,3,4
+          default_indicator: true
+          session:
+            - name: internet
+              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
+              ambr:
+                downlink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                uplink:
+                  value: 1
+                  unit: 3
+              qos:
+                index: 9  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                arp:
+                  priority_level: 8  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
+                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
+            - name: ims
+              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
+              ambr:
+                downlink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                uplink:
+                  value: 1
+                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+              qos:
+                index: 5  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                arp:
+                  priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
+                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
+              pcc_rule:
+                - qos:
+                    index: 1  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                    arp:
+                      priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                      pre_emption_vulnerability: 1   # 1: Disabled, 2:Enabled
+                      pre_emption_capability: 1   # 1: Disabled, 2:Enabled
+                    mbr:
+                      downlink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                    gbr:
+                      downlink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 82
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                - qos:
+                    index: 2  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
+                    arp:
+                      priority_level: 4  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+                      pre_emption_vulnerability: 2   # 1: Disabled, 2:Enabled
+                      pre_emption_capability: 2   # 1: Disabled, 2:Enabled
+                    mbr:
+                      downlink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                    gbr:
+                      downlink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+                      uplink:
+                        value: 802
+                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+
+nssf:
+  sbi:
+    server:
+#      - address: 127.0.3.14
+#        port: 7777
+      - address: nssf.5gc.mnc010.mcc315.3gppnetwork.org
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc010.mcc315.3gppnetwork.org
+      nsi:
+        - uri: http://nrf.5gc.mnc010.mcc315.3gppnetwork.org
+          s_nssai:
+            sst: 1
+bsf:
+  sbi:
+    server:
+      - address: 127.0.3.15
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc010.mcc315.3gppnetwork.org
+
+udr:
+  sbi:
+    server:
+      - address: 127.0.3.20
+        port: 7777
+    client:
+      nrf:
+        - uri: http://nrf.5gc.mnc010.mcc315.3gppnetwork.org

open5gs_2.7.6.tar.xz/configs/examples/5gc-sepp1-999-70.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/5gc-sepp1-999-70.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/5gc-sepp2-001-01.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/5gc-sepp2-001-01.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/5gc-sepp3-315-010.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/5gc-sepp3-315-010.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/5gc-tls-sepp1-999-70.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/5gc-tls-sepp1-999-70.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/5gc-tls-sepp2-001-01.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/5gc-tls-sepp2-001-01.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/5gc-tls-sepp3-315-010.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/5gc-tls-sepp3-315-010.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/gnb-001-01-ue-001-01.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/gnb-001-01-ue-001-01.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/gnb-001-01-ue-315-010.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/gnb-001-01-ue-315-010.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/gnb-001-01-ue-999-70.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/gnb-001-01-ue-999-70.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/gnb-315-010-ue-001-01.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/gnb-315-010-ue-001-01.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/gnb-315-010-ue-315-010.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/gnb-315-010-ue-315-010.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/gnb-315-010-ue-999-70.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/gnb-315-010-ue-999-70.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/gnb-999-70-ue-001-01.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/gnb-999-70-ue-001-01.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/gnb-999-70-ue-315-010.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/gnb-999-70-ue-315-010.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/gnb-999-70-ue-999-70.yaml.in -> open5gs_2.7.7.tar.xz/configs/examples/gnb-999-70-ue-999-70.yaml.in Changed

open5gs_2.7.6.tar.xz/configs/examples/meson.build -> open5gs_2.7.7.tar.xz/configs/examples/meson.build Changed

open5gs_2.7.6.tar.xz/debian/changelog -> open5gs_2.7.7.tar.xz/debian/changelog Changed

@@ -1,3 +1,45 @@
+open5gs (2.7.7) unstable; urgency=medium
+
+  * Bug Fixed
+
+ -- Sukchan Lee <acetcom@gmail.com>  Sun, 15 Mar 2026 20:35:27 +0900
+
+open5gs (2.7.7~questing) questing; urgency=medium
+
+  * Bug Fixed
+
+ -- Sukchan Lee <acetcom@gmail.com>  Sun, 15 Mar 2026 20:32:45 +0900
+
+open5gs (2.7.7~plucky) plucky; urgency=medium
+
+  * Bug Fixed
+
+ -- Sukchan Lee <acetcom@gmail.com>  Sun, 15 Mar 2026 20:29:35 +0900
+
+open5gs (2.7.7~noble) noble; urgency=medium
+
+  * Bug Fixed
+
+ -- Sukchan Lee <acetcom@gmail.com>  Sun, 15 Mar 2026 20:27:45 +0900
+
+open5gs (2.7.7~jammy) jammy; urgency=medium
+
+  * Bug Fixed
+
+ -- Sukchan Lee <acetcom@gmail.com>  Sun, 15 Mar 2026 20:26:00 +0900
+
+open5gs (2.7.7~focal) focal; urgency=medium
+
+  * Bug Fixed
+
+ -- Sukchan Lee <acetcom@gmail.com>  Sun, 15 Mar 2026 20:23:53 +0900
+
+open5gs (2.7.7~bionic) bionic; urgency=medium
+
+  * Bug Fixed
+
+ -- Sukchan Lee <acetcom@gmail.com>  Sun, 15 Mar 2026 20:21:59 +0900
+
 open5gs (2.7.6) unstable; urgency=medium
 
   * Bug Fixed

open5gs_2.7.6.tar.xz/docker/alpine/latest/base/Dockerfile -> open5gs_2.7.7.tar.xz/docker/alpine/latest/base/Dockerfile Changed

open5gs_2.7.6.tar.xz/docker/alpine/latest/dev/Dockerfile -> open5gs_2.7.7.tar.xz/docker/alpine/latest/dev/Dockerfile Changed

open5gs_2.7.6.tar.xz/docker/build/Dockerfile -> open5gs_2.7.7.tar.xz/docker/build/Dockerfile Changed

open5gs_2.7.6.tar.xz/docker/debian/latest/base/Dockerfile -> open5gs_2.7.7.tar.xz/docker/debian/latest/base/Dockerfile Changed

open5gs_2.7.6.tar.xz/docker/debian/latest/dev/Dockerfile -> open5gs_2.7.7.tar.xz/docker/debian/latest/dev/Dockerfile Changed

open5gs_2.7.6.tar.xz/docker/docker-compose.yml -> open5gs_2.7.7.tar.xz/docker/docker-compose.yml Changed

open5gs_2.7.6.tar.xz/docker/fedora/latest/base/Dockerfile -> open5gs_2.7.7.tar.xz/docker/fedora/latest/base/Dockerfile Changed

open5gs_2.7.6.tar.xz/docker/fedora/latest/dev/Dockerfile -> open5gs_2.7.7.tar.xz/docker/fedora/latest/dev/Dockerfile Changed

open5gs_2.7.6.tar.xz/docker/ubuntu/latest/base/Dockerfile -> open5gs_2.7.7.tar.xz/docker/ubuntu/latest/base/Dockerfile Changed

open5gs_2.7.6.tar.xz/docker/ubuntu/latest/dev/Dockerfile -> open5gs_2.7.7.tar.xz/docker/ubuntu/latest/dev/Dockerfile Changed

open5gs_2.7.6.tar.xz/docker/webui/Dockerfile -> open5gs_2.7.7.tar.xz/docker/webui/Dockerfile Changed

open5gs_2.7.6.tar.xz/docs/_docs/guide/01-quickstart.md -> open5gs_2.7.7.tar.xz/docs/_docs/guide/01-quickstart.md Changed

open5gs_2.7.6.tar.xz/docs/_docs/hardware/01-genodebs.md -> open5gs_2.7.7.tar.xz/docs/_docs/hardware/01-genodebs.md Changed

@@ -14,17 +14,21 @@
  * Airspan AirSpeed 2900
  * Airspan AirStrand 2200
  * ASKEY SCE2200 5G SUB-6 SMALL CELL
+ * Baicells Aurora 243
  * BTI Wireless nCELL-F2240 5G NR Femtocell (n78)
  * CableFree Small Cell Outdoor radios (5G n77, n78 and other bands)
  * CableFree Small Cell Indoor radios (5G n77, n78 and other bands)
  * CableFree Macro (BBU+RRH) radios (4G and 5G, various bands)
  * Ericsson Baseband 6630 (21.Q3 Software) + Radio 2217, Radio 2219 (4G and 5G, various bands)
+ * Ericsson Baseband 6648/6651 IRU 8848 Dots 4475 (N78, N1,N3) 
  * Ericsson StreetMacro 6701 (21.Q3 Software) (5G mmWave, n261) (Baseband 6318 and AIR 1281 packaged together)
- * Huawei BTS5900
+ * Huawei BTS5900 V100R019C10SPC220 (N78, N28)
  * LIONS RANathon O-CU and O-DU + RANathon RS8601 Indoor O-RU + RANathon XG8600 Fronthaul Gateway
  * NOKIA AEQE (SW: 5G20A)
  * NOKIA AEQD (SW: 5G20A)
  * NOKIA AEQP (SW: 5G21A)
+ * MOSO Networks Canopy 5GID1 Indoor 2T2R (5G n48 n78)
+ * ZTE ITBBU ITRAN-PNF V5.65.20.20F10 (n78, n1, n3) 
 
 ### Commercial 4G
 ---
@@ -42,10 +46,12 @@
  * Baicells Nova 436Q
  * Baicells Nova 227 (EBS & CBRS)
  * Baicells Nova 233
- * Ericsson Baseband 6630 (21Q1 Software)
+ * Baicells Nova 430i (band 48/CBRS, SW version BaiBLQ_3.0.12)
+ * Ericsson Baseband 6630/6648/6651 (21Q1 Software)
  * Ericsson RBS 6402 (18.Q1 software, B2 B25 B4 B7 B252 B255)
  * Ericsson RBS 6601 + DUL 20 01 + RUS 01 B8 
  * Gemtek WLTGFC-101 (S/W version 2.1.1746.1116)
+ * Gemtek WLTGFC-105 (band 3, SW version 2.1.2277.1720-wltgfc105-gemtek-fdd)
  * Huawei BTS3900 (S/W version V100R011C10SPC230)
  * Huawei BBU5900 with RRU5304W Band 7 FDD 2600Mhz 40W Version V100R016C10
  * Klas VoyagerCell Duo 4GAP1000/4GAP1000X
@@ -56,7 +62,10 @@
  * Nokia FWGR Flexi Zone Mini-Macro Outdoor BTS, 2x20w Band 1
  * Nokia FWHG Flexi Zone Indoor Pico BTS, 2x250 mW Band 7
  * Nokia FW2HHD Flexi Zone Multiband Indoor Pico BTS, Band 38/41(S/W TLS18SP_ENB)
+ * Mikrotik Intercell B1+B3 IC322GC-b1D+b3D
  * Ruckus Q710 and Q910
+ * Sercomm SCE4255W "Englewood" (band 48/CBRS, SW version DG3934v3@2308041842)
+ * ZTE ITBBU ITRAN-PNF V5.65.20.20F10
 
 ### 4G/5G Software Stacks + SDRs
 ---
@@ -64,9 +73,11 @@
  * Amarisoft(https://www.amarisoft.com/) + LimeSDR, USRP, Amarisoft PCI Express Card
  * Open Air Interface 5G (NR_SA_F1AP_5GRECORDS branch(https://gitlab.eurecom.fr/oai/openairinterface5g/-/tree/NR_SA_F1AP_5GRECORDS)) + USRP B210
  * srsLTE / srsENB(https://github.com/srsLTE/srsLTE) + LimeSDR, USRP, BladeRF x40 (BladeRF Not stable)
+ * srsRAN_Project(https://github.com/srsran/srsRAN_Project) 5G O-RAN CU/DU based on USRP SDR.
 
 ### Misc Radio Hardware
 ---
  * OpenAirInterface v1.0.3(https://gitlab.eurecom.fr/oai/openairinterface5g/-/tree/v1.0.3) 4G RAN Simulator
  * OsmoBTS(https://osmocom.org/projects/osmobts/wiki) controlled ip.access NanoBTS (Used for CSFB with Osmocom)
  * UERANSIM(https://github.com/aligungr/UERANSIM) 5G RAN Simulator
+ * PacketRusher(https://github.com/HewlettPackard/PacketRusher) 5G performance testing and validation tool

open5gs_2.7.6.tar.xz/docs/_docs/tutorial/05-roaming.md -> open5gs_2.7.7.tar.xz/docs/_docs/tutorial/05-roaming.md Changed

@@ -4,10 +4,9 @@
 
 ## 0. Introduction
 
-Now, we will explain how to install and test 5G Core Roaming using Open5GS. Since we cannot test roaming with UERANSIM, we will use the test environment of Open5GS. 
-
-We can only use the LBO method. HR roaming will be implemented at a later date. And also, 5G roaming has been implemented according to the document below.
+This document explains how to install and test 5G Core Roaming using Open5GS. Since roaming cannot be tested with UERANSIM, we use Open5GS's built-in test environment.
 
+Open5GS supports both LBO (Local Breakout) and HR (Home Routed) roaming methods. The 5G roaming implementation follows the specifications outlined in the document below:
 ```
 TS29.500
 6 General Functionalities in Service Based Architecture
@@ -15,7 +14,7 @@
 6.1.4.3 Routing across PLMN
 ```
 
-Let's start the explanation assuming that the connection test of the UE to this single host has been completed.
+This explanation assumes that you have already completed the UE connection test on a single host.
 
 ## 1. Your First Roaming with Test Program
 
@@ -29,36 +28,43 @@
 $ ninja -C build install
 ```
 
-#### Configure FQDN to DNS
+#### Configure DNS for FQDN Resolution
 
-For routing to Home PLMN, NRF, AUSF and UDM address in H-PLMN shall use FQDN format, so please edit the /etc/hosts file as follows.
+For routing to the Home PLMN, the NRF, AUSF, and UDM addresses in H-PLMN must use FQDN format. Additionally, for HR roaming, NSSF, SMF, and BSF must also use FQDN format. Please edit the /etc/hosts file as follows:
 
 ```diff
-$ diff -u hosts.old hosts.new
---- hosts.old	2023-10-02 11:58:54.261154726 +0900
-+++ hosts.new	2023-10-02 11:59:02.868771248 +0900
-@@ -1,6 +1,18 @@
+--- hosts	2025-07-15 08:33:36.594334895 +0900
++++ /etc/hosts	2025-07-15 08:46:53.727356793 +0900
+@@ -1,6 +1,27 @@
  127.0.0.1	localhost
  127.0.1.1	open5gs
 
 +127.0.1.10	nrf.5gc.mnc070.mcc999.3gppnetwork.org
 +127.0.1.11	ausf.5gc.mnc070.mcc999.3gppnetwork.org
 +127.0.1.12	udm.5gc.mnc070.mcc999.3gppnetwork.org
++127.0.1.14	nssf.5gc.mnc070.mcc999.3gppnetwork.org
++127.0.1.4	smf.5gc.mnc070.mcc999.3gppnetwork.org
++127.0.1.15	bsf.5gc.mnc070.mcc999.3gppnetwork.org
 +
 +127.0.2.10	nrf.5gc.mnc001.mcc001.3gppnetwork.org
 +127.0.2.11	ausf.5gc.mnc001.mcc001.3gppnetwork.org
 +127.0.2.12	udm.5gc.mnc001.mcc001.3gppnetwork.org
++127.0.2.14	nssf.5gc.mnc001.mcc001.3gppnetwork.org
++127.0.2.4	smf.5gc.mnc001.mcc001.3gppnetwork.org
++127.0.2.15	bsf.5gc.mnc001.mcc001.3gppnetwork.org
 +
 +127.0.3.10	nrf.5gc.mnc010.mcc315.3gppnetwork.org
 +127.0.3.11	ausf.5gc.mnc010.mcc315.3gppnetwork.org
 +127.0.3.12	udm.5gc.mnc010.mcc315.3gppnetwork.org
++127.0.3.14	nssf.5gc.mnc010.mcc315.3gppnetwork.org
++127.0.3.4	smf.5gc.mnc010.mcc315.3gppnetwork.org
++127.0.3.15	bsf.5gc.mnc010.mcc315.3gppnetwork.org
 +
  # The following lines are desirable for IPv6 capable hosts
  ::1     ip6-localhost ip6-loopback
  fe00::0 ip6-localnet
 ```
 
-
 #### Run the V-PLMN 5G Core and H-PLMN 5G Core on a single host
 
 5G Core requires root privileges as it uses reserved ports such as http(80) or https(443).
@@ -69,7 +75,7 @@
 $ sudo ./build/tests/app/5gc -c ./build/configs/examples/5gc-sepp3-315-010.yaml
 ```
 
-Performs a test of UE access while roaming subscribed to H-PLMN.
+Test UE access while roaming with UEs subscribed to different H-PLMNs. The same test commands work for both LBO and HR roaming scenarios - the roaming type is determined by the network configuration and policies:
 ```
 $ ./build/tests/registration/registration -c ./build/configs/examples/gnb-999-70-ue-001-01.yaml simple-test
 $ ./build/tests/registration/registration -c ./build/configs/examples/gnb-999-70-ue-315-010.yaml simple-test
@@ -79,15 +85,30 @@
 $ ./build/tests/registration/registration -c ./build/configs/examples/gnb-315-010-ue-001-01.yaml simple-test
 ```
 
-You can see the sample traffic.  -- 5g-roaming-lbo.pcapng({{ site.url }}{{ site.baseurl }}/assets/pcapng/5g_roaming_lbo.pcapng).
+You can see the sample traffic for both roaming types:
+- LBO Roaming: 5g-roaming-lbo.pcapng({{ site.url }}{{ site.baseurl }}/assets/pcapng/5g-roaming-lbo.pcapng)
+- HR Roaming: 5g-roaming-hr.pcapng({{ site.url }}{{ site.baseurl }}/assets/pcapng/5g-roaming-hr.pcapng)
+
 
 ## 2. Roaming Test on a Single Host
 
+Open5GS now supports both roaming architectures:
+
+1. **LBO (Local Breakout)**: User plane traffic is routed locally through the visited network's UPF
+2. **HR (Home Routed)**: User plane traffic is routed back to the home network's UPF through the visited network
+
+The choice between LBO and HR is determined by subscriber configuration and roaming agreements. In Open5GS WebUI, you can configure the roaming type for each subscriber session using the `lbo_roaming_allowed` parameter:
+
+- **LBO Roaming**: Set `Subscriber.slice.session.lbo_roaming_allowed` to `true`
+- **HR Roaming**: Set `Subscriber.slice.session.lbo_roaming_allowed` to `false` or leave it unset (default behavior)
+
+This allows flexible per-session roaming policy configuration based on subscriber profiles and service requirements.
+
 ### Home PLMN
 
-NRF shall follow TS23.003(28.3.2.3.2 Format of NRF FQDN) for routing.
+The NRF must include PLMN information when serving in a 5G roaming environment. This enables proper network function discovery and routing by providing the necessary PLMN context for roaming subscribers.
 
-- Create h-nrf.yaml
+**Create h-nrf.yaml:**
 
 ```bash
 $ sh -c 'cat << EOF > ./install/etc/open5gs/h-nrf.yaml
@@ -112,7 +133,9 @@
 EOF'
 ```
 
-- Update h-scp.yaml
+The SCP acts as a communication proxy between different network functions, enabling indirect communication and service discovery in the 5G Service Based Architecture.
+
+**Create h-scp.yaml:**
 
 ```bash
 $ sh -c 'cat << EOF > ./install/etc/open5gs/h-scp.yaml
@@ -137,9 +160,9 @@
 EOF'
 ```
 
-AUSF and UDM shall use FQDN in the Home PLMN.
+AUSF handles authentication procedures for UE access. It must use FQDN in the Home PLMN for proper authentication in roaming scenarios, ensuring that roaming subscribers can be properly authenticated by the home network.
 
-- Update ausf.yaml
+**Update ausf.yaml:**
 
 ```diff
 diff -u ./install/etc/open5gs/ausf.yaml.old ./install/etc/open5gs/ausf.yaml
@@ -163,7 +186,9 @@
  # SBI Server
 ```
 
-- Update udm.yaml
+UDM handles user data management and subscription information. It must also use Home PLMN FQDN to ensure proper user data retrieval and management for roaming subscribers.
+
+**Update udm.yaml:**
 
 ```diff
 $ diff -u ./install/etc/open5gs/udm.yaml.old ./install/etc/open5gs/udm.yaml
@@ -187,7 +212,9 @@
  ################################################################################
 ```
 
-- Update udr.yaml
+UDR stores subscription data and user profiles. It needs updated SCP client configuration to properly communicate with other network functions through the service communication proxy.
+
+**Update udr.yaml:**
 
 ```diff
 $ diff -u ./install/etc/open5gs/udr.yaml.old ./install/etc/open5gs/udr.yaml
@@ -204,7 +231,200 @@
  # SBI Server
 ```
 
-- Update sepp1.yaml
+SMF manages PDU sessions and requires comprehensive configuration for data plane handling. It coordinates with UPF for user plane traffic and handles session establishment, modification, and termination.
+
+**Create h-smf.yaml:**
+
+```bash
+$ sh -c 'cat << EOF > ./install/etc/open5gs/h-smf.yaml
+logger:
+  file:
+    path: /home/acetcom/Documents/git/open5gs/install/var/log/open5gs/smf.log
+#  level: info   # fatal|error|warn|info(default)|debug|trace
+
+global:
+  max:
+    ue: 1024  # The number of UE can be increased depending on memory size.
+#    peer: 64
+
+smf:
+  sbi:
+    server:
+      - address: smf.5gc.mnc070.mcc999.3gppnetwork.org
+    client:
+#      nrf:
+#        - uri: http://127.0.1.10:7777
+      scp:
+        - uri: http://127.0.1.200:7777
+  pfcp:
+    server:
+      - address: 127.0.1.4
+    client:
+      upf:
+        - address: 127.0.1.7
+  gtpc:
+    server:
+      - address: 127.0.1.4
+  gtpu:
+    server:
+      - address: 127.0.1.4
+  metrics:
+    server:
+      - address: 127.0.1.4
+        port: 9090
+  session:
+    - subnet: 10.46.0.0/16
+      gateway: 10.46.0.1
+    - subnet: 2001:db8:babe::/48
+      gateway: 2001:db8:babe::1
+  dns:
+    - 8.8.8.8
+    - 8.8.4.4
+    - 2001:4860:4860::8888
+    - 2001:4860:4860::8844
+  mtu: 1400
+EOF'
+```
+
+UPF handles user data forwarding and requires coordination with SMF. It manages the user plane traffic routing and forwarding, including packet inspection and QoS enforcement.
+
+**Create h-upf.yaml:**
+
+```bash
+$ sh -c 'cat << EOF > ./install/etc/open5gs/h-upf.yaml
+logger:
+  file:
+    path: /home/acetcom/Documents/git/open5gs/install/var/log/open5gs/upf.log
+#  level: info   # fatal|error|warn|info(default)|debug|trace
+
+global:
+  max:
+    ue: 1024  # The number of UE can be increased depending on memory size.
+#    peer: 64
+
+upf:
+  pfcp:
+    server:
+      - address: 127.0.1.7
+    client:
+#      smf:     #  UPF PFCP Client try to associate SMF PFCP Server
+#        - address: 127.0.1.4
+  gtpu:
+    server:
+      - address: 127.0.1.7
+  session:
+    - subnet: 10.46.0.0/16
+      gateway: 10.46.0.1
+      dev: ogstun2
+    - subnet: 2001:db8:babe::/48
+      gateway: 2001:db8:babe::1
+      dev: ogstun2
+  metrics:
+    server:
+      - address: 127.0.1.7
+        port: 9090
+EOF'
+```
+
+PCF provides policy control and charging rules for subscriber sessions. It determines QoS policies, charging rules, and session management policies based on subscriber profiles and network conditions.
+
+**Create h-pcf.yaml:**
+
+```bash
+$ sh -c 'cat << EOF > ./install/etc/open5gs/h-pcf.yaml
+db_uri: mongodb://localhost/open5gs
+logger:
+  file:
+    path: /home/acetcom/Documents/git/open5gs/install/var/log/open5gs/pcf.log
+#  level: info   # fatal|error|warn|info(default)|debug|trace
+
+global:
+  max:
+    ue: 1024  # The number of UE can be increased depending on memory size.
+#    peer: 64
+
+pcf:
+  sbi:
+    server:
+      - address: 127.0.1.13
+        port: 7777
+    client:
+#      nrf:
+#        - uri: http://127.0.0.10:7777
+      scp:
+        - uri: http://127.0.1.200:7777
+  metrics:
+    server:
+      - address: 127.0.1.13
+        port: 9090
+EOF'
+```
+
+BSF manages binding information for network functions. It maintains bindings between different network function instances and provides binding discovery services for dynamic network function selection.
+
+**Create h-bsf.yaml:**
+
+```bash
+$ sh -c 'cat << EOF > ./install/etc/open5gs/h-bsf.yaml
+logger:
+  file:
+    path: /home/acetcom/Documents/git/open5gs/install/var/log/open5gs/bsf.log
+#  level: info   # fatal|error|warn|info(default)|debug|trace
+
+global:
+  max:
+    ue: 1024  # The number of UE can be increased depending on memory size.
+#    peer: 64
+
+bsf:
+  sbi:
+    server:
+      - address: 127.0.1.15
+        port: 7777
+    client:
+#      nrf:
+#        - uri: http://127.0.0.10:7777
+      scp:
+        - uri: http://127.0.1.200:7777
+EOF'
+```
+
+NSSF handles network slice selection and must use FQDN for proper slice identification. It determines which network slice instance should serve a particular UE based on subscription information and network slice availability.
+
+**Create h-nssf.yaml:**
+
+```bash
+$ sh -c 'cat << EOF > ./install/etc/open5gs/h-nssf.yaml
+logger:
+  file:
+    path: /home/acetcom/Documents/git/open5gs/install/var/log/open5gs/nssf.log
+#  level: info   # fatal|error|warn|info(default)|debug|trace
+
+global:
+  max:
+    ue: 1024  # The number of UE can be increased depending on memory size.
+#    peer: 64
+
+nssf:
+  sbi:
+    server:
+      - address: nssf.5gc.mnc070.mcc999.3gppnetwork.org
+    client:
+#      nrf:
+#        - uri: http://127.0.0.10:7777
+      scp:
+        - uri: http://127.0.1.200:7777
+      nsi:
+        - uri: http://nrf.5gc.mnc070.mcc999.3gppnetwork.org
+          s_nssai:
+            sst: 1
+EOF'
+```
+
+
+SEPP handles security for inter-PLMN communication and requires SCP client update. It provides security functions for N32 interface communication between different PLMN networks, including message filtering and topology hiding.
+
+**Update sepp1.yaml:**
 
 ```diff
 $ diff -u ./install/etc/open5gs/sepp1.yaml.old ./install/etc/open5gs/sepp1.yaml
@@ -223,15 +443,15 @@
 
 ### Visited PLMN
 
-The Visited Network should be configured using the PLMN ID 001/01, so the NRF and AMF settings should be changed accordingly.
+The visited network NRF must be configured with the visited PLMN ID and use appropriate FQDN for network function registration and discovery.
 
-- Update nrf.yaml
+**Update nrf.yaml:**
 
 ```diff
-$ diff -u ./install/etc/open5gs/nrf.yaml.old ./install/etc/open5gs/nrf.yaml
---- ./install/etc/open5gs/nrf.yaml.old	2023-11-19 18:02:34.105115863 +0900
-+++ ./install/etc/open5gs/nrf.yaml	2023-11-19 18:02:59.981115848 +0900
-@@ -10,8 +10,8 @@
+$ diff -u ./install/etc/open5gs/nrf.yaml ./install.new/etc/open5gs/nrf.yaml
+--- ./install/etc/open5gs/nrf.yaml	2025-07-18 21:57:51.244553083 +0900
++++ ./install.new/etc/open5gs/nrf.yaml	2025-07-18 21:32:57.596880880 +0900
+@@ -11,12 +11,11 @@
  nrf:
    serving:  # 5G roaming requires PLMN in NRF
      - plmn_id:
@@ -241,16 +461,42 @@
 +        mnc: 01
    sbi:
      server:
-       - address: 127.0.0.10
+-      - address: 127.0.0.10
+-        port: 7777
++      - address: nrf.5gc.mnc001.mcc001.3gppnetwork.org
+
+ ################################################################################
+ # SBI Server
 ```
 
-- Update amf.yaml
+The visited network SCP must be updated to reference the visited network NRF for proper service discovery and communication routing.
+
+**Update scp.yaml:**
+
+```diff
+$ diff -u ./install/etc/open5gs/scp.yaml ./install.new/etc/open5gs/scp.yaml
+--- ./install/etc/open5gs/scp.yaml	2025-07-18 21:57:51.262552520 +0900
++++ ./install.new/etc/open5gs/scp.yaml	2025-07-18 21:33:54.670492255 +0900
+@@ -15,7 +15,7 @@
+         port: 7777
+     client:
+       nrf:
+-        - uri: http://127.0.0.10:7777
++        - uri: http://nrf.5gc.mnc001.mcc001.3gppnetwork.org
+
+ ################################################################################
+ # SCP Info
+ ```
+
+AMF handles access and mobility management for UEs. The visited network AMF must be configured to support both home and visited PLMN access control, and handle roaming subscribers appropriately.
+
+**Update amf.yaml:**
 
 ```diff
-$ diff -u ./install/etc/open5gs/amf.yaml.old ./install/etc/open5gs/amf.yaml
---- ./install/etc/open5gs/amf.yaml.old	2023-11-19 17:50:42.997116266 +0900
-+++ ./install/etc/open5gs/amf.yaml	2023-11-19 19:08:59.145113607 +0900
-@@ -19,27 +19,34 @@
+$ diff -u ./install/etc/open5gs/amf.yaml ./install.new/etc/open5gs/amf.yaml
+--- ./install/etc/open5gs/amf.yaml	2025-07-18 21:57:51.173555303 +0900
++++ ./install.new/etc/open5gs/amf.yaml	2025-07-18 21:05:05.396288769 +0900
+@@ -20,27 +20,34 @@
          - uri: http://127.0.0.200:7777
    ngap:
      server:
@@ -293,28 +539,43 @@
    security:
 ```
 
-Due to the absence of UDR in the visiting network, V-PCF uses locally configured policies. When the UE is located in the home PLMN (001/01), MongoDB is used. On the other hand, when the UE is located in the visiting PLMN (999/70, 315/010), locally configured policies are used. This is because there is no session management policy data for the UE in the visiting network, so locally configured information based on the roaming agreement is used.
+The visited network SMF must use the visited PLMN FQDN for proper session management and coordination with other network functions.
 
-- Update pcf.yaml
+**Update smf.yaml:**
+
+```diff
+$ diff -u ./install/etc/open5gs/smf.yaml ./install.new/etc/open5gs/smf.yaml
+--- ./install/etc/open5gs/smf.yaml	2025-07-18 21:57:51.154555897 +0900
++++ ./install.new/etc/open5gs/smf.yaml	2025-07-18 21:28:29.423632460 +0900
+@@ -11,8 +11,7 @@
+ smf:
+   sbi:
+     server:
+-      - address: 127.0.0.4
+-        port: 7777
++      - address: smf.5gc.mnc001.mcc001.3gppnetwork.org
+     client:
+ #      nrf:
+ #        - uri: http://127.0.0.10:7777
+ ```
+
+
+Due to the absence of UDR in the visiting network, V-PCF uses locally configured policies. When the UE is located in the home PLMN (999/70), MongoDB is used. When the UE is located in the visiting PLMN (001/01), locally configured policies are used based on roaming agreements.
+
+**Update pcf.yaml:**
 
 ```diff
-$ diff -u ./install/etc/open5gs/pcf.yaml.old ./install/etc/open5gs/pcf.yaml
---- ./install/etc/open5gs/pcf.yaml.old	2023-11-19 18:05:35.389115760 +0900
-+++ ./install/etc/open5gs/pcf.yaml	2023-11-19 19:02:27.221113829 +0900
-@@ -1,4 +1,3 @@
--db_uri: mongodb://localhost/open5gs
- logger:
-   file:
-     path: /home/acetcom/Documents/git/open5gs/install/var/log/open5gs/pcf.log
- #  level: info   # fatal|error|warn|info(default)|debug|trace
-@@ -22,6 +21,29 @@
+$ diff --git a/configs/open5gs/pcf.yaml.in b/configs/open5gs/pcf.yaml.in
+index 4c5d103f9..d16e85728 100644
+--- a/configs/open5gs/pcf.yaml.in
++++ b/configs/open5gs/pcf.yaml.in
+@@ -23,6 +23,84 @@ pcf:
      server:
        - address: 127.0.0.13
          port: 9090
 +  policy:
-+    - plmn_id:
-+        mcc: 999
-+        mnc: 70
++    - supi_range:
++        - 999700000000001-999709999999999
 +      slice:
 +        - sst: 1  # 1,2,3,4
 +          default_indicator: true
@@ -334,9 +595,111 @@
 +                  priority_level: 8  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
 +                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
 +                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
++            - name: ims
++              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
++              ambr:
++                downlink:
++                  value: 1
++                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                uplink:
++                  value: 1
++                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++              qos:
++                index: 5  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
++                arp:
++                  priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
++                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
++                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
++              pcc_rule:
++                - qos:
++                    index: 1  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
++                    arp:
++                      priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
++                      pre_emption_vulnerability: 1   # 1: Disabled, 2:Enabled
++                      pre_emption_capability: 1   # 1: Disabled, 2:Enabled
++                    mbr:
++                      downlink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                    gbr:
++                      downlink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                - qos:
++                    index: 2  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
++                    arp:
++                      priority_level: 4  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
++                      pre_emption_vulnerability: 2   # 1: Disabled, 2:Enabled
++                      pre_emption_capability: 2   # 1: Disabled, 2:Enabled
++                    mbr:
++                      downlink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                    gbr:
++                      downlink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
 
  ################################################################################
- # Locally configured policy
+ # PCF Policy Configuration: UE Home PLMN and SUPI Range Based Policies
+```
+
+The visited network BSF requires updated addresses to align with the visited network addressing scheme.
+
+**Update bsf.yaml:**
+
+```diff
+$ diff -u ./install/etc/open5gs/bsf.yaml ./install.new/etc/open5gs/bsf.yaml
+--- ./install/etc/open5gs/bsf.yaml	2025-12-23 15:08:00.929141999 +0900
++++ ./install.new/etc/open5gs/bsf.yaml	2025-12-23 15:08:31.540143864 +0900
+@@ -11,7 +11,7 @@
+ bsf:
+   sbi:
+     server:
+-      - address: 127.0.0.15
++      - address: 127.0.2.15
+         port: 7777
+     client:
+ #      nrf:
+```
+The visited network NSSF must use the visited PLMN FQDN and reference the appropriate NRF for network slice selection services.
+
+**Update nssf.yaml:**
+
+```diff
+diff -u ./install/etc/open5gs/nssf.yaml ./install.new/etc/open5gs/nssf.yaml
+--- ./install/etc/open5gs/nssf.yaml	2025-07-18 21:57:51.387548612 +0900
++++ ./install.new/etc/open5gs/nssf.yaml	2025-07-18 21:21:33.415221920 +0900
+@@ -11,15 +11,14 @@
+ nssf:
+   sbi:
+     server:
+-      - address: 127.0.0.14
+-        port: 7777
++      - address: nssf.5gc.mnc001.mcc001.3gppnetwork.org
+     client:
+ #      nrf:
+ #        - uri: http://127.0.0.10:7777
+       scp:
+         - uri: http://127.0.0.200:7777
+       nsi:
+-        - uri: http://127.0.0.10:7777
++        - uri: http://nrf.5gc.mnc001.mcc001.3gppnetwork.org
+           s_nssai:
+             sst: 1
+ ################################################################################
 ```
 
 ### Run the V-PLMN 5G Core and H-PLMN 5G Core on a single host
@@ -351,19 +714,24 @@
 $ sudo ./install/bin/open5gs-ausfd
 $ sudo ./install/bin/open5gs-udmd
 $ ./install/bin/open5gs-udrd
+$ sudo ./install/bin/open5gs-smfd -c ./install/etc/open5gs/h-smf.yaml
+$ ./install/bin/open5gs-upfd -c ./install/etc/open5gs/h-upf.yaml
+$ ./install/bin/open5gs-pcfd -c ./install/etc/open5gs/h-pcf.yaml
+$ ./install/bin/open5gs-bsfd -c ./install/etc/open5gs/h-bsf.yaml
+$ sudo ./install/bin/open5gs-nssfd -c ./install/etc/open5gs/h-nssf.yaml
 $ ./install/bin/open5gs-seppd -c ./install/etc/open5gs/sepp1.yaml
 ```
 
 #### Visited Network
 ```
-$ ./install/bin/open5gs-nrfd
+$ sudo ./install/bin/open5gs-nrfd
 $ ./install/bin/open5gs-scpd
 $ ./install/bin/open5gs-amfd
-$ ./install/bin/open5gs-smfd
+$ sudo ./install/bin/open5gs-smfd
 $ ./install/bin/open5gs-upfd
 $ ./install/bin/open5gs-pcfd
 $ ./install/bin/open5gs-bsfd
-$ ./install/bin/open5gs-nssfd
+$ sudo ./install/bin/open5gs-nssfd
 $ ./install/bin/open5gs-seppd -c ./install/etc/open5gs/sepp2.yaml
 ```
 
@@ -417,21 +785,24 @@
 - Edit /etc/hosts
 
 ```diff
- $ diff -u hosts.old hosts.new
---- hosts.old	2023-10-02 12:22:41.320546720 +0900
-+++ hosts.new	2023-10-02 12:22:33.576884651 +0900
-@@ -1,6 +1,10 @@
+$ diff -u hosts.old hosts.new
+--- hosts.old	2025-07-19 07:02:44.813666212 +0900
++++ hosts.new	2025-07-19 07:02:51.019489167 +0900
+@@ -1,6 +1,13 @@
  127.0.0.1	localhost
  127.0.1.1	open5gs
 
-+127.0.0.10	nrf.5gc.mnc070.mcc999.3gppnetwork.org
-+127.0.0.11	ausf.5gc.mnc070.mcc999.3gppnetwork.org
-+127.0.0.12	udm.5gc.mnc070.mcc999.3gppnetwork.org
++127.0.1.10	nrf.5gc.mnc070.mcc999.3gppnetwork.org
++127.0.1.11	ausf.5gc.mnc070.mcc999.3gppnetwork.org
++127.0.1.12	udm.5gc.mnc070.mcc999.3gppnetwork.org
++127.0.1.14	nssf.5gc.mnc070.mcc999.3gppnetwork.org
++127.0.1.4	smf.5gc.mnc070.mcc999.3gppnetwork.org
++127.0.1.15	bsf.5gc.mnc070.mcc999.3gppnetwork.org
 +
  # The following lines are desirable for IPv6 capable hosts
  ::1     ip6-localhost ip6-loopback
  fe00::0 ip6-localnet
- ```
+```
 
 NRF shall follow TS23.003(28.3.2.3.2 Format of NRF FQDN) for routing.
 
@@ -476,21 +847,30 @@
 
 ```diff
 $ diff --git a/configs/open5gs/nssf.yaml.in b/configs/open5gs/nssf.yaml.in
-index d01645b2c..7d89cffef 100644
+index 015085f56..92ceb63b5 100644
 --- a/configs/open5gs/nssf.yaml.in
 +++ b/configs/open5gs/nssf.yaml.in
-@@ -17,7 +17,7 @@ nssf:
-         scp:
-           - uri: http://127.0.0.200:7777
-         nsi:
--          - uri: http://127.0.0.10:7777
-+          - uri: http://nrf.5gc.mnc070.mcc999.3gppnetwork.org
-             s_nssai:
-               sst: 1
+@@ -11,15 +11,14 @@ global:
+ nssf:
+   sbi:
+     server:
+-      - address: 127.0.0.14
+-        port: 7777
++      - address: nssf.5gc.mnc070.mcc999.3gppnetwork.org
+     client:
+ #      nrf:
+ #        - uri: http://127.0.0.10:7777
+       scp:
+         - uri: http://127.0.0.200:7777
+       nsi:
+-        - uri: http://127.0.0.10:7777
++        - uri: http://nrf.5gc.mnc070.mcc999.3gppnetwork.org
+           s_nssai:
+             sst: 1
  ################################################################################
 ```
 
-AUSF and UDM shall use FQDN in the Home PLMN.
+AUSF, UDM and SMF shall use FQDN in the Home PLMN.
 
 - Update ausf.yaml
 
@@ -530,6 +910,25 @@
  #          - uri: http://127.0.0.10:7777
 ```
 
+- Update smf.yaml
+```diff
+$ diff --git a/configs/open5gs/smf.yaml.in b/configs/open5gs/smf.yaml.in
+index e47752393..b6cee9ff8 100644
+--- a/configs/open5gs/smf.yaml.in
++++ b/configs/open5gs/smf.yaml.in
+@@ -11,8 +11,7 @@ global:
+ smf:
+   sbi:
+     server:
+-      - address: 127.0.0.4
+-        port: 7777
++      - address: smf.5gc.mnc070.mcc999.3gppnetwork.org
+     client:
+ #      nrf:
+ #        - uri: http://127.0.0.10:7777
+```
+
+
 AMF and UPF must use external IP addresses such as 10.10.1.x for communication between VM2 and VM3.
 
 - Update amf.yaml
@@ -588,17 +987,17 @@
 
 ```diff
 $ diff --git a/configs/open5gs/pcf.yaml.in b/configs/open5gs/pcf.yaml.in
-index 2df2e9a36..9eea1f1de 100644
+index 4c5d103f9..c1526ff3a 100644
 --- a/configs/open5gs/pcf.yaml.in
 +++ b/configs/open5gs/pcf.yaml.in
-@@ -22,6 +22,51 @@ pcf:
+@@ -23,6 +23,85 @@ pcf:
      server:
        - address: 127.0.0.13
          port: 9090
 +  policy:
-+    - plmn_id:
-+        mcc: 001
-+        mnc: 01
++    - supi_range:
++        - 001010000000001-001019999999999
++        - 315010000000001-315010999999999
 +      slice:
 +        - sst: 1  # 1,2,3,4
 +          default_indicator: true
@@ -618,14 +1017,7 @@
 +                  priority_level: 8  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
 +                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
 +                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
-+    - plmn_id:
-+        mcc: 315
-+        mnc: 010
-+      slice:
-+        - sst: 1  # 1,2,3,4
-+          default_indicator: true
-+          session:
-+            - name: internet
++            - name: ims
 +              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
 +              ambr:
 +                downlink:
@@ -633,13 +1025,57 @@
 +                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
 +                uplink:
 +                  value: 1
-+                  unit: 3
++                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
 +              qos:
-+                index: 9  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
++                index: 5  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
 +                arp:
-+                  priority_level: 8  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
++                  priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
 +                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
 +                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
++              pcc_rule:
++                - qos:
++                    index: 1  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
++                    arp:
++                      priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
++                      pre_emption_vulnerability: 1   # 1: Disabled, 2:Enabled
++                      pre_emption_capability: 1   # 1: Disabled, 2:Enabled
++                    mbr:
++                      downlink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                    gbr:
++                      downlink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                - qos:
++                    index: 2  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
++                    arp:
++                      priority_level: 4  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
++                      pre_emption_vulnerability: 2   # 1: Disabled, 2:Enabled
++                      pre_emption_capability: 2   # 1: Disabled, 2:Enabled
++                    mbr:
++                      downlink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                    gbr:
++                      downlink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+
+ ################################################################################
+ # PCF Policy Configuration: UE Home PLMN and SUPI Range Based Policies
 ```
 
 For now we will set up SEPP without using TLS.
@@ -711,21 +1147,24 @@
 - Edit /etc/hosts
 
 ```diff
- $ diff -u hosts.old hosts.new
---- hosts.old	2023-10-02 12:22:41.320546720 +0900
-+++ hosts.new	2023-10-02 12:22:33.576884651 +0900
-@@ -1,6 +1,10 @@
+$ diff -u hosts.old hosts.new
+--- hosts.old	2025-07-19 07:02:44.813666212 +0900
++++ hosts.new	2025-07-19 07:03:40.466147375 +0900
+@@ -1,6 +1,13 @@
  127.0.0.1	localhost
  127.0.1.1	open5gs
 
-+127.0.0.10	nrf.5gc.mnc001.mcc001.3gppnetwork.org
-+127.0.0.11	ausf.5gc.mnc001.mcc001.3gppnetwork.org
-+127.0.0.12	udm.5gc.mnc001.mcc001.3gppnetwork.org
++127.0.2.10	nrf.5gc.mnc001.mcc001.3gppnetwork.org
++127.0.2.11	ausf.5gc.mnc001.mcc001.3gppnetwork.org
++127.0.2.12	udm.5gc.mnc001.mcc001.3gppnetwork.org
++127.0.2.14	nssf.5gc.mnc001.mcc001.3gppnetwork.org
++127.0.2.4	smf.5gc.mnc001.mcc001.3gppnetwork.org
++127.0.2.15	baf.5gc.mnc001.mcc001.3gppnetwork.org
 +
  # The following lines are desirable for IPv6 capable hosts
  ::1     ip6-localhost ip6-loopback
  fe00::0 ip6-localnet
- ```
+```
 
 NRF shall follow TS23.003(28.3.2.3.2 Format of NRF FQDN) for routing.
 
@@ -776,21 +1215,30 @@
 
 ```diff
 $ diff --git a/configs/open5gs/nssf.yaml.in b/configs/open5gs/nssf.yaml.in
-index d01645b2c..7d89cffef 100644
+index 015085f56..92ceb63b5 100644
 --- a/configs/open5gs/nssf.yaml.in
 +++ b/configs/open5gs/nssf.yaml.in
-@@ -17,7 +17,7 @@ nssf:
-         scp:
-           - uri: http://127.0.0.200:7777
-         nsi:
--          - uri: http://127.0.0.10:7777
-+          - uri: http://nrf.5gc.mnc001.mcc001.3gppnetwork.org
-             s_nssai:
-               sst: 1
+@@ -11,15 +11,14 @@ global:
+ nssf:
+   sbi:
+     server:
+-      - address: 127.0.0.14
+-        port: 7777
++      - address: nssf.5gc.mnc001.mcc001.3gppnetwork.org
+     client:
+ #      nrf:
+ #        - uri: http://127.0.0.10:7777
+       scp:
+         - uri: http://127.0.0.200:7777
+       nsi:
+-        - uri: http://127.0.0.10:7777
++        - uri: http://nrf.5gc.mnc001.mcc001.3gppnetwork.org
+           s_nssai:
+             sst: 1
  ################################################################################
 ```
 
-AUSF and UDM shall use FQDN in the Home PLMN.
+AUSF, UDM and SMF shall use FQDN in the Home PLMN.
 
 - Update ausf.yaml
 
@@ -830,6 +1278,25 @@
  #          - uri: http://127.0.0.10:7777
 ```
 
+- Update smf.yaml
+```diff
+$ diff --git a/configs/open5gs/smf.yaml.in b/configs/open5gs/smf.yaml.in
+index e47752393..b6cee9ff8 100644
+--- a/configs/open5gs/smf.yaml.in
++++ b/configs/open5gs/smf.yaml.in
+@@ -11,8 +11,7 @@ global:
+ smf:
+   sbi:
+     server:
+-      - address: 127.0.0.4
+-        port: 7777
++      - address: smf.5gc.mnc001.mcc001.3gppnetwork.org
+     client:
+ #      nrf:
+ #        - uri: http://127.0.0.10:7777
+```
+
+
 AMF and UPF must use external IP addresses such as 10.10.2.x for communication between VM1 and VM3.
 
 - Update amf.yaml
@@ -909,17 +1376,17 @@
 
 ```diff
 $ diff --git a/configs/open5gs/pcf.yaml.in b/configs/open5gs/pcf.yaml.in
-index 2df2e9a36..9eea1f1de 100644
+index 4c5d103f9..c1526ff3a 100644
 --- a/configs/open5gs/pcf.yaml.in
 +++ b/configs/open5gs/pcf.yaml.in
-@@ -22,6 +22,51 @@ pcf:
+@@ -23,6 +23,85 @@ pcf:
      server:
        - address: 127.0.0.13
          port: 9090
 +  policy:
-+    - plmn_id:
-+        mcc: 999
-+        mnc: 70
++    - supi_range:
++        - 999700000000001-999709999999999
++        - 315010000000001-315010999999999
 +      slice:
 +        - sst: 1  # 1,2,3,4
 +          default_indicator: true
@@ -939,14 +1406,7 @@
 +                  priority_level: 8  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
 +                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
 +                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
-+    - plmn_id:
-+        mcc: 315
-+        mnc: 010
-+      slice:
-+        - sst: 1  # 1,2,3,4
-+          default_indicator: true
-+          session:
-+            - name: internet
++            - name: ims
 +              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
 +              ambr:
 +                downlink:
@@ -954,13 +1414,57 @@
 +                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
 +                uplink:
 +                  value: 1
-+                  unit: 3
++                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
 +              qos:
-+                index: 9  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
++                index: 5  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
 +                arp:
-+                  priority_level: 8  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
++                  priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
 +                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
 +                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
++              pcc_rule:
++                - qos:
++                    index: 1  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
++                    arp:
++                      priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
++                      pre_emption_vulnerability: 1   # 1: Disabled, 2:Enabled
++                      pre_emption_capability: 1   # 1: Disabled, 2:Enabled
++                    mbr:
++                      downlink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                    gbr:
++                      downlink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                - qos:
++                    index: 2  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
++                    arp:
++                      priority_level: 4  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
++                      pre_emption_vulnerability: 2   # 1: Disabled, 2:Enabled
++                      pre_emption_capability: 2   # 1: Disabled, 2:Enabled
++                    mbr:
++                      downlink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                    gbr:
++                      downlink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
+
+ ################################################################################
+ # PCF Policy Configuration: UE Home PLMN and SUPI Range Based Policies
 ```
 
 For now we will set up SEPP without using TLS.
@@ -1033,20 +1537,23 @@
 
 ```diff
  $ diff -u hosts.old hosts.new
---- hosts.old	2023-10-02 12:22:41.320546720 +0900
-+++ hosts.new	2023-10-02 12:22:33.576884651 +0900
-@@ -1,6 +1,10 @@
+--- hosts.old	2025-07-19 07:02:44.813666212 +0900
++++ hosts.new	2025-07-19 07:04:14.598284689 +0900
+@@ -1,6 +1,13 @@
  127.0.0.1	localhost
  127.0.1.1	open5gs
 
-+127.0.0.10	nrf.5gc.mnc010.mcc315.3gppnetwork.org
-+127.0.0.11	ausf.5gc.mnc010.mcc315.3gppnetwork.org
-+127.0.0.12	udm.5gc.mnc010.mcc315.3gppnetwork.org
++127.0.3.10	nrf.5gc.mnc010.mcc315.3gppnetwork.org
++127.0.3.11	ausf.5gc.mnc010.mcc315.3gppnetwork.org
++127.0.3.12	udm.5gc.mnc010.mcc315.3gppnetwork.org
++127.0.3.14	nssf.5gc.mnc010.mcc315.3gppnetwork.org
++127.0.3.4	smf.5gc.mnc010.mcc315.3gppnetwork.org
++127.0.3.15	bsf.5gc.mnc010.mcc315.3gppnetwork.org
 +
  # The following lines are desirable for IPv6 capable hosts
  ::1     ip6-localhost ip6-loopback
  fe00::0 ip6-localnet
- ```
+```
 
 NRF shall follow TS23.003(28.3.2.3.2 Format of NRF FQDN) for routing.
 
@@ -1097,21 +1604,30 @@
 
 ```diff
 $ diff --git a/configs/open5gs/nssf.yaml.in b/configs/open5gs/nssf.yaml.in
-index d01645b2c..7d89cffef 100644
+index 015085f56..92ceb63b5 100644
 --- a/configs/open5gs/nssf.yaml.in
 +++ b/configs/open5gs/nssf.yaml.in
-@@ -17,7 +17,7 @@ nssf:
-         scp:
-           - uri: http://127.0.0.200:7777
-         nsi:
--          - uri: http://127.0.0.10:7777
-+          - uri: http://nrf.5gc.mnc010.mcc315.3gppnetwork.org
-             s_nssai:
-               sst: 1
+@@ -11,15 +11,14 @@ global:
+ nssf:
+   sbi:
+     server:
+-      - address: 127.0.0.14
+-        port: 7777
++      - address: nssf.5gc.mnc010.mcc315.3gppnetwork.org
+     client:
+ #      nrf:
+ #        - uri: http://127.0.0.10:7777
+       scp:
+         - uri: http://127.0.0.200:7777
+       nsi:
+-        - uri: http://127.0.0.10:7777
++        - uri: http://nrf.5gc.mnc010.mcc315.3gppnetwork.org
+           s_nssai:
+             sst: 1
  ################################################################################
 ```
 
-AUSF and UDM shall use FQDN in the Home PLMN.
+AUSF, UDM and SMF shall use FQDN in the Home PLMN.
 
 - Update ausf.yaml
 
@@ -1151,6 +1667,24 @@
  #          - uri: http://127.0.0.10:7777
 ```
 
+- Update smf.yaml
+```diff
+$ diff --git a/configs/open5gs/smf.yaml.in b/configs/open5gs/smf.yaml.in
+index e47752393..b6cee9ff8 100644
+--- a/configs/open5gs/smf.yaml.in
++++ b/configs/open5gs/smf.yaml.in
+@@ -11,8 +11,7 @@ global:
+ smf:
+   sbi:
+     server:
+-      - address: 127.0.0.4
+-        port: 7777
++      - address: smf.5gc.mnc010.mcc315.3gppnetwork.org
+     client:
+ #      nrf:
+ #        - uri: http://127.0.0.10:7777
+```
+
 AMF and UPF must use external IP addresses such as 10.10.3.x for communication between VM1 and VM2.
 
 - Update amf.yaml
@@ -1230,17 +1764,17 @@
 
 ```diff
 $ diff --git a/configs/open5gs/pcf.yaml.in b/configs/open5gs/pcf.yaml.in
-index 2df2e9a36..9eea1f1de 100644
+index 4c5d103f9..c1526ff3a 100644
 --- a/configs/open5gs/pcf.yaml.in
 +++ b/configs/open5gs/pcf.yaml.in
-@@ -22,6 +22,51 @@ pcf:
+@@ -23,6 +23,85 @@ pcf:
      server:
        - address: 127.0.0.13
          port: 9090
 +  policy:
-+    - plmn_id:
-+        mcc: 999
-+        mnc: 70
++    - supi_range:
++        - 999700000000001-999709999999999
++        - 001010000000001-001019999999999
 +      slice:
 +        - sst: 1  # 1,2,3,4
 +          default_indicator: true
@@ -1260,14 +1794,7 @@
 +                  priority_level: 8  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
 +                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
 +                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
-+    - plmn_id:
-+        mcc: 001
-+        mnc: 01
-+      slice:
-+        - sst: 1  # 1,2,3,4
-+          default_indicator: true
-+          session:
-+            - name: internet
++            - name: ims
 +              type: 3  # 1:IPv4, 2:IPv6, 3:IPv4v6
 +              ambr:
 +                downlink:
@@ -1275,57 +1802,57 @@
 +                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
 +                uplink:
 +                  value: 1
-+                  unit: 3
++                  unit: 3  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
 +              qos:
-+                index: 9  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
++                index: 5  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
 +                arp:
-+                  priority_level: 8  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
++                  priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
 +                  pre_emption_vulnerability: 1  # 1: Disabled, 2:Enabled
 +                  pre_emption_capability: 1  # 1: Disabled, 2:Enabled
-```
-
-For now we will set up SEPP without using TLS.
-
-- Create sepp.yaml
-
-```bash
-$ sh -c 'cat << EOF > ./install/etc/open5gs/sepp.yaml
-logger:
-    file:
-      path: /home/acetcom/Documents/git/open5gs/install/var/log/open5gs/sepp.log
-#    level: info   # fatal|error|warn|info(default)|debug|trace
++              pcc_rule:
++                - qos:
++                    index: 1  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
++                    arp:
++                      priority_level: 1  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
++                      pre_emption_vulnerability: 1   # 1: Disabled, 2:Enabled
++                      pre_emption_capability: 1   # 1: Disabled, 2:Enabled
++                    mbr:
++                      downlink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                    gbr:
++                      downlink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 82
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                - qos:
++                    index: 2  # 1, 2, 3, 4, 65, 66, 67, 75, 71, 72, 73, 74, 76, 5, 6, 7, 8, 9, 69, 70, 79, 80, 82, 83, 84, 85, 86
++                    arp:
++                      priority_level: 4  # 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
++                      pre_emption_vulnerability: 2   # 1: Disabled, 2:Enabled
++                      pre_emption_capability: 2   # 1: Disabled, 2:Enabled
++                    mbr:
++                      downlink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                    gbr:
++                      downlink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
++                      uplink:
++                        value: 802
++                        unit: 1  # 0:bps, 1:Kbps, 2:Mbps, 3:Gbps, 4:Tbps
 
-max:
-    ue: 1024  # The number of UE can be increased depending on memory size.
-#    peer: 64
-
-sepp:
-    sbi:
-      server:
-        - address: 127.0.0.250
-          port: 7777
-      client:
-        scp:
-          - uri: http://127.0.0.200:7777
-    n32:
-      server:
-        - sender: sepp3.localdomain
-          address: 10.10.3.251
-          port: 7777
-          n32f:
-            address: 10.10.3.252
-            port: 7777
-      client:
-        sepp:
-          - receiver: sepp1.localdomain
-            uri: http://10.10.1.251:7777
-            n32f:
-              uri: http://10.10.1.252:7777
-          - receiver: sepp2.localdomain
-            uri: http://10.10.2.251:7777
-            n32f:
-              uri: http://10.10.2.252:7777
-EOF'
+ ################################################################################
+ # PCF Policy Configuration: UE Home PLMN and SUPI Range Based Policies
 ```
 
 NFs requires root privileges as it uses reserved ports such as http (80) or https (443).

open5gs_2.7.7.tar.xz/docs/_docs/tutorial/07-infoAPI-UE-gNB-session-data.md Added

@@ -0,0 +1,495 @@
+---
+title: Open5GS JSON infoAPI for accessing UE, gNB/eNB, and session data
+---
+
+## How it works
+
+Open5GS has a lightweight HTTP server (already used for `/metrics`) embedded in some NFs.  
+New optional JSON endpoints were added:
+
+| NF  | Endpoint | Content |
+| --- | --- | --- |
+| SMF | /pdu-info | All currently connected UEs + their PDU sessions (IMSI/SUPI, DNN, IPs, S-NSSAI, QoS, state, etc.) |
+| AMF | /gnb-info | All currently connected gNBs and their supported TAs, PLMNs, SCTP info, number of UEs |
+| AMF | /ue-info | All currently connected NR UEs and their info, active gNB, tai, security, slices, am_policy |
+| MME | /enb-info | All currently connected eNBs and their supported TAs, PLMNs, SCTP info, number of UEs |
+| MME | /ue-info | All currently connected LTE UEs and their info, active eNB, tai, pdn info |
+
+They are exposed on the same HTTP port used by Prometheus metrics (default `:9090`).
+
+To reduce processor load when there are a large number of devices, the API includes a pager that limits output.
+
+`/ue-info?page=0&page_size=100`
+
+page in the range 0-n (0 is default),
+
+`page=-1` to avoid paging
+
+`page_size=100` (default and MAX)
+
+---
+
+## How to enable
+
+You need to build Open5GS from the latest `main` branch:
+
+```
+git clone https://github.com/open5gs/open5gs.git
+cd open5gsgit checkout mainmeson build --prefix=`pwd`/installninja -C build install
+```
+
+## How to use
+
+### Get info about PDUs from all UEs connected to 5G NR and LTE basestation
+
+contains session info as APN/DNN, IP addresses, slice info, QoS info, PDU/PDN_state and UE_activity status
+
+```
+curl -s "http://127.0.0.4:9090/pdu-info" |jq . 
+```
+
+##### Example response
+
+```
+{
+  "items": 
+    {
+      "supi": "imsi-231510000114763",
+      "pdu": 
+        {
+          "psi": 1,
+          "dnn": "internet",
+          "ipv4": "10.45.0.11",
+          "snssai": {
+            "sst": 1,
+            "sd": "ffffff"
+          },
+          "qos_flows": 
+            {
+              "qfi": 1,
+              "5qi": 9
+            }
+          ,
+          "pdu_state": "inactive"
+        }
+      ,
+      "ue_activity": "idle"
+    }
+  ,
+  "pager": {
+    "page": 0,
+    "page_size": 100,
+    "count": 1,
+  }
+}
+```
+
+### Get all 5G NR connected UEs (from AMF)
+
+contains the UE_ID as SUPI, SUCI, PEI, GUTI, TMSI, GNB_ID to which the UE is connected, AMBR, slices ..
+
+```
+curl -s "http://127.0.0.5:9090/ue-info" |jq . 
+```
+
+##### Example response
+
+```
+{
+  "items": 
+    {
+      "supi": "imsi-001010000056492",
+      "suci": "suci-0-001-01-0000-1-1-85731c4241d466407311a85135e914987944f361550f13f4532e29bdc5859548a363cc1a81798bb4cc59f2b4db",
+      "pei": "imeisv-3535938300494715",
+      "cm_state": "connected",
+      "guti": "00101-030080-CC00007AB",
+      "m_tmsi": 3221227435,
+      "gnb": {
+        "ostream_id": 1,
+        "amf_ue_ngap_id": 2,
+        "ran_ue_ngap_id": 39,
+        "gnb_id": 100,
+        "cell_id": 1
+      },
+      "location": {
+        "timestamp": 1758733375895512,
+        "nr_tai": {
+          "plmn": "99970",
+          "tac_hex": "000001",
+          "tac": 1
+        },
+        "nr_cgi": {
+          "plmn": "99970",
+          "nci": 1638401,
+          "gnb_id": 100,
+          "cell_id": 1
+        },
+        "last_visited_plmn_id": "000000"
+      },
+      "msisdn": ,
+      "security": {
+        "valid": 1,
+        "enc": "nea2",
+        "int": "nia2"
+      },
+      "ambr": {
+        "downlink": 1000000000,
+        "uplink": 1000000000
+      },
+      "pdu_sessions": ,
+      "pdu_sessions_count": 0,
+      "requested_slices": 
+        {
+          "sst": 1,
+          "sd": "ffffff"
+        }
+      ,
+      "allowed_slices": 
+        {
+          "sst": 1,
+          "sd": "ffffff"
+        }
+      ,
+      "requested_slices_count": 1,
+      "allowed_slices_count": 1,
+      "am_policy_features": 4,
+      "am_policy_features_info": {
+        "hex": "0x0000000000000004",
+        "bits": 
+          2
+        ,
+        "labels": 
+          "QoS Policy Control"
+        
+      }
+    }
+  ,
+  "pager": {
+    "page": 0,
+    "page_size": 100,
+    "count": 2
+  }
+}
+```
+
+### Get all LTE connected UEs ( from MME )
+
+contains the ENB_ID to which the UE is connected
+
+```
+curl -s "http://127.0.0.2:9090/ue-info?" |jq . 
+```
+
+##### Example response
+
+```
+{
+  "items": 
+    {
+      "supi": "999700000021632",
+      "domain": "EPS",
+      "rat": "E-UTRA",
+      "cm_state": "connected",
+      "enb": {
+        "ostream_id": 3,
+        "mme_ue_ngap_id": 3,
+        "ran_ue_ngap_id": 9,
+        "enb_id": 264040,
+        "cell_id": 67594275
+      },
+      "location": {
+        "tai": {
+          "plmn": "99970",
+          "tac_hex": "0001",
+          "tac": 1
+        }
+      },
+      "ambr": {
+        "downlink": 1000000000,
+        "uplink": 1000000000
+      },
+      "pdn": 
+        {
+          "apn": "internet",
+          "qos_flows": 
+            {
+              "ebi": 5
+            }
+          ,
+          "qci": 9,
+          "ebi": 5,
+          "bearer_count": 1,
+          "pdu_state": "active"
+        }
+      ,
+      "pdn_count": 1
+    }
+  ,
+  "pager": {
+    "page": 0,
+    "page_size": 100,
+    "count": 1
+  }
+}
+```
+
+### Get all connected gNBs (from AMF)
+
+contains gNB info and number of RRC connected UEs
+
+```
+curl -s "http://127.0.0.5:9090/gnb-info?" |jq . 
+```
+
+##### Example response
+
+```
+{
+  "items": 
+    {
+      "gnb_id": 100,
+      "plmn": "99970",
+      "network": {
+        "amf_name": "efire-amf0",
+        "ngap_port": 38412
+      },
+      "ng": {
+        "sctp": {
+          "peer": "192.168.168.100:60110",
+          "max_out_streams": 2,
+          "next_ostream_id": 1
+        },
+        "setup_success": true
+      },
+      "supported_ta_list": 
+        {
+          "tac": "000001",
+          "bplmns": 
+            {
+              "plmn": "99970",
+              "snssai": 
+                {
+                  "sst": 1,
+                  "sd": "ffffff"
+                }
+              
+            },
+            {
+              "plmn": "99971",
+              "snssai": 
+                {
+                  "sst": 2,
+                  "sd": "000000"
+                }
+              
+            }
+          
+        }
+      ,
+      "num_connected_ues": 2
+    }
+  ,
+  "pager": {
+    "page": 0,
+    "page_size": 100,
+    "count": 1
+  }
+}
+```
+
+### Get all connected eNBs (from MME)
+
+contains eNB info and number of connected UEs
+
+```
+curl -s "http://127.0.0.2:9090/enb-info?" |jq . 
+```
+
+##### Example response
+
+```
+{
+  "items": 
+    {
+      "enb_id": 264040,
+      "plmn": "99970",
+      "network": {
+        "mme_name": "efire-mme0"
+      },
+      "s1": {
+        "sctp": {
+          "peer": "192.168.168.254:36412",
+          "max_out_streams": 10,
+          "next_ostream_id": 3
+        },
+        "setup_success": true
+      },
+      "supported_ta_list": 
+        {
+          "tac": "0001",
+          "plmn": "99970"
+        }
+      ,
+      "num_connected_ues": 1
+    }
+  ,
+  "pager": {
+    "page": 0,
+    "page_size": 100,
+    "count": 1
+  }
+}
+```
+
+Using a suitable filter in jq, the output can be simplified and adapted to the desired form.
+
+AMF/ue-info sorted on supi ( page=-1 to avoid paging and show all UEs )
+
+```
+./amf_ue_sort.sh 
+supi                  cm-state   gnb_id  dnn
+imsi-001010000056492  connected  100     internet
+imsi-231510000114763  connected  100     internet
+imsi-999700000021630  connected  100     internet
+imsi-999700000083810  idle       100     internet
+imsi-999700000114762  idle       100     internet
+```
+
+```
+curl -s "http://127.0.0.5:9090/ue-info?page=-1" \
+| jq -r '
+  # Unwrap common list keys or accept a bare array/object
+  ( .ue_infos // .items // .data // .results // .list // . )
+  | (if type=="array" then . else . end)
+| sort_by(.supi // "")| group_by(.supi)| map({supi: (.0.supi // "-"),
+  cm: (if any(.; .cm_state == "connected") then "connected"
+       else (.-1.cm_state // "-") end),
+  gnb_id: (
+    (  . | select(.cm_state=="connected")
+          | (.gnb.gnb_id? // .location.nr_cgi.gnb_id?) 
+      | map(select(.!=null)) | .0 )
+    // (  . | (.gnb.gnb_id? // .location.nr_cgi.gnb_id?) 
+         | map(select(.!=null)) | .0 )
+    // "-"
+  ),
+  dnns: (
+     ..pdu_sessions?.dnn 
+    | map(select(. != null and . != ""))
+    | unique | sort
+    | if length==0 then "-" else . end
+  )
+})
+| sort_by( ( .supi | tostring | sub("^imsi-"; "") | tonumber? ) // 0 )
+```
+
+AMF/gnb-info
+
+```
+./amf_gnb_sort.sh 
+gnb_id  peer                     plmn   num_connected_ues
+100     192.168.168.100:60110  99970  1
+411     192.168.168.99:34349   99970  0
+```
+
+```
+curl -s "http://127.0.0.5:9090/gnb-info" \
+| jq -r '
+  ( .items // .gnbs // .data // .results // .list // . )
+  | (if type=="array" then . else . end)
+  | sort_by(.gnb_id // 0)
+  | ("gnb_id","peer","plmn","num_connected_ues"),
+    ( . |
+       (.gnb_id // "-"),
+        (.ng?.sctp?.peer // "-"),
+        (.plmn // "-"),
+        ((.num_connected_ues // 0) | tostring)
+      )
+  | @tsv
+' | column -s $'\t' -t
+```
+
+MME/enb-info
+
+```
+./mme_enb_sort.sh 
+enb_id  peer                     plmn   num_connected_ues
+264040  192.168.168.254:36412  99970  1
+```
+
+```
+curl -s "http://127.0.0.2:9090/enb-info" \
+| jq -r '
+  ( .items // .enbs // .data // .results // .list // . )
+  | (if type=="array" then . else . end)
+  | sort_by(.enb_id // 0)
+  | ("enb_id","peer","plmn","num_connected_ues"),
+    ( . |
+       (.enb_id // "-"),
+        (.s1?.sctp?.peer // "-"),
+        (.plmn // "-"),
+        ((.num_connected_ues // 0) | tostring)
+      )
+  | @tsv
+' | column -s $'\t' -t
+```
+
+MME/ue-info
+
+```
+./mme_ue_sort.sh 
+supi             cm-state   enb_id  apn
+001010000056492  connected  264040  internet
+999700000021632  connected  264040  internet
+999700000083811  connected  264040  internet
+```
+
+```
+curl -s "http://127.0.0.2:9090/ue-info?page=-1" \
+| jq -r '
+  ( .items // .ue_infos // .data // .results // .list // . )
+  | (if type=="array" then . else . end)
+| map(select(((.rat? // "") | test("^(E-?UTRA|LTE)$"; "i")) or((.domain? // "") | test("^EPS$"; "i"))))
+| sort_by(.supi // "")| group_by(.supi)| map({supi: (.0.supi // "-"),cm: (if any(.; .cm_state == "connected") then "connected"else (.-1.cm_state // "-") end),enb_id: ((  . | select(.cm_state=="connected") | .enb.enb_id? | map(select(.!=null)) | .0 )// (  . | .enb.enb_id?  | map(select(.!=null)) | .0 )// "-"),apns: ( ..pdn?.apn | map(select(. != null and . != ""))| unique | sort| if length==0 then "-" else . end)})
+| sort_by( ( .supi | tostring | sub("^imsi-"; "") | tonumber? ) // 0 )
+```
+
+SMF/pdu-info
+
+```
+./smf_pdu_sort.sh 
+supi                  ue_activity  dnn       ipv4/ipv6      pdu_state
+imsi-001010000056492  active       internet  10.45.0.59     active
+imsi-231510000114763  idle         internet  10.45.0.52     inactive
+imsi-999700000021630  idle         internet  10.45.250.250  inactive
+999700000021632       unknown      internet  10.45.0.8      unknown
+imsi-999700000083810  idle         internet  10.45.0.12     inactive
+imsi-999700000114762  idle         internet  10.45.0.10     inactive
+```
+
+```
+curl -s "http://127.0.0.4:9090/pdu-info?page=-1" \
+| jq -r '
+  ( .items // .ue_infos // .data // .results // .list // . )
+  | (if type=="array" then . else . end) as $arr
+| ($arr | map((.pdu // ) | length) | max // 0) as $maxp
+| ( "supi","ue_activity"+ ( range(0; $maxp) | "dnn","ipv4/ipv6","pdu_state" ) ),
+# Rows
+( $arr
+  | sort_by( ( .supi | tostring | sub("^imsi-"; "") | tonumber? ) // 0 )
+  | .
+  | . as $ue
+  | ( $ue.pdu //  | sort_by(.psi // .ebi // 0) ) as $pdus
+  |  ($ue.supi // "-"), ($ue.ue_activity // "-") 
+    + (
+        $pdus
+        | map(
+            (.dnn // .apn // "-"),
+            ( (.ipv4?, .ipv6? | map(select(.!=null and .!="")) | join("/") )
+              | if .=="" then "-" else . end ),
+            (.pdu_state // "-")
+          )
+        | add // 
+      )
+    + (  range( ( ($pdus|length) * 3 ); ($maxp * 3) ) | "-"  )
+)
+```

open5gs_2.7.7.tar.xz/docs/_docs/tutorial/08-AMF-API-addAndDelete-new-PLMN.md Added

@@ -0,0 +1,119 @@
+# Tutorial: Dynamically Adding and Removing PLMNs in the AMF
+
+This tutorial describes the different OAM (Operations, Administration and Maintenance) management API calls for the AMF (Access and Mobility Management Function) in Open5GS. The goal is to dynamically add and remove PLMNs without restarting the AMF.  
+The feature is implemented by extending the SBI, so the API uses HTTP/2.0.
+
+## Objective
+
+Implement a RESTful API that allows you to:
+
+1. Query the configuration of PLMNs and slices (S-NSSAI)
+2. Dynamically add new PLMNs without restarting the AMF
+3. Dynamically delete PLMNs without restarting the AMF and deregister the associated UEs
+4. Automatically notify gNBs about configuration changes
+
+## API Calls
+
+| Method | URL                                                      | Description                                                                                          |
+|--------|-----------------------------------------------------------|------------------------------------------------------------------------------------------------------|
+| GET    | `http://<AMFIP>:7777/namf-oam/v1/plmns`                  | Returns all PLMNs in the current AMF context.                                                       |
+| GET    | `http://<AMFIP>:7777/namf-oam/v1/plmns/{plmnid}`         | Returns detailed information for the PLMN identified by `{plmnid}` (composed of MCC and MNC).      |
+| POST   | `http://<AMFIP>:7777/namf-oam/v1/plmns`                  | Adds a new PLMN to the list or a new `sst`/`sd` combination if the PLMN already exists; notifies gNBs. |
+| DELETE | `http://<AMFIP>:7777/namf-oam/v1/plmns/{plmnid}`         | Deletes the specified PLMN, deregisters the associated UEs, and notifies the gNBs.                  |
+
+## How to use
+
+### Get all PLMNs in the AMF
+Retrieve all PLMNs (mcc, mnc, s_nssai with stt and sd)
+```
+curl --http2-prior-knowledge -X GET http://<AMFIP>:7777/namf-oam/v1/plmns
+```
+
+##### Example response
+```
+{
+        "plmns":        {
+                        "plmn_id":      "99970",
+                        "mcc":  999,
+                        "mnc":  70,
+                        "s_nssai":      {
+                                        "sst":  1,
+                                        "sd":   "333333"
+                                }, {
+                                        "sst":  3
+                                }
+                },
+        "total_plmns":  1,
+        "connected_gnbs":       0,
+        "registered_ues":       0
+}
+```
+
+
+### Get specific PLMN
+Retrieve all entries for the specific PLMN (mcc, mnc, s_nssai with stt and sd) using the PLMN id which is formed using the mcc+mc
+```
+curl --http2-prior-knowledge -X GET http://<AMFIP>:7777/namf-oam/v1/plmns/99970
+```
+
+##### Example response
+```
+{
+        "plmn_id":      "99970",
+        "mcc":  999,
+        "mnc":  70,
+        "s_nssai":      {
+                        "sst":  1,
+                        "sd":   "333333"
+                }, {
+                        "sst":  3
+                }
+}
+```
+
+
+### Add new PLMN in the AMF
+Add a new PLMN to the AMF and notify gnBs (send AMFConfigurationUpdate)
+```
+curl --http2-prior-knowledge -X POST http://<AMFIP>:7777/namf-oam/v1/plmns \
+  -H "Content-Type: application/json" \
+  -d '{
+    "plmn_id": {
+      "mcc": "999",
+      "mnc": "70"
+    },
+    "s_nssai": 
+      {"sst": 1, "sd": "333333"},
+      {"sst": 3}
+    
+  }'
+```
+
+##### Example response
+```
+{
+    "status":       "success",
+    "message":      "PLMN added successfully",
+    "total_plmns":  1
+}
+```
+
+### Remove PLMN
+Remove a PLMN of the AMF and notify the gnBs (send AMFConfigurationUpdate) and unregister the UEs to avoid the go through the CORE 5G
+
+```
+curl --http2-prior-knowledge -X DELETE http://10.244.0.216:7777/namf-oam/v1/plmns/99970
+```
+
+
+##### Example response
+
+```
+{
+        "status":       "success",
+        "message":      "PLMN deleted successfully",
+        "deleted_plmn_id":      "99970",
+        "deleted_entries":      1,
+        "remaining_plmns":      0
+}
+```
\ No newline at end of file

open5gs_2.7.6.tar.xz/docs/_pages/docs.md -> open5gs_2.7.7.tar.xz/docs/_pages/docs.md Changed

@@ -17,6 +17,7 @@
   - VoLTE Setup with Kamailio IMS and Open5GS(tutorial/02-VoLTE-setup)
   - Dockerized VoLTE Setup(tutorial/03-VoLTE-dockerized)
   - Roaming(tutorial/05-roaming)
+  - infoAPI for accessing UE, gNB/eNB, and session data(tutorial/07-infoAPI-UE-gNB-session-data)
 
 - In the lab
   - A Demonstration of 30 Gbps Load Testing for Accelerated UPF with Open5gs(https://nextepc.com/technology)
@@ -50,6 +51,7 @@
   - 5G Frame Routing(https://futuredon.medium.com/5g-frame-routing-6e34d8587123)
   - 5G SCTP LoadBalancer Using LoxiLB(https://futuredon.medium.com/5g-sctp-loadbalancer-using-loxilb-b525198a9103)(Video Link(https://youtu.be/k3ICc7MXcC8))
   - 5G Roaming With Mutual TLS(https://futuredon.medium.com/5g-roaming-with-mutual-tls-1468d109129c)
+  - Building a Cloud-Native 5G Roaming Architecture with Open5GS(https://futuredon.medium.com/building-a-cloud-native-5g-roaming-architecture-with-open5gs-cert-manager-and-openbao-supporting-08168a937ddc)
 
 - @nickvsnetworking
   - My first 5G Core : Open5GS and UERANSIM(http://nickvsnetworking.com/my-first-5g-core-open5gs-and-ueransim/)
@@ -70,7 +72,8 @@
   - Select UPF based on S-NSSAI(https://github.com/s5uishida/open5gs_5gc_ueransim_snssai_upf_sample_config)
   - SCP Indirect communication Model C(https://github.com/s5uishida/open5gs_5gc_ueransim_scp_model_c_sample_config)
   - Monitoring Metrics with Prometheus(https://github.com/s5uishida/open5gs_5gc_ueransim_metrics_sample_config)
-  - Frame Routing(https://github.com/s5uishida/open5gs_5gc_ueransim_framed_routing_sample_config)
+  - Frame Routing with Open5GS UPF(https://github.com/s5uishida/open5gs_5gc_ueransim_framed_routing_sample_config)
+  - Frame Routing with OAI-CN5G-UPF(https://github.com/s5uishida/open5gs_5gc_ueransim_oai_upf_framed_routing_sample_config)
   - VPP-UPF with DPDK(https://github.com/s5uishida/open5gs_5gc_ueransim_vpp_upf_dpdk_sample_config)
   - UERANSIM with eUPF(eBPF/XDP UPF)(https://github.com/s5uishida/open5gs_5gc_ueransim_eupf_sample_config)
   - srsRAN with eUPF(eBPF/XDP UPF)(https://github.com/s5uishida/open5gs_epc_srsran_eupf_sample_config)
@@ -84,6 +87,9 @@
   - Open5GS and srsenb(https://gradiant.github.io/5g-charts/open5gs-srsenb.html)
   - Open5GS with SCP(Service Communication Proxy(https://gradiant.github.io/5g-charts/open5gs-scp.html)
 
+- @gradiant operator
+  - Open5GS Operator(https://github.com/Gradiant/open5gs-operator)
+
 - @loxilb
   - Exploring 5G SCP with Open5GS and LoxiLB(https://dev.to/nikhilmalik/5g-service-communication-proxy-with-loxilb-4242)
   - NGAP Load Balancing with Open5GS and LoxiLB(https://www.loxilb.io/post/ngap-load-balancing-with-loxilb)

open5gs_2.7.6.tar.xz/docs/_posts/2025-07-19-release-v2.7.6.md -> open5gs_2.7.7.tar.xz/docs/_posts/2025-07-19-release-v2.7.6.md Changed

open5gs_2.7.7.tar.xz/docs/_posts/2026-03-15-release-v2.7.7.md Added

open5gs_2.7.7.tar.xz/docs/assets/pcapng/5g-roaming-hr.pcapng Added

open5gs_2.7.7.tar.xz/docs/assets/pcapng/5g-roaming-lbo.pcapng Changed

open5gs_2.7.6.tar.xz/docs/assets/webui/install -> open5gs_2.7.7.tar.xz/docs/assets/webui/install Changed

open5gs_2.7.6.tar.xz/lib/app/ogs-config.c -> open5gs_2.7.7.tar.xz/lib/app/ogs-config.c Changed

@@ -60,8 +60,8 @@
 
 static void recalculate_pool_size(void)
 {
-    ogs_app()->pool.packet =
-        global_conf.max.ue * OGS_MAX_NUM_OF_PACKET_BUFFER;
+    ogs_app()->pool.gtpu =
+        global_conf.max.ue * OGS_MAX_NUM_OF_GTPU_BUFFER;
 
 #define MAX_NUM_OF_TUNNEL       3   /* Num of Tunnel per Bearer */
     ogs_app()->pool.sess = global_conf.max.ue * OGS_MAX_NUM_OF_SESS;
@@ -93,6 +93,9 @@
 #define MAX_NUM_OF_IMPU         8
     ogs_app()->pool.impi = global_conf.max.ue;
     ogs_app()->pool.impu = ogs_app()->pool.impi * MAX_NUM_OF_IMPU;
+
+#define MAX_NUM_EMERG           8
+    ogs_app()->pool.emerg = MAX_NUM_EMERG;
 }
 
 ogs_app_global_conf_t *ogs_global_conf(void)
@@ -1310,7 +1313,7 @@
 }
 
 ogs_app_policy_conf_t *ogs_app_policy_conf_find(
-        char *supi, ogs_plmn_id_t *plmn_id)
+        const char *supi, const ogs_plmn_id_t *plmn_id)
 {
     ogs_app_policy_conf_t *policy_conf;
     int i;
@@ -1386,7 +1389,7 @@
 }
 
 ogs_app_slice_conf_t *ogs_app_slice_conf_add(
-        ogs_app_policy_conf_t *policy_conf, ogs_s_nssai_t *s_nssai)
+        ogs_app_policy_conf_t *policy_conf, const ogs_s_nssai_t *s_nssai)
 {
     ogs_app_slice_conf_t *slice_conf = NULL;
 
@@ -1416,7 +1419,7 @@
 }
 
 ogs_app_slice_conf_t *ogs_app_slice_conf_find_by_s_nssai(
-        ogs_app_policy_conf_t *policy_conf, ogs_s_nssai_t *s_nssai)
+        ogs_app_policy_conf_t *policy_conf, const ogs_s_nssai_t *s_nssai)
 {
     ogs_app_slice_conf_t *slice_conf = NULL;
 
@@ -1486,7 +1489,7 @@
 }
 
 ogs_app_session_conf_t *ogs_app_session_conf_add(
-        ogs_app_slice_conf_t *slice_conf, char *name)
+        ogs_app_slice_conf_t *slice_conf, const char *name)
 {
     ogs_app_session_conf_t *session_conf = NULL;
 
@@ -1518,7 +1521,7 @@
     return session_conf;
 }
 ogs_app_session_conf_t *ogs_app_session_conf_find_by_dnn(
-        ogs_app_slice_conf_t *slice_conf, char *name)
+        ogs_app_slice_conf_t *slice_conf, const char *name)
 {
     ogs_app_session_conf_t *session_conf = NULL;
 
@@ -1561,7 +1564,8 @@
 }
 
 int ogs_app_config_session_data(
-        char *supi, ogs_plmn_id_t *plmn_id, ogs_s_nssai_t *s_nssai, char *dnn,
+        const char *supi, const ogs_plmn_id_t *plmn_id,
+        const ogs_s_nssai_t *s_nssai, const char *dnn,
         ogs_session_data_t *session_data)
 {
     ogs_app_policy_conf_t *policy_conf = NULL;

open5gs_2.7.6.tar.xz/lib/app/ogs-config.h -> open5gs_2.7.7.tar.xz/lib/app/ogs-config.h Changed

@@ -208,27 +208,28 @@
 ogs_app_policy_conf_t *ogs_app_policy_conf_add(
         ogs_supi_range_t *supi_range, ogs_plmn_id_t *plmn_id);
 ogs_app_policy_conf_t *ogs_app_policy_conf_find(
-        char *supi, ogs_plmn_id_t *plmn_id);
+        const char *supi, const ogs_plmn_id_t *plmn_id);
 void ogs_app_policy_conf_remove(ogs_app_policy_conf_t *policy_conf);
 void ogs_app_policy_conf_remove_all(void);
 
 ogs_app_slice_conf_t *ogs_app_slice_conf_add(
-        ogs_app_policy_conf_t *policy_conf, ogs_s_nssai_t *s_nssai);
+        ogs_app_policy_conf_t *policy_conf, const ogs_s_nssai_t *s_nssai);
 ogs_app_slice_conf_t *ogs_app_slice_conf_find_by_s_nssai(
-        ogs_app_policy_conf_t *policy_conf, ogs_s_nssai_t *s_nssai);
+        ogs_app_policy_conf_t *policy_conf, const ogs_s_nssai_t *s_nssai);
 void ogs_app_slice_conf_remove(ogs_app_slice_conf_t *slice_conf);
 void ogs_app_slice_conf_remove_all(ogs_app_policy_conf_t *policy_conf);
 
 ogs_app_session_conf_t *ogs_app_session_conf_add(
-        ogs_app_slice_conf_t *slice_conf, char *name);
+        ogs_app_slice_conf_t *slice_conf, const char *name);
 ogs_app_session_conf_t *ogs_app_session_conf_find_by_dnn(
-        ogs_app_slice_conf_t *slice_conf, char *name);
+        ogs_app_slice_conf_t *slice_conf, const char *name);
 void ogs_app_session_conf_remove(ogs_app_session_conf_t *session_conf);
 void ogs_app_session_conf_remove_all(
         ogs_app_slice_conf_t *slice_conf);
 
 int ogs_app_config_session_data(
-        char *supi, ogs_plmn_id_t *plmn_id, ogs_s_nssai_t *s_nssai, char *dnn,
+        const char *supi, const ogs_plmn_id_t *plmn_id,
+        const ogs_s_nssai_t *s_nssai, const char *dnn,
         ogs_session_data_t *session_data);
 
 #ifdef __cplusplus

open5gs_2.7.6.tar.xz/lib/app/ogs-context.h -> open5gs_2.7.7.tar.xz/lib/app/ogs-context.h Changed

open5gs_2.7.6.tar.xz/lib/asn1c/util/conv.c -> open5gs_2.7.7.tar.xz/lib/asn1c/util/conv.c Changed

open5gs_2.7.6.tar.xz/lib/core/ogs-compat.h -> open5gs_2.7.7.tar.xz/lib/core/ogs-compat.h Changed

open5gs_2.7.6.tar.xz/lib/core/ogs-conv.c -> open5gs_2.7.7.tar.xz/lib/core/ogs-conv.c Changed

@@ -226,24 +226,53 @@
 
 uint64_t ogs_uint64_from_string(char *str, int base)
 {
-    uint64_t x;
+    char *end = NULL;
+    unsigned long long v;
 
     ogs_assert(str);
 
-    if (strlen(str) == 0)
+    if (str0 == '\0') {
+    /* SupportedFeatures/OpenAPI allows empty string; treat as success(0). */
+        errno = 0;
         return 0;
+    }
+
+    /* reject negative for uint64 */
+    if (str0 == '-') {
+        errno = EINVAL;
+        ogs_log_message(OGS_LOG_ERROR, ogs_errno,
+                "strtoull() failed (negative) %s", str);
+        return 0;
+    }
 
     errno = 0;
-    x = strtoll(str, NULL, base);
+    v = strtoull(str, &end, base);
 
-    if ((errno == ERANGE && (x == LONG_MAX || x == LONG_MIN)) ||
-            (errno != 0 && x == 0)) {
-        ogs_log_message(OGS_LOG_FATAL, ogs_errno, "strtoll()) failed %lld",
-                (long long)x);
-        ogs_assert_if_reached();
+    /* no digits parsed */
+    if (end == str) {
+        errno = EINVAL;
+        ogs_log_message(OGS_LOG_ERROR, ogs_errno,
+                "strtoull() failed (no digits) %s", str);
+        return 0;
+    }
+
+    /* trailing garbage */
+    if (*end != '\0') {
+        errno = EINVAL;
+        ogs_log_message(OGS_LOG_ERROR, ogs_errno,
+                "strtoull() failed (trailing) %s", str);
+        return 0;
+    }
+
+    /* overflow/underflow */
+    if (errno == ERANGE) {
+        ogs_log_message(OGS_LOG_ERROR, ogs_errno,
+                "strtoull() failed (range) %s", str);
+        return 0;
     }
 
-    return x;
+    errno = 0;  /* success */
+    return (uint64_t)v;
 }
 
 double *ogs_alloc_double(double value)

open5gs_2.7.6.tar.xz/lib/core/ogs-epoll.c -> open5gs_2.7.7.tar.xz/lib/core/ogs-epoll.c Changed

open5gs_2.7.6.tar.xz/lib/core/ogs-macros.h -> open5gs_2.7.7.tar.xz/lib/core/ogs-macros.h Changed

open5gs_2.7.6.tar.xz/lib/core/ogs-sockaddr.c -> open5gs_2.7.7.tar.xz/lib/core/ogs-sockaddr.c Changed

@@ -103,11 +103,18 @@
     int rc;
     char serviceNI_MAXSERV;
     struct addrinfo hints, *ai, *ai_list;
-    ogs_sockaddr_t *prev;
+    ogs_sockaddr_t *prev = NULL;
+
+    /* Last node of original list (for appending) */
+    ogs_sockaddr_t *tail = NULL;
+    /* First newly added node (for cleanup on error) */
+    ogs_sockaddr_t *first_new = NULL;
+
     char bufOGS_ADDRSTRLEN;
 
     ogs_assert(sa_list);
 
+    /* Prepare hints for getaddrinfo() */
     memset(&hints, 0, sizeof(hints));
     hints.ai_family = family;
     hints.ai_socktype = SOCK_STREAM;
@@ -118,24 +125,41 @@
     rc = getaddrinfo(hostname, service, &hints, &ai_list);
     if (rc != 0) {
         ogs_log_message(OGS_LOG_ERROR, ogs_socket_errno,
-                "getaddrinfo(%d:%s:%d:0x%x) failed",
-                family, hostname, port, flags);
+                        "getaddrinfo(%d:%s:%d:0x%x) failed: %s",
+                        family, hostname ? hostname : "(null)",
+                        port, flags, gai_strerror(rc));
+        /* Non-fatal: log the error and return */
         return OGS_ERROR;
     }
 
-    prev = NULL;
+    /* Find the end of the existing list, so new entries can be appended */
     if (*sa_list) {
-        prev = *sa_list;
-        while(prev->next) prev = prev->next;
+        tail = *sa_list;
+        while (tail->next)
+            tail = tail->next;
+        prev = tail;
     }
+
+    /* Iterate over each result from getaddrinfo and add to the linked list */
     for (ai = ai_list; ai; ai = ai->ai_next) {
         ogs_sockaddr_t *new, tmp;
         if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
-            continue;
+            continue; /* Skip unsupported address families */
 
         new = ogs_calloc(1, sizeof(ogs_sockaddr_t));
         if (!new) {
             ogs_error("ogs_calloc() failed");
+            /* Clean up any partially added entries on memory failure */
+            if (first_new) {
+                if (tail) {
+                    /* detach new sub-list from original list */
+                    tail->next = NULL;
+                } else {
+                    *sa_list = NULL;    /* no original list, reset head */
+                }
+                ogs_freeaddrinfo(first_new);
+            }
+            freeaddrinfo(ai_list);
             return OGS_ERROR;
         }
         memcpy(&new->sa, ai->ai_addr, ai->ai_addrlen);
@@ -143,30 +167,49 @@
 
         if (hostname) {
             if (ogs_inet_pton(ai->ai_family, hostname, &tmp) == OGS_OK) {
-                /* It's a valid IP address */
+                /* Input string is a valid numeric IP address */
                 ogs_debug("addr:%s, port:%d", OGS_ADDR(new, buf), port);
             } else {
-                /* INVALID IP address! We assume it is a hostname */
+                /* Input string is not a numeric IP; treat it as a hostname */
                 new->hostname = ogs_strdup(hostname);
-                ogs_assert(new->hostname);
+                if (!new->hostname) {
+                    ogs_error("ogs_strdup() failed");
+                    /* Free the new node and any previously added nodes */
+                    ogs_free(new);
+                    if (first_new) {
+                        if (tail) {
+                            tail->next = NULL;
+                        } else {
+                            *sa_list = NULL;
+                        }
+                        ogs_freeaddrinfo(first_new);
+                    }
+                    freeaddrinfo(ai_list);
+                    return OGS_ERROR;
+                }
                 ogs_debug("name:%s, port:%d", new->hostname, port);
             }
         }
 
-        if (!prev)
+        /* Link the new node into the list */
+        if (!prev) {
             *sa_list = new;
-        else
+        } else {
             prev->next = new;
-
+        }
         prev = new;
+        if (!first_new) {
+            first_new = new;  /* mark the first new node added */
+        }
     }
 
     freeaddrinfo(ai_list);
 
-    if (prev == NULL) {
+    if (first_new == NULL) {
+        /* No addresses were added (e.g., no AF_INET/AF_INET6 results) */
         ogs_log_message(OGS_LOG_ERROR, ogs_socket_errno,
-                "ogs_getaddrinfo(%d:%s:%d:%d) failed",
-                family, hostname, port, flags);
+                        "ogs_addaddrinfo(%d:%s:%d:0x%x) returned no addresses",
+                        family, hostname ? hostname : "(null)", port, flags);
         return OGS_ERROR;
     }
 
@@ -800,3 +843,37 @@
     /* No address */
     return NULL;
 }
+
+int ogs_sockaddr_from_ip_or_fqdn(ogs_sockaddr_t **sa_list,
+        int family, const char *ip_or_fqdn, uint16_t port)
+{
+    int rc;
+    int flags = 0;
+    ogs_sockaddr_t tmp;
+
+    ogs_assert(sa_list);
+    ogs_assert(ip_or_fqdn);
+
+    /* Determine if the input is an IP literal (numeric address).
+     * If so, use AI_NUMERICHOST to avoid DNS lookup. */
+    if (ogs_inet_pton(AF_INET, ip_or_fqdn, &tmp) == OGS_OK ||
+        ogs_inet_pton(AF_INET6, ip_or_fqdn, &tmp) == OGS_OK) {
+        flags |= AI_NUMERICHOST;
+    }
+
+    /* Use ogs_addaddrinfo
+     * to perform resolution and construct the sockaddr list */
+    *sa_list = NULL;
+    rc = ogs_addaddrinfo(sa_list, family, ip_or_fqdn, port, flags);
+    if (rc != OGS_OK) {
+        ogs_error("Failed to resolve address: %s", ip_or_fqdn);
+        /* Cleanup: free any nodes that might have been added before failure */
+        if (*sa_list) {
+            ogs_freeaddrinfo(*sa_list);
+            *sa_list = NULL;
+        }
+        return OGS_ERROR;
+    }
+
+    return OGS_OK;
+}

open5gs_2.7.6.tar.xz/lib/core/ogs-sockaddr.h -> open5gs_2.7.7.tar.xz/lib/core/ogs-sockaddr.h Changed

open5gs_2.7.6.tar.xz/lib/core/ogs-strings.c -> open5gs_2.7.7.tar.xz/lib/core/ogs-strings.c Changed

open5gs_2.7.6.tar.xz/lib/core/ogs-strings.h -> open5gs_2.7.7.tar.xz/lib/core/ogs-strings.h Changed

open5gs_2.7.6.tar.xz/lib/core/ogs-timer.c -> open5gs_2.7.7.tar.xz/lib/core/ogs-timer.c Changed

open5gs_2.7.6.tar.xz/lib/core/ogs-tlv-msg.c -> open5gs_2.7.7.tar.xz/lib/core/ogs-tlv-msg.c Changed

open5gs_2.7.6.tar.xz/lib/core/ogs-tlv.c -> open5gs_2.7.7.tar.xz/lib/core/ogs-tlv.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019,2026 by Sukchan Lee <acetcom@gmail.com>
  * Copyright (C) 2022 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
  *
  * This file is part of Open5GS.
@@ -34,7 +34,10 @@
     ogs_pool_alloc(&pool, &tlv);
 
     /* check for error */
-    ogs_assert(tlv);
+    if (!tlv) {
+        ogs_error("ogs_tlv_get() failed");
+        return NULL;
+    }
 
     /* initialize tlv node */
     memset(tlv, 0, sizeof(ogs_tlv_t));
@@ -443,28 +446,71 @@
     ogs_tlv_t *curr = NULL;
 
     root = curr = ogs_tlv_get();
-
-    ogs_assert(curr);
+    if (!curr) {
+        ogs_error("ogs_tlv_parse_block() failedLEN:%d,MODE:%d - no tlv",
+                length, mode);
+/*
+ * Limit hexdump size to avoid excessive logging when handling malformed
+ * or intentionally crafted messages. This prevents log flooding and
+ * secondary DoS effects while still providing enough data for debugging.
+ */
+        ogs_log_hexdump(OGS_LOG_ERROR, data, ogs_min(length, 512));
+        return NULL;
+    }
 
     pos = tlv_get_element(curr, pos, mode);
-
-    ogs_assert(pos);
+    if (!pos) {
+        ogs_error("ogs_tlv_parse_block() failedLEN:%u,MODE:%u - parse error",
+                length, mode);
+/*
+ * Limit hexdump size to avoid excessive logging when handling malformed
+ * or intentionally crafted messages. This prevents log flooding and
+ * secondary DoS effects while still providing enough data for debugging.
+ */
+        ogs_log_hexdump(OGS_LOG_ERROR, data, ogs_min(length, 512));
+        ogs_tlv_free_all(root);
+        return NULL;
+    }
 
     while(pos - blk < length) {
         prev = curr;
 
         curr = ogs_tlv_get();
-        ogs_assert(curr);
+        if (!curr) {
+            ogs_error("ogs_tlv_parse_block() failedLEN:%d,MODE:%d",
+                    length, mode);
+/*
+ * Limit hexdump size to avoid excessive logging when handling malformed
+ * or intentionally crafted messages. This prevents log flooding and
+ * secondary DoS effects while still providing enough data for debugging.
+ */
+            ogs_log_hexdump(OGS_LOG_ERROR, data, ogs_min(length, 512));
+
+            ogs_tlv_free_all(root);
+            return NULL;
+        }
         prev->next = curr;
 
         pos = tlv_get_element(curr, pos, mode);
-        ogs_assert(pos);
+        if (!pos) {
+            ogs_error("ogs_tlv_parse_block() failedLEN:%d,MODE:%d",
+                    length, mode);
+/*
+ * Limit hexdump size to avoid excessive logging when handling malformed
+ * or intentionally crafted messages. This prevents log flooding and
+ * secondary DoS effects while still providing enough data for debugging.
+ */
+            ogs_log_hexdump(OGS_LOG_ERROR, data, ogs_min(length, 512));
+
+            ogs_tlv_free_all(root);
+            return NULL;
+        }
     }
 
     if (length != (pos - blk)) {
         ogs_error("ogs_tlv_parse_block() failedLEN:%d,MODE:%d", length, mode);
         ogs_error("POS%p BLK%p POS-BLK%d", pos, blk, (int)(pos - blk));
-        ogs_log_hexdump(OGS_LOG_FATAL, data, length);
+        ogs_log_hexdump(OGS_LOG_ERROR, data, ogs_min(length, 512));
 
         ogs_tlv_free_all(root);
         return NULL;

open5gs_2.7.6.tar.xz/lib/dbi/session.c -> open5gs_2.7.7.tar.xz/lib/dbi/session.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -19,7 +19,8 @@
 
 #include "ogs-dbi.h"
 
-int ogs_dbi_session_data(char *supi, ogs_s_nssai_t *s_nssai, char *dnn,
+int ogs_dbi_session_data(
+        const char *supi, const ogs_s_nssai_t *s_nssai, const char *dnn,
         ogs_session_data_t *session_data)
 {
     int rv = OGS_OK;
@@ -168,6 +169,9 @@
         } else if (!strcmp(child4_key, OGS_TYPE_STRING) &&
             BSON_ITER_HOLDS_INT32(&child4_iter)) {
             session->session_type = bson_iter_int32(&child4_iter);
+        } else if (!strcmp(child4_key, OGS_LBO_ROAMING_ALLOWED_STRING) &&
+            BSON_ITER_HOLDS_BOOL(&child4_iter)) {
+            session->lbo_roaming_allowed = bson_iter_bool(&child4_iter);
         } else if (!strcmp(child4_key, OGS_QOS_STRING) &&
             BSON_ITER_HOLDS_DOCUMENT(&child4_iter)) {
             bson_iter_recurse(&child4_iter, &child5_iter);

open5gs_2.7.6.tar.xz/lib/dbi/session.h -> open5gs_2.7.7.tar.xz/lib/dbi/session.h Changed

open5gs_2.7.6.tar.xz/lib/dbi/subscription.c -> open5gs_2.7.7.tar.xz/lib/dbi/subscription.c Changed

open5gs_2.7.6.tar.xz/lib/diameter/common/init.c -> open5gs_2.7.7.tar.xz/lib/diameter/common/init.c Changed

open5gs_2.7.6.tar.xz/lib/diameter/common/message.h -> open5gs_2.7.7.tar.xz/lib/diameter/common/message.h Changed

open5gs_2.7.6.tar.xz/lib/diameter/s6a/dict.c -> open5gs_2.7.7.tar.xz/lib/diameter/s6a/dict.c Changed

@@ -357,13 +357,14 @@
                 {  { .avp_vendor = 10415, .avp_name = "Supported-Features" }, RULE_OPTIONAL, -1, -1 },
                 {  { .avp_vendor = 10415, .avp_name = "Terminal-Information" }, RULE_OPTIONAL, -1, 1 },
                 {  { .avp_vendor = 10415, .avp_name = "ULR-Flags" }, RULE_REQUIRED, -1, 1 },
+                {  { .avp_vendor = 10415, .avp_name = "UE-SRVCC-Capability" }, RULE_OPTIONAL, -1, 1 },
                 {  { .avp_vendor = 10415, .avp_name = "Visited-PLMN-Id" }, RULE_REQUIRED, -1, 1 },
                 {  { .avp_vendor = 10415, .avp_name = "Equivalent-PLMN-List" }, RULE_OPTIONAL, -1, 1 },
                 {  { .avp_vendor = 10415, .avp_name = "RAT-Type" }, RULE_REQUIRED, -1, 1 },
                 {  { .avp_vendor = 10415, .avp_name = "SGSN-Number" }, RULE_OPTIONAL, -1, 1 },
                 {  { .avp_vendor = 10415, .avp_name = "Homogeneous-Support-of-IMS-Voice-Over-PS-Sessions" }, RULE_OPTIONAL, -1, 1 },
                 {  { .avp_vendor = 10415, .avp_name = "Active-APN" }, RULE_OPTIONAL, -1, 1 },
-                {  { .avp_vendor = 10415, .avp_name = "UE-SRVCC-Capability" }, RULE_OPTIONAL, -1, 1 },
+                {  { .avp_vendor = 10415, .avp_name = "SMS-Register-Request" }, RULE_OPTIONAL, -1, 1 },
                 {  {                      .avp_name = "Proxy-Info" }, RULE_OPTIONAL, -1, -1 },
                 {  {                      .avp_name = "Route-Record" }, RULE_OPTIONAL, -1, -1 },
             };
@@ -546,7 +547,7 @@
                 {  {                      .avp_name = "Destination-Realm" }, RULE_REQUIRED, -1, 1 },
                 {  {                      .avp_name = "User-Name" }, RULE_REQUIRED, -1, 1 },
                 {  { .avp_vendor = 10415, .avp_name = "Supported-Features" }, RULE_OPTIONAL, -1, -1 },
-                {  { .avp_vendor = 10415, .avp_name = "Cancellation-Type" }, RULE_REQUIRED, -1, -1 },                
+                {  { .avp_vendor = 10415, .avp_name = "Cancellation-Type" }, RULE_REQUIRED, -1, -1 },
                 {  { .avp_vendor = 10415, .avp_name = "CLR-Flags" }, RULE_OPTIONAL, -1, 1 },
                 {  {                      .avp_name = "Proxy-Info" }, RULE_OPTIONAL, -1, -1 },
                 {  {                      .avp_name = "Route-Record" }, RULE_OPTIONAL, -1, -1 },
@@ -603,7 +604,7 @@
                 {  {                      .avp_name = "Destination-Realm" }, RULE_REQUIRED, -1, 1 },
                 {  {                      .avp_name = "User-Name" }, RULE_REQUIRED, -1, 1 },
                 {  { .avp_vendor = 10415, .avp_name = "Supported-Features" }, RULE_OPTIONAL, -1, -1 },
-                {  { .avp_vendor = 10415, .avp_name = "Subscription-Data" }, RULE_REQUIRED, -1, 1 },                
+                {  { .avp_vendor = 10415, .avp_name = "Subscription-Data" }, RULE_REQUIRED, -1, 1 },
                 {  { .avp_vendor = 10415, .avp_name = "IDR-Flags" }, RULE_OPTIONAL, -1, 1 },
                 {  {                      .avp_name = "Proxy-Info" }, RULE_OPTIONAL, -1, -1 },
                 {  {                      .avp_name = "Route-Record" }, RULE_OPTIONAL, -1, -1 },
@@ -638,7 +639,7 @@
                 {  { .avp_vendor = 10415, .avp_name = "EPS-User-State" }, RULE_OPTIONAL, -1, 1 },
                 {  { .avp_vendor = 10415, .avp_name = "EPS-Location-Information" }, RULE_OPTIONAL, -1, 1 },
                 {  { .avp_vendor = 10415, .avp_name = "Local-Time-Zone" }, RULE_OPTIONAL, -1, 1 },
-                {  { .avp_vendor = 10415, .avp_name = "Supported-Services" }, RULE_OPTIONAL, -1, 1 },                                                                                                
+                {  { .avp_vendor = 10415, .avp_name = "Supported-Services" }, RULE_OPTIONAL, -1, 1 },
                 {  {                      .avp_name = "Failed-AVP" }, RULE_OPTIONAL, -1, -1 },
                 {  {                      .avp_name = "Proxy-Info" }, RULE_OPTIONAL, -1, -1 },
                 {  {                      .avp_name = "Route-Record" }, RULE_OPTIONAL, -1, -1 },

open5gs_2.7.6.tar.xz/lib/diameter/s6a/message.c -> open5gs_2.7.7.tar.xz/lib/diameter/s6a/message.c Changed

@@ -1,4 +1,4 @@
-/*
+/* 3GPP TS 29.272 S6a
  * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
@@ -92,6 +92,8 @@
 struct dict_object *ogs_diam_s6a_msisdn = NULL;
 struct dict_object *ogs_diam_s6a_a_msisdn = NULL;
 
+struct dict_object *ogs_diam_s6a_sms_register_request = NULL;
+
 struct dict_object *ogs_diam_s6a_supported_features = NULL;
 struct dict_object *ogs_diam_s6a_feature_list_id = NULL;
 struct dict_object *ogs_diam_s6a_feature_list = NULL;
@@ -180,6 +182,8 @@
     CHECK_dict_search(DICT_AVP, AVP_BY_NAME_ALL_VENDORS, "MSISDN", &ogs_diam_s6a_msisdn);
     CHECK_dict_search(DICT_AVP, AVP_BY_NAME_ALL_VENDORS, "A-MSISDN", &ogs_diam_s6a_a_msisdn);
 
+    CHECK_dict_search(DICT_AVP, AVP_BY_NAME_ALL_VENDORS, "SMS-Register-Request", &ogs_diam_s6a_sms_register_request);
+
     CHECK_dict_search(DICT_AVP, AVP_BY_NAME_ALL_VENDORS, "Supported-Features", &ogs_diam_s6a_supported_features);
     CHECK_dict_search(DICT_AVP, AVP_BY_NAME_ALL_VENDORS, "Feature-List-ID", &ogs_diam_s6a_feature_list_id);
     CHECK_dict_search(DICT_AVP, AVP_BY_NAME_ALL_VENDORS, "Feature-List", &ogs_diam_s6a_feature_list);

open5gs_2.7.6.tar.xz/lib/diameter/s6a/message.h -> open5gs_2.7.7.tar.xz/lib/diameter/s6a/message.h Changed

@@ -1,4 +1,4 @@
-/*
+/* 3GPP TS 29.272 S6a
  * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
@@ -89,6 +89,11 @@
 #define OGS_DIAM_S6A_SUBDATA_OP_DET_BARRING             (1 << 10)
 #define OGS_DIAM_S6A_SUBDATA_ALL                        0xFFFFFFFF
 
+/* 7.3.162 SMS-Register-Request, see also 3GPP TS 23.272 C.8 "Registration of MME for SMS" */
+#define OGS_DIAM_S6A_SMS_REGISTER_REQUIRED              0
+#define OGS_DIAM_S6A_SMS_REGISTER_NOT_PREFERRED         1
+#define OGS_DIAM_S6A_SMS_REGISTER_NO_PREFERENCE         2
+
 extern struct dict_object *ogs_diam_s6a_application;
 
 extern struct dict_object *ogs_diam_s6a_cmd_air;
@@ -159,6 +164,8 @@
 extern struct dict_object *ogs_diam_s6a_msisdn;
 extern struct dict_object *ogs_diam_s6a_a_msisdn;
 
+extern struct dict_object *ogs_diam_s6a_sms_register_request;
+
 extern struct dict_object *ogs_diam_s6a_supported_features;
 extern struct dict_object *ogs_diam_s6a_feature_list_id;
 extern struct dict_object *ogs_diam_s6a_feature_list;

open5gs_2.7.6.tar.xz/lib/gtp/path.c -> open5gs_2.7.7.tar.xz/lib/gtp/path.c Changed

open5gs_2.7.6.tar.xz/lib/gtp/path.h -> open5gs_2.7.7.tar.xz/lib/gtp/path.h Changed

open5gs_2.7.6.tar.xz/lib/gtp/v1/types.c -> open5gs_2.7.7.tar.xz/lib/gtp/v1/types.c Changed

@@ -31,12 +31,21 @@
 
     memset(uli, 0, sizeof(ogs_gtp1_uli_t));
 
+    if (octet->len < 1) {
+        ogs_error("ULI IE too short %u", octet->len);
+        return 0;
+    }
+
     uli->geo_loc_type = source->geo_loc_type;
     size++;
 
     switch (uli->geo_loc_type) {
     case OGS_GTP1_GEO_LOC_TYPE_CGI:
-        ogs_assert(size + sizeof(uli->cgi) <= octet->len);
+        if (size + (int)sizeof(uli->cgi) > octet->len) {
+            ogs_error("ULI CGI too short %d+%zu > %u",
+                    size, sizeof(uli->cgi), octet->len);
+            return 0;
+        }
         memcpy(&uli->cgi,
                 (unsigned char *)octet->data + size, sizeof(uli->cgi));
         uli->cgi.lac = be16toh(uli->cgi.lac);
@@ -44,7 +53,11 @@
         size += sizeof(uli->cgi);
         break;
     case OGS_GTP1_GEO_LOC_TYPE_SAI:
-        ogs_assert(size + sizeof(uli->sai) <= octet->len);
+        if (size + (int)sizeof(uli->sai) > octet->len) {
+            ogs_error("ULI SAI too short %d+%zu > %u",
+                    size, sizeof(uli->sai), octet->len);
+            return 0;
+        }
         memcpy(&uli->sai,
                 (unsigned char *)octet->data + size, sizeof(uli->sai));
         uli->sai.lac = be16toh(uli->sai.lac);
@@ -52,7 +65,11 @@
         size += sizeof(uli->sai);
         break;
     case OGS_GTP1_GEO_LOC_TYPE_RAI:
-        ogs_assert(size + sizeof(uli->rai) <= octet->len);
+        if (size + (int)sizeof(uli->rai) > octet->len) {
+            ogs_error("ULI RAI too short %d+%zu > %u",
+                    size, sizeof(uli->rai), octet->len);
+            return 0;
+        }
         memcpy(&uli->rai,
                 (unsigned char *)octet->data + size, sizeof(uli->rai));
         uli->rai.lac = be16toh(uli->rai.lac);
@@ -65,7 +82,11 @@
         return 0;
     }
 
-    ogs_assert(size == octet->len);
+    if (size != octet->len) {
+        ogs_error("Mismatch IE Length%d != Decoded%d", octet->len, size);
+        return 0;
+    }
+
     return size;
 }
 int16_t ogs_gtp1_build_uli(
@@ -414,6 +435,8 @@
 
     CHECK_SPACE_ERR(1);
     decoded->xres_len = *ptr++;
+    if (decoded->xres_len > OGS_MAX_RES_LEN)
+        return OGS_ERROR;
     CHECK_SPACE_ERR(decoded->xres_len);
     memcpy(&decoded->xres0, ptr, decoded->xres_len);
     ptr += decoded->xres_len;
@@ -428,6 +451,8 @@
 
     CHECK_SPACE_ERR(1);
     decoded->autn_len = *ptr++;
+    if (decoded->autn_len > OGS_AUTN_LEN)
+        return OGS_ERROR;
     CHECK_SPACE_ERR(decoded->autn_len);
     memcpy(&decoded->autn0, ptr, decoded->autn_len);
     ptr += decoded->autn_len;
@@ -473,6 +498,8 @@
     decoded->ksi = *ptr & 0x07;
     ptr++;
     decoded->num_vectors = (*ptr >> 3) & 0x07;
+    if (decoded->num_vectors > OGS_ARRAY_SIZE(decoded->auth_quintuplets))
+        return OGS_ERROR;
     decoded->used_cipher = *ptr & 0x07;
     ptr++;

open5gs_2.7.6.tar.xz/lib/gtp/v2/build.c -> open5gs_2.7.7.tar.xz/lib/gtp/v2/build.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -117,6 +117,51 @@
     return pkbuf;
 }
 
+void ogs_gtp2_encapsulate_header(
+        ogs_gtp2_header_desc_t *header_desc, ogs_pkbuf_t *pkbuf)
+{
+    int i;
+
+    ogs_gtp2_header_t gtp_hdesc;
+    ogs_gtp2_extension_header_t ext_hdesc;
+
+    ogs_assert(header_desc);
+
+    memset(&gtp_hdesc, 0, sizeof(gtp_hdesc));
+    memset(&ext_hdesc, 0, sizeof(ext_hdesc));
+
+    gtp_hdesc.flags = header_desc->flags;
+    gtp_hdesc.type = header_desc->type;
+
+    i = 0;
+
+    if (header_desc->qos_flow_identifier) {
+        ext_hdesc.arrayi.type =
+            OGS_GTP2_EXTENSION_HEADER_TYPE_PDU_SESSION_CONTAINER;
+        ext_hdesc.arrayi.len = 1;
+        ext_hdesc.arrayi.pdu_type = header_desc->pdu_type;
+        ext_hdesc.arrayi.qos_flow_identifier =
+            header_desc->qos_flow_identifier;
+        i++;
+    }
+
+    if (header_desc->udp.presence == true) {
+        ext_hdesc.arrayi.type = OGS_GTP2_EXTENSION_HEADER_TYPE_UDP_PORT;
+        ext_hdesc.arrayi.len = 1;
+        ext_hdesc.arrayi.udp_port = htobe16(header_desc->udp.port);
+        i++;
+    }
+
+    if (header_desc->pdcp_number_presence == true) {
+        ext_hdesc.arrayi.type = OGS_GTP2_EXTENSION_HEADER_TYPE_PDCP_NUMBER;
+        ext_hdesc.arrayi.len = 1;
+        ext_hdesc.arrayi.pdcp_number = htobe16(header_desc->pdcp_number);
+        i++;
+    }
+
+    ogs_gtp2_fill_header(&gtp_hdesc, &ext_hdesc, pkbuf);
+}
+
 void ogs_gtp2_fill_header(
         ogs_gtp2_header_t *gtp_hdesc, ogs_gtp2_extension_header_t *ext_hdesc,
         ogs_pkbuf_t *pkbuf)
@@ -174,11 +219,8 @@
          * - The Error Indication message where the Tunnel Endpoint Identifier
          *   shall be set to all zeros.
          */
-        ogs_assert(gtp_hdesc->teid == 0);
     }
 
-    gtp_h->teid = htobe32(gtp_hdesc->teid);
-
     /*
      * TS29.281 5.1 General format in GTP-U header
      *

open5gs_2.7.6.tar.xz/lib/gtp/v2/build.h -> open5gs_2.7.7.tar.xz/lib/gtp/v2/build.h Changed

open5gs_2.7.6.tar.xz/lib/gtp/v2/path.c -> open5gs_2.7.7.tar.xz/lib/gtp/v2/path.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -19,72 +19,6 @@
 
 #include "ogs-gtp.h"
 
-int ogs_gtp2_send_user_plane(
-        ogs_gtp_node_t *gnode,
-        ogs_gtp2_header_desc_t *header_desc,
-        ogs_pkbuf_t *pkbuf)
-{
-    char bufOGS_ADDRSTRLEN;
-    int rv, i;
-
-    ogs_gtp2_header_t gtp_hdesc;
-    ogs_gtp2_extension_header_t ext_hdesc;
-
-    ogs_assert(header_desc);
-
-    memset(&gtp_hdesc, 0, sizeof(gtp_hdesc));
-    memset(&ext_hdesc, 0, sizeof(ext_hdesc));
-
-    gtp_hdesc.flags = header_desc->flags;
-    gtp_hdesc.type = header_desc->type;
-    gtp_hdesc.teid = header_desc->teid;
-
-    i = 0;
-
-    if (header_desc->qos_flow_identifier) {
-        ext_hdesc.arrayi.type =
-            OGS_GTP2_EXTENSION_HEADER_TYPE_PDU_SESSION_CONTAINER;
-        ext_hdesc.arrayi.len = 1;
-        ext_hdesc.arrayi.pdu_type = header_desc->pdu_type;
-        ext_hdesc.arrayi.qos_flow_identifier =
-            header_desc->qos_flow_identifier;
-        i++;
-    }
-
-    if (header_desc->udp.presence == true) {
-        ext_hdesc.arrayi.type = OGS_GTP2_EXTENSION_HEADER_TYPE_UDP_PORT;
-        ext_hdesc.arrayi.len = 1;
-        ext_hdesc.arrayi.udp_port = htobe16(header_desc->udp.port);
-        i++;
-    }
-
-    if (header_desc->pdcp_number_presence == true) {
-        ext_hdesc.arrayi.type = OGS_GTP2_EXTENSION_HEADER_TYPE_PDCP_NUMBER;
-        ext_hdesc.arrayi.len = 1;
-        ext_hdesc.arrayi.pdcp_number = htobe16(header_desc->pdcp_number);
-        i++;
-    }
-
-    ogs_gtp2_fill_header(&gtp_hdesc, &ext_hdesc, pkbuf);
-
-    ogs_trace("SEND GTP-U%d to Peer%s : TEID0x%x",
-            header_desc->type,
-            OGS_ADDR(&gnode->addr, buf), header_desc->teid);
-
-    rv = ogs_gtp_sendto(gnode, pkbuf);
-    if (rv != OGS_OK) {
-        if (ogs_socket_errno != OGS_EAGAIN) {
-            ogs_error("SEND GTP-U%d to Peer%s : TEID0x%x",
-                header_desc->type,
-                OGS_ADDR(&gnode->addr, buf), header_desc->teid);
-        }
-    }
-
-    ogs_pkbuf_free(pkbuf);
-
-    return rv;
-}
-
 ogs_pkbuf_t *ogs_gtp2_handle_echo_req(ogs_pkbuf_t *pkb)
 {
     ogs_gtp2_header_t *gtph = NULL;
@@ -305,7 +239,6 @@
 void ogs_gtp1_send_error_indication(
         ogs_sock_t *sock, uint32_t teid, uint8_t qfi, const ogs_sockaddr_t *to)
 {
-    ssize_t sent;
     ogs_pkbuf_t *pkbuf = NULL;
 
     ogs_gtp2_header_t gtp_hdesc;
@@ -343,10 +276,7 @@
 
     ogs_gtp2_fill_header(&gtp_hdesc, &ext_hdesc, pkbuf);
 
-    sent = ogs_sendto(sock->fd, pkbuf->data, pkbuf->len, 0, to);
-    if (sent < 0 || sent != pkbuf->len) {
-        ogs_log_message(OGS_LOG_ERROR, ogs_socket_errno,
-                "ogs_sendto() failed");
-    }
+    ogs_gtp_send_with_teid(sock, pkbuf, teid, (ogs_sockaddr_t *)to);
+
     ogs_pkbuf_free(pkbuf);
 }

open5gs_2.7.6.tar.xz/lib/gtp/v2/path.h -> open5gs_2.7.7.tar.xz/lib/gtp/v2/path.h Changed

open5gs_2.7.6.tar.xz/lib/gtp/v2/types.c -> open5gs_2.7.7.tar.xz/lib/gtp/v2/types.c Changed

@@ -31,7 +31,13 @@
 
     ogs_assert(bearer_qos);
     ogs_assert(octet);
-    ogs_assert(octet->len == GTP2_BEARER_QOS_LEN);
+
+    /* Validate IE length instead of asserting */
+    if (octet->len != GTP2_BEARER_QOS_LEN) {
+        ogs_error("Invalid Bearer QoS IE length %u, expected %u",
+                octet->len, GTP2_BEARER_QOS_LEN);
+        return 0;
+    }
 
     source = (ogs_gtp2_bearer_qos_t *)octet->data;
 
@@ -208,7 +214,12 @@
 
     ogs_assert(flow_qos);
     ogs_assert(octet);
-    ogs_assert(octet->len == GTP2_FLOW_QOS_LEN);
+
+    if (octet->len != GTP2_FLOW_QOS_LEN) {
+        ogs_error("Invalid Flow QoS IE length %u, expected %u",
+                octet->len, GTP2_FLOW_QOS_LEN);
+        return 0;
+    }
 
     source = (ogs_gtp2_flow_qos_t *)octet->data;
 
@@ -293,7 +304,11 @@
 
     memset(tft, 0, sizeof(ogs_gtp2_tft_t));
 
-    ogs_assert(size+sizeof(tft->flags) <= octet->len);
+    if (size + (int)sizeof(tft->flags) > octet->len) {
+        ogs_error("TFT: size%d+flags%d > IE Length%d",
+                size, (int)sizeof(tft->flags), octet->len);
+        return size;
+    }
     memcpy(&tft->flags, (unsigned char *)octet->data+size, sizeof(tft->flags));
     size++;
 
@@ -308,7 +323,11 @@
 
     for (i = 0; i < tft->num_of_packet_filter &&
                 i < OGS_MAX_NUM_OF_FLOW_IN_GTP ; i++) {
-        ogs_assert(size+sizeof(tft->pfi.flags) <= octet->len);
+        if (size + (int)sizeof(tft->pfi.flags) > octet->len) {
+            ogs_error("TFT: size%d+pf%d.flags%d > IE Length%d",
+                    size, i, (int)sizeof(tft->pfi.flags), octet->len);
+            return size;
+        }
         memcpy(&tft->pfi.flags, (unsigned char *)octet->data+size,
                 sizeof(tft->pfi.flags));
         size += sizeof(tft->pfi.flags);
@@ -316,29 +335,70 @@
         if (tft->code == OGS_GTP2_TFT_CODE_DELETE_PACKET_FILTERS_FROM_EXISTING)
             continue;
 
-        ogs_assert(size+sizeof(tft->pfi.precedence) <= octet->len);
+        if (size + (int)sizeof(tft->pfi.precedence) > octet->len) {
+            ogs_error("TFT: size%d+pf%d.precedence%d > IE Length%d",
+                    size, i, (int)sizeof(tft->pfi.precedence), octet->len);
+            return size;
+        }
         memcpy(&tft->pfi.precedence, (unsigned char *)octet->data+size,
                 sizeof(tft->pfi.precedence));
         size += sizeof(tft->pfi.precedence);
 
-        ogs_assert(size+sizeof(tft->pfi.content.length) <= octet->len);
+        if (size + (int)sizeof(tft->pfi.content.length) > octet->len) {
+            ogs_error("TFT: size%d+pf%d.content.length%d > IE Length%d",
+                    size, i, (int)sizeof(tft->pfi.content.length),
+                    octet->len);
+            return size;
+        }
         memcpy(&tft->pfi.content.length, (unsigned char *)octet->data+size,
                 sizeof(tft->pfi.content.length));
         size += sizeof(tft->pfi.content.length);
 
+        /*
+         * Critical validation:
+         * content.length must not exceed remaining IE length.
+         * This prevents out-of-bounds reads/crash for malformed TFT/TAD.
+         */
+        if ((int)tft->pfi.content.length > (octet->len - size)) {
+            ogs_error("TFT: pf%d.content.length%u > remaining%d "
+                    "(size%d, IE%d)", i, tft->pfi.content.length,
+                    octet->len - size, size, octet->len);
+            return size;
+        }
+
         j = 0; len = 0;
         while(len < tft->pfi.content.length) {
-            ogs_assert(size+len+sizeof(tft->pfi.content.componentj.type) <=
+            int comp_max = (int)(sizeof(tft->pfi.content.component) /
+                                 sizeof(tft->pfi.content.component0));
+            if (j >= comp_max) {
+                ogs_error("TFT: pf%d too many components (j%d >= max%d)",
+                        i, j, comp_max);
+                return size;
+            }
+            if (size + len + (int)sizeof(tft->pfi.content.componentj.type) >
+                octet->len) {
+                ogs_error("TFT: size%d+len%d+pf%d.component%d."
+                        "type%d > IE Length%d",
+                        size, len, i, j,
+                        (int)sizeof(tft->pfi.content.componentj.type),
                         octet->len);
+                return size;
+            }
             memcpy(&tft->pfi.content.componentj.type,
                     (unsigned char *)octet->data+size+len,
                     sizeof(tft->pfi.content.componentj.type));
             len += sizeof(tft->pfi.content.componentj.type);
             switch(tft->pfi.content.componentj.type) {
             case OGS_PACKET_FILTER_PROTOCOL_IDENTIFIER_NEXT_HEADER_TYPE:
-                ogs_assert(size+len+
-                        sizeof(tft->pfi.content.componentj.proto) <=
-                        octet->len);
+                if (size + len +
+                    (int)sizeof(tft->pfi.content.componentj.proto) >
+                    octet->len) {
+                    ogs_error("TFT: size%d+len%d+pf%d.component%d."
+                            "proto%d > IE Length%d", size, len, i, j,
+                            (int)sizeof(tft->pfi.content.componentj.proto),
+                            octet->len);
+                    return size;
+                }
                 memcpy(&tft->pfi.content.componentj.proto,
                         (unsigned char *)octet->data+size+len,
                         sizeof(tft->pfi.content.componentj.proto));
@@ -346,17 +406,33 @@
                 break;
             case OGS_PACKET_FILTER_IPV4_REMOTE_ADDRESS_TYPE:
             case OGS_PACKET_FILTER_IPV4_LOCAL_ADDRESS_TYPE:
-                ogs_assert(size+len+
-                        sizeof(tft->pfi.content.componentj.ipv4.addr) <=
-                        octet->len);
+                if (size + len +
+                    (int)sizeof(tft->pfi.content.componentj.ipv4.addr) >
+                    octet->len) {
+                    ogs_error("TFT: size%d+len%d+pf%d.component%d."
+                            "ipv4.addr%d > IE Length%d",
+                            size, len, i, j,
+                            (int)sizeof(tft->pfi.content.componentj.
+                                ipv4.addr),
+                            octet->len);
+                    return size;
+                }
                 memcpy(&tft->pfi.content.componentj.ipv4.addr,
                     (unsigned char *)octet->data+size+len,
                     sizeof(tft->pfi.content.componentj.ipv4.addr));
                 len += sizeof(tft->pfi.content.componentj.ipv4.addr);
 
-                ogs_assert(size+len+
-                    sizeof(tft->pfi.content.componentj.ipv4.mask) <=
-                    octet->len);
+                if (size + len +
+                    (int)sizeof(tft->pfi.content.componentj.ipv4.mask) >
+                    octet->len) {
+                    ogs_error("TFT: size%d+len%d+pf%d.component%d."
+                            "ipv4.mask%d > IE Length%d",
+                            size, len, i, j,
+                            (int)sizeof(tft->pfi.content.componentj.
+                                ipv4.mask),
+                            octet->len);
+                    return size;
+                }
                 memcpy(&tft->pfi.content.componentj.ipv4.mask,
                     (unsigned char *)octet->data+size+len,
                     sizeof(tft->pfi.content.componentj.ipv4.mask));
@@ -364,17 +440,33 @@
                 break;
             case OGS_PACKET_FILTER_IPV6_LOCAL_ADDRESS_PREFIX_LENGTH_TYPE:
             case OGS_PACKET_FILTER_IPV6_REMOTE_ADDRESS_PREFIX_LENGTH_TYPE:
-                ogs_assert(size+len+
-                    sizeof(tft->pfi.content.componentj.ipv6.addr) <=
-                    octet->len);
+                if (size + len + (int)sizeof(tft->pfi.content.componentj.
+                        ipv6.addr) >
+                    octet->len) {
+                    ogs_error("TFT: size%d+len%d+pf%d.component%d."
+                            "ipv6.addr%d > IE Length%d",
+                            size, len, i, j,
+                            (int)sizeof(tft->pfi.content.componentj.
+                                ipv6.addr),
+                            octet->len);
+                    return size;
+                }
                 memcpy(&tft->pfi.content.componentj.ipv6.addr,
                     (unsigned char *)octet->data+size+len,
                     sizeof(tft->pfi.content.componentj.ipv6.addr));
                 len += sizeof(tft->pfi.content.componentj.ipv6.addr);
 
-                ogs_assert(size+len+
-                    sizeof(tft->pfi.content.componentj.ipv6.prefixlen) <=
-                        octet->len);
+                if (size + len + (int)sizeof(tft->pfi.content.componentj.
+                        ipv6.prefixlen) >
+                    octet->len) {
+                    ogs_error("TFT: size%d+len%d+pf%d.component%d."
+                            "ipv6.prefixlen%d > IE Length%d",
+                            size, len, i, j,
+                            (int)sizeof(tft->pfi.content.componentj.
+                                ipv6.prefixlen),
+                            octet->len);
+                    return size;
+                }
                 memcpy(&tft->pfi.content.componentj.ipv6.prefixlen,
                     (unsigned char *)octet->data+size+len,
                     sizeof(tft->pfi.content.componentj.ipv6.prefixlen));
@@ -382,17 +474,33 @@
                 break;
             case OGS_PACKET_FILTER_IPV6_LOCAL_ADDRESS_TYPE:
             case OGS_PACKET_FILTER_IPV6_REMOTE_ADDRESS_TYPE:
-                ogs_assert(size+len+
-                    sizeof(tft->pfi.content.componentj.ipv6_mask.addr) <=
-                        octet->len);
+                if (size + len + (int)sizeof(tft->pfi.content.componentj.
+                        ipv6_mask.addr) >
+                    octet->len) {
+                    ogs_error("TFT: size%d+len%d+pf%d.component%d."
+                            "ipv6_mask.addr%d > IE Length%d",
+                            size, len, i, j,
+                            (int)sizeof(tft->pfi.content.componentj.
+                                ipv6_mask.addr),
+                            octet->len);
+                    return size;
+                }
                 memcpy(&tft->pfi.content.componentj.ipv6_mask.addr,
                     (unsigned char *)octet->data+size+len,
                     sizeof(tft->pfi.content.componentj.ipv6_mask.addr));
                 len += sizeof(tft->pfi.content.componentj.ipv6_mask.addr);
 
-                ogs_assert(size+len+
-                    sizeof(tft->pfi.content.componentj.ipv6_mask.mask) <=
-                        octet->len);
+                if (size + len + (int)sizeof(tft->pfi.content.componentj.
+                        ipv6_mask.mask) >
+                    octet->len) {
+                    ogs_error("TFT: size%d+len%d+pf%d.component%d."
+                            "ipv6_mask.mask%d > IE Length%d",
+                            size, len, i, j,
+                            (int)sizeof(tft->pfi.content.componentj.
+                                ipv6_mask.mask),
+                            octet->len);
+                    return size;
+                }
                 memcpy(&tft->pfi.content.componentj.ipv6_mask.mask,
                     (unsigned char *)octet->data+size+len,
                     sizeof(tft->pfi.content.componentj.ipv6_mask.mask));
@@ -400,9 +508,17 @@
                 break;
             case OGS_PACKET_FILTER_SINGLE_LOCAL_PORT_TYPE:
             case OGS_PACKET_FILTER_SINGLE_REMOTE_PORT_TYPE:
-                ogs_assert(size+len+
-                    sizeof(tft->pfi.content.componentj.port.low) <=
-                        octet->len);
+                if (size + len + (int)sizeof(tft->pfi.content.componentj.
+                        port.low) >
+                    octet->len) {
+                    ogs_error("TFT: size%d+len%d+pf%d.component%d."
+                            "port.low%d > IE Length%d",
+                            size, len, i, j,
+                            (int)sizeof(tft->pfi.content.componentj.
+                                port.low),
+                            octet->len);
+                    return size;
+                }
                 memcpy(&tft->pfi.content.componentj.port.low,
                     (unsigned char *)octet->data+size+len,
                     sizeof(tft->pfi.content.componentj.port.low));
@@ -412,9 +528,17 @@
                 break;
             case OGS_PACKET_FILTER_LOCAL_PORT_RANGE_TYPE:
             case OGS_PACKET_FILTER_REMOTE_PORT_RANGE_TYPE:
-                ogs_assert(size+len+
-                    sizeof(tft->pfi.content.componentj.port.low) <=
-                        octet->len);
+                if (size + len + (int)sizeof(tft->pfi.content.componentj.
+                        port.low) >
+                    octet->len) {
+                    ogs_error("TFT: size%d+len%d+pf%d.component%d."
+                            "port.low%d > IE Length%d",
+                            size, len, i, j,
+                            (int)sizeof(tft->pfi.content.componentj.
+                                port.low),
+                            octet->len);
+                    return size;
+                }
                 memcpy(&tft->pfi.content.componentj.port.low,
                     (unsigned char *)octet->data+size+len,
                     sizeof(tft->pfi.content.componentj.port.low));
@@ -422,9 +546,17 @@
                     be16toh(tft->pfi.content.componentj.port.low);
                 len += sizeof(tft->pfi.content.componentj.port.low);
 
-                ogs_assert(size+len+
-                    sizeof(tft->pfi.content.componentj.port.high) <=
-                        octet->len);
+                if (size + len + (int)sizeof(tft->pfi.content.componentj.
+                        port.high) >
+                    octet->len) {
+                    ogs_error("TFT: size%d+len%d+pf%d.component%d."
+                            "port.high%d > IE Length%d",
+                            size, len, i, j,
+                            (int)sizeof(tft->pfi.content.componentj.
+                                port.high),
+                            octet->len);
+                    return size;
+                }
                 memcpy(&tft->pfi.content.componentj.port.high,
                     (unsigned char *)octet->data+size+len,
                     sizeof(tft->pfi.content.componentj.port.high));

open5gs_2.7.6.tar.xz/lib/gtp/xact.c -> open5gs_2.7.7.tar.xz/lib/gtp/xact.c Changed

@@ -77,7 +77,11 @@
     ogs_assert(hdesc);
 
     ogs_pool_id_calloc(&pool, &xact);
-    ogs_assert(xact);
+    if (!xact) {
+        ogs_error("Maximum number of xact%lld reached",
+                    (long long)ogs_app()->pool.xact);
+        return NULL;
+    }
     xact->index = ogs_pool_index(&pool, xact);
 
     xact->gtp_version = 1;
@@ -94,7 +98,12 @@
         xact->tm_response = ogs_timer_add(
                 ogs_app()->timer_mgr, response_timeout,
                 OGS_UINT_TO_POINTER(xact->id));
-        ogs_assert(xact->tm_response);
+        if (!xact->tm_response) {
+            ogs_error("Maximum number of xact->tm_response%lld reached",
+                        (long long)ogs_app()->pool.timer);
+            ogs_gtp_xact_delete(xact);
+            return NULL;
+        }
         xact->response_rcount =
             ogs_local_conf()->time.message.gtp.n3_response_rcount;
     }
@@ -102,7 +111,12 @@
     xact->tm_holding = ogs_timer_add(
             ogs_app()->timer_mgr, holding_timeout,
             OGS_UINT_TO_POINTER(xact->id));
-    ogs_assert(xact->tm_holding);
+    if (!xact->tm_holding) {
+        ogs_error("Maximum number of xact->tm_holding%lld reached",
+                    (long long)ogs_app()->pool.timer);
+        ogs_gtp_xact_delete(xact);
+        return NULL;
+    }
     xact->holding_rcount = ogs_local_conf()->time.message.gtp.n3_holding_rcount;
 
     ogs_list_add(&xact->gnode->local_list, xact);
@@ -134,7 +148,11 @@
     ogs_assert(hdesc);
 
     ogs_pool_id_calloc(&pool, &xact);
-    ogs_assert(xact);
+    if (!xact) {
+        ogs_error("Maximum number of xact%lld reached",
+                    (long long)ogs_app()->pool.xact);
+        return NULL;
+    }
     xact->index = ogs_pool_index(&pool, xact);
 
     xact->gtp_version = 2;
@@ -153,19 +171,34 @@
     xact->tm_response = ogs_timer_add(
             ogs_app()->timer_mgr, response_timeout,
             OGS_UINT_TO_POINTER(xact->id));
-    ogs_assert(xact->tm_response);
+    if (!xact->tm_response) {
+        ogs_error("Maximum number of xact->tm_response%lld reached",
+                    (long long)ogs_app()->pool.timer);
+        ogs_gtp_xact_delete(xact);
+        return NULL;
+    }
     xact->response_rcount =
         ogs_local_conf()->time.message.gtp.n3_response_rcount,
 
     xact->tm_holding = ogs_timer_add(
             ogs_app()->timer_mgr, holding_timeout,
             OGS_UINT_TO_POINTER(xact->id));
-    ogs_assert(xact->tm_holding);
+    if (!xact->tm_holding) {
+        ogs_error("Maximum number of xact->tm_holding%lld reached",
+                    (long long)ogs_app()->pool.timer);
+        ogs_gtp_xact_delete(xact);
+        return NULL;
+    }
     xact->holding_rcount = ogs_local_conf()->time.message.gtp.n3_holding_rcount,
 
     xact->tm_peer = ogs_timer_add(ogs_app()->timer_mgr, peer_timeout,
             OGS_UINT_TO_POINTER(xact->id));
-    ogs_assert(xact->tm_peer);
+    if (!xact->tm_peer) {
+        ogs_error("Maximum number of xact->tm_peer%lld reached",
+                    (long long)ogs_app()->pool.timer);
+        ogs_gtp_xact_delete(xact);
+        return NULL;
+    }
 
     ogs_list_add(&xact->gnode->local_list, xact);
 
@@ -192,7 +225,11 @@
     ogs_assert(gnode);
 
     ogs_pool_id_calloc(&pool, &xact);
-    ogs_assert(xact);
+    if (!xact) {
+        ogs_error("Maximum number of xact%lld reached",
+                    (long long)ogs_app()->pool.xact);
+        return NULL;
+    }
     xact->index = ogs_pool_index(&pool, xact);
 
     xact->gtp_version = gtp_version;
@@ -204,19 +241,34 @@
     xact->tm_response = ogs_timer_add(
             ogs_app()->timer_mgr, response_timeout,
             OGS_UINT_TO_POINTER(xact->id));
-    ogs_assert(xact->tm_response);
+    if (!xact->tm_response) {
+        ogs_error("Maximum number of xact->tm_response%lld reached",
+                    (long long)ogs_app()->pool.timer);
+        ogs_gtp_xact_delete(xact);
+        return NULL;
+    }
     xact->response_rcount =
         ogs_local_conf()->time.message.gtp.n3_response_rcount,
 
     xact->tm_holding = ogs_timer_add(
             ogs_app()->timer_mgr, holding_timeout,
             OGS_UINT_TO_POINTER(xact->id));
-    ogs_assert(xact->tm_holding);
+    if (!xact->tm_holding) {
+        ogs_error("Maximum number of xact->tm_holding%lld reached",
+                    (long long)ogs_app()->pool.timer);
+        ogs_gtp_xact_delete(xact);
+        return NULL;
+    }
     xact->holding_rcount = ogs_local_conf()->time.message.gtp.n3_holding_rcount,
 
     xact->tm_peer = ogs_timer_add(ogs_app()->timer_mgr, peer_timeout,
             OGS_UINT_TO_POINTER(xact->id));
-    ogs_assert(xact->tm_peer);
+    if (!xact->tm_peer) {
+        ogs_error("Maximum number of xact->tm_peer%lld reached",
+                    (long long)ogs_app()->pool.timer);
+        ogs_gtp_xact_delete(xact);
+        return NULL;
+    }
 
     ogs_list_add(&xact->gnode->remote_list, xact);

open5gs_2.7.6.tar.xz/lib/gtp/xact.h -> open5gs_2.7.7.tar.xz/lib/gtp/xact.h Changed

open5gs_2.7.6.tar.xz/lib/ipfw/ogs-ipfw.c -> open5gs_2.7.7.tar.xz/lib/ipfw/ogs-ipfw.c Changed

open5gs_2.7.6.tar.xz/lib/metrics/context.c -> open5gs_2.7.7.tar.xz/lib/metrics/context.c Changed

@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2022 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
  * Copyright (C) 2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2025 by Juraj Elias <juraj.elias@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -19,6 +20,8 @@
  */
 
 #include "ogs-metrics.h"
+#include "ogs-core.h"
+#include "metrics/ogs-metrics.h"
 
 #define DEFAULT_PROMETHEUS_HTTP_PORT       9090
 
@@ -38,6 +41,8 @@
     ogs_metrics_spec_init(ogs_metrics_self());
     ogs_metrics_server_init(ogs_metrics_self());
 
+    ogs_list_init(&self.custom_eps);
+
     context_initialized = 1;
 }
 
@@ -47,7 +52,15 @@
 }
 void ogs_metrics_context_close(ogs_metrics_context_t *ctx)
 {
+    ogs_metrics_custom_ep_t *node = NULL, *node_next = NULL;
+
     ogs_metrics_server_close(ctx);
+
+    ogs_list_for_each_safe(&self.custom_eps, node_next, node) {
+        if (node->endpoint) ogs_free(node->endpoint);
+        ogs_list_remove(&self.custom_eps, node);
+        ogs_free(node);
+    }
 }
 
 void ogs_metrics_context_final(void)
@@ -263,3 +276,18 @@
 
     return OGS_OK;
 }
+
+
+void ogs_metrics_register_custom_ep(ogs_metrics_custom_ep_hdlr_t handler,
+        const char *endpoint)
+{
+    ogs_metrics_custom_ep_t *ep;
+
+    ep = ogs_calloc(1, sizeof(*ep));
+    ogs_assert(ep);
+
+    ep->endpoint = ogs_strdup(endpoint);
+    ep->handler = handler;
+
+    ogs_list_add(&self.custom_eps, ep);
+}

open5gs_2.7.6.tar.xz/lib/metrics/context.h -> open5gs_2.7.7.tar.xz/lib/metrics/context.h Changed

open5gs_2.7.6.tar.xz/lib/metrics/ogs-metrics.h -> open5gs_2.7.7.tar.xz/lib/metrics/ogs-metrics.h Changed

open5gs_2.7.6.tar.xz/lib/metrics/prometheus/context.c -> open5gs_2.7.7.tar.xz/lib/metrics/prometheus/context.c Changed

@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2022 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
  * Copyright (C) 2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2025 by Juraj Elias <juraj.elias@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -18,21 +19,39 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
-#include "ogs-metrics.h"
+ /*
+ * Prometheus HTTP server (MicroHTTPD) with optional JSON endpoints:
+ *   - /                (provide health check)
+ *   - /metrics         (provide prometheus metrics metrics according to the relevant NF)
+ *   - /pdu-info        (provided by NF registering ogs_metrics_pdu_info_dumper)
+ *   - /gnb-info        (provided by NF registering ogs_metrics_gnb_info_dumper)
+ *   - /enb-info        (provided by NF registering ogs_metrics_enb_info_dumper)
+ *   - /ue-info         (provided by NF registering ogs_metrics_ue_info_dumper)
+ */
+
+#include "ogs-core.h"
+#include "metrics/ogs-metrics.h"
 
 #include <netdb.h> /* AI_PASSIVE */
 #include "prom.h"
 #include "microhttpd.h"
+#include <string.h>
+
 
+extern int __ogs_metrics_domain;
 #define MAX_LABELS 8
 
+#if MHD_VERSION >= 0x00096100
+static void free_callback(void *cls) { ogs_free(cls); }
+#endif
+
 typedef struct ogs_metrics_server_s {
     ogs_socknode_t node;
     struct MHD_Daemon *mhd;
 } ogs_metrics_server_t;
 
 typedef struct ogs_metrics_spec_s {
-    ogs_metrics_context_t       *ctx; /* backpointer */
+    ogs_metrics_context_t       *ctx;  /* backpointer */ 
     ogs_list_t                  entry; /* included in ogs_metrics_context_t */
     ogs_metrics_metric_type_t   type;
     char                        *name;
@@ -54,9 +73,21 @@
 static OGS_POOL(metrics_spec_pool, ogs_metrics_spec_t);
 static OGS_POOL(metrics_server_pool, ogs_metrics_server_t);
 
+/* Forward decls */
 static int ogs_metrics_context_server_start(ogs_metrics_server_t *server);
 static int ogs_metrics_context_server_stop(ogs_metrics_server_t *server);
 
+static size_t get_query_size_t(struct MHD_Connection *connection,
+                               const char *key, size_t default_val)
+{
+    const char *val = MHD_lookup_connection_value(connection, MHD_GET_ARGUMENT_KIND, key);
+    if (!val || !*val) return default_val;
+    char *end = NULL;
+    unsigned long long v = strtoull(val, &end, 10);
+    if (end == val || *end != '\0') return default_val;
+    return (size_t)v;
+}
+
 void ogs_metrics_server_init(ogs_metrics_context_t *ctx)
 {
     ogs_list_init(&ctx->server_list);
@@ -66,7 +97,6 @@
 void ogs_metrics_server_open(ogs_metrics_context_t *ctx)
 {
     ogs_metrics_server_t *server = NULL;
-
     ogs_list_for_each(&ctx->server_list, server)
         ogs_metrics_context_server_start(server);
 }
@@ -74,35 +104,33 @@
 void ogs_metrics_server_close(ogs_metrics_context_t *ctx)
 {
     ogs_metrics_server_t *server = NULL, *next = NULL;
-
     ogs_list_for_each_safe(&ctx->server_list, next, server)
         ogs_metrics_context_server_stop(server);
 }
 
 void ogs_metrics_server_final(ogs_metrics_context_t *ctx)
 {
-    ogs_metrics_server_remove_all();
+    ogs_metrics_server_t *server = NULL, *next = NULL;
+
+    ogs_list_for_each_safe(&ctx->server_list, next, server)
+        ogs_metrics_server_remove(server);
 
     ogs_pool_final(&metrics_server_pool);
 }
 
-ogs_metrics_server_t *ogs_metrics_server_add(
-        ogs_sockaddr_t *addr, ogs_sockopt_t *option)
+ogs_metrics_server_t *ogs_metrics_server_add(ogs_sockaddr_t *addr, ogs_sockopt_t *option)
 {
     ogs_metrics_server_t *server = NULL;
 
     ogs_assert(addr);
-
     ogs_pool_alloc(&metrics_server_pool, &server);
     ogs_assert(server);
-    memset(server, 0, sizeof(ogs_metrics_server_t));
+    memset(server, 0, sizeof *server);
 
     ogs_assert(OGS_OK == ogs_copyaddrinfo(&server->node.addr, addr));
-    if (option)
-        server->node.option = ogs_memdup(option, sizeof *option);
+    if (option) server->node.option = ogs_memdup(option, sizeof *option);
 
     ogs_list_add(&ogs_metrics_self()->server_list, server);
-
     return server;
 }
 
@@ -114,67 +142,47 @@
 
     ogs_assert(server->node.addr);
     ogs_freeaddrinfo(server->node.addr);
-    if (server->node.option)
-        ogs_free(server->node.option);
+    if (server->node.option) ogs_free(server->node.option);
 
     ogs_pool_free(&metrics_server_pool, server);
 }
 
-void ogs_metrics_server_remove_all(void)
-{
-    ogs_metrics_server_t *server = NULL, *next_server = NULL;
-
-    ogs_list_for_each_safe(
-            &ogs_metrics_self()->server_list, next_server, server) {
-        ogs_metrics_server_remove(server);
-    }
-}
-
 static void mhd_server_run(short when, ogs_socket_t fd, void *data)
 {
+    (void)when; (void)fd;
     struct MHD_Daemon *mhd_daemon = data;
-
     ogs_assert(mhd_daemon);
     MHD_run(mhd_daemon);
 }
 
 static void mhd_server_notify_connection(void *cls,
-        struct MHD_Connection *connection,
-        void **socket_context,
+        struct MHD_Connection *connection, void **socket_context,
         enum MHD_ConnectionNotificationCode toe)
 {
+    (void)cls;
     struct MHD_Daemon *mhd_daemon = NULL;
     MHD_socket mhd_socket = INVALID_SOCKET;
 
     const union MHD_ConnectionInfo *mhd_info = NULL;
-    struct {
-        ogs_poll_t *read;
-    } poll;
+    struct { ogs_poll_t *read; } poll = {0};
 
     switch (toe) {
-        case MHD_CONNECTION_NOTIFY_STARTED:
-            mhd_info = MHD_get_connection_info(
-                    connection, MHD_CONNECTION_INFO_DAEMON);
-            ogs_assert(mhd_info);
-            mhd_daemon = mhd_info->daemon;
-            ogs_assert(mhd_daemon);
-
-            mhd_info = MHD_get_connection_info(
-                    connection, MHD_CONNECTION_INFO_CONNECTION_FD);
-            ogs_assert(mhd_info);
-            mhd_socket = mhd_info->connect_fd;
-            ogs_assert(mhd_socket != INVALID_SOCKET);
-
-            poll.read = ogs_pollset_add(ogs_app()->pollset,
-                    OGS_POLLIN, mhd_socket, mhd_server_run, mhd_daemon);
-            ogs_assert(poll.read);
-            *socket_context = poll.read;
-            break;
-        case MHD_CONNECTION_NOTIFY_CLOSED:
-            poll.read = *socket_context;
-            if (poll.read)
-                ogs_pollset_remove(poll.read);
-            break;
+    case MHD_CONNECTION_NOTIFY_STARTED:
+        mhd_info = MHD_get_connection_info(connection, MHD_CONNECTION_INFO_DAEMON);
+        ogs_assert(mhd_info); mhd_daemon = mhd_info->daemon; ogs_assert(mhd_daemon);
+
+        mhd_info = MHD_get_connection_info(connection, MHD_CONNECTION_INFO_CONNECTION_FD);
+        ogs_assert(mhd_info); mhd_socket = mhd_info->connect_fd; ogs_assert(mhd_socket != INVALID_SOCKET);
+
+        poll.read = ogs_pollset_add(ogs_app()->pollset, OGS_POLLIN, mhd_socket, mhd_server_run, mhd_daemon);
+        ogs_assert(poll.read);
+        *socket_context = poll.read;
+        break;
+
+    case MHD_CONNECTION_NOTIFY_CLOSED:
+        poll.read = *socket_context;
+        if (poll.read) ogs_pollset_remove(poll.read);
+        break;
     }
 }
 
@@ -184,41 +192,131 @@
 typedef int _MHD_Result;
 #endif
 
-static _MHD_Result mhd_server_access_handler(void *cls, struct MHD_Connection *connection,
-        const char *url, const char *method, const char *version,
-        const char *upload_data, size_t *upload_data_size, void **con_cls) {
+/* Small helper to serve JSON from a registered dumper */
+static _MHD_Result serve_json_from_dumper(struct MHD_Connection *connection,
+                                          ogs_metrics_custom_ep_hdlr_t handler,
+                                          size_t page, size_t page_size)
+{
+    ogs_assert(connection);
+    ogs_assert(handler);
+
+    size_t cap = 512 * 1024;
+    char *bufjson = (char *)ogs_malloc(cap);
+    if (!bufjson) {
+        const char *msg = "Out of memory\n";
+        struct MHD_Response *rsp = MHD_create_response_from_buffer(strlen(msg),
+                                (void*)msg, MHD_RESPMEM_PERSISTENT);
+        if (!rsp) return (_MHD_Result)MHD_NO;
+        int ret = MHD_queue_response(connection, MHD_HTTP_INTERNAL_SERVER_ERROR, rsp);
+        MHD_destroy_response(rsp);
+        return (_MHD_Result)ret;
+    }
+
+    size_t n = handler(bufjson, cap, page, page_size);
+    if (n >= cap - 1) {
+        /* grow once */
+        size_t newcap = cap * 2;
+        char *tmp = (char *)ogs_realloc(bufjson, newcap);
+        if (!tmp) {
+            ogs_free(bufjson);
+            const char *msg = "Out of memory\n";
+            struct MHD_Response *rsp = MHD_create_response_from_buffer(strlen(msg),
+                                    (void*)msg, MHD_RESPMEM_PERSISTENT);
+            if (!rsp) return (_MHD_Result)MHD_NO;
+            int ret = MHD_queue_response(connection, MHD_HTTP_INTERNAL_SERVER_ERROR, rsp);
+            MHD_destroy_response(rsp);
+            return (_MHD_Result)ret;
+        }
+        bufjson = tmp; cap = newcap;
+        n = handler(bufjson, cap, page, page_size);
+        if (n >= cap - 1) {
+            /* graceful fallback */
+            n = ogs_snprintf(bufjson, cap, "");
+        }
+    }
 
-    const char *buf;
     struct MHD_Response *rsp;
-    int ret;
+#if MHD_VERSION >= 0x00096100
+    rsp = MHD_create_response_from_buffer_with_free_callback(n, (void*)bufjson, free_callback);
+    bufjson = NULL; /* ownership moved to MHD */
+#else
+    rsp = MHD_create_response_from_buffer(n, (void*)bufjson, MHD_RESPMEM_MUST_COPY);
+#endif
+    if (!rsp) {
+#if MHD_VERSION < 0x00096100
+        ogs_free(bufjson);
+#endif
+        return (_MHD_Result)MHD_NO;
+    }
 
+    MHD_add_response_header(rsp, "Content-Type", "application/json");
+    MHD_add_response_header(rsp, "Access-Control-Allow-Origin", "*");
+    int ret = MHD_queue_response(connection, MHD_HTTP_OK, rsp);
+    MHD_destroy_response(rsp);
+#if MHD_VERSION < 0x00096100
+    ogs_free(bufjson);
+#endif
+    return (_MHD_Result)ret;
+}
+
+static _MHD_Result
+mhd_server_access_handler(void *cls, struct MHD_Connection *connection,
+        const char *url, const char *method, const char *version,
+        const char *upload_data, size_t *upload_data_size, void **con_cls)
+{
+    (void)cls; (void)version; (void)upload_data; (void)upload_data_size; (void)con_cls;
+
+    const char *buf = NULL;
+    struct MHD_Response *rsp = NULL;
+    int ret = MHD_NO;
+
+    /* Only GET is supported */
     if (strcmp(method, "GET") != 0) {
         buf = "Invalid HTTP Method\n";
         rsp = MHD_create_response_from_buffer(strlen(buf), (void *)buf, MHD_RESPMEM_PERSISTENT);
         ret = MHD_queue_response(connection, MHD_HTTP_BAD_REQUEST, rsp);
         MHD_destroy_response(rsp);
-        return ret;
+        return (_MHD_Result)ret;
     }
+
+    /* Health */
     if (strcmp(url, "/") == 0) {
         buf = "OK\n";
         rsp = MHD_create_response_from_buffer(strlen(buf), (void *)buf, MHD_RESPMEM_PERSISTENT);
         ret = MHD_queue_response(connection, MHD_HTTP_OK, rsp);
         MHD_destroy_response(rsp);
-        return ret;
+        return (_MHD_Result)ret;
     }
+
+    /* Prometheus metrics plain-text */
     if (strcmp(url, "/metrics") == 0) {
         buf = prom_collector_registry_bridge(PROM_COLLECTOR_REGISTRY_DEFAULT);
-        rsp = MHD_create_response_from_buffer(strlen(buf), (void *)buf, MHD_RESPMEM_MUST_FREE);
+        rsp = MHD_create_response_from_buffer(strlen(buf), (void *)buf, MHD_RESPMEM_MUST_COPY);
         MHD_add_response_header(rsp, "Content-Type", "text/plain; version=0.0.4; charset=utf-8");
         ret = MHD_queue_response(connection, MHD_HTTP_OK, rsp);
         MHD_destroy_response(rsp);
-        return ret;
+        prom_free((void *)buf);
+        return (_MHD_Result)ret;
+    }
+
+    size_t page = get_query_size_t(connection, "page", 0);
+    size_t page_size = get_query_size_t(connection, "page_size", 100);
+
+    ogs_metrics_custom_ep_t *node = NULL;
+    ogs_list_for_each(&ogs_metrics_self()->custom_eps, node) {
+        if (!strcmp(node->endpoint, url)) {
+            return serve_json_from_dumper(connection,
+                    node->handler,
+                    page, page_size);
+        }
     }
+
+    /* No matching route */
     buf = "Bad Request\n";
     rsp = MHD_create_response_from_buffer(strlen(buf), (void *)buf, MHD_RESPMEM_PERSISTENT);
     ret = MHD_queue_response(connection, MHD_HTTP_BAD_REQUEST, rsp);
     MHD_destroy_response(rsp);
-    return ret;
+    return (_MHD_Result)ret;
 }
 
 static int ogs_metrics_context_server_start(ogs_metrics_server_t *server)
@@ -254,31 +352,26 @@
 
     mhd_opsindex.option = MHD_OPTION_NOTIFY_CONNECTION;
     mhd_opsindex.value = (intptr_t)&mhd_server_notify_connection;
-    mhd_opsindex.ptr_value = NULL;
-    index++;
+    mhd_opsindex.ptr_value = NULL; index++;
 
     mhd_opsindex.option = MHD_OPTION_SOCK_ADDR;
     mhd_opsindex.value = 0;
-    mhd_opsindex.ptr_value = (void *)&addr->sa;
-    index++;
+    mhd_opsindex.ptr_value = (void *)&addr->sa; index++;
 
     mhd_opsindex.option = MHD_OPTION_END;
     mhd_opsindex.value = 0;
-    mhd_opsindex.ptr_value = NULL;
-    index++;
+    mhd_opsindex.ptr_value = NULL; index++;
 
     if (server->mhd) {
         ogs_error("Prometheus HTTP server is already opened!");
         return OGS_ERROR;
     }
 
-    server->mhd = MHD_start_daemon(
-                mhd_flags,
-                0,
-                NULL, NULL,
-                mhd_server_access_handler, server,
-                MHD_OPTION_ARRAY, mhd_ops,
-                MHD_OPTION_END);
+    server->mhd = MHD_start_daemon(mhd_flags, 0,
+                                   NULL, NULL,
+                                   mhd_server_access_handler, server,
+                                   MHD_OPTION_ARRAY, mhd_ops,
+                                   MHD_OPTION_END);
     if (!server->mhd) {
         ogs_error("Cannot start Prometheus HTTP server");
         return OGS_ERROR;
@@ -288,17 +381,15 @@
     mhd_info = MHD_get_daemon_info(server->mhd, MHD_DAEMON_INFO_LISTEN_FD);
     ogs_assert(mhd_info);
 
-    server->node.poll = ogs_pollset_add(ogs_app()->pollset,
-            OGS_POLLIN, mhd_info->listen_fd, mhd_server_run, server->mhd);
+    server->node.poll = ogs_pollset_add(ogs_app()->pollset, OGS_POLLIN,
+                                        mhd_info->listen_fd, mhd_server_run, server->mhd);
     ogs_assert(server->node.poll);
 
     hostname = ogs_gethostname(addr);
     if (hostname)
-        ogs_info("metrics_server() http://%s:%d",
-                hostname, OGS_PORT(addr));
+        ogs_info("metrics_server() http://%s:%d", hostname, OGS_PORT(addr));
     else
-        ogs_info("metrics_server() http://%s:%d",
-                OGS_ADDR(addr, buf), OGS_PORT(addr));
+        ogs_info("metrics_server() http://%s:%d", OGS_ADDR(addr, buf), OGS_PORT(addr));
 
     return OGS_OK;
 }
@@ -317,11 +408,12 @@
     return OGS_OK;
 }
 
+/* ---- Metric spec/inst API (unchanged) ---------------------------------- */
+
 void ogs_metrics_spec_init(ogs_metrics_context_t *ctx)
 {
     ogs_list_init(&ctx->spec_list);
     ogs_pool_init(&metrics_spec_pool, ogs_app()->metrics.max_specs);
-
     prom_collector_registry_default_init();
 }
 
@@ -329,11 +421,10 @@
 {
     ogs_metrics_spec_t *spec = NULL, *next = NULL;
 
-    ogs_list_for_each_entry_safe(&ctx->spec_list, next, spec, entry) {
+    ogs_list_for_each_entry_safe(&ctx->spec_list, next, spec, entry)
         ogs_metrics_spec_free(spec);
-    }
-    prom_collector_registry_destroy(PROM_COLLECTOR_REGISTRY_DEFAULT);
 
+    prom_collector_registry_destroy(PROM_COLLECTOR_REGISTRY_DEFAULT);
     ogs_pool_final(&metrics_spec_pool);
 }
 
@@ -345,8 +436,7 @@
 {
     ogs_metrics_spec_t *spec;
     unsigned int i;
-
-    prom_histogram_buckets_t *buckets;
+    prom_histogram_buckets_t *buckets = NULL;
     double *upper_bounds;
 
     ogs_assert(name);
@@ -393,17 +483,14 @@
         case OGS_METRICS_HISTOGRAM_BUCKET_TYPE_VARIABLE:
             buckets = (prom_histogram_buckets_t *)prom_malloc(sizeof(prom_histogram_buckets_t));
             ogs_assert(buckets);
-
             ogs_assert(histogram_params->count <= OGS_METRICS_HIST_VAR_BUCKETS_MAX);
             buckets->count = histogram_params->count;
 
-            upper_bounds = (double *)prom_malloc(
-                    sizeof(double) * histogram_params->count);
+            upper_bounds = (double *)prom_malloc(sizeof(double) * histogram_params->count);
             ogs_assert(upper_bounds);
             for (i = 0; i < histogram_params->count; i++) {
                 upper_boundsi = histogram_params->var.bucketsi;
-                if (i > 0)
-                    ogs_assert(upper_boundsi > upper_boundsi - 1);
+                if (i > 0) ogs_assert(upper_boundsi > upper_boundsi - 1);
             }
             buckets->upper_bounds = upper_bounds;
             break;
@@ -432,9 +519,8 @@
 
     ogs_list_remove(&spec->ctx->spec_list, &spec->entry);
 
-    ogs_list_for_each_entry_safe(&spec->inst_list, next, inst, entry) {
+    ogs_list_for_each_entry_safe(&spec->inst_list, next, inst, entry)
         ogs_metrics_inst_free(inst);
-    }
 
     ogs_free(spec->name);
     ogs_free(spec->description);
@@ -444,7 +530,6 @@
     ogs_pool_free(&metrics_spec_pool, spec);
 }
 
-
 ogs_metrics_inst_t *ogs_metrics_inst_new(
         ogs_metrics_spec_t *spec,
         unsigned int num_labels, const char **label_values)
@@ -455,7 +540,7 @@
     ogs_assert(spec);
     ogs_assert(num_labels == spec->num_labels);
 
-    inst = ogs_calloc(1, sizeof(ogs_metrics_inst_t));
+    inst = ogs_calloc(1, sizeof *inst);
     ogs_assert(inst);
     inst->spec = spec;
     inst->num_labels = num_labels;
@@ -502,7 +587,6 @@
         prom_gauge_set(inst->spec->prom, (double)inst->spec->initial_val, (const char **)inst->label_values);
         break;
     default:
-        /* Other types have no way to reset */
         break;
     }
 }
@@ -529,3 +613,4 @@
         break;
     }
 }
+

open5gs_2.7.7.tar.xz/lib/metrics/prometheus/json_pager.c Added

@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2025 by Juraj Elias <juraj.elias@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+/*
+ * /ue-info — MME-side JSON exporter (Prometheus HTTP endpoint)
+ *
+ * License: AGPLv3+
+ */
+
+/* lib/metrics/prometheus/json_pager.c */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <string.h>
+
+#include "ogs-core.h"
+#include "ogs-proto.h"
+#include "sbi/openapi/external/cJSON.h"
+
+#include "metrics/prometheus/json_pager.h"
+
+size_t
+json_pager_safe_start_index(bool no_paging, size_t page, size_t page_size)
+{
+    if (no_paging) return 0;
+    if (page_size != 0 && page > SIZE_MAX / page_size)
+        return SIZE_MAX; /* treat as beyond end */
+    return page * page_size;
+}
+
+void
+json_pager_add_trailing(cJSON *root,
+                        bool no_paging,
+                        size_t page,
+                        size_t page_size,
+                        size_t count,
+                        bool has_next,
+                        const char *base_path,
+                        bool truncated)
+{
+    cJSON *pager = cJSON_CreateObject();
+    cJSON_AddNumberToObject(pager, "page",      (double)(no_paging ? 0 : page));
+    cJSON_AddNumberToObject(pager, "page_size", (double)(no_paging ? 0 : page_size));
+    cJSON_AddNumberToObject(pager, "count",     (double)count);
+
+    /* Only add "truncated" when true */
+    if (truncated)
+        cJSON_AddBoolToObject(pager, "truncated", 1);
+
+    if (!no_paging) {
+        if (page > 0) {
+            char prev128;
+            snprintf(prev, sizeof prev, "%s?page=%zu", base_path, page - 1);
+            cJSON_AddStringToObject(pager, "prev", prev);
+        }
+        if (has_next) {
+            char next128;
+            snprintf(next, sizeof next, "%s?page=%zu", base_path, page + 1);
+            cJSON_AddStringToObject(pager, "next", next);
+        }
+    }
+
+    cJSON_AddItemToObject(root, "pager", pager);
+}
+
+size_t
+json_pager_finalize(cJSON *root, char *buf, size_t buflen)
+{
+    size_t outlen = 0;
+
+    if (cJSON_PrintPreallocated(root, buf, (int)buflen, 0)) {
+        outlen = strlen(buf);
+        cJSON_Delete(root);
+        return outlen;
+    }
+
+    char *tmp = cJSON_PrintUnformatted(root);
+    if (!tmp) {
+        if (buflen >= 3) {
+            memcpy(buf, "{}", 3);
+            cJSON_Delete(root);
+            return 2;
+        }
+        if (buflen) buf0 = '\0';
+        cJSON_Delete(root);
+        return 0;
+    }
+
+    size_t need = strlen(tmp);
+    if (need + 1 <= buflen) {
+        memcpy(buf, tmp, need + 1);
+        outlen = need;
+    } else {
+        if (buflen >= 3) {
+            memcpy(buf, "{}", 3);
+            outlen = 2;
+        } else if (buflen) {
+            buf0 = '\0';
+        }
+    }
+    cJSON_free(tmp);
+    cJSON_Delete(root);
+    return outlen;
+}
+

open5gs_2.7.7.tar.xz/lib/metrics/prometheus/json_pager.h Added

@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2025 by Juraj Elias <juraj.elias@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+/*
+ * /ue-info — MME-side JSON exporter (Prometheus HTTP endpoint)
+ *
+ * License: AGPLv3+
+ */
+
+/* lib/metrics/prometheus/json_pager.h  */
+
+#ifndef OGS_METRICS_PROM_JSON_PAGER_H
+#define OGS_METRICS_PROM_JSON_PAGER_H
+
+#include <stddef.h>
+#include <stdbool.h>
+
+/* Forward-declare so callers don't need to include cJSON.h here */
+typedef struct cJSON cJSON;
+
+/* Safe start_index = page * page_size with overflow guard. */
+size_t json_pager_safe_start_index(bool no_paging, size_t page, size_t page_size);
+
+/* Append trailing { "pager": { page, page_size, count, truncated, prev?, next? } }.  */
+void json_pager_add_trailing(cJSON *root,
+                             bool no_paging,
+                             size_t page,
+                             size_t page_size,
+                             size_t count,
+                             bool has_next,
+                             const char *base_path,
+                             bool truncated);
+
+/* Finalize JSON into buf and free root. */
+size_t json_pager_finalize(cJSON *root, char *buf, size_t buflen);
+
+/* Paging step helper
+ * Returns: 1 -> CONTINUE (skip), 2 -> BREAK (page full; set has_next), 0 -> EMIT.
+ */
+static inline int
+json_pager_advance(bool no_paging,
+                   size_t idx, size_t start_index,
+                   size_t emitted, size_t page_size,
+                   bool *has_next)
+{
+    if (no_paging) return 0;
+    if (idx < start_index) return 1;
+    if (emitted == page_size) { if (has_next) *has_next = true; return 2; }
+    return 0;
+}
+
+#endif /* OGS_METRICS_PROM_JSON_PAGER_H */
+
+

open5gs_2.7.6.tar.xz/lib/nas/5gs/encoder.c -> open5gs_2.7.7.tar.xz/lib/nas/5gs/encoder.c Changed

open5gs_2.7.6.tar.xz/lib/nas/5gs/support/nas-message.py -> open5gs_2.7.7.tar.xz/lib/nas/5gs/support/nas-message.py Changed

open5gs_2.7.6.tar.xz/lib/nas/5gs/types.c -> open5gs_2.7.7.tar.xz/lib/nas/5gs/types.c Changed

@@ -273,7 +273,7 @@
             ogs_nas_build_s_nssai(&nas_s_nssai, nas_s_nssai_ie + i);
             memcpy(nas_nssai->buffer + nas_nssai->length, &nas_s_nssai,
                     sizeof(nas_s_nssai.length) + nas_s_nssai.length);
-            nas_nssai->length += 
+            nas_nssai->length +=
                     (sizeof(nas_s_nssai.length) + nas_s_nssai.length);
         }
     }
@@ -805,14 +805,216 @@
     return OGS_OK;
 }
 
+/* Parse "Packet filter list", 3GPP TS 24.501 Figure 9.11.4.13.3 and Figure 9.11.4.13. */
+static int parse_qos_rules_packet_filter_list(ogs_nas_qos_rule_t *rule, const uint8_t *buffer, uint16_t length) {
+    uint16_t size = 0;
+    int i, j, len = 0;
+
+    for (i = 0; i < rule->num_of_packet_filter && i < OGS_MAX_NUM_OF_FLOW_IN_GTP; i++) {
+        if (size+sizeof(rule->pfi.flags) > length) {
+            ogs_error("PF%d Overflow: size%d length%d", i, size, length);
+            goto cleanup;
+        }
+        memcpy(&rule->pfi.flags, buffer+size, sizeof(rule->pfi.flags));
+        size += sizeof(rule->pfi.flags);
+
+        if (rule->code ==
+            OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_DELETE_PACKET_FILTERS)
+            continue;
+
+        if (size+sizeof(rule->pfi.content.length) > length) {
+            ogs_error("PF%d Overflow: size%d length%d", i, size, length);
+            goto cleanup;
+        }
+        memcpy(&rule->pfi.content.length, buffer+size,
+                sizeof(rule->pfi.content.length));
+        size += sizeof(rule->pfi.content.length);
+
+        j = 0; len = 0;
+        while(len < rule->pfi.content.length) {
+            if (size+len+
+                sizeof(rule->pfi.content.componentj.type) > length) {
+                ogs_error("PF%d Overflow: size%d len%d length%d",
+                          i, size, len, length);
+                goto cleanup;
+            }
+            memcpy(&rule->pfi.content.componentj.type,
+                    buffer+size+len,
+                    sizeof(rule->pfi.content.componentj.type));
+            len += sizeof(rule->pfi.content.componentj.type);
+            switch(rule->pfi.content.componentj.type) {
+            case OGS_PACKET_FILTER_MATCH_ALL:
+                break;
+            case OGS_PACKET_FILTER_PROTOCOL_IDENTIFIER_NEXT_HEADER_TYPE:
+                if (size+len+
+                    sizeof(rule->pfi.content.componentj.proto) >
+                    length) {
+                    ogs_error("PF%d Overflow: size%d len%d length%d",
+                              i, size, len, length);
+                    goto cleanup;
+                }
+                memcpy(&rule->pfi.content.componentj.proto,
+                    buffer+size+len,
+                    sizeof(rule->pfi.content.componentj.proto));
+                len += sizeof(rule->pfi.content.componentj.proto);
+                break;
+            case OGS_PACKET_FILTER_IPV4_REMOTE_ADDRESS_TYPE:
+            case OGS_PACKET_FILTER_IPV4_LOCAL_ADDRESS_TYPE:
+                if (size+len+
+                    sizeof(rule->pfi.content.componentj.ipv4.addr) >
+                    length) {
+                    ogs_error("PF%d Overflow: size%d len%d length%d",
+                              i, size, len, length);
+                    goto cleanup;
+                }
+                memcpy(&rule->pfi.content.componentj.ipv4.addr,
+                    buffer+size+len,
+                    sizeof(rule->pfi.content.componentj.ipv4.addr));
+                len += sizeof(rule->pfi.content.componentj.ipv4.addr);
+
+                if (size+len+
+                    sizeof(rule->pfi.content.componentj.ipv4.mask) >
+                    length) {
+                    ogs_error("PF%d Overflow: size%d len%d length%d",
+                              i, size, len, length);
+                    goto cleanup;
+                }
+                memcpy(&rule->pfi.content.componentj.ipv4.mask,
+                    buffer+size+len,
+                    sizeof(rule->pfi.content.componentj.ipv4.mask));
+                len += sizeof(rule->pfi.content.componentj.ipv4.mask);
+                break;
+            case OGS_PACKET_FILTER_IPV6_LOCAL_ADDRESS_PREFIX_LENGTH_TYPE:
+            case OGS_PACKET_FILTER_IPV6_REMOTE_ADDRESS_PREFIX_LENGTH_TYPE:
+                if (size+len+
+                    sizeof(rule->pfi.content.componentj.ipv6.addr) >
+                    length) {
+                    ogs_error("PF%d Overflow: size%d len%d length%d",
+                              i, size, len, length);
+                    goto cleanup;
+                }
+                memcpy(&rule->pfi.content.componentj.ipv6.addr,
+                    buffer+size+len,
+                    sizeof(rule->pfi.content.componentj.ipv6.addr));
+                len += sizeof(rule->pfi.content.componentj.ipv6.addr);
+
+                if (size+len+
+                    sizeof(
+                        rule->pfi.content.componentj.ipv6.prefixlen) >
+                    length) {
+                    ogs_error("PF%d Overflow: size%d len%d length%d",
+                              i, size, len, length);
+                    goto cleanup;
+                }
+                memcpy(&rule->pfi.content.componentj.ipv6.prefixlen,
+                    buffer+size+len,
+                    sizeof(
+                        rule->pfi.content.componentj.ipv6.prefixlen));
+                len += sizeof(
+                        rule->pfi.content.componentj.ipv6.prefixlen);
+                break;
+            case OGS_PACKET_FILTER_IPV6_LOCAL_ADDRESS_TYPE:
+            case OGS_PACKET_FILTER_IPV6_REMOTE_ADDRESS_TYPE:
+                if (size+len+
+                    sizeof(
+                        rule->pfi.content.componentj.ipv6_mask.addr) >
+                        length) {
+                    ogs_error("PF%d Overflow: size%d len%d length%d",
+                              i, size, len, length);
+                    goto cleanup;
+                }
+                memcpy(&rule->pfi.content.componentj.ipv6_mask.addr,
+                    buffer+size+len,
+                    sizeof(
+                        rule->pfi.content.componentj.ipv6_mask.addr));
+                len += sizeof(
+                        rule->pfi.content.componentj.ipv6_mask.addr);
+
+                if (size+len+
+                    sizeof(
+                        rule->pfi.content.componentj.ipv6_mask.mask) >
+                        length) {
+                    ogs_error("PF%d Overflow: size%d len%d length%d",
+                              i, size, len, length);
+                    goto cleanup;
+                }
+                memcpy(&rule->pfi.content.componentj.ipv6_mask.mask,
+                    buffer+size+len,
+                    sizeof(
+                        rule->pfi.content.componentj.ipv6_mask.mask));
+                len += sizeof(
+                        rule->pfi.content.componentj.ipv6_mask.mask);
+                break;
+            case OGS_PACKET_FILTER_SINGLE_LOCAL_PORT_TYPE:
+            case OGS_PACKET_FILTER_SINGLE_REMOTE_PORT_TYPE:
+                if (size+len+
+                    sizeof(rule->pfi.content.componentj.port.low) >
+                        length) {
+                    ogs_error("PF%d Overflow: size%d len%d length%d",
+                              i, size, len, length);
+                    goto cleanup;
+                }
+                memcpy(&rule->pfi.content.componentj.port.low,
+                    buffer+size+len,
+                    sizeof(rule->pfi.content.componentj.port.low));
+                rule->pfi.content.componentj.port.low =
+                    be16toh(rule->pfi.content.componentj.port.low);
+                len += sizeof(rule->pfi.content.componentj.port.low);
+                break;
+            case OGS_PACKET_FILTER_LOCAL_PORT_RANGE_TYPE:
+            case OGS_PACKET_FILTER_REMOTE_PORT_RANGE_TYPE:
+                if (size+len+
+                    sizeof(rule->pfi.content.componentj.port.low) >
+                        length) {
+                    ogs_error("PF%d Overflow: size%d len%d length%d",
+                              i, size, len, length);
+                    goto cleanup;
+                }
+                memcpy(&rule->pfi.content.componentj.port.low,
+                    buffer+size+len,
+                    sizeof(rule->pfi.content.componentj.port.low));
+                rule->pfi.content.componentj.port.low =
+                    be16toh(rule->pfi.content.componentj.port.low);
+                len += sizeof(rule->pfi.content.componentj.port.low);
+
+                if (size+len+
+                    sizeof(rule->pfi.content.componentj.port.high) >
+                        length) {
+                    ogs_error("PF%d Overflow: size%d len%d length%d",
+                              i, size, len, length);
+                    goto cleanup;
+                }
+                memcpy(&rule->pfi.content.componentj.port.high,
+                    buffer+size+len,
+                    sizeof(rule->pfi.content.componentj.port.high));
+                rule->pfi.content.componentj.port.high =
+                    be16toh(rule->pfi.content.componentj.port.high);
+                len += sizeof(rule->pfi.content.componentj.port.high);
+                break;
+            default:
+                ogs_error("PF%d Unknown Packet Filter Type(%d)",
+                          i, rule->pfi.content.componentj.type);
+                goto cleanup;
+            }
+            j++;
+        }
+        rule->pfi.content.num_of_component = j;
+        size += len;
+    }
+    return size;
+cleanup:
+    return -1;
+}
+
+/* Parse "QoS rules", 3GPP TS 24.501 Figure 9.11.4.13.1. */
 int ogs_nas_parse_qos_rules(
         ogs_nas_qos_rule_t *rule, ogs_nas_qos_rules_t *rules)
 {
     ogs_nas_qos_rule_t *first = rule;
 
-    char *buffer;
-    uint16_t length, size = 0;
-    int i, j, len = 0;
+    uint8_t *buffer;
+    uint16_t length, size;
+    int rc;
 
     ogs_assert(rule);
     ogs_assert(rules);
@@ -828,9 +1030,10 @@
 
     length = rules->length;
     buffer = rules->buffer;
-
     size = 0;
+
     while (size < length) {
+        bool have_octet_m1, have_octet_m2;
         memset(rule, 0, sizeof(*rule));
 
         if (size+sizeof(rule->identifier) > length) {
@@ -841,244 +1044,106 @@
         size += sizeof(rule->identifier);
 
         if (size+sizeof(rule->length) > length) {
-            ogs_error("Overflow : size%d length%d", size, length);
+            ogs_error("RuleId%u Overflow: size%d length%d", rule->identifier, size, length);
             goto cleanup;
         }
         memcpy(&rule->length, buffer+size, sizeof(rule->length));
         rule->length = be16toh(rule->length);
         size += sizeof(rule->length);
 
+        if (rule->length == 0) {
+            ogs_error("RuleId%u Wrong 'Length of QoS rule' (0)", rule->identifier);
+            goto cleanup;
+        }
+
         if (size+sizeof(rule->flags) > length) {
-            ogs_error("Overflow : size%d length%d", size, length);
+            ogs_error("RuleId%u Overflow: size%d length%d", rule->identifier, size, length);
             goto cleanup;
         }
         memcpy(&rule->flags, buffer+size, sizeof(rule->flags));
         size += sizeof(rule->flags);
 
         if (rule->code == 0 || rule->code == 7) { /* Reserved */
-            ogs_error("Reserved Rule Code %d", rule->code);
+            ogs_error("RuleId%u Reserved Rule Code %d", rule->identifier, rule->code);
             goto cleanup;
         }
 
         if (rule->code == OGS_NAS_QOS_CODE_DELETE_EXISTING_QOS_RULE ||
             rule->code == OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_WITHOUT_MODIFYING_PACKET_FILTERS) {
             if (rule->num_of_packet_filter != 0) {
-                ogs_error("Invalue QoS rule code%d "
-                        "and number of packet filter%d",
-                        rule->code, rule->num_of_packet_filter);
+                ogs_error("RuleId%u Invalid QoS rule code%d and number of packet filter%d",
+                          rule->identifier, rule->code, rule->num_of_packet_filter);
                 rule->num_of_packet_filter = 0;
                 goto cleanup;
             }
         }
 
-        for (i = 0; i < rule->num_of_packet_filter &&
-                    i < OGS_MAX_NUM_OF_FLOW_IN_GTP; i++) {
-            if (size+sizeof(rule->pfi.flags) > length) {
-                ogs_error("Overflow : size%d length%d", size, length);
-                goto cleanup;
-            }
-            memcpy(&rule->pfi.flags, buffer+size, sizeof(rule->pfi.flags));
-            size += sizeof(rule->pfi.flags);
+        rc = parse_qos_rules_packet_filter_list(rule, buffer + size, rule->length - 1);
+        if (rc < 0)
+            goto cleanup;
+        size += rc;
 
-            if (rule->code ==
-                OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_DELETE_PACKET_FILTERS)
-                continue;
+        if (rule->length == (sizeof(rule->flags) + rc)) {
+            have_octet_m1 = false;
+            have_octet_m2 = false;
+        } else if (rule->length == (sizeof(rule->flags) + rc + sizeof(rule->precedence))) {
+            have_octet_m1 = true;
+            have_octet_m2 = false;
+        } else if (rule->length == (sizeof(rule->flags) + rc + sizeof(rule->precedence) + sizeof(rule->flow.flags))) {
+            have_octet_m1 = true;
+            have_octet_m2 = true;
+        } else {
+                ogs_error("RuleId%u 'Length of QoS rule' (%d) doesn't match parsed length (%zu..%zu)",
+                          rule->identifier, rule->length,
+                          sizeof(rule->flags) + rc,
+                          sizeof(rule->flags) + rc + sizeof(rule->precedence) + sizeof(rule->flow.flags));
+                goto cleanup;
+        }
 
-            if (size+sizeof(rule->pfi.content.length) > length) {
-                ogs_error("Overflow : size%d length%d", size, length);
+        if (have_octet_m1) {
+            if ((size + sizeof(rule->precedence)) > length) {
+                ogs_error("RuleId%u Overflow m+1: size%d length%d", rule->identifier, size, length);
+                goto cleanup;
+            }
+            memcpy(&rule->precedence, buffer+size, sizeof(rule->precedence));
+            size += sizeof(rule->precedence);
+            /* 'For the "delete existing QoS rule" operation, the QoS rule precedence value field shall not
+             * be included.'
+             * This implicitly means also m+2 shall neither be present, following Table 9.11.4.13. "NOTE 1". */
+            if (rule->code == OGS_NAS_QOS_CODE_DELETE_EXISTING_QOS_RULE) {
+                ogs_error("RuleId%u Invalid QoS rule code%d and presence of Precedence octet %u",
+                          rule->identifier, rule->code, rule->precedence);
                 goto cleanup;
             }
-            memcpy(&rule->pfi.content.length, buffer+size,
-                    sizeof(rule->pfi.content.length));
-            size += sizeof(rule->pfi.content.length);
 
-            j = 0; len = 0;
-            while(len < rule->pfi.content.length) {
-                if (size+len+
-                    sizeof(rule->pfi.content.componentj.type) > length) {
-                    ogs_error("Overflow : size%d len%d length%d",
-                            size, len, length);
+            if (have_octet_m2) {
+                if ((size + sizeof(rule->flow.flags)) > length) {
+                    ogs_error("RuleId%u Overflow m+2: size%d length%d", rule->identifier, size, length);
                     goto cleanup;
                 }
-                memcpy(&rule->pfi.content.componentj.type,
-                        buffer+size+len,
-                        sizeof(rule->pfi.content.componentj.type));
-                len += sizeof(rule->pfi.content.componentj.type);
-                switch(rule->pfi.content.componentj.type) {
-                case OGS_PACKET_FILTER_PROTOCOL_IDENTIFIER_NEXT_HEADER_TYPE:
-                    if (size+len+
-                        sizeof(rule->pfi.content.componentj.proto) >
-                        length) {
-                        ogs_error("Overflow : size%d len%d length%d",
-                                size, len, length);
-                        goto cleanup;
-                    }
-                    memcpy(&rule->pfi.content.componentj.proto,
-                        buffer+size+len,
-                        sizeof(rule->pfi.content.componentj.proto));
-                    len += sizeof(rule->pfi.content.componentj.proto);
-                    break;
-                case OGS_PACKET_FILTER_IPV4_REMOTE_ADDRESS_TYPE:
-                case OGS_PACKET_FILTER_IPV4_LOCAL_ADDRESS_TYPE:
-                    if (size+len+
-                        sizeof(rule->pfi.content.componentj.ipv4.addr) >
-                        length) {
-                        ogs_error("Overflow : size%d len%d length%d",
-                                size, len, length);
-                        goto cleanup;
-                    }
-                    memcpy(&rule->pfi.content.componentj.ipv4.addr,
-                        buffer+size+len,
-                        sizeof(rule->pfi.content.componentj.ipv4.addr));
-                    len += sizeof(rule->pfi.content.componentj.ipv4.addr);
-
-                    if (size+len+
-                        sizeof(rule->pfi.content.componentj.ipv4.mask) >
-                        length) {
-                        ogs_error("Overflow : size%d len%d length%d",
-                                size, len, length);
-                        goto cleanup;
-                    }
-                    memcpy(&rule->pfi.content.componentj.ipv4.mask,
-                        buffer+size+len,
-                        sizeof(rule->pfi.content.componentj.ipv4.mask));
-                    len += sizeof(rule->pfi.content.componentj.ipv4.mask);
-                    break;
-                case OGS_PACKET_FILTER_IPV6_LOCAL_ADDRESS_PREFIX_LENGTH_TYPE:
-                case OGS_PACKET_FILTER_IPV6_REMOTE_ADDRESS_PREFIX_LENGTH_TYPE:
-                    if (size+len+
-                        sizeof(rule->pfi.content.componentj.ipv6.addr) >
-                        length) {
-                        ogs_error("Overflow : size%d len%d length%d",
-                                size, len, length);
-                        goto cleanup;
-                    }
-                    memcpy(&rule->pfi.content.componentj.ipv6.addr,
-                        buffer+size+len,
-                        sizeof(rule->pfi.content.componentj.ipv6.addr));
-                    len += sizeof(rule->pfi.content.componentj.ipv6.addr);
-
-                    if (size+len+
-                        sizeof(
-                            rule->pfi.content.componentj.ipv6.prefixlen) >
-                        length) {
-                        ogs_error("Overflow : size%d len%d length%d",
-                                size, len, length);
-                        goto cleanup;
-                    }
-                    memcpy(&rule->pfi.content.componentj.ipv6.prefixlen,
-                        buffer+size+len,
-                        sizeof(
-                            rule->pfi.content.componentj.ipv6.prefixlen));
-                    len += sizeof(
-                            rule->pfi.content.componentj.ipv6.prefixlen);
-                    break;
-                case OGS_PACKET_FILTER_IPV6_LOCAL_ADDRESS_TYPE:
-                case OGS_PACKET_FILTER_IPV6_REMOTE_ADDRESS_TYPE:
-                    if (size+len+
-                        sizeof(
-                            rule->pfi.content.componentj.ipv6_mask.addr) >
-                            length) {
-                        ogs_error("Overflow : size%d len%d length%d",
-                                size, len, length);
-                        goto cleanup;
-                    }
-                    memcpy(&rule->pfi.content.componentj.ipv6_mask.addr,
-                        buffer+size+len,
-                        sizeof(
-                            rule->pfi.content.componentj.ipv6_mask.addr));
-                    len += sizeof(
-                            rule->pfi.content.componentj.ipv6_mask.addr);
-
-                    if (size+len+
-                        sizeof(
-                            rule->pfi.content.componentj.ipv6_mask.mask) >
-                            length) {
-                        ogs_error("Overflow : size%d len%d length%d",
-                                size, len, length);
-                        goto cleanup;
-                    }
-                    memcpy(&rule->pfi.content.componentj.ipv6_mask.mask,
-                        buffer+size+len,
-                        sizeof(
-                            rule->pfi.content.componentj.ipv6_mask.mask));
-                    len += sizeof(
-                            rule->pfi.content.componentj.ipv6_mask.mask);
-                    break;
-                case OGS_PACKET_FILTER_SINGLE_LOCAL_PORT_TYPE:
-                case OGS_PACKET_FILTER_SINGLE_REMOTE_PORT_TYPE:
-                    if (size+len+
-                        sizeof(rule->pfi.content.componentj.port.low) >
-                            length) {
-                        ogs_error("Overflow : size%d len%d length%d",
-                                size, len, length);
-                        goto cleanup;
-                    }
-                    memcpy(&rule->pfi.content.componentj.port.low,
-                        buffer+size+len,
-                        sizeof(rule->pfi.content.componentj.port.low));
-                    rule->pfi.content.componentj.port.low =
-                        be16toh(rule->pfi.content.componentj.port.low);
-                    len += sizeof(rule->pfi.content.componentj.port.low);
-                    break;
-                case OGS_PACKET_FILTER_LOCAL_PORT_RANGE_TYPE:
-                case OGS_PACKET_FILTER_REMOTE_PORT_RANGE_TYPE:
-                    if (size+len+
-                        sizeof(rule->pfi.content.componentj.port.low) >
-                            length) {
-                        ogs_error("Overflow : size%d len%d length%d",
-                                size, len, length);
-                        goto cleanup;
-                    }
-                    memcpy(&rule->pfi.content.componentj.port.low,
-                        buffer+size+len,
-                        sizeof(rule->pfi.content.componentj.port.low));
-                    rule->pfi.content.componentj.port.low =
-                        be16toh(rule->pfi.content.componentj.port.low);
-                    len += sizeof(rule->pfi.content.componentj.port.low);
-
-                    if (size+len+
-                        sizeof(rule->pfi.content.componentj.port.high) >
-                            length) {
-                        ogs_error("Overflow : size%d len%d length%d",
-                                size, len, length);
-                        goto cleanup;
-                    }
-                    memcpy(&rule->pfi.content.componentj.port.high,
-                        buffer+size+len,
-                        sizeof(rule->pfi.content.componentj.port.high));
-                    rule->pfi.content.componentj.port.high =
-                        be16toh(rule->pfi.content.componentj.port.high);
-                    len += sizeof(rule->pfi.content.componentj.port.high);
-                    break;
-                default:
-                    ogs_error("Unknown Packet Filter Type(%d)",
-                            rule->pfi.content.componentj.type);
+                memcpy(&rule->flow.flags, buffer+size, sizeof(rule->flow.flags));
+                size += sizeof(rule->flow.flags);
+                /* 'For the "delete existing QoS rule" operation, the QoS rule precedence value field shall not
+                * be included.'
+                * This implicitly means also m+2 shall neither be present, following Table 9.11.4.13. "NOTE 1". */
+                if (rule->code == OGS_NAS_QOS_CODE_DELETE_EXISTING_QOS_RULE) {
+                    ogs_error("RuleId%u Invalid QoS rule code%d and presence of QFI octet %u",
+                            rule->identifier, rule->code, rule->flow.flags);
                     goto cleanup;
                 }
-                j++;
-            }
-            rule->pfi.content.num_of_component = j;
-            size += len;
-        }
-
-        if (rule->code != OGS_NAS_QOS_CODE_DELETE_EXISTING_QOS_RULE &&
-            rule->code != OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_DELETE_PACKET_FILTERS &&
-            rule->code != OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_WITHOUT_MODIFYING_PACKET_FILTERS) {
-
-            if (size+sizeof(rule->precedence) > length) {
-                ogs_error("Overflow : size%d length%d", size, length);
+            } else if (rule->code == OGS_NAS_QOS_CODE_CREATE_NEW_QOS_RULE) {
+                /* 'For the "create new QoS rule" operation, the QoS flow identifier value field shall
+                 * be included.' */
+                ogs_error("RuleId%u Invalid QoS rule code%d without QFI octet",
+                          rule->identifier, rule->code);
                 goto cleanup;
             }
-            memcpy(&rule->precedence, buffer+size, sizeof(rule->precedence));
-            size += sizeof(rule->precedence);
-
-            if (size+sizeof(rule->flow.flags) > length) {
-                ogs_error("Overflow : size%d length%d", size, length);
+        } else if (rule->code == OGS_NAS_QOS_CODE_CREATE_NEW_QOS_RULE) {
+                /* 'For the "create new QoS rule" operation, the QoS rule precedence value field shall
+                 * be included.' */
+                ogs_error("RuleId%u Invalid QoS rule code%d without Precedence octet",
+                          rule->identifier, rule->code);
                 goto cleanup;
-            }
-            memcpy(&rule->flow.flags, buffer+size, sizeof(rule->flow.flags));
-            size += sizeof(rule->flow.flags);
         }
 
         rule++;

open5gs_2.7.6.tar.xz/lib/nas/5gs/types.h -> open5gs_2.7.7.tar.xz/lib/nas/5gs/types.h Changed

open5gs_2.7.6.tar.xz/lib/nas/common/types.h -> open5gs_2.7.7.tar.xz/lib/nas/common/types.h Changed

@@ -30,7 +30,7 @@
 extern "C" {
 #endif
 
-/* The Packet Buffer(ogs_pkbuf_t) for NAS message MUST make a HEADROOM. 
+/* The Packet Buffer(ogs_pkbuf_t) for NAS message MUST make a HEADROOM.
  * When calculating AES_CMAC, we need to use the headroom of the packet. */
 #define OGS_NAS_HEADROOM 16
 
@@ -90,22 +90,27 @@
  * O TLV 4 */
 typedef struct ogs_nas_eps_bearer_context_status_s {
     uint8_t length;
-ED8(uint8_t ebi7:1;,
-    uint8_t ebi6:1;,
-    uint8_t ebi5:1;,
-    uint8_t ebi4:1;,
-    uint8_t ebi3:1;,
-    uint8_t ebi2:1;,
-    uint8_t ebi1:1;,
-    uint8_t ebi0:1;)
-ED8(uint8_t ebi15:1;,
-    uint8_t ebi14:1;,
-    uint8_t ebi13:1;,
-    uint8_t ebi12:1;,
-    uint8_t ebi11:1;,
-    uint8_t ebi10:1;,
-    uint8_t ebi9:1;,
-    uint8_t ebi8:1;)
+    union {
+        struct {
+        ED8(uint8_t ebi7:1;,
+            uint8_t ebi6:1;,
+            uint8_t ebi5:1;,
+            uint8_t ebi4:1;,
+            uint8_t ebi3:1;,
+            uint8_t ebi2:1;,
+            uint8_t ebi1:1;,
+            uint8_t ebi0:1;)
+        ED8(uint8_t ebi15:1;,
+            uint8_t ebi14:1;,
+            uint8_t ebi13:1;,
+            uint8_t ebi12:1;,
+            uint8_t ebi11:1;,
+            uint8_t ebi10:1;,
+            uint8_t ebi9:1;,
+            uint8_t ebi8:1;)
+        };
+        uint16_t value;
+    };
 } __attribute__ ((packed)) ogs_nas_eps_bearer_context_status_t;
 
 typedef struct ogs_nas_mobile_identity_imeisv_s {
@@ -703,7 +708,7 @@
  * O TLV 5-50 */
 #define OGS_NAS_MAX_EMERGENCY_NUMBER_LIST_LEN 48
 typedef struct ogs_nas_emergency_number_list_s {
-    uint16_t length;
+    uint8_t length;
     uint8_t bufferOGS_NAS_MAX_EMERGENCY_NUMBER_LIST_LEN;
 } __attribute__ ((packed)) ogs_nas_emergency_number_list_t;

open5gs_2.7.6.tar.xz/lib/nas/eps/encoder.c -> open5gs_2.7.7.tar.xz/lib/nas/eps/encoder.c Changed

open5gs_2.7.6.tar.xz/lib/nas/eps/support/nas-message.py -> open5gs_2.7.7.tar.xz/lib/nas/eps/support/nas-message.py Changed

open5gs_2.7.6.tar.xz/lib/nas/eps/types.h -> open5gs_2.7.7.tar.xz/lib/nas/eps/types.h Changed

@@ -291,17 +291,19 @@
 } __attribute__ ((packed)) ogs_nas_eps_attach_result_t;
 
 /* 9.9.3.11 EPS attach type
- * M V 1/2
- * 9.9.3.21 NAS key set identifier
+ * M V 1/2  */
+#define OGS_NAS_ATTACH_TYPE_EPS_ATTACH 1
+#define OGS_NAS_ATTACH_TYPE_COMBINED_EPS_IMSI_ATTACH 2
+#define OGS_NAS_ATTACH_TYPE_EPS_RLOS_ATTACH 3
+#define OGS_NAS_ATTACH_TYPE_EPS_EMERGENCY_ATTACH 6
+#define OGS_NAS_ATTACH_TYPE_RESERVED 7
+
+ /* 9.9.3.21 NAS key set identifier
  * M V 1/2 */
 #define OGS_NAS_KEY_SET_IDENTIFIER_NATIVE 0
 #define OGS_NAS_KEY_SET_IDENTIFIER_MAPPED 1
 #define OGS_NAS_KEY_SET_IDENTIFIER_NOT_AVAILABLE 0x111
 
-#define OGS_NAS_ATTACH_TYPE_EPS_ATTACH 1
-#define OGS_NAS_ATTACH_TYPE_COMBINED_EPS_IMSI_ATTACH 2
-#define OGS_NAS_ATTACH_TYPE_EPS_EMERGENCY_ATTACH 3
-#define OGS_NAS_ATTACH_TYPE_RESERVED 4
 typedef struct ogs_nas_eps_attach_type_s {
 ED4(uint8_t tsc:1;,
     uint8_t nas_key_set_identifier:3;,
@@ -604,6 +606,22 @@
     uint8_t update_needed:1;)
 } __attribute__ ((packed)) ogs_nas_ue_radio_capability_information_update_needed_t;
 
+/* 9.9.3.37 Emergency Number List
+ * See subclause 10.5.3.13 and 10.5.4.33 in 3GPP TS 24.008 13. */
+#define OGS_NAS_SERVICE_CATEGORY_POLICE                 0x01
+#define OGS_NAS_SERVICE_CATEGORY_AMBULANCE              0x02
+#define OGS_NAS_SERVICE_CATEGORY_FIRE_BRIGADE           0x04
+#define OGS_NAS_SERVICE_CATEGORY_MARINE_GUARD           0x08
+#define OGS_NAS_SERVICE_CATEGORY_MOUNTAIN_RESCUE        0x10
+#define OGS_NAS_SERVICE_CATEGORY_MANUAL_ECALL           0x20
+#define OGS_NAS_SERVICE_CATEGORY_AUTOMATICALLY_ECALL    0x40
+typedef struct ogs_nas_emergency_number_item_s {
+    uint8_t length;
+ED2(uint8_t spare:3;,
+    uint8_t service_category:5;)
+    uint8_t digits0;
+} __attribute__ ((packed)) ogs_nas_emergency_number_item_t;
+
 /* 9.9.3.38 CLI
  * O TLV 3-14
  * The coding of the CLI value part is the same as for

open5gs_2.7.6.tar.xz/lib/pfcp/build.c -> open5gs_2.7.7.tar.xz/lib/pfcp/build.c Changed

@@ -781,20 +781,20 @@
 }
 
 void ogs_pfcp_build_update_urr(
-    ogs_pfcp_tlv_update_urr_t *message, int i, ogs_pfcp_urr_t *urr, uint64_t modify_flags)
+    ogs_pfcp_tlv_update_urr_t *message, int i,
+    ogs_pfcp_urr_t *urr, uint64_t modify_flags)
 {
     ogs_assert(message);
     ogs_assert(urr);
 
-    /* No change requested, skip. */
-    if (!(modify_flags & (OGS_PFCP_MODIFY_URR_MEAS_METHOD|
-                          OGS_PFCP_MODIFY_URR_REPORT_TRIGGER|
-                          OGS_PFCP_MODIFY_URR_VOLUME_THRESH|
-                          OGS_PFCP_MODIFY_URR_VOLUME_QUOTA|
-                          OGS_PFCP_MODIFY_URR_TIME_THRESH|
-                          OGS_PFCP_MODIFY_URR_TIME_QUOTA|
-                          OGS_PFCP_MODIFY_URR_QUOTA_VALIDITY_TIME)))
-        return;
+    ogs_assert(modify_flags &
+            (OGS_PFCP_MODIFY_URR_MEAS_METHOD|
+             OGS_PFCP_MODIFY_URR_REPORT_TRIGGER|
+             OGS_PFCP_MODIFY_URR_VOLUME_THRESH|
+             OGS_PFCP_MODIFY_URR_VOLUME_QUOTA|
+             OGS_PFCP_MODIFY_URR_TIME_THRESH|
+             OGS_PFCP_MODIFY_URR_TIME_QUOTA|
+             OGS_PFCP_MODIFY_URR_QUOTA_VALIDITY_TIME));
 
     /* Change request: Send only changed IEs */
     message->presence = 1;
@@ -891,26 +891,35 @@
 }
 
 void ogs_pfcp_build_update_qer(
-    ogs_pfcp_tlv_update_qer_t *message, int i, ogs_pfcp_qer_t *qer)
+    ogs_pfcp_tlv_update_qer_t *message, int i,
+    ogs_pfcp_qer_t *qer, uint64_t modify_flags)
 {
     ogs_assert(message);
     ogs_assert(qer);
 
+    ogs_assert(modify_flags &
+            (OGS_PFCP_MODIFY_QOS_MODIFY|
+             OGS_PFCP_MODIFY_EPC_QOS_UPDATE));
+
     message->presence = 1;
     message->qer_id.presence = 1;
     message->qer_id.u32 = qer->id;
 
-    if (qer->mbr.uplink || qer->mbr.downlink) {
-        message->maximum_bitrate.presence = 1;
-        ogs_pfcp_build_bitrate(
-                &message->maximum_bitrate,
-                &qer->mbr, update_qer_bufi.mbr, OGS_PFCP_BITRATE_LEN);
-    }
-    if (qer->gbr.uplink || qer->gbr.downlink) {
-        message->guaranteed_bitrate.presence = 1;
-        ogs_pfcp_build_bitrate(
-                &message->guaranteed_bitrate,
-                &qer->gbr, update_qer_bufi.gbr, OGS_PFCP_BITRATE_LEN);
+    if (modify_flags &
+            (OGS_PFCP_MODIFY_QOS_MODIFY|
+             OGS_PFCP_MODIFY_EPC_QOS_UPDATE)) {
+        if (qer->mbr.uplink || qer->mbr.downlink) {
+            message->maximum_bitrate.presence = 1;
+            ogs_pfcp_build_bitrate(
+                    &message->maximum_bitrate,
+                    &qer->mbr, update_qer_bufi.mbr, OGS_PFCP_BITRATE_LEN);
+        }
+        if (qer->gbr.uplink || qer->gbr.downlink) {
+            message->guaranteed_bitrate.presence = 1;
+            ogs_pfcp_build_bitrate(
+                    &message->guaranteed_bitrate,
+                    &qer->gbr, update_qer_bufi.gbr, OGS_PFCP_BITRATE_LEN);
+        }
     }
 }

open5gs_2.7.6.tar.xz/lib/pfcp/build.h -> open5gs_2.7.7.tar.xz/lib/pfcp/build.h Changed

open5gs_2.7.6.tar.xz/lib/pfcp/context.c -> open5gs_2.7.7.tar.xz/lib/pfcp/context.c Changed

@@ -1349,7 +1349,10 @@
     pdr = ogs_pfcp_pdr_find(sess, id);
     if (!pdr) {
         pdr = ogs_pfcp_pdr_add(sess);
-        ogs_assert(pdr);
+        if (!pdr) {
+            ogs_error("ogs_pfcp_pdr_add() failed");
+            return NULL;
+        }
         pdr->id = id;
     }
 
@@ -1399,7 +1402,7 @@
     return OGS_PFCP_CAUSE_REQUEST_ACCEPTED;
 }
 
-void ogs_pfcp_object_teid_hash_set(
+uint8_t ogs_pfcp_object_teid_hash_set(
         ogs_pfcp_object_type_e type, ogs_pfcp_pdr_t *pdr,
         bool restoration_indication)
 {
@@ -1429,12 +1432,20 @@
                     &ogs_gtp_self()->gtpu_resource_list,
                     pdr->dnn, pdr->src_if);
             if (resource) {
-                ogs_assert(
-                    (resource->info.v4 && pdr->f_teid.ipv4) ||
-                    (resource->info.v6 && pdr->f_teid.ipv6));
-                ogs_assert(OGS_OK ==
-                    ogs_pfcp_user_plane_ip_resource_info_to_f_teid(
-                    &resource->info, &pdr->f_teid, &pdr->f_teid_len));
+                if (!((resource->info.v4 && pdr->f_teid.ipv4) ||
+                      (resource->info.v6 && pdr->f_teid.ipv6))) {
+                    ogs_error("CH F-TEID address family mismatch: "
+                            "resourcev4:%d v6:%d fteidv4:%d v6:%d",
+                            resource->info.v4, resource->info.v6,
+                            pdr->f_teid.ipv4, pdr->f_teid.ipv6);
+                    return OGS_PFCP_CAUSE_REQUEST_REJECTED;
+                }
+                if (OGS_OK != ogs_pfcp_user_plane_ip_resource_info_to_f_teid(
+                        &resource->info, &pdr->f_teid, &pdr->f_teid_len)) {
+                    ogs_error("user_plane_ip_resource_info_to_f_teid() "
+                            "failed in CH path");
+                    return OGS_PFCP_CAUSE_REQUEST_REJECTED;
+                }
                 if (resource->info.teidri)
                     pdr->f_teid.teid = OGS_PFCP_GTPU_INDEX_TO_TEID(
                             pdr->teid, resource->info.teidri,
@@ -1442,16 +1453,26 @@
                 else
                     pdr->f_teid.teid = pdr->teid;
             } else {
-                ogs_assert(
-                    (ogs_gtp_self()->gtpu_addr && pdr->f_teid.ipv4) ||
-                    (ogs_gtp_self()->gtpu_addr6 && pdr->f_teid.ipv6));
-                ogs_assert(OGS_OK ==
-                    ogs_pfcp_sockaddr_to_f_teid(
+                if (!((ogs_gtp_self()->gtpu_addr && pdr->f_teid.ipv4) ||
+                    (ogs_gtp_self()->gtpu_addr6 && pdr->f_teid.ipv6))) {
+                    ogs_error("CH F-TEID address family mismatch with local "
+                            "GTP-U address: gtpuv4:%p v6:%p "
+                            "fteidv4:%d v6:%d",
+                            ogs_gtp_self()->gtpu_addr,
+                            ogs_gtp_self()->gtpu_addr6,
+                            pdr->f_teid.ipv4, pdr->f_teid.ipv6);
+                    return OGS_PFCP_CAUSE_REQUEST_REJECTED;
+                }
+                if (OGS_OK != ogs_pfcp_sockaddr_to_f_teid(
                         pdr->f_teid.ipv4 ?
                             ogs_gtp_self()->gtpu_addr : NULL,
                         pdr->f_teid.ipv6 ?
                             ogs_gtp_self()->gtpu_addr6 : NULL,
-                        &pdr->f_teid, &pdr->f_teid_len));
+                        &pdr->f_teid, &pdr->f_teid_len)) {
+                    ogs_error("ogs_pfcp_sockaddr_to_f_teid() "
+                            "failed in CH path");
+                    return OGS_PFCP_CAUSE_REQUEST_REJECTED;
+                }
                 pdr->f_teid.teid = pdr->teid;
             }
         }
@@ -1478,6 +1499,8 @@
         ogs_fatal("Unknown type %d", type);
         ogs_assert_if_reached();
     }
+
+    return OGS_PFCP_CAUSE_REQUEST_ACCEPTED;
 }
 
 ogs_pfcp_object_t *ogs_pfcp_object_find_by_teid(uint32_t teid)
@@ -1677,7 +1700,10 @@
     far = ogs_pfcp_far_find(sess, id);
     if (!far) {
         far = ogs_pfcp_far_add(sess);
-        ogs_assert(far);
+        if (!far) {
+            ogs_error("ogs_pfcp_far_add() failed");
+            return NULL;
+        }
         far->id = id;
     }
 
@@ -1884,8 +1910,8 @@
     if (far->dnn)
         ogs_free(far->dnn);
 
-    for (i = 0; i < far->num_of_buffered_packet; i++)
-        ogs_pkbuf_free(far->buffered_packeti);
+    for (i = 0; i < far->num_of_buffered_gtpu; i++)
+        ogs_pkbuf_free(far->buffered_gtpui);
 
     if (far->id_node)
         ogs_pool_free(&far->sess->far_id_pool, far->id_node);
@@ -1955,7 +1981,10 @@
     urr = ogs_pfcp_urr_find(sess, id);
     if (!urr) {
         urr = ogs_pfcp_urr_add(sess);
-        ogs_assert(urr);
+        if (!urr) {
+            ogs_error("ogs_pfcp_urr_add() failed");
+            return NULL;
+        }
         urr->id = id;
     }
 
@@ -2040,7 +2069,10 @@
     qer = ogs_pfcp_qer_find(sess, id);
     if (!qer) {
         qer = ogs_pfcp_qer_add(sess);
-        ogs_assert(qer);
+        if (!qer) {
+            ogs_error("ogs_pfcp_qer_add() failed");
+            return NULL;
+        }
         qer->id = id;
     }

open5gs_2.7.6.tar.xz/lib/pfcp/context.h -> open5gs_2.7.7.tar.xz/lib/pfcp/context.h Changed

open5gs_2.7.6.tar.xz/lib/pfcp/handler.c -> open5gs_2.7.7.tar.xz/lib/pfcp/handler.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -216,11 +216,13 @@
 }
 
 bool ogs_pfcp_up_handle_pdr(
-        ogs_pfcp_pdr_t *pdr, uint8_t type,
+        ogs_pfcp_pdr_t *pdr, uint8_t type, int len,
         ogs_gtp2_header_desc_t *recvhdr, ogs_pkbuf_t *sendbuf,
         ogs_pfcp_user_plane_report_t *report)
 {
     ogs_pfcp_far_t *far = NULL;
+
+    ogs_gtp2_header_desc_t sendhdr;
     bool buffering;
 
     ogs_assert(sendbuf);
@@ -231,36 +233,142 @@
     far = pdr->far;
     ogs_assert(far);
 
+    buffering = false;
+
     memset(report, 0, sizeof(*report));
 
-    buffering = false;
+    if ((pdr->src_if == OGS_PFCP_INTERFACE_CORE &&
+         pdr->src_if_type_presence == true &&
+         pdr->src_if_type ==
+             OGS_PFCP_3GPP_INTERFACE_TYPE_N9_FOR_ROAMING) ||
+        (far->dst_if == OGS_PFCP_INTERFACE_CORE &&
+         far->dst_if_type_presence == true &&
+         far->dst_if_type ==
+             OGS_PFCP_3GPP_INTERFACE_TYPE_N9_FOR_ROAMING)) {
+    /*
+     * <Home Routed Roaming>
+     * - VPLMN
+     * o DL
+     *  PDR->src : Core/N9-for-roaming
+     *  FAT->dst : Access/N3
+     * o UL
+     *  PDR->src : Access/N3
+     *  FAT->dst : Core/N9-for-roaming
+     * - HPLMN
+     * o DL
+     *  PDR->src : Core/N6
+     *  FAT->dst : Access/N9-for-roaming
+     * o UL
+     *  PDR->src : Access/N9-for-roaming
+     *  FAT->dst : Core/N6
+     */
+
+    /*
+     * For Home Routed Roaming, when the UPF is located in the VPLMN,
+     * only the TEID in the GTP header is modified. Since the TEID
+     * can only exist in the Outer Header Creator during the Activation
+     * process, it is not filled in at this stage.
+     *
+     * The TEID might be determined later due to buffering, so it is
+     * filled in during the GPDU transmission stage.
+     */
+        ogs_pkbuf_push(sendbuf, len);
+
+    } else {
+    /*
+     * <Normal>
+     * o DL
+     *  PDR->src : Core/N6
+     *  FAT->dst : Access/N3
+     * o UL
+     *  PDR->src : Access/N3
+     *  FAT->dst : Core/N6
+     * o CP2UP
+     *  PDR->src : CP-function
+     *  FAT->dst : Access/N3
+     * o UP2CP
+     *  PDR->src : Access/N3
+     *  FAT->dst : CP-function
+     *
+     * <Indirect>
+     *  PDR->src : Access/UL-Forwarding
+     *  FAT->dst : Access/DL-Forwarding
+     */
+        memset(&sendhdr, 0, sizeof(sendhdr));
+
+        sendhdr.type = type;
+        sendhdr.teid = far->outer_header_creation.teid;
+
+        if (pdr->qer && pdr->qer->qfi) {
+            sendhdr.pdu_type =
+                OGS_GTP2_EXTENSION_HEADER_PDU_TYPE_DL_PDU_SESSION_INFORMATION;
+            sendhdr.qos_flow_identifier = pdr->qer->qfi;
+        } else if (pdr->src_if == OGS_PFCP_INTERFACE_ACCESS &&
+                far->dst_if == OGS_PFCP_INTERFACE_ACCESS &&
+                recvhdr->qos_flow_identifier) {
+/*
+ * HR Indirect Forwarding (source gNB -> V-UPF -> target gNB)
+ *
+ * Context:
+ * - Home-Routed roaming: the V-UPF is controlled by the V-SMF, which
+ *   typically does not provision QER/QFI for the indirect path.
+ * - During Xn/N2 handover the source gNB may forward remaining DL data
+ *   to the core using UL PDU Session Information (PSC PDU type = UL).
+ *
+ * Goal:
+ * - Preserve the PDU Session Container across the V-UPF hop and deliver
+ *   it to the target gNB with PDU type = DL while keeping the same QFI.
+ *
+ * What we do here:
+ * - If this PDR has no QER/QFI and the path is Access->Access, derive
+ *   PSC fields from the received header (recvhdr).
+ * - Force sendhdr.pdu_type = DL PDU Session Information.
+ * - Copy recvhdr->qos_flow_identifier into sendhdr.qos_flow_identifier.
+ * - The encapsulation routine will build a fresh GTP-U header and
+ *   generate the PSC extension from sendhdr fields. This converts UL
+ *   PSC to DL PSC and preserves the QFI for the target gNB.
+ *
+ * Why this is needed in HR:
+ * - With OHR+OHC, the incoming GTP-U (extensions included) is removed
+ *   and a new one is created. Without recreating PSC from sendhdr.*, the
+ *   extension header would be lost when QER is absent on the V-UPF.
+ */
+            sendhdr.pdu_type =
+                OGS_GTP2_EXTENSION_HEADER_PDU_TYPE_DL_PDU_SESSION_INFORMATION;
+            sendhdr.qos_flow_identifier = recvhdr->qos_flow_identifier;
+        }
+
+        if (recvhdr) {
+            /*
+             * Issue #2584
+             * Discussion #2477
+             *
+             * Forward PDCP Number via Indirect Tunnel during Handover
+             */
+            if (recvhdr->pdcp_number_presence == true) {
+                sendhdr.pdcp_number_presence = recvhdr->pdcp_number_presence;
+                sendhdr.pdcp_number = recvhdr->pdcp_number;
+            }
+
+            if (recvhdr->udp.presence == true) {
+                sendhdr.udp.presence = recvhdr->udp.presence;
+                sendhdr.udp.port = recvhdr->udp.port;
+            }
+        }
+
+        ogs_gtp2_encapsulate_header(&sendhdr, sendbuf);
+
+        ogs_trace("ENCAP GTP-U%d, TEID0x%x", sendhdr.type, sendhdr.teid);
+    }
 
     if (!far->gnode) {
+
         buffering = true;
 
     } else {
         if (far->apply_action & OGS_PFCP_APPLY_ACTION_FORW) {
-            ogs_gtp2_header_desc_t sendhdr;
 
-            /* Forward packet */
-            memset(&sendhdr, 0, sizeof(sendhdr));
-            sendhdr.type = type;
-
-            if (recvhdr) {
-                /*
-                 * Issue #2584
-                 * Discussion #2477
-                 *
-                 * Forward PDCP Number via Indirect Tunnel during Handover
-                 */
-                if (recvhdr->pdcp_number_presence == true) {
-                    sendhdr.pdcp_number_presence =
-                        recvhdr->pdcp_number_presence;
-                    sendhdr.pdcp_number = recvhdr->pdcp_number;
-                }
-            }
-
-            ogs_pfcp_send_g_pdu(pdr, &sendhdr, sendbuf);
+            ogs_pfcp_send_gtpu(pdr, sendbuf);
 
         } else if (far->apply_action & OGS_PFCP_APPLY_ACTION_BUFF) {
 
@@ -274,14 +382,14 @@
 
     if (buffering == true) {
 
-        if (far->num_of_buffered_packet == 0) {
+        if (far->num_of_buffered_gtpu == 0) {
             /* Only the first time a packet is buffered,
              * it reports downlink notifications. */
             report->type.downlink_data_report = 1;
         }
 
-        if (far->num_of_buffered_packet < OGS_MAX_NUM_OF_PACKET_BUFFER) {
-            far->buffered_packetfar->num_of_buffered_packet++ = sendbuf;
+        if (far->num_of_buffered_gtpu < OGS_MAX_NUM_OF_GTPU_BUFFER) {
+            far->buffered_gtpufar->num_of_buffered_gtpu++ = sendbuf;
         } else {
             ogs_pkbuf_free(sendbuf);
         }
@@ -353,12 +461,11 @@
         return NULL;
     }
 
-    pdr = ogs_pfcp_pdr_find_or_add(sess, message->pdr_id.u16);
-    ogs_assert(pdr);
-
-    if (message->precedence.presence) {
-        ogs_pfcp_pdr_reorder_by_precedence(pdr, message->precedence.u32);
-        pdr->precedence = message->precedence.u32;
+    if (message->far_id.presence == 0) {
+        ogs_error("No FAR-ID");
+        *cause_value = OGS_PFCP_CAUSE_MANDATORY_IE_MISSING;
+        *offending_ie_value = OGS_PFCP_FAR_ID_TYPE;
+        return NULL;
     }
 
     if (message->pdi.presence == 0) {
@@ -401,6 +508,33 @@
         }
     }
 
+    for (i = 0; i < OGS_ARRAY_SIZE(message->urr_id); i++) {
+        if (message->urr_idi.presence) {
+            if (!(message->urr_idi.u32 > 0 &&
+                    message->urr_idi.u32 <= OGS_MAX_NUM_OF_URR)) {
+                ogs_error("Invalid URR-ID %u (valid range: 1..%d) "
+                        "in PFCP message",
+                        message->urr_idi.u32, OGS_MAX_NUM_OF_URR);
+                *cause_value = OGS_PFCP_CAUSE_NO_RESOURCES_AVAILABLE;
+                *offending_ie_value = OGS_PFCP_URR_ID_TYPE;
+                return NULL;
+            }
+        }
+    }
+
+    pdr = ogs_pfcp_pdr_find_or_add(sess, message->pdr_id.u16);
+    if (!pdr) {
+        ogs_error("ogs_pfcp_pdr_find_or_add() failed");
+        *cause_value = OGS_PFCP_CAUSE_NO_RESOURCES_AVAILABLE;
+        *offending_ie_value = OGS_PFCP_PDR_ID_TYPE;
+        return NULL;
+    }
+
+    if (message->precedence.presence) {
+        ogs_pfcp_pdr_reorder_by_precedence(pdr, message->precedence.u32);
+        pdr->precedence = message->precedence.u32;
+    }
+
     pdr->src_if = message->pdi.source_interface.u8;
 
     if (message->pdi.source_interface_type.presence) {
@@ -469,7 +603,14 @@
                     sdf_filter.flow_description_len+1);
 
             rv = ogs_ipfw_compile_rule(&rule->ipfw, flow_description);
-            ogs_assert(rv == OGS_OK);
+
+            if (rv != OGS_OK) {
+                ogs_error("ogs_ipfw_compile_rule() failed %s",
+                        flow_description);
+                ogs_free(flow_description);
+                ogs_pfcp_rule_remove(rule);
+                continue;
+            }
 
             ogs_free(flow_description);
 /*
@@ -522,7 +663,11 @@
             pdr->dnn = ogs_strdup(dnn);
             ogs_assert(pdr->dnn);
         } else {
-            ogs_error("Invalid pdi.network_instance");
+            ogs_error("Invalid pdi.network_instance %d",
+                    message->pdi.network_instance.len);
+            ogs_log_hexdump(OGS_LOG_ERROR,
+                    message->pdi.network_instance.data,
+                    message->pdi.network_instance.len);
         }
     }
 
@@ -533,10 +678,23 @@
     pdr->f_teid_len = 0;
 
     if (message->pdi.local_f_teid.presence) {
+        if (!message->pdi.local_f_teid.len) {
+            ogs_error("No F-TEID LEN");
+            *cause_value = OGS_PFCP_CAUSE_INVALID_LENGTH;
+            *offending_ie_value = OGS_PFCP_F_TEID_TYPE;
+            return NULL;
+        }
         pdr->f_teid_len =
             ogs_min(message->pdi.local_f_teid.len, sizeof(pdr->f_teid));
         memcpy(&pdr->f_teid, message->pdi.local_f_teid.data, pdr->f_teid_len);
-        ogs_assert(pdr->f_teid.ipv4 || pdr->f_teid.ipv6);
+
+        if (!pdr->f_teid.ipv4 && !pdr->f_teid.ipv6) {
+            ogs_error("Invalid F-TEID ");
+            *cause_value = OGS_PFCP_CAUSE_INVALID_F_TEID_ALLOCATION_OPTION;
+            *offending_ie_value = OGS_PFCP_F_TEID_TYPE;
+            return NULL;
+        }
+
         pdr->f_teid.teid = be32toh(pdr->f_teid.teid);
     }
 
@@ -623,7 +781,12 @@
 
     if (message->far_id.presence) {
         far = ogs_pfcp_far_find_or_add(sess, message->far_id.u32);
-        ogs_assert(far);
+        if (!far) {
+            ogs_error("ogs_pfcp_far_find_or_add() failed");
+            *cause_value = OGS_PFCP_CAUSE_NO_RESOURCES_AVAILABLE;
+            *offending_ie_value = OGS_PFCP_FAR_ID_TYPE;
+            return NULL;
+        }
         ogs_pfcp_pdr_associate_far(pdr, far);
     }
 
@@ -633,7 +796,12 @@
     for (i = 0; i < OGS_ARRAY_SIZE(message->urr_id); i++) {
         if (message->urr_idi.presence) {
             urr = ogs_pfcp_urr_find_or_add(sess, message->urr_idi.u32);
-            ogs_assert(urr);
+            if (!urr) {
+                ogs_error("ogs_pfcp_urr_find_or_add() failed");
+                *cause_value = OGS_PFCP_CAUSE_NO_RESOURCES_AVAILABLE;
+                *offending_ie_value = OGS_PFCP_URR_ID_TYPE;
+                return NULL;
+            }
             ogs_pfcp_pdr_associate_urr(pdr,urr);
         }
     }
@@ -642,7 +810,12 @@
 
     if (message->qer_id.presence) {
         qer = ogs_pfcp_qer_find_or_add(sess, message->qer_id.u32);
-        ogs_assert(qer);
+        if (!qer) {
+            ogs_error("ogs_pfcp_qer_find_or_add() failed");
+            *cause_value = OGS_PFCP_CAUSE_NO_RESOURCES_AVAILABLE;
+            *offending_ie_value = OGS_PFCP_QER_ID_TYPE;
+            return NULL;
+        }
         ogs_pfcp_pdr_associate_qer(pdr, qer);
     }
 
@@ -820,7 +993,13 @@
                         sdf_filter.flow_description_len+1);
 
                 rv = ogs_ipfw_compile_rule(&rule->ipfw, flow_description);
-                ogs_assert(rv == OGS_OK);
+                if (rv != OGS_OK) {
+                    ogs_error("ogs_ipfw_compile_rule() failed %s",
+                            flow_description);
+                    ogs_free(flow_description);
+                    ogs_pfcp_rule_remove(rule);
+                    continue;
+                }
 
                 ogs_free(flow_description);
     /*
@@ -871,7 +1050,11 @@
                 pdr->dnn = ogs_strdup(dnn);
                 ogs_assert(pdr->dnn);
             } else {
-                ogs_error("Invalid pdi.network_instance");
+                ogs_error("Invalid pdi.network_instance %d",
+                        message->pdi.network_instance.len);
+                ogs_log_hexdump(OGS_LOG_ERROR,
+                        message->pdi.network_instance.data,
+                        message->pdi.network_instance.len);
             }
         }
 
@@ -887,6 +1070,14 @@
         }
     }
 
+    if (message->outer_header_removal.presence) {
+        pdr->outer_header_removal_len =
+            ogs_min(message->outer_header_removal.len,
+                    sizeof(pdr->outer_header_removal));
+        memcpy(&pdr->outer_header_removal, message->outer_header_removal.data,
+                pdr->outer_header_removal_len);
+    }
+
     return pdr;
 }
 
@@ -911,9 +1102,9 @@
 
     pdr = ogs_pfcp_pdr_find(sess, message->pdr_id.u16);
     if (!pdr) {
-        ogs_error("Unknown PDR-ID%d", message->pdr_id.u16);
-        *cause_value = OGS_PFCP_CAUSE_SESSION_CONTEXT_NOT_FOUND;
-        return false;
+        ogs_warn("Unknown PDR-ID%d in Remove PDR (already removed?)",
+                message->pdr_id.u16);
+        return true;
     }
 
     ogs_pfcp_pdr_remove(pdr);
@@ -940,10 +1131,10 @@
         return NULL;
     }
 
-    far = ogs_pfcp_far_find(sess, message->far_id.u32);
+    far = ogs_pfcp_far_find_or_add(sess, message->far_id.u32);
     if (!far) {
-        ogs_error("Cannot find FAR-ID%d in PDR", message->far_id.u32);
-        *cause_value = OGS_PFCP_CAUSE_MANDATORY_IE_INCORRECT;
+        ogs_error("Cannot allocate FAR-ID%d", message->far_id.u32);
+        *cause_value = OGS_PFCP_CAUSE_NO_RESOURCES_AVAILABLE;
         *offending_ie_value = OGS_PFCP_FAR_ID_TYPE;
         return NULL;
     }
@@ -958,7 +1149,9 @@
     far->apply_action = message->apply_action.u16;
 
     far->dst_if = 0;
+    far->dst_if_type_presence = false;
     memset(&far->outer_header_creation, 0, sizeof(far->outer_header_creation));
+    far->outer_header_creation_len = 0;
 
     if (far->dnn) {
         ogs_free(far->dnn);
@@ -1149,9 +1342,9 @@
 
     far = ogs_pfcp_far_find(sess, message->far_id.u32);
     if (!far) {
-        ogs_error("Unknown FAR-ID%d", message->far_id.u32);
-        *cause_value = OGS_PFCP_CAUSE_SESSION_CONTEXT_NOT_FOUND;
-        return false;
+        ogs_warn("Unknown FAR-ID%d in Remove FAR (already removed?)",
+                message->far_id.u32);
+        return true;
     }
 
     ogs_pfcp_far_remove(far);
@@ -1163,6 +1356,7 @@
         ogs_pfcp_tlv_create_qer_t *message,
         uint8_t *cause_value, uint8_t *offending_ie_value)
 {
+    int rv;
     ogs_pfcp_qer_t *qer = NULL;
 
     ogs_assert(message);
@@ -1178,10 +1372,10 @@
         return NULL;
     }
 
-    qer = ogs_pfcp_qer_find(sess, message->qer_id.u32);
+    qer = ogs_pfcp_qer_find_or_add(sess, message->qer_id.u32);
     if (!qer) {
-        ogs_error("Cannot find QER-ID%d in PDR", message->qer_id.u32);
-        *cause_value = OGS_PFCP_CAUSE_MANDATORY_IE_INCORRECT;
+        ogs_error("Cannot allocate QER-ID%d", message->qer_id.u32);
+        *cause_value = OGS_PFCP_CAUSE_NO_RESOURCES_AVAILABLE;
         *offending_ie_value = OGS_PFCP_QER_ID_TYPE;
         return NULL;
     }
@@ -1198,10 +1392,25 @@
     memset(&qer->mbr, 0, sizeof(qer->mbr));
     memset(&qer->gbr, 0, sizeof(qer->gbr));
 
-    if (message->maximum_bitrate.presence)
-        ogs_pfcp_parse_bitrate(&qer->mbr, &message->maximum_bitrate);
-    if (message->guaranteed_bitrate.presence)
-        ogs_pfcp_parse_bitrate(&qer->gbr, &message->guaranteed_bitrate);
+    if (message->maximum_bitrate.presence) {
+        rv = ogs_pfcp_parse_bitrate(&qer->mbr, &message->maximum_bitrate);
+        if (rv != OGS_PFCP_BITRATE_LEN) {
+            ogs_error("MBR: ogs_pfcp_parse_bitrate() failed");
+            *cause_value = OGS_PFCP_CAUSE_INVALID_LENGTH;
+            *offending_ie_value = OGS_PFCP_MBR_TYPE;
+            return NULL;
+        }
+    }
+
+    if (message->guaranteed_bitrate.presence) {
+        rv = ogs_pfcp_parse_bitrate(&qer->gbr, &message->guaranteed_bitrate);
+        if (rv != OGS_PFCP_BITRATE_LEN) {
+            ogs_error("GBR: ogs_pfcp_parse_bitrate() failed");
+            *cause_value = OGS_PFCP_CAUSE_INVALID_LENGTH;
+            *offending_ie_value = OGS_PFCP_GBR_TYPE;
+            return NULL;
+        }
+    }
 
     qer->qfi = 0;
 
@@ -1215,6 +1424,7 @@
         ogs_pfcp_tlv_update_qer_t *message,
         uint8_t *cause_value, uint8_t *offending_ie_value)
 {
+    int rv;
     ogs_pfcp_qer_t *qer = NULL;
 
     ogs_assert(message);
@@ -1238,10 +1448,24 @@
         return NULL;
     }
 
-    if (message->maximum_bitrate.presence)
-        ogs_pfcp_parse_bitrate(&qer->mbr, &message->maximum_bitrate);
-    if (message->guaranteed_bitrate.presence)
-        ogs_pfcp_parse_bitrate(&qer->gbr, &message->guaranteed_bitrate);
+    if (message->maximum_bitrate.presence) {
+        rv = ogs_pfcp_parse_bitrate(&qer->mbr, &message->maximum_bitrate);
+        if (rv != OGS_PFCP_BITRATE_LEN) {
+            ogs_error("MBR: ogs_pfcp_parse_bitrate() failed");
+            *cause_value = OGS_PFCP_CAUSE_INVALID_LENGTH;
+            *offending_ie_value = OGS_PFCP_MBR_TYPE;
+            return NULL;
+        }
+    }
+    if (message->guaranteed_bitrate.presence) {
+        rv = ogs_pfcp_parse_bitrate(&qer->gbr, &message->guaranteed_bitrate);
+        if (rv != OGS_PFCP_BITRATE_LEN) {
+            ogs_error("GBR: ogs_pfcp_parse_bitrate() failed");
+            *cause_value = OGS_PFCP_CAUSE_INVALID_LENGTH;
+            *offending_ie_value = OGS_PFCP_GBR_TYPE;
+            return NULL;
+        }
+    }
 
     return qer;
 }
@@ -1267,9 +1491,9 @@
 
     qer = ogs_pfcp_qer_find(sess, message->qer_id.u32);
     if (!qer) {
-        ogs_error("Unknown QER-ID%d", message->qer_id.u32);
-        *cause_value = OGS_PFCP_CAUSE_SESSION_CONTEXT_NOT_FOUND;
-        return false;
+        ogs_warn("Unknown QER-ID%d in Remove QER (already removed?)",
+                message->qer_id.u32);
+        return true;
     }
 
     ogs_pfcp_qer_remove(qer);
@@ -1352,10 +1576,10 @@
         return NULL;
     }
 
-    urr = ogs_pfcp_urr_find(sess, message->urr_id.u32);
+    urr = ogs_pfcp_urr_find_or_add(sess, message->urr_id.u32);
     if (!urr) {
-        ogs_error("Cannot find URR-ID%d in PDR", message->urr_id.u32);
-        *cause_value = OGS_PFCP_CAUSE_MANDATORY_IE_INCORRECT;
+        ogs_error("Cannot allocate URR-ID%d", message->urr_id.u32);
+        *cause_value = OGS_PFCP_CAUSE_NO_RESOURCES_AVAILABLE;
         *offending_ie_value = OGS_PFCP_URR_ID_TYPE;
         return NULL;
     }
@@ -1379,6 +1603,21 @@
     urr->rep_triggers.reptri_6 = (message->reporting_triggers.u24 >> 8) & 0xFF;
     urr->rep_triggers.reptri_7 = message->reporting_triggers.u24 & 0xFF;
 
+    /* Clear optional/presence-driven fields to prevent stale state
+     * when find_or_add() returns an already-existing URR */
+    urr->meas_period = 0;
+    memset(&urr->vol_threshold, 0, sizeof(urr->vol_threshold));
+    memset(&urr->vol_quota, 0, sizeof(urr->vol_quota));
+    urr->event_threshold = 0;
+    urr->event_quota = 0;
+    urr->time_threshold = 0;
+    urr->time_quota = 0;
+    urr->quota_holding_time = 0;
+    memset(&urr->dropped_dl_traffic_threshold, 0,
+            sizeof(urr->dropped_dl_traffic_threshold));
+    urr->quota_validity_time = 0;
+    memset(&urr->meas_info, 0, sizeof(urr->meas_info));
+
     if (message->measurement_period.presence) {
         urr->meas_period = message->measurement_period.u32;
     }
@@ -1432,9 +1671,15 @@
     }
 
     if (message->dropped_dl_traffic_threshold.presence) {
-        ogs_pfcp_parse_dropped_dl_traffic_threshold(
+        decoded = ogs_pfcp_parse_dropped_dl_traffic_threshold(
                 &urr->dropped_dl_traffic_threshold,
                 &message->dropped_dl_traffic_threshold);
+        if (message->dropped_dl_traffic_threshold.len != decoded) {
+            ogs_error("Invalid Dropped DL Traffic Threshold");
+            *cause_value = OGS_PFCP_CAUSE_MANDATORY_IE_INCORRECT;
+            *offending_ie_value = OGS_PFCP_DROPPED_DL_TRAFFIC_THRESHOLD_TYPE;
+            return NULL;
+        }
     }
 
     if (message->quota_validity_time.presence) {
@@ -1539,9 +1784,15 @@
     }
 
     if (message->dropped_dl_traffic_threshold.presence) {
-        ogs_pfcp_parse_dropped_dl_traffic_threshold(
+        decoded = ogs_pfcp_parse_dropped_dl_traffic_threshold(
                 &urr->dropped_dl_traffic_threshold,
                 &message->dropped_dl_traffic_threshold);
+        if (message->dropped_dl_traffic_threshold.len != decoded) {
+            ogs_error("Invalid Dropped DL Traffic Threshold");
+            *cause_value = OGS_PFCP_CAUSE_MANDATORY_IE_INCORRECT;
+            *offending_ie_value = OGS_PFCP_DROPPED_DL_TRAFFIC_THRESHOLD_TYPE;
+            return NULL;
+        }
     }
 
     if (message->quota_validity_time.presence) {
@@ -1577,9 +1828,9 @@
 
     urr = ogs_pfcp_urr_find(sess, message->urr_id.u32);
     if (!urr) {
-        ogs_error("Unknown URR-ID%d", message->urr_id.u32);
-        *cause_value = OGS_PFCP_CAUSE_SESSION_CONTEXT_NOT_FOUND;
-        return false;
+        ogs_warn("Unknown URR-ID%d in Remove URR (already removed?)",
+                message->urr_id.u32);
+        return true;
     }
 
     ogs_pfcp_urr_remove(urr);

open5gs_2.7.6.tar.xz/lib/pfcp/handler.h -> open5gs_2.7.7.tar.xz/lib/pfcp/handler.h Changed

open5gs_2.7.6.tar.xz/lib/pfcp/path.c -> open5gs_2.7.7.tar.xz/lib/pfcp/path.c Changed

@@ -395,17 +395,12 @@
     return rv;
 }
 
-void ogs_pfcp_send_g_pdu(
-        ogs_pfcp_pdr_t *pdr,
-        ogs_gtp2_header_desc_t *sendhdr, ogs_pkbuf_t *sendbuf)
+void ogs_pfcp_send_gtpu(ogs_pfcp_pdr_t *pdr, ogs_pkbuf_t *sendbuf)
 {
     ogs_gtp_node_t *gnode = NULL;
     ogs_pfcp_far_t *far = NULL;
 
-    ogs_gtp2_header_desc_t header_desc;
-
     ogs_assert(pdr);
-    ogs_assert(sendhdr);
     ogs_assert(sendbuf);
 
     far = pdr->far;
@@ -422,55 +417,49 @@
     }
 
     gnode = far->gnode;
-    ogs_assert(gnode);
-    ogs_assert(gnode->sock);
+    if (!gnode) {
+        ogs_error("No GTP Node Setup");
+        ogs_pkbuf_free(sendbuf);
+        return;
+    }
+    if (!gnode->sock) {
+        ogs_error("No GTP Socket Setup");
+        ogs_pkbuf_free(sendbuf);
+        return;
+    }
 
-    memset(&header_desc, 0, sizeof(header_desc));
+    ogs_gtp_send_with_teid(
+            gnode->sock,
+            sendbuf, far->outer_header_creation.teid,
+            &gnode->addr);
 
-    header_desc.type = sendhdr->type;
-    header_desc.teid = far->outer_header_creation.teid;
+    ogs_pkbuf_free(sendbuf);
+}
 
-    if (pdr->qer && pdr->qer->qfi) {
-        header_desc.pdu_type =
-            OGS_GTP2_EXTENSION_HEADER_PDU_TYPE_DL_PDU_SESSION_INFORMATION;
-        header_desc.qos_flow_identifier = pdr->qer->qfi;
-    }
+void ogs_pfcp_send_buffered_gtpu(ogs_pfcp_pdr_t *pdr)
+{
+    ogs_pfcp_far_t *far = NULL;
+    int i;
 
-    if (sendhdr->udp.presence == true) {
-        header_desc.udp.presence = sendhdr->udp.presence;
-        header_desc.udp.port = sendhdr->udp.port;
-    }
+    ogs_assert(pdr);
+    far = pdr->far;
 
-    if (sendhdr->pdcp_number_presence == true) {
-        header_desc.pdcp_number_presence = sendhdr->pdcp_number_presence;
-        header_desc.pdcp_number = sendhdr->pdcp_number;
+    if (far && far->gnode) {
+        if (far->apply_action & OGS_PFCP_APPLY_ACTION_FORW) {
+            for (i = 0; i < far->num_of_buffered_gtpu; i++) {
+                ogs_pfcp_send_gtpu(pdr, far->buffered_gtpui);
+            }
+            far->num_of_buffered_gtpu = 0;
+        }
     }
-
-    ogs_gtp2_send_user_plane(gnode, &header_desc, sendbuf);
 }
 
 int ogs_pfcp_send_end_marker(ogs_pfcp_pdr_t *pdr)
 {
-    ogs_gtp_node_t *gnode = NULL;
-    ogs_pfcp_far_t *far = NULL;
-
     ogs_pkbuf_t *sendbuf = NULL;
-
     ogs_gtp2_header_desc_t header_desc;
 
     ogs_assert(pdr);
-    far = pdr->far;
-    ogs_assert(far);
-
-    gnode = far->gnode;
-    if (!gnode) {
-        ogs_error("No GTP Node Setup");
-        return OGS_DONE;
-    }
-    if (!gnode->sock) {
-        ogs_error("No GTP Socket Setup");
-        return OGS_DONE;
-    }
 
     sendbuf = ogs_pkbuf_alloc(NULL, OGS_GTPV1U_5GC_HEADER_LEN);
     if (!sendbuf) {
@@ -480,9 +469,7 @@
     ogs_pkbuf_reserve(sendbuf, OGS_GTPV1U_5GC_HEADER_LEN);
 
     memset(&header_desc, 0, sizeof(header_desc));
-
     header_desc.type = OGS_GTPU_MSGTYPE_END_MARKER;
-    header_desc.teid = far->outer_header_creation.teid;
 
     if (pdr->qer && pdr->qer->qfi) {
         header_desc.pdu_type =
@@ -490,33 +477,11 @@
         header_desc.qos_flow_identifier = pdr->qer->qfi;
     }
 
-    ogs_gtp2_send_user_plane(gnode, &header_desc, sendbuf);
-
-    return OGS_OK;
-}
-
-void ogs_pfcp_send_buffered_packet(ogs_pfcp_pdr_t *pdr)
-{
-    ogs_pfcp_far_t *far = NULL;
-    int i;
+    ogs_gtp2_encapsulate_header(&header_desc, sendbuf);
 
-    ogs_assert(pdr);
-    far = pdr->far;
+    ogs_pfcp_send_gtpu(pdr, sendbuf);
 
-    if (far && far->gnode) {
-        if (far->apply_action & OGS_PFCP_APPLY_ACTION_FORW) {
-            for (i = 0; i < far->num_of_buffered_packet; i++) {
-                ogs_gtp2_header_desc_t sendhdr;
-
-                memset(&sendhdr, 0, sizeof(sendhdr));
-                sendhdr.type = OGS_GTPU_MSGTYPE_GPDU;
-
-                ogs_pfcp_send_g_pdu(
-                        pdr, &sendhdr, far->buffered_packeti);
-            }
-            far->num_of_buffered_packet = 0;
-        }
-    }
+    return OGS_OK;
 }
 
 void ogs_pfcp_send_error_message(

open5gs_2.7.6.tar.xz/lib/pfcp/path.h -> open5gs_2.7.7.tar.xz/lib/pfcp/path.h Changed

open5gs_2.7.6.tar.xz/lib/pfcp/rule-match.c -> open5gs_2.7.7.tar.xz/lib/pfcp/rule-match.c Changed

@@ -55,7 +55,10 @@
         uint32_t jp_len = 0;
         struct ip6_opt_jumbo *jumbo = NULL;
 
-        ogs_assert(nxt == 0);
+        if (nxt != 0) {
+            ogs_error("Invalid IPv6 jumbo: plen=0 but NextHeader=%u", nxt);
+            return OGS_ERROR;   /* Drop packet safely */
+        }
 
         jumbo = (struct ip6_opt_jumbo *)jp;
         memcpy(&jp_len, jumbo->ip6oj_jumbo_len, sizeof(jp_len));
@@ -150,7 +153,13 @@
             ip_h = NULL;
             ip6_h = (struct ip6_hdr *)pkbuf->data;
 
-            decode_ipv6_header(ip6_h, &proto, &ip_hlen);
+            if (OGS_OK != decode_ipv6_header(ip6_h, &proto, &ip_hlen)) {
+                /* Drop malformed IPv6 packet gracefully */
+                ogs_error("Malformed IPv6 packet while matching PDR plen:%d",
+                        pkbuf->len);
+                ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len);
+                continue;
+            }
 
             src_addr = (void *)ip6_h->ip6_src.s6_addr;
             dst_addr = (void *)ip6_h->ip6_dst.s6_addr;

open5gs_2.7.6.tar.xz/lib/pfcp/types.c -> open5gs_2.7.7.tar.xz/lib/pfcp/types.c Changed

open5gs_2.7.6.tar.xz/lib/pfcp/xact.c -> open5gs_2.7.7.tar.xz/lib/pfcp/xact.c Changed

@@ -75,7 +75,11 @@
     ogs_assert(node);
 
     ogs_pool_id_calloc(&pool, &xact);
-    ogs_assert(xact);
+    if (!xact) {
+        ogs_error("Maximum number of xact%lld reached",
+                    (long long)ogs_app()->pool.xact);
+        return NULL;
+    }
     xact->index = ogs_pool_index(&pool, xact);
 
     xact->org = OGS_PFCP_LOCAL_ORIGINATOR;
@@ -87,21 +91,36 @@
     xact->tm_response = ogs_timer_add(
             ogs_app()->timer_mgr, response_timeout,
             OGS_UINT_TO_POINTER(xact->id));
-    ogs_assert(xact->tm_response);
+    if (!xact->tm_response) {
+        ogs_error("Maximum number of xact->tm_response%lld reached",
+                    (long long)ogs_app()->pool.timer);
+        ogs_pfcp_xact_delete(xact);
+        return NULL;
+    }
     xact->response_rcount =
         ogs_local_conf()->time.message.pfcp.n1_response_rcount;
 
     xact->tm_holding = ogs_timer_add(
             ogs_app()->timer_mgr, holding_timeout,
             OGS_UINT_TO_POINTER(xact->id));
-    ogs_assert(xact->tm_holding);
+    if (!xact->tm_holding) {
+        ogs_error("Maximum number of xact->tm_holding%lld reached",
+                    (long long)ogs_app()->pool.timer);
+        ogs_pfcp_xact_delete(xact);
+        return NULL;
+    }
     xact->holding_rcount =
         ogs_local_conf()->time.message.pfcp.n1_holding_rcount;
 
     xact->tm_delayed_commit = ogs_timer_add(
             ogs_app()->timer_mgr, delayed_commit_timeout,
             OGS_UINT_TO_POINTER(xact->id));
-    ogs_assert(xact->tm_delayed_commit);
+    if (!xact->tm_delayed_commit) {
+        ogs_error("Maximum number of xact->tm_delayed_commit%lld reached",
+                    (long long)ogs_app()->pool.timer);
+        ogs_pfcp_xact_delete(xact);
+        return NULL;
+    }
 
     ogs_list_add(xact->org == OGS_PFCP_LOCAL_ORIGINATOR ?
             &xact->node->local_list : &xact->node->remote_list, xact);
@@ -124,7 +143,11 @@
     ogs_assert(node);
 
     ogs_pool_id_calloc(&pool, &xact);
-    ogs_assert(xact);
+    if (!xact) {
+        ogs_error("Maximum number of xact%lld reached",
+                    (long long)ogs_app()->pool.xact);
+        return NULL;
+    }
     xact->index = ogs_pool_index(&pool, xact);
 
     xact->org = OGS_PFCP_REMOTE_ORIGINATOR;
@@ -134,21 +157,36 @@
     xact->tm_response = ogs_timer_add(
             ogs_app()->timer_mgr, response_timeout,
             OGS_UINT_TO_POINTER(xact->id));
-    ogs_assert(xact->tm_response);
+    if (!xact->tm_response) {
+        ogs_error("Maximum number of xact->tm_response%lld reached",
+                    (long long)ogs_app()->pool.timer);
+        ogs_pfcp_xact_delete(xact);
+        return NULL;
+    }
     xact->response_rcount =
         ogs_local_conf()->time.message.pfcp.n1_response_rcount;
 
     xact->tm_holding = ogs_timer_add(
             ogs_app()->timer_mgr, holding_timeout,
             OGS_UINT_TO_POINTER(xact->id));
-    ogs_assert(xact->tm_holding);
+    if (!xact->tm_holding) {
+        ogs_error("Maximum number of xact->tm_holding%lld reached",
+                    (long long)ogs_app()->pool.timer);
+        ogs_pfcp_xact_delete(xact);
+        return NULL;
+    }
     xact->holding_rcount =
         ogs_local_conf()->time.message.pfcp.n1_holding_rcount;
 
     xact->tm_delayed_commit = ogs_timer_add(
             ogs_app()->timer_mgr, delayed_commit_timeout,
             OGS_UINT_TO_POINTER(xact->id));
-    ogs_assert(xact->tm_delayed_commit);
+    if (!xact->tm_delayed_commit) {
+        ogs_error("Maximum number of xact->tm_delayed_commit%lld reached",
+                    (long long)ogs_app()->pool.timer);
+        ogs_pfcp_xact_delete(xact);
+        return NULL;
+    }
 
     ogs_list_add(xact->org == OGS_PFCP_LOCAL_ORIGINATOR ?
             &xact->node->local_list : &xact->node->remote_list, xact);

open5gs_2.7.6.tar.xz/lib/pfcp/xact.h -> open5gs_2.7.7.tar.xz/lib/pfcp/xact.h Changed

@@ -102,21 +102,22 @@
 #define OGS_PFCP_MODIFY_QOS_DELETE ((uint64_t)1<<16)
 #define OGS_PFCP_MODIFY_OUTER_HEADER_REMOVAL ((uint64_t)1<<17)
 #define OGS_PFCP_MODIFY_ACTIVATE ((uint64_t)1<<18)
-#define OGS_PFCP_MODIFY_DEACTIVATE ((uint64_t)1<<19)
-#define OGS_PFCP_MODIFY_END_MARKER ((uint64_t)1<<20)
-#define OGS_PFCP_MODIFY_ERROR_INDICATION ((uint64_t)1<<21)
-#define OGS_PFCP_MODIFY_XN_HANDOVER ((uint64_t)1<<22)
-#define OGS_PFCP_MODIFY_N2_HANDOVER ((uint64_t)1<<23)
-#define OGS_PFCP_MODIFY_HANDOVER_CANCEL ((uint64_t)1<<24)
-#define OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING ((uint64_t)1<<25)
-#define OGS_PFCP_MODIFY_URR  ((uint64_t)1<<26) /* type of trigger */
-#define OGS_PFCP_MODIFY_URR_MEAS_METHOD ((uint64_t)1<<27)
-#define OGS_PFCP_MODIFY_URR_REPORT_TRIGGER ((uint64_t)1<<28)
-#define OGS_PFCP_MODIFY_URR_QUOTA_VALIDITY_TIME ((uint64_t)1<<29)
-#define OGS_PFCP_MODIFY_URR_VOLUME_QUOTA ((uint64_t)1<<30)
-#define OGS_PFCP_MODIFY_URR_TIME_QUOTA ((uint64_t)1<<31)
-#define OGS_PFCP_MODIFY_URR_VOLUME_THRESH ((uint64_t)1<<32)
-#define OGS_PFCP_MODIFY_URR_TIME_THRESH ((uint64_t)1<<33)
+#define OGS_PFCP_MODIFY_FROM_ACTIVATING ((uint64_t)1<<19)
+#define OGS_PFCP_MODIFY_DEACTIVATE ((uint64_t)1<<20)
+#define OGS_PFCP_MODIFY_END_MARKER ((uint64_t)1<<21)
+#define OGS_PFCP_MODIFY_ERROR_INDICATION ((uint64_t)1<<22)
+#define OGS_PFCP_MODIFY_XN_HANDOVER ((uint64_t)1<<23)
+#define OGS_PFCP_MODIFY_N2_HANDOVER ((uint64_t)1<<24)
+#define OGS_PFCP_MODIFY_HANDOVER_CANCEL ((uint64_t)1<<25)
+#define OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING ((uint64_t)1<<26)
+#define OGS_PFCP_MODIFY_URR  ((uint64_t)1<<27) /* type of trigger */
+#define OGS_PFCP_MODIFY_URR_MEAS_METHOD ((uint64_t)1<<28)
+#define OGS_PFCP_MODIFY_URR_REPORT_TRIGGER ((uint64_t)1<<29)
+#define OGS_PFCP_MODIFY_URR_QUOTA_VALIDITY_TIME ((uint64_t)1<<30)
+#define OGS_PFCP_MODIFY_URR_VOLUME_QUOTA ((uint64_t)1<<31)
+#define OGS_PFCP_MODIFY_URR_TIME_QUOTA ((uint64_t)1<<32)
+#define OGS_PFCP_MODIFY_URR_VOLUME_THRESH ((uint64_t)1<<33)
+#define OGS_PFCP_MODIFY_URR_TIME_THRESH ((uint64_t)1<<34)
     uint64_t        modify_flags;
 
 #define OGS_PFCP_DELETE_TRIGGER_LOCAL_INITIATED 1

open5gs_2.7.6.tar.xz/lib/proto/types.c -> open5gs_2.7.7.tar.xz/lib/proto/types.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2022 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -129,8 +129,9 @@
 }
 
 #define FQDN_3GPPNETWORK_ORG ".3gppnetwork.org"
-#define FQDN_5GC_MNC "5gc.mnc"
+#define FQDN_GPRS ".gprs"
 #define FQDN_MCC ".mcc"
+#define FQDN_MNC ".mnc"
 
 char *ogs_serving_network_name_from_plmn_id(const ogs_plmn_id_t *plmn_id)
 {
@@ -165,78 +166,65 @@
             ogs_plmn_id_mnc(plmn_id), ogs_plmn_id_mcc(plmn_id));
 }
 
-char *ogs_home_network_domain_from_fqdn(char *fqdn)
+char *ogs_dnn_oi_from_plmn_id(const ogs_plmn_id_t *plmn_id)
 {
-    char *p = NULL;
+    return ogs_msprintf("mnc%03d.mcc%03d" FQDN_GPRS,
+            ogs_plmn_id_mnc(plmn_id), ogs_plmn_id_mcc(plmn_id));
+}
+
+char *ogs_dnn_oi_from_fqdn(char *fqdn)
+{
+    char *mnc_pos = NULL;
 
     ogs_assert(fqdn);
 
-    if (strlen(fqdn) <
-        strlen(FQDN_5GC_MNC "XXX" FQDN_MCC "XXX" FQDN_3GPPNETWORK_ORG)) {
+    /* Find ".mnc" from right side */
+    mnc_pos = ogs_strrstr(fqdn, FQDN_MNC);
+    if (!mnc_pos)
         return NULL;
-    }
 
-    p = fqdn + strlen(fqdn);
-    if (strncmp(p - strlen(FQDN_3GPPNETWORK_ORG),
-                FQDN_3GPPNETWORK_ORG, strlen(FQDN_3GPPNETWORK_ORG)) != 0) {
+    /* Ensure minimum required length for parsing */
+    if ((mnc_pos + strlen(FQDN_MNC) + 3 + strlen(FQDN_MCC) + 3) >
+        fqdn + strlen(fqdn))
         return NULL;
-    }
 
-    p -= (strlen(FQDN_3GPPNETWORK_ORG) + 3);
-    if (strncmp(p - strlen(FQDN_MCC),
-                FQDN_MCC, strlen(FQDN_MCC)) != 0) {
+    /* Validate that ".mnc" is followed by 3 digits */
+    if (!isdigit(mnc_pos4) ||
+        !isdigit(mnc_pos5) ||
+        !isdigit(mnc_pos6))
         return NULL;
-    }
 
-    p -= (strlen(FQDN_MCC) + 3);
-    if (strncmp(p - strlen(FQDN_5GC_MNC),
-                FQDN_5GC_MNC, strlen(FQDN_5GC_MNC)) != 0) {
+    /* Check format ".mcc" after MNC */
+    if (strncmp(mnc_pos + 7, FQDN_MCC, strlen(FQDN_MCC)) != 0)
+        return NULL;
+
+    /* Validate MCC digits */
+    if (!isdigit(mnc_pos11) ||
+        !isdigit(mnc_pos12) ||
+        !isdigit(mnc_pos13))
         return NULL;
-    }
 
-    return p - strlen(FQDN_5GC_MNC);
+    return mnc_pos+1;   /* caller will parse MNC, MCC from here */
 }
 
 uint16_t ogs_plmn_id_mcc_from_fqdn(char *fqdn)
 {
-    char mcc4;
-    char *p = NULL;
-
-    ogs_assert(fqdn);
-
-    p = ogs_home_network_domain_from_fqdn(fqdn);
-    if (p == NULL) {
+    char *p = ogs_dnn_oi_from_fqdn(fqdn);
+    if (!p) {
         ogs_error("Invalid FQDN %d:%s", (int)strlen(fqdn), fqdn);
         return 0;
     }
-
-    p += strlen(FQDN_5GC_MNC) + 3 + strlen(FQDN_MCC);
-
-    memcpy(mcc, p, 3);
-    mcc3 = 0;
-
-    return atoi(mcc);
+    return (uint16_t)atoi(p + 10); /* after ".mcc" */
 }
 
 uint16_t ogs_plmn_id_mnc_from_fqdn(char *fqdn)
 {
-    char mnc4;
-    char *p = NULL;
-
-    ogs_assert(fqdn);
-
-    p = ogs_home_network_domain_from_fqdn(fqdn);
-    if (p == NULL) {
+    char *p = ogs_dnn_oi_from_fqdn(fqdn);
+    if (!p) {
         ogs_error("Invalid FQDN %d:%s", (int)strlen(fqdn), fqdn);
         return 0;
     }
-
-    p += strlen(FQDN_5GC_MNC);
-
-    memcpy(mnc, p, 3);
-    mnc3 = 0;
-
-    return atoi(mnc);
+    return (uint16_t)atoi(p + 3); /* after "mnc" */
 }
 
 uint32_t ogs_amf_id_hexdump(const ogs_amf_id_t *amf_id)
@@ -459,26 +447,55 @@
 
     memset(pco, 0, sizeof(ogs_pco_t));
 
+    if (data_len < 1) {
+        ogs_error("PCO/EPCO too short %d", data_len);
+        return -EINVAL;
+    }
+
     pco->ext = source->ext;
     pco->configuration_protocol = source->configuration_protocol;
     size++;
 
     while(size < data_len && i < OGS_MAX_NUM_OF_PROTOCOL_OR_CONTAINER_ID) {
         ogs_pco_id_t *id = &pco->idsi;
-        ogs_assert(size + sizeof(id->id) <= data_len);
+
+        if (size + (int)sizeof(id->id) > data_len) {
+            ogs_error("PCO/EPCO truncated before Container-ID "
+                    "offset:%d len:%d", size, data_len);
+            return -EINVAL;
+        }
         memcpy(&id->id, data + size, sizeof(id->id));
         id->id = be16toh(id->id);
         size += sizeof(id->id);
 
-        ogs_assert(size + sizeof(id->len) <= data_len);
+        if (size + (int)sizeof(id->len) > data_len) {
+            ogs_error("PCO/EPCO truncated before Container-Length "
+                    "id:0x%x offset:%d len:%d",
+                    id->id, size, data_len);
+            return -EINVAL;
+        }
         memcpy(&id->len, data + size, sizeof(id->len));
         size += sizeof(id->len);
 
+        if (size + id->len > data_len) {
+            ogs_error("PCO/EPCO truncated Container data "
+                    "id:0x%x container-len:%u offset:%d len:%d",
+                    id->id, id->len, size, data_len);
+            return -EINVAL;
+        }
+
         id->data = data + size;
         size += id->len;
 
         i++;
     }
+
+    if (size < data_len) {
+        ogs_error("PCO/EPCO exceeds maximum number of containers "
+                "%d", OGS_MAX_NUM_OF_PROTOCOL_OR_CONTAINER_ID);
+        return -EINVAL;
+    }
+
     pco->num_of_id = i;
     ogs_expect(size == data_len);

open5gs_2.7.6.tar.xz/lib/proto/types.h -> open5gs_2.7.7.tar.xz/lib/proto/types.h Changed

@@ -31,7 +31,7 @@
 #define OGS_MAX_NUM_OF_SESS             4   /* Num of APN(Session) per UE */
 #define OGS_MAX_NUM_OF_BEARER           4   /* Num of Bearer per Session */
 #define OGS_BEARER_PER_UE               8   /* Num of Bearer per UE */
-#define OGS_MAX_NUM_OF_PACKET_BUFFER    64  /* Num of PacketBuffer per UE */
+#define OGS_MAX_NUM_OF_GTPU_BUFFER      64  /* Num of GTPU Buffer per UE */
 
 /*
  * TS24.008
@@ -193,6 +193,7 @@
 #define OGS_SESSION_STRING "session"
 #define OGS_NAME_STRING "name"
 #define OGS_TYPE_STRING "type"
+#define OGS_LBO_ROAMING_ALLOWED_STRING "lbo_roaming_allowed"
 #define OGS_QOS_STRING "qos"
 #define OGS_INDEX_STRING "index"
 #define OGS_ARP_STRING "arp"
@@ -245,7 +246,8 @@
 char *ogs_epc_domain_from_plmn_id(const ogs_plmn_id_t *plmn_id);
 char *ogs_nrf_fqdn_from_plmn_id(const ogs_plmn_id_t *plmn_id);
 char *ogs_nssf_fqdn_from_plmn_id(const ogs_plmn_id_t *plmn_id);
-char *ogs_home_network_domain_from_fqdn(char *fqdn);
+char *ogs_dnn_oi_from_plmn_id(const ogs_plmn_id_t *plmn_id);
+char *ogs_dnn_oi_from_fqdn(char *fqdn);
 uint16_t ogs_plmn_id_mnc_from_fqdn(char *fqdn);
 uint16_t ogs_plmn_id_mcc_from_fqdn(char *fqdn);
 
@@ -431,7 +433,21 @@
     };
 } __attribute__ ((packed)) ogs_paa_t;
 
-#define MAX_BIT_RATE 10000000000UL
+/*
+ *  Bitrate Upper Bound According to 3GPP Standards
+ *
+ *  EPC (S1AP): 3GPP TS 36.413 §9.2.1.19 Bit Rate
+ *      - Maximum allowed bitrate value specified for EPC
+ *
+ *  5GC (NGAP): 3GPP TS 38.414 §9.3.1.4 Bit Rate
+ *      - Defines larger bitrate ceiling due to 5GC performance model
+ *
+ *  NOTE: These values represent the upper boundary (ceiling) of the encode
+ *        bitrate field in each control-plane protocol.
+ */
+#define OGS_MAX_BITRATE_S1AP    10000000000UL        /* S1AP / EPC */
+#define OGS_MAX_BITRATE_NGAP    4000000000000UL      /* NGAP / 5GC */
+
 
 typedef struct ogs_bitrate_s {
     uint64_t downlink;        /* bits per seconds */
@@ -621,6 +637,8 @@
 #define OGS_PDU_SESSION_TYPE_FROM_DIAMETER(x)       ((x)+1)
     uint8_t session_type;
 
+    bool lbo_roaming_allowed; /* true: Allowed, false: Not allowed */
+
 #define OGS_SSC_MODE_1                              1
 #define OGS_SSC_MODE_2                              2
 #define OGS_SSC_MODE_3                              3

open5gs_2.7.6.tar.xz/lib/sbi/client.c -> open5gs_2.7.7.tar.xz/lib/sbi/client.c Changed

@@ -32,6 +32,8 @@
 typedef struct connection_s {
     ogs_lnode_t lnode;
 
+    ogs_pool_id_t id;
+
     void *data;
 
     char *method;
@@ -170,7 +172,7 @@
 
     ogs_list_add(&ogs_sbi_self()->client_list, client);
 
-    ogs_debug("CLEINT added with Ref %d", client->reference_count);
+    ogs_debug("CLIENT added with Ref %d", client->reference_count);
 
     return client;
 }
@@ -181,7 +183,7 @@
 
     ogs_assert(client);
 
-    ogs_debug("CLEINT UnRef %d", client->reference_count);
+    ogs_debug("CLIENT UnRef %d", client->reference_count);
     if (client->fqdn)
         ogs_debug("- fqdn %s:%d", client->fqdn, client->fqdn_port);
     if (client->resolve)
@@ -199,7 +201,7 @@
         return;
     }
 
-    ogs_debug("CLEINT removed %d", client->reference_count);
+    ogs_debug("CLIENT removed %d", client->reference_count);
 
     ogs_list_remove(&ogs_sbi_self()->client_list, client);
 
@@ -413,12 +415,11 @@
     ogs_assert(request);
     ogs_assert(request->h.method);
 
-    ogs_pool_alloc(&connection_pool, &conn);
+    ogs_pool_id_calloc(&connection_pool, &conn);
     if (!conn) {
         ogs_error("ogs_pool_alloc() failed");
         return NULL;
     }
-    memset(conn, 0, sizeof(connection_t));
 
     conn->client = client;
     conn->client_cb = client_cb;
@@ -456,7 +457,8 @@
     }
 
     conn->timer = ogs_timer_add(
-            ogs_app()->timer_mgr, connection_timer_expired, conn);
+            ogs_app()->timer_mgr, connection_timer_expired,
+            OGS_UINT_TO_POINTER(conn->id));
     if (!conn->timer) {
         ogs_error("conn->timer is NULL");
         connection_free(conn);
@@ -492,8 +494,8 @@
     /* HTTPS certificate-related settings */
     if (client->scheme == OpenAPI_uri_scheme_https) {
         if (client->insecure_skip_verify) {
-            curl_easy_setopt(conn->easy, CURLOPT_SSL_VERIFYPEER, 0);
-            curl_easy_setopt(conn->easy, CURLOPT_SSL_VERIFYHOST, 0);
+            curl_easy_setopt(conn->easy, CURLOPT_SSL_VERIFYPEER, 0L);
+            curl_easy_setopt(conn->easy, CURLOPT_SSL_VERIFYHOST, 0L);
         } else {
             if (client->cacert)
                 curl_easy_setopt(conn->easy, CURLOPT_CAINFO, client->cacert);
@@ -633,7 +635,7 @@
     if (conn->method)
         ogs_free(conn->method);
 
-    ogs_pool_free(&connection_pool, conn);
+    ogs_pool_id_free(&connection_pool, conn);
 }
 
 static void connection_remove_all(ogs_sbi_client_t *client)
@@ -648,12 +650,20 @@
 
 static void connection_timer_expired(void *data)
 {
+    ogs_pool_id_t conn_id = OGS_POINTER_TO_UINT(data);
     connection_t *conn = NULL;
     CURLcode res;
     char *effective_url = NULL;
 
-    conn = data;
-    ogs_assert(conn);
+    if (conn_id >= OGS_MIN_POOL_ID && conn_id <= OGS_MAX_POOL_ID)
+        conn = ogs_pool_find_by_id(&connection_pool, conn_id);
+    else
+        ogs_error("Invalid Connection ID %d", conn_id);
+
+    if (!conn) {
+        ogs_error("No Connection");
+        return;
+    }
 
     ogs_error("Connection timer expired METHOD:%s", conn->method);

open5gs_2.7.6.tar.xz/lib/sbi/context.c -> open5gs_2.7.7.tar.xz/lib/sbi/context.c Changed

@@ -28,8 +28,6 @@
 static OGS_POOL(xact_pool, ogs_sbi_xact_t);
 static OGS_POOL(subscription_spec_pool, ogs_sbi_subscription_spec_t);
 static OGS_POOL(subscription_data_pool, ogs_sbi_subscription_data_t);
-static OGS_POOL(smf_info_pool, ogs_sbi_smf_info_t);
-static OGS_POOL(amf_info_pool, ogs_sbi_amf_info_t);
 static OGS_POOL(nf_info_pool, ogs_sbi_nf_info_t);
 
 void ogs_sbi_context_init(OpenAPI_nf_type_e nf_type)
@@ -61,9 +59,6 @@
     ogs_list_init(&self.subscription_data_list);
     ogs_pool_init(&subscription_data_pool, ogs_app()->pool.subscription);
 
-    ogs_pool_init(&smf_info_pool, ogs_app()->pool.nf);
-    ogs_pool_init(&amf_info_pool, ogs_app()->pool.nf);
-
     ogs_pool_init(&nf_info_pool, ogs_app()->pool.nf * OGS_MAX_NUM_OF_NF_INFO);
 
     /* Add SELF NF-Instance */
@@ -108,9 +103,6 @@
 
     ogs_pool_final(&nf_instance_pool);
     ogs_pool_final(&nf_service_pool);
-    ogs_pool_final(&smf_info_pool);
-    ogs_pool_final(&amf_info_pool);
-
     ogs_pool_final(&nf_info_pool);
 
     ogs_sbi_client_final();
@@ -1371,6 +1363,9 @@
         ogs_free(nf_instance->id);
     }
 
+    if (nf_instance->hnrf_uri)
+        ogs_free(nf_instance->hnrf_uri);
+
     if (nf_instance->client)
         ogs_sbi_client_remove(nf_instance->client);
 
@@ -1697,8 +1692,6 @@
     amf_info->num_of_guami = 0;
     amf_info->num_of_nr_tai = 0;
     amf_info->num_of_nr_tai_range = 0;
-
-    ogs_pool_free(&amf_info_pool, amf_info);
 }
 
 static void smf_info_free(ogs_sbi_smf_info_t *smf_info)
@@ -1714,8 +1707,6 @@
     smf_info->num_of_slice = 0;
     smf_info->num_of_nr_tai = 0;
     smf_info->num_of_nr_tai_range = 0;
-
-    ogs_pool_free(&smf_info_pool, smf_info);
 }
 
 static void scp_info_free(ogs_sbi_scp_info_t *scp_info)
@@ -2061,7 +2052,11 @@
                 return NULL;
             }
         }
-    }
+    } else
+        ogs_error("%s No instance-level endpoint, "
+                "client association skipped id:%s",
+                OpenAPI_nf_type_ToString(nf_instance->nf_type),
+                nf_instance->id);
 
     return client;
 }
@@ -2105,12 +2100,16 @@
                 return;
             }
         }
-    }
-
-    ogs_debug("%s NFService associated %s",
-            nf_service->name, nf_service->id);
-    if (client)
+    } else
+        ogs_error("%s No service-level endpoint, "
+                "client association skipped id:%s",
+                nf_service->name, nf_service->id);
+
+    if (client) {
+        ogs_info("%s NFService associated %s",
+                nf_service->name, nf_service->id);
         OGS_SBI_SETUP_CLIENT(nf_service, client);
+    }
 }
 
 static void nf_service_associate_client_all(ogs_sbi_nf_instance_t *nf_instance)
@@ -2129,60 +2128,117 @@
         ogs_sbi_discovery_option_t *discovery_option)
 {
     ogs_sbi_nf_info_t *nf_info = NULL;
+    bool smf_info_checked = false;
+    bool smf_match_found = false;
+    bool need_smf_slice = false;   /* requires both S-NSSAI and DNN */
+    bool need_smf_tai = false;     /* TAI filter present */
+    bool need_smf_any = false;     /* any SMF-specific filter */
+    int i;
 
     ogs_assert(nf_instance);
     ogs_assert(requester_nf_type);
     ogs_assert(discovery_option);
 
+    /* --------------------------------------------------------------
+     * Step 1. Common pre-checks for all NF types
+     * -------------------------------------------------------------- */
     if (discovery_option->target_nf_instance_id &&
-        nf_instance->id && strcmp(nf_instance->id,
-            discovery_option->target_nf_instance_id) != 0) {
+        nf_instance->id &&
+        strcmp(nf_instance->id,
+           discovery_option->target_nf_instance_id) != 0)
         return false;
-    }
 
-    if (discovery_option->num_of_service_names) {
-        if (ogs_sbi_discovery_option_service_names_is_matched(
-                    nf_instance, requester_nf_type, discovery_option) == false)
-            return false;
-    }
+    if (discovery_option->num_of_service_names &&
+        ogs_sbi_discovery_option_service_names_is_matched(
+            nf_instance, requester_nf_type, discovery_option) == false)
+        return false;
 
-    if (discovery_option->num_of_target_plmn_list) {
-        if (ogs_sbi_discovery_option_target_plmn_list_is_matched(
-                    nf_instance, discovery_option) == false)
-            return false;
+    if (discovery_option->num_of_target_plmn_list &&
+        ogs_sbi_discovery_option_target_plmn_list_is_matched(
+            nf_instance, discovery_option) == false)
+        return false;
+
+    if (nf_instance->nf_type == OpenAPI_nf_type_NRF &&
+        ogs_sbi_discovery_option_hnrf_uri_is_matched(
+            nf_instance, discovery_option) == false)
+        return false;
+
+    /* Determine which SMF filters are requested */
+    if (nf_instance->nf_type == OpenAPI_nf_type_SMF) {
+        need_smf_slice = (discovery_option->num_of_snssais &&
+                          discovery_option->dnn) ? true : false;
+        need_smf_tai = discovery_option->tai_presence ? true : false;
+
+        /* If more SMF filters are added later, OR them here */
+        need_smf_any = (need_smf_slice || need_smf_tai) ? true : false;
     }
 
+    /* --------------------------------------------------------------
+     * Step 2. NF-type specific matching
+     * -------------------------------------------------------------- */
     ogs_list_for_each(&nf_instance->nf_info_list, nf_info) {
         if (nf_instance->nf_type != nf_info->nf_type) {
             ogs_error("Invalid NF-Type %d:%d",
-                    nf_instance->nf_type, nf_info->nf_type);
+                nf_instance->nf_type, nf_info->nf_type);
             return false;
         }
 
-        switch (nf_info->nf_type) {
-        case OpenAPI_nf_type_AMF:
+        /* --- AMF --- */
+        if (nf_info->nf_type == OpenAPI_nf_type_AMF) {
             if (requester_nf_type == OpenAPI_nf_type_AMF &&
                 discovery_option->guami_presence &&
-                ogs_sbi_check_amf_info_guami(&nf_info->amf,
+                ogs_sbi_check_amf_info_guami(
+                    &nf_info->amf,
                     &discovery_option->guami) == false)
                 return false;
-            break;
-        case OpenAPI_nf_type_SMF:
-            if (discovery_option->num_of_snssais && discovery_option->dnn &&
-                ogs_sbi_check_smf_info_slice(&nf_info->smf,
-                    &discovery_option->snssais0,
-                    discovery_option->dnn) == false)
-                return false;
-            if (discovery_option->tai_presence &&
-                ogs_sbi_check_smf_info_tai(&nf_info->smf,
-                    &discovery_option->tai) == false)
-                return false;
-            break;
-        default:
-            break;
         }
+
+        /* --- SMF --- */
+        else if (nf_info->nf_type == OpenAPI_nf_type_SMF) {
+            /* Skip expensive checks if no SMF filter is requested */
+            smf_info_checked = true;
+
+            /* Slice (S-NSSAI + DNN) filter */
+            if (need_smf_slice) {
+                bool slice_ok = false;
+                for (i = 0; i < discovery_option->num_of_snssais; i++) {
+                    if (ogs_sbi_check_smf_info_slice(
+                            &nf_info->smf,
+                            &discovery_option->snssaisi,
+                            discovery_option->dnn)) {
+                        slice_ok = true;
+                        break;
+                    }
+                }
+                if (slice_ok == false)
+                    continue; /* this smfInfo does not match slice */
+            }
+
+            /* TAI filter (applied after slice if present) */
+            if (need_smf_tai) {
+                if (ogs_sbi_check_smf_info_tai(
+                        &nf_info->smf,
+                        &discovery_option->tai) == false)
+                    continue; /* this smfInfo does not match TAI */
+            }
+
+            /* If we reached here, all requested filters passed */
+            smf_match_found = true;
+            break; /* OR logic across smfInfo blocks */
+        }
+
+        /* Other NF types: no additional checks here */
     }
 
+    /* --------------------------------------------------------------
+     * Step 3. Final validation for SMF
+     * -------------------------------------------------------------- */
+    if (nf_instance->nf_type == OpenAPI_nf_type_SMF &&
+        smf_info_checked &&
+        need_smf_any &&
+        smf_match_found == false)
+        return false;
+
     return true;
 }
 
@@ -2284,6 +2340,23 @@
     return false;
 }
 
+bool ogs_sbi_discovery_option_hnrf_uri_is_matched(
+        ogs_sbi_nf_instance_t *nf_instance,
+        ogs_sbi_discovery_option_t *discovery_option)
+{
+    ogs_assert(nf_instance);
+    ogs_assert(discovery_option);
+
+    if (nf_instance->hnrf_uri == NULL && discovery_option->hnrf_uri == NULL)
+        return true;
+    else if (nf_instance->hnrf_uri == NULL ||
+            discovery_option->hnrf_uri == NULL)
+        return false;
+
+    return ogs_strcasecmp(nf_instance->hnrf_uri,
+            discovery_option->hnrf_uri) == 0;
+}
+
 bool ogs_sbi_discovery_param_is_matched(
         ogs_sbi_nf_instance_t *nf_instance,
         OpenAPI_nf_type_e target_nf_type,
@@ -2364,18 +2437,37 @@
     ogs_assert(nf_instance);
 
     client = nf_instance_find_client(nf_instance);
-    ogs_assert(client);
+    if (client) {
+        ogs_info("%s NFInstance associated %s",
+                nf_instance->nf_type ?
+                    OpenAPI_nf_type_ToString(nf_instance->nf_type) : "NULL",
+                nf_instance->id);
 
-    ogs_debug("%s NFInstance associated %s",
-            nf_instance->nf_type ?
-                OpenAPI_nf_type_ToString(nf_instance->nf_type) : "NULL",
-            nf_instance->id);
-
-    OGS_SBI_SETUP_CLIENT(nf_instance, client);
+        OGS_SBI_SETUP_CLIENT(nf_instance, client);
+    }
 
     nf_service_associate_client_all(nf_instance);
 }
 
+bool nf_instance_has_usable_client(ogs_sbi_nf_instance_t *nf_instance)
+{
+    ogs_sbi_nf_service_t *nf_service = NULL;
+
+    ogs_assert(nf_instance);
+
+    /* Instance-level client */
+    if (NF_INSTANCE_CLIENT(nf_instance))
+        return true;
+
+    /* Service-level clients */
+    ogs_list_for_each(&nf_instance->nf_service_list, nf_service) {
+        if (nf_service->client)
+            return true;
+    }
+
+    return false;
+}
+
 int ogs_sbi_default_client_port(OpenAPI_uri_scheme_e scheme)
 {
     if (scheme == OpenAPI_uri_scheme_NULL)
@@ -2448,6 +2540,8 @@
         if (sbi_object->nf_type_arrayi.nf_instance_id)
             ogs_free(sbi_object->nf_type_arrayi.nf_instance_id);
     }
+    if (sbi_object->home_nsmf_pdusession.nf_instance_id)
+        ogs_free(sbi_object->home_nsmf_pdusession.nf_instance_id);
 }
 
 ogs_sbi_xact_t *ogs_sbi_xact_add(
@@ -2578,6 +2672,16 @@
     if (xact->target_apiroot)
         ogs_free(xact->target_apiroot);
 
+    /*
+     * Release optional user context attached to the transaction.
+     * The transaction owns this memory and is responsible for
+     * freeing it when the transaction is destroyed.
+     */
+    if (xact->user_data) {
+        if (xact->user_data_free)
+            xact->user_data_free(xact->user_data);
+    }
+
     ogs_list_remove(&sbi_object->xact_list, xact);
     ogs_pool_id_free(&xact_pool, xact);
 }
@@ -2738,6 +2842,92 @@
     }
 }
 
+/*
+ * Send DELETE requests to NRF for all subscriptions belonging
+ * to the given NF instance before re-registration.
+ *
+ * This prevents subscription accumulation during repeated
+ * re-registration loops (e.g., heartbeat flapping).
+ *
+ * IMPORTANT:
+ * Local subscription_data MUST NOT be removed here.
+ * Cleanup is performed asynchronously in the unsubscribe
+ * response handler once NRF confirms deletion.
+ */
+void ogs_sbi_subscription_data_delete_and_remove_all_by_nf_instance_id(
+        const char *nf_instance_id)
+{
+    ogs_sbi_subscription_data_t *subscription_data = NULL;
+
+    ogs_assert(nf_instance_id);
+
+    ogs_list_for_each(
+            &ogs_sbi_self()->subscription_data_list, subscription_data) {
+
+        if (!subscription_data->id) {
+            ogs_error("Skip subscription delete: id is NULL");
+            continue;
+        }
+
+        if (!subscription_data->req_nf_instance_id) {
+            ogs_error("Skip subscription delete: req_nf_instance_id is NULL");
+            continue;
+        }
+
+        if (!subscription_data->resource_uri) {
+            ogs_error("Skip subscription delete: resource_uri is NULL");
+            continue;
+        }
+
+        if (strcmp(subscription_data->req_nf_instance_id,
+                   nf_instance_id) != 0) {
+            ogs_error("Skip subscription delete: nf_instance_id mismatch "
+                  "target:%s, current:%s",
+                  subscription_data->req_nf_instance_id, nf_instance_id);
+            continue;
+        }
+
+        /*
+         * Prevent duplicate DELETE transmissions.
+         * (Simple guard using existing state field or flag placeholder)
+         */
+        if (subscription_data->flags & OGS_SBI_SUBSCRIPTION_DELETE_SENT) {
+            ogs_debug("%s Skip subscription delete: DELETE already sent",
+                    subscription_data->id);
+            continue;
+        }
+
+        subscription_data->flags |= OGS_SBI_SUBSCRIPTION_DELETE_SENT;
+
+        /*
+         * If we have a subscription resource identifier,
+         * send DELETE to NRF to cleanup remote subscription state.
+         *
+         * Typical resource:
+         *   /nnrf-nfm/v1/subscriptions/{subscriptionId}
+         */
+        ogs_info("%s Sending NRF subscription DELETE before "
+                "NF re-registration", subscription_data->id);
+
+
+        /* Build DELETE request */
+        ogs_nnrf_nfm_send_nf_status_unsubscribe(subscription_data);
+
+        /*
+         * NOTE:
+         * Do NOT remove subscription_data here.
+         *
+         * Local cleanup is performed in the unsubscribe
+         * response handler once NRF confirms deletion.
+         *
+         * Removing here could lead to:
+         *   - Use-after-free
+         *   - Double free
+         *   - Dangling transaction context
+         */
+    }
+}
+
 void ogs_sbi_subscription_data_remove_all(void)
 {
     ogs_sbi_subscription_data_t *subscription_data = NULL;
@@ -2840,7 +3030,7 @@
         return false;
     }
 
-    if (ogs_home_network_domain_from_fqdn(fqdn) == NULL) {
+    if (ogs_dnn_oi_from_fqdn(fqdn) == NULL) {
         return false;
     }

open5gs_2.7.6.tar.xz/lib/sbi/context.h -> open5gs_2.7.7.tar.xz/lib/sbi/context.h Changed

@@ -161,6 +161,7 @@
     int num_of_plmn_id;
 
     char *fqdn;
+    char *hnrf_uri; /* NRF Only */
 
 #define OGS_SBI_MAX_NUM_OF_IP_ADDRESS 8
     int num_of_ipv4;
@@ -215,8 +216,9 @@
          */
         ogs_time_t validity_timeout;
 #endif
-    } nf_type_arrayOGS_SBI_MAX_NUM_OF_NF_TYPE,
-      service_type_arrayOGS_SBI_MAX_NUM_OF_SERVICE_TYPE;
+      } nf_type_arrayOGS_SBI_MAX_NUM_OF_NF_TYPE,
+        service_type_arrayOGS_SBI_MAX_NUM_OF_SERVICE_TYPE,
+        home_nsmf_pdusession;
 
     ogs_list_t xact_list;
 
@@ -268,11 +270,30 @@
 
     ogs_pool_id_t assoc_stream_id;
 
+    /*
+     * Optional user context attached to this SBI transaction.
+     *
+     * This pointer allows NF-specific code to associate arbitrary
+     * data with the transaction. The memory is owned by the
+     * transaction and will be released automatically when the
+     * transaction is removed via ogs_sbi_xact_remove().
+     *
+     * Typical usage:
+     *   - Store a snapshot of context identifiers needed when the
+     *     asynchronous SBI response arrives.
+     *   - Example: AMF stores a snapshot of RAN-UE ID because the
+     *     session's current RAN-UE may change before the response
+     *     (e.g., NG context release / re-establishment).
+     */
+    void *user_data;
+    void (*user_data_free)(void *user_data);
+
     int state;
     char *target_apiroot;
 
     ogs_sbi_object_t *sbi_object;
     ogs_pool_id_t sbi_object_id;
+
 } ogs_sbi_xact_t;
 
 typedef struct ogs_sbi_nf_service_s {
@@ -330,6 +351,9 @@
     ogs_timer_t *t_validity;                /* check validation */
     ogs_timer_t *t_patch;                   /* for sending PATCH */
 
+#define OGS_SBI_SUBSCRIPTION_DELETE_SENT  (1 << 0)
+    uint32_t flags;                         /* Subscription lifecycle flags */
+
     char *id;                               /* SubscriptionId */
     char *req_nf_instance_id;               /* reqNfInstanceId */
     OpenAPI_nf_type_e req_nf_type;          /* reqNfType */
@@ -506,6 +530,7 @@
         ogs_sbi_service_type_e service_type);
 
 void ogs_sbi_client_associate(ogs_sbi_nf_instance_t *nf_instance);
+bool nf_instance_has_usable_client(ogs_sbi_nf_instance_t *nf_instance);
 
 int ogs_sbi_default_client_port(OpenAPI_uri_scheme_e scheme);
 
@@ -604,6 +629,9 @@
 bool ogs_sbi_discovery_option_target_plmn_list_is_matched(
         ogs_sbi_nf_instance_t *nf_instance,
         ogs_sbi_discovery_option_t *discovery_option);
+bool ogs_sbi_discovery_option_hnrf_uri_is_matched(
+        ogs_sbi_nf_instance_t *nf_instance,
+        ogs_sbi_discovery_option_t *discovery_option);
 
 void ogs_sbi_object_free(ogs_sbi_object_t *sbi_object);
 
@@ -632,6 +660,8 @@
         ogs_sbi_subscription_data_t *subscription_data);
 void ogs_sbi_subscription_data_remove_all_by_nf_instance_id(
         char *nf_instance_id);
+void ogs_sbi_subscription_data_delete_and_remove_all_by_nf_instance_id(
+        const char *nf_instance_id);
 void ogs_sbi_subscription_data_remove_all(void);
 ogs_sbi_subscription_data_t *ogs_sbi_subscription_data_find(char *id);

open5gs_2.7.6.tar.xz/lib/sbi/conv.c -> open5gs_2.7.7.tar.xz/lib/sbi/conv.c Changed

open5gs_2.7.6.tar.xz/lib/sbi/message.c -> open5gs_2.7.7.tar.xz/lib/sbi/message.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -66,6 +66,8 @@
     /* Query parameters */
     for (i = 0; i < message->param.num_of_fields; i++)
         ogs_free(message->param.fieldsi);
+    for (i = 0; i < message->param.num_of_dataset_names; i++)
+        ogs_free(message->param.dataset_namesi);
 
     /* JSON Data */
     if (message->NFProfile)
@@ -113,6 +115,8 @@
                 message->Amf3GppAccessRegistrationModification);
     if (message->SmfRegistration)
         OpenAPI_smf_registration_free(message->SmfRegistration);
+    if (message->ProvisionedDataSets)
+        OpenAPI_provisioned_data_sets_free(message->ProvisionedDataSets);
     if (message->Nssai)
         OpenAPI_nssai_free(message->Nssai);
     if (message->AccessAndMobilitySubscriptionData)
@@ -139,6 +143,30 @@
         OpenAPI_sm_context_release_data_free(message->SmContextReleaseData);
     if (message->SmContextReleasedData)
         OpenAPI_sm_context_released_data_free(message->SmContextReleasedData);
+    if (message->PduSessionCreateData)
+        OpenAPI_pdu_session_create_data_free(message->PduSessionCreateData);
+    if (message->PduSessionCreatedData)
+        OpenAPI_pdu_session_created_data_free(message->PduSessionCreatedData);
+    if (message->PduSessionCreateError)
+        OpenAPI_pdu_session_create_error_free(message->PduSessionCreateError);
+    if (message->HsmfUpdateData)
+        OpenAPI_hsmf_update_data_free(message->HsmfUpdateData);
+    if (message->HsmfUpdatedData)
+        OpenAPI_hsmf_updated_data_free(message->HsmfUpdatedData);
+    if (message->HsmfUpdateError)
+        OpenAPI_hsmf_update_error_free(message->HsmfUpdateError);
+    if (message->VsmfUpdateData)
+        OpenAPI_vsmf_update_data_free(message->VsmfUpdateData);
+    if (message->VsmfUpdatedData)
+        OpenAPI_vsmf_updated_data_free(message->VsmfUpdatedData);
+    if (message->VsmfUpdateError)
+        OpenAPI_vsmf_update_error_free(message->VsmfUpdateError);
+    if (message->ReleaseData)
+        OpenAPI_release_data_free(message->ReleaseData);
+    if (message->ReleasedData)
+        OpenAPI_released_data_free(message->ReleasedData);
+    if (message->StatusNotification)
+        OpenAPI_status_notification_free(message->StatusNotification);
     if (message->SessionManagementSubscriptionDataList) {
         OpenAPI_lnode_t *node = NULL;
         OpenAPI_list_for_each(message->SessionManagementSubscriptionDataList, node)
@@ -523,6 +551,10 @@
                                 &discovery_option->requester_plmn_list0));
             }
         }
+        if (discovery_option->hnrf_uri) {
+            ogs_sbi_header_set(request->http.params,
+                    OGS_SBI_PARAM_HNRF_URI, discovery_option->hnrf_uri);
+        }
         if (discovery_option->requester_features) {
             char *v = ogs_uint64_to_string(
                     discovery_option->requester_features);
@@ -618,35 +650,55 @@
         ogs_sbi_header_set(request->http.params, OGS_SBI_PARAM_SNSSAI, v);
         ogs_free(v);
     }
-    if (message->param.slice_info_request_for_pdu_session_presence) {
+    if (message->param.slice_info_for_pdu_session_presence) {
         OpenAPI_slice_info_for_pdu_session_t SliceInfoForPDUSession;
-        OpenAPI_snssai_t sNSSAI;
+        OpenAPI_snssai_t sNssai, homeSnssai;
 
         char *v = NULL;
         cJSON *item = NULL;
 
+        if (!message->param.snssai_presence) {
+            ogs_error("No S-NSSAI");
+            ogs_sbi_request_free(request);
+            return NULL;
+        }
         if (!message->param.roaming_indication) {
             ogs_error("No Roaming Indication");
             ogs_sbi_request_free(request);
             return NULL;
         }
 
-        memset(&sNSSAI, 0, sizeof(sNSSAI));
-        sNSSAI.sst = message->param.s_nssai.sst;
-        sNSSAI.sd = ogs_s_nssai_sd_to_string(message->param.s_nssai.sd);
+        memset(&sNssai, 0, sizeof(sNssai));
+        sNssai.sst = message->param.s_nssai.sst;
+        sNssai.sd = ogs_s_nssai_sd_to_string(message->param.s_nssai.sd);
+
+        memset(&homeSnssai, 0, sizeof(homeSnssai));
+        if (message->param.home_snssai_presence) {
+            homeSnssai.sst = message->param.home_snssai.sst;
+            homeSnssai.sd = ogs_s_nssai_sd_to_string(
+                    message->param.home_snssai.sd);
+        }
 
         memset(&SliceInfoForPDUSession, 0, sizeof(SliceInfoForPDUSession));
 
-        SliceInfoForPDUSession.s_nssai = &sNSSAI;
+        SliceInfoForPDUSession.s_nssai = &sNssai;
         SliceInfoForPDUSession.roaming_indication =
             message->param.roaming_indication;
+        if (homeSnssai.sst)
+            SliceInfoForPDUSession.home_snssai = &homeSnssai;
 
         item = OpenAPI_slice_info_for_pdu_session_convertToJSON(
                 &SliceInfoForPDUSession);
         if (!item) {
             ogs_error("OpenAPI_slice_info_for_pdu_session_convertToJSON() "
                     "failed");
+
+            if (sNssai.sd)
+                ogs_free(sNssai.sd);
+            if (homeSnssai.sd)
+                ogs_free(homeSnssai.sd);
             ogs_sbi_request_free(request);
+
             return NULL;
         }
 
@@ -654,6 +706,12 @@
         if (!v) {
             ogs_error("cJSON_PrintUnformatted() failed");
             ogs_sbi_request_free(request);
+
+            if (sNssai.sd)
+                ogs_free(sNssai.sd);
+            if (homeSnssai.sd)
+                ogs_free(homeSnssai.sd);
+
             return NULL;
         }
         cJSON_Delete(item);
@@ -662,8 +720,10 @@
                 OGS_SBI_PARAM_SLICE_INFO_REQUEST_FOR_PDU_SESSION, v);
         ogs_free(v);
 
-        if (sNSSAI.sd)
-            ogs_free(sNSSAI.sd);
+        if (sNssai.sd)
+            ogs_free(sNssai.sd);
+        if (homeSnssai.sd)
+            ogs_free(homeSnssai.sd);
     }
     if (message->param.num_of_fields) {
         char *fields;
@@ -683,7 +743,25 @@
                     OGS_SBI_PARAM_FIELDS, fields);
             ogs_free(fields);
         }
+    }
+    if (message->param.num_of_dataset_names) {
+        char *dataset_names;
+
+        dataset_names = ogs_strdup(message->param.dataset_names0);
+        if (!dataset_names) {
+            ogs_error("ogs_strdup() failed");
+            return NULL;
+        }
+
+        for (i = 1; i < message->param.num_of_dataset_names; i++)
+            dataset_names = ogs_mstrcatf(
+                    dataset_names, ",%s", message->param.dataset_namesi);
 
+        if (dataset_names) {
+            ogs_sbi_header_set(request->http.params,
+                    OGS_SBI_PARAM_DATASET_NAMES, dataset_names);
+            ogs_free(dataset_names);
+        }
     }
     if (message->param.ipv4addr) {
         ogs_sbi_header_set(request->http.params,
@@ -694,6 +772,72 @@
                 OGS_SBI_PARAM_IPV6PREFIX, message->param.ipv6prefix);
     }
 
+    if (message->param.home_plmn_id_presence) {
+        OpenAPI_plmn_id_t home_plmn_id;
+
+        home_plmn_id.mnc = ogs_plmn_id_mnc_string(&message->param.home_plmn_id);
+        home_plmn_id.mcc = ogs_plmn_id_mcc_string(&message->param.home_plmn_id);
+
+        if (home_plmn_id.mnc && home_plmn_id.mcc) {
+            char *v = NULL;
+            cJSON *item = NULL;
+
+            item = OpenAPI_plmn_id_convertToJSON(&home_plmn_id);
+            if (!item) {
+                ogs_error("OpenAPI_plmn_id_convertToJSON() failed");
+                ogs_sbi_request_free(request);
+                return NULL;
+            }
+            if (home_plmn_id.mnc) ogs_free(home_plmn_id.mnc);
+            if (home_plmn_id.mcc) ogs_free(home_plmn_id.mcc);
+
+            v = cJSON_PrintUnformatted(item);
+            if (!v) {
+                ogs_error("cJSON_PrintUnformatted() failed");
+                ogs_sbi_request_free(request);
+                return NULL;
+            }
+            cJSON_Delete(item);
+
+            ogs_sbi_header_set(
+                    request->http.params, OGS_SBI_PARAM_HOME_PLMN_ID, v);
+            ogs_free(v);
+        }
+    }
+
+    if (message->param.tai_presence) {
+        OpenAPI_tai_t tai;
+
+        memset(&tai, 0, sizeof(tai));
+        tai.plmn_id = ogs_sbi_build_plmn_id(&message->param.tai.plmn_id);
+        tai.tac = ogs_uint24_to_0string(message->param.tai.tac);
+
+        if (tai.plmn_id && tai.tac) {
+            char *v = NULL;
+            cJSON *item = NULL;
+
+            item = OpenAPI_tai_convertToJSON(&tai);
+            if (!item) {
+                ogs_error("OpenAPI_tai_convertToJSON() failed");
+                ogs_sbi_request_free(request);
+                return NULL;
+            }
+            if (tai.plmn_id) ogs_sbi_free_plmn_id(tai.plmn_id);
+            if (tai.tac) ogs_free(tai.tac);
+
+            v = cJSON_PrintUnformatted(item);
+            if (!v) {
+                ogs_error("cJSON_PrintUnformatted() failed");
+                ogs_sbi_request_free(request);
+                return NULL;
+            }
+            cJSON_Delete(item);
+
+            ogs_sbi_header_set(request->http.params, OGS_SBI_PARAM_TAI, v);
+            ogs_free(v);
+        }
+    }
+
     if (build_content(&request->http, message) == false) {
         ogs_error("build_content() failed");
         ogs_sbi_request_free(request);
@@ -903,12 +1047,23 @@
                         discovery_option->requester_plmn_list, v);
                 discovery_option_presence = true;
             }
+        } else if (!strcmp(ogs_hash_this_key(hi), OGS_SBI_PARAM_HNRF_URI)) {
+            char *v = ogs_hash_this_val(hi);
+            if (v) {
+                ogs_sbi_discovery_option_set_hnrf_uri(discovery_option, v);
+                discovery_option_presence = true;
+            }
         } else if (!strcmp(ogs_hash_this_key(hi),
                     OGS_SBI_PARAM_REQUESTER_FEATURES)) {
             char *v = ogs_hash_this_val(hi);
             if (v) {
                 discovery_option->requester_features =
                     ogs_uint64_from_string_hexadecimal(v);
+                if (ogs_errno == EINVAL || ogs_errno == ERANGE) {
+                    ogs_error("ogs_uint64_from_string_hexadecimal() failed");
+                    ogs_sbi_discovery_option_free(discovery_option);
+                    return OGS_ERROR;
+                }
                 discovery_option_presence = true;
             }
         }
@@ -970,17 +1125,29 @@
                     SliceInfoForPduSession =
                         OpenAPI_slice_info_for_pdu_session_parseFromJSON(item);
                     if (SliceInfoForPduSession) {
-                        OpenAPI_snssai_t *s_nssai =
-                            SliceInfoForPduSession->s_nssai;
+                        OpenAPI_snssai_t *s_nssai = NULL, *home_snssai = NULL;
+
+                        s_nssai = SliceInfoForPduSession->s_nssai;
                         if (s_nssai) {
                             message->param.s_nssai.sst = s_nssai->sst;
                             message->param.s_nssai.sd =
                                 ogs_s_nssai_sd_from_string(s_nssai->sd);
+                            message->param.snssai_presence = true;
                         }
+
                         message->param.roaming_indication =
                             SliceInfoForPduSession->roaming_indication;
+
+                        home_snssai = SliceInfoForPduSession->home_snssai;
+                        if (home_snssai) {
+                            message->param.home_snssai.sst = home_snssai->sst;
+                            message->param.home_snssai.sd =
+                                ogs_s_nssai_sd_from_string(home_snssai->sd);
+                            message->param.home_snssai_presence = true;
+                        }
+
                         message->param.
-                            slice_info_request_for_pdu_session_presence = true;
+                            slice_info_for_pdu_session_presence = true;
 
                         OpenAPI_slice_info_for_pdu_session_free(
                                 SliceInfoForPduSession);
@@ -1013,10 +1180,80 @@
             }
 
             ogs_free(v);
+        } else if (!strcmp(ogs_hash_this_key(hi),
+                OGS_SBI_PARAM_DATASET_NAMES)) {
+            char *_v = ogs_hash_this_val(hi), *v = NULL;
+            char *token = NULL;
+            char *saveptr = NULL;
+
+            v = ogs_strdup(_v);
+            ogs_assert(v);
+
+            token = ogs_strtok_r(v, ",", &saveptr);
+            while (token != NULL) {
+                if (message->param.num_of_dataset_names <
+                        OGS_SBI_MAX_NUM_OF_DATASETNAMES) {
+                    message->param.dataset_names
+                        message->param.num_of_dataset_names =
+                                ogs_strdup(token);
+                    ogs_assert(message->param.dataset_names
+                        message->param.num_of_dataset_names);
+                    message->param.num_of_dataset_names++;
+                    token = ogs_strtok_r(NULL, ",", &saveptr);
+                } else {
+                    ogs_error("Datasetnames in query exceeds "
+                                "MAX_NUM_OF_DATASETNAMES");
+                    break;
+                }
+            }
+
+            ogs_free(v);
         } else if (!strcmp(ogs_hash_this_key(hi), OGS_SBI_PARAM_IPV4ADDR)) {
             message->param.ipv4addr = ogs_hash_this_val(hi);
         } else if (!strcmp(ogs_hash_this_key(hi), OGS_SBI_PARAM_IPV6PREFIX)) {
             message->param.ipv6prefix = ogs_hash_this_val(hi);
+        } else if (!strcmp(ogs_hash_this_key(hi), OGS_SBI_PARAM_HOME_PLMN_ID)) {
+            char *v = NULL;
+            cJSON *item = NULL;
+            OpenAPI_plmn_id_t *home_plmn_id = NULL;
+
+            v = ogs_hash_this_val(hi);
+            if (v) {
+                item = cJSON_Parse(v);
+                if (item) {
+                    home_plmn_id = OpenAPI_plmn_id_parseFromJSON(item);
+                    if (home_plmn_id &&
+                            home_plmn_id->mnc && home_plmn_id->mcc) {
+                        ogs_plmn_id_build(&message->param.home_plmn_id,
+                            atoi(home_plmn_id->mcc),
+                            atoi(home_plmn_id->mnc), strlen(home_plmn_id->mnc));
+                        message->param.home_plmn_id_presence = true;
+                        OpenAPI_plmn_id_free(home_plmn_id);
+                    }
+                    cJSON_Delete(item);
+                }
+            }
+        } else if (!strcmp(ogs_hash_this_key(hi), OGS_SBI_PARAM_TAI)) {
+            char *v = NULL;
+            cJSON *item = NULL;
+            OpenAPI_tai_t *tai = NULL;
+
+            v = ogs_hash_this_val(hi);
+            if (v) {
+                item = cJSON_Parse(v);
+                if (item) {
+                    tai = OpenAPI_tai_parseFromJSON(item);
+                    if (tai && tai->plmn_id && tai->tac) {
+                        ogs_sbi_parse_plmn_id(
+                                &message->param.tai.plmn_id, tai->plmn_id);
+                        message->param.tai.tac =
+                            ogs_uint24_from_string_hexadecimal(tai->tac);
+                        message->param.tai_presence = true;
+                        OpenAPI_tai_free(tai);
+                    }
+                    cJSON_Delete(item);
+                }
+            }
         }
     }
 
@@ -1049,7 +1286,6 @@
 
     if (parse_content(message, &request->http) != OGS_OK) {
         ogs_error("parse_content() failed");
-        ogs_sbi_message_free(message);
         return OGS_ERROR;
     }
 
@@ -1278,6 +1514,10 @@
     } else if (message->SmfRegistration) {
         item = OpenAPI_smf_registration_convertToJSON(message->SmfRegistration);
         ogs_assert(item);
+    } else if (message->ProvisionedDataSets) {
+        item = OpenAPI_provisioned_data_sets_convertToJSON(
+                message->ProvisionedDataSets);
+        ogs_assert(item);
     } else if (message->Nssai) {
         item = OpenAPI_nssai_convertToJSON(message->Nssai);
         ogs_assert(item);
@@ -1325,6 +1565,52 @@
         item = OpenAPI_sm_context_released_data_convertToJSON(
                 message->SmContextReleasedData);
         ogs_assert(item);
+    } else if (message->PduSessionCreateData) {
+        item = OpenAPI_pdu_session_create_data_convertToJSON(
+                message->PduSessionCreateData);
+        ogs_assert(item);
+    } else if (message->PduSessionCreatedData) {
+        item = OpenAPI_pdu_session_created_data_convertToJSON(
+                message->PduSessionCreatedData);
+        ogs_assert(item);
+    } else if (message->PduSessionCreateError) {
+        item = OpenAPI_pdu_session_create_error_convertToJSON(
+                message->PduSessionCreateError);
+        ogs_assert(item);
+    } else if (message->HsmfUpdateData) {
+        item = OpenAPI_hsmf_update_data_convertToJSON(
+                message->HsmfUpdateData);
+        ogs_assert(item);
+    } else if (message->HsmfUpdatedData) {
+        item = OpenAPI_hsmf_updated_data_convertToJSON(
+                message->HsmfUpdatedData);
+        ogs_assert(item);
+    } else if (message->HsmfUpdateError) {
+        item = OpenAPI_hsmf_update_error_convertToJSON(
+                message->HsmfUpdateError);
+        ogs_assert(item);
+    } else if (message->VsmfUpdateData) {
+        item = OpenAPI_vsmf_update_data_convertToJSON(
+                message->VsmfUpdateData);
+        ogs_assert(item);
+    } else if (message->VsmfUpdatedData) {
+        item = OpenAPI_vsmf_updated_data_convertToJSON(
+                message->VsmfUpdatedData);
+        ogs_assert(item);
+    } else if (message->VsmfUpdateError) {
+        item = OpenAPI_vsmf_update_error_convertToJSON(
+                message->VsmfUpdateError);
+        ogs_assert(item);
+    } else if (message->ReleaseData) {
+        item = OpenAPI_release_data_convertToJSON(message->ReleaseData);
+        ogs_assert(item);
+    } else if (message->ReleasedData) {
+        item = OpenAPI_released_data_convertToJSON(message->ReleasedData);
+        ogs_assert(item);
+    } else if (message->StatusNotification) {
+        item = OpenAPI_status_notification_convertToJSON(
+                message->StatusNotification);
+        ogs_assert(item);
     } else if (message->SessionManagementSubscriptionDataList) {
         OpenAPI_lnode_t *node = NULL;
 
@@ -1934,6 +2220,20 @@
                 DEFAULT
                     SWITCH(message->h.resource.component3)
                     CASE(OGS_SBI_RESOURCE_NAME_PROVISIONED_DATA)
+                        if (!message->h.resource.component4) {
+                            if (message->res_status < 300) {
+                                message->ProvisionedDataSets =
+                                    OpenAPI_provisioned_data_sets_parseFromJSON(item);
+                                if (!message->ProvisionedDataSets) {
+                                    rv = OGS_ERROR;
+                                    ogs_error("JSON parse error");
+                                }
+                            } else {
+                                ogs_error("HTTP ERROR Status : %d",
+                                        message->res_status);
+                            }
+                            break;
+                        }
                         SWITCH(message->h.resource.component4)
                         CASE(OGS_SBI_RESOURCE_NAME_AM_DATA)
                             if (message->res_status < 300) {
@@ -2172,6 +2472,153 @@
                 END
                 break;
 
+            CASE(OGS_SBI_RESOURCE_NAME_PDU_SESSIONS)
+                SWITCH(message->h.resource.component2)
+                CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
+                    if (message->res_status == 0) {
+                        message->HsmfUpdateData =
+                            OpenAPI_hsmf_update_data_parseFromJSON(item);
+                        if (!message->HsmfUpdateData) {
+                            rv = OGS_ERROR;
+                            ogs_error("JSON parse error");
+                        }
+                    } else if (message->res_status == OGS_SBI_HTTP_STATUS_OK) {
+                        message->HsmfUpdatedData =
+                            OpenAPI_hsmf_updated_data_parseFromJSON(item);
+                        if (!message->HsmfUpdatedData) {
+                            rv = OGS_ERROR;
+                            ogs_error("JSON parse error");
+                        }
+                    } else if (message->res_status ==
+                            OGS_SBI_HTTP_STATUS_BAD_REQUEST ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_FORBIDDEN ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_NOT_FOUND ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_INTERNAL_SERVER_ERROR ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_SERVICE_UNAVAILABLE ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_GATEWAY_TIMEOUT) {
+                        message->HsmfUpdateError =
+                            OpenAPI_hsmf_update_error_parseFromJSON(item);
+                        if (!message->HsmfUpdateError) {
+                            rv = OGS_ERROR;
+                            ogs_error("JSON parse error");
+                        }
+                    }
+                    break;
+                CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
+                    if (message->res_status == 0) {
+                        message->ReleaseData =
+                            OpenAPI_release_data_parseFromJSON(item);
+                        if (!message->ReleaseData) {
+                            rv = OGS_ERROR;
+                            ogs_error("JSON parse error");
+                        }
+                    } else if (message->res_status ==
+                            OGS_SBI_HTTP_STATUS_NO_CONTENT) {
+                    } else if (message->res_status == OGS_SBI_HTTP_STATUS_OK) {
+                        message->ReleasedData =
+                            OpenAPI_released_data_parseFromJSON(item);
+                        if (!message->ReleasedData) {
+                            rv = OGS_ERROR;
+                            ogs_error("JSON parse error");
+                        }
+                    }
+                    break;
+                DEFAULT
+                    if (message->res_status == 0) {
+                        message->PduSessionCreateData =
+                            OpenAPI_pdu_session_create_data_parseFromJSON(item);
+                        if (!message->PduSessionCreateData) {
+                            rv = OGS_ERROR;
+                            ogs_error("JSON parse error");
+                        }
+                    } else if (message->res_status ==
+                            OGS_SBI_HTTP_STATUS_CREATED) {
+                        message->PduSessionCreatedData =
+                            OpenAPI_pdu_session_created_data_parseFromJSON(
+                                    item);
+                        if (!message->PduSessionCreatedData) {
+                            rv = OGS_ERROR;
+                            ogs_error("JSON parse error");
+                        }
+                    } else if (message->res_status ==
+                            OGS_SBI_HTTP_STATUS_BAD_REQUEST ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_FORBIDDEN ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_NOT_FOUND ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_INTERNAL_SERVER_ERROR ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_SERVICE_UNAVAILABLE ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_GATEWAY_TIMEOUT) {
+                        message->PduSessionCreateError =
+                            OpenAPI_pdu_session_create_error_parseFromJSON(
+                                    item);
+                        if (!message->PduSessionCreateError) {
+                            rv = OGS_ERROR;
+                            ogs_error("JSON parse error");
+                        }
+                    }
+                END
+                break;
+            CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+                SWITCH(message->h.resource.component2)
+                CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
+                    if (message->res_status == 0) {
+                        message->VsmfUpdateData =
+                            OpenAPI_vsmf_update_data_parseFromJSON(item);
+                        if (!message->VsmfUpdateData) {
+                            rv = OGS_ERROR;
+                            ogs_error("JSON parse error");
+                        }
+                    } else if (message->res_status == OGS_SBI_HTTP_STATUS_OK) {
+                        message->VsmfUpdatedData =
+                            OpenAPI_vsmf_updated_data_parseFromJSON(item);
+                        if (!message->VsmfUpdatedData) {
+                            rv = OGS_ERROR;
+                            ogs_error("JSON parse error");
+                        }
+                    } else if (message->res_status ==
+                            OGS_SBI_HTTP_STATUS_BAD_REQUEST ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_FORBIDDEN ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_NOT_FOUND ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_INTERNAL_SERVER_ERROR ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_SERVICE_UNAVAILABLE ||
+                                message->res_status ==
+                                    OGS_SBI_HTTP_STATUS_GATEWAY_TIMEOUT) {
+                        message->VsmfUpdateError =
+                            OpenAPI_vsmf_update_error_parseFromJSON(item);
+                        if (!message->VsmfUpdateError) {
+                            rv = OGS_ERROR;
+                            ogs_error("JSON parse error");
+                        }
+                    }
+                    break;
+                DEFAULT
+                    if (message->res_status < 300) {
+                        message->StatusNotification =
+                            OpenAPI_status_notification_parseFromJSON(item);
+                        if (!message->StatusNotification) {
+                            rv = OGS_ERROR;
+                            ogs_error("JSON parse error");
+                        }
+                    } else {
+                        ogs_error("HTTP ERROR Status : %d",
+                                message->res_status);
+                    }
+                END
+                break;
+
             DEFAULT
                 rv = OGS_ERROR;
                 ogs_error("Unknown resource name %s",
@@ -2677,18 +3124,41 @@
     return true;
 }
 
+typedef struct multipart_part_data_s {
+    char *content_type;
+    char *content_id;
+    char *content;
+    size_t content_length;
+} multipart_part_data_t;
+
 typedef struct multipart_parser_data_s {
     int num_of_part;
-    struct {
-        char *content_type;
-        char *content_id;
-        char *content;
-        size_t content_length;
-    } partOGS_SBI_MAX_NUM_OF_PART;
+    multipart_part_data_t partOGS_SBI_MAX_NUM_OF_PART;
+
+    bool parse_error;
 
     char *header_field;
 } multipart_parser_data_t;
 
+static void multipart_parser_data_free(multipart_parser_data_t *data)
+{
+    int i;
+
+    ogs_assert(data);
+
+    for (i = 0; i < OGS_SBI_MAX_NUM_OF_PART; i++) {
+        if (data->parti.content_type)
+            ogs_free(data->parti.content_type);
+        if (data->parti.content_id)
+            ogs_free(data->parti.content_id);
+        if (data->parti.content)
+            ogs_free(data->parti.content);
+    }
+
+    if (data->header_field)
+        ogs_free(data->header_field);
+}
+
 static int on_header_field(
         multipart_parser *parser, const char *at, size_t length)
 {
@@ -2763,7 +3233,7 @@
                     ogs_error("Overflow length %d:%d",
                         (int)data->partdata->num_of_part.content_length,
                         (int)length);
-                    ogs_assert_if_reached();
+                    data->parse_error = true;
                     return 0;
                 }
                 data->partdata->num_of_part.content_length += length;
@@ -2805,7 +3275,8 @@
         ogs_sbi_message_t *message, ogs_sbi_http_message_t *http)
 {
     char *boundary = NULL;
-    int i, preamble;
+    int i, preamble, rv;
+    size_t parsed;
 
     multipart_parser_settings settings;
     multipart_parser_data_t data;
@@ -2820,6 +3291,12 @@
         return OGS_ERROR;
     }
 
+    if (http->content_length < 2) {
+        ogs_error("Invalid HTTP content_length %d",
+                (int)http->content_length);
+        return OGS_ERROR;
+    }
+
     memset(&settings, 0, sizeof(settings));
     settings.on_header_field = &on_header_field;
     settings.on_header_value = &on_header_value;
@@ -2850,17 +3327,40 @@
 
     memset(&data, 0, sizeof(data));
     multipart_parser_set_data(parser, &data);
-    multipart_parser_execute(parser,
+    parsed = multipart_parser_execute(parser,
             http->content+preamble, http->content_length-preamble);
 
-    multipart_parser_free(parser);
-    ogs_free(boundary);
+    rv = OGS_ERROR;
+
+    if (parsed != (http->content_length - preamble) || data.parse_error) {
+        ogs_error("Multipart parse failed %d:%d,len:%d,preamble:%d,err:%d",
+                (int)parsed, (int)(http->content_length - preamble),
+                (int)http->content_length, preamble, data.parse_error);
+        ogs_log_hexdump(OGS_LOG_ERROR,
+                (unsigned char *)http->content, http->content_length);
+        goto cleanup;
+    }
 
     if (data.num_of_part > OGS_SBI_MAX_NUM_OF_PART) {
         /* Overflow Issues #1247 */
-        ogs_fatal("Overflow num_of_part%d", data.num_of_part);
-        ogs_assert_if_reached();
+        ogs_error("Overflow num_of_part%d", data.num_of_part);
+        ogs_log_hexdump(OGS_LOG_ERROR,
+                (unsigned char *)http->content, http->content_length);
+        goto cleanup;
     }
+
+    rv = OGS_OK;
+
+cleanup:
+
+    multipart_parser_free(parser);
+    ogs_free(boundary);
+
+    if (rv != OGS_OK) {
+        multipart_parser_data_free(&data);
+        return OGS_ERROR;
+    }
+
     for (i = 0; i < data.num_of_part; i++) {
         SWITCH(data.parti.content_type)
         CASE(OGS_SBI_CONTENT_JSON_TYPE)
@@ -3075,6 +3575,9 @@
     for (i = 0; i < discovery_option->num_of_service_names; i++)
         ogs_free(discovery_option->service_namesi);
 
+    if (discovery_option->hnrf_uri)
+        ogs_free(discovery_option->hnrf_uri);
+
     ogs_free(discovery_option);
 }
 
@@ -3585,3 +4088,22 @@
 
     return num_of_plmn_list;
 }
+
+void ogs_sbi_discovery_option_set_hnrf_uri(
+        ogs_sbi_discovery_option_t *discovery_option, char *hnrf_uri)
+{
+    ogs_assert(discovery_option);
+    ogs_assert(hnrf_uri);
+
+    ogs_assert(!discovery_option->hnrf_uri);
+    discovery_option->hnrf_uri = ogs_strdup(hnrf_uri);
+    ogs_assert(discovery_option->hnrf_uri);
+}
+
+void ogs_sbi_discovery_option_clear_hnrf_uri(
+        ogs_sbi_discovery_option_t *discovery_option)
+{
+    ogs_assert(discovery_option);
+    ogs_free(discovery_option->hnrf_uri);
+    discovery_option->hnrf_uri = NULL;
+}

open5gs_2.7.6.tar.xz/lib/sbi/message.h -> open5gs_2.7.7.tar.xz/lib/sbi/message.h Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -120,6 +120,9 @@
 #define OGS_SBI_RESOURCE_NAME_MODIFY                "modify"
 #define OGS_SBI_RESOURCE_NAME_RELEASE               "release"
 
+#define OGS_SBI_RESOURCE_NAME_PDU_SESSIONS          "pdu-sessions"
+#define OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS     "vsmf-pdu-session"
+
 #define OGS_SBI_RESOURCE_NAME_SM_POLICY_NOTIFY      "sm-policy-notify"
 #define OGS_SBI_RESOURCE_NAME_N1_N2_FAILURE_NOTIFY  "n1-n2-failure-notify"
 
@@ -308,6 +311,8 @@
     OGS_SBI_CUSTOM_DISCOVERY_COMMON OGS_SBI_PARAM_REQUESTER_FEATURES
 #define OGS_SBI_CUSTOM_DISCOVERY_GUAMI  \
     OGS_SBI_CUSTOM_DISCOVERY_COMMON OGS_SBI_PARAM_GUAMI
+#define OGS_SBI_CUSTOM_DISCOVERY_HNRF_URI  \
+    OGS_SBI_CUSTOM_DISCOVERY_COMMON OGS_SBI_PARAM_HNRF_URI
 #define OGS_SBI_CUSTOM_PRODUCER_ID       \
     OGS_SBI_CUSTOM_3GPP_COMMON "Producer-Id"
 #define OGS_SBI_CUSTOM_OCI               \
@@ -349,14 +354,22 @@
 #define OGS_SBI_PARAM_SLICE_INFO_REQUEST_FOR_PDU_SESSION \
         "slice-info-request-for-pdu-session"
 #define OGS_SBI_PARAM_FIELDS                        "fields"
+#define OGS_SBI_PARAM_DATASET_NAMES                 "dataset-names"
 #define OGS_SBI_PARAM_IPV4ADDR                      "ipv4Addr"
 #define OGS_SBI_PARAM_IPV6PREFIX                    "ipv6Prefix"
+#define OGS_SBI_PARAM_HOME_PLMN_ID                  "home-plmn-id"
+#define OGS_SBI_PARAM_HNRF_URI                      "hnrf-uri"
 
 #define OGS_SBI_PARAM_FIELDS_GPSIS                       "gpsis"
 #define OGS_SBI_PARAM_FIELDS_SUBSCRIBED_UE_AMBR          "subscribedUeAmbr"
 #define OGS_SBI_PARAM_FIELDS_NSSAI                       "nssai"
 #define OGS_SBI_MAX_NUM_OF_FIELDS                         8
 
+#define OGS_SBI_PARAM_DATASET_NAME_AM                    "AM"
+#define OGS_SBI_PARAM_DATASET_NAME_SMF_SEL               "SMF_SEL"
+#define OGS_SBI_PARAM_DATASET_NAME_SM                    "SM"
+#define OGS_SBI_MAX_NUM_OF_DATASETNAMES                   8
+
 #define OGS_SBI_CONTENT_JSON_TYPE                   \
     OGS_SBI_APPLICATION_TYPE "/" OGS_SBI_APPLICATION_JSON_TYPE
 #define OGS_SBI_CONTENT_PROBLEM_TYPE                \
@@ -461,6 +474,8 @@
     int num_of_requester_plmn_list;
     ogs_plmn_id_t requester_plmn_listOGS_MAX_NUM_OF_PLMN;
 
+    char *hnrf_uri;
+
     uint64_t requester_features;
 } ogs_sbi_discovery_option_t;
 
@@ -495,19 +510,29 @@
         char *dnn;
         int num_of_fields;
         char *fieldsOGS_SBI_MAX_NUM_OF_FIELDS;
+        int num_of_dataset_names;
+        char *dataset_namesOGS_SBI_MAX_NUM_OF_DATASETNAMES;
 
         /* Shared memory */
+        bool plmn_id_presence;
         ogs_plmn_id_t plmn_id;
-        ogs_s_nssai_t s_nssai;
 
-        bool plmn_id_presence;
         bool single_nssai_presence;
         bool snssai_presence;
-        bool slice_info_request_for_pdu_session_presence;
+        ogs_s_nssai_t s_nssai;
+
+        bool slice_info_for_pdu_session_presence;
         OpenAPI_roaming_indication_e roaming_indication;
+        bool home_snssai_presence;
+        ogs_s_nssai_t home_snssai;
 
         char *ipv4addr;
         char *ipv6prefix;
+
+        bool home_plmn_id_presence;
+        ogs_plmn_id_t home_plmn_id;
+        bool tai_presence;
+        ogs_5gs_tai_t tai;
     } param;
 
     int res_status;
@@ -530,6 +555,7 @@
     OpenAPI_amf3_gpp_access_registration_t *Amf3GppAccessRegistration;
     OpenAPI_amf3_gpp_access_registration_modification_t
         *Amf3GppAccessRegistrationModification;
+    OpenAPI_provisioned_data_sets_t *ProvisionedDataSets;
     OpenAPI_nssai_t *Nssai;
     OpenAPI_access_and_mobility_subscription_data_t
         *AccessAndMobilitySubscriptionData;
@@ -543,6 +569,18 @@
     OpenAPI_sm_context_update_error_t *SmContextUpdateError;
     OpenAPI_sm_context_release_data_t *SmContextReleaseData;
     OpenAPI_sm_context_released_data_t *SmContextReleasedData;
+    OpenAPI_pdu_session_create_data_t *PduSessionCreateData;
+    OpenAPI_pdu_session_created_data_t *PduSessionCreatedData;
+    OpenAPI_pdu_session_create_error_t *PduSessionCreateError;
+    OpenAPI_hsmf_update_data_t *HsmfUpdateData;
+    OpenAPI_hsmf_updated_data_t *HsmfUpdatedData;
+    OpenAPI_hsmf_update_error_t *HsmfUpdateError;
+    OpenAPI_vsmf_update_data_t *VsmfUpdateData;
+    OpenAPI_vsmf_updated_data_t *VsmfUpdatedData;
+    OpenAPI_vsmf_update_error_t *VsmfUpdateError;
+    OpenAPI_release_data_t *ReleaseData;
+    OpenAPI_released_data_t *ReleasedData;
+    OpenAPI_status_notification_t *StatusNotification;
     OpenAPI_list_t *SessionManagementSubscriptionDataList;
     OpenAPI_n1_n2_message_transfer_req_data_t *N1N2MessageTransferReqData;
     OpenAPI_n1_n2_message_transfer_rsp_data_t *N1N2MessageTransferRspData;
@@ -699,6 +737,11 @@
 int ogs_sbi_discovery_option_parse_plmn_list(
         ogs_plmn_id_t *plmn_list, char *v);
 
+void ogs_sbi_discovery_option_set_hnrf_uri(
+        ogs_sbi_discovery_option_t *discovery_option, char *hnrf_uri);
+void ogs_sbi_discovery_option_clear_hnrf_uri(
+        ogs_sbi_discovery_option_t *discovery_option);
+
 #ifdef __cplusplus
 }
 #endif

open5gs_2.7.6.tar.xz/lib/sbi/mhd-server.c -> open5gs_2.7.7.tar.xz/lib/sbi/mhd-server.c Changed

@@ -142,7 +142,8 @@
     sbi_sess->connection = connection;
 
     sbi_sess->timer = ogs_timer_add(
-            ogs_app()->timer_mgr, session_timer_expired, sbi_sess);
+            ogs_app()->timer_mgr, session_timer_expired,
+            OGS_UINT_TO_POINTER(sbi_sess->id));
     if (!sbi_sess->timer) {
         ogs_error("ogs_timer_add() failed");
         ogs_pool_id_free(&session_pool, sbi_sess);
@@ -183,15 +184,22 @@
 
 static void session_timer_expired(void *data)
 {
-    ogs_sbi_session_t *sbi_sess = data;
+    ogs_pool_id_t sbi_sess_id = OGS_POINTER_TO_UINT(data);
+    ogs_sbi_session_t *sbi_sess = NULL;
 
-    ogs_assert(sbi_sess);
+    if (sbi_sess_id >= OGS_MIN_POOL_ID && sbi_sess_id <= OGS_MAX_POOL_ID)
+        sbi_sess = ogs_pool_find_by_id(&session_pool, sbi_sess_id);
+    else
+        ogs_error("Invalid Session ID %d", sbi_sess_id);
 
     ogs_fatal("An HTTP request was received, "
                 "but the HTTP response is missing.");
     ogs_fatal("Please send the related pcap files for this case.");
 
-    session_remove(sbi_sess);
+    if (sbi_sess)
+        session_remove(sbi_sess);
+    else
+        ogs_error("No Session Context");
 
     ogs_assert_if_reached();
 }

open5gs_2.7.6.tar.xz/lib/sbi/nf-sm.c -> open5gs_2.7.7.tar.xz/lib/sbi/nf-sm.c Changed

@@ -275,6 +275,52 @@
     }
 }
 
+static bool nf_status_subscription_exists(
+        const char *req_nf_instance_id,
+        OpenAPI_nf_type_e nf_type,
+        const char *service_name)
+{
+    ogs_sbi_subscription_data_t *s = NULL;
+    bool same_nf_type = false;
+    bool same_service_name = false;
+    bool nf_type_present = false;
+    bool service_name_present = false;
+
+    ogs_assert(req_nf_instance_id);
+
+    nf_type_present = (nf_type != OpenAPI_nf_type_NULL);
+    service_name_present = (service_name != NULL);
+
+    ogs_list_for_each(&ogs_sbi_self()->subscription_data_list, s) {
+        if (!s->req_nf_instance_id)
+            continue;
+
+        if (strcmp(s->req_nf_instance_id, req_nf_instance_id) != 0)
+            continue;
+
+        if (s->flags & OGS_SBI_SUBSCRIPTION_DELETE_SENT)
+            continue;
+
+        same_nf_type = false;
+        same_service_name = false;
+
+        if (nf_type_present &&
+            s->subscr_cond.nf_type != OpenAPI_nf_type_NULL &&
+            s->subscr_cond.nf_type == nf_type)
+            same_nf_type = true;
+
+        if (service_name_present &&
+            s->subscr_cond.service_name &&
+            strcmp(s->subscr_cond.service_name, service_name) == 0)
+            same_service_name = true;
+
+        if (same_nf_type || same_service_name)
+            return true;
+    }
+
+    return false;
+}
+
 void ogs_sbi_nf_state_registered(ogs_fsm_t *s, ogs_event_t *e)
 {
     ogs_sbi_nf_instance_t *nf_instance = NULL;
@@ -308,6 +354,15 @@
 
             ogs_list_for_each(
                 &ogs_sbi_self()->subscription_spec_list, subscription_spec) {
+                if (nf_status_subscription_exists(
+                            ogs_sbi_self()->nf_instance->id,
+                            subscription_spec->subscr_cond.nf_type,
+                            subscription_spec->subscr_cond.service_name)) {
+                    ogs_warn("%s NF status subscription already exists, skip",
+                            ogs_sbi_self()->nf_instance->id);
+                    continue;
+                }
+
                 ogs_nnrf_nfm_send_nf_status_subscribe(
                         ogs_sbi_self()->nf_instance->nf_type,
                         ogs_sbi_self()->nf_instance->id,
@@ -432,6 +487,20 @@
                     NF_INSTANCE_ID(ogs_sbi_self()->nf_instance),
                     OpenAPI_nf_type_ToString(
                         NF_INSTANCE_TYPE(ogs_sbi_self()->nf_instance)));
+
+
+        /*
+         * In case of NF re-registration due to heartbeat loss, clear any
+         * local subscription bookkeeping tied to the current NF instance id.
+         *
+         * This prevents unbounded growth of subscription_data entries when
+         * re-registration and re-subscription loops happen (e.g., docker-compose
+         * timing/race), which could otherwise exhaust subscription_data_pool.
+         */
+            if (ogs_sbi_self()->nf_instance && ogs_sbi_self()->nf_instance->id)
+                ogs_sbi_subscription_data_delete_and_remove_all_by_nf_instance_id(
+                        ogs_sbi_self()->nf_instance->id);
+
             OGS_FSM_TRAN(s, &ogs_sbi_nf_state_will_register);
             break;

open5gs_2.7.6.tar.xz/lib/sbi/nghttp2-server.c -> open5gs_2.7.7.tar.xz/lib/sbi/nghttp2-server.c Changed

@@ -1397,6 +1397,21 @@
 
         j = 0;
         while(paramsj.key && paramsj.val) {
+            if (j >= MAX_NUM_OF_PARAM_IN_QUERY) {
+                ogs_error("Too many query params (max=%d)",
+                        MAX_NUM_OF_PARAM_IN_QUERY);
+                ogs_sbi_server_send_error(stream,
+                        OGS_SBI_HTTP_STATUS_BAD_REQUEST, NULL,
+                        "Too many query parameters", NULL, NULL);
+
+                ogs_free(query);
+
+                ogs_free(namestr);
+                ogs_free(valuestr);
+
+                return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
+            }
+
             if (strlen(paramsj.key))
                 ogs_sbi_header_set(request->http.params,
                         paramsj.key, paramsj.val);
@@ -1406,12 +1421,6 @@
             j++;
         }
 
-        if (j >= MAX_NUM_OF_PARAM_IN_QUERY+1) {
-            ogs_fatal("Maximum number(%d) of query params reached",
-                    MAX_NUM_OF_PARAM_IN_QUERY);
-            ogs_assert_if_reached();
-        }
-
         ogs_free(query);
 
     } else if (namebuf.len == sizeof(METHOD) - 1 &&
@@ -1439,6 +1448,7 @@
 {
     ogs_sbi_stream_t *stream = NULL;
     ogs_sbi_request_t *request = NULL;
+    char *content = NULL;
 
     size_t offset = 0;
 
@@ -1456,28 +1466,48 @@
     ogs_assert(data);
     ogs_assert(len);
 
+#define MAX_HTTP_CONTENT_LEN (256 * 1024 * 1024) /* 256MB */
+    if (request->http.content_length + len > MAX_HTTP_CONTENT_LEN) {
+        stream->memory_overflow = true;
+
+        ogs_error("Payload too large : Content-Length%d, len%d",
+                    (int)request->http.content_length, (int)len);
+
+        ogs_sbi_server_send_error(stream,
+                OGS_SBI_HTTP_STATUS_PAYLOAD_TOO_LARGE,
+                NULL, "Payload too large", NULL, NULL);
+
+        return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
+    }
+
     if (request->http.content == NULL) {
         ogs_assert(request->http.content_length == 0);
         ogs_assert(offset == 0);
 
-        request->http.content = (char*)ogs_malloc(len + 1);
+        content = (char*)ogs_malloc(len + 1);
     } else {
         ogs_assert(request->http.content_length != 0);
 
-        request->http.content = (char*)ogs_realloc(
+        content = (char*)ogs_realloc(
                 request->http.content, request->http.content_length + len + 1);
     }
 
-    if (!request->http.content) {
+    if (!content) {
         stream->memory_overflow = true;
 
-        ogs_error("Overflow : Content-Length%d, len%d",
+        ogs_error("Memory Overflow : Content-Length%d, len%d",
                     (int)request->http.content_length, (int)len);
         ogs_log_hexdump(OGS_LOG_ERROR, data, len);
 
-        return 0;
+        ogs_sbi_server_send_error(stream,
+                OGS_SBI_HTTP_STATUS_SERVICE_UNAVAILABLE,
+                NULL, "Memory Overflow", NULL, NULL);
+
+        return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
     }
 
+    request->http.content = content;
+
     offset = request->http.content_length;
     request->http.content_length += len;

open5gs_2.7.6.tar.xz/lib/sbi/nnrf-handler.c -> open5gs_2.7.7.tar.xz/lib/sbi/nnrf-handler.c Changed

@@ -50,7 +50,7 @@
         nf_instance->time.heartbeat_interval = NFProfile->heart_beat_timer;
 
     if (NFProfile->plmn_list) {
-        nf_instance->num_of_plmn_id = 0;
+        ogs_local_conf()->num_of_serving_plmn_id = 0;
         OpenAPI_list_for_each(NFProfile->plmn_list, node) {
             OpenAPI_plmn_id_t *PlmnId = node->data;
             if (PlmnId) {
@@ -418,7 +418,11 @@
     OpenAPI_list_for_each(sNssaiSmfInfoList, node) {
         sNssaiSmfInfoItem = node->data;
         if (sNssaiSmfInfoItem) {
-            ogs_assert(nf_info->smf.num_of_slice < OGS_MAX_NUM_OF_SLICE);
+            if (nf_info->smf.num_of_slice >= OGS_MAX_NUM_OF_SLICE) {
+                ogs_error("OVERFLOW Slice %d:%d",
+                        nf_info->smf.num_of_slice, OGS_MAX_NUM_OF_SLICE);
+                break;
+            }
 
             DnnSmfInfoList = sNssaiSmfInfoItem->dnn_smf_info_list;
             OpenAPI_list_for_each(DnnSmfInfoList, node2) {
@@ -467,7 +471,11 @@
         TaiItem = node->data;
         if (TaiItem && TaiItem->plmn_id && TaiItem->tac) {
             ogs_5gs_tai_t *nr_tai = NULL;
-            ogs_assert(nf_info->smf.num_of_nr_tai < OGS_MAX_NUM_OF_TAI);
+            if (nf_info->smf.num_of_nr_tai >= OGS_MAX_NUM_OF_TAI) {
+                ogs_error("OVERFLOW TAI %d:%d",
+                        nf_info->smf.num_of_nr_tai, OGS_MAX_NUM_OF_TAI);
+                break;
+            }
 
             nr_tai = &nf_info->smf.nr_tainf_info->smf.num_of_nr_tai;
             ogs_assert(nr_tai);
@@ -502,7 +510,11 @@
                         TacRangeItem->start && TacRangeItem->end) {
                     int tac_index = nf_info->smf.nr_tai_range
                         nf_info->smf.num_of_nr_tai_range.num_of_tac_range;
-                    ogs_assert(tac_index < OGS_MAX_NUM_OF_TAI);
+                    if (tac_index >= OGS_MAX_NUM_OF_TAI) {
+                        ogs_error("OVERFLOW TAI %d:%d",
+                                tac_index, OGS_MAX_NUM_OF_TAI);
+                        break;
+                    }
 
                     nf_info->smf.nr_tai_range
                         nf_info->smf.num_of_nr_tai_range.
@@ -615,7 +627,8 @@
         }
     }
 
-    if (scp_info.http.presence || scp_info.https.presence) {
+    if (scp_info.http.presence || scp_info.https.presence ||
+        scp_info.num_of_domain) {
         nf_info = ogs_sbi_nf_info_add(
                 &nf_instance->nf_info_list, OpenAPI_nf_type_SCP);
         ogs_assert(nf_info);
@@ -714,7 +727,11 @@
     OpenAPI_list_for_each(GuamiList, node) {
         GuamiAmfInfoItem = node->data;
         if (GuamiAmfInfoItem) {
-            ogs_assert(nf_info->amf.num_of_guami < OGS_MAX_NUM_OF_SERVED_GUAMI);
+            if (nf_info->amf.num_of_guami >= OGS_MAX_NUM_OF_SERVED_GUAMI) {
+                ogs_error("OVERFLOW Guami %d:%d",
+                        nf_info->amf.num_of_guami, OGS_MAX_NUM_OF_SERVED_GUAMI);
+                break;
+            }
 
             if (GuamiAmfInfoItem->amf_id && GuamiAmfInfoItem->plmn_id &&
                     GuamiAmfInfoItem->plmn_id->mnc &&
@@ -753,9 +770,6 @@
         TaiRangeItem = node->data;
         if (TaiRangeItem && TaiRangeItem->plmn_id &&
                 TaiRangeItem->tac_range_list) {
-            ogs_assert(nf_info->amf.num_of_nr_tai_range <
-                    OGS_MAX_NUM_OF_TAI);
-
             if (nf_info->amf.num_of_nr_tai_range >= OGS_MAX_NUM_OF_TAI) {
                 ogs_error("OVERFLOW TaiRangeItem %d:%d",
                         nf_info->amf.num_of_nr_tai_range, OGS_MAX_NUM_OF_TAI);

open5gs_2.7.6.tar.xz/lib/sbi/ogs-sbi.h -> open5gs_2.7.7.tar.xz/lib/sbi/ogs-sbi.h Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2022 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -58,6 +58,17 @@
 #include "model/sm_context_update_error.h"
 #include "model/sm_context_release_data.h"
 #include "model/sm_context_released_data.h"
+#include "model/pdu_session_create_data.h"
+#include "model/pdu_session_create_error.h"
+#include "model/pdu_session_created_data.h"
+#include "model/hsmf_update_data.h"
+#include "model/hsmf_updated_data.h"
+#include "model/hsmf_update_error.h"
+#include "model/vsmf_update_data.h"
+#include "model/vsmf_updated_data.h"
+#include "model/vsmf_update_error.h"
+#include "model/release_data.h"
+#include "model/released_data.h"
 #include "model/session_management_subscription_data.h"
 #include "model/n1_n2_message_transfer_req_data.h"
 #include "model/n1_n2_message_transfer_rsp_data.h"
@@ -88,6 +99,8 @@
 #include "model/ue_context_transfer_rsp_data.h"
 #include "model/ue_reg_status_update_req_data.h"
 #include "model/ue_reg_status_update_rsp_data.h"
+#include "model/status_notification.h"
+#include "model/provisioned_data_sets.h"
 
 #include "custom/links.h"

open5gs_2.7.6.tar.xz/lib/sbi/openapi/model/sm_subs_data.c -> open5gs_2.7.7.tar.xz/lib/sbi/openapi/model/sm_subs_data.c Changed

@@ -5,15 +5,15 @@
 #include "sm_subs_data.h"
 
 OpenAPI_sm_subs_data_t *OpenAPI_sm_subs_data_create(
-    OpenAPI_list_t *shared_sm_subs_data_ids,
-    OpenAPI_list_t *individual_sm_subs_data
+    OpenAPI_list_t *session_management_subscription_data_list,
+    OpenAPI_extended_sm_subs_data_t *extended_sm_subs_data
 )
 {
     OpenAPI_sm_subs_data_t *sm_subs_data_local_var = ogs_malloc(sizeof(OpenAPI_sm_subs_data_t));
     ogs_assert(sm_subs_data_local_var);
 
-    sm_subs_data_local_var->shared_sm_subs_data_ids = shared_sm_subs_data_ids;
-    sm_subs_data_local_var->individual_sm_subs_data = individual_sm_subs_data;
+    sm_subs_data_local_var->session_management_subscription_data_list = session_management_subscription_data_list;
+    sm_subs_data_local_var->extended_sm_subs_data = extended_sm_subs_data;
 
     return sm_subs_data_local_var;
 }
@@ -25,19 +25,16 @@
     if (NULL == sm_subs_data) {
         return;
     }
-    if (sm_subs_data->shared_sm_subs_data_ids) {
-        OpenAPI_list_for_each(sm_subs_data->shared_sm_subs_data_ids, node) {
-            ogs_free(node->data);
-        }
-        OpenAPI_list_free(sm_subs_data->shared_sm_subs_data_ids);
-        sm_subs_data->shared_sm_subs_data_ids = NULL;
-    }
-    if (sm_subs_data->individual_sm_subs_data) {
-        OpenAPI_list_for_each(sm_subs_data->individual_sm_subs_data, node) {
+    if (sm_subs_data->session_management_subscription_data_list) {
+        OpenAPI_list_for_each(sm_subs_data->session_management_subscription_data_list, node) {
             OpenAPI_session_management_subscription_data_free(node->data);
         }
-        OpenAPI_list_free(sm_subs_data->individual_sm_subs_data);
-        sm_subs_data->individual_sm_subs_data = NULL;
+        OpenAPI_list_free(sm_subs_data->session_management_subscription_data_list);
+        sm_subs_data->session_management_subscription_data_list = NULL;
+    }
+    if (sm_subs_data->extended_sm_subs_data) {
+        OpenAPI_extended_sm_subs_data_free(sm_subs_data->extended_sm_subs_data);
+        sm_subs_data->extended_sm_subs_data = NULL;
     }
     ogs_free(sm_subs_data);
 }
@@ -53,35 +50,32 @@
     }
 
     item = cJSON_CreateObject();
-    if (!sm_subs_data->shared_sm_subs_data_ids) {
-        ogs_error("OpenAPI_sm_subs_data_convertToJSON() failed shared_sm_subs_data_ids");
-        return NULL;
-    }
-    cJSON *shared_sm_subs_data_idsList = cJSON_AddArrayToObject(item, "sharedSmSubsDataIds");
-    if (shared_sm_subs_data_idsList == NULL) {
-        ogs_error("OpenAPI_sm_subs_data_convertToJSON() failed shared_sm_subs_data_ids");
+    if (sm_subs_data->session_management_subscription_data_list) {
+    cJSON *session_management_subscription_data_listList = cJSON_AddArrayToObject(item, "SessionManagementSubscriptionDataList");
+    if (session_management_subscription_data_listList == NULL) {
+        ogs_error("OpenAPI_sm_subs_data_convertToJSON() failed session_management_subscription_data_list");
         goto end;
     }
-    OpenAPI_list_for_each(sm_subs_data->shared_sm_subs_data_ids, node) {
-        if (cJSON_AddStringToObject(shared_sm_subs_data_idsList, "", (char*)node->data) == NULL) {
-            ogs_error("OpenAPI_sm_subs_data_convertToJSON() failed shared_sm_subs_data_ids");
+    OpenAPI_list_for_each(sm_subs_data->session_management_subscription_data_list, node) {
+        cJSON *itemLocal = OpenAPI_session_management_subscription_data_convertToJSON(node->data);
+        if (itemLocal == NULL) {
+            ogs_error("OpenAPI_sm_subs_data_convertToJSON() failed session_management_subscription_data_list");
             goto end;
         }
+        cJSON_AddItemToArray(session_management_subscription_data_listList, itemLocal);
+    }
     }
 
-    if (sm_subs_data->individual_sm_subs_data) {
-    cJSON *individual_sm_subs_dataList = cJSON_AddArrayToObject(item, "individualSmSubsData");
-    if (individual_sm_subs_dataList == NULL) {
-        ogs_error("OpenAPI_sm_subs_data_convertToJSON() failed individual_sm_subs_data");
+    if (sm_subs_data->extended_sm_subs_data) {
+    cJSON *extended_sm_subs_data_local_JSON = OpenAPI_extended_sm_subs_data_convertToJSON(sm_subs_data->extended_sm_subs_data);
+    if (extended_sm_subs_data_local_JSON == NULL) {
+        ogs_error("OpenAPI_sm_subs_data_convertToJSON() failed extended_sm_subs_data");
         goto end;
     }
-    OpenAPI_list_for_each(sm_subs_data->individual_sm_subs_data, node) {
-        cJSON *itemLocal = OpenAPI_session_management_subscription_data_convertToJSON(node->data);
-        if (itemLocal == NULL) {
-            ogs_error("OpenAPI_sm_subs_data_convertToJSON() failed individual_sm_subs_data");
-            goto end;
-        }
-        cJSON_AddItemToArray(individual_sm_subs_dataList, itemLocal);
+    cJSON_AddItemToObject(item, "ExtendedSmSubsData", extended_sm_subs_data_local_JSON);
+    if (item->child == NULL) {
+        ogs_error("OpenAPI_sm_subs_data_convertToJSON() failed extended_sm_subs_data");
+        goto end;
     }
     }
 
@@ -93,77 +87,60 @@
 {
     OpenAPI_sm_subs_data_t *sm_subs_data_local_var = NULL;
     OpenAPI_lnode_t *node = NULL;
-    cJSON *shared_sm_subs_data_ids = NULL;
-    OpenAPI_list_t *shared_sm_subs_data_idsList = NULL;
-    cJSON *individual_sm_subs_data = NULL;
-    OpenAPI_list_t *individual_sm_subs_dataList = NULL;
-    shared_sm_subs_data_ids = cJSON_GetObjectItemCaseSensitive(sm_subs_dataJSON, "sharedSmSubsDataIds");
-    if (!shared_sm_subs_data_ids) {
-        ogs_error("OpenAPI_sm_subs_data_parseFromJSON() failed shared_sm_subs_data_ids");
-        goto end;
-    }
-        cJSON *shared_sm_subs_data_ids_local = NULL;
-        if (!cJSON_IsArray(shared_sm_subs_data_ids)) {
-            ogs_error("OpenAPI_sm_subs_data_parseFromJSON() failed shared_sm_subs_data_ids");
+    cJSON *session_management_subscription_data_list = NULL;
+    OpenAPI_list_t *session_management_subscription_data_listList = NULL;
+    cJSON *extended_sm_subs_data = NULL;
+    OpenAPI_extended_sm_subs_data_t *extended_sm_subs_data_local_nonprim = NULL;
+    session_management_subscription_data_list = cJSON_GetObjectItemCaseSensitive(sm_subs_dataJSON, "SessionManagementSubscriptionDataList");
+    if (session_management_subscription_data_list) {
+        cJSON *session_management_subscription_data_list_local = NULL;
+        if (!cJSON_IsArray(session_management_subscription_data_list)) {
+            ogs_error("OpenAPI_sm_subs_data_parseFromJSON() failed session_management_subscription_data_list");
             goto end;
         }
 
-        shared_sm_subs_data_idsList = OpenAPI_list_create();
+        session_management_subscription_data_listList = OpenAPI_list_create();
 
-        cJSON_ArrayForEach(shared_sm_subs_data_ids_local, shared_sm_subs_data_ids) {
-            double *localDouble = NULL;
-            int *localInt = NULL;
-            if (!cJSON_IsString(shared_sm_subs_data_ids_local)) {
-                ogs_error("OpenAPI_sm_subs_data_parseFromJSON() failed shared_sm_subs_data_ids");
+        cJSON_ArrayForEach(session_management_subscription_data_list_local, session_management_subscription_data_list) {
+            if (!cJSON_IsObject(session_management_subscription_data_list_local)) {
+                ogs_error("OpenAPI_sm_subs_data_parseFromJSON() failed session_management_subscription_data_list");
                 goto end;
             }
-            OpenAPI_list_add(shared_sm_subs_data_idsList, ogs_strdup(shared_sm_subs_data_ids_local->valuestring));
-        }
-
-    individual_sm_subs_data = cJSON_GetObjectItemCaseSensitive(sm_subs_dataJSON, "individualSmSubsData");
-    if (individual_sm_subs_data) {
-        cJSON *individual_sm_subs_data_local = NULL;
-        if (!cJSON_IsArray(individual_sm_subs_data)) {
-            ogs_error("OpenAPI_sm_subs_data_parseFromJSON() failed individual_sm_subs_data");
-            goto end;
-        }
-
-        individual_sm_subs_dataList = OpenAPI_list_create();
-
-        cJSON_ArrayForEach(individual_sm_subs_data_local, individual_sm_subs_data) {
-            if (!cJSON_IsObject(individual_sm_subs_data_local)) {
-                ogs_error("OpenAPI_sm_subs_data_parseFromJSON() failed individual_sm_subs_data");
-                goto end;
-            }
-            OpenAPI_session_management_subscription_data_t *individual_sm_subs_dataItem = OpenAPI_session_management_subscription_data_parseFromJSON(individual_sm_subs_data_local);
-            if (!individual_sm_subs_dataItem) {
-                ogs_error("No individual_sm_subs_dataItem");
+            OpenAPI_session_management_subscription_data_t *session_management_subscription_data_listItem = OpenAPI_session_management_subscription_data_parseFromJSON(session_management_subscription_data_list_local);
+            if (!session_management_subscription_data_listItem) {
+                ogs_error("No session_management_subscription_data_listItem");
                 goto end;
             }
-            OpenAPI_list_add(individual_sm_subs_dataList, individual_sm_subs_dataItem);
+            OpenAPI_list_add(session_management_subscription_data_listList, session_management_subscription_data_listItem);
         }
     }
 
+    extended_sm_subs_data = cJSON_GetObjectItemCaseSensitive(sm_subs_dataJSON, "ExtendedSmSubsData");
+    if (extended_sm_subs_data) {
+    extended_sm_subs_data_local_nonprim = OpenAPI_extended_sm_subs_data_parseFromJSON(extended_sm_subs_data);
+    if (!extended_sm_subs_data_local_nonprim) {
+        ogs_error("OpenAPI_extended_sm_subs_data_parseFromJSON failed extended_sm_subs_data");
+        goto end;
+    }
+    }
+
     sm_subs_data_local_var = OpenAPI_sm_subs_data_create (
-        shared_sm_subs_data_idsList,
-        individual_sm_subs_data ? individual_sm_subs_dataList : NULL
+        session_management_subscription_data_list ? session_management_subscription_data_listList : NULL,
+        extended_sm_subs_data ? extended_sm_subs_data_local_nonprim : NULL
     );
 
     return sm_subs_data_local_var;
 end:
-    if (shared_sm_subs_data_idsList) {
-        OpenAPI_list_for_each(shared_sm_subs_data_idsList, node) {
-            ogs_free(node->data);
-        }
-        OpenAPI_list_free(shared_sm_subs_data_idsList);
-        shared_sm_subs_data_idsList = NULL;
-    }
-    if (individual_sm_subs_dataList) {
-        OpenAPI_list_for_each(individual_sm_subs_dataList, node) {
+    if (session_management_subscription_data_listList) {
+        OpenAPI_list_for_each(session_management_subscription_data_listList, node) {
             OpenAPI_session_management_subscription_data_free(node->data);
         }
-        OpenAPI_list_free(individual_sm_subs_dataList);
-        individual_sm_subs_dataList = NULL;
+        OpenAPI_list_free(session_management_subscription_data_listList);
+        session_management_subscription_data_listList = NULL;
+    }
+    if (extended_sm_subs_data_local_nonprim) {
+        OpenAPI_extended_sm_subs_data_free(extended_sm_subs_data_local_nonprim);
+        extended_sm_subs_data_local_nonprim = NULL;
     }
     return NULL;
 }

open5gs_2.7.6.tar.xz/lib/sbi/openapi/model/sm_subs_data.h -> open5gs_2.7.7.tar.xz/lib/sbi/openapi/model/sm_subs_data.h Changed

open5gs_2.7.6.tar.xz/lib/sbi/path.c -> open5gs_2.7.7.tar.xz/lib/sbi/path.c Changed

@@ -497,6 +497,13 @@
                 ogs_free(v);
             }
 
+            if (discovery_option && discovery_option->hnrf_uri) {
+                ogs_debug("hnrf_uri %s", discovery_option->hnrf_uri);
+                ogs_sbi_header_set(request->http.headers,
+                        OGS_SBI_CUSTOM_DISCOVERY_HNRF_URI,
+                        discovery_option->hnrf_uri);
+            }
+
             rc = ogs_sbi_client_send_via_scp_or_sepp(
                     scp_client, client_discover_cb, request,
                     OGS_UINT_TO_POINTER(xact->id));
@@ -510,9 +517,7 @@
          ***********************/
 
         /* If `client` instance is available, use direct communication */
-        rc = ogs_sbi_send_request_to_client(
-                client, ogs_sbi_client_handler, request,
-                OGS_UINT_TO_POINTER(xact->id));
+        rc = ogs_sbi_send_request_with_sepp_discovery(client, xact);
         ogs_expect(rc == true);
         return (rc == true) ? OGS_OK : OGS_ERROR;
 
@@ -590,15 +595,10 @@
 bool ogs_sbi_send_request_to_nf_instance(
         ogs_sbi_nf_instance_t *nf_instance, ogs_sbi_xact_t *xact)
 {
-    bool rc;
     ogs_sbi_request_t *request = NULL;
     ogs_sbi_client_t *client = NULL;
 
-    ogs_sbi_object_t *sbi_object = NULL;
-
     ogs_assert(xact);
-    sbi_object = xact->sbi_object;
-    ogs_assert(sbi_object);
     request = xact->request;
     ogs_assert(request);
 
@@ -660,6 +660,26 @@
 #endif
     }
 
+    if (ogs_sbi_send_request_with_sepp_discovery(client, xact) == false) {
+        ogs_sbi_xact_remove(xact);
+        return false;
+    }
+
+    return true;
+}
+
+bool ogs_sbi_send_request_with_sepp_discovery(
+        ogs_sbi_client_t *client, ogs_sbi_xact_t *xact)
+{
+    bool rc;
+    ogs_sbi_request_t *request = NULL;
+
+    ogs_assert(xact);
+    request = xact->request;
+    ogs_assert(request);
+
+    ogs_assert(client);
+
     if (client->fqdn && ogs_sbi_fqdn_in_vplmn(client->fqdn) == true) {
         ogs_sbi_client_t *sepp_client = NULL, *nrf_client = NULL;
 
@@ -672,7 +692,6 @@
             ogs_error("No SEPP(%p) and NRF(%p) %s",
                     sepp_client, nrf_client, client->fqdn);
 
-            ogs_sbi_xact_remove(xact);
             return false;
 
         } else if (!sepp_client) {
@@ -682,7 +701,6 @@
             xact->target_apiroot = ogs_sbi_client_apiroot(client);
             if (!xact->target_apiroot) {
                 ogs_error("ogs_strdup(xact->target_apiroot) failed");
-                ogs_sbi_xact_remove(xact);
                 return false;
             }
 
@@ -690,7 +708,6 @@
                         OpenAPI_nf_type_SEPP, xact->requester_nf_type, NULL);
             if (!nrf_request) {
                 ogs_error("ogs_nnrf_disc_build_discover() failed");
-                ogs_sbi_xact_remove(xact);
                 return false;
             }
 
@@ -699,7 +716,6 @@
                     OGS_UINT_TO_POINTER(xact->id));
             if (rc == false) {
                 ogs_error("ogs_sbi_client_send_request() failed");
-                ogs_sbi_xact_remove(xact);
             }
 
             ogs_sbi_request_free(nrf_request);
@@ -713,7 +729,6 @@
             OGS_UINT_TO_POINTER(xact->id));
     if (rc == false) {
         ogs_error("ogs_sbi_send_request_to_client() failed");
-        ogs_sbi_xact_remove(xact);
     }
 
     return rc;

open5gs_2.7.6.tar.xz/lib/sbi/path.h -> open5gs_2.7.7.tar.xz/lib/sbi/path.h Changed

open5gs_2.7.6.tar.xz/lib/sbi/support/r17-20230301-openapitools-6.4.0/modified/TS29503_Nudm_SDM.yaml -> open5gs_2.7.7.tar.xz/lib/sbi/support/r17-20230301-openapitools-6.4.0/modified/TS29503_Nudm_SDM.yaml Changed

open5gs_2.7.6.tar.xz/lib/sbi/types.c -> open5gs_2.7.7.tar.xz/lib/sbi/types.c Changed

open5gs_2.7.6.tar.xz/lib/sbi/types.h -> open5gs_2.7.7.tar.xz/lib/sbi/types.h Changed

open5gs_2.7.6.tar.xz/meson.build -> open5gs_2.7.7.tar.xz/meson.build Changed

open5gs_2.7.6.tar.xz/misc/db/open5gs-dbctl -> open5gs_2.7.7.tar.xz/misc/db/open5gs-dbctl Changed

@@ -26,6 +26,7 @@
     echo "   showfiltered: shows {imsi key opc apn ip} information of subscriber"
     echo "   ambr_speed {imsi dl_value dl_unit ul_value ul_unit}: Change AMBR speed from a specific user and the  unit values are \"0=bps 1=Kbps 2=Mbps 3=Gbps 4=Tbps \""
     echo "   subscriber_status {imsi subscriber_status_val={0,1} operator_determined_barring={0..8}}: Change TS 29.272 values for Subscriber-Status (7.3.29) and Operator-Determined-Barring (7.3.30)"
+    echo "   lbo_roaming_allowed {imsi lbo_roaming_allowed={0,1}}: Change roaming type for a specific subscriber: 0 = LBO roaming (default), 1 = HR roaming"
 
 }
 
@@ -800,6 +801,24 @@
     echo "open5gs-dbctl: incorrect number of args, format is \"open5gs-dbctl subscriber_status imsi subscriber_status_val={0,1} operator_determined_barring={0..8}"
     exit 1
 fi
+if  "$1" = "lbo_roaming_allowed" ; then
+    if  "$#" -eq 3 ; then
+        IMSI=$2
+        LBO_ALLOWED=$3
+        if  $LBO_ALLOWED = "1" ; then
+            LBO_ALLOWED_BOOL=true
+        else
+            LBO_ALLOWED_BOOL=false
+        fi
+        mongosh --eval "db.subscribers.updateOne({ \"imsi\": \"$IMSI\"},
+            {\$set: { \"slice.0.session.0.lbo_roaming_allowed\": $LBO_ALLOWED_BOOL
+                    }
+            });" $DB_URI
+        exit $?
+    fi
+    echo "open5gs-dbctl: incorrect number of args, format is \"open5gs-dbctl lbo_roaming_allowed imsi lbo_roaming_allowed={0,1}"
+    exit 1
+fi
 if  "$1" = "showall" ; then
    mongosh --eval "db.subscribers.find()" $DB_URI
         exit $?

open5gs_2.7.6.tar.xz/src/amf/amf-sm.c -> open5gs_2.7.7.tar.xz/src/amf/amf-sm.c Changed

@@ -23,6 +23,7 @@
 #include "ngap-handler.h"
 #include "nnrf-handler.h"
 #include "namf-handler.h"
+#include "namf-oam.h"
 #include "nsmf-handler.h"
 #include "nnssf-handler.h"
 #include "nas-security.h"
@@ -68,6 +69,7 @@
     ogs_sbi_xact_t *sbi_xact = NULL;
     ogs_pool_id_t sbi_xact_id = OGS_INVALID_POOL_ID;
     int state = AMF_CREATE_SM_CONTEXT_NO_STATE;
+    ogs_pool_id_t ran_ue_id = OGS_INVALID_POOL_ID;
     ogs_sbi_stream_t *stream = NULL;
     ogs_pool_id_t stream_id = OGS_INVALID_POOL_ID;
     ogs_sbi_request_t *sbi_request = NULL;
@@ -106,6 +108,28 @@
             break;
         }
 
+        /*
+         * Special handling for NAMF_OAM custom API
+         */
+        if (sbi_request->h.uri &&
+            strstr(sbi_request->h.uri, OGS_SBI_SERVICE_NAME_NAMF_OAM) != NULL) {
+            rv = ogs_sbi_parse_header(&sbi_message, &sbi_request->h);
+            if (rv != OGS_OK) {
+                ogs_error("cannot parse HTTP header");
+                ogs_assert(true ==
+                    ogs_sbi_server_send_error(
+                        stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                        NULL, "cannot parse HTTP header", NULL, NULL));
+                break;
+            } else {
+                amf_namf_oam_handler(stream, &sbi_message, sbi_request);
+                break;
+            }
+        }
+
+        /*
+         * For standard APIs: parse the complete request (header + body)
+         */
         rv = ogs_sbi_parse_request(&sbi_message, sbi_request);
         if (rv != OGS_OK) {
             /* 'sbi_message' buffer is released in ogs_sbi_parse_request() */
@@ -393,14 +417,17 @@
 
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
                     if (sbi_message.res_status ==
-                            OGS_SBI_HTTP_STATUS_NO_CONTENT) {
-                        ogs_sbi_subscription_data_remove(subscription_data);
-                    } else {
+                            OGS_SBI_HTTP_STATUS_NO_CONTENT)
+                        ogs_info("%s Subscription deleted",
+                                subscription_data->id ?
+                                    subscription_data->id : "Unknown");
+                    else
                         ogs_error("%s HTTP response error %d",
                                 subscription_data->id ?
                                     subscription_data->id : "Unknown",
                                 sbi_message.res_status);
-                    }
+
+                    ogs_sbi_subscription_data_remove(subscription_data);
                     break;
 
                 DEFAULT
@@ -517,6 +544,13 @@
             ogs_assert(sbi_object_id >= OGS_MIN_POOL_ID &&
                     sbi_object_id <= OGS_MAX_POOL_ID);
 
+            if (sbi_xact->user_data) {
+                amf_sbi_xact_ctx_t *ctx = sbi_xact->user_data;
+
+                if (ctx->ran_ue_id != OGS_INVALID_POOL_ID)
+                    ran_ue_id = ctx->ran_ue_id;
+            }
+
             ogs_sbi_xact_remove(sbi_xact);
 
             sess = amf_sess_find_by_id(sbi_object_id);
@@ -565,14 +599,13 @@
 
             ogs_assert(OGS_FSM_STATE(&amf_ue->sm));
 
-            e->amf_ue_id = amf_ue->id;
-            e->sess_id = sess->id;
-            e->h.sbi.message = &sbi_message;;
+            if (ran_ue_id >= OGS_MIN_POOL_ID && ran_ue_id <= OGS_MAX_POOL_ID)
+                ran_ue = ran_ue_find_by_id(ran_ue_id);
 
             SWITCH(sbi_message.h.resource.component2)
             CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
                 amf_nsmf_pdusession_handle_update_sm_context(
-                        sess, state, &sbi_message);
+                        amf_ue, ran_ue, sess, state, &sbi_message);
                 break;
 
             CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
@@ -584,12 +617,13 @@
                     ogs_error("%s:%d HTTP response error %d",
                             amf_ue->supi, sess->psi, sbi_message.res_status);
                 }
-                amf_nsmf_pdusession_handle_release_sm_context(sess, state);
+                amf_nsmf_pdusession_handle_release_sm_context(
+                        amf_ue, ran_ue, sess, state);
                 break;
 
             DEFAULT
                 rv = amf_nsmf_pdusession_handle_create_sm_context(
-                        sess, &sbi_message);
+                        amf_ue, ran_ue, sess, &sbi_message);
                 if (rv != OGS_OK) {
                     /*
                      * 1. First PDU session establishment request
@@ -635,6 +669,13 @@
             ogs_assert(sbi_object_id >= OGS_MIN_POOL_ID &&
                     sbi_object_id <= OGS_MAX_POOL_ID);
 
+            if (sbi_xact->user_data) {
+                amf_sbi_xact_ctx_t *ctx = sbi_xact->user_data;
+
+                if (ctx->ran_ue_id != OGS_INVALID_POOL_ID)
+                    ran_ue_id = ctx->ran_ue_id;
+            }
+
             state = sbi_xact->state;
 
             ogs_sbi_xact_remove(sbi_xact);
@@ -653,12 +694,11 @@
 
             ogs_assert(OGS_FSM_STATE(&amf_ue->sm));
 
-            e->amf_ue_id = amf_ue->id;
-            e->sess_id = sess->id;
-            e->h.sbi.message = &sbi_message;;
-            e->h.sbi.state = state;
+            if (ran_ue_id >= OGS_MIN_POOL_ID && ran_ue_id <= OGS_MAX_POOL_ID)
+                ran_ue = ran_ue_find_by_id(ran_ue_id);
 
-            amf_nnssf_nsselection_handle_get(sess, &sbi_message);
+            amf_nnssf_nsselection_handle_get(
+                    amf_ue, ran_ue, sess, state, &sbi_message);
             break;
 
         DEFAULT
@@ -764,6 +804,13 @@
             ogs_assert(sbi_object_id >= OGS_MIN_POOL_ID &&
                     sbi_object_id <= OGS_MAX_POOL_ID);
 
+            if (sbi_xact->user_data) {
+                amf_sbi_xact_ctx_t *ctx = sbi_xact->user_data;
+
+                if (ctx->ran_ue_id != OGS_INVALID_POOL_ID)
+                    ran_ue_id = ctx->ran_ue_id;
+            }
+
             service_type = sbi_xact->service_type;
             requester_nf_type = sbi_xact->requester_nf_type;
             discovery_option = sbi_xact->discovery_option;
@@ -781,8 +828,10 @@
                     break;
                 }
 
-                ogs_error("%s:%s Cannot receive SBI message",
-                        amf_ue->supi, amf_ue->suci);
+                ogs_error("%s:%s Cannot receive SBI message "
+                        "type:%d,value:%d", amf_ue->supi, amf_ue->suci,
+                        amf_ue->nas.message_type,
+                        amf_ue->nas.registration.value);
 
                 /*
                 * TS 23.502
@@ -808,6 +857,10 @@
 
                         break;
                     }
+                } else if (amf_ue->nas.message_type ==
+                        OGS_NAS_5GS_DEREGISTRATION_REQUEST_FROM_UE) {
+                    ogs_error("T3522 expired");
+                    break;
                 }
 
                 r = nas_5gs_send_gmm_reject_from_sbi(amf_ue,
@@ -832,7 +885,13 @@
                 ogs_error("%s:%s:%d:%d Cannot receive SBI message",
                         amf_ue->supi, amf_ue->suci, sess->psi, sess->pti);
 
-                ran_ue = ran_ue_find_by_id(sess->ran_ue_id);
+                if (ran_ue_id < OGS_MIN_POOL_ID ||
+                    ran_ue_id > OGS_MAX_POOL_ID) {
+                    ogs_error("No assoc RAN-UE id %d", ran_ue_id);
+                    break;
+                }
+
+                ran_ue = ran_ue_find_by_id(ran_ue_id);
                 if (!ran_ue) {
                     ogs_error("%s:%s:%d:%d "
                             "NG Context has already been removed",
@@ -856,14 +915,14 @@
 
                 if (sess->payload_container_type) {
                     r = nas_5gs_send_back_gsm_message(
-                            ran_ue_find_by_id(sess->ran_ue_id), sess,
+                            ran_ue, sess,
                             OGS_5GMM_CAUSE_PAYLOAD_WAS_NOT_FORWARDED,
                             AMF_NAS_BACKOFF_TIME);
                     ogs_expect(r == OGS_OK);
                     ogs_assert(r != OGS_ERROR);
                 } else {
                     r = ngap_send_error_indication2(
-                            ran_ue_find_by_id(sess->ran_ue_id),
+                            ran_ue,
                             NGAP_Cause_PR_transport,
                             NGAP_CauseTransport_transport_resource_unavailable);
                     ogs_expect(r == OGS_OK);

open5gs_2.7.6.tar.xz/src/amf/context.c -> open5gs_2.7.7.tar.xz/src/amf/context.c Changed

@@ -1370,6 +1370,12 @@
 
     ogs_assert(gnb);
 
+    if ((gnb->max_num_of_ostreams - 1) < 1) {
+        ogs_error("gnb->max_num_of_ostreams too small (%d)",
+                gnb->max_num_of_ostreams);
+        return NULL;
+    }
+
     ogs_pool_id_calloc(&ran_ue_pool, &ran_ue);
     if (ran_ue == NULL) {
         ogs_error("Could not allocate ran_ue context from pool");
@@ -2372,10 +2378,12 @@
 
     if (sess->nssf.nsi_id)
         ogs_free(sess->nssf.nsi_id);
-    if (sess->nssf.nrf.id)
-        ogs_free(sess->nssf.nrf.id);
+    if (sess->nssf.nrf_uri)
+        ogs_free(sess->nssf.nrf_uri);
     if (sess->nssf.nrf.client)
         ogs_sbi_client_remove(sess->nssf.nrf.client);
+    if (sess->nssf.hnrf_uri)
+        ogs_free(sess->nssf.hnrf_uri);
 
     ogs_pool_id_free(&amf_sess_pool, sess);
 
@@ -2412,28 +2420,6 @@
     return ogs_pool_find_by_id(&amf_sess_pool, id);
 }
 
-void amf_sbi_select_nf(
-        ogs_sbi_object_t *sbi_object,
-        ogs_sbi_service_type_e service_type,
-        OpenAPI_nf_type_e requester_nf_type,
-        ogs_sbi_discovery_option_t *discovery_option)
-{
-    OpenAPI_nf_type_e target_nf_type = OpenAPI_nf_type_NULL;
-    ogs_sbi_nf_instance_t *nf_instance = NULL;
-
-    ogs_assert(sbi_object);
-    ogs_assert(service_type);
-    target_nf_type = ogs_sbi_service_type_to_nf_type(service_type);
-    ogs_assert(target_nf_type);
-    ogs_assert(requester_nf_type);
-
-    nf_instance = ogs_sbi_nf_instance_find_by_discovery_param(
-                    target_nf_type, requester_nf_type, discovery_option);
-    if (nf_instance)
-        OGS_SBI_SETUP_NF_INSTANCE(
-                sbi_object->service_type_arrayservice_type, nf_instance);
-}
-
 int amf_sess_xact_count(amf_ue_t *amf_ue)
 {
     amf_sess_t *sess = NULL;
@@ -2545,7 +2531,9 @@
             ogs_assert(list1->taij.type == OGS_TAI1_TYPE);
             ogs_assert(list1->taij.num <= OGS_MAX_NUM_OF_TAI);
 
-            if (list1->taij.tac.v <= nr_tai->tac.v &&
+            if (memcmp(&list1->taij.plmn_id,
+                    &nr_tai->plmn_id, OGS_PLMN_ID_LEN) == 0 &&
+                list1->taij.tac.v <= nr_tai->tac.v &&
                 nr_tai->tac.v < (list1->taij.tac.v+list1->taij.num))
                 return i;
         }

open5gs_2.7.6.tar.xz/src/amf/context.h -> open5gs_2.7.7.tar.xz/src/amf/context.h Changed

@@ -428,6 +428,9 @@
     int             security_context_available;
     int             mac_failed;
 
+    /* Authentication synch failure counter */
+    uint8_t auth_synch_fail_count;
+
     /* flag: 1 = allow restoration of context, 0 = disallow */
     bool            can_restore_context;
 
@@ -679,36 +682,37 @@
 
     uint8_t psi;            /* PDU Session Identity */
     uint8_t pti;            /* Procedure Trasaction Identity */
+    uint8_t request_type;   /* Request type */
 
 #define SESSION_CONTEXT_IN_SMF(__sESS)  \
-    ((__sESS) && (__sESS)->sm_context.ref)
+    ((__sESS) && (__sESS)->sm_context_ref)
 #define STORE_SESSION_CONTEXT(__sESS, __rESOURCE_URI, __rEF) \
     do { \
         ogs_assert(__sESS); \
         ogs_assert(__rESOURCE_URI); \
         ogs_assert(__rEF); \
         CLEAR_SESSION_CONTEXT(__sESS); \
-        (__sESS)->sm_context.resource_uri = ogs_strdup(__rESOURCE_URI); \
-        ogs_assert((__sESS)->sm_context.resource_uri); \
-        (__sESS)->sm_context.ref = ogs_strdup(__rEF); \
-        ogs_assert((__sESS)->sm_context.ref); \
+        (__sESS)->sm_context_resource_uri = ogs_strdup(__rESOURCE_URI); \
+        ogs_assert((__sESS)->sm_context_resource_uri); \
+        (__sESS)->sm_context_ref = ogs_strdup(__rEF); \
+        ogs_assert((__sESS)->sm_context_ref); \
     } while(0);
 #define CLEAR_SESSION_CONTEXT(__sESS) \
     do { \
         ogs_assert(__sESS); \
-        if ((__sESS)->sm_context.ref) \
-            ogs_free((__sESS)->sm_context.ref); \
-        (__sESS)->sm_context.ref = NULL; \
-        if ((__sESS)->sm_context.resource_uri) \
-            ogs_free((__sESS)->sm_context.resource_uri); \
-        (__sESS)->sm_context.resource_uri = NULL; \
+        if ((__sESS)->sm_context_ref) \
+            ogs_free((__sESS)->sm_context_ref); \
+        (__sESS)->sm_context_ref = NULL; \
+        if ((__sESS)->sm_context_resource_uri) \
+            ogs_free((__sESS)->sm_context_resource_uri); \
+        (__sESS)->sm_context_resource_uri = NULL; \
     } while(0);
 
     /* SMF sends the RESPONSE
      * of POST /nsmf-pdusession/v1/sm-contexts */
+    char *sm_context_resource_uri;
+    char *sm_context_ref;
     struct {
-        char *resource_uri;
-        char *ref;
         ogs_sbi_client_t *client;
     } sm_context;
 
@@ -894,10 +898,11 @@
 
     struct {
         char *nsi_id;
+        char *nrf_uri;
         struct {
-            char *id;
             ogs_sbi_client_t *client;
         } nrf;
+        char *hnrf_uri;
     } nssf;
 
     /* last payload for sending back to the UE */
@@ -907,14 +912,42 @@
     /* amf_bearer_first(sess) : Default Bearer Context */
     ogs_list_t      bearer_list;
 
-    /* Related Context */
+    /* AMF-UE identifier associated with this session. */
     ogs_pool_id_t   amf_ue_id;
+
+    /*
+     * RAN-UE identifier currently associated with this session.
+     *
+     * NOTE:
+     * This field represents the latest RAN UE NGAP ID known for the session.
+     * It may change during procedures such as NG context release and
+     * re-establishment.
+     *
+     * IMPORTANT:
+     * - During SBI Client operations (e.g., AMF sending requests to SMF/PCF),
+     *   the RAN-UE may change before the asynchronous SBI response arrives.
+     *   To avoid using a stale or incorrect RAN-UE, the SBI transaction
+     *   (ogs_sbi_xact_t) stores a snapshot in xact->user_data.
+     *
+     *   When handling SBI Client responses, the AMF MUST use the snapshot
+     *   stored in the SBI transaction instead of this session field.
+     *
+     * - For SBI Server operations (e.g., Namf callbacks where the AMF
+     *   receives requests from SMF), there is no transaction-specific
+     *   snapshot. In such cases, the current session value (sess->ran_ue_id)
+     *   is used.
+     *
+     * This design helps prevent RAN-UE mismatches observed in Issue #2839,
+     * where concurrent UE procedures could result in NAS being sent to the
+     * wrong RAN UE.
+     */
     ogs_pool_id_t   ran_ue_id;
 
     ogs_s_nssai_t s_nssai;
     ogs_s_nssai_t mapped_hplmn;
     bool mapped_hplmn_presence;
     char *dnn;
+    bool lbo_roaming_allowed;
 
 } amf_sess_t;
 
@@ -1049,12 +1082,6 @@
 amf_ue_t *amf_ue_find_by_id(ogs_pool_id_t id);
 amf_sess_t *amf_sess_find_by_id(ogs_pool_id_t id);
 
-void amf_sbi_select_nf(
-        ogs_sbi_object_t *sbi_object,
-        ogs_sbi_service_type_e service_type,
-        OpenAPI_nf_type_e requester_nf_type,
-        ogs_sbi_discovery_option_t *discovery_option);
-
 #define AMF_SESSION_SYNC_DONE(__aMF, __sTATE) \
     (amf_sess_xact_state_count(__aMF, __sTATE) == 0)
 int amf_sess_xact_count(amf_ue_t *amf_ue);

open5gs_2.7.6.tar.xz/src/amf/gmm-handler.c -> open5gs_2.7.7.tar.xz/src/amf/gmm-handler.c Changed

@@ -209,7 +209,20 @@
             sizeof(ogs_nas_5gs_registration_type_t));
     amf_ue->nas.message_type = OGS_NAS_5GS_REGISTRATION_REQUEST;
 
-    if (registration_type->value == OGS_NAS_5GS_REGISTRATION_TYPE_INITIAL) {
+    /*
+     * TS 24.501 Table 9.11.3.7.1:
+     * Unused registration-type encodings shall be interpreted as
+     * "initial registration" by the network.
+     *
+     * Normalize here so subsequent transfer logic has a stable basis.
+     */
+    if (amf_ue->nas.registration.value == 0) {
+        ogs_error("Normalize reg_type0 to INITIAL");
+        amf_ue->nas.registration.value = OGS_NAS_5GS_REGISTRATION_TYPE_INITIAL;
+    }
+
+    if (amf_ue->nas.registration.value ==
+            OGS_NAS_5GS_REGISTRATION_TYPE_INITIAL) {
         /*
          * Issue #2040
          *
@@ -484,9 +497,17 @@
 
         ogs_list_for_each(&amf_ue->sess_list, sess) {
             if ((psimask & (1 << sess->psi)) == 0) {
-                if (SESSION_CONTEXT_IN_SMF(sess))
+                if (SESSION_CONTEXT_IN_SMF(sess)) {
+                    amf_nsmf_pdusession_sm_context_param_t param;
+
+                    memset(&param, 0, sizeof(param));
+                    param.ue_location = true;
+                    param.ue_timezone = true;
+
                     amf_sbi_send_release_session(
-                        ran_ue, sess, AMF_RELEASE_SM_CONTEXT_REGISTRATION_ACCEPT);
+                        ran_ue, sess,
+                        AMF_RELEASE_SM_CONTEXT_REGISTRATION_ACCEPT, &param);
+                }
             }
         }
     }
@@ -571,24 +592,14 @@
         return false;
     }
 
-    /*
-     * TODO : FIXME
-     *
-     * Typically, UEs send 5G-GUTIs with all 0. In such cases,
-     * we need to prevent context transfer betwen AMFs by the N14 interface
-     * because they are not included in served_guami.
-     *
-     * We don't yet know how to check for 5G GUTI conformance,
-     * so we've implemented the following as a temporary solution.
+    /* Robustness: many devices (and fuzzers) send a "placeholder" 5G-GUTI
+     * (AMF-ID zero + M-TMSI zero). Treat it as non-actionable for context
+     * transfer regardless of PLMN digits, and fall back to Identity Request /
+     * normal registration handling.
      */
-    if ((amf_ue->old_guti.amf_id.region == 0 &&
-         amf_ue->old_guti.amf_id.set2 == 0) &&
-        (amf_ue->old_guti.nas_plmn_id.mcc1 == 0 &&
-         amf_ue->old_guti.nas_plmn_id.mcc2 == 0 &&
-         amf_ue->old_guti.nas_plmn_id.mcc3 == 0) &&
-        (amf_ue->old_guti.nas_plmn_id.mnc1 == 0 &&
-         amf_ue->old_guti.nas_plmn_id.mnc2 == 0 &&
-         amf_ue->old_guti.nas_plmn_id.mnc3 == 0)) {
+    if (amf_ue->old_guti.amf_id.region == 0 &&
+        amf_ue->old_guti.amf_id.set2 == 0 &&
+        amf_ue->old_guti.m_tmsi == 0) {
         return false;
     }
 
@@ -808,9 +819,17 @@
 
         ogs_list_for_each(&amf_ue->sess_list, sess) {
             if ((psimask & (1 << sess->psi)) == 0) {
-                if (SESSION_CONTEXT_IN_SMF(sess))
+                if (SESSION_CONTEXT_IN_SMF(sess)) {
+                    amf_nsmf_pdusession_sm_context_param_t param;
+
+                    memset(&param, 0, sizeof(param));
+                    param.ue_location = true;
+                    param.ue_timezone = true;
+
                     amf_sbi_send_release_session(
-                        ran_ue, sess, AMF_RELEASE_SM_CONTEXT_SERVICE_ACCEPT);
+                        ran_ue, sess,
+                        AMF_RELEASE_SM_CONTEXT_SERVICE_ACCEPT, &param);
+                }
             }
         }
     }
@@ -858,6 +877,7 @@
     int r, state, xact_count = 0;
     ran_ue_t *ran_ue = NULL;
     ogs_nas_de_registration_type_t *de_registration_type = NULL;
+    amf_nsmf_pdusession_sm_context_param_t param;
 
     ogs_assert(amf_ue);
     ran_ue = ran_ue_find_by_id(amf_ue->ran_ue_id);
@@ -892,7 +912,16 @@
     xact_count = amf_sess_xact_count(amf_ue);
 
     state = AMF_UE_INITIATED_DE_REGISTERED;
-    amf_sbi_send_release_all_sessions(ran_ue, amf_ue, state);
+
+    memset(&param, 0, sizeof(param));
+    param.cause = OpenAPI_cause_REL_DUE_TO_UNSPECIFIED_REASON;
+    param.ngApCause.group = NGAP_Cause_PR_nas;
+    param.ngApCause.value = NGAP_CauseNas_deregister;
+    param.gmm_cause = OGS_5GMM_CAUSE_REQUEST_ACCEPTED;
+    param.ue_location = true;
+    param.ue_timezone = true;
+
+    amf_sbi_send_release_all_sessions(ran_ue, amf_ue, state, &param);
 
     if (!AMF_SESSION_RELEASE_PENDING(amf_ue) &&
         amf_sess_xact_count(amf_ue) == xact_count) {
@@ -1140,11 +1169,11 @@
     int r;
     ogs_slice_data_t *selected_slice = NULL;
     amf_sess_t *sess = NULL;
-    amf_nsmf_pdusession_sm_context_param_t param;
 
     ogs_nas_payload_container_type_t *payload_container_type = NULL;
     ogs_nas_payload_container_t *payload_container = NULL;
     ogs_nas_pdu_session_identity_2_t *pdu_session_id = NULL;
+    ogs_nas_request_type_t *request_type = NULL;
     ogs_nas_s_nssai_t *nas_s_nssai = NULL;
     ogs_nas_dnn_t *dnn = NULL;
     ogs_nas_5gsm_header_t *gsm_header = NULL;
@@ -1206,6 +1235,8 @@
         return OGS_ERROR;
     }
 
+    request_type = &ul_nas_transport->request_type;
+
     switch (payload_container_type->value) {
     case OGS_NAS_PAYLOAD_CONTAINER_N1_SM_INFORMATION:
         gsm_header = (ogs_nas_5gsm_header_t *)payload_container->buffer;
@@ -1233,7 +1264,6 @@
              */
                 sess->pdu_session_resource_release_response_received = false;
                 sess->pdu_session_release_complete_received = false;
-
             }
         } else {
             sess = amf_sess_find_by_psi(amf_ue, *pdu_session_id);
@@ -1248,6 +1278,8 @@
             }
         }
 
+        sess->request_type = request_type->value;
+
         /*
          * To check if Reactivation Request has been used.
          *
@@ -1323,7 +1355,6 @@
 
                         if (ul_nas_transport->presencemask &
                                 OGS_NAS_5GS_UL_NAS_TRANSPORT_DNN_PRESENT) {
-
                             for (k = 0;
                                     k < amf_ue->slicei.num_of_session; k++) {
                                 if (k >= OGS_MAX_NUM_OF_SESS) {
@@ -1344,13 +1375,15 @@
                                     sess->dnn = ogs_strdup(dnn->value);
                                     ogs_assert(sess->dnn);
 
+                                    sess->lbo_roaming_allowed =
+                                        amf_ue->slicei.
+                                        sessionk.lbo_roaming_allowed;
                                 } else {
                                     continue;
                                 }
                             }
 
                         } else {
-
                             selected_slice = amf_ue->slice + i;
                             ogs_assert(selected_slice);
 
@@ -1360,6 +1393,9 @@
                                 sess->dnn = ogs_strdup(
                                         selected_slice->session0.name);
                                 ogs_assert(sess->dnn);
+                                sess->lbo_roaming_allowed =
+                                    amf_ue->slicei.
+                                    session0.lbo_roaming_allowed;
                             }
                         }
                     }
@@ -1380,70 +1416,223 @@
             sess->s_nssai.sst = selected_slice->s_nssai.sst;
             sess->s_nssai.sd.v = selected_slice->s_nssai.sd.v;
 
-            ogs_info("UE SUPI%s DNN%s S_NSSAISST:%d SD:0x%x "
+            ogs_info("UE SUPI%s DNN%s LBO%d S_NSSAISST:%d SD:0x%x "
                     "smContextRef%s smContextResourceURI%s",
-                amf_ue->supi, sess->dnn, sess->s_nssai.sst, sess->s_nssai.sd.v,
-                sess->sm_context.ref ? sess->sm_context.ref : "NULL",
-                sess->sm_context.resource_uri ?
-                    sess->sm_context.resource_uri : "NULL");
+                amf_ue->supi, sess->dnn, sess->lbo_roaming_allowed,
+                sess->s_nssai.sst, sess->s_nssai.sd.v,
+                sess->sm_context_ref ? sess->sm_context_ref : "NULL",
+                sess->sm_context_resource_uri ?
+                    sess->sm_context_resource_uri : "NULL");
 
             if (!SESSION_CONTEXT_IN_SMF(sess)) {
-                ogs_sbi_nf_instance_t *nf_instance = NULL;
-                ogs_sbi_service_type_e service_type =
-                    OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION;
-
-                ogs_sbi_discovery_option_t *discovery_option = NULL;
-
-                discovery_option = ogs_sbi_discovery_option_new();
-                ogs_assert(discovery_option);
+                ogs_sbi_nf_instance_t *v_smf_instance = NULL;
+                ogs_sbi_nf_instance_t *h_smf_instance = NULL;
+                ogs_sbi_discovery_option_t *v_discovery_option = NULL;
+
+                amf_nnssf_nsselection_param_t param;
+
+                ogs_sbi_service_type_e service_type = OGS_SBI_SERVICE_TYPE_NULL;
+                OpenAPI_nf_type_e target_nf_type = OpenAPI_nf_type_NULL;
+                OpenAPI_nf_type_e requester_nf_type = OpenAPI_nf_type_NULL;
+
+                service_type = OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION;
+                target_nf_type = ogs_sbi_service_type_to_nf_type(service_type);
+                ogs_assert(target_nf_type);
+                requester_nf_type = NF_INSTANCE_TYPE(
+                        ogs_sbi_self()->nf_instance);
+                ogs_assert(requester_nf_type);
+
+                int state = AMF_CREATE_SM_CONTEXT_NO_STATE;
+
+                /********************************************
+                 * Visited Discovery Option
+                 *******************************************/
+                v_discovery_option = ogs_sbi_discovery_option_new();
+                ogs_assert(v_discovery_option);
 
                 ogs_sbi_discovery_option_add_snssais(
-                        discovery_option, &sess->s_nssai);
-                ogs_sbi_discovery_option_set_dnn(discovery_option, sess->dnn);
+                        v_discovery_option, &sess->s_nssai);
+                ogs_sbi_discovery_option_set_dnn(
+                        v_discovery_option, sess->dnn);
                 ogs_sbi_discovery_option_set_tai(
-                        discovery_option, &amf_ue->nr_tai);
+                        v_discovery_option, &amf_ue->nr_tai);
 
-                nf_instance = OGS_SBI_GET_NF_INSTANCE(
-                        sess->sbi.service_type_arrayservice_type);
-                if (!nf_instance) {
-                    OpenAPI_nf_type_e requester_nf_type =
-                                NF_INSTANCE_TYPE(ogs_sbi_self()->nf_instance);
-                    ogs_assert(requester_nf_type);
+                /********************************************
+                 * Parameter for nnssf-nsselection build
+                 *******************************************/
+                memset(&param, 0, sizeof(param));
+                param.slice_info_for_pdu_session.presence = true;
+                param.slice_info_for_pdu_session.snssai = &sess->s_nssai;
 
-                    amf_sbi_select_nf(
-                            &sess->sbi,
-                            OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION,
-                            requester_nf_type,
-                            discovery_option);
-                    nf_instance = OGS_SBI_GET_NF_INSTANCE(
-                            sess->sbi.service_type_arrayservice_type);
+                if (ogs_sbi_plmn_id_in_vplmn(&amf_ue->home_plmn_id) == true) {
 
-                    if (!nf_instance)
-                        ogs_info("No SMF Instance");
+                    if (sess->lbo_roaming_allowed == true)
+                        param.slice_info_for_pdu_session.roaming_indication =
+                            OpenAPI_roaming_indication_LOCAL_BREAKOUT;
                     else
-                        ogs_info("SMF Instance %s", nf_instance->id);
+                        param.slice_info_for_pdu_session.roaming_indication =
+                            OpenAPI_roaming_indication_HOME_ROUTED_ROAMING;
+
+                    param.home_plmn_id = &amf_ue->home_plmn_id;
+
+                } else
+                    param.slice_info_for_pdu_session.roaming_indication =
+                        OpenAPI_roaming_indication_NON_ROAMING;
+
+                param.tai = &amf_ue->nr_tai;
+
+                /********************************************
+                 * Check Visited SMF Instance
+                 *******************************************/
+                v_smf_instance = OGS_SBI_GET_NF_INSTANCE(
+                        sess->sbi.service_type_arrayservice_type);
+                if (!v_smf_instance) {
+                    v_smf_instance =
+                        ogs_sbi_nf_instance_find_by_discovery_param(
+                                target_nf_type,
+                                requester_nf_type,
+                                v_discovery_option);
+                    if (v_smf_instance) {
+                        ogs_info("V-SMF Instance %s(LIST)",
+                                v_smf_instance->id);
+                        OGS_SBI_SETUP_NF_INSTANCE(
+                                sess->sbi.service_type_arrayservice_type,
+                                v_smf_instance);
+                    } else
+                        ogs_info("No V-SMF Instance");
                 } else
-                    ogs_info("SMF Instance %s", nf_instance->id);
+                    ogs_info("V-SMF Instance %s(SESSION)",
+                            v_smf_instance->id);
 
-                if (nf_instance) {
+                if (v_smf_instance) {
+                    ogs_info("V-SMF Instance %s", v_smf_instance->id);
+                    if (param.slice_info_for_pdu_session.roaming_indication ==
+                            OpenAPI_roaming_indication_HOME_ROUTED_ROAMING) {
+
+                /********************************************
+                 * Check Home SMF Instance
+                 *******************************************/
+                        /* Home-Routed roaming */
+                        ogs_info("Home-Routed Roaming");
+
+                        h_smf_instance = OGS_SBI_GET_NF_INSTANCE(
+                                sess->sbi.home_nsmf_pdusession);
+
+                        if (!h_smf_instance) {
+                            ogs_sbi_discovery_option_t *h_discovery_option =
+                                ogs_sbi_discovery_option_new();
+                            ogs_assert(h_discovery_option);
+
+                            ogs_sbi_discovery_option_add_snssais(
+                                    h_discovery_option, &sess->s_nssai);
+                            ogs_sbi_discovery_option_set_dnn(
+                                    h_discovery_option, sess->dnn);
+                            ogs_sbi_discovery_option_set_tai(
+                                    h_discovery_option, &amf_ue->nr_tai);
+
+                            ogs_sbi_discovery_option_add_target_plmn_list(
+                                    h_discovery_option, &amf_ue->home_plmn_id);
+
+                            ogs_assert(ogs_local_conf()->
+                                    num_of_serving_plmn_id);
+                            for (i = 0; i <
+                                    ogs_local_conf()->num_of_serving_plmn_id;
+                                    i++) {
+                                ogs_sbi_discovery_option_add_requester_plmn_list(
+                                        h_discovery_option,
+                                        &ogs_local_conf()->serving_plmn_idi);
+                            }
+
+                            h_smf_instance =
+                                ogs_sbi_nf_instance_find_by_discovery_param(
+                                        target_nf_type,
+                                        requester_nf_type,
+                                        h_discovery_option);
+                            if (h_smf_instance) {
+                                ogs_info("H-SMF Instance %s(LIST)",
+                                        h_smf_instance->id);
+                                OGS_SBI_SETUP_NF_INSTANCE(
+                                        sess->sbi.home_nsmf_pdusession,
+                                        h_smf_instance);
+                            } else
+                                ogs_info("No H-SMF Instance");
+
+                            ogs_sbi_discovery_option_free(h_discovery_option);
+
+                        } else
+                            ogs_info("H-SMF Instance %s(SESSION)",
+                                    h_smf_instance->id);
+
+                        if (h_smf_instance) {
+                            /* Both V-SMF and H-SMF Discovered */
+                            ogs_info("H-SMF Instance %s", h_smf_instance->id);
+                        } else {
+                            /* No H-SMF Instance */
+                            ogs_info("H-SMF not discovered");
+                            state = AMF_SMF_SELECTION_IN_VPLMN_IN_HOME_ROUTED;
+                        }
+
+                    } else {
+                        /* Non-roaming or LBO roaming */
+                        ogs_info("V-SMF discovered in "
+                                "Non-Roaming or LBO-Roaming%d",
+                                sess->lbo_roaming_allowed);
+                    }
+                } else {
+                    /* No V-SMF Instance */
+                    if (param.slice_info_for_pdu_session.roaming_indication ==
+                            OpenAPI_roaming_indication_HOME_ROUTED_ROAMING) {
+                        ogs_info("V-SMF not discovered in HOME-ROUTED");
+                        state = AMF_SMF_SELECTION_IN_VPLMN_IN_HOME_ROUTED;
+                    } else {
+                        ogs_info("V-SMF not discovered in NON-ROAMING OR LBO");
+                        state =
+                            AMF_SMF_SELECTION_IN_VPLMN_IN_NON_ROAMING_OR_LBO;
+                    }
+                }
+
+                if (state == AMF_SMF_SELECTION_IN_VPLMN_IN_NON_ROAMING_OR_LBO ||
+                        state == AMF_SMF_SELECTION_IN_VPLMN_IN_HOME_ROUTED) {
+                    /********************************************
+                     * Send nnssf-nsselection (GET)
+                     *******************************************/
+                    ogs_info("nnssf-nsselection%d:%d:%p:%p",
+                            state,
+                            param.slice_info_for_pdu_session.roaming_indication,
+                            v_smf_instance,
+                            h_smf_instance);
                     r = amf_sess_sbi_discover_and_send(
-                            OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION,
-                            discovery_option,
-                            amf_nsmf_pdusession_build_create_sm_context,
-                            ran_ue, sess, AMF_CREATE_SM_CONTEXT_NO_STATE, NULL);
+                            OGS_SBI_SERVICE_TYPE_NNSSF_NSSELECTION, NULL,
+                            amf_nnssf_nsselection_build_get,
+                            ran_ue, sess, state, &param);
                     ogs_expect(r == OGS_OK);
                     ogs_assert(r != OGS_ERROR);
-                } else {
+
+                    ogs_sbi_discovery_option_free(v_discovery_option);
+
+                } else if (state == AMF_CREATE_SM_CONTEXT_NO_STATE) {
+                    /********************************************
+                     * Send nsmf-pdusession (CREATE SM CONTEXT)
+                     *******************************************/
+                    ogs_info("nsmf_pdusession %d:%p:%p",
+                            param.slice_info_for_pdu_session.roaming_indication,
+                            v_smf_instance,
+                            h_smf_instance);
                     r = amf_sess_sbi_discover_and_send(
-                            OGS_SBI_SERVICE_TYPE_NNSSF_NSSELECTION,
-                            discovery_option,
-                            amf_nnssf_nsselection_build_get,
-                            ran_ue, sess, 0, NULL);
+                            OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION,
+                            v_discovery_option,
+                            amf_nsmf_pdusession_build_create_sm_context,
+                            ran_ue, sess, state, NULL);
                     ogs_expect(r == OGS_OK);
                     ogs_assert(r != OGS_ERROR);
+
+                } else {
+                    ogs_error("Invalid state %d", state);
+                    ogs_assert_if_reached();
                 }
 
             } else {
+                amf_nsmf_pdusession_sm_context_param_t param;
 
                 memset(&param, 0, sizeof(param));
                 param.release = 1;
@@ -1460,7 +1649,6 @@
             }
 
         } else {
-
             if (!SESSION_CONTEXT_IN_SMF(sess)) {
                 ogs_error("%s:%d Session Context is not in SMF %d",
                     amf_ue->supi, sess->psi, gsm_header->message_type);
@@ -1471,11 +1659,13 @@
                 return OGS_ERROR;
             }
 
-            memset(&param, 0, sizeof(param));
-            param.n1smbuf = sess->payload_container;
-
             if (gsm_header->message_type ==
                     OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE) {
+                amf_nsmf_pdusession_sm_context_param_t param;
+
+                memset(&param, 0, sizeof(param));
+                param.n1smbuf = sess->payload_container;
+
                 param.ue_location = true;
                 param.ue_timezone = true;
 
@@ -1487,6 +1677,10 @@
                 ogs_expect(r == OGS_OK);
                 ogs_assert(r != OGS_ERROR);
             } else {
+                amf_nsmf_pdusession_sm_context_param_t param;
+
+                memset(&param, 0, sizeof(param));
+                param.n1smbuf = sess->payload_container;
 
                 r = amf_sess_sbi_discover_and_send(
                         OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,

open5gs_2.7.6.tar.xz/src/amf/gmm-handler.h -> open5gs_2.7.7.tar.xz/src/amf/gmm-handler.h Changed

open5gs_2.7.6.tar.xz/src/amf/gmm-sm.c -> open5gs_2.7.7.tar.xz/src/amf/gmm-sm.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2026 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -86,6 +86,8 @@
 
     int r, state = 0, xact_count;
 
+    amf_nsmf_pdusession_sm_context_param_t param;
+
     ogs_assert(s);
     ogs_assert(e);
 
@@ -244,13 +246,12 @@
                 ogs_expect(r == OGS_OK);
                 ogs_assert(r != OGS_ERROR);
             } else if (PCF_AM_POLICY_ASSOCIATED(amf_ue)) {
-                    r = amf_ue_sbi_discover_and_send(
-                        OGS_SBI_SERVICE_TYPE_NPCF_AM_POLICY_CONTROL,
-                        NULL,
-                        amf_npcf_am_policy_control_build_delete,
-                        amf_ue, state, NULL);
-                    ogs_expect(r == OGS_OK);
-                    ogs_assert(r != OGS_ERROR);
+                r = amf_ue_sbi_discover_and_send(
+                    OGS_SBI_SERVICE_TYPE_NPCF_AM_POLICY_CONTROL, NULL,
+                    amf_npcf_am_policy_control_build_delete,
+                    amf_ue, state, NULL);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
             }
             break;
 
@@ -265,6 +266,8 @@
         ogs_assert(sbi_message);
         state = e->h.sbi.state;
 
+        xact_count = amf_sess_xact_count(amf_ue);
+
         SWITCH(sbi_message->h.service.name)
         CASE(OGS_SBI_SERVICE_NAME_NAUSF_AUTH)
             SWITCH(sbi_message->h.resource.component0)
@@ -291,6 +294,57 @@
                     ogs_error("%s Ignore SBI message", amf_ue->suci);
                     break;
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
+                    /*
+                     * gmm_state_de_registered()
+                     *
+                     * - AMF_UE_INITIATED_DE_REGISTERED
+                     * 1. PDU session establishment request
+                     * 2. PDUSessionResourceSetupRequest +
+                     *    PDU session establishment accept
+                     * 3. PDUSessionResourceSetupResponse
+                     * 4. Authentication Result Removal
+                     * 5. AM_Policy_Association_Termination
+                     * 6. Deregistration request
+                     * 7. UEContextReleaseCommand
+                     * 8. UEContextReleaseComplete
+                     *
+                     * - AMF_RELEASE_SM_CONTEXT_NO_STATE
+                     * 1. PDU session release request
+                     * 2. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 3. PDUSessionResourceReleaseREsponse
+                     * 4. PDU session release complete
+                     * 5. Authentication Result Removal
+                     * 6. AM_Policy_Association_Termination
+                     * 7. Deregistration request
+                     * 8. UEContextReleaseCommand
+                     * 9. UEContextReleaseComplete
+                     *
+                     * - AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED
+                     * 1. Implicit Timer Expiration
+                     * 2. UDM_SDM_Unsubscribe
+                     * 3. UDM_UECM_Deregisration
+                     * 4. PDU session release request
+                     * 5. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 6. PDUSessionResourceReleaseResponse
+                     * 7. Authentication Result Removal
+                     * 8. AM_Policy_Association_Termination
+                     *
+                     * - AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED
+                     * 1. UDM_UECM_DeregistrationNotification
+                     * 2. Deregistration request
+                     * 3. UDM_SDM_Unsubscribe
+                     * 4. UDM_UECM_Deregisration
+                     * 5. PDU session release request
+                     * 6. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 7. PDUSessionResourceReleaseResponse
+                     * 8. Authentication Result Removal
+                     * 9. AM_Policy_Association_Termination
+                     * 10.Deregistration accept
+                     * 11.Signalling Connecion Release
+                     */
                     CLEAR_5G_AKA_CONFIRMATION(amf_ue);
 
                     if (state == AMF_RELEASE_SM_CONTEXT_NO_STATE ||
@@ -315,8 +369,12 @@
                                state ==
                             AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED) {
 
-                        xact_count = amf_sess_xact_count(amf_ue);
-                        amf_sbi_send_release_all_sessions(NULL, amf_ue, state);
+                        memset(&param, 0, sizeof(param));
+                        param.ue_location = true;
+                        param.ue_timezone = true;
+
+                        amf_sbi_send_release_all_sessions(
+                                NULL, amf_ue, state, &param);
 
                         if (!AMF_SESSION_RELEASE_PENDING(amf_ue) &&
                             amf_sess_xact_count(amf_ue) == xact_count) {
@@ -357,29 +415,38 @@
             if ((sbi_message->res_status != OGS_SBI_HTTP_STATUS_OK) &&
                 (sbi_message->res_status != OGS_SBI_HTTP_STATUS_CREATED) &&
                 (sbi_message->res_status != OGS_SBI_HTTP_STATUS_NO_CONTENT)) {
-                ogs_error("%s HTTP response error %d",
-                          amf_ue->supi, sbi_message->res_status);
+                ogs_error("%s HTTP response error %d in (%s:%s)",
+                        amf_ue->supi, sbi_message->res_status,
+                        sbi_message->h.method,
+                        sbi_message->h.resource.component1);
             }
 
             SWITCH(sbi_message->h.resource.component1)
             CASE(OGS_SBI_RESOURCE_NAME_AM_DATA)
             CASE(OGS_SBI_RESOURCE_NAME_SMF_SELECT_DATA)
             CASE(OGS_SBI_RESOURCE_NAME_UE_CONTEXT_IN_SMF_DATA)
-                ogs_error("%s Ignore SBI message", amf_ue->supi);
+                ogs_error("%s Ignore SBI message %d in (%s:%s)",
+                        amf_ue->supi, sbi_message->res_status,
+                        sbi_message->h.method,
+                        sbi_message->h.resource.component1);
                 break;
 
             CASE(OGS_SBI_RESOURCE_NAME_SDM_SUBSCRIPTIONS)
                 SWITCH(sbi_message->h.method)
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
                     /*
+                     * gmm_state_de_registered()
+                     *
                      * - AMF_UE_INITIATED_DE_REGISTERED
                      * 1. PDU session establishment request
                      * 2. PDUSessionResourceSetupRequest +
                      *    PDU session establishment accept
                      * 3. PDUSessionResourceSetupResponse
-                     * 4. Deregistration request
-                     * 5. UEContextReleaseCommand
-                     * 6. UEContextReleaseComplete
+                     * 4. Authentication Result Removal
+                     * 5. AM_Policy_Association_Termination
+                     * 6. Deregistration request
+                     * 7. UEContextReleaseCommand
+                     * 8. UEContextReleaseComplete
                      *
                      * - AMF_RELEASE_SM_CONTEXT_NO_STATE
                      * 1. PDU session release request
@@ -387,12 +454,41 @@
                      *    PDU session release command
                      * 3. PDUSessionResourceReleaseREsponse
                      * 4. PDU session release complete
-                     * 5. Deregistration request
-                     * 6. UEContextReleaseCommand
-                     * 7. UEContextReleaseComplete
+                     * 5. Authentication Result Removal
+                     * 6. AM_Policy_Association_Termination
+                     * 7. Deregistration request
+                     * 8. UEContextReleaseCommand
+                     * 9. UEContextReleaseComplete
+                     *
+                     * - AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED
+                     * 1. Implicit Timer Expiration
+                     * 2. UDM_SDM_Unsubscribe
+                     * 3. UDM_UECM_Deregisration
+                     * 4. PDU session release request
+                     * 5. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 6. PDUSessionResourceReleaseResponse
+                     * 7. Authentication Result Removal
+                     * 8. AM_Policy_Association_Termination
+                     *
+                     * - AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED
+                     * 1. UDM_UECM_DeregistrationNotification
+                     * 2. Deregistration request
+                     * 3. UDM_SDM_Unsubscribe
+                     * 4. UDM_UECM_Deregisration
+                     * 5. PDU session release request
+                     * 6. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 7. PDUSessionResourceReleaseResponse
+                     * 8. Authentication Result Removal
+                     * 9. AM_Policy_Association_Termination
+                     * 10.Deregistration accept
+                     * 11.Signalling Connecion Release
                      */
                     if (state == AMF_RELEASE_SM_CONTEXT_NO_STATE ||
-                        state == AMF_UE_INITIATED_DE_REGISTERED) {
+                        state == AMF_UE_INITIATED_DE_REGISTERED ||
+                        state == AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED ||
+                        state == AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED) {
                         UDM_SDM_CLEAR(amf_ue);
 
                         r = amf_ue_sbi_discover_and_send(
@@ -402,18 +498,25 @@
                         ogs_expect(r == OGS_OK);
                         ogs_assert(r != OGS_ERROR);
                     } else {
-                        ogs_fatal("Invalid state %d", state);
+                        ogs_fatal("%s:%d Invalid state %d in (%s:%s)",
+                                amf_ue->supi, state, sbi_message->res_status,
+                                sbi_message->h.method,
+                                sbi_message->h.resource.component1);
                         ogs_assert_if_reached();
                     }
                     break;
                 DEFAULT
-                    ogs_error("%s Ignore invalid HTTP method %s",
-                            amf_ue->suci, sbi_message->h.method);
+                    ogs_error("%s Ignore invalid HTTP method %d in (%s:%s)",
+                            amf_ue->supi, sbi_message->res_status,
+                            sbi_message->h.method,
+                            sbi_message->h.resource.component1);
                 END
                 break;
 
             DEFAULT
-                ogs_error("Invalid resource name %s",
+                ogs_fatal("%s Invalid resource name %d in (%s:%s)",
+                        amf_ue->supi, sbi_message->res_status,
+                        sbi_message->h.method,
                         sbi_message->h.resource.component1);
                 ogs_assert_if_reached();
             END
@@ -436,33 +539,62 @@
                 CASE(OGS_SBI_HTTP_METHOD_PATCH)
                     SWITCH(sbi_message->h.resource.component2)
                     CASE(OGS_SBI_RESOURCE_NAME_AMF_3GPP_ACCESS)
-                        /*
-                         * - AMF_UE_INITIATED_DE_REGISTERED
-                         * 1. PDU session establishment request
-                         * 2. PDUSessionResourceSetupRequest +
-                         *    PDU session establishment accept
-                         * 3. PDUSessionResourceSetupResponse
-                         * 4. Deregistration request
-                         * 5. UEContextReleaseCommand
-                         * 6. UEContextReleaseComplete
-                         *
-                         * - AMF_RELEASE_SM_CONTEXT_NO_STATE
-                         * 1. PDU session release request
-                         * 2. PDUSessionResourceReleaseCommand +
-                         *    PDU session release command
-                         * 3. PDUSessionResourceReleaseREsponse
-                         * 4. PDU session release complete
-                         * 5. Deregistration request
-                         * 6. UEContextReleaseCommand
-                         * 7. UEContextReleaseComplete
-                         */
+                    /*
+                     * gmm_state_de_registered()
+                     *
+                     * - AMF_UE_INITIATED_DE_REGISTERED
+                     * 1. PDU session establishment request
+                     * 2. PDUSessionResourceSetupRequest +
+                     *    PDU session establishment accept
+                     * 3. PDUSessionResourceSetupResponse
+                     * 4. Authentication Result Removal
+                     * 5. AM_Policy_Association_Termination
+                     * 6. Deregistration request
+                     * 7. UEContextReleaseCommand
+                     * 8. UEContextReleaseComplete
+                     *
+                     * - AMF_RELEASE_SM_CONTEXT_NO_STATE
+                     * 1. PDU session release request
+                     * 2. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 3. PDUSessionResourceReleaseREsponse
+                     * 4. PDU session release complete
+                     * 5. Authentication Result Removal
+                     * 6. AM_Policy_Association_Termination
+                     * 7. Deregistration request
+                     * 8. UEContextReleaseCommand
+                     * 9. UEContextReleaseComplete
+                     *
+                     * - AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED
+                     * 1. Implicit Timer Expiration
+                     * 2. UDM_SDM_Unsubscribe
+                     * 3. UDM_UECM_Deregisration
+                     * 4. PDU session release request
+                     * 5. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 6. PDUSessionResourceReleaseResponse
+                     * 7. Authentication Result Removal
+                     * 8. AM_Policy_Association_Termination
+                     *
+                     * - AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED
+                     * 1. UDM_UECM_DeregistrationNotification
+                     * 2. Deregistration request
+                     * 3. UDM_SDM_Unsubscribe
+                     * 4. UDM_UECM_Deregisration
+                     * 5. PDU session release request
+                     * 6. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 7. PDUSessionResourceReleaseResponse
+                     * 8. Authentication Result Removal
+                     * 9. AM_Policy_Association_Termination
+                     * 10.Deregistration accept
+                     * 11.Signalling Connecion Release
+                     */
                         if (state == AMF_RELEASE_SM_CONTEXT_NO_STATE ||
                             state == AMF_UE_INITIATED_DE_REGISTERED) {
-
                             if (CHECK_5G_AKA_CONFIRMATION(amf_ue)) {
                                 r = amf_ue_sbi_discover_and_send(
-                                    OGS_SBI_SERVICE_TYPE_NAUSF_AUTH,
-                                    NULL,
+                                    OGS_SBI_SERVICE_TYPE_NAUSF_AUTH, NULL,
                                     amf_nausf_auth_build_authenticate_delete,
                                     amf_ue, state, NULL);
                                 ogs_expect(r == OGS_OK);
@@ -480,6 +612,39 @@
                                 ogs_expect(r == OGS_OK);
                                 ogs_assert(r != OGS_ERROR);
                             }
+                        } else if (state ==
+                                AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED ||
+                                state ==
+                                AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED) {
+                            if (CHECK_5G_AKA_CONFIRMATION(amf_ue)) {
+                                r = amf_ue_sbi_discover_and_send(
+                                        OGS_SBI_SERVICE_TYPE_NAUSF_AUTH, NULL,
+                                        amf_nausf_auth_build_authenticate_delete,
+                                        amf_ue, state, NULL);
+                                ogs_expect(r == OGS_OK);
+                                ogs_assert(r != OGS_ERROR);
+                            } else {
+                                memset(&param, 0, sizeof(param));
+                                param.ue_location = true;
+                                param.ue_timezone = true;
+
+                                amf_sbi_send_release_all_sessions(
+                                        NULL, amf_ue, state, &param);
+
+                                if (!AMF_SESSION_RELEASE_PENDING(amf_ue) &&
+                                    amf_sess_xact_count(amf_ue) == xact_count) {
+
+                                    if (PCF_AM_POLICY_ASSOCIATED(amf_ue)) {
+                                        r = amf_ue_sbi_discover_and_send(
+                                                OGS_SBI_SERVICE_TYPE_NPCF_AM_POLICY_CONTROL,
+                                                NULL,
+                                                amf_npcf_am_policy_control_build_delete,
+                                                amf_ue, state, NULL);
+                                        ogs_expect(r == OGS_OK);
+                                        ogs_assert(r != OGS_ERROR);
+                                    }
+                                }
+                            }
                         } else {
                             ogs_fatal("Invalid state %d", state);
                             ogs_assert_if_reached();
@@ -510,7 +675,8 @@
             CASE(OGS_SBI_RESOURCE_NAME_POLICIES)
                 SWITCH(sbi_message->h.method)
                 CASE(OGS_SBI_HTTP_METHOD_POST)
-                    if (sbi_message->res_status != OGS_SBI_HTTP_STATUS_CREATED) {
+                    if (sbi_message->res_status !=
+                            OGS_SBI_HTTP_STATUS_CREATED) {
                         ogs_error("%s HTTP response error %d",
                                 amf_ue->supi, sbi_message->res_status);
                     }
@@ -519,14 +685,18 @@
 
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
                     /*
+                     * gmm_state_de_registered()
+                     *
                      * - AMF_UE_INITIATED_DE_REGISTERED
                      * 1. PDU session establishment request
                      * 2. PDUSessionResourceSetupRequest +
                      *    PDU session establishment accept
                      * 3. PDUSessionResourceSetupResponse
-                     * 4. Deregistration request
-                     * 5. UEContextReleaseCommand
-                     * 6. UEContextReleaseComplete
+                     * 4. Authentication Result Removal
+                     * 5. AM_Policy_Association_Termination
+                     * 6. Deregistration request
+                     * 7. UEContextReleaseCommand
+                     * 8. UEContextReleaseComplete
                      *
                      * - AMF_RELEASE_SM_CONTEXT_NO_STATE
                      * 1. PDU session release request
@@ -534,9 +704,36 @@
                      *    PDU session release command
                      * 3. PDUSessionResourceReleaseREsponse
                      * 4. PDU session release complete
-                     * 5. Deregistration request
-                     * 6. UEContextReleaseCommand
-                     * 7. UEContextReleaseComplete
+                     * 5. Authentication Result Removal
+                     * 6. AM_Policy_Association_Termination
+                     * 7. Deregistration request
+                     * 8. UEContextReleaseCommand
+                     * 9. UEContextReleaseComplete
+                     *
+                     * - AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED
+                     * 1. Implicit Timer Expiration
+                     * 2. UDM_SDM_Unsubscribe
+                     * 3. UDM_UECM_Deregisration
+                     * 4. PDU session release request
+                     * 5. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 6. PDUSessionResourceReleaseResponse
+                     * 7. Authentication Result Removal
+                     * 8. AM_Policy_Association_Termination
+                     *
+                     * - AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED
+                     * 1. UDM_UECM_DeregistrationNotification
+                     * 2. Deregistration request
+                     * 3. UDM_SDM_Unsubscribe
+                     * 4. UDM_UECM_Deregisration
+                     * 5. PDU session release request
+                     * 6. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 7. PDUSessionResourceReleaseResponse
+                     * 8. Authentication Result Removal
+                     * 9. AM_Policy_Association_Termination
+                     * 10.Deregistration accept
+                     * 11.Signalling Connecion Release
                      */
                     if (state == AMF_RELEASE_SM_CONTEXT_NO_STATE ||
                         state == AMF_UE_INITIATED_DE_REGISTERED) {
@@ -545,6 +742,27 @@
                         ogs_assert(r != OGS_ERROR);
 
                         PCF_AM_POLICY_CLEAR(amf_ue);
+                    } else if (state ==
+                            AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED) {
+                        ogs_warn("%s Implicit De-registered", amf_ue->supi);
+                        OGS_FSM_TRAN(&amf_ue->sm,
+                                &gmm_state_ue_context_will_remove);
+
+                    } else if (state ==
+                            AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED) {
+                        ogs_warn("%s Explicit De-registered", amf_ue->supi);
+
+                        amf_ue->explict_de_registered.sbi_done = true;
+
+                        if (amf_ue->explict_de_registered.n1_done == true) {
+                            r = ngap_send_ran_ue_context_release_command(
+                                    ran_ue_find_by_id(amf_ue->ran_ue_id),
+                                    NGAP_Cause_PR_misc,
+                                    NGAP_CauseMisc_om_intervention,
+                                    NGAP_UE_CTX_REL_UE_CONTEXT_REMOVE, 0);
+                            ogs_expect(r == OGS_OK);
+                            ogs_assert(r != OGS_ERROR);
+                        }
                     } else {
                         ogs_fatal("Invalid state %d", state);
                         ogs_assert_if_reached();
@@ -601,10 +819,13 @@
                         }
                     }
 
-                    xact_count = amf_sess_xact_count(amf_ue);
+                    memset(&param, 0, sizeof(param));
+                    param.ue_location = true;
+                    param.ue_timezone = true;
+
                     amf_sbi_send_release_all_sessions(
                             ran_ue_find_by_id(amf_ue->ran_ue_id), amf_ue,
-                            AMF_RELEASE_SM_CONTEXT_NO_STATE);
+                            AMF_RELEASE_SM_CONTEXT_NO_STATE, &param);
 
                     if (!AMF_SESSION_RELEASE_PENDING(amf_ue) &&
                         amf_sess_xact_count(amf_ue) == xact_count) {
@@ -653,6 +874,8 @@
 
     ogs_sbi_message_t *sbi_message = NULL;
 
+    amf_nsmf_pdusession_sm_context_param_t param;
+
     ogs_assert(s);
     ogs_assert(e);
 
@@ -840,13 +1063,12 @@
                 ogs_expect(r == OGS_OK);
                 ogs_assert(r != OGS_ERROR);
             } else if (PCF_AM_POLICY_ASSOCIATED(amf_ue)) {
-                    r = amf_ue_sbi_discover_and_send(
-                        OGS_SBI_SERVICE_TYPE_NPCF_AM_POLICY_CONTROL,
-                        NULL,
-                        amf_npcf_am_policy_control_build_delete,
-                        amf_ue, state, NULL);
-                    ogs_expect(r == OGS_OK);
-                    ogs_assert(r != OGS_ERROR);
+                r = amf_ue_sbi_discover_and_send(
+                    OGS_SBI_SERVICE_TYPE_NPCF_AM_POLICY_CONTROL, NULL,
+                    amf_npcf_am_policy_control_build_delete,
+                    amf_ue, state, NULL);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
             }
             break;
 
@@ -867,7 +1089,6 @@
         CASE(OGS_SBI_SERVICE_NAME_NAUSF_AUTH)
             SWITCH(sbi_message->h.resource.component0)
             CASE(OGS_SBI_RESOURCE_NAME_UE_AUTHENTICATIONS)
-
                 if (sbi_message->res_status != OGS_SBI_HTTP_STATUS_CREATED &&
                     sbi_message->res_status != OGS_SBI_HTTP_STATUS_OK &&
                     sbi_message->res_status != OGS_SBI_HTTP_STATUS_NO_CONTENT) {
@@ -889,6 +1110,57 @@
                     ogs_error("%s Ignore SBI message", amf_ue->suci);
                     break;
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
+                    /*
+                     * gmm_state_registered()
+                     *
+                     * - AMF_UE_INITIATED_DE_REGISTERED
+                     * 1. PDU session establishment request
+                     * 2. PDUSessionResourceSetupRequest +
+                     *    PDU session establishment accept
+                     * 3. PDUSessionResourceSetupResponse
+                     * 4. Authentication Result Removal
+                     * 5. AM_Policy_Association_Termination
+                     * 6. Deregistration request
+                     * 7. UEContextReleaseCommand
+                     * 8. UEContextReleaseComplete
+                     *
+                     * - AMF_RELEASE_SM_CONTEXT_NO_STATE
+                     * 1. PDU session release request
+                     * 2. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 3. PDUSessionResourceReleaseREsponse
+                     * 4. PDU session release complete
+                     * 5. Authentication Result Removal
+                     * 6. AM_Policy_Association_Termination
+                     * 7. Deregistration request
+                     * 8. UEContextReleaseCommand
+                     * 9. UEContextReleaseComplete
+                     *
+                     * - AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED
+                     * 1. Implicit Timer Expiration
+                     * 2. UDM_SDM_Unsubscribe
+                     * 3. UDM_UECM_Deregisration
+                     * 4. PDU session release request
+                     * 5. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 6. PDUSessionResourceReleaseResponse
+                     * 7. Authentication Result Removal
+                     * 8. AM_Policy_Association_Termination
+                     *
+                     * - AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED
+                     * 1. UDM_UECM_DeregistrationNotification
+                     * 2. Deregistration request
+                     * 3. UDM_SDM_Unsubscribe
+                     * 4. UDM_UECM_Deregisration
+                     * 5. PDU session release request
+                     * 6. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 7. PDUSessionResourceReleaseResponse
+                     * 8. Authentication Result Removal
+                     * 9. AM_Policy_Association_Termination
+                     * 10.Deregistration accept
+                     * 11.Signalling Connecion Release
+                     */
                     CLEAR_5G_AKA_CONFIRMATION(amf_ue);
 
                     if (state == AMF_RELEASE_SM_CONTEXT_NO_STATE ||
@@ -913,8 +1185,12 @@
                                state ==
                             AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED) {
 
-                        int xact_count = amf_sess_xact_count(amf_ue);
-                        amf_sbi_send_release_all_sessions(NULL, amf_ue, state);
+                        memset(&param, 0, sizeof(param));
+                        param.ue_location = true;
+                        param.ue_timezone = true;
+
+                        amf_sbi_send_release_all_sessions(
+                                NULL, amf_ue, state, &param);
 
                         if (!AMF_SESSION_RELEASE_PENDING(amf_ue) &&
                             amf_sess_xact_count(amf_ue) == xact_count) {
@@ -955,21 +1231,28 @@
             if ((sbi_message->res_status != OGS_SBI_HTTP_STATUS_OK) &&
                 (sbi_message->res_status != OGS_SBI_HTTP_STATUS_CREATED) &&
                 (sbi_message->res_status != OGS_SBI_HTTP_STATUS_NO_CONTENT)) {
-                ogs_error("%s HTTP response error %d",
-                          amf_ue->supi, sbi_message->res_status);
+                ogs_error("%s HTTP response error %d in (%s:%s)",
+                        amf_ue->supi, sbi_message->res_status,
+                        sbi_message->h.method,
+                        sbi_message->h.resource.component1);
             }
 
             SWITCH(sbi_message->h.resource.component1)
             CASE(OGS_SBI_RESOURCE_NAME_AM_DATA)
             CASE(OGS_SBI_RESOURCE_NAME_SMF_SELECT_DATA)
             CASE(OGS_SBI_RESOURCE_NAME_UE_CONTEXT_IN_SMF_DATA)
-                ogs_error("%s Ignore SBI message", amf_ue->supi);
+                ogs_error("%s Ignore SBI message %d in (%s:%s)",
+                        amf_ue->supi, sbi_message->res_status,
+                        sbi_message->h.method,
+                        sbi_message->h.resource.component1);
                 break;
 
             CASE(OGS_SBI_RESOURCE_NAME_SDM_SUBSCRIPTIONS)
                 SWITCH(sbi_message->h.method)
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
                     /*
+                     * gmm_state_registered()
+                     *
                      * - AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED
                      * 1. Implicit Timer Expiration
                      * 2. UDM_SDM_Unsubscribe
@@ -978,7 +1261,8 @@
                      * 5. PDUSessionResourceReleaseCommand +
                      *    PDU session release command
                      * 6. PDUSessionResourceReleaseResponse
-                     * 7. AM_Policy_Association_Termination
+                     * 7. Authentication Result Removal
+                     * 8. AM_Policy_Association_Termination
                      *
                      * - AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED
                      * 1. UDM_UECM_DeregistrationNotification
@@ -989,9 +1273,10 @@
                      * 6. PDUSessionResourceReleaseCommand +
                      *    PDU session release command
                      * 7. PDUSessionResourceReleaseResponse
-                     * 8. AM_Policy_Association_Termination
-                     * 9.  Deregistration accept
-                     * 10. Signalling Connecion Release
+                     * 8. Authentication Result Removal
+                     * 9. AM_Policy_Association_Termination
+                     * 10.Deregistration accept
+                     * 11.Signalling Connecion Release
                      */
                     if (state ==
                             AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED ||
@@ -1005,19 +1290,48 @@
                                 amf_ue, state, NULL);
                         ogs_expect(r == OGS_OK);
                         ogs_assert(r != OGS_ERROR);
+                    } else if (state == AMF_UE_INITIATED_DE_REGISTERED) {
+/*
+ * Issues: #4209
+ *
+ * gmm_state_registered()
+ *
+ * Ignore SDM subscription DELETE response.
+ *
+ * In some scenarios, a DELETE response for SDM_SUBSCRIPTIONS may arrive
+ * while the AMF is already handling a subsequent Registration Request
+ * (Integrity Protected). In this code path, the DELETE response is not
+ * relevant and does not require any further processing.
+ *
+ * The response is intentionally ignored to avoid unnecessary handling.
+ */
+                        ogs_warn("%s Ignoring SDM_SUBSCRIPTIONS DELETE "
+                                "response %d in (%s:%s)",
+                                amf_ue->supi, sbi_message->res_status,
+                                sbi_message->h.method,
+                                sbi_message->h.resource.component1);
+
+                        UDM_SDM_CLEAR(amf_ue);
                     } else {
-                        ogs_fatal("Invalid state %d", state);
+                        ogs_fatal("%s:%d Invalid state %d in (%s:%s)",
+                                amf_ue->supi, state, sbi_message->res_status,
+                                sbi_message->h.method,
+                                sbi_message->h.resource.component1);
                         ogs_assert_if_reached();
                     }
                     break;
                 DEFAULT
-                    ogs_warn("%s Ignore invalid HTTP method %s",
-                            amf_ue->suci, sbi_message->h.method);
+                    ogs_error("%s Ignore invalid HTTP method %d in (%s:%s)",
+                            amf_ue->supi, sbi_message->res_status,
+                            sbi_message->h.method,
+                            sbi_message->h.resource.component1);
                 END
                 break;
 
             DEFAULT
-                ogs_error("Invalid resource name %s",
+                ogs_fatal("%s Invalid resource name %d in (%s:%s)",
+                        amf_ue->supi, sbi_message->res_status,
+                        sbi_message->h.method,
                         sbi_message->h.resource.component1);
                 ogs_assert_if_reached();
             END
@@ -1040,38 +1354,40 @@
                 CASE(OGS_SBI_HTTP_METHOD_PATCH)
                     SWITCH(sbi_message->h.resource.component2)
                     CASE(OGS_SBI_RESOURCE_NAME_AMF_3GPP_ACCESS)
-                        /*
-                         * - AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED
-                         * 1. Implicit Timer Expiration
-                         * 2. UDM_SDM_Unsubscribe
-                         * 3. UDM_UECM_Deregisration
-                         * 4. Authentication Result Removal
-                         * 5. PDU session release request
-                         * 6. PDUSessionResourceReleaseCommand +
-                         *    PDU session release command
-                         * 7. PDUSessionResourceReleaseResponse
-                         * 8. AM_Policy_Association_Termination
-                         *
-                         * - AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED
-                         * 1. UDM_UECM_DeregistrationNotification
-                         * 2. Deregistration request
-                         * 3. UDM_SDM_Unsubscribe
-                         * 4. UDM_UECM_Deregisration
-                         * 5. Authentication Result Removal
-                         * 6. PDU session release request
-                         * 7. PDUSessionResourceReleaseCommand +
-                         *    PDU session release command
-                         * 8. PDUSessionResourceReleaseResponse
-                         * 9. AM_Policy_Association_Termination
-                         * 10. Deregistration accept
-                         * 11. Signalling Connecion Release
-                         */
+                    /*
+                     * gmm_state_registered()
+                     *
+                     * - AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED
+                     * 1. Implicit Timer Expiration
+                     * 2. UDM_SDM_Unsubscribe
+                     * 3. UDM_UECM_Deregisration
+                     * 4. PDU session release request
+                     * 5. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 6. PDUSessionResourceReleaseResponse
+                     * 7. Authentication Result Removal
+                     * 8. AM_Policy_Association_Termination
+                     *
+                     * - AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED
+                     * 1. UDM_UECM_DeregistrationNotification
+                     * 2. Deregistration request
+                     * 3. UDM_SDM_Unsubscribe
+                     * 4. UDM_UECM_Deregisration
+                     * 5. PDU session release request
+                     * 6. PDUSessionResourceReleaseCommand +
+                     *    PDU session release command
+                     * 7. PDUSessionResourceReleaseResponse
+                     * 8. Authentication Result Removal
+                     * 9. AM_Policy_Association_Termination
+                     * 10.Deregistration accept
+                     * 11.Signalling Connecion Release
+                     */
                         if (state ==
                                 AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED ||
                             state ==
                                 AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED) {
 
-                            if (amf_ue->confirmation_for_5g_aka.resource_uri) {
+                            if (CHECK_5G_AKA_CONFIRMATION(amf_ue)) {
                                 r = amf_ue_sbi_discover_and_send(
                                         OGS_SBI_SERVICE_TYPE_NAUSF_AUTH,
                                         NULL,
@@ -1081,9 +1397,12 @@
                                 ogs_assert(r != OGS_ERROR);
 
                             } else {
+                                memset(&param, 0, sizeof(param));
+                                param.ue_location = true;
+                                param.ue_timezone = true;
 
                                 amf_sbi_send_release_all_sessions(
-                                        NULL, amf_ue, state);
+                                        NULL, amf_ue, state, &param);
 
                                 if (!AMF_SESSION_RELEASE_PENDING(amf_ue) &&
                                     amf_sess_xact_count(amf_ue) == xact_count) {
@@ -1129,7 +1448,8 @@
             CASE(OGS_SBI_RESOURCE_NAME_POLICIES)
                 SWITCH(sbi_message->h.method)
                 CASE(OGS_SBI_HTTP_METHOD_POST)
-                    if (sbi_message->res_status != OGS_SBI_HTTP_STATUS_CREATED) {
+                    if (sbi_message->res_status !=
+                            OGS_SBI_HTTP_STATUS_CREATED) {
                         ogs_error("%s HTTP response error %d",
                                 amf_ue->supi, sbi_message->res_status);
                     }
@@ -1138,6 +1458,8 @@
 
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
                     /*
+                     * gmm_state_registered()
+                     *
                      * - AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED
                      * 1. Implicit Timer Expiration
                      * 2. UDM_SDM_Unsubscribe
@@ -1146,7 +1468,8 @@
                      * 5. PDUSessionResourceReleaseCommand +
                      *    PDU session release command
                      * 6. PDUSessionResourceReleaseResponse
-                     * 7. AM_Policy_Association_Termination
+                     * 7. Authentication Result Removal
+                     * 8. AM_Policy_Association_Termination
                      *
                      * - AMF_NETWORK_INITIATED_EXPLICIT_DE_REGISTERED
                      * 1. UDM_UECM_DeregistrationNotification
@@ -1157,9 +1480,10 @@
                      * 6. PDUSessionResourceReleaseCommand +
                      *    PDU session release command
                      * 7. PDUSessionResourceReleaseResponse
-                     * 8. AM_Policy_Association_Termination
-                     * 9. Deregistration accept
-                     * 10.Signalling Connecion Release
+                     * 8. Authentication Result Removal
+                     * 9. AM_Policy_Association_Termination
+                     * 10.Deregistration accept
+                     * 11.Signalling Connecion Release
                      */
                     if (state == AMF_NETWORK_INITIATED_IMPLICIT_DE_REGISTERED) {
                         ogs_warn("%s Implicit De-registered", amf_ue->supi);
@@ -1239,9 +1563,14 @@
                     }
 
                     xact_count = amf_sess_xact_count(amf_ue);
+
+                    memset(&param, 0, sizeof(param));
+                    param.ue_location = true;
+                    param.ue_timezone = true;
+
                     amf_sbi_send_release_all_sessions(
                             ran_ue_find_by_id(amf_ue->ran_ue_id), amf_ue,
-                            AMF_RELEASE_SM_CONTEXT_NO_STATE);
+                            AMF_RELEASE_SM_CONTEXT_NO_STATE, &param);
 
                     if (!AMF_SESSION_RELEASE_PENDING(amf_ue) &&
                         amf_sess_xact_count(amf_ue) == xact_count) {
@@ -1293,6 +1622,8 @@
     ogs_nas_5gs_message_t *nas_message = NULL;
     ogs_nas_security_header_type_t h;
 
+    amf_nsmf_pdusession_sm_context_param_t param;
+
     ogs_assert(e);
 
     sess = amf_sess_find_by_id(e->sess_id);
@@ -1349,13 +1680,15 @@
                 amf_metrics_inst_global_inc(AMF_METR_GLOB_CTR_RM_REG_MOB_REQ);
                 break;
             case OGS_NAS_5GS_REGISTRATION_TYPE_PERIODIC_UPDATING:
-                amf_metrics_inst_global_inc(AMF_METR_GLOB_CTR_RM_REG_PERIOD_REQ);
+                amf_metrics_inst_global_inc(
+                        AMF_METR_GLOB_CTR_RM_REG_PERIOD_REQ);
                 break;
             case OGS_NAS_5GS_REGISTRATION_TYPE_EMERGENCY:
                 amf_metrics_inst_global_inc(AMF_METR_GLOB_CTR_RM_REG_EMERG_REQ);
                 break;
             default:
-                ogs_error("Unknown reg_type%d", amf_ue->nas.registration.value);
+                ogs_error("Unknown reg_type%d",
+                        amf_ue->nas.registration.value);
             }
 
             if (gmm_cause != OGS_5GMM_CAUSE_REQUEST_ACCEPTED) {
@@ -1374,7 +1707,8 @@
                 ogs_sbi_discovery_option_t *discovery_option = NULL;
                 ogs_guami_t guami;
 
-                amf_ue->amf_ue_context_transfer_state = UE_CONTEXT_INITIAL_STATE;
+                amf_ue->amf_ue_context_transfer_state =
+                    UE_CONTEXT_INITIAL_STATE;
 
                 discovery_option = ogs_sbi_discovery_option_new();
                 ogs_assert(discovery_option);
@@ -1445,7 +1779,8 @@
                     if (!UDM_SDM_SUBSCRIBED(amf_ue)) {
                         r = amf_ue_sbi_discover_and_send(
                                 OGS_SBI_SERVICE_TYPE_NUDM_UECM, NULL,
-                                amf_nudm_uecm_build_registration, amf_ue, 0, NULL);
+                                amf_nudm_uecm_build_registration,
+                                amf_ue, 0, NULL);
                         ogs_expect(r == OGS_OK);
                         ogs_assert(r != OGS_ERROR);
                         OGS_FSM_TRAN(s, &gmm_state_initial_context_setup);
@@ -1474,9 +1809,13 @@
                     OGS_FSM_TRAN(s, &gmm_state_registered);
 
             } else {
+                memset(&param, 0, sizeof(param));
+                param.ue_location = true;
+                param.ue_timezone = true;
 
                 amf_sbi_send_release_all_sessions(
-                        ran_ue, amf_ue, AMF_RELEASE_SM_CONTEXT_NO_STATE);
+                        ran_ue, amf_ue,
+                        AMF_RELEASE_SM_CONTEXT_NO_STATE, &param);
 
                 if (!AMF_SESSION_RELEASE_PENDING(amf_ue) &&
                     amf_sess_xact_count(amf_ue) == xact_count) {
@@ -1496,10 +1835,11 @@
             ogs_info("Service request");
 
             if (state != GMM_COMMON_STATE_REGISTERED) {
-                ogs_info("%s Handling service request failed Not registered",
-                            amf_ue->suci);
+                ogs_info("%s Handling service request failed "
+                        "Not registered", amf_ue->suci);
                 r = nas_5gs_send_service_reject(ran_ue, amf_ue,
-                    OGS_5GMM_CAUSE_UE_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK);
+                    OGS_5GMM_CAUSE_UE_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK
+                    );
                 ogs_expect(r == OGS_OK);
                 ogs_assert(r != OGS_ERROR);
                 AMF_RESTORE_CONTEXT_ON_FAILURE(amf_ue, s);
@@ -1521,7 +1861,8 @@
             if (!AMF_UE_HAVE_SUCI(amf_ue)) {
                 ogs_info("Service request : Unknown UE");
                 r = nas_5gs_send_service_reject(ran_ue, amf_ue,
-                    OGS_5GMM_CAUSE_UE_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK);
+                    OGS_5GMM_CAUSE_UE_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK
+                    );
                 ogs_expect(r == OGS_OK);
                 ogs_assert(r != OGS_ERROR);
                 AMF_RESTORE_CONTEXT_ON_FAILURE(amf_ue, s);
@@ -1531,7 +1872,8 @@
             if (!h.integrity_protected || !SECURITY_CONTEXT_IS_VALID(amf_ue)) {
                 ogs_error("No Security Context");
                 r = nas_5gs_send_service_reject(ran_ue, amf_ue,
-                    OGS_5GMM_CAUSE_UE_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK);
+                    OGS_5GMM_CAUSE_UE_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK
+                    );
                 ogs_expect(r == OGS_OK);
                 ogs_assert(r != OGS_ERROR);
                 AMF_RESTORE_CONTEXT_ON_FAILURE(amf_ue, s);
@@ -1598,8 +1940,12 @@
                 break;
             }
 
+            memset(&param, 0, sizeof(param));
+            param.ue_location = true;
+            param.ue_timezone = true;
+
             amf_sbi_send_release_all_sessions(
-                    ran_ue, amf_ue, AMF_RELEASE_SM_CONTEXT_NO_STATE);
+                    ran_ue, amf_ue, AMF_RELEASE_SM_CONTEXT_NO_STATE, &param);
 
             if (!AMF_SESSION_RELEASE_PENDING(amf_ue) &&
                 amf_sess_xact_count(amf_ue) == xact_count) {
@@ -1751,6 +2097,7 @@
 
     switch (e->h.id) {
     case OGS_FSM_ENTRY_SIG:
+        amf_ue->auth_synch_fail_count = 0;
         break;
     case OGS_FSM_EXIT_SIG:
         break;
@@ -1822,7 +2169,17 @@
                 return;
 
             case OGS_5GMM_CAUSE_SYNCH_FAILURE:
-                ogs_warn("Authentication failure(Synch failure)");
+                ogs_warn("%s Authentication failure(Synch failurecount=%d)",
+                        amf_ue->suci, amf_ue->auth_synch_fail_count);
+
+                amf_ue->auth_synch_fail_count++;
+
+                if (amf_ue->auth_synch_fail_count >= 2) {
+                    ogs_warn("%s Too many authentication synch failures, "
+                            "sending AUTHENTICATION REJECT", amf_ue->suci);
+                    break;
+                }
+
                 if (authentication_failure_parameter->length != OGS_AUTS_LEN) {
                     ogs_error("Invalid AUTS Length %d",
                             authentication_failure_parameter->length);
@@ -2020,6 +2377,14 @@
                      */
                     ogs_error("%s Ignore SBI message", amf_ue->supi);
                     break;
+                CASE(OGS_SBI_HTTP_METHOD_PATCH)
+                    /*
+                     * Issue #4074
+                     *
+                     * We need to ignore this message in this state.
+                     */
+                    ogs_error("%s Ignore SBI message", amf_ue->supi);
+                    break;
                 DEFAULT
                     ogs_error("%s Invalid HTTP method %s",
                             amf_ue->suci, sbi_message->h.method);
@@ -2038,20 +2403,59 @@
             if ((sbi_message->res_status != OGS_SBI_HTTP_STATUS_OK) &&
                 (sbi_message->res_status != OGS_SBI_HTTP_STATUS_CREATED) &&
                 (sbi_message->res_status != OGS_SBI_HTTP_STATUS_NO_CONTENT)) {
-                ogs_error("%s HTTP response error %d",
-                          amf_ue->supi, sbi_message->res_status);
+                ogs_error("%s HTTP response error %d in (%s:%s)",
+                        amf_ue->supi, sbi_message->res_status,
+                        sbi_message->h.method,
+                        sbi_message->h.resource.component1);
             }
 
             SWITCH(sbi_message->h.resource.component1)
             CASE(OGS_SBI_RESOURCE_NAME_AM_DATA)
             CASE(OGS_SBI_RESOURCE_NAME_SMF_SELECT_DATA)
             CASE(OGS_SBI_RESOURCE_NAME_UE_CONTEXT_IN_SMF_DATA)
-            CASE(OGS_SBI_RESOURCE_NAME_SDM_SUBSCRIPTIONS)
-                ogs_error("%s Ignore SBI message", amf_ue->supi);
+                ogs_error("%s Ignore SBI message %d in (%s:%s)",
+                        amf_ue->supi, sbi_message->res_status,
+                        sbi_message->h.method,
+                        sbi_message->h.resource.component1);
                 break;
 
+            CASE(OGS_SBI_RESOURCE_NAME_SDM_SUBSCRIPTIONS)
+                SWITCH(sbi_message->h.method)
+                CASE(OGS_SBI_HTTP_METHOD_DELETE)
+/*
+ * Issues: #4209
+ *
+ * gmm_state_authentication()
+ *
+ * Ignore SDM subscription DELETE response.
+ *
+ * In some scenarios, a DELETE response for SDM_SUBSCRIPTIONS may arrive
+ * while the AMF is already handling a subsequent Registration Request
+ * (Integrity Protected). In this code path, the DELETE response is not
+ * relevant and does not require any further processing.
+ *
+ * The response is intentionally ignored to avoid unnecessary handling.
+ */
+                    ogs_warn("%s Ignoring SDM_SUBSCRIPTIONS DELETE response"
+                            "%d in (%s:%s)",
+                            amf_ue->supi, sbi_message->res_status,
+                            sbi_message->h.method,
+                            sbi_message->h.resource.component1);
+
+                    UDM_SDM_CLEAR(amf_ue);
+                    break;
+                DEFAULT
+                    ogs_error("%s Ignoring invalid HTTP method"
+                            "%d in (%s:%s)",
+                            amf_ue->supi, sbi_message->res_status,
+                            sbi_message->h.method,
+                            sbi_message->h.resource.component1);
+                END
+                break;
             DEFAULT
-                ogs_error("Invalid resource name %s",
+                ogs_fatal("%s Invalid resource name %d in (%s:%s)",
+                        amf_ue->supi, sbi_message->res_status,
+                        sbi_message->h.method,
                         sbi_message->h.resource.component1);
                 ogs_assert_if_reached();
             END
@@ -2062,13 +2466,16 @@
             CASE(OGS_SBI_RESOURCE_NAME_POLICIES)
                 SWITCH(sbi_message->h.method)
                 CASE(OGS_SBI_HTTP_METHOD_POST)
-                    if (sbi_message->res_status != OGS_SBI_HTTP_STATUS_CREATED) {
+                    if (sbi_message->res_status !=
+                            OGS_SBI_HTTP_STATUS_CREATED) {
                         ogs_error("%s HTTP response error %d",
                                 amf_ue->supi, sbi_message->res_status);
                     }
                     ogs_error("%s Ignore SBI message", amf_ue->supi);
                     break;
-
+                CASE(OGS_SBI_HTTP_METHOD_DELETE)
+                    ogs_error("%s Ignore SBI message", amf_ue->supi);
+                    break;
                 DEFAULT
                     ogs_error("Unknown method %s", sbi_message->h.method);
                     ogs_assert_if_reached();
@@ -2191,7 +2598,8 @@
                 break;
             }
 
-            if (amf_ue->amf_ue_context_transfer_state == UE_CONTEXT_TRANSFER_NEW_AMF_STATE) {
+            if (amf_ue->amf_ue_context_transfer_state ==
+                    UE_CONTEXT_TRANSFER_NEW_AMF_STATE) {
                 /*
                 * UE context transfer message has been sent
                 * to old AMF after Registration request.
@@ -2219,7 +2627,8 @@
                 ogs_expect(r == OGS_OK);
                 ogs_assert(r != OGS_ERROR);
 
-                amf_ue->amf_ue_context_transfer_state = REGISTRATION_STATUS_UPDATE_NEW_AMF_STATE;
+                amf_ue->amf_ue_context_transfer_state =
+                    REGISTRATION_STATUS_UPDATE_NEW_AMF_STATE;
                 break;
             }
 
@@ -2279,7 +2688,8 @@
         case OGS_NAS_5GS_SERVICE_REQUEST:
             ogs_info("%s Service request", amf_ue->supi);
             r = nas_5gs_send_service_reject(ran_ue, amf_ue,
-                    OGS_5GMM_CAUSE_UE_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK);
+                    OGS_5GMM_CAUSE_UE_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK
+                    );
             ogs_expect(r == OGS_OK);
             ogs_assert(r != OGS_ERROR);
             OGS_FSM_TRAN(s, &gmm_state_exception);
@@ -2360,18 +2770,22 @@
             CASE(OGS_SBI_RESOURCE_NAME_UE_CONTEXTS)
                 SWITCH(sbi_message->h.resource.component2)
                 CASE(OGS_SBI_RESOURCE_NAME_TRANSFER_UPDATE)
-                    if (amf_ue->amf_ue_context_transfer_state != REGISTRATION_STATUS_UPDATE_NEW_AMF_STATE) {
+                    if (amf_ue->amf_ue_context_transfer_state !=
+                            REGISTRATION_STATUS_UPDATE_NEW_AMF_STATE) {
                         ogs_error("UE context transfer state not correct");
                     }
                     if (sbi_message->res_status != OGS_SBI_HTTP_STATUS_OK) {
                         ogs_error("%s HTTP response error %d",
                                 amf_ue->supi, sbi_message->res_status);
                     }
-                    r = amf_namf_comm_handle_registration_status_update_response(sbi_message, amf_ue);
+                    r =
+                    amf_namf_comm_handle_registration_status_update_response(
+                            sbi_message, amf_ue);
                     ogs_expect(r == OGS_OK);
                     ogs_assert(r != OGS_ERROR);
 
-                    amf_ue->amf_ue_context_transfer_state = UE_CONTEXT_INITIAL_STATE;
+                    amf_ue->amf_ue_context_transfer_state =
+                        UE_CONTEXT_INITIAL_STATE;
 
                     /* Continue with registration */
                     ogs_kdf_kgnb_and_kn3iwf(
@@ -2386,13 +2800,15 @@
                     ogs_expect(r == OGS_OK);
                     ogs_assert(r != OGS_ERROR);
 
-                    if (amf_ue->nas.message_type == OGS_NAS_5GS_REGISTRATION_REQUEST) {
+                    if (amf_ue->nas.message_type ==
+                            OGS_NAS_5GS_REGISTRATION_REQUEST) {
                         OGS_FSM_TRAN(s, &gmm_state_initial_context_setup);
                     } else if (amf_ue->nas.message_type ==
                                 OGS_NAS_5GS_SERVICE_REQUEST) {
                         OGS_FSM_TRAN(s, &gmm_state_registered);
                     } else {
-                        ogs_fatal("Invalid OGS_NAS_5GS%d", amf_ue->nas.message_type);
+                        ogs_fatal("Invalid OGS_NAS_5GS%d",
+                                amf_ue->nas.message_type);
                         ogs_assert_if_reached();
                     }
                     break;
@@ -2461,7 +2877,8 @@
 
     ogs_sbi_message_t *sbi_message = NULL;
 
-    gmm_configuration_update_command_param_t param;
+    gmm_configuration_update_command_param_t gmm_param;
+    amf_nsmf_pdusession_sm_context_param_t nsmf_param;
 
     ogs_assert(s);
     ogs_assert(e);
@@ -2580,6 +2997,32 @@
             break;
 
         CASE(OGS_SBI_SERVICE_NAME_NUDM_SDM)
+            if (!strcmp(sbi_message->h.resource.component1,
+                        OGS_SBI_RESOURCE_NAME_SDM_SUBSCRIPTIONS) &&
+                !strcmp(sbi_message->h.method, OGS_SBI_HTTP_METHOD_DELETE)) {
+/*
+ * Issues: #4209
+ *
+ * gmm_state_initial_context_setup()
+ *
+ * Ignore SDM subscription DELETE response.
+ *
+ * In some scenarios, a DELETE response for SDM_SUBSCRIPTIONS may arrive
+ * while the AMF is already handling a subsequent Registration Request
+ * (Integrity Protected). In this code path, the DELETE response is not
+ * relevant and does not require any further processing.
+ *
+ * The response is intentionally ignored to avoid unnecessary handling.
+ */
+                ogs_warn("%s Ignoring SDM_SUBSCRIPTIONS DELETE response"
+                        "%d in (%s:%s)",
+                        amf_ue->supi, sbi_message->res_status,
+                        sbi_message->h.method,
+                        sbi_message->h.resource.component1);
+
+                UDM_SDM_CLEAR(amf_ue);
+                break;
+            }
 
             SWITCH(sbi_message->h.resource.component1)
             CASE(OGS_SBI_RESOURCE_NAME_AM_DATA)
@@ -2588,8 +3031,10 @@
             CASE(OGS_SBI_RESOURCE_NAME_SDM_SUBSCRIPTIONS)
                 if ((sbi_message->res_status != OGS_SBI_HTTP_STATUS_OK) &&
                     (sbi_message->res_status != OGS_SBI_HTTP_STATUS_CREATED)) {
-                    ogs_error("%s HTTP response error %d",
-                            amf_ue->supi, sbi_message->res_status);
+                    ogs_error("%s HTTP response error %d in (%s:%s)",
+                            amf_ue->supi, sbi_message->res_status,
+                            sbi_message->h.method,
+                            sbi_message->h.resource.component1);
                     r = nas_5gs_send_gmm_reject(
                             ran_ue_find_by_id(amf_ue->ran_ue_id), amf_ue,
                             OGS_5GMM_CAUSE_5GS_SERVICES_NOT_ALLOWED);
@@ -2602,15 +3047,18 @@
                 rv = amf_nudm_sdm_handle_provisioned(
                         amf_ue, state, sbi_message);
                 if (rv != OGS_OK) {
-                    ogs_error("%s amf_nudm_sdm_handle_provisioned(%s) failed",
-                            amf_ue->supi, sbi_message->h.resource.component1);
+                    ogs_error("%s amf_nudm_sdm_handle_provisioned(%s:%s) "
+                            "failed", amf_ue->supi, sbi_message->h.method,
+                            sbi_message->h.resource.component1);
                     OGS_FSM_TRAN(&amf_ue->sm, &gmm_state_exception);
                     break;
                 }
                 break;
 
             DEFAULT
-                ogs_error("Invalid resource name %s",
+                ogs_fatal("%s Invalid resource name %d in (%s:%s)",
+                        amf_ue->supi, sbi_message->res_status,
+                        sbi_message->h.method,
                         sbi_message->h.resource.component1);
                 ogs_assert_if_reached();
             END
@@ -2750,9 +3198,9 @@
              * Indication if the AMF wants to update these NAS parameters
              * without triggering a UE Registration procedure.
              */
-            memset(&param, 0, sizeof(param));
-            param.nitz = 1;
-            r = nas_5gs_send_configuration_update_command(amf_ue, &param);
+            memset(&gmm_param, 0, sizeof(gmm_param));
+            gmm_param.nitz = 1;
+            r = nas_5gs_send_configuration_update_command(amf_ue, &gmm_param);
             ogs_expect(r == OGS_OK);
             ogs_assert(r != OGS_ERROR);
 
@@ -2764,10 +3212,12 @@
                 amf_metrics_inst_global_inc(AMF_METR_GLOB_CTR_RM_REG_MOB_SUCC);
                 break;
             case OGS_NAS_5GS_REGISTRATION_TYPE_PERIODIC_UPDATING:
-                amf_metrics_inst_global_inc(AMF_METR_GLOB_CTR_RM_REG_PERIOD_SUCC);
+                amf_metrics_inst_global_inc(
+                        AMF_METR_GLOB_CTR_RM_REG_PERIOD_SUCC);
                 break;
             case OGS_NAS_5GS_REGISTRATION_TYPE_EMERGENCY:
-                amf_metrics_inst_global_inc(AMF_METR_GLOB_CTR_RM_REG_EMERG_SUCC);
+                amf_metrics_inst_global_inc(
+                        AMF_METR_GLOB_CTR_RM_REG_EMERG_SUCC);
                 break;
             default:
                 ogs_error("Unknown reg_type%d",
@@ -2791,8 +3241,13 @@
                 break;
             }
 
+            memset(&nsmf_param, 0, sizeof(nsmf_param));
+            nsmf_param.ue_location = true;
+            nsmf_param.ue_timezone = true;
+
             amf_sbi_send_release_all_sessions(
-                    ran_ue, amf_ue, AMF_RELEASE_SM_CONTEXT_NO_STATE);
+                    ran_ue, amf_ue,
+                    AMF_RELEASE_SM_CONTEXT_NO_STATE, &nsmf_param);
 
             if (!AMF_SESSION_RELEASE_PENDING(amf_ue) &&
                 amf_sess_xact_count(amf_ue) == xact_count) {
@@ -2904,6 +3359,8 @@
     ogs_nas_security_header_type_t h;
     ogs_sbi_message_t *sbi_message = NULL;
 
+    amf_nsmf_pdusession_sm_context_param_t param;
+
     ogs_assert(s);
     ogs_assert(e);
 
@@ -2925,7 +3382,8 @@
         AMF_UE_CLEAR_5GSM_MESSAGE(amf_ue);
         CLEAR_AMF_UE_ALL_TIMERS(amf_ue);
 
-        if (amf_ue->amf_ue_context_transfer_state == UE_CONTEXT_TRANSFER_NEW_AMF_STATE) {
+        if (amf_ue->amf_ue_context_transfer_state ==
+                UE_CONTEXT_TRANSFER_NEW_AMF_STATE) {
             /*
             * UE context transfer message has been sent
             * to old AMF after Registration request.
@@ -2953,15 +3411,20 @@
             ogs_expect(r == OGS_OK);
             ogs_assert(r != OGS_ERROR);
 
-            amf_ue->amf_ue_context_transfer_state = REGISTRATION_STATUS_UPDATE_NEW_AMF_STATE;
+            amf_ue->amf_ue_context_transfer_state =
+                REGISTRATION_STATUS_UPDATE_NEW_AMF_STATE;
             break;
         }
 
         xact_count = amf_sess_xact_count(amf_ue);
 
+        memset(&param, 0, sizeof(param));
+        param.ue_location = true;
+        param.ue_timezone = true;
+
         amf_sbi_send_release_all_sessions(
                 ran_ue_find_by_id(amf_ue->ran_ue_id), amf_ue,
-                AMF_RELEASE_SM_CONTEXT_NO_STATE);
+                AMF_RELEASE_SM_CONTEXT_NO_STATE, &param);
 
         if (!AMF_SESSION_RELEASE_PENDING(amf_ue) &&
             amf_sess_xact_count(amf_ue) == xact_count) {
@@ -3080,9 +3543,13 @@
                     OGS_FSM_TRAN(s, &gmm_state_registered);
 
             } else {
+                memset(&param, 0, sizeof(param));
+                param.ue_location = true;
+                param.ue_timezone = true;
 
                 amf_sbi_send_release_all_sessions(
-                        ran_ue, amf_ue, AMF_RELEASE_SM_CONTEXT_NO_STATE);
+                        ran_ue, amf_ue,
+                        AMF_RELEASE_SM_CONTEXT_NO_STATE, &param);
 
                 if (!AMF_SESSION_RELEASE_PENDING(amf_ue) &&
                     amf_sess_xact_count(amf_ue) == xact_count) {
@@ -3215,20 +3682,59 @@
             if ((sbi_message->res_status != OGS_SBI_HTTP_STATUS_OK) &&
                 (sbi_message->res_status != OGS_SBI_HTTP_STATUS_CREATED) &&
                 (sbi_message->res_status != OGS_SBI_HTTP_STATUS_NO_CONTENT)) {
-                ogs_error("%s HTTP response error %d",
-                          amf_ue->supi, sbi_message->res_status);
+                ogs_error("%s HTTP response error %d in (%s:%s)",
+                        amf_ue->supi, sbi_message->res_status,
+                        sbi_message->h.method,
+                        sbi_message->h.resource.component1);
             }
 
             SWITCH(sbi_message->h.resource.component1)
             CASE(OGS_SBI_RESOURCE_NAME_AM_DATA)
             CASE(OGS_SBI_RESOURCE_NAME_SMF_SELECT_DATA)
             CASE(OGS_SBI_RESOURCE_NAME_UE_CONTEXT_IN_SMF_DATA)
-            CASE(OGS_SBI_RESOURCE_NAME_SDM_SUBSCRIPTIONS)
-                ogs_error("%s Ignore SBI message", amf_ue->supi);
+                ogs_error("%s Ignore SBI message %d in (%s:%s)",
+                        amf_ue->supi, sbi_message->res_status,
+                        sbi_message->h.method,
+                        sbi_message->h.resource.component1);
                 break;
 
+            CASE(OGS_SBI_RESOURCE_NAME_SDM_SUBSCRIPTIONS)
+                SWITCH(sbi_message->h.method)
+                CASE(OGS_SBI_HTTP_METHOD_DELETE)
+/*
+ * Issues: #4209
+ *
+ * gmm_state_exception()
+ *
+ * Ignore SDM subscription DELETE response.
+ *
+ * In some scenarios, a DELETE response for SDM_SUBSCRIPTIONS may arrive
+ * while the AMF is already handling a subsequent Registration Request
+ * (Integrity Protected). In this code path, the DELETE response is not
+ * relevant and does not require any further processing.
+ *
+ * The response is intentionally ignored to avoid unnecessary handling.
+ */
+                    ogs_warn("%s Ignoring SDM_SUBSCRIPTIONS DELETE response"
+                            "%d in (%s:%s)",
+                            amf_ue->supi, sbi_message->res_status,
+                            sbi_message->h.method,
+                            sbi_message->h.resource.component1);
+
+                    UDM_SDM_CLEAR(amf_ue);
+                    break;
+                DEFAULT
+                    ogs_error("%s Ignoring invalid HTTP method"
+                            "%d in (%s:%s)",
+                            amf_ue->supi, sbi_message->res_status,
+                            sbi_message->h.method,
+                            sbi_message->h.resource.component1);
+                END
+                break;
             DEFAULT
-                ogs_error("Invalid resource name %s",
+                ogs_fatal("%s Invalid resource name %d in (%s:%s)",
+                        amf_ue->supi, sbi_message->res_status,
+                        sbi_message->h.method,
                         sbi_message->h.resource.component1);
                 ogs_assert_if_reached();
             END
@@ -3239,7 +3745,8 @@
             CASE(OGS_SBI_RESOURCE_NAME_POLICIES)
                 SWITCH(sbi_message->h.method)
                 CASE(OGS_SBI_HTTP_METHOD_POST)
-                    if (sbi_message->res_status != OGS_SBI_HTTP_STATUS_CREATED) {
+                    if (sbi_message->res_status !=
+                            OGS_SBI_HTTP_STATUS_CREATED) {
                         ogs_error("%s HTTP response error %d",
                                 amf_ue->supi, sbi_message->res_status);
                     }
@@ -3264,23 +3771,33 @@
             CASE(OGS_SBI_RESOURCE_NAME_UE_CONTEXTS)
                 SWITCH(sbi_message->h.resource.component2)
                 CASE(OGS_SBI_RESOURCE_NAME_TRANSFER_UPDATE)
-                    if (amf_ue->amf_ue_context_transfer_state != REGISTRATION_STATUS_UPDATE_NEW_AMF_STATE) {
+                    if (amf_ue->amf_ue_context_transfer_state !=
+                            REGISTRATION_STATUS_UPDATE_NEW_AMF_STATE) {
                         ogs_error("UE context transfer state not correct");
                     }
                     if (sbi_message->res_status != OGS_SBI_HTTP_STATUS_OK) {
                         ogs_error("%s HTTP response error %d",
                                 amf_ue->supi, sbi_message->res_status);
                     }
-                    r = amf_namf_comm_handle_registration_status_update_response(sbi_message, amf_ue);
+                    r =
+                    amf_namf_comm_handle_registration_status_update_response(
+                            sbi_message, amf_ue);
                     ogs_expect(r == OGS_OK);
                     ogs_assert(r != OGS_ERROR);
 
-                    amf_ue->amf_ue_context_transfer_state = UE_CONTEXT_INITIAL_STATE;
+                    amf_ue->amf_ue_context_transfer_state =
+                        UE_CONTEXT_INITIAL_STATE;
 
                     /* Continue with release command */
                     xact_count = amf_sess_xact_count(amf_ue);
+
+                    memset(&param, 0, sizeof(param));
+                    param.ue_location = true;
+                    param.ue_timezone = true;
+
                     amf_sbi_send_release_all_sessions(
-                            ran_ue, amf_ue, AMF_RELEASE_SM_CONTEXT_NO_STATE);
+                            ran_ue, amf_ue,
+                            AMF_RELEASE_SM_CONTEXT_NO_STATE, &param);
 
                     if (!AMF_SESSION_RELEASE_PENDING(amf_ue) &&
                         amf_sess_xact_count(amf_ue) == xact_count) {

open5gs_2.7.7.tar.xz/src/amf/gnb-info.c Added

@@ -0,0 +1,280 @@
+/*
+ * Copyright (C) 2025 by Juraj Elias <juraj.elias@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/*
+ * GNB info - AMF gNBs JSON dumper for the Prometheus HTTP server (/gnb-info).
+ * - gnb_id, plmn, amf, ng, gnb_IP, supported ta_list, slices, num_connceted_ues
+ * - pager: /gnb-info?page=0&page_size=100 (0-based, page=-1 without paging) Default: page=0 page_size=100=MAXSIZE
+ *
+ * path: http://AMF_IP:9090/gnb-info
+ * curl -s "http://127.0.0.5:9090/gnb-info?" |jq . 
+ * {
+ *   "items": 
+ *     {
+ *       "gnb_id": 100,
+ *       "plmn": "99970",
+ *       "network": {
+ *         "amf_name": "efire-amf0",
+ *         "ngap_port": 38412
+ *       },
+ *       "ng": {
+ *         "sctp": {
+ *           "peer": "192.168.168.100:60110",
+ *           "max_out_streams": 2,
+ *           "next_ostream_id": 1
+ *         },
+ *         "setup_success": true
+ *       },
+ *       "supported_ta_list": 
+ *         {
+ *           "tac": "000001",
+ *           "bplmns": 
+ *             {
+ *               "plmn": "99970",
+ *               "snssai": 
+ *                 {
+ *                   "sst": 1,
+ *                   "sd": "ffffff"
+ *                 }
+ *               
+ *             },
+ *             {
+ *               "plmn": "99971",
+ *               "snssai": 
+ *                 {
+ *                   "sst": 2,
+ *                   "sd": "000000"
+ *                 }
+ *               
+ *             }
+ *           
+ *         }
+ *       ,
+ *       "num_connected_ues": 2
+ *     }
+ *   ,
+ *   "pager": {
+ *     "page": 0,
+ *     "page_size": 100,
+ *     "count": 1
+ *   }
+ * }
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <stdbool.h>
+#include <sys/socket.h>
+
+#include "ogs-core.h"
+#include "ogs-proto.h"
+#include "context.h"
+#include "gnb-info.h"
+
+#include "sbi/openapi/external/cJSON.h"
+#include "metrics/prometheus/json_pager.h"
+
+#ifndef GNB_INFO_PAGE_SIZE_DEFAULT
+#define GNB_INFO_PAGE_SIZE_DEFAULT 100U
+#endif
+
+size_t amf_dump_gnb_info(char *buf, size_t buflen, size_t page, size_t page_size)
+{
+    return amf_dump_gnb_info_paged(buf, buflen, page, page_size);
+}
+
+static inline uint32_t u24_to_u32(ogs_uint24_t v)
+{
+    uint32_t x = 0; memcpy(&x, &v, sizeof(v) < sizeof(x) ? sizeof(v) : sizeof(x));
+    return (x & 0xFFFFFFu);
+}
+
+static inline const char *safe_sa_str(ogs_sockaddr_t *sa)
+{
+    if (!sa) return "";
+    int fam = sa->sa.sa_family;
+    if (fam != AF_INET && fam != AF_INET6) return "";
+    return ogs_sockaddr_to_string_static(sa);
+}
+
+static inline int add_plmn_string(cJSON *obj, const char *key, const ogs_plmn_id_t *plmn)
+{
+    char sOGS_PLMNIDSTRLEN = {0};
+    if (plmn) ogs_plmn_id_to_string(plmn, s);
+    return cJSON_AddStringToObject(obj, key, s) ? 0 : -1;
+}
+
+/* ---------- main (paged) ---------- */
+
+size_t amf_dump_gnb_info_paged(char *buf, size_t buflen, size_t page, size_t page_size)
+{
+    if (!buf || buflen == 0) return 0;
+
+    const bool no_paging = (page == SIZE_MAX);
+    if (!no_paging) {
+        if (page_size == 0) page_size = GNB_INFO_PAGE_SIZE_DEFAULT;
+        if (page_size > GNB_INFO_PAGE_SIZE_DEFAULT) page_size = GNB_INFO_PAGE_SIZE_DEFAULT;
+    } else {
+        page_size = SIZE_MAX;
+        page = 0;
+    }
+
+    amf_context_t *ctxt = amf_self();
+
+    cJSON *root = cJSON_CreateObject();
+    if (!root) { if (buflen >= 3) { memcpy(buf, "{}", 3); return 2; } buf0 = '\0'; return 0; }
+
+    cJSON *items = cJSON_AddArrayToObject(root, "items");
+    if (!items) { cJSON_Delete(root); if (buflen >= 3) { memcpy(buf, "{}", 3); return 2; } buf0 = '\0'; return 0; }
+
+    size_t idx = 0, emitted = 0;
+    bool has_next = false, oom = false;
+
+    const size_t start_index = json_pager_safe_start_index(no_paging, page, page_size);
+
+    amf_gnb_t *gnb = NULL;
+    ogs_list_for_each(&ctxt->gnb_list, gnb) {
+        int act = json_pager_advance(no_paging, idx, start_index, emitted, page_size, &has_next);
+        if (act == 1) { idx++; continue; }
+        if (act == 2) break;
+
+        /* Build the item completely before attaching to items */
+        cJSON *g = cJSON_CreateObject();
+        if (!g) { oom = true; break; }
+
+        /* basics */
+        if (!cJSON_AddNumberToObject(g, "gnb_id", (double)(unsigned)gnb->gnb_id)) { cJSON_Delete(g); oom = true; break; }
+        if (add_plmn_string(g, "plmn", &gnb->plmn_id) < 0) { cJSON_Delete(g); oom = true; break; }
+
+        /* network */
+        {
+            cJSON *network = cJSON_CreateObject();
+            if (!network) { cJSON_Delete(g); oom = true; break; }
+
+            if (!cJSON_AddStringToObject(network, "amf_name", ctxt->amf_name ? ctxt->amf_name : "")) { cJSON_Delete(network); cJSON_Delete(g); oom = true; break; }
+            if (!cJSON_AddNumberToObject(network, "ngap_port", (double)(unsigned)ctxt->ngap_port)) { cJSON_Delete(network); cJSON_Delete(g); oom = true; break; }
+
+            cJSON_AddItemToObjectCS(g, "network", network);
+        }
+
+        /* ng + sctp */
+        {
+            cJSON *ng = cJSON_CreateObject();
+            if (!ng) { cJSON_Delete(g); oom = true; break; }
+
+            /* Build sctp first, then attach */
+            cJSON *sctp = cJSON_CreateObject();
+            if (!sctp) { cJSON_Delete(ng); cJSON_Delete(g); oom = true; break; }
+
+            if (!cJSON_AddStringToObject(sctp, "peer", safe_sa_str(gnb->sctp.addr))) { cJSON_Delete(sctp); cJSON_Delete(ng); cJSON_Delete(g); oom = true; break; }
+            if (!cJSON_AddNumberToObject(sctp, "max_out_streams", (double)gnb->max_num_of_ostreams)) { cJSON_Delete(sctp); cJSON_Delete(ng); cJSON_Delete(g); oom = true; break; }
+            if (!cJSON_AddNumberToObject(sctp, "next_ostream_id", (double)(unsigned)gnb->ostream_id)) { cJSON_Delete(sctp); cJSON_Delete(ng); cJSON_Delete(g); oom = true; break; }
+
+            cJSON_AddItemToObjectCS(ng, "sctp", sctp);
+
+            if (!cJSON_AddBoolToObject(ng, "setup_success", gnb->state.ng_setup_success ? 1 : 0)) { cJSON_Delete(ng); cJSON_Delete(g); oom = true; break; }
+
+            cJSON_AddItemToObjectCS(g, "ng", ng);
+        }
+
+        /* supported_ta_list */
+        {
+            cJSON *tas = cJSON_CreateArray();
+            if (!tas) { cJSON_Delete(g); oom = true; break; }
+
+            bool inner_oom = false;
+            int t;
+
+            for (t = 0; t < gnb->num_of_supported_ta_list; t++) {
+                const ogs_uint24_t tac = gnb->supported_ta_listt.tac;
+                const int nbp = gnb->supported_ta_listt.num_of_bplmn_list;
+
+                cJSON *ta = cJSON_CreateObject();
+                if (!ta) { inner_oom = true; break; }
+
+                char tac_hex7; snprintf(tac_hex, sizeof tac_hex, "%06x", (unsigned)u24_to_u32(tac));
+                if (!cJSON_AddStringToObject(ta, "tac", tac_hex)) { cJSON_Delete(ta); inner_oom = true; break; }
+
+                cJSON *bplmns = cJSON_CreateArray();
+                if (!bplmns) { cJSON_Delete(ta); inner_oom = true; break; }
+
+                bool inner2_oom = false;
+                int p;
+
+                for (p = 0; p < nbp; p++) {
+                    const ogs_plmn_id_t *bp_plmn = &gnb->supported_ta_listt.bplmn_listp.plmn_id;
+                    const int ns = gnb->supported_ta_listt.bplmn_listp.num_of_s_nssai;
+                    const ogs_s_nssai_t *sn = gnb->supported_ta_listt.bplmn_listp.s_nssai;
+
+                    cJSON *bp = cJSON_CreateObject();
+                    if (!bp) { inner2_oom = true; break; }
+
+                    if (add_plmn_string(bp, "plmn", bp_plmn) < 0) { cJSON_Delete(bp); inner2_oom = true; break; }
+
+                    cJSON *sns = cJSON_CreateArray();
+                    if (!sns) { cJSON_Delete(bp); inner2_oom = true; break; }
+
+                    bool inner3_oom = false;
+                    int i;
+
+                    for (i = 0; i < ns; i++) {
+                        cJSON *o = cJSON_CreateObject();
+                        if (!o) { inner3_oom = true; break; }
+
+                        if (!cJSON_AddNumberToObject(o, "sst", (double)(unsigned)sni.sst)) { cJSON_Delete(o); inner3_oom = true; break; }
+                        char sd7; snprintf(sd, sizeof sd, "%06x", (unsigned)u24_to_u32(sni.sd));
+                        if (!cJSON_AddStringToObject(o, "sd", sd)) { cJSON_Delete(o); inner3_oom = true; break; }
+
+                        cJSON_AddItemToArray(sns, o);
+                    }
+
+                    if (inner3_oom) { cJSON_Delete(sns); cJSON_Delete(bp); inner2_oom = true; break; }
+
+                    cJSON_AddItemToObjectCS(bp, "snssai", sns);
+                    cJSON_AddItemToArray(bplmns, bp);
+                }
+
+                if (inner2_oom) { cJSON_Delete(bplmns); cJSON_Delete(ta); inner_oom = true; break; }
+
+                cJSON_AddItemToObjectCS(ta, "bplmns", bplmns);
+                cJSON_AddItemToArray(tas, ta);
+            }
+
+            if (inner_oom) { cJSON_Delete(tas); cJSON_Delete(g); oom = true; break; }
+
+            cJSON_AddItemToObjectCS(g, "supported_ta_list", tas);
+        }
+
+        /* num_connected_ues */
+        {
+            size_t num = 0; ran_ue_t *r = NULL; ogs_list_for_each(&((amf_gnb_t*)gnb)->ran_ue_list, r) num++;
+            if (!cJSON_AddNumberToObject(g, "num_connected_ues", (double)num)) { cJSON_Delete(g); oom = true; break; }
+        }
+
+        /* attach completed item */
+        cJSON_AddItemToArray(items, g);
+        emitted++;
+        idx++;
+    }
+
+    json_pager_add_trailing(root, no_paging, page, page_size, emitted, has_next && !oom,"/gnb-info", oom);
+
+    return json_pager_finalize(root, buf, buflen);
+}
+

open5gs_2.7.7.tar.xz/src/amf/gnb-info.h Added

@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2025 by Juraj Elias <juraj.elias@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/*
+ * /gnb-info — AMF-side JSON exporter (Prometheus HTTP endpoint)
+ *
+ */
+#pragma once
+
+#include <stddef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef GNB_INFO_PAGE_SIZE_DEFAULT
+#define GNB_INFO_PAGE_SIZE_DEFAULT 100U
+#endif
+
+size_t amf_dump_gnb_info(char *buf, size_t buflen, size_t page, size_t page_size);
+size_t amf_dump_gnb_info_paged(char *buf, size_t buflen, size_t page, size_t page_size);
+
+#ifdef __cplusplus
+}
+#endif
+

open5gs_2.7.6.tar.xz/src/amf/init.c -> open5gs_2.7.7.tar.xz/src/amf/init.c Changed

open5gs_2.7.6.tar.xz/src/amf/meson.build -> open5gs_2.7.7.tar.xz/src/amf/meson.build Changed

open5gs_2.7.6.tar.xz/src/amf/namf-build.c -> open5gs_2.7.7.tar.xz/src/amf/namf-build.c Changed

open5gs_2.7.6.tar.xz/src/amf/namf-handler.c -> open5gs_2.7.7.tar.xz/src/amf/namf-handler.c Changed

@@ -287,7 +287,7 @@
                 header.resource.component1 = amf_ue->supi;
                 header.resource.component2 =
                     (char *)OGS_SBI_RESOURCE_NAME_N1_N2_MESSAGES;
-                header.resource.component3 = sess->sm_context.ref;
+                header.resource.component3 = sess->sm_context_ref;
 
                 sendmsg.http.location = ogs_sbi_server_uri(server, &header);
 
@@ -349,7 +349,7 @@
             header.resource.component1 = amf_ue->supi;
             header.resource.component2 =
                 (char *)OGS_SBI_RESOURCE_NAME_N1_N2_MESSAGES;
-            header.resource.component3 = sess->sm_context.ref;
+            header.resource.component3 = sess->sm_context_ref;
 
             sendmsg.http.location = ogs_sbi_server_uri(server, &header);
 
@@ -423,7 +423,7 @@
                 header.resource.component1 = amf_ue->supi;
                 header.resource.component2 =
                     (char *)OGS_SBI_RESOURCE_NAME_N1_N2_MESSAGES;
-                header.resource.component3 = sess->sm_context.ref;
+                header.resource.component3 = sess->sm_context_ref;
 
                 sendmsg.http.location = ogs_sbi_server_uri(server, &header);
 
@@ -595,6 +595,7 @@
         sess->n2_released == true &&
         sess->resource_status == OpenAPI_resource_status_RELEASED) {
         amf_nsmf_pdusession_handle_release_sm_context(
+                amf_ue, ran_ue_find_by_id(sess->ran_ue_id),
                 sess, AMF_RELEASE_SM_CONTEXT_NO_STATE);
     }
 
@@ -1485,9 +1486,9 @@
         ogs_assert(sNSSAI);
 
         PduSessionContext->pdu_session_id = sess->psi;
-        ogs_assert(sess->sm_context.resource_uri);
+        ogs_assert(sess->sm_context_resource_uri);
         PduSessionContext->sm_context_ref =
-            ogs_strdup(sess->sm_context.resource_uri);
+            ogs_strdup(sess->sm_context_resource_uri);
 
         sNSSAI->sst = sess->s_nssai.sst;
         sNSSAI->sd = ogs_s_nssai_sd_to_string(sess->s_nssai.sd);
@@ -1812,9 +1813,9 @@
         ogs_freeaddrinfo(addr);
         ogs_freeaddrinfo(addr6);
 
-        sess->sm_context.resource_uri =
+        sess->sm_context_resource_uri =
             ogs_strdup(PduSessionContext->sm_context_ref);
-        sess->sm_context.ref =
+        sess->sm_context_ref =
             ogs_strdup(message.h.resource.component1);
 
         memset(&sess->s_nssai, 0, sizeof(sess->s_nssai));
@@ -1895,7 +1896,15 @@
                     uint8_t psi = *(double *)node->data;
                     sess = amf_sess_find_by_psi(amf_ue, psi);
                     if (SESSION_CONTEXT_IN_SMF(sess)) {
-                        amf_sbi_send_release_session(ran_ue, sess, AMF_RELEASE_SM_CONTEXT_NO_STATE);
+                        amf_nsmf_pdusession_sm_context_param_t param;
+
+                        memset(&param, 0, sizeof(param));
+                        param.ue_location = true;
+                        param.ue_timezone = true;
+
+                        amf_sbi_send_release_session(
+                                ran_ue, sess,
+                                AMF_RELEASE_SM_CONTEXT_NO_STATE, &param);
                     } else {
                         ogs_error("%s No Session Context PSI%d",
                                 amf_ue->supi, psi);

open5gs_2.7.7.tar.xz/src/amf/namf-oam.c Added

@@ -0,0 +1,849 @@
+/*
+ * Copyright (C) 2019,2020 by Sukchan Lee <acetcom@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include "namf-oam.h"
+#include "sbi-path.h"
+#include "ngap-path.h"
+#include "nsmf-handler.h"
+
+/*
+ * Returns true if duplicate found, false otherwise
+ * Note: Multiple PLMNs can exist, but PLMN + SST + SD combinations must be unique
+ */
+static bool is_duplicate_slice(const ogs_plmn_id_t *plmn_id, const ogs_s_nssai_t *s_nssai)
+{
+    int i, k;
+
+    ogs_assert(plmn_id);
+    ogs_assert(s_nssai);
+
+    for (i = 0; i < amf_self()->num_of_plmn_support; i++) {
+        /* Check if PLMN matches */
+        if (memcmp(&amf_self()->plmn_supporti.plmn_id,
+                   plmn_id,
+                   sizeof(ogs_plmn_id_t)) != 0)
+            continue;
+
+        /* Same PLMN found, check all its S-NSSAIs */
+        for (k = 0; k < amf_self()->plmn_supporti.num_of_s_nssai; k++) {
+            ogs_s_nssai_t *existing = &amf_self()->plmn_supporti.s_nssaik;
+
+            /* Check if SST and SD match */
+            if (existing->sst == s_nssai->sst && existing->sd.v == s_nssai->sd.v) {
+                return true;  /* Duplicate found */
+            }
+        }
+    }
+
+    return false;  /* No duplicate */
+}
+
+/*
+ * Returns the number of unique PLMN IDs (same PLMN with different slices counts as one)
+ */
+static int count_unique_plmns(void)
+{
+    int i, j;
+    int unique_count = 0;
+    bool already_countedOGS_MAX_NUM_OF_PLMN;
+
+    memset(already_counted, 0, sizeof(already_counted));
+
+    for (i = 0; i < amf_self()->num_of_plmn_support; i++) {
+        if (already_countedi)
+            continue;
+
+        unique_count++;
+        already_countedi = true;
+
+        /* Mark all other entries with same PLMN ID as counted */
+        for (j = i + 1; j < amf_self()->num_of_plmn_support; j++) {
+            if (memcmp(&amf_self()->plmn_supporti.plmn_id,
+                       &amf_self()->plmn_supportj.plmn_id,
+                       sizeof(ogs_plmn_id_t)) == 0) {
+                already_countedj = true;
+            }
+        }
+    }
+
+    return unique_count;
+}
+
+
+/*
+ * Disconnect gNBs that have the specified PLMN being deleted
+ * Returns the number of gNBs disconnected
+ */
+/* static int disconnect_gnbs(const ogs_plmn_id_t *deleted_plmn_id)
+{
+    amf_gnb_t *gnb = NULL, *next_gnb = NULL;
+    int disconnected = 0;
+    char bufOGS_ADDRSTRLEN;
+    char deleted_plmn_strOGS_PLMNIDSTRLEN;
+    ogs_plmn_id_to_string(deleted_plmn_id, deleted_plmn_str);
+    ogs_list_for_each_safe(&amf_self()->gnb_list, next_gnb, gnb) {
+        bool has_deleted_plmn = false;
+        int ta_idx, bplmn_idx;
+        for (ta_idx = 0; ta_idx < gnb->num_of_supported_ta_list && !has_deleted_plmn; ta_idx++) {
+            for (bplmn_idx = 0; bplmn_idx < gnb->supported_ta_listta_idx.num_of_bplmn_list; bplmn_idx++) {
+                ogs_plmn_id_t *gnb_plmn = &gnb->supported_ta_listta_idx.bplmn_listbplmn_idx.plmn_id;
+                if (memcmp(gnb_plmn, deleted_plmn_id, sizeof(ogs_plmn_id_t)) == 0) {
+                    has_deleted_plmn = true;
+                    break;
+                }
+            }
+        }
+        if (has_deleted_plmn) {
+            char gnb_plmn_strOGS_PLMNIDSTRLEN;
+            ogs_plmn_id_to_string(&gnb->plmn_id, gnb_plmn_str);
+            ogs_warn("OAM Disconnecting gNB %s, PLMN=%s - using deleted PLMN %s",
+                gnb->sctp.addr ? OGS_ADDR(&gnb->sctp.addr->sa, buf) : "unknown",
+                gnb_plmn_str, deleted_plmn_str);
+            amf_gnb_remove(gnb);
+            disconnected++;
+        }
+    }
+    if (disconnected > 0) {
+        ogs_info("OAM Disconnected %d gNB(s) using deleted PLMN %s", disconnected, deleted_plmn_str);
+    }
+    return disconnected;
+} */
+
+/*
+ * Release all UEs associated with the deleted PLMN
+ * Returns the number of UEs released
+ *
+ * This function releases PDU sessions via SMF and sends RAN context release.
+ * The actual UE removal is handled asynchronously by the framework after all
+ * sessions are released and RAN context is freed.
+ */
+static int release_ues_of_plmn(const ogs_plmn_id_t *deleted_plmn_id)
+{
+    amf_ue_t *amf_ue = NULL, *next_ue = NULL;
+    int released = 0;
+    char deleted_plmn_strOGS_PLMNIDSTRLEN;
+
+    ogs_plmn_id_to_string(deleted_plmn_id, deleted_plmn_str);
+
+    ogs_list_for_each_safe(&amf_self()->amf_ue_list, next_ue, amf_ue) {
+
+        if (!(AMF_UE_HAVE_SUCI(amf_ue) || AMF_UE_HAVE_SUPI(amf_ue)))
+            continue;
+
+        if (memcmp(&amf_ue->nr_tai.plmn_id, deleted_plmn_id, sizeof(ogs_plmn_id_t)) == 0) {
+            ran_ue_t *ran_ue = NULL;
+            amf_nsmf_pdusession_sm_context_param_t param;
+            int state = AMF_RELEASE_SM_CONTEXT_NO_STATE;
+
+            ogs_warn("OAM Releasing UE SUPI=%s - attached to deleted PLMN %s",
+                     amf_ue->supi, deleted_plmn_str);
+
+            ran_ue = ran_ue_find_by_id(amf_ue->ran_ue_id);
+
+            /* Prepare release parameters */
+            memset(&param, 0, sizeof(param));
+            param.cause = OpenAPI_cause_REL_DUE_TO_UNSPECIFIED_REASON;
+            param.ngApCause.group = NGAP_Cause_PR_nas;
+            param.ngApCause.value = NGAP_CauseNas_deregister;
+            param.ue_location = true;
+            param.ue_timezone = true;
+
+            /* Release all PDU sessions via SBI (this will properly notify SMF/UPF) */
+            amf_sbi_send_release_all_sessions(ran_ue, amf_ue, state, &param);
+
+            /* Release RAN context */
+            if (ran_ue) {
+                int rv = ngap_send_ran_ue_context_release_command(ran_ue,
+                        NGAP_Cause_PR_nas, NGAP_CauseNas_deregister,
+                        NGAP_UE_CTX_REL_NG_REMOVE_AND_UNLINK, 0);
+                ogs_expect(rv == OGS_OK);
+            }
+
+            released++;
+        }
+    }
+
+    if (released > 0) {
+        ogs_info("OAM Initiated release for %d UE(s) and their PDU sessions for deleted PLMN %s",
+                 released, deleted_plmn_str);
+    }
+
+    return released;
+}
+
+/*
+ * Main router for Namf_OAM API
+ */
+bool amf_namf_oam_handler(
+    ogs_sbi_stream_t *stream,
+    ogs_sbi_message_t *message,
+    ogs_sbi_request_t *request)
+{
+    const char *resource = NULL;
+
+    ogs_assert(stream);
+    ogs_assert(message);
+    ogs_assert(request);
+
+    resource = message->h.resource.component0;
+
+    if (!resource) {
+        ogs_error("No resource specified");
+        ogs_assert(true == ogs_sbi_server_send_error(
+            stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+            message, "No resource specified", NULL, NULL));
+        return false;
+    }
+
+    /*
+     * Route based on resource path:
+     * - /namf-oam/v1/plmns (GET, POST)
+     * - /namf-oam/v1/plmns/{plmn_id} (GET, DELETE)
+     * - /namf-oam/v1/status
+     */
+    if (!strcmp(resource, "plmns")) {
+        const char *plmn_id_param = message->h.resource.component1;
+
+        if (plmn_id_param) {
+            /* /plmns/{plmn_id} */
+            if (!strcmp(message->h.method, OGS_SBI_HTTP_METHOD_GET)) {
+                return namf_oam_handle_plmns_get_by_id(stream, message);
+
+            } else if (!strcmp(message->h.method, OGS_SBI_HTTP_METHOD_DELETE)) {
+                return namf_oam_handle_plmns_delete(stream, message);
+
+            } else {
+                ogs_error("Invalid HTTP method %s for /plmns/{id}",
+                        message->h.method);
+                ogs_assert(true == ogs_sbi_server_send_error(
+                    stream, OGS_SBI_HTTP_STATUS_METHOD_NOT_ALLOWED,
+                    message, "Method not allowed", message->h.method, NULL));
+                return false;
+            }
+        } else {
+            /* /plmns */
+            if (!strcmp(message->h.method, OGS_SBI_HTTP_METHOD_GET)) {
+                return namf_oam_handle_plmns_get(stream, message);
+
+            } else if (!strcmp(message->h.method, OGS_SBI_HTTP_METHOD_POST)) {
+                return namf_oam_handle_plmns_post(stream, message, request);
+
+            } else {
+                ogs_error("Invalid HTTP method %s for /plmns",
+                        message->h.method);
+                ogs_assert(true == ogs_sbi_server_send_error(
+                    stream, OGS_SBI_HTTP_STATUS_METHOD_NOT_ALLOWED,
+                    message, "Method not allowed", message->h.method, NULL));
+                return false;
+            }
+        }
+    }
+
+    /* Resource not found */
+    ogs_error("Invalid OAM resource %s", resource);
+    ogs_assert(true == ogs_sbi_server_send_error(
+        stream, OGS_SBI_HTTP_STATUS_NOT_FOUND,
+        message, "Resource not found", resource, NULL));
+
+    return false;
+}
+
+/*
+ * GET /namf-oam/v1/plmns
+ *
+ * Returns list of configured PLMNs with their slices and general statistics
+ */
+bool namf_oam_handle_plmns_get(ogs_sbi_stream_t *stream,  ogs_sbi_message_t *message)
+{
+    cJSON *root = NULL;
+    cJSON *plmns_array = NULL;
+    char *response_body = NULL;
+    ogs_sbi_message_t response_message;
+    ogs_sbi_response_t *response = NULL;
+
+    int i, j, k;
+    int status = OGS_SBI_HTTP_STATUS_OK;
+    amf_gnb_t *gnb = NULL;
+    amf_ue_t *amf_ue = NULL;
+    int total_gnbs = 0;
+    int total_ues = 0;
+    bool already_addedOGS_MAX_NUM_OF_PLMN;
+
+    /* Create JSON response */
+    root = cJSON_CreateObject();
+    plmns_array = cJSON_CreateArray();
+    cJSON_AddItemToObject(root, "plmns", plmns_array);
+
+    /* Initialize tracking array */
+    memset(already_added, 0, sizeof(already_added));
+
+    /* Iterate through configured PLMNs and group by PLMN ID */
+    for (i = 0; i < amf_self()->num_of_plmn_support; i++) {
+        ogs_plmn_id_t *plmn_id = &amf_self()->plmn_supporti.plmn_id;
+        char plmn_id_strOGS_PLMNIDSTRLEN;
+        cJSON *plmn_obj = NULL;
+        cJSON *nssai_array = NULL;
+
+        /* Skip if already processed in a previous iteration */
+        if (already_addedi)
+            continue;
+
+        ogs_plmn_id_to_string(plmn_id, plmn_id_str);
+
+        /* Create PLMN object */
+        plmn_obj = cJSON_CreateObject();
+        nssai_array = cJSON_CreateArray();
+
+        cJSON_AddStringToObject(plmn_obj, "plmn_id", plmn_id_str);
+        cJSON_AddNumberToObject(plmn_obj, "mcc", ogs_plmn_id_mcc(plmn_id));
+        cJSON_AddNumberToObject(plmn_obj, "mnc", ogs_plmn_id_mnc(plmn_id));
+
+        /* Collect all S-NSSAIs for this PLMN ID */
+        for (j = i; j < amf_self()->num_of_plmn_support; j++) {
+            ogs_plmn_id_t *other_plmn = &amf_self()->plmn_supportj.plmn_id;
+            char other_plmn_strOGS_PLMNIDSTRLEN;
+
+            ogs_plmn_id_to_string(other_plmn, other_plmn_str);
+
+            /* If same PLMN ID, add its S-NSSAIs */
+            if (strcmp(plmn_id_str, other_plmn_str) == 0) {
+                already_addedj = true;
+
+                for (k = 0; k < amf_self()->plmn_supportj.num_of_s_nssai; k++) {
+                    cJSON *nssai_obj = cJSON_CreateObject();
+                    ogs_s_nssai_t *s_nssai = &amf_self()->plmn_supportj.s_nssaik;
+
+                    cJSON_AddNumberToObject(nssai_obj, "sst", s_nssai->sst);
+                    if (s_nssai->sd.v != OGS_S_NSSAI_NO_SD_VALUE) {
+                        char *sd_str = ogs_s_nssai_sd_to_string(s_nssai->sd);
+                        cJSON_AddStringToObject(nssai_obj, "sd", sd_str);
+                        ogs_free(sd_str);
+                    }
+
+                    cJSON_AddItemToArray(nssai_array, nssai_obj);
+                }
+            }
+        }
+
+        cJSON_AddItemToObject(plmn_obj, "s_nssai", nssai_array);
+        cJSON_AddItemToArray(plmns_array, plmn_obj);
+    }
+
+    /* Count total connected gNBs */
+    ogs_list_for_each(&amf_self()->gnb_list, gnb) {
+        if (gnb->state.ng_setup_success)
+            total_gnbs++;
+    }
+
+    /* Count total registered UEs */
+    ogs_list_for_each(&amf_self()->amf_ue_list, amf_ue) {
+        if (AMF_UE_HAVE_SUCI(amf_ue))
+            total_ues++;
+    }
+
+    /* Add statistics to response */
+    cJSON_AddNumberToObject(root, "total_plmns", count_unique_plmns());
+    cJSON_AddNumberToObject(root, "connected_gnbs", total_gnbs);
+    cJSON_AddNumberToObject(root, "registered_ues", total_ues);
+
+    /* Convert to string */
+    response_body = cJSON_Print(root);
+    ogs_assert(response_body);
+    cJSON_Delete(root);
+
+    /* Build SBI response */
+    memset(&response_message, 0, sizeof(response_message));
+    response_message.res_status = OGS_SBI_HTTP_STATUS_OK;
+
+    response = ogs_sbi_build_response(&response_message, status);
+    ogs_assert(response);
+
+    response->http.content = response_body;
+    response->http.content_length = strlen(response_body);
+    ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+
+    ogs_info("OAM Listed %d PLMNs", amf_self()->num_of_plmn_support);
+
+    return true;
+}
+
+/*
+ * GET /namf-oam/v1/plmns/{plmn_id}
+ *
+ * Get details of a specific PLMN by ID (format: "99970" or "999-70")
+ */
+bool namf_oam_handle_plmns_get_by_id(ogs_sbi_stream_t *stream, ogs_sbi_message_t *message)
+{
+    cJSON *root = NULL;
+    cJSON *s_nssai_array = NULL;
+    char *response_body = NULL;
+    ogs_sbi_message_t response_message;
+    ogs_sbi_response_t *response = NULL;
+    const char *plmn_id_str = NULL;
+    int i, k;
+    bool found = false;
+    int status = OGS_SBI_HTTP_STATUS_OK;
+
+    plmn_id_str = message->h.resource.component1;
+
+    if (!plmn_id_str) {
+        ogs_error("OAM Missing PLMN ID in path");
+        ogs_assert(true == ogs_sbi_server_send_error(
+            stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+            message, "Missing PLMN ID", NULL, NULL));
+        return false;
+    }
+
+    /* Create response object */
+    root = cJSON_CreateObject();
+    s_nssai_array = cJSON_CreateArray();
+
+    /* Search for ALL entries with this PLMN ID and collect all S-NSSAIs */
+    for (i = 0; i < amf_self()->num_of_plmn_support; i++) {
+        ogs_plmn_id_t *plmn_id = &amf_self()->plmn_supporti.plmn_id;
+        char current_plmn_strOGS_PLMNIDSTRLEN;
+
+        ogs_plmn_id_to_string(plmn_id, current_plmn_str);
+
+        if (strcmp(current_plmn_str, plmn_id_str) == 0) {
+            /* First match: add PLMN info */
+            if (!found) {
+                cJSON_AddStringToObject(root, "plmn_id", current_plmn_str);
+                cJSON_AddNumberToObject(root, "mcc", ogs_plmn_id_mcc(plmn_id));
+                cJSON_AddNumberToObject(root, "mnc", ogs_plmn_id_mnc(plmn_id));
+                found = true;
+            }
+
+            /* Add all S-NSSAIs from this entry */
+            for (k = 0; k < amf_self()->plmn_supporti.num_of_s_nssai; k++) {
+                cJSON *nssai_obj = cJSON_CreateObject();
+                ogs_s_nssai_t *s_nssai = &amf_self()->plmn_supporti.s_nssaik;
+
+                cJSON_AddNumberToObject(nssai_obj, "sst", s_nssai->sst);
+                if (s_nssai->sd.v != OGS_S_NSSAI_NO_SD_VALUE) {
+                    char *sd_str = ogs_s_nssai_sd_to_string(s_nssai->sd);
+                    cJSON_AddStringToObject(nssai_obj, "sd", sd_str);
+                    ogs_free(sd_str);
+                }
+                cJSON_AddItemToArray(s_nssai_array, nssai_obj);
+            }
+        }
+    }
+
+    if (!found) {
+        cJSON_Delete(root);
+        cJSON_Delete(s_nssai_array);
+        ogs_error("OAM PLMN not found: %s", plmn_id_str);
+        ogs_assert(true == ogs_sbi_server_send_error(
+            stream, OGS_SBI_HTTP_STATUS_NOT_FOUND,
+            message, "PLMN not found", plmn_id_str, NULL));
+        return false;
+    }
+
+    /* Add collected S-NSSAI array to response */
+    cJSON_AddItemToObject(root, "s_nssai", s_nssai_array);
+
+    response_body = cJSON_Print(root);
+
+    char plmn_id_str_copyOGS_PLMNIDSTRLEN = {0};
+    if (plmn_id_str)
+        strncpy(plmn_id_str_copy, plmn_id_str, sizeof(plmn_id_str_copy) - 1);
+    cJSON_Delete(root);
+
+    /* Build SBI response */
+    memset(&response_message, 0, sizeof(response_message));
+    response_message.res_status = OGS_SBI_HTTP_STATUS_OK;
+
+    response = ogs_sbi_build_response(&response_message, status);
+    ogs_assert(response);
+
+    response->http.content = response_body;
+    response->http.content_length = strlen(response_body);
+    ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+
+    ogs_info("OAM Retrieved PLMN: %s", plmn_id_str_copy);
+
+    return true;
+}
+
+/*
+ * DELETE /namf-oam/v1/plmns/{plmn_id}
+ *
+ * Remove ALL entries with this PLMN ID from the configuration
+ */
+bool namf_oam_handle_plmns_delete(ogs_sbi_stream_t *stream, ogs_sbi_message_t *message)
+{
+    cJSON *response_json = NULL;
+    char *response_body = NULL;
+    ogs_sbi_message_t response_message;
+    ogs_sbi_response_t *response = NULL;
+    const char *plmn_id_str = NULL;
+    int status = OGS_SBI_HTTP_STATUS_OK;
+    int i;
+    bool found = false;
+    int deleted_count = 0;
+    ogs_plmn_id_t deleted_plmn_id;
+
+    plmn_id_str = message->h.resource.component1;
+
+    if (!plmn_id_str) {
+        ogs_error("OAM Missing PLMN ID in path");
+        ogs_assert(true == ogs_sbi_server_send_error(
+            stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+            message, "Missing PLMN ID", NULL, NULL));
+        return false;
+    }
+
+    /* Delete ALL entries with this PLMN ID */
+    i = 0;
+    while (i < amf_self()->num_of_plmn_support) {
+        ogs_plmn_id_t *plmn_id = &amf_self()->plmn_supporti.plmn_id;
+        char current_plmn_strOGS_PLMNIDSTRLEN;
+
+        ogs_plmn_id_to_string(plmn_id, current_plmn_str);
+
+        if (strcmp(current_plmn_str, plmn_id_str) == 0) {
+            int j;
+
+            /* Save the PLMN ID before deleting (for gNB disconnection) */
+            if (!found) {
+                memcpy(&deleted_plmn_id, plmn_id, sizeof(ogs_plmn_id_t));
+            }
+
+            found = true;
+            deleted_count++;
+
+            /* Shift remaining entries to fill the gap */
+            for (j = i; j < amf_self()->num_of_plmn_support - 1; j++) {
+                memcpy(&amf_self()->plmn_supportj,
+                       &amf_self()->plmn_supportj + 1,
+                       sizeof(amf_self()->plmn_support0));
+            }
+
+            /* Clear the last entry */
+            memset(&amf_self()->plmn_supportamf_self()->num_of_plmn_support - 1,
+                   0, sizeof(amf_self()->plmn_support0));
+            amf_self()->num_of_plmn_support--;
+
+        } else {
+            i++;
+        }
+    }
+
+    if (!found) {
+        ogs_error("OAM PLMN not found for deletion: %s", plmn_id_str);
+        ogs_assert(true == ogs_sbi_server_send_error(
+            stream, OGS_SBI_HTTP_STATUS_NOT_FOUND,
+            message, "PLMN not found", plmn_id_str, NULL));
+        return false;
+    }
+
+
+    /* Send AMFConfigurationUpdate to all connected gNBs */
+    ngap_send_amf_configuration_update_all();
+
+    /* Release UEs that are using the deleted PLMN */
+    release_ues_of_plmn(&deleted_plmn_id);
+
+    /* Build success response */
+    response_json = cJSON_CreateObject();
+    cJSON_AddStringToObject(response_json, "status", "success");
+
+    if (deleted_count == 1) {
+        cJSON_AddStringToObject(response_json, "message", "PLMN deleted successfully");
+    } else {
+        char *msg = ogs_msprintf("PLMN deleted successfully (%d entries removed)", deleted_count);
+        cJSON_AddStringToObject(response_json, "message", msg);
+        ogs_free(msg);
+    }
+
+    cJSON_AddStringToObject(response_json, "deleted_plmn_id", plmn_id_str);
+    cJSON_AddNumberToObject(response_json, "deleted_entries", deleted_count);
+    cJSON_AddNumberToObject(response_json, "remaining_plmns", count_unique_plmns());
+
+    response_body = cJSON_Print(response_json);
+    cJSON_Delete(response_json);
+
+    /* Build SBI response */
+    memset(&response_message, 0, sizeof(response_message));
+    response_message.res_status = OGS_SBI_HTTP_STATUS_OK;
+
+    response = ogs_sbi_build_response(&response_message, status);
+    ogs_assert(response);
+
+    response->http.content = response_body;
+    response->http.content_length = strlen(response_body);
+    ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+
+    ogs_info("OAM PLMN deleted: %s (%d entries), remaining: %d",
+        plmn_id_str, deleted_count, amf_self()->num_of_plmn_support);
+
+    return true;
+}
+
+/*
+ * POST /namf-oam/v1/plmns
+ *
+ * Add a new PLMN to the AMF configuration
+ *
+ * Request body example:
+ * {
+ *   "plmn_id": {
+ *     "mcc": "999",
+ *     "mnc": "70"
+ *   },
+ *   "s_nssai": 
+ *     {"sst": 1, "sd": "000001"},
+ *     {"sst": 1}
+ *   
+ * }
+ */
+bool namf_oam_handle_plmns_post(
+    ogs_sbi_stream_t *stream,
+    ogs_sbi_message_t *message,
+    ogs_sbi_request_t *request)
+{
+    cJSON *root = NULL;
+    cJSON *plmn_id_obj = NULL;
+    cJSON *mcc_obj = NULL;
+    cJSON *mnc_obj = NULL;
+    cJSON *s_nssai_array = NULL;
+    char *response_body = NULL;
+    ogs_sbi_message_t response_message;
+    ogs_sbi_response_t *response = NULL;
+    int i;
+    ogs_plmn_id_t plmn_id;
+    uint16_t mcc, mnc;
+    int mnc_len;
+
+    ogs_assert(request);
+
+    /* Check if we have reached the maximum number of PLMNs */
+    if (amf_self()->num_of_plmn_support >= OGS_MAX_NUM_OF_PLMN) {
+        ogs_error("OAM Cannot add PLMN: maximum limit reached (%d)",
+            OGS_MAX_NUM_OF_PLMN);
+        ogs_assert(true == ogs_sbi_server_send_error(
+            stream, OGS_SBI_HTTP_STATUS_CONFLICT,
+            message, "Maximum number of PLMNs reached", NULL, NULL));
+        return false;
+    }
+
+    /* Parse JSON request body */
+    if (!request->http.content || request->http.content_length == 0) {
+        ogs_error("OAM POST /plmns: empty body");
+        ogs_assert(true == ogs_sbi_server_send_error(
+            stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+            message, "Request body is required", NULL, NULL));
+        return false;
+    }
+
+    root = cJSON_Parse(request->http.content);
+    if (!root) {
+        ogs_error("OAM Failed to parse JSON request");
+        ogs_assert(true == ogs_sbi_server_send_error(
+            stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+            message, "Invalid JSON format", NULL, NULL));
+        return false;
+    }
+
+    /* Extract PLMN ID */
+    plmn_id_obj = cJSON_GetObjectItem(root, "plmn_id");
+    if (!plmn_id_obj) {
+        ogs_error("OAM Missing 'plmn_id' in request");
+        cJSON_Delete(root);
+        ogs_assert(true == ogs_sbi_server_send_error(
+            stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+            message, "Missing 'plmn_id' field", NULL, NULL));
+        return false;
+    }
+
+    mcc_obj = cJSON_GetObjectItem(plmn_id_obj, "mcc");
+    mnc_obj = cJSON_GetObjectItem(plmn_id_obj, "mnc");
+
+    if (!mcc_obj || !cJSON_IsString(mcc_obj) ||
+        !mnc_obj || !cJSON_IsString(mnc_obj)) {
+        ogs_error("OAM Invalid 'plmn_id' format");
+        cJSON_Delete(root);
+        ogs_assert(true == ogs_sbi_server_send_error(
+            stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+            message, "plmn_id must contain 'mcc' and 'mnc' strings", NULL, NULL));
+        return false;
+    }
+
+    /* Parse MCC and MNC */
+    mcc = atoi(mcc_obj->valuestring);
+    mnc = atoi(mnc_obj->valuestring);
+    mnc_len = strlen(mnc_obj->valuestring);
+
+    if (mcc > 999 || mnc > 999 || mnc_len < 2 || mnc_len > 3) {
+        ogs_error("OAM Invalid MCC (%d) or MNC (%d, len=%d)",
+            mcc, mnc, mnc_len);
+        cJSON_Delete(root);
+        ogs_assert(true == ogs_sbi_server_send_error(
+            stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+            message, "Invalid MCC/MNC values", NULL, NULL));
+        return false;
+    }
+
+    /* Build PLMN ID */
+    ogs_plmn_id_build(&plmn_id, mcc, mnc, mnc_len);
+
+    /* Extract S-NSSAI array */
+    s_nssai_array = cJSON_GetObjectItem(root, "s_nssai");
+    if (!s_nssai_array || !cJSON_IsArray(s_nssai_array)) {
+        ogs_error("OAM Missing or invalid 's_nssai' array");
+        cJSON_Delete(root);
+        ogs_assert(true == ogs_sbi_server_send_error(
+            stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+            message, "'s_nssai' must be an array", NULL, NULL));
+        return false;
+    }
+
+    int num_slices = cJSON_GetArraySize(s_nssai_array);
+    if (num_slices == 0 || num_slices > OGS_MAX_NUM_OF_SLICE) {
+        ogs_error("OAM Invalid number of slices: %d (max: %d)",
+            num_slices, OGS_MAX_NUM_OF_SLICE);
+        cJSON_Delete(root);
+        ogs_assert(true == ogs_sbi_server_send_error(
+            stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+            message, "Invalid number of slices", NULL, NULL));
+        return false;
+    }
+
+    /* Check for duplicate PLMN + S-NSSAI combinations before adding */
+    for (i = 0; i < num_slices; i++) {
+        cJSON *slice_obj = cJSON_GetArrayItem(s_nssai_array, i);
+        cJSON *sst_obj = cJSON_GetObjectItem(slice_obj, "sst");
+        cJSON *sd_obj = cJSON_GetObjectItem(slice_obj, "sd");
+        ogs_s_nssai_t temp_nssai;
+        char plmn_id_strOGS_PLMNIDSTRLEN;
+
+        if (!sst_obj || !cJSON_IsNumber(sst_obj)) {
+            ogs_error("OAM Slice %d: missing or invalid 'sst'", i);
+            cJSON_Delete(root);
+            ogs_assert(true == ogs_sbi_server_send_error(
+                stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                message, "Each slice must have 'sst' (number)", NULL, NULL));
+            return false;
+        }
+
+        temp_nssai.sst = (uint8_t)sst_obj->valueint;
+
+        if (sd_obj && cJSON_IsString(sd_obj)) {
+            temp_nssai.sd.v = strtoul(sd_obj->valuestring, NULL, 16);
+        } else {
+            temp_nssai.sd.v = OGS_S_NSSAI_NO_SD_VALUE;
+        }
+
+        /* Check if this PLMN + S-NSSAI combination already exists */
+        if (is_duplicate_slice(&plmn_id, &temp_nssai)) {
+            char *sd_str = NULL;
+            char *error_msg = NULL;
+
+            ogs_plmn_id_to_string(&plmn_id, plmn_id_str);
+
+            if (temp_nssai.sd.v != OGS_S_NSSAI_NO_SD_VALUE) {
+                sd_str = ogs_s_nssai_sd_to_string(temp_nssai.sd);
+                ogs_error("OAM Duplicate slice: PLMN=%s, SST=%d, SD=%s",
+                    plmn_id_str, temp_nssai.sst, sd_str);
+
+                error_msg = ogs_msprintf("Slice already exists: PLMN=%s, SST=%d, SD=%s",
+                    plmn_id_str, temp_nssai.sst, sd_str);
+                ogs_free(sd_str);
+            } else {
+                ogs_error("OAM Duplicate slice: PLMN=%s, SST=%d (no SD)",
+                    plmn_id_str, temp_nssai.sst);
+
+                error_msg = ogs_msprintf("Slice already exists: PLMN=%s, SST=%d",
+                    plmn_id_str, temp_nssai.sst);
+            }
+
+            cJSON_Delete(root);
+            ogs_assert(error_msg);
+            ogs_assert(true == ogs_sbi_server_send_error(
+                stream, OGS_SBI_HTTP_STATUS_CONFLICT,
+                message, error_msg, NULL, NULL));
+            ogs_free(error_msg);
+
+            return false;
+        }
+    }
+
+    /* Add new PLMN entry */
+    int plmn_idx = amf_self()->num_of_plmn_support;
+
+    memcpy(&amf_self()->plmn_supportplmn_idx.plmn_id,
+           &plmn_id, sizeof(ogs_plmn_id_t));
+
+    amf_self()->plmn_supportplmn_idx.num_of_s_nssai = 0;
+
+    for (i = 0; i < num_slices; i++) {
+        cJSON *slice_obj = cJSON_GetArrayItem(s_nssai_array, i);
+        cJSON *sst_obj = cJSON_GetObjectItem(slice_obj, "sst");
+        cJSON *sd_obj = cJSON_GetObjectItem(slice_obj, "sd");
+
+        uint8_t sst = (uint8_t)sst_obj->valueint;
+        amf_self()->plmn_supportplmn_idx.s_nssaii.sst = sst;
+
+        /* SD is optional */
+        if (sd_obj && cJSON_IsString(sd_obj)) {
+            ogs_uint24_t sd;
+            sd.v = strtoul(sd_obj->valuestring, NULL, 16);
+            amf_self()->plmn_supportplmn_idx.s_nssaii.sd = sd;
+        } else {
+            amf_self()->plmn_supportplmn_idx.s_nssaii.sd.v = OGS_S_NSSAI_NO_SD_VALUE;
+        }
+
+        amf_self()->plmn_supportplmn_idx.num_of_s_nssai++;
+    }
+
+    /* Increment PLMN counter */
+    amf_self()->num_of_plmn_support++;
+
+    cJSON_Delete(root);
+
+    /* Send AMFConfigurationUpdate to all connected gNBs */
+    ngap_send_amf_configuration_update_all();
+
+    /* Build success response */
+    cJSON *response_json = cJSON_CreateObject();
+    cJSON_AddStringToObject(response_json, "status", "success");
+    cJSON_AddStringToObject(response_json, "message", "PLMN added successfully");
+    cJSON_AddNumberToObject(response_json, "total_plmns", amf_self()->num_of_plmn_support);
+
+    response_body = cJSON_Print(response_json);
+    ogs_assert(response_body);
+    cJSON_Delete(response_json);
+
+    /* Build SBI response */
+    memset(&response_message, 0, sizeof(response_message));
+    response_message.res_status = OGS_SBI_HTTP_STATUS_CREATED;
+
+    response = ogs_sbi_build_response(&response_message, OGS_SBI_HTTP_STATUS_CREATED);
+    ogs_assert(response);
+
+    response->http.content = response_body;
+    response->http.content_length = strlen(response_body);
+    ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+
+    ogs_info("OAM PLMN added: MCC=%d MNC=%d (%d slices), notified to gNBs",
+        mcc, mnc, num_slices);
+
+    return true;
+}

open5gs_2.7.7.tar.xz/src/amf/namf-oam.h Added

@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2019,2020 by Sukchan Lee <acetcom@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#ifndef AMF_NAMF_OAM_H
+#define AMF_NAMF_OAM_H
+
+#include "context.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Namf_OAM API Handler
+ *
+ * OAM = Operations, Administration and Maintenance
+ * Custom API for dynamic configuration management (not part of 3GPP standard)
+ */
+bool amf_namf_oam_handler(ogs_sbi_stream_t *stream, ogs_sbi_message_t *message, ogs_sbi_request_t *request);
+
+/* Individual endpoint handlers */
+bool namf_oam_handle_plmns_get(ogs_sbi_stream_t *stream, ogs_sbi_message_t *message);
+bool namf_oam_handle_plmns_post(ogs_sbi_stream_t *stream,
+    ogs_sbi_message_t *message,
+    ogs_sbi_request_t *request);
+
+bool namf_oam_handle_plmns_delete(
+    ogs_sbi_stream_t *stream,
+    ogs_sbi_message_t *message);
+
+bool namf_oam_handle_plmns_get_by_id(
+    ogs_sbi_stream_t *stream,
+    ogs_sbi_message_t *message);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* AMF_NAMF_OAM_H */

open5gs_2.7.6.tar.xz/src/amf/nas-path.c -> open5gs_2.7.7.tar.xz/src/amf/nas-path.c Changed

open5gs_2.7.6.tar.xz/src/amf/ngap-build.c -> open5gs_2.7.7.tar.xz/src/amf/ngap-build.c Changed

@@ -19,10 +19,61 @@
 
 #include "ngap-build.h"
 
-ogs_pkbuf_t *ngap_build_ng_setup_response(void)
+static void ngap_build_plmn_support_list(NGAP_PLMNSupportList_t *PLMNSupportList)
 {
     int i, j;
 
+    ogs_assert(PLMNSupportList);
+
+    for (i = 0; i < amf_self()->num_of_plmn_support; i++) {
+        NGAP_PLMNSupportItem_t *NGAP_PLMNSupportItem = NULL;
+        NGAP_PLMNIdentity_t *pLMNIdentity = NULL;
+        NGAP_SliceSupportList_t *sliceSupportList = NULL;
+
+        /* Skip PLMNs with no S-NSSAIs (invalid NGAP configuration) */
+        if (amf_self()->plmn_supporti.num_of_s_nssai == 0) {
+            ogs_warn("Skipping PLMN at index %d with no S-NSSAIs", i);
+            continue;
+        }
+
+        NGAP_PLMNSupportItem = (NGAP_PLMNSupportItem_t *)
+                CALLOC(1, sizeof(NGAP_PLMNSupportItem_t));
+        pLMNIdentity = &NGAP_PLMNSupportItem->pLMNIdentity;
+        sliceSupportList = &NGAP_PLMNSupportItem->sliceSupportList;
+
+        ogs_asn_buffer_to_OCTET_STRING(
+                &amf_self()->plmn_supporti.plmn_id,
+                OGS_PLMN_ID_LEN, pLMNIdentity);
+        for (j = 0; j < amf_self()->plmn_supporti.num_of_s_nssai; j++) {
+            NGAP_SliceSupportItem_t *NGAP_SliceSupportItem = NULL;
+            NGAP_S_NSSAI_t *s_NSSAI = NULL;
+            NGAP_SST_t *sST = NULL;
+
+            NGAP_SliceSupportItem = (NGAP_SliceSupportItem_t *)
+                    CALLOC(1, sizeof(NGAP_SliceSupportItem_t));
+            s_NSSAI = &NGAP_SliceSupportItem->s_NSSAI;
+            sST = &s_NSSAI->sST;
+
+            ogs_asn_uint8_to_OCTET_STRING(
+                amf_self()->plmn_supporti.s_nssaij.sst, sST);
+            if (amf_self()->plmn_supporti.s_nssaij.sd.v !=
+                    OGS_S_NSSAI_NO_SD_VALUE) {
+                s_NSSAI->sD = CALLOC(1, sizeof(NGAP_SD_t));
+                ogs_asn_uint24_to_OCTET_STRING(
+                    amf_self()->plmn_supporti.s_nssaij.sd, s_NSSAI->sD);
+            }
+
+            ASN_SEQUENCE_ADD(&sliceSupportList->list, NGAP_SliceSupportItem);
+        }
+
+        ASN_SEQUENCE_ADD(&PLMNSupportList->list, NGAP_PLMNSupportItem);
+    }
+}
+
+ogs_pkbuf_t *ngap_build_ng_setup_response(void)
+{
+    int i;
+
     NGAP_NGAP_PDU_t pdu;
     NGAP_SuccessfulOutcome_t *successfulOutcome = NULL;
     NGAP_NGSetupResponse_t *NGSetupResponse = NULL;
@@ -121,43 +172,7 @@
 
     *RelativeAMFCapacity = amf_self()->relative_capacity;
 
-    for (i = 0; i < amf_self()->num_of_plmn_support; i++) {
-        NGAP_PLMNSupportItem_t *NGAP_PLMNSupportItem = NULL;
-        NGAP_PLMNIdentity_t *pLMNIdentity = NULL;
-        NGAP_SliceSupportList_t *sliceSupportList = NULL;
-
-        NGAP_PLMNSupportItem = (NGAP_PLMNSupportItem_t *)
-                CALLOC(1, sizeof(NGAP_PLMNSupportItem_t));
-        pLMNIdentity = &NGAP_PLMNSupportItem->pLMNIdentity;
-        sliceSupportList = &NGAP_PLMNSupportItem->sliceSupportList;
-
-        ogs_asn_buffer_to_OCTET_STRING(
-                &amf_self()->plmn_supporti.plmn_id,
-                OGS_PLMN_ID_LEN, pLMNIdentity);
-        for (j = 0; j < amf_self()->plmn_supporti.num_of_s_nssai; j++) {
-            NGAP_SliceSupportItem_t *NGAP_SliceSupportItem = NULL;
-            NGAP_S_NSSAI_t *s_NSSAI = NULL;
-            NGAP_SST_t *sST = NULL;
-
-            NGAP_SliceSupportItem = (NGAP_SliceSupportItem_t *)
-                    CALLOC(1, sizeof(NGAP_SliceSupportItem_t));
-            s_NSSAI = &NGAP_SliceSupportItem->s_NSSAI;
-            sST = &s_NSSAI->sST;
-
-            ogs_asn_uint8_to_OCTET_STRING(
-                amf_self()->plmn_supporti.s_nssaij.sst, sST);
-            if (amf_self()->plmn_supporti.s_nssaij.sd.v !=
-                    OGS_S_NSSAI_NO_SD_VALUE) {
-                s_NSSAI->sD = CALLOC(1, sizeof(NGAP_SD_t));
-                ogs_asn_uint24_to_OCTET_STRING(
-                    amf_self()->plmn_supporti.s_nssaij.sd, s_NSSAI->sD);
-            }
-
-            ASN_SEQUENCE_ADD(&sliceSupportList->list, NGAP_SliceSupportItem);
-        }
-
-        ASN_SEQUENCE_ADD(&PLMNSupportList->list, NGAP_PLMNSupportItem);
-    }
+    ngap_build_plmn_support_list(PLMNSupportList);
 
     return ogs_ngap_encode(&pdu);
 }
@@ -213,6 +228,62 @@
     return ogs_ngap_encode(&pdu);
 }
 
+ogs_pkbuf_t *ngap_build_amf_configuration_update(void)
+{
+    int i, num_plmn = 0;
+    NGAP_NGAP_PDU_t pdu;
+    NGAP_InitiatingMessage_t *initiatingMessage = NULL;
+    NGAP_AMFConfigurationUpdate_t *AMFConfigurationUpdate = NULL;
+
+    NGAP_AMFConfigurationUpdateIEs_t *ie = NULL;
+    NGAP_PLMNSupportList_t *PLMNSupportList = NULL;
+
+    ogs_debug("AMFConfigurationUpdate");
+
+    /* Count valid PLMNs (those with at least one S-NSSAI) */
+    for (i = 0; i < amf_self()->num_of_plmn_support; i++) {
+        if (amf_self()->plmn_supporti.num_of_s_nssai > 0) {
+            num_plmn++;
+        }
+    }
+
+    /*
+     * Build message even without PLMNs to notify gNBs
+     * If no PLMNs, the PLMNSupportList IE is omitted
+     */
+    if (num_plmn == 0) {
+        ogs_warn("Building AMF Configuration Update with no PLMNs (gNBs will be notified)");
+    }
+
+    memset(&pdu, 0, sizeof(NGAP_NGAP_PDU_t));
+    pdu.present = NGAP_NGAP_PDU_PR_initiatingMessage;
+    pdu.choice.initiatingMessage =
+        CALLOC(1, sizeof(NGAP_InitiatingMessage_t));
+
+    initiatingMessage = pdu.choice.initiatingMessage;
+    initiatingMessage->procedureCode = NGAP_ProcedureCode_id_AMFConfigurationUpdate;
+    initiatingMessage->criticality = NGAP_Criticality_reject;
+    initiatingMessage->value.present = NGAP_InitiatingMessage__value_PR_AMFConfigurationUpdate;
+
+    AMFConfigurationUpdate = &initiatingMessage->value.choice.AMFConfigurationUpdate;
+
+    /* Only add PLMNSupportList IE if there are PLMNs */
+    if (num_plmn > 0) {
+        ie = CALLOC(1, sizeof(NGAP_AMFConfigurationUpdateIEs_t));
+        ASN_SEQUENCE_ADD(&AMFConfigurationUpdate->protocolIEs, ie);
+
+        ie->id = NGAP_ProtocolIE_ID_id_PLMNSupportList;
+        ie->criticality = NGAP_Criticality_reject;
+        ie->value.present =
+            NGAP_AMFConfigurationUpdateIEs__value_PR_PLMNSupportList;
+
+        PLMNSupportList = &ie->value.choice.PLMNSupportList;
+        ngap_build_plmn_support_list(PLMNSupportList);
+    }
+
+    return ogs_ngap_encode(&pdu);
+}
+
 ogs_pkbuf_t *ngap_build_ran_configuration_update_ack(void)
 {
     NGAP_NGAP_PDU_t pdu;
@@ -824,10 +895,14 @@
 
     asn_uint642INTEGER(
             &UEAggregateMaximumBitRate->uEAggregateMaximumBitRateUL,
-            amf_ue->ue_ambr.uplink == 0 ? MAX_BIT_RATE : amf_ue->ue_ambr.uplink);
+            (amf_ue->ue_ambr.uplink == 0 ||
+             amf_ue->ue_ambr.uplink > OGS_MAX_BITRATE_NGAP) ?
+                OGS_MAX_BITRATE_NGAP : amf_ue->ue_ambr.uplink);
     asn_uint642INTEGER(
             &UEAggregateMaximumBitRate->uEAggregateMaximumBitRateDL,
-            amf_ue->ue_ambr.downlink == 0 ? MAX_BIT_RATE : amf_ue->ue_ambr.downlink);
+            (amf_ue->ue_ambr.downlink == 0 ||
+             amf_ue->ue_ambr.downlink > OGS_MAX_BITRATE_NGAP) ?
+                OGS_MAX_BITRATE_NGAP : amf_ue->ue_ambr.downlink);
 
     ran_ue->ue_ambr_sent = true;

open5gs_2.7.6.tar.xz/src/amf/ngap-build.h -> open5gs_2.7.7.tar.xz/src/amf/ngap-build.h Changed

open5gs_2.7.6.tar.xz/src/amf/ngap-handler.c -> open5gs_2.7.7.tar.xz/src/amf/ngap-handler.c Changed

@@ -183,6 +183,18 @@
         return;
     }
 
+    if (globalGNB_ID->pLMNIdentity.size != sizeof(gnb->plmn_id)) {
+        ogs_error("Invalid PLMNIdentity size = %d (expected %d)",
+                (int)globalGNB_ID->pLMNIdentity.size,
+                (int)sizeof(gnb->plmn_id));
+        group = NGAP_Cause_PR_protocol;
+        cause = NGAP_CauseProtocol_semantic_error;
+        r = ngap_send_ng_setup_failure(gnb, group, cause);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
+
     if (!SupportedTAList) {
         ogs_error("No SupportedTAList");
         group = NGAP_Cause_PR_protocol;
@@ -274,6 +286,18 @@
                     &BroadcastPLMNItem->pLMNIdentity;
             ogs_assert(pLMNIdentity);
 
+            if (pLMNIdentity->size != sizeof(ogs_plmn_id_t)) {
+                ogs_error("Invalid PLMNIdentity size = %d (expected %d)",
+                        (int)pLMNIdentity->size,
+                        (int)sizeof(ogs_plmn_id_t));
+                group = NGAP_Cause_PR_protocol;
+                cause = NGAP_CauseProtocol_semantic_error;
+                r = ngap_send_ng_setup_failure(gnb, group, cause);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
+                return;
+            }
+
             memcpy(&gnb->supported_ta_listi.bplmn_listj.plmn_id,
                     pLMNIdentity->buf, sizeof(ogs_plmn_id_t));
             ogs_debug("    PLMN_IDMCC:%d MNC:%d",
@@ -2920,6 +2944,56 @@
     eUTRAintegrityProtectionAlgorithms =
         &UESecurityCapabilities->eUTRAintegrityProtectionAlgorithms;
 
+    if (nRencryptionAlgorithms->size != sizeof(nr_ea)) {
+        ogs_error("Invalid nRencryptionAlgorithms->size = %d (expected %d)",
+                (int)nRencryptionAlgorithms->size,
+                (int)sizeof(nr_ea));
+        r = ngap_send_error_indication(
+                gnb, &ran_ue->ran_ue_ngap_id, &ran_ue->amf_ue_ngap_id,
+                NGAP_Cause_PR_protocol,
+                NGAP_CauseProtocol_message_not_compatible_with_receiver_state);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
+    if (nRintegrityProtectionAlgorithms->size != sizeof(nr_ia)) {
+        ogs_error("Invalid nRintegrityProtectionAlgorithms->size = %d "
+                "(expected %d)",
+                (int)nRintegrityProtectionAlgorithms->size,
+                (int)sizeof(nr_ia));
+        r = ngap_send_error_indication(
+                gnb, &ran_ue->ran_ue_ngap_id, &ran_ue->amf_ue_ngap_id,
+                NGAP_Cause_PR_protocol,
+                NGAP_CauseProtocol_message_not_compatible_with_receiver_state);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
+    if (eUTRAencryptionAlgorithms->size != sizeof(eutra_ea)) {
+        ogs_error("Invalid eUTRAencryptionAlgorithms->size = %d (expected %d)",
+                (int)eUTRAencryptionAlgorithms->size,
+                (int)sizeof(eutra_ea));
+        r = ngap_send_error_indication(
+                gnb, &ran_ue->ran_ue_ngap_id, &ran_ue->amf_ue_ngap_id,
+                NGAP_Cause_PR_protocol,
+                NGAP_CauseProtocol_message_not_compatible_with_receiver_state);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
+    if (eUTRAintegrityProtectionAlgorithms->size != sizeof(eutra_ia)) {
+        ogs_error("Invalid eUTRAintegrityProtectionAlgorithms->size = %d "
+                "(expected %d)",
+                (int)eUTRAintegrityProtectionAlgorithms->size,
+                (int)sizeof(eutra_ia));
+        r = ngap_send_error_indication(
+                gnb, &ran_ue->ran_ue_ngap_id, &ran_ue->amf_ue_ngap_id,
+                NGAP_Cause_PR_protocol,
+                NGAP_CauseProtocol_message_not_compatible_with_receiver_state);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     memcpy(&nr_ea, nRencryptionAlgorithms->buf, sizeof(nr_ea));
     nr_ea = be16toh(nr_ea);
     nr_ea0 = amf_ue->ue_security_capability.nr_ea0;
@@ -4239,7 +4313,7 @@
      * send partial-handover error
      */
     if (xact_count == amf_sess_xact_count(amf_ue)) {
-        ogs_error("No SMF session were processed %d", sess->psi);
+        ogs_error("No SMF sessions were processed");
         r = ngap_send_error_indication2(source_ue,
                 NGAP_Cause_PR_radioNetwork,
                 NGAP_CauseRadioNetwork_partial_handover);
@@ -4388,6 +4462,19 @@
                         &BroadcastPLMNItem->pLMNIdentity;
                 ogs_assert(pLMNIdentity);
 
+                if (pLMNIdentity->size != sizeof(ogs_plmn_id_t)) {
+                    ogs_error("Invalid PLMNIdentity size = %d (expected %d)",
+                            (int)pLMNIdentity->size,
+                            (int)sizeof(ogs_plmn_id_t));
+                    group = NGAP_Cause_PR_protocol;
+                    cause = NGAP_CauseProtocol_semantic_error;
+                    r = ngap_send_ran_configuration_update_failure(
+                            gnb, group, cause);
+                    ogs_expect(r == OGS_OK);
+                    ogs_assert(r != OGS_ERROR);
+                    return;
+                }
+
                 memcpy(&gnb->supported_ta_listi.bplmn_listj.plmn_id,
                         pLMNIdentity->buf, sizeof(ogs_plmn_id_t));
                 ogs_debug("    PLMN_IDMCC:%d MNC:%d",
@@ -4655,7 +4742,7 @@
                 ran_ue = ran_ue_find_by_amf_ue_ngap_id(amf_ue_ngap_id);
 
                 if (!ran_ue) {
-                    ogs_error("No RAN UE Context : AMF_UE_NGAP_ID%lld",
+                    ogs_warn("No RAN UE Context : AMF_UE_NGAP_ID%lld",
                             (long long)amf_ue_ngap_id);
                     continue;
                 }
@@ -4812,4 +4899,37 @@
         ogs_warn("    CauseGroup:%d Cause:%d",
                 Cause->present, (int)Cause->choice.radioNetwork);
     }
+
+    if (ran_ue) {
+        amf_ue_t *amf_ue = NULL;
+        int xact_count = 0;
+
+        ogs_warn("    Performing local release for "
+                "RAN_UE_NGAP_ID%lld AMF_UE_NGAP_ID%lld",
+                (long long)ran_ue->ran_ue_ngap_id,
+                (long long)ran_ue->amf_ue_ngap_id);
+
+        amf_ue = amf_ue_find_by_id(ran_ue->amf_ue_id);
+        if (amf_ue) {
+            CLEAR_AMF_UE_ALL_TIMERS(amf_ue);
+
+            xact_count = amf_sess_xact_count(amf_ue);
+
+            amf_sbi_send_deactivate_all_sessions(
+                    ran_ue, amf_ue,
+                    AMF_REMOVE_N2_CONTEXT_BY_ERROR_INDICATION,
+                    Cause->present, (int)Cause->choice.radioNetwork);
+
+            if (amf_sess_xact_count(amf_ue) == xact_count) {
+                ogs_debug("    SUPI%s", amf_ue->supi);
+                amf_ue_deassociate_ran_ue(amf_ue, ran_ue);
+                ran_ue_remove(ran_ue);
+                ogs_timer_start(amf_ue->mobile_reachable.timer,
+                        ogs_time_from_sec(
+                            amf_self()->time.t3512.value + 240));
+            }
+        } else {
+            ran_ue_remove(ran_ue);
+        }
+    }
 }

open5gs_2.7.6.tar.xz/src/amf/ngap-path.c -> open5gs_2.7.7.tar.xz/src/amf/ngap-path.c Changed

@@ -176,7 +176,7 @@
 
     amf_ue = amf_ue_find_by_id(ran_ue->amf_ue_id);
 
-    /* The Packet Buffer(pkbuf_t) for NAS message MUST make a HEADROOM. 
+    /* The Packet Buffer(pkbuf_t) for NAS message MUST make a HEADROOM.
      * When calculating AES_CMAC, we need to use the headroom of the packet. */
     nasbuf = ogs_pkbuf_alloc(NULL, OGS_NAS_HEADROOM+nasPdu->size);
     ogs_assert(nasbuf);
@@ -316,6 +316,39 @@
     return rv;
 }
 
+int ngap_send_amf_configuration_update(amf_gnb_t *gnb)
+{
+    int rv;
+    ogs_pkbuf_t *ngap_buffer;
+
+    ogs_assert(gnb);
+
+    ogs_debug("AMF-Configuration update");
+
+    ngap_buffer = ngap_build_amf_configuration_update();
+    ogs_assert(ngap_buffer);
+
+    rv = ngap_send_to_gnb(gnb, ngap_buffer, NGAP_NON_UE_SIGNALLING);
+    ogs_expect(rv == OGS_OK);
+
+    return rv;
+}
+
+void ngap_send_amf_configuration_update_all(void)
+{
+    amf_gnb_t *gnb = NULL;
+    int count = 0;
+
+    ogs_list_for_each(&amf_self()->gnb_list, gnb) {
+        if (gnb->state.ng_setup_success == true) {
+            ngap_send_amf_configuration_update(gnb);
+            count++;
+        }
+    }
+
+    ogs_info("AMFConfigurationUpdate sent to %d connected gNB(s)", count);
+}
+
 int ngap_send_ng_setup_failure(
         amf_gnb_t *gnb, NGAP_Cause_PR group, long cause)
 {

open5gs_2.7.6.tar.xz/src/amf/ngap-path.h -> open5gs_2.7.7.tar.xz/src/amf/ngap-path.h Changed

open5gs_2.7.6.tar.xz/src/amf/nnrf-handler.c -> open5gs_2.7.7.tar.xz/src/amf/nnrf-handler.c Changed

@@ -29,10 +29,18 @@
 
     ogs_sbi_nf_instance_t *nf_instance = NULL;
     ogs_sbi_object_t *sbi_object = NULL;
+    ogs_pool_id_t sbi_object_id = OGS_INVALID_POOL_ID;
     ogs_sbi_service_type_e service_type = OGS_SBI_SERVICE_TYPE_NULL;
+    OpenAPI_nf_type_e target_nf_type = OpenAPI_nf_type_NULL;
     OpenAPI_nf_type_e requester_nf_type = OpenAPI_nf_type_NULL;
     ogs_sbi_discovery_option_t *discovery_option = NULL;
 
+    amf_ue_t *amf_ue = NULL;
+    ran_ue_t *ran_ue = NULL;
+    amf_sess_t *sess = NULL;
+
+    ogs_pool_id_t ran_ue_id = OGS_INVALID_POOL_ID;
+
     OpenAPI_search_result_t *SearchResult = NULL;
 
     ogs_assert(recvmsg);
@@ -41,9 +49,15 @@
     ogs_assert(sbi_object);
     service_type = xact->service_type;
     ogs_assert(service_type);
+    target_nf_type = ogs_sbi_service_type_to_nf_type(service_type);
+    ogs_assert(target_nf_type);
     requester_nf_type = xact->requester_nf_type;
     ogs_assert(requester_nf_type);
 
+    sbi_object_id = xact->sbi_object_id;
+    ogs_assert(sbi_object_id >= OGS_MIN_POOL_ID &&
+            sbi_object_id <= OGS_MAX_POOL_ID);
+
     discovery_option = xact->discovery_option;
 
     SearchResult = recvmsg->SearchResult;
@@ -53,20 +67,37 @@
         return;
     }
 
-    ogs_nnrf_disc_handle_nf_discover_search_result(SearchResult);
+    if (sbi_object->type == OGS_SBI_OBJ_UE_TYPE) {
+        amf_ue = amf_ue_find_by_id(sbi_object_id);
+        ogs_assert(amf_ue);
+    } else if (sbi_object->type == OGS_SBI_OBJ_SESS_TYPE) {
+        sess = amf_sess_find_by_id(sbi_object_id);
+        ogs_assert(sess);
+        amf_ue = amf_ue_find_by_id(sess->amf_ue_id);
+        ogs_assert(amf_ue);
 
-    amf_sbi_select_nf(sbi_object,
-            service_type, requester_nf_type, discovery_option);
+        if (xact->user_data) {
+            amf_sbi_xact_ctx_t *ctx = xact->user_data;
 
-    nf_instance = OGS_SBI_GET_NF_INSTANCE(
-            sbi_object->service_type_arrayservice_type);
+            if (ctx->ran_ue_id != OGS_INVALID_POOL_ID)
+                ran_ue_id = ctx->ran_ue_id;
+        }
 
-    if (!nf_instance) {
-        amf_ue_t *amf_ue = NULL;
-        amf_sess_t *sess = NULL;
+        ogs_assert(ran_ue_id >= OGS_MIN_POOL_ID &&
+                ran_ue_id <= OGS_MAX_POOL_ID);
+        ran_ue = ran_ue_find_by_id(ran_ue_id);
+        ogs_assert(ran_ue);
+    } else {
+        ogs_fatal("(NF discover) Not implemented %s:%d",
+            ogs_sbi_service_type_to_name(service_type), sbi_object->type);
+        ogs_assert_if_reached();
+    }
+
+    ogs_nnrf_disc_handle_nf_discover_search_result(SearchResult);
 
-        ogs_assert(sbi_object->type > OGS_SBI_OBJ_BASE &&
-                    sbi_object->type < OGS_SBI_OBJ_TOP);
+    nf_instance = ogs_sbi_nf_instance_find_by_discovery_param(
+                    target_nf_type, requester_nf_type, discovery_option);
+    if (!nf_instance) {
         switch(sbi_object->type) {
         case OGS_SBI_OBJ_UE_TYPE:
             amf_ue = (amf_ue_t *)sbi_object;
@@ -107,21 +138,18 @@
             ogs_assert(r != OGS_ERROR);
             break;
         case OGS_SBI_OBJ_SESS_TYPE:
-            sess = (amf_sess_t *)sbi_object;
-            ogs_assert(sess);
-                        
             ogs_error("%d:%d (NF discover) No %s", sess->psi, sess->pti,
                         ogs_sbi_service_type_to_name(service_type));
             if (sess->payload_container_type) {
                 r = nas_5gs_send_back_gsm_message(
-                        ran_ue_find_by_id(sess->ran_ue_id), sess,
+                        ran_ue, sess,
                         OGS_5GMM_CAUSE_PAYLOAD_WAS_NOT_FORWARDED,
                         AMF_NAS_BACKOFF_TIME);
                 ogs_expect(r == OGS_OK);
                 ogs_assert(r != OGS_ERROR);
             } else {
                 r = ngap_send_error_indication2(
-                        ran_ue_find_by_id(sess->ran_ue_id),
+                        ran_ue,
                         NGAP_Cause_PR_transport,
                         NGAP_CauseTransport_transport_resource_unavailable);
                 ogs_expect(r == OGS_OK);
@@ -137,6 +165,9 @@
         return;
     }
 
+    OGS_SBI_SETUP_NF_INSTANCE(
+            sbi_object->service_type_arrayservice_type, nf_instance);
+
     ogs_expect(true == amf_sbi_send_request(nf_instance, xact));
 }

open5gs_2.7.6.tar.xz/src/amf/nnssf-build.c -> open5gs_2.7.7.tar.xz/src/amf/nnssf-build.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019,2020 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -24,8 +24,14 @@
 {
     ogs_sbi_message_t message;
     ogs_sbi_request_t *request = NULL;
+    amf_nnssf_nsselection_param_t *param = data;
 
+    amf_ue_t *amf_ue = NULL;
+
+    ogs_assert(param);
     ogs_assert(sess);
+    amf_ue = amf_ue_find_by_id(sess->amf_ue_id);
+    ogs_assert(amf_ue);
 
     memset(&message, 0, sizeof(message));
     message.h.method = (char *)OGS_SBI_HTTP_METHOD_GET;
@@ -36,20 +42,60 @@
 
     message.param.nf_id = NF_INSTANCE_ID(ogs_sbi_self()->nf_instance);
     if (!message.param.nf_id) {
-        ogs_error("No nf_id");
+        ogs_error("No nf-id");
         goto end;
     }
     message.param.nf_type = NF_INSTANCE_TYPE(ogs_sbi_self()->nf_instance);
     if (!message.param.nf_type) {
-        ogs_error("No nf_type");
+        ogs_error("No nf-type");
+        goto end;
+    }
+
+    message.param.slice_info_for_pdu_session_presence =
+        param->slice_info_for_pdu_session.presence;
+
+    if (!message.param.slice_info_for_pdu_session_presence) {
+        ogs_error("No sliceInfoForPDUSession");
         goto end;
     }
 
-    message.param.slice_info_request_for_pdu_session_presence = true;
-    message.param.roaming_indication = OpenAPI_roaming_indication_NON_ROAMING;
-    memcpy(&message.param.s_nssai, &sess->s_nssai,
+    if (!param->slice_info_for_pdu_session.snssai) {
+        ogs_error("No sNssai");
+        goto end;
+    }
+
+    message.param.snssai_presence = true;
+    memcpy(&message.param.s_nssai,
+            param->slice_info_for_pdu_session.snssai,
             sizeof(message.param.s_nssai));
 
+    message.param.roaming_indication =
+        param->slice_info_for_pdu_session.roaming_indication;
+
+    if (!message.param.roaming_indication) {
+        ogs_error("No roamingIndication");
+        goto end;
+    }
+
+    if (param->slice_info_for_pdu_session.home_snssai) {
+        message.param.home_snssai_presence = true;
+        if (message.param.home_snssai_presence)
+            memcpy(&message.param.home_snssai,
+                    param->slice_info_for_pdu_session.home_snssai,
+                    sizeof(message.param.home_snssai));
+    }
+
+    if (param->home_plmn_id) {
+        message.param.home_plmn_id_presence = true;
+        memcpy(&message.param.home_plmn_id,
+                param->home_plmn_id, sizeof(message.param.home_plmn_id));
+    }
+
+    if (param->tai) {
+        message.param.tai_presence = true;
+        memcpy(&message.param.tai, param->tai, sizeof(message.param.tai));
+    }
+
     request = ogs_sbi_build_request(&message);
     ogs_expect(request);

open5gs_2.7.6.tar.xz/src/amf/nnssf-build.h -> open5gs_2.7.7.tar.xz/src/amf/nnssf-build.h Changed

open5gs_2.7.6.tar.xz/src/amf/nnssf-handler.c -> open5gs_2.7.7.tar.xz/src/amf/nnssf-handler.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -22,10 +22,11 @@
 #include "sbi-path.h"
 
 int amf_nnssf_nsselection_handle_get(
-        amf_sess_t *sess, ogs_sbi_message_t *recvmsg)
+        amf_ue_t *amf_ue, ran_ue_t *ran_ue, amf_sess_t *sess,
+        int state, ogs_sbi_message_t *recvmsg)
 {
     bool rc;
-    int r;
+    int r, i;
     OpenAPI_uri_scheme_e scheme = OpenAPI_uri_scheme_NULL;
     ogs_sbi_client_t *client = NULL, *scp_client = NULL;
     char *fqdn = NULL;
@@ -36,9 +37,7 @@
     OpenAPI_authorized_network_slice_info_t *AuthorizedNetworkSliceInfo = NULL;
     OpenAPI_nsi_information_t *NsiInformation = NULL;
 
-    amf_ue_t *amf_ue = NULL;
-    ran_ue_t *ran_ue = NULL;
-
+    ogs_assert(state);
     ogs_assert(recvmsg);
     ogs_assert(!SESSION_CONTEXT_IN_SMF(sess));
 
@@ -47,13 +46,11 @@
         return OGS_ERROR;
     }
 
-    amf_ue = amf_ue_find_by_id(sess->amf_ue_id);
     if (!amf_ue) {
         ogs_error("UE(amf_ue) Context has already been removed");
         return OGS_ERROR;
     }
 
-    ran_ue = ran_ue_find_by_id(sess->ran_ue_id);
     if (!ran_ue) {
         ogs_error("%s RAN-NG Context has already been removed", amf_ue->supi);
         return OGS_ERROR;
@@ -97,6 +94,27 @@
         return OGS_ERROR;
     }
 
+    if (state == AMF_SMF_SELECTION_IN_HPLMN_IN_HOME_ROUTED) {
+        if (!sess->nssf.nrf_uri) {
+            ogs_error("No VPLMN nrf_uri");
+            r = nas_5gs_send_gmm_reject_from_sbi(
+                    amf_ue, OGS_SBI_HTTP_STATUS_INTERNAL_SERVER_ERROR);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+            return OGS_ERROR;
+        }
+
+        if (sess->nssf.hnrf_uri)
+            ogs_free(sess->nssf.hnrf_uri);
+        sess->nssf.hnrf_uri = ogs_strdup(NsiInformation->nrf_id);
+        ogs_assert(sess->nssf.hnrf_uri);
+    } else {
+        if (sess->nssf.nrf_uri)
+            ogs_free(sess->nssf.nrf_uri);
+        sess->nssf.nrf_uri = ogs_strdup(NsiInformation->nrf_id);
+        ogs_assert(sess->nssf.nrf_uri);
+    }
+
     discovery_option = ogs_sbi_discovery_option_new();
     ogs_assert(discovery_option);
 
@@ -104,18 +122,41 @@
     ogs_sbi_discovery_option_set_dnn(discovery_option, sess->dnn);
     ogs_sbi_discovery_option_set_tai(discovery_option, &amf_ue->nr_tai);
 
-    if (sess->nssf.nrf.id)
-        ogs_free(sess->nssf.nrf.id);
-    sess->nssf.nrf.id = ogs_strdup(NsiInformation->nrf_id);
-    ogs_assert(sess->nssf.nrf.id);
+    if (state == AMF_SMF_SELECTION_IN_HPLMN_IN_HOME_ROUTED) {
+        /*
+         * In order for Home Routed to find NRFs that are on HPLMN,
+         * we need to include Home PLMN information in the Discovery Option.
+         */
+        ogs_sbi_discovery_option_add_target_plmn_list(
+                discovery_option, &amf_ue->home_plmn_id);
+
+        ogs_assert(ogs_local_conf()->num_of_serving_plmn_id);
+        for (i = 0; i < ogs_local_conf()->num_of_serving_plmn_id; i++) {
+            ogs_sbi_discovery_option_add_requester_plmn_list(
+                    discovery_option,
+                    &ogs_local_conf()->serving_plmn_idi);
+        }
+
+        ogs_assert(sess->nssf.hnrf_uri);
+        ogs_sbi_discovery_option_set_hnrf_uri(
+                discovery_option, sess->nssf.hnrf_uri);
+    }
 
-    scp_client = NF_INSTANCE_CLIENT(ogs_sbi_self()->scp_instance);
+    /*
+     * SCP can only be used with Non-Roaming or LBO.
+     *
+     * In Home Routed, obtaining NRF from NSSF and selecting SMF
+     * cannot be done via SCP.
+     */
+    if (state == AMF_SMF_SELECTION_IN_VPLMN_IN_NON_ROAMING_OR_LBO)
+        scp_client = NF_INSTANCE_CLIENT(ogs_sbi_self()->scp_instance);
 
     if (scp_client) {
+        /* SCP can only be used with Non-Roaming or LBO. */
         amf_nsmf_pdusession_sm_context_param_t param;
 
         memset(&param, 0, sizeof(param));
-        param.nrf_uri.nrf.id = sess->nssf.nrf.id;
+        param.nrf_uri = sess->nssf.nrf_uri;
 
         r = amf_sess_sbi_discover_and_send(
                 OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, discovery_option,
@@ -124,6 +165,10 @@
         ogs_expect(r == OGS_OK);
         ogs_assert(r != OGS_ERROR);
     } else {
+        /*
+         * In Home Routed, obtaining NRF from NSSF and selecting SMF
+         * cannot be done via SCP.
+         */
         rc = ogs_sbi_getaddr_from_uri(
                 &scheme, &fqdn, &fqdn_port, &addr, &addr6,
                 NsiInformation->nrf_id);
@@ -163,7 +208,7 @@
 
         r = amf_sess_sbi_discover_by_nsi(
                 ran_ue, sess,
-                OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, discovery_option);
+                OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, discovery_option, state);
         ogs_expect(r == OGS_OK);
         ogs_assert(r != OGS_ERROR);
     }

open5gs_2.7.6.tar.xz/src/amf/nnssf-handler.h -> open5gs_2.7.7.tar.xz/src/amf/nnssf-handler.h Changed

open5gs_2.7.6.tar.xz/src/amf/npcf-build.c -> open5gs_2.7.7.tar.xz/src/amf/npcf-build.c Changed

open5gs_2.7.6.tar.xz/src/amf/nsmf-build.c -> open5gs_2.7.7.tar.xz/src/amf/nsmf-build.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019,2020 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -56,20 +56,6 @@
     memset(&header, 0, sizeof(header));
     memset(&ueLocation, 0, sizeof(ueLocation));
 
-    SmContextCreateData.serving_nf_id =
-        NF_INSTANCE_ID(ogs_sbi_self()->nf_instance);
-    if (!SmContextCreateData.serving_nf_id) {
-        ogs_error("No serving_nf_id");
-        goto end;
-    }
-
-    SmContextCreateData.serving_network =
-        ogs_sbi_build_plmn_id_nid(&amf_ue->nr_tai.plmn_id);
-    if (!SmContextCreateData.serving_nf_id) {
-        ogs_error("No serving_network");
-        goto end;
-    }
-
     SmContextCreateData.supi = amf_ue->supi;
     SmContextCreateData.pei = amf_ue->pei;
     if (amf_ue->num_of_msisdn) {
@@ -109,17 +95,13 @@
      * is absent, the serving core network operator shall be assumed.
      */
     if (ogs_sbi_plmn_id_in_vplmn(&amf_ue->home_plmn_id) == true) {
-        char *home_network_domain = NULL;
+        char *dnn_oi = ogs_dnn_oi_from_plmn_id(&amf_ue->home_plmn_id);
+        ogs_assert(dnn_oi);
 
-        home_network_domain =
-            ogs_home_network_domain_from_plmn_id(&amf_ue->home_plmn_id);
-        ogs_assert(home_network_domain);
-
-        SmContextCreateData.dnn =
-            ogs_msprintf("%s.%s", sess->dnn, home_network_domain);
+        SmContextCreateData.dnn = ogs_msprintf("%s.%s", sess->dnn, dnn_oi);
         ogs_assert(SmContextCreateData.dnn);
 
-        ogs_free(home_network_domain);
+        ogs_free(dnn_oi);
 
     } else {
 
@@ -138,35 +120,35 @@
         SmContextCreateData.hplmn_snssai = &hplmnSnssai;
     }
 
+    SmContextCreateData.serving_nf_id =
+        NF_INSTANCE_ID(ogs_sbi_self()->nf_instance);
+    if (!SmContextCreateData.serving_nf_id) {
+        ogs_error("No serving_nf_id");
+        goto end;
+    }
+
     SmContextCreateData.guami = ogs_sbi_build_guami(amf_ue->guami);
     if (!SmContextCreateData.guami) {
         ogs_error("No guami");
         goto end;
     }
-    SmContextCreateData.an_type = amf_ue->nas.access_type; 
 
-    header.service.name = (char *)OGS_SBI_SERVICE_NAME_NAMF_CALLBACK;
-    header.api.version = (char *)OGS_SBI_API_V1;
-    header.resource.component0 = amf_ue->supi;
-    header.resource.component1 =
-        (char *)OGS_SBI_RESOURCE_NAME_SM_CONTEXT_STATUS;
-    header.resource.component2 = ogs_msprintf("%d", sess->psi);
-    if (!header.resource.component2) {
-        ogs_error("No header.resource.component2");
+    SmContextCreateData.serving_network =
+        ogs_sbi_build_plmn_id_nid(&amf_ue->nr_tai.plmn_id);
+    if (!SmContextCreateData.serving_network) {
+        ogs_error("No serving_network");
         goto end;
     }
 
-    server = ogs_sbi_server_first();
-    if (!server) {
-        ogs_error("No server");
-        goto end;
-    }
-    SmContextCreateData.sm_context_status_uri =
-        ogs_sbi_server_uri(server, &header);
+    if (sess->request_type >= OpenAPI_request_type_INITIAL_REQUEST &&
+            sess->request_type <=
+            OpenAPI_request_type_EXISTING_EMERGENCY_PDU_SESSION)
+        SmContextCreateData.request_type = sess->request_type;
 
     n1SmMsg.content_id = (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
     SmContextCreateData.n1_sm_msg = &n1SmMsg;
 
+    SmContextCreateData.an_type = amf_ue->nas.access_type;
     SmContextCreateData.rat_type = amf_ue_rat_type(amf_ue);
 
     ueLocation.nr_location = ogs_sbi_build_nr_location(
@@ -175,12 +157,9 @@
         ogs_error("No ueLocation.nr_location");
         goto end;
     }
-    ueLocation.nr_location->ue_location_timestamp =
-        ogs_sbi_gmtime_string(amf_ue->ue_location_timestamp);
-    if (!ueLocation.nr_location->ue_location_timestamp) {
-        ogs_error("No ue_location_timestamp");
-        goto end;
-    }
+    if (amf_ue->ue_location_timestamp)
+        ueLocation.nr_location->ue_location_timestamp =
+            ogs_sbi_gmtime_string(amf_ue->ue_location_timestamp);
 
     SmContextCreateData.ue_location = &ueLocation;
     SmContextCreateData.ue_time_zone = ogs_sbi_timezone_string(ogs_timezone());
@@ -189,6 +168,54 @@
         goto end;
     }
 
+    header.service.name = (char *)OGS_SBI_SERVICE_NAME_NAMF_CALLBACK;
+    header.api.version = (char *)OGS_SBI_API_V1;
+    header.resource.component0 = amf_ue->supi;
+    header.resource.component1 =
+        (char *)OGS_SBI_RESOURCE_NAME_SM_CONTEXT_STATUS;
+    header.resource.component2 = ogs_msprintf("%d", sess->psi);
+    if (!header.resource.component2) {
+        ogs_error("No header.resource.component2");
+        goto end;
+    }
+
+    server = ogs_sbi_server_first();
+    if (!server) {
+        ogs_error("No server");
+        goto end;
+    }
+    SmContextCreateData.sm_context_status_uri =
+        ogs_sbi_server_uri(server, &header);
+
+    if (ogs_sbi_plmn_id_in_vplmn(&amf_ue->home_plmn_id) == true) {
+        if (sess->lbo_roaming_allowed == false) {
+            ogs_sbi_nf_instance_t *h_smf_instance = NULL;
+            ogs_sbi_client_t *h_smf_client = NULL;
+            char *apiroot = NULL;
+
+            /* Home-Routed Roaming */
+            h_smf_instance = OGS_SBI_GET_NF_INSTANCE(
+                    sess->sbi.home_nsmf_pdusession);
+            ogs_assert(h_smf_instance);
+            h_smf_client = NF_INSTANCE_CLIENT(h_smf_instance);
+            ogs_assert(h_smf_client);
+
+            SmContextCreateData.h_smf_id = h_smf_instance->id;
+
+            apiroot = ogs_sbi_client_apiroot(h_smf_client);
+            ogs_assert(apiroot);
+
+            SmContextCreateData.h_smf_uri =
+                ogs_msprintf("%s/%s/%s/%s", apiroot,
+                        (char *)OGS_SBI_SERVICE_NAME_NSMF_PDUSESSION,
+                        (char *)OGS_SBI_API_V1,
+                        (char *)OGS_SBI_RESOURCE_NAME_PDU_SESSIONS);
+            ogs_assert(SmContextCreateData.h_smf_uri);
+
+            ogs_free(apiroot);
+        }
+    }
+
     /*
      * We're experiencing an issue after changing SearchResult.validityTime
      * from 3600 seconds to 30 seconds. (#3210)
@@ -223,22 +250,10 @@
     message.http.accept = (char *)(OGS_SBI_CONTENT_JSON_TYPE ","
         OGS_SBI_CONTENT_NGAP_TYPE "," OGS_SBI_CONTENT_PROBLEM_TYPE);
 
-/*
- * Callback Header Configuration
- *
- * The 3gpp-Sbi-Callback HTTP header (per 3GPP TS 29.500 v17.9.0) indicates that
- * a message is an asynchronous notification or callback. This header should be
- * included only in HTTP POST requests that are callbacks (e.g., event or
- * notification messages) and must not be added to regular service requests,
- * such as registration (HTTP PUT) or subscription requests.
- */
-    message.http.custom.callback =
-        (char *)OGS_SBI_CALLBACK_NSMF_PDUSESSION_STATUS_NOTIFY;
-
-    if (param && param->nrf_uri.nrf.id) {
+    if (param && param->nrf_uri) {
         message.http.custom.nrf_uri =
             ogs_msprintf("%s: \"%s\"",
-                    OGS_SBI_SERVICE_NAME_NNRF_DISC, param->nrf_uri.nrf.id);
+                    OGS_SBI_SERVICE_NAME_NNRF_DISC, param->nrf_uri);
     }
 
     request = ogs_sbi_build_request(&message);
@@ -269,6 +284,9 @@
     if (SmContextCreateData.ue_time_zone)
         ogs_free(SmContextCreateData.ue_time_zone);
 
+    if (SmContextCreateData.h_smf_uri)
+        ogs_free(SmContextCreateData.h_smf_uri);
+
     if (message.http.custom.nrf_uri)
         ogs_free(message.http.custom.nrf_uri);
 
@@ -292,14 +310,14 @@
 
     ogs_assert(param);
     ogs_assert(sess);
-    ogs_assert(sess->sm_context.resource_uri);
+    ogs_assert(sess->sm_context_resource_uri);
     amf_ue = amf_ue_find_by_id(sess->amf_ue_id);
     ogs_assert(amf_ue);
 
     memset(&message, 0, sizeof(message));
     message.h.method = (char *)OGS_SBI_HTTP_METHOD_POST;
     message.h.uri = ogs_msprintf("%s/%s",
-            sess->sm_context.resource_uri, OGS_SBI_RESOURCE_NAME_MODIFY);
+            sess->sm_context_resource_uri, OGS_SBI_RESOURCE_NAME_MODIFY);
     ogs_assert(message.h.uri);
 
     memset(&ueLocation, 0, sizeof(ueLocation));
@@ -367,12 +385,9 @@
             ogs_error("No ueLocation.nr_location");
             goto end;
         }
-        ueLocation.nr_location->ue_location_timestamp =
-            ogs_sbi_gmtime_string(amf_ue->ue_location_timestamp);
-        if (!ueLocation.nr_location->ue_location_timestamp) {
-            ogs_error("No ueLocation.nr_location->ue_location_timestamp");
-            goto end;
-        }
+        if (amf_ue->ue_location_timestamp)
+            ueLocation.nr_location->ue_location_timestamp =
+                ogs_sbi_gmtime_string(amf_ue->ue_location_timestamp);
 
         SmContextUpdateData.ue_location = &ueLocation;
     }
@@ -424,31 +439,31 @@
     OpenAPI_ng_ap_cause_t ngApCause;
     OpenAPI_user_location_t ueLocation;
 
+    ogs_assert(param);
+
     ogs_assert(sess);
-    ogs_assert(sess->sm_context.resource_uri);
+    ogs_assert(sess->sm_context_resource_uri);
 
     memset(&message, 0, sizeof(message));
     message.h.method = (char *)OGS_SBI_HTTP_METHOD_POST;
     message.h.uri = ogs_msprintf("%s/%s",
-            sess->sm_context.resource_uri, OGS_SBI_RESOURCE_NAME_RELEASE);
+            sess->sm_context_resource_uri, OGS_SBI_RESOURCE_NAME_RELEASE);
     ogs_assert(message.h.uri);
 
     memset(&SmContextReleaseData, 0, sizeof(SmContextReleaseData));
 
-    if (param) {
-        SmContextReleaseData.cause = param->cause;
+    SmContextReleaseData.cause = param->cause;
 
-        if (param->ngApCause.group) {
-            SmContextReleaseData.ng_ap_cause = &ngApCause;
-            memset(&ngApCause, 0, sizeof(ngApCause));
-            ngApCause.group = param->ngApCause.group;
-            ngApCause.value = param->ngApCause.value;
-        }
+    if (param->ngApCause.group) {
+        SmContextReleaseData.ng_ap_cause = &ngApCause;
+        memset(&ngApCause, 0, sizeof(ngApCause));
+        ngApCause.group = param->ngApCause.group;
+        ngApCause.value = param->ngApCause.value;
+    }
 
-        if (param->gmm_cause) {
-            SmContextReleaseData._5g_mm_cause_value = param->gmm_cause;
-            SmContextReleaseData.is__5g_mm_cause_value = true;
-        }
+    if (param->gmm_cause) {
+        SmContextReleaseData._5g_mm_cause_value = param->gmm_cause;
+        SmContextReleaseData.is__5g_mm_cause_value = true;
     }
 
     memset(&ueLocation, 0, sizeof(ueLocation));
@@ -459,24 +474,27 @@
         goto end;
     }
 
-    ueLocation.nr_location = ogs_sbi_build_nr_location(
-            &amf_ue->nr_tai, &amf_ue->nr_cgi);
-    if (!ueLocation.nr_location) {
-        ogs_error("No ueLocation.nr_location");
-        goto end;
-    }
-    ueLocation.nr_location->ue_location_timestamp =
-        ogs_sbi_gmtime_string(amf_ue->ue_location_timestamp);
-    if (!ueLocation.nr_location->ue_location_timestamp) {
-        ogs_error("No ueLocation.nr_location->ue_location_timestamp");
-        goto end;
+    if (param->ue_location) {
+        ueLocation.nr_location = ogs_sbi_build_nr_location(
+                &amf_ue->nr_tai, &amf_ue->nr_cgi);
+        if (!ueLocation.nr_location) {
+            ogs_error("No ueLocation.nr_location");
+            goto end;
+        }
+        if (amf_ue->ue_location_timestamp)
+            ueLocation.nr_location->ue_location_timestamp =
+                ogs_sbi_gmtime_string(amf_ue->ue_location_timestamp);
+
+        SmContextReleaseData.ue_location = &ueLocation;
     }
 
-    SmContextReleaseData.ue_location = &ueLocation;
-    SmContextReleaseData.ue_time_zone = ogs_sbi_timezone_string(ogs_timezone());
-    if (!SmContextReleaseData.ue_time_zone) {
-        ogs_error("No SmContextReleaseData.ue_time_zone");
-        goto end;
+    if (param->ue_timezone) {
+        SmContextReleaseData.ue_time_zone =
+            ogs_sbi_timezone_string(ogs_timezone());
+        if (!SmContextReleaseData.ue_time_zone) {
+            ogs_error("No SmContextReleaseData.ue_time_zone");
+            goto end;
+        }
     }
 
     message.SmContextReleaseData = &SmContextReleaseData;

open5gs_2.7.6.tar.xz/src/amf/nsmf-build.h -> open5gs_2.7.7.tar.xz/src/amf/nsmf-build.h Changed

open5gs_2.7.6.tar.xz/src/amf/nsmf-handler.c -> open5gs_2.7.7.tar.xz/src/amf/nsmf-handler.c Changed

@@ -25,13 +25,11 @@
 #include "gmm-build.h"
 
 int amf_nsmf_pdusession_handle_create_sm_context(
-        amf_sess_t *sess, ogs_sbi_message_t *recvmsg)
+        amf_ue_t *amf_ue, ran_ue_t *ran_ue, amf_sess_t *sess,
+        ogs_sbi_message_t *recvmsg)
 {
     int rv, r;
 
-    amf_ue_t *amf_ue = NULL;
-    ran_ue_t *ran_ue = NULL;
-
     ogs_assert(recvmsg);
 
     if (!sess) {
@@ -39,13 +37,11 @@
         return OGS_ERROR;
     }
 
-    amf_ue = amf_ue_find_by_id(sess->amf_ue_id);
     if (!amf_ue) {
         ogs_error("UE(amf_ue) Context has already been removed");
         return OGS_ERROR;
     }
 
-    ran_ue = ran_ue_find_by_id(sess->ran_ue_id);
     if (!ran_ue) {
         ogs_error("%s RAN-NG Context has already been removed", amf_ue->supi);
         return OGS_ERROR;
@@ -246,13 +242,11 @@
 }
 
 int amf_nsmf_pdusession_handle_update_sm_context(
-        amf_sess_t *sess, int state, ogs_sbi_message_t *recvmsg)
+        amf_ue_t *amf_ue, ran_ue_t *ran_ue, amf_sess_t *sess,
+        int state, ogs_sbi_message_t *recvmsg)
 {
     int r;
 
-    amf_ue_t *amf_ue = NULL;
-    ran_ue_t *ran_ue = NULL;
-
     ogs_assert(recvmsg);
 
     if (!sess) {
@@ -260,14 +254,11 @@
         return OGS_ERROR;
     }
 
-    amf_ue = amf_ue_find_by_id(sess->amf_ue_id);
     if (!amf_ue) {
         ogs_error("UE(amf_ue) Context has already been removed");
         return OGS_ERROR;
     }
 
-    ran_ue = ran_ue_find_by_id(sess->ran_ue_id);
-
     if (recvmsg->res_status == OGS_SBI_HTTP_STATUS_NO_CONTENT ||
         recvmsg->res_status == OGS_SBI_HTTP_STATUS_OK) {
 
@@ -741,11 +732,10 @@
             } else if (state == AMF_UPDATE_SM_CONTEXT_HANDOVER_CANCEL) {
 
                 if (AMF_SESSION_SYNC_DONE(amf_ue, state)) {
-                    ran_ue_t *source_ue = NULL, *target_ue = NULL;
+                    ran_ue_t *target_ue = NULL;
 
-                    source_ue = ran_ue_find_by_id(sess->ran_ue_id);
-                    ogs_assert(source_ue);
-                    target_ue = ran_ue_find_by_id(source_ue->target_ue_id);
+                    ogs_assert(ran_ue);
+                    target_ue = ran_ue_find_by_id(ran_ue->target_ue_id);
                     if (target_ue) {
                         r = ngap_send_ran_ue_context_release_command(
                                 target_ue,
@@ -808,6 +798,23 @@
                                 amf_self()->time.t3512.value + 240));
                 }
 
+            } else if (state == AMF_REMOVE_N2_CONTEXT_BY_ERROR_INDICATION) {
+                if (AMF_SESSION_SYNC_DONE(amf_ue, state)) {
+
+                    if (ran_ue) {
+                        ogs_debug("    SUPI%s", amf_ue->supi);
+                        amf_ue_deassociate_ran_ue(amf_ue, ran_ue);
+                        ran_ue_remove(ran_ue);
+                    } else {
+                        ogs_warn("%s RAN-NG Context has already been removed",
+                                amf_ue->supi);
+                    }
+
+                    ogs_timer_start(amf_ue->mobile_reachable.timer,
+                            ogs_time_from_sec(
+                                amf_self()->time.t3512.value + 240));
+                }
+                
             } else if (state == AMF_REMOVE_S1_CONTEXT_BY_RESET_ALL) {
                 if (AMF_SESSION_SYNC_DONE(amf_ue, state)) {
 
@@ -954,7 +961,7 @@
                 sess->n2_released == true &&
                 sess->resource_status == OpenAPI_resource_status_RELEASED) {
                 amf_nsmf_pdusession_handle_release_sm_context(
-                        sess, AMF_RELEASE_SM_CONTEXT_NO_STATE);
+                        amf_ue, ran_ue, sess, AMF_RELEASE_SM_CONTEXT_NO_STATE);
             }
         }
     } else {
@@ -1106,25 +1113,21 @@
     return OGS_OK;
 }
 
-int amf_nsmf_pdusession_handle_release_sm_context(amf_sess_t *sess, int state)
+int amf_nsmf_pdusession_handle_release_sm_context(
+        amf_ue_t *amf_ue, ran_ue_t *ran_ue, amf_sess_t *sess, int state)
 {
     int r;
-    amf_ue_t *amf_ue = NULL;
-    ran_ue_t *ran_ue = NULL;
 
     if (!sess) {
         ogs_error("Session has already been removed");
         return OGS_ERROR;
     }
 
-    amf_ue = amf_ue_find_by_id(sess->amf_ue_id);
     if (!amf_ue) {
         ogs_error("UE(amf_ue) Context has already been removed");
         return OGS_ERROR;
     }
 
-    ran_ue = ran_ue_find_by_id(sess->ran_ue_id);
-
     /*
      * To check if Reactivation Request has been used.
      *
@@ -1139,7 +1142,7 @@
     if (sess->old_gsm_type == OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE &&
         sess->current_gsm_type ==
             OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST) {
-        ogs_error("%s:%d Do not remove Session due to Reactivation-requested",
+        ogs_warn("%s:%d Session retained: reactivation has been requested",
                 amf_ue->supi, sess->psi);
 
         /*
@@ -1242,6 +1245,9 @@
                      * 6. UEContextReleaseComplete
                      */
                     if (UDM_SDM_SUBSCRIBED(amf_ue)) {
+                        ogs_info("%s UDM_SDM_SUCSCRIBED "
+                                "in de_registered",
+                                amf_ue->supi);
                         r = amf_ue_sbi_discover_and_send(
                                 OGS_SBI_SERVICE_TYPE_NUDM_SDM, NULL,
                                 amf_nudm_sdm_build_subscription_delete,
@@ -1249,6 +1255,8 @@
                         ogs_expect(r == OGS_OK);
                         ogs_assert(r != OGS_ERROR);
                     } else if (PCF_AM_POLICY_ASSOCIATED(amf_ue)) {
+                        ogs_info("%s PCF_AM_POLICY_ASSOCIATED "
+                                "in de_registered", amf_ue->supi);
                         r = amf_ue_sbi_discover_and_send(
                                 OGS_SBI_SERVICE_TYPE_NPCF_AM_POLICY_CONTROL,
                                 NULL,
@@ -1257,6 +1265,7 @@
                         ogs_expect(r == OGS_OK);
                         ogs_assert(r != OGS_ERROR);
                     } else {
+                        ogs_info("%s Deregistration Accept in de_registered", amf_ue->supi);
                         r = nas_5gs_send_de_registration_accept(amf_ue);
                         ogs_expect(r == OGS_OK);
                         ogs_assert(r != OGS_ERROR);
@@ -1264,24 +1273,25 @@
 
                 } else if (OGS_FSM_CHECK(&amf_ue->sm,
                             gmm_state_authentication)) {
-                    ogs_fatal("Release SM Context in authentication");
-                    ogs_assert_if_reached();
+                    ogs_warn("%s Release SM Context in authentication",
+                            amf_ue->supi);
                 } else if (OGS_FSM_CHECK(
                             &amf_ue->sm, gmm_state_security_mode)) {
-                    ogs_fatal("Release SM Context in security-mode");
-                    ogs_assert_if_reached();
+                    ogs_warn("%s Release SM Context in security-mode",
+                            amf_ue->supi);
                 } else if (OGS_FSM_CHECK(&amf_ue->sm,
                                 gmm_state_initial_context_setup)) {
-                    ogs_fatal("Release SM Context in initial-context-setup");
-                    ogs_assert_if_reached();
+                    ogs_warn("%s Release SM Context in "
+                            "initial-context-setup", amf_ue->supi);
                 } else if (OGS_FSM_CHECK(&amf_ue->sm, gmm_state_registered)) {
-                    ogs_fatal("Release SM Context in registered");
-                    ogs_assert_if_reached();
+                    ogs_warn("%s Release SM Context in registered",
+                            amf_ue->supi);
                 } else if (OGS_FSM_CHECK(&amf_ue->sm, gmm_state_exception)) {
-                    ogs_fatal("Release SM Context in exception");
-                    ogs_assert_if_reached();
+                    ogs_warn("%s Release SM Context in exception",
+                            amf_ue->supi);
                 } else {
-                    ogs_fatal("Release SM Context : INVALID STATE");
+                    ogs_fatal("%s Release SM Context : INVALID STATE",
+                            amf_ue->supi);
                     ogs_assert_if_reached();
                 }
 
@@ -1381,8 +1391,15 @@
 
                 } else if (OGS_FSM_CHECK(
                             &amf_ue->sm, gmm_state_security_mode)) {
-                    ogs_fatal("Release SM Context in security-mode");
-                    ogs_assert_if_reached();
+    /*
+     * Issue #4012
+     * avoid abort on SM context release in security-mode state.
+     *
+     * Replace ogs_assert_if_reached() with ogs_error to log the invalid state
+     * and keep AMF running; logs error for debugging and improves availability.
+     */
+                    ogs_error("Invalid state transition: cannot release "
+                            "SM Context during security-mode state");
                 } else if (OGS_FSM_CHECK(&amf_ue->sm,
                                 gmm_state_initial_context_setup)) {
     /*

open5gs_2.7.6.tar.xz/src/amf/nsmf-handler.h -> open5gs_2.7.7.tar.xz/src/amf/nsmf-handler.h Changed

open5gs_2.7.6.tar.xz/src/amf/nudm-build.c -> open5gs_2.7.7.tar.xz/src/amf/nudm-build.c Changed

open5gs_2.7.6.tar.xz/src/amf/nudm-handler.c -> open5gs_2.7.7.tar.xz/src/amf/nudm-handler.c Changed

open5gs_2.7.6.tar.xz/src/amf/sbi-path.c -> open5gs_2.7.7.tar.xz/src/amf/sbi-path.c Changed

@@ -154,6 +154,11 @@
     return OGS_OK;
 }
 
+static void amf_sbi_xact_ctx_free(void *data)
+{
+    ogs_free(data);
+}
+
 int amf_sess_sbi_discover_and_send(
         ogs_sbi_service_type_e service_type,
         ogs_sbi_discovery_option_t *discovery_option,
@@ -168,6 +173,32 @@
     ogs_assert(sess);
     ogs_assert(build);
 
+/*
+ * RAN-UE identifier currently associated with this session.
+ *
+ * NOTE:
+ * This field represents the latest RAN UE NGAP ID known for the session.
+ * It may change during procedures such as NG context release and
+ * re-establishment.
+ *
+ * IMPORTANT:
+ * - During SBI Client operations (e.g., AMF sending requests to SMF/PCF),
+ *   the RAN-UE may change before the asynchronous SBI response arrives.
+ *   To avoid using a stale or incorrect RAN-UE, the SBI transaction
+ *   (ogs_sbi_xact_t) stores a snapshot in xact->user_data.
+ *
+ *   When handling SBI Client responses, the AMF MUST use the snapshot
+ *   stored in the SBI transaction instead of this session field.
+ *
+ * - For SBI Server operations (e.g., Namf callbacks where the AMF
+ *   receives requests from SMF), there is no transaction-specific
+ *   snapshot. In such cases, the current session value (sess->ran_ue_id)
+ *   is used.
+ *
+ * This design helps prevent RAN-UE mismatches observed in Issue #2839,
+ * where concurrent UE procedures could result in NAS being sent to the
+ * wrong RAN UE.
+ */
     if (ran_ue) {
         sess->ran_ue_id = ran_ue->id;
     } else
@@ -179,13 +210,25 @@
     if (!xact) {
         ogs_error("amf_sess_sbi_discover_and_send() failed");
         r = nas_5gs_send_back_gsm_message(
-                ran_ue_find_by_id(sess->ran_ue_id), sess,
+                ran_ue, sess,
                 OGS_5GMM_CAUSE_PAYLOAD_WAS_NOT_FORWARDED, AMF_NAS_BACKOFF_TIME);
         ogs_expect(r == OGS_OK);
         ogs_assert(r != OGS_ERROR);
         return OGS_ERROR;
     }
 
+    /* Bind per-xact AMF context */
+    if (ran_ue) {
+        amf_sbi_xact_ctx_t *ctx = NULL;
+
+        ctx = ogs_calloc(1, sizeof(*ctx));
+        ogs_assert(ctx);
+
+        ctx->ran_ue_id = ran_ue->id;
+        xact->user_data = ctx;
+        xact->user_data_free = amf_sbi_xact_ctx_free;
+    }
+
     xact->state = state;
 
     rv = ogs_sbi_discover_and_send(xact);
@@ -193,7 +236,7 @@
         ogs_error("amf_sess_sbi_discover_and_send() failed");
         ogs_sbi_xact_remove(xact);
         r = nas_5gs_send_back_gsm_message(
-                ran_ue_find_by_id(sess->ran_ue_id), sess,
+                ran_ue, sess,
                 OGS_5GMM_CAUSE_PAYLOAD_WAS_NOT_FORWARDED, AMF_NAS_BACKOFF_TIME);
         ogs_expect(r == OGS_OK);
         ogs_assert(r != OGS_ERROR);
@@ -205,18 +248,27 @@
 static int client_discover_cb(
         int status, ogs_sbi_response_t *response, void *data)
 {
-    int r, rv;
+    int r, i, rv;
     ogs_sbi_message_t message;
 
+    ogs_sbi_nf_instance_t *nf_instance = NULL;
+
     ogs_sbi_xact_t *xact = NULL;
     ogs_pool_id_t xact_id = OGS_INVALID_POOL_ID;
     ogs_sbi_service_type_e service_type = OGS_SBI_SERVICE_TYPE_NULL;
+    OpenAPI_nf_type_e target_nf_type = OpenAPI_nf_type_NULL;
     OpenAPI_nf_type_e requester_nf_type = OpenAPI_nf_type_NULL;
     ogs_sbi_discovery_option_t *discovery_option = NULL;
     amf_ue_t *amf_ue = NULL;
     ran_ue_t *ran_ue = NULL;
     amf_sess_t *sess = NULL;
 
+    ogs_pool_id_t ran_ue_id = OGS_INVALID_POOL_ID;
+
+    ogs_sbi_discovery_option_t *v_discovery_option = NULL;
+
+    int current_state, next_state = AMF_CREATE_SM_CONTEXT_NO_STATE;
+
     xact_id = OGS_POINTER_TO_UINT(data);
     ogs_assert(xact_id >= OGS_MIN_POOL_ID && xact_id <= OGS_MAX_POOL_ID);
 
@@ -228,12 +280,27 @@
         return OGS_ERROR;
     }
 
+    if (xact->user_data) {
+        amf_sbi_xact_ctx_t *ctx = xact->user_data;
+
+        if (ctx->ran_ue_id != OGS_INVALID_POOL_ID)
+            ran_ue_id = ctx->ran_ue_id;
+    }
+
+    if (ran_ue_id >= OGS_MIN_POOL_ID && ran_ue_id <= OGS_MAX_POOL_ID)
+        ran_ue = ran_ue_find_by_id(ran_ue_id);
+
     service_type = xact->service_type;
     ogs_assert(service_type);
+    target_nf_type = ogs_sbi_service_type_to_nf_type(service_type);
+    ogs_assert(target_nf_type);
     requester_nf_type = xact->requester_nf_type;
     ogs_assert(requester_nf_type);
     discovery_option = xact->discovery_option;
 
+    current_state = xact->state;
+    ogs_assert(current_state);
+
     sess = amf_sess_find_by_id(xact->sbi_object_id);
     if (!sess) {
         ogs_error("Session has already been removed");
@@ -252,7 +319,6 @@
             ogs_sbi_response_free(response);
         return OGS_ERROR;
     }
-    ran_ue = ran_ue_find_by_id(sess->ran_ue_id);
     if (!ran_ue) {
         ogs_error("%s NG context has already been removed", amf_ue->supi);
         ogs_sbi_xact_remove(xact);
@@ -306,11 +372,9 @@
 
     ogs_nnrf_disc_handle_nf_discover_search_result(message.SearchResult);
 
-    amf_sbi_select_nf(&sess->sbi,
-            service_type, requester_nf_type, discovery_option);
-
-    if (!OGS_SBI_GET_NF_INSTANCE(
-                sess->sbi.service_type_arrayservice_type)) {
+    nf_instance = ogs_sbi_nf_instance_find_by_discovery_param(
+                    target_nf_type, requester_nf_type, discovery_option);
+    if (!nf_instance) {
         ogs_error("%s:%d (NF discover) No %s",
                     amf_ue->supi, sess->psi,
                     ogs_sbi_service_type_to_name(service_type));
@@ -323,12 +387,117 @@
         goto cleanup;
     }
 
-    r = amf_sess_sbi_discover_and_send(
-            service_type, NULL,
-            amf_nsmf_pdusession_build_create_sm_context,
-            ran_ue, sess, AMF_CREATE_SM_CONTEXT_NO_STATE, NULL);
-    ogs_expect(r == OGS_OK);
-    ogs_assert(r != OGS_ERROR);
+    v_discovery_option = ogs_sbi_discovery_option_new();
+    ogs_assert(v_discovery_option);
+
+    ogs_sbi_discovery_option_add_snssais(v_discovery_option, &sess->s_nssai);
+    ogs_sbi_discovery_option_set_dnn(v_discovery_option, sess->dnn);
+    ogs_sbi_discovery_option_set_tai(v_discovery_option, &amf_ue->nr_tai);
+
+    if (current_state == AMF_SMF_SELECTION_IN_VPLMN_IN_NON_ROAMING_OR_LBO) {
+        OGS_SBI_SETUP_NF_INSTANCE(
+                sess->sbi.service_type_arrayservice_type, nf_instance);
+
+    } else if (current_state == AMF_SMF_SELECTION_IN_VPLMN_IN_HOME_ROUTED) {
+        /* Home-Routed roaming */
+        ogs_sbi_nf_instance_t *h_smf_instance = NULL;
+
+        ogs_info("Home-Routed Roaming(VPLMN)");
+
+        OGS_SBI_SETUP_NF_INSTANCE(
+                sess->sbi.service_type_arrayservice_type, nf_instance);
+
+        h_smf_instance = OGS_SBI_GET_NF_INSTANCE(
+                sess->sbi.home_nsmf_pdusession);
+
+        if (!h_smf_instance) {
+            ogs_sbi_discovery_option_t *h_discovery_option =
+                ogs_sbi_discovery_option_new();
+            ogs_assert(h_discovery_option);
+
+            ogs_sbi_discovery_option_add_snssais(
+                    h_discovery_option, &sess->s_nssai);
+            ogs_sbi_discovery_option_set_dnn(
+                    h_discovery_option, sess->dnn);
+            ogs_sbi_discovery_option_set_tai(
+                    h_discovery_option, &amf_ue->nr_tai);
+
+            ogs_sbi_discovery_option_add_target_plmn_list(
+                    h_discovery_option, &amf_ue->home_plmn_id);
+
+            ogs_assert(ogs_local_conf()->num_of_serving_plmn_id);
+            for (i = 0; i < ogs_local_conf()->num_of_serving_plmn_id; i++) {
+                ogs_sbi_discovery_option_add_requester_plmn_list(
+                        h_discovery_option,
+                        &ogs_local_conf()->serving_plmn_idi);
+            }
+
+            h_smf_instance = ogs_sbi_nf_instance_find_by_discovery_param(
+                        target_nf_type, requester_nf_type, h_discovery_option);
+            if (h_smf_instance) {
+                ogs_info("H-SMF Instance %s(LIST)", h_smf_instance->id);
+                OGS_SBI_SETUP_NF_INSTANCE(
+                        sess->sbi.home_nsmf_pdusession, h_smf_instance);
+            } else
+                ogs_info("No H-SMF Instance");
+
+            ogs_sbi_discovery_option_free(h_discovery_option);
+        } else
+            ogs_info("H-SMF Instance %s(SESSION)", h_smf_instance->id);
+
+        if (h_smf_instance) {
+            /* Both V-SMF and H-SMF Discovered */
+            ogs_info("H-SMF Instance %s", h_smf_instance->id);
+        } else {
+            ogs_info("H-SMF not discovered");
+            next_state = AMF_SMF_SELECTION_IN_HPLMN_IN_HOME_ROUTED;
+        }
+    } else if (current_state == AMF_SMF_SELECTION_IN_HPLMN_IN_HOME_ROUTED) {
+        ogs_info("Home-Routed Roaming(HPLMN)");
+
+        OGS_SBI_SETUP_NF_INSTANCE(sess->sbi.home_nsmf_pdusession, nf_instance);
+    } else {
+        ogs_fatal("Invalid current_state = %d", current_state);
+        ogs_assert_if_reached();
+    }
+
+    if (next_state == AMF_SMF_SELECTION_IN_HPLMN_IN_HOME_ROUTED) {
+
+        amf_nnssf_nsselection_param_t param;
+
+        memset(&param, 0, sizeof(param));
+        param.slice_info_for_pdu_session.presence = true;
+        param.slice_info_for_pdu_session.snssai = &sess->s_nssai;
+        param.slice_info_for_pdu_session.roaming_indication =
+            OpenAPI_roaming_indication_HOME_ROUTED_ROAMING;
+        param.slice_info_for_pdu_session.home_snssai = &sess->s_nssai;
+        param.home_plmn_id = &amf_ue->home_plmn_id;
+        param.tai = &amf_ue->nr_tai;
+
+        /* No H-SMF Instance */
+        ogs_info("H-SMF not discovered");
+        r = amf_sess_sbi_discover_and_send(
+                OGS_SBI_SERVICE_TYPE_NNSSF_NSSELECTION, NULL,
+                amf_nnssf_nsselection_build_get, ran_ue, sess,
+                AMF_SMF_SELECTION_IN_HPLMN_IN_HOME_ROUTED, &param);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+
+        ogs_sbi_discovery_option_free(v_discovery_option);
+
+    } else if (next_state == AMF_CREATE_SM_CONTEXT_NO_STATE) {
+
+        r = amf_sess_sbi_discover_and_send(
+                service_type, v_discovery_option,
+                amf_nsmf_pdusession_build_create_sm_context,
+                ran_ue, sess, next_state, NULL);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+
+    } else {
+        ogs_error("Invalid NEXT state %d", next_state);
+        ogs_assert_if_reached();
+    }
 
     ogs_sbi_xact_remove(xact);
 
@@ -349,7 +518,7 @@
 int amf_sess_sbi_discover_by_nsi(
         ran_ue_t *ran_ue, amf_sess_t *sess,
         ogs_sbi_service_type_e service_type,
-        ogs_sbi_discovery_option_t *discovery_option)
+        ogs_sbi_discovery_option_t *discovery_option, int state)
 {
     ogs_sbi_xact_t *xact = NULL;
     ogs_sbi_client_t *client = NULL;
@@ -358,8 +527,9 @@
     client = sess->nssf.nrf.client;
     ogs_assert(client);
     ogs_assert(service_type);
+    ogs_assert(state);
 
-    ogs_warn("Try to discover %s",
+    ogs_warn("Try to discover by NsiInformation %s",
                 ogs_sbi_service_type_to_name(service_type));
 
     if (ran_ue) {
@@ -376,13 +546,27 @@
     }
 
     xact->request = amf_nnrf_disc_build_discover(
-                sess->nssf.nrf.id, xact->service_type, xact->discovery_option);
+                sess->nssf.nrf_uri, xact->service_type, xact->discovery_option);
     if (!xact->request) {
         ogs_error("amf_nnrf_disc_build_discover() failed");
         ogs_sbi_xact_remove(xact);
         return OGS_ERROR;
     }
 
+    /* Bind per-xact AMF context */
+    if (ran_ue) {
+        amf_sbi_xact_ctx_t *ctx = NULL;
+
+        ctx = ogs_calloc(1, sizeof(*ctx));
+        ogs_assert(ctx);
+
+        ctx->ran_ue_id = ran_ue->id;
+        xact->user_data = ctx;
+        xact->user_data_free = amf_sbi_xact_ctx_free;
+    }
+
+    xact->state = state;
+
     return ogs_sbi_client_send_request(
             client, client_discover_cb, xact->request,
             OGS_UINT_TO_POINTER(xact->id)) == true ? OGS_OK : OGS_ERROR;
@@ -486,7 +670,7 @@
 }
 
 void amf_sbi_send_release_session(
-        ran_ue_t *ran_ue, amf_sess_t *sess, int state)
+        ran_ue_t *ran_ue, amf_sess_t *sess, int state, void *data)
 {
     int r;
 
@@ -495,7 +679,7 @@
     r = amf_sess_sbi_discover_and_send(
             OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
             amf_nsmf_pdusession_build_release_sm_context,
-            ran_ue, sess, state, NULL);
+            ran_ue, sess, state, data);
     ogs_expect(r == OGS_OK);
     ogs_assert(r != OGS_ERROR);
 
@@ -504,7 +688,7 @@
 }
 
 void amf_sbi_send_release_all_sessions(
-        ran_ue_t *ran_ue, amf_ue_t *amf_ue, int state)
+        ran_ue_t *ran_ue, amf_ue_t *amf_ue, int state, void *data)
 {
     amf_sess_t *sess = NULL;
 
@@ -512,7 +696,7 @@
 
     ogs_list_for_each(&amf_ue->sess_list, sess) {
         if (SESSION_CONTEXT_IN_SMF(sess))
-            amf_sbi_send_release_session(ran_ue, sess, state);
+            amf_sbi_send_release_session(ran_ue, sess, state, data);
     }
 }

open5gs_2.7.6.tar.xz/src/amf/sbi-path.h -> open5gs_2.7.7.tar.xz/src/amf/sbi-path.h Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2022 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -31,6 +31,17 @@
 extern "C" {
 #endif
 
+typedef struct amf_sbi_xact_ctx_s {
+    /*
+     * Snapshot of the RAN-UE identifier associated with the
+     * SBI transaction at the time the request was sent.
+     *
+     * This is required because the session's current RAN-UE
+     * may change before the asynchronous response arrives.
+     */
+    ogs_pool_id_t ran_ue_id;
+} amf_sbi_xact_ctx_t;
+
 int amf_sbi_open(void);
 void amf_sbi_close(void);
 
@@ -63,6 +74,15 @@
 #define AMF_REMOVE_S1_CONTEXT_BY_LO_CONNREFUSED         51
 #define AMF_REMOVE_S1_CONTEXT_BY_RESET_ALL              52
 #define AMF_REMOVE_S1_CONTEXT_BY_RESET_PARTIAL          53
+#define AMF_REMOVE_N2_CONTEXT_BY_ERROR_INDICATION       54
+
+/*
+ * TS23.502
+ * 4.3.2.2.3 SMF selection
+ */
+#define AMF_SMF_SELECTION_IN_VPLMN_IN_NON_ROAMING_OR_LBO    1
+#define AMF_SMF_SELECTION_IN_VPLMN_IN_HOME_ROUTED           2
+#define AMF_SMF_SELECTION_IN_HPLMN_IN_HOME_ROUTED           3
 
 int amf_ue_sbi_discover_and_send(
         ogs_sbi_service_type_e service_type,
@@ -78,7 +98,7 @@
 int amf_sess_sbi_discover_by_nsi(
         ran_ue_t *ran_ue, amf_sess_t *sess,
         ogs_sbi_service_type_e service_type,
-        ogs_sbi_discovery_option_t *discovery_option);
+        ogs_sbi_discovery_option_t *discovery_option, int state);
 
 void amf_sbi_send_activating_session(
         ran_ue_t *ran_ue, amf_sess_t *sess, int state);
@@ -90,9 +110,9 @@
 void amf_sbi_send_deactivate_all_ue_in_gnb(amf_gnb_t *gnb, int state);
 
 void amf_sbi_send_release_session(
-        ran_ue_t *ran_ue, amf_sess_t *sess, int state);
+        ran_ue_t *ran_ue, amf_sess_t *sess, int state, void *data);
 void amf_sbi_send_release_all_sessions(
-        ran_ue_t *ran_ue, amf_ue_t *amf_ue, int state);
+        ran_ue_t *ran_ue, amf_ue_t *amf_ue, int state, void *data);
 
 bool amf_sbi_send_n1_n2_failure_notify(
         amf_sess_t *sess, OpenAPI_n1_n2_message_transfer_cause_e cause);

open5gs_2.7.7.tar.xz/src/amf/ue-info.c Added

@@ -0,0 +1,620 @@
+/*
+ * Copyright (C) 2025 by Juraj Elias <juraj.elias@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/*
+ * Connected AMF UEs JSON dumper for the Prometheus HTTP server (/ue-info).
+ * - supi, suci, pei, cm_state, guti,m_tmsi, gnb_info, location, security, ambr, slices, am_policy
+ * - pager: /ue-info?page=0&page_size=100 (0-based, page=-1 without paging) Default: page=0 page_size=100=MAXSIZE
+ *
+ * path: http://AMF_IP:9090/ue-info
+ * curl -s "http://127.0.0.5:9090/ue-info" |jq . 
+ * {
+ *   "items": 
+ *     {
+ *       "supi": "imsi-001010000056492",
+ *       "suci": "suci-0-001-01-0000-1-1-85731c4241d466407311a85135e914987944f361550f13f4532e29bdc5859548a363cc1a81798bb4cc59f2b4db",
+ *       "pei": "imeisv-3535938300494715",
+ *       "cm_state": "connected",
+ *       "guti": "00101-030080-CC00007AB",
+ *       "m_tmsi": 3221227435,
+ *       "gnb": {
+ *         "ostream_id": 1,
+ *         "amf_ue_ngap_id": 2,
+ *         "ran_ue_ngap_id": 39,
+ *         "gnb_id": 100,
+ *         "cell_id": 1
+ *       },
+ *       "location": {
+ *         "timestamp": 1758733375895512,
+ *         "nr_tai": {
+ *           "plmn": "99970",
+ *           "tac_hex": "000001",
+ *           "tac": 1
+ *         },
+ *         "nr_cgi": {
+ *           "plmn": "99970",
+ *           "nci": 1638401,
+ *           "gnb_id": 100,
+ *           "cell_id": 1
+ *         },
+ *         "last_visited_plmn_id": "000000"
+ *       },
+ *       "msisdn": ,
+ *       "security": {
+ *         "valid": 1,
+ *         "enc": "nea2",
+ *         "int": "nia2"
+ *       },
+ *       "ambr": {
+ *         "downlink": 1000000000,
+ *         "uplink": 1000000000
+ *       },
+ *       "pdu_sessions": ,
+ *       "pdu_sessions_count": 0,
+ *       "requested_slices": 
+ *         {
+ *           "sst": 1,
+ *           "sd": "ffffff"
+ *         }
+ *       ,
+ *       "allowed_slices": 
+ *         {
+ *           "sst": 1,
+ *           "sd": "ffffff"
+ *         }
+ *       ,
+ *       "requested_slices_count": 1,
+ *       "allowed_slices_count": 1,
+ *       "am_policy_features": 4,
+ *       "am_policy_features_info": {
+ *         "hex": "0x0000000000000004",
+ *         "bits": 
+ *           2
+ *         ,
+ *         "labels": 
+ *           "QoS Policy Control"
+ *         
+ *       }
+ *     }
+ *   ,
+ *   "pager": {
+ *     "page": 0,
+ *     "page_size": 100,
+ *     "count": 2
+ *   }
+ * }
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <inttypes.h>
+#include <string.h>
+
+#include "ogs-core.h"
+#include "ogs-proto.h"
+#include "context.h"
+#include "ue-info.h"
+
+#include "sbi/openapi/external/cJSON.h"
+#include "metrics/prometheus/json_pager.h"
+
+
+size_t amf_dump_ue_info(char *buf, size_t buflen, size_t page, size_t page_size)
+{
+    page_size = page_size ? page_size : 100;
+    if (page_size > 100) page_size = 100;
+
+    return amf_dump_ue_info_paged(buf, buflen, page, page_size);
+}
+
+static inline uint32_t u24_to_u32(ogs_uint24_t v)
+{
+    uint32_t x = 0;
+    memcpy(&x, &v, sizeof(v) < sizeof(x) ? sizeof(v) : sizeof(x));
+    return (x & 0xFFFFFFu);
+}
+
+/* AM policy feature labels */
+static const char *am_policy_feature_names64 = {
+    /*0*/ "AM Policy Association",
+    /*1*/ "Slice-specific Policy",
+    /*2*/ "QoS Policy Control",
+    /*3*/ "Access & Mobility Policy",
+    /*4*/ "Charging Policy",
+    /*5*/ "Traffic Steering",
+    /*6*/ "Roaming Policy",
+    /*7*/ "Emergency Services Policy",
+    /*8*/ "UE Policy",
+    /*9*/ "Session Continuity Policy",
+    /*10*/ "Application-based Policy",
+    /*11*/ "Location-based Policy",
+    /*12*/ "Time-based Policy",
+    /*13*/ "Data Network Selection",
+    /*14*/ "Policy Update Notification",
+    /*15*/ "Policy Control Event Exposure",
+};
+
+/* -------- JSON builders: 0=OK, -1=OOM. Children are attached only when complete. -------- */
+static int add_snssai_sd_string(cJSON *obj, const char *key, const ogs_uint24_t *sd_ptr)
+{
+    char sd_hex7;
+    uint32_t sd = 0;
+    if (sd_ptr)
+        sd = u24_to_u32(*sd_ptr);
+    (void)snprintf(sd_hex, sizeof sd_hex, "%06x", (unsigned)sd);
+    cJSON *s = cJSON_CreateString(sd_hex);
+    if (!s) return -1;
+    cJSON_AddItemToObjectCS(obj, key, s);
+    return 0;
+}
+
+static int add_basic_identity(cJSON *o, const amf_ue_t *ue)
+{
+    if (ue->supi && ue->supi0) {
+        cJSON *v = cJSON_CreateString(ue->supi); if (!v) return -1;
+        cJSON_AddItemToObjectCS(o, "supi", v);
+    }
+    if (ue->suci && ue->suci0) {
+        cJSON *v = cJSON_CreateString(ue->suci); if (!v) return -1;
+        cJSON_AddItemToObjectCS(o, "suci", v);
+    }
+    if (ue->pei && ue->pei0) {
+        cJSON *v = cJSON_CreateString(ue->pei); if (!v) return -1;
+        cJSON_AddItemToObjectCS(o, "pei", v);
+    }
+
+    {
+        const char *cm = CM_CONNECTED(ue) ? "connected" : "idle";
+        cJSON *v = cJSON_CreateString(cm); if (!v) return -1;
+        cJSON_AddItemToObjectCS(o, "cm_state", v);
+    }
+
+    /* If M-TMSI present, expose GUTI string and m_tmsi numeric */
+    if (ue->current.m_tmsi) {
+        char plmn_strOGS_PLMNIDSTRLEN = {0};
+        ogs_plmn_id_to_string(&ue->guami->plmn_id, plmn_str);
+
+        /* ogs_amf_id_to_string() returns heap memory — free it */
+        char *amf_hex = ogs_amf_id_to_string(&ue->guami->amf_id);
+        const char *amf_str = amf_hex ? amf_hex : "";
+
+        char guti_buf80;
+        (void)snprintf(guti_buf, sizeof guti_buf, "%s-%s-C%08X",
+                       plmn_str, amf_str, (unsigned)ue->current.guti.m_tmsi);
+
+        cJSON *g = cJSON_CreateString(guti_buf);
+        if (amf_hex) ogs_free(amf_hex);
+        if (!g) return -1;
+        cJSON_AddItemToObjectCS(o, "guti", g);
+
+        cJSON *m = cJSON_CreateNumber((double)ue->current.guti.m_tmsi);
+        if (!m) return -1;
+        cJSON_AddItemToObjectCS(o, "m_tmsi", m);
+    }
+    return 0;
+}
+
+static int add_gnb(cJSON *parent, const amf_ue_t *ue)
+{
+    cJSON *gnb = cJSON_CreateObject();
+    if (!gnb) return -1;
+
+    cJSON *osid = cJSON_CreateNumber((double)ue->gnb_ostream_id);
+    if (!osid) { cJSON_Delete(gnb); return -1; }
+    cJSON_AddItemToObjectCS(gnb, "ostream_id", osid);
+
+    ran_ue_t *ran = ran_ue_find_by_id(ue->ran_ue_id);
+    if (ran) {
+        uint64_t nci = ue->nr_cgi.cell_id & 0xFFFFFFFFFULL; /* 36-bit */
+        uint32_t gnb_id  = (uint32_t)((nci >> 14) & 0x3FFFFF);
+        uint32_t cell_id = (uint32_t)(nci & 0x3FFF);
+
+        cJSON *a = cJSON_CreateNumber((double)ran->amf_ue_ngap_id);
+        cJSON *r = cJSON_CreateNumber((double)ran->ran_ue_ngap_id);
+        cJSON *g = cJSON_CreateNumber((double)gnb_id);
+        cJSON *c = cJSON_CreateNumber((double)cell_id);
+        if (!a || !r || !g || !c) {
+            if (a) cJSON_Delete(a);
+            if (r) cJSON_Delete(r);
+            if (g) cJSON_Delete(g);
+            if (c) cJSON_Delete(c);
+            cJSON_Delete(gnb);
+            return -1;
+        }
+        cJSON_AddItemToObjectCS(gnb, "amf_ue_ngap_id", a);
+        cJSON_AddItemToObjectCS(gnb, "ran_ue_ngap_id", r);
+        cJSON_AddItemToObjectCS(gnb, "gnb_id", g);
+        cJSON_AddItemToObjectCS(gnb, "cell_id", c);
+    } else {
+        cJSON *st = cJSON_CreateString("not-connected");
+        if (!st) { cJSON_Delete(gnb); return -1; }
+        cJSON_AddItemToObjectCS(gnb, "status", st);
+    }
+
+    cJSON_AddItemToObjectCS(parent, "gnb", gnb);
+    return 0;
+}
+
+static int add_location(cJSON *parent, const amf_ue_t *ue)
+{
+    cJSON *loc = cJSON_CreateObject();
+    if (!loc) return -1;
+
+    cJSON *ts = cJSON_CreateNumber((double)ue->ue_location_timestamp);
+    if (!ts) { cJSON_Delete(loc); return -1; }
+    cJSON_AddItemToObjectCS(loc, "timestamp", ts);
+
+    /* nr_tai */
+    {
+        cJSON *tai = cJSON_CreateObject();
+        if (!tai) { cJSON_Delete(loc); return -1; }
+
+        char plmn_strOGS_PLMNIDSTRLEN = {0};
+        ogs_plmn_id_to_string(&ue->nr_tai.plmn_id, plmn_str);
+        cJSON *p = cJSON_CreateString(plmn_str);
+        if (!p) { cJSON_Delete(tai); cJSON_Delete(loc); return -1; }
+        cJSON_AddItemToObjectCS(tai, "plmn", p);
+
+        char tac_hex7;
+        (void)snprintf(tac_hex, sizeof tac_hex, "%06x", (unsigned)u24_to_u32(ue->nr_tai.tac));
+        cJSON *th = cJSON_CreateString(tac_hex);
+        cJSON *tn = cJSON_CreateNumber((double)u24_to_u32(ue->nr_tai.tac));
+        if (!th || !tn) { if (th) cJSON_Delete(th); if (tn) cJSON_Delete(tn); cJSON_Delete(tai); cJSON_Delete(loc); return -1; }
+        cJSON_AddItemToObjectCS(tai, "tac_hex", th);
+        cJSON_AddItemToObjectCS(tai, "tac", tn);
+
+        cJSON_AddItemToObjectCS(loc, "nr_tai", tai);
+    }
+
+    /* nr_cgi */
+    {
+        cJSON *cgi = cJSON_CreateObject();
+        if (!cgi) { cJSON_Delete(loc); return -1; }
+
+        char plmn_strOGS_PLMNIDSTRLEN = {0};
+        ogs_plmn_id_to_string(&ue->nr_cgi.plmn_id, plmn_str);
+        cJSON *p = cJSON_CreateString(plmn_str);
+        if (!p) { cJSON_Delete(cgi); cJSON_Delete(loc); return -1; }
+        cJSON_AddItemToObjectCS(cgi, "plmn", p);
+
+        uint64_t nci     = ue->nr_cgi.cell_id & 0xFFFFFFFFFULL; /* 36-bit */
+        uint32_t gnb_id  = (uint32_t)((nci >> 14) & 0x3FFFFF);
+        uint32_t cell_id = (uint32_t)(nci & 0x3FFF);
+
+        cJSON *n = cJSON_CreateNumber((double)nci);
+        cJSON *g = cJSON_CreateNumber((double)gnb_id);
+        cJSON *c = cJSON_CreateNumber((double)cell_id);
+        if (!n || !g || !c) { if (n) cJSON_Delete(n); if (g) cJSON_Delete(g); if (c) cJSON_Delete(c); cJSON_Delete(cgi); cJSON_Delete(loc); return -1; }
+        cJSON_AddItemToObjectCS(cgi, "nci", n);
+        cJSON_AddItemToObjectCS(cgi, "gnb_id", g);
+        cJSON_AddItemToObjectCS(cgi, "cell_id", c);
+
+        cJSON_AddItemToObjectCS(loc, "nr_cgi", cgi);
+    }
+
+    /* last_visited_plmn_id */
+    {
+        char plmn_strOGS_PLMNIDSTRLEN = {0};
+        ogs_plmn_id_to_string(&ue->last_visited_plmn_id, plmn_str);
+        cJSON *lv = cJSON_CreateString(plmn_str);
+        if (!lv) { cJSON_Delete(loc); return -1; }
+        cJSON_AddItemToObjectCS(loc, "last_visited_plmn_id", lv);
+    }
+
+    cJSON_AddItemToObjectCS(parent, "location", loc);
+    return 0;
+}
+
+static int add_msisdn_array(cJSON *parent, const amf_ue_t *ue)
+{
+    cJSON *arr = cJSON_CreateArray();
+    int i;
+
+    if (!arr) return -1;
+
+    for (i = 0; i < ue->num_of_msisdn; i++) {
+        if (!ue->msisdni || !ue->msisdni0) continue;
+        cJSON *s = cJSON_CreateString(ue->msisdni);
+        if (!s) { cJSON_Delete(arr); return -1; }
+        cJSON_AddItemToArray(arr, s);
+    }
+
+    cJSON_AddItemToObjectCS(parent, "msisdn", arr);
+    return 0;
+}
+
+static int add_security(cJSON *parent, const amf_ue_t *ue)
+{
+    cJSON *sec = cJSON_CreateObject();
+    if (!sec) return -1;
+
+    {
+        int valid_ctx = SECURITY_CONTEXT_IS_VALID(ue);
+        cJSON *v = cJSON_CreateNumber((double)valid_ctx);
+        if (!v) { cJSON_Delete(sec); return -1; }
+        cJSON_AddItemToObjectCS(sec, "valid", v);
+    }
+
+    const char *enc =
+        ue->selected_enc_algorithm == OGS_NAS_SECURITY_ALGORITHMS_128_NEA2 ? "nea2" :
+        ue->selected_enc_algorithm == OGS_NAS_SECURITY_ALGORITHMS_128_NEA1 ? "nea1" :
+        ue->selected_enc_algorithm == OGS_NAS_SECURITY_ALGORITHMS_128_NEA3 ? "nea3" : "nea0";
+
+    const char *integ =
+        ue->selected_int_algorithm == OGS_NAS_SECURITY_ALGORITHMS_128_NIA2 ? "nia2" :
+        ue->selected_int_algorithm == OGS_NAS_SECURITY_ALGORITHMS_128_NIA1 ? "nia1" :
+        ue->selected_int_algorithm == OGS_NAS_SECURITY_ALGORITHMS_128_NIA3 ? "nia3" : "nia0";
+
+    cJSON *e = cJSON_CreateString(enc);
+    cJSON *i = cJSON_CreateString(integ);
+    if (!e || !i) { if (e) cJSON_Delete(e); if (i) cJSON_Delete(i); cJSON_Delete(sec); return -1; }
+    cJSON_AddItemToObjectCS(sec, "enc", e);
+    cJSON_AddItemToObjectCS(sec, "int", i);
+
+    cJSON_AddItemToObjectCS(parent, "security", sec);
+    return 0;
+}
+
+static int add_ambr(cJSON *parent, const amf_ue_t *ue)
+{
+    cJSON *ambr = cJSON_CreateObject();
+    if (!ambr) return -1;
+
+    cJSON *dl = cJSON_CreateNumber((double)ue->ue_ambr.downlink);
+    cJSON *ul = cJSON_CreateNumber((double)ue->ue_ambr.uplink);
+    if (!dl || !ul) { if (dl) cJSON_Delete(dl); if (ul) cJSON_Delete(ul); cJSON_Delete(ambr); return -1; }
+
+    cJSON_AddItemToObjectCS(ambr, "downlink", dl);
+    cJSON_AddItemToObjectCS(ambr, "uplink", ul);
+
+    cJSON_AddItemToObjectCS(parent, "ambr", ambr);
+    return 0;
+}
+
+static int add_pdu_sessions(cJSON *parent, const amf_ue_t *ue)
+{
+    cJSON *arr = cJSON_CreateArray();
+    if (!arr) return -1;
+
+    int count = 0;
+    amf_sess_t *sess = NULL;
+    ogs_list_for_each(&(ue->sess_list), sess) {
+        cJSON *it = cJSON_CreateObject();
+        if (!it) { cJSON_Delete(arr); return -1; }
+
+        /* PSI */
+        {
+            cJSON *n = cJSON_CreateNumber((double)sess->psi);
+            if (!n) { cJSON_Delete(it); cJSON_Delete(arr); return -1; }
+            cJSON_AddItemToObjectCS(it, "psi", n);
+        }
+
+        /* DNN */
+        if (sess->dnn && sess->dnn0) {
+            cJSON *d = cJSON_CreateString(sess->dnn);
+            if (!d) { cJSON_Delete(it); cJSON_Delete(arr); return -1; }
+            cJSON_AddItemToObjectCS(it, "dnn", d);
+        }
+
+        /* S-NSSAI */
+        {
+            cJSON *sn = cJSON_CreateObject();
+            if (!sn) { cJSON_Delete(it); cJSON_Delete(arr); return -1; }
+            cJSON *sst = cJSON_CreateNumber((double)sess->s_nssai.sst);
+            if (!sst) { cJSON_Delete(sn); cJSON_Delete(it); cJSON_Delete(arr); return -1; }
+            cJSON_AddItemToObjectCS(sn, "sst", sst);
+            if (add_snssai_sd_string(sn, "sd", &sess->s_nssai.sd) < 0) { cJSON_Delete(sn); cJSON_Delete(it); cJSON_Delete(arr); return -1; }
+            cJSON_AddItemToObjectCS(it, "snssai", sn);
+        }
+
+        /* Flags/counters mirrored as-is */
+        {
+            cJSON *lbo = cJSON_CreateBool(sess->lbo_roaming_allowed);
+            cJSON *rs  = cJSON_CreateNumber((double)sess->resource_status);
+            cJSON *n1  = cJSON_CreateBool(sess->n1_released);
+            cJSON *n2  = cJSON_CreateBool(sess->n2_released);
+            if (!lbo || !rs || !n1 || !n2) {
+                if (lbo) cJSON_Delete(lbo);
+                if (rs)  cJSON_Delete(rs);
+                if (n1)  cJSON_Delete(n1);
+                if (n2)  cJSON_Delete(n2);
+                cJSON_Delete(it);
+                cJSON_Delete(arr);
+                return -1;
+            }
+            cJSON_AddItemToObjectCS(it, "lbo_roaming_allowed", lbo);
+            cJSON_AddItemToObjectCS(it, "resource_status", rs);
+            cJSON_AddItemToObjectCS(it, "n1_released", n1);
+            cJSON_AddItemToObjectCS(it, "n2_released", n2);
+        }
+
+        cJSON_AddItemToArray(arr, it);
+        count++;
+    }
+
+    cJSON_AddItemToObjectCS(parent, "pdu_sessions", arr);
+    {
+        cJSON *n = cJSON_CreateNumber((double)count);
+        if (!n) return -1;
+        cJSON_AddItemToObjectCS(parent, "pdu_sessions_count", n);
+    }
+    return 0;
+}
+
+static int add_requested_allowed_slices(cJSON *parent, const amf_ue_t *ue)
+{
+    cJSON *req = cJSON_CreateArray();
+    cJSON *allow = cJSON_CreateArray();
+    int i;
+
+    if (!req || !allow) { if (req) cJSON_Delete(req); if (allow) cJSON_Delete(allow); return -1; }
+
+    /* requested */
+    for (i = 0; i < ue->requested_nssai.num_of_s_nssai; i++) {
+        const ogs_nas_s_nssai_ie_t *ie = &ue->requested_nssai.s_nssaii;
+        cJSON *sn = cJSON_CreateObject();
+        if (!sn) { cJSON_Delete(req); cJSON_Delete(allow); return -1; }
+        cJSON *sst = cJSON_CreateNumber((double)ie->sst);
+        if (!sst) { cJSON_Delete(sn); cJSON_Delete(req); cJSON_Delete(allow); return -1; }
+        cJSON_AddItemToObjectCS(sn, "sst", sst);
+        if (add_snssai_sd_string(sn, "sd", &ie->sd) < 0) { cJSON_Delete(sn); cJSON_Delete(req); cJSON_Delete(allow); return -1; }
+        cJSON_AddItemToArray(req, sn);
+    }
+
+    /* allowed */
+    for (i = 0; i < ue->allowed_nssai.num_of_s_nssai; i++) {
+        const ogs_nas_s_nssai_ie_t *ie = &ue->allowed_nssai.s_nssaii;
+        cJSON *sn = cJSON_CreateObject();
+        if (!sn) { cJSON_Delete(req); cJSON_Delete(allow); return -1; }
+        cJSON *sst = cJSON_CreateNumber((double)ie->sst);
+        if (!sst) { cJSON_Delete(sn); cJSON_Delete(req); cJSON_Delete(allow); return -1; }
+        cJSON_AddItemToObjectCS(sn, "sst", sst);
+        if (add_snssai_sd_string(sn, "sd", &ie->sd) < 0) { cJSON_Delete(sn); cJSON_Delete(req); cJSON_Delete(allow); return -1; }
+        cJSON_AddItemToArray(allow, sn);
+    }
+
+    cJSON_AddItemToObjectCS(parent, "requested_slices", req);
+    cJSON_AddItemToObjectCS(parent, "allowed_slices", allow);
+
+    cJSON *rc = cJSON_CreateNumber((double)ue->requested_nssai.num_of_s_nssai);
+    cJSON *ac = cJSON_CreateNumber((double)ue->allowed_nssai.num_of_s_nssai);
+    if (!rc || !ac) { if (rc) cJSON_Delete(rc); if (ac) cJSON_Delete(ac); return -1; }
+    cJSON_AddItemToObjectCS(parent, "requested_slices_count", rc);
+    cJSON_AddItemToObjectCS(parent, "allowed_slices_count", ac);
+
+    return 0;
+}
+
+static int add_am_policy_features(cJSON *parent, const amf_ue_t *ue)
+{
+    uint64_t f = ue->am_policy_control_features;
+
+    cJSON *fv = cJSON_CreateNumber((double)f);
+    if (!fv) return -1;
+    cJSON_AddItemToObjectCS(parent, "am_policy_features", fv);
+
+    cJSON *feat = cJSON_CreateObject();
+    if (!feat) return -1;
+
+    char hex2 + 16 + 1;
+    (void)snprintf(hex, sizeof hex, "0x%016" PRIx64, f);
+    cJSON *hx = cJSON_CreateString(hex);
+    if (!hx) { cJSON_Delete(feat); return -1; }
+    cJSON_AddItemToObjectCS(feat, "hex", hx);
+
+    cJSON *bits = cJSON_CreateArray();
+    cJSON *labels = cJSON_CreateArray();
+    if (!bits || !labels) { if (bits) cJSON_Delete(bits); if (labels) cJSON_Delete(labels); cJSON_Delete(feat); return -1; }
+
+    int i;
+    for (i = 0; i < 64; i++) {
+        if ((f >> i) & 1ULL) {
+            cJSON *bi = cJSON_CreateNumber((double)i);
+            if (!bi) { cJSON_Delete(bits); cJSON_Delete(labels); cJSON_Delete(feat); return -1; }
+            cJSON_AddItemToArray(bits, bi);
+
+            const char *label = (i < 64 && am_policy_feature_namesi && am_policy_feature_namesi0)
+                                  ? am_policy_feature_namesi : NULL;
+            char fb16;
+            if (!label) { (void)snprintf(fb, sizeof fb, "bit%d", i); label = fb; }
+
+            cJSON *ls = cJSON_CreateString(label);
+            if (!ls) { cJSON_Delete(bits); cJSON_Delete(labels); cJSON_Delete(feat); return -1; }
+            cJSON_AddItemToArray(labels, ls);
+        }
+    }
+
+    cJSON_AddItemToObjectCS(feat, "bits", bits);
+    cJSON_AddItemToObjectCS(feat, "labels", labels);
+    cJSON_AddItemToObjectCS(parent, "am_policy_features_info", feat);
+    return 0;
+}
+
+static cJSON *amf_ue_to_json(const amf_ue_t *ue)
+{
+    cJSON *o = cJSON_CreateObject();
+    if (!o) return NULL;
+
+    if (add_basic_identity(o, ue)            < 0) goto fail;
+    if (add_gnb(o, ue)                       < 0) goto fail;
+    if (add_location(o, ue)                  < 0) goto fail;
+    if (add_msisdn_array(o, ue)              < 0) goto fail;
+    if (add_security(o, ue)                  < 0) goto fail;
+    if (add_ambr(o, ue)                      < 0) goto fail;
+    if (add_pdu_sessions(o, ue)              < 0) goto fail;
+    if (add_requested_allowed_slices(o, ue)  < 0) goto fail;
+    if (add_am_policy_features(o, ue)        < 0) goto fail;
+
+    return o;
+
+fail:
+    cJSON_Delete(o);
+    return NULL;
+}
+
+size_t amf_dump_ue_info_paged(char *buf, size_t buflen, size_t page, size_t page_size)
+{
+    if (!buf || buflen == 0) return 0;
+
+    const bool no_paging = (page == SIZE_MAX);
+    if (!no_paging) {
+        if (page_size == 0) page_size = 100;
+        if (page_size > 100) page_size = 100;
+    } else {
+        page_size = SIZE_MAX;
+        page = 0;
+    }
+
+    const size_t start_index = json_pager_safe_start_index(no_paging, page, page_size);
+
+    amf_context_t *ctxt = amf_self();
+
+    cJSON *root = cJSON_CreateObject();
+    if (!root) { if (buflen) buf0 = '\0'; return 0; }
+
+    cJSON *items = cJSON_CreateArray();
+    if (!items) { cJSON_Delete(root); if (buflen) buf0 = '\0'; return 0; }
+    cJSON_AddItemToObjectCS(root, "items", items);
+
+    size_t idx = 0, emitted = 0;
+    bool has_next = false;
+    bool oom = false;
+
+    amf_ue_t *ue = NULL;
+    ogs_list_for_each(&ctxt->amf_ue_list, ue) {
+        int act = json_pager_advance(no_paging, idx, start_index, emitted, page_size, &has_next);
+        if (act == 1) { idx++; continue; }
+        if (act == 2) break;
+
+        cJSON *one = amf_ue_to_json(ue);
+        if (!one) { oom = true; break; }
+
+        cJSON_AddItemToArray(items, one);
+        emitted++;
+        idx++;
+    }
+
+    /* add trailing pager info (json_pager_finalize will free 'root') */
+    json_pager_add_trailing(root, no_paging, page, page_size, emitted,
+                            has_next && !oom, "/ue-info", oom);
+
+    return json_pager_finalize(root, buf, buflen);
+}
+

open5gs_2.7.7.tar.xz/src/amf/ue-info.h Added

@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2025 by Juraj Elias <juraj.elias@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/*
+ * /ue-info — AMF-side JSON exporter (Prometheus HTTP endpoint)
+ *
+ */
+#pragma once
+
+#include <stddef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef UE_INFO_PAGE_SIZE_DEFAULT
+#define UE_INFO_PAGE_SIZE_DEFAULT 100U
+#endif
+
+size_t amf_dump_ue_info(char *buf, size_t buflen,
+        size_t page, size_t page_size);
+size_t amf_dump_ue_info_paged(char *buf, size_t buflen,
+        size_t page, size_t page_size);
+
+#ifdef __cplusplus
+}
+#endif
+

open5gs_2.7.6.tar.xz/src/ausf/ausf-sm.c -> open5gs_2.7.7.tar.xz/src/ausf/ausf-sm.c Changed

@@ -274,15 +274,17 @@
                     break;
 
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
-                    if (message.res_status ==
-                            OGS_SBI_HTTP_STATUS_NO_CONTENT) {
-                        ogs_sbi_subscription_data_remove(subscription_data);
-                    } else {
+                    if (message.res_status == OGS_SBI_HTTP_STATUS_NO_CONTENT)
+                        ogs_info("%s Subscription deleted",
+                                subscription_data->id ?
+                                    subscription_data->id : "Unknown");
+                    else
                         ogs_error("%s HTTP response error %d",
                                 subscription_data->id ?
                                     subscription_data->id : "Unknown",
                                 message.res_status);
-                    }
+
+                    ogs_sbi_subscription_data_remove(subscription_data);
                     break;
 
                 DEFAULT

open5gs_2.7.6.tar.xz/src/bsf/bsf-sm.c -> open5gs_2.7.7.tar.xz/src/bsf/bsf-sm.c Changed

open5gs_2.7.6.tar.xz/src/hss/hss-cx-path.c -> open5gs_2.7.7.tar.xz/src/hss/hss-cx-path.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -47,256 +47,455 @@
 }
 
 /* Callback for incoming User-Authorization-Request messages */
-static int hss_ogs_diam_cx_uar_cb( struct msg **msg, struct avp *avp,
+static int hss_ogs_diam_cx_uar_cb(struct msg **msg, struct avp *avp,
         struct session *session, void *opaque, enum disp_action *act)
 {
     int rv, ret;
     uint32_t result_code = 0;
-
-    struct msg *ans, *qry;
-
-    struct avp_hdr *hdr;
+    struct msg *ans = NULL, *qry = NULL;
+    struct avp_hdr *hdr = NULL;
     union avp_value val;
 
     char *user_name = NULL;
     char *public_identity = NULL;
     char *visited_network_identifier = NULL;
     char *server_name = NULL;
-
     char imsi_or_msisdn_bcdOGS_MAX_IMSI_BCD_LEN+1;
-
     ogs_msisdn_data_t msisdn_data;
-
-    ogs_assert(msg);
+    int error_occurred = 0;
 
     ogs_debug("Rx User-Authorization-Request");
 
+    /* Validate input parameters */
+    if (!msg || !*msg) {
+        ogs_error("Invalid message pointer");
+        return EINVAL;
+    }
+
+    /* Initialize variables */
+    memset(imsi_or_msisdn_bcd, 0, sizeof(imsi_or_msisdn_bcd));
+    memset(&msisdn_data, 0, sizeof(ogs_msisdn_data_t));
+
     /* Create answer header */
     qry = *msg;
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create answer message");
+        error_occurred = 1;
+        goto out;
+    }
     ans = *msg;
 
     /* Get User-Name AVP (Mandatory) */
     ret = fd_msg_search_avp(qry, ogs_diam_user_name, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search User-Name AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No User-Name AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get User-Name AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     user_name = ogs_strndup(
         (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
-    ogs_assert(user_name);
+    if (!user_name) {
+        ogs_error("Failed to duplicate User-Name");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     ogs_extract_digit_from_string(imsi_or_msisdn_bcd, user_name);
 
     /* Get Public-Identity AVP (Mandatory) */
     ret = fd_msg_search_avp(qry, ogs_diam_cx_public_identity, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Public-Identity AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No Public-Identity AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get Public-Identity AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     public_identity = ogs_strndup(
         (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
-    ogs_assert(public_identity);
+    if (!public_identity) {
+        ogs_error("Failed to duplicate Public-Identity");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Get Visited-Network-Identifier AVP (Mandatory) */
     ret = fd_msg_search_avp(qry, ogs_diam_visited_network_identifier, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Visited-Network-Identifier AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No Visited-Network-Identifier AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get Visited-Network-Identifier AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     visited_network_identifier = ogs_strndup(
         (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
-    ogs_assert(visited_network_identifier);
+    if (!visited_network_identifier) {
+        ogs_error("Failed to duplicate Visited-Network-Identifier");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
-    memset(&msisdn_data, 0, sizeof(ogs_msisdn_data_t));
+    /* Get MSISDN data from database */
     rv = hss_db_msisdn_data(imsi_or_msisdn_bcd, &msisdn_data);
     if (rv != OGS_OK) {
-        ogs_error("Cannot get MSISDN-Data for IMSI or MSISDN:'%s'",
+        ogs_error("Cannot get MSISDN-Data for IMSI or MSISDN: %s",
                     imsi_or_msisdn_bcd);
         result_code = OGS_DIAM_CX_ERROR_USER_UNKNOWN;
+        error_occurred = 1;
         goto out;
     }
 
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_CX_APPLICATION_ID);
-    ogs_assert(ret == 0);
-
-    /* Associate IMPI(User-Name) with IMPU(Public-Identity) */
-    hss_cx_associate_identity(user_name, public_identity);
-
-    /* Set IMSI for IMPI(User-Name) */
-    hss_cx_set_imsi_bcd(user_name,
-            msisdn_data.imsi.bcd, visited_network_identifier);
+    if (!error_occurred) {
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_CX_APPLICATION_ID);
+        if (ret != 0) {
+            ogs_error("Failed to set Vendor-Specific-Application-Id");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Get Server-Name by IMPU(Public-Identity) */
-    server_name = hss_cx_get_server_name(public_identity);
-    if (!server_name)
-        result_code = OGS_DIAM_CX_FIRST_REGISTRATION;
-    else
-        result_code = OGS_DIAM_CX_SUBSEQUENT_REGISTRATION;
+        /* Associate IMPI(User-Name) with IMPU(Public-Identity) */
+        hss_cx_associate_identity(user_name, public_identity);
 
-    /* Set the Experimental-Result, Origin-Host and Origin-Realm AVPs */
-    ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
-    ogs_assert(ret == 0);
-
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+        /* Set IMSI for IMPI(User-Name) */
+        hss_cx_set_imsi_bcd(user_name,
+                msisdn_data.imsi.bcd, visited_network_identifier);
+
+        /* Get Server-Name by IMPU(Public-Identity) */
+        server_name = hss_cx_get_server_name(public_identity);
+        if (!server_name)
+            result_code = OGS_DIAM_CX_FIRST_REGISTRATION;
+        else
+            result_code = OGS_DIAM_CX_SUBSEQUENT_REGISTRATION;
+
+        /* Set the Experimental-Result, Origin-Host and Origin-Realm AVPs */
+        ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
+        if (ret != 0) {
+            ogs_error("Failed to set experimental result code");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Set the Server-Name AVP */
-    if (server_name) {
-        ret = fd_msg_avp_new(ogs_diam_cx_server_name, 0, &avp);
-        ogs_assert(ret == 0);
-        val.os.data = (uint8_t *)server_name;
-        val.os.len  = strlen(server_name);
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
         ret = fd_msg_avp_setvalue(avp, &val);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to set Auth-Session-State value");
+            error_occurred = 1;
+            goto out;
+        }
         ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-        ogs_assert(ret == 0);
-    }
+        if (ret != 0) {
+            ogs_error("Failed to add Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Send the answer */
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        /* Set the Server-Name AVP */
+        if (server_name) {
+            ret = fd_msg_avp_new(ogs_diam_cx_server_name, 0, &avp);
+            if (ret != 0) {
+                ogs_error("Failed to create Server-Name AVP");
+                error_occurred = 1;
+                goto out;
+            }
+            val.os.data = (uint8_t *)server_name;
+            val.os.len  = strlen(server_name);
+            ret = fd_msg_avp_setvalue(avp, &val);
+            if (ret != 0) {
+                ogs_error("Failed to set Server-Name value");
+                error_occurred = 1;
+                goto out;
+            }
+            ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+            if (ret != 0) {
+                ogs_error("Failed to add Server-Name AVP");
+                error_occurred = 1;
+                goto out;
+            }
+        }
 
-    ogs_debug("Tx User-Authorization-Answer");
+        /* Send the answer */
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send message");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Add this value to the stats */
-    OGS_DIAM_STATS_MTX(
-        OGS_DIAM_STATS_INC(nb_echoed);
-        HSS_DIAM_PRIV_STATS_INC(cx.rx_uar);
-        HSS_DIAM_PRIV_STATS_INC(cx.tx_uaa);
-    )
+        ogs_debug("Tx User-Authorization-Answer");
 
-    ogs_free(user_name);
-    ogs_free(public_identity);
-    ogs_free(visited_network_identifier);
+        /* Add to stats */
+        OGS_DIAM_STATS_MTX(
+            OGS_DIAM_STATS_INC(nb_echoed);
+            HSS_DIAM_PRIV_STATS_INC(cx.rx_uar);
+            HSS_DIAM_PRIV_STATS_INC(cx.tx_uaa);
+        )
+
+        /* Cleanup resources */
+        if (user_name) ogs_free(user_name);
+        if (public_identity) ogs_free(public_identity);
+        if (visited_network_identifier) ogs_free(visited_network_identifier);
 
-    return 0;
+        return 0;
+    }
 
 out:
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_CX_APPLICATION_ID);
-    ogs_assert(ret == 0);
-
-    /* Set the Experimental-Result, Origin-Host and Origin-Realm AVPs */
-    ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
-    ogs_assert(ret == 0);
-
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    /* Error handling */
+    if (ans) {
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_CX_APPLICATION_ID);
+
+        /* Set the Experimental-Result, Origin-Host and Origin-Realm AVPs */
+        if (result_code != 0) {
+            ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
+        }
+
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret == 0) {
+            val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+            ret = fd_msg_avp_setvalue(avp, &val);
+            if (ret == 0) {
+                ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+            }
+        }
 
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send error response");
+        }
+    }
 
+    /* Update error stats */
     OGS_DIAM_STATS_MTX(
         HSS_DIAM_PRIV_STATS_INC(cx.rx_uar);
         HSS_DIAM_PRIV_STATS_INC(cx.rx_uar_error);
     )
 
-    ogs_free(user_name);
-    ogs_free(public_identity);
-    ogs_free(visited_network_identifier);
+    /* Cleanup resources */
+    if (user_name) ogs_free(user_name);
+    if (public_identity) ogs_free(public_identity);
+    if (visited_network_identifier) ogs_free(visited_network_identifier);
 
     return 0;
 }
 
 /* Callback for incoming Multimedia-Auth-Request messages */
-static int hss_ogs_diam_cx_mar_cb( struct msg **msg, struct avp *avp,
+static int hss_ogs_diam_cx_mar_cb(struct msg **msg, struct avp *avp,
         struct session *session, void *opaque, enum disp_action *act)
 {
     int rv, ret;
     uint32_t result_code = 0;
-
-    struct msg *ans, *qry;
-
+    struct msg *ans = NULL, *qry = NULL;
     struct avp *sip_auth_data_item_avp = NULL;
     struct avp *authentication_scheme_avp = NULL;
     struct avp *sip_authorization_avp = NULL;
-
     struct avp *avpch = NULL;
-    struct avp_hdr *hdr;
+    struct avp_hdr *hdr = NULL;
     union avp_value val;
 
     char *user_name = NULL;
     char *public_identity = NULL;
     char *server_name = NULL;
     char *authentication_scheme = NULL;
-
     char *imsi_bcd = NULL;
 
     ogs_dbi_auth_info_t auth_info;
     uint8_t zeroOGS_RAND_LEN;
-
     uint8_t authenticateOGS_KEY_LEN*2;
-
     uint8_t opcOGS_KEY_LEN;
     uint8_t sqnOGS_SQN_LEN;
-
     uint8_t autnOGS_AUTN_LEN;
     uint8_t ikOGS_KEY_LEN;
     uint8_t ckOGS_KEY_LEN;
     uint8_t akOGS_AK_LEN;
     uint8_t xresOGS_MAX_RES_LEN;
     size_t xres_len = 8;
-
     uint8_t mac_sOGS_MAC_S_LEN;
 
     bool matched = false;
-
-    ogs_assert(msg);
+    int error_occurred = 0;
 
     ogs_debug("Rx Multimedia-Auth-Request");
 
+    /* Validate input parameters */
+    if (!msg || !*msg) {
+        ogs_error("Invalid message pointer");
+        return EINVAL;
+    }
+
+    /* Initialize variables */
+    memset(&auth_info, 0, sizeof(auth_info));
+
     /* Create answer header */
     qry = *msg;
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create answer message");
+        error_occurred = 1;
+        goto out;
+    }
     ans = *msg;
 
     /* Get User-Name AVP (Mandatory) */
     ret = fd_msg_search_avp(qry, ogs_diam_user_name, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search User-Name AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No User-Name AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get User-Name AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     user_name = ogs_strndup(
         (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
-    ogs_assert(user_name);
+    if (!user_name) {
+        ogs_error("Failed to duplicate User-Name");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Get Public-Identity AVP (Mandatory) */
     ret = fd_msg_search_avp(qry, ogs_diam_cx_public_identity, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Public-Identity AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No Public-Identity AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get Public-Identity AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     public_identity = ogs_strndup(
         (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
-    ogs_assert(public_identity);
+    if (!public_identity) {
+        ogs_error("Failed to duplicate Public-Identity");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Get Server-Name AVP (Mandatory) */
     ret = fd_msg_search_avp(qry, ogs_diam_cx_server_name, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Server-Name AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No Server-Name AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get Server-Name AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     server_name = ogs_strndup(
         (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
-    ogs_assert(server_name);
+    if (!server_name) {
+        ogs_error("Failed to duplicate Server-Name");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Check if IMPI(User-Name) + IMPU(Public-Identity) is associated */
     matched = hss_cx_identity_is_associated(user_name, public_identity);
@@ -304,6 +503,7 @@
         ogs_error("User-Name%s Public-Identity%s is not associated",
                     user_name, public_identity);
         result_code = OGS_DIAM_CX_ERROR_IDENTITIES_DONT_MATCH;
+        error_occurred = 1;
         goto out;
     }
 
@@ -313,27 +513,50 @@
         ogs_error("Cannot find IMSI for User-Name%s Public-Identity%s",
                     user_name, public_identity);
         result_code = OGS_DIAM_CX_ERROR_IDENTITY_NOT_REGISTERED;
+        error_occurred = 1;
         goto out;
     }
 
     /* Get the SIP-Auth-Data-Item AVP (Mandatory) */
     ret = fd_msg_search_avp(
             qry, ogs_diam_cx_sip_auth_data_item, &sip_auth_data_item_avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search SIP-Auth-Data-Item AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!sip_auth_data_item_avp) {
+        ogs_error("No SIP-Auth-Data-Item AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(sip_auth_data_item_avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get SIP-Auth-Data-Item AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Get the Authentication-Scheme AVP */
     ret = fd_msg_search_avp(sip_auth_data_item_avp,
             ogs_diam_cx_sip_authentication_scheme, &authentication_scheme_avp);
-    ogs_assert(ret == 0);
-    if (authentication_scheme_avp) {
+    if (ret == 0 && authentication_scheme_avp) {
         ret = fd_msg_avp_hdr(authentication_scheme_avp, &hdr);
-        ogs_assert(ret == 0);
-
-        authentication_scheme = ogs_strndup(
-            (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
-        ogs_assert(authentication_scheme);
+        if (ret == 0 && hdr) {
+            authentication_scheme = ogs_strndup(
+                (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
+            if (!authentication_scheme) {
+                ogs_error("Failed to duplicate Authentication-Scheme");
+                result_code = OGS_DIAM_INVALID_AVP_VALUE;
+                error_occurred = 1;
+                goto out;
+            }
+        }
     }
 
     /* IMS_AKA is only supported */
@@ -345,14 +568,16 @@
         ogs_error("Authentication-Scheme%s is not supported",
                     authentication_scheme);
         result_code = OGS_DIAM_CX_ERROR_AUTH_SCHEME_NOT_SUPPORTED;
+        error_occurred = 1;
         goto out;
     }
 
     /* DB : HSS Auth-Info */
     rv = hss_db_auth_info(imsi_bcd, &auth_info);
     if (rv != OGS_OK) {
-        ogs_error("Cannot get IMS-Data for IMSI:'%s'", imsi_bcd);
+        ogs_error("Cannot get IMS-Data for IMSI: %s", imsi_bcd);
         result_code = OGS_DIAM_CX_ERROR_USER_UNKNOWN;
+        error_occurred = 1;
         goto out;
     }
 
@@ -372,47 +597,51 @@
     /* Get the SIP-Authorization AVP */
     ret = fd_msg_search_avp(sip_auth_data_item_avp,
             ogs_diam_cx_sip_authorization, &sip_authorization_avp);
-    ogs_assert(ret == 0);
-    if (sip_authorization_avp) {
+    if (ret == 0 && sip_authorization_avp) {
         ret = fd_msg_avp_hdr(sip_authorization_avp, &hdr);
-        ogs_assert(ret == 0);
-
-        ogs_auc_sqn(opc, auth_info.k,
-                hdr->avp_value->os.data,
-                hdr->avp_value->os.data + OGS_RAND_LEN,
-                sqn, mac_s);
-        if (memcmp(mac_s, hdr->avp_value->os.data +
-                    OGS_RAND_LEN + OGS_SQN_LEN, OGS_MAC_S_LEN) == 0) {
-            ogs_random(auth_info.rand, OGS_RAND_LEN);
-            auth_info.sqn = ogs_buffer_to_uint64(sqn, OGS_SQN_LEN);
-            /* 33.102 C.3.4 Guide : IND + 1 */
-            auth_info.sqn = (auth_info.sqn + 32 + 1) & OGS_MAX_SQN;
-        } else {
-            ogs_error("Re-synch MAC failed for IMSI:`%s`", imsi_bcd);
-            ogs_log_print(OGS_LOG_ERROR, "MAC_S: ");
-            ogs_log_hexdump(OGS_LOG_ERROR, mac_s, OGS_MAC_S_LEN);
-            ogs_log_hexdump(OGS_LOG_ERROR,
-                (void*)(hdr->avp_value->os.data +
-                    OGS_RAND_LEN + OGS_SQN_LEN),
-                OGS_MAC_S_LEN);
-            ogs_log_print(OGS_LOG_ERROR, "SQN: ");
-            ogs_log_hexdump(OGS_LOG_ERROR, sqn, OGS_SQN_LEN);
-            result_code = OGS_DIAM_CX_ERROR_AUTH_SCHEME_NOT_SUPPORTED;
-            goto out;
+        if (ret == 0 && hdr) {
+            ogs_auc_sqn(opc, auth_info.k,
+                    hdr->avp_value->os.data,
+                    hdr->avp_value->os.data + OGS_RAND_LEN,
+                    sqn, mac_s);
+            if (memcmp(mac_s, hdr->avp_value->os.data +
+                        OGS_RAND_LEN + OGS_SQN_LEN, OGS_MAC_S_LEN) == 0) {
+                ogs_random(auth_info.rand, OGS_RAND_LEN);
+                auth_info.sqn = ogs_buffer_to_uint64(sqn, OGS_SQN_LEN);
+                /* 33.102 C.3.4 Guide : IND + 1 */
+                auth_info.sqn = (auth_info.sqn + 32 + 1) & OGS_MAX_SQN;
+            } else {
+                ogs_error("Re-synch MAC failed for IMSI: %s", imsi_bcd);
+
+                ogs_log_print(OGS_LOG_ERROR, "MAC_S: ");
+                ogs_log_hexdump(OGS_LOG_ERROR, mac_s, OGS_MAC_S_LEN);
+                ogs_log_hexdump(OGS_LOG_ERROR,
+                    (void*)(hdr->avp_value->os.data +
+                        OGS_RAND_LEN + OGS_SQN_LEN),
+                    OGS_MAC_S_LEN);
+                ogs_log_print(OGS_LOG_ERROR, "SQN: ");
+                ogs_log_hexdump(OGS_LOG_ERROR, sqn, OGS_SQN_LEN);
+
+                result_code = OGS_DIAM_CX_ERROR_AUTH_SCHEME_NOT_SUPPORTED;
+                error_occurred = 1;
+                goto out;
+            }
         }
     }
 
     rv = hss_db_update_sqn(imsi_bcd, auth_info.rand, auth_info.sqn);
     if (rv != OGS_OK) {
-        ogs_error("Cannot update rand and sqn for IMSI:'%s'", imsi_bcd);
+        ogs_error("Cannot update rand and sqn for IMSI: %s", imsi_bcd);
         result_code = OGS_DIAM_CX_ERROR_IN_ASSIGNMENT_TYPE;
+        error_occurred = 1;
         goto out;
     }
 
     rv = hss_db_increment_sqn(imsi_bcd);
     if (rv != OGS_OK) {
-        ogs_error("Cannot increment sqn for IMSI:'%s'", imsi_bcd);
+        ogs_error("Cannot increment sqn for IMSI: %s", imsi_bcd);
         result_code = OGS_DIAM_CX_ERROR_IN_ASSIGNMENT_TYPE;
+        error_occurred = 1;
         goto out;
     }
 
@@ -441,247 +670,458 @@
     ogs_log_print(OGS_LOG_DEBUG, "ik - ");
     ogs_log_hexdump(OGS_LOG_DEBUG, ik, OGS_KEY_LEN);
     ogs_log_print(OGS_LOG_DEBUG, "ak - ");
-    ogs_log_hexdump(OGS_LOG_DEBUG, ak, OGS_KEY_LEN);
+    ogs_log_hexdump(OGS_LOG_DEBUG, ak, OGS_AK_LEN);
     ogs_log_print(OGS_LOG_DEBUG, "xles - ");
     ogs_log_hexdump(OGS_LOG_DEBUG, xres, xres_len);
 
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_CX_APPLICATION_ID);
-    ogs_assert(ret == 0);
-
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Set the Origin-Host, Origin-Realm, and Result-Code AVPs */
-    ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
-    ogs_assert(ret == 0);
-
-    /* Set the User-Name AVP */
-    ret = fd_msg_avp_new(ogs_diam_user_name, 0, &avp);
-    ogs_assert(ret == 0);
-    val.os.data = (uint8_t *)user_name;
-    val.os.len = strlen(user_name);
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Set the Public-Identity AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_public_identity, 0, &avp);
-    ogs_assert(ret == 0);
-    val.os.data = (uint8_t *)public_identity;
-    val.os.len = strlen(public_identity);
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Set the SIP-Number-Auth-Items AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_sip_number_auth_items, 0, &avp);
-    ogs_assert(ret == 0);
-    val.u32 = 1;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Set the SIP-Auth-Data-Item AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_sip_auth_data_item, 0, &avp);
-    ogs_assert(ret == 0);
-
-    /* Set the SIP-Item-Number AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_sip_item_number, 0, &avpch);
-    ogs_assert(ret == 0);
-    val.u32 = 1;
-    ret = fd_msg_avp_setvalue(avpch, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
-    ogs_assert(ret == 0);
-
-    /* Set the SIP-Authentication-Scheme AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_sip_authentication_scheme, 0, &avpch);
-    ogs_assert(ret == 0);
-    val.os.data = (uint8_t *)OGS_DIAM_CX_AUTH_SCHEME_IMS_AKA;
-    val.os.len = strlen(OGS_DIAM_CX_AUTH_SCHEME_IMS_AKA);
-    ret = fd_msg_avp_setvalue(avpch, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
-    ogs_assert(ret == 0);
-
-    /* Set the SIP-Authenticatie AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_sip_authenticate, 0, &avpch);
-    ogs_assert(ret == 0);
-    val.os.data = authenticate;
-    val.os.len = OGS_KEY_LEN * 2;
-    ret = fd_msg_avp_setvalue(avpch, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
-    ogs_assert(ret == 0);
-
-    /* Set the SIP-Authorization AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_sip_authorization, 0, &avpch);
-    ogs_assert(ret == 0);
-    val.os.data = xres;
-    val.os.len = xres_len;
-    ret = fd_msg_avp_setvalue(avpch, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
-    ogs_assert(ret == 0);
-
-    /* Set the Confidentiality-Key AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_confidentiality_key, 0, &avpch);
-    ogs_assert(ret == 0);
-    val.os.data = ck;
-    val.os.len = OGS_KEY_LEN;
-    ret = fd_msg_avp_setvalue(avpch, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
-    ogs_assert(ret == 0);
-
-    /* Set the Integrity-Key AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_integrity_key, 0, &avpch);
-    ogs_assert(ret == 0);
-    val.os.data = ik;
-    val.os.len = OGS_KEY_LEN;
-    ret = fd_msg_avp_setvalue(avpch, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
-    ogs_assert(ret == 0);
-
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Send the answer */
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+    if (!error_occurred) {
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_CX_APPLICATION_ID);
+        if (ret != 0) {
+            ogs_error("Failed to set Vendor-Specific-Application-Id");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Auth-Session-State value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set success result code */
+        ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
+        if (ret != 0) {
+            ogs_error("Failed to set success result code");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_debug("Tx Multimedia-Auth-Answer");
+        /* Set the User-Name AVP */
+        ret = fd_msg_avp_new(ogs_diam_user_name, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create User-Name AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.os.data = (uint8_t *)user_name;
+        val.os.len = strlen(user_name);
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set User-Name value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add User-Name AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Add this value to the stats */
-    OGS_DIAM_STATS_MTX(
-        OGS_DIAM_STATS_INC(nb_echoed);
-        HSS_DIAM_PRIV_STATS_INC(cx.rx_mar);
-        HSS_DIAM_PRIV_STATS_INC(cx.tx_maa);
-    )
+        /* Set the Public-Identity AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_public_identity, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create Public-Identity AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.os.data = (uint8_t *)public_identity;
+        val.os.len = strlen(public_identity);
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Public-Identity value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add Public-Identity AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    if (authentication_scheme)
-        ogs_free(authentication_scheme);
+        /* Set the SIP-Number-Auth-Items AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_sip_number_auth_items, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create SIP-Number-Auth-Items AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.u32 = 1;
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set SIP-Number-Auth-Items value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add SIP-Number-Auth-Items AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_free(user_name);
-    ogs_free(public_identity);
-    ogs_free(server_name);
+        /* Set the SIP-Auth-Data-Item AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_sip_auth_data_item, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create SIP-Auth-Data-Item AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    return 0;
+        /* Set the SIP-Item-Number AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_sip_item_number, 0, &avpch);
+        if (ret != 0) {
+            ogs_error("Failed to create SIP-Item-Number AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.u32 = 1;
+        ret = fd_msg_avp_setvalue(avpch, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set SIP-Item-Number value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
+        if (ret != 0) {
+            ogs_error("Failed to add SIP-Item-Number AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set the SIP-Authentication-Scheme AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_sip_authentication_scheme, 0, &avpch);
+        if (ret != 0) {
+            ogs_error("Failed to create SIP-Authentication-Scheme AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.os.data = (uint8_t *)OGS_DIAM_CX_AUTH_SCHEME_IMS_AKA;
+        val.os.len = strlen(OGS_DIAM_CX_AUTH_SCHEME_IMS_AKA);
+        ret = fd_msg_avp_setvalue(avpch, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set SIP-Authentication-Scheme value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
+        if (ret != 0) {
+            ogs_error("Failed to add SIP-Authentication-Scheme AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set the SIP-Authenticate AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_sip_authenticate, 0, &avpch);
+        if (ret != 0) {
+            ogs_error("Failed to create SIP-Authenticate AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.os.data = authenticate;
+        val.os.len = OGS_KEY_LEN * 2;
+        ret = fd_msg_avp_setvalue(avpch, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set SIP-Authenticate value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
+        if (ret != 0) {
+            ogs_error("Failed to add SIP-Authenticate AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set the SIP-Authorization AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_sip_authorization, 0, &avpch);
+        if (ret != 0) {
+            ogs_error("Failed to create SIP-Authorization AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.os.data = xres;
+        val.os.len = xres_len;
+        ret = fd_msg_avp_setvalue(avpch, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set SIP-Authorization value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
+        if (ret != 0) {
+            ogs_error("Failed to add SIP-Authorization AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set the Confidentiality-Key AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_confidentiality_key, 0, &avpch);
+        if (ret != 0) {
+            ogs_error("Failed to create Confidentiality-Key AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.os.data = ck;
+        val.os.len = OGS_KEY_LEN;
+        ret = fd_msg_avp_setvalue(avpch, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Confidentiality-Key value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
+        if (ret != 0) {
+            ogs_error("Failed to add Confidentiality-Key AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set the Integrity-Key AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_integrity_key, 0, &avpch);
+        if (ret != 0) {
+            ogs_error("Failed to create Integrity-Key AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.os.data = ik;
+        val.os.len = OGS_KEY_LEN;
+        ret = fd_msg_avp_setvalue(avpch, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Integrity-Key value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
+        if (ret != 0) {
+            ogs_error("Failed to add Integrity-Key AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add SIP-Auth-Data-Item AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Send the answer */
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send message");
+            error_occurred = 1;
+            goto out;
+        }
+
+        ogs_debug("Tx Multimedia-Auth-Answer");
+
+        /* Add to stats */
+        OGS_DIAM_STATS_MTX(
+            OGS_DIAM_STATS_INC(nb_echoed);
+            HSS_DIAM_PRIV_STATS_INC(cx.rx_mar);
+            HSS_DIAM_PRIV_STATS_INC(cx.tx_maa);
+        )
+
+        /* Cleanup resources */
+        if (authentication_scheme) ogs_free(authentication_scheme);
+        if (user_name) ogs_free(user_name);
+        if (public_identity) ogs_free(public_identity);
+        if (server_name) ogs_free(server_name);
+
+        return 0;
+    }
 
 out:
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_CX_APPLICATION_ID);
-    ogs_assert(ret == 0);
-
-    /* Set the Experimental-Result, Origin-Host and Origin-Realm AVPs */
-    ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
-    ogs_assert(ret == 0);
-
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    /* Error handling */
+    if (ans) {
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_CX_APPLICATION_ID);
+
+        /* Set the Experimental-Result, Origin-Host and Origin-Realm AVPs */
+        if (result_code != 0) {
+            ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
+        }
 
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret == 0) {
+            val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+            ret = fd_msg_avp_setvalue(avp, &val);
+            if (ret == 0) {
+                ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+            }
+        }
 
-    if (authentication_scheme)
-        ogs_free(authentication_scheme);
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send error response");
+        }
+    }
 
+    /* Update error stats */
     OGS_DIAM_STATS_MTX(
         HSS_DIAM_PRIV_STATS_INC(cx.rx_mar);
         HSS_DIAM_PRIV_STATS_INC(cx.rx_mar_error);
     )
 
-    ogs_free(user_name);
-    ogs_free(public_identity);
-    ogs_free(server_name);
+    /* Cleanup resources */
+    if (authentication_scheme) ogs_free(authentication_scheme);
+    if (user_name) ogs_free(user_name);
+    if (public_identity) ogs_free(public_identity);
+    if (server_name) ogs_free(server_name);
 
     return 0;
 }
 
 /* Callback for incoming Server-Assignment-Request messages */
-static int hss_ogs_diam_cx_sar_cb( struct msg **msg, struct avp *avp,
+static int hss_ogs_diam_cx_sar_cb(struct msg **msg, struct avp *avp,
         struct session *session, void *opaque, enum disp_action *act)
 {
     int rv, ret;
     uint32_t result_code = 0;
-
-    struct msg *ans, *qry;
-
+    struct msg *ans = NULL, *qry = NULL;
     bool matched = false;
     struct avp *user_name_avp = NULL;
     struct avp *avpch = NULL;
-    struct avp_hdr *hdr;
+    struct avp_hdr *hdr = NULL;
     union avp_value val;
 
     char *user_name = NULL;
     char *public_identity = NULL;
     char *server_name = NULL;
     char *user_data = NULL;
-
     char *imsi_bcd = NULL;
     char *visited_network_identifier = NULL;
 
     ogs_ims_data_t ims_data;
-
-    ogs_assert(msg);
+    int error_occurred = 0;
 
     ogs_debug("Rx Server-Assignment-Request");
 
+    /* Validate input parameters */
+    if (!msg || !*msg) {
+        ogs_error("Invalid message pointer");
+        return EINVAL;
+    }
+
+    /* Initialize variables */
+    memset(&ims_data, 0, sizeof(ogs_ims_data_t));
+
     /* Create answer header */
     qry = *msg;
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create answer message");
+        error_occurred = 1;
+        goto out;
+    }
     ans = *msg;
 
     /* Get Public-Identity AVP (Mandatory) */
     ret = fd_msg_search_avp(qry, ogs_diam_cx_public_identity, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Public-Identity AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No Public-Identity AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get Public-Identity AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     public_identity = ogs_strndup(
         (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
-    ogs_assert(public_identity);
+    if (!public_identity) {
+        ogs_error("Failed to duplicate Public-Identity");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Get Server-Name AVP (Mandatory) */
     ret = fd_msg_search_avp(qry, ogs_diam_cx_server_name, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Server-Name AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No Server-Name AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get Server-Name AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     server_name = ogs_strndup(
         (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
-    ogs_assert(server_name);
+    if (!server_name) {
+        ogs_error("Failed to duplicate Server-Name");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
-    /* Get User-Name AVP */
+    /* Get User-Name AVP (Optional) */
     ret = fd_msg_search_avp(qry, ogs_diam_user_name, &user_name_avp);
-    ogs_assert(ret == 0);
-    if (user_name_avp) {
+    if (ret == 0 && user_name_avp) {
         ret = fd_msg_avp_hdr(user_name_avp, &hdr);
-        ogs_assert(ret == 0);
+        if (ret != 0 || !hdr) {
+            ogs_error("Failed to get User-Name AVP header");
+            result_code = OGS_DIAM_INVALID_AVP_VALUE;
+            error_occurred = 1;
+            goto out;
+        }
 
         user_name = ogs_strndup(
             (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
-        ogs_assert(user_name);
+        if (!user_name) {
+            ogs_error("Failed to duplicate User-Name");
+            result_code = OGS_DIAM_INVALID_AVP_VALUE;
+            error_occurred = 1;
+            goto out;
+        }
 
         /* Check if IMPI(User-Name) + IMPU(Public-Identity) is associated */
         matched = hss_cx_identity_is_associated(user_name, public_identity);
@@ -689,19 +1129,26 @@
             ogs_error("User-Name%s Public-Identity%s is not associated",
                         user_name, public_identity);
             result_code = OGS_DIAM_CX_ERROR_IDENTITIES_DONT_MATCH;
+            error_occurred = 1;
             goto out;
         }
     } else {
-        user_name = hss_cx_get_user_name(public_identity);
-        if (!user_name) {
+        const char *temp_user_name = hss_cx_get_user_name(public_identity);
+        if (!temp_user_name) {
             ogs_error("Cannot find User-Name for Public-Identity%s",
                         public_identity);
             result_code = OGS_DIAM_CX_ERROR_USER_UNKNOWN;
+            error_occurred = 1;
             goto out;
         }
 
-        user_name = ogs_strdup(user_name);
-        ogs_assert(user_name);
+        user_name = ogs_strdup(temp_user_name);
+        if (!user_name) {
+            ogs_error("Failed to duplicate User-Name from context");
+            result_code = OGS_DIAM_INVALID_AVP_VALUE;
+            error_occurred = 1;
+            goto out;
+        }
     }
 
     /* Check if IMSI */
@@ -710,6 +1157,7 @@
         ogs_error("Cannot find IMSI for User-Name%s Public-Identity%s",
                     user_name, public_identity);
         result_code = OGS_DIAM_CX_ERROR_IDENTITY_NOT_REGISTERED;
+        error_occurred = 1;
         goto out;
     }
 
@@ -721,283 +1169,496 @@
                     "for User-Name%s Public-Identity%s",
                     user_name, public_identity);
         result_code = OGS_DIAM_CX_ERROR_IDENTITY_NOT_REGISTERED;
+        error_occurred = 1;
         goto out;
     }
 
     /* DB : HSS IMS Service Profile */
-    memset(&ims_data, 0, sizeof(ogs_ims_data_t));
     rv = hss_db_ims_data(imsi_bcd, &ims_data);
     if (rv != OGS_OK) {
-        ogs_error("Cannot get IMS-Data for IMSI:'%s'", imsi_bcd);
+        ogs_error("Cannot get IMS-Data for IMSI: %s", imsi_bcd);
         result_code = OGS_DIAM_CX_ERROR_USER_UNKNOWN;
+        error_occurred = 1;
         goto out;
     }
 
     /* Overwrite Server-Name for IMPU(Public-Identity) */
     hss_cx_set_server_name(public_identity, server_name, true);
 
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_CX_APPLICATION_ID);
-    ogs_assert(ret == 0);
-
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Set the Origin-Host, Origin-Realm, and Result-Code AVPs */
-    ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
-    ogs_assert(ret == 0);
+    if (!error_occurred) {
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_CX_APPLICATION_ID);
+        if (ret != 0) {
+            ogs_error("Failed to set Vendor-Specific-Application-Id");
+            error_occurred = 1;
+            goto out;
+        }
 
-    if (user_name_avp) {
-        /* Set the User-Name AVP */
-        ret = fd_msg_avp_new(ogs_diam_user_name, 0, &avp);
-        ogs_assert(ret == 0);
-        val.os.data = (uint8_t *)user_name;
-        val.os.len = strlen(user_name);
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
         ret = fd_msg_avp_setvalue(avp, &val);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to set Auth-Session-State value");
+            error_occurred = 1;
+            goto out;
+        }
         ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-        ogs_assert(ret == 0);
-    }
+        if (ret != 0) {
+            ogs_error("Failed to add Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Get Server-Assignment-Type AVP (Mandatory) */
-    ret = fd_msg_search_avp(qry,
-            ogs_diam_cx_server_assignment_type, &avp);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
-    if (hdr->avp_value->i32 == OGS_DIAM_CX_SERVER_ASSIGNMENT_REGISTRATION ||
-        hdr->avp_value->i32 == OGS_DIAM_CX_SERVER_ASSIGNMENT_RE_REGISTRATION) {
-
-        /* Get User-Data-Already-Available AVP (Mandatory) */
-        ret = fd_msg_search_avp(
-                qry, ogs_diam_cx_user_data_already_available, &avp);
-        ogs_assert(ret == 0);
-        ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
+        /* Set success result code */
+        ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
+        if (ret != 0) {
+            ogs_error("Failed to set success result code");
+            error_occurred = 1;
+            goto out;
+        }
 
-        if (hdr->avp_value->i32 == OGS_DIAM_CX_USER_DATA_ALREADY_AVAILABLE) {
-            /* Nothing to do */
-        } else {
-            /* Set the User-Data AVP */
-            user_data = hss_cx_download_user_data(
-                    user_name, visited_network_identifier, &ims_data);
-            ogs_assert(user_data);
-
-            ret = fd_msg_avp_new(ogs_diam_cx_user_data, 0, &avp);
-            ogs_assert(ret == 0);
-            val.os.data = (uint8_t *)user_data;
-            val.os.len = strlen(user_data);
+        if (user_name_avp) {
+            /* Set the User-Name AVP */
+            ret = fd_msg_avp_new(ogs_diam_user_name, 0, &avp);
+            if (ret != 0) {
+                ogs_error("Failed to create User-Name AVP");
+                error_occurred = 1;
+                goto out;
+            }
+            val.os.data = (uint8_t *)user_name;
+            val.os.len = strlen(user_name);
             ret = fd_msg_avp_setvalue(avp, &val);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to set User-Name value");
+                error_occurred = 1;
+                goto out;
+            }
             ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add User-Name AVP");
+                error_occurred = 1;
+                goto out;
+            }
+        }
 
-            /* Set the Charging-Information AVP */
-            ret = fd_msg_avp_new(ogs_diam_cx_charging_information, 0, &avp);
-            ogs_assert(ret == 0);
-
-            /* Set the Charging-Information AVP */
-            ret = fd_msg_avp_new(ogs_diam_cx_charging_information, 0, &avp);
-            ogs_assert(ret == 0);
-
-            /* Set the Primary-Charging-Collection-Function-Name AVP */
-            ret = fd_msg_avp_new(
-                    ogs_diam_cx_primary_charging_collection_function_name, 0,
-                    &avpch);
-            ogs_assert(ret == 0);
-#define PRIMARY_CHARGING_COLLECTION_FUNCTION_NAME "pcrf"
-            val.os.data = (uint8_t *)PRIMARY_CHARGING_COLLECTION_FUNCTION_NAME;
-            val.os.len = strlen(PRIMARY_CHARGING_COLLECTION_FUNCTION_NAME);
-            ret = fd_msg_avp_setvalue(avpch, &val);
-            ogs_assert(ret == 0);
-            ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
-            ogs_assert(ret == 0);
+        /* Get Server-Assignment-Type AVP (Mandatory) */
+        ret = fd_msg_search_avp(qry,
+                ogs_diam_cx_server_assignment_type, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to search Server-Assignment-Type AVP");
+            result_code = OGS_DIAM_MISSING_AVP;
+            error_occurred = 1;
+            goto out;
+        }
 
-            ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-            ogs_assert(ret == 0);
+        if (!avp) {
+            ogs_error("No Server-Assignment-Type AVP found");
+            result_code = OGS_DIAM_MISSING_AVP;
+            error_occurred = 1;
+            goto out;
         }
-    }
 
-    /* Send the answer */
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        ret = fd_msg_avp_hdr(avp, &hdr);
+        if (ret != 0 || !hdr) {
+            ogs_error("Failed to get Server-Assignment-Type AVP header");
+            result_code = OGS_DIAM_INVALID_AVP_VALUE;
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_debug("Tx Server-Assignment-Answer");
+        if (hdr->avp_value->i32 == OGS_DIAM_CX_SERVER_ASSIGNMENT_REGISTRATION ||
+            hdr->avp_value->i32 ==
+                OGS_DIAM_CX_SERVER_ASSIGNMENT_RE_REGISTRATION) {
+
+            /* Get User-Data-Already-Available AVP (Mandatory) */
+            ret = fd_msg_search_avp(
+                    qry, ogs_diam_cx_user_data_already_available, &avp);
+            if (ret != 0) {
+                ogs_error("Failed to search User-Data-Already-Available AVP");
+                result_code = OGS_DIAM_MISSING_AVP;
+                error_occurred = 1;
+                goto out;
+            }
+
+            if (!avp) {
+                ogs_error("No User-Data-Already-Available AVP found");
+                result_code = OGS_DIAM_MISSING_AVP;
+                error_occurred = 1;
+                goto out;
+            }
+
+            ret = fd_msg_avp_hdr(avp, &hdr);
+            if (ret != 0 || !hdr) {
+                ogs_error("Failed to get User-Data-Already-Available header");
+                result_code = OGS_DIAM_INVALID_AVP_VALUE;
+                error_occurred = 1;
+                goto out;
+            }
+
+            if (hdr->avp_value->i32 ==
+                    OGS_DIAM_CX_USER_DATA_ALREADY_AVAILABLE) {
+                /* Nothing to do */
+            } else {
+                /* Set the User-Data AVP */
+                user_data = hss_cx_download_user_data(
+                        user_name, visited_network_identifier, &ims_data);
+                if (!user_data) {
+                    ogs_error("Failed to download user data");
+                    result_code = OGS_DIAM_CX_ERROR_USER_UNKNOWN;
+                    error_occurred = 1;
+                    goto out;
+                }
+
+                ret = fd_msg_avp_new(ogs_diam_cx_user_data, 0, &avp);
+                if (ret != 0) {
+                    ogs_error("Failed to create User-Data AVP");
+                    error_occurred = 1;
+                    goto out;
+                }
+                val.os.data = (uint8_t *)user_data;
+                val.os.len = strlen(user_data);
+                ret = fd_msg_avp_setvalue(avp, &val);
+                if (ret != 0) {
+                    ogs_error("Failed to set User-Data value");
+                    error_occurred = 1;
+                    goto out;
+                }
+                ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+                if (ret != 0) {
+                    ogs_error("Failed to add User-Data AVP");
+                    error_occurred = 1;
+                    goto out;
+                }
+
+                /* Set the Charging-Information AVP */
+                ret = fd_msg_avp_new(ogs_diam_cx_charging_information, 0, &avp);
+                if (ret != 0) {
+                    ogs_error("Failed to create Charging-Information AVP");
+                    error_occurred = 1;
+                    goto out;
+                }
+
+                /* Set the Primary-Charging-Collection-Function-Name AVP */
+                ret = fd_msg_avp_new(
+                        ogs_diam_cx_primary_charging_collection_function_name, 0,
+                        &avpch);
+                if (ret != 0) {
+                    ogs_error("Failed to create Primary-Charging-Collection-"
+                             "Function-Name AVP");
+                    error_occurred = 1;
+                    goto out;
+                }
+#define PRIMARY_CHARGING_COLLECTION_FUNCTION_NAME "pcrf"
+                val.os.data =
+                    (uint8_t *)PRIMARY_CHARGING_COLLECTION_FUNCTION_NAME;
+                val.os.len = strlen(PRIMARY_CHARGING_COLLECTION_FUNCTION_NAME);
+                ret = fd_msg_avp_setvalue(avpch, &val);
+                if (ret != 0) {
+                    ogs_error("Failed to set Primary-Charging-Collection-"
+                             "Function-Name value");
+                    error_occurred = 1;
+                    goto out;
+                }
+                ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
+                if (ret != 0) {
+                    ogs_error("Failed to add Primary-Charging-Collection-"
+                             "Function-Name AVP");
+                    error_occurred = 1;
+                    goto out;
+                }
+
+                ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+                if (ret != 0) {
+                    ogs_error("Failed to add Charging-Information AVP");
+                    error_occurred = 1;
+                    goto out;
+                }
+            }
+        }
 
-    /* Add this value to the stats */
-    OGS_DIAM_STATS_MTX(
-        OGS_DIAM_STATS_INC(nb_echoed);
-        HSS_DIAM_PRIV_STATS_INC(cx.rx_sar);
-        HSS_DIAM_PRIV_STATS_INC(cx.tx_saa);
-    )
+        /* Send the answer */
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send message");
+            error_occurred = 1;
+            goto out;
+        }
 
-    if (user_data)
-        ogs_free(user_data);
-    ogs_free(user_name);
-    ogs_free(public_identity);
-    ogs_free(server_name);
+        ogs_debug("Tx Server-Assignment-Answer");
 
-    return 0;
+        /* Add to stats */
+        OGS_DIAM_STATS_MTX(
+            OGS_DIAM_STATS_INC(nb_echoed);
+            HSS_DIAM_PRIV_STATS_INC(cx.rx_sar);
+            HSS_DIAM_PRIV_STATS_INC(cx.tx_saa);
+        )
+
+        /* Cleanup resources */
+        if (user_data) ogs_free(user_data);
+        if (user_name) ogs_free(user_name);
+        if (public_identity) ogs_free(public_identity);
+        if (server_name) ogs_free(server_name);
+
+        return 0;
+    }
 
 out:
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_CX_APPLICATION_ID);
-    ogs_assert(ret == 0);
-
-    /* Set the Experimental-Result, Origin-Host and Origin-Realm AVPs */
-    ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
-    ogs_assert(ret == 0);
-
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    /* Error handling */
+    if (ans) {
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_CX_APPLICATION_ID);
+
+        /* Set the Experimental-Result, Origin-Host and Origin-Realm AVPs */
+        if (result_code != 0) {
+            ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
+        }
+
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret == 0) {
+            val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+            ret = fd_msg_avp_setvalue(avp, &val);
+            if (ret == 0) {
+                ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+            }
+        }
 
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send error response");
+        }
+    }
 
+    /* Update error stats */
     OGS_DIAM_STATS_MTX(
         HSS_DIAM_PRIV_STATS_INC(cx.rx_sar);
         HSS_DIAM_PRIV_STATS_INC(cx.rx_sar_error);
     )
 
-    if (user_data)
-        ogs_free(user_data);
-    ogs_free(user_name);
-    ogs_free(public_identity);
-    ogs_free(server_name);
+    /* Cleanup resources */
+    if (user_data) ogs_free(user_data);
+    if (user_name) ogs_free(user_name);
+    if (public_identity) ogs_free(public_identity);
+    if (server_name) ogs_free(server_name);
 
     return 0;
 }
 
 /* Callback for incoming Location-Info-Request messages */
-static int hss_ogs_diam_cx_lir_cb( struct msg **msg, struct avp *avp,
+static int hss_ogs_diam_cx_lir_cb(struct msg **msg, struct avp *avp,
         struct session *session, void *opaque, enum disp_action *act)
 {
     int ret;
     uint32_t result_code = 0;
-
-    struct msg *ans, *qry;
-
-    struct avp_hdr *hdr;
+    struct msg *ans = NULL, *qry = NULL;
+    struct avp_hdr *hdr = NULL;
     union avp_value val;
 
     char *public_identity = NULL;
     char *server_name = NULL;
-
-    ogs_assert(msg);
+    int error_occurred = 0;
 
     ogs_debug("Rx Location-Info-Request");
 
+    /* Validate input parameters */
+    if (!msg || !*msg) {
+        ogs_error("Invalid message pointer");
+        return EINVAL;
+    }
+
     /* Create answer header */
     qry = *msg;
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create answer message");
+        error_occurred = 1;
+        goto out;
+    }
     ans = *msg;
 
     /* Get Public-Identity AVP (Mandatory) */
     ret = fd_msg_search_avp(qry, ogs_diam_cx_public_identity, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Public-Identity AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No Public-Identity AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get Public-Identity AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     public_identity = ogs_strndup(
         (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
-    ogs_assert(public_identity);
+    if (!public_identity) {
+        ogs_error("Failed to duplicate Public-Identity");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Get Server-Name by IMPU(Public-Identity) */
     server_name = hss_cx_get_server_name(public_identity);
     if (!server_name) {
         ogs_error("No Server-Name in Public-Identity%s", public_identity);
         result_code = OGS_DIAM_CX_SERVER_NAME_NOT_STORED;
+        error_occurred = 1;
         goto out;
     }
 
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_CX_APPLICATION_ID);
-    ogs_assert(ret == 0);
-
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Set the Origin-Host, Origin-Realm, and Result-Code AVPs */
-    ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
-    ogs_assert(ret == 0);
-
-    /* Set Server-Name AVPs */
-    ret = fd_msg_avp_new(ogs_diam_cx_server_name, 0, &avp);
-    ogs_assert(ret == 0);
-    val.os.data = (uint8_t *)server_name;
-    val.os.len  = strlen(server_name);
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Send the answer */
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+    if (!error_occurred) {
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_CX_APPLICATION_ID);
+        if (ret != 0) {
+            ogs_error("Failed to set Vendor-Specific-Application-Id");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Auth-Session-State value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_debug("Tx Location-Info-Answer");
+        /* Set success result code */
+        ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
+        if (ret != 0) {
+            ogs_error("Failed to set success result code");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Add this value to the stats */
-    OGS_DIAM_STATS_MTX(
-        OGS_DIAM_STATS_INC(nb_echoed);
-        HSS_DIAM_PRIV_STATS_INC(cx.rx_lir);
-        HSS_DIAM_PRIV_STATS_INC(cx.tx_lia);
-    )
+        /* Set Server-Name AVPs */
+        ret = fd_msg_avp_new(ogs_diam_cx_server_name, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create Server-Name AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.os.data = (uint8_t *)server_name;
+        val.os.len  = strlen(server_name);
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Server-Name value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add Server-Name AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Send the answer */
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send message");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_free(public_identity);
+        ogs_debug("Tx Location-Info-Answer");
 
-    return 0;
+        /* Add to stats */
+        OGS_DIAM_STATS_MTX(
+            OGS_DIAM_STATS_INC(nb_echoed);
+            HSS_DIAM_PRIV_STATS_INC(cx.rx_lir);
+            HSS_DIAM_PRIV_STATS_INC(cx.tx_lia);
+        )
+
+        /* Cleanup resources */
+        if (public_identity) ogs_free(public_identity);
+
+        return 0;
+    }
 
 out:
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_CX_APPLICATION_ID);
-    ogs_assert(ret == 0);
-
-    /* Set the Experimental-Result, Origin-Host and Origin-Realm AVPs */
-    ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
-    ogs_assert(ret == 0);
-
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    /* Error handling */
+    if (ans) {
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_CX_APPLICATION_ID);
+        if (ret != 0) {
+            ogs_warn("Failed to set Vendor-Specific-Application-Id in error");
+        }
+
+        /* Set the Experimental-Result, Origin-Host and Origin-Realm AVPs */
+        if (result_code != 0) {
+            ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
+            if (ret != 0) {
+                ogs_warn("Failed to set experimental result code");
+            }
+        }
 
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret == 0) {
+            val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+            ret = fd_msg_avp_setvalue(avp, &val);
+            if (ret == 0) {
+                ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+                if (ret != 0) {
+                    ogs_warn("Failed to add Auth-Session-State AVP in error");
+                }
+            } else {
+                ogs_warn("Failed to set Auth-Session-State value in error");
+            }
+        } else {
+            ogs_warn("Failed to create Auth-Session-State AVP in error");
+        }
+
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send error response");
+        }
+    }
 
+    /* Update error stats */
     OGS_DIAM_STATS_MTX(
         HSS_DIAM_PRIV_STATS_INC(cx.rx_lir);
         HSS_DIAM_PRIV_STATS_INC(cx.rx_lir_error);
     )
 
-    ogs_free(public_identity);
+    /* Cleanup resources */
+    if (public_identity) ogs_free(public_identity);
 
     return 0;
 }

open5gs_2.7.6.tar.xz/src/hss/hss-s6a-path.c -> open5gs_2.7.7.tar.xz/src/hss/hss-s6a-path.c Changed

@@ -71,15 +71,15 @@
 }
 
 /* Callback for incoming Authentication-Information-Request messages */
-static int hss_ogs_diam_s6a_air_cb( struct msg **msg, struct avp *avp,
+static int hss_ogs_diam_s6a_air_cb(struct msg **msg, struct avp *avp,
         struct session *session, void *opaque, enum disp_action *act)
 {
     int ret;
-
-    struct msg *ans, *qry;
-    struct avp *avpch;
-    struct avp *avp_e_utran_vector, *avp_xres, *avp_kasme, *avp_rand, *avp_autn;
-    struct avp_hdr *hdr;
+    struct msg *ans = NULL, *qry = NULL;
+    struct avp *avpch = NULL;
+    struct avp *avp_e_utran_vector = NULL, *avp_xres = NULL,
+               *avp_kasme = NULL, *avp_rand = NULL, *avp_autn = NULL;
+    struct avp_hdr *hdr = NULL;
     union avp_value val;
 
     char imsi_bcdOGS_MAX_IMSI_BCD_LEN+1;
@@ -92,105 +92,169 @@
     uint8_t xresOGS_MAX_RES_LEN;
     uint8_t kasmeOGS_SHA256_DIGEST_SIZE;
     size_t xres_len = 8;
-
     uint8_t mac_sOGS_MAC_S_LEN;
 
     ogs_dbi_auth_info_t auth_info;
     uint8_t zeroOGS_RAND_LEN;
     int rv;
     uint32_t result_code = 0;
-
     ogs_plmn_id_t visited_plmn_id;
-
-    ogs_assert(msg);
+    int error_occurred = 0;
 
     ogs_debug("Rx Authentication-Information-Request");
 
+    /* Validate input parameters */
+    if (!msg || !*msg) {
+        ogs_error("Invalid message pointer");
+        return EINVAL;
+    }
+
+    /* Initialize variables */
+    memset(imsi_bcd, 0, sizeof(imsi_bcd));
+    memset(&auth_info, 0, sizeof(auth_info));
+    memset(&visited_plmn_id, 0, sizeof(visited_plmn_id));
+
     /* Create answer header */
     qry = *msg;
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create answer message");
+        error_occurred = 1;
+        goto out;
+    }
     ans = *msg;
 
+    /* Get User-Name AVP */
     ret = fd_msg_search_avp(qry, ogs_diam_user_name, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search User-Name AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No User-Name AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get User-Name AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
+
     ogs_cpystrn(imsi_bcd, (char*)hdr->avp_value->os.data,
         ogs_min(hdr->avp_value->os.len, OGS_MAX_IMSI_BCD_LEN)+1);
 
+    /* Get authentication info from database */
     rv = hss_db_auth_info(imsi_bcd, &auth_info);
     if (rv != OGS_OK) {
+        ogs_warn("Failed to get auth info for IMSI: %s", imsi_bcd);
         result_code = OGS_DIAM_S6A_ERROR_USER_UNKNOWN;
+        error_occurred = 1;
         goto out;
     }
 
+    /* Generate RAND if not set */
     memset(zero, 0, sizeof(zero));
     if (memcmp(auth_info.rand, zero, OGS_RAND_LEN) == 0) {
         ogs_random(auth_info.rand, OGS_RAND_LEN);
     }
 
+    /* Calculate OPC */
     if (auth_info.use_opc)
         memcpy(opc, auth_info.opc, sizeof(opc));
     else
         milenage_opc(auth_info.k, auth_info.op, opc);
 
+    /* Check for re-synchronization */
     ret = fd_msg_search_avp(qry, ogs_diam_s6a_req_eutran_auth_info, &avp);
-    ogs_assert(ret == 0);
-    if (avp) {
-        ret = fd_avp_search_avp(
-                avp, ogs_diam_s6a_re_synchronization_info, &avpch);
-        ogs_assert(ret == 0);
-        if (avpch) {
+    if (ret == 0 && avp) {
+        ret = fd_avp_search_avp(avp, ogs_diam_s6a_re_synchronization_info,
+                                &avpch);
+        if (ret == 0 && avpch) {
             ret = fd_msg_avp_hdr(avpch, &hdr);
-            ogs_assert(ret == 0);
-            ogs_auc_sqn(opc, auth_info.k,
-                    hdr->avp_value->os.data,
-                    hdr->avp_value->os.data + OGS_RAND_LEN,
-                    sqn, mac_s);
-            if (memcmp(mac_s, hdr->avp_value->os.data +
-                        OGS_RAND_LEN + OGS_SQN_LEN, OGS_MAC_S_LEN) == 0) {
-                ogs_random(auth_info.rand, OGS_RAND_LEN);
-                auth_info.sqn = ogs_buffer_to_uint64(sqn, OGS_SQN_LEN);
-                /* 33.102 C.3.4 Guide : IND + 1 */
-                auth_info.sqn = (auth_info.sqn + 32 + 1) & OGS_MAX_SQN;
-            } else {
-                ogs_error("Re-synch MAC failed for IMSI:`%s`", imsi_bcd);
-                ogs_log_print(OGS_LOG_ERROR, "MAC_S: ");
-                ogs_log_hexdump(OGS_LOG_ERROR, mac_s, OGS_MAC_S_LEN);
-                ogs_log_hexdump(OGS_LOG_ERROR,
-                    (void*)(hdr->avp_value->os.data +
-                        OGS_RAND_LEN + OGS_SQN_LEN),
-                    OGS_MAC_S_LEN);
-                ogs_log_print(OGS_LOG_ERROR, "SQN: ");
-                ogs_log_hexdump(OGS_LOG_ERROR, sqn, OGS_SQN_LEN);
-                result_code = OGS_DIAM_S6A_AUTHENTICATION_DATA_UNAVAILABLE;
-                goto out;
+            if (ret == 0 && hdr) {
+                ogs_auc_sqn(opc, auth_info.k,
+                        hdr->avp_value->os.data,
+                        hdr->avp_value->os.data + OGS_RAND_LEN,
+                        sqn, mac_s);
+                if (memcmp(mac_s, hdr->avp_value->os.data +
+                            OGS_RAND_LEN + OGS_SQN_LEN, OGS_MAC_S_LEN) == 0) {
+                    ogs_random(auth_info.rand, OGS_RAND_LEN);
+                    auth_info.sqn = ogs_buffer_to_uint64(sqn, OGS_SQN_LEN);
+                    /* 33.102 C.3.4 Guide : IND + 1 */
+                    auth_info.sqn = (auth_info.sqn + 32 + 1) & OGS_MAX_SQN;
+                } else {
+                    ogs_error("Re-synch MAC failed for IMSI: %s", imsi_bcd);
+
+                    ogs_log_print(OGS_LOG_ERROR, "MAC_S: ");
+                    ogs_log_hexdump(OGS_LOG_ERROR, mac_s, OGS_MAC_S_LEN);
+                    ogs_log_hexdump(OGS_LOG_ERROR,
+                            (void*)(hdr->avp_value->os.data +
+                                OGS_RAND_LEN + OGS_SQN_LEN),
+                            OGS_MAC_S_LEN);
+                    ogs_log_print(OGS_LOG_ERROR, "SQN: ");
+                    ogs_log_hexdump(OGS_LOG_ERROR, sqn, OGS_SQN_LEN);
+
+                    result_code = OGS_DIAM_S6A_AUTHENTICATION_DATA_UNAVAILABLE;
+                    error_occurred = 1;
+                    goto out;
+                }
             }
         }
     }
 
+    /* Update SQN in database */
     rv = hss_db_update_sqn(imsi_bcd, auth_info.rand, auth_info.sqn);
     if (rv != OGS_OK) {
-        ogs_error("Cannot update rand and sqn for IMSI:'%s'", imsi_bcd);
+        ogs_error("Cannot update rand and sqn for IMSI: %s", imsi_bcd);
         result_code = OGS_DIAM_S6A_AUTHENTICATION_DATA_UNAVAILABLE;
+        error_occurred = 1;
         goto out;
     }
 
     rv = hss_db_increment_sqn(imsi_bcd);
     if (rv != OGS_OK) {
-        ogs_error("Cannot increment sqn for IMSI:'%s'", imsi_bcd);
+        ogs_error("Cannot increment sqn for IMSI: %s", imsi_bcd);
         result_code = OGS_DIAM_S6A_AUTHENTICATION_DATA_UNAVAILABLE;
+        error_occurred = 1;
         goto out;
     }
 
+    /* Get Visited-PLMN-Id */
     ret = fd_msg_search_avp(qry, ogs_diam_visited_plmn_id, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Visited-PLMN-Id AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No Visited-PLMN-Id AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get Visited-PLMN-Id AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
+
     memcpy(&visited_plmn_id, hdr->avp_value->os.data,
             ogs_min(hdr->avp_value->os.len, sizeof(visited_plmn_id)));
 
+    /* Generate authentication vectors */
     milenage_generate(opc, auth_info.amf, auth_info.k,
         ogs_uint64_to_buffer(auth_info.sqn, OGS_SQN_LEN, sqn), auth_info.rand,
         autn, ik, ck, ak, xres, &xres_len);
@@ -198,105 +262,213 @@
 
     /* Set the Authentication-Info */
     ret = fd_msg_avp_new(ogs_diam_s6a_authentication_info, 0, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create Authentication-Info AVP");
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_new(ogs_diam_s6a_e_utran_vector, 0, &avp_e_utran_vector);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create E-UTRAN-Vector AVP");
+        error_occurred = 1;
+        goto out;
+    }
 
+    /* Add RAND */
     ret = fd_msg_avp_new(ogs_diam_s6a_rand, 0, &avp_rand);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create RAND AVP");
+        error_occurred = 1;
+        goto out;
+    }
     val.os.data = auth_info.rand;
     val.os.len = OGS_KEY_LEN;
     ret = fd_msg_avp_setvalue(avp_rand, &val);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to set RAND value");
+        error_occurred = 1;
+        goto out;
+    }
     ret = fd_msg_avp_add(avp_e_utran_vector, MSG_BRW_LAST_CHILD, avp_rand);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to add RAND AVP");
+        error_occurred = 1;
+        goto out;
+    }
 
+    /* Add XRES */
     ret = fd_msg_avp_new(ogs_diam_s6a_xres, 0, &avp_xres);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create XRES AVP");
+        error_occurred = 1;
+        goto out;
+    }
     val.os.data = xres;
     val.os.len = xres_len;
     ret = fd_msg_avp_setvalue(avp_xres, &val);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to set XRES value");
+        error_occurred = 1;
+        goto out;
+    }
     ret = fd_msg_avp_add(avp_e_utran_vector, MSG_BRW_LAST_CHILD, avp_xres);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to add XRES AVP");
+        error_occurred = 1;
+        goto out;
+    }
 
+    /* Add AUTN */
     ret = fd_msg_avp_new(ogs_diam_s6a_autn, 0, &avp_autn);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create AUTN AVP");
+        error_occurred = 1;
+        goto out;
+    }
     val.os.data = autn;
     val.os.len = OGS_AUTN_LEN;
     ret = fd_msg_avp_setvalue(avp_autn, &val);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to set AUTN value");
+        error_occurred = 1;
+        goto out;
+    }
     ret = fd_msg_avp_add(avp_e_utran_vector, MSG_BRW_LAST_CHILD, avp_autn);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to add AUTN AVP");
+        error_occurred = 1;
+        goto out;
+    }
 
+    /* Add KASME */
     ret = fd_msg_avp_new(ogs_diam_s6a_kasme, 0, &avp_kasme);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create KASME AVP");
+        error_occurred = 1;
+        goto out;
+    }
     val.os.data = kasme;
     val.os.len = OGS_SHA256_DIGEST_SIZE;
     ret = fd_msg_avp_setvalue(avp_kasme, &val);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to set KASME value");
+        error_occurred = 1;
+        goto out;
+    }
     ret = fd_msg_avp_add(avp_e_utran_vector, MSG_BRW_LAST_CHILD, avp_kasme);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to add KASME AVP");
+        error_occurred = 1;
+        goto out;
+    }
 
+    /* Add E-UTRAN-Vector to Authentication-Info */
     ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avp_e_utran_vector);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to add E-UTRAN-Vector AVP");
+        error_occurred = 1;
+        goto out;
+    }
+
+    /* Add Authentication-Info to answer */
     ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to add Authentication-Info AVP");
+        error_occurred = 1;
+        goto out;
+    }
 
-    /* Set the Origin-Host, Origin-Realm, and Result-Code AVPs */
-    ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
-    ogs_assert(ret == 0);
+    if (!error_occurred) {
+        /* Set success result code */
+        ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
+        if (ret != 0) {
+            ogs_error("Failed to set success result code");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Auth-Session-State value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_S6A_APPLICATION_ID);
-    ogs_assert(ret == 0);
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_S6A_APPLICATION_ID);
+        if (ret != 0) {
+            ogs_error("Failed to set Vendor-Specific-Application-Id");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Send the answer */
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        /* Send the answer */
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send message");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_debug("Tx Authentication-Information-Answer");
+        ogs_debug("Tx Authentication-Information-Answer");
 
-    /* Add this value to the stats */
-    OGS_DIAM_STATS_MTX(
-        OGS_DIAM_STATS_INC(nb_echoed);
-        HSS_DIAM_PRIV_STATS_INC(s6a.rx_air);
-        HSS_DIAM_PRIV_STATS_INC(s6a.tx_aia);
-    )
+        /* Add to stats */
+        OGS_DIAM_STATS_MTX(
+            OGS_DIAM_STATS_INC(nb_echoed);
+            HSS_DIAM_PRIV_STATS_INC(s6a.rx_air);
+            HSS_DIAM_PRIV_STATS_INC(s6a.tx_aia);
+        )
 
-    return 0;
+        return 0;
+    }
 
 out:
-    ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
-    ogs_assert(ret == 0);
-
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    /* Error handling */
+    if (ans) {
+        if (result_code != 0) {
+            ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
+            if (ret != 0) {
+                ogs_error("Failed to set experimental result code");
+            }
+        }
 
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_S6A_APPLICATION_ID);
-    ogs_assert(ret == 0);
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret == 0) {
+            val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+            ret = fd_msg_avp_setvalue(avp, &val);
+            if (ret == 0) {
+                ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+            }
+        }
 
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_S6A_APPLICATION_ID);
+
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send error response");
+        }
+    }
 
+    /* Update error stats */
     OGS_DIAM_STATS_MTX(
         HSS_DIAM_PRIV_STATS_INC(s6a.rx_air);
         HSS_DIAM_PRIV_STATS_INC(s6a.rx_air_error);
@@ -757,104 +929,161 @@
 }
 
 /* Callback for incoming Update-Location-Request messages */
-static int hss_ogs_diam_s6a_ulr_cb( struct msg **msg, struct avp *avp,
+static int hss_ogs_diam_s6a_ulr_cb(struct msg **msg, struct avp *avp,
         struct session *session, void *opaque, enum disp_action *act)
 {
     int ret;
-    struct msg *ans, *qry;
-
-    struct avp_hdr *hdr;
-    struct avp *avpch1;
+    struct msg *ans = NULL, *qry = NULL;
+    struct avp_hdr *hdr = NULL;
+    struct avp *avpch1 = NULL;
     union avp_value val;
 
     char *imsi_bcd = NULL;
     char imeisv_bcdOGS_MAX_IMEISV_BCD_LEN+1;
-
     char *mme_host = NULL;
     char *mme_realm = NULL;
 
     int rv;
     uint32_t result_code = 0;
     ogs_subscription_data_t subscription_data;
-
     ogs_plmn_id_t visited_plmn_id;
-
-    ogs_assert(msg);
+    int error_occurred = 0;
 
     ogs_debug("Rx Update-Location-Request");
 
+    /* Validate input parameters */
+    if (!msg || !*msg) {
+        ogs_error("Invalid message pointer");
+        return EINVAL;
+    }
+
+    /* Initialize variables */
     memset(&subscription_data, 0, sizeof(ogs_subscription_data_t));
+    memset(imeisv_bcd, 0, sizeof(imeisv_bcd));
+    memset(&visited_plmn_id, 0, sizeof(visited_plmn_id));
 
     /* Create answer header */
     qry = *msg;
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create answer message");
+        error_occurred = 1;
+        goto out;
+    }
     ans = *msg;
 
     /* Get User-Name AVP */
     ret = fd_msg_search_avp(qry, ogs_diam_user_name, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search User-Name AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     if (avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
+        if (ret != 0 || !hdr) {
+            ogs_error("Failed to get User-Name AVP header");
+            result_code = OGS_DIAM_INVALID_AVP_VALUE;
+            error_occurred = 1;
+            goto out;
+        }
 
         imsi_bcd = ogs_strndup(
             (char*)hdr->avp_value->os.data,
             ogs_min(hdr->avp_value->os.len, OGS_MAX_IMSI_BCD_LEN) + 1);
-        ogs_assert(imsi_bcd);
+        if (!imsi_bcd) {
+            ogs_error("Failed to duplicate IMSI");
+            result_code = OGS_DIAM_INVALID_AVP_VALUE;
+            error_occurred = 1;
+            goto out;
+        }
     } else {
-        ogs_error("no_User-Name");
+        ogs_error("No User-Name AVP found");
         result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
         goto out;
     }
 
+    /* Get subscription data from database */
     rv = hss_db_subscription_data(imsi_bcd, &subscription_data);
     if (rv != OGS_OK) {
-        ogs_error("Cannot get Subscription-Data for IMSI:'%s'", imsi_bcd);
+        ogs_error("Cannot get Subscription-Data for IMSI: %s", imsi_bcd);
         result_code = OGS_DIAM_S6A_ERROR_USER_UNKNOWN;
+        error_occurred = 1;
         goto out;
     }
 
     /* Get Origin-Host */
     ret = fd_msg_search_avp(qry, ogs_diam_origin_host, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Origin-Host AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     if (avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
+        if (ret != 0 || !hdr) {
+            ogs_error("Failed to get Origin-Host AVP header");
+            result_code = OGS_DIAM_INVALID_AVP_VALUE;
+            error_occurred = 1;
+            goto out;
+        }
 
         mme_host = ogs_strndup(
             (char*)hdr->avp_value->os.data,
             ogs_min(hdr->avp_value->os.len, OGS_MAX_FQDN_LEN) + 1);
-        ogs_assert(mme_host);
+        if (!mme_host) {
+            ogs_error("Failed to duplicate MME host");
+            result_code = OGS_DIAM_INVALID_AVP_VALUE;
+            error_occurred = 1;
+            goto out;
+        }
     } else {
-        ogs_error("no_Origin-Host");
+        ogs_error("No Origin-Host AVP found");
         result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
         goto out;
     }
 
     /* Get Origin-Realm */
     ret = fd_msg_search_avp(qry, ogs_diam_origin_realm, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Origin-Realm AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     if (avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
+        if (ret != 0 || !hdr) {
+            ogs_error("Failed to get Origin-Realm AVP header");
+            result_code = OGS_DIAM_INVALID_AVP_VALUE;
+            error_occurred = 1;
+            goto out;
+        }
 
         mme_realm = ogs_strndup(
             (char*)hdr->avp_value->os.data,
             ogs_min(hdr->avp_value->os.len, OGS_MAX_FQDN_LEN) + 1);
-        ogs_assert(mme_realm);
+        if (!mme_realm) {
+            ogs_error("Failed to duplicate MME realm");
+            result_code = OGS_DIAM_INVALID_AVP_VALUE;
+            error_occurred = 1;
+            goto out;
+        }
     } else {
-        ogs_error("no_Origin-Realm");
+        ogs_error("No Origin-Realm AVP found");
         result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
         goto out;
     }
 
-    ogs_assert(mme_host);
-    ogs_assert(mme_realm);
-
-    /* If UE is not purged at MME, determine if the MME sending the ULR
-     * is different from the one that was last used.  if so, send CLR.
-     */
+    /* Check if CLR needs to be sent to previous MME */
     if (subscription_data.mme_host != NULL &&
             subscription_data.mme_realm != NULL) {
         if (!subscription_data.purge_flag) {
@@ -870,250 +1099,412 @@
     }
 
     /* Update database with current MME and timestamp */
-    ogs_assert(OGS_OK == hss_db_update_mme(imsi_bcd, mme_host, mme_realm,
-        false));
+    rv = hss_db_update_mme(imsi_bcd, mme_host, mme_realm, false);
+    if (rv != OGS_OK) {
+        ogs_error("Failed to update MME info for IMSI: %s", imsi_bcd);
+        result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+        error_occurred = 1;
+        goto out;
+    }
 
+    /* Process Terminal-Information if present */
     ret = fd_msg_search_avp(qry, ogs_diam_s6a_terminal_information, &avp);
-    ogs_assert(ret == 0);
-    if (avp) {
+    if (ret == 0 && avp) {
         char *p, *last;
 
         p = imeisv_bcd;
         last = imeisv_bcd + OGS_MAX_IMEISV_BCD_LEN + 1;
 
         ret = fd_avp_search_avp(avp, ogs_diam_s6a_imei, &avpch1);
-        ogs_assert(ret == 0);
-        if (avpch1) {
+        if (ret == 0 && avpch1) {
             ret = fd_msg_avp_hdr(avpch1, &hdr);
-            ogs_assert(ret == 0);
-            if (hdr->avp_value->os.len) {
-                char *s = NULL;
-
-                ogs_assert(hdr->avp_value->os.data);
-                s = ogs_strndup(
+            if (ret == 0 && hdr && hdr->avp_value->os.len) {
+                char *s = ogs_strndup(
                         (const char *)hdr->avp_value->os.data,
                         hdr->avp_value->os.len);
-                ogs_assert(s);
-                p = ogs_slprintf(p, last, "%s", s);
-
-                ogs_free(s);
+                if (s) {
+                    p = ogs_slprintf(p, last, "%s", s);
+                    ogs_free(s);
+                }
             }
         }
 
         ret = fd_avp_search_avp(avp, ogs_diam_s6a_software_version, &avpch1);
-        ogs_assert(ret == 0);
-        if (avpch1) {
+        if (ret == 0 && avpch1) {
             ret = fd_msg_avp_hdr(avpch1, &hdr);
-            ogs_assert(ret == 0);
-            if (hdr->avp_value->os.len) {
-                char *s = NULL;
-
-                ogs_assert(hdr->avp_value->os.data);
-                s = ogs_strndup(
+            if (ret == 0 && hdr && hdr->avp_value->os.len) {
+                char *s = ogs_strndup(
                         (const char *)hdr->avp_value->os.data,
                         hdr->avp_value->os.len);
-                ogs_assert(s);
-                p = ogs_slprintf(p, last, "%s", s);
-
-                ogs_free(s);
+                if (s) {
+                    p = ogs_slprintf(p, last, "%s", s);
+                    ogs_free(s);
+                }
             }
         }
 
-        ogs_assert(OGS_OK == hss_db_update_imeisv(imsi_bcd, imeisv_bcd));
+        if (strlen(imeisv_bcd) > 0) {
+            rv = hss_db_update_imeisv(imsi_bcd, imeisv_bcd);
+            if (rv != OGS_OK) {
+                ogs_warn("Failed to update IMEISV for IMSI: %s", imsi_bcd);
+            }
+        }
     }
 
+    /* Get Visited-PLMN-Id */
     ret = fd_msg_search_avp(qry, ogs_diam_visited_plmn_id, &avp);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
-    memcpy(&visited_plmn_id, hdr->avp_value->os.data,
-            ogs_min(hdr->avp_value->os.len, sizeof(visited_plmn_id)));
+    if (ret != 0) {
+        ogs_error("Failed to search Visited-PLMN-Id AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
 
-    ret = fd_msg_search_avp(qry, ogs_diam_s6a_ulr_flags, &avp);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
-    if (!(hdr->avp_value->u32 & OGS_DIAM_S6A_ULR_SKIP_SUBSCRIBER_DATA)) {
-        /* Set the Subscription Data */
-        ret = fd_msg_avp_new(ogs_diam_s6a_subscription_data, 0, &avp);
-        ogs_assert(ret == 0);
-        rv = hss_s6a_avp_add_subscription_data(&subscription_data,
-            avp, OGS_DIAM_S6A_SUBDATA_ALL);
-        if (rv != OGS_OK) {
-            result_code = OGS_DIAM_S6A_ERROR_UNKNOWN_EPS_SUBSCRIPTION;
+    if (avp) {
+        ret = fd_msg_avp_hdr(avp, &hdr);
+        if (ret != 0 || !hdr) {
+            ogs_error("Failed to get Visited-PLMN-Id AVP header");
+            result_code = OGS_DIAM_INVALID_AVP_VALUE;
+            error_occurred = 1;
             goto out;
         }
-        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-        ogs_assert(ret == 0);
+        memcpy(&visited_plmn_id, hdr->avp_value->os.data,
+                ogs_min(hdr->avp_value->os.len, sizeof(visited_plmn_id)));
     }
 
-    /* Set the Origin-Host, Origin-Realm, and Result-Code AVPs */
-    ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
-    ogs_assert(ret == 0);
+    /* Check ULR-Flags */
+    ret = fd_msg_search_avp(qry, ogs_diam_s6a_ulr_flags, &avp);
+    if (ret != 0) {
+        ogs_error("Failed to search ULR-Flags AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
 
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    if (avp) {
+        ret = fd_msg_avp_hdr(avp, &hdr);
+        if (ret != 0 || !hdr) {
+            ogs_error("Failed to get ULR-Flags AVP header");
+            result_code = OGS_DIAM_INVALID_AVP_VALUE;
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Set the ULA Flags */
-    ret = fd_msg_avp_new(ogs_diam_s6a_ula_flags, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_S6A_ULA_FLAGS_MME_REGISTERED_FOR_SMS;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+        if (!(hdr->avp_value->u32 & OGS_DIAM_S6A_ULR_SKIP_SUBSCRIBER_DATA)) {
+            /* Set the Subscription Data */
+            ret = fd_msg_avp_new(ogs_diam_s6a_subscription_data, 0, &avp);
+            if (ret != 0) {
+                ogs_error("Failed to create Subscription-Data AVP");
+                error_occurred = 1;
+                goto out;
+            }
 
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_S6A_APPLICATION_ID);
-    ogs_assert(ret == 0);
+            rv = hss_s6a_avp_add_subscription_data(&subscription_data,
+                avp, OGS_DIAM_S6A_SUBDATA_ALL);
+            if (rv != OGS_OK) {
+                ogs_error("Failed to add subscription data");
+                result_code = OGS_DIAM_S6A_ERROR_UNKNOWN_EPS_SUBSCRIPTION;
+                error_occurred = 1;
+                goto out;
+            }
 
-    /*
-     * AVP 628 Supported-Features
-     *     AVP 629 Feature-List-ID: 1
-     *         AVP 630 Feature-List: (misc subscriber restrictions)
-     */
-    ret = fd_msg_avp_new(ogs_diam_s6a_supported_features, 0, &avp);
-    ogs_assert(ret == 0);
+            ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+            if (ret != 0) {
+                ogs_error("Failed to add Subscription-Data AVP");
+                error_occurred = 1;
+                goto out;
+            }
+        }
+    }
 
-    ret = fd_msg_avp_new(ogs_diam_vendor_id, 0, &avpch1);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_3GPP_VENDOR_ID;
-    ret = fd_msg_avp_setvalue (avpch1, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add (avp, MSG_BRW_LAST_CHILD, avpch1);
-    ogs_assert(ret == 0);
+    if (!error_occurred) {
+        /* Set success result code */
+        ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
+        if (ret != 0) {
+            ogs_error("Failed to set success result code");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ret = fd_msg_avp_new(ogs_diam_s6a_feature_list_id, 0, &avpch1);
-    ogs_assert(ret == 0);
-    val.i32 = 1;
-    ret = fd_msg_avp_setvalue (avpch1, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add (avp, MSG_BRW_LAST_CHILD, avpch1);
-    ogs_assert(ret == 0);
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Auth-Session-State value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ret = fd_msg_avp_new(ogs_diam_s6a_feature_list, 0, &avpch1);
-    ogs_assert(ret == 0);
-    val.u32 = 0x0000000b;
-    ret = fd_msg_avp_setvalue (avpch1, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add (avp, MSG_BRW_LAST_CHILD, avpch1);
-    ogs_assert(ret == 0);
+        /* Set the ULA Flags */
+        ret = fd_msg_avp_new(ogs_diam_s6a_ula_flags, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create ULA-Flags AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.i32 = OGS_DIAM_S6A_ULA_FLAGS_MME_REGISTERED_FOR_SMS;
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set ULA-Flags value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add ULA-Flags AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_S6A_APPLICATION_ID);
+        if (ret != 0) {
+            ogs_error("Failed to set Vendor-Specific-Application-Id");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /*
-     * AVP 628 Supported-Features
-     *     AVP 629 Feature-List-ID: 2
-     *         AVP 630 Feature-List: (“NR as Secondary RAT: Supported”)
-     */
-    ret = fd_msg_avp_new(ogs_diam_s6a_supported_features, 0, &avp);
-    ogs_assert(ret == 0);
+        /* Set Supported-Features (Feature-List-ID: 1) */
+        ret = fd_msg_avp_new(ogs_diam_s6a_supported_features, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create Supported-Features AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ret = fd_msg_avp_new(ogs_diam_vendor_id, 0, &avpch1);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_3GPP_VENDOR_ID;
-    ret = fd_msg_avp_setvalue (avpch1, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add (avp, MSG_BRW_LAST_CHILD, avpch1);
-    ogs_assert(ret == 0);
+        ret = fd_msg_avp_new(ogs_diam_vendor_id, 0, &avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to create Vendor-Id AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.i32 = OGS_3GPP_VENDOR_ID;
+        ret = fd_msg_avp_setvalue(avpch1, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Vendor-Id value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to add Vendor-Id AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ret = fd_msg_avp_new(ogs_diam_s6a_feature_list_id, 0, &avpch1);
-    ogs_assert(ret == 0);
-    val.i32 = 2;
-    ret = fd_msg_avp_setvalue (avpch1, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add (avp, MSG_BRW_LAST_CHILD, avpch1);
-    ogs_assert(ret == 0);
+        ret = fd_msg_avp_new(ogs_diam_s6a_feature_list_id, 0, &avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to create Feature-List-ID AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.i32 = 1;
+        ret = fd_msg_avp_setvalue(avpch1, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Feature-List-ID value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to add Feature-List-ID AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ret = fd_msg_avp_new(ogs_diam_s6a_feature_list, 0, &avpch1);
-    ogs_assert(ret == 0);
-    val.u32 = 0x08000001;
-    ret = fd_msg_avp_setvalue (avpch1, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add (avp, MSG_BRW_LAST_CHILD, avpch1);
-    ogs_assert(ret == 0);
+        ret = fd_msg_avp_new(ogs_diam_s6a_feature_list, 0, &avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to create Feature-List AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.u32 = 0x0000000b;
+        ret = fd_msg_avp_setvalue(avpch1, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Feature-List value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to add Feature-List AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add Supported-Features AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Send the answer */
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        /* Set Supported-Features (Feature-List-ID: 2) */
+        ret = fd_msg_avp_new(ogs_diam_s6a_supported_features, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create second Supported-Features AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_debug("Tx Update-Location-Answer");
+        ret = fd_msg_avp_new(ogs_diam_vendor_id, 0, &avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to create second Vendor-Id AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.i32 = OGS_3GPP_VENDOR_ID;
+        ret = fd_msg_avp_setvalue(avpch1, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set second Vendor-Id value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to add second Vendor-Id AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Add this value to the stats */
-    OGS_DIAM_STATS_MTX(
-        OGS_DIAM_STATS_INC(nb_echoed);
-        HSS_DIAM_PRIV_STATS_INC(s6a.rx_ulr);
-        HSS_DIAM_PRIV_STATS_INC(s6a.tx_ula);
-    )
+        ret = fd_msg_avp_new(ogs_diam_s6a_feature_list_id, 0, &avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to create second Feature-List-ID AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.i32 = 2;
+        ret = fd_msg_avp_setvalue(avpch1, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set second Feature-List-ID value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to add second Feature-List-ID AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_subscription_data_free(&subscription_data);
+        ret = fd_msg_avp_new(ogs_diam_s6a_feature_list, 0, &avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to create second Feature-List AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.u32 = 0x08000001;
+        ret = fd_msg_avp_setvalue(avpch1, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set second Feature-List value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to add second Feature-List AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    if (imsi_bcd)
-        ogs_free(imsi_bcd);
-    if (mme_host)
-        ogs_free(mme_host);
-    if (mme_realm)
-        ogs_free(mme_realm);
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add second Supported-Features AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    return 0;
+        /* Send the answer */
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send message");
+            error_occurred = 1;
+            goto out;
+        }
 
-out:
-    ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
-    ogs_assert(ret == 0);
+        ogs_debug("Tx Update-Location-Answer");
 
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+        /* Add to stats */
+        OGS_DIAM_STATS_MTX(
+            OGS_DIAM_STATS_INC(nb_echoed);
+            HSS_DIAM_PRIV_STATS_INC(s6a.rx_ulr);
+            HSS_DIAM_PRIV_STATS_INC(s6a.tx_ula);
+        )
+
+        /* Cleanup resources */
+        ogs_subscription_data_free(&subscription_data);
+        if (imsi_bcd) ogs_free(imsi_bcd);
+        if (mme_host) ogs_free(mme_host);
+        if (mme_realm) ogs_free(mme_realm);
 
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_S6A_APPLICATION_ID);
-    ogs_assert(ret == 0);
+        return 0;
+    }
 
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+out:
+    /* Error handling */
+    if (ans) {
+        if (result_code != 0) {
+            ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
+            if (ret != 0) {
+                ogs_error("Failed to set experimental result code");
+            }
+        }
 
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret == 0) {
+            val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+            ret = fd_msg_avp_setvalue(avp, &val);
+            if (ret == 0) {
+                ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+            }
+        }
+
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_S6A_APPLICATION_ID);
+
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send error response");
+        }
+    }
+
+    /* Update error stats */
     OGS_DIAM_STATS_MTX(
         HSS_DIAM_PRIV_STATS_INC(s6a.rx_ulr);
         HSS_DIAM_PRIV_STATS_INC(s6a.rx_ulr_error);
     )
 
+    /* Cleanup resources */
     ogs_subscription_data_free(&subscription_data);
-
-    if (imsi_bcd)
-        ogs_free(imsi_bcd);
-    if (mme_host)
-        ogs_free(mme_host);
-    if (mme_realm)
-        ogs_free(mme_realm);
+    if (imsi_bcd) ogs_free(imsi_bcd);
+    if (mme_host) ogs_free(mme_host);
+    if (mme_realm) ogs_free(mme_realm);
 
     return 0;
 }
 
 /* Callback for incoming Purge-UE-Request messages */
-static int hss_ogs_diam_s6a_pur_cb( struct msg **msg, struct avp *avp,
+static int hss_ogs_diam_s6a_pur_cb(struct msg **msg, struct avp *avp,
         struct session *session, void *opaque, enum disp_action *act)
 {
     int ret, rv;
-
-    struct msg *ans, *qry;
-    struct avp_hdr *hdr;
+    struct msg *ans = NULL, *qry = NULL;
+    struct avp_hdr *hdr = NULL;
     union avp_value val;
 
     ogs_subscription_data_t subscription_data;
@@ -1123,129 +1514,267 @@
     char mme_realmOGS_MAX_FQDN_LEN+1;
 
     uint32_t result_code = 0;
-
-    ogs_assert(msg);
+    int error_occurred = 0;
+    int use_experimental_code = 1;
 
     ogs_debug("Rx Purge-UE-Request");
 
+    /* Validate input parameters */
+    if (!msg || !*msg) {
+        ogs_error("Invalid message pointer");
+        return EINVAL;
+    }
+
+    /* Initialize variables */
     memset(&subscription_data, 0, sizeof(ogs_subscription_data_t));
+    memset(imsi_bcd, 0, sizeof(imsi_bcd));
+    memset(mme_host, 0, sizeof(mme_host));
+    memset(mme_realm, 0, sizeof(mme_realm));
 
     /* Create answer header */
     qry = *msg;
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create answer message");
+        error_occurred = 1;
+        goto out;
+    }
     ans = *msg;
 
+    /* Get User-Name AVP */
     ret = fd_msg_search_avp(qry, ogs_diam_user_name, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search User-Name AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No User-Name AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get User-Name AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
+
     ogs_cpystrn(imsi_bcd, (char*)hdr->avp_value->os.data,
         ogs_min(hdr->avp_value->os.len, OGS_MAX_IMSI_BCD_LEN)+1);
 
+    /* Get subscription data from database */
     rv = hss_db_subscription_data(imsi_bcd, &subscription_data);
     if (rv != OGS_OK) {
-        ogs_error("Cannot get Subscription-Data for IMSI:'%s'", imsi_bcd);
+        ogs_error("Cannot get Subscription-Data for IMSI: %s", imsi_bcd);
         result_code = OGS_DIAM_S6A_ERROR_USER_UNKNOWN;
+        error_occurred = 1;
         goto out;
     }
 
+    /* Get Origin-Host */
     ret = fd_msg_search_avp(qry, ogs_diam_origin_host, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Origin-Host AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No Origin-Host AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get Origin-Host AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
+
     ogs_cpystrn(mme_host, (char*)hdr->avp_value->os.data,
         ogs_min(hdr->avp_value->os.len, OGS_MAX_FQDN_LEN)+1);
 
+    /* Get Origin-Realm */
     ret = fd_msg_search_avp(qry, ogs_diam_origin_realm, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Origin-Realm AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No Origin-Realm AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get Origin-Realm AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
+
     ogs_cpystrn(mme_realm, (char*)hdr->avp_value->os.data,
         ogs_min(hdr->avp_value->os.len, OGS_MAX_FQDN_LEN)+1);
 
-    if (!strcmp(subscription_data.mme_host, mme_host) &&
-            !strcmp(subscription_data.mme_realm, mme_realm)) {
+    /* Check if the MME matches the one in subscription data */
+    if (subscription_data.mme_host && subscription_data.mme_realm &&
+        !strcmp(subscription_data.mme_host, mme_host) &&
+        !strcmp(subscription_data.mme_realm, mme_realm)) {
+
         rv = hss_db_update_mme(imsi_bcd, mme_host, mme_realm, true);
         if (rv != OGS_OK) {
-            ogs_error("Cannot update UE Purged at MME flag:'%s'", imsi_bcd);
+            ogs_error("Cannot update UE Purged at MME flag: %s", imsi_bcd);
             ret = fd_msg_rescode_set(ans,
                     (char*)"DIAMETER_UNABLE_TO_COMPLY", NULL, NULL, 1);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to set DIAMETER_UNABLE_TO_COMPLY");
+            }
+            use_experimental_code = 0;
+            error_occurred = 1;
             goto outnoexp;
         }
     }
 
-    /* Set the PUA Flags */
-    ret = fd_msg_avp_new(ogs_diam_s6a_pua_flags, 0, &avp);
-    ogs_assert(ret == 0);
-    if (!strcmp(subscription_data.mme_host, mme_host) &&
+    if (!error_occurred) {
+        /* Set the PUA Flags */
+        ret = fd_msg_avp_new(ogs_diam_s6a_pua_flags, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create PUA-Flags AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        if (subscription_data.mme_host && subscription_data.mme_realm &&
+            !strcmp(subscription_data.mme_host, mme_host) &&
             !strcmp(subscription_data.mme_realm, mme_realm)) {
-        val.i32 = OGS_DIAM_S6A_PUA_FLAGS_FREEZE_MTMSI;
-    } else {
-        val.i32 = 0;
-    }
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+            val.i32 = OGS_DIAM_S6A_PUA_FLAGS_FREEZE_MTMSI;
+        } else {
+            val.i32 = 0;
+        }
 
-    /* Set the Origin-Host, Origin-Realm, and Result-Code AVPs */
-    ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
-    ogs_assert(ret == 0);
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set PUA-Flags value");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add PUA-Flags AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_S6A_APPLICATION_ID);
-    ogs_assert(ret == 0);
+        /* Set success result code */
+        ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
+        if (ret != 0) {
+            ogs_error("Failed to set success result code");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Send the answer */
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Auth-Session-State value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_debug("Tx Purge-UE-Answer");
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_S6A_APPLICATION_ID);
+        if (ret != 0) {
+            ogs_error("Failed to set Vendor-Specific-Application-Id");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Add this value to the stats */
-    OGS_DIAM_STATS_MTX(
-        OGS_DIAM_STATS_INC(nb_echoed);
-        HSS_DIAM_PRIV_STATS_INC(s6a.rx_pur);
-        HSS_DIAM_PRIV_STATS_INC(s6a.tx_pua);
-    )
+        /* Send the answer */
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send message");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_subscription_data_free(&subscription_data);
+        ogs_debug("Tx Purge-UE-Answer");
 
-    return 0;
+        /* Add to stats */
+        OGS_DIAM_STATS_MTX(
+            OGS_DIAM_STATS_INC(nb_echoed);
+            HSS_DIAM_PRIV_STATS_INC(s6a.rx_pur);
+            HSS_DIAM_PRIV_STATS_INC(s6a.tx_pua);
+        )
+
+        ogs_subscription_data_free(&subscription_data);
+        return 0;
+    }
 
 out:
-    ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
-    ogs_assert(ret == 0);
-outnoexp:
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    /* Error handling with experimental result code */
+    if (ans && use_experimental_code) {
+        if (result_code != 0) {
+            ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
+            if (ret != 0) {
+                ogs_error("Failed to set experimental result code");
+            }
+        }
+    }
 
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_S6A_APPLICATION_ID);
-    ogs_assert(ret == 0);
+outnoexp:
+    /* Common error handling */
+    if (ans) {
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret == 0) {
+            val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+            ret = fd_msg_avp_setvalue(avp, &val);
+            if (ret == 0) {
+                ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+            }
+        }
 
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_S6A_APPLICATION_ID);
+
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send error response");
+        }
+    }
 
+    /* Update error stats */
     OGS_DIAM_STATS_MTX(
         OGS_DIAM_STATS_INC(nb_echoed);
         HSS_DIAM_PRIV_STATS_INC(s6a.rx_pur);
@@ -1253,7 +1782,6 @@
     )
 
     ogs_subscription_data_free(&subscription_data);
-
     return 0;
 }
 
@@ -1390,54 +1918,87 @@
 static void hss_s6a_cla_cb(void *data, struct msg **msg)
 {
     int ret;
-
     struct sess_state *sess_data = NULL;
-    struct session *session;
-    int new;
+    struct session *session = NULL;
+    int new = 0;
+    int error_occurred = 0;
 
     ogs_debug("HSS Rx Cancel-Location-Answer");
 
+    /* Validate input parameters */
+    if (!msg || !*msg) {
+        ogs_error("Invalid message pointer");
+        error_occurred = 1;
+        goto cleanup;
+    }
+
     /* Search the session, retrieve its data */
     ret = fd_msg_sess_get(fd_g_config->cnf_dict, *msg, &session, &new);
     if (ret != 0) {
-        ogs_error("fd_msg_sess_get() failed");
-        goto out;
+        ogs_error("fd_msg_sess_get() failed with error: %d", ret);
+        error_occurred = 1;
+        goto cleanup;
     }
+
     if (new != 0) {
-        ogs_error("fd_msg_sess_get() failed");
-        goto out;
+        ogs_error("Session should already exist, but new session flag is set");
+        error_occurred = 1;
+        goto cleanup;
     }
 
+    if (!session) {
+        ogs_error("Session is NULL");
+        error_occurred = 1;
+        goto cleanup;
+    }
+
+    /* Retrieve session state */
     ret = fd_sess_state_retrieve(hss_s6a_reg, session, &sess_data);
     if (ret != 0) {
-        ogs_error("fd_sess_state_retrieve() failed");
-        goto out;
+        ogs_error("fd_sess_state_retrieve() failed with error: %d", ret);
+        error_occurred = 1;
+        goto cleanup;
     }
+
     if (!sess_data) {
-        ogs_error("fd_sess_state_retrieve() failed");
-        goto out;
+        ogs_error("Session state is NULL");
+        error_occurred = 1;
+        goto cleanup;
     }
+
+    /* Validate data pointer consistency */
     if ((void *)sess_data != data) {
-        ogs_error("fd_sess_state_retrieve() failed");
-        goto out;
+        ogs_error("Session data pointer mismatch - expected: %p, got: %p",
+                  data, sess_data);
+        error_occurred = 1;
+        goto cleanup;
     }
 
-    ret = fd_msg_free(*msg);
-    ogs_assert(ret == 0);
-    *msg = NULL;
+cleanup:
+    /* Always try to free the message if it exists */
+    if (msg && *msg) {
+        ret = fd_msg_free(*msg);
+        if (ret != 0) {
+            ogs_error("Failed to free message: %d", ret);
+            error_occurred = 1;
+        }
+        *msg = NULL;
+    }
 
-    state_cleanup(sess_data, NULL, NULL);
+    /* Clean up session state if it exists */
+    if (sess_data) {
+        state_cleanup(sess_data, NULL, NULL);
+        sess_data = NULL;
+    }
 
+    /* Update statistics */
     OGS_DIAM_STATS_MTX(
         HSS_DIAM_PRIV_STATS_INC(s6a.rx_cla);
+        if (error_occurred)
+            HSS_DIAM_PRIV_STATS_INC(s6a.rx_cla_error);
     )
-    return;
 
-out:
-    OGS_DIAM_STATS_MTX(
-        HSS_DIAM_PRIV_STATS_INC(s6a.rx_cla);
-        HSS_DIAM_PRIV_STATS_INC(s6a.rx_cla_error);
-    )
+    return;
 }
 
 /* HSS Sends Insert Subscriber Data Request to MME */
@@ -1605,54 +2166,86 @@
 static void hss_s6a_ida_cb(void *data, struct msg **msg)
 {
     int ret;
-
     struct sess_state *sess_data = NULL;
-    struct session *session;
-    int new;
+    struct session *session = NULL;
+    int new = 0;
+    int error_occurred = 0;
 
     ogs_debug("HSS Rx Insert-Subscriber-Data-Answer");
 
+    /* Validate input parameters */
+    if (!msg || !*msg) {
+        ogs_error("Invalid message pointer");
+        error_occurred = 1;
+        goto cleanup;
+    }
+
     /* Search the session, retrieve its data */
     ret = fd_msg_sess_get(fd_g_config->cnf_dict, *msg, &session, &new);
     if (ret != 0) {
-        ogs_error("fd_msg_sess_get() failed");
-        goto out;
+        ogs_error("fd_msg_sess_get() failed with error: %d", ret);
+        error_occurred = 1;
+        goto cleanup;
     }
+
     if (new != 0) {
-        ogs_error("fd_msg_sess_get() failed");
-        goto out;
+        ogs_error("Session should already exist, but new session flag is set");
+        error_occurred = 1;
+        goto cleanup;
     }
 
+    if (!session) {
+        ogs_error("Session is NULL");
+        error_occurred = 1;
+        goto cleanup;
+    }
+
+    /* Retrieve session state */
     ret = fd_sess_state_retrieve(hss_s6a_reg, session, &sess_data);
     if (ret != 0) {
-        ogs_error("fd_sess_state_retrieve() failed");
-        goto out;
+        ogs_error("fd_sess_state_retrieve() failed with error: %d", ret);
+        error_occurred = 1;
+        goto cleanup;
     }
+
     if (!sess_data) {
-        ogs_error("fd_sess_state_retrieve() failed");
-        goto out;
+        ogs_error("Session state is NULL");
+        error_occurred = 1;
+        goto cleanup;
     }
+
+    /* Validate data pointer consistency */
     if ((void *)sess_data != data) {
-        ogs_error("fd_sess_state_retrieve() failed");
-        goto out;
+        ogs_error("Session data pointer mismatch - expected: %p, got: %p",
+                  data, sess_data);
+        error_occurred = 1;
+        goto cleanup;
     }
 
-    ret = fd_msg_free(*msg);
-    ogs_assert(ret == 0);
-    *msg = NULL;
+cleanup:
+    /* Always try to free the message if it exists */
+    if (msg && *msg) {
+        ret = fd_msg_free(*msg);
+        if (ret != 0) {
+            ogs_error("Failed to free message: %d", ret);
+            error_occurred = 1;
+        }
+        *msg = NULL;
+    }
 
-    state_cleanup(sess_data, NULL, NULL);
+    /* Clean up session state if it exists */
+    if (sess_data) {
+        state_cleanup(sess_data, NULL, NULL);
+        sess_data = NULL;
+    }
 
+    /* Update statistics */
     OGS_DIAM_STATS_MTX(
         HSS_DIAM_PRIV_STATS_INC(s6a.rx_ida);
+        if (error_occurred)
+            HSS_DIAM_PRIV_STATS_INC(s6a.rx_ida_error);
     )
-    return;
 
-out:
-    OGS_DIAM_STATS_MTX(
-        HSS_DIAM_PRIV_STATS_INC(s6a.rx_ida);
-        HSS_DIAM_PRIV_STATS_INC(s6a.rx_ida_error);
-    )
     return;
 }

open5gs_2.7.6.tar.xz/src/hss/hss-swx-path.c -> open5gs_2.7.7.tar.xz/src/hss/hss-swx-path.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -43,84 +43,135 @@
 }
 
 /* Callback for incoming Multimedia-Auth-Request messages */
-static int hss_ogs_diam_swx_mar_cb( struct msg **msg, struct avp *avp,
+static int hss_ogs_diam_swx_mar_cb(struct msg **msg, struct avp *avp,
         struct session *session, void *opaque, enum disp_action *act)
 {
     int rv, ret;
     uint32_t result_code = 0;
-
-    struct msg *ans, *qry;
-
+    struct msg *ans = NULL, *qry = NULL;
     struct avp *sip_auth_data_item_avp = NULL;
     struct avp *authentication_scheme_avp = NULL;
     struct avp *sip_authorization_avp = NULL;
-
     struct avp *avpch = NULL;
-    struct avp_hdr *hdr;
+    struct avp_hdr *hdr = NULL;
     union avp_value val;
 
     char *user_name = NULL;
     char *authentication_scheme = NULL;
-
     char imsi_bcdOGS_MAX_IMSI_BCD_LEN+1;
 
     ogs_dbi_auth_info_t auth_info;
     uint8_t zeroOGS_RAND_LEN;
-
     uint8_t authenticateOGS_KEY_LEN*2;
-
     uint8_t opcOGS_KEY_LEN;
     uint8_t sqnOGS_SQN_LEN;
-
     uint8_t autnOGS_AUTN_LEN;
     uint8_t ikOGS_KEY_LEN;
     uint8_t ckOGS_KEY_LEN;
     uint8_t akOGS_AK_LEN;
     uint8_t xresOGS_MAX_RES_LEN;
     size_t xres_len = 8;
-
     uint8_t mac_sOGS_MAC_S_LEN;
 
-    ogs_assert(msg);
+    int error_occurred = 0;
 
     ogs_debug("Rx Multimedia-Auth-Request");
 
+    /* Validate input parameters */
+    if (!msg || !*msg) {
+        ogs_error("Invalid message pointer");
+        return EINVAL;
+    }
+
+    /* Initialize variables */
+    memset(imsi_bcd, 0, sizeof(imsi_bcd));
+    memset(&auth_info, 0, sizeof(auth_info));
+
     /* Create answer header */
     qry = *msg;
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create answer message");
+        error_occurred = 1;
+        goto out;
+    }
     ans = *msg;
 
     /* Get User-Name AVP (Mandatory) */
     ret = fd_msg_search_avp(qry, ogs_diam_user_name, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search User-Name AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No User-Name AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get User-Name AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     user_name = ogs_strndup(
         (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
-    ogs_assert(user_name);
+    if (!user_name) {
+        ogs_error("Failed to duplicate User-Name");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     ogs_extract_digit_from_string(imsi_bcd, user_name);
 
     /* Get the SIP-Auth-Data-Item AVP (Mandatory) */
     ret = fd_msg_search_avp(
             qry, ogs_diam_cx_sip_auth_data_item, &sip_auth_data_item_avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search SIP-Auth-Data-Item AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!sip_auth_data_item_avp) {
+        ogs_error("No SIP-Auth-Data-Item AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(sip_auth_data_item_avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get SIP-Auth-Data-Item AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Get the Authentication-Scheme AVP */
     ret = fd_msg_search_avp(sip_auth_data_item_avp,
             ogs_diam_cx_sip_authentication_scheme, &authentication_scheme_avp);
-    ogs_assert(ret == 0);
-    if (authentication_scheme_avp) {
+    if (ret == 0 && authentication_scheme_avp) {
         ret = fd_msg_avp_hdr(authentication_scheme_avp, &hdr);
-        ogs_assert(ret == 0);
-
-        authentication_scheme = ogs_strndup(
-            (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
-        ogs_assert(authentication_scheme);
+        if (ret == 0 && hdr) {
+            authentication_scheme = ogs_strndup(
+                (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
+            if (!authentication_scheme) {
+                ogs_error("Failed to duplicate Authentication-Scheme");
+                result_code = OGS_DIAM_INVALID_AVP_VALUE;
+                error_occurred = 1;
+                goto out;
+            }
+        }
     }
 
     /* EAP-AKA is only supported */
@@ -130,14 +181,16 @@
         ogs_error("Authentication-Scheme%s is not supported",
                     authentication_scheme);
         result_code = OGS_DIAM_CX_ERROR_AUTH_SCHEME_NOT_SUPPORTED;
+        error_occurred = 1;
         goto out;
     }
 
     /* DB : HSS Auth-Info */
     rv = hss_db_auth_info(imsi_bcd, &auth_info);
     if (rv != OGS_OK) {
-        ogs_error("Cannot get IMS-Data for IMSI:'%s'", imsi_bcd);
+        ogs_error("Cannot get IMS-Data for IMSI: %s", imsi_bcd);
         result_code = OGS_DIAM_CX_ERROR_USER_UNKNOWN;
+        error_occurred = 1;
         goto out;
     }
 
@@ -154,47 +207,51 @@
     /* Get the SIP-Authorization AVP */
     ret = fd_msg_search_avp(sip_auth_data_item_avp,
             ogs_diam_cx_sip_authorization, &sip_authorization_avp);
-    ogs_assert(ret == 0);
-    if (sip_authorization_avp) {
+    if (ret == 0 && sip_authorization_avp) {
         ret = fd_msg_avp_hdr(sip_authorization_avp, &hdr);
-        ogs_assert(ret == 0);
-
-        ogs_auc_sqn(opc, auth_info.k,
-                hdr->avp_value->os.data,
-                hdr->avp_value->os.data + OGS_RAND_LEN,
-                sqn, mac_s);
-        if (memcmp(mac_s, hdr->avp_value->os.data +
-                    OGS_RAND_LEN + OGS_SQN_LEN, OGS_MAC_S_LEN) == 0) {
-            ogs_random(auth_info.rand, OGS_RAND_LEN);
-            auth_info.sqn = ogs_buffer_to_uint64(sqn, OGS_SQN_LEN);
-            /* 33.102 C.3.4 Guide : IND + 1 */
-            auth_info.sqn = (auth_info.sqn + 32 + 1) & OGS_MAX_SQN;
-        } else {
-            ogs_error("Re-synch MAC failed for IMSI:`%s`", imsi_bcd);
-            ogs_log_print(OGS_LOG_ERROR, "MAC_S: ");
-            ogs_log_hexdump(OGS_LOG_ERROR, mac_s, OGS_MAC_S_LEN);
-            ogs_log_hexdump(OGS_LOG_ERROR,
-                (void*)(hdr->avp_value->os.data +
-                    OGS_RAND_LEN + OGS_SQN_LEN),
-                OGS_MAC_S_LEN);
-            ogs_log_print(OGS_LOG_ERROR, "SQN: ");
-            ogs_log_hexdump(OGS_LOG_ERROR, sqn, OGS_SQN_LEN);
-            result_code = OGS_DIAM_CX_ERROR_AUTH_SCHEME_NOT_SUPPORTED;
-            goto out;
+        if (ret == 0 && hdr) {
+            ogs_auc_sqn(opc, auth_info.k,
+                    hdr->avp_value->os.data,
+                    hdr->avp_value->os.data + OGS_RAND_LEN,
+                    sqn, mac_s);
+            if (memcmp(mac_s, hdr->avp_value->os.data +
+                        OGS_RAND_LEN + OGS_SQN_LEN, OGS_MAC_S_LEN) == 0) {
+                ogs_random(auth_info.rand, OGS_RAND_LEN);
+                auth_info.sqn = ogs_buffer_to_uint64(sqn, OGS_SQN_LEN);
+                /* 33.102 C.3.4 Guide : IND + 1 */
+                auth_info.sqn = (auth_info.sqn + 32 + 1) & OGS_MAX_SQN;
+            } else {
+                ogs_error("Re-synch MAC failed for IMSI: %s", imsi_bcd);
+
+                ogs_log_print(OGS_LOG_ERROR, "MAC_S: ");
+                ogs_log_hexdump(OGS_LOG_ERROR, mac_s, OGS_MAC_S_LEN);
+                ogs_log_hexdump(OGS_LOG_ERROR,
+                    (void*)(hdr->avp_value->os.data +
+                        OGS_RAND_LEN + OGS_SQN_LEN),
+                    OGS_MAC_S_LEN);
+                ogs_log_print(OGS_LOG_ERROR, "SQN: ");
+                ogs_log_hexdump(OGS_LOG_ERROR, sqn, OGS_SQN_LEN);
+
+                result_code = OGS_DIAM_CX_ERROR_AUTH_SCHEME_NOT_SUPPORTED;
+                error_occurred = 1;
+                goto out;
+            }
         }
     }
 
     rv = hss_db_update_sqn(imsi_bcd, auth_info.rand, auth_info.sqn);
     if (rv != OGS_OK) {
-        ogs_error("Cannot update rand and sqn for IMSI:'%s'", imsi_bcd);
+        ogs_error("Cannot update rand and sqn for IMSI: %s", imsi_bcd);
         result_code = OGS_DIAM_CX_ERROR_IN_ASSIGNMENT_TYPE;
+        error_occurred = 1;
         goto out;
     }
 
     rv = hss_db_increment_sqn(imsi_bcd);
     if (rv != OGS_OK) {
-        ogs_error("Cannot increment sqn for IMSI:'%s'", imsi_bcd);
+        ogs_error("Cannot increment sqn for IMSI: %s", imsi_bcd);
         result_code = OGS_DIAM_CX_ERROR_IN_ASSIGNMENT_TYPE;
+        error_occurred = 1;
         goto out;
     }
 
@@ -227,188 +284,325 @@
     ogs_log_print(OGS_LOG_DEBUG, "xles - ");
     ogs_log_hexdump(OGS_LOG_DEBUG, xres, xres_len);
 
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_SWX_APPLICATION_ID);
-    ogs_assert(ret == 0);
-
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Set the Origin-Host, Origin-Realm, and Result-Code AVPs */
-    ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
-    ogs_assert(ret == 0);
-
-    /* Set the User-Name AVP */
-    ret = fd_msg_avp_new(ogs_diam_user_name, 0, &avp);
-    ogs_assert(ret == 0);
-    val.os.data = (uint8_t *)user_name;
-    val.os.len = strlen(user_name);
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Set the SIP-Number-Auth-Items AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_sip_number_auth_items, 0, &avp);
-    ogs_assert(ret == 0);
-    val.u32 = 1;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Set the SIP-Auth-Data-Item AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_sip_auth_data_item, 0, &avp);
-    ogs_assert(ret == 0);
-
-    /* Set the SIP-Item-Number AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_sip_item_number, 0, &avpch);
-    ogs_assert(ret == 0);
-    val.u32 = 1;
-    ret = fd_msg_avp_setvalue(avpch, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
-    ogs_assert(ret == 0);
-
-    /* Set the SIP-Authentication-Scheme AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_sip_authentication_scheme, 0, &avpch);
-    ogs_assert(ret == 0);
-    val.os.data = (uint8_t *)OGS_DIAM_SWX_AUTH_SCHEME_EAP_AKA;
-    val.os.len = strlen(OGS_DIAM_SWX_AUTH_SCHEME_EAP_AKA);
-    ret = fd_msg_avp_setvalue(avpch, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
-    ogs_assert(ret == 0);
-
-    /* Set the SIP-Authenticatie AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_sip_authenticate, 0, &avpch);
-    ogs_assert(ret == 0);
-    val.os.data = authenticate;
-    val.os.len = OGS_KEY_LEN * 2;
-    ret = fd_msg_avp_setvalue(avpch, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
-    ogs_assert(ret == 0);
-
-    /* Set the SIP-Authorization AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_sip_authorization, 0, &avpch);
-    ogs_assert(ret == 0);
-    val.os.data = xres;
-    val.os.len = xres_len;
-    ret = fd_msg_avp_setvalue(avpch, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
-    ogs_assert(ret == 0);
-
-    /* Set the Confidentiality-Key AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_confidentiality_key, 0, &avpch);
-    ogs_assert(ret == 0);
-    val.os.data = ck;
-    val.os.len = OGS_KEY_LEN;
-    ret = fd_msg_avp_setvalue(avpch, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
-    ogs_assert(ret == 0);
-
-    /* Set the Integrity-Key AVP */
-    ret = fd_msg_avp_new(ogs_diam_cx_integrity_key, 0, &avpch);
-    ogs_assert(ret == 0);
-    val.os.data = ik;
-    val.os.len = OGS_KEY_LEN;
-    ret = fd_msg_avp_setvalue(avpch, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
-    ogs_assert(ret == 0);
-
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Send the answer */
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+    if (!error_occurred) {
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_SWX_APPLICATION_ID);
+        if (ret != 0) {
+            ogs_error("Failed to set Vendor-Specific-Application-Id");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_debug("Tx Multimedia-Auth-Answer");
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Auth-Session-State value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Add this value to the stats */
-    OGS_DIAM_STATS_MTX(
-        OGS_DIAM_STATS_INC(nb_echoed);
-        HSS_DIAM_PRIV_STATS_INC(swx.rx_mar);
-        HSS_DIAM_PRIV_STATS_INC(swx.tx_maa);
-    )
+        /* Set success result code */
+        ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
+        if (ret != 0) {
+            ogs_error("Failed to set success result code");
+            error_occurred = 1;
+            goto out;
+        }
 
-    if (authentication_scheme)
-        ogs_free(authentication_scheme);
+        /* Set the User-Name AVP */
+        ret = fd_msg_avp_new(ogs_diam_user_name, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create User-Name AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.os.data = (uint8_t *)user_name;
+        val.os.len = strlen(user_name);
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set User-Name value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add User-Name AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_free(user_name);
+        /* Set the SIP-Number-Auth-Items AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_sip_number_auth_items, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create SIP-Number-Auth-Items AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.u32 = 1;
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set SIP-Number-Auth-Items value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add SIP-Number-Auth-Items AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    return 0;
+        /* Set the SIP-Auth-Data-Item AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_sip_auth_data_item, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create SIP-Auth-Data-Item AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set the SIP-Item-Number AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_sip_item_number, 0, &avpch);
+        if (ret != 0) {
+            ogs_error("Failed to create SIP-Item-Number AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.u32 = 1;
+        ret = fd_msg_avp_setvalue(avpch, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set SIP-Item-Number value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
+        if (ret != 0) {
+            ogs_error("Failed to add SIP-Item-Number AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set the SIP-Authentication-Scheme AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_sip_authentication_scheme, 0, &avpch);
+        if (ret != 0) {
+            ogs_error("Failed to create SIP-Authentication-Scheme AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.os.data = (uint8_t *)OGS_DIAM_SWX_AUTH_SCHEME_EAP_AKA;
+        val.os.len = strlen(OGS_DIAM_SWX_AUTH_SCHEME_EAP_AKA);
+        ret = fd_msg_avp_setvalue(avpch, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set SIP-Authentication-Scheme value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
+        if (ret != 0) {
+            ogs_error("Failed to add SIP-Authentication-Scheme AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set the SIP-Authenticate AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_sip_authenticate, 0, &avpch);
+        if (ret != 0) {
+            ogs_error("Failed to create SIP-Authenticate AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.os.data = authenticate;
+        val.os.len = OGS_KEY_LEN * 2;
+        ret = fd_msg_avp_setvalue(avpch, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set SIP-Authenticate value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
+        if (ret != 0) {
+            ogs_error("Failed to add SIP-Authenticate AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set the SIP-Authorization AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_sip_authorization, 0, &avpch);
+        if (ret != 0) {
+            ogs_error("Failed to create SIP-Authorization AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.os.data = xres;
+        val.os.len = xres_len;
+        ret = fd_msg_avp_setvalue(avpch, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set SIP-Authorization value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
+        if (ret != 0) {
+            ogs_error("Failed to add SIP-Authorization AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set the Confidentiality-Key AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_confidentiality_key, 0, &avpch);
+        if (ret != 0) {
+            ogs_error("Failed to create Confidentiality-Key AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.os.data = ck;
+        val.os.len = OGS_KEY_LEN;
+        ret = fd_msg_avp_setvalue(avpch, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Confidentiality-Key value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
+        if (ret != 0) {
+            ogs_error("Failed to add Confidentiality-Key AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set the Integrity-Key AVP */
+        ret = fd_msg_avp_new(ogs_diam_cx_integrity_key, 0, &avpch);
+        if (ret != 0) {
+            ogs_error("Failed to create Integrity-Key AVP");
+            error_occurred = 1;
+            goto out;
+        }
+        val.os.data = ik;
+        val.os.len = OGS_KEY_LEN;
+        ret = fd_msg_avp_setvalue(avpch, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Integrity-Key value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch);
+        if (ret != 0) {
+            ogs_error("Failed to add Integrity-Key AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add SIP-Auth-Data-Item AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Send the answer */
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send message");
+            error_occurred = 1;
+            goto out;
+        }
+
+        ogs_debug("Tx Multimedia-Auth-Answer");
+
+        /* Add to stats */
+        OGS_DIAM_STATS_MTX(
+            OGS_DIAM_STATS_INC(nb_echoed);
+            HSS_DIAM_PRIV_STATS_INC(swx.rx_mar);
+            HSS_DIAM_PRIV_STATS_INC(swx.tx_maa);
+        )
+
+        /* Cleanup resources */
+        if (authentication_scheme) ogs_free(authentication_scheme);
+        if (user_name) ogs_free(user_name);
+
+        return 0;
+    }
 
 out:
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_SWX_APPLICATION_ID);
-    ogs_assert(ret == 0);
-
-    /* Set the Experimental-Result, Origin-Host and Origin-Realm AVPs */
-    ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
-    ogs_assert(ret == 0);
-
-    /* Set the User-Name AVP */
-    ret = fd_msg_avp_new(ogs_diam_user_name, 0, &avp);
-    ogs_assert(ret == 0);
-    val.os.data = (uint8_t *)user_name;
-    val.os.len = strlen(user_name);
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    /* Error handling */
+    if (ans) {
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_SWX_APPLICATION_ID);
+
+        /* Set the Experimental-Result, Origin-Host and Origin-Realm AVPs */
+        if (result_code != 0) {
+            ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
+        }
+
+        /* Set the User-Name AVP */
+        if (user_name) {
+            ret = fd_msg_avp_new(ogs_diam_user_name, 0, &avp);
+            if (ret == 0) {
+                val.os.data = (uint8_t *)user_name;
+                val.os.len = strlen(user_name);
+                ret = fd_msg_avp_setvalue(avp, &val);
+                if (ret == 0) {
+                    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+                }
+            }
+        }
 
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret == 0) {
+            val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+            ret = fd_msg_avp_setvalue(avp, &val);
+            if (ret == 0) {
+                ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+            }
+        }
+
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send error response");
+        }
+    }
 
+    /* Update error stats */
     OGS_DIAM_STATS_MTX(
         HSS_DIAM_PRIV_STATS_INC(swx.rx_mar);
         HSS_DIAM_PRIV_STATS_INC(swx.rx_mar_error);
     )
 
-    if (authentication_scheme)
-        ogs_free(authentication_scheme);
-
-    ogs_free(user_name);
+    /* Cleanup resources */
+    if (authentication_scheme) ogs_free(authentication_scheme);
+    if (user_name) ogs_free(user_name);
 
     return 0;
 }
 
 /* Callback for incoming Server-Assignment-Request messages */
-static int hss_ogs_diam_swx_sar_cb( struct msg **msg, struct avp *avp,
+static int hss_ogs_diam_swx_sar_cb(struct msg **msg, struct avp *avp,
         struct session *session, void *opaque, enum disp_action *act)
 {
     int rv, ret;
     uint32_t result_code = 0;
+    int error_occurred = 0;
 
-    struct msg *ans, *qry;
-
-    struct avp_hdr *hdr;
+    struct msg *ans = NULL, *qry = NULL;
+    struct avp_hdr *hdr = NULL;
     union avp_value val;
 
     char *user_name = NULL;
-
     char imsi_bcdOGS_MAX_IMSI_BCD_LEN+1;
 
     ogs_subscription_data_t subscription_data;
@@ -416,27 +610,63 @@
     struct sockaddr_in sin;
     struct sockaddr_in6 sin6;
 
-    ogs_assert(msg);
-
     ogs_debug("Rx Server-Assignment-Request");
 
+    /* Validate input parameters */
+    if (!msg || !*msg) {
+        ogs_error("Invalid message pointer");
+        return EINVAL;
+    }
+
+    /* Initialize variables */
+    memset(imsi_bcd, 0, sizeof(imsi_bcd));
     memset(&subscription_data, 0, sizeof(ogs_subscription_data_t));
+    memset(&sin, 0, sizeof(sin));
+    memset(&sin6, 0, sizeof(sin6));
 
     /* Create answer header */
     qry = *msg;
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create answer message");
+        error_occurred = 1;
+        result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+        goto out;
+    }
     ans = *msg;
 
     /* Get User-Name AVP (Mandatory) */
     ret = fd_msg_search_avp(qry, ogs_diam_user_name, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search User-Name AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No User-Name AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get User-Name AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     user_name = ogs_strndup(
         (char*)hdr->avp_value->os.data, hdr->avp_value->os.len);
-    ogs_assert(user_name);
+    if (!user_name) {
+        ogs_error("Failed to duplicate User-Name");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
 
     ogs_extract_digit_from_string(imsi_bcd, user_name);
 
@@ -445,108 +675,262 @@
     if (rv != OGS_OK) {
         ogs_error("Cannot get Subscription-Data for IMSI:'%s'", imsi_bcd);
         result_code = OGS_DIAM_S6A_ERROR_USER_UNKNOWN;
+        error_occurred = 1;
         goto out;
     }
 
     /* Get Server-Assignment-Type AVP (Mandatory) */
     ret = fd_msg_search_avp(qry,
             ogs_diam_cx_server_assignment_type, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Server-Assignment-Type AVP");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!avp) {
+        ogs_error("No Server-Assignment-Type AVP found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
-    ogs_assert(ret == 0);
+    if (ret != 0 || !hdr) {
+        ogs_error("Failed to get Server-Assignment-Type AVP header");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
+
     if (hdr->avp_value->i32 == OGS_DIAM_CX_SERVER_ASSIGNMENT_REGISTRATION ||
         hdr->avp_value->i32 ==
         OGS_DIAM_CX_SERVER_ASSIGNMENT_AAA_USER_DATA_REQUEST) {
 
-        struct avp *avp_subscription_id;
-        struct avp *avp_subscription_id_type, *avp_subscription_id_data;
-        struct avp *avp_non_3gpp_ip_access, *avp_non_3gpp_ip_access_apn;
-        struct avp *avp_ambr, *avp_max_bandwidth_ul, *avp_max_bandwidth_dl;
+        struct avp *avp_subscription_id = NULL;
+        struct avp *avp_subscription_id_type = NULL;
+        struct avp *avp_subscription_id_data = NULL;
+        struct avp *avp_non_3gpp_ip_access = NULL;
+        struct avp *avp_non_3gpp_ip_access_apn = NULL;
+        struct avp *avp_ambr = NULL;
+        struct avp *avp_max_bandwidth_ul = NULL;
+        struct avp *avp_max_bandwidth_dl = NULL;
 
         /* Set the APN Configuration Profile */
-        struct avp *context_identifier;
+        struct avp *context_identifier = NULL;
 
         int i;
 
         /* Set the Non-3GPP-User-Data */
         ret = fd_msg_avp_new(ogs_diam_swx_non_3gpp_user_data, 0, &avp);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create Non-3GPP-User-Data AVP");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
 
         /* Set Subscription-Id */
-        if (subscription_data.num_of_msisdn >= 1)  {
+        if (subscription_data.num_of_msisdn >= 1) {
             ret = fd_msg_avp_new(ogs_diam_subscription_id, 0,
                     &avp_subscription_id);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to create Subscription-Id AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             ret = fd_msg_avp_new(ogs_diam_subscription_id_type, 0,
                     &avp_subscription_id_type);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to create Subscription-Id-Type AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             val.i32 = OGS_DIAM_SUBSCRIPTION_ID_TYPE_END_USER_E164;
-            ret = fd_msg_avp_setvalue (avp_subscription_id_type, &val);
-            ogs_assert(ret == 0);
+            ret = fd_msg_avp_setvalue(avp_subscription_id_type, &val);
+            if (ret != 0) {
+                ogs_error("Failed to set Subscription-Id-Type value");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             ret = fd_msg_avp_add(avp_subscription_id, MSG_BRW_LAST_CHILD,
                     avp_subscription_id_type);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add Subscription-Id-Type AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             ret = fd_msg_avp_new(ogs_diam_subscription_id_data, 0,
                     &avp_subscription_id_data);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to create Subscription-Id-Data AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             val.os.data = (uint8_t *)subscription_data.msisdn0.bcd;
             val.os.len = strlen(subscription_data.msisdn0.bcd);
-            ret = fd_msg_avp_setvalue (avp_subscription_id_data, &val);
-            ogs_assert(ret == 0);
-            ret = fd_msg_avp_add (avp_subscription_id, MSG_BRW_LAST_CHILD,
+            ret = fd_msg_avp_setvalue(avp_subscription_id_data, &val);
+            if (ret != 0) {
+                ogs_error("Failed to set Subscription-Id-Data value");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
+            ret = fd_msg_avp_add(avp_subscription_id, MSG_BRW_LAST_CHILD,
                     avp_subscription_id_data);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add Subscription-Id-Data AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avp_subscription_id);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add Subscription-Id AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
         }
 
         /* Set Non-3GPP-IP-Access */
         ret = fd_msg_avp_new(ogs_diam_swx_non_3gpp_ip_access, 0,
                 &avp_non_3gpp_ip_access);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create Non-3GPP-IP-Access AVP");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
+
         val.i32 = OGS_DIAM_SWX_NON_3GPP_SUBSCRIPTION_ALLOWED;
         ret = fd_msg_avp_setvalue(avp_non_3gpp_ip_access, &val);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to set Non-3GPP-IP-Access value");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
+
         ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avp_non_3gpp_ip_access);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to add Non-3GPP-IP-Access AVP");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
 
         /* Set Non-3GPP-IP-Access-APN */
         ret = fd_msg_avp_new(ogs_diam_swx_non_3gpp_ip_access_apn, 0,
                 &avp_non_3gpp_ip_access_apn);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create Non-3GPP-IP-Access-APN AVP");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
+
         val.i32 = OGS_DIAM_SWX_NON_3GPP_APNS_ENABLE;
         ret = fd_msg_avp_setvalue(avp_non_3gpp_ip_access_apn, &val);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to set Non-3GPP-IP-Access-APN value");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
+
         ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD,
                 avp_non_3gpp_ip_access_apn);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to add Non-3GPP-IP-Access-APN AVP");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
 
         /* Set the AMBR */
         ret = fd_msg_avp_new(ogs_diam_s6a_ambr, 0, &avp_ambr);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create AMBR AVP");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
+
         ret = fd_msg_avp_new(
                 ogs_diam_s6a_max_bandwidth_ul, 0, &avp_max_bandwidth_ul);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create Max-Bandwidth-UL AVP");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
+
         val.u32 = ogs_uint64_to_uint32(subscription_data.ambr.uplink);
         ret = fd_msg_avp_setvalue(avp_max_bandwidth_ul, &val);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to set Max-Bandwidth-UL value");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
+
         ret = fd_msg_avp_add(
                 avp_ambr, MSG_BRW_LAST_CHILD, avp_max_bandwidth_ul);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to add Max-Bandwidth-UL AVP");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
+
         ret = fd_msg_avp_new(
                 ogs_diam_s6a_max_bandwidth_dl, 0, &avp_max_bandwidth_dl);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create Max-Bandwidth-DL AVP");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
+
         val.u32 = ogs_uint64_to_uint32(subscription_data.ambr.downlink);
         ret = fd_msg_avp_setvalue(avp_max_bandwidth_dl, &val);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to set Max-Bandwidth-DL value");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
+
         ret = fd_msg_avp_add(
                 avp_ambr, MSG_BRW_LAST_CHILD, avp_max_bandwidth_dl);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to add Max-Bandwidth-DL AVP");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
+
         ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avp_ambr);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to add AMBR AVP");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
 
         /* For EPC, we'll use first Slice in Subscription */
         if (subscription_data.num_of_slice)
@@ -555,34 +939,60 @@
         if (!slice_data) {
             ogs_error("%s Cannot find S-NSSAI", imsi_bcd);
             result_code = OGS_DIAM_S6A_ERROR_UNKNOWN_EPS_SUBSCRIPTION;
+            error_occurred = 1;
             goto out;
         }
 
         if (!slice_data->num_of_session) {
             ogs_error("%s No PDN", imsi_bcd);
             result_code = OGS_DIAM_S6A_ERROR_UNKNOWN_EPS_SUBSCRIPTION;
+            error_occurred = 1;
             goto out;
         }
 
         ret = fd_msg_avp_new(ogs_diam_s6a_context_identifier, 0,
                 &context_identifier);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create Context-Identifier AVP");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
+
         val.i32 = 1; /* Context Identifier : 1 */
         ret = fd_msg_avp_setvalue(context_identifier, &val);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to set Context-Identifier value");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
+
         ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, context_identifier);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to add Context-Identifier AVP");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
 
         for (i = 0; i < slice_data->num_of_session; i++) {
             /* Set the APN Configuration */
-            struct avp *apn_configuration, *context_identifier, *pdn_type;
-            struct avp *served_party_ip_address, *service_selection;
-            struct avp *eps_subscribed_qos_profile, *qos_class_identifier;
-            struct avp *allocation_retention_priority, *priority_level;
-            struct avp *pre_emption_capability, *pre_emption_vulnerability;
-            struct avp *mip6_agent_info, *mip_home_agent_address;
-            struct avp *pdn_gw_allocation_type;
-            struct avp *vplmn_dynamic_address_allowed;
+            struct avp *apn_configuration = NULL;
+            struct avp *context_identifier_sub = NULL;
+            struct avp *pdn_type = NULL;
+            struct avp *served_party_ip_address = NULL;
+            struct avp *service_selection = NULL;
+            struct avp *eps_subscribed_qos_profile = NULL;
+            struct avp *qos_class_identifier = NULL;
+            struct avp *allocation_retention_priority = NULL;
+            struct avp *priority_level = NULL;
+            struct avp *pre_emption_capability = NULL;
+            struct avp *pre_emption_vulnerability = NULL;
+            struct avp *mip6_agent_info = NULL;
+            struct avp *mip_home_agent_address = NULL;
+            struct avp *pdn_gw_allocation_type = NULL;
+            struct avp *vplmn_dynamic_address_allowed = NULL;
 
             ogs_session_t *session = NULL;
 
@@ -593,33 +1003,75 @@
             }
 
             session = &slice_data->sessioni;
-            ogs_assert(session);
+            if (!session) {
+                ogs_error("Invalid session at index %d", i);
+                continue;
+            }
             session->context_identifier = i+1;
 
             ret = fd_msg_avp_new(ogs_diam_s6a_apn_configuration, 0,
                 &apn_configuration);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to create APN-Configuration AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             /* Set Context-Identifier */
             ret = fd_msg_avp_new(ogs_diam_s6a_context_identifier, 0,
-                    &context_identifier);
-            ogs_assert(ret == 0);
+                    &context_identifier_sub);
+            if (ret != 0) {
+                ogs_error("Failed to create Context-Identifier AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             val.i32 = session->context_identifier;
-            ret = fd_msg_avp_setvalue(context_identifier, &val);
-            ogs_assert(ret == 0);
+            ret = fd_msg_avp_setvalue(context_identifier_sub, &val);
+            if (ret != 0) {
+                ogs_error("Failed to set Context-Identifier value");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             ret = fd_msg_avp_add(apn_configuration,
-                    MSG_BRW_LAST_CHILD, context_identifier);
-            ogs_assert(ret == 0);
+                    MSG_BRW_LAST_CHILD, context_identifier_sub);
+            if (ret != 0) {
+                ogs_error("Failed to add Context-Identifier AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             /* Set PDN-Type */
             ret = fd_msg_avp_new(ogs_diam_s6a_pdn_type, 0, &pdn_type);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to create PDN-Type AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             val.i32 = OGS_PDU_SESSION_TYPE_TO_DIAMETER(session->session_type);
             ret = fd_msg_avp_setvalue(pdn_type, &val);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to set PDN-Type value");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             ret = fd_msg_avp_add(apn_configuration,
                     MSG_BRW_LAST_CHILD, pdn_type);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add PDN-Type AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             /* Set Served-Party-IP-Address */
             if ((session->session_type == OGS_PDU_SESSION_TYPE_IPV4 ||
@@ -627,14 +1079,31 @@
                 session->ue_ip.ipv4) {
                 ret = fd_msg_avp_new(ogs_diam_s6a_served_party_ip_address,
                         0, &served_party_ip_address);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to create Served-Party-IP-Address AVP");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
+
                 sin.sin_family = AF_INET;
                 sin.sin_addr.s_addr = session->ue_ip.addr;
                 ret = fd_msg_avp_value_encode(&sin, served_party_ip_address);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to encode IPv4 address");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
+
                 ret = fd_msg_avp_add(apn_configuration, MSG_BRW_LAST_CHILD,
                         served_party_ip_address);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to add Served-Party-IP-Address AVP");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
             }
 
             if ((session->session_type == OGS_PDU_SESSION_TYPE_IPV6 ||
@@ -642,281 +1111,595 @@
                 session->ue_ip.ipv6) {
                 ret = fd_msg_avp_new(ogs_diam_s6a_served_party_ip_address,
                         0, &served_party_ip_address);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to create Served-Party-IP-Address AVP");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
+
                 sin6.sin6_family = AF_INET6;
                 memcpy(sin6.sin6_addr.s6_addr,
                         session->ue_ip.addr6, OGS_IPV6_LEN);
                 ret = fd_msg_avp_value_encode(&sin6, served_party_ip_address);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to encode IPv6 address");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
+
                 ret = fd_msg_avp_add(apn_configuration, MSG_BRW_LAST_CHILD,
                         served_party_ip_address);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to add Served-Party-IP-Address AVP");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
             }
 
             /* Set Service-Selection */
             ret = fd_msg_avp_new(ogs_diam_service_selection, 0,
                     &service_selection);
-            ogs_assert(ret == 0);
-            ogs_assert(session->name);
+            if (ret != 0) {
+                ogs_error("Failed to create Service-Selection AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
+            if (!session->name) {
+                ogs_error("Session name is NULL");
+                result_code = OGS_DIAM_INVALID_AVP_VALUE;
+                error_occurred = 1;
+                goto out;
+            }
+
             val.os.data = (uint8_t *)session->name;
             val.os.len = strlen(session->name);
             ret = fd_msg_avp_setvalue(service_selection, &val);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to set Service-Selection value");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             ret = fd_msg_avp_add(apn_configuration,
                     MSG_BRW_LAST_CHILD, service_selection);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add Service-Selection AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             /* Set the EPS Subscribed QoS Profile */
             ret = fd_msg_avp_new(ogs_diam_s6a_eps_subscribed_qos_profile, 0,
                     &eps_subscribed_qos_profile);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to create EPS-Subscribed-QoS-Profile AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             ret = fd_msg_avp_new(ogs_diam_s6a_qos_class_identifier, 0,
                     &qos_class_identifier);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to create QoS-Class-Identifier AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             val.i32 = session->qos.index;
             ret = fd_msg_avp_setvalue(qos_class_identifier, &val);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to set QoS-Class-Identifier value");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             ret = fd_msg_avp_add(eps_subscribed_qos_profile,
                     MSG_BRW_LAST_CHILD, qos_class_identifier);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add QoS-Class-Identifier AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
-                    /* Set Allocation retention priority */
+            /* Set Allocation retention priority */
             ret = fd_msg_avp_new(ogs_diam_s6a_allocation_retention_priority, 0,
                     &allocation_retention_priority);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to create Allocation-Retention-Priority");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             ret = fd_msg_avp_new(
                     ogs_diam_s6a_priority_level, 0, &priority_level);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to create Priority-Level AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             val.u32 = session->qos.arp.priority_level;
             ret = fd_msg_avp_setvalue(priority_level, &val);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to set Priority-Level value");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             ret = fd_msg_avp_add(allocation_retention_priority,
                 MSG_BRW_LAST_CHILD, priority_level);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add Priority-Level AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             ret = fd_msg_avp_new(ogs_diam_s6a_pre_emption_capability, 0,
                     &pre_emption_capability);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to create Pre-emption-Capability AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             val.u32 = OGS_EPC_PRE_EMPTION_DISABLED;
             if (session->qos.arp.pre_emption_capability ==
                     OGS_5GC_PRE_EMPTION_ENABLED)
                 val.u32 = OGS_EPC_PRE_EMPTION_ENABLED;
             ret = fd_msg_avp_setvalue(pre_emption_capability, &val);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to set Pre-emption-Capability value");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             ret = fd_msg_avp_add(allocation_retention_priority,
                 MSG_BRW_LAST_CHILD, pre_emption_capability);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add Pre-emption-Capability AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             ret = fd_msg_avp_new(ogs_diam_s6a_pre_emption_vulnerability, 0,
                     &pre_emption_vulnerability);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to create Pre-emption-Vulnerability AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             val.u32 = OGS_EPC_PRE_EMPTION_DISABLED;
             if (session->qos.arp.pre_emption_vulnerability ==
                     OGS_5GC_PRE_EMPTION_ENABLED)
                 val.u32 = OGS_EPC_PRE_EMPTION_ENABLED;
             ret = fd_msg_avp_setvalue(pre_emption_vulnerability, &val);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to set Pre-emption-Vulnerability value");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
+
             ret = fd_msg_avp_add(allocation_retention_priority,
                 MSG_BRW_LAST_CHILD, pre_emption_vulnerability);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add Pre-emption-Vulnerability AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             ret = fd_msg_avp_add(eps_subscribed_qos_profile,
                 MSG_BRW_LAST_CHILD, allocation_retention_priority);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add Allocation-Retention-Priority AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             ret = fd_msg_avp_add(apn_configuration,
                 MSG_BRW_LAST_CHILD, eps_subscribed_qos_profile);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add EPS-Subscribed-QoS-Profile AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             /* Set MIP6-Agent-Info */
             if (session->smf_ip.ipv4 || session->smf_ip.ipv6) {
                 ret = fd_msg_avp_new(ogs_diam_mip6_agent_info, 0,
                             &mip6_agent_info);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to create MIP6-Agent-Info AVP");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
 
                 if (session->smf_ip.ipv4) {
                     ret = fd_msg_avp_new(ogs_diam_mip_home_agent_address, 0,
                                 &mip_home_agent_address);
-                    ogs_assert(ret == 0);
+                    if (ret != 0) {
+                        ogs_error("Failed to create MIP-Home-Agent-Address");
+                        result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                        error_occurred = 1;
+                        goto out;
+                    }
+
                     sin.sin_family = AF_INET;
                     sin.sin_addr.s_addr = session->smf_ip.addr;
-                    ret = fd_msg_avp_value_encode (
-                                &sin, mip_home_agent_address );
-                    ogs_assert(ret == 0);
+                    ret = fd_msg_avp_value_encode(&sin, mip_home_agent_address);
+                    if (ret != 0) {
+                        ogs_error("Failed to encode SMF IPv4 address");
+                        result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                        error_occurred = 1;
+                        goto out;
+                    }
+
                     ret = fd_msg_avp_add(mip6_agent_info,
                             MSG_BRW_LAST_CHILD, mip_home_agent_address);
-                    ogs_assert(ret == 0);
+                    if (ret != 0) {
+                        ogs_error("Failed to add MIP-Home-Agent-Address AVP");
+                        result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                        error_occurred = 1;
+                        goto out;
+                    }
                 }
 
                 if (session->smf_ip.ipv6) {
                     ret = fd_msg_avp_new(ogs_diam_mip_home_agent_address, 0,
                                 &mip_home_agent_address);
-                    ogs_assert(ret == 0);
+                    if (ret != 0) {
+                        ogs_error("Failed to create MIP-Home-Agent-Address");
+                        result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                        error_occurred = 1;
+                        goto out;
+                    }
+
                     sin6.sin6_family = AF_INET6;
                     memcpy(sin6.sin6_addr.s6_addr, session->smf_ip.addr6,
                             sizeof session->smf_ip.addr6);
-                    ret = fd_msg_avp_value_encode (
-                                &sin6, mip_home_agent_address );
-                    ogs_assert(ret == 0);
+                    ret = fd_msg_avp_value_encode(&sin6, mip_home_agent_address);
+                    if (ret != 0) {
+                        ogs_error("Failed to encode SMF IPv6 address");
+                        result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                        error_occurred = 1;
+                        goto out;
+                    }
+
                     ret = fd_msg_avp_add(mip6_agent_info,
                             MSG_BRW_LAST_CHILD, mip_home_agent_address);
-                    ogs_assert(ret == 0);
+                    if (ret != 0) {
+                        ogs_error("Failed to add MIP-Home-Agent-Address AVP");
+                        result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                        error_occurred = 1;
+                        goto out;
+                    }
                 }
 
                 ret = fd_msg_avp_add(apn_configuration,
                         MSG_BRW_LAST_CHILD, mip6_agent_info);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to add MIP6-Agent-Info AVP");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
 
                 ret = fd_msg_avp_new(ogs_diam_s6a_pdn_gw_allocation_type, 0,
                             &pdn_gw_allocation_type);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to create PDN-GW-Allocation-Type AVP");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
 
                 val.u32 = OGS_DIAM_S6A_PDN_GW_ALLOCATION_DYNAMIC;
                 ret = fd_msg_avp_setvalue(pdn_gw_allocation_type, &val);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to set PDN-GW-Allocation-Type value");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
 
                 ret = fd_msg_avp_add(apn_configuration,
                         MSG_BRW_LAST_CHILD, pdn_gw_allocation_type);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to add PDN-GW-Allocation-Type AVP");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
             }
 
             /* Set VPLMN-Dynamic-Address-Allowed */
             ret = fd_msg_avp_new(ogs_diam_s6a_vplmn_dynamic_address_allowed, 0,
                     &vplmn_dynamic_address_allowed);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to create VPLMN-Dynamic-Address-Allowed");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             val.u32 = OGS_DIAM_S6A_VPLMN_DYNAMIC_ADDRESS_ALLOWED;
             ret = fd_msg_avp_setvalue(vplmn_dynamic_address_allowed, &val);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to set VPLMN-Dynamic-Address-Allowed value");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             ret = fd_msg_avp_add(apn_configuration,
                     MSG_BRW_LAST_CHILD, vplmn_dynamic_address_allowed);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add VPLMN-Dynamic-Address-Allowed AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
 
             /* Set AMBR */
             if (session->ambr.downlink || session->ambr.uplink) {
-                ret = fd_msg_avp_new(ogs_diam_s6a_ambr, 0, &avp_ambr);
-                ogs_assert(ret == 0);
+                struct avp *session_ambr = NULL;
+                struct avp *session_max_bandwidth_ul = NULL;
+                struct avp *session_max_bandwidth_dl = NULL;
+
+                ret = fd_msg_avp_new(ogs_diam_s6a_ambr, 0, &session_ambr);
+                if (ret != 0) {
+                    ogs_error("Failed to create session AMBR AVP");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
+
                 ret = fd_msg_avp_new(ogs_diam_s6a_max_bandwidth_ul, 0,
-                            &avp_max_bandwidth_ul);
-                ogs_assert(ret == 0);
+                            &session_max_bandwidth_ul);
+                if (ret != 0) {
+                    ogs_error("Failed to create session Max-Bandwidth-UL");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
+
                 val.u32 = ogs_uint64_to_uint32(session->ambr.uplink);
-                ret = fd_msg_avp_setvalue(avp_max_bandwidth_ul, &val);
-                ogs_assert(ret == 0);
-                ret = fd_msg_avp_add(avp_ambr, MSG_BRW_LAST_CHILD,
-                            avp_max_bandwidth_ul);
-                ogs_assert(ret == 0);
+                ret = fd_msg_avp_setvalue(session_max_bandwidth_ul, &val);
+                if (ret != 0) {
+                    ogs_error("Failed to set session Max-Bandwidth-UL value");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
+
+                ret = fd_msg_avp_add(session_ambr, MSG_BRW_LAST_CHILD,
+                            session_max_bandwidth_ul);
+                if (ret != 0) {
+                    ogs_error("Failed to add session Max-Bandwidth-UL AVP");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
+
                 ret = fd_msg_avp_new(ogs_diam_s6a_max_bandwidth_dl, 0,
-                            &avp_max_bandwidth_dl);
-                ogs_assert(ret == 0);
+                            &session_max_bandwidth_dl);
+                if (ret != 0) {
+                    ogs_error("Failed to create session Max-Bandwidth-DL");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
+
                 val.u32 = ogs_uint64_to_uint32(session->ambr.downlink);
-                ret = fd_msg_avp_setvalue(avp_max_bandwidth_dl, &val);
-                ogs_assert(ret == 0);
-                ret = fd_msg_avp_add(avp_ambr, MSG_BRW_LAST_CHILD,
-                            avp_max_bandwidth_dl);
-                ogs_assert(ret == 0);
+                ret = fd_msg_avp_setvalue(session_max_bandwidth_dl, &val);
+                if (ret != 0) {
+                    ogs_error("Failed to set session Max-Bandwidth-DL value");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
+
+                ret = fd_msg_avp_add(session_ambr, MSG_BRW_LAST_CHILD,
+                            session_max_bandwidth_dl);
+                if (ret != 0) {
+                    ogs_error("Failed to add session Max-Bandwidth-DL AVP");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
 
                 ret = fd_msg_avp_add(apn_configuration,
-                        MSG_BRW_LAST_CHILD, avp_ambr);
-                ogs_assert(ret == 0);
+                        MSG_BRW_LAST_CHILD, session_ambr);
+                if (ret != 0) {
+                    ogs_error("Failed to add session AMBR AVP");
+                    result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                    error_occurred = 1;
+                    goto out;
+                }
             }
 
             ret = fd_msg_avp_add(avp,
                     MSG_BRW_LAST_CHILD, apn_configuration);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add APN-Configuration AVP");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                error_occurred = 1;
+                goto out;
+            }
         }
 
         ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to add Non-3GPP-User-Data AVP");
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            error_occurred = 1;
+            goto out;
+        }
     }
 
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_SWX_APPLICATION_ID);
-    ogs_assert(ret == 0);
-
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Set the Origin-Host, Origin-Realm, and Result-Code AVPs */
-    ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
-    ogs_assert(ret == 0);
-
-    /* Set the User-Name AVP */
-    ret = fd_msg_avp_new(ogs_diam_user_name, 0, &avp);
-    ogs_assert(ret == 0);
-    val.os.data = (uint8_t *)user_name;
-    val.os.len = strlen(user_name);
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Send the answer */
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+    if (!error_occurred) {
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_SWX_APPLICATION_ID);
+        if (ret != 0) {
+            ogs_error("Failed to set Vendor-Specific-Application-Id");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_debug("Tx Server-Assignment-Answer");
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Add this value to the stats */
-    OGS_DIAM_STATS_MTX(
-        OGS_DIAM_STATS_INC(nb_echoed);
-        HSS_DIAM_PRIV_STATS_INC(swx.rx_sar);
-        HSS_DIAM_PRIV_STATS_INC(swx.tx_saa);
-    )
+        val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Auth-Session-State value");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_subscription_data_free(&subscription_data);
-    ogs_free(user_name);
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add Auth-Session-State AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-    return 0;
+        /* Set the Origin-Host, Origin-Realm, and Result-Code AVPs */
+        ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
+        if (ret != 0) {
+            ogs_error("Failed to set success result code");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Set the User-Name AVP */
+        ret = fd_msg_avp_new(ogs_diam_user_name, 0, &avp);
+        if (ret != 0) {
+            ogs_error("Failed to create User-Name AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        val.os.data = (uint8_t *)user_name;
+        val.os.len = strlen(user_name);
+        ret = fd_msg_avp_setvalue(avp, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set User-Name value");
+            error_occurred = 1;
+            goto out;
+        }
+
+        ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+        if (ret != 0) {
+            ogs_error("Failed to add User-Name AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
+        /* Send the answer */
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send message");
+            error_occurred = 1;
+            goto out;
+        }
+
+        ogs_debug("Tx Server-Assignment-Answer");
+
+        /* Add this value to the stats */
+        OGS_DIAM_STATS_MTX(
+            OGS_DIAM_STATS_INC(nb_echoed);
+            HSS_DIAM_PRIV_STATS_INC(swx.rx_sar);
+            HSS_DIAM_PRIV_STATS_INC(swx.tx_saa);
+        )
+
+        /* Cleanup resources */
+        ogs_subscription_data_free(&subscription_data);
+        if (user_name) ogs_free(user_name);
+
+        return 0;
+    }
 
 out:
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            ans, OGS_DIAM_SWX_APPLICATION_ID);
-    ogs_assert(ret == 0);
-
-    /* Set the Experimental-Result, Origin-Host and Origin-Realm AVPs */
-    ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
-    ogs_assert(ret == 0);
-
-    /* Set the Auth-Session-State AVP */
-    ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
-
-    /* Set the User-Name AVP */
-    ret = fd_msg_avp_new(ogs_diam_user_name, 0, &avp);
-    ogs_assert(ret == 0);
-    val.os.data = (uint8_t *)user_name;
-    val.os.len = strlen(user_name);
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    /* Error handling */
+    if (ans) {
+        /* Set Vendor-Specific-Application-Id AVP */
+        ret = ogs_diam_message_vendor_specific_appid_set(
+                ans, OGS_DIAM_SWX_APPLICATION_ID);
+
+        /* Set the Experimental-Result, Origin-Host and Origin-Realm AVPs */
+        if (result_code != 0) {
+            ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
+        }
+
+        /* Set the Auth-Session-State AVP */
+        ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
+        if (ret == 0) {
+            val.i32 = OGS_DIAM_AUTH_SESSION_NO_STATE_MAINTAINED;
+            ret = fd_msg_avp_setvalue(avp, &val);
+            if (ret == 0) {
+                ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+            }
+        }
+
+        /* Set the User-Name AVP */
+        if (user_name) {
+            ret = fd_msg_avp_new(ogs_diam_user_name, 0, &avp);
+            if (ret == 0) {
+                val.os.data = (uint8_t *)user_name;
+                val.os.len = strlen(user_name);
+                ret = fd_msg_avp_setvalue(avp, &val);
+                if (ret == 0) {
+                    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+                }
+            }
+        }
 
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send error response");
+        }
+    }
 
+    /* Update error stats */
     OGS_DIAM_STATS_MTX(
         HSS_DIAM_PRIV_STATS_INC(swx.rx_sar);
         HSS_DIAM_PRIV_STATS_INC(swx.rx_sar_error);
     )
 
+    /* Cleanup resources */
     ogs_subscription_data_free(&subscription_data);
-    ogs_free(user_name);
+    if (user_name) ogs_free(user_name);
 
     return 0;
 }

open5gs_2.7.6.tar.xz/src/mme/emm-build.c -> open5gs_2.7.7.tar.xz/src/mme/emm-build.c Changed

@@ -43,6 +43,8 @@
         &attach_accept->location_area_identification;
     ogs_nas_mobile_identity_t *ms_identity = &attach_accept->ms_identity;
     ogs_nas_mobile_identity_tmsi_t *tmsi = &ms_identity->tmsi;;
+    ogs_nas_emergency_number_list_t *emerg_numbers =
+        &attach_accept->emergency_number_list;
 
     ogs_assert(mme_ue);
     ogs_assert(esmbuf);
@@ -202,6 +204,30 @@
             OGS_NAS_EPS_ATTACH_ACCEPT_T3423_VALUE_PRESENT;
     }
 
+    /* Set emergency number(s) */
+    if (!ogs_list_empty(&mme_self()->emerg_list)) {
+        mme_emerg_t *emerg;
+        ogs_nas_emergency_number_item_t *item;
+        int len, o = 0;
+        ogs_list_for_each(&mme_self()->emerg_list, emerg) {
+            len = (strlen(emerg->digits) + 1) >> 1;
+            if (o + 2 + len > OGS_NAS_MAX_EMERGENCY_NUMBER_LIST_LEN) {
+                ogs_debug("    Too many list EMERG_NUM_LIST items.");
+                break;
+            }
+            ogs_debug("    EMERG_NUM_LISTCAT:0x%02x,DIGITS:%s",
+                    emerg->categories, emerg->digits);
+            item = (ogs_nas_emergency_number_item_t *)(emerg_numbers->buffer + o);
+            item->service_category = emerg->categories;
+            ogs_bcd_to_buffer(emerg->digits, item->digits, &len);
+            item->length = 1 + len;
+            o += 2 + len;
+        }
+        attach_accept->presencemask |=
+            OGS_NAS_EPS_ATTACH_ACCEPT_EMERGENCY_NUMBER_LIST_PRESENT;
+        emerg_numbers->length = o;
+    }
+
     attach_accept->presencemask |=
         OGS_NAS_EPS_ATTACH_ACCEPT_EPS_NETWORK_FEATURE_SUPPORT_PRESENT;
     if (ogs_global_conf()->parameter.use_openair == false) {
@@ -211,6 +237,8 @@
     }
     eps_network_feature_support->ims_voice_over_ps_session_in_s1_mode = 1;
     eps_network_feature_support->extended_protocol_configuration_options = 1;
+    if (mme_self()->emergency.dnn)
+        eps_network_feature_support->emergency_bearer_services_in_s1_mode = 1;
 
     if (MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue)) {
         ogs_assert(mme_ue->csmap);

open5gs_2.7.6.tar.xz/src/mme/emm-handler.c -> open5gs_2.7.7.tar.xz/src/mme/emm-handler.c Changed

@@ -108,9 +108,19 @@
         case OGS_NAS_ATTACH_TYPE_EPS_EMERGENCY_ATTACH:
             ogs_debug("    Requested EPS_ATTACH_TYPE3, EPS_EMERGENCY_ATTACH");
             break;
-        default:
+        case OGS_NAS_ATTACH_TYPE_RESERVED:
             ogs_error("    Invalid Requested EPS_ATTACH_TYPE%d",
-                mme_ue->nas_eps.attach.value);
+                      mme_ue->nas_eps.attach.value);
+            break;
+        case OGS_NAS_ATTACH_TYPE_EPS_RLOS_ATTACH:
+                /* fall-through: '"EPS RLOS attach" shall be interpreted as "EPS attach"
+                 * by a network not supporting attach for access to RLOS."'*/
+        default:
+            /* 'All other values are unused and shall be interpreted as "EPS attach",
+             * if received by the network' */
+            ogs_warn("    Requested EPS_ATTACH_TYPE%d, assuming EPS_ATTACH",
+                     mme_ue->nas_eps.attach.value);
+            mme_ue->nas_eps.attach.value = OGS_NAS_ATTACH_TYPE_EPS_ATTACH;
     }
 
     /*

open5gs_2.7.6.tar.xz/src/mme/emm-sm.c -> open5gs_2.7.7.tar.xz/src/mme/emm-sm.c Changed

@@ -262,8 +262,6 @@
          * detach timer such that the sum of the timer values is greater than
          * timer T3346.
          */
-            ogs_debug("%s Starting Implicit Detach timer",
-                mme_ue->imsi_bcd);
             ogs_timer_start(mme_ue->t_implicit_detach.timer,
                 ogs_time_from_sec(mme_self()->time.t3412.value + 240));
             break;
@@ -271,6 +269,14 @@
         case MME_TIMER_IMPLICIT_DETACH:
             ogs_info("%s Implicit Detach timer expired, detaching UE",
                 mme_ue->imsi_bcd);
+
+            /*
+             * Reset the deferral flag for this implicit detach handling.
+             * mme_send_delete_session_or_detach() may set this flag if the UE
+             * must be removed locally (e.g., no S1 context exists).
+             */
+            mme_ue->ue_context_will_remove = false;
+
             CLEAR_MME_UE_TIMER(mme_ue->t_implicit_detach);
             /* TS 24.301 5.3.5
              * If the implicit detach timer expires before the UE contacts
@@ -280,14 +286,22 @@
             if (MME_CURRENT_P_TMSI_IS_AVAILABLE(mme_ue)) {
                 ogs_assert(OGS_OK == sgsap_send_detach_indication(mme_ue));
             } else {
-                enb_ue_t *enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);
-                if (enb_ue)
-                    mme_send_delete_session_or_detach(enb_ue, mme_ue);
-                else
-                    ogs_error("ENB-S1 Context has already been removed");
+                mme_send_delete_session_or_detach(
+                        enb_ue_find_by_id(mme_ue->enb_ue_id), mme_ue);
             }
 
-            OGS_FSM_TRAN(s, &emm_state_de_registered);
+            /*
+             * Do not remove the UE context directly in this handler.
+             *
+             * If mme_send_delete_session_or_detach() decided that local removal
+             * is required, transition to a dedicated state that will remove the
+             * UE context on entry. Otherwise follow the normal de-registered
+             * transition for implicit detach.
+             */
+            if (mme_ue->ue_context_will_remove == true)
+                OGS_FSM_TRAN(s, &emm_state_ue_context_will_remove);
+            else
+                OGS_FSM_TRAN(s, &emm_state_de_registered);
             break;
 
         default:
@@ -675,6 +689,21 @@
              * 10. UplinkNASTransport + Tracking area update complete (Target)
              */
 
+            /* Save tau-request message */
+            mme_ue->tracking_area_update_request_presencemask =
+                message->emm.tracking_area_update_request.presencemask;
+            mme_ue->tracking_area_update_request_ebcs_value =
+                message->emm.tracking_area_update_request.
+                    eps_bearer_context_status.value;
+
+            /* Determine S1AP procedure and store it for reuse */
+            mme_ue->tracking_area_update_accept_proc =
+                S1AP_ProcedureCode_id_downlinkNASTransport;
+            if (e->s1ap_code == S1AP_ProcedureCode_id_initialUEMessage &&
+                mme_ue->nas_eps.update.active_flag)
+                mme_ue->tracking_area_update_accept_proc =
+                    S1AP_ProcedureCode_id_InitialContextSetup;
+
             /* Update CSMAP from Tracking area update request */
             mme_ue->csmap = mme_csmap_find_by_tai(&mme_ue->tai);
             if (mme_ue->csmap &&
@@ -685,80 +714,45 @@
                  mme_ue->nas_eps.update.value ==
                  OGS_NAS_EPS_UPDATE_TYPE_COMBINED_TA_LA_UPDATING_WITH_IMSI_ATTACH)) {
 
-                if (e->s1ap_code == S1AP_ProcedureCode_id_initialUEMessage)
-                    mme_ue->tracking_area_update_request_type =
-                        MME_TAU_TYPE_INITIAL_UE_MESSAGE;
-                else if (e->s1ap_code ==
-                        S1AP_ProcedureCode_id_uplinkNASTransport)
-                    mme_ue->tracking_area_update_request_type =
-                        MME_TAU_TYPE_UPLINK_NAS_TRANPORT;
-                else {
-                    ogs_error("Invalid Procedure Code%d", (int)e->s1ap_code);
-                    break;
-                }
-
                 ogs_assert(OGS_OK ==
                     sgsap_send_location_update_request(mme_ue));
 
             } else {
 
-                if (e->s1ap_code == S1AP_ProcedureCode_id_initialUEMessage) {
-                    ogs_debug("    Initial UE Message");
-                    if (mme_ue->nas_eps.update.active_flag) {
-
-    /*
-     * TS33.401
-     * 7 Security procedures between UE and EPS access network elements
-     * 7.2 Handling of user-related keys in E-UTRAN
-     * 7.2.7 Key handling for the TAU procedure when registered in E-UTRAN
-     *
-     * If the "active flag" is set in the TAU request message or
-     * the MME chooses to establish radio bearers when there is pending downlink
-     * UP data or pending downlink signalling, radio bearers will be established
-     * as part of the TAU procedure and a KeNB derivation is necessary.
-     */
-                        ogs_kdf_kenb(mme_ue->kasme, mme_ue->ul_count.i32,
-                                mme_ue->kenb);
-                        ogs_kdf_nh_enb(mme_ue->kasme, mme_ue->kenb, mme_ue->nh);
-                        mme_ue->nhcc = 1;
+                if (mme_ue->nas_eps.update.active_flag) {
 
-                        r = nas_eps_send_tau_accept(mme_ue,
-                                S1AP_ProcedureCode_id_InitialContextSetup);
-                        ogs_expect(r == OGS_OK);
-                        ogs_assert(r != OGS_ERROR);
-                    } else {
-                        r = nas_eps_send_tau_accept(mme_ue,
-                                S1AP_ProcedureCode_id_downlinkNASTransport);
-                        ogs_expect(r == OGS_OK);
-                        ogs_assert(r != OGS_ERROR);
-                    }
-                } else if (e->s1ap_code ==
-                        S1AP_ProcedureCode_id_uplinkNASTransport) {
-                    ogs_debug("    Uplink NAS Transport");
-                    r = nas_eps_send_tau_accept(mme_ue,
-                            S1AP_ProcedureCode_id_downlinkNASTransport);
-                    ogs_expect(r == OGS_OK);
-                    ogs_assert(r != OGS_ERROR);
-                } else {
-                    ogs_error("Invalid Procedure Code%d", (int)e->s1ap_code);
-                    break;
+/*
+ * TS33.401
+ * 7 Security procedures between UE and EPS access network elements
+ * 7.2 Handling of user-related keys in E-UTRAN
+ * 7.2.7 Key handling for the TAU procedure when registered in E-UTRAN
+ *
+ * If the "active flag" is set in the TAU request message or
+ * the MME chooses to establish radio bearers when there is pending downlink
+ * UP data or pending downlink signalling, radio bearers will be established
+ * as part of the TAU procedure and a KeNB derivation is necessary.
+ */
+                    ogs_kdf_kenb(mme_ue->kasme, mme_ue->ul_count.i32,
+                            mme_ue->kenb);
+                    ogs_kdf_nh_enb(mme_ue->kasme, mme_ue->kenb, mme_ue->nh);
+                    mme_ue->nhcc = 1;
+
+                    ogs_info("%s KDF update(active_flag=1)",
+                            mme_ue->imsi_bcd);
                 }
 
-        /*
-         * When active_flag is 0, check if the P-TMSI has been updated.
-         * If the P-TMSI has changed, wait to receive the TAU Complete message
-         * from the UE before sending the UEContextReleaseCommand.
-         *
-         * This ensures that the UE has acknowledged the new P-TMSI,
-         * allowing the TAU procedure to complete successfully
-         * and maintaining synchronization between the UE and the network.
-         */
-                if (!mme_ue->nas_eps.update.active_flag &&
-                    !MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue)) {
-                    enb_ue->relcause.group = S1AP_Cause_PR_nas;
-                    enb_ue->relcause.cause = S1AP_CauseNas_normal_release;
-                    mme_send_release_access_bearer_or_ue_context_release(
-                            enb_ue);
+                /* check BCS regardless of active_flag */
+                if (mme_ue->tracking_area_update_request_presencemask &
+                    OGS_NAS_EPS_TRACKING_AREA_UPDATE_REQUEST_EPS_BEARER_CONTEXT_STATUS_TYPE) {
+                    ogs_info("%s TAU accept(active_flag=%d, BCS check)",
+                        mme_ue->imsi_bcd,
+                        mme_ue->nas_eps.update.active_flag);
+                    mme_send_delete_session_or_tau_accept(enb_ue, mme_ue);
+                } else {
+                    ogs_info("%s TAU accept(active_flag=%d, No BCS)",
+                        mme_ue->imsi_bcd,
+                        mme_ue->nas_eps.update.active_flag);
+                    mme_send_tau_accept_and_check_release(enb_ue, mme_ue);
                 }
             }
 
@@ -1081,7 +1075,7 @@
 
 void emm_state_authentication(ogs_fsm_t *s, mme_event_t *e)
 {
-    int r, rv;
+    int r, rv, xact_count;
     mme_ue_t *mme_ue = NULL;
     enb_ue_t *enb_ue = NULL;
     ogs_nas_eps_message_t *message = NULL;
@@ -1098,6 +1092,7 @@
 
     switch (e->id) {
     case OGS_FSM_ENTRY_SIG:
+        mme_ue->auth_synch_fail_count = 0;
         break;
     case OGS_FSM_EXIT_SIG:
         break;
@@ -1118,6 +1113,8 @@
             break;
         }
 
+        xact_count = mme_ue_xact_count(mme_ue, OGS_GTP_LOCAL_ORIGINATOR);
+
         switch (message->emm.h.message_type) {
         case OGS_NAS_EPS_AUTHENTICATION_RESPONSE:
             rv = emm_handle_authentication_response(enb_ue, mme_ue,
@@ -1155,7 +1152,17 @@
                         "(Non-EPS authentication unacceptable)");
                 break;
             case OGS_NAS_EMM_CAUSE_SYNCH_FAILURE:
-                ogs_info("Authentication failure(Synch failure)");
+                ogs_warn("%s Authentication failure(Synch failurecount=%d)",
+                        mme_ue->imsi_bcd, mme_ue->auth_synch_fail_count);
+
+                mme_ue->auth_synch_fail_count++;
+
+                if (mme_ue->auth_synch_fail_count >= 2) {
+                    ogs_warn("%s Too many authentication synch failures, "
+                            "sending AUTHENTICATION REJECT", mme_ue->imsi_bcd);
+                    break;
+                }
+
                 mme_s6a_send_air(enb_ue, mme_ue,
                         authentication_failure_parameter);
                 return;
@@ -1182,7 +1189,15 @@
                 break;
             }
 
-            mme_s6a_send_air(enb_ue, mme_ue, NULL);
+            mme_gtp_send_delete_all_sessions(enb_ue, mme_ue,
+                OGS_GTP_DELETE_SEND_AUTHENTICATION_REQUEST);
+
+            if (!MME_SESSION_RELEASE_PENDING(mme_ue) &&
+                mme_ue_xact_count(mme_ue, OGS_GTP_LOCAL_ORIGINATOR) ==
+                    xact_count) {
+                mme_s6a_send_air(enb_ue, mme_ue, NULL);
+            }
+
             OGS_FSM_TRAN(s, &emm_state_authentication);
             break;
         case OGS_NAS_EPS_EMM_STATUS:
@@ -1270,7 +1285,7 @@
 
 void emm_state_security_mode(ogs_fsm_t *s, mme_event_t *e)
 {
-    int r, rv;
+    int r, rv, xact_count;
     mme_ue_t *mme_ue = NULL;
     enb_ue_t *enb_ue = NULL;
     ogs_nas_eps_message_t *message = NULL;
@@ -1310,6 +1325,8 @@
             break;
         }
 
+        xact_count = mme_ue_xact_count(mme_ue, OGS_GTP_LOCAL_ORIGINATOR);
+
         if (message->emm.h.security_header_type
                 == OGS_NAS_SECURITY_HEADER_FOR_SERVICE_REQUEST_MESSAGE) {
             ogs_debug("Service request");
@@ -1398,7 +1415,7 @@
                 break;
             }
 
-            mme_s6a_send_ulr(enb_ue, mme_ue);
+            mme_s6a_send_ulr(enb_ue, mme_ue, 0);
 
             if (MME_NEXT_GUTI_IS_AVAILABLE(mme_ue)) {
                 OGS_FSM_TRAN(s, &emm_state_initial_context_setup);
@@ -1425,7 +1442,15 @@
                 break;
             }
 
-            mme_s6a_send_air(enb_ue, mme_ue, NULL);
+            mme_gtp_send_delete_all_sessions(enb_ue, mme_ue,
+                OGS_GTP_DELETE_SEND_AUTHENTICATION_REQUEST);
+
+            if (!MME_SESSION_RELEASE_PENDING(mme_ue) &&
+                mme_ue_xact_count(mme_ue, OGS_GTP_LOCAL_ORIGINATOR) ==
+                    xact_count) {
+                mme_s6a_send_air(enb_ue, mme_ue, NULL);
+            }
+
             OGS_FSM_TRAN(s, &emm_state_authentication);
             break;
         case OGS_NAS_EPS_TRACKING_AREA_UPDATE_REQUEST:
@@ -1822,6 +1847,48 @@
     }
 }
 
+/*
+ * EMM state: UE context will remove.
+ *
+ * This state exists to perform UE context removal at a safe point,
+ * after the triggering EMM event has completed its core handling
+ * and a state transition has been decided.
+ *
+ * It is primarily used by implicit detach paths where the UE may be
+ * removed locally (e.g., no S1 context) and we must avoid freeing
+ * mme_ue inside the original EMM timer handler.
+ */
+void emm_state_ue_context_will_remove(ogs_fsm_t *s, mme_event_t *e)
+{
+    mme_ue_t *mme_ue = NULL;
+
+    ogs_assert(s);
+    ogs_assert(e);
+
+    mme_sm_debug(e);
+
+    mme_ue = mme_ue_find_by_id(e->mme_ue_id);
+    ogs_assert(mme_ue);
+
+    switch (e->id) {
+    case OGS_FSM_ENTRY_SIG:
+        /*
+         * Remove UE context on state entry.
+         *
+         * MME_UE_REMOVE_WITH_PAGING_FAIL() handles corner cases where
+         * paging procedures may still be in progress.
+         */
+        MME_UE_REMOVE_WITH_PAGING_FAIL(mme_ue);
+        break;
+
+    case OGS_FSM_EXIT_SIG:
+        break;
+
+    default:
+        ogs_error("Unknown event%s", mme_event_get_name(e));
+    }
+}
+
 void emm_state_exception(ogs_fsm_t *s, mme_event_t *e)
 {
     int r, rv, xact_count;

open5gs_2.7.7.tar.xz/src/mme/enb-info.c Added

@@ -0,0 +1,243 @@
+/*
+ * Copyright (C) 2025 by Juraj Elias <juraj.elias@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/*
+ * ENB info - MME eNBs JSON dumper for the Prometheus HTTP server (/enb-info).
+ * - enb_id, plmn, s1 info, enb_IP, supported ta_list, num_connceted_ues
+ * - pager: /enb-info?page=0&page_size=100 (0-based, page=-1 without paging) Default: page=0 page_size=100=MAXSIZE
+ *
+ * curl -s "http://127.0.0.2:9090/enb-info?" |jq . 
+ * {
+ *   "items": 
+ *     {
+ *       "enb_id": 264040,
+ *       "plmn": "99970",
+ *       "network": {
+ *         "mme_name": "efire-mme0"
+ *       },
+ *       "s1": {
+ *         "sctp": {
+ *           "peer": "192.168.168.254:36412",
+ *           "max_out_streams": 10,
+ *           "next_ostream_id": 3
+ *         },
+ *         "setup_success": true
+ *       },
+ *       "supported_ta_list": 
+ *         {
+ *           "tac": "0001",
+ *           "plmn": "99970"
+ *         }
+ *       ,
+ *       "num_connected_ues": 1
+ *     }
+ *   ,
+ *   "pager": {
+ *     "page": 0,
+ *     "page_size": 100,
+ *     "count": 1
+ *   }
+ * }
+*/
+
+#include <stdio.h>
+#include <string.h>
+#include <stdbool.h>
+#include <sys/socket.h>
+
+#include "ogs-core.h"
+#include "ogs-proto.h"
+#include "mme-context.h"
+#include "enb-info.h"
+
+#include "sbi/openapi/external/cJSON.h"
+#include "metrics/prometheus/json_pager.h"
+
+#ifndef ENB_INFO_PAGE_SIZE_DEFAULT
+#define ENB_INFO_PAGE_SIZE_DEFAULT 100U
+#endif
+
+
+size_t mme_dump_enb_info(char *buf, size_t buflen, size_t page, size_t page_size)
+{
+    page_size = page_size ? page_size : ENB_INFO_PAGE_SIZE_DEFAULT;
+    if (page_size > ENB_INFO_PAGE_SIZE_DEFAULT) page_size = ENB_INFO_PAGE_SIZE_DEFAULT;
+
+    return mme_dump_enb_info_paged(buf, buflen, page, page_size);
+}
+
+static inline const char *safe_sa_str(const ogs_sockaddr_t *sa)
+{
+    if (!sa) return "";
+    int fam = ((const struct sockaddr *)&sa->sa)->sa_family;
+    if (fam != AF_INET && fam != AF_INET6) return "";
+    return ogs_sockaddr_to_string_static((ogs_sockaddr_t *)sa);
+}
+
+size_t mme_dump_enb_info_paged(char *buf, size_t buflen, size_t page, size_t page_size)
+{
+    if (!buf || buflen == 0) return 0;
+
+    const bool no_paging = (page == SIZE_MAX);
+    if (!no_paging) {
+        if (page_size == 0) page_size = ENB_INFO_PAGE_SIZE_DEFAULT;
+        if (page_size > ENB_INFO_PAGE_SIZE_DEFAULT) page_size = ENB_INFO_PAGE_SIZE_DEFAULT;
+    } else {
+        page_size = SIZE_MAX;
+        page = 0;
+    }
+
+    const size_t start_index = json_pager_safe_start_index(no_paging, page, page_size);
+
+    mme_context_t *ctxt = mme_self();
+
+    /* root */
+    cJSON *root = cJSON_CreateObject();
+    if (!root) {
+        if (buflen >= 3) { memcpy(buf, "{}", 3); return 2; }
+        if (buflen) buf0 = '\0';
+        return 0;
+    }
+
+    /* items array */
+    cJSON *items = cJSON_AddArrayToObject(root, "items");
+    if (!items) {
+        cJSON_Delete(root);
+        if (buflen >= 3) { memcpy(buf, "{}", 3); return 2; }
+        if (buflen) buf0 = '\0';
+        return 0;
+    }
+
+    size_t idx = 0, emitted = 0;
+    bool has_next = false;
+    bool oom = false;
+
+    mme_enb_t *enb = NULL;
+    ogs_list_for_each(&ctxt->enb_list, enb) {
+        int act = json_pager_advance(no_paging, idx, start_index, emitted, page_size, &has_next);
+        if (act == 1) { idx++; continue; }
+        if (act == 2) break;
+
+        /* Count connected UEs on this eNB */
+        size_t num_connected_ues = 0;
+        {
+            enb_ue_t *ue_it = NULL;
+            ogs_list_for_each(&enb->enb_ue_list, ue_it) num_connected_ues++;
+        }
+
+        /* eNB object (build fully before attaching) */
+        cJSON *e = cJSON_CreateObject();
+        if (!e) { oom = true; break; }
+
+        /* enb_id */
+        if (!cJSON_AddNumberToObject(e, "enb_id", (double)(unsigned)enb->enb_id)) { cJSON_Delete(e); oom = true; break; }
+
+        /* plmn */
+        {
+            char plmn_strOGS_PLMNIDSTRLEN = {0};
+            ogs_plmn_id_to_string(&enb->plmn_id, plmn_str);
+            if (!cJSON_AddStringToObject(e, "plmn", plmn_str)) { cJSON_Delete(e); oom = true; break; }
+        }
+
+        /* network */
+        {
+            cJSON *network = cJSON_CreateObject();
+            if (!network) { cJSON_Delete(e); oom = true; break; }
+            if (!cJSON_AddStringToObject(network, "mme_name", ctxt->mme_name ? ctxt->mme_name : "")) {
+                cJSON_Delete(network); cJSON_Delete(e); oom = true; break;
+            }
+            cJSON_AddItemToObjectCS(e, "network", network);
+        }
+
+        /* s1 + sctp block */
+        {
+            cJSON *s1 = cJSON_CreateObject();
+            if (!s1) { cJSON_Delete(e); oom = true; break; }
+
+            if (!cJSON_AddBoolToObject(s1, "setup_success", enb->state.s1_setup_success ? 1 : 0)) {
+                cJSON_Delete(s1); cJSON_Delete(e); oom = true; break;
+            }
+
+            /*  sctp  */
+            cJSON *sctp = cJSON_CreateObject();
+            if (!sctp) { cJSON_Delete(s1); cJSON_Delete(e); oom = true; break; }
+
+            if (!cJSON_AddStringToObject(sctp, "peer", safe_sa_str(enb->sctp.addr))) {
+                cJSON_Delete(sctp); cJSON_Delete(s1); cJSON_Delete(e); oom = true; break;
+            }
+            if (!cJSON_AddNumberToObject(sctp, "max_out_streams", (double)enb->max_num_of_ostreams)) {
+                cJSON_Delete(sctp); cJSON_Delete(s1); cJSON_Delete(e); oom = true; break;
+            }
+            if (!cJSON_AddNumberToObject(sctp, "next_ostream_id", (double)(unsigned)enb->ostream_id)) {
+                cJSON_Delete(sctp); cJSON_Delete(s1); cJSON_Delete(e); oom = true; break;
+            }
+
+            cJSON_AddItemToObjectCS(s1, "sctp", sctp);
+            cJSON_AddItemToObjectCS(e, "s1", s1);
+        }
+
+        /* supported_ta_list (LTE TAC is 16-bit) */
+        {
+            cJSON *tas = cJSON_CreateArray();
+            if (!tas) { cJSON_Delete(e); oom = true; break; }
+
+            bool inner_oom = false;
+            int t;
+
+            for (t = 0; t < enb->num_of_supported_ta_list; t++) {
+                cJSON *ta = cJSON_CreateObject();
+                if (!ta) { inner_oom = true; break; }
+
+                char tac_hex5;
+                snprintf(tac_hex, sizeof tac_hex, "%04X", (unsigned)enb->supported_ta_listt.tac);
+                if (!cJSON_AddStringToObject(ta, "tac", tac_hex)) {
+                    cJSON_Delete(ta); inner_oom = true; break;
+                }
+
+                char ta_plmnOGS_PLMNIDSTRLEN = {0};
+                ogs_plmn_id_to_string(&enb->supported_ta_listt.plmn_id, ta_plmn);
+                if (!cJSON_AddStringToObject(ta, "plmn", ta_plmn)) {
+                    cJSON_Delete(ta); inner_oom = true; break;
+                }
+
+                cJSON_AddItemToArray(tas, ta);
+            }
+
+            if (inner_oom) { cJSON_Delete(tas); cJSON_Delete(e); oom = true; break; }
+
+            cJSON_AddItemToObjectCS(e, "supported_ta_list", tas);
+        }
+
+        /* num_connected_ues */
+        if (!cJSON_AddNumberToObject(e, "num_connected_ues", (double)num_connected_ues)) {
+            cJSON_Delete(e); oom = true; break;
+        }
+
+        /* success -> append to items */
+        cJSON_AddItemToArray(items, e);
+        emitted++;
+        idx++;
+    }
+
+    json_pager_add_trailing(root, no_paging, page, page_size,
+                            emitted, has_next && !oom, "/enb-info", oom);
+
+    return json_pager_finalize(root, buf, buflen);
+}
+

open5gs_2.7.7.tar.xz/src/mme/enb-info.h Added

@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2025 by Juraj Elias <juraj.elias@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+/*
+ * /enb-info — MME-side JSON exporter (Prometheus HTTP endpoint)
+ *
+ * License: AGPLv3+
+ */
+#pragma once
+
+#include <stddef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef ENB_INFO_PAGE_SIZE_DEFAULT
+#define ENB_INFO_PAGE_SIZE_DEFAULT 100U
+#endif
+
+size_t mme_dump_enb_info(char *buf, size_t buflen, size_t page, size_t page_size);
+size_t mme_dump_enb_info_paged(char *buf, size_t buflen, size_t page, size_t page_size);
+
+#ifdef __cplusplus
+}
+#endif
+

open5gs_2.7.6.tar.xz/src/mme/esm-handler.c -> open5gs_2.7.7.tar.xz/src/mme/esm-handler.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2026 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -37,15 +37,25 @@
     mme_ue_t *mme_ue = NULL;
     mme_sess_t *sess = NULL;
     uint8_t security_protected_required = 0;
+    const char *emergency_dnn = mme_self()->emergency.dnn;
+    bool emergency;
 
-    ogs_assert(bearer);
+    ogs_assert(req);
+
+    if (!bearer) {
+        ogs_error("No bearer context");
+        return OGS_NOTFOUND;
+    }
     sess = mme_sess_find_by_id(bearer->sess_id);
-    ogs_assert(sess);
+    if (!sess) {
+        ogs_warn("Session context has already been removed");
+        return OGS_NOTFOUND;
+    }
     mme_ue = mme_ue_find_by_id(sess->mme_ue_id);
-    ogs_assert(mme_ue);
-    ogs_assert(enb_ue);
-
-    ogs_assert(req);
+    if (!mme_ue) {
+        ogs_warn("UE(mme-ue) context has already been removed");
+        return OGS_NOTFOUND;
+    }
 
     ogs_assert(MME_UE_HAVE_IMSI(mme_ue));
 
@@ -87,10 +97,27 @@
                 security_protected_required);
     }
 
-    if (req->presencemask &
-            OGS_NAS_EPS_PDN_CONNECTIVITY_REQUEST_ACCESS_POINT_NAME_PRESENT) {
-        sess->session = mme_session_find_by_apn(
-                            mme_ue, req->access_point_name.apn);
+    emergency = (req->request_type.value == OGS_NAS_EPS_REQUEST_TYPE_EMERGENCY);
+    if (emergency && !emergency_dnn) {
+        /* Emergency call, but no emergency APN defined */
+        r = nas_eps_send_pdn_connectivity_reject(
+                sess, OGS_NAS_ESM_CAUSE_REQUEST_REJECTED_UNSPECIFIED, create_action);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        ogs_warn("Emergency call, but no emergency APN defined");
+        return OGS_ERROR;
+    }
+    if ((req->presencemask &
+            OGS_NAS_EPS_PDN_CONNECTIVITY_REQUEST_ACCESS_POINT_NAME_PRESENT) ||
+        emergency) {
+        const char *apn;
+        if (emergency) {
+            apn = emergency_dnn;
+            sess->ue_request_type.value = 1;
+        } else {
+            apn = req->access_point_name.apn;
+        }
+        sess->session = mme_session_find_by_apn(mme_ue, apn);
         if (!sess->session) {
             /* Invalid APN */
             r = nas_eps_send_pdn_connectivity_reject(
@@ -98,7 +125,7 @@
                     create_action);
             ogs_expect(r == OGS_OK);
             ogs_assert(r != OGS_ERROR);
-            ogs_warn("Invalid APN%s", req->access_point_name.apn);
+            ogs_warn("Invalid APN%s", apn);
             return OGS_ERROR;
         }
 
@@ -196,13 +223,18 @@
     int r;
     mme_ue_t *mme_ue = NULL;
 
-    ogs_assert(sess);
-    mme_ue = mme_ue_find_by_id(sess->mme_ue_id);
-    ogs_assert(mme_ue);
-    ogs_assert(enb_ue);
-
     ogs_assert(rsp);
 
+    if (!sess) {
+        ogs_warn("Session context has already been removed");
+        return OGS_NOTFOUND;
+    }
+    mme_ue = mme_ue_find_by_id(sess->mme_ue_id);
+    if (!mme_ue) {
+        ogs_warn("UE(mme-ue) context has already been removed");
+        return OGS_NOTFOUND;
+    }
+
     if (rsp->presencemask &
             OGS_NAS_EPS_ESM_INFORMATION_RESPONSE_ACCESS_POINT_NAME_PRESENT) {
         sess->session = mme_session_find_by_apn(
@@ -294,12 +326,20 @@
     mme_ue_t *mme_ue = NULL;
     mme_sess_t *sess = NULL;
 
-    ogs_assert(bearer);
+    if (!bearer) {
+        ogs_error("No bearer context");
+        return OGS_NOTFOUND;
+    }
     sess = mme_sess_find_by_id(bearer->sess_id);
-    ogs_assert(sess);
+    if (!sess) {
+        ogs_warn("Session context has already been removed");
+        return OGS_NOTFOUND;
+    }
     mme_ue = mme_ue_find_by_id(sess->mme_ue_id);
-    ogs_assert(mme_ue);
-    ogs_assert(enb_ue);
+    if (!mme_ue) {
+        ogs_warn("UE(mme-ue) context has already been removed");
+        return OGS_NOTFOUND;
+    }
 
     r = nas_eps_send_bearer_resource_allocation_reject(
             mme_ue, sess->pti, OGS_NAS_ESM_CAUSE_NETWORK_FAILURE);
@@ -314,10 +354,15 @@
 {
     mme_ue_t *mme_ue = NULL;
 
-    ogs_assert(bearer);
+    if (!bearer) {
+        ogs_error("No bearer context");
+        return OGS_NOTFOUND;
+    }
     mme_ue = mme_ue_find_by_id(bearer->mme_ue_id);
-    ogs_assert(mme_ue);
-    ogs_assert(enb_ue);
+    if (!mme_ue) {
+        ogs_warn("UE(mme-ue) context has already been removed");
+        return OGS_NOTFOUND;
+    }
 
     ogs_assert(OGS_OK ==
         mme_gtp_send_bearer_resource_command(bearer, message));

open5gs_2.7.6.tar.xz/src/mme/esm-sm.c -> open5gs_2.7.7.tar.xz/src/mme/esm-sm.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2026 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -103,7 +103,11 @@
         ogs_assert(message);
 
         enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);
-        ogs_assert(enb_ue);
+        if (!enb_ue)
+            ogs_warn("No eNB-UE context; dropping ESM message(type:%d) "
+                    "IMSI%s PTI%d EBI%d",
+                    message->esm.h.message_type,
+                    mme_ue->imsi_bcd, sess->pti, bearer->ebi);
 
         switch (message->esm.h.message_type) {
         case OGS_NAS_EPS_PDN_CONNECTIVITY_REQUEST:
@@ -148,13 +152,10 @@
             CLEAR_BEARER_TIMER(bearer->t3489);
 
             h.type = e->nas_type;
-            enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);
 
             if (h.integrity_protected == 0) {
                 ogs_error("%s No Integrity Protected", mme_ue->imsi_bcd);
 
-                ogs_assert(enb_ue);
-
                 r = nas_eps_send_attach_reject(enb_ue, mme_ue,
                         OGS_NAS_EMM_CAUSE_SECURITY_MODE_REJECTED_UNSPECIFIED,
                         OGS_NAS_ESM_CAUSE_PROTOCOL_ERROR_UNSPECIFIED);
@@ -172,8 +173,6 @@
             if (!SECURITY_CONTEXT_IS_VALID(mme_ue)) {
                 ogs_warn("%s No Security Context", mme_ue->imsi_bcd);
 
-                ogs_assert(enb_ue);
-
                 r = nas_eps_send_attach_reject(enb_ue, mme_ue,
                         OGS_NAS_EMM_CAUSE_SECURITY_MODE_REJECTED_UNSPECIFIED,
                         OGS_NAS_ESM_CAUSE_PROTOCOL_ERROR_UNSPECIFIED);
@@ -309,13 +308,17 @@
         ogs_assert(message);
 
         enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);
+        if (!enb_ue)
+            ogs_warn("No eNB-UE context; dropping ESM message(type:%d) "
+                    "IMSI%s PTI%d EBI%d",
+                    message->esm.h.message_type,
+                    mme_ue->imsi_bcd, sess->pti, bearer->ebi);
 
         switch (message->esm.h.message_type) {
         case OGS_NAS_EPS_PDN_CONNECTIVITY_REQUEST:
             ogs_debug("PDN Connectivity request");
             ogs_debug("    IMSI%s PTI%d EBI%d",
                     mme_ue->imsi_bcd, sess->pti, bearer->ebi);
-            ogs_assert(enb_ue);
             rv = esm_handle_pdn_connectivity_request(
                     enb_ue, bearer, &message->esm.pdn_connectivity_request,
                     e->create_action);
@@ -331,7 +334,6 @@
             ogs_debug("    IMSI%s PTI%d EBI%d",
                     mme_ue->imsi_bcd, sess->pti, bearer->ebi);
 
-            ogs_assert(enb_ue);
             if (MME_HAVE_SGW_S1U_PATH(sess)) {
                 sgw_ue = sgw_ue_find_by_id(mme_ue->sgw_ue_id);
                 ogs_assert(sgw_ue);
@@ -373,7 +375,6 @@
             ogs_debug("Bearer resource allocation request");
             ogs_debug("    IMSI%s PTI%d EBI%d",
                     mme_ue->imsi_bcd, sess->pti, bearer->ebi);
-            ogs_assert(enb_ue);
             esm_handle_bearer_resource_allocation_request(
                     enb_ue, bearer, message);
             break;
@@ -381,7 +382,6 @@
             ogs_debug("Bearer resource modification request");
             ogs_debug("    IMSI%s PTI%d EBI%d",
                     mme_ue->imsi_bcd, sess->pti, bearer->ebi);
-            ogs_assert(enb_ue);
             esm_handle_bearer_resource_modification_request(
                     enb_ue, bearer, message);
             break;
@@ -428,7 +428,11 @@
         ogs_assert(message);
 
         enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);
-        ogs_assert(enb_ue);
+        if (!enb_ue)
+            ogs_warn("No eNB-UE context; dropping ESM message(type:%d) "
+                    "IMSI%s PTI%d EBI%d",
+                    message->esm.h.message_type,
+                    mme_ue->imsi_bcd, sess->pti, bearer->ebi);
 
         switch (message->esm.h.message_type) {
         case OGS_NAS_EPS_DEACTIVATE_EPS_BEARER_CONTEXT_ACCEPT:

open5gs_2.7.6.tar.xz/src/mme/meson.build -> open5gs_2.7.7.tar.xz/src/mme/meson.build Changed

open5gs_2.7.6.tar.xz/src/mme/mme-context.c -> open5gs_2.7.7.tar.xz/src/mme/mme-context.c Changed

@@ -53,6 +53,7 @@
 static OGS_POOL(sgw_ue_pool, sgw_ue_t);
 static OGS_POOL(mme_sess_pool, mme_sess_t);
 static OGS_POOL(mme_bearer_pool, mme_bearer_t);
+static OGS_POOL(mme_emerg_pool, mme_emerg_t);
 
 static OGS_POOL(m_tmsi_pool, mme_m_tmsi_t);
 
@@ -99,6 +100,7 @@
     ogs_list_init(&self.vlr_list);
     ogs_list_init(&self.csmap_list);
     ogs_list_init(&self.hssmap_list);
+    ogs_list_init(&self.emerg_list);
 
     ogs_pool_init(&mme_sgsn_route_pool, ogs_app()->pool.nf);
     ogs_pool_init(&mme_sgsn_pool, ogs_app()->pool.nf);
@@ -107,6 +109,7 @@
     ogs_pool_init(&mme_vlr_pool, ogs_app()->pool.nf);
     ogs_pool_init(&mme_csmap_pool, ogs_app()->pool.csmap);
     ogs_pool_init(&mme_hssmap_pool, ogs_app()->pool.nf);
+    ogs_pool_init(&mme_emerg_pool, ogs_app()->pool.emerg);
 
     /* Allocate TWICE the pool to check if maximum number of eNBs is reached */
     ogs_pool_init(&mme_enb_pool, ogs_global_conf()->max.peer*2);
@@ -159,6 +162,7 @@
     mme_vlr_remove_all();
     mme_sgsn_remove_all();
     mme_hssmap_remove_all();
+    mme_emerg_remove_all();
 
     ogs_assert(self.enb_addr_hash);
     ogs_hash_destroy(self.enb_addr_hash);
@@ -175,6 +179,7 @@
     ogs_hash_destroy(self.mme_gn_teid_hash);
 
     ogs_pool_final(&m_tmsi_pool);
+    ogs_pool_final(&mme_emerg_pool);
     ogs_pool_final(&mme_bearer_pool);
     ogs_pool_final(&mme_sess_pool);
     ogs_pool_final(&mme_ue_pool);
@@ -2530,6 +2535,97 @@
                     }
                 } else if (!strcmp(mme_key, "metrics")) {
                     /* handle config in metrics library */
+                } else if (!strcmp(mme_key, "emergency")) {
+                    ogs_yaml_iter_t emerg_iter;
+                    ogs_yaml_iter_recurse(&mme_iter, &emerg_iter);
+                    while (ogs_yaml_iter_next(&emerg_iter)) {
+                        const char *emerg_key = ogs_yaml_iter_key(&emerg_iter);
+                        ogs_assert(emerg_key);
+                        if (!strcmp(emerg_key, "dnn")) {
+                                const char *dnn = ogs_yaml_iter_value(&emerg_iter);
+                                ogs_assert(dnn);
+                                self.emergency.dnn = dnn;
+                        } else if (!strcmp(emerg_key, "number")) {
+                            ogs_yaml_iter_t number_array, number_iter;
+                            ogs_yaml_iter_recurse(&emerg_iter, &number_array);
+                            do {
+                                const char *digits = NULL;
+                                uint8_t categories = 0;
+
+                                if (ogs_yaml_iter_type(&number_array) ==
+                                        YAML_MAPPING_NODE) {
+                                    memcpy(&number_iter, &number_array,
+                                            sizeof(ogs_yaml_iter_t));
+                                } else if (ogs_yaml_iter_type(&number_array) ==
+                                        YAML_SEQUENCE_NODE) {
+                                    if (!ogs_yaml_iter_next(&number_array))
+                                        break;
+                                    ogs_yaml_iter_recurse(&number_array, &number_iter);
+                                } else if (ogs_yaml_iter_type(&number_array) ==
+                                        YAML_SCALAR_NODE) {
+                                    break;
+                                } else
+                                    ogs_assert_if_reached();
+
+                                while (ogs_yaml_iter_next(&number_iter)) {
+                                    const char *number_key =
+                                        ogs_yaml_iter_key(&number_iter);
+                                    ogs_assert(number_key);
+                                    if (!strcmp(number_key, "digits")) {
+                                        digits = ogs_yaml_iter_value(&number_iter);
+                                    } else if (!strcmp(number_key, "categories")) {
+                                        ogs_yaml_iter_t categories_iter;
+                                        ogs_yaml_iter_recurse(&number_iter,
+                                                &categories_iter);
+                                        ogs_assert(ogs_yaml_iter_type(
+                                                &categories_iter) != YAML_MAPPING_NODE);
+
+                                        do {
+                                            const char *v = NULL;
+
+                                            if (ogs_yaml_iter_type(&categories_iter) ==
+                                                    YAML_SEQUENCE_NODE) {
+                                                if (!ogs_yaml_iter_next(
+                                                            &categories_iter))
+                                                    break;
+                                            }
+
+                                            v = ogs_yaml_iter_value(&categories_iter);
+                                            if (v) {
+                                                if (strstr(v, "police")) {
+                                                    categories |=
+                                                        OGS_NAS_SERVICE_CATEGORY_POLICE;
+                                                } else if (strstr(v, "ambulance")) {
+                                                    categories |=
+                                                        OGS_NAS_SERVICE_CATEGORY_AMBULANCE;
+                                                } else if (strstr(v, "fire")) {
+                                                    categories |=
+                                                        OGS_NAS_SERVICE_CATEGORY_FIRE_BRIGADE;
+                                                } else if (strstr(v, "marine")) {
+                                                    categories |=
+                                                        OGS_NAS_SERVICE_CATEGORY_MARINE_GUARD;
+                                                } else if (strstr(v, "mountain")) {
+                                                    categories |=
+                                                        OGS_NAS_SERVICE_CATEGORY_MOUNTAIN_RESCUE;
+                                                } else {
+                                                    categories = strtol(v, NULL, 0);
+                                                    if (categories < 1 || categories > 0x1f)
+                                                        ogs_warn("invalid categories `%s`", v);
+                                                }
+                                            }
+                                        } while (
+                                            ogs_yaml_iter_type(&categories_iter) ==
+                                                YAML_SEQUENCE_NODE);
+                                    } else
+                                        ogs_warn("unknown key `%s`", number_key);
+                                }
+                                if (digits && categories > 0 && categories <= 0x1f)
+                                    mme_emerg_add(categories, digits);
+                            } while (ogs_yaml_iter_type(&number_array) ==
+                                YAML_SEQUENCE_NODE);
+                        } else
+                            ogs_warn("unknown key `%s`", emerg_key);
+                    }
                 } else
                     ogs_warn("unknown key `%s`", mme_key);
             }
@@ -3139,6 +3235,12 @@
 
     ogs_assert(enb);
 
+    if ((enb->max_num_of_ostreams - 1) < 1) {
+        ogs_error("enb->max_num_of_ostreams too small (%d)",
+                enb->max_num_of_ostreams);
+        return NULL;
+    }
+
     ogs_pool_id_calloc(&enb_ue_pool, &enb_ue);
     if (enb_ue == NULL) {
         ogs_error("Could not allocate enb_ue context from pool");
@@ -3166,7 +3268,6 @@
      *   0 : Non UE signalling
      *   1-29 : UE specific association
      */
-    ogs_assert((enb->max_num_of_ostreams-1) >= 1); /* NEXT_ID(MAX >= MIN) */
     enb_ue->enb_ostream_id =
         OGS_NEXT_ID(enb->ostream_id, 1, enb->max_num_of_ostreams-1);
 
@@ -3584,8 +3685,6 @@
     }
     mme_ue->gn.gtp_xact_id = OGS_INVALID_POOL_ID;
 
-    mme_ebi_pool_init(mme_ue);
-
     ogs_list_init(&mme_ue->sess_list);
 
     /* Set MME-S11-TEID */
@@ -3697,8 +3796,6 @@
     mme_sess_remove_all(mme_ue);
     mme_session_remove_all(mme_ue);
 
-    mme_ebi_pool_final(mme_ue);
-
     ogs_pool_free(&mme_s11_teid_pool, mme_ue->mme_s11_teid_node);
     ogs_pool_free(&mme_gn_teid_pool, mme_ue->gn.mme_gn_teid_node);
     ogs_pool_id_free(&mme_ue_pool, mme_ue);
@@ -3966,6 +4063,25 @@
     sgw_ue_t *sgw_ue = NULL, *old_sgw_ue = NULL;
     ogs_assert(mme_ue && imsi_bcd);
 
+    /*
+     * Issues: #4357
+     *
+     * Remove the old IMSI hash entry BEFORE overwriting mme_ue->imsi.
+     *
+     * Previously, the hash removal at the end of this function used
+     * mme_ue->imsi AFTER it had already been overwritten with the new IMSI,
+     * so the OLD IMSI entry was never actually removed from the hash table.
+     *
+     * This caused a dangling pointer: the old IMSI key still pointed to
+     * this mme_ue_t, and after mme_ue_remove() freed the object (with
+     * mme_ue_fsm_fini()), a subsequent lookup by the old IMSI would return
+     * a context with an invalid FSM state, leading to ogs_assert_if_reached()
+     * in mme_state_operational().
+     */
+    if (mme_ue->imsi_len != 0)
+        ogs_hash_set(mme_self()->imsi_ue_hash,
+                mme_ue->imsi, mme_ue->imsi_len, NULL);
+
     ogs_cpystrn(mme_ue->imsi_bcd, imsi_bcd, OGS_MAX_IMSI_BCD_LEN+1);
     ogs_bcd_to_buffer(mme_ue->imsi_bcd, mme_ue->imsi, &mme_ue->imsi_len);
 
@@ -4009,10 +4125,12 @@
                 ogs_list_for_each(&old_sess->bearer_list, old_bearer) {
                     old_bearer->mme_ue_id = mme_ue->id;
 
-                    if (old_bearer->ebi_node)
-                        ogs_pool_free(
-                                &old_mme_ue->ebi_pool, old_bearer->ebi_node);
-                    old_bearer->ebi_node = NULL;
+                    if (mme_ebi_reserve(mme_ue, old_bearer->ebi) == OGS_OK)
+                        ogs_info("Bearer reserved (EBI=%d IMSI=%s)",
+                                old_bearer->ebi, mme_ue->imsi_bcd);
+                    else
+                        ogs_error("Failed to reserve bearer (EBI=%d IMSI=%s)",
+                                old_bearer->ebi, mme_ue->imsi_bcd);
                 }
                 old_sess->mme_ue_id = mme_ue->id;
             }
@@ -4035,10 +4153,8 @@
         }
     }
 
-    if (mme_ue->imsi_len != 0)
-        ogs_hash_set(mme_self()->imsi_ue_hash,
-                mme_ue->imsi, mme_ue->imsi_len, NULL);
-
+    /* Register new IMSI in hash.
+     * Old IMSI hash entry was already removed at the top of this function. */
     ogs_hash_set(self.imsi_ue_hash, mme_ue->imsi, mme_ue->imsi_len, mme_ue);
 
     mme_ue->hssmap = mme_hssmap_find_by_imsi_bcd(mme_ue->imsi_bcd);
@@ -4466,13 +4582,19 @@
 
     ogs_list_init(&bearer->update.xact_list);
 
-    ogs_pool_alloc(&mme_ue->ebi_pool, &bearer->ebi_node);
-    ogs_assert(bearer->ebi_node);
-
-    bearer->ebi = *(bearer->ebi_node);
+    /*
+     * Allocate a new EBI from the UE bitmap.
+     * If all EBIs are exhausted, reject bearer creation.
+     */
+    bearer->ebi = mme_ebi_alloc(mme_ue);
+    if (bearer->ebi == INVALID_EPS_BEARER_ID) {
+        ogs_error("Bearer add failed: EBI pool exhausted (IMSI=%s)",
+                mme_ue->imsi_bcd);
+        ogs_pool_free(&mme_bearer_pool, bearer);
+        return NULL;
+    }
 
-    ogs_assert(bearer->ebi >= MIN_EPS_BEARER_ID &&
-                bearer->ebi <= MAX_EPS_BEARER_ID);
+    ogs_info("Bearer added (EBI=%d IMSI=%s)", bearer->ebi, mme_ue->imsi_bcd);
 
     bearer->mme_ue_id = mme_ue->id;
     bearer->sess_id = sess->id;
@@ -4504,6 +4626,8 @@
     sess = mme_sess_find_by_id(bearer->sess_id);
     ogs_assert(sess);
 
+    ogs_info("Bearer removed (EBI=%d IMSI=%s)", bearer->ebi, mme_ue->imsi_bcd);
+
     memset(&e, 0, sizeof(e));
     e.bearer_id = bearer->id;
     ogs_fsm_fini(&bearer->sm, &e);
@@ -4515,8 +4639,7 @@
 
     OGS_TLV_CLEAR_DATA(&bearer->tft);
 
-    if (bearer->ebi_node)
-        ogs_pool_free(&mme_ue->ebi_pool, bearer->ebi_node);
+    ogs_expect(OGS_OK == mme_ebi_free(mme_ue, bearer->ebi));
 
     ogs_list_for_each_entry_safe(&bearer->update.xact_list,
             next_xact, xact, to_update_node) {
@@ -4720,7 +4843,8 @@
                     pdn_connectivity_request->access_point_name.apn);
                 return NULL;
             }
-        } else {
+        } else if (pdn_connectivity_request->request_type.value !=
+                OGS_NAS_EPS_REQUEST_TYPE_EMERGENCY) {
             sess = mme_sess_first(mme_ue);
             ogs_debug("%s:%p", mme_ue->imsi_bcd, mme_ue);
             if (sess) {
@@ -4899,8 +5023,10 @@
             ogs_assert(list1->taij.type == OGS_TAI1_TYPE);
             ogs_assert(list1->taij.num <= OGS_MAX_NUM_OF_TAI);
 
-            if (list1->taij.tac <= tai->tac &&
-                tai->tac < (list1->taij.tac+list1->taij.num))
+            if (memcmp(&list1->taij.plmn_id,
+                        &tai->plmn_id, OGS_PLMN_ID_LEN) == 0 &&
+                    list1->taij.tac <= tai->tac &&
+                    tai->tac < (list1->taij.tac+list1->taij.num))
                 return i;
         }
 
@@ -5004,36 +5130,73 @@
     return OGS_OK;
 }
 
-void mme_ebi_pool_init(mme_ue_t *mme_ue)
+/*
+ * EPS Bearer ID (EBI) management
+ *
+ * In EPC, valid EBIs are in range 5..15.
+ * Each UE can have at most 11 bearers.
+ *
+ * We track EBI usage with a bitmap rather than ogs_pool nodes,
+ * because bearer contexts may migrate between MME-UE objects
+ * during UE context relocation (OLD UE -> NEW UE).
+ *
+ * Bitmap-based tracking avoids ownership issues with pool-internal
+ * pointers (ebi_node) and supports safe EBI reservation.
+ */
+uint8_t mme_ebi_alloc(mme_ue_t *mme_ue)
 {
-    int i, index;
+    uint8_t ebi;
 
     ogs_assert(mme_ue);
 
-    ogs_pool_create(&mme_ue->ebi_pool, MAX_EPS_BEARER_ID-MIN_EPS_BEARER_ID+1);
+    for (ebi = MIN_EPS_BEARER_ID; ebi <= MAX_EPS_BEARER_ID; ebi++) {
 
-    for (i = MIN_EPS_BEARER_ID, index = 0;
-            i <= MAX_EPS_BEARER_ID; i++, index++) {
-        mme_ue->ebi_pool.arrayindex = i;
+        if (!(mme_ue->ebi_bitmap & (1 << ebi))) {
+            mme_ue->ebi_bitmap |= (1 << ebi);
+            ogs_debug("EBI allocated %d", ebi);
+            return ebi;
+        }
     }
+
+    ogs_error("No available EBI (range %d-%d)",
+            MIN_EPS_BEARER_ID, MAX_EPS_BEARER_ID);
+
+    return INVALID_EPS_BEARER_ID; /* no available EBI */
 }
 
-void mme_ebi_pool_final(mme_ue_t *mme_ue)
+int mme_ebi_free(mme_ue_t *mme_ue, int ebi)
 {
     ogs_assert(mme_ue);
 
-    ogs_pool_destroy(&mme_ue->ebi_pool);
+    if (ebi < MIN_EPS_BEARER_ID || ebi > MAX_EPS_BEARER_ID) {
+        ogs_error("Invalid EBI to free %d", ebi);
+        return OGS_ERROR;
+    }
+
+    mme_ue->ebi_bitmap &= ~(1 << ebi);
+
+    ogs_debug("EBI freed %d", ebi);
+
+    return OGS_OK;
 }
 
-void mme_ebi_pool_clear(mme_ue_t *mme_ue)
+int mme_ebi_reserve(mme_ue_t *mme_ue, int ebi)
 {
     ogs_assert(mme_ue);
 
-    /* Suppress log message (mme_ue->ebi_pool.avail != mme_ue->ebi_pool.size) */
-    mme_ue->ebi_pool.avail = mme_ue->ebi_pool.size;
+    if (ebi < MIN_EPS_BEARER_ID || ebi > MAX_EPS_BEARER_ID) {
+        ogs_error("Invalid EBI to reserve %d", ebi);
+        return OGS_ERROR;
+    }
+
+    if (mme_ue->ebi_bitmap & (1 << ebi)) {
+        ogs_error("EBI %d already reserved", ebi);
+        return OGS_ERROR;
+    }
 
-    mme_ebi_pool_final(mme_ue);
-    mme_ebi_pool_init(mme_ue);
+    mme_ue->ebi_bitmap |= (1 << ebi);
+    ogs_debug("EBI reserved %d", ebi);
+    return OGS_OK;
 }
 
 uint8_t mme_selected_int_algorithm(mme_ue_t *mme_ue)
@@ -5172,3 +5335,56 @@
     num_of_mme_sess = num_of_mme_sess - 1;
     ogs_info("Removed Number of MME-Sessions is now %d", num_of_mme_sess);
 }
+
+/*--------------------------------------------------------------
+ *  Emergency Number (EMERG) Management Functions
+ *-------------------------------------------------------------*/
+mme_emerg_t *mme_emerg_add(uint8_t categories, const char *digits)
+{
+    mme_emerg_t *emerg = NULL;
+
+    ogs_pool_id_calloc(&mme_emerg_pool, &emerg);
+
+    /* Try to allocate an emergency entry from the pool */
+    if (!emerg) {
+        ogs_error("Failed to allocate mme_emerg_t from mme_emerg_pool");
+        return NULL;
+    }
+
+    /* Set attributes */
+    emerg->categories = categories;
+    emerg->digits = digits;
+
+    /* Add to the golbal emergency list */
+    ogs_list_add(&self.emerg_list, emerg);
+
+    ogs_debug("Added Emergency Number %s (categories 0x%02x)",
+            digits, categories);
+
+    return emerg;
+}
+
+void mme_emerg_remove(mme_emerg_t *emerg)
+{
+    if (!emerg)
+        return;
+
+    /* Remove from the list */
+    ogs_list_remove(&self.emerg_list, emerg);
+
+    /* Release object back to the pool */
+    ogs_pool_id_free(&mme_emerg_pool, emerg);
+
+    ogs_debug("Emergency number entry removed");
+}
+
+void mme_emerg_remove_all(void)
+{
+    mme_emerg_t *emerg, *tmp;
+
+    /* Iterate safely and free all entries */
+    ogs_list_for_each_safe(&self.emerg_list, tmp, emerg)
+        ogs_pool_id_free(&mme_emerg_pool, emerg);
+
+    ogs_debug("All emergency number entries removed");
+}

open5gs_2.7.6.tar.xz/src/mme/mme-context.h -> open5gs_2.7.7.tar.xz/src/mme/mme-context.h Changed

@@ -100,6 +100,8 @@
     ogs_list_t      csmap_list;     /* TAI-LAI Map List */
     ogs_list_t      hssmap_list;    /* PLMN HSS Map List */
 
+    ogs_list_t      emerg_list;     /* Emergency number list */
+
     /* Served GUMME */
     int             num_of_served_gummei;
     served_gummei_t served_gummeiOGS_MAX_NUM_OF_SERVED_GUMMEI;
@@ -163,6 +165,10 @@
             ogs_time_t value;       /* Timer Value(Seconds) */
         } t3402, t3412, t3423;
     } time;
+
+    struct {
+        const char *dnn;            /* Emergency APN */
+    } emergency;
 } mme_context_t;
 
 typedef struct mme_sgsn_route_s {
@@ -267,6 +273,15 @@
 
 } mme_enb_t;
 
+typedef struct mme_emerg_s {
+    ogs_lnode_t     lnode;
+    ogs_pool_id_t   id;
+
+    uint8_t         categories; /* Service categories */
+    const char      *digits;    /* Emergency number */
+
+} mme_emerg_t;
+
 struct enb_ue_s {
     ogs_lnode_t     lnode;
     ogs_pool_id_t   id;
@@ -431,10 +446,10 @@
         ogs_nas_detach_type_t detach;
     } nas_eps;
 
-#define MME_TAU_TYPE_INITIAL_UE_MESSAGE    1
-#define MME_TAU_TYPE_UPLINK_NAS_TRANPORT   2
-#define MME_TAU_TYPE_UNPROTECTED_INGERITY  3
-    uint8_t tracking_area_update_request_type;
+    uint64_t tracking_area_update_request_presencemask;
+    uint16_t tracking_area_update_request_ebcs_value;
+    S1AP_ProcedureCode_t tracking_area_update_accept_proc;
+
 
     /* 1. MME initiated detach request to the UE.
      *    (nas_eps.type = MME_EPS_TYPE_DETACH_REQUEST_TO_UE)
@@ -525,9 +540,25 @@
     int             security_context_available;
     int             mac_failed;
 
+    /* Authentication synch failure counter */
+    uint8_t auth_synch_fail_count;
+
     /* flag: 1 = allow restoration of context, 0 = disallow */
     bool            can_restore_context;
 
+    /*
+     * ue_context_will_remove:
+     *
+     * Set when the UE context must be removed locally after the current
+     * EMM event completes, but we must not free the UE context inside
+     * the ongoing procedure.
+     *
+     * This flag is used to defer UE context removal to a dedicated EMM
+     * state (emm_state_ue_context_will_remove) to avoid use-after-free
+     * and double-free scenarios in implicit detach paths.
+     */
+    bool            ue_context_will_remove;
+
     /* Memento of context fields */
     mme_ue_memento_t memento;
 
@@ -603,15 +634,17 @@
     /* ESM Info */
     ogs_list_t      sess_list;
 
+#define INVALID_EPS_BEARER_ID       0
 #define MIN_EPS_BEARER_ID           5
 #define MAX_EPS_BEARER_ID           15
 
 #define CLEAR_EPS_BEARER_ID(__mME) \
     do { \
         ogs_assert((__mME)); \
-        mme_ebi_pool_clear(__mME); \
+        (__mME)->ebi_bitmap = 0; \
     } while(0)
-    OGS_POOL(ebi_pool, uint8_t);
+
+    uint16_t ebi_bitmap; /* bit5~bit15 used */
 
     /* Paging Info */
 #define ECM_CONNECTED(__mME) \
@@ -799,6 +832,7 @@
 
 #define GTP_COUNTER_CREATE_SESSION_BY_PATH_SWITCH               1
 #define GTP_COUNTER_DELETE_SESSION_BY_PATH_SWITCH               2
+#define GTP_COUNTER_DELETE_SESSION_BY_TAU                       3
     struct {
         uint8_t request;
         uint8_t response;
@@ -810,6 +844,15 @@
     mme_hssmap_t    *hssmap;
 };
 
+#define MME_UE_REMOVE_WITH_PAGING_FAIL(__mME) \
+    do { \
+        if (MME_PAGING_ONGOING(__mME)) { \
+            ogs_error("Paging is ON-Going %d", (__mME)->paging.type); \
+            mme_send_after_paging(__mME, false); \
+        } \
+        mme_ue_remove(__mME); \
+    } while(0)
+
 #define SESSION_CONTEXT_IS_AVAILABLE(__mME) \
     ((__mME) && \
      ((__mME)->sgw_ue_id >= OGS_MIN_POOL_ID) && \
@@ -928,7 +971,6 @@
 
     ogs_fsm_t       sm;             /* State Machine */
 
-    uint8_t         *ebi_node;      /* Pool-Node for EPS Bearer ID */
     uint8_t         ebi;            /* EPS Bearer ID */
 
     uint32_t        enb_s1u_teid;
@@ -1206,9 +1248,9 @@
 mme_m_tmsi_t *mme_m_tmsi_alloc(void);
 int mme_m_tmsi_free(mme_m_tmsi_t *tmsi);
 
-void mme_ebi_pool_init(mme_ue_t *mme_ue);
-void mme_ebi_pool_final(mme_ue_t *mme_ue);
-void mme_ebi_pool_clear(mme_ue_t *mme_ue);
+uint8_t mme_ebi_alloc(mme_ue_t *mme_ue);
+int mme_ebi_free(mme_ue_t *mme_ue, int ebi);
+int mme_ebi_reserve(mme_ue_t *mme_ue, int ebi);
 
 uint8_t mme_selected_int_algorithm(mme_ue_t *mme_ue);
 uint8_t mme_selected_enc_algorithm(mme_ue_t *mme_ue);
@@ -1216,6 +1258,10 @@
 void mme_ue_save_memento(mme_ue_t *mme_ue, mme_ue_memento_t *memento);
 void mme_ue_restore_memento(mme_ue_t *mme_ue, const mme_ue_memento_t *memento);
 
+mme_emerg_t *mme_emerg_add(uint8_t categories, const char *digits);
+void mme_emerg_remove(mme_emerg_t *emerg);
+void mme_emerg_remove_all(void);
+
 #ifdef __cplusplus
 }
 #endif

open5gs_2.7.6.tar.xz/src/mme/mme-fd-path.c -> open5gs_2.7.7.tar.xz/src/mme/mme-fd-path.c Changed

@@ -1,5 +1,5 @@
-/*
- * Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
+/* 3GPP TS 29.272 S6a
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -424,8 +424,13 @@
                     ogs_assert(ret == 0);
                     switch(hdr->avp_code) {
                     case OGS_DIAM_S6A_AVP_CODE_SERVED_PARTY_IP_ADDRESS:
+                        memset(&addr, 0, sizeof(addr));
                         ret = fd_msg_avp_value_interpret(avpch3, &addr.sa);
-                        ogs_assert(ret == 0);
+                        if (ret != 0) {
+                            ogs_warn("Ignore malformed "
+                                    "Served-Party-IP-Address AVP");
+                            break;
+                        }
 
                         if (addr.ogs_sa_family == AF_INET) {
                             session->ue_ip.addr = addr.sin.sin_addr.s_addr;
@@ -451,7 +456,8 @@
                                     "IPv6. Ignoring...", session->session_type);
                             }
                         } else {
-                            ogs_error("Invalid family%d",
+                            ogs_warn("Invalid family%d in "
+                                    "Served-Party-IP-Address",
                                     addr.ogs_sa_family);
                         }
                         break;
@@ -613,27 +619,27 @@
                         ogs_assert(ret == 0);
                         switch(hdr->avp_code) {
                         case OGS_DIAM_S6A_AVP_CODE_MIP_HOME_AGENT_ADDRESS:
+                            memset(&addr, 0, sizeof(addr));
                             ret = fd_msg_avp_value_interpret(avpch4,
                                     &addr.sa);
-                            ogs_assert(ret == 0);
-                            if (addr.ogs_sa_family == AF_INET)
-                            {
+                            if (ret != 0) {
+                                ogs_warn("Ignore malformed "
+                                    "MIP-Home-Agent-Address AVP");
+                                break;
+                            }
+                            if (addr.ogs_sa_family == AF_INET) {
                                 session->smf_ip.ipv4 = 1;
                                 session->smf_ip.addr =
                                     addr.sin.sin_addr.s_addr;
-                            }
-                            else if (addr.ogs_sa_family == AF_INET6)
-                            {
+                            } else if (addr.ogs_sa_family == AF_INET6) {
                                 session->smf_ip.ipv6 = 1;
                                 memcpy(session->smf_ip.addr6,
                                     addr.sin6.sin6_addr.s6_addr,
                                     OGS_IPV6_LEN);
-                            }
-                            else
-                            {
-                                ogs_error("Invald family:%d",
+                            } else {
+                                ogs_warn("Invald family%d "
+                                        "in MIP-Home-Agent-Address",
                                         addr.ogs_sa_family);
-                                error++;
                             }
                             break;
                         case OGS_DIAM_S6A_AVP_CODE_MIP_HOME_AGENT_HOST:
@@ -882,24 +888,36 @@
 /* MME received Authentication Information Answer from HSS */
 static void mme_s6a_aia_cb(void *data, struct msg **msg)
 {
-    int ret;
-
-    struct sess_state *sess_data = NULL;
+    int ret, rv, new;
+    struct sess_state *sess_data;
     struct timespec ts;
     struct session *session;
     struct avp *avp, *avpch;
     struct avp *avp_e_utran_vector, *avp_xres, *avp_kasme, *avp_rand, *avp_autn;
     struct avp_hdr *hdr;
     unsigned long dur;
-    int error = 0;
-    int new;
-
-    mme_event_t *e = NULL;
-    mme_ue_t *mme_ue = NULL;
-    enb_ue_t *enb_ue = NULL;
-    ogs_diam_s6a_message_t *s6a_message = NULL;
-    ogs_diam_s6a_aia_message_t *aia_message = NULL;
-    ogs_diam_e_utran_vector_t *e_utran_vector = NULL;
+    int error;
+    mme_event_t *e;
+    mme_ue_t *mme_ue;
+    enb_ue_t *enb_ue;
+    ogs_diam_s6a_message_t *s6a_message;
+    ogs_diam_s6a_aia_message_t *aia_message;
+    ogs_diam_e_utran_vector_t *e_utran_vector;
+
+    /* Initialize variables */
+    sess_data = NULL;
+    avp_e_utran_vector = NULL;
+    avp_xres = NULL;
+    avp_kasme = NULL;
+    avp_rand = NULL;
+    avp_autn = NULL;
+    error = 0;
+    e = NULL;
+    mme_ue = NULL;
+    enb_ue = NULL;
+    s6a_message = NULL;
+    aia_message = NULL;
+    e_utran_vector = NULL;
 
     ogs_debug("MME Authentication-Information-Answer");
 
@@ -910,50 +928,59 @@
     ret = fd_msg_sess_get(fd_g_config->cnf_dict, *msg, &session, &new);
     if (ret != 0) {
         ogs_error("fd_msg_sess_get() failed");
-        return;
+        goto cleanup;
     }
     if (new != 0) {
-        ogs_error("fd_msg_sess_get() failed");
-        return;
+        ogs_error("fd_msg_sess_get() failed - unexpected new session");
+        goto cleanup;
     }
 
     ret = fd_sess_state_retrieve(mme_s6a_reg, session, &sess_data);
     if (ret != 0) {
         ogs_error("fd_sess_state_retrieve() failed");
-        return;
+        goto cleanup;
     }
     if (!sess_data) {
-        ogs_error("fd_sess_state_retrieve() failed");
-        return;
+        ogs_error("fd_sess_state_retrieve() failed - no session data");
+        goto cleanup;
     }
     if ((void *)sess_data != data) {
-        ogs_error("fd_sess_state_retrieve() failed");
-        return;
+        ogs_error("fd_sess_state_retrieve() failed - data mismatch");
+        goto cleanup;
     }
 
     mme_ue = mme_ue_find_by_id(sess_data->mme_ue_id);
     if (!mme_ue) {
         ogs_error("MME-UE Context has already been removed %d",
                 sess_data->mme_ue_id);
-        return;
+        goto cleanup;
     }
     enb_ue = enb_ue_find_by_id(sess_data->enb_ue_id);
     if (!enb_ue) {
         ogs_error("%s ENB-S1 Context has already been removed %d",
                 mme_ue->imsi_bcd, sess_data->enb_ue_id);
-        return;
+        goto cleanup;
     }
 
-    /* Set Authentication-Information Command */
+    /* Allocate message structure early for proper cleanup */
     s6a_message = ogs_calloc(1, sizeof(ogs_diam_s6a_message_t));
-    ogs_assert(s6a_message);
+    if (!s6a_message) {
+        ogs_error("Failed to allocate s6a_message");
+        error++;
+        goto cleanup;
+    }
+
+    /* Set Authentication-Information Command */
     s6a_message->cmd_code = OGS_DIAM_S6A_CMD_CODE_AUTHENTICATION_INFORMATION;
     aia_message = &s6a_message->aia_message;
-    ogs_assert(aia_message);
     e_utran_vector = &aia_message->e_utran_vector;
-    ogs_assert(e_utran_vector);
 
-    /* Value of Result Code */
+    /* AVP: 'Result-Code'(268)
+     * The Result-Code AVP indicates whether a particular request was completed
+     * successfully or whether an error occurred. The Result-Code data field
+     * contains an IANA-managed 32-bit address space representing errors.
+     * Reference: RFC 6733
+     */
     ret = fd_msg_search_avp(*msg, ogs_diam_result_code, &avp);
     ogs_assert(ret == 0);
     if (avp) {
@@ -980,10 +1007,16 @@
         } else {
             ogs_error("no Result-Code");
             error++;
+            goto cleanup;
         }
     }
 
-    /* Value of Origin-Host */
+    /* AVP: 'Origin-Host'(264)
+     * The Origin-Host AVP identifies the endpoint that originated the Diameter
+     * message. Relay agents MUST NOT modify this AVP. The value of the
+     * Origin-Host AVP is guaranteed to be unique within a single host.
+     * Reference: RFC 6733
+     */
     ret = fd_msg_search_avp(*msg, ogs_diam_origin_host, &avp);
     ogs_assert(ret == 0);
     if (avp) {
@@ -992,11 +1025,17 @@
         ogs_debug("    From '%.*s'",
                 (int)hdr->avp_value->os.len, hdr->avp_value->os.data);
     } else {
-        ogs_error("no_Origin-Host ");
+        ogs_error("no_Origin-Host");
         error++;
+        goto cleanup;
     }
 
-    /* Value of Origin-Realm */
+    /* AVP: 'Origin-Realm'(296)
+     * This AVP contains the Realm of the originator of any Diameter message
+     * and MUST be present in all messages. This AVP SHOULD be placed as close
+     * to the Diameter header as possible.
+     * Reference: RFC 6733
+     */
     ret = fd_msg_search_avp(*msg, ogs_diam_origin_realm, &avp);
     ogs_assert(ret == 0);
     if (avp) {
@@ -1005,8 +1044,9 @@
         ogs_debug("         ('%.*s')",
                 (int)hdr->avp_value->os.len, hdr->avp_value->os.data);
     } else {
-        ogs_error("no_Origin-Realm ");
+        ogs_error("no_Origin-Realm");
         error++;
+        goto cleanup;
     }
 
     if (s6a_message->result_code != ER_DIAMETER_SUCCESS) {
@@ -1020,92 +1060,137 @@
                     s6a_message->result_code);
             ogs_assert_if_reached();
         }
-        goto out;
-    }
-
-    ret = fd_msg_search_avp(*msg, ogs_diam_s6a_authentication_info, &avp);
-    ogs_assert(ret == 0);
-    if (avp) {
-        ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
+        /* Continue processing even with error result code */
     } else {
-        ogs_error("no_Authentication-Info ");
-        error++;
-    }
+        /* Parse authentication info only if result is success */
 
-    ret = fd_avp_search_avp(
-            avp, ogs_diam_s6a_e_utran_vector, &avp_e_utran_vector);
-    ogs_assert(ret == 0);
-    if (avp) {
-        ret = fd_msg_avp_hdr(avp_e_utran_vector, &hdr);
+        /* AVP: 'Authentication-Info'(1413)
+         * The Authentication-Info AVP contains the re-synchronization
+         * information in case of a re-synchronization and one or more
+         * E-UTRAN vectors used for EPS authentication and key agreement.
+         * Reference: 3GPP TS 29.272 7.3.17
+         */
+        ret = fd_msg_search_avp(*msg, ogs_diam_s6a_authentication_info, &avp);
         ogs_assert(ret == 0);
-    } else {
-        ogs_error("no_E-UTRAN-Vector-Info ");
-        error++;
-    }
+        if (avp) {
+            ret = fd_msg_avp_hdr(avp, &hdr);
+            ogs_assert(ret == 0);
+        } else {
+            ogs_error("no_Authentication-Info");
+            error++;
+            goto cleanup;
+        }
 
-    ret = fd_avp_search_avp(avp_e_utran_vector, ogs_diam_s6a_xres, &avp_xres);
-    ogs_assert(ret == 0);
-    if (avp) {
-        ret = fd_msg_avp_hdr(avp_xres, &hdr);
+        /* AVP: 'E-UTRAN-Vector'(1414)
+         * The E-UTRAN-Vector AVP is of type Grouped. The E-UTRAN-Vector AVP
+         * contains an E-UTRAN vector used for EPS authentication and key
+         * agreement.
+         * Reference: 3GPP TS 29.272 7.3.18
+         */
+        ret = fd_avp_search_avp(
+                avp, ogs_diam_s6a_e_utran_vector, &avp_e_utran_vector);
         ogs_assert(ret == 0);
-        e_utran_vector->xres_len =
-            ogs_min(hdr->avp_value->os.len,
-                    OGS_ARRAY_SIZE(e_utran_vector->xres));
-        memcpy(e_utran_vector->xres,
-                hdr->avp_value->os.data, e_utran_vector->xres_len);
-    } else {
-        ogs_error("no_XRES");
-        error++;
-    }
+        if (avp_e_utran_vector) {
+            ret = fd_msg_avp_hdr(avp_e_utran_vector, &hdr);
+            ogs_assert(ret == 0);
+        } else {
+            ogs_error("no_E-UTRAN-Vector-Info");
+            error++;
+            goto cleanup;
+        }
 
-    ret = fd_avp_search_avp(avp_e_utran_vector, ogs_diam_s6a_kasme, &avp_kasme);
-    ogs_assert(ret == 0);
-    if (avp) {
-        ret = fd_msg_avp_hdr(avp_kasme, &hdr);
+        /* AVP: 'XRES'(1415)
+         * The XRES AVP is of type OctetString. This AVP contains the
+         * expected result of the authentication challenge when the UICC
+         * and the AuC apply the UMTS AKA algorithms.
+         * Reference: 3GPP TS 29.272 7.3.62
+         */
+        ret = fd_avp_search_avp(avp_e_utran_vector, ogs_diam_s6a_xres,
+                                &avp_xres);
         ogs_assert(ret == 0);
-        memcpy(e_utran_vector->kasme, hdr->avp_value->os.data,
+        if (avp_xres) {
+            ret = fd_msg_avp_hdr(avp_xres, &hdr);
+            ogs_assert(ret == 0);
+            e_utran_vector->xres_len =
                 ogs_min(hdr->avp_value->os.len,
-                    OGS_ARRAY_SIZE(e_utran_vector->kasme)));
-    } else {
-        ogs_error("no_KASME");
-        error++;
-    }
+                        OGS_ARRAY_SIZE(e_utran_vector->xres));
+            memcpy(e_utran_vector->xres,
+                    hdr->avp_value->os.data, e_utran_vector->xres_len);
+        } else {
+            ogs_error("no_XRES");
+            error++;
+            goto cleanup;
+        }
 
+        /* AVP: 'KASME'(1450)
+         * The KASME AVP is of type OctetString. This AVP contains the
+         * security key KASME.
+         * Reference: 3GPP TS 29.272 7.3.23
+         */
+        ret = fd_avp_search_avp(avp_e_utran_vector, ogs_diam_s6a_kasme,
+                                &avp_kasme);
+        ogs_assert(ret == 0);
+        if (avp_kasme) {
+            ret = fd_msg_avp_hdr(avp_kasme, &hdr);
+            ogs_assert(ret == 0);
+            memcpy(e_utran_vector->kasme, hdr->avp_value->os.data,
+                    ogs_min(hdr->avp_value->os.len,
+                        OGS_ARRAY_SIZE(e_utran_vector->kasme)));
+        } else {
+            ogs_error("no_KASME");
+            error++;
+            goto cleanup;
+        }
 
-    ret = fd_avp_search_avp(avp_e_utran_vector, ogs_diam_s6a_rand, &avp_rand);
-    /* Clang scan-build SA: Value stored is not used: add ogs_assert(). */
-    ogs_assert(ret == 0);
-    if (avp) {
-        ret = fd_msg_avp_hdr(avp_rand, &hdr);
-        /* Clang scan-build SA: Value stored is not used: add ogs_assert(). */
+        /* AVP: 'RAND'(1447)
+         * The RAND AVP is of type OctetString. This AVP contains the
+         * random challenge RAND generated by the AuC.
+         * Reference: 3GPP TS 29.272 7.3.53
+         */
+        ret = fd_avp_search_avp(avp_e_utran_vector, ogs_diam_s6a_rand,
+                                &avp_rand);
         ogs_assert(ret == 0);
-        memcpy(e_utran_vector->rand, hdr->avp_value->os.data,
-                ogs_min(hdr->avp_value->os.len,
-                    OGS_ARRAY_SIZE(e_utran_vector->rand)));
-    } else {
-        ogs_error("no_RAND");
-        error++;
-    }
+        if (avp_rand) {
+            ret = fd_msg_avp_hdr(avp_rand, &hdr);
+            ogs_assert(ret == 0);
+            memcpy(e_utran_vector->rand, hdr->avp_value->os.data,
+                    ogs_min(hdr->avp_value->os.len,
+                        OGS_ARRAY_SIZE(e_utran_vector->rand)));
+        } else {
+            ogs_error("no_RAND");
+            error++;
+            goto cleanup;
+        }
 
-    ret = fd_avp_search_avp(avp_e_utran_vector, ogs_diam_s6a_autn, &avp_autn);
-    ogs_assert(ret == 0);
-    if (avp) {
-        ret = fd_msg_avp_hdr(avp_autn, &hdr);
+        /* AVP: 'AUTN'(1449)
+         * The AUTN AVP is of type OctetString. This AVP contains the
+         * authentication token AUTN.
+         * Reference: 3GPP TS 29.272 7.3.24
+         */
+        ret = fd_avp_search_avp(avp_e_utran_vector, ogs_diam_s6a_autn,
+                                &avp_autn);
         ogs_assert(ret == 0);
-        memcpy(e_utran_vector->autn, hdr->avp_value->os.data,
-                ogs_min(hdr->avp_value->os.len,
-                    OGS_ARRAY_SIZE(e_utran_vector->autn)));
-    } else {
-        ogs_error("no_AUTN");
-        error++;
+        if (avp_autn) {
+            ret = fd_msg_avp_hdr(avp_autn, &hdr);
+            ogs_assert(ret == 0);
+            memcpy(e_utran_vector->autn, hdr->avp_value->os.data,
+                    ogs_min(hdr->avp_value->os.len,
+                        OGS_ARRAY_SIZE(e_utran_vector->autn)));
+        } else {
+            ogs_error("no_AUTN");
+            error++;
+            goto cleanup;
+        }
     }
 
-out:
+    /* Send event to MME if no errors */
     if (!error) {
-        int rv;
         e = mme_event_new(MME_EVENT_S6A_MESSAGE);
-        ogs_assert(e);
+        if (!e) {
+            ogs_error("Failed to create MME event");
+            error++;
+            goto cleanup;
+        }
         e->mme_ue_id = mme_ue->id;
         e->enb_ue_id = enb_ue->id;
         e->gtp_xact_id = sess_data->gtp_xact_id;
@@ -1113,32 +1198,56 @@
         rv = ogs_queue_push(ogs_app()->queue, e);
         if (rv != OGS_OK) {
             ogs_error("ogs_queue_push() failed:%d", (int)rv);
-            ogs_free(s6a_message);
             mme_event_free(e);
+            error++;
+            goto cleanup;
         } else {
             ogs_pollset_notify(ogs_app()->pollset);
+            /* Transfer ownership of s6a_message to event */
+            s6a_message = NULL;
         }
     }
 
-    /* Free the message */
+cleanup:
+    /* Free s6a_message if it wasn't transferred to event */
+    if (s6a_message) {
+        ogs_free(s6a_message);
+    }
+
+    /* Update statistics */
     ogs_assert(pthread_mutex_lock(&ogs_diam_stats_self()->stats_lock) == 0);
-    dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
-        ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-    if (ogs_diam_stats_self()->stats.nb_recv) {
-        /* Ponderate in the avg */
-        ogs_diam_stats_self()->stats.avg = (ogs_diam_stats_self()->stats.avg *
-            ogs_diam_stats_self()->stats.nb_recv + dur) /
-            (ogs_diam_stats_self()->stats.nb_recv + 1);
-        /* Min, max */
-        if (dur < ogs_diam_stats_self()->stats.shortest)
+    if (sess_data) {
+        dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
+            ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+        if (ogs_diam_stats_self()->stats.nb_recv) {
+            /* Ponderate in the avg */
+            ogs_diam_stats_self()->stats.avg =
+                (ogs_diam_stats_self()->stats.avg *
+                 ogs_diam_stats_self()->stats.nb_recv + dur) /
+                (ogs_diam_stats_self()->stats.nb_recv + 1);
+            /* Min, max */
+            if (dur < ogs_diam_stats_self()->stats.shortest)
+                ogs_diam_stats_self()->stats.shortest = dur;
+            if (dur > ogs_diam_stats_self()->stats.longest)
+                ogs_diam_stats_self()->stats.longest = dur;
+        } else {
             ogs_diam_stats_self()->stats.shortest = dur;
-        if (dur > ogs_diam_stats_self()->stats.longest)
             ogs_diam_stats_self()->stats.longest = dur;
-    } else {
-        ogs_diam_stats_self()->stats.shortest = dur;
-        ogs_diam_stats_self()->stats.longest = dur;
-        ogs_diam_stats_self()->stats.avg = dur;
+            ogs_diam_stats_self()->stats.avg = dur;
+        }
+
+        /* Display timing information */
+        if (ts.tv_nsec > sess_data->ts.tv_nsec)
+            ogs_trace("in %d.%06ld sec",
+                    (int)(ts.tv_sec - sess_data->ts.tv_sec),
+                    (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+        else
+            ogs_trace("in %d.%06ld sec",
+                    (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
+                    (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec)
+                    / 1000);
     }
+
     if (error)
         ogs_diam_stats_self()->stats.nb_errs++;
     else
@@ -1146,26 +1255,19 @@
 
     ogs_assert(pthread_mutex_unlock(&ogs_diam_stats_self()->stats_lock) == 0);
 
-    /* Display how long it took */
-    if (ts.tv_nsec > sess_data->ts.tv_nsec)
-        ogs_trace("in %d.%06ld sec",
-                (int)(ts.tv_sec - sess_data->ts.tv_sec),
-                (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-    else
-        ogs_trace("in %d.%06ld sec",
-                (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
-                (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-
+    /* Free the message */
     ret = fd_msg_free(*msg);
     ogs_assert(ret == 0);
     *msg = NULL;
 
-    state_cleanup(sess_data, NULL, NULL);
-    return;
+    /* Clean up session data */
+    if (sess_data) {
+        state_cleanup(sess_data, NULL, NULL);
+    }
 }
 
 /* MME Sends Update Location Request to HSS */
-void mme_s6a_send_ulr(enb_ue_t *enb_ue, mme_ue_t *mme_ue)
+void mme_s6a_send_ulr(enb_ue_t *enb_ue, mme_ue_t *mme_ue, uint32_t extra_ulr_flags)
 {
     int ret;
 
@@ -1206,6 +1308,11 @@
     ret = fd_msg_sess_get(fd_g_config->cnf_dict, req, &session, NULL);
     ogs_assert(ret == 0);
 
+    /* Set Vendor-Specific-Application-Id AVP */
+    ret = ogs_diam_message_vendor_specific_appid_set(
+            req, OGS_DIAM_S6A_APPLICATION_ID);
+    ogs_assert(ret == 0);
+
     /* Set the Auth-Session-State AVP */
     ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
     ogs_assert(ret == 0);
@@ -1271,7 +1378,9 @@
     /* Set the ULR-Flags */
     ret = fd_msg_avp_new(ogs_diam_s6a_ulr_flags, 0, &avp);
     ogs_assert(ret == 0);
-    val.u32 = OGS_DIAM_S6A_ULR_S6A_S6D_INDICATOR;
+    val.u32 = OGS_DIAM_S6A_ULR_S6A_S6D_INDICATOR |
+              OGS_DIAM_S6A_ULR_INITIAL_ATTACH_IND |
+              extra_ulr_flags;
     ret = fd_msg_avp_setvalue(avp, &val);
     ogs_assert(ret == 0);
     ret = fd_msg_avp_add(req, MSG_BRW_LAST_CHILD, avp);
@@ -1296,9 +1405,16 @@
     ret = fd_msg_avp_add(req, MSG_BRW_LAST_CHILD, avp);
     ogs_assert(ret == 0);
 
-    /* Set Vendor-Specific-Application-Id AVP */
-    ret = ogs_diam_message_vendor_specific_appid_set(
-            req, OGS_DIAM_S6A_APPLICATION_ID);
+    /* Set the SMS-Register-Request */
+    ret = fd_msg_avp_new(ogs_diam_s6a_sms_register_request, 0, &avp);
+    ogs_assert(ret == 0);
+    /* "SMS in MME" (3GPP TS 23.272 Annex C) not supported yet.
+     * We do support SGs interface though, so signal that,
+     * see 3GPP TS 23.272 C.8. */
+    val.u32 = OGS_DIAM_S6A_SMS_REGISTER_NOT_PREFERRED;
+    ret = fd_msg_avp_setvalue(avp, &val);
+    ogs_assert(ret == 0);
+    ret = fd_msg_avp_add(req, MSG_BRW_LAST_CHILD, avp);
     ogs_assert(ret == 0);
 
     ret = clock_gettime(CLOCK_REALTIME, &sess_data->ts);
@@ -1324,25 +1440,35 @@
 }
 
 /* MME received Update Location Answer from HSS */
+/* Fixed mme_s6a_ula_cb() function with proper error handling and C89 compliance */
 static void mme_s6a_ula_cb(void *data, struct msg **msg)
 {
-    int ret;
-
-    struct sess_state *sess_data = NULL;
+    int ret, rv, new;
+    struct sess_state *sess_data;
     struct timespec ts;
     struct session *session;
     struct avp *avp, *avpch;
     struct avp_hdr *hdr;
     unsigned long dur;
-    int error = 0;
-    int new;
-
-    mme_event_t *e = NULL;
-    mme_ue_t *mme_ue = NULL;
-    enb_ue_t *enb_ue = NULL;
-    ogs_diam_s6a_message_t *s6a_message = NULL;
-    ogs_diam_s6a_ula_message_t *ula_message = NULL;
-    ogs_subscription_data_t *subscription_data = NULL;
+    int error;
+    mme_event_t *e;
+    mme_ue_t *mme_ue;
+    enb_ue_t *enb_ue;
+    ogs_diam_s6a_message_t *s6a_message;
+    ogs_diam_s6a_ula_message_t *ula_message;
+    ogs_subscription_data_t *subscription_data;
+    uint32_t subdatamask;
+
+    /* Initialize variables */
+    sess_data = NULL;
+    error = 0;
+    e = NULL;
+    mme_ue = NULL;
+    enb_ue = NULL;
+    s6a_message = NULL;
+    ula_message = NULL;
+    subscription_data = NULL;
+    subdatamask = 0;
 
     ogs_debug("MME Update-Location-Answer");
 
@@ -1353,48 +1479,52 @@
     ret = fd_msg_sess_get(fd_g_config->cnf_dict, *msg, &session, &new);
     if (ret != 0) {
         ogs_error("fd_msg_sess_get() failed");
-        return;
+        goto cleanup;
     }
     if (new != 0) {
-        ogs_error("fd_msg_sess_get() failed");
-        return;
+        ogs_error("fd_msg_sess_get() failed - unexpected new session");
+        goto cleanup;
     }
 
     ret = fd_sess_state_retrieve(mme_s6a_reg, session, &sess_data);
     if (ret != 0) {
         ogs_error("fd_sess_state_retrieve() failed");
-        return;
+        goto cleanup;
     }
     if (!sess_data) {
-        ogs_error("fd_sess_state_retrieve() failed");
-        return;
+        ogs_error("fd_sess_state_retrieve() failed - no session data");
+        goto cleanup;
     }
     if ((void *)sess_data != data) {
-        ogs_error("fd_sess_state_retrieve() failed");
-        return;
+        ogs_error("fd_sess_state_retrieve() failed - data mismatch");
+        goto cleanup;
     }
 
     mme_ue = mme_ue_find_by_id(sess_data->mme_ue_id);
     if (!mme_ue) {
         ogs_error("MME-UE Context has already been removed %d",
                 sess_data->mme_ue_id);
-        return;
+        goto cleanup;
     }
     enb_ue = enb_ue_find_by_id(sess_data->enb_ue_id);
     if (!enb_ue) {
         ogs_error("%s ENB-S1 Context has already been removed %d",
                 mme_ue->imsi_bcd, sess_data->enb_ue_id);
-        return;
+        goto cleanup;
     }
 
-    /* Set Update-Location Command */
+    /* Allocate message structure early for proper cleanup */
     s6a_message = ogs_calloc(1, sizeof(ogs_diam_s6a_message_t));
-    ogs_assert(s6a_message);
+    if (!s6a_message) {
+        ogs_error("Failed to allocate s6a_message");
+        error++;
+        goto cleanup;
+    }
+
+    /* Set Update-Location Command */
     s6a_message->cmd_code = OGS_DIAM_S6A_CMD_CODE_UPDATE_LOCATION;
     ula_message = &s6a_message->ula_message;
-    ogs_assert(ula_message);
     subscription_data = &ula_message->subscription_data;
-    ogs_assert(subscription_data);
 
     /* AVP: 'Result-Code'(268)
      * The Result-Code AVP indicates whether a particular request was completed
@@ -1428,6 +1558,7 @@
         } else {
             ogs_error("no Result-Code");
             error++;
+            goto cleanup;
         }
     }
 
@@ -1447,6 +1578,7 @@
     } else {
         ogs_error("no_Origin-Host");
         error++;
+        goto cleanup;
     }
 
     /* AVP: 'Origin-Realm'(296)
@@ -1465,6 +1597,7 @@
     } else {
         ogs_error("no_Origin-Realm");
         error++;
+        goto cleanup;
     }
 
     /* AVP: 'ULA-Flags'(1406)
@@ -1478,9 +1611,11 @@
         ret = fd_msg_avp_hdr(avp, &hdr);
         ogs_assert(ret == 0);
         ula_message->ula_flags = hdr->avp_value->i32;
+        ogs_debug("    ULA-Flags: %d", ula_message->ula_flags);
     } else {
         ogs_error("no_ULA-Flags");
         error++;
+        goto cleanup;
     }
 
     /* AVP: 'Subscription-Data'(1400)
@@ -1491,12 +1626,15 @@
     ret = fd_msg_search_avp(*msg, ogs_diam_s6a_subscription_data, &avp);
     ogs_assert(ret == 0);
     if (avp) {
-        uint32_t subdatamask = 0;
-        ret = mme_s6a_subscription_data_from_avp(avp, subscription_data, mme_ue,
-            &subdatamask);
-        /* Clang scan-build SA: Value stored is not used: add ogs_assert(). */
-        ogs_assert(ret == 0);
+        ret = mme_s6a_subscription_data_from_avp(avp, subscription_data,
+                                                 mme_ue, &subdatamask);
+        if (ret != 0) {
+            ogs_error("Failed to parse subscription data");
+            error++;
+            goto cleanup;
+        }
 
+        /* Validate required subscription data fields */
         if (!(subdatamask & OGS_DIAM_S6A_SUBDATA_NAM)) {
             mme_ue->network_access_mode = 0;
             ogs_warn("no subscribed Network-Access-Mode, defaulting to "
@@ -1510,6 +1648,7 @@
         if (!(subdatamask & OGS_DIAM_S6A_SUBDATA_UEAMBR)) {
             ogs_error("no_AMBR");
             error++;
+            goto cleanup;
         }
         if (!(subdatamask & OGS_DIAM_S6A_SUBDATA_RAU_TAU_TIMER)) {
             subscription_data->subscribed_rau_tau_timer =
@@ -1518,53 +1657,82 @@
         if (!(subdatamask & OGS_DIAM_S6A_SUBDATA_APN_CONFIG)) {
             ogs_error("no_APN-Configuration-Profile");
             error++;
+            goto cleanup;
         }
     } else {
         ogs_error("no_Subscription-Data");
         error++;
+        goto cleanup;
     }
 
+    /* Send event to MME if no errors */
     if (!error) {
-        int rv;
         e = mme_event_new(MME_EVENT_S6A_MESSAGE);
-        ogs_assert(e);
+        if (!e) {
+            ogs_error("Failed to create MME event");
+            error++;
+            goto cleanup;
+        }
         e->mme_ue_id = mme_ue->id;
         e->enb_ue_id = enb_ue->id;
         e->s6a_message = s6a_message;
         rv = ogs_queue_push(ogs_app()->queue, e);
         if (rv != OGS_OK) {
             ogs_error("ogs_queue_push() failed:%d", (int)rv);
-            ogs_subscription_data_free(subscription_data);
-            ogs_free(s6a_message);
             mme_event_free(e);
+            error++;
+            goto cleanup;
         } else {
             ogs_pollset_notify(ogs_app()->pollset);
+            /* Transfer ownership of s6a_message to event */
+            s6a_message = NULL;
+        }
+    }
+
+cleanup:
+    /* Free s6a_message if it wasn't transferred to event */
+    if (s6a_message) {
+        /* Free subscription data if it was allocated */
+        if (subscription_data) {
+            ogs_subscription_data_free(subscription_data);
         }
-    } else {
-        ogs_subscription_data_free(subscription_data);
         ogs_free(s6a_message);
     }
 
-    /* Free the message */
+    /* Update statistics */
     ogs_assert(pthread_mutex_lock(&ogs_diam_stats_self()->stats_lock) == 0);
-    dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
-        ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-    if (ogs_diam_stats_self()->stats.nb_recv) {
-        /* Ponderate in the avg */
-        ogs_diam_stats_self()->stats.avg =
-            (ogs_diam_stats_self()->stats.avg *
-            ogs_diam_stats_self()->stats.nb_recv + dur) /
-            (ogs_diam_stats_self()->stats.nb_recv + 1);
-        /* Min, max */
-        if (dur < ogs_diam_stats_self()->stats.shortest)
+    if (sess_data) {
+        dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
+            ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+        if (ogs_diam_stats_self()->stats.nb_recv) {
+            /* Ponderate in the avg */
+            ogs_diam_stats_self()->stats.avg =
+                (ogs_diam_stats_self()->stats.avg *
+                ogs_diam_stats_self()->stats.nb_recv + dur) /
+                (ogs_diam_stats_self()->stats.nb_recv + 1);
+            /* Min, max */
+            if (dur < ogs_diam_stats_self()->stats.shortest)
+                ogs_diam_stats_self()->stats.shortest = dur;
+            if (dur > ogs_diam_stats_self()->stats.longest)
+                ogs_diam_stats_self()->stats.longest = dur;
+        } else {
             ogs_diam_stats_self()->stats.shortest = dur;
-        if (dur > ogs_diam_stats_self()->stats.longest)
             ogs_diam_stats_self()->stats.longest = dur;
-    } else {
-        ogs_diam_stats_self()->stats.shortest = dur;
-        ogs_diam_stats_self()->stats.longest = dur;
-        ogs_diam_stats_self()->stats.avg = dur;
+            ogs_diam_stats_self()->stats.avg = dur;
+        }
+
+        /* Display timing information */
+        if (ts.tv_nsec > sess_data->ts.tv_nsec)
+            ogs_trace("in %d.%06ld sec",
+                    (int)(ts.tv_sec - sess_data->ts.tv_sec),
+                    (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+        else
+            ogs_trace("in %d.%06ld sec",
+                    (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
+                    (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec)
+                    / 1000);
     }
+
     if (error)
         ogs_diam_stats_self()->stats.nb_errs++;
     else
@@ -1572,22 +1740,15 @@
 
     ogs_assert(pthread_mutex_unlock(&ogs_diam_stats_self()->stats_lock) == 0);
 
-    /* Display how long it took */
-    if (ts.tv_nsec > sess_data->ts.tv_nsec)
-        ogs_trace("in %d.%06ld sec",
-                (int)(ts.tv_sec - sess_data->ts.tv_sec),
-                (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-    else
-        ogs_trace("in %d.%06ld sec",
-                (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
-                (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-
+    /* Free the message */
     ret = fd_msg_free(*msg);
     ogs_assert(ret == 0);
     *msg = NULL;
 
-    state_cleanup(sess_data, NULL, NULL);
-    return;
+    /* Clean up session data */
+    if (sess_data) {
+        state_cleanup(sess_data, NULL, NULL);
+    }
 }
 
 /* MME Sends Purge UE Request to HSS */
@@ -1685,24 +1846,31 @@
 }
 
 /* MME received Purge UE Answer from HSS */
+/* Fixed mme_s6a_pua_cb() function with proper error handling and C89 compliance */
 static void mme_s6a_pua_cb(void *data, struct msg **msg)
 {
-    int ret;
-
-    struct sess_state *sess_data = NULL;
+    int ret, rv, new;
+    struct sess_state *sess_data;
     struct timespec ts;
     struct session *session;
     struct avp *avp, *avpch;
     struct avp_hdr *hdr;
     unsigned long dur;
-    int error = 0;
-    int new;
-
-    mme_event_t *e = NULL;
-    mme_ue_t *mme_ue = NULL;
-    enb_ue_t *enb_ue = NULL;
-    ogs_diam_s6a_message_t *s6a_message = NULL;
-    ogs_diam_s6a_pua_message_t *pua_message = NULL;
+    int error;
+    mme_event_t *e;
+    mme_ue_t *mme_ue;
+    enb_ue_t *enb_ue;
+    ogs_diam_s6a_message_t *s6a_message;
+    ogs_diam_s6a_pua_message_t *pua_message;
+
+    /* Initialize variables */
+    sess_data = NULL;
+    error = 0;
+    e = NULL;
+    mme_ue = NULL;
+    enb_ue = NULL;
+    s6a_message = NULL;
+    pua_message = NULL;
 
     ogs_debug("MME Purge-UE-Answer");
 
@@ -1713,46 +1881,51 @@
     ret = fd_msg_sess_get(fd_g_config->cnf_dict, *msg, &session, &new);
     if (ret != 0) {
         ogs_error("fd_msg_sess_get() failed");
-        return;
+        goto cleanup;
     }
     if (new != 0) {
-        ogs_error("fd_msg_sess_get() failed");
-        return;
+        ogs_error("fd_msg_sess_get() failed - unexpected new session");
+        goto cleanup;
     }
 
     ret = fd_sess_state_retrieve(mme_s6a_reg, session, &sess_data);
     if (ret != 0) {
         ogs_error("fd_sess_state_retrieve() failed");
-        return;
+        goto cleanup;
     }
     if (!sess_data) {
-        ogs_error("fd_sess_state_retrieve() failed");
-        return;
+        ogs_error("fd_sess_state_retrieve() failed - no session data");
+        goto cleanup;
     }
     if ((void *)sess_data != data) {
-        ogs_error("fd_sess_state_retrieve() failed");
-        return;
+        ogs_error("fd_sess_state_retrieve() failed - data mismatch");
+        goto cleanup;
     }
 
     mme_ue = mme_ue_find_by_id(sess_data->mme_ue_id);
     if (!mme_ue) {
         ogs_error("MME-UE Context has already been removed %d",
                 sess_data->mme_ue_id);
-        return;
+        goto cleanup;
     }
     enb_ue = enb_ue_find_by_id(sess_data->enb_ue_id);
     if (!enb_ue) {
         ogs_error("%s ENB-S1 Context has already been removed %d",
                 mme_ue->imsi_bcd, sess_data->enb_ue_id);
-        return;
+        goto cleanup;
     }
 
-    /* Set Purge-UE Command */
+    /* Allocate message structure early for proper cleanup */
     s6a_message = ogs_calloc(1, sizeof(ogs_diam_s6a_message_t));
-    ogs_assert(s6a_message);
+    if (!s6a_message) {
+        ogs_error("Failed to allocate s6a_message");
+        error++;
+        goto cleanup;
+    }
+
+    /* Set Purge-UE Command */
     s6a_message->cmd_code = OGS_DIAM_S6A_CMD_CODE_PURGE_UE;
     pua_message = &s6a_message->pua_message;
-    ogs_assert(pua_message);
 
     /* AVP: 'Result-Code'(268)
      * The Result-Code AVP indicates whether a particular request was completed
@@ -1786,6 +1959,7 @@
         } else {
             ogs_error("no Result-Code");
             error++;
+            goto cleanup;
         }
     }
 
@@ -1805,6 +1979,7 @@
     } else {
         ogs_error("no_Origin-Host");
         error++;
+        goto cleanup;
     }
 
     /* AVP: 'Origin-Realm'(296)
@@ -1823,12 +1998,14 @@
     } else {
         ogs_error("no_Origin-Realm");
         error++;
+        goto cleanup;
     }
 
-    /* AVP: 'PUA-Flags'(1406)
+    /* AVP: 'PUA-Flags'(1442)
      * The PUA-Flags AVP contains a bit mask, whose meanings are defined in
      * table in 29.272 7.3.8/1.
      * Reference: 3GPP TS 29.272-f70
+     * Note: This AVP is optional, so no error if not present
      */
     ret = fd_msg_search_avp(*msg, ogs_diam_s6a_pua_flags, &avp);
     ogs_assert(ret == 0);
@@ -1836,47 +2013,76 @@
         ret = fd_msg_avp_hdr(avp, &hdr);
         ogs_assert(ret == 0);
         pua_message->pua_flags = hdr->avp_value->i32;
+        ogs_debug("    PUA-Flags: %d", pua_message->pua_flags);
+    } else {
+        ogs_debug("    No PUA-Flags (optional AVP)");
+        pua_message->pua_flags = 0;
     }
 
+    /* Send event to MME if no errors */
     if (!error) {
-        int rv;
         e = mme_event_new(MME_EVENT_S6A_MESSAGE);
-        ogs_assert(e);
+        if (!e) {
+            ogs_error("Failed to create MME event");
+            error++;
+            goto cleanup;
+        }
         e->mme_ue_id = mme_ue->id;
         e->enb_ue_id = enb_ue->id;
         e->s6a_message = s6a_message;
         rv = ogs_queue_push(ogs_app()->queue, e);
         if (rv != OGS_OK) {
             ogs_error("ogs_queue_push() failed:%d", (int)rv);
-            ogs_free(s6a_message);
             mme_event_free(e);
+            error++;
+            goto cleanup;
         } else {
             ogs_pollset_notify(ogs_app()->pollset);
+            /* Transfer ownership of s6a_message to event */
+            s6a_message = NULL;
         }
-    } else {
+    }
+
+cleanup:
+    /* Free s6a_message if it wasn't transferred to event */
+    if (s6a_message) {
         ogs_free(s6a_message);
     }
 
-    /* Free the message */
+    /* Update statistics */
     ogs_assert(pthread_mutex_lock(&ogs_diam_stats_self()->stats_lock) == 0);
-    dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
-        ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-    if (ogs_diam_stats_self()->stats.nb_recv) {
-        /* Ponderate in the avg */
-        ogs_diam_stats_self()->stats.avg =
-            (ogs_diam_stats_self()->stats.avg *
-            ogs_diam_stats_self()->stats.nb_recv + dur) /
-            (ogs_diam_stats_self()->stats.nb_recv + 1);
-        /* Min, max */
-        if (dur < ogs_diam_stats_self()->stats.shortest)
+    if (sess_data) {
+        dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
+            ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+        if (ogs_diam_stats_self()->stats.nb_recv) {
+            /* Ponderate in the avg */
+            ogs_diam_stats_self()->stats.avg =
+                (ogs_diam_stats_self()->stats.avg *
+                ogs_diam_stats_self()->stats.nb_recv + dur) /
+                (ogs_diam_stats_self()->stats.nb_recv + 1);
+            /* Min, max */
+            if (dur < ogs_diam_stats_self()->stats.shortest)
+                ogs_diam_stats_self()->stats.shortest = dur;
+            if (dur > ogs_diam_stats_self()->stats.longest)
+                ogs_diam_stats_self()->stats.longest = dur;
+        } else {
             ogs_diam_stats_self()->stats.shortest = dur;
-        if (dur > ogs_diam_stats_self()->stats.longest)
             ogs_diam_stats_self()->stats.longest = dur;
-    } else {
-        ogs_diam_stats_self()->stats.shortest = dur;
-        ogs_diam_stats_self()->stats.longest = dur;
-        ogs_diam_stats_self()->stats.avg = dur;
+            ogs_diam_stats_self()->stats.avg = dur;
+        }
+
+        /* Display timing information */
+        if (ts.tv_nsec > sess_data->ts.tv_nsec)
+            ogs_trace("in %d.%06ld sec",
+                    (int)(ts.tv_sec - sess_data->ts.tv_sec),
+                    (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+        else
+            ogs_trace("in %d.%06ld sec",
+                    (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
+                    (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec)
+                    / 1000);
     }
+
     if (error)
         ogs_diam_stats_self()->stats.nb_errs++;
     else
@@ -1884,84 +2090,110 @@
 
     ogs_assert(pthread_mutex_unlock(&ogs_diam_stats_self()->stats_lock) == 0);
 
-    /* Display how long it took */
-    if (ts.tv_nsec > sess_data->ts.tv_nsec)
-        ogs_trace("in %d.%06ld sec",
-                (int)(ts.tv_sec - sess_data->ts.tv_sec),
-                (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-    else
-        ogs_trace("in %d.%06ld sec",
-                (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
-                (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-
+    /* Free the message */
     ret = fd_msg_free(*msg);
     ogs_assert(ret == 0);
     *msg = NULL;
 
-    state_cleanup(sess_data, NULL, NULL);
-    return;
+    /* Clean up session data */
+    if (sess_data) {
+        state_cleanup(sess_data, NULL, NULL);
+    }
 }
 
 /* Callback for incoming Cancel-Location-Request messages */
-static int mme_ogs_diam_s6a_clr_cb( struct msg **msg, struct avp *avp,
+static int mme_s6a_clr_cb(struct msg **msg, struct avp *avp,
         struct session *session, void *opaque, enum disp_action *act)
 {
     int ret, rv;
-
-    mme_event_t *e = NULL;
-    mme_ue_t *mme_ue = NULL;
-
     struct msg *ans, *qry;
-    ogs_diam_s6a_clr_message_t *clr_message = NULL;
-
-    struct avp_hdr *hdr;
     union avp_value val;
-
+    struct avp_hdr *hdr;
     char imsi_bcdOGS_MAX_IMSI_BCD_LEN+1;
-
-    uint32_t result_code = 0;
+    uint32_t result_code;
+    mme_event_t *e;
+    mme_ue_t *mme_ue;
+    ogs_diam_s6a_message_t *s6a_message;
+    ogs_diam_s6a_clr_message_t *clr_message;
+
+    /* Initialize variables */
+    result_code = 0;
+    e = NULL;
+    mme_ue = NULL;
+    s6a_message = NULL;
+    clr_message = NULL;
 
     ogs_assert(msg);
 
-    ogs_diam_s6a_message_t *s6a_message = NULL;
-
     ogs_debug("Cancel-Location-Request");
 
-    s6a_message = ogs_calloc(1, sizeof(ogs_diam_s6a_message_t));
-    ogs_assert(s6a_message);
-    s6a_message->cmd_code = OGS_DIAM_S6A_CMD_CODE_CANCEL_LOCATION;
-    clr_message = &s6a_message->clr_message;
-    ogs_assert(clr_message);
-
     /* Create answer header */
     qry = *msg;
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
     ogs_assert(ret == 0);
     ans = *msg;
 
+    /* Allocate message structure early for proper cleanup */
+    s6a_message = ogs_calloc(1, sizeof(ogs_diam_s6a_message_t));
+    if (!s6a_message) {
+        ogs_error("Failed to allocate s6a_message");
+        result_code = OGS_DIAM_OUT_OF_SPACE;
+        goto error_out;
+    }
+
+    s6a_message->cmd_code = OGS_DIAM_S6A_CMD_CODE_CANCEL_LOCATION;
+    clr_message = &s6a_message->clr_message;
+
+    /* Get User-Name AVP */
     ret = fd_msg_search_avp(qry, ogs_diam_user_name, &avp);
     ogs_assert(ret == 0);
+    if (!avp) {
+        ogs_error("User-Name AVP not found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        goto error_out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
     ogs_assert(ret == 0);
+    if (!hdr->avp_value->os.data || hdr->avp_value->os.len == 0) {
+        ogs_error("Invalid User-Name AVP data");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        goto error_out;
+    }
 
     ogs_cpystrn(imsi_bcd, (char*)hdr->avp_value->os.data,
         ogs_min(hdr->avp_value->os.len, OGS_MAX_IMSI_BCD_LEN)+1);
 
     mme_ue = mme_ue_find_by_imsi_bcd(imsi_bcd);
-
     if (!mme_ue) {
         ogs_error("Cancel Location for Unknown IMSI%s", imsi_bcd);
         result_code = OGS_DIAM_S6A_ERROR_USER_UNKNOWN;
-        goto out;
+        goto error_out;
     }
 
+    /* Get Cancellation-Type AVP */
     ret = fd_msg_search_avp(qry, ogs_diam_s6a_cancellation_type, &avp);
     ogs_assert(ret == 0);
+    if (!avp) {
+        ogs_error("Cancellation-Type AVP not found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        goto error_out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
     ogs_assert(ret == 0);
     clr_message->cancellation_type = hdr->avp_value->i32;
 
-    /* Set the Origin-Host, Origin-Realm, andResult-Code AVPs */
+    /* Get CLR-Flags AVP (optional) */
+    ret = fd_msg_search_avp(qry, ogs_diam_s6a_clr_flags, &avp);
+    ogs_assert(ret == 0);
+    if (avp) {
+        ret = fd_msg_avp_hdr(avp, &hdr);
+        ogs_assert(ret == 0);
+        clr_message->clr_flags = hdr->avp_value->i32;
+    }
+
+    /* Set the Origin-Host, Origin-Realm, and Result-Code AVPs */
     ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
     ogs_assert(ret == 0);
 
@@ -1974,14 +2206,6 @@
     ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
     ogs_assert(ret == 0);
 
-    ret = fd_msg_search_avp(qry, ogs_diam_s6a_clr_flags, &avp);
-    ogs_assert(ret == 0);
-    if (avp) {
-        ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
-        clr_message->clr_flags = hdr->avp_value->i32;
-    }
-
     /* Set Vendor-Specific-Application-Id AVP */
     ret = ogs_diam_message_vendor_specific_appid_set(
             ans, OGS_DIAM_S6A_APPLICATION_ID);
@@ -1994,12 +2218,17 @@
     ogs_debug("Cancel-Location-Answer");
 
     /* Add this value to the stats */
-    ogs_assert( pthread_mutex_lock(&ogs_diam_stats_self()->stats_lock) == 0);
+    ogs_assert(pthread_mutex_lock(&ogs_diam_stats_self()->stats_lock) == 0);
     ogs_diam_stats_self()->stats.nb_echoed++;
-    ogs_assert( pthread_mutex_unlock(&ogs_diam_stats_self()->stats_lock) == 0);
+    ogs_assert(pthread_mutex_unlock(&ogs_diam_stats_self()->stats_lock) == 0);
 
+    /* Send event to MME */
     e = mme_event_new(MME_EVENT_S6A_MESSAGE);
-    ogs_assert(e);
+    if (!e) {
+        ogs_error("Failed to create MME event");
+        ogs_free(s6a_message);
+        return 0;
+    }
     e->mme_ue_id = mme_ue->id;
     e->s6a_message = s6a_message;
     rv = ogs_queue_push(ogs_app()->queue, e);
@@ -2009,13 +2238,27 @@
         mme_event_free(e);
     } else {
         ogs_pollset_notify(ogs_app()->pollset);
+        /* Transfer ownership of s6a_message to event */
+        s6a_message = NULL;
     }
 
     return 0;
 
-out:
-    ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
-    ogs_assert(ret == 0);
+error_out:
+    /* Free s6a_message if it wasn't transferred to event */
+    if (s6a_message) {
+        ogs_free(s6a_message);
+    }
+
+    /* Set appropriate error result code */
+    if (result_code == OGS_DIAM_S6A_ERROR_USER_UNKNOWN) {
+        ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
+        ogs_assert(ret == 0);
+    } else {
+        ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_UNABLE_TO_COMPLY",
+                                NULL, NULL, 1);
+        ogs_assert(ret == 0);
+    }
 
     /* Set the Auth-Session-State AVP */
     ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
@@ -2031,76 +2274,92 @@
             ans, OGS_DIAM_S6A_APPLICATION_ID);
     ogs_assert(ret == 0);
 
-    /* Send the answer */
+    /* Send error response */
     ret = fd_msg_send(msg, NULL, NULL);
     ogs_assert(ret == 0);
 
-    ogs_free(s6a_message);
-
     return 0;
 }
 
 /* Callback for incoming Insert-Subscriber-Data-Request messages
  * 29.272 5.2.2.1.2 */
-static int mme_ogs_diam_s6a_idr_cb( struct msg **msg, struct avp *avp,
+static int mme_s6a_idr_cb(struct msg **msg, struct avp *avp,
         struct session *session, void *opaque, enum disp_action *act)
 {
-    int ret;
+    int ret, rv;
     char imsi_bcdOGS_MAX_IMSI_BCD_LEN+1;
-    uint32_t result_code = 0;
-    /* Clang scan-build SA: Branch condition evaluates to a garbage value: has_subscriber_data can be used uninitialized. */
-    bool has_subscriber_data = false;
-
+    uint32_t result_code;
+    bool has_subscriber_data;
     struct msg *ans, *qry;
-
-    mme_event_t *e = NULL;
-    mme_ue_t *mme_ue = NULL;
-    ogs_diam_s6a_message_t *s6a_message = NULL;
-    ogs_diam_s6a_idr_message_t *idr_message = NULL;
-    ogs_subscription_data_t *subscription_data = NULL;
-
+    mme_event_t *e;
+    mme_ue_t *mme_ue;
+    ogs_diam_s6a_message_t *s6a_message;
+    ogs_diam_s6a_idr_message_t *idr_message;
+    ogs_subscription_data_t *subscription_data;
     struct avp_hdr *hdr;
     union avp_value val;
+    uint32_t subdatamask;
+
+    /* Initialize variables */
+    result_code = 0;
+    has_subscriber_data = false;
+    e = NULL;
+    mme_ue = NULL;
+    s6a_message = NULL;
+    idr_message = NULL;
+    subscription_data = NULL;
+    subdatamask = 0;
 
     ogs_assert(msg);
 
     ogs_debug("Insert-Subscriber-Data-Request");
 
-    s6a_message = ogs_calloc(1, sizeof(ogs_diam_s6a_message_t));
-    ogs_assert(s6a_message);
-    s6a_message->cmd_code = OGS_DIAM_S6A_CMD_CODE_INSERT_SUBSCRIBER_DATA;
-    idr_message = &s6a_message->idr_message;
-    ogs_assert(idr_message);
-    subscription_data = &idr_message->subscription_data;
-    ogs_assert(subscription_data);
-
     /* Create answer header */
     qry = *msg;
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
     ogs_assert(ret == 0);
     ans = *msg;
 
+    /* Allocate message structure early for proper cleanup */
+    s6a_message = ogs_calloc(1, sizeof(ogs_diam_s6a_message_t));
+    if (!s6a_message) {
+        ogs_error("Failed to allocate s6a_message");
+        result_code = OGS_DIAM_OUT_OF_SPACE;
+        goto error_out;
+    }
+
+    s6a_message->cmd_code = OGS_DIAM_S6A_CMD_CODE_INSERT_SUBSCRIBER_DATA;
+    idr_message = &s6a_message->idr_message;
+    subscription_data = &idr_message->subscription_data;
+
+    /* Get User-Name AVP */
     ret = fd_msg_search_avp(qry, ogs_diam_user_name, &avp);
     ogs_assert(ret == 0);
+    if (!avp) {
+        ogs_error("User-Name AVP not found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        goto error_out;
+    }
+
     ret = fd_msg_avp_hdr(avp, &hdr);
     ogs_assert(ret == 0);
+    if (!hdr->avp_value->os.data || hdr->avp_value->os.len == 0) {
+        ogs_error("Invalid User-Name AVP data");
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        goto error_out;
+    }
 
     ogs_cpystrn(imsi_bcd, (char*)hdr->avp_value->os.data,
         ogs_min(hdr->avp_value->os.len, OGS_MAX_IMSI_BCD_LEN)+1);
 
     mme_ue = mme_ue_find_by_imsi_bcd(imsi_bcd);
-
     if (!mme_ue) {
         ogs_error("Insert Subscriber Data for Unknown IMSI%s", imsi_bcd);
         result_code = OGS_DIAM_S6A_ERROR_USER_UNKNOWN;
-        goto out;
+        goto error_out;
     }
 
-    /* AVP: 'Subscription-Data'(1400)
-     * The Subscription-Data AVP contains the information related to the user
-     * profile relevant for EPS and GERAN/UTRAN.
-     * Reference: 3GPP TS 29.272-f70
-     */
+    /* AVP: 'Subscription-Data'(1400) - Optional */
     ret = fd_msg_search_avp(qry, ogs_diam_s6a_subscription_data, &avp);
     ogs_assert(ret == 0);
     if (avp) {
@@ -2111,16 +2370,19 @@
             ogs_info("%s Subscription-Data is Empty.", imsi_bcd);
         } else {
             has_subscriber_data = true;
-            uint32_t subdatamask = 0;
             ret = mme_s6a_subscription_data_from_avp(avp, subscription_data,
                 mme_ue, &subdatamask);
-            /* Clang scan-build SA: Value stored is not used: add ogs_assert(). */
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to parse subscription data");
+                result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+                goto error_out;
+            }
             idr_message->subdatamask = subdatamask;
             ogs_info("%s Subscription-Data Processed.", imsi_bcd);
         }
     }
 
+    /* AVP: 'IDR-Flags'(1490) - Optional */
     ret = fd_msg_search_avp(qry, ogs_diam_s6a_idr_flags, &avp);
     ogs_assert(ret == 0);
     if (avp) {
@@ -2129,25 +2391,25 @@
         idr_message->idr_flags = hdr->avp_value->i32;
     }
 
+    /* Handle EPS-Location-Information request */
     if (idr_message->idr_flags & OGS_DIAM_S6A_IDR_FLAGS_EPS_LOCATION_INFO) {
         char buf8;
-
         uint8_t ida_ecgi8;
         uint8_t ida_tai5;
         ogs_time_t ida_age;
-
         ogs_nas_plmn_id_t ida_plmn_buf;
         char ida_cell_id_hex9;
         char ida_tac_hex5;
-
-        uint32_t ida_cell_id = mme_ue->e_cgi.cell_id;
-        uint16_t ida_tac = mme_ue->tai.tac;
-
+        uint32_t ida_cell_id;
+        uint16_t ida_tac;
         struct avp *avp_mme_location_information;
         struct avp *avp_e_utran_cell_global_identity;
         struct avp *avp_tracking_area_identity;
         struct avp *avp_age_of_location_information;
 
+        ida_cell_id = mme_ue->e_cgi.cell_id;
+        ida_tac = mme_ue->tai.tac;
+
         ogs_snprintf(ida_cell_id_hex, sizeof(ida_cell_id_hex),
                 "%08x", ida_cell_id);
         memcpy(ida_ecgi,
@@ -2210,6 +2472,8 @@
         ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
         ogs_assert(ret == 0);
     }
+
+    /* Handle EPS-User-State request */
     if (idr_message->idr_flags & OGS_DIAM_S6A_IDR_FLAGS_EPS_USER_STATE) {
 #define OGS_DIAM_S6A_USER_STATE_DETACHED                           0
 #define OGS_DIAM_S6A_USER_STATE_ATTACHED_NOT_REACHABLE_FOR_PAGING  1
@@ -2217,12 +2481,13 @@
 #define OGS_DIAM_S6A_USER_STATE_CONNECTED_NOT_REACHABLE_FOR_PAGING 3
 #define OGS_DIAM_S6A_USER_STATE_CONNECTED_REACHABLE_FOR_PAGING     4
 #define OGS_DIAM_S6A_USER_STATE_RESERVED                           5
+
         struct avp *avp_eps_user_state = NULL;
         struct avp *avp_mme_user_state = NULL;
         struct avp *avp_user_state = NULL;
         uint32_t user_state = 0;
 
-        /* check user state */
+        /* Check user state */
         if (!ECM_CONNECTED(mme_ue))
             user_state = OGS_DIAM_S6A_USER_STATE_DETACHED;
         else if (mme_ue->paging.failed)
@@ -2231,9 +2496,11 @@
             user_state = OGS_DIAM_S6A_USER_STATE_CONNECTED_REACHABLE_FOR_PAGING;
 
         /* Set the EPS-User-State AVP */
-        ret = fd_msg_avp_new(ogs_diam_s6a_eps_user_state, 0, &avp_eps_user_state);
+        ret = fd_msg_avp_new(ogs_diam_s6a_eps_user_state, 0,
+                             &avp_eps_user_state);
         ogs_assert(ret == 0);
-        ret = fd_msg_avp_new(ogs_diam_s6a_mme_user_state, 0, &avp_mme_user_state);
+        ret = fd_msg_avp_new(ogs_diam_s6a_mme_user_state, 0,
+                             &avp_mme_user_state);
         ogs_assert(ret == 0);
         ret = fd_msg_avp_new(ogs_diam_s6a_user_state, 0, &avp_user_state);
         ogs_assert(ret == 0);
@@ -2241,13 +2508,17 @@
         val.i32 = user_state;
         ret = fd_msg_avp_setvalue(avp_user_state, &val);
         ogs_assert(ret == 0);
-        ret = fd_msg_avp_add(avp_mme_user_state, MSG_BRW_LAST_CHILD, avp_user_state);
+        ret = fd_msg_avp_add(avp_mme_user_state, MSG_BRW_LAST_CHILD,
+                             avp_user_state);
         ogs_assert(ret == 0);
-        ret = fd_msg_avp_add(avp_eps_user_state, MSG_BRW_LAST_CHILD, avp_mme_user_state);
+        ret = fd_msg_avp_add(avp_eps_user_state, MSG_BRW_LAST_CHILD,
+                             avp_mme_user_state);
         ogs_assert(ret == 0);
         ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp_eps_user_state);
         ogs_assert(ret == 0);
     }
+
+    /* Validate that we have meaningful data to process */
     if (!has_subscriber_data &&
         !(idr_message->idr_flags & OGS_DIAM_S6A_IDR_FLAGS_EPS_LOCATION_INFO) &&
         !(idr_message->idr_flags & OGS_DIAM_S6A_IDR_FLAGS_EPS_USER_STATE))
@@ -2262,7 +2533,7 @@
         goto outnoexp;
     }
 
-    /* Set the Origin-Host, Origin-Realm, andResult-Code AVPs */
+    /* Set the Origin-Host, Origin-Realm, and Result-Code AVPs */
     ret = fd_msg_rescode_set(ans, (char*)"DIAMETER_SUCCESS", NULL, NULL, 1);
     ogs_assert(ret == 0);
 
@@ -2287,13 +2558,18 @@
     ogs_debug("Insert-Subscriber-Data-Answer");
 
     /* Add this value to the stats */
-    ogs_assert( pthread_mutex_lock(&ogs_diam_stats_self()->stats_lock) == 0);
+    ogs_assert(pthread_mutex_lock(&ogs_diam_stats_self()->stats_lock) == 0);
     ogs_diam_stats_self()->stats.nb_echoed++;
-    ogs_assert( pthread_mutex_unlock(&ogs_diam_stats_self()->stats_lock) == 0);
+    ogs_assert(pthread_mutex_unlock(&ogs_diam_stats_self()->stats_lock) == 0);
 
-    int rv;
+    /* Send event to MME */
     e = mme_event_new(MME_EVENT_S6A_MESSAGE);
-    ogs_assert(e);
+    if (!e) {
+        ogs_error("Failed to create MME event");
+        ogs_subscription_data_free(subscription_data);
+        ogs_free(s6a_message);
+        return 0;
+    }
     e->mme_ue_id = mme_ue->id;
     e->s6a_message = s6a_message;
     rv = ogs_queue_push(ogs_app()->queue, e);
@@ -2304,13 +2580,25 @@
         mme_event_free(e);
     } else {
         ogs_pollset_notify(ogs_app()->pollset);
+        /* Transfer ownership of s6a_message to event */
+        s6a_message = NULL;
     }
 
     return 0;
 
-out:
+error_out:
+    /* Free s6a_message if it wasn't transferred to event */
+    if (s6a_message) {
+        if (subscription_data) {
+            ogs_subscription_data_free(subscription_data);
+        }
+        ogs_free(s6a_message);
+    }
+
+    /* Set appropriate error result code */
     ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
     ogs_assert(ret == 0);
+
 outnoexp:
     /* Set the Auth-Session-State AVP */
     ret = fd_msg_avp_new(ogs_diam_auth_session_state, 0, &avp);
@@ -2326,12 +2614,10 @@
             ans, OGS_DIAM_S6A_APPLICATION_ID);
     ogs_assert(ret == 0);
 
-    /* Send the answer */
+    /* Send error response */
     ret = fd_msg_send(msg, NULL, NULL);
     ogs_assert(ret == 0);
 
-    ogs_free(s6a_message);
-
     return 0;
 }
 
@@ -2355,13 +2641,13 @@
     /* Specific handler for Cancel-Location-Request */
     memset(&data, 0, sizeof(data));
     data.command = ogs_diam_s6a_cmd_clr;
-    ret = fd_disp_register(mme_ogs_diam_s6a_clr_cb, DISP_HOW_CC, &data, NULL,
+    ret = fd_disp_register(mme_s6a_clr_cb, DISP_HOW_CC, &data, NULL,
                 &hdl_s6a_clr);
     ogs_assert(ret == 0);
 
     /* Specific handler for Insert-Subscriber-Data-Request */
     data.command = ogs_diam_s6a_cmd_idr;
-    ret = fd_disp_register(mme_ogs_diam_s6a_idr_cb, DISP_HOW_CC, &data, NULL,
+    ret = fd_disp_register(mme_s6a_idr_cb, DISP_HOW_CC, &data, NULL,
                 &hdl_s6a_idr);
     ogs_assert(ret == 0);

open5gs_2.7.6.tar.xz/src/mme/mme-fd-path.h -> open5gs_2.7.7.tar.xz/src/mme/mme-fd-path.h Changed

open5gs_2.7.6.tar.xz/src/mme/mme-gtp-path.c -> open5gs_2.7.7.tar.xz/src/mme/mme-gtp-path.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2026 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -271,7 +271,6 @@
     mme_ue_t *mme_ue = NULL;
     sgw_ue_t *sgw_ue = NULL;
 
-    ogs_assert(enb_ue);
     mme_ue = mme_ue_find_by_id(sess->mme_ue_id);
     ogs_assert(mme_ue);
     sgw_ue = sgw_ue_find_by_id(mme_ue->sgw_ue_id);
@@ -301,7 +300,10 @@
     }
     xact->create_action = create_action;
     xact->local_teid = mme_ue->gn.mme_gn_teid;
-    xact->enb_ue_id = enb_ue->id;
+    if (enb_ue)
+        xact->enb_ue_id = enb_ue->id;
+    else
+        xact->enb_ue_id = OGS_INVALID_POOL_ID;
 
     rv = ogs_gtp_xact_commit(xact);
     ogs_expect(rv == OGS_OK);
@@ -321,7 +323,6 @@
     ogs_gtp2_header_t h;
     ogs_pkbuf_t *pkbuf = NULL;
 
-    ogs_assert(enb_ue);
     ogs_assert(mme_ue);
     sgw_ue = sgw_ue_find_by_id(mme_ue->sgw_ue_id);
     ogs_assert(sgw_ue);
@@ -345,7 +346,10 @@
     }
     xact->modify_action = modify_action;
     xact->local_teid = mme_ue->gn.mme_gn_teid;
-    xact->enb_ue_id = enb_ue->id;
+    if (enb_ue)
+        xact->enb_ue_id = enb_ue->id;
+    else
+        xact->enb_ue_id = OGS_INVALID_POOL_ID;
 
     rv = ogs_gtp_xact_commit(xact);
     ogs_expect(rv == OGS_OK);
@@ -362,7 +366,6 @@
     ogs_gtp_xact_t *xact = NULL;
     mme_ue_t *mme_ue = NULL;
 
-    ogs_assert(enb_ue);
     ogs_assert(action);
     ogs_assert(sess);
     mme_ue = mme_ue_find_by_id(sess->mme_ue_id);
@@ -388,7 +391,10 @@
     }
     xact->delete_action = action;
     xact->local_teid = mme_ue->gn.mme_gn_teid;
-    xact->enb_ue_id = enb_ue->id;
+    if (enb_ue)
+        xact->enb_ue_id = enb_ue->id;
+    else
+        xact->enb_ue_id = OGS_INVALID_POOL_ID;
     ogs_debug("delete_session_request - xact:%p, sess:%p", xact, sess);
 
     rv = ogs_gtp_xact_commit(xact);
@@ -403,7 +409,6 @@
     mme_sess_t *sess = NULL, *next_sess = NULL;
     sgw_ue_t *sgw_ue = NULL;
 
-    ogs_assert(enb_ue);
     ogs_assert(mme_ue);
     sgw_ue = sgw_ue_find_by_id(mme_ue->sgw_ue_id);
     ogs_assert(sgw_ue);

open5gs_2.7.6.tar.xz/src/mme/mme-init.c -> open5gs_2.7.7.tar.xz/src/mme/mme-init.c Changed

open5gs_2.7.6.tar.xz/src/mme/mme-path.c -> open5gs_2.7.7.tar.xz/src/mme/mme-path.c Changed

@@ -29,7 +29,6 @@
 {
     int r, xact_count;
     ogs_assert(mme_ue);
-    ogs_assert(enb_ue);
 
     xact_count = mme_ue_xact_count(mme_ue, OGS_GTP_LOCAL_ORIGINATOR);
 
@@ -86,8 +85,20 @@
                         S1AP_Cause_PR_nas, S1AP_CauseNas_normal_release,
                         S1AP_UE_CTX_REL_UE_CONTEXT_REMOVE, 0));
             } else {
-                ogs_warn("%s MME-UE Context Removed", mme_ue->imsi_bcd);
-                mme_ue_remove(mme_ue);
+            /*
+             * No S1 context exists (eNB UE context already gone).
+             *
+             * Historically, this path removed the UE context immediately.
+             * That can free mme_ue while EMM FSM is still handling the timer
+             * event, which may lead to invalid FSM transitions or assertions.
+             *
+             * Defer UE removal to EMM FSM by setting ue_context_will_remove.
+             * The caller will transition to emm_state_ue_context_will_remove,
+             * and the removal will be performed on state entry.
+             */
+                ogs_warn("%s No S1 Context - defer UE removal to FSM",
+                    mme_ue->imsi_bcd);
+                mme_ue->ue_context_will_remove = true;
             }
         }
         break;
@@ -325,3 +336,128 @@
     if (failed)
         mme_ue->paging.failed = true;
 }
+
+/* ----------------------------------------------------------------------
+ * Function: mme_send_delete_session_or_tau_accept
+ * ----------------------------------------------------------------------
+ * - Check UE's EPS Bearer Context Status (BCS) regardless of active_flag
+ *   against MME's sessions before sending TAU ACCEPT.
+ * - If UE does not report the default bearer EBI, delete that session.
+ * - Otherwise, send TAU ACCEPT immediately.
+ * ---------------------------------------------------------------------- */
+void mme_send_delete_session_or_tau_accept(enb_ue_t *enb_ue, mme_ue_t *mme_ue)
+{
+    sgw_ue_t *sgw_ue = NULL;
+    mme_sess_t *sess = NULL;
+    mme_bearer_t *def = NULL;
+
+    uint16_t mask;
+    uint8_t ebi;
+    int deleted = 0;
+
+    ogs_assert(enb_ue);
+    ogs_assert(mme_ue);
+
+    mask = mme_ue->tracking_area_update_request_ebcs_value;
+
+    ogs_list_for_each(&mme_ue->sess_list, sess) {
+        def = mme_default_bearer_in_sess(sess);
+        if (!def) {
+            ogs_warn("%s No default bearer; skip session", mme_ue->imsi_bcd);
+            continue;
+        }
+
+        ebi = def->ebi;
+        if (ebi > 15) {
+            ogs_warn("%s Invalid EBI=%u; skip", mme_ue->imsi_bcd, ebi);
+            continue;
+        }
+
+        /* If UE's BCS bit for this EBI is 0,
+         * delete the session */
+        if (!(mask & (1 << ebi))) {
+            ogs_warn("%s BCS mismatch: UE missing EBI=%u",
+                    mme_ue->imsi_bcd, ebi);
+            sgw_ue = sgw_ue_find_by_id(mme_ue->sgw_ue_id);
+            ogs_assert(sgw_ue);
+
+            GTP_COUNTER_INCREMENT(
+                mme_ue, GTP_COUNTER_DELETE_SESSION_BY_TAU);
+
+            mme_gtp_send_delete_session_request(
+                enb_ue, sgw_ue, sess,
+                OGS_GTP_DELETE_SEND_TAU_ACCEPT);
+
+            deleted++;
+        }
+    }
+
+    if (deleted > 0) {
+        ogs_warn("%s Deleted %d session(s) due to BCS mismatch, "
+                "active_flag=%d",
+                mme_ue->imsi_bcd, deleted,
+                mme_ue->nas_eps.update.active_flag);
+    } else {
+        /*
+         * Choose S1AP procedure based on active_flag:
+         *  - active_flag==1 : InitialContextSetup
+         *  - active_flag==0 : DownlinkNASTransport
+         */
+        ogs_info("%s Send TAU accept(BCS match, active_flag=%d)",
+                 mme_ue->imsi_bcd, mme_ue->nas_eps.update.active_flag);
+        mme_send_tau_accept_and_check_release(enb_ue, mme_ue);
+    }
+}
+
+void mme_send_tau_accept_and_check_release(enb_ue_t *enb_ue, mme_ue_t *mme_ue)
+{
+    int r;
+
+    ogs_assert(mme_ue);
+    ogs_assert(enb_ue);
+
+    /*
+     * If BCS mismatch deleted all sessions, InitialContextSetup is impossible
+     * (requires E-RABs). Fall back to DownlinkNASTransport to deliver TAU
+     * Accept without bearer setup. The UE reported no bearers via BCS,
+     * so it can re-establish PDN connectivity after TAU completes.
+     */
+    if (mme_ue->tracking_area_update_accept_proc ==
+            S1AP_ProcedureCode_id_InitialContextSetup &&
+            ogs_list_count(&mme_ue->sess_list) == 0) {
+        ogs_warn("%s No sessions after BCS cleanup; "
+                "downgrade InitialContextSetup to DownlinkNASTransport",
+                mme_ue->imsi_bcd);
+        mme_ue->tracking_area_update_accept_proc =
+            S1AP_ProcedureCode_id_downlinkNASTransport;
+    }
+
+    r = nas_eps_send_tau_accept(mme_ue,
+            mme_ue->tracking_area_update_accept_proc);
+    ogs_expect(r == OGS_OK);
+    ogs_assert(r != OGS_ERROR);
+
+    /*
+     * TS 24.301 Ch5.5.3.3
+     * When active_flag is 0, check if the P-TMSI has been updated.
+     * If the P-TMSI has changed, wait to receive the TAU Complete message
+     * from the UE before sending the UEContextReleaseCommand.
+     *
+     * This ensures that the UE has acknowledged the new P-TMSI,
+     * allowing the TAU procedure to complete successfully
+     * and maintaining synchronization between the UE and the network.
+     */
+    ogs_info("%s TAU done (sgsap_connected=%d, next_ptmsi=%u)",
+         mme_ue->imsi_bcd,
+         MME_SGSAP_IS_CONNECTED(mme_ue),
+         (unsigned)mme_ue->next.p_tmsi);
+    if (!mme_ue->nas_eps.update.active_flag &&
+        !MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue)) {
+        enb_ue->relcause.group = S1AP_Cause_PR_nas;
+        enb_ue->relcause.cause = S1AP_CauseNas_normal_release;
+
+        ogs_info("%s release access bearer", mme_ue->imsi_bcd);
+
+        mme_send_release_access_bearer_or_ue_context_release(enb_ue);
+    }
+}

open5gs_2.7.6.tar.xz/src/mme/mme-path.h -> open5gs_2.7.7.tar.xz/src/mme/mme-path.h Changed

open5gs_2.7.6.tar.xz/src/mme/mme-s11-handler.c -> open5gs_2.7.7.tar.xz/src/mme/mme-s11-handler.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2026 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -173,12 +173,47 @@
     /* Not Implemented */
 }
 
+static void mme_s11_create_session_fail(
+        enb_ue_t *enb_ue, mme_ue_t *mme_ue,
+        int create_action, uint8_t fail_cause,
+        const char *reason)
+{
+    int r;
+
+    ogs_assert(mme_ue);
+
+    if (reason)
+        ogs_error("%s CreateSessionResponse failure: %s Cause:%d",
+                mme_ue->imsi_bcd, reason, fail_cause);
+    else
+        ogs_error("%s CreateSessionResponse failure Cause:%d",
+                mme_ue->imsi_bcd, fail_cause);
+
+    if (create_action == OGS_GTP_CREATE_IN_ATTACH_REQUEST) {
+        r = nas_eps_send_attach_reject(enb_ue, mme_ue,
+                OGS_NAS_EMM_CAUSE_NETWORK_FAILURE,
+                OGS_NAS_ESM_CAUSE_NETWORK_FAILURE);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+    } else if (create_action == OGS_GTP_CREATE_IN_TRACKING_AREA_UPDATE) {
+        r = nas_eps_send_tau_reject(enb_ue, mme_ue,
+                OGS_NAS_EMM_CAUSE_NETWORK_FAILURE);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+    }
+
+    if (enb_ue)
+        mme_send_delete_session_or_mme_ue_context_release(enb_ue, mme_ue);
+    else
+        ogs_error("No S1 Context");
+}
+
 void mme_s11_handle_create_session_response(
         ogs_gtp_xact_t *xact, mme_ue_t *mme_ue_from_teid,
         ogs_gtp2_create_session_response_t *rsp)
 {
     int i, r, rv;
-    uint8_t cause_value = OGS_GTP2_CAUSE_UNDEFINED_VALUE;
+    uint8_t fail_cause = OGS_GTP2_CAUSE_REQUEST_REJECTED_REASON_NOT_SPECIFIED;
     uint8_t session_cause = OGS_GTP2_CAUSE_UNDEFINED_VALUE;
     uint8_t bearer_cause = OGS_GTP2_CAUSE_UNDEFINED_VALUE;
     ogs_gtp2_f_teid_t *sgw_s11_teid = NULL;
@@ -196,6 +231,7 @@
     ogs_gtp2_ambr_t *ambr = NULL;
     uint16_t decoded = 0;
     int create_action = 0;
+    const char *fail_reason = NULL;
 
     ogs_assert(rsp);
 
@@ -206,6 +242,7 @@
      ********************/
     ogs_assert(xact);
     create_action = xact->create_action;
+
     sess = mme_sess_find_by_id(OGS_POINTER_TO_UINT(xact->data));
     if (sess)
         mme_ue = mme_ue_find_by_id(sess->mme_ue_id);
@@ -231,60 +268,64 @@
         ogs_error("MME-UE Context has already been removed");
         return;
     }
+
     source_ue = sgw_ue_find_by_id(mme_ue->sgw_ue_id);
-    ogs_assert(source_ue);
+    if (!source_ue) {
+        fail_reason = "No SGW UE Context";
+        fail_cause = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+        goto fail;
+    }
 
     if (create_action == OGS_GTP_CREATE_IN_PATH_SWITCH_REQUEST) {
         target_ue = sgw_ue_find_by_id(source_ue->target_ue_id);
-        ogs_assert(target_ue);
+        if (!target_ue) {
+            fail_reason = "No target SGW UE Context";
+            fail_cause = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+            goto fail;
+        }
     } else {
         target_ue = source_ue;
-        ogs_assert(target_ue);
     }
 
     /************************
      * Getting Cause Value
      ************************/
-    if (rsp->cause.presence && rsp->cause.data) {
+    if (rsp->cause.presence == 0) {
+        fail_cause = OGS_GTP2_CAUSE_MANDATORY_IE_MISSING;
+        fail_reason = "Mandatory IE missing";
+        goto fail;
+    }
+
+    if (rsp->cause.data) {
         ogs_gtp2_cause_t *cause = rsp->cause.data;
         ogs_assert(cause);
         session_cause = cause->value;
+    } else {
+        fail_cause = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+        fail_reason = "Invalid Cause IE";
+        goto fail;
     }
 
     /************************
      * Check MME-UE Context
      ************************/
-    cause_value = OGS_GTP2_CAUSE_REQUEST_ACCEPTED;
-
     if (!mme_ue_from_teid) {
         ogs_error("%s No Context in TEID Cause:%d",
                 mme_ue->imsi_bcd, session_cause);
-        cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
-    }
-
-    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
-        if (create_action == OGS_GTP_CREATE_IN_ATTACH_REQUEST) {
-            ogs_error("%s Attach reject Cause:%d",
-                    mme_ue->imsi_bcd, session_cause);
-            r = nas_eps_send_attach_reject(enb_ue, mme_ue,
-                    OGS_NAS_EMM_CAUSE_NETWORK_FAILURE,
-                    OGS_NAS_ESM_CAUSE_NETWORK_FAILURE);
-            ogs_expect(r == OGS_OK);
-            ogs_assert(r != OGS_ERROR);
-        }
-        mme_send_delete_session_or_mme_ue_context_release(enb_ue, mme_ue);
-        return;
+        fail_cause = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+        fail_reason = "No Context in TEID";
+        goto fail;
     }
 
     /*****************************************
      * Check Mandatory/Conditional IE Missing
      *****************************************/
-    ogs_assert(cause_value == OGS_GTP2_CAUSE_REQUEST_ACCEPTED);
-
     if (rsp->sender_f_teid_for_control_plane.presence == 0) {
         ogs_error("%s No S11 TEID Cause:%d",
                 mme_ue->imsi_bcd, session_cause);
-        cause_value = OGS_GTP2_CAUSE_CONDITIONAL_IE_MISSING;
+        fail_cause = OGS_GTP2_CAUSE_CONDITIONAL_IE_MISSING;
+        fail_reason = "Conditional IE missing";
+        goto fail;
     }
 
     switch (create_action) {
@@ -292,53 +333,40 @@
         /* No need for PAA or S5C TEID in PathSwitchRequest */
         break;
     case OGS_GTP_CREATE_IN_TRACKING_AREA_UPDATE:
-        /* No need for PAA or S5C TEID in 2G->4G mobility, it was already provided by SGSN peer */
+        /* 2G->4G mobility: PAA/S5C TEID may already exist from SGSN */
         break;
     default:
         if (rsp->pgw_s5_s8__s2a_s2b_f_teid_for_pmip_based_interface_or_for_gtp_based_control_plane_interface.presence == 0) {
             ogs_error("%s No S5C TEID Cause:%d",
                     mme_ue->imsi_bcd, session_cause);
-            cause_value = OGS_GTP2_CAUSE_CONDITIONAL_IE_MISSING;
+            fail_cause = OGS_GTP2_CAUSE_CONDITIONAL_IE_MISSING;
+            fail_reason = "Conditional IE missing";
+            goto fail;
         }
 
         if (rsp->pdn_address_allocation.presence == 0) {
             ogs_error("%s No PDN Address Allocation Cause:%d",
                     mme_ue->imsi_bcd, session_cause);
-            cause_value = OGS_GTP2_CAUSE_CONDITIONAL_IE_MISSING;
+            fail_cause = OGS_GTP2_CAUSE_CONDITIONAL_IE_MISSING;
+            fail_reason = "Conditional IE missing";
+            goto fail;
         }
     }
 
-    if (rsp->cause.presence == 0) {
-        ogs_error("%s No Cause VALUE:%d", mme_ue->imsi_bcd, session_cause);
-        cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_MISSING;
-    }
-
-    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
-        if (create_action == OGS_GTP_CREATE_IN_ATTACH_REQUEST) {
-            ogs_error("%s Attach reject Cause:%d",
-                    mme_ue->imsi_bcd, session_cause);
-            r = nas_eps_send_attach_reject(enb_ue, mme_ue,
-                    OGS_NAS_EMM_CAUSE_NETWORK_FAILURE,
-                    OGS_NAS_ESM_CAUSE_NETWORK_FAILURE);
-            ogs_expect(r == OGS_OK);
-            ogs_assert(r != OGS_ERROR);
-        } else if (create_action == OGS_GTP_CREATE_IN_TRACKING_AREA_UPDATE) {
-            ogs_error("%s TAU reject Cause:%d",
-                    mme_ue->imsi_bcd, session_cause);
-            r = nas_eps_send_tau_reject(enb_ue, mme_ue,
-                    OGS_NAS_EMM_CAUSE_NETWORK_FAILURE);
-            ogs_expect(r == OGS_OK);
-            ogs_assert(r != OGS_ERROR);
+    if (rsp->pdn_address_allocation.presence) {
+        if (rsp->pdn_address_allocation.len < OGS_PAA_IPV4_LEN ||
+            rsp->pdn_address_allocation.len > OGS_PAA_IPV4V6_LEN) {
+            ogs_error("Invalid PAA IE Length:%d",
+                    rsp->pdn_address_allocation.len);
+            fail_cause = OGS_GTP2_CAUSE_INVALID_LENGTH;
+            fail_reason = "Invalid Length";
+            goto fail;
         }
-        mme_send_delete_session_or_mme_ue_context_release(enb_ue, mme_ue);
-        return;
     }
 
     /********************
      * Check Cause Value
      ********************/
-    ogs_assert(cause_value == OGS_GTP2_CAUSE_REQUEST_ACCEPTED);
-
     for (i = 0; i < OGS_BEARER_PER_UE; i++) {
         ogs_gtp2_cause_t *cause = NULL;
 
@@ -346,24 +374,15 @@
             break;
         }
         cause = rsp->bearer_contexts_createdi.cause.data;
-        if (cause == NULL) {
-            ogs_error("No Cause Data");
-            continue;
-        }
+        ogs_assert(cause);
+
         bearer_cause = cause->value;
         if (bearer_cause != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
             ogs_error("%s GTP Bearer Cause VALUE:%d",
                     mme_ue->imsi_bcd, bearer_cause);
-            if (create_action == OGS_GTP_CREATE_IN_ATTACH_REQUEST) {
-                ogs_error("%s Attach reject", mme_ue->imsi_bcd);
-                r = nas_eps_send_attach_reject(enb_ue, mme_ue,
-                        OGS_NAS_EMM_CAUSE_NETWORK_FAILURE,
-                        OGS_NAS_ESM_CAUSE_NETWORK_FAILURE);
-                ogs_expect(r == OGS_OK);
-                ogs_assert(r != OGS_ERROR);
-            }
-            mme_send_delete_session_or_mme_ue_context_release(enb_ue, mme_ue);
-            return;
+            fail_cause = bearer_cause;
+            fail_reason = "Bearer Context not accepted";
+            goto fail;
         }
     }
 
@@ -374,68 +393,80 @@
         session_cause !=
             OGS_GTP2_CAUSE_NEW_PDN_TYPE_DUE_TO_SINGLE_ADDRESS_BEARER_ONLY) {
         ogs_error("%s GTP Cause VALUE:%d", mme_ue->imsi_bcd, session_cause);
-        if (create_action == OGS_GTP_CREATE_IN_ATTACH_REQUEST) {
-            ogs_error("%s Attach reject", mme_ue->imsi_bcd);
-            r = nas_eps_send_attach_reject(enb_ue, mme_ue,
-                    OGS_NAS_EMM_CAUSE_NETWORK_FAILURE,
-                    OGS_NAS_ESM_CAUSE_NETWORK_FAILURE);
-            ogs_expect(r == OGS_OK);
-            ogs_assert(r != OGS_ERROR);
-        }
-        mme_send_delete_session_or_mme_ue_context_release(enb_ue, mme_ue);
-        return;
+        fail_cause = session_cause;
+        fail_reason = "Session Cause not accepted";
+        goto fail;
     }
 
     /********************
      * Check ALL Context
      ********************/
-    ogs_assert(sess);
     session = sess->session;
-    ogs_assert(session);
-
-    ogs_assert(mme_ue);
-    ogs_assert(source_ue);
-    ogs_assert(target_ue);
+    if (!session) {
+        fail_cause = OGS_GTP2_CAUSE_SYSTEM_FAILURE;
+        fail_reason = "No Session";
+        goto fail;
+    }
 
     ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
             mme_ue->mme_s11_teid, target_ue->sgw_s11_teid);
 
     for (i = 0; i < OGS_BEARER_PER_UE; i++) {
-        if (rsp->bearer_contexts_createdi.presence == 0) {
+        if (rsp->bearer_contexts_createdi.presence == 0)
             break;
-        }
+
         if (rsp->bearer_contexts_createdi.eps_bearer_id.presence == 0) {
             ogs_error("No EPS Bearer ID");
-            break;
+            fail_cause = OGS_GTP2_CAUSE_MANDATORY_IE_MISSING;
+            fail_reason = "Missing EPS Bearer ID";
+            goto fail;
         }
         if (rsp->bearer_contexts_createdi.s1_u_enodeb_f_teid.presence == 0) {
             ogs_error("No SGW-S1U TEID");
-            break;
+            fail_cause = OGS_GTP2_CAUSE_MANDATORY_IE_MISSING;
+            fail_reason = "Missing SGW-S1U TEID";
+            goto fail;
         }
         if (rsp->bearer_contexts_createdi.s5_s8_u_sgw_f_teid.presence == 0) {
             ogs_error("No PGW-S5U TEID");
-            break;
+            fail_cause = OGS_GTP2_CAUSE_MANDATORY_IE_MISSING;
+            fail_reason = "Missing PGW-S5U TEID";
+            goto fail;
         }
 
         /* EPS Bearer ID */
         bearer = mme_bearer_find_by_ue_ebi(mme_ue,
                 rsp->bearer_contexts_createdi.eps_bearer_id.u8);
         if (!bearer) {
-            mme_send_delete_session_or_mme_ue_context_release(enb_ue, mme_ue);
-            return;
+            ogs_error("%s Unknown EPS Bearer ID %u",
+                    mme_ue->imsi_bcd,
+                    rsp->bearer_contexts_createdi.eps_bearer_id.u8);
+            fail_cause = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+            fail_reason = "Unknown EPS Bearer ID";
+            goto fail;
         }
 
         /* Data Plane(UL) : SGW-S1U */
         sgw_s1u_teid = rsp->bearer_contexts_createdi.s1_u_enodeb_f_teid.data;
+        ogs_assert(sgw_s1u_teid);
         bearer->sgw_s1u_teid = be32toh(sgw_s1u_teid->teid);
-        ogs_assert(OGS_OK ==
-                ogs_gtp2_f_teid_to_ip(sgw_s1u_teid, &bearer->sgw_s1u_ip));
+        if (OGS_OK !=
+                ogs_gtp2_f_teid_to_ip(sgw_s1u_teid, &bearer->sgw_s1u_ip)) {
+            fail_cause = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+            fail_reason = "Invalid SGW-S1U TEID";
+            goto fail;
+        }
 
         /* Data Plane(UL) : PGW-S5U */
         pgw_s5u_teid = rsp->bearer_contexts_createdi.s5_s8_u_sgw_f_teid.data;
+        ogs_assert(pgw_s5u_teid);
         bearer->pgw_s5u_teid = be32toh(pgw_s5u_teid->teid);
-        ogs_assert(OGS_OK ==
-                ogs_gtp2_f_teid_to_ip(pgw_s5u_teid, &bearer->pgw_s5u_ip));
+        if (OGS_OK !=
+                ogs_gtp2_f_teid_to_ip(pgw_s5u_teid, &bearer->pgw_s5u_ip)) {
+            fail_cause = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+            fail_reason = "Invalid PGW-S5U TEID";
+            goto fail;
+        }
 
         ogs_debug("    ENB_S1U_TEID%d SGW_S1U_TEID%d PGW_S5U_TEID%d",
             bearer->enb_s1u_teid, bearer->sgw_s1u_teid, bearer->pgw_s5u_teid);
@@ -445,12 +476,20 @@
             OGS_FSM_TRAN(&bearer->sm, esm_state_active);
     }
 
-    /* Bearer Level QoS */
+    /* Bearer QoS */
     if (rsp->bearer_contexts_created0.bearer_level_qos.presence) {
         decoded = ogs_gtp2_parse_bearer_qos(&bearer_qos,
             &rsp->bearer_contexts_created0.bearer_level_qos);
-        ogs_assert(decoded ==
-                rsp->bearer_contexts_created0.bearer_level_qos.len);
+        if (decoded != rsp->bearer_contexts_created0.bearer_level_qos.len) {
+            ogs_error("%s Invalid Bearer QoS IE length %u, decoded %u",
+                    mme_ue->imsi_bcd,
+                    rsp->bearer_contexts_created0.bearer_level_qos.len,
+                    decoded);
+            fail_cause = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+            fail_reason = "Invalid Bearer QoS IE length";
+            goto fail;
+        }
+
         session->qos.index = bearer_qos.qci;
         session->qos.arp.priority_level = bearer_qos.priority_level;
         session->qos.arp.pre_emption_capability =
@@ -461,14 +500,20 @@
 
     /* Control Plane(UL) : SGW-S11 */
     sgw_s11_teid = rsp->sender_f_teid_for_control_plane.data;
+    ogs_assert(sgw_s11_teid);
     target_ue->sgw_s11_teid = be32toh(sgw_s11_teid->teid);
 
     /* Control Plane(UL) : PGW-S5C */
     if (rsp->pgw_s5_s8__s2a_s2b_f_teid_for_pmip_based_interface_or_for_gtp_based_control_plane_interface.presence) {
         pgw_s5c_teid = rsp->pgw_s5_s8__s2a_s2b_f_teid_for_pmip_based_interface_or_for_gtp_based_control_plane_interface.data;
+        ogs_assert(pgw_s5c_teid);
         sess->pgw_s5c_teid = be32toh(pgw_s5c_teid->teid);
-        ogs_assert(OGS_OK ==
-                ogs_gtp2_f_teid_to_ip(pgw_s5c_teid, &sess->pgw_s5c_ip));
+        if (OGS_OK !=
+                ogs_gtp2_f_teid_to_ip(pgw_s5c_teid, &sess->pgw_s5c_ip)) {
+            fail_cause = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+            fail_reason = "Invalid S5C TEID";
+            goto fail;
+        }
     }
 
     /* PDN Addresss Allocation */
@@ -493,7 +538,7 @@
 #endif
     }
 
-    /* ePCO */
+    /* ePCO/PCO */
     if (rsp->extended_protocol_configuration_options.presence) {
         OGS_TLV_STORE_DATA(&sess->pgw_epco,
                 &rsp->extended_protocol_configuration_options);
@@ -504,23 +549,10 @@
                 &rsp->protocol_configuration_options);
     }
 
-    /* Bearer QoS */
-    if (rsp->bearer_contexts_created0.bearer_level_qos.presence) {
-        decoded = ogs_gtp2_parse_bearer_qos(&bearer_qos,
-            &rsp->bearer_contexts_created0.bearer_level_qos);
-        ogs_assert(rsp->bearer_contexts_created0.bearer_level_qos.len ==
-                decoded);
-        session->qos.index = bearer_qos.qci;
-        session->qos.arp.priority_level = bearer_qos.priority_level;
-        session->qos.arp.pre_emption_capability =
-                        bearer_qos.pre_emption_capability;
-        session->qos.arp.pre_emption_vulnerability =
-                        bearer_qos.pre_emption_vulnerability;
-    }
-
     /* AMBR */
     if (rsp->aggregate_maximum_bit_rate.presence) {
         ambr = rsp->aggregate_maximum_bit_rate.data;
+        ogs_assert(ambr);
         session->ambr.downlink = be32toh(ambr->downlink) * 1000;
         session->ambr.uplink = be32toh(ambr->uplink) * 1000;
     }
@@ -538,12 +570,18 @@
             ogs_expect(r == OGS_OK);
             ogs_assert(r != OGS_ERROR);
         } else {
-            ogs_assert(OGS_OK == sgsap_send_location_update_request(mme_ue));
+            if (OGS_OK != sgsap_send_location_update_request(mme_ue)) {
+                ogs_error("%s sgsap_send_location_update_request() failed",
+                        mme_ue->imsi_bcd);
+                fail_cause = OGS_GTP2_CAUSE_SYSTEM_FAILURE;
+                fail_reason = "SGs location update failed";
+                goto fail;
+            }
         }
 
     } else if (create_action == OGS_GTP_CREATE_IN_TRACKING_AREA_UPDATE) {
-        /* 3GPP TS 23.401 D.3.6 step 13, 14: */
-        mme_s6a_send_ulr(enb_ue, mme_ue);
+        /* 3GPP TS 23.401 D.3.6 "Gn/Gp SGSN to MME Tracking Area Update" step 13, 14: */
+        mme_s6a_send_ulr(enb_ue, mme_ue, OGS_DIAM_S6A_ULR_SINGLE_REGISTRATION_IND);
     } else if (create_action == OGS_GTP_CREATE_IN_UPLINK_NAS_TRANSPORT) {
         r = nas_eps_send_activate_default_bearer_context_request(
                 bearer, create_action);
@@ -565,6 +603,14 @@
         ogs_fatal("Invalid Create Session Action%d", create_action);
         ogs_assert_if_reached();
     }
+
+
+    return;
+
+fail:
+    mme_s11_create_session_fail(enb_ue, mme_ue,
+            create_action, fail_cause, fail_reason);
+    return;
 }
 
 void mme_s11_handle_modify_bearer_response(
@@ -729,11 +775,6 @@
         return;
     }
 
-    if (!enb_ue) {
-        ogs_error("ENB-S1 Context has already been removed");
-        return;
-    }
-
     if (!mme_ue) {
         ogs_error("MME-UE Context has already been removed");
         return;
@@ -828,7 +869,7 @@
     } else if (action == OGS_GTP_DELETE_SEND_RELEASE_WITH_UE_CONTEXT_REMOVE) {
         if (mme_sess_count(mme_ue) == 1) /* Last Session */ {
             if (ECM_IDLE(mme_ue)) {
-                mme_ue_remove(mme_ue);
+                MME_UE_REMOVE_WITH_PAGING_FAIL(mme_ue);
 
                 /* mme_sess_remove() should not be called here
                  * since mme_ue_remove() has already been executed. */
@@ -880,6 +921,25 @@
 
         return;
 
+    } else if (action == OGS_GTP_DELETE_SEND_TAU_ACCEPT) {
+
+        MME_SESS_CLEAR(sess);
+
+        if (!enb_ue) {
+            ogs_error("ENB-S1 Context has already been removed");
+            return;
+        }
+
+        GTP_COUNTER_CHECK(mme_ue, GTP_COUNTER_DELETE_SESSION_BY_TAU,
+
+            ogs_info("%s Send TAU accept(BCS match, active_flag=%d)",
+                     mme_ue->imsi_bcd, mme_ue->nas_eps.update.active_flag);
+            mme_send_tau_accept_and_check_release(enb_ue, mme_ue);
+
+        );
+
+        return;
+
     } else {
         ogs_fatal("Invalid action = %d", action);
         ogs_assert_if_reached();
@@ -1041,14 +1101,18 @@
 
     if (bearer->qos.mbr.downlink || bearer->qos.mbr.uplink ||
         bearer->qos.gbr.downlink || bearer->qos.gbr.uplink) {
-        if (bearer->qos.mbr.downlink == 0)
-            bearer->qos.mbr.downlink = MAX_BIT_RATE;
-        if (bearer->qos.mbr.uplink == 0)
-            bearer->qos.mbr.uplink = MAX_BIT_RATE;
-        if (bearer->qos.gbr.downlink == 0)
-            bearer->qos.gbr.downlink = MAX_BIT_RATE;
-        if (bearer->qos.gbr.uplink == 0)
-            bearer->qos.gbr.uplink = MAX_BIT_RATE;
+        if (bearer->qos.mbr.downlink == 0 ||
+            bearer->qos.mbr.downlink > OGS_MAX_BITRATE_S1AP)
+            bearer->qos.mbr.downlink = OGS_MAX_BITRATE_S1AP;
+        if (bearer->qos.mbr.uplink == 0 ||
+            bearer->qos.mbr.uplink > OGS_MAX_BITRATE_S1AP)
+            bearer->qos.mbr.uplink = OGS_MAX_BITRATE_S1AP;
+        if (bearer->qos.gbr.downlink == 0 ||
+            bearer->qos.gbr.downlink > OGS_MAX_BITRATE_S1AP)
+            bearer->qos.gbr.downlink = OGS_MAX_BITRATE_S1AP;
+        if (bearer->qos.gbr.uplink == 0 ||
+            bearer->qos.gbr.uplink > OGS_MAX_BITRATE_S1AP)
+            bearer->qos.gbr.uplink = OGS_MAX_BITRATE_S1AP;
     }
 
     /* Save Bearer TFT */
@@ -1684,10 +1748,8 @@
  *   included in Downlink Data Notification is "Error Indication received
  *   from RNC/eNodeB/S4-SGSN"
  */
-            enb_ue_t *enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);
-            ogs_assert(enb_ue);
-
-            r = s1ap_send_ue_context_release_command(enb_ue,
+            r = s1ap_send_ue_context_release_command(
+                    enb_ue_find_by_id(mme_ue->enb_ue_id),
                     S1AP_Cause_PR_nas, S1AP_CauseNas_normal_release,
                     S1AP_UE_CTX_REL_S1_PAGING, 0);
             ogs_expect(r == OGS_OK);
@@ -1759,7 +1821,10 @@
     }
 
     if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
-        mme_send_delete_session_or_mme_ue_context_release(source_ue, mme_ue);
+        if (source_ue)
+            mme_send_delete_session_or_mme_ue_context_release(source_ue, mme_ue);
+        else
+            ogs_error("ENB-S1 Context has already been removed");
         return;
     }
 
@@ -1774,7 +1839,10 @@
     }
 
     if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
-        mme_send_delete_session_or_mme_ue_context_release(source_ue, mme_ue);
+        if (source_ue)
+            mme_send_delete_session_or_mme_ue_context_release(source_ue, mme_ue);
+        else
+            ogs_error("ENB-S1 Context has already been removed");
         return;
     }
 
@@ -1785,7 +1853,11 @@
 
     if (session_cause != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
         ogs_error("%s GTP Cause VALUE:%d", mme_ue->imsi_bcd, session_cause);
-        mme_send_delete_session_or_mme_ue_context_release(source_ue, mme_ue);
+        if (source_ue)
+            mme_send_delete_session_or_mme_ue_context_release(
+                    source_ue, mme_ue);
+        else
+            ogs_error("ENB-S1 Context has already been removed");
         return;
     }

open5gs_2.7.6.tar.xz/src/mme/mme-s6a-handler.c -> open5gs_2.7.7.tar.xz/src/mme/mme-s6a-handler.c Changed

@@ -127,6 +127,10 @@
             return OGS_NAS_EMM_CAUSE_NO_EPS_BEARER_CONTEXT_ACTIVATED;
         }
 
+        /* Determine S1AP procedure and store it for reuse */
+        mme_ue->tracking_area_update_accept_proc =
+            S1AP_ProcedureCode_id_InitialContextSetup;
+
         /* Update CSMAP from Tracking area update request */
         mme_ue->csmap = mme_csmap_find_by_tai(&mme_ue->tai);
         if (mme_ue->csmap &&
@@ -137,13 +141,12 @@
              mme_ue->nas_eps.update.value ==
              OGS_NAS_EPS_UPDATE_TYPE_COMBINED_TA_LA_UPDATING_WITH_IMSI_ATTACH)) {
 
-            mme_ue->tracking_area_update_request_type =
-                MME_TAU_TYPE_UNPROTECTED_INGERITY;
             ogs_assert(OGS_OK == sgsap_send_location_update_request(mme_ue));
 
         } else {
+            ogs_info("%s TAU accept(Diameter ULA)", mme_ue->imsi_bcd);
             r = nas_eps_send_tau_accept(mme_ue,
-                    S1AP_ProcedureCode_id_InitialContextSetup);
+                    mme_ue->tracking_area_update_accept_proc);
             ogs_expect(r == OGS_OK);
             ogs_assert(r != OGS_ERROR);
         }
@@ -335,9 +338,8 @@
         }
         break;
     default:
-        ogs_fatal("Unsupported Cancellation-Type %d",
+        ogs_error("Unsupported Cancellation-Type %d",
             clr_message->cancellation_type);
-        ogs_assert_if_reached();
         break;
     }
 }

open5gs_2.7.6.tar.xz/src/mme/mme-sm.h -> open5gs_2.7.7.tar.xz/src/mme/mme-sm.h Changed

open5gs_2.7.6.tar.xz/src/mme/nas-path.c -> open5gs_2.7.7.tar.xz/src/mme/nas-path.c Changed

open5gs_2.7.6.tar.xz/src/mme/s1ap-build.c -> open5gs_2.7.7.tar.xz/src/mme/s1ap-build.c Changed

@@ -382,6 +382,11 @@
                 (long long)bearer->qos.gbr.downlink,
                 (long long)bearer->qos.gbr.uplink);
 
+            ogs_assert(bearer->qos.mbr.downlink <= OGS_MAX_BITRATE_S1AP);
+            ogs_assert(bearer->qos.mbr.uplink <= OGS_MAX_BITRATE_S1AP);
+            ogs_assert(bearer->qos.gbr.downlink <= OGS_MAX_BITRATE_S1AP);
+            ogs_assert(bearer->qos.gbr.uplink <= OGS_MAX_BITRATE_S1AP);
+
             gbrQosInformation =
                     CALLOC(1, sizeof(struct S1AP_GBR_QosInformation));
             asn_uint642INTEGER(&gbrQosInformation->e_RAB_MaximumBitrateDL,
@@ -581,7 +586,7 @@
          */
         ogs_list_for_each(&mme_ue->sess_list, sess) {
             ogs_list_for_each(&sess->bearer_list, bearer) {
-                if (OGS_FSM_CHECK(&bearer->sm, esm_state_inactive)) {
+                if (!OGS_FSM_CHECK(&bearer->sm, esm_state_active)) {
                     ogs_warn("No active EPS bearer %d", bearer->ebi);
                     ogs_warn("    IMSI%s NAS-EPS Type%d "
                             "ENB_UE_S1AP_ID%d MME_UE_S1AP_ID%d",
@@ -636,6 +641,9 @@
                     ogs_error("    IN-ACTIVE");
                 else if (OGS_FSM_CHECK(&bearer->sm, esm_state_active))
                     ogs_error("    ACTIVE");
+                else if (OGS_FSM_CHECK(&bearer->sm,
+                            esm_state_pdn_will_disconnect))
+                    ogs_error("    PDN will disconnect");
                 else
                     ogs_error("    OTHER STATE");
 
@@ -643,6 +651,9 @@
                         bearer->ebi, bearer->qos.index, bearer->sgw_s1u_teid);
             }
         }
+        ogs_error("Before ogs_s1ap_free()");
+        ogs_s1ap_free(&pdu);
+        ogs_error("After ogs_s1ap_free()");
         return NULL;
     }
 
@@ -1153,6 +1164,11 @@
         if (bearer->qos.mbr.downlink && bearer->qos.mbr.uplink &&
             bearer->qos.gbr.downlink && bearer->qos.gbr.uplink) {
 
+            ogs_assert(bearer->qos.mbr.downlink <= OGS_MAX_BITRATE_S1AP);
+            ogs_assert(bearer->qos.mbr.uplink <= OGS_MAX_BITRATE_S1AP);
+            ogs_assert(bearer->qos.gbr.downlink <= OGS_MAX_BITRATE_S1AP);
+            ogs_assert(bearer->qos.gbr.uplink <= OGS_MAX_BITRATE_S1AP);
+
             gbrQosInformation = CALLOC(1, sizeof(S1AP_GBR_QosInformation_t));
             asn_uint642INTEGER(&gbrQosInformation->e_RAB_MaximumBitrateDL,
                     bearer->qos.mbr.downlink);
@@ -1297,6 +1313,10 @@
         ogs_assert(bearer->qos.mbr.uplink);
         ogs_assert(bearer->qos.gbr.downlink);
         ogs_assert(bearer->qos.gbr.uplink);
+        ogs_assert(bearer->qos.mbr.downlink <= OGS_MAX_BITRATE_S1AP);
+        ogs_assert(bearer->qos.mbr.uplink <= OGS_MAX_BITRATE_S1AP);
+        ogs_assert(bearer->qos.gbr.downlink <= OGS_MAX_BITRATE_S1AP);
+        ogs_assert(bearer->qos.gbr.uplink <= OGS_MAX_BITRATE_S1AP);
 
         gbrQosInformation =
                 CALLOC(1, sizeof(S1AP_GBR_QosInformation_t));
@@ -2349,6 +2369,15 @@
             S1AP_E_RABToBeSetupItemHOReq_t *e_rab = NULL;
             S1AP_GBR_QosInformation_t *gbrQosInformation = NULL;
 
+            if (!OGS_FSM_CHECK(&bearer->sm, esm_state_active)) {
+                ogs_warn("No active EPS bearer %d", bearer->ebi);
+                ogs_warn("    IMSI%s NAS-EPS Type%d "
+                        "ENB_UE_S1AP_ID%d MME_UE_S1AP_ID%d",
+                        mme_ue->imsi_bcd, mme_ue->nas_eps.type,
+                        target_ue->enb_ue_s1ap_id, target_ue->mme_ue_s1ap_id);
+                continue;
+            }
+
             item = CALLOC(1, sizeof(S1AP_E_RABToBeSetupItemHOReqIEs_t));
             ASN_SEQUENCE_ADD(&E_RABToBeSetupListHOReq->list, item);
 
@@ -2377,6 +2406,10 @@
                 ogs_assert(bearer->qos.mbr.uplink);
                 ogs_assert(bearer->qos.gbr.downlink);
                 ogs_assert(bearer->qos.gbr.uplink);
+                ogs_assert(bearer->qos.mbr.downlink <= OGS_MAX_BITRATE_S1AP);
+                ogs_assert(bearer->qos.mbr.uplink <= OGS_MAX_BITRATE_S1AP);
+                ogs_assert(bearer->qos.gbr.downlink <= OGS_MAX_BITRATE_S1AP);
+                ogs_assert(bearer->qos.gbr.uplink <= OGS_MAX_BITRATE_S1AP);
 
                 gbrQosInformation =
                         CALLOC(1, sizeof(struct S1AP_GBR_QosInformation));
@@ -2401,6 +2434,31 @@
         }
     }
 
+    if (!E_RABToBeSetupListHOReq->list.count) {
+        ogs_list_for_each(&mme_ue->sess_list, sess) {
+            ogs_error("    APN%s",
+                    sess->session ? sess->session->name : "Unknown");
+            ogs_list_for_each(&sess->bearer_list, bearer) {
+                if (OGS_FSM_CHECK(&bearer->sm, esm_state_inactive))
+                    ogs_error("    IN-ACTIVE");
+                else if (OGS_FSM_CHECK(&bearer->sm, esm_state_active))
+                    ogs_error("    ACTIVE");
+                else if (OGS_FSM_CHECK(&bearer->sm,
+                            esm_state_pdn_will_disconnect))
+                    ogs_error("    PDN will disconnect");
+                else
+                    ogs_error("    OTHER STATE");
+
+                ogs_error("    EBI%d QCI%d SGW-S1U-TEID%d",
+                        bearer->ebi, bearer->qos.index, bearer->sgw_s1u_teid);
+            }
+        }
+        ogs_error("Before ogs_s1ap_free()");
+        ogs_s1ap_free(&pdu);
+        ogs_error("After ogs_s1ap_free()");
+        return NULL;
+    }
+
     ogs_s1ap_buffer_to_OCTET_STRING(
             source_totarget_transparentContainer->buf,
             source_totarget_transparentContainer->size,

open5gs_2.7.6.tar.xz/src/mme/s1ap-handler.c -> open5gs_2.7.7.tar.xz/src/mme/s1ap-handler.c Changed

@@ -139,6 +139,19 @@
         return;
     }
 
+    if (Global_ENB_ID->pLMNidentity.size != sizeof(enb->plmn_id)) {
+        ogs_error("Invalid PLMNIdentity size = %d (expected %d)",
+                (int)Global_ENB_ID->pLMNidentity.size,
+                (int)sizeof(enb->plmn_id));
+        group = S1AP_Cause_PR_misc;
+        cause = S1AP_CauseProtocol_semantic_error;
+
+        r = s1ap_send_s1_setup_failure(enb, group, cause);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
+
     if (!SupportedTAs) {
         ogs_error("No SupportedTAs");
         group = S1AP_Cause_PR_misc;
@@ -193,6 +206,30 @@
                 break;
             }
 
+            if (tAC->size != sizeof(uint16_t)) {
+                ogs_error("Invalid tAC size = %d (expected %d)",
+                        (int)tAC->size, (int)sizeof(uint16_t));
+                group = S1AP_Cause_PR_misc;
+                cause = S1AP_CauseProtocol_semantic_error;
+
+                r = s1ap_send_s1_setup_failure(enb, group, cause);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
+                return;
+            }
+
+            if (pLMNidentity->size != sizeof(ogs_plmn_id_t)) {
+                ogs_error("Invalid pLMNidentity size = %d (expected %d)",
+                        (int)pLMNidentity->size, (int)sizeof(ogs_plmn_id_t));
+                group = S1AP_Cause_PR_misc;
+                cause = S1AP_CauseProtocol_semantic_error;
+
+                r = s1ap_send_s1_setup_failure(enb, group, cause);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
+                return;
+            }
+
             memcpy(&enb->supported_ta_listenb->num_of_supported_ta_list.tac,
                     tAC->buf, sizeof(uint16_t));
             enb->supported_ta_listenb->num_of_supported_ta_list.tac =
@@ -335,6 +372,31 @@
                     break;
                 }
 
+                if (tAC->size != sizeof(uint16_t)) {
+                    ogs_error("Invalid tAC size = %d (expected %d)",
+                            (int)tAC->size, (int)sizeof(uint16_t));
+                    group = S1AP_Cause_PR_misc;
+                    cause = S1AP_CauseProtocol_semantic_error;
+
+                    r = s1ap_send_s1_setup_failure(enb, group, cause);
+                    ogs_expect(r == OGS_OK);
+                    ogs_assert(r != OGS_ERROR);
+                    return;
+                }
+
+                if (pLMNidentity->size != sizeof(ogs_plmn_id_t)) {
+                    ogs_error("Invalid pLMNidentity size = %d (expected %d)",
+                            (int)pLMNidentity->size,
+                            (int)sizeof(ogs_plmn_id_t));
+                    group = S1AP_Cause_PR_misc;
+                    cause = S1AP_CauseProtocol_semantic_error;
+
+                    r = s1ap_send_s1_setup_failure(enb, group, cause);
+                    ogs_expect(r == OGS_OK);
+                    ogs_assert(r != OGS_ERROR);
+                    return;
+                }
+
                 memcpy(&enb->supported_ta_list
                         enb->num_of_supported_ta_list.tac,
                         tAC->buf, sizeof(uint16_t));
@@ -500,8 +562,30 @@
             nas_guti.mme_gid = served_gummei->mme_gid0;
 
             /* size must be 1 */
+            if (S_TMSI->mMEC.size != 1) {
+                ogs_error("Invalid S_TMSI->mMEC.size = %d (expected 1)",
+                        (int)S_TMSI->mMEC.size);
+                r = s1ap_send_error_indication1(
+                        enb_ue,
+                        S1AP_Cause_PR_protocol,
+                        S1AP_CauseProtocol_semantic_error);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
+                return;
+            }
             memcpy(&nas_guti.mme_code, S_TMSI->mMEC.buf, S_TMSI->mMEC.size);
             /* size must be 4 */
+            if (S_TMSI->m_TMSI.size != 4) {
+                ogs_error("Invalid S_TMSI->m_TMSI.size = %d (expected 4)",
+                        (int)S_TMSI->m_TMSI.size);
+                r = s1ap_send_error_indication1(
+                        enb_ue,
+                        S1AP_Cause_PR_protocol,
+                        S1AP_CauseProtocol_semantic_error);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
+                return;
+            }
             memcpy(&nas_guti.m_tmsi, S_TMSI->m_TMSI.buf, S_TMSI->m_TMSI.size);
             nas_guti.m_tmsi = be32toh(nas_guti.m_tmsi);
 
@@ -586,18 +670,61 @@
     }
 
     pLMNidentity = &TAI->pLMNidentity;
-    ogs_assert(pLMNidentity && pLMNidentity->size == sizeof(ogs_plmn_id_t));
+    if (pLMNidentity->size != sizeof(enb_ue->saved.tai.plmn_id)) {
+        ogs_error("Invalid pLMNidentity->size = %d (expected %d)",
+                (int)pLMNidentity->size,
+                (int)sizeof(enb_ue->saved.tai.plmn_id));
+        r = s1ap_send_error_indication1(
+                enb_ue,
+                S1AP_Cause_PR_protocol,
+                S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     tAC = &TAI->tAC;
-    ogs_assert(tAC && tAC->size == sizeof(uint16_t));
+    if (tAC->size != sizeof(enb_ue->saved.tai.tac)) {
+        ogs_error("Invalid tAC->size = %d (expected %d)",
+                (int)tAC->size, (int)sizeof(enb_ue->saved.tai.tac));
+        r = s1ap_send_error_indication1(
+                enb_ue,
+                S1AP_Cause_PR_protocol,
+                S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     memcpy(&enb_ue->saved.tai.plmn_id, pLMNidentity->buf,
             sizeof(enb_ue->saved.tai.plmn_id));
     memcpy(&enb_ue->saved.tai.tac, tAC->buf, sizeof(enb_ue->saved.tai.tac));
     enb_ue->saved.tai.tac = be16toh(enb_ue->saved.tai.tac);
 
     pLMNidentity = &EUTRAN_CGI->pLMNidentity;
-    ogs_assert(pLMNidentity && pLMNidentity->size == sizeof(ogs_plmn_id_t));
+    if (pLMNidentity->size != sizeof(enb_ue->saved.e_cgi.plmn_id)) {
+        ogs_error("Invalid pLMNidentity->size = %d (expected %d)",
+                (int)pLMNidentity->size,
+                (int)sizeof(enb_ue->saved.e_cgi.plmn_id));
+        r = s1ap_send_error_indication1(
+                enb_ue,
+                S1AP_Cause_PR_protocol,
+                S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     cell_ID = &EUTRAN_CGI->cell_ID;
-    ogs_assert(cell_ID);
+    if (cell_ID->size != sizeof(enb_ue->saved.e_cgi.cell_id)) {
+        ogs_error("Invalid cell_ID->size = %d (expected %d)",
+                (int)cell_ID->size,
+                (int)sizeof(enb_ue->saved.e_cgi.cell_id));
+        r = s1ap_send_error_indication1(
+                enb_ue,
+                S1AP_Cause_PR_protocol,
+                S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     memcpy(&enb_ue->saved.e_cgi.plmn_id, pLMNidentity->buf,
             sizeof(enb_ue->saved.e_cgi.plmn_id));
     memcpy(&enb_ue->saved.e_cgi.cell_id, cell_ID->buf,
@@ -745,9 +872,26 @@
     }
 
     pLMNidentity = &TAI->pLMNidentity;
-    ogs_assert(pLMNidentity && pLMNidentity->size == sizeof(ogs_plmn_id_t));
+    if (pLMNidentity->size != sizeof(tai.plmn_id)) {
+        ogs_error("Invalid pLMNidentity->size = %d (expected %d)",
+                (int)pLMNidentity->size,
+                (int)sizeof(tai.plmn_id));
+        r = s1ap_send_error_indication(enb, MME_UE_S1AP_ID, ENB_UE_S1AP_ID,
+                S1AP_Cause_PR_protocol, S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     tAC = &TAI->tAC;
-    ogs_assert(tAC && tAC->size == sizeof(uint16_t));
+    if (tAC->size != sizeof(tai.tac)) {
+        ogs_error("Invalid tAC->size = %d (expected %d)",
+                (int)tAC->size, (int)sizeof(tai.tac));
+        r = s1ap_send_error_indication(enb, MME_UE_S1AP_ID, ENB_UE_S1AP_ID,
+                S1AP_Cause_PR_protocol, S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     memcpy(&tai.plmn_id, pLMNidentity->buf, sizeof(tai.plmn_id));
     memcpy(&tai.tac, tAC->buf, sizeof(tai.tac));
     tai.tac = be16toh(tai.tac);
@@ -767,9 +911,27 @@
     ogs_debug("    SERVED_TAI_INDEX%d", served_tai_index);
 
     pLMNidentity = &EUTRAN_CGI->pLMNidentity;
-    ogs_assert(pLMNidentity && pLMNidentity->size == sizeof(ogs_plmn_id_t));
+    if (pLMNidentity->size != sizeof(enb_ue->saved.e_cgi.plmn_id)) {
+        ogs_error("Invalid pLMNidentity->size = %d (expected %d)",
+                (int)pLMNidentity->size,
+                (int)sizeof(enb_ue->saved.e_cgi.plmn_id));
+        r = s1ap_send_error_indication(enb, MME_UE_S1AP_ID, ENB_UE_S1AP_ID,
+                S1AP_Cause_PR_protocol, S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     cell_ID = &EUTRAN_CGI->cell_ID;
-    ogs_assert(cell_ID);
+    if (cell_ID->size != sizeof(enb_ue->saved.e_cgi.cell_id)) {
+        ogs_error("Invalid cell_ID->size = %d (expected %d)",
+                (int)cell_ID->size,
+                (int)sizeof(enb_ue->saved.e_cgi.cell_id));
+        r = s1ap_send_error_indication(enb, MME_UE_S1AP_ID, ENB_UE_S1AP_ID,
+                S1AP_Cause_PR_protocol, S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     memcpy(&enb_ue->saved.e_cgi.plmn_id, pLMNidentity->buf,
             sizeof(enb_ue->saved.e_cgi.plmn_id));
     memcpy(&enb_ue->saved.e_cgi.cell_id, cell_ID->buf,
@@ -777,9 +939,26 @@
     enb_ue->saved.e_cgi.cell_id = (be32toh(enb_ue->saved.e_cgi.cell_id) >> 4);
 
     pLMNidentity = &TAI->pLMNidentity;
-    ogs_assert(pLMNidentity && pLMNidentity->size == sizeof(ogs_plmn_id_t));
+    if (pLMNidentity->size != sizeof(enb_ue->saved.tai.plmn_id)) {
+        ogs_error("Invalid pLMNidentity->size = %d (expected %d)",
+                (int)pLMNidentity->size,
+                (int)sizeof(enb_ue->saved.tai.plmn_id));
+        r = s1ap_send_error_indication(enb, MME_UE_S1AP_ID, ENB_UE_S1AP_ID,
+                S1AP_Cause_PR_protocol, S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     tAC = &TAI->tAC;
-    ogs_assert(tAC && tAC->size == sizeof(uint16_t));
+    if (tAC->size != sizeof(enb_ue->saved.tai.tac)) {
+        ogs_error("Invalid tAC->size = %d (expected %d)",
+                (int)tAC->size, (int)sizeof(enb_ue->saved.tai.tac));
+        r = s1ap_send_error_indication(enb, MME_UE_S1AP_ID, ENB_UE_S1AP_ID,
+                S1AP_Cause_PR_protocol, S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     memcpy(&enb_ue->saved.tai.plmn_id, pLMNidentity->buf,
             sizeof(enb_ue->saved.tai.plmn_id));
     memcpy(&enb_ue->saved.tai.tac, tAC->buf, sizeof(enb_ue->saved.tai.tac));
@@ -1042,9 +1221,24 @@
                 return;
             }
 
+            if (e_rab->gTP_TEID.size != sizeof(bearer->enb_s1u_teid)) {
+                ogs_error("Invalid e_rab->gTP_TEID.size = %d (expected %d)",
+                        (int)e_rab->gTP_TEID.size,
+                        (int)sizeof(bearer->enb_s1u_teid));
+                r = s1ap_send_error_indication2(mme_ue,
+                        S1AP_Cause_PR_protocol,
+                        S1AP_CauseProtocol_semantic_error);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
+                return;
+            }
             memcpy(&bearer->enb_s1u_teid, e_rab->gTP_TEID.buf,
                     sizeof(bearer->enb_s1u_teid));
             bearer->enb_s1u_teid = be32toh(bearer->enb_s1u_teid);
+
+            ogs_debug("UE%s EBI%d Update enb_s1u_teid = 0x%x",
+                    mme_ue->imsi_bcd, bearer->ebi, bearer->enb_s1u_teid);
+
             rv = ogs_asn_BIT_STRING_to_ip(
                     &e_rab->transportLayerAddress, &bearer->enb_s1u_ip);
             if (rv != OGS_OK) {
@@ -1058,8 +1252,14 @@
                 return;
             }
 
-            ogs_debug("    EBI%d ENB-S1U-TEID%d",
-                    bearer->ebi, bearer->enb_s1u_teid);
+            ogs_log_hexdump(OGS_LOG_DEBUG,
+                    e_rab->transportLayerAddress.buf,
+                    e_rab->transportLayerAddress.size);
+            ogs_debug("    IPv4(%d): 0x%x",
+                    bearer->enb_s1u_ip.ipv4, bearer->enb_s1u_ip.addr);
+            ogs_debug("    IPv6(%d):", bearer->enb_s1u_ip.ipv6);
+            ogs_log_hexdump(OGS_LOG_DEBUG,
+                    bearer->enb_s1u_ip.addr6, OGS_IPV6_LEN);
 
             if (OGS_FSM_CHECK(&bearer->sm, esm_state_active)) {
                 ogs_debug("    NAS_EPS Type%d", mme_ue->nas_eps.type);
@@ -1446,6 +1646,11 @@
 
     enb_ue_t *enb_ue = NULL;
     mme_ue_t *mme_ue = NULL;
+    sgw_ue_t *sgw_ue = NULL;
+
+    mme_sess_t *sess = NULL;
+    mme_bearer_t *bearer = NULL;
+    mme_bearer_t *linked_bearer = NULL;
 
     ogs_assert(enb);
     ogs_assert(enb->sctp.sock);
@@ -1540,8 +1745,6 @@
             S1AP_E_RABSetupItemBearerSUResIEs_t *item = NULL;
             S1AP_E_RABSetupItemBearerSURes_t *e_rab = NULL;
 
-            mme_bearer_t *bearer = NULL;
-
             item = (S1AP_E_RABSetupItemBearerSUResIEs_t *)
                 E_RABSetupListBearerSURes->list.arrayi;
             if (!item) {
@@ -1576,9 +1779,24 @@
                 return;
             }
 
+            if (e_rab->gTP_TEID.size != sizeof(bearer->enb_s1u_teid)) {
+                ogs_error("Invalid e_rab->gTP_TEID.size = %d (expected %d)",
+                        (int)e_rab->gTP_TEID.size,
+                        (int)sizeof(bearer->enb_s1u_teid));
+                r = s1ap_send_error_indication2(mme_ue,
+                        S1AP_Cause_PR_protocol,
+                        S1AP_CauseProtocol_semantic_error);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
+                return;
+            }
             memcpy(&bearer->enb_s1u_teid, e_rab->gTP_TEID.buf,
-                sizeof(bearer->enb_s1u_teid));
+                    sizeof(bearer->enb_s1u_teid));
             bearer->enb_s1u_teid = be32toh(bearer->enb_s1u_teid);
+
+            ogs_debug("UE%s EBI%d Update enb_s1u_teid = 0x%x",
+                    mme_ue->imsi_bcd, bearer->ebi, bearer->enb_s1u_teid);
+
             rv = ogs_asn_BIT_STRING_to_ip(
                     &e_rab->transportLayerAddress, &bearer->enb_s1u_ip);
             if (rv != OGS_OK) {
@@ -1592,10 +1810,17 @@
                 return;
             }
 
-            ogs_debug("    EBI%d", bearer->ebi);
+            ogs_log_hexdump(OGS_LOG_DEBUG,
+                    e_rab->transportLayerAddress.buf,
+                    e_rab->transportLayerAddress.size);
+            ogs_debug("    IPv4(%d): 0x%x",
+                    bearer->enb_s1u_ip.ipv4, bearer->enb_s1u_ip.addr);
+            ogs_debug("    IPv6(%d):", bearer->enb_s1u_ip.ipv6);
+            ogs_log_hexdump(OGS_LOG_DEBUG,
+                    bearer->enb_s1u_ip.addr6, OGS_IPV6_LEN);
 
             if (OGS_FSM_CHECK(&bearer->sm, esm_state_active)) {
-                mme_bearer_t *linked_bearer = mme_linked_bearer(bearer);
+                linked_bearer = mme_linked_bearer(bearer);
                 ogs_assert(linked_bearer);
                 ogs_debug("    Linked-EBI%d", linked_bearer->ebi);
 
@@ -1616,13 +1841,16 @@
     }
 
     if (E_RABFailedToSetupListBearerSURes) {
-        ogs_debug("E_RABFailedToSetupListBearerSURes");
+        ogs_warn("E_RABFailedToSetupListBearerSURes");
         for (i = 0; i < E_RABFailedToSetupListBearerSURes->list.count; i++) {
-            S1AP_E_RABItem_t *item = (S1AP_E_RABItem_t *)
+            S1AP_E_RABItemIEs_t *item = NULL;
+            S1AP_E_RABItem_t *e_rab = NULL;
+
+            item = (S1AP_E_RABItemIEs_t *)
                 E_RABFailedToSetupListBearerSURes->list.arrayi;
 
             if (!item) {
-                ogs_error("No S1AP_E_RABItem_t");
+                ogs_error("No S1AP_E_RABItemIEs_t");
                 r = s1ap_send_error_indication2(mme_ue,
                         S1AP_Cause_PR_protocol,
                         S1AP_CauseProtocol_semantic_error);
@@ -1631,9 +1859,44 @@
                 return;
             }
 
-            ogs_debug("RAB_ID: %d", (int)item->e_RAB_ID);
-            ogs_debug("    CauseGroup:%d Cause:%d",
-                (int)item->cause.present, (int)item->cause.choice.radioNetwork);
+            e_rab = &item->value.choice.E_RABItem;
+
+            ogs_warn("RAB_ID: %x", (int)e_rab->e_RAB_ID);
+            ogs_warn("    CauseGroup:%d Cause:%d",
+                (int)e_rab->cause.present,
+                (int)e_rab->cause.choice.radioNetwork);
+
+            bearer = mme_bearer_find_by_ue_ebi(mme_ue, e_rab->e_RAB_ID);
+            if (!bearer) {
+                ogs_error("No Bearer %d", (int)e_rab->e_RAB_ID);
+                r = s1ap_send_error_indication2(mme_ue,
+                        S1AP_Cause_PR_radioNetwork,
+                        S1AP_CauseRadioNetwork_unknown_E_RAB_ID);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
+                return;
+            }
+
+            linked_bearer = mme_linked_bearer(bearer);
+            ogs_assert(linked_bearer);
+            ogs_debug("    Linked-EBI%d", linked_bearer->ebi);
+
+            if (bearer->ebi == linked_bearer->ebi) {
+                sgw_ue = sgw_ue_find_by_id(mme_ue->sgw_ue_id);
+                ogs_assert(sgw_ue);
+
+                sess = mme_sess_find_by_id(bearer->sess_id);
+                ogs_assert(sess);
+
+                /* Radio failure cleanup:
+                 * delete session without E-RAB release procedure */
+                ogs_assert(OGS_OK ==
+                    mme_gtp_send_delete_session_request(enb_ue, sgw_ue, sess,
+                        OGS_GTP_DELETE_NO_ACTION));
+                ogs_warn("Delete Session Request");
+            } else {
+                ogs_error("Not implemented : remove dedicated bearer");
+            }
         }
     }
 
@@ -1895,7 +2158,7 @@
         CLEAR_MME_UE_ALL_TIMERS(mme_ue);
 
         if (OGS_FSM_CHECK(&mme_ue->sm, emm_state_registered)) {
-            ogs_debug("Mobile Reachable timer started for IMSI%s",
+            ogs_info("Mobile Reachable timer started for IMSI%s",
                 mme_ue->imsi_bcd);
         /*
          * TS 24.301
@@ -2222,9 +2485,24 @@
             return;
         }
 
+        if (e_rab->dL_GTP_TEID.size != sizeof(bearer->enb_s1u_teid)) {
+            ogs_error("Invalid e_rab->dL_GTP_TEID.size = %d (expected %d)",
+                    (int)e_rab->dL_GTP_TEID.size,
+                    (int)sizeof(bearer->enb_s1u_teid));
+            r = s1ap_send_error_indication2(mme_ue,
+                    S1AP_Cause_PR_protocol,
+                    S1AP_CauseProtocol_semantic_error);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+            return;
+        }
         memcpy(&bearer->enb_s1u_teid, e_rab->dL_GTP_TEID.buf,
                 sizeof(bearer->enb_s1u_teid));
         bearer->enb_s1u_teid = be32toh(bearer->enb_s1u_teid);
+
+        ogs_debug("UE%s EBI%d Update enb_s1u_teid = 0x%x",
+                mme_ue->imsi_bcd, bearer->ebi, bearer->enb_s1u_teid);
+
         rv = ogs_asn_BIT_STRING_to_ip(
                 &e_rab->transportLayerAddress, &bearer->enb_s1u_ip);
         if (rv != OGS_OK) {
@@ -2238,6 +2516,15 @@
             return;
         }
 
+        ogs_log_hexdump(OGS_LOG_DEBUG,
+                e_rab->transportLayerAddress.buf,
+                e_rab->transportLayerAddress.size);
+        ogs_debug("    IPv4(%d): 0x%x",
+                bearer->enb_s1u_ip.ipv4, bearer->enb_s1u_ip.addr);
+        ogs_debug("    IPv6(%d):", bearer->enb_s1u_ip.ipv6);
+        ogs_log_hexdump(OGS_LOG_DEBUG,
+                bearer->enb_s1u_ip.addr6, OGS_IPV6_LEN);
+
         if (ogs_list_exists(
                     &mme_ue->bearer_to_modify_list,
                     &bearer->to_modify_node) == false)
@@ -2317,7 +2604,47 @@
     switch (RIMRoutingAddress->present) {
     case S1AP_RIMRoutingAddress_PR_gERAN_Cell_ID:
         geran_cell_id = RIMRoutingAddress->choice.gERAN_Cell_ID;
-        ogs_assert(geran_cell_id);
+        if (!geran_cell_id) {
+            ogs_error("No gERAN_Cell_ID");
+            r = s1ap_send_error_indication(enb, NULL, NULL,
+                    S1AP_Cause_PR_protocol, S1AP_CauseProtocol_semantic_error);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+            return;
+        }
+        if (geran_cell_id->lAI.pLMNidentity.size != sizeof(plmn_id)) {
+            ogs_error("Invalid geran_cell_id->lAI.pLMNidentity.size = %d "
+                    "(expected %d)",
+                    (int)geran_cell_id->lAI.pLMNidentity.size,
+                    (int)sizeof(plmn_id));
+            r = s1ap_send_error_indication(enb, NULL, NULL,
+                    S1AP_Cause_PR_protocol, S1AP_CauseProtocol_semantic_error);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+            return;
+        }
+        if (geran_cell_id->lAI.lAC.size != sizeof(uint16_t)) {
+            ogs_error("Invalid geran_cell_id->lAI.lAC.size = %d "
+                    "(expected %d)",
+                    (int)geran_cell_id->lAI.lAC.size,
+                    (int)sizeof(uint16_t));
+            r = s1ap_send_error_indication(enb, NULL, NULL,
+                    S1AP_Cause_PR_protocol, S1AP_CauseProtocol_semantic_error);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+            return;
+        }
+        if (geran_cell_id->cI.size != sizeof(uint16_t)) {
+            ogs_error("Invalid geran_cell_id->cI.size = %d "
+                    "(expected %d)",
+                    (int)geran_cell_id->cI.size,
+                    (int)sizeof(uint16_t));
+            r = s1ap_send_error_indication(enb, NULL, NULL,
+                    S1AP_Cause_PR_protocol, S1AP_CauseProtocol_semantic_error);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+            return;
+        }
         memcpy(&plmn_id, geran_cell_id->lAI.pLMNidentity.buf, sizeof(plmn_id));
         ogs_nas_from_plmn_id(&rai.lai.nas_plmn_id, &plmn_id);
         memcpy(&rai.lai.lac, geran_cell_id->lAI.lAC.buf, sizeof(uint16_t));
@@ -2508,9 +2835,26 @@
     }
 
     pLMNidentity = &TAI->pLMNidentity;
-    ogs_assert(pLMNidentity && pLMNidentity->size == sizeof(ogs_plmn_id_t));
+    if (pLMNidentity->size != sizeof(tai.plmn_id)) {
+        ogs_error("Invalid pLMNidentity->size = %d (expected %d)",
+                (int)pLMNidentity->size,
+                (int)sizeof(tai.plmn_id));
+        r = s1ap_send_error_indication(enb, MME_UE_S1AP_ID, ENB_UE_S1AP_ID,
+                S1AP_Cause_PR_protocol, S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     tAC = &TAI->tAC;
-    ogs_assert(tAC && tAC->size == sizeof(uint16_t));
+    if (tAC->size != sizeof(tai.tac)) {
+        ogs_error("Invalid tAC->size = %d (expected %d)",
+                (int)tAC->size, (int)sizeof(tai.tac));
+        r = s1ap_send_error_indication(enb, MME_UE_S1AP_ID, ENB_UE_S1AP_ID,
+                S1AP_Cause_PR_protocol, S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     memcpy(&tai.plmn_id, pLMNidentity->buf, sizeof(tai.plmn_id));
     memcpy(&tai.tac, tAC->buf, sizeof(tai.tac));
     tai.tac = be16toh(tai.tac);
@@ -2577,18 +2921,61 @@
             enb_ue->enb_ue_s1ap_id, enb_ue->mme_ue_s1ap_id);
 
     pLMNidentity = &TAI->pLMNidentity;
-    ogs_assert(pLMNidentity && pLMNidentity->size == sizeof(ogs_plmn_id_t));
+    if (pLMNidentity->size != sizeof(enb_ue->saved.tai.plmn_id)) {
+        ogs_error("Invalid pLMNidentity->size = %d (expected %d)",
+                (int)pLMNidentity->size,
+                (int)sizeof(enb_ue->saved.tai.plmn_id));
+        r = s1ap_send_error_indication1(
+                enb_ue,
+                S1AP_Cause_PR_protocol,
+                S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     tAC = &TAI->tAC;
-    ogs_assert(tAC && tAC->size == sizeof(uint16_t));
+    if (tAC->size != sizeof(enb_ue->saved.tai.tac)) {
+        ogs_error("Invalid tAC->size = %d (expected %d)",
+                (int)tAC->size, (int)sizeof(enb_ue->saved.tai.tac));
+        r = s1ap_send_error_indication1(
+                enb_ue,
+                S1AP_Cause_PR_protocol,
+                S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     memcpy(&enb_ue->saved.tai.plmn_id, pLMNidentity->buf,
             sizeof(enb_ue->saved.tai.plmn_id));
     memcpy(&enb_ue->saved.tai.tac, tAC->buf, sizeof(enb_ue->saved.tai.tac));
     enb_ue->saved.tai.tac = be16toh(enb_ue->saved.tai.tac);
 
     pLMNidentity = &EUTRAN_CGI->pLMNidentity;
-    ogs_assert(pLMNidentity && pLMNidentity->size == sizeof(ogs_plmn_id_t));
+    if (pLMNidentity->size != sizeof(enb_ue->saved.e_cgi.plmn_id)) {
+        ogs_error("Invalid pLMNidentity->size = %d (expected %d)",
+                (int)pLMNidentity->size,
+                (int)sizeof(enb_ue->saved.e_cgi.plmn_id));
+        r = s1ap_send_error_indication1(
+                enb_ue,
+                S1AP_Cause_PR_protocol,
+                S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     cell_ID = &EUTRAN_CGI->cell_ID;
-    ogs_assert(cell_ID);
+    if (cell_ID->size != sizeof(enb_ue->saved.e_cgi.cell_id)) {
+        ogs_error("Invalid cell_ID->size = %d (expected %d)",
+                (int)cell_ID->size,
+                (int)sizeof(enb_ue->saved.e_cgi.cell_id));
+        r = s1ap_send_error_indication1(
+                enb_ue,
+                S1AP_Cause_PR_protocol,
+                S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     memcpy(&enb_ue->saved.e_cgi.plmn_id, pLMNidentity->buf,
             sizeof(enb_ue->saved.e_cgi.plmn_id));
     memcpy(&enb_ue->saved.e_cgi.cell_id, cell_ID->buf,
@@ -2614,12 +3001,37 @@
     integrityProtectionAlgorithms =
         &UESecurityCapabilities->integrityProtectionAlgorithms;
 
+    if (encryptionAlgorithms->size != sizeof(eea)) {
+        ogs_error("Invalid encryptionAlgorithms->size = %d (expected %d)",
+                (int)encryptionAlgorithms->size,
+                (int)sizeof(eea));
+        r = s1ap_send_error_indication1(
+                enb_ue,
+                S1AP_Cause_PR_protocol,
+                S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     memcpy(&eea, encryptionAlgorithms->buf, sizeof(eea));
     eea = be16toh(eea);
     eea0 = mme_ue->ue_network_capability.eea0;
     mme_ue->ue_network_capability.eea = eea >> 9;
     mme_ue->ue_network_capability.eea0 = eea0;
 
+    if (integrityProtectionAlgorithms->size != sizeof(eia)) {
+        ogs_error("Invalid integrityProtectionAlgorithms->size = %d "
+                "(expected %d)",
+                (int)integrityProtectionAlgorithms->size,
+                (int)sizeof(eia));
+        r = s1ap_send_error_indication1(
+                enb_ue,
+                S1AP_Cause_PR_protocol,
+                S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     memcpy(&eia, integrityProtectionAlgorithms->buf, sizeof(eia));
     eia = be16toh(eia);
     eia0 = mme_ue->ue_network_capability.eia0;
@@ -2670,9 +3082,24 @@
             return;
         }
 
+        if (e_rab->gTP_TEID.size != sizeof(bearer->enb_s1u_teid)) {
+            ogs_error("Invalid e_rab->gTP_TEID.size = %d (expected %d)",
+                    (int)e_rab->gTP_TEID.size,
+                    (int)sizeof(bearer->enb_s1u_teid));
+            r = s1ap_send_error_indication2(mme_ue,
+                    S1AP_Cause_PR_protocol,
+                    S1AP_CauseProtocol_semantic_error);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+            return;
+        }
         memcpy(&bearer->enb_s1u_teid, e_rab->gTP_TEID.buf,
                 sizeof(bearer->enb_s1u_teid));
         bearer->enb_s1u_teid = be32toh(bearer->enb_s1u_teid);
+
+        ogs_debug("UE%s EBI%d Update enb_s1u_teid = 0x%x",
+                mme_ue->imsi_bcd, bearer->ebi, bearer->enb_s1u_teid);
+
         rv = ogs_asn_BIT_STRING_to_ip(
                 &e_rab->transportLayerAddress, &bearer->enb_s1u_ip);
         if (rv != OGS_OK) {
@@ -2686,6 +3113,15 @@
             return;
         }
 
+        ogs_log_hexdump(OGS_LOG_DEBUG,
+                e_rab->transportLayerAddress.buf,
+                e_rab->transportLayerAddress.size);
+        ogs_debug("    IPv4(%d): 0x%x",
+                bearer->enb_s1u_ip.ipv4, bearer->enb_s1u_ip.addr);
+        ogs_debug("    IPv6(%d):", bearer->enb_s1u_ip.ipv6);
+        ogs_log_hexdump(OGS_LOG_DEBUG,
+                bearer->enb_s1u_ip.addr6, OGS_IPV6_LEN);
+
         if (ogs_list_exists(
                     &mme_ue->bearer_to_modify_list,
                     &bearer->to_modify_node) == false)
@@ -2771,6 +3207,30 @@
         ogs_s1ap_ENB_ID_to_uint32(
                 &targeteNB_ID->global_ENB_ID.eNB_ID, &target_enb_id);
 
+        if (sourceeNB_ID->selected_TAI.tAC.size != sizeof(source_tac)) {
+            ogs_error("Invalid sourceeNB_ID->selected_TAI.tAC.size = %d "
+                    "(expected %d)",
+                    (int)sourceeNB_ID->selected_TAI.tAC.size,
+                    (int)sizeof(source_tac));
+            r = s1ap_send_error_indication(enb, NULL, NULL,
+                    S1AP_Cause_PR_radioNetwork,
+                    S1AP_CauseRadioNetwork_unknown_targetID);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+            return;
+        }
+        if (targeteNB_ID->selected_TAI.tAC.size != sizeof(target_tac)) {
+            ogs_error("Invalid targeteNB_ID->selected_TAI.tAC.size = %d "
+                    "(expected %d)",
+                    (int)targeteNB_ID->selected_TAI.tAC.size,
+                    (int)sizeof(target_tac));
+            r = s1ap_send_error_indication(enb, NULL, NULL,
+                    S1AP_Cause_PR_radioNetwork,
+                    S1AP_CauseRadioNetwork_unknown_targetID);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+            return;
+        }
         memcpy(&source_tac, sourceeNB_ID->selected_TAI.tAC.buf,
                 sizeof(source_tac));
         source_tac = be16toh(source_tac);
@@ -2867,6 +3327,24 @@
         return;
     }
 
+    if (!SESSION_CONTEXT_IS_AVAILABLE(mme_ue)) {
+        ogs_error("No Session Context : IMSI%s", mme_ue->imsi_bcd);
+        r = s1ap_send_handover_preparation_failure(source_ue,
+                S1AP_Cause_PR_nas, S1AP_CauseNas_authentication_failure);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
+
+    if (!ACTIVE_EPS_BEARERS_IS_AVAIABLE(mme_ue)) {
+        ogs_error("No active EPS bearers : IMSI%s", mme_ue->imsi_bcd);
+        r = s1ap_send_handover_preparation_failure(source_ue,
+                S1AP_Cause_PR_nas, S1AP_CauseNas_authentication_failure);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
+
     source_ue->handover_type = S1AP_HandoverType_intralte;
 
     mme_ue->nhcc++;
@@ -3208,9 +3686,24 @@
             return;
         }
 
+        if (e_rab->gTP_TEID.size != sizeof(bearer->enb_s1u_teid)) {
+            ogs_error("Invalid e_rab->gTP_TEID.size = %d (expected %d)",
+                    (int)e_rab->gTP_TEID.size,
+                    (int)sizeof(bearer->enb_s1u_teid));
+            r = s1ap_send_error_indication2(mme_ue,
+                    S1AP_Cause_PR_protocol,
+                    S1AP_CauseProtocol_semantic_error);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+            return;
+        }
         memcpy(&bearer->target_s1u_teid, e_rab->gTP_TEID.buf,
                 sizeof(bearer->target_s1u_teid));
         bearer->target_s1u_teid = be32toh(bearer->target_s1u_teid);
+
+        ogs_debug("UE%s EBI%d Update target_s1u_teid = 0x%x",
+                mme_ue->imsi_bcd, bearer->ebi, bearer->target_s1u_teid);
+
         rv = ogs_asn_BIT_STRING_to_ip(
                 &e_rab->transportLayerAddress, &bearer->target_s1u_ip);
         if (rv != OGS_OK) {
@@ -3224,12 +3717,34 @@
             return;
         }
 
+        ogs_log_hexdump(OGS_LOG_DEBUG,
+                e_rab->transportLayerAddress.buf,
+                e_rab->transportLayerAddress.size);
+        ogs_debug("    IPv4(%d): 0x%x",
+                bearer->target_s1u_ip.ipv4, bearer->target_s1u_ip.addr);
+        ogs_debug("    IPv6(%d):", bearer->target_s1u_ip.ipv6);
+        ogs_log_hexdump(OGS_LOG_DEBUG,
+                bearer->target_s1u_ip.addr6, OGS_IPV6_LEN);
+
         if (e_rab->dL_transportLayerAddress && e_rab->dL_gTP_TEID) {
-            ogs_assert(e_rab->dL_gTP_TEID->buf);
-            ogs_assert(e_rab->dL_transportLayerAddress->buf);
+            if (e_rab->dL_gTP_TEID->size != sizeof(bearer->enb_dl_teid)) {
+                ogs_error("Invalid e_rab->dL_gTP_TEID.size = %d (expected %d)",
+                        (int)e_rab->dL_gTP_TEID->size,
+                        (int)sizeof(bearer->enb_dl_teid));
+                r = s1ap_send_error_indication2(mme_ue,
+                        S1AP_Cause_PR_protocol,
+                        S1AP_CauseProtocol_semantic_error);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
+                return;
+            }
             memcpy(&bearer->enb_dl_teid, e_rab->dL_gTP_TEID->buf,
                     sizeof(bearer->enb_dl_teid));
             bearer->enb_dl_teid = be32toh(bearer->enb_dl_teid);
+
+            ogs_debug("UE%s EBI%d Update enb_dl_teid = 0x%x",
+                    mme_ue->imsi_bcd, bearer->ebi, bearer->enb_dl_teid);
+
             rv = ogs_asn_BIT_STRING_to_ip(
                     e_rab->dL_transportLayerAddress, &bearer->enb_dl_ip);
             if (rv != OGS_OK) {
@@ -3242,11 +3757,29 @@
                 ogs_assert(r != OGS_ERROR);
                 return;
             }
+
+            ogs_log_hexdump(OGS_LOG_DEBUG,
+                    e_rab->dL_transportLayerAddress->buf,
+                    e_rab->dL_transportLayerAddress->size);
+            ogs_debug("    IPv4(%d): 0x%x",
+                    bearer->enb_dl_ip.ipv4, bearer->enb_dl_ip.addr);
+            ogs_debug("    IPv6(%d):", bearer->enb_dl_ip.ipv6);
+            ogs_log_hexdump(OGS_LOG_DEBUG,
+                    bearer->enb_dl_ip.addr6, OGS_IPV6_LEN);
         }
 
         if (e_rab->uL_TransportLayerAddress && e_rab->uL_GTP_TEID) {
-            ogs_assert(e_rab->uL_GTP_TEID->buf);
-            ogs_assert(e_rab->uL_TransportLayerAddress->buf);
+            if (e_rab->uL_GTP_TEID->size != sizeof(bearer->enb_ul_teid)) {
+                ogs_error("Invalid e_rab->uL_GTP_TEID.size = %d (expected %d)",
+                        (int)e_rab->uL_GTP_TEID->size,
+                        (int)sizeof(bearer->enb_ul_teid));
+                r = s1ap_send_error_indication2(mme_ue,
+                        S1AP_Cause_PR_protocol,
+                        S1AP_CauseProtocol_semantic_error);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
+                return;
+            }
             memcpy(&bearer->enb_ul_teid, e_rab->uL_GTP_TEID->buf,
                     sizeof(bearer->enb_ul_teid));
             bearer->enb_ul_teid = be32toh(bearer->enb_ul_teid);
@@ -3262,6 +3795,15 @@
                 ogs_assert(r != OGS_ERROR);
                 return;
             }
+
+            ogs_log_hexdump(OGS_LOG_DEBUG,
+                    e_rab->uL_TransportLayerAddress->buf,
+                    e_rab->uL_TransportLayerAddress->size);
+            ogs_debug("    IPv4(%d): 0x%x",
+                    bearer->enb_ul_ip.ipv4, bearer->enb_ul_ip.addr);
+            ogs_debug("    IPv6(%d):", bearer->enb_ul_ip.ipv6);
+            ogs_log_hexdump(OGS_LOG_DEBUG,
+                    bearer->enb_ul_ip.addr6, OGS_IPV6_LEN);
         }
     }
 
@@ -3763,9 +4305,30 @@
     CLEAR_MME_UE_TIMER(mme_ue->t_mobile_reachable);
 
     pLMNidentity = &TAI->pLMNidentity;
-    ogs_assert(pLMNidentity && pLMNidentity->size == sizeof(ogs_plmn_id_t));
+    if (pLMNidentity->size != sizeof(target_ue->saved.tai.plmn_id)) {
+        ogs_error("Invalid pLMNidentity->size = %d (expected %d)",
+                (int)pLMNidentity->size,
+                (int)sizeof(target_ue->saved.tai.plmn_id));
+        r = s1ap_send_error_indication2(
+                mme_ue,
+                S1AP_Cause_PR_protocol,
+                S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     tAC = &TAI->tAC;
-    ogs_assert(tAC && tAC->size == sizeof(uint16_t));
+    if (tAC->size != sizeof(target_ue->saved.tai.tac)) {
+        ogs_error("Invalid tAC->size = %d (expected %d)",
+                (int)tAC->size, (int)sizeof(target_ue->saved.tai.tac));
+        r = s1ap_send_error_indication2(
+                mme_ue,
+                S1AP_Cause_PR_protocol,
+                S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     memcpy(&target_ue->saved.tai.plmn_id, pLMNidentity->buf,
             sizeof(target_ue->saved.tai.plmn_id));
     memcpy(&target_ue->saved.tai.tac,
@@ -3773,9 +4336,31 @@
     target_ue->saved.tai.tac = be16toh(target_ue->saved.tai.tac);
 
     pLMNidentity = &EUTRAN_CGI->pLMNidentity;
-    ogs_assert(pLMNidentity && pLMNidentity->size == sizeof(ogs_plmn_id_t));
+    if (pLMNidentity->size != sizeof(target_ue->saved.e_cgi.plmn_id)) {
+        ogs_error("Invalid pLMNidentity->size = %d (expected %d)",
+                (int)pLMNidentity->size,
+                (int)sizeof(target_ue->saved.e_cgi.plmn_id));
+        r = s1ap_send_error_indication2(
+                mme_ue,
+                S1AP_Cause_PR_protocol,
+                S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     cell_ID = &EUTRAN_CGI->cell_ID;
-    ogs_assert(cell_ID);
+    if (cell_ID->size != sizeof(target_ue->saved.e_cgi.cell_id)) {
+        ogs_error("Invalid cell_ID->size = %d (expected %d)",
+                (int)cell_ID->size,
+                (int)sizeof(target_ue->saved.e_cgi.cell_id));
+        r = s1ap_send_error_indication1(
+                target_ue,
+                S1AP_Cause_PR_protocol,
+                S1AP_CauseProtocol_semantic_error);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        return;
+    }
     memcpy(&target_ue->saved.e_cgi.plmn_id, pLMNidentity->buf,
             sizeof(target_ue->saved.e_cgi.plmn_id));
     memcpy(&target_ue->saved.e_cgi.cell_id, cell_ID->buf,
@@ -3814,13 +4399,24 @@
 
     ogs_list_for_each(&mme_ue->sess_list, sess) {
         ogs_list_for_each(&sess->bearer_list, bearer) {
-            bearer->enb_s1u_teid = bearer->target_s1u_teid;
-            memcpy(&bearer->enb_s1u_ip, &bearer->target_s1u_ip,
-                    sizeof(ogs_ip_t));
-
-            ogs_list_add(
-                    &mme_ue->bearer_to_modify_list, &bearer->to_modify_node);
-
+            if (bearer->target_s1u_ip.ipv4 || bearer->target_s1u_ip.ipv6) {
+                bearer->enb_s1u_teid = bearer->target_s1u_teid;
+                ogs_debug("UE%s EBI%d Update enb_s1u_teid = 0x%x",
+                        mme_ue->imsi_bcd, bearer->ebi, bearer->enb_s1u_teid);
+
+                memcpy(&bearer->enb_s1u_ip, &bearer->target_s1u_ip,
+                        sizeof(ogs_ip_t));
+
+                ogs_debug("    IPv4(%d): 0x%x",
+                        bearer->enb_s1u_ip.ipv4, bearer->enb_s1u_ip.addr);
+                ogs_debug("    IPv6(%d):", bearer->enb_s1u_ip.ipv6);
+                ogs_log_hexdump(OGS_LOG_DEBUG,
+                        bearer->enb_s1u_ip.addr6, OGS_IPV6_LEN);
+
+                ogs_list_add(
+                        &mme_ue->bearer_to_modify_list,
+                        &bearer->to_modify_node);
+            }
         }
     }

open5gs_2.7.6.tar.xz/src/mme/s1ap-path.c -> open5gs_2.7.7.tar.xz/src/mme/s1ap-path.c Changed

@@ -879,27 +879,16 @@
     return rv;
 }
 
-int s1ap_send_error_indication2(
-        mme_ue_t *mme_ue, S1AP_Cause_PR group, long cause)
+int s1ap_send_error_indication1(
+        enb_ue_t *enb_ue, S1AP_Cause_PR group, long cause)
 {
     int rv;
     mme_enb_t *enb;
-    enb_ue_t *enb_ue;
 
     S1AP_MME_UE_S1AP_ID_t mme_ue_s1ap_id;
     S1AP_ENB_UE_S1AP_ID_t enb_ue_s1ap_id;
 
-    if (!mme_ue) {
-        ogs_error("UE(mme-ue) context has already been removed");
-        return OGS_NOTFOUND;
-    }
-
-    enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);
-    if (!enb_ue) {
-        ogs_error("S1 context has already been removed");
-        return OGS_NOTFOUND;
-    }
-
+    ogs_assert(enb_ue);
     enb = mme_enb_find_by_id(enb_ue->enb_id);
     if (!enb) {
         ogs_error("eNB has already been removed");
@@ -916,6 +905,25 @@
     return rv;
 }
 
+int s1ap_send_error_indication2(
+        mme_ue_t *mme_ue, S1AP_Cause_PR group, long cause)
+{
+    enb_ue_t *enb_ue;
+
+    if (!mme_ue) {
+        ogs_error("UE(mme-ue) context has already been removed");
+        return OGS_NOTFOUND;
+    }
+
+    enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);
+    if (!enb_ue) {
+        ogs_error("S1 context has already been removed");
+        return OGS_NOTFOUND;
+    }
+
+    return s1ap_send_error_indication1(enb_ue, group, cause);
+}
+
 int s1ap_send_s1_reset_ack(
         mme_enb_t *enb,
         S1AP_UE_associatedLogicalS1_ConnectionListRes_t *partOfS1_Interface)

open5gs_2.7.6.tar.xz/src/mme/s1ap-path.h -> open5gs_2.7.7.tar.xz/src/mme/s1ap-path.h Changed

open5gs_2.7.6.tar.xz/src/mme/sgsap-build.c -> open5gs_2.7.7.tar.xz/src/mme/sgsap-build.c Changed

@@ -91,6 +91,7 @@
 
     return pkbuf;
 }
+
 ogs_pkbuf_t *sgsap_build_tmsi_reallocation_complete(mme_ue_t *mme_ue)
 {
     mme_csmap_t *csmap = NULL;
@@ -117,6 +118,96 @@
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-1);
 
     ogs_pkbuf_trim(pkbuf, 1+ogs_tlv_render(root,
+            pkbuf->data+1, OGS_MAX_SDU_LEN-1));
+
+    ogs_tlv_free_all(root);
+
+    return pkbuf;
+}
+
+ogs_pkbuf_t *sgsap_build_ue_activity_indication(mme_ue_t *mme_ue)
+{
+    ogs_tlv_t *root = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
+
+    ogs_assert(mme_ue);
+
+    root = ogs_tlv_add(NULL, OGS_TLV_MODE_T1_L1, SGSAP_IE_IMSI_TYPE,
+            SGSAP_IE_IMSI_LEN, 0, &mme_ue->nas_mobile_identity_imsi);
+
+    /* TODO: Maximum UE Availability Time */
+
+    pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    if (!pkbuf) {
+        ogs_error("ogs_pkbuf_alloc() failed");
+        ogs_tlv_free_all(root);
+        return NULL;
+    }
+    ogs_pkbuf_put_u8(pkbuf, SGSAP_UE_ACTIVITY_INDICATION);
+    ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-1);
+
+    ogs_pkbuf_trim(pkbuf, 1+ogs_tlv_render(root,
+            pkbuf->data+1, OGS_MAX_SDU_LEN-1));
+
+    ogs_tlv_free_all(root);
+
+    return pkbuf;
+}
+
+ogs_pkbuf_t *sgsap_build_alert_ack(mme_ue_t *mme_ue)
+{
+    ogs_tlv_t *root = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
+
+    ogs_assert(mme_ue);
+
+    root = ogs_tlv_add(NULL, OGS_TLV_MODE_T1_L1, SGSAP_IE_IMSI_TYPE,
+            SGSAP_IE_IMSI_LEN, 0, &mme_ue->nas_mobile_identity_imsi);
+
+    pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    if (!pkbuf) {
+        ogs_error("ogs_pkbuf_alloc() failed");
+        ogs_tlv_free_all(root);
+        return NULL;
+    }
+    ogs_pkbuf_put_u8(pkbuf, SGSAP_ALERT_ACK);
+    ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-1);
+
+    ogs_pkbuf_trim(pkbuf, 1+ogs_tlv_render(root,
+            pkbuf->data+1, OGS_MAX_SDU_LEN-1));
+
+    ogs_tlv_free_all(root);
+
+    return pkbuf;
+}
+
+ogs_pkbuf_t *sgsap_build_alert_reject(
+    ogs_nas_mobile_identity_imsi_t *nas_mobile_identity_imsi,
+    int nas_mobile_identity_imsi_len, uint8_t sgs_cause)
+{
+    ogs_tlv_t *root = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
+
+    ogs_assert(nas_mobile_identity_imsi);
+    ogs_assert(nas_mobile_identity_imsi_len == SGSAP_IE_IMSI_LEN);
+
+    root = ogs_tlv_add(NULL, OGS_TLV_MODE_T1_L1,
+            SGSAP_IE_IMSI_TYPE, SGSAP_IE_IMSI_LEN, 0, nas_mobile_identity_imsi);
+    ogs_tlv_add(root, OGS_TLV_MODE_T1_L1,
+            SGSAP_IE_SGS_CAUSE_TYPE, SGSAP_IE_SGS_CAUSE_LEN, 0, &sgs_cause);
+
+    ogs_debug("    CAUSE%d", sgs_cause);
+
+    pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    if (!pkbuf) {
+        ogs_error("ogs_pkbuf_alloc() failed");
+        ogs_tlv_free_all(root);
+        return NULL;
+    }
+    ogs_pkbuf_put_u8(pkbuf, SGSAP_ALERT_REJECT);
+    ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-1);
+
+    ogs_pkbuf_trim(pkbuf, 1+ogs_tlv_render(root,
             pkbuf->data+1, OGS_MAX_SDU_LEN-1));
 
     ogs_tlv_free_all(root);

open5gs_2.7.6.tar.xz/src/mme/sgsap-build.h -> open5gs_2.7.7.tar.xz/src/mme/sgsap-build.h Changed

open5gs_2.7.6.tar.xz/src/mme/sgsap-handler.c -> open5gs_2.7.7.tar.xz/src/mme/sgsap-handler.c Changed

@@ -129,70 +129,39 @@
         ogs_expect(r == OGS_OK);
         ogs_assert(r != OGS_ERROR);
     } else if (mme_ue->nas_eps.type == MME_EPS_TYPE_TAU_REQUEST) {
-        if (mme_ue->tracking_area_update_request_type ==
-                MME_TAU_TYPE_INITIAL_UE_MESSAGE) {
-            ogs_debug("    Iniital UE Message");
-            if (mme_ue->nas_eps.update.active_flag) {
-
-/*
-* TS33.401
-* 7 Security procedures between UE and EPS access network elements
-* 7.2 Handling of user-related keys in E-UTRAN
-* 7.2.7 Key handling for the TAU procedure when registered in E-UTRAN
-*
-* If the "active flag" is set in the TAU request message or
-* the MME chooses to establish radio bearers when there is pending downlink
-* UP data or pending downlink signalling, radio bearers will be established
-* as part of the TAU procedure and a KeNB derivation is necessary.
-*/
-                ogs_kdf_kenb(mme_ue->kasme, mme_ue->ul_count.i32,
-                        mme_ue->kenb);
-                ogs_kdf_nh_enb(mme_ue->kasme, mme_ue->kenb, mme_ue->nh);
-                mme_ue->nhcc = 1;
-
-                r = nas_eps_send_tau_accept(mme_ue,
-                        S1AP_ProcedureCode_id_InitialContextSetup);
-                ogs_expect(r == OGS_OK);
-                ogs_assert(r != OGS_ERROR);
-            } else {
-                r = nas_eps_send_tau_accept(mme_ue,
-                        S1AP_ProcedureCode_id_downlinkNASTransport);
-                ogs_expect(r == OGS_OK);
-                ogs_assert(r != OGS_ERROR);
-            }
-        } else if (mme_ue->tracking_area_update_request_type ==
-                MME_TAU_TYPE_UPLINK_NAS_TRANPORT) {
-            ogs_debug("    Uplink NAS Transport");
-            r = nas_eps_send_tau_accept(mme_ue,
-                    S1AP_ProcedureCode_id_downlinkNASTransport);
-            ogs_expect(r == OGS_OK);
-            ogs_assert(r != OGS_ERROR);
-        } else if (mme_ue->tracking_area_update_request_type ==
-                MME_TAU_TYPE_UNPROTECTED_INGERITY) {
-            ogs_debug("    Unprotected Integrity");
-            r = nas_eps_send_tau_accept(mme_ue,
-                    S1AP_ProcedureCode_id_InitialContextSetup);
-            ogs_expect(r == OGS_OK);
-        } else {
-            ogs_error("Invalid TAU Type%d",
-                    mme_ue->tracking_area_update_request_type);
-            return;
+        if (mme_ue->nas_eps.update.active_flag) {
+
+    /*
+     * TS33.401
+     * 7 Security procedures between UE and EPS access network elements
+     * 7.2 Handling of user-related keys in E-UTRAN
+     * 7.2.7 Key handling for the TAU procedure when registered in E-UTRAN
+     *
+     * If the "active flag" is set in the TAU request message or
+     * the MME chooses to establish radio bearers when there is pending downlink
+     * UP data or pending downlink signalling, radio bearers will be established
+     * as part of the TAU procedure and a KeNB derivation is necessary.
+     */
+            ogs_kdf_kenb(mme_ue->kasme, mme_ue->ul_count.i32,
+                    mme_ue->kenb);
+            ogs_kdf_nh_enb(mme_ue->kasme, mme_ue->kenb, mme_ue->nh);
+            mme_ue->nhcc = 1;
+
+            ogs_info("%s KDF update(active_flag=1)", mme_ue->imsi_bcd);
         }
 
-        /*
-         * When active_flag is 0, check if the P-TMSI has been updated.
-         * If the P-TMSI has changed, wait to receive the TAU Complete message
-         * from the UE before sending the UEContextReleaseCommand.
-         *
-         * This ensures that the UE has acknowledged the new P-TMSI,
-         * allowing the TAU procedure to complete successfully
-         * and maintaining synchronization between the UE and the network.
-         */
-        if (!mme_ue->nas_eps.update.active_flag &&
-            !MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue)) {
-            enb_ue->relcause.group = S1AP_Cause_PR_nas;
-            enb_ue->relcause.cause = S1AP_CauseNas_normal_release;
-            mme_send_release_access_bearer_or_ue_context_release(enb_ue);
+        /* check BCS regardless of active_flag */
+        if (mme_ue->tracking_area_update_request_presencemask &
+            OGS_NAS_EPS_TRACKING_AREA_UPDATE_REQUEST_EPS_BEARER_CONTEXT_STATUS_TYPE) {
+            ogs_info("%s LU accept + TAU accept(active_flag=%d, BCS)",
+                mme_ue->imsi_bcd,
+                mme_ue->nas_eps.update.active_flag);
+            mme_send_delete_session_or_tau_accept(enb_ue, mme_ue);
+        } else {
+            ogs_info("%s LU accept + TAU accept(active_flag=%d, No BCS)",
+                mme_ue->imsi_bcd,
+                mme_ue->nas_eps.update.active_flag);
+            mme_send_tau_accept_and_check_release(enb_ue, mme_ue);
         }
     } else {
         ogs_fatal("%s Invalid EPS-Type%d",
@@ -326,54 +295,38 @@
         ogs_expect(r == OGS_OK);
         ogs_assert(r != OGS_ERROR);
     } else if (mme_ue->nas_eps.type == MME_EPS_TYPE_TAU_REQUEST) {
-        if (mme_ue->tracking_area_update_request_type ==
-                MME_TAU_TYPE_INITIAL_UE_MESSAGE) {
-            ogs_debug("    Iniital UE Message");
-            if (mme_ue->nas_eps.update.active_flag) {
-
-/*
-* TS33.401
-* 7 Security procedures between UE and EPS access network elements
-* 7.2 Handling of user-related keys in E-UTRAN
-* 7.2.7 Key handling for the TAU procedure when registered in E-UTRAN
-*
-* If the "active flag" is set in the TAU request message or
-* the MME chooses to establish radio bearers when there is pending downlink
-* UP data or pending downlink signalling, radio bearers will be established
-* as part of the TAU procedure and a KeNB derivation is necessary.
-*/
-                ogs_kdf_kenb(mme_ue->kasme, mme_ue->ul_count.i32,
-                        mme_ue->kenb);
-                ogs_kdf_nh_enb(mme_ue->kasme, mme_ue->kenb, mme_ue->nh);
-                mme_ue->nhcc = 1;
-
-                r = nas_eps_send_tau_accept(mme_ue,
-                        S1AP_ProcedureCode_id_InitialContextSetup);
-                ogs_expect(r == OGS_OK);
-                ogs_assert(r != OGS_ERROR);
-            } else {
-                r = nas_eps_send_tau_accept(mme_ue,
-                        S1AP_ProcedureCode_id_downlinkNASTransport);
-                ogs_expect(r == OGS_OK);
-                ogs_assert(r != OGS_ERROR);
-            }
-        } else if (mme_ue->tracking_area_update_request_type ==
-                MME_TAU_TYPE_UPLINK_NAS_TRANPORT) {
-            ogs_debug("    Uplink NAS Transport");
-            r = nas_eps_send_tau_accept(mme_ue,
-                    S1AP_ProcedureCode_id_downlinkNASTransport);
-            ogs_expect(r == OGS_OK);
-            ogs_assert(r != OGS_ERROR);
-        } else if (mme_ue->tracking_area_update_request_type ==
-                MME_TAU_TYPE_UNPROTECTED_INGERITY) {
-            ogs_debug("    Unprotected Integrity");
-            r = nas_eps_send_tau_accept(mme_ue,
-                    S1AP_ProcedureCode_id_InitialContextSetup);
-            ogs_expect(r == OGS_OK);
+        if (mme_ue->nas_eps.update.active_flag) {
+    /*
+     * TS33.401
+     * 7 Security procedures between UE and EPS access network elements
+     * 7.2 Handling of user-related keys in E-UTRAN
+     * 7.2.7 Key handling for the TAU procedure when registered in E-UTRAN
+     *
+     * If the "active flag" is set in the TAU request message or
+     * the MME chooses to establish radio bearers when there is pending downlink
+     * UP data or pending downlink signalling, radio bearers will be established
+     * as part of the TAU procedure and a KeNB derivation is necessary.
+     */
+            ogs_kdf_kenb(mme_ue->kasme, mme_ue->ul_count.i32,
+                    mme_ue->kenb);
+            ogs_kdf_nh_enb(mme_ue->kasme, mme_ue->kenb, mme_ue->nh);
+            mme_ue->nhcc = 1;
+
+            ogs_info("%s KDF update(active_flag=1)", mme_ue->imsi_bcd);
+        }
+
+        /* check BCS regardless of active_flag */
+        if (mme_ue->tracking_area_update_request_presencemask &
+            OGS_NAS_EPS_TRACKING_AREA_UPDATE_REQUEST_EPS_BEARER_CONTEXT_STATUS_TYPE) {
+            ogs_info("%s LU reject + TAU accept(active_flag=%d, BCS)",
+                mme_ue->imsi_bcd,
+                mme_ue->nas_eps.update.active_flag);
+            mme_send_delete_session_or_tau_accept(enb_ue, mme_ue);
         } else {
-            ogs_error("Invalid TAU Type%d",
-                    mme_ue->tracking_area_update_request_type);
-            return;
+            ogs_info("%s LU reject + TAU accept(active_flag=%d, No BCS)",
+                mme_ue->imsi_bcd,
+                mme_ue->nas_eps.update.active_flag);
+            mme_send_tau_accept_and_check_release(enb_ue, mme_ue);
         }
 
         /*
@@ -387,7 +340,6 @@
          */
         if (!mme_ue->nas_eps.update.active_flag &&
             !MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue)) {
-            ogs_fatal("NEXT = %d", MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue));
             enb_ue->relcause.group = S1AP_Cause_PR_nas;
             enb_ue->relcause.cause = S1AP_CauseNas_normal_release;
             mme_send_release_access_bearer_or_ue_context_release(enb_ue);
@@ -405,6 +357,98 @@
     return;
 }
 
+void sgsap_handle_alert_request(mme_vlr_t *vlr, ogs_pkbuf_t *pkbuf)
+{
+    ogs_tlv_t *root = NULL, *iter = NULL;
+    mme_ue_t *mme_ue = NULL;
+    uint8_t sgs_cause = SGSAP_SGS_CAUSE_IMSI_UNKNOWN;
+
+    char imsi_bcdOGS_MAX_IMSI_BCD_LEN+1 = {0, };
+
+    ogs_nas_mobile_identity_imsi_t *nas_mobile_identity_imsi = NULL;
+    int nas_mobile_identity_imsi_len = 0;
+
+    ogs_assert(vlr);
+    ogs_assert(pkbuf);
+
+    ogs_warn("SGSAP Rx ALERT-REQUEST");
+
+    ogs_pkbuf_pull(pkbuf, 1);
+
+    root = ogs_tlv_parse_block(pkbuf->len, pkbuf->data, OGS_TLV_MODE_T1_L1);
+    if (!root) {
+        ogs_error("ogs_tlv_parse_block() failed");
+        sgs_cause = SGSAP_SGS_CAUSE_SEMANTICALLY_INCORRECT_MESSAGE;
+        goto alert_reject;
+    }
+
+    iter = root;
+    while (iter) {
+        switch (iter->type) {
+        case SGSAP_IE_IMSI_TYPE:
+            nas_mobile_identity_imsi = iter->value;
+            nas_mobile_identity_imsi_len = iter->length;
+            break;
+        default:
+            ogs_warn("Invalid Type %d", iter->type);
+            break;
+        }
+        iter = iter->next;
+    }
+
+    ogs_tlv_free_all(root);
+
+    if (!nas_mobile_identity_imsi) {
+        ogs_error("No IMSI");
+        sgs_cause = SGSAP_SGS_CAUSE_MISSING_MANDATORY_IE;
+        goto alert_reject;
+    }
+    if (nas_mobile_identity_imsi_len != SGSAP_IE_IMSI_LEN) {
+        ogs_error("Invalid IMSI len %d", nas_mobile_identity_imsi_len);
+        sgs_cause = SGSAP_SGS_CAUSE_INVALID_MANDATORY_IE;
+        goto alert_reject;
+    }
+
+    if (nas_mobile_identity_imsi->type != OGS_NAS_MOBILE_IDENTITY_IMSI) {
+        ogs_error("nas_mobile_identity_imsi->type == "
+                    "OGS_NAS_MOBILE_IDENTITY_IMSI");
+        sgs_cause = SGSAP_SGS_CAUSE_INVALID_MANDATORY_IE;
+        goto alert_reject;
+    }
+
+    ogs_nas_eps_imsi_to_bcd(nas_mobile_identity_imsi,
+                            nas_mobile_identity_imsi_len, imsi_bcd);
+    mme_ue = mme_ue_find_by_imsi_bcd(imsi_bcd);
+
+    if (!mme_ue) {
+       ogs_error("No UE(mme-ue) context");
+       sgs_cause = SGSAP_SGS_CAUSE_IMSI_UNKNOWN;
+       goto alert_reject;
+    }
+
+    /* TODO: Set NEAF flag in UE */
+
+    ogs_warn("SGSAP Tx ALERT-ACK");
+
+    sgsap_send_to_vlr_with_sid(
+        vlr,
+        sgsap_build_alert_ack(mme_ue),
+        0);
+    return;
+
+alert_reject:
+    ogs_debug("SGSAP Tx ALERT-REJECT");
+    ogs_debug("    IMSI%s", imsi_bcd);
+
+    sgsap_send_to_vlr_with_sid(
+        vlr,
+        sgsap_build_alert_reject(
+            nas_mobile_identity_imsi, nas_mobile_identity_imsi_len,
+            sgs_cause),
+        0);
+    return;
+}
+
 void sgsap_handle_detach_ack(mme_vlr_t *vlr, ogs_pkbuf_t *pkbuf)
 {
     ogs_tlv_t *root = NULL, *iter = NULL;
@@ -491,14 +535,15 @@
     int r;
     ogs_tlv_t *root = NULL, *iter = NULL;
     mme_ue_t *mme_ue = NULL;
+    uint8_t sgs_cause = SGSAP_SGS_CAUSE_IMSI_UNKNOWN;
 
-    char imsi_bcdOGS_MAX_IMSI_BCD_LEN+1;
+    char imsi_bcdOGS_MAX_IMSI_BCD_LEN+1 = { 0, };
 
     ogs_nas_mobile_identity_imsi_t *nas_mobile_identity_imsi = NULL;
     int nas_mobile_identity_imsi_len = 0;
     ogs_nas_lai_t *lai = NULL;
     char vlr_nameSGSAP_IE_VLR_NAME_LEN = { 0, };
-    uint8_t service_indicator = 0;
+    uint8_t *service_indicator = NULL;
 
     ogs_assert(vlr);
     ogs_assert(pkbuf);
@@ -524,14 +569,15 @@
             if (ogs_fqdn_parse(vlr_name, iter->value,
                 ogs_min(iter->length, SGSAP_IE_VLR_NAME_LEN)) <= 0) {
                 ogs_error("Invalid VLR-Name");
-                return;
+                sgs_cause = SGSAP_SGS_CAUSE_INVALID_MANDATORY_IE;
+                goto paging_reject;
             }
             break;
         case SGSAP_IE_LAI_TYPE:
             lai = iter->value;
             break;
         case SGSAP_IE_SERVICE_INDICATOR_TYPE:
-            service_indicator = *((uint8_t*)(iter->value));
+            service_indicator = iter->value;
             break;
         default:
             ogs_warn("Invalid Type %d", iter->type);
@@ -544,11 +590,19 @@
 
     if (!nas_mobile_identity_imsi) {
         ogs_error("No IMSI");
-        return;
+        sgs_cause = SGSAP_SGS_CAUSE_MISSING_MANDATORY_IE;
+        goto paging_reject;
     }
     if (nas_mobile_identity_imsi_len != SGSAP_IE_IMSI_LEN) {
         ogs_error("Invalid IMSI len %d", nas_mobile_identity_imsi_len);
-        return;
+        sgs_cause = SGSAP_SGS_CAUSE_INVALID_MANDATORY_IE;
+        goto paging_reject;
+    }
+
+    if (!service_indicator) {
+        ogs_error("No Service indicator");
+        sgs_cause = SGSAP_SGS_CAUSE_MISSING_MANDATORY_IE;
+        goto paging_reject;
     }
 
     if (nas_mobile_identity_imsi->type == OGS_NAS_MOBILE_IDENTITY_IMSI) {
@@ -558,57 +612,73 @@
         mme_ue = mme_ue_find_by_imsi_bcd(imsi_bcd);
     } else {
         ogs_error("Unknown type %d", nas_mobile_identity_imsi->type);
-        return;
+            sgs_cause = SGSAP_SGS_CAUSE_INVALID_MANDATORY_IE;
+            goto paging_reject;
     }
 
-    if (mme_ue) {
-        ogs_assert(service_indicator);
-        mme_ue->service_indicator = service_indicator;
-
-        ogs_debug("    IMSI%s", mme_ue->imsi_bcd);
-        ogs_debug("    VLR_NAME%s", vlr_name);
-        ogs_debug("    SERVICE_INDICATOR%d", mme_ue->service_indicator);
-
-        if (lai) {
-            ogs_debug("    LAIPLMN_ID:%06x,LAC:%d",
-                        ogs_plmn_id_hexdump(&lai->nas_plmn_id), lai->lac);
-        }
-
-        if (ECM_IDLE(mme_ue)) {
-            if (CS_CALL_SERVICE_INDICATOR(mme_ue)) {
-                /* UE will respond Extended Service Request in PS CNDomain*/
-                MME_STORE_PAGING_INFO(mme_ue,
-                    MME_PAGING_TYPE_CS_CALL_SERVICE, NULL);
-                r = s1ap_send_paging(mme_ue, S1AP_CNDomain_cs);
-                ogs_expect(r == OGS_OK);
-                ogs_assert(r != OGS_ERROR);
-            } else if (SMS_SERVICE_INDICATOR(mme_ue)) {
-                /* UE will respond Service Request in PS CNDomain*/
-                MME_STORE_PAGING_INFO(mme_ue,
-                    MME_PAGING_TYPE_SMS_SERVICE, NULL);
-                r = s1ap_send_paging(mme_ue, S1AP_CNDomain_ps);
-                ogs_expect(r == OGS_OK);
-                ogs_assert(r != OGS_ERROR);
-            } else
-                goto paging_reject;
+    if (!mme_ue) {
+        sgs_cause = SGSAP_SGS_CAUSE_IMSI_UNKNOWN;
+        goto paging_reject;
+    }
+
+    switch (*service_indicator) {
+    case SGSAP_CS_CALL_SERVICE_INDICATOR:
+    case SGSAP_SMS_SERVICE_INDICATOR:
+        mme_ue->service_indicator = *service_indicator;
+        break;
+    default:
+        /* 3GPP TS 29.118 9.4.17: Other vals "shall not be sent in this version
+         * of the protocol. If received, shall be treated as '00000001'" */
+        mme_ue->service_indicator = SGSAP_CS_CALL_SERVICE_INDICATOR;
+        break;
+    }
+
+    ogs_debug("    IMSI%s", mme_ue->imsi_bcd);
+    ogs_debug("    VLR_NAME%s", vlr_name);
+    ogs_debug("    SERVICE_INDICATOR%d", mme_ue->service_indicator);
+
+    if (lai) {
+        ogs_debug("    LAIPLMN_ID:%06x,LAC:%d",
+                    ogs_plmn_id_hexdump(&lai->nas_plmn_id), lai->lac);
+    }
 
+    if (ECM_IDLE(mme_ue)) {
+        if (CS_CALL_SERVICE_INDICATOR(mme_ue)) {
+            /* UE will respond Extended Service Request in CS CNDomain*/
+            MME_STORE_PAGING_INFO(mme_ue,
+                MME_PAGING_TYPE_CS_CALL_SERVICE, NULL);
+            r = s1ap_send_paging(mme_ue, S1AP_CNDomain_cs);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+        } else if (SMS_SERVICE_INDICATOR(mme_ue)) {
+            /* UE will respond Service Request in PS CNDomain*/
+            MME_STORE_PAGING_INFO(mme_ue,
+                MME_PAGING_TYPE_SMS_SERVICE, NULL);
+            r = s1ap_send_paging(mme_ue, S1AP_CNDomain_ps);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
         } else {
-            MME_CLEAR_PAGING_INFO(mme_ue);
-            if (CS_CALL_SERVICE_INDICATOR(mme_ue)) {
-                r = nas_eps_send_cs_service_notification(mme_ue);
-                ogs_expect(r == OGS_OK);
-                ogs_assert(r != OGS_ERROR);
-            } else if (SMS_SERVICE_INDICATOR(mme_ue)) {
-                ogs_assert(OGS_OK ==
-                    sgsap_send_service_request(
-                        mme_ue, SGSAP_EMM_CONNECTED_MODE));
-            } else
-                goto paging_reject;
+            sgs_cause = SGSAP_SGS_CAUSE_MT_CS_FALLBACK_REJECT_BY_USER;
+            goto paging_reject;
+        }
+    } else {
+        MME_CLEAR_PAGING_INFO(mme_ue);
+        if (CS_CALL_SERVICE_INDICATOR(mme_ue)) {
+            r = nas_eps_send_cs_service_notification(mme_ue);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+        } else if (SMS_SERVICE_INDICATOR(mme_ue)) {
+            ogs_assert(OGS_OK ==
+                sgsap_send_service_request(
+                    mme_ue, SGSAP_EMM_CONNECTED_MODE));
+        } else {
+            sgs_cause = SGSAP_SGS_CAUSE_MT_CS_FALLBACK_REJECT_BY_USER;
+            goto paging_reject;
         }
-
-        return;
     }
 
+    return;
+
 paging_reject:
     ogs_debug("SGSAP PAGING-REJECT");
     ogs_debug("    IMSI%s", imsi_bcd);
@@ -617,7 +687,7 @@
         vlr,
         sgsap_build_paging_reject(
             nas_mobile_identity_imsi, nas_mobile_identity_imsi_len,
-            SGSAP_SGS_CAUSE_IMSI_UNKNOWN),
+            sgs_cause),
         0);
 }

open5gs_2.7.6.tar.xz/src/mme/sgsap-handler.h -> open5gs_2.7.7.tar.xz/src/mme/sgsap-handler.h Changed

open5gs_2.7.6.tar.xz/src/mme/sgsap-path.c -> open5gs_2.7.7.tar.xz/src/mme/sgsap-path.c Changed

open5gs_2.7.6.tar.xz/src/mme/sgsap-path.h -> open5gs_2.7.7.tar.xz/src/mme/sgsap-path.h Changed

open5gs_2.7.6.tar.xz/src/mme/sgsap-sm.c -> open5gs_2.7.7.tar.xz/src/mme/sgsap-sm.c Changed

open5gs_2.7.6.tar.xz/src/mme/sgsap-types.h -> open5gs_2.7.7.tar.xz/src/mme/sgsap-types.h Changed

open5gs_2.7.7.tar.xz/src/mme/ue-info.c Added

@@ -0,0 +1,386 @@
+/*
+ * Copyright (C) 2025 by Juraj Elias <juraj.elias@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+/*
+ *
+ * Connected MME UEs (LTE) JSON dumper for the Prometheus HTTP server (/ue-info).
+ * - supi, cm_state, enb_info, location, ambr, slices, pdn_count
+ * - pager: /ue-info?page=0&page_size=100 (0-based, page=-1 without paging) Default: page=0 page_size=100=MAXSIZE
+ *
+ * path: http://MME_IP:9090/ue-info
+ * 
+ * curl -s "http://127.0.0.2:9090/ue-info?" |jq . 
+ * {
+ *   "items": 
+ *     {
+ *       "supi": "999700000021632",
+ *       "domain": "EPS",
+ *       "rat": "E-UTRA",
+ *       "cm_state": "connected",
+ *       "enb": {
+ *         "ostream_id": 3,
+ *         "mme_ue_ngap_id": 3,
+ *         "ran_ue_ngap_id": 9,
+ *         "enb_id": 264040,
+ *         "cell_id": 67594275
+ *       },
+ *       "location": {
+ *         "tai": {
+ *           "plmn": "99970",
+ *           "tac_hex": "0001",
+ *           "tac": 1
+ *         }
+ *       },
+ *       "ambr": {
+ *         "downlink": 1000000000,
+ *         "uplink": 1000000000
+ *       },
+ *       "pdn": 
+ *         {
+ *           "apn": "internet",
+ *           "qos_flows": 
+ *             {
+ *               "ebi": 5
+ *             }
+ *           ,
+ *           "qci": 9,
+ *           "ebi": 5,
+ *           "bearer_count": 1,
+ *           "pdu_state": "active"
+ *         }
+ *       ,
+ *       "pdn_count": 1
+ *     }
+ *   ,
+ *   "pager": {
+ *     "page": 0,
+ *     "page_size": 100,
+ *     "count": 1
+ *   }
+ * }
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <string.h>
+#include <inttypes.h>
+
+#include "ogs-core.h"
+#include "ogs-proto.h"
+
+#include "mme-context.h"
+#include "ue-info.h"
+#include "mme-context.h"
+
+#include "metrics/prometheus/json_pager.h"
+#include "metrics/ogs-metrics.h"
+#include "sbi/openapi/external/cJSON.h"
+
+#ifndef MME_UE_INFO_PAGE_SIZE_DEFAULT
+#define MME_UE_INFO_PAGE_SIZE_DEFAULT 100U
+#endif
+
+
+size_t mme_dump_ue_info(char *buf, size_t buflen, size_t page, size_t page_size)
+{
+    if (page == SIZE_MAX) {
+        page = 0;
+        page_size = MME_UE_INFO_PAGE_SIZE_DEFAULT;
+    } else if (page_size == 0) {
+        page_size = MME_UE_INFO_PAGE_SIZE_DEFAULT;
+    } else if (page_size > MME_UE_INFO_PAGE_SIZE_DEFAULT) {
+        page_size = MME_UE_INFO_PAGE_SIZE_DEFAULT;
+    }
+
+    return mme_dump_ue_info_paged(buf, buflen, page, page_size);
+}
+
+static inline const char *cm_state_str(const mme_ue_t *ue)
+{
+    return (ue && ECM_CONNECTED(ue)) ? "connected" : "idle";
+}
+
+static cJSON *build_enb(const mme_ue_t *ue)
+{
+    cJSON *enb = cJSON_CreateObject();
+    if (!enb) return NULL;
+
+    /* ostream_id */
+    if (!cJSON_AddNumberToObject(enb, "ostream_id", (double)ue->enb_ostream_id))
+        goto end;
+
+    /* S1AP IDs */
+    enb_ue_t *ran = enb_ue_find_by_id(ue->enb_ue_id);
+    if (ran) {
+        if (!cJSON_AddNumberToObject(enb, "mme_ue_ngap_id", (double)ran->mme_ue_s1ap_id))
+            goto end;
+        if (!cJSON_AddNumberToObject(enb, "ran_ue_ngap_id", (double)ran->enb_ue_s1ap_id))
+            goto end;
+
+        mme_enb_t *enb_obj = mme_enb_find_by_id(ran->enb_id);
+        if (enb_obj && enb_obj->enb_id_presence) {
+            if (!cJSON_AddNumberToObject(enb, "enb_id", (double)enb_obj->enb_id))
+                goto end;
+        }
+
+        /* cell_id: prefer last reported via E-UTRAN_CGI from RAN; else fallback to UE’s e_cgi */
+        uint32_t cell_id = 0;
+        if (ran->saved.e_cgi.cell_id) cell_id = ran->saved.e_cgi.cell_id;
+        else if (ue->e_cgi.cell_id)   cell_id = ue->e_cgi.cell_id;
+
+        if (cell_id) {
+            if (!cJSON_AddNumberToObject(enb, "cell_id", (double)cell_id))
+                goto end;
+        }
+    }
+
+    return enb;
+
+end:
+    cJSON_Delete(enb);
+    return NULL;
+}
+
+static cJSON *build_location(const mme_ue_t *ue)
+{
+    cJSON *loc = cJSON_CreateObject();
+    if (!loc) return NULL;
+
+    cJSON *tai = cJSON_CreateObject();
+    if (!tai) goto end;
+
+    /* TAI: PLMN + TAC (hex and numeric) */
+    char plmn_strOGS_PLMNIDSTRLEN = {0};
+    ogs_plmn_id_to_string(&ue->tai.plmn_id, plmn_str);
+    if (!cJSON_AddStringToObject(tai, "plmn", plmn_str)) { cJSON_Delete(tai); goto end; }
+
+    char tac_hex8;
+    (void)snprintf(tac_hex, sizeof tac_hex, "%04x", (unsigned)ue->tai.tac);
+    if (!cJSON_AddStringToObject(tai, "tac_hex", tac_hex)) { cJSON_Delete(tai); goto end; }
+    if (!cJSON_AddNumberToObject(tai, "tac", (double)ue->tai.tac)) { cJSON_Delete(tai); goto end; }
+
+    cJSON_AddItemToObjectCS(loc, "tai", tai);
+    return loc;
+
+end:
+    cJSON_Delete(loc);
+    return NULL;
+}
+
+static cJSON *build_ambr(const mme_ue_t *ue)
+{
+    cJSON *ambr = cJSON_CreateObject();
+    if (!ambr) return NULL;
+
+    if (!cJSON_AddNumberToObject(ambr, "downlink", (double)ue->ambr.downlink)) goto end;
+    if (!cJSON_AddNumberToObject(ambr, "uplink",   (double)ue->ambr.uplink))   goto end;
+
+    return ambr;
+
+end:
+    cJSON_Delete(ambr);
+    return NULL;
+}
+
+static cJSON *build_pdn_array(const mme_ue_t *ue)
+{
+    cJSON *arr = cJSON_CreateArray();
+    if (!arr) return NULL;
+
+    mme_sess_t *sess = NULL;
+
+    ogs_list_for_each(&(ue->sess_list), sess) {
+        cJSON *it = cJSON_CreateObject();
+        if (!it) goto oom_all;
+
+        /* APN */
+        const char *apn = (sess->session && sess->session->name && sess->session->name0)
+                            ? (const char*)sess->session->name : "";
+        if (apn0) {
+            if (!cJSON_AddStringToObject(it, "apn", apn)) { cJSON_Delete(it); goto oom_all; }
+        }
+
+        /* QoS flows: list EBIs; QCI at session-level if present */
+        unsigned ebi_root = 0;
+        unsigned bearer_count = 0;
+
+        cJSON *qarr = cJSON_CreateArray();
+        if (!qarr) { cJSON_Delete(it); goto oom_all; }
+
+        mme_bearer_t *b = NULL;
+        ogs_list_for_each(&((mme_sess_t *)sess)->bearer_list, b) {
+            if (!b || b->ebi == 0) continue;
+
+            bearer_count++;
+            if (ebi_root == 0 || b->ebi < ebi_root)
+                ebi_root = (unsigned)b->ebi;
+
+            cJSON *q = cJSON_CreateObject();
+            if (!q) { cJSON_Delete(qarr); cJSON_Delete(it); goto oom_all; }
+            if (!cJSON_AddNumberToObject(q, "ebi", (double)b->ebi)) { cJSON_Delete(q); cJSON_Delete(qarr); cJSON_Delete(it); goto oom_all; }
+
+            cJSON_AddItemToArray(qarr, q);
+        }
+
+        cJSON_AddItemToObjectCS(it, "qos_flows", qarr);
+
+        /* Session-level QCI (if known) */
+        if (sess->session && sess->session->qos.index > 0) {
+            if (!cJSON_AddNumberToObject(it, "qci", (double)sess->session->qos.index)) { cJSON_Delete(it); goto oom_all; }
+        }
+
+        if (ebi_root) {
+            if (!cJSON_AddNumberToObject(it, "ebi", (double)ebi_root)) { cJSON_Delete(it); goto oom_all; }
+        }
+        if (!cJSON_AddNumberToObject(it, "bearer_count", (double)bearer_count)) { cJSON_Delete(it); goto oom_all; }
+
+        const char *state = bearer_count ? "active" : "unknown";
+        if (!cJSON_AddStringToObject(it, "pdu_state", state)) { cJSON_Delete(it); goto oom_all; }
+
+        cJSON_AddItemToArray(arr, it);
+    }
+
+    return arr;
+
+oom_all:
+    cJSON_Delete(arr);
+    return NULL;
+}
+
+static cJSON *ue_to_json(const mme_ue_t *ue)
+{
+    cJSON *o = cJSON_CreateObject();
+    if (!o) return NULL;
+
+    /* identity */
+    if (ue->imsi_bcd0) {
+        if (!cJSON_AddStringToObject(o, "supi", ue->imsi_bcd)) goto end;
+    }
+    if (!cJSON_AddStringToObject(o, "domain", "EPS")) goto end;
+    if (!cJSON_AddStringToObject(o, "rat", "E-UTRA")) goto end;
+    if (!cJSON_AddStringToObject(o, "cm_state", cm_state_str(ue))) goto end;
+
+    /* enb */
+    {
+        cJSON *enb = build_enb(ue);
+        if (!enb) goto end;
+        cJSON_AddItemToObjectCS(o, "enb", enb);
+    }
+
+    /* location */
+    {
+        cJSON *loc = build_location(ue);
+        if (!loc) goto end;
+        cJSON_AddItemToObjectCS(o, "location", loc);
+    }
+
+    /* ambr */
+    {
+        cJSON *ambr = build_ambr(ue);
+        if (!ambr) goto end;
+        cJSON_AddItemToObjectCS(o, "ambr", ambr);
+    }
+
+    /* pdn + pdn_count */
+    {
+        cJSON *pdn = build_pdn_array(ue);
+        if (!pdn) goto end;
+
+        /* Count PDNs before attaching */
+        size_t pdn_count = 0;
+        {
+            cJSON *it = NULL;
+            cJSON_ArrayForEach(it, pdn) pdn_count++;
+        }
+
+        cJSON_AddItemToObjectCS(o, "pdn", pdn);
+        if (!cJSON_AddNumberToObject(o, "pdn_count", (double)pdn_count)) goto end;
+    }
+
+    return o;
+
+end:
+    cJSON_Delete(o);
+    return NULL;
+}
+
+size_t mme_dump_ue_info_paged(char *buf, size_t buflen, size_t page, size_t page_size)
+{
+    if (!buf || buflen == 0) return 0;
+
+    const bool no_paging = (page == SIZE_MAX);
+    if (!no_paging) {
+        if (page_size == 0) page_size = MME_UE_INFO_PAGE_SIZE_DEFAULT;
+        if (page_size > MME_UE_INFO_PAGE_SIZE_DEFAULT) page_size = MME_UE_INFO_PAGE_SIZE_DEFAULT;
+    } else {
+        page_size = SIZE_MAX;
+        page = 0;
+    }
+
+    const size_t start_index = json_pager_safe_start_index(no_paging, page, page_size);
+
+    cJSON *root  = cJSON_CreateObject();
+    if (!root) {
+        if (buflen >= 3) { memcpy(buf, "{}", 3); return 2; }
+        if (buflen) buf0 = '\0';
+        return 0;
+    }
+
+    cJSON *items = cJSON_CreateArray();
+    if (!items) {
+        cJSON_Delete(root);
+        if (buflen >= 3) { memcpy(buf, "{}", 3); return 2; }
+        if (buflen) buf0 = '\0';
+        return 0;
+    }
+
+    size_t idx = 0, emitted = 0;
+    bool has_next = false, oom = false;
+
+    mme_context_t *ctxt = mme_self();
+    if (!ctxt) {
+        cJSON_Delete(items);
+        cJSON_Delete(root);
+        if (buflen >= 3) { memcpy(buf, "{}", 3); return 2; }
+        if (buflen) buf0 = '\0';
+        return 0;
+    }
+
+    mme_ue_t *ue = NULL;
+    ogs_list_for_each(&ctxt->mme_ue_list, ue) {
+        int act = json_pager_advance(no_paging, idx, start_index, emitted, page_size, &has_next);
+        if (act == 1) { idx++; continue; }
+        if (act == 2) break;
+
+        cJSON *one = ue_to_json(ue);
+        if (!one) { oom = true; break; }
+
+        cJSON_AddItemToArray(items, one);
+        emitted++;
+        idx++;
+    }
+
+    /* attach only when array is fully built */
+    cJSON_AddItemToObjectCS(root, "items", items);
+    json_pager_add_trailing(root, no_paging, page, page_size, emitted,
+                            has_next && !oom, "/ue-info", oom);
+
+    return json_pager_finalize(root, buf, buflen);
+}
+

open5gs_2.7.7.tar.xz/src/mme/ue-info.h Added

@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2025 by Juraj Elias <juraj.elias@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+/*
+ * /ue-info — MME-side JSON exporter (Prometheus HTTP endpoint)
+ *
+ * License: AGPLv3+
+ */
+
+#pragma once
+#include <stddef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef UE_INFO_PAGE_SIZE_DEFAULT
+#define UE_INFO_PAGE_SIZE_DEFAULT 100U
+#endif
+
+size_t mme_dump_ue_info(char *buf, size_t buflen,
+        size_t page, size_t page_size);
+size_t mme_dump_ue_info_paged(char *buf, size_t buflen,
+        size_t page, size_t page_size);
+
+#ifdef __cplusplus
+}
+#endif
+

open5gs_2.7.6.tar.xz/src/nrf/nnrf-handler.c -> open5gs_2.7.7.tar.xz/src/nrf/nnrf-handler.c Changed

@@ -125,6 +125,23 @@
 
     ogs_sbi_client_associate(nf_instance);
 
+    /* ---------------------------------------------------------- */
+    /* Validate usable endpoint after association                 */
+    /* ---------------------------------------------------------- */
+    if (!nf_instance_has_usable_client(nf_instance)) {
+
+        ogs_error("NFProfile has no usable endpoint: id=%s type=%s",
+            nf_instance->id,
+            OpenAPI_nf_type_ToString(nf_instance->nf_type));
+
+        ogs_assert(true ==
+            ogs_sbi_server_send_error(
+                stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST, recvmsg,
+                "NFProfile has no usable endpoint", nf_instance->id, NULL));
+
+        return false;
+    }
+
     switch (nf_instance->nf_type) {
     case OpenAPI_nf_type_SEPP:
         ogs_sbi_self()->sepp_instance = nf_instance;
@@ -524,8 +541,13 @@
 
     /* Issue #2630 : The format of subscrCond is invalid. Must be 'oneOf'. */
         if (SubscrCond->nf_type && SubscrCond->service_name) {
-            ogs_error("SubscrCond must be 'oneOf'");
+            ogs_error("SubscrCond must be either an NF type or a service name");
             ogs_sbi_subscription_data_remove(subscription_data);
+            ogs_assert(true ==
+                ogs_sbi_server_send_error(
+                    stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                    recvmsg, "SubscrCond must be either an NF type or a service name",
+                    NULL, NULL));
             return false;
         }
 
@@ -538,10 +560,24 @@
             subscription_data->subscr_cond.nf_instance_id = 
                 ogs_strdup(SubscrCond->nf_instance_id);
         else {
-            ogs_error("No SubscrCond");
+            ogs_error("Requested SubscrCond is not supported yet");
             ogs_sbi_subscription_data_remove(subscription_data);
+            ogs_assert(true ==
+                ogs_sbi_server_send_error(
+                    stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                    recvmsg, "Requested SubscrCond is not supported yet",
+                    NULL, NULL));
             return false;
         }
+    } else {
+        ogs_error("No SubscrCond found in NF Subscription message");
+        ogs_sbi_subscription_data_remove(subscription_data);
+        ogs_assert(true ==
+            ogs_sbi_server_send_error(
+                stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                recvmsg, "No SubscrCond found in NF Subscription message",
+                NULL, NULL));
+        return false;
     }
 
     subscription_data->notification_uri =
@@ -823,6 +859,13 @@
         return false;
     }
 
+    ogs_info("%s Removing local subscription data after NRF unsubscribe "
+            "duration:%lld,validity:%d.%06d",
+            subscription_data->id,
+            (long long)subscription_data->validity_duration,
+            (int)ogs_time_sec(subscription_data->validity_duration),
+            (int)ogs_time_usec(subscription_data->validity_duration));
+
     ogs_assert(subscription_data->id);
     ogs_sbi_subscription_data_remove(subscription_data);
 
@@ -1028,6 +1071,9 @@
                     ogs_plmn_id_mnc(
                         &discovery_option->requester_plmn_listi));
         }
+        if (discovery_option->hnrf_uri) {
+            ogs_debug("hnrf_uri%s", discovery_option->hnrf_uri);
+        }
         if (discovery_option->requester_features) {
             ogs_debug("requester-features0x%llx",
                 (long long)discovery_option->requester_features);
@@ -1062,11 +1108,12 @@
         if (recvmsg->param.limit && i >= recvmsg->param.limit)
             break;
 
-        ogs_debug("%s:%d NF-Discovered NF-Type:%s,NF-Status:%s,"
-                "IPv4:%d,IPv6:%d", nf_instance->id, i,
+        ogs_info("%s:%d NF-Discovered NF-Type:%s,NF-Status:%s,"
+                "IPv4:%d,IPv6:%d,FQDN:%s", nf_instance->id, i,
                 OpenAPI_nf_type_ToString(nf_instance->nf_type),
                 OpenAPI_nf_status_ToString(nf_instance->nf_status),
-                nf_instance->num_of_ipv4, nf_instance->num_of_ipv6);
+                nf_instance->num_of_ipv4, nf_instance->num_of_ipv6,
+                nf_instance->fqdn ? nf_instance->fqdn : "NULL");
 
         NFProfile = ogs_nnrf_nfm_build_nf_profile(
                 nf_instance, NULL, discovery_option,
@@ -1133,6 +1180,16 @@
                         nf_instance, discovery_option) == false)
                 continue;
 
+            /*
+             * NRFs in Home PLMN are categorized into those with and without
+             * hnrf-uri. Since Open5GS includes hnrf-uri in the Discovery
+             * message, NRFs must be differentiated based on the presence or
+             * absence of hnrf-uri, so the following match routine is used.
+             */
+            if (ogs_sbi_discovery_option_hnrf_uri_is_matched(
+                        nf_instance, discovery_option) == false)
+                continue;
+
             break;
         }
 
@@ -1154,10 +1211,63 @@
             nf_instance->num_of_plmn_id =
                 discovery_option->num_of_target_plmn_list;
 
-            nf_instance->fqdn = ogs_nrf_fqdn_from_plmn_id(nf_instance->plmn_id);
-            ogs_assert(nf_instance->fqdn);
+            /*
+             * NRFs with a Home PLMN can use the target_plmn information
+             * to extract the FQDN. However, the standards documentation
+             * describes hnrf-uri, so if hnrf-uri is included in discovery,
+             * we implement it so that the FQDN of an NRF with a Home PLMN
+             * is created using hnrf-uri.
+             */
+            if (discovery_option->hnrf_uri) {
+                OpenAPI_uri_scheme_e scheme = OpenAPI_uri_scheme_NULL;
+                char *fqdn = NULL;
+                uint16_t fqdn_port = 0;
+                ogs_sockaddr_t *addr = NULL, *addr6 = NULL;
+
+                rc = ogs_sbi_getaddr_from_uri(
+                        &scheme, &fqdn, &fqdn_port, &addr, &addr6,
+                        discovery_option->hnrf_uri);
+                if (rc == false || scheme == OpenAPI_uri_scheme_NULL)
+                    ogs_error("Invalid URL %s", request->h.uri);
+                else {
+            /*
+             * If there is an hnrf-uri, this value creates an nf-instance->fqdn,
+             * which in turn creates a client->fqdn from the hnrf-uri.
+             */
+                    nf_instance->hnrf_uri =
+                        ogs_strdup(discovery_option->hnrf_uri);
+                    nf_instance->fqdn = ogs_strdup(fqdn);
+
+                    ogs_free(fqdn);
+                    ogs_freeaddrinfo(addr);
+                    ogs_freeaddrinfo(addr6);
+                }
+            }
+
+            if (!nf_instance->fqdn) {
+                nf_instance->fqdn =
+                    ogs_nrf_fqdn_from_plmn_id(nf_instance->plmn_id);
+                ogs_assert(nf_instance->fqdn);
+            }
 
+            /*
+             * At this stage, the client->fqdn is set and this is
+             * passed through to the Target-apiRoot to the Home PLMN.
+             *
+             * As mentioned above, if there is an hnrf-uri, this value creates
+             * an nf-instance->fqdn, which in turn creates a client->fqdn
+             * from the hnrf-uri.
+             */
             ogs_sbi_client_associate(nf_instance);
+
+            ogs_info("New NRF fqdn:%s, hnrf_uri:%s",
+                    nf_instance->fqdn ? nf_instance->fqdn : "NULL",
+                    nf_instance->hnrf_uri ? nf_instance->hnrf_uri : "NULL");
+
+        } else {
+            ogs_info("NRF Found fqdn:%s, hnrf_uri:%s",
+                    nf_instance->fqdn ? nf_instance->fqdn : "NULL",
+                    nf_instance->hnrf_uri ? nf_instance->hnrf_uri : "NULL");
         }
 
         client = NF_INSTANCE_CLIENT(nf_instance);
@@ -1165,7 +1275,7 @@
 
         /*
          * TS29.510
-         * 5.3.2.4 Service Discovery in a different PLMN
+         * 5.3.2.2.3 Service Discovery in a different PLMN
          *
          * Then, steps 1-2 in Figure 5.3.2.2.3-1 are executed,
          * between the NRF in the Serving PLMN and the NRF in the Home PLMN.
@@ -1173,6 +1283,7 @@
          * in the query parameter of the URI is not required.
          */
         discovery_option->num_of_target_plmn_list = 0;
+        ogs_sbi_discovery_option_clear_hnrf_uri(discovery_option);
 
         assoc = nrf_assoc_add(stream);
         if (!assoc) {

open5gs_2.7.6.tar.xz/src/nssf/context.c -> open5gs_2.7.7.tar.xz/src/nssf/context.c Changed

@@ -24,6 +24,7 @@
 int __nssf_log_domain;
 
 static OGS_POOL(nssf_nsi_pool, nssf_nsi_t);
+static OGS_POOL(nssf_home_pool, nssf_home_t);
 
 static int context_initialized = 0;
 
@@ -37,6 +38,7 @@
     ogs_log_install_domain(&__nssf_log_domain, "nssf", ogs_core()->log.level);
 
     ogs_pool_init(&nssf_nsi_pool, ogs_app()->pool.nf);
+    ogs_pool_init(&nssf_home_pool, ogs_app()->pool.nf);
 
     context_initialized = 1;
 }
@@ -46,8 +48,10 @@
     ogs_assert(context_initialized == 1);
 
     nssf_nsi_remove_all();
+    nssf_home_remove_all();
 
     ogs_pool_final(&nssf_nsi_pool);
+    ogs_pool_final(&nssf_home_pool);
 
     context_initialized = 0;
 }
@@ -344,6 +348,75 @@
     return NULL;
 }
 
+nssf_home_t *nssf_home_add(ogs_plmn_id_t *plmn_id, ogs_s_nssai_t *s_nssai)
+{
+    nssf_home_t *home = NULL;
+
+    ogs_assert(plmn_id);
+    ogs_assert(s_nssai);
+
+    ogs_pool_id_calloc(&nssf_home_pool, &home);
+    if (home == NULL) {
+        ogs_error("Could not allocate home context from pool");
+        return NULL;
+    }
+
+    memcpy(&home->plmn_id, plmn_id, sizeof(ogs_plmn_id_t));
+    memcpy(&home->s_nssai, s_nssai, sizeof(ogs_s_nssai_t));
+
+    ogs_list_add(&self.home_list, home);
+
+    return home;
+}
+
+void nssf_home_remove(nssf_home_t *home)
+{
+    ogs_assert(home);
+
+    ogs_list_remove(&self.home_list, home);
+
+    if (home->nrf_id)
+        ogs_free(home->nrf_id);
+
+    if (home->nsi_id)
+        ogs_free(home->nsi_id);
+
+    /* Free SBI object memory */
+    ogs_sbi_object_free(&home->sbi);
+
+    ogs_pool_id_free(&nssf_home_pool, home);
+}
+
+void nssf_home_remove_all(void)
+{
+    nssf_home_t *home = NULL, *next_home = NULL;
+
+    ogs_list_for_each_safe(&self.home_list, next_home, home)
+        nssf_home_remove(home);
+}
+
+nssf_home_t *nssf_home_find(ogs_plmn_id_t *plmn_id, ogs_s_nssai_t *s_nssai)
+{
+    nssf_home_t *home = NULL;
+
+    ogs_assert(plmn_id);
+    ogs_assert(s_nssai);
+
+    ogs_list_for_each(&self.home_list, home) {
+        if (memcmp(&home->plmn_id, plmn_id, sizeof(ogs_plmn_id_t)) == 0 &&
+            memcmp(&home->s_nssai, s_nssai, sizeof(ogs_s_nssai_t)) == 0) {
+            return home;
+        }
+    }
+
+    return NULL;
+}
+
+nssf_home_t *nssf_home_find_by_id(ogs_pool_id_t id)
+{
+    return ogs_pool_find_by_id(&nssf_home_pool, id);
+}
+
 int get_nsi_load(void)
 {
     return (((ogs_pool_size(&nssf_nsi_pool) -

open5gs_2.7.6.tar.xz/src/nssf/context.h -> open5gs_2.7.7.tar.xz/src/nssf/context.h Changed

@@ -36,6 +36,7 @@
 
 typedef struct nssf_context_s {
     ogs_list_t      nsi_list; /* NSI List */
+    ogs_list_t      home_list; /* Home List for HR-Roaming*/
 } nssf_context_t;
 
 void nssf_context_init(void);
@@ -51,13 +52,34 @@
     char *nsi_id;
 
     ogs_s_nssai_t s_nssai;
+    OpenAPI_roaming_indication_e roaming_indication;
+
+    bool tai_presence;
+    ogs_5gs_tai_t tai;
 } nssf_nsi_t;
 
+typedef struct nssf_home_s {
+    ogs_sbi_object_t sbi;
+    ogs_pool_id_t id;
+
+    ogs_plmn_id_t plmn_id;
+    ogs_s_nssai_t s_nssai;
+
+    char *nrf_id;
+    char *nsi_id;
+} nssf_home_t;
+
 nssf_nsi_t *nssf_nsi_add(char *nrf_id, uint8_t sst, ogs_uint24_t sd);
 void nssf_nsi_remove(nssf_nsi_t *nsi);
 void nssf_nsi_remove_all(void);
 nssf_nsi_t *nssf_nsi_find_by_s_nssai(ogs_s_nssai_t *s_nssai);
 
+nssf_home_t *nssf_home_add(ogs_plmn_id_t *plmn_id, ogs_s_nssai_t *s_nssai);
+void nssf_home_remove(nssf_home_t *home);
+void nssf_home_remove_all(void);
+nssf_home_t *nssf_home_find(ogs_plmn_id_t *plmn_id, ogs_s_nssai_t *s_nssai);
+nssf_home_t *nssf_home_find_by_id(ogs_pool_id_t id);
+
 int get_nsi_load(void);
 
 #ifdef __cplusplus

open5gs_2.7.6.tar.xz/src/nssf/meson.build -> open5gs_2.7.7.tar.xz/src/nssf/meson.build Changed

open5gs_2.7.7.tar.xz/src/nssf/nnrf-handler.c Added

@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include "sbi-path.h"
+#include "nnrf-handler.h"
+
+void nssf_nnrf_handle_nf_discover(
+        ogs_sbi_xact_t *xact, ogs_sbi_message_t *recvmsg)
+{
+    ogs_sbi_nf_instance_t *nf_instance = NULL;
+    ogs_sbi_object_t *sbi_object = NULL;
+    ogs_sbi_service_type_e service_type = OGS_SBI_SERVICE_TYPE_NULL;
+    ogs_sbi_discovery_option_t *discovery_option = NULL;
+
+    OpenAPI_nf_type_e target_nf_type = OpenAPI_nf_type_NULL;
+    OpenAPI_nf_type_e requester_nf_type = OpenAPI_nf_type_NULL;
+    OpenAPI_search_result_t *SearchResult = NULL;
+
+    ogs_assert(recvmsg);
+    ogs_assert(xact);
+    sbi_object = xact->sbi_object;
+    ogs_assert(sbi_object);
+    service_type = xact->service_type;
+    ogs_assert(service_type);
+    target_nf_type = ogs_sbi_service_type_to_nf_type(service_type);
+    ogs_assert(target_nf_type);
+    requester_nf_type = xact->requester_nf_type;
+    ogs_assert(requester_nf_type);
+
+    discovery_option = xact->discovery_option;
+
+    SearchResult = recvmsg->SearchResult;
+    if (!SearchResult) {
+        ogs_error("No SearchResult");
+        return;
+    }
+
+    ogs_nnrf_disc_handle_nf_discover_search_result(SearchResult);
+
+    nf_instance = ogs_sbi_nf_instance_find_by_discovery_param(
+                    target_nf_type, requester_nf_type, discovery_option);
+    if (!nf_instance) {
+        ogs_error("(NF discover) No %s:%s",
+                    ogs_sbi_service_type_to_name(service_type),
+                    OpenAPI_nf_type_ToString(requester_nf_type));
+        return;
+    }
+
+    OGS_SBI_SETUP_NF_INSTANCE(
+            sbi_object->service_type_arrayservice_type, nf_instance);
+
+    ogs_expect(true == nssf_sbi_send_request(nf_instance, xact));
+}

open5gs_2.7.7.tar.xz/src/nssf/nnrf-handler.h Added

@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#ifndef NSSF_NNRF_HANDLER_H
+#define NSSF_NNRF_HANDLER_H
+
+#include "context.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void nssf_nnrf_handle_nf_discover(
+        ogs_sbi_xact_t *xact, ogs_sbi_message_t *recvmsg);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* NSSF_NNRF_HANDLER_H */

open5gs_2.7.7.tar.xz/src/nssf/nnssf-build.c Added

@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include "nnssf-build.h"
+
+ogs_sbi_request_t *nssf_nnssf_nsselection_build_get(
+        nssf_home_t *home, void *data)
+{
+    ogs_sbi_message_t message;
+    ogs_sbi_request_t *request = NULL;
+    nssf_nnssf_nsselection_param_t *param = data;
+
+    ogs_assert(param);
+    ogs_assert(home);
+
+    memset(&message, 0, sizeof(message));
+    message.h.method = (char *)OGS_SBI_HTTP_METHOD_GET;
+    message.h.service.name = (char *)OGS_SBI_SERVICE_NAME_NNSSF_NSSELECTION;
+    message.h.api.version = (char *)OGS_SBI_API_V2;
+    message.h.resource.component0 =
+        (char *)OGS_SBI_RESOURCE_NAME_NETWORK_SLICE_INFORMATION;
+
+    message.param.nf_id = NF_INSTANCE_ID(ogs_sbi_self()->nf_instance);
+    if (!message.param.nf_id) {
+        ogs_error("No nf-id");
+        goto end;
+    }
+    message.param.nf_type = NF_INSTANCE_TYPE(ogs_sbi_self()->nf_instance);
+    if (!message.param.nf_type) {
+        ogs_error("No nf-type");
+        goto end;
+    }
+
+    message.param.slice_info_for_pdu_session_presence =
+        param->slice_info_for_pdu_session.presence;
+
+    if (!message.param.slice_info_for_pdu_session_presence) {
+        ogs_error("No sliceInfoForPDUSession");
+        goto end;
+    }
+
+    if (!param->slice_info_for_pdu_session.snssai) {
+        ogs_error("No sNssai");
+        goto end;
+    }
+
+    message.param.snssai_presence = true;
+    memcpy(&message.param.s_nssai,
+            param->slice_info_for_pdu_session.snssai,
+            sizeof(message.param.s_nssai));
+
+    message.param.roaming_indication =
+        param->slice_info_for_pdu_session.roaming_indication;
+
+    if (!message.param.roaming_indication) {
+        ogs_error("No roamingIndication");
+        goto end;
+    }
+
+    if (param->tai) {
+        message.param.tai_presence = true;
+        memcpy(&message.param.tai, param->tai, sizeof(message.param.tai));
+    }
+
+    request = ogs_sbi_build_request(&message);
+    ogs_expect(request);
+
+end:
+
+    return request;
+}

open5gs_2.7.7.tar.xz/src/nssf/nnssf-build.h Added

@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#ifndef AMF_NNSSF_BUILD_H
+#define AMF_NNSSF_BUILD_H
+
+#include "context.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct nssf_nnssf_nsselection_param_s {
+    struct {
+        bool presence;
+        ogs_s_nssai_t *snssai;
+        OpenAPI_roaming_indication_e roaming_indication;
+    } slice_info_for_pdu_session;
+    ogs_5gs_tai_t *tai;
+} nssf_nnssf_nsselection_param_t;
+
+ogs_sbi_request_t *nssf_nnssf_nsselection_build_get(
+        nssf_home_t *home, void *data);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* AMF_NNSSF_BUILD_H */

open5gs_2.7.6.tar.xz/src/nssf/nnssf-handler.c -> open5gs_2.7.7.tar.xz/src/nssf/nnssf-handler.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019,2020 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -21,7 +21,7 @@
 #include "nnrf-handler.h"
 #include "nnssf-handler.h"
 
-bool nssf_nnrf_nsselection_handle_get(
+bool nssf_nnrf_nsselection_handle_get_from_amf_or_vnssf(
         ogs_sbi_stream_t *stream, ogs_sbi_message_t *recvmsg)
 {
     int status = OGS_SBI_HTTP_STATUS_OK;
@@ -50,12 +50,24 @@
         goto cleanup;
     }
 
-    if (!recvmsg->param.slice_info_request_for_pdu_session_presence) {
+    if (!recvmsg->param.slice_info_for_pdu_session_presence) {
         status = OGS_SBI_HTTP_STATUS_BAD_REQUEST;
         strerror = ogs_msprintf("Not implemented except PDU session");
         goto cleanup;
     }
 
+    if (!recvmsg->param.snssai_presence) {
+        status = OGS_SBI_HTTP_STATUS_BAD_REQUEST;
+        strerror = ogs_msprintf("No sNssai");
+        goto cleanup;
+    }
+
+    if (!recvmsg->param.roaming_indication) {
+        status = OGS_SBI_HTTP_STATUS_BAD_REQUEST;
+        strerror = ogs_msprintf("No roamingIndication");
+        goto cleanup;
+    }
+
     nsi = nssf_nsi_find_by_s_nssai(&recvmsg->param.s_nssai);
     if (!nsi) {
         status = OGS_SBI_HTTP_STATUS_FORBIDDEN;
@@ -64,9 +76,78 @@
         goto cleanup;
     }
 
+    nsi->roaming_indication = recvmsg->param.roaming_indication;
+
+    if (recvmsg->param.tai_presence) {
+        nsi->tai_presence = true;
+        memcpy(&nsi->tai, &recvmsg->param.tai, sizeof(nsi->tai));
+    }
+
     memset(&NsiInformation, 0, sizeof(NsiInformation));
-    NsiInformation.nrf_id = nsi->nrf_id;
-    NsiInformation.nsi_id = nsi->nsi_id;
+
+    if (recvmsg->param.home_plmn_id_presence &&
+            recvmsg->param.home_snssai_presence) {
+        nssf_home_t *home = nssf_home_find(
+                &recvmsg->param.home_plmn_id, &recvmsg->param.home_snssai);
+        if (!home) {
+            home = nssf_home_add(
+                    &recvmsg->param.home_plmn_id, &recvmsg->param.home_snssai);
+            if (!home) {
+                status = OGS_SBI_HTTP_STATUS_INTERNAL_SERVER_ERROR;
+                strerror = ogs_msprintf("Cannot allocate Home Network "
+                        "by PLMN-ID(0x%x) S-NSSAISST:%d SD:0x%x",
+                        ogs_plmn_id_hexdump(&recvmsg->param.home_plmn_id),
+                        recvmsg->param.home_snssai.sst,
+                        recvmsg->param.home_snssai.sd.v);
+                goto cleanup;
+            }
+        }
+
+        if (!home->nrf_id || !home->nsi_id) {
+            int r, i;
+            nssf_nnssf_nsselection_param_t param;
+            ogs_sbi_discovery_option_t *h_discovery_option = NULL;
+
+            h_discovery_option = ogs_sbi_discovery_option_new();
+            ogs_assert(h_discovery_option);
+
+            ogs_sbi_discovery_option_add_snssais(
+                    h_discovery_option, &home->s_nssai);
+            ogs_sbi_discovery_option_add_target_plmn_list(
+                    h_discovery_option, &home->plmn_id);
+            ogs_assert(ogs_local_conf()->num_of_serving_plmn_id);
+            for (i = 0; i < ogs_local_conf()->num_of_serving_plmn_id; i++) {
+                ogs_sbi_discovery_option_add_requester_plmn_list(
+                        h_discovery_option,
+                        &ogs_local_conf()->serving_plmn_idi);
+            }
+
+            memset(&param, 0, sizeof(param));
+            param.slice_info_for_pdu_session.presence = true;
+            param.slice_info_for_pdu_session.snssai = &home->s_nssai;
+            param.slice_info_for_pdu_session.roaming_indication =
+                nsi->roaming_indication;
+
+            if (nsi->tai_presence) param.tai = &nsi->tai;
+
+            r = nssf_sbi_discover_and_send(
+                    OGS_SBI_SERVICE_TYPE_NNSSF_NSSELECTION, h_discovery_option,
+                    nssf_nnssf_nsselection_build_get,
+                    home, stream, &param);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+
+            return true;
+        }
+
+        /* Home Network */
+        NsiInformation.nrf_id = home->nrf_id;
+        NsiInformation.nsi_id = home->nsi_id;
+    } else {
+        /* Serving Network */
+        NsiInformation.nrf_id = nsi->nrf_id;
+        NsiInformation.nsi_id = nsi->nsi_id;
+    }
 
     memset(&AuthorizedNetworkSliceInfo, 0, sizeof(AuthorizedNetworkSliceInfo));
     AuthorizedNetworkSliceInfo.nsi_information = &NsiInformation;
@@ -76,6 +157,81 @@
 
     response = ogs_sbi_build_response(&sendmsg, OGS_SBI_HTTP_STATUS_OK);
     ogs_assert(response);
+    ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+
+    return true;
+
+cleanup:
+    ogs_assert(strerror);
+
+    ogs_error("%s", strerror);
+    ogs_sbi_server_send_error(stream, status, recvmsg, strerror, NULL,
+            NULL);
+    ogs_free(strerror);
+
+    return false;
+}
+
+bool nssf_nnrf_nsselection_handle_get_from_hnssf(
+        nssf_home_t *home,
+        ogs_sbi_stream_t *stream, ogs_sbi_message_t *recvmsg)
+{
+    int status = OGS_SBI_HTTP_STATUS_OK;
+    char *strerror = NULL;
+
+    OpenAPI_authorized_network_slice_info_t *AuthorizedNetworkSliceInfo = NULL;
+    OpenAPI_nsi_information_t *NsiInformation = NULL;
+
+    ogs_sbi_message_t sendmsg;
+    ogs_sbi_response_t *response = NULL;
+
+    ogs_assert(home);
+    ogs_assert(stream);
+    ogs_assert(recvmsg);
+
+    if (recvmsg->res_status != OGS_SBI_HTTP_STATUS_OK) {
+        status = recvmsg->res_status;
+        strerror = ogs_msprintf("HTTP response error %d",
+                recvmsg->res_status);
+        goto cleanup;
+    }
+
+    AuthorizedNetworkSliceInfo = recvmsg->AuthorizedNetworkSliceInfo;
+    if (!AuthorizedNetworkSliceInfo) {
+        status = OGS_SBI_HTTP_STATUS_BAD_REQUEST;
+        strerror = ogs_msprintf("No AuthorizedNetworkSliceInfo");
+        goto cleanup;
+    }
+
+    NsiInformation = AuthorizedNetworkSliceInfo->nsi_information;
+    if (!NsiInformation) {
+        status = OGS_SBI_HTTP_STATUS_BAD_REQUEST;
+        strerror = ogs_msprintf("No NsiInformation");
+        goto cleanup;
+    }
+
+    if (!NsiInformation->nrf_id) {
+        status = OGS_SBI_HTTP_STATUS_BAD_REQUEST;
+        strerror = ogs_msprintf("No nrfId");
+        goto cleanup;
+    }
+
+    if (!NsiInformation->nsi_id) {
+        status = OGS_SBI_HTTP_STATUS_BAD_REQUEST;
+        strerror = ogs_msprintf("No nsiId");
+        goto cleanup;
+    }
+
+    home->nrf_id = ogs_strdup(NsiInformation->nrf_id);
+    ogs_assert(home->nrf_id);
+    home->nsi_id = ogs_strdup(NsiInformation->nsi_id);
+    ogs_assert(home->nsi_id);
+
+    memset(&sendmsg, 0, sizeof(sendmsg));
+    sendmsg.AuthorizedNetworkSliceInfo = AuthorizedNetworkSliceInfo;
+
+    response = ogs_sbi_build_response(&sendmsg, OGS_SBI_HTTP_STATUS_OK);
+    ogs_assert(response);
     ogs_assert(true == ogs_sbi_server_send_response(stream, response));
 
     return true;

open5gs_2.7.6.tar.xz/src/nssf/nnssf-handler.h -> open5gs_2.7.7.tar.xz/src/nssf/nnssf-handler.h Changed

open5gs_2.7.6.tar.xz/src/nssf/nssf-sm.c -> open5gs_2.7.7.tar.xz/src/nssf/nssf-sm.c Changed

@@ -46,6 +46,12 @@
     ogs_pool_id_t stream_id = OGS_INVALID_POOL_ID;
     ogs_sbi_request_t *request = NULL;
 
+    nssf_home_t *home = NULL;
+
+    ogs_pool_id_t sbi_object_id = OGS_INVALID_POOL_ID;
+    ogs_sbi_xact_t *sbi_xact = NULL;
+    ogs_pool_id_t sbi_xact_id = OGS_INVALID_POOL_ID;
+
     ogs_sbi_nf_instance_t *nf_instance = NULL;
     ogs_sbi_subscription_data_t *subscription_data = NULL;
     ogs_sbi_response_t *response = NULL;
@@ -141,7 +147,8 @@
             CASE(OGS_SBI_RESOURCE_NAME_NETWORK_SLICE_INFORMATION)
                 SWITCH(message.h.method)
                 CASE(OGS_SBI_HTTP_METHOD_GET)
-                    nssf_nnrf_nsselection_handle_get(stream, &message);
+                    nssf_nnrf_nsselection_handle_get_from_amf_or_vnssf(
+                            stream, &message);
                     break;
 
                 DEFAULT
@@ -191,7 +198,16 @@
             break;
         }
 
-        if (strcmp(message.h.api.version, OGS_SBI_API_V1) != 0) {
+        SWITCH(message.h.service.name)
+        CASE(OGS_SBI_SERVICE_NAME_NNSSF_NSSELECTION)
+            api_version = OGS_SBI_API_V2;
+            break;
+        DEFAULT
+            api_version = OGS_SBI_API_V1;
+        END
+
+        ogs_assert(api_version);
+        if (strcmp(message.h.api.version, api_version) != 0) {
             ogs_error("Not supported version %s", message.h.api.version);
             ogs_sbi_message_free(&message);
             ogs_sbi_response_free(response);
@@ -264,15 +280,17 @@
                     break;
 
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
-                    if (message.res_status ==
-                            OGS_SBI_HTTP_STATUS_NO_CONTENT) {
-                        ogs_sbi_subscription_data_remove(subscription_data);
-                    } else {
+                    if (message.res_status == OGS_SBI_HTTP_STATUS_NO_CONTENT)
+                        ogs_info("%s Subscription deleted",
+                                subscription_data->id ?
+                                    subscription_data->id : "Unknown");
+                    else
                         ogs_error("%s HTTP response error %d",
                                 subscription_data->id ?
                                     subscription_data->id : "Unknown",
                                 message.res_status);
-                    }
+
+                    ogs_sbi_subscription_data_remove(subscription_data);
                     break;
 
                 DEFAULT
@@ -289,6 +307,80 @@
             END
             break;
 
+        CASE(OGS_SBI_SERVICE_NAME_NNRF_DISC)
+            SWITCH(message.h.resource.component0)
+            CASE(OGS_SBI_RESOURCE_NAME_NF_INSTANCES)
+                sbi_xact_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
+                ogs_assert(sbi_xact_id >= OGS_MIN_POOL_ID &&
+                        sbi_xact_id <= OGS_MAX_POOL_ID);
+
+                sbi_xact = ogs_sbi_xact_find_by_id(sbi_xact_id);
+                if (!sbi_xact) {
+                    /* CLIENT_WAIT timer could remove SBI transaction
+                     * before receiving SBI message */
+                    ogs_error("SBI transaction has already been removed %d",
+                            sbi_xact_id);
+                    break;
+                }
+
+                SWITCH(message.h.method)
+                CASE(OGS_SBI_HTTP_METHOD_GET)
+                    if (message.res_status == OGS_SBI_HTTP_STATUS_OK)
+                        nssf_nnrf_handle_nf_discover(sbi_xact, &message);
+                    else
+                        ogs_error("HTTP response error %d",
+                                message.res_status);
+                    break;
+
+                DEFAULT
+                    ogs_error("Invalid HTTP method %s", message.h.method);
+                    ogs_assert_if_reached();
+                END
+                break;
+
+            DEFAULT
+                ogs_error("Invalid resource name %s",
+                        message.h.resource.component0);
+                ogs_assert_if_reached();
+            END
+            break;
+
+        CASE(OGS_SBI_SERVICE_NAME_NNSSF_NSSELECTION)
+            sbi_xact_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
+            ogs_assert(sbi_xact_id >= OGS_MIN_POOL_ID &&
+                    sbi_xact_id <= OGS_MAX_POOL_ID);
+
+            sbi_xact = ogs_sbi_xact_find_by_id(sbi_xact_id);
+            if (!sbi_xact) {
+                /* CLIENT_WAIT timer could remove SBI transaction
+                 * before receiving SBI message */
+                ogs_error("SBI transaction has already been removed %d",
+                        sbi_xact_id);
+                break;
+            }
+
+            sbi_object_id = sbi_xact->sbi_object_id;
+            ogs_assert(sbi_object_id >= OGS_MIN_POOL_ID &&
+                    sbi_object_id <= OGS_MAX_POOL_ID);
+
+            ogs_assert(sbi_xact->assoc_stream_id >= OGS_MIN_POOL_ID &&
+                    sbi_xact->assoc_stream_id <= OGS_MAX_POOL_ID);
+            stream = ogs_sbi_stream_find_by_id(sbi_xact->assoc_stream_id);
+
+            ogs_sbi_xact_remove(sbi_xact);
+
+            home = nssf_home_find_by_id(sbi_object_id);
+            if (!home) {
+                ogs_error("Home Network Context has already been removed");
+                break;
+            }
+
+            e->h.sbi.message = &message;;
+
+            nssf_nnrf_nsselection_handle_get_from_hnssf(home, stream, &message);
+            break;
+
+
         DEFAULT
             ogs_error("Invalid API name %s", message.h.service.name);
             ogs_assert_if_reached();
@@ -346,6 +438,64 @@
                     subscription_data->id);
             break;
 
+        case OGS_TIMER_SBI_CLIENT_WAIT:
+            /*
+             * ogs_pollset_poll() receives the time of the expiration
+             * of next timer as an argument. If this timeout is
+             * in very near future (1 millisecond), and if there are
+             * multiple events that need to be processed by ogs_pollset_poll(),
+             * these could take more than 1 millisecond for processing,
+             * resulting in the timer already passed the expiration.
+             *
+             * In case that another NF is under heavy load and responds
+             * to an SBI request with some delay of a few seconds,
+             * it can happen that ogs_pollset_poll() adds SBI responses
+             * to the event list for further processing,
+             * then ogs_timer_mgr_expire() is called which will add
+             * an additional event for timer expiration. When all events are
+             * processed one-by-one, the SBI xact would get deleted twice
+             * in a row, resulting in a crash.
+             *
+             * 1. ogs_pollset_poll()
+             *    message was received and put into an event list,
+             * 2. ogs_timer_mgr_expire()
+             *    add an additional event for timer expiration
+             * 3. message event is processed. (free SBI xact)
+             * 4. timer expiration event is processed. (double-free SBI xact)
+             *
+             * To avoid double-free SBI xact,
+             * we need to check ogs_sbi_xact_find_by_id()
+             */
+            sbi_xact_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
+            ogs_assert(sbi_xact_id >= OGS_MIN_POOL_ID &&
+                    sbi_xact_id <= OGS_MAX_POOL_ID);
+
+            sbi_xact = ogs_sbi_xact_find_by_id(sbi_xact_id);
+            if (!sbi_xact) {
+                ogs_error("SBI transaction has already been removed %d",
+                        sbi_xact_id);
+                break;
+            }
+
+            ogs_assert(sbi_xact->assoc_stream_id >= OGS_MIN_POOL_ID &&
+                    sbi_xact->assoc_stream_id <= OGS_MAX_POOL_ID);
+            stream = ogs_sbi_stream_find_by_id(sbi_xact->assoc_stream_id);
+
+            ogs_sbi_xact_remove(sbi_xact);
+
+            ogs_error("Cannot receive SBI message");
+
+            if (!stream) {
+                ogs_error("STREAM has alreadt been removed %d",
+                        sbi_xact->assoc_stream_id);
+                break;
+            }
+            ogs_assert(true ==
+                ogs_sbi_server_send_error(stream,
+                    OGS_SBI_HTTP_STATUS_GATEWAY_TIMEOUT, NULL,
+                    "Cannot receive SBI message", NULL, NULL));
+            break;
+
         default:
             ogs_error("Unknown timer%s:%d",
                     ogs_timer_get_name(e->h.timer_id), e->h.timer_id);

open5gs_2.7.6.tar.xz/src/nssf/sbi-path.c -> open5gs_2.7.7.tar.xz/src/nssf/sbi-path.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2022 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -33,6 +33,7 @@
     ogs_sbi_nf_instance_build_default(nf_instance);
     ogs_sbi_nf_instance_add_allowed_nf_type(nf_instance, OpenAPI_nf_type_SCP);
     ogs_sbi_nf_instance_add_allowed_nf_type(nf_instance, OpenAPI_nf_type_AMF);
+    ogs_sbi_nf_instance_add_allowed_nf_type(nf_instance, OpenAPI_nf_type_NSSF);
 
     /* Build NF service information. It will be transmitted to NRF. */
     if (ogs_sbi_nf_service_is_available(
@@ -43,6 +44,7 @@
         ogs_sbi_nf_service_add_version(
                     service, OGS_SBI_API_V2, OGS_SBI_API_V2_0_0, NULL);
         ogs_sbi_nf_service_add_allowed_nf_type(service, OpenAPI_nf_type_AMF);
+        ogs_sbi_nf_service_add_allowed_nf_type(service, OpenAPI_nf_type_NSSF);
     }
 
     /* Initialize NRF NF Instance */
@@ -64,3 +66,57 @@
     ogs_sbi_client_stop_all();
     ogs_sbi_server_stop_all();
 }
+
+bool nssf_sbi_send_request(
+        ogs_sbi_nf_instance_t *nf_instance, ogs_sbi_xact_t *xact)
+{
+    ogs_assert(nf_instance);
+    ogs_assert(xact);
+    return ogs_sbi_send_request_to_nf_instance(nf_instance, xact);
+}
+
+int nssf_sbi_discover_and_send(
+        ogs_sbi_service_type_e service_type,
+        ogs_sbi_discovery_option_t *discovery_option,
+        ogs_sbi_request_t *(*build)(nssf_home_t *home, void *data),
+        nssf_home_t *home, ogs_sbi_stream_t *stream, void *data)
+{
+    ogs_sbi_xact_t *xact = NULL;
+    int r;
+
+    ogs_assert(service_type);
+    ogs_assert(home);
+    ogs_assert(stream);
+    ogs_assert(build);
+
+    ogs_assert(home->id >= OGS_MIN_POOL_ID && home->id <= OGS_MAX_POOL_ID);
+
+    xact = ogs_sbi_xact_add(
+            home->id, &home->sbi, service_type, discovery_option,
+            (ogs_sbi_build_f)build, home, data);
+    if (!xact) {
+        ogs_error("nssf_sbi_discover_and_send() failed");
+        ogs_assert(true ==
+            ogs_sbi_server_send_error(stream,
+                OGS_SBI_HTTP_STATUS_GATEWAY_TIMEOUT, NULL,
+                "Cannot discover", NULL, NULL));
+        return OGS_ERROR;
+    }
+
+    xact->assoc_stream_id = ogs_sbi_id_from_stream(stream);
+    ogs_assert(xact->assoc_stream_id >= OGS_MIN_POOL_ID &&
+            xact->assoc_stream_id <= OGS_MAX_POOL_ID);
+
+    r = ogs_sbi_discover_and_send(xact);
+    if (r != OGS_OK) {
+        ogs_error("nssf_sbi_discover_and_send() failed");
+        ogs_sbi_xact_remove(xact);
+        ogs_assert(true ==
+            ogs_sbi_server_send_error(stream,
+                OGS_SBI_HTTP_STATUS_GATEWAY_TIMEOUT, NULL,
+                "Cannot discover", NULL, NULL));
+        return r;
+    }
+
+    return OGS_OK;
+}

open5gs_2.7.6.tar.xz/src/nssf/sbi-path.h -> open5gs_2.7.7.tar.xz/src/nssf/sbi-path.h Changed

open5gs_2.7.6.tar.xz/src/pcf/context.c -> open5gs_2.7.7.tar.xz/src/pcf/context.c Changed

@@ -875,36 +875,45 @@
             ogs_pool_size(&pcf_ue_sm_pool));
 }
 
-int pcf_db_qos_data(char *supi,
-        ogs_plmn_id_t *plmn_id, ogs_s_nssai_t *s_nssai, char *dnn,
-        ogs_session_data_t *session_data)
+int pcf_get_session_data(const char *supi,
+                         const ogs_plmn_id_t *plmn_id,
+                         const ogs_s_nssai_t *s_nssai,
+                         const char *dnn,
+                         ogs_session_data_t *session_data,
+                         int flags)
 {
-    int rv;
-
+    int rv = OGS_OK;
     ogs_app_policy_conf_t *policy_conf = NULL;
 
+    /* Validate input parameters */
     ogs_assert(supi);
     ogs_assert(s_nssai);
     ogs_assert(dnn);
     ogs_assert(session_data);
 
+    /* Initialize the session data structure */
     memset(session_data, 0, sizeof(*session_data));
 
+    /* Attempt to locate a policy configuration */
     policy_conf = ogs_app_policy_conf_find(supi, plmn_id);
     if (policy_conf) {
         rv = ogs_app_config_session_data(
                 supi, plmn_id, s_nssai, dnn, session_data);
-        if (rv != OGS_OK)
-            ogs_error("ogs_app_config_session_data() failed - "
-                    "MCC%d MNC%d SST%d SD0x%x DNN%s",
-                    ogs_plmn_id_mcc(plmn_id), ogs_plmn_id_mnc(plmn_id),
-                    s_nssai->sst, s_nssai->sd.v, dnn);
+        if (rv != OGS_OK) {
+            if (!(flags & PCF_SESSION_DATA_FLAG_NO_ERROR_LOG))
+                ogs_error("ogs_app_config_session_data() failed - "
+                        "MCC%d MNC%d SST%d SD0x%x DNN%s",
+                        ogs_plmn_id_mcc(plmn_id), ogs_plmn_id_mnc(plmn_id),
+                        s_nssai->sst, s_nssai->sd.v, dnn);
+        }
     } else {
         rv = ogs_dbi_session_data(supi, s_nssai, dnn, session_data);
-        if (rv != OGS_OK)
-            ogs_error("ogs_dbi_session_data() failed - "
-                    "SUPI%s SST%d SD0x%x DNN%s",
-                    supi, s_nssai->sst, s_nssai->sd.v, dnn);
+        if (rv != OGS_OK) {
+            if (!(flags & PCF_SESSION_DATA_FLAG_NO_ERROR_LOG))
+                ogs_error("ogs_dbi_session_data() failed - "
+                        "SUPI%s SST%d SD0x%x DNN%s",
+                        supi, s_nssai->sst, s_nssai->sd.v, dnn);
+        }
     }
 
     return rv;

open5gs_2.7.6.tar.xz/src/pcf/context.h -> open5gs_2.7.7.tar.xz/src/pcf/context.h Changed

@@ -244,9 +244,42 @@
 pcf_app_t *pcf_app_find_by_app_session_id(char *app_session_id);
 int pcf_instance_get_load(void);
 
-int pcf_db_qos_data(char *supi,
-        ogs_plmn_id_t *plmn_id, ogs_s_nssai_t *s_nssai, char *dnn,
-        ogs_session_data_t *session_data);
+/*------------------------------------------------------------------
+ * Flag definition(s) for pcf_get_session_data().
+ *------------------------------------------------------------------
+ * Use PCF_SESSION_DATA_FLAG_NO_ERROR_LOG to suppress error logs.
+ */
+#define PCF_SESSION_DATA_FLAG_NO_ERROR_LOG 0x01
+
+/*------------------------------------------------------------------
+ * pcf_get_session_data - Retrieve session data from policy config or DB.
+ *
+ * This function retrieves session data for the given subscriber by
+ * first checking for a policy configuration; if none is found, it
+ * falls back to querying the database.
+ *
+ * Parameters:
+ *   supi         - Subscriber identifier (read-only).
+ *   plmn_id      - Pointer to a PLMN ID structure (read-only).
+ *   s_nssai      - Pointer to an S-NSSAI structure (read-only).
+ *   dnn          - Data network name (read-only).
+ *   session_data - Pointer to the session data structure to be filled.
+ *   flags        - Flags to control behavior (e.g., error logging).
+ *
+ * Returns:
+ *   OGS_OK on success, or an error code on failure.
+ *
+ * Note:
+ *   To suppress error logging, pass the flag
+ *   PCF_SESSION_DATA_FLAG_NO_ERROR_LOG in the flags parameter.
+ *------------------------------------------------------------------
+ */
+int pcf_get_session_data(const char *supi,
+                         const ogs_plmn_id_t *plmn_id,
+                         const ogs_s_nssai_t *s_nssai,
+                         const char *dnn,
+                         ogs_session_data_t *session_data,
+                         int flags);
 
 #ifdef __cplusplus
 }

open5gs_2.7.6.tar.xz/src/pcf/npcf-handler.c -> open5gs_2.7.7.tar.xz/src/pcf/npcf-handler.c Changed

@@ -234,7 +234,7 @@
     uint16_t fqdn_port = 0;
     ogs_sockaddr_t *addr = NULL, *addr6 = NULL;
 
-    char *home_network_domain = NULL;
+    char *dnn_oi = NULL;
 
     ogs_assert(sess);
     pcf_ue_sm = pcf_ue_sm_find_by_id(sess->pcf_ue_sm_id);
@@ -369,22 +369,20 @@
      * The DNN of the PDU session, a full DNN with both the Network Identifier
      * and Operator Identifier, or a DNN with the Network Identifier only
      */
-    home_network_domain = ogs_home_network_domain_from_fqdn(
-            SmPolicyContextData->dnn);
+    dnn_oi = ogs_dnn_oi_from_fqdn(SmPolicyContextData->dnn);
 
-    if (home_network_domain) {
-        char dnn_network_identiferOGS_MAX_DNN_LEN+1;
+    if (dnn_oi) {
+        char dnn_niOGS_MAX_DNN_LEN+1;
         uint16_t mcc = 0, mnc = 0;
 
-        ogs_assert(home_network_domain > SmPolicyContextData->dnn);
+        ogs_assert(dnn_oi > SmPolicyContextData->dnn);
 
-        ogs_cpystrn(dnn_network_identifer, SmPolicyContextData->dnn,
-            ogs_min(OGS_MAX_DNN_LEN,
-                home_network_domain - SmPolicyContextData->dnn));
+        ogs_cpystrn(dnn_ni, SmPolicyContextData->dnn,
+            ogs_min(OGS_MAX_DNN_LEN, dnn_oi - SmPolicyContextData->dnn));
 
         if (sess->dnn)
             ogs_free(sess->dnn);
-        sess->dnn = ogs_strdup(dnn_network_identifer);
+        sess->dnn = ogs_strdup(dnn_ni);
         ogs_assert(sess->dnn);
 
         if (sess->full_dnn)
@@ -846,10 +844,10 @@
     ogs_freeaddrinfo(addr);
     ogs_freeaddrinfo(addr6);
 
-    rv = pcf_db_qos_data(
+    rv = pcf_get_session_data(
             pcf_ue_sm->supi,
             sess->home.presence == true ? &sess->home.plmn_id : NULL,
-            &sess->s_nssai, sess->dnn, &session_data);
+            &sess->s_nssai, sess->dnn, &session_data, 0);
     if (rv != OGS_OK) {
         strerror = ogs_msprintf("%s:%d Cannot find SUPI in DB",
                 pcf_ue_sm->supi, sess->psi);
@@ -1294,10 +1292,10 @@
         }
     }
 
-    rv = pcf_db_qos_data(
+    rv = pcf_get_session_data(
             pcf_ue_sm->supi,
             sess->home.presence == true ? &sess->home.plmn_id : NULL,
-            &sess->s_nssai, sess->dnn, &session_data);
+            &sess->s_nssai, sess->dnn, &session_data, 0);
     if (rv != OGS_OK) {
         strerror = ogs_msprintf("%s:%d Cannot find SUPI in DB",
                 pcf_ue_sm->supi, sess->psi);

open5gs_2.7.6.tar.xz/src/pcf/pcf-sm.c -> open5gs_2.7.7.tar.xz/src/pcf/pcf-sm.c Changed

@@ -440,15 +440,17 @@
                     break;
 
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
-                    if (message.res_status ==
-                            OGS_SBI_HTTP_STATUS_NO_CONTENT) {
-                        ogs_sbi_subscription_data_remove(subscription_data);
-                    } else {
+                    if (message.res_status == OGS_SBI_HTTP_STATUS_NO_CONTENT)
+                        ogs_info("%s Subscription deleted",
+                                subscription_data->id ?
+                                    subscription_data->id : "Unknown");
+                    else
                         ogs_error("%s HTTP response error %d",
                                 subscription_data->id ?
                                     subscription_data->id : "Unknown",
                                 message.res_status);
-                    }
+
+                    ogs_sbi_subscription_data_remove(subscription_data);
                     break;
 
                 DEFAULT

open5gs_2.7.6.tar.xz/src/pcf/sbi-path.c -> open5gs_2.7.7.tar.xz/src/pcf/sbi-path.c Changed

open5gs_2.7.6.tar.xz/src/pcrf/pcrf-gx-path.c -> open5gs_2.7.7.tar.xz/src/pcrf/pcrf-gx-path.c Changed

@@ -1,5 +1,5 @@
 /* Gx Interface, 3GPP TS 29.212 section 4
- * Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -47,6 +47,8 @@
 
     ogs_list_t  rx_list;
 
+    uint32_t    rat_type;            /* RAT-Type */
+
     struct timespec ts;             /* Time of sending the message */
 };
 
@@ -221,27 +223,30 @@
     return ENOTSUP;
 }
 
-static int pcrf_gx_ccr_cb( struct msg **msg, struct avp *avp,
+static int pcrf_gx_ccr_cb(struct msg **msg, struct avp *avp,
         struct session *sess, void *opaque, enum disp_action *act)
 {
     int rv;
     int ret = 0, i;
-
-    struct msg *ans, *qry;
-    struct avp *avpch1, *avpch2;
-    struct avp_hdr *hdr;
+    struct msg *ans = NULL, *qry = NULL;
+    struct avp *avpch1 = NULL, *avpch2 = NULL;
+    struct avp_hdr *hdr = NULL;
     union avp_value val;
     struct sess_state *sess_data = NULL;
-
     ogs_diam_gx_message_t gx_message;
-
     uint32_t cc_request_type = OGS_DIAM_GX_CC_REQUEST_TYPE_INITIAL_REQUEST;
     uint32_t cc_request_number = 0;
     uint32_t result_code = OGS_DIAM_MISSING_AVP;
+    int error_occurred = 0;
+    int charging_rule = 0;
 
     ogs_debug("Rx Credit-Control-Request");
 
-    ogs_assert(msg);
+    /* Validate input parameters */
+    if (!msg || !*msg || !sess) {
+        ogs_error("Invalid input parameters");
+        return EINVAL;
+    }
 
     /* Initialize Message */
     memset(&gx_message, 0, sizeof(ogs_diam_gx_message_t));
@@ -249,40 +254,78 @@
     /* Create answer header */
     qry = *msg;
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create answer message");
+        error_occurred = 1;
+        goto out;
+    }
     ans = *msg;
 
     /* Set the Auth-Application-Id AVP */
     ret = fd_msg_avp_new(ogs_diam_auth_application_id, 0, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create Auth-Application-Id AVP");
+        error_occurred = 1;
+        goto out;
+    }
     val.i32 = OGS_DIAM_GX_APPLICATION_ID;
     ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to set Auth-Application-Id value");
+        error_occurred = 1;
+        goto out;
+    }
     ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to add Auth-Application-Id AVP");
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Get CC-Request-Type */
     ret = fd_msg_search_avp(qry, ogs_diam_gx_cc_request_type, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search CC-Request-Type AVP");
+        error_occurred = 1;
+        goto out;
+    }
+
     if (avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to get CC-Request-Type AVP header");
+            error_occurred = 1;
+            goto out;
+        }
         cc_request_type = hdr->avp_value->i32;
     } else {
-        ogs_error("no_CC-Request-Type ");
-        ogs_assert_if_reached();
+        ogs_error("No CC-Request-Type found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
     }
 
     /* Get CC-Request-Number */
     ret = fd_msg_search_avp(qry, ogs_diam_gx_cc_request_number, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search CC-Request-Number AVP");
+        error_occurred = 1;
+        goto out;
+    }
+
     if (avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to get CC-Request-Number AVP header");
+            error_occurred = 1;
+            goto out;
+        }
         cc_request_number = hdr->avp_value->i32;
     } else {
-        ogs_error("no_CC-Request-Number");
-        ogs_assert_if_reached();
+        ogs_error("No CC-Request-Number found");
+        result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
     }
 
     ogs_debug("    CC-Request-Type%d Number%d",
@@ -290,25 +333,53 @@
 
     /* Set CC-Request-Type */
     ret = fd_msg_avp_new(ogs_diam_gx_cc_request_type, 0, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create CC-Request-Type AVP");
+        error_occurred = 1;
+        goto out;
+    }
     val.i32 = cc_request_type;
     ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to set CC-Request-Type value");
+        error_occurred = 1;
+        goto out;
+    }
     ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to add CC-Request-Type AVP");
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Set CC-Request-Number */
     ret = fd_msg_avp_new(ogs_diam_gx_cc_request_number, 0, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create CC-Request-Number AVP");
+        error_occurred = 1;
+        goto out;
+    }
     val.i32 = cc_request_number;
     ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to set CC-Request-Number value");
+        error_occurred = 1;
+        goto out;
+    }
     ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to add CC-Request-Number AVP");
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Find Session */
     ret = fd_sess_state_retrieve(pcrf_gx_reg, sess, &sess_data);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to retrieve session state");
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Check Session */
     if (!sess_data &&
@@ -316,128 +387,227 @@
         cc_request_type == OGS_DIAM_GX_CC_REQUEST_TYPE_TERMINATION_REQUEST)) {
         ogs_error("No Session for CC-Request-Type: %d", cc_request_type);
         result_code = OGS_DIAM_UNKNOWN_SESSION_ID;
+        error_occurred = 1;
         goto out;
     }
 
     if (!sess_data) {
-        os0_t sid;
+        os0_t sid = NULL;
         size_t sidlen;
 
         ret = fd_sess_getsid(sess, &sid, &sidlen);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to get session ID");
+            error_occurred = 1;
+            goto out;
+        }
 
         sess_data = new_state(sid);
-        ogs_assert(sess_data);
+        if (!sess_data) {
+            ogs_error("Failed to create new session state");
+            error_occurred = 1;
+            goto out;
+        }
     }
 
     /* Get Origin-Host */
     ret = fd_msg_search_avp(qry, ogs_diam_origin_host, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Origin-Host AVP");
+        error_occurred = 1;
+        goto out;
+    }
+
     if (avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to get Origin-Host AVP header");
+            error_occurred = 1;
+            goto out;
+        }
 
-        if (sess_data->peer_host)
+        if (sess_data->peer_host) {
             ogs_free(sess_data->peer_host);
+            sess_data->peer_host = NULL;
+        }
         sess_data->peer_host =
             (os0_t)ogs_strdup((char *)hdr->avp_value->os.data);
-        ogs_assert(sess_data->peer_host);
+        if (!sess_data->peer_host) {
+            ogs_error("Failed to duplicate peer host");
+            error_occurred = 1;
+            goto out;
+        }
     } else {
-        ogs_error("no_CC-Request-Type ");
+        ogs_error("No Origin-Host found");
         result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
         goto out;
     }
 
     /* Get Framed-IP-Address */
     ret = fd_msg_search_avp(qry, ogs_diam_gx_framed_ip_address, &avp);
-    ogs_assert(ret == 0);
-    if (avp) {
+    if (ret == 0 && avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
-
-        ogs_assert(hdr->avp_value->os.len == sizeof sess_data->addr);
-        memcpy(&sess_data->addr,
-                hdr->avp_value->os.data, hdr->avp_value->os.len);
-        pcrf_sess_set_ipv4(&sess_data->addr, sess_data->sid);
-        sess_data->ipv4 = 1;
+        if (ret == 0 && hdr &&
+            hdr->avp_value->os.len == sizeof(sess_data->addr)) {
+            memcpy(&sess_data->addr,
+                    hdr->avp_value->os.data, hdr->avp_value->os.len);
+            pcrf_sess_set_ipv4(&sess_data->addr, sess_data->sid);
+            sess_data->ipv4 = 1;
+        } else if (ret != 0) {
+            ogs_warn("Failed to get Framed-IP-Address AVP header");
+        }
     }
 
     /* Get Framed-IPv6-Prefix */
     ret = fd_msg_search_avp(qry, ogs_diam_gx_framed_ipv6_prefix, &avp);
-    ogs_assert(ret == 0);
-    if (avp) {
+    if (ret == 0 && avp) {
         ogs_paa_t *paa = NULL;
 
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
-
-        paa = (ogs_paa_t *)hdr->avp_value->os.data;
-        ogs_assert(paa);
-        ogs_assert(paa->len == OGS_IPV6_DEFAULT_PREFIX_LEN /* 64bit */);
-        memcpy(sess_data->addr6, paa->addr6, paa->len >> 3);
-        pcrf_sess_set_ipv6(sess_data->addr6, sess_data->sid);
-        sess_data->ipv6 = 1;
+        if (ret == 0 && hdr) {
+            paa = (ogs_paa_t *)hdr->avp_value->os.data;
+            if (paa && paa->len == OGS_IPV6_DEFAULT_PREFIX_LEN) {
+                memcpy(sess_data->addr6, paa->addr6, paa->len >> 3);
+                pcrf_sess_set_ipv6(sess_data->addr6, sess_data->sid);
+                sess_data->ipv6 = 1;
+            }
+        } else if (ret != 0) {
+            ogs_warn("Failed to get Framed-IPv6-Prefix AVP header");
+        }
     }
 
     /* Get IMSI + APN */
     ret = fd_msg_search_avp(qry, ogs_diam_subscription_id, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Subscription-Id AVP");
+        error_occurred = 1;
+        goto out;
+    }
+
     if (avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to get Subscription-Id AVP header");
+            error_occurred = 1;
+            goto out;
+        }
+
         ret = fd_avp_search_avp(avp, ogs_diam_subscription_id_type, &avpch1);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to search Subscription-Id-Type AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
         if (avpch1) {
             ret = fd_msg_avp_hdr(avpch1, &hdr);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to get Subscription-Id-Type AVP header");
+                error_occurred = 1;
+                goto out;
+            }
             if (hdr->avp_value->i32 !=
                     OGS_DIAM_SUBSCRIPTION_ID_TYPE_END_USER_IMSI) {
                 ogs_error("Not implemented Subscription-Id-Type(%d)",
                         hdr->avp_value->i32);
                 result_code = OGS_DIAM_AVP_UNSUPPORTED;
+                error_occurred = 1;
                 goto out;
             }
         } else {
-            ogs_error("no_Subscription-Id-Type");
+            ogs_error("No Subscription-Id-Type found");
             result_code = OGS_DIAM_MISSING_AVP;
+            error_occurred = 1;
             goto out;
         }
+
         ret = fd_avp_search_avp(avp, ogs_diam_subscription_id_data, &avpch1);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to search Subscription-Id-Data AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
         if (avpch1) {
             ret = fd_msg_avp_hdr(avpch1, &hdr);
-            ogs_assert(ret == 0);
-            if (sess_data->imsi_bcd)
+            if (ret != 0) {
+                ogs_error("Failed to get Subscription-Id-Data AVP header");
+                error_occurred = 1;
+                goto out;
+            }
+            if (sess_data->imsi_bcd) {
                 ogs_free(sess_data->imsi_bcd);
+                sess_data->imsi_bcd = NULL;
+            }
             sess_data->imsi_bcd = ogs_strdup((char *)hdr->avp_value->os.data);
-            ogs_assert(sess_data->imsi_bcd);
+            if (!sess_data->imsi_bcd) {
+                ogs_error("Failed to duplicate IMSI");
+                error_occurred = 1;
+                goto out;
+            }
         } else {
-            ogs_error("no_Subscription-Id-Data");
+            ogs_error("No Subscription-Id-Data found");
             result_code = OGS_DIAM_MISSING_AVP;
+            error_occurred = 1;
             goto out;
         }
     }
 
-    if (sess_data->imsi_bcd == NULL) {
-        ogs_error("no_Subscription-Id");
+    if (!sess_data->imsi_bcd) {
+        ogs_error("No Subscription-Id");
         result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
+        goto out;
+    }
+
+    ret = fd_msg_search_avp(qry, ogs_diam_rat_type, &avp);
+    if (ret != 0) {
+        ogs_error("Failed to search RAT-Type AVP");
+        error_occurred = 1;
         goto out;
     }
 
+    if (avp) {
+        ret = fd_msg_avp_hdr(avp, &hdr);
+        if (ret != 0) {
+            ogs_error("Failed to get RAT-Type AVP header");
+            error_occurred = 1;
+            goto out;
+        }
+        sess_data->rat_type = hdr->avp_value->i32;
+    }
+
     ret = fd_msg_search_avp(qry, ogs_diam_gx_called_station_id, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Called-Station-Id AVP");
+        error_occurred = 1;
+        goto out;
+    }
+
     if (avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
-        if (sess_data->apn)
+        if (ret != 0) {
+            ogs_error("Failed to get Called-Station-Id AVP header");
+            error_occurred = 1;
+            goto out;
+        }
+        if (sess_data->apn) {
             ogs_free(sess_data->apn);
+            sess_data->apn = NULL;
+        }
         sess_data->apn = ogs_strdup((char *)hdr->avp_value->os.data);
-        ogs_assert(sess_data->apn);
+        if (!sess_data->apn) {
+            ogs_error("Failed to duplicate APN");
+            error_occurred = 1;
+            goto out;
+        }
     }
 
-    if (sess_data->apn == NULL) {
-        ogs_error("no_Called-Station-Id");
+    if (!sess_data->apn) {
+        ogs_error("No Called-Station-Id");
         result_code = OGS_DIAM_MISSING_AVP;
+        error_occurred = 1;
         goto out;
     }
 
@@ -445,15 +615,15 @@
     rv = pcrf_db_qos_data(
             sess_data->imsi_bcd, sess_data->apn, &gx_message.session_data);
     if (rv != OGS_OK) {
-        ogs_error("Cannot get data for IMSI(%s)+APN(%s)'",
+        ogs_error("Cannot get data for IMSI(%s)+APN(%s)",
                 sess_data->imsi_bcd, sess_data->apn);
         result_code = OGS_DIAM_UNKNOWN_SESSION_ID;
+        error_occurred = 1;
         goto out;
     }
 
     if (cc_request_type == OGS_DIAM_GX_CC_REQUEST_TYPE_INITIAL_REQUEST ||
         cc_request_type == OGS_DIAM_GX_CC_REQUEST_TYPE_UPDATE_REQUEST) {
-        int charging_rule = 0;
 
         for (i = 0; i < gx_message.session_data.num_of_pcc_rule; i++) {
             ogs_pcc_rule_t *pcc_rule = &gx_message.session_data.pcc_rulei;
@@ -461,137 +631,289 @@
                 if (charging_rule == 0) {
                     ret = fd_msg_avp_new(
                             ogs_diam_gx_charging_rule_install, 0, &avp);
-                    ogs_assert(ret == 0);
-
+                    if (ret != 0) {
+                        ogs_error("Failed to create Charging-Rule-Install AVP");
+                        error_occurred = 1;
+                        goto out;
+                    }
                     charging_rule = 1;
                 }
 
                 rv = encode_pcc_rule_definition(avp, pcc_rule, 1);
-                ogs_assert(rv == OGS_OK);
+                if (rv != OGS_OK) {
+                    ogs_error("Failed to encode PCC rule definition");
+                    error_occurred = 1;
+                    goto out;
+                }
             }
         }
 
         if (charging_rule) {
             ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add Charging-Rule-Install AVP");
+                error_occurred = 1;
+                goto out;
+            }
         }
 
         /* Set QoS-Information */
         if (gx_message.session_data.session.ambr.downlink ||
                 gx_message.session_data.session.ambr.uplink) {
             ret = fd_msg_avp_new(ogs_diam_gx_qos_information, 0, &avp);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to create QoS-Information AVP");
+                error_occurred = 1;
+                goto out;
+            }
 
             if (gx_message.session_data.session.ambr.uplink) {
                 ret = fd_msg_avp_new(
                         ogs_diam_gx_apn_aggregate_max_bitrate_ul, 0, &avpch1);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to create APN-AMBR-UL AVP");
+                    error_occurred = 1;
+                    goto out;
+                }
                 val.u32 = ogs_uint64_to_uint32(
                             gx_message.session_data.session.ambr.uplink);
-                ret = fd_msg_avp_setvalue (avpch1, &val);
-                ogs_assert(ret == 0);
-                ret = fd_msg_avp_add (avp, MSG_BRW_LAST_CHILD, avpch1);
-                ogs_assert(ret == 0);
+                ret = fd_msg_avp_setvalue(avpch1, &val);
+                if (ret != 0) {
+                    ogs_error("Failed to set APN-AMBR-UL value");
+                    error_occurred = 1;
+                    goto out;
+                }
+                ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch1);
+                if (ret != 0) {
+                    ogs_error("Failed to add APN-AMBR-UL AVP");
+                    error_occurred = 1;
+                    goto out;
+                }
             }
 
             if (gx_message.session_data.session.ambr.downlink) {
                 ret = fd_msg_avp_new(
                         ogs_diam_gx_apn_aggregate_max_bitrate_dl, 0, &avpch1);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to create APN-AMBR-DL AVP");
+                    error_occurred = 1;
+                    goto out;
+                }
                 val.u32 = ogs_uint64_to_uint32(
                             gx_message.session_data.session.ambr.downlink);
-                ret = fd_msg_avp_setvalue (avpch1, &val);
-                ogs_assert(ret == 0);
-                ret = fd_msg_avp_add (avp, MSG_BRW_LAST_CHILD, avpch1);
-                ogs_assert(ret == 0);
+                ret = fd_msg_avp_setvalue(avpch1, &val);
+                if (ret != 0) {
+                    ogs_error("Failed to set APN-AMBR-DL value");
+                    error_occurred = 1;
+                    goto out;
+                }
+                ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch1);
+                if (ret != 0) {
+                    ogs_error("Failed to add APN-AMBR-DL AVP");
+                    error_occurred = 1;
+                    goto out;
+                }
             }
 
             ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to add QoS-Information AVP");
+                error_occurred = 1;
+                goto out;
+            }
         }
 
         /* Set Default-EPS-Bearer-QoS */
         ret = fd_msg_avp_new(ogs_diam_gx_default_eps_bearer_qos, 0, &avp);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create Default-EPS-Bearer-QoS AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
         ret = fd_msg_avp_new(ogs_diam_gx_qos_class_identifier, 0, &avpch1);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create QoS-Class-Identifier AVP");
+            error_occurred = 1;
+            goto out;
+        }
         val.u32 = gx_message.session_data.session.qos.index;
-        ret = fd_msg_avp_setvalue (avpch1, &val);
-        ogs_assert(ret == 0);
-        ret = fd_msg_avp_add (avp, MSG_BRW_LAST_CHILD, avpch1);
-        ogs_assert(ret == 0);
+        ret = fd_msg_avp_setvalue(avpch1, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set QoS-Class-Identifier value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to add QoS-Class-Identifier AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
         ret = fd_msg_avp_new(
                 ogs_diam_gx_allocation_retention_priority, 0, &avpch1);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create ARP AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
         ret = fd_msg_avp_new(ogs_diam_gx_priority_level, 0, &avpch2);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create Priority-Level AVP");
+            error_occurred = 1;
+            goto out;
+        }
         val.u32 = gx_message.session_data.session.qos.arp.priority_level;
-        ret = fd_msg_avp_setvalue (avpch2, &val);
-        ogs_assert(ret == 0);
-        ret = fd_msg_avp_add (avpch1, MSG_BRW_LAST_CHILD, avpch2);
-        ogs_assert(ret == 0);
+        ret = fd_msg_avp_setvalue(avpch2, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Priority-Level value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avpch1, MSG_BRW_LAST_CHILD, avpch2);
+        if (ret != 0) {
+            ogs_error("Failed to add Priority-Level AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
         ret = fd_msg_avp_new(ogs_diam_gx_pre_emption_capability, 0, &avpch2);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create Pre-emption-Capability AVP");
+            error_occurred = 1;
+            goto out;
+        }
         val.u32 = OGS_EPC_PRE_EMPTION_DISABLED;
         if (gx_message.session_data.session.qos.arp.pre_emption_capability ==
                 OGS_5GC_PRE_EMPTION_ENABLED)
             val.u32 = OGS_EPC_PRE_EMPTION_ENABLED;
-        ret = fd_msg_avp_setvalue (avpch2, &val);
-        ogs_assert(ret == 0);
-        ret = fd_msg_avp_add (avpch1, MSG_BRW_LAST_CHILD, avpch2);
-        ogs_assert(ret == 0);
+        ret = fd_msg_avp_setvalue(avpch2, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Pre-emption-Capability value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avpch1, MSG_BRW_LAST_CHILD, avpch2);
+        if (ret != 0) {
+            ogs_error("Failed to add Pre-emption-Capability AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
         ret = fd_msg_avp_new(ogs_diam_gx_pre_emption_vulnerability, 0, &avpch2);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create Pre-emption-Vulnerability AVP");
+            error_occurred = 1;
+            goto out;
+        }
         val.u32 = OGS_EPC_PRE_EMPTION_DISABLED;
         if (gx_message.session_data.session.qos.arp.pre_emption_vulnerability ==
                 OGS_5GC_PRE_EMPTION_ENABLED)
             val.u32 = OGS_EPC_PRE_EMPTION_ENABLED;
-        ret = fd_msg_avp_setvalue (avpch2, &val);
-        ogs_assert(ret == 0);
-        ret = fd_msg_avp_add (avpch1, MSG_BRW_LAST_CHILD, avpch2);
-        ogs_assert(ret == 0);
+        ret = fd_msg_avp_setvalue(avpch2, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Pre-emption-Vulnerability value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avpch1, MSG_BRW_LAST_CHILD, avpch2);
+        if (ret != 0) {
+            ogs_error("Failed to add Pre-emption-Vulnerability AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
-        ret = fd_msg_avp_add (avp, MSG_BRW_LAST_CHILD, avpch1);
-        ogs_assert(ret == 0);
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to add ARP AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
         ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to add Default-EPS-Bearer-QoS AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
         /* Set Supported Features */
         ret = fd_msg_avp_new(ogs_diam_gx_supported_features, 0, &avp);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create Supported-Features AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
         ret = fd_msg_avp_new(ogs_diam_vendor_id, 0, &avpch1);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create Vendor-Id AVP");
+            error_occurred = 1;
+            goto out;
+        }
         val.i32 = OGS_3GPP_VENDOR_ID;
-        ret = fd_msg_avp_setvalue (avpch1, &val);
-        ogs_assert(ret == 0);
-        ret = fd_msg_avp_add (avp, MSG_BRW_LAST_CHILD, avpch1);
-        ogs_assert(ret == 0);
+        ret = fd_msg_avp_setvalue(avpch1, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Vendor-Id value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to add Vendor-Id AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
         ret = fd_msg_avp_new(ogs_diam_gx_feature_list_id, 0, &avpch1);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create Feature-List-ID AVP");
+            error_occurred = 1;
+            goto out;
+        }
         val.i32 = 1;
-        ret = fd_msg_avp_setvalue (avpch1, &val);
-        ogs_assert(ret == 0);
-        ret = fd_msg_avp_add (avp, MSG_BRW_LAST_CHILD, avpch1);
-        ogs_assert(ret == 0);
+        ret = fd_msg_avp_setvalue(avpch1, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Feature-List-ID value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to add Feature-List-ID AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
         ret = fd_msg_avp_new(ogs_diam_gx_feature_list, 0, &avpch1);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to create Feature-List AVP");
+            error_occurred = 1;
+            goto out;
+        }
         val.u32 = 0x0000000b;
-        ret = fd_msg_avp_setvalue (avpch1, &val);
-        ogs_assert(ret == 0);
-        ret = fd_msg_avp_add (avp, MSG_BRW_LAST_CHILD, avpch1);
-        ogs_assert(ret == 0);
+        ret = fd_msg_avp_setvalue(avpch1, &val);
+        if (ret != 0) {
+            ogs_error("Failed to set Feature-List value");
+            error_occurred = 1;
+            goto out;
+        }
+        ret = fd_msg_avp_add(avp, MSG_BRW_LAST_CHILD, avpch1);
+        if (ret != 0) {
+            ogs_error("Failed to add Feature-List AVP");
+            error_occurred = 1;
+            goto out;
+        }
 
         ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to add Supported-Features AVP");
+            error_occurred = 1;
+            goto out;
+        }
+
     } else if (cc_request_type ==
             OGS_DIAM_GX_CC_REQUEST_TYPE_TERMINATION_REQUEST) {
         struct rx_sess_state *rx_sess_data = NULL, *next_rx_sess_data = NULL;
@@ -599,80 +921,110 @@
                 next_rx_sess_data, rx_sess_data) {
             rv = pcrf_rx_send_asr(
                     rx_sess_data->sid, OGS_DIAM_RX_ABORT_CAUSE_BEARER_RELEASED);
-            ogs_expect(rv == OGS_OK);
+            if (rv != OGS_OK) {
+                ogs_warn("Failed to send ASR for RX session");
+                /* Continue processing other sessions */
+            }
 
             remove_rx_state(rx_sess_data);
         }
     }
 
-    /* Set the Origin-Host, Origin-Realm, andResult-Code AVPs */
-    ret = fd_msg_rescode_set(ans, (char *)"DIAMETER_SUCCESS", NULL, NULL, 1);
-    ogs_assert(ret == 0);
-
-    if (cc_request_type != OGS_DIAM_GX_CC_REQUEST_TYPE_TERMINATION_REQUEST) {
-        /* Store this value in the session */
-        ret = fd_sess_state_store(pcrf_gx_reg, sess, &sess_data);
-        ogs_assert(ret == 0);
-        ogs_assert(sess_data == NULL);
-    } else {
-        state_cleanup(sess_data, NULL, NULL);
-    }
-
-    /* Send the answer */
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+    if (!error_occurred) {
+        /* Set success result code */
+        ret = fd_msg_rescode_set(ans, (char *)"DIAMETER_SUCCESS", NULL, NULL, 1);
+        if (ret != 0) {
+            ogs_error("Failed to set success result code");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_debug("Tx Credit-Control-Answer");
+        /* Store or cleanup session based on request type */
+        if (cc_request_type != OGS_DIAM_GX_CC_REQUEST_TYPE_TERMINATION_REQUEST) {
+            /* Store this value in the session */
+            ret = fd_sess_state_store(pcrf_gx_reg, sess, &sess_data);
+            if (ret != 0) {
+                ogs_error("Failed to store session state");
+                error_occurred = 1;
+                goto out;
+            }
+            sess_data = NULL; /* Ownership transferred */
+        } else {
+            state_cleanup(sess_data, NULL, NULL);
+            sess_data = NULL;
+        }
 
-    /* Add this value to the stats */
-    OGS_DIAM_STATS_MTX(
-        OGS_DIAM_STATS_INC(nb_echoed);
-        PCRF_DIAM_PRIV_STATS_INC(gx.rx_ccr);
-        PCRF_DIAM_PRIV_STATS_INC(gx.tx_cca);
-    )
+        /* Send the answer */
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send message");
+            error_occurred = 1;
+            goto out;
+        }
 
-    OGS_SESSION_DATA_FREE(&gx_message.session_data);
+        ogs_debug("Tx Credit-Control-Answer");
 
-    return 0;
+        /* Add to stats */
+        OGS_DIAM_STATS_MTX(
+            OGS_DIAM_STATS_INC(nb_echoed);
+            PCRF_DIAM_PRIV_STATS_INC(gx.rx_ccr);
+            PCRF_DIAM_PRIV_STATS_INC(gx.tx_cca);
+        )
 
-out:
-    /* Set the Result-Code */
-    if (result_code == OGS_DIAM_AVP_UNSUPPORTED) {
-        ret = fd_msg_rescode_set(ans,
-                    (char *)"DIAMETER_AVP_UNSUPPORTED", NULL, NULL, 1);
-        ogs_assert(ret == 0);
-    } else if (result_code == OGS_DIAM_UNKNOWN_SESSION_ID) {
-        ret = fd_msg_rescode_set(ans,
-                    (char *)"DIAMETER_UNKNOWN_SESSION_ID", NULL, NULL, 1);
-        ogs_assert(ret == 0);
-    } else if (result_code == OGS_DIAM_MISSING_AVP) {
-        ret = fd_msg_rescode_set(ans,
-                    (char *)"DIAMETER_MISSING_AVP", NULL, NULL, 1);
-        ogs_assert(ret == 0);
-    } else {
-        ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
-        ogs_assert(ret == 0);
+        OGS_SESSION_DATA_FREE(&gx_message.session_data);
+        return 0;
     }
 
-    if (sess_data) {
-        if (cc_request_type !=
-                OGS_DIAM_GX_CC_REQUEST_TYPE_TERMINATION_REQUEST) {
-            /* Store this value in the session */
-            ret = fd_sess_state_store(pcrf_gx_reg, sess, &sess_data);
-            ogs_assert(sess_data == NULL);
+out:
+    /* Error handling */
+    if (ans) {
+        /* Set the Result-Code */
+        if (result_code == OGS_DIAM_AVP_UNSUPPORTED) {
+            ret = fd_msg_rescode_set(ans,
+                        (char *)"DIAMETER_AVP_UNSUPPORTED", NULL, NULL, 1);
+        } else if (result_code == OGS_DIAM_UNKNOWN_SESSION_ID) {
+            ret = fd_msg_rescode_set(ans,
+                        (char *)"DIAMETER_UNKNOWN_SESSION_ID", NULL, NULL, 1);
+        } else if (result_code == OGS_DIAM_MISSING_AVP) {
+            ret = fd_msg_rescode_set(ans,
+                        (char *)"DIAMETER_MISSING_AVP", NULL, NULL, 1);
         } else {
-            state_cleanup(sess_data, NULL, NULL);
+            ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
         }
-    }
 
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to set error result code");
+        }
 
+        /* Handle session state for error cases */
+        if (sess_data) {
+            if (cc_request_type !=
+                    OGS_DIAM_GX_CC_REQUEST_TYPE_TERMINATION_REQUEST) {
+                /* Store this value in the session */
+                ret = fd_sess_state_store(pcrf_gx_reg, sess, &sess_data);
+                if (ret != 0) {
+                    ogs_error("Failed to store session state in error path");
+                }
+                sess_data = NULL; /* Ownership transferred */
+            } else {
+                state_cleanup(sess_data, NULL, NULL);
+                sess_data = NULL;
+            }
+        }
+
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send error response");
+        }
+    }
+
+    /* Update error stats */
     OGS_DIAM_STATS_MTX(
         PCRF_DIAM_PRIV_STATS_INC(gx.rx_ccr);
         PCRF_DIAM_PRIV_STATS_INC(gx.rx_ccr_error);
     )
 
+    /* Always free session data */
     OGS_SESSION_DATA_FREE(&gx_message.session_data);
 
     return 0;
@@ -806,12 +1158,13 @@
                     == OGS_DIAM_RX_MEDIA_TYPE_CONTROL)) {
                 /*
                  * Check for default bearer for IMS signalling
-                 * QCI 5 and ARP 1
+                 * QCI 5 and ARP 1 only in case of 3GPP RAT.
                  */
-                if (gx_message.session_data.
+                if (sess_data->rat_type != OGS_DIAM_RAT_TYPE_WLAN &&
+                    (gx_message.session_data.
                         session.qos.index != OGS_QOS_INDEX_5 ||
                     gx_message.session_data.
-                        session.qos.arp.priority_level != 1) {
+                        session.qos.arp.priority_level != 1)) {
                     ogs_error("CHECK WEBUI : Even the Default "
                         "Bearer(QCI:%d,ARP:%d) cannot support IMS signalling.",
                         gx_message.session_data.session.qos.index,
@@ -1054,133 +1407,208 @@
 static void pcrf_gx_raa_cb(void *data, struct msg **msg)
 {
     int ret;
-
     struct sess_state *sess_data = NULL;
     struct timespec ts;
-    struct session *session;
-    struct avp *avp, *avpch1;
-    struct avp_hdr *hdr;
+    struct session *session = NULL;
+    struct avp *avp = NULL, *avpch1 = NULL;
+    struct avp_hdr *hdr = NULL;
     unsigned long dur;
     int error = 0;
-    int new;
-
-    uint32_t result_code;
+    int new = 0;
+    uint32_t result_code = 0;
 
     ogs_debug("PCRF Rx Re-Auth-Answer");
 
+    /* Validate input parameters */
+    if (!msg || !*msg) {
+        ogs_error("Invalid message pointer");
+        return;
+    }
+
+    /* Get current timestamp */
     ret = clock_gettime(CLOCK_REALTIME, &ts);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to get current time");
+        goto cleanup;
+    }
 
     /* Search the session, retrieve its data */
     ret = fd_msg_sess_get(fd_g_config->cnf_dict, *msg, &session, &new);
-    ogs_assert(ret == 0);
-    ogs_assert(new == 0);
+    if (ret != 0) {
+        ogs_error("Failed to get session from message");
+        error++;
+        goto cleanup;
+    }
+
+    if (new != 0) {
+        ogs_error("Session should already exist");
+        error++;
+        goto cleanup;
+    }
 
+    /* Retrieve session state */
     ret = fd_sess_state_retrieve(pcrf_gx_reg, session, &sess_data);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to retrieve session state");
+        error++;
+        goto cleanup;
+    }
+
     if (!sess_data) {
         ogs_error("No Session Data");
-        return;
+        error++;
+        goto cleanup;
+    }
+
+    /* Validate data pointer consistency */
+    if ((void *)sess_data != data) {
+        ogs_error("Session data pointer mismatch");
+        error++;
+        goto cleanup;
     }
-    ogs_assert((void *)sess_data == data);
 
     /* Value of Result Code */
     ret = fd_msg_search_avp(*msg, ogs_diam_result_code, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Result-Code AVP");
+        error++;
+        goto parse_experimental_result;
+    }
+
     if (avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to get Result-Code AVP header");
+            error++;
+            goto parse_experimental_result;
+        }
         result_code = hdr->avp_value->i32;
-        ogs_debug("    Result Code: %d", hdr->avp_value->i32);
+        ogs_debug("    Result Code: %d", result_code);
     } else {
+parse_experimental_result:
+        /* Try experimental result code */
         ret = fd_msg_search_avp(*msg, ogs_diam_experimental_result, &avp);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to search Experimental-Result AVP");
+            error++;
+            goto parse_origin_host;
+        }
+
         if (avp) {
-            ret = fd_avp_search_avp(
-                    avp, ogs_diam_experimental_result_code, &avpch1);
-            ogs_assert(ret == 0);
+            ret = fd_avp_search_avp(avp, ogs_diam_experimental_result_code,
+                                    &avpch1);
+            if (ret != 0) {
+                ogs_error("Failed to search Experimental-Result-Code AVP");
+                error++;
+                goto parse_origin_host;
+            }
+
             if (avpch1) {
                 ret = fd_msg_avp_hdr(avpch1, &hdr);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to get Experimental-Result-Code header");
+                    error++;
+                    goto parse_origin_host;
+                }
                 result_code = hdr->avp_value->i32;
                 ogs_debug("    Experimental Result Code: %d", result_code);
             }
         } else {
-            ogs_error("no Result-Code");
+            ogs_error("No Result-Code or Experimental-Result found");
             error++;
         }
     }
 
+parse_origin_host:
     /* Value of Origin-Host */
     ret = fd_msg_search_avp(*msg, ogs_diam_origin_host, &avp);
-    ogs_assert(ret == 0);
-    if (avp) {
+    if (ret == 0 && avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
-        ogs_debug("    From '%.*s'",
-                (int)hdr->avp_value->os.len, hdr->avp_value->os.data);
+        if (ret == 0 && hdr) {
+            ogs_debug("    From '%.*s'",
+                    (int)hdr->avp_value->os.len, hdr->avp_value->os.data);
+        } else {
+            ogs_warn("Failed to get Origin-Host AVP header");
+        }
     } else {
-        ogs_error("no_Origin-Host");
-        error++;
+        ogs_warn("No Origin-Host found");
     }
 
     /* Value of Origin-Realm */
     ret = fd_msg_search_avp(*msg, ogs_diam_origin_realm, &avp);
-    ogs_assert(ret == 0);
-    if (avp) {
+    if (ret == 0 && avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
-        ogs_debug("         ('%.*s')",
-                (int)hdr->avp_value->os.len, hdr->avp_value->os.data);
+        if (ret == 0 && hdr) {
+            ogs_debug("         ('%.*s')",
+                    (int)hdr->avp_value->os.len, hdr->avp_value->os.data);
+        } else {
+            ogs_warn("Failed to get Origin-Realm AVP header");
+        }
     } else {
-        ogs_error("no_Origin-Realm");
-        error++;
+        ogs_warn("No Origin-Realm found");
     }
 
-    /* Free the message */
-    OGS_DIAM_STATS_MTX(
-        dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
-            ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-        if (ogs_diam_stats_self()->stats.nb_recv) {
-            /* Ponderate in the avg */
-            ogs_diam_stats_self()->stats.avg = (ogs_diam_stats_self()->stats.avg *
-                ogs_diam_stats_self()->stats.nb_recv + dur) /
-                (ogs_diam_stats_self()->stats.nb_recv + 1);
-            /* Min, max */
-            if (dur < ogs_diam_stats_self()->stats.shortest)
+    /* Update statistics and calculate duration if we have valid session data */
+    if (sess_data) {
+        OGS_DIAM_STATS_MTX(
+            dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
+                ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+
+            if (ogs_diam_stats_self()->stats.nb_recv) {
+                /* Ponderate in the avg */
+                ogs_diam_stats_self()->stats.avg =
+                    (ogs_diam_stats_self()->stats.avg *
+                     ogs_diam_stats_self()->stats.nb_recv + dur) /
+                    (ogs_diam_stats_self()->stats.nb_recv + 1);
+                /* Min, max */
+                if (dur < ogs_diam_stats_self()->stats.shortest)
+                    ogs_diam_stats_self()->stats.shortest = dur;
+                if (dur > ogs_diam_stats_self()->stats.longest)
+                    ogs_diam_stats_self()->stats.longest = dur;
+            } else {
                 ogs_diam_stats_self()->stats.shortest = dur;
-            if (dur > ogs_diam_stats_self()->stats.longest)
                 ogs_diam_stats_self()->stats.longest = dur;
-        } else {
-            ogs_diam_stats_self()->stats.shortest = dur;
-            ogs_diam_stats_self()->stats.longest = dur;
-            ogs_diam_stats_self()->stats.avg = dur;
-        }
-        if (error)
-            ogs_diam_stats_self()->stats.nb_errs++;
-        else
-            ogs_diam_stats_self()->stats.nb_recv++;
-
-        PCRF_DIAM_PRIV_STATS_INC(gx.rx_raa);
-    )
+                ogs_diam_stats_self()->stats.avg = dur;
+            }
 
-    /* Display how long it took */
-    if (ts.tv_nsec > sess_data->ts.tv_nsec)
-        ogs_trace("in %d.%06ld sec",
-                (int)(ts.tv_sec - sess_data->ts.tv_sec),
-                (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-    else
-        ogs_trace("in %d.%06ld sec",
-                (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
-                (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+            if (error)
+                ogs_diam_stats_self()->stats.nb_errs++;
+            else
+                ogs_diam_stats_self()->stats.nb_recv++;
+
+            PCRF_DIAM_PRIV_STATS_INC(gx.rx_raa);
+        )
+
+        /* Display processing duration */
+        if (ts.tv_nsec > sess_data->ts.tv_nsec) {
+            ogs_trace("Processed in %d.%06ld sec",
+                    (int)(ts.tv_sec - sess_data->ts.tv_sec),
+                    (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+        } else {
+            ogs_trace("Processed in %d.%06ld sec",
+                    (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
+                    (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec) /
+                    1000);
+        }
 
-    ret = fd_sess_state_store(pcrf_gx_reg, session, &sess_data);
-    ogs_assert(ret == 0);
-    ogs_assert(sess_data == NULL);
+        /* Store session state back */
+        ret = fd_sess_state_store(pcrf_gx_reg, session, &sess_data);
+        if (ret != 0) {
+            ogs_error("Failed to store session state");
+        } else {
+            sess_data = NULL; /* Ownership transferred */
+        }
+    }
 
-    ret = fd_msg_free(*msg);
-    ogs_assert(ret == 0);
-    *msg = NULL;
+cleanup:
+    /* Always free the message */
+    if (msg && *msg) {
+        ret = fd_msg_free(*msg);
+        if (ret != 0) {
+            ogs_error("Failed to free message");
+        }
+        *msg = NULL;
+    }
 
     return;
 }

open5gs_2.7.6.tar.xz/src/pcrf/pcrf-rx-path.c -> open5gs_2.7.7.tar.xz/src/pcrf/pcrf-rx-path.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -104,156 +104,213 @@
     return ENOTSUP;
 }
 
-static int pcrf_rx_aar_cb( struct msg **msg, struct avp *avp,
+static int pcrf_rx_aar_cb(struct msg **msg, struct avp *avp,
         struct session *sess, void *opaque, enum disp_action *act)
 {
     int rv;
     int ret;
-
-    struct msg *ans, *qry;
-    struct avp *avpch1, *avpch2, *avpch3;
-    struct avp_hdr *hdr;
+    struct msg *ans = NULL, *qry = NULL;
+    struct avp *avpch1 = NULL, *avpch2 = NULL, *avpch3 = NULL;
+    struct avp_hdr *hdr = NULL;
     union avp_value val;
     struct sess_state *sess_data = NULL;
     size_t sidlen;
-
     ogs_diam_rx_message_t rx_message;
     ogs_media_component_t *media_component = NULL;
     ogs_media_sub_component_t *sub = NULL;
     ogs_flow_t *flow = NULL;
-
     char bufOGS_ADDRSTRLEN;
     os0_t gx_sid = NULL;
     uint32_t result_code = OGS_DIAM_RX_DIAMETER_IP_CAN_SESSION_NOT_AVAILABLE;
+    int error_occurred = 0;
 
     ogs_debug("PCRF Rx AA-Request");
 
-    ogs_assert(msg);
-    ogs_assert(sess);
+    /* Validate input parameters */
+    if (!msg || !*msg || !sess) {
+        ogs_error("Invalid input parameters");
+        return EINVAL;
+    }
 
+    /* Initialize Message */
+    memset(&rx_message, 0, sizeof(ogs_diam_rx_message_t));
+    rx_message.cmd_code = OGS_DIAM_RX_CMD_CODE_AA;
+
+    /* Retrieve session state */
     ret = fd_sess_state_retrieve(pcrf_rx_reg, sess, &sess_data);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to retrieve session state");
+        error_occurred = 1;
+        goto out;
+    }
+
     if (!sess_data) {
         os0_t sid = NULL;
         ret = fd_sess_getsid(sess, &sid, &sidlen);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to get session ID");
+            error_occurred = 1;
+            goto out;
+        }
 
         sess_data = new_state(sid);
-        ogs_assert(sess_data);
+        if (!sess_data) {
+            ogs_error("Failed to create new session state");
+            error_occurred = 1;
+            goto out;
+        }
     }
 
-    /* Initialize Message */
-    memset(&rx_message, 0, sizeof(ogs_diam_rx_message_t));
-    rx_message.cmd_code = OGS_DIAM_RX_CMD_CODE_AA;
-
     /* Create answer header */
     qry = *msg;
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create answer message");
+        error_occurred = 1;
+        goto out;
+    }
     ans = *msg;
 
     /* Set the Auth-Application-Id AVP */
     ret = fd_msg_avp_new(ogs_diam_auth_application_id, 0, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create Auth-Application-Id AVP");
+        error_occurred = 1;
+        goto out;
+    }
     val.i32 = OGS_DIAM_RX_APPLICATION_ID;
     ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to set Auth-Application-Id value");
+        error_occurred = 1;
+        goto out;
+    }
     ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to add Auth-Application-Id AVP");
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Set the Auth-Request-Type AVP */
     ret = fd_msg_avp_new(ogs_diam_auth_request_type, 0, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create Auth-Request-Type AVP");
+        error_occurred = 1;
+        goto out;
+    }
     val.i32 = OGS_DIAM_AUTH_REQUEST_TYPE_AUTHENTICATE_ONLY;
     ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to set Auth-Request-Type value");
+        error_occurred = 1;
+        goto out;
+    }
     ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to add Auth-Request-Type AVP");
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Get Framed-IP-Address */
     ret = fd_msg_search_avp(qry, ogs_diam_rx_framed_ip_address, &avp);
-    ogs_assert(ret == 0);
-    if (avp) {
+    if (ret == 0 && avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
-        gx_sid = (os0_t)pcrf_sess_find_by_ipv4(hdr->avp_value->os.data);
-        if (!gx_sid) {
-            ogs_warn("Cannot find Gx Sesson for IPv4:%s",
-                    OGS_INET_NTOP(hdr->avp_value->os.data, buf));
+        if (ret == 0 && hdr) {
+            gx_sid = (os0_t)pcrf_sess_find_by_ipv4(hdr->avp_value->os.data);
+            if (!gx_sid) {
+                ogs_warn("Cannot find Gx Session for IPv4:%s",
+                        OGS_INET_NTOP(hdr->avp_value->os.data, buf));
+            }
         }
     }
 
     if (!gx_sid) {
         /* Get Framed-IPv6-Prefix */
         ret = fd_msg_search_avp(qry, ogs_diam_rx_framed_ipv6_prefix, &avp);
-        ogs_assert(ret == 0);
-        if (avp) {
+        if (ret == 0 && avp) {
             ogs_paa_t *paa = NULL;
 
             ret = fd_msg_avp_hdr(avp, &hdr);
-            ogs_assert(ret == 0);
-            paa = (ogs_paa_t *)hdr->avp_value->os.data;
-            ogs_assert(paa);
-            ogs_assert(paa->len == OGS_IPV6_LEN * 8 /* 128bit */);
-            gx_sid = (os0_t)pcrf_sess_find_by_ipv6(paa->addr6);
-            if (!gx_sid) {
-                ogs_warn("Cannot find Gx Sesson for IPv6:%s",
-                        OGS_INET6_NTOP(hdr->avp_value->os.data, buf));
+            if (ret == 0 && hdr) {
+                paa = (ogs_paa_t *)hdr->avp_value->os.data;
+                if (paa && paa->len == OGS_IPV6_LEN * 8) {
+                    gx_sid = (os0_t)pcrf_sess_find_by_ipv6(paa->addr6);
+                    if (!gx_sid) {
+                        ogs_warn("Cannot find Gx Session for IPv6:%s",
+                                OGS_INET6_NTOP(hdr->avp_value->os.data, buf));
+                    }
+                }
             }
         }
     }
 
     if (!gx_sid) {
-        ogs_error("No Gx Session");
+        ogs_error("No Gx Session found");
+        result_code = OGS_DIAM_RX_DIAMETER_IP_CAN_SESSION_NOT_AVAILABLE;
+        error_occurred = 1;
         goto out;
     }
 
+    /* Parse AVPs - with error checking for each browse operation */
     ret = fd_msg_browse(qry, MSG_BRW_FIRST_CHILD, &avpch1, NULL);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to browse message");
+        error_occurred = 1;
+        goto out;
+    }
+
     while (avpch1) {
         ret = fd_msg_avp_hdr(avpch1, &hdr);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to get AVP header");
+            fd_msg_browse(avpch1, MSG_BRW_NEXT, &avpch1, NULL);
+            continue;
+        }
+
         switch(hdr->avp_code) {
         case AC_SESSION_ID:
         case AC_ORIGIN_HOST:
-            if (sess_data->peer_host)
+            if (sess_data->peer_host) {
                 ogs_free(sess_data->peer_host);
+                sess_data->peer_host = NULL;
+            }
             sess_data->peer_host =
                 (os0_t)ogs_strdup((char *)hdr->avp_value->os.data);
-            ogs_assert(sess_data->peer_host);
-            break;
-        case AC_ORIGIN_REALM:
-        case AC_DESTINATION_REALM:
-        case AC_ROUTE_RECORD:
-        case AC_PROXY_INFO:
-        case AC_AUTH_APPLICATION_ID:
-        case OGS_DIAM_AVP_CODE_FRAME_IP_ADDRESS:
-        case OGS_DIAM_AVP_CODE_FRAME_IPV6_PREFIX:
-        case OGS_DIAM_RX_AVP_CODE_SUBSCRIPTION_ID:
-            break;
-        /* Gwt Specific-Action */
-        case OGS_DIAM_RX_AVP_CODE_SPECIFIC_ACTION:
+            if (!sess_data->peer_host) {
+                ogs_error("Failed to duplicate peer host");
+                error_occurred = 1;
+                goto out;
+            }
             break;
-        /* Gwt Media-Component-Description */
+
         case OGS_DIAM_RX_AVP_CODE_MEDIA_COMPONENT_DESCRIPTION:
             if (rx_message.ims_data.num_of_media_component >=
                     OGS_ARRAY_SIZE(rx_message.ims_data.media_component)) {
-                ogs_error("OVERFLOW rx_message.ims_data.num_of_media_component "
-                        "%d:%d:%d",
-                        rx_message.ims_data.num_of_media_component,
-                        OGS_MAX_NUM_OF_MEDIA_COMPONENT,
+                ogs_error("OVERFLOW rx_message.ims_data.num_of_media_component"
+                        " %d:%d", rx_message.ims_data.num_of_media_component,
                         (int)OGS_ARRAY_SIZE(
                             rx_message.ims_data.media_component));
                 break;
             }
+
             media_component = &rx_message.ims_data.
                     media_componentrx_message.ims_data.num_of_media_component;
 
             ret = fd_msg_browse(avpch1, MSG_BRW_FIRST_CHILD, &avpch2, NULL);
-            ogs_assert(ret == 0);
+            if (ret != 0) {
+                ogs_error("Failed to browse media component");
+                break;
+            }
+
             while (avpch2) {
                 ret = fd_msg_avp_hdr(avpch2, &hdr);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    fd_msg_browse(avpch2, MSG_BRW_NEXT, &avpch2, NULL);
+                    continue;
+                }
+
                 switch (hdr->avp_code) {
                 case OGS_DIAM_RX_AVP_CODE_MEDIA_COMPONENT_NUMBER:
                     media_component->media_component_number =
@@ -287,24 +344,32 @@
                 case OGS_DIAM_RX_AVP_CODE_FLOW_STATUS:
                     media_component->flow_status = hdr->avp_value->i32;
                     break;
+
                 case OGS_DIAM_RX_AVP_CODE_MEDIA_SUB_COMPONENT:
                     if (media_component->num_of_sub >=
                             OGS_ARRAY_SIZE(media_component->sub)) {
-                        ogs_error("OVERFLOW media_component->num_of_sub "
-                                "%d:%d:%d",
+                        ogs_error("OVERFLOW media_component->num_of_sub %d:%d",
                                 media_component->num_of_sub,
-                                OGS_MAX_NUM_OF_MEDIA_SUB_COMPONENT,
                                 (int)OGS_ARRAY_SIZE(media_component->sub));
                         break;
                     }
+
                     sub = &media_component->submedia_component->num_of_sub;
 
                     ret = fd_msg_browse(avpch2, MSG_BRW_FIRST_CHILD,
-                            &avpch3, NULL);
-                    ogs_assert(ret == 0);
+                                        &avpch3, NULL);
+                    if (ret != 0) {
+                        ogs_error("Failed to browse sub component");
+                        break;
+                    }
+
                     while (avpch3) {
                         ret = fd_msg_avp_hdr(avpch3, &hdr);
-                        ogs_assert(ret == 0);
+                        if (ret != 0) {
+                            fd_msg_browse(avpch3, MSG_BRW_NEXT, &avpch3, NULL);
+                            continue;
+                        }
+
                         switch (hdr->avp_code) {
                         case OGS_DIAM_RX_AVP_CODE_FLOW_NUMBER:
                             sub->flow_number = hdr->avp_value->i32;
@@ -326,23 +391,26 @@
                             }
                             break;
                         case OGS_DIAM_RX_AVP_CODE_FLOW_DESCRIPTION:
-                            if (sub->num_of_flow >= OGS_ARRAY_SIZE(sub->flow)) {
-                                ogs_error(
-                                    "OVERFLOW sub->num_of_flow %d:%d:%d",
+                            if (sub->num_of_flow >=
+                                    OGS_ARRAY_SIZE(sub->flow)) {
+                                ogs_error("OVERFLOW sub->num_of_flow %d:%d",
                                     sub->num_of_flow,
-                                    OGS_MAX_NUM_OF_FLOW_IN_MEDIA_SUB_COMPONENT,
                                     (int)OGS_ARRAY_SIZE(sub->flow));
                                 break;
                             }
+
                             flow = &sub->flowsub->num_of_flow;
                             flow->description = ogs_strndup(
                                     (char*)hdr->avp_value->os.data,
                                     hdr->avp_value->os.len);
-                            ogs_assert(flow->description);
+                            if (!flow->description) {
+                                ogs_error("Failed to duplicate flow description");
+                                break;
+                            }
                             sub->num_of_flow++;
                             break;
                         default:
-                            ogs_error("Not supported(%d)",
+                            ogs_warn("Not supported AVP code(%d)",
                                     hdr->avp_code);
                             break;
                         }
@@ -352,7 +420,7 @@
                     media_component->num_of_sub++;
                     break;
                 default:
-                    ogs_warn("Not supported(%d)", hdr->avp_code);
+                    ogs_warn("Not supported AVP code(%d)", hdr->avp_code);
                     break;
                 }
 
@@ -361,99 +429,148 @@
 
             rx_message.ims_data.num_of_media_component++;
             break;
+
+        case AC_ORIGIN_REALM:
+        case AC_DESTINATION_REALM:
+        case AC_ROUTE_RECORD:
+        case AC_PROXY_INFO:
+        case AC_AUTH_APPLICATION_ID:
+        case OGS_DIAM_AVP_CODE_FRAME_IP_ADDRESS:
+        case OGS_DIAM_AVP_CODE_FRAME_IPV6_PREFIX:
+        case OGS_DIAM_RX_AVP_CODE_SUBSCRIPTION_ID:
+        case OGS_DIAM_RX_AVP_CODE_SPECIFIC_ACTION:
+            break;
         default:
-            ogs_warn("Not supported(%d)", hdr->avp_code);
+            ogs_warn("Not supported AVP code(%d)", hdr->avp_code);
             break;
         }
         fd_msg_browse(avpch1, MSG_BRW_NEXT, &avpch1, NULL);
     }
 
-    /* Send Re-Auth Request */
-    rv = pcrf_gx_send_rar(gx_sid, sess_data->rx_sid, &rx_message);
-    if (rv != OGS_OK) {
-        result_code = rx_message.result_code;
-        if (result_code != ER_DIAMETER_SUCCESS) {
-            ogs_error("pcrf_gx_send_rar() failed");
-            goto out;
+    if (!error_occurred) {
+        /* Send Re-Auth Request */
+        rv = pcrf_gx_send_rar(gx_sid, sess_data->rx_sid, &rx_message);
+        if (rv != OGS_OK) {
+            result_code = rx_message.result_code;
+            if (result_code != ER_DIAMETER_SUCCESS) {
+                ogs_error("pcrf_gx_send_rar() failed");
+                error_occurred = 1;
+                goto out;
+            }
         }
-    }
 
-    /* Store Gx Session-Id in this session */
-    if (!sess_data->gx_sid)
-        sess_data->gx_sid = (os0_t)ogs_strdup((char *)gx_sid);
-    ogs_assert(sess_data->gx_sid);
-
-    /* Set IP-Can-Type */
-    ret = fd_msg_avp_new(ogs_diam_rx_ip_can_type, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_RX_IP_CAN_TYPE_3GPP_EPS;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+        /* Store Gx Session-Id in this session */
+        if (!sess_data->gx_sid) {
+            sess_data->gx_sid = (os0_t)ogs_strdup((char *)gx_sid);
+            if (!sess_data->gx_sid) {
+                ogs_error("Failed to duplicate gx_sid");
+                error_occurred = 1;
+                goto out;
+            }
+        }
 
-    /* Set RAT-Type */
-    ret = fd_msg_avp_new(ogs_diam_rat_type, 0, &avp);
-    ogs_assert(ret == 0);
-    val.i32 = OGS_DIAM_RAT_TYPE_EUTRAN;
-    ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
-    ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+        /* Set IP-Can-Type */
+        ret = fd_msg_avp_new(ogs_diam_rx_ip_can_type, 0, &avp);
+        if (ret == 0) {
+            val.i32 = OGS_DIAM_RX_IP_CAN_TYPE_3GPP_EPS;
+            ret = fd_msg_avp_setvalue(avp, &val);
+            if (ret == 0) {
+                ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+            }
+        }
+        if (ret != 0) {
+            ogs_error("Failed to add IP-Can-Type AVP");
+        }
 
-    /* Set the Origin-Host, Origin-Realm, andResult-Code AVPs */
-    ret = fd_msg_rescode_set(ans, (char *)"DIAMETER_SUCCESS", NULL, NULL, 1);
-    ogs_assert(ret == 0);
+        /* Set RAT-Type */
+        ret = fd_msg_avp_new(ogs_diam_rat_type, 0, &avp);
+        if (ret == 0) {
+            val.i32 = OGS_DIAM_RAT_TYPE_EUTRAN;
+            ret = fd_msg_avp_setvalue(avp, &val);
+            if (ret == 0) {
+                ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
+            }
+        }
+        if (ret != 0) {
+            ogs_error("Failed to add RAT-Type AVP");
+        }
 
-    /* Store this value in the session */
-    ret = fd_sess_state_store(pcrf_rx_reg, sess, &sess_data);
-    ogs_assert(ret == 0);
-    ogs_assert(sess_data == NULL);
+        /* Set success result code */
+        ret = fd_msg_rescode_set(ans, (char *)"DIAMETER_SUCCESS", NULL, NULL, 1);
+        if (ret != 0) {
+            ogs_error("Failed to set success result code");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Send the answer */
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        /* Store session state */
+        ret = fd_sess_state_store(pcrf_rx_reg, sess, &sess_data);
+        if (ret != 0) {
+            ogs_error("Failed to store session state");
+            error_occurred = 1;
+            goto out;
+        }
+        sess_data = NULL; /* Ownership transferred */
 
-    ogs_debug("PCRF Tx AA-Answer");
+        /* Send the answer */
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send message");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Add this value to the stats */
-    OGS_DIAM_STATS_MTX(
-        OGS_DIAM_STATS_INC(nb_echoed);
-        PCRF_DIAM_PRIV_STATS_INC(rx.rx_aar);
-        PCRF_DIAM_PRIV_STATS_INC(rx.tx_aaa);
-    )
+        ogs_debug("PCRF Tx AA-Answer");
 
-    ogs_ims_data_free(&rx_message.ims_data);
+        /* Add to stats */
+        OGS_DIAM_STATS_MTX(
+            OGS_DIAM_STATS_INC(nb_echoed);
+            PCRF_DIAM_PRIV_STATS_INC(rx.rx_aar);
+            PCRF_DIAM_PRIV_STATS_INC(rx.tx_aaa);
+        )
 
-    return 0;
+        ogs_ims_data_free(&rx_message.ims_data);
+        return 0;
+    }
 
 out:
-    if (result_code == OGS_DIAM_AVP_UNSUPPORTED) {
-        ret = fd_msg_rescode_set(ans,
-                    (char *)"DIAMETER_AVP_UNSUPPORTED", NULL, NULL, 1);
-        ogs_assert(ret == 0);
-    } else if (result_code == OGS_DIAM_UNKNOWN_SESSION_ID) {
-        ret = fd_msg_rescode_set(ans,
-                    (char *)"DIAMETER_UNKNOWN_SESSION_ID", NULL, NULL, 1);
-        ogs_assert(ret == 0);
-    } else if (result_code == OGS_DIAM_MISSING_AVP) {
-        ret = fd_msg_rescode_set(ans,
-                    (char *)"DIAMETER_MISSING_AVP", NULL, NULL, 1);
-        ogs_assert(ret == 0);
-    } else {
-        ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
-        ogs_assert(ret == 0);
-    }
+    /* Error handling */
+    if (ans) {
+        if (result_code == OGS_DIAM_AVP_UNSUPPORTED) {
+            ret = fd_msg_rescode_set(ans,
+                        (char *)"DIAMETER_AVP_UNSUPPORTED", NULL, NULL, 1);
+        } else if (result_code == OGS_DIAM_UNKNOWN_SESSION_ID) {
+            ret = fd_msg_rescode_set(ans,
+                        (char *)"DIAMETER_UNKNOWN_SESSION_ID", NULL, NULL, 1);
+        } else if (result_code == OGS_DIAM_MISSING_AVP) {
+            ret = fd_msg_rescode_set(ans,
+                        (char *)"DIAMETER_MISSING_AVP", NULL, NULL, 1);
+        } else {
+            ret = ogs_diam_message_experimental_rescode_set(ans, result_code);
+        }
 
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to set error result code");
+        }
 
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send error response");
+        }
+    }
+
+    /* Update error stats */
     OGS_DIAM_STATS_MTX(
         PCRF_DIAM_PRIV_STATS_INC(rx.rx_aar);
         PCRF_DIAM_PRIV_STATS_INC(rx.rx_aar_error);
     )
 
-    state_cleanup(sess_data, NULL, NULL);
+    /* Cleanup session state if it wasn't stored */
+    if (sess_data) {
+        state_cleanup(sess_data, NULL, NULL);
+    }
+
+    /* Always free IMS data */
     ogs_ims_data_free(&rx_message.ims_data);
 
     return 0;
@@ -583,104 +700,144 @@
 static void pcrf_rx_asa_cb(void *data, struct msg **msg)
 {
     int ret;
-
-    struct session *session;
-    struct avp *avp, *avpch1;
-    struct avp_hdr *hdr;
-    int new;
+    struct session *session = NULL;
+    struct avp *avp = NULL, *avpch1 = NULL;
+    struct avp_hdr *hdr = NULL;
+    int new = 0;
     int result_code = 0;
 
     ogs_debug("PCRF Rx Abort-Session-Answer");
 
+    /* Validate input parameters */
+    if (!msg || !*msg) {
+        ogs_error("Invalid message pointer");
+        return;
+    }
+
     /* Search the session, retrieve its data */
     ret = fd_msg_sess_get(fd_g_config->cnf_dict, *msg, &session, &new);
-    ogs_assert(ret == 0);
-    ogs_assert(new == 0);
+    if (ret != 0) {
+        ogs_error("Failed to get session from message");
+        goto cleanup;
+    }
+
+    if (new != 0) {
+        ogs_error("Session should already exist");
+        goto cleanup;
+    }
 
     /* Value of Result Code */
     ret = fd_msg_search_avp(*msg, ogs_diam_result_code, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to search Result-Code AVP");
+        goto cleanup;
+    }
+
     if (avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to get Result-Code AVP header");
+            goto cleanup;
+        }
         result_code = hdr->avp_value->i32;
-        ogs_debug("    Result Code: %d", hdr->avp_value->i32);
+        ogs_debug("    Result Code: %d", result_code);
     } else {
+        /* Try experimental result code */
         ret = fd_msg_search_avp(*msg, ogs_diam_experimental_result, &avp);
-        ogs_assert(ret == 0);
+        if (ret != 0) {
+            ogs_error("Failed to search Experimental-Result AVP");
+            goto cleanup;
+        }
+
         if (avp) {
-            ret = fd_avp_search_avp(avp, ogs_diam_experimental_result_code, &avpch1);
-            ogs_assert(ret == 0);
+            ret = fd_avp_search_avp(avp, ogs_diam_experimental_result_code,
+                                    &avpch1);
+            if (ret != 0) {
+                ogs_error("Failed to search Experimental-Result-Code AVP");
+                goto cleanup;
+            }
+
             if (avpch1) {
                 ret = fd_msg_avp_hdr(avpch1, &hdr);
-                ogs_assert(ret == 0);
+                if (ret != 0) {
+                    ogs_error("Failed to get Experimental-Result-Code header");
+                    goto cleanup;
+                }
                 result_code = hdr->avp_value->i32;
-                ogs_debug("    Experimental Result Code: %d",
-                        result_code);
+                ogs_debug("    Experimental Result Code: %d", result_code);
             }
         } else {
-            ogs_error("no Result-Code");
+            ogs_error("No Result-Code or Experimental-Result found");
+            result_code = -1; /* Set error indicator */
         }
     }
 
     /* Value of Origin-Host */
     ret = fd_msg_search_avp(*msg, ogs_diam_origin_host, &avp);
-    ogs_assert(ret == 0);
-    if (avp) {
+    if (ret == 0 && avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
-        ogs_debug("    From '%.*s'",
-                (int)hdr->avp_value->os.len, hdr->avp_value->os.data);
+        if (ret == 0 && hdr) {
+            ogs_debug("    From '%.*s'",
+                    (int)hdr->avp_value->os.len, hdr->avp_value->os.data);
+        }
     } else {
-        ogs_error("no_Origin-Host ");
+        ogs_warn("No Origin-Host found");
     }
 
     /* Value of Origin-Realm */
     ret = fd_msg_search_avp(*msg, ogs_diam_origin_realm, &avp);
-    ogs_assert(ret == 0);
-    if (avp) {
+    if (ret == 0 && avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
-        ogs_debug("         ('%.*s')",
-                (int)hdr->avp_value->os.len, hdr->avp_value->os.data);
+        if (ret == 0 && hdr) {
+            ogs_debug("         ('%.*s')",
+                    (int)hdr->avp_value->os.len, hdr->avp_value->os.data);
+        }
     } else {
-        ogs_error("no_Origin-Realm ");
+        ogs_warn("No Origin-Realm found");
     }
 
     if (result_code != ER_DIAMETER_SUCCESS) {
         ogs_error("ERROR DIAMETER Result Code(%d)", result_code);
     }
 
+    /* Update statistics */
     OGS_DIAM_STATS_MTX(
         PCRF_DIAM_PRIV_STATS_INC(rx.rx_asa);
     )
 
-    ret = fd_msg_free(*msg);
-    ogs_assert(ret == 0);
-    *msg = NULL;
+cleanup:
+    /* Always free the message */
+    if (msg && *msg) {
+        ret = fd_msg_free(*msg);
+        if (ret != 0) {
+            ogs_error("Failed to free message");
+        }
+        *msg = NULL;
+    }
 
     return;
 }
 
-static int pcrf_rx_str_cb( struct msg **msg, struct avp *avp,
+static int pcrf_rx_str_cb(struct msg **msg, struct avp *avp,
         struct session *sess, void *opaque, enum disp_action *act)
 {
     int rv;
     int ret;
-
-    struct msg *ans, *qry;
-    struct avp_hdr *hdr;
+    struct msg *ans = NULL, *qry = NULL;
+    struct avp_hdr *hdr = NULL;
     union avp_value val;
     struct sess_state *sess_data = NULL;
-
     ogs_diam_rx_message_t rx_message;
-
     uint32_t result_code = OGS_DIAM_RX_DIAMETER_IP_CAN_SESSION_NOT_AVAILABLE;
+    int error_occurred = 0;
 
     ogs_debug("PCRF Rx Session-Termination-Request");
 
-    ogs_assert(msg);
-    ogs_assert(sess);
+    /* Validate input parameters */
+    if (!msg || !*msg || !sess) {
+        ogs_error("Invalid input parameters");
+        return EINVAL;
+    }
 
     /* Initialize Message */
     memset(&rx_message, 0, sizeof(ogs_diam_rx_message_t));
@@ -689,121 +846,191 @@
     /* Create answer header */
     qry = *msg;
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create answer message");
+        error_occurred = 1;
+        goto out;
+    }
     ans = *msg;
 
     /* Set the Auth-Application-Id AVP */
     ret = fd_msg_avp_new(ogs_diam_auth_application_id, 0, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create Auth-Application-Id AVP");
+        error_occurred = 1;
+        goto out;
+    }
     val.i32 = OGS_DIAM_RX_APPLICATION_ID;
     ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to set Auth-Application-Id value");
+        error_occurred = 1;
+        goto out;
+    }
     ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to add Auth-Application-Id AVP");
+        error_occurred = 1;
+        goto out;
+    }
 
     /* Set the Auth-Request-Type AVP */
     ret = fd_msg_avp_new(ogs_diam_auth_request_type, 0, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create Auth-Request-Type AVP");
+        error_occurred = 1;
+        goto out;
+    }
     val.i32 = OGS_DIAM_AUTH_REQUEST_TYPE_AUTHENTICATE_ONLY;
     ret = fd_msg_avp_setvalue(avp, &val);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to set Auth-Request-Type value");
+        error_occurred = 1;
+        goto out;
+    }
     ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to add Auth-Request-Type AVP");
+        error_occurred = 1;
+        goto out;
+    }
 
+    /* Retrieve session state */
     ret = fd_sess_state_retrieve(pcrf_rx_reg, sess, &sess_data);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to retrieve session state");
+        error_occurred = 1;
+        goto out;
+    }
+
     if (!sess_data) {
         ogs_error("Cannot find session in Session-Termination-Request");
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!sess_data->rx_sid) {
+        ogs_error("No Rx Session-Id in session data");
+        error_occurred = 1;
+        goto out;
+    }
+
+    if (!sess_data->gx_sid) {
+        ogs_error("No Gx Session-Id in session data");
+        error_occurred = 1;
         goto out;
     }
-    ogs_assert(sess_data->rx_sid);
-    ogs_assert(sess_data->gx_sid);
 
     /* Get Termination-Cause */
     ret = fd_msg_search_avp(qry, ogs_diam_termination_cause, &avp);
-    ogs_assert(ret == 0);
-    if (avp) {
+    if (ret == 0 && avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        ogs_assert(ret == 0);
-        sess_data->termination_cause = hdr->avp_value->i32;
-        switch (sess_data->termination_cause) {
-        case OGS_DIAM_TERMINATION_CAUSE_DIAMETER_LOGOUT:
-            break;
-        default:
-            ogs_error("Termination-Cause Error : %d",
-                    sess_data->termination_cause);
-            break;
+        if (ret == 0 && hdr) {
+            sess_data->termination_cause = hdr->avp_value->i32;
+            switch (sess_data->termination_cause) {
+            case OGS_DIAM_TERMINATION_CAUSE_DIAMETER_LOGOUT:
+                break;
+            default:
+                ogs_error("Termination-Cause Error : %d",
+                        sess_data->termination_cause);
+                break;
+            }
+        } else {
+            ogs_error("Failed to get Termination-Cause AVP header");
         }
     } else {
-        ogs_error("no_Termination-Cause");
+        ogs_warn("No Termination-Cause found");
     }
 
     if (sess_data->state != SESSION_ABORTED) {
-        /* Send Re-Auth Request if Abort-Session-Request is not initaited */
+        /* Send Re-Auth Request if Abort-Session-Request is not initiated */
         rv = pcrf_gx_send_rar(
                 sess_data->gx_sid, sess_data->rx_sid, &rx_message);
         if (rv != OGS_OK) {
             result_code = rx_message.result_code;
             if (result_code != ER_DIAMETER_SUCCESS) {
                 ogs_error("pcrf_gx_send_rar() failed");
+                error_occurred = 1;
                 goto out;
             }
         }
     }
 
-    /* Set the Origin-Host, Origin-Realm, andResult-Code AVPs */
-    ret = fd_msg_rescode_set(ans, (char *)"DIAMETER_SUCCESS", NULL, NULL, 1);
-    ogs_assert(ret == 0);
+    if (!error_occurred) {
+        /* Set success result code */
+        ret = fd_msg_rescode_set(ans, (char *)"DIAMETER_SUCCESS", NULL, NULL, 1);
+        if (ret != 0) {
+            ogs_error("Failed to set success result code");
+            error_occurred = 1;
+            goto out;
+        }
 
-    /* Send the answer */
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+        /* Send the answer */
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send message");
+            error_occurred = 1;
+            goto out;
+        }
 
-    ogs_debug("PCRF Tx Session-Termination-Answer");
+        ogs_debug("PCRF Tx Session-Termination-Answer");
 
-    /* Add this value to the stats */
-    OGS_DIAM_STATS_MTX(
-        OGS_DIAM_STATS_INC(nb_echoed);
-        PCRF_DIAM_PRIV_STATS_INC(rx.rx_str);
-        PCRF_DIAM_PRIV_STATS_INC(rx.tx_sta);
-    )
+        /* Add to stats */
+        OGS_DIAM_STATS_MTX(
+            OGS_DIAM_STATS_INC(nb_echoed);
+            PCRF_DIAM_PRIV_STATS_INC(rx.rx_str);
+            PCRF_DIAM_PRIV_STATS_INC(rx.tx_sta);
+        )
 
-    state_cleanup(sess_data, NULL, NULL);
-    ogs_ims_data_free(&rx_message.ims_data);
+        /* Clean up session state */
+        state_cleanup(sess_data, NULL, NULL);
+        ogs_ims_data_free(&rx_message.ims_data);
 
-    return 0;
+        return 0;
+    }
 
 out:
-    if (result_code == OGS_DIAM_AVP_UNSUPPORTED) {
-        ret = fd_msg_rescode_set(ans,
-                    (char *)"DIAMETER_AVP_UNSUPPORTED", NULL, NULL, 1);
-        ogs_assert(ret == 0);
-    } else if (result_code == OGS_DIAM_UNKNOWN_SESSION_ID) {
-        ret = fd_msg_rescode_set(ans,
-                    (char *)"DIAMETER_UNKNOWN_SESSION_ID", NULL, NULL, 1);
-        ogs_assert(ret == 0);
-    } else if (result_code == OGS_DIAM_MISSING_AVP) {
-        ret = fd_msg_rescode_set(ans,
-                    (char *)"DIAMETER_MISSING_AVP", NULL, NULL, 1);
-        ogs_assert(ret == 0);
-    } else {
-        ret = fd_msg_rescode_set(ans,
-                    (char *)"DIAMETER_MISSING_AVP", NULL, NULL, 1);
-        ogs_assert(ret == 0);
-    }
+    /* Error handling */
+    if (ans) {
+        if (result_code == OGS_DIAM_AVP_UNSUPPORTED) {
+            ret = fd_msg_rescode_set(ans,
+                        (char *)"DIAMETER_AVP_UNSUPPORTED", NULL, NULL, 1);
+        } else if (result_code == OGS_DIAM_UNKNOWN_SESSION_ID) {
+            ret = fd_msg_rescode_set(ans,
+                        (char *)"DIAMETER_UNKNOWN_SESSION_ID", NULL, NULL, 1);
+        } else if (result_code == OGS_DIAM_MISSING_AVP) {
+            ret = fd_msg_rescode_set(ans,
+                        (char *)"DIAMETER_MISSING_AVP", NULL, NULL, 1);
+        } else {
+            ret = fd_msg_rescode_set(ans,
+                        (char *)"DIAMETER_UNABLE_TO_COMPLY", NULL, NULL, 1);
+        }
 
-    ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
-    ogs_debug("PCRF Tx Session-Termination-Answer");
+        if (ret != 0) {
+            ogs_error("Failed to set error result code");
+        }
+
+        ret = fd_msg_send(msg, NULL, NULL);
+        if (ret != 0) {
+            ogs_error("Failed to send error response");
+        }
 
+        ogs_debug("PCRF Tx Session-Termination-Answer");
+    }
+
+    /* Update error stats */
     OGS_DIAM_STATS_MTX(
         PCRF_DIAM_PRIV_STATS_INC(rx.rx_str);
         PCRF_DIAM_PRIV_STATS_INC(rx.rx_str_error);
         PCRF_DIAM_PRIV_STATS_INC(rx.tx_sta);
     )
 
-    if (sess_data)
+    /* Clean up session state */
+    if (sess_data) {
         state_cleanup(sess_data, NULL, NULL);
+    }
+
+    /* Always free IMS data */
     ogs_ims_data_free(&rx_message.ims_data);
 
     return 0;

open5gs_2.7.6.tar.xz/src/scp/sbi-path.c -> open5gs_2.7.7.tar.xz/src/scp/sbi-path.c Changed

open5gs_2.7.6.tar.xz/src/scp/scp-sm.c -> open5gs_2.7.7.tar.xz/src/scp/scp-sm.c Changed

open5gs_2.7.6.tar.xz/src/sepp/sepp-sm.c -> open5gs_2.7.7.tar.xz/src/sepp/sepp-sm.c Changed

open5gs_2.7.6.tar.xz/src/sgwc/context.c -> open5gs_2.7.7.tar.xz/src/sgwc/context.c Changed

@@ -201,7 +201,10 @@
     if (sgwc_ue)
         sgwc_ue_remove(sgwc_ue);
     sgwc_ue = sgwc_ue_add(req->imsi.data, req->imsi.len);
-    ogs_assert(sgwc_ue);
+    if (!sgwc_ue) {
+        ogs_error("sgwc_ue_add() failed");
+        return NULL;
+    }
 
     return sgwc_ue;
 }
@@ -214,7 +217,11 @@
     ogs_assert(imsi_len);
 
     ogs_pool_id_calloc(&sgwc_ue_pool, &sgwc_ue);
-    ogs_assert(sgwc_ue);
+    if (!sgwc_ue) {
+        ogs_error("Maximum number of sgwc_ue%lld reached",
+                    (long long)ogs_global_conf()->max.ue);
+        return NULL;
+    }
 
     /* Set SGW-S11-TEID */
     ogs_pool_alloc(&sgwc_s11_teid_pool, &sgwc_ue->sgw_s11_teid_node);
@@ -418,14 +425,20 @@
         ogs_pfcp_self()->pfcp_node =
             ogs_list_last(&ogs_pfcp_self()->pfcp_peer_list);
 
-    /* setup GTP session with selected SGW-U */
-    ogs_pfcp_self()->pfcp_node =
-        selected_sgwu_node(ogs_pfcp_self()->pfcp_node, sess);
-    ogs_assert(ogs_pfcp_self()->pfcp_node);
-    OGS_SETUP_PFCP_NODE(sess, ogs_pfcp_self()->pfcp_node);
-    ogs_debug("UE using SGW-U on IP %s",
-            ogs_sockaddr_to_string_static(
-                ogs_pfcp_self()->pfcp_node->addr_list));
+    if (ogs_pfcp_self()->pfcp_node) {
+
+        /* setup GTP session with selected SGW-U */
+        ogs_pfcp_self()->pfcp_node =
+            selected_sgwu_node(ogs_pfcp_self()->pfcp_node, sess);
+        ogs_assert(ogs_pfcp_self()->pfcp_node);
+        OGS_SETUP_PFCP_NODE(sess, ogs_pfcp_self()->pfcp_node);
+        ogs_debug("UE using SGW-U on IP %s",
+                ogs_sockaddr_to_string_static(
+                    ogs_pfcp_self()->pfcp_node->addr_list));
+    } else {
+        ogs_error("No suitable SGWU found for session");
+        ogs_assert(sess->pfcp_node == NULL);
+    }
 }
 
 int sgwc_sess_remove(sgwc_sess_t *sess)
@@ -557,20 +570,31 @@
     ogs_assert(sgwc_ue);
 
     ogs_pool_id_calloc(&sgwc_bearer_pool, &bearer);
-    ogs_assert(bearer);
+    if (!bearer) {
+        ogs_error("ogs_pool_id_calloc() failed");
+        return NULL;
+    }
+
+    ogs_list_add(&sess->bearer_list, bearer);
 
     bearer->sgwc_ue_id = sgwc_ue->id;
     bearer->sess_id = sess->id;
 
     /* Downlink */
     tunnel = sgwc_tunnel_add(bearer, OGS_GTP2_F_TEID_S5_S8_SGW_GTP_U);
-    ogs_assert(tunnel);
+    if (!tunnel) {
+        ogs_error("sgwc_tunnel_add() failed");
+        sgwc_bearer_remove(bearer);
+        return NULL;
+    }
 
     /* Uplink */
     tunnel = sgwc_tunnel_add(bearer, OGS_GTP2_F_TEID_S1_U_SGW_GTP_U);
-    ogs_assert(tunnel);
-
-    ogs_list_add(&sess->bearer_list, bearer);
+    if (!tunnel) {
+        ogs_error("sgwc_tunnel_add() failed");
+        sgwc_bearer_remove(bearer);
+        return NULL;
+    }
 
     return bearer;
 }
@@ -691,12 +715,23 @@
     }
 
     ogs_pool_id_calloc(&sgwc_tunnel_pool, &tunnel);
-    ogs_assert(tunnel);
+    if (!tunnel) {
+        ogs_error("ogs_pool_id_calloc() failed");
+        return NULL;
+    }
+
+    ogs_list_add(&bearer->tunnel_list, tunnel);
 
     tunnel->interface_type = interface_type;
+    tunnel->bearer_id = bearer->id;
 
     pdr = ogs_pfcp_pdr_add(&sess->pfcp);
-    ogs_assert(pdr);
+    if (!pdr) {
+        ogs_error("ogs_pfcp_pdr_add() failed");
+        sgwc_tunnel_remove(tunnel);
+        return NULL;
+    }
+    tunnel->pdr = pdr;
 
     ogs_assert(sess->session.name);
     pdr->apn = ogs_strdup(sess->session.name);
@@ -708,7 +743,12 @@
     pdr->src_if_type = src_if_type;
 
     far = ogs_pfcp_far_add(&sess->pfcp);
-    ogs_assert(far);
+    if (!far) {
+        ogs_error("ogs_pfcp_far_add() failed");
+        sgwc_tunnel_remove(tunnel);
+        return NULL;
+    }
+    tunnel->far = far;
 
     ogs_assert(sess->session.name);
     far->apn = ogs_strdup(sess->session.name);
@@ -782,13 +822,6 @@
         pdr->f_teid.teid = tunnel->local_teid;
     }
 
-    tunnel->pdr = pdr;
-    tunnel->far = far;
-
-    tunnel->bearer_id = bearer->id;
-
-    ogs_list_add(&bearer->tunnel_list, tunnel);
-
     return tunnel;
 }
 
@@ -802,8 +835,10 @@
 
     ogs_list_remove(&bearer->tunnel_list, tunnel);
 
-    ogs_pfcp_pdr_remove(tunnel->pdr);
-    ogs_pfcp_far_remove(tunnel->far);
+    if (tunnel->pdr)
+        ogs_pfcp_pdr_remove(tunnel->pdr);
+    if (tunnel->far)
+        ogs_pfcp_far_remove(tunnel->far);
 
     if (tunnel->local_addr)
         ogs_freeaddrinfo(tunnel->local_addr);

open5gs_2.7.6.tar.xz/src/sgwc/gtp-path.c -> open5gs_2.7.7.tar.xz/src/sgwc/gtp-path.c Changed

open5gs_2.7.6.tar.xz/src/sgwc/pfcp-path.c -> open5gs_2.7.7.tar.xz/src/sgwc/pfcp-path.c Changed

@@ -294,6 +294,10 @@
     ogs_assert(xact);
 
     xact->local_seid = sess->sgwc_sxa_seid;
+    ogs_info("PFCP Session Modification xact: "
+            "sess_id=%d xact=%p local_seid=0x%llx bearer_to_modify_count=%d",
+            sess->id, xact, (unsigned long long)xact->local_seid,
+            ogs_list_count(&xact->bearer_to_modify_list));
 
     memset(&h, 0, sizeof(ogs_pfcp_header_t));
     h.type = OGS_PFCP_SESSION_MODIFICATION_REQUEST_TYPE;
@@ -406,6 +410,10 @@
     sgwc_bearer_t *bearer = NULL;
 
     ogs_assert(sess);
+    ogs_assert(ogs_list_count(&sess->bearer_list));
+    ogs_info("PFCP Session Modification from session: "
+            "sess_id=%d gtp_xact_id=%d flags=0x%llx",
+            sess->id, gtp_xact_id, (unsigned long long)flags);
 
     xact = ogs_pfcp_xact_local_create(
             sess->pfcp_node, sess_timeout, OGS_UINT_TO_POINTER(sess->id));
@@ -444,6 +452,9 @@
     ogs_assert(bearer);
     sess = sgwc_sess_find_by_id(bearer->sess_id);
     ogs_assert(sess);
+    ogs_info("PFCP Session Modification from bearer: "
+            "bearer_id=%d sess_id=%d gtp_xact_id=%d flags=0x%llx",
+            bearer->id, sess->id, gtp_xact_id, (unsigned long long)flags);
 
     xact = ogs_pfcp_xact_local_create(
             sess->pfcp_node, bearer_timeout, OGS_UINT_TO_POINTER(bearer->id));

open5gs_2.7.6.tar.xz/src/sgwc/s11-build.c -> open5gs_2.7.7.tar.xz/src/sgwc/s11-build.c Changed

open5gs_2.7.6.tar.xz/src/sgwc/s11-handler.c -> open5gs_2.7.7.tar.xz/src/sgwc/s11-handler.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2026 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -167,7 +167,7 @@
         sgwc_ue_t *sgwc_ue, ogs_gtp_xact_t *s11_xact,
         ogs_pkbuf_t *gtpbuf, ogs_gtp2_message_t *message)
 {
-    int i;
+    int rv, i;
     uint8_t cause_value = 0;
 
     sgwc_sess_t *sess = NULL;
@@ -188,7 +188,7 @@
     req = &message->create_session_request;
     ogs_assert(req);
 
-    ogs_debug("Create Session Request");
+    ogs_info("Create Session Request");
 
     /************************
      * Check SGWC-UE Context
@@ -200,12 +200,8 @@
         cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
     }
 
-    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
-        ogs_gtp_send_error_message(
-                s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
-                OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE, cause_value);
-        return;
-    }
+    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED)
+        goto cleanup;
 
     /*****************************************
      * Check Mandatory/Conditional IE Missing
@@ -247,12 +243,8 @@
         cause_value = OGS_GTP2_CAUSE_CONDITIONAL_IE_MISSING;
     }
 
-    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
-        ogs_gtp_send_error_message(
-                s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
-                OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE, cause_value);
-        return;
-    }
+    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED)
+        goto cleanup;
 
     /* Add Session */
     sess = sgwc_sess_find_by_ebi(sgwc_ue,
@@ -278,10 +270,10 @@
             ogs_nas_to_plmn_id(&sgwc_ue->e_cgi.plmn_id, &uli.e_cgi.nas_plmn_id);
             sgwc_ue->e_cgi.cell_id = uli.e_cgi.cell_id;
 
-            ogs_debug("    TAIPLMN_ID:%06x,TAC:%d",
+            ogs_info("    TAIPLMN_ID:%06x,TAC:%d",
                     ogs_plmn_id_hexdump(&sgwc_ue->e_tai.plmn_id),
                     sgwc_ue->e_tai.tac);
-            ogs_debug("    E_CGIPLMN_ID:%06x,CELL_ID:0x%x",
+            ogs_info("    E_CGIPLMN_ID:%06x,CELL_ID:0x%x",
                     ogs_plmn_id_hexdump(&sgwc_ue->e_cgi.plmn_id),
                     sgwc_ue->e_cgi.cell_id);
         } else
@@ -291,14 +283,20 @@
     /* Select SGW-U based on UE Location Information */
     sgwc_sess_select_sgwu(sess);
 
+    if (!sess->pfcp_node) {
+        ogs_error("%s:%s No SGWU available for session",
+                  sgwc_ue->imsi_bcd, sess->session.name);
+        cause_value = OGS_GTP2_CAUSE_SYSTEM_FAILURE;
+        goto cleanup;
+    }
+
     /* Check if selected SGW-U is associated with SGW-C */
     ogs_assert(sess->pfcp_node);
     if (!OGS_FSM_CHECK(&sess->pfcp_node->sm, sgwc_pfcp_state_associated)) {
-        ogs_gtp_send_error_message(
-                s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
-                OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE,
-                OGS_GTP2_CAUSE_REMOTE_PEER_NOT_RESPONDING);
-        return;
+        ogs_error("%s:%s Remote peer not responding",
+                  sgwc_ue->imsi_bcd, sess->session.name);
+        cause_value = OGS_GTP2_CAUSE_REMOTE_PEER_NOT_RESPONDING;
+        goto cleanup;
     }
 
     /* Remove all previous bearer */
@@ -320,8 +318,12 @@
 
         decoded = ogs_gtp2_parse_bearer_qos(&bearer_qos,
                 &req->bearer_contexts_to_be_createdi.bearer_level_qos);
-        ogs_assert(decoded ==
-                req->bearer_contexts_to_be_createdi.bearer_level_qos.len);
+        if (GTP2_BEARER_QOS_LEN != decoded) {
+            ogs_error("Invalid Bearer QoS IE in Create Session Request "
+                    "(decoded=%d, expected=%d)", decoded, GTP2_BEARER_QOS_LEN);
+            cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+            goto cleanup;
+        }
 
         bearer = sgwc_bearer_add(sess);
         ogs_assert(bearer);
@@ -343,17 +345,26 @@
                             s1_u_enodeb_f_teid.data;
             dl_tunnel->remote_teid = be32toh(enb_s1u_teid->teid);
 
-            ogs_assert(OGS_OK ==
-                    ogs_gtp2_f_teid_to_ip(enb_s1u_teid, &dl_tunnel->remote_ip));
+            rv = ogs_gtp2_f_teid_to_ip(enb_s1u_teid, &dl_tunnel->remote_ip);
+            if (rv != OGS_OK) {
+                ogs_error("No IPv4 or IPv6 in eNB-S1U(DL)");
+                cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+                goto cleanup;
+            }
 
             far = dl_tunnel->far;
             ogs_assert(far);
 
             far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
 
-            ogs_assert(OGS_OK == ogs_pfcp_ip_to_outer_header_creation(
+            rv = ogs_pfcp_ip_to_outer_header_creation(
                     &dl_tunnel->remote_ip, &far->outer_header_creation,
-                    &far->outer_header_creation_len));
+                    &far->outer_header_creation_len);
+            if (rv != OGS_OK) {
+                ogs_error("No IPv4 or IPv6 in DL-Tunnel");
+                cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+                goto cleanup;
+            }
             far->outer_header_creation.teid = dl_tunnel->remote_teid;
         }
 
@@ -371,17 +382,26 @@
                             s5_s8_u_sgw_f_teid.data;
             ul_tunnel->remote_teid = be32toh(pgw_s5u_teid->teid);
 
-            ogs_assert(OGS_OK ==
-                    ogs_gtp2_f_teid_to_ip(pgw_s5u_teid, &ul_tunnel->remote_ip));
+            rv = ogs_gtp2_f_teid_to_ip(pgw_s5u_teid, &ul_tunnel->remote_ip);
+            if (rv != OGS_OK) {
+                ogs_error("No IPv4 or IPv6 in PGW-S5U(UL)");
+                cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+                goto cleanup;
+            }
 
             far = ul_tunnel->far;
             ogs_assert(far);
 
             far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
 
-            ogs_assert(OGS_OK == ogs_pfcp_ip_to_outer_header_creation(
+            rv = ogs_pfcp_ip_to_outer_header_creation(
                     &ul_tunnel->remote_ip, &far->outer_header_creation,
-                    &far->outer_header_creation_len));
+                    &far->outer_header_creation_len);
+            if (rv != OGS_OK) {
+                ogs_error("No IPv4 or IPv6 in UL-Tunnel");
+                cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+                goto cleanup;
+            }
             far->outer_header_creation.teid = ul_tunnel->remote_teid;
         }
 
@@ -406,19 +426,31 @@
     ogs_assert(pgw_s5c_teid);
     sess->pgw_s5c_teid = be32toh(pgw_s5c_teid->teid);
 
-    ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
         sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
 
     ogs_assert(OGS_OK ==
         sgwc_pfcp_send_session_establishment_request(
             sess, s11_xact->id, gtpbuf, 0));
+
+    return;
+
+cleanup:
+    ogs_assert(cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED);
+    if (sess)
+        sgwc_sess_remove(sess);
+
+    ogs_gtp_send_error_message(
+            s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
+            OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE,
+            cause_value);
 }
 
 void sgwc_s11_handle_modify_bearer_request(
         sgwc_ue_t *sgwc_ue, ogs_gtp_xact_t *s11_xact,
         ogs_pkbuf_t *gtpbuf, ogs_gtp2_message_t *message)
 {
-    int i = 0;
+    int rv, i = 0;
     uint16_t decoded;
     uint8_t cause_value = 0;
 
@@ -443,7 +475,7 @@
     req = &message->modify_bearer_request;
     ogs_assert(req);
 
-    ogs_debug("Modify Bearer Request");
+    ogs_info("Modify Bearer Request");
 
     /************************
      * Check SGWC-UE Context
@@ -455,12 +487,8 @@
         cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
     }
 
-    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
-        ogs_gtp_send_error_message(
-                s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
-                OGS_GTP2_MODIFY_BEARER_RESPONSE_TYPE, cause_value);
-        return;
-    }
+    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED)
+        goto cleanup;
 
     /*****************************************
      * Check Mandatory/Conditional IE Missing
@@ -537,7 +565,12 @@
             req->bearer_contexts_to_be_modifiedi.s1_u_enodeb_f_teid.data;
         dl_tunnel->remote_teid = be32toh(enb_s1u_teid->teid);
 
-        ogs_assert(OGS_OK == ogs_gtp2_f_teid_to_ip(enb_s1u_teid, &remote_ip));
+        rv = ogs_gtp2_f_teid_to_ip(enb_s1u_teid, &remote_ip);
+        if (rv != OGS_OK) {
+            ogs_error("No IPv4 or IPv6 in eNB-S1U(DL)");
+            cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+            goto cleanup;
+        }
 
         memset(&zero_ip, 0, sizeof(ogs_ip_t));
 
@@ -560,40 +593,34 @@
         ogs_assert(pdr);
 
         pdr->outer_header_removal_len = 1;
-        if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
-            pdr->outer_header_removal.description =
-                OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV4;
-        } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
-            pdr->outer_header_removal.description =
-                OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV6;
-        } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
-            pdr->outer_header_removal.description =
-                OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
-        } else {
-            ogs_error("Invalid session_type %d", sess->session.session_type);
-            ogs_assert_if_reached();
-        }
+        pdr->outer_header_removal.description =
+            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
 
         far = dl_tunnel->far;
         ogs_assert(far);
 
         far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
 
-        ogs_assert(OGS_OK ==
-            ogs_pfcp_ip_to_outer_header_creation(&dl_tunnel->remote_ip,
-                &far->outer_header_creation, &far->outer_header_creation_len));
+        rv = ogs_pfcp_ip_to_outer_header_creation(&dl_tunnel->remote_ip,
+                &far->outer_header_creation, &far->outer_header_creation_len);
+        if (rv != OGS_OK) {
+            ogs_error("No IPv4 or IPv6 in DL-Tunnel");
+            cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+            goto cleanup;
+        }
         far->outer_header_creation.teid = dl_tunnel->remote_teid;
 
+        ogs_info("    sess_id=%d current_xact=%p flags=0x%llx, bearerEBI=%d",
+                sess->id, current_xact,
+                (unsigned long long)current_xact->modify_flags, bearer->ebi);
+
         ogs_list_add(&current_xact->bearer_to_modify_list,
                         &bearer->to_modify_node);
     }
 
     if (i == 0) {
         ogs_error("No Bearer");
-        ogs_gtp_send_error_message(
-                s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
-                OGS_GTP2_MODIFY_BEARER_RESPONSE_TYPE, cause_value);
-        return;
+        goto cleanup;
     }
 
     if (req->user_location_information.presence == 1) {
@@ -606,19 +633,19 @@
             ogs_nas_to_plmn_id(&sgwc_ue->e_cgi.plmn_id, &uli.e_cgi.nas_plmn_id);
             sgwc_ue->e_cgi.cell_id = uli.e_cgi.cell_id;
 
-            ogs_debug("    TAIPLMN_ID:%06x,TAC:%d",
+            ogs_info("    TAIPLMN_ID:%06x,TAC:%d",
                     ogs_plmn_id_hexdump(&sgwc_ue->e_tai.plmn_id),
                     sgwc_ue->e_tai.tac);
-            ogs_debug("    E_CGIPLMN_ID:%06x,CELL_ID:0x%x",
+            ogs_info("    E_CGIPLMN_ID:%06x,CELL_ID:0x%x",
                     ogs_plmn_id_hexdump(&sgwc_ue->e_cgi.plmn_id),
                     sgwc_ue->e_cgi.cell_id);
         } else
             ogs_error("Invalid User Location Info(ULI)");
     }
 
-    ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
         sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
-    ogs_debug("    ENB_S1U_TEID%d SGW_S1U_TEID%d",
+    ogs_info("    ENB_S1U_TEID%d SGW_S1U_TEID%d",
         dl_tunnel->remote_teid, dl_tunnel->local_teid);
 
     ogs_list_for_each_entry(&pfcp_xact_list, pfcp_xact, tmpnode) {
@@ -632,9 +659,21 @@
             sess = sgwc_sess_find_by_id(sess_id);
             ogs_assert(sess);
 
+            ogs_info("    sess_id=%d xact=%p flags=0x%llx",
+                    sess->id, pfcp_xact,
+                    (unsigned long long)pfcp_xact->modify_flags);
             sgwc_pfcp_send_bearer_to_modify_list(sess, pfcp_xact);
         }
     }
+
+    return;
+
+cleanup:
+    ogs_assert(cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED);
+
+    ogs_gtp_send_error_message(
+            s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
+            OGS_GTP2_MODIFY_BEARER_RESPONSE_TYPE, cause_value);
 }
 
 void sgwc_s11_handle_delete_session_request(
@@ -654,7 +693,7 @@
     req = &message->delete_session_request;
     ogs_assert(req);
 
-    ogs_debug("Delete Session Request");
+    ogs_info("Delete Session Request");
 
     /************************
      * Check SGWC-UE Context
@@ -680,12 +719,8 @@
         }
     }
 
-    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
-        ogs_gtp_send_error_message(
-                s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
-                OGS_GTP2_DELETE_SESSION_RESPONSE_TYPE, cause_value);
-        return;
-    }
+    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED)
+        goto cleanup;
 
     /*****************************************
      * Check Mandatory/Conditional IE Missing
@@ -701,11 +736,8 @@
         indication->operation_indication == 1 &&
         indication->scope_indication == 1) {
         ogs_error("Invalid Indication");
-        ogs_gtp_send_error_message(
-                s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
-                OGS_GTP2_DELETE_SESSION_RESPONSE_TYPE,
-                OGS_GTP2_CAUSE_INVALID_MESSAGE_FORMAT);
-        return;
+        cause_value = OGS_GTP2_CAUSE_INVALID_MESSAGE_FORMAT;
+        goto cleanup;
     }
 
     /********************
@@ -714,9 +746,9 @@
     ogs_assert(sgwc_ue);
     ogs_assert(sess);
     ogs_assert(sess->gnode);
-    ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
         sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
-    ogs_debug("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
+    ogs_info("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
         sess->sgw_s5c_teid, sess->pgw_s5c_teid);
 
     if (indication &&
@@ -751,6 +783,16 @@
         rv = ogs_gtp_xact_commit(s5c_xact);
         ogs_expect(rv == OGS_OK);
     }
+
+    return;
+
+cleanup:
+    ogs_assert(cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED);
+
+    ogs_gtp_send_error_message(
+            s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
+            OGS_GTP2_DELETE_SESSION_RESPONSE_TYPE,
+            cause_value);
 }
 
 void sgwc_s11_handle_create_bearer_response(
@@ -775,12 +817,11 @@
     ogs_gtp2_f_teid_t *sgw_s1u_teid = NULL, *enb_s1u_teid = NULL;
     ogs_gtp2_uli_t uli;
 
-    ogs_assert(sgwc_ue);
     ogs_assert(message);
     rsp = &message->create_bearer_response;
     ogs_assert(rsp);
 
-    ogs_debug("Create Bearer Response");
+    ogs_info("Create Bearer Response");
 
     /********************
      * Check Transaction
@@ -816,6 +857,12 @@
             ogs_error("No Session ID %d", bearer->sess_id);
     }
 
+    if (sess) {
+        sgwc_ue = sgwc_ue_find_by_id(sess->sgwc_ue_id);
+        if (!sgwc_ue)
+            ogs_error("No SGWC-UE ID %d", sess->sgwc_ue_id);
+    }
+
     rv = ogs_gtp_xact_commit(s11_xact);
     ogs_expect(rv == OGS_OK);
 
@@ -858,17 +905,20 @@
         ogs_error("No Session Context");
         cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
     }
+    if (!sgwc_ue) {
+        ogs_error("No SGWC-UE Context");
+        cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+    }
 
     if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
         if (bearer) {
+            ogs_info("    bearerEBI=%d", bearer->ebi);
             ogs_assert(OGS_OK ==
                 sgwc_pfcp_send_bearer_modification_request(
                     bearer, OGS_INVALID_POOL_ID, NULL,
                     OGS_PFCP_MODIFY_UL_ONLY|OGS_PFCP_MODIFY_REMOVE));
         }
-        ogs_gtp_send_error_message(s5c_xact, sess ? sess->pgw_s5c_teid : 0,
-                OGS_GTP2_CREATE_BEARER_RESPONSE_TYPE, cause_value);
-        return;
+        goto cleanup;
     }
 
     /********************
@@ -881,13 +931,12 @@
     cause_value = cause->value;
     if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
         ogs_error("GTP Cause Value:%d", cause_value);
+        ogs_info("    bearerEBI=%d", bearer->ebi);
         ogs_assert(OGS_OK ==
             sgwc_pfcp_send_bearer_modification_request(
                 bearer, OGS_INVALID_POOL_ID, NULL,
                 OGS_PFCP_MODIFY_UL_ONLY|OGS_PFCP_MODIFY_REMOVE));
-        ogs_gtp_send_error_message(s5c_xact, sess ? sess->pgw_s5c_teid : 0,
-                OGS_GTP2_CREATE_BEARER_RESPONSE_TYPE, cause_value);
-        return;
+        goto cleanup;
     }
 
     /********************
@@ -906,19 +955,15 @@
     if (!ul_tunnel) {
         ogs_error("No UL-tunnel EBI:%d, TEID:0x%x",
                 bearer->ebi, be32toh(sgw_s1u_teid->teid));
-        ogs_gtp_send_error_message(s5c_xact, sess ? sess->pgw_s5c_teid : 0,
-                OGS_GTP2_CREATE_BEARER_RESPONSE_TYPE,
-                OGS_GTP2_CAUSE_GRE_KEY_NOT_FOUND);
-        return;
+        cause_value = OGS_GTP2_CAUSE_GRE_KEY_NOT_FOUND;
+        goto cleanup;
     }
     dl_tunnel = sgwc_dl_tunnel_in_bearer(bearer);
     if (!dl_tunnel) {
         ogs_error("No DL-tunnel EBI:%d, TEID:0x%x",
                 bearer->ebi, be32toh(sgw_s1u_teid->teid));
-        ogs_gtp_send_error_message(s5c_xact, sess ? sess->pgw_s5c_teid : 0,
-                OGS_GTP2_CREATE_BEARER_RESPONSE_TYPE,
-                OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND);
-        return;
+        cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+        goto cleanup;
     }
 
     /* Set EBI */
@@ -928,39 +973,35 @@
     enb_s1u_teid = rsp->bearer_contexts.s1_u_enodeb_f_teid.data;
     dl_tunnel->remote_teid = be32toh(enb_s1u_teid->teid);
 
-    ogs_debug("    ENB_S1U_TEID%d SGW_S1U_TEID%d",
+    ogs_info("    ENB_S1U_TEID%d SGW_S1U_TEID%d",
         dl_tunnel->remote_teid, dl_tunnel->local_teid);
 
-    ogs_assert(OGS_OK ==
-            ogs_gtp2_f_teid_to_ip(enb_s1u_teid, &dl_tunnel->remote_ip));
+    rv = ogs_gtp2_f_teid_to_ip(enb_s1u_teid, &dl_tunnel->remote_ip);
+    if (rv != OGS_OK) {
+        ogs_error("No IPv4 or IPv6 in eNB-S1U");
+        cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+        goto cleanup;
+    }
 
     pdr = dl_tunnel->pdr;
     ogs_assert(pdr);
 
     pdr->outer_header_removal_len = 1;
-    if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
-        pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV4;
-    } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
-        pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV6;
-    } else if (sess->session.session_type ==
-            OGS_PDU_SESSION_TYPE_IPV4V6) {
-        pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
-    } else {
-        ogs_error("Invalid session_type %d", sess->session.session_type);
-        ogs_assert_if_reached();
-    }
+    pdr->outer_header_removal.description =
+        OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
 
     far = dl_tunnel->far;
     ogs_assert(far);
 
     far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
 
-    ogs_assert(OGS_OK ==
-        ogs_pfcp_ip_to_outer_header_creation(&dl_tunnel->remote_ip,
-            &far->outer_header_creation, &far->outer_header_creation_len));
+    rv = ogs_pfcp_ip_to_outer_header_creation(&dl_tunnel->remote_ip,
+            &far->outer_header_creation, &far->outer_header_creation_len);
+    if (rv != OGS_OK) {
+        ogs_error("No IPv4 or IPv6 in DL-Tunnel");
+        cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+        goto cleanup;
+    }
     far->outer_header_creation.teid = dl_tunnel->remote_teid;
 
     if (rsp->user_location_information.presence == 1) {
@@ -973,20 +1014,30 @@
             ogs_nas_to_plmn_id(&sgwc_ue->e_cgi.plmn_id, &uli.e_cgi.nas_plmn_id);
             sgwc_ue->e_cgi.cell_id = uli.e_cgi.cell_id;
 
-            ogs_debug("    TAIPLMN_ID:%06x,TAC:%d",
+            ogs_info("    TAIPLMN_ID:%06x,TAC:%d",
                     ogs_plmn_id_hexdump(&sgwc_ue->e_tai.plmn_id),
                     sgwc_ue->e_tai.tac);
-            ogs_debug("    E_CGIPLMN_ID:%06x,CELL_ID:0x%x",
+            ogs_info("    E_CGIPLMN_ID:%06x,CELL_ID:0x%x",
                     ogs_plmn_id_hexdump(&sgwc_ue->e_cgi.plmn_id),
                     sgwc_ue->e_cgi.cell_id);
         } else
             ogs_error("Invalid User Location Info(ULI)");
     }
 
+    ogs_info("    bearerEBI=%d xact=%p", bearer->ebi, s5c_xact);
     ogs_assert(OGS_OK ==
         sgwc_pfcp_send_bearer_modification_request(
             bearer, s5c_xact->id, gtpbuf,
             OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_CREATE));
+
+    return;
+
+cleanup:
+    ogs_assert(cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED);
+
+    ogs_gtp_send_error_message(s5c_xact, sess ? sess->pgw_s5c_teid : 0,
+            OGS_GTP2_CREATE_BEARER_RESPONSE_TYPE,
+            cause_value);
 }
 
 void sgwc_s11_handle_update_bearer_response(
@@ -1003,12 +1054,11 @@
     ogs_pool_id_t bearer_id = OGS_INVALID_POOL_ID;
     ogs_gtp2_update_bearer_response_t *rsp = NULL;
 
-    ogs_assert(sgwc_ue);
     ogs_assert(message);
     rsp = &message->update_bearer_response;
     ogs_assert(rsp);
 
-    ogs_debug("Update Bearer Response");
+    ogs_info("Update Bearer Response");
 
     /********************
      * Check Transaction
@@ -1025,7 +1075,8 @@
                 bearer_id <= OGS_MAX_POOL_ID);
 
         bearer = sgwc_bearer_find_by_id(bearer_id);
-        ogs_assert(bearer);
+        if (!bearer)
+            ogs_error("No Bearer ID %d", bearer_id);
     } else {
         ogs_assert(s11_xact->data);
         bearer_id = OGS_POINTER_TO_UINT(s11_xact->data);
@@ -1033,11 +1084,21 @@
                 bearer_id <= OGS_MAX_POOL_ID);
 
         bearer = sgwc_bearer_find_by_id(bearer_id);
-        ogs_assert(bearer);
+        if (!bearer)
+            ogs_error("No Bearer ID %d", bearer_id);
     }
 
-    sess = sgwc_sess_find_by_id(bearer->sess_id);
-    ogs_assert(sess);
+    if (bearer) {
+        sess = sgwc_sess_find_by_id(bearer->sess_id);
+        if (!sess)
+            ogs_error("No Session ID %d", bearer->sess_id);
+    }
+
+    if (sess) {
+        sgwc_ue = sgwc_ue_find_by_id(sess->sgwc_ue_id);
+        if (!sgwc_ue)
+            ogs_error("No SGWC-UE ID %d", sess->sgwc_ue_id);
+    }
 
     rv = ogs_gtp_xact_commit(s11_xact);
     ogs_expect(rv == OGS_OK);
@@ -1065,12 +1126,22 @@
         cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_MISSING;
     }
 
-    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
-        ogs_gtp_send_error_message(s5c_xact, sess ? sess->pgw_s5c_teid : 0,
-                OGS_GTP2_UPDATE_BEARER_RESPONSE_TYPE, cause_value);
-        return;
+    if (!bearer) {
+        ogs_error("No Bearer Context");
+        cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+    }
+    if (!sess) {
+        ogs_error("No Session Context");
+        cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+    }
+    if (!sgwc_ue) {
+        ogs_error("No SGWC-UE Context");
+        cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
     }
 
+    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED)
+        goto cleanup;
+
     /********************
      * Check Cause Value
      ********************/
@@ -1081,9 +1152,7 @@
     cause_value = cause->value;
     if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
         ogs_error("GTP Bearer Cause VALUE:%d", cause_value);
-        ogs_gtp_send_error_message(s5c_xact, sess ? sess->pgw_s5c_teid : 0,
-                OGS_GTP2_UPDATE_BEARER_RESPONSE_TYPE, cause_value);
-        return;
+        goto cleanup;
     }
 
     cause = rsp->cause.data;
@@ -1091,9 +1160,7 @@
     cause_value = cause->value;
     if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
         ogs_error("GTP Cause Value:%d", cause_value);
-        ogs_gtp_send_error_message(s5c_xact, sess ? sess->pgw_s5c_teid : 0,
-                OGS_GTP2_UPDATE_BEARER_RESPONSE_TYPE, cause_value);
-        return;
+        goto cleanup;
     }
 
     /********************
@@ -1102,9 +1169,9 @@
     ogs_assert(sgwc_ue);
     ogs_assert(sess);
 
-    ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
         sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
-    ogs_debug("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
+    ogs_info("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
         sess->sgw_s5c_teid, sess->pgw_s5c_teid);
 
     message->h.type = OGS_GTP2_UPDATE_BEARER_RESPONSE_TYPE;
@@ -1124,6 +1191,14 @@
 
     rv = ogs_gtp_xact_commit(s5c_xact);
     ogs_expect(rv == OGS_OK);
+
+    return;
+
+cleanup:
+    ogs_assert(cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED);
+
+    ogs_gtp_send_error_message(s5c_xact, sess ? sess->pgw_s5c_teid : 0,
+            OGS_GTP2_UPDATE_BEARER_RESPONSE_TYPE, cause_value);
 }
 
 void sgwc_s11_handle_delete_bearer_response(
@@ -1139,12 +1214,11 @@
     ogs_pool_id_t bearer_id = OGS_INVALID_POOL_ID;
     ogs_gtp2_delete_bearer_response_t *rsp = NULL;
 
-    ogs_assert(sgwc_ue);
     ogs_assert(message);
     rsp = &message->delete_bearer_response;
     ogs_assert(rsp);
 
-    ogs_debug("Delete Bearer Response");
+    ogs_info("Delete Bearer Response");
 
     /********************
      * Check Transaction
@@ -1161,7 +1235,8 @@
                 bearer_id <= OGS_MAX_POOL_ID);
 
         bearer = sgwc_bearer_find_by_id(bearer_id);
-        ogs_assert(bearer);
+        if (!bearer)
+            ogs_error("No Bearer ID %d", bearer_id);
     } else {
         ogs_assert(s11_xact->data);
         bearer_id = OGS_POINTER_TO_UINT(s11_xact->data);
@@ -1169,11 +1244,21 @@
                 bearer_id <= OGS_MAX_POOL_ID);
 
         bearer = sgwc_bearer_find_by_id(bearer_id);
-        ogs_assert(bearer);
+        if (!bearer)
+            ogs_error("No Bearer ID %d", bearer_id);
     }
 
-    sess = sgwc_sess_find_by_id(bearer->sess_id);
-    ogs_assert(sess);
+    if (bearer) {
+        sess = sgwc_sess_find_by_id(bearer->sess_id);
+        if (!sess)
+            ogs_error("No Session ID %d", bearer->sess_id);
+    }
+
+    if (sess) {
+        sgwc_ue = sgwc_ue_find_by_id(sess->sgwc_ue_id);
+        if (!sgwc_ue)
+            ogs_error("No SGWC-UE ID %d", sess->sgwc_ue_id);
+    }
 
     rv = ogs_gtp_xact_commit(s11_xact);
     ogs_expect(rv == OGS_OK);
@@ -1183,6 +1268,22 @@
      ************************/
     cause_value = OGS_GTP2_CAUSE_REQUEST_ACCEPTED;
 
+    if (!bearer) {
+        ogs_error("No Bearer Context");
+        cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+    }
+    if (!sess) {
+        ogs_error("No Session Context");
+        cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+    }
+    if (!sgwc_ue) {
+        ogs_error("No SGWC-UE Context");
+        cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+    }
+
+    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED)
+        goto cleanup;
+
     if (rsp->linked_eps_bearer_id.presence) {
        /*
         * << Linked EPS Bearer ID >>
@@ -1255,15 +1356,24 @@
             ogs_error("No Cause");
         }
 
-        ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+        ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
             sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
-        ogs_debug("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
+        ogs_info("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
             sess->sgw_s5c_teid, sess->pgw_s5c_teid);
 
+        ogs_info("    bearerEBI=%d xact=%p", bearer->ebi, s5c_xact);
         ogs_assert(OGS_OK ==
             sgwc_pfcp_send_bearer_modification_request(
                 bearer, s5c_xact->id, gtpbuf, OGS_PFCP_MODIFY_REMOVE));
     }
+
+    return;
+
+cleanup:
+    ogs_assert(cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED);
+
+    ogs_gtp_send_error_message(s5c_xact, sess ? sess->pgw_s5c_teid : 0,
+            OGS_GTP2_DELETE_BEARER_RESPONSE_TYPE, cause_value);
 }
 
 void sgwc_s11_handle_release_access_bearers_request(
@@ -1280,7 +1390,7 @@
     req = &message->release_access_bearers_request;
     ogs_assert(req);
 
-    ogs_debug("Release Access Bearers Request");
+    ogs_info("Release Access Bearers Request");
 
     /************************
      * Check SGWC-UE Context
@@ -1304,11 +1414,13 @@
      ********************/
     ogs_assert(sgwc_ue);
 
-    ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
         sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
 
     ogs_list_for_each(&sgwc_ue->sess_list, sess) {
 
+        ogs_assert(ogs_list_count(&sess->bearer_list));
+        ogs_info("    sess_id=%d xact=%p", sess->id, s11_xact);
         ogs_assert(OGS_OK ==
             sgwc_pfcp_send_session_modification_request(
                 sess, s11_xact->id, gtpbuf,
@@ -1337,16 +1449,34 @@
      * Check Transaction
      ********************/
     ogs_assert(s11_xact);
-    ogs_assert(s11_xact->data);
+
+    if (!s11_xact->data) {
+        ogs_error("No Transaction Data in Downlink Data Notification Ack");
+        goto out;
+    }
+
     bearer_id = OGS_POINTER_TO_UINT(s11_xact->data);
-    ogs_assert(bearer_id >= OGS_MIN_POOL_ID &&
-            bearer_id <= OGS_MAX_POOL_ID);
+    if (bearer_id < OGS_MIN_POOL_ID || bearer_id > OGS_MAX_POOL_ID) {
+        ogs_error("Invalid Bearer ID %d in Downlink Data Notification Ack",
+                bearer_id);
+        goto out;
+    }
 
     bearer = sgwc_bearer_find_by_id(bearer_id);
-    ogs_assert(bearer);
+    if (!bearer) {
+        ogs_warn("Bearer Not Found id:%d in Downlink Data Notification Ack",
+                bearer_id);
+        goto out;
+    }
+
     sess = sgwc_sess_find_by_id(bearer->sess_id);
-    ogs_assert(sess);
+    if (!sess) {
+        ogs_warn("Session Not Found id:%d in Downlink Data Notification Ack",
+                bearer->sess_id);
+        goto out;
+    }
 
+out:
     rv = ogs_gtp_xact_commit(s11_xact);
     ogs_expect(rv == OGS_OK);
 
@@ -1366,11 +1496,18 @@
         ogs_error("No Cause");
     }
 
-    ogs_debug("Downlink Data Notification Acknowledge %d", bearer->id);
-    if (sgwc_ue) {
-        ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("Downlink Data Notification Acknowledge%s%s",
+            s11_xact->data ? " bearer_id present" : "",
+            sgwc_ue ? " ue present" : "");
+
+    if (sgwc_ue)
+        ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
             sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
-    }
+    if (sess)
+        ogs_info("    SGW_S5C_TEID%d PGW_S5C_TEID%d",
+            sess->sgw_s5c_teid, sess->pgw_s5c_teid);
+    if (bearer)
+        ogs_info("    BEARER ID%d EBI%d", bearer->id, bearer->ebi);
 }
 
 void sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request(
@@ -1394,7 +1531,7 @@
     req = &message->create_indirect_data_forwarding_tunnel_request;
     ogs_assert(req);
 
-    ogs_debug("Create Indirect Data Forwarding Tunnel Request");
+    ogs_info("Create Indirect Data Forwarding Tunnel Request");
 
     /************************
      * Check SGWC-UE Context
@@ -1406,35 +1543,33 @@
         cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
     }
 
-    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
-        ogs_gtp_send_error_message(
-                s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
-                OGS_GTP2_CREATE_INDIRECT_DATA_FORWARDING_TUNNEL_RESPONSE_TYPE,
-                cause_value);
-        return;
-    }
+    if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED)
+        goto cleanup;
 
     /********************
      * Check ALL Context
      ********************/
     ogs_assert(sgwc_ue);
 
-    ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
         sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
 
     for (i = 0; req->bearer_contextsi.presence; i++) {
         if (req->bearer_contextsi.eps_bearer_id.presence == 0) {
             ogs_error("No EBI");
-            ogs_gtp_send_error_message(
-                s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
-                OGS_GTP2_CREATE_INDIRECT_DATA_FORWARDING_TUNNEL_RESPONSE_TYPE,
-                OGS_GTP2_CAUSE_MANDATORY_IE_MISSING);
-            return;
+            cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_MISSING;
+            goto cleanup;
         }
 
         bearer = sgwc_bearer_find_by_ue_ebi(sgwc_ue,
                     req->bearer_contextsi.eps_bearer_id.u8);
-        ogs_assert(bearer);
+        if (!bearer) {
+            ogs_error("No Bearer Context %d",
+                    req->bearer_contextsi.eps_bearer_id.u8);
+            cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+            goto cleanup;
+        }
+
         sess = sgwc_sess_find_by_id(bearer->sess_id);
         ogs_assert(sess);
 
@@ -1444,52 +1579,45 @@
 
             tunnel = sgwc_tunnel_add(bearer,
                     OGS_GTP2_F_TEID_SGW_GTP_U_FOR_DL_DATA_FORWARDING);
-            ogs_assert(tunnel);
+            if (!tunnel) {
+                ogs_error("sgwc_tunnel_add() failed");
+                cause_value = OGS_GTP2_CAUSE_SYSTEM_FAILURE;
+                goto cleanup;
+            }
 
             tunnel->remote_teid = be32toh(req_teid->teid);
 
             rv = ogs_gtp2_f_teid_to_ip(req_teid, &tunnel->remote_ip);
             if (rv != OGS_OK) {
-                ogs_gtp_send_error_message(s11_xact,
-                        sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
-                OGS_GTP2_CREATE_INDIRECT_DATA_FORWARDING_TUNNEL_RESPONSE_TYPE,
-                OGS_GTP2_CAUSE_MANDATORY_IE_MISSING);
-                return;
+                ogs_error("No IPv4 or IPv6 in REQ-TEID");
+                cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+                goto cleanup;
             }
 
             pdr = tunnel->pdr;
             ogs_assert(pdr);
 
             pdr->outer_header_removal_len = 1;
-            if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
-                pdr->outer_header_removal.description =
-                    OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV4;
-            } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
-                pdr->outer_header_removal.description =
-                    OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV6;
-            } else if (sess->session.session_type ==
-                    OGS_PDU_SESSION_TYPE_IPV4V6) {
-                pdr->outer_header_removal.description =
-                    OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
-            } else {
-                ogs_error("Invalid session_type %d",
-                        sess->session.session_type);
-                ogs_assert_if_reached();
-            }
+            pdr->outer_header_removal.description =
+                OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
 
             far = tunnel->far;
             ogs_assert(far);
 
             far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
 
-            ogs_assert(OGS_OK ==
-                ogs_pfcp_ip_to_outer_header_creation(
+            rv = ogs_pfcp_ip_to_outer_header_creation(
                     &tunnel->remote_ip,
                     &far->outer_header_creation,
-                    &far->outer_header_creation_len));
+                    &far->outer_header_creation_len);
+            if (rv != OGS_OK) {
+                ogs_error("No IPv4 or IPv6 in Tunnel");
+                cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+                goto cleanup;
+            }
             far->outer_header_creation.teid = tunnel->remote_teid;
 
-            ogs_debug("    SGW_DL_TEID%d ENB_DL_TEID%d",
+            ogs_info("    SGW_DL_TEID%d ENB_DL_TEID%d",
                     tunnel->local_teid, tunnel->remote_teid);
         }
 
@@ -1499,63 +1627,97 @@
 
             tunnel = sgwc_tunnel_add(bearer,
                     OGS_GTP2_F_TEID_SGW_GTP_U_FOR_UL_DATA_FORWARDING);
-            ogs_assert(tunnel);
+            if (!tunnel) {
+                ogs_error("sgwc_tunnel_add() failed");
+                cause_value = OGS_GTP2_CAUSE_SYSTEM_FAILURE;
+                goto cleanup;
+            }
 
             tunnel->remote_teid = be32toh(req_teid->teid);
 
             rv = ogs_gtp2_f_teid_to_ip(req_teid, &tunnel->remote_ip);
             if (rv != OGS_OK) {
-                ogs_gtp_send_error_message(s11_xact,
-                        sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
-                OGS_GTP2_CREATE_INDIRECT_DATA_FORWARDING_TUNNEL_RESPONSE_TYPE,
-                OGS_GTP2_CAUSE_MANDATORY_IE_MISSING);
-                return;
+                ogs_error("No IPv4 or IPv6 in REQ-TEID");
+                cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+                goto cleanup;
             }
 
             pdr = tunnel->pdr;
             ogs_assert(pdr);
 
             pdr->outer_header_removal_len = 1;
-            if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
-                pdr->outer_header_removal.description =
-                    OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV4;
-            } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
-                pdr->outer_header_removal.description =
-                    OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV6;
-            } else if (sess->session.session_type ==
-                    OGS_PDU_SESSION_TYPE_IPV4V6) {
-                pdr->outer_header_removal.description =
-                    OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
-            } else {
-                ogs_error("Invalid session_type %d",
-                        sess->session.session_type);
-                ogs_assert_if_reached();
-            }
+            pdr->outer_header_removal.description =
+                OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
 
             far = tunnel->far;
             ogs_assert(far);
 
             far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
 
-            ogs_assert(OGS_OK ==
-                ogs_pfcp_ip_to_outer_header_creation(
+            rv = ogs_pfcp_ip_to_outer_header_creation(
                     &tunnel->remote_ip,
                     &far->outer_header_creation,
-                    &far->outer_header_creation_len));
+                    &far->outer_header_creation_len);
+            if (rv != OGS_OK) {
+                ogs_error("No IPv4 or IPv6 in Tunnel");
+                cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+                goto cleanup;
+            }
             far->outer_header_creation.teid = tunnel->remote_teid;
 
-            ogs_debug("    SGW_UL_TEID%d ENB_UL_TEID%d",
+            ogs_info("    SGW_UL_TEID%d ENB_UL_TEID%d",
                     tunnel->local_teid, tunnel->remote_teid);
         }
     }
 
     ogs_list_for_each(&sgwc_ue->sess_list, sess) {
+        bool has_indirect = false;
 
-        ogs_assert(OGS_OK ==
-            sgwc_pfcp_send_session_modification_request(
-                sess, s11_xact->id, gtpbuf,
-                OGS_PFCP_MODIFY_INDIRECT|OGS_PFCP_MODIFY_CREATE));
+        ogs_assert(ogs_list_count(&sess->bearer_list));
+        ogs_list_for_each(&sess->bearer_list, bearer) {
+            ogs_list_for_each(&bearer->tunnel_list, tunnel) {
+                if ((tunnel->interface_type ==
+                         OGS_GTP2_F_TEID_SGW_GTP_U_FOR_DL_DATA_FORWARDING) ||
+                    (tunnel->interface_type ==
+                         OGS_GTP2_F_TEID_SGW_GTP_U_FOR_UL_DATA_FORWARDING)) {
+                    has_indirect = true;
+                    break;
+                }
+            }
+            if (has_indirect) break;
+        }
+
+        if (has_indirect == true) {
+            ogs_info("    sess_id=%d xact=%p", sess->id, s11_xact);
+            ogs_assert(OGS_OK ==
+                sgwc_pfcp_send_session_modification_request(
+                    sess, s11_xact->id, gtpbuf,
+                    OGS_PFCP_MODIFY_INDIRECT|OGS_PFCP_MODIFY_CREATE));
+        } else {
+            ogs_error("No Indirect Tunnel");
+            ogs_error("    UE IMSI%s APN%s",
+                    sgwc_ue->imsi_bcd, sess->session.name);
+            ogs_error("    MME_S11_TEID%d SGW_S11_TEID%d",
+                    sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
+            ogs_list_for_each(&sess->bearer_list, bearer) {
+                ogs_error("    EBI%d", bearer->ebi);
+                ogs_list_for_each(&bearer->tunnel_list, tunnel) {
+                    ogs_error("TUNNEL%d INF%d",
+                            tunnel->id, tunnel->interface_type);
+                }
+            }
+        }
     }
+
+    return;
+
+cleanup:
+    ogs_assert(cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED);
+
+    ogs_gtp_send_error_message(s11_xact,
+            sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
+            OGS_GTP2_CREATE_INDIRECT_DATA_FORWARDING_TUNNEL_RESPONSE_TYPE,
+            cause_value);
 }
 
 void sgwc_s11_handle_delete_indirect_data_forwarding_tunnel_request(
@@ -1563,11 +1725,13 @@
         ogs_pkbuf_t *gtpbuf, ogs_gtp2_message_t *recv_message)
 {
     sgwc_sess_t *sess = NULL;
+    sgwc_bearer_t *bearer = NULL;
+    sgwc_tunnel_t *tunnel = NULL;
     uint8_t cause_value = 0;
 
     ogs_assert(s11_xact);
 
-    ogs_debug("Delete Indirect Data Forwarding Tunnel Request");
+    ogs_info("Delete Indirect Data Forwarding Tunnel Request");
 
     /************************
      * Check SGWC-UE Context
@@ -1592,15 +1756,44 @@
      ********************/
     ogs_assert(sgwc_ue);
 
-    ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
         sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
 
     ogs_list_for_each(&sgwc_ue->sess_list, sess) {
+        bool has_indirect = false;
+        ogs_list_for_each(&sess->bearer_list, bearer) {
+            ogs_list_for_each(&bearer->tunnel_list, tunnel) {
+                if (tunnel->interface_type ==
+                        OGS_GTP2_F_TEID_SGW_GTP_U_FOR_DL_DATA_FORWARDING ||
+                    tunnel->interface_type ==
+                        OGS_GTP2_F_TEID_SGW_GTP_U_FOR_UL_DATA_FORWARDING) {
+                    has_indirect = true;
+                    break;
+                }
+            }
+            if (has_indirect) break;
+        }
 
-        ogs_assert(OGS_OK ==
-            sgwc_pfcp_send_session_modification_request(
-                sess, s11_xact->id, gtpbuf,
-                OGS_PFCP_MODIFY_INDIRECT| OGS_PFCP_MODIFY_REMOVE));
+        if (has_indirect) {
+            ogs_info("    sess_id=%d xact=%p", sess->id, s11_xact);
+            ogs_assert(OGS_OK ==
+                sgwc_pfcp_send_session_modification_request(
+                    sess, s11_xact->id, gtpbuf,
+                    OGS_PFCP_MODIFY_INDIRECT|OGS_PFCP_MODIFY_REMOVE));
+        } else {
+            ogs_error("No Indirect Tunnel");
+            ogs_error("    UE IMSI%s APN%s",
+                    sgwc_ue->imsi_bcd, sess->session.name);
+            ogs_error("    MME_S11_TEID%d SGW_S11_TEID%d",
+                    sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
+            ogs_list_for_each(&sess->bearer_list, bearer) {
+                ogs_error("    EBI%d", bearer->ebi);
+                ogs_list_for_each(&bearer->tunnel_list, tunnel) {
+                    ogs_error("TUNNEL%d INF%d",
+                            tunnel->id, tunnel->interface_type);
+                }
+            }
+        }
     }
 }
 
@@ -1623,7 +1816,7 @@
     cmd = &message->bearer_resource_command;
     ogs_assert(cmd);
 
-    ogs_debug("Bearer Resource Command");
+    ogs_info("Bearer Resource Command");
 
     /************************
      * Check SGWC-UE Context
@@ -1691,9 +1884,9 @@
     ogs_assert(sess->gnode);
     ogs_assert(sgwc_ue);
 
-    ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
         sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
-    ogs_debug("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
+    ogs_info("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
         sess->sgw_s5c_teid, sess->pgw_s5c_teid);
 
     message->h.type = OGS_GTP2_BEARER_RESOURCE_COMMAND_TYPE;

open5gs_2.7.6.tar.xz/src/sgwc/s5c-handler.c -> open5gs_2.7.7.tar.xz/src/sgwc/s5c-handler.c Changed

@@ -54,6 +54,7 @@
         break;
     case OGS_GTP2_DELETE_BEARER_REQUEST_TYPE:
         ogs_error("%s No Delete Bearer Response", sgwc_ue->imsi_bcd);
+        ogs_info("    bearerEBI=%d", bearer->ebi);
         ogs_assert(OGS_OK ==
             sgwc_pfcp_send_bearer_modification_request(
                 bearer, OGS_INVALID_POOL_ID, NULL, OGS_PFCP_MODIFY_REMOVE));
@@ -91,18 +92,23 @@
     rsp = &message->create_session_response;
     ogs_assert(rsp);
 
-    ogs_debug("Create Session Response");
+    ogs_info("Create Session Response");
 
     /********************
      * Check Transaction
      ********************/
     ogs_assert(s5c_xact);
     s11_xact = ogs_gtp_xact_find_by_id(s5c_xact->assoc_xact_id);
-    ogs_assert(s11_xact);
 
     rv = ogs_gtp_xact_commit(s5c_xact);
     ogs_expect(rv == OGS_OK);
 
+    if (!s11_xact) {
+        ogs_error("No S11 Transaction (assoc_xact_id=%u)",
+                s5c_xact->assoc_xact_id);
+        return;
+    }
+
     /************************
      * Getting Cause Value
      ************************/
@@ -146,6 +152,11 @@
     if (rsp->pdn_address_allocation.presence == 0) {
         ogs_error("No PDN Address Allocation Cause:%d", session_cause);
         cause_value = OGS_GTP2_CAUSE_CONDITIONAL_IE_MISSING;
+    } else if (rsp->pdn_address_allocation.len < OGS_PAA_IPV4_LEN ||
+            rsp->pdn_address_allocation.len > OGS_PAA_IPV4V6_LEN) {
+        ogs_error("Invalid PAA IE Length:%d",
+                rsp->pdn_address_allocation.len);
+        cause_value = OGS_GTP2_CAUSE_INVALID_LENGTH;
     } else {
         memcpy(&sess->paa, rsp->pdn_address_allocation.data,
                 rsp->pdn_address_allocation.len);
@@ -216,9 +227,9 @@
     ogs_assert(sgwc_ue);
     ogs_assert(sess);
 
-    ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
         sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
-    ogs_debug("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
+    ogs_info("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
         sess->sgw_s5c_teid, sess->pgw_s5c_teid);
 
     for (i = 0; i < OGS_BEARER_PER_UE; i++) {
@@ -227,28 +238,38 @@
         }
         if (rsp->bearer_contexts_createdi.eps_bearer_id.presence == 0) {
             ogs_error("No EPS Bearer ID");
-            break;
+            ogs_gtp_send_error_message(
+                    s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
+                    OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE,
+                    OGS_GTP2_CAUSE_MANDATORY_IE_MISSING);
+            return;
         }
         if (rsp->bearer_contexts_createdi.s5_s8_u_sgw_f_teid.presence == 0) {
             ogs_error("No GTP TEID");
-            break;
+            ogs_gtp_send_error_message(
+                    s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
+                    OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE,
+                    OGS_GTP2_CAUSE_MANDATORY_IE_MISSING);
+            return;
         }
 
         /* EPS Bearer ID */
         bearer = sgwc_bearer_find_by_sess_ebi(sess,
                     rsp->bearer_contexts_createdi.eps_bearer_id.u8);
         if (!bearer) {
+            ogs_error("No Bearer %d",
+                    rsp->bearer_contexts_createdi.eps_bearer_id.u8);
             ogs_gtp_send_error_message(
                     s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
                     OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE,
-                    OGS_GTP2_CAUSE_MANDATORY_IE_MISSING);
+                    OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND);
             return;
         }
 
         ul_tunnel = sgwc_ul_tunnel_in_bearer(bearer);
         ogs_assert(ul_tunnel);
 
-        ogs_debug("    SGW_S5U_TEID%d PGW_S5U_TEID%d",
+        ogs_info("    SGW_S5U_TEID%d PGW_S5U_TEID%d",
             ul_tunnel->local_teid, ul_tunnel->remote_teid);
 
         /* Receive Data Plane(UL) : PGW-S5U */
@@ -258,6 +279,7 @@
 
         rv = ogs_gtp2_f_teid_to_ip(pgw_s5u_teid, &ul_tunnel->remote_ip);
         if (rv != OGS_OK) {
+            ogs_error("ogs_gtp2_f_teid_to_ip() failed");
             ogs_gtp_send_error_message(
                     s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
                     OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE,
@@ -269,19 +291,8 @@
         ogs_assert(pdr);
 
         pdr->outer_header_removal_len = 1;
-        if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
-            pdr->outer_header_removal.description =
-                OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV4;
-        } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
-            pdr->outer_header_removal.description =
-                OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV6;
-        } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
-            pdr->outer_header_removal.description =
-                OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
-        } else {
-            ogs_error("Invalid session_type %d", sess->session.session_type);
-            ogs_assert_if_reached();
-        }
+        pdr->outer_header_removal.description =
+            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
 
         far = ul_tunnel->far;
         ogs_assert(far);
@@ -313,6 +324,8 @@
     /* Setup GTP Node */
     OGS_SETUP_GTP_NODE(sess, pgw);
 
+    ogs_assert(ogs_list_count(&sess->bearer_list));
+    ogs_info("    sess_id=%d xact=%p", sess->id, s11_xact);
     ogs_assert(OGS_OK ==
         sgwc_pfcp_send_session_modification_request(
             sess, s11_xact->id, gtpbuf,
@@ -340,19 +353,24 @@
     rsp = &message->modify_bearer_response;
     ogs_assert(rsp);
 
-    ogs_debug("Modify Bearer Response");
+    ogs_info("Modify Bearer Response");
 
     /********************
      * Check Transaction
      ********************/
     ogs_assert(s5c_xact);
     s11_xact = ogs_gtp_xact_find_by_id(s5c_xact->assoc_xact_id);
-    ogs_assert(s11_xact);
-    modify_action = s5c_xact->modify_action;
 
     rv = ogs_gtp_xact_commit(s5c_xact);
     ogs_expect(rv == OGS_OK);
 
+    if (!s11_xact) {
+        ogs_error("No S11 Transaction (assoc_xact_id=%u)",
+                s5c_xact->assoc_xact_id);
+        return;
+    }
+    modify_action = s5c_xact->modify_action;
+
     /************************
      * Getting Cause Value
      ************************/
@@ -435,12 +453,33 @@
     ogs_assert(sgwc_ue);
     ogs_assert(sess);
 
-    ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
         sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
-    ogs_debug("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
+    ogs_info("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
         sess->sgw_s5c_teid, sess->pgw_s5c_teid);
 
     if (modify_action == OGS_GTP_MODIFY_IN_PATH_SWITCH_REQUEST) {
+        sgwc_bearer_t *bearer = NULL;
+        sgwc_tunnel_t *ul_tunnel = NULL;
+
+        ogs_list_for_each(&sess->bearer_list, bearer) {
+            ul_tunnel = sgwc_ul_tunnel_in_bearer(bearer);
+
+            /* Defensive check: UL tunnel remote IP must be initialized */
+            if (!ul_tunnel ||
+                (!ul_tunnel->remote_ip.ipv4 && !ul_tunnel->remote_ip.ipv6)) {
+
+                ogs_error("ModifyBearerResponse missing PGW S5U address "
+                        "(SEID=%u, bearer=%u)", sess->id, bearer->ebi);
+
+                ogs_gtp_send_error_message(
+                        s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
+                        OGS_GTP2_CREATE_SESSION_RESPONSE_TYPE,
+                        OGS_GTP2_CAUSE_MANDATORY_IE_MISSING);
+                return;
+            }
+        }
+
         ogs_assert(OGS_OK ==
             sgwc_gtp_send_create_session_response(sess, s11_xact));
     } else {
@@ -481,18 +520,23 @@
     rsp = &message->delete_session_response;
     ogs_assert(rsp);
 
-    ogs_debug("Delete Session Response");
+    ogs_info("Delete Session Response");
 
     /********************
      * Check Transaction
      ********************/
     ogs_assert(s5c_xact);
     s11_xact = ogs_gtp_xact_find_by_id(s5c_xact->assoc_xact_id);
-    ogs_assert(s11_xact);
 
     rv = ogs_gtp_xact_commit(s5c_xact);
     ogs_expect(rv == OGS_OK);
 
+    if (!s11_xact) {
+        ogs_error("No S11 Transaction (assoc_xact_id=%u)",
+                s5c_xact->assoc_xact_id);
+        return;
+    }
+
     /************************
      * Getting Cause Value
      ************************/
@@ -545,9 +589,9 @@
     ogs_assert(sgwc_ue);
 
     /* Remove a pgw session */
-    ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
         sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
-    ogs_debug("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
+    ogs_info("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
         sess->sgw_s5c_teid, sess->pgw_s5c_teid);
 
     /*
@@ -578,7 +622,7 @@
     req = &message->create_bearer_request;
     ogs_assert(req);
 
-    ogs_debug("Create Bearer Request");
+    ogs_info("Create Bearer Request");
 
     /********************
      * Check Transaction
@@ -648,11 +692,11 @@
     ogs_assert(pgw_s5u_teid);
     ul_tunnel->remote_teid = be32toh(pgw_s5u_teid->teid);
 
-    ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
         sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
-    ogs_debug("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
+    ogs_info("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
         sess->sgw_s5c_teid, sess->pgw_s5c_teid);
-    ogs_debug("    SGW_S5U_TEID%d PGW_S5U_TEID%d",
+    ogs_info("    SGW_S5U_TEID%d PGW_S5U_TEID%d",
         ul_tunnel->local_teid, ul_tunnel->remote_teid);
 
     rv = ogs_gtp2_f_teid_to_ip(pgw_s5u_teid, &ul_tunnel->remote_ip);
@@ -667,20 +711,8 @@
     ogs_assert(pdr);
 
     pdr->outer_header_removal_len = 1;
-    if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
-        pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV4;
-    } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
-        pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV6;
-    } else if (sess->session.session_type ==
-            OGS_PDU_SESSION_TYPE_IPV4V6) {
-        pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
-    } else {
-        ogs_error("Invalid session_type %d", sess->session.session_type);
-        ogs_assert_if_reached();
-    }
+    pdr->outer_header_removal.description =
+        OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
 
     far = ul_tunnel->far;
     ogs_assert(far);
@@ -692,6 +724,7 @@
             &far->outer_header_creation, &far->outer_header_creation_len));
     far->outer_header_creation.teid = ul_tunnel->remote_teid;
 
+    ogs_info("    bearerEBI=%d xact=%p", bearer->ebi, s5c_xact);
     ogs_assert(OGS_OK ==
         sgwc_pfcp_send_bearer_modification_request(
             bearer, s5c_xact->id, gtpbuf,
@@ -714,7 +747,7 @@
     req = &message->update_bearer_request;
     ogs_assert(req);
 
-    ogs_debug("Update Bearer Request");
+    ogs_info("Update Bearer Request");
 
     /********************
      * Check Transaction
@@ -767,10 +800,10 @@
     ogs_assert(sgwc_ue);
     ogs_assert(sgwc_ue->gnode);
 
-    ogs_debug("    EBI%d", bearer->ebi);
-    ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("    EBI%d", bearer->ebi);
+    ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
         sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
-    ogs_debug("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
+    ogs_info("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
         sess->sgw_s5c_teid, sess->pgw_s5c_teid);
 
     message->h.type = OGS_GTP2_UPDATE_BEARER_REQUEST_TYPE;
@@ -806,7 +839,7 @@
     rv = ogs_gtp_xact_commit(s11_xact);
     ogs_expect(rv == OGS_OK);
 
-    ogs_debug("Update Bearer Request : SGW <-- PGW");
+    ogs_info("Update Bearer Request : SGW <-- PGW");
 }
 
 void sgwc_s5c_handle_delete_bearer_request(
@@ -825,7 +858,7 @@
     req = &message->delete_bearer_request;
     ogs_assert(req);
 
-    ogs_debug("Delete Bearer Request");
+    ogs_info("Delete Bearer Request");
 
     /********************
      * Check Transaction
@@ -909,10 +942,10 @@
     ogs_assert(sgwc_ue);
     ogs_assert(sgwc_ue->gnode);
 
-    ogs_debug("    EBI%d", bearer->ebi);
-    ogs_debug("    MME_S11_TEID%d SGW_S11_TEID%d",
+    ogs_info("    EBI%d", bearer->ebi);
+    ogs_info("    MME_S11_TEID%d SGW_S11_TEID%d",
         sgwc_ue->mme_s11_teid, sgwc_ue->sgw_s11_teid);
-    ogs_debug("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
+    ogs_info("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
         sess->sgw_s5c_teid, sess->pgw_s5c_teid);
 
     message->h.type = OGS_GTP2_DELETE_BEARER_REQUEST_TYPE;
@@ -972,6 +1005,7 @@
         sgwc_sess_t *sess, ogs_gtp_xact_t *s5c_xact,
         ogs_pkbuf_t *gtpbuf, ogs_gtp2_message_t *message)
 {
+    int rv;
     uint8_t cause_value = 0;
     ogs_gtp_xact_t *s11_xact = NULL;
     ogs_gtp2_bearer_resource_failure_indication_t *ind = NULL;
@@ -982,14 +1016,22 @@
     ind = &message->bearer_resource_failure_indication;
     ogs_assert(ind);
 
-    ogs_debug("Bearer Resource Failure Indication");
+    ogs_info("Bearer Resource Failure Indication");
 
     /********************
      * Check Transaction
      ********************/
     ogs_assert(s5c_xact);
     s11_xact = ogs_gtp_xact_find_by_id(s5c_xact->assoc_xact_id);
-    ogs_assert(s11_xact);
+
+    rv = ogs_gtp_xact_commit(s5c_xact);
+    ogs_expect(rv == OGS_OK);
+
+    if (!s11_xact) {
+        ogs_error("No S11 Transaction (assoc_xact_id=%u)",
+                s5c_xact->assoc_xact_id);
+        return;
+    }
 
     /************************
      * Check Session Context

open5gs_2.7.6.tar.xz/src/sgwc/sgwc-sm.c -> open5gs_2.7.7.tar.xz/src/sgwc/sgwc-sm.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019,2026 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -151,17 +151,17 @@
             break;
         }
 
-        if (gtp_message.h.teid_presence && gtp_message.h.teid != 0) {
+        if (gtp_message.h.teid_presence && gtp_message.h.teid != 0)
             /* Cause is not "Context not found" */
             sgwc_ue = sgwc_ue_find_by_teid(gtp_message.h.teid);
-        } else if (gtp_xact->local_teid) { /* rx no TEID or TEID=0 */
+
+        if (!sgwc_ue && gtp_xact->local_teid) /* rx no TEID or TEID=0 */
             /* 3GPP TS 29.274 5.5.2: we receive TEID=0 under some
              * conditions, such as cause "Session context not found". In those
              * cases, we still want to identify the local session which
              * originated the message, so try harder by using the TEID we
              * locally stored in xact when sending the original request: */
             sgwc_ue = sgwc_ue_find_by_teid(gtp_xact->local_teid);
-        }
 
         switch(gtp_message.h.type) {
         case OGS_GTP2_ECHO_REQUEST_TYPE:
@@ -250,16 +250,16 @@
             break;
         }
 
-        if (gtp_message.h.teid_presence && gtp_message.h.teid != 0) {
+        if (gtp_message.h.teid_presence && gtp_message.h.teid != 0)
             sess = sgwc_sess_find_by_teid(gtp_message.h.teid);
-        } else if (gtp_xact->local_teid) { /* rx no TEID or TEID=0 */
+
+        if (!sess && gtp_xact->local_teid) /* rx no TEID or TEID=0 */
             /* 3GPP TS 29.274 5.5.2: we receive TEID=0 under some
              * conditions, such as cause "Session context not found". In those
              * cases, we still want to identify the local session which
              * originated the message, so try harder by using the TEID we
              * locally stored in xact when sending the original request: */
             sess = sgwc_sess_find_by_teid(gtp_xact->local_teid);
-        }
 
         switch(gtp_message.h.type) {
         case OGS_GTP2_ECHO_REQUEST_TYPE:

open5gs_2.7.6.tar.xz/src/sgwc/sxa-build.c -> open5gs_2.7.7.tar.xz/src/sgwc/sxa-build.c Changed

@@ -36,7 +36,7 @@
     ogs_pfcp_f_seid_t f_seid;
     int len;
 
-    ogs_debug("Session Establishment Request");
+    ogs_info("Session Establishment Request");
     ogs_assert(sess);
 
     pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
@@ -135,13 +135,18 @@
     int num_of_update_far = 0;
 
     uint64_t modify_flags = 0;
+    int total = 0;
 
-    ogs_debug("Session Modification Request");
+    ogs_info("Session Modification Request");
 
     ogs_assert(sess);
     ogs_assert(xact);
     modify_flags = xact->modify_flags;
     ogs_assert(modify_flags);
+    ogs_info("PFCP Session Modification build start: "
+            "sess_id=%d xact=%p flags=0x%llx bearer_to_modify_count=%d",
+            sess->id, xact, (unsigned long long)modify_flags,
+            ogs_list_count(&xact->bearer_to_modify_list));
 
     pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
     if (!pfcp_message) {
@@ -276,8 +281,19 @@
         }
     }
 
-    ogs_assert(num_of_remove_pdr + num_of_remove_far + num_of_create_pdr +
-            num_of_create_far + num_of_update_pdr + num_of_update_far);
+    total = num_of_remove_pdr + num_of_remove_far + num_of_create_pdr +
+            num_of_create_far + num_of_update_pdr + num_of_update_far;
+
+    if (!total) {
+        ogs_error("PFCP Session Modification build invalid state: "
+                "sess_id=%d xact=%p flags=0x%llx remove_pdr=%d remove_far=%d "
+                "create_pdr=%d create_far=%d update_pdr=%d update_far=%d",
+                sess->id, xact, (unsigned long long)modify_flags,
+                num_of_remove_pdr, num_of_remove_far,
+                num_of_create_pdr, num_of_create_far,
+                num_of_update_pdr, num_of_update_far);
+        ogs_assert_if_reached();
+    }
 
     pfcp_message->h.type = type;
     pkbuf = ogs_pfcp_build_msg(pfcp_message);
@@ -298,7 +314,7 @@
     ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pkbuf_t *pkbuf = NULL;
 
-    ogs_debug("Session Deletion Request");
+    ogs_info("Session Deletion Request");
     ogs_assert(sess);
 
     pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));

open5gs_2.7.6.tar.xz/src/sgwc/sxa-handler.c -> open5gs_2.7.7.tar.xz/src/sgwc/sxa-handler.c Changed

@@ -115,7 +115,7 @@
 
     bearer = sgwc_bearer_find_by_id(bearer_id);
     if (!bearer) {
-        ogs_error("Bearer has already been removed %d", type);
+        ogs_warn("Bearer has already been removed %d", type);
         return;
     }
 
@@ -127,6 +127,7 @@
     switch (type) {
     case OGS_GTP2_CREATE_BEARER_REQUEST_TYPE:
         ogs_error("%s No Create Bearer Response", sgwc_ue->imsi_bcd);
+        ogs_info("    bearerEBI=%d", bearer->ebi);
         ogs_assert(OGS_OK ==
             sgwc_pfcp_send_bearer_modification_request(
                 bearer, OGS_INVALID_POOL_ID, NULL,
@@ -169,7 +170,7 @@
 
     ogs_gtp2_indication_t *indication = NULL;
 
-    ogs_debug("Session Establishment Response");
+    ogs_info("Session Establishment Response");
 
     ogs_assert(pfcp_xact);
     ogs_assert(pfcp_rsp);
@@ -267,7 +268,7 @@
 
     ogs_assert(sess);
 
-    ogs_debug("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
+    ogs_info("    SGW_S5C_TEID0x%x PGW_S5C_TEID0x%x",
         sess->sgw_s5c_teid, sess->pgw_s5c_teid);
 
     /* Data Plane(DL) : SGW-S5U */
@@ -278,7 +279,7 @@
         dl_tunnel = sgwc_dl_tunnel_in_bearer(bearer);
         ogs_assert(dl_tunnel);
 
-        ogs_debug("    SGW_S5U_TEID%d PGW_S5U_TEID%d",
+        ogs_info("    SGW_S5U_TEID%d PGW_S5U_TEID%d",
             dl_tunnel->local_teid, dl_tunnel->remote_teid);
 
         if (dl_tunnel->local_addr == NULL && dl_tunnel->local_addr6 == NULL) {
@@ -479,7 +480,7 @@
 
     ogs_gtp2_cause_t cause;
 
-    ogs_debug("Session Modification Response");
+    ogs_info("Session Modification Response");
 
     ogs_assert(pfcp_xact);
     ogs_assert(pfcp_rsp);
@@ -493,42 +494,58 @@
         if (!sess) {
             ogs_pool_id_t sess_id = OGS_INVALID_POOL_ID;
 
-            ogs_error("No Context");
+            ogs_error("No Session Context");
 
             sess_id = OGS_POINTER_TO_UINT(pfcp_xact->data);
-            ogs_assert(sess_id >= OGS_MIN_POOL_ID &&
-                    sess_id <= OGS_MAX_POOL_ID);
-
-            sess = sgwc_sess_find_by_id(sess_id);
-            ogs_assert(sess);
-
-            cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+            if (sess_id >= OGS_MIN_POOL_ID && sess_id <= OGS_MAX_POOL_ID) {
+                sess = sgwc_sess_find_by_id(sess_id);
+                if (!sess) {
+                    ogs_error("Session not found %d", sess_id);
+                    cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+                }
+            } else {
+                ogs_error("Invalid session id: %u", sess_id);
+                cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+            }
         }
 
-        sgwc_ue = sgwc_ue_find_by_id(sess->sgwc_ue_id);
-        ogs_assert(sgwc_ue);
+        if (sess && cause_value == OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
+            sgwc_ue = sgwc_ue_find_by_id(sess->sgwc_ue_id);
+            if (!sgwc_ue) {
+                ogs_error("UE not found %d", sess->sgwc_ue_id);
+                cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+            }
+        }
 
     } else {
         ogs_pool_id_t bearer_id = OGS_POINTER_TO_UINT(pfcp_xact->data);
-        ogs_assert(bearer_id >= OGS_MIN_POOL_ID &&
-                bearer_id <= OGS_MAX_POOL_ID);
-
-        bearer = sgwc_bearer_find_by_id(bearer_id);
-        if (!bearer) {
-            ogs_error("No Bearer Context");
-            cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
-        } else {
-            if (!sess) {
-                ogs_error("No Context");
+        if (bearer_id >= OGS_MIN_POOL_ID && bearer_id <= OGS_MAX_POOL_ID) {
+            bearer = sgwc_bearer_find_by_id(bearer_id);
+            if (!bearer) {
+                ogs_error("No Bearer Context %d", bearer_id);
+                cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+            } else {
+                if (!sess) {
+                    ogs_error("No Session Context");
 
-                sess = sgwc_sess_find_by_id(bearer->sess_id);
-                ogs_assert(sess);
+                    sess = sgwc_sess_find_by_id(bearer->sess_id);
+                    if (!sess) {
+                        ogs_error("Session not found %d", bearer->sess_id);
+                        cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+                    }
+                }
 
-                cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+                if (sess && cause_value == OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
+                    sgwc_ue = sgwc_ue_find_by_id(sess->sgwc_ue_id);
+                    if (!sgwc_ue) {
+                        ogs_error("UE not found %d", sess->sgwc_ue_id);
+                        cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+                    }
+                }
             }
-
-            sgwc_ue = sgwc_ue_find_by_id(bearer->sgwc_ue_id);
-            ogs_assert(sgwc_ue);
+        } else {
+            ogs_error("Invalid bearer id: %u", bearer_id);
+            cause_value = OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
         }
     }
 
@@ -650,12 +667,35 @@
                 ogs_assert_if_reached();
             }
         } else if (flags & OGS_PFCP_MODIFY_DEACTIVATE) {
-            s11_xact = ogs_gtp_xact_find_by_id(pfcp_xact->assoc_xact_id);
-            ogs_assert(s11_xact);
+            if (flags & OGS_PFCP_MODIFY_ERROR_INDICATION) {
+                /* It's faked method for receiving `bearer` context */
+                bearer = sgwc_bearer_find_by_id(pfcp_xact->assoc_xact_id);
+                ogs_assert(bearer);
+                sgwc_ue = sgwc_ue_find_by_id(bearer->sgwc_ue_id);
+                ogs_assert(sgwc_ue);
+
+                ogs_assert(flags & OGS_PFCP_MODIFY_SESSION);
+                if (SGWC_SESSION_SYNC_DONE(sgwc_ue,
+                        OGS_PFCP_SESSION_MODIFICATION_REQUEST_TYPE, flags)) {
+                    ogs_assert(OGS_OK ==
+                        sgwc_gtp_send_downlink_data_notification(
+                            OGS_GTP2_CAUSE_ERROR_INDICATION_RECEIVED, bearer));
+                }
+            } else {
+                s11_xact = ogs_gtp_xact_find_by_id(pfcp_xact->assoc_xact_id);
 
-            ogs_gtp_send_error_message(
-                    s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
-                    OGS_GTP2_RELEASE_ACCESS_BEARERS_RESPONSE_TYPE, cause_value);
+                if (s11_xact) {
+                    ogs_gtp_send_error_message(
+                            s11_xact, sgwc_ue ? sgwc_ue->mme_s11_teid : 0,
+                            OGS_GTP2_RELEASE_ACCESS_BEARERS_RESPONSE_TYPE,
+                            cause_value);
+                } else {
+                   ogs_error("No s11_xact: IMSI%s flags0x%llx "
+                           "assoc_xact_id%u",
+                           sgwc_ue ? sgwc_ue->imsi_bcd : "unknown",
+                           (long long)flags, pfcp_xact->assoc_xact_id);
+                }
+            }
         }
 
         ogs_pfcp_xact_commit(pfcp_xact);
@@ -866,7 +906,10 @@
             rv = ogs_gtp2_ip_to_f_teid(
                     &ul_tunnel->remote_ip, &pgw_s5u_teid, &len);
             /* Clang scan-build SA: Value stored is not used: add ogs_assert(). */
-            ogs_assert(rv == OGS_OK);
+            if (rv != OGS_OK) {
+                ogs_error("ogs_gtp2_ip_to_f_teid() failed");
+                return;
+            }
             gtp_rsp->bearer_contexts.s5_s8_u_pgw_f_teid.presence = 1;
             gtp_rsp->bearer_contexts.s5_s8_u_pgw_f_teid.data = &pgw_s5u_teid;
             gtp_rsp->bearer_contexts.s5_s8_u_pgw_f_teid.len = len;
@@ -1245,12 +1288,14 @@
 
         } else {
             s11_xact = ogs_gtp_xact_find_by_id(pfcp_xact->assoc_xact_id);
-            ogs_assert(s11_xact);
+            if (!s11_xact)
+                ogs_error("GTP xact has already been removed %d",
+                        pfcp_xact->assoc_xact_id);
 
             ogs_pfcp_xact_commit(pfcp_xact);
 
             ogs_assert(flags & OGS_PFCP_MODIFY_SESSION);
-            if (SGWC_SESSION_SYNC_DONE(sgwc_ue,
+            if (s11_xact && SGWC_SESSION_SYNC_DONE(sgwc_ue,
                     OGS_PFCP_SESSION_MODIFICATION_REQUEST_TYPE, flags)) {
 
                 ogs_gtp2_release_access_bearers_response_t *gtp_rsp = NULL;
@@ -1307,7 +1352,7 @@
     ogs_gtp_xact_t *gtp_xact = NULL;
     ogs_pkbuf_t *pkbuf = NULL;
 
-    ogs_debug("Session Deletion Response");
+    ogs_info("Session Deletion Response");
 
     ogs_assert(pfcp_xact);
     ogs_assert(pfcp_rsp);
@@ -1432,7 +1477,7 @@
     uint8_t cause_value = 0;
     uint16_t pdr_id = 0;
 
-    ogs_debug("Session Report Request");
+    ogs_info("Session Report Request");
 
     ogs_assert(pfcp_xact);
     ogs_assert(pfcp_req);
@@ -1517,6 +1562,8 @@
             if (far->dst_if == OGS_PFCP_INTERFACE_ACCESS) {
                 ogs_warn("%s Error Indication from eNB", sgwc_ue->imsi_bcd);
                 ogs_list_for_each(&sgwc_ue->sess_list, sess) {
+                    ogs_assert(ogs_list_count(&sess->bearer_list));
+                    ogs_info("    sess_id=%d", sess->id);
                     ogs_assert(OGS_OK ==
                         sgwc_pfcp_send_session_modification_request(sess,
                     /* We only use the `assoc_xact` parameter temporarily here
@@ -1536,6 +1583,7 @@
                 } else {
                     ogs_error("%s Error Indication(Dedicated Bearer) "
                             "from SMF", sgwc_ue->imsi_bcd);
+                    ogs_info("    bearerEBI=%d", bearer->ebi);
                     ogs_assert(OGS_OK ==
                         sgwc_pfcp_send_bearer_modification_request(
                             bearer, OGS_INVALID_POOL_ID, NULL,

open5gs_2.7.6.tar.xz/src/sgwu/context.c -> open5gs_2.7.7.tar.xz/src/sgwu/context.c Changed

open5gs_2.7.6.tar.xz/src/sgwu/gtp-path.c -> open5gs_2.7.7.tar.xz/src/sgwu/gtp-path.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -112,8 +112,8 @@
     if (header_desc.type == OGS_GTPU_MSGTYPE_END_MARKER) {
         ogs_pfcp_object_t *pfcp_object = NULL;
         ogs_pfcp_pdr_t *pdr = NULL;
+
         ogs_gtp2_header_desc_t sendhdr;
-        ogs_pkbuf_t *sendbuf = NULL;
 
         pfcp_object = ogs_pfcp_object_find_by_teid(header_desc.teid);
         if (!pfcp_object) {
@@ -154,14 +154,19 @@
 
         ogs_assert(pdr);
 
-        sendbuf = ogs_pkbuf_copy(pkbuf);
-        ogs_assert(sendbuf);
+        /* Forward End-Marker Packet */
+        memset(&sendhdr, 0, sizeof(header_desc));
+        sendhdr.type = OGS_GTPU_MSGTYPE_END_MARKER;
+
+        ogs_gtp2_encapsulate_header(&sendhdr, pkbuf);
 
-        /* Forward packet */
-        memset(&sendhdr, 0, sizeof(sendhdr));
-        sendhdr.type = header_desc.type;
+        ogs_pfcp_send_gtpu(pdr, pkbuf);
 
-        ogs_pfcp_send_g_pdu(pdr, &sendhdr, sendbuf);
+        /*
+         * The ogs_pfcp_send_gtpu() function
+         * buffers or frees the Packet Buffer(pkbuf) memory.
+         */
+        return;
 
     } else if (header_desc.type == OGS_GTPU_MSGTYPE_ERR_IND) {
         ogs_pfcp_far_t *far = NULL;
@@ -260,7 +265,7 @@
 
         ogs_assert(pdr);
         ogs_assert(true == ogs_pfcp_up_handle_pdr(
-                    pdr, header_desc.type, &header_desc, pkbuf, &report));
+                    pdr, header_desc.type, len, &header_desc, pkbuf, &report));
 
         if (report.type.downlink_data_report) {
             ogs_assert(pdr->sess);
@@ -295,7 +300,7 @@
     ogs_pkbuf_config_t config;
     memset(&config, 0, sizeof config);
 
-    config.cluster_2048_pool = ogs_app()->pool.packet;
+    config.cluster_2048_pool = ogs_app()->pool.gtpu;
 
 #if OGS_USE_TALLOC == 1
     /* allocate a talloc pool for GTP to ensure it doesn't have to go back

open5gs_2.7.6.tar.xz/src/sgwu/sxa-handler.c -> open5gs_2.7.7.tar.xz/src/sgwu/sxa-handler.c Changed

@@ -131,15 +131,18 @@
         ogs_assert(pdr);
 
         /* Setup TEID Hash */
-        if (pdr->f_teid_len)
-            ogs_pfcp_object_teid_hash_set(
+        if (pdr->f_teid_len) {
+            cause_value = ogs_pfcp_object_teid_hash_set(
                     OGS_PFCP_OBJ_PDR_TYPE, pdr, restoration_indication);
+            if (cause_value != OGS_PFCP_CAUSE_REQUEST_ACCEPTED)
+                goto cleanup;
+        }
     }
 
     /* Send Buffered Packet to gNB */
     ogs_list_for_each(&sess->pfcp.pdr_list, pdr) {
         if (pdr->src_if == OGS_PFCP_INTERFACE_CORE) { /* Downlink */
-            ogs_pfcp_send_buffered_packet(pdr);
+            ogs_pfcp_send_buffered_gtpu(pdr);
         }
     }
 
@@ -199,6 +202,14 @@
         goto cleanup;
 
     for (i = 0; i < OGS_MAX_NUM_OF_PDR; i++) {
+        if (ogs_pfcp_handle_update_pdr(&sess->pfcp, &req->update_pdri,
+                    &cause_value, &offending_ie_value) == NULL)
+            break;
+    }
+    if (cause_value != OGS_PFCP_CAUSE_REQUEST_ACCEPTED)
+        goto cleanup;
+
+    for (i = 0; i < OGS_MAX_NUM_OF_PDR; i++) {
         if (ogs_pfcp_handle_remove_pdr(&sess->pfcp, &req->remove_pdri,
                 &cause_value, &offending_ie_value) == false)
             break;
@@ -300,14 +311,18 @@
         ogs_assert(pdr);
 
         /* Setup TEID Hash */
-        if (pdr->f_teid_len)
-            ogs_pfcp_object_teid_hash_set(OGS_PFCP_OBJ_PDR_TYPE, pdr, false);
+        if (pdr->f_teid_len) {
+            cause_value = ogs_pfcp_object_teid_hash_set(
+                    OGS_PFCP_OBJ_PDR_TYPE, pdr, false);
+            if (cause_value != OGS_PFCP_CAUSE_REQUEST_ACCEPTED)
+                goto cleanup;
+        }
     }
 
     /* Send Buffered Packet to gNB */
     ogs_list_for_each(&sess->pfcp.pdr_list, pdr) {
         if (pdr->src_if == OGS_PFCP_INTERFACE_CORE) { /* Downlink */
-            ogs_pfcp_send_buffered_packet(pdr);
+            ogs_pfcp_send_buffered_gtpu(pdr);
         }
     }

open5gs_2.7.6.tar.xz/src/smf/binding.c -> open5gs_2.7.7.tar.xz/src/smf/binding.c Changed

@@ -21,6 +21,7 @@
 #include "s5c-build.h"
 #include "pfcp-path.h"
 #include "gtp-path.h"
+#include "sbi-path.h"
 
 #include "ipfw/ipfw2.h"
 
@@ -41,7 +42,7 @@
 
     bearer = smf_bearer_find_by_id(bearer_id);
     if (!bearer) {
-        ogs_error("Bearer has already been removed %d", type);
+        ogs_warn("Bearer has already been removed %d", type);
         return;
     }
 
@@ -586,9 +587,9 @@
                 } else {
                     ogs_assert(OGS_OK ==
                         ogs_pfcp_sockaddr_to_f_teid(
-                            sess->upf_n3_addr, sess->upf_n3_addr6,
+                            sess->local_ul_addr, sess->local_ul_addr6,
                             &ul_pdr->f_teid, &ul_pdr->f_teid_len));
-                    ul_pdr->f_teid.teid = sess->upf_n3_teid;
+                    ul_pdr->f_teid.teid = sess->local_ul_teid;
                 }
 
                 qos_flow->pcc_rule.id = ogs_strdup(pcc_rule->id);
@@ -779,6 +780,9 @@
     if (ogs_list_count(&sess->qos_flow_to_modify_list)) {
         ogs_assert(OGS_OK ==
                 smf_5gc_pfcp_send_qos_flow_list_modification_request(
-                    sess, NULL, pfcp_flags, 0));
+                    sess, NULL,
+                    HOME_ROUTED_ROAMING_IN_HSMF(sess) ?
+                        OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|pfcp_flags :
+                        pfcp_flags, 0));
     }
 }

open5gs_2.7.6.tar.xz/src/smf/context.c -> open5gs_2.7.7.tar.xz/src/smf/context.c Changed

@@ -111,6 +111,8 @@
 
 void smf_context_final(void)
 {
+    int i;
+
     ogs_gtp_node_t *gnode = NULL, *next_gnode = NULL;
     ogs_assert(context_initialized == 1);
 
@@ -143,6 +145,11 @@
         ogs_gtp_node_remove(&self.sgw_s5c_list, gnode);
     }
 
+    for (i = 0; i < self.num_of_p_cscf; i++)
+        ogs_free(self.p_cscfi);
+    for (i = 0; i < self.num_of_p_cscf6; i++)
+        ogs_free(self.p_cscf6i);
+
     ogs_pool_final(&smf_gtp_node_pool);
 
     context_initialized = 0;
@@ -547,40 +554,69 @@
                     ogs_yaml_iter_t p_cscf_iter;
                     ogs_yaml_iter_recurse(&smf_iter, &p_cscf_iter);
                     ogs_assert(ogs_yaml_iter_type(&p_cscf_iter) !=
-                        YAML_MAPPING_NODE);
+                            YAML_MAPPING_NODE);
 
                     self.num_of_p_cscf = 0;
                     self.num_of_p_cscf6 = 0;
                     do {
                         const char *v = NULL;
+                        ogs_sockaddr_t *resolved_list = NULL;
+                        ogs_sockaddr_t *cur = NULL;
+                        char bufOGS_ADDRSTRLEN;
+                        int res;
 
                         if (ogs_yaml_iter_type(&p_cscf_iter) ==
                                 YAML_SEQUENCE_NODE) {
                             if (!ogs_yaml_iter_next(&p_cscf_iter))
                                 break;
                         }
-
                         v = ogs_yaml_iter_value(&p_cscf_iter);
-                        if (v) {
-                            ogs_ipsubnet_t ipsub;
-                            rv = ogs_ipsubnet(&ipsub, v, NULL);
-                            ogs_assert(rv == OGS_OK);
+                        if (!v) {
+                            ogs_error("No value for P-CSCF in configuration");
+                            continue;
+                        }
 
-                            if (ipsub.family == AF_INET) {
-                                if (self.num_of_p_cscf >= MAX_NUM_OF_P_CSCF)
-                                    ogs_warn("Ignore P-CSCF : %s", v);
-                                else self.p_cscfself.num_of_p_cscf++ = v;
+                        /* Use the new API to resolve IP or FQDN
+                         * into one or more addresses */
+                        res = ogs_sockaddr_from_ip_or_fqdn(
+                                &resolved_list, AF_UNSPEC, v, 0);
+                        if (res != OGS_OK || !resolved_list) {
+                            ogs_error("Failed to resolve P-CSCF address: %s",
+                                    v);
+                            continue; /* Skip this entry and move to the next */
+                        }
+
+                        /* Iterate through all resolved addresses
+                         * and store them */
+                        for (cur = resolved_list; cur; cur = cur->next) {
+                            if (cur->ogs_sa_family == AF_INET) {
+                                if (self.num_of_p_cscf < MAX_NUM_OF_P_CSCF) {
+                                    self.p_cscfself.num_of_p_cscf++ =
+                                        ogs_ipstrdup(cur);
+                                } else {
+                                    ogs_warn("Ignore P-CSCF IPv4 "
+                                            "(max %d reached): %s",
+                                             MAX_NUM_OF_P_CSCF,
+                                             OGS_ADDR(cur, buf));
+                                }
+                            } else if (cur->ogs_sa_family == AF_INET6) {
+                                if (self.num_of_p_cscf6 < MAX_NUM_OF_P_CSCF) {
+                                    self.p_cscf6self.num_of_p_cscf6++ =
+                                        ogs_ipstrdup(cur);
+                                } else {
+                                    ogs_warn("Ignore P-CSCF IPv6 "
+                                            "(max %d reached): %s",
+                                             MAX_NUM_OF_P_CSCF,
+                                             OGS_ADDR(cur, buf));
+                                }
                             }
-                            else if (ipsub.family == AF_INET6) {
-                                if (self.num_of_p_cscf6 >= MAX_NUM_OF_P_CSCF)
-                                    ogs_warn("Ignore P-CSCF : %s", v);
-                                else self.p_cscf6self.num_of_p_cscf6++ = v;
-                            } else
-                                ogs_warn("Ignore P-CSCF : %s", v);
                         }
+                        /* free the linked list */
+                        ogs_freeaddrinfo(resolved_list);
 
                     } while (ogs_yaml_iter_type(&p_cscf_iter) ==
-                                YAML_SEQUENCE_NODE);
+                            YAML_SEQUENCE_NODE);
+
                 } else if (!strcmp(smf_key, "info")) {
                     ogs_sbi_nf_instance_t *nf_instance = NULL;
 
@@ -1464,6 +1500,10 @@
     sess->sm_context_ref = ogs_msprintf("%d", sess->index);
     ogs_assert(sess->sm_context_ref);
 
+    /* Set PduSessionRef in 5GC */
+    sess->pdu_session_ref = ogs_msprintf("%d", sess->index);
+    ogs_assert(sess->pdu_session_ref);
+
     /* Create BAR in PFCP Session */
     ogs_pfcp_bar_new(&sess->pfcp);
 
@@ -1493,7 +1533,7 @@
     return sess;
 }
 
-smf_sess_t *smf_sess_add_by_sbi_message(ogs_sbi_message_t *message)
+smf_sess_t *smf_sess_add_by_sm_context(ogs_sbi_message_t *message)
 {
     smf_ue_t *smf_ue = NULL;
     smf_sess_t *sess = NULL;
@@ -1513,6 +1553,12 @@
     }
 
     if (SmContextCreateData->is_pdu_session_id == false) {
+        ogs_error("No PDU session identitiy");
+        return NULL;
+    }
+
+    if (SmContextCreateData->pdu_session_id ==
+            OGS_NAS_PDU_SESSION_IDENTITY_UNASSIGNED) {
         ogs_error("PDU session identity is unassigned");
         return NULL;
     }
@@ -1540,6 +1586,60 @@
     return sess;
 }
 
+smf_sess_t *smf_sess_add_by_pdu_session(ogs_sbi_message_t *message)
+{
+    smf_ue_t *smf_ue = NULL;
+    smf_sess_t *sess = NULL;
+
+    OpenAPI_pdu_session_create_data_t *PduSessionCreateData = NULL;
+
+    ogs_assert(message);
+    PduSessionCreateData = message->PduSessionCreateData;
+    if (!PduSessionCreateData) {
+        ogs_error("No PduSessionCreateData");
+        return NULL;
+    }
+
+    if (!PduSessionCreateData->supi) {
+        ogs_error("No SUPI");
+        return NULL;
+    }
+
+    if (PduSessionCreateData->is_pdu_session_id == false) {
+        ogs_error("No PDU session identitiy");
+        return NULL;
+    }
+
+    if (PduSessionCreateData->pdu_session_id ==
+            OGS_NAS_PDU_SESSION_IDENTITY_UNASSIGNED) {
+        ogs_error("PDU session identitiy is unassigned");
+        return NULL;
+    }
+
+    smf_ue = smf_ue_find_by_supi(PduSessionCreateData->supi);
+    if (!smf_ue) {
+        smf_ue = smf_ue_add_by_supi(PduSessionCreateData->supi);
+        if (!smf_ue) {
+            ogs_error("smf_ue_add_by_supi() failed");
+            return NULL;
+        }
+    }
+
+    sess = smf_sess_find_by_psi(smf_ue, PduSessionCreateData->pdu_session_id);
+    if (sess) {
+        ogs_warn("OLD Session Will Release SUPI:%s,PDU Session identity:%d",
+                PduSessionCreateData->supi,
+                PduSessionCreateData->pdu_session_id);
+        smf_metrics_inst_by_slice_add(&sess->serving_plmn_id, &sess->s_nssai,
+                SMF_METR_GAUGE_SM_SESSIONNBR, -1);
+        smf_sess_remove(sess);
+    }
+
+    sess = smf_sess_add_by_psi(smf_ue, PduSessionCreateData->pdu_session_id);
+
+    return sess;
+}
+
 uint8_t smf_sess_set_ue_ip(smf_sess_t *sess)
 {
     ogs_pfcp_subnet_t *subnet6 = NULL;
@@ -1747,12 +1847,15 @@
 
     if (sess->sm_context_ref)
         ogs_free(sess->sm_context_ref);
-
     if (sess->sm_context_status_uri)
         ogs_free(sess->sm_context_status_uri);
     if (sess->namf.client)
         ogs_sbi_client_remove(sess->namf.client);
 
+    CLEAR_PDU_SESSION(sess);
+    if (sess->pdu_session.client)
+        ogs_sbi_client_remove(sess->pdu_session.client);
+
     PCF_SM_POLICY_CLEAR(sess);
     if (sess->policy_association.client)
         ogs_sbi_client_remove(sess->policy_association.client);
@@ -1783,20 +1886,48 @@
         ogs_free(sess->session.ipv6_framed_routes);
     }
 
-    if (sess->upf_n3_addr)
-        ogs_freeaddrinfo(sess->upf_n3_addr);
-    if (sess->upf_n3_addr6)
-        ogs_freeaddrinfo(sess->upf_n3_addr6);
-
-    if (sess->handover.upf_dl_addr)
-        ogs_freeaddrinfo(sess->handover.upf_dl_addr);
-    if (sess->handover.upf_dl_addr6)
-        ogs_freeaddrinfo(sess->handover.upf_dl_addr6);
+    if (sess->handover.local_dl_addr)
+        ogs_freeaddrinfo(sess->handover.local_dl_addr);
+    if (sess->handover.local_dl_addr6)
+        ogs_freeaddrinfo(sess->handover.local_dl_addr6);
+
+    if (sess->local_dl_addr)
+        ogs_freeaddrinfo(sess->local_dl_addr);
+    if (sess->local_dl_addr6)
+        ogs_freeaddrinfo(sess->local_dl_addr6);
+    if (sess->local_ul_addr)
+        ogs_freeaddrinfo(sess->local_ul_addr);
+    if (sess->local_ul_addr6)
+        ogs_freeaddrinfo(sess->local_ul_addr6);
 
     if (sess->pcf_id)
         ogs_free(sess->pcf_id);
-    if (sess->serving_nf_id)
-        ogs_free(sess->serving_nf_id);
+    if (sess->amf_nf_id)
+        ogs_free(sess->amf_nf_id);
+
+    /* H-SMF */
+    if (sess->h_smf_uri)
+        ogs_free(sess->h_smf_uri);
+    if (sess->h_smf.client)
+        ogs_sbi_client_remove(sess->h_smf.client);
+    if (sess->vsmf_pdu_session_uri)
+        ogs_free(sess->vsmf_pdu_session_uri);
+    if (sess->v_smf.client)
+        ogs_sbi_client_remove(sess->v_smf.client);
+
+    if (sess->n1SmBufFromUe)
+        ogs_pkbuf_free(sess->n1SmBufFromUe);
+
+    OGS_NAS_CLEAR_DATA(&sess->h_smf_extended_protocol_configuration_options);
+    sess->h_smf_gsm_cause = 0;
+
+    CLEAR_QOS_FLOWS_SETUP_LIST(sess->h_smf_qos_flows_setup_list);
+    CLEAR_QOS_FLOWS_ADD_MOD_REQUEST_LIST(
+            sess->h_smf_qos_flows_add_mod_request_list);
+    CLEAR_QOS_FLOWS_REL_REQUEST_LIST(sess->h_smf_qos_flows_rel_request_list);
+
+    if (sess->pending_modification_xact)
+        ogs_sbi_xact_remove(sess->pending_modification_xact);
 
     /* Free SBI object memory */
     ogs_sbi_object_free(&sess->sbi);
@@ -1900,6 +2031,12 @@
     return smf_sess_find(atoll(sm_context_ref));
 }
 
+smf_sess_t *smf_sess_find_by_pdu_session_ref(char *pdu_session_ref)
+{
+    ogs_assert(pdu_session_ref);
+    return smf_sess_find(atoll(pdu_session_ref));
+}
+
 smf_sess_t *smf_sess_find_by_ipv4(uint32_t addr)
 {
     ogs_assert(self.ipv4_hash);
@@ -1985,22 +2122,14 @@
     ul_pdr->src_if = OGS_PFCP_INTERFACE_ACCESS;
 
     ul_pdr->src_if_type_presence = true;
-    ul_pdr->src_if_type = OGS_PFCP_3GPP_INTERFACE_TYPE_N3_3GPP_ACCESS;
+    if (HOME_ROUTED_ROAMING_IN_HSMF(sess))
+        ul_pdr->src_if_type = OGS_PFCP_3GPP_INTERFACE_TYPE_N9_FOR_ROAMING;
+    else
+        ul_pdr->src_if_type = OGS_PFCP_3GPP_INTERFACE_TYPE_N3_3GPP_ACCESS;
 
     ul_pdr->outer_header_removal_len = 1;
-    if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
-        ul_pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV4;
-    } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
-        ul_pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV6;
-    } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
-        ul_pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
-    } else {
-        ogs_error("Invalid session_type %d", sess->session.session_type);
-        ogs_assert_if_reached();
-    }
+    ul_pdr->outer_header_removal.description =
+        OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
 
     /* FAR */
     dl_far = ogs_pfcp_far_add(&sess->pfcp);
@@ -2014,7 +2143,10 @@
     dl_far->dst_if = OGS_PFCP_INTERFACE_ACCESS;
 
     dl_far->dst_if_type_presence = true;
-    dl_far->dst_if_type = OGS_PFCP_3GPP_INTERFACE_TYPE_N3_3GPP_ACCESS;
+    if (HOME_ROUTED_ROAMING_IN_HSMF(sess))
+        dl_far->dst_if_type = OGS_PFCP_3GPP_INTERFACE_TYPE_N9_FOR_ROAMING;
+    else
+        dl_far->dst_if_type = OGS_PFCP_3GPP_INTERFACE_TYPE_N3_3GPP_ACCESS;
 
     ogs_pfcp_pdr_associate_far(dl_pdr, dl_far);
 
@@ -2075,6 +2207,105 @@
     return qos_flow;
 }
 
+smf_bearer_t *smf_vcn_tunnel_add(smf_sess_t *sess)
+{
+    smf_bearer_t *qos_flow = NULL;
+
+    ogs_pfcp_pdr_t *dl_pdr = NULL;
+    ogs_pfcp_pdr_t *ul_pdr = NULL;
+    ogs_pfcp_far_t *dl_far = NULL;
+    ogs_pfcp_far_t *ul_far = NULL;
+
+    ogs_assert(sess);
+
+    ogs_pool_id_calloc(&smf_bearer_pool, &qos_flow);
+    ogs_assert(qos_flow);
+
+    /*
+     * Since smf_pf_identifier_pool_final() is executed by smf_bearer_remove(),
+     * so even if there is no PF Rule in vcnTunnel,
+     * we at least need to initialize it using smf_pf_identifier_pool_init().
+     */
+    smf_pf_identifier_pool_init(qos_flow);
+
+    ogs_list_init(&qos_flow->pf_list);
+
+    /* PDR */
+    dl_pdr = ogs_pfcp_pdr_add(&sess->pfcp);
+    ogs_assert(dl_pdr);
+    qos_flow->dl_pdr = dl_pdr;
+
+    ogs_assert(sess->session.name);
+    dl_pdr->apn = ogs_strdup(sess->session.name);
+    ogs_assert(dl_pdr->apn);
+
+    dl_pdr->src_if = OGS_PFCP_INTERFACE_CORE;
+
+    dl_pdr->src_if_type_presence = true;
+    dl_pdr->src_if_type = OGS_PFCP_3GPP_INTERFACE_TYPE_N9_FOR_ROAMING;
+
+    ul_pdr = ogs_pfcp_pdr_add(&sess->pfcp);
+    ogs_assert(ul_pdr);
+    qos_flow->ul_pdr = ul_pdr;
+
+    ogs_assert(sess->session.name);
+    ul_pdr->apn = ogs_strdup(sess->session.name);
+    ogs_assert(ul_pdr->apn);
+
+    ul_pdr->src_if = OGS_PFCP_INTERFACE_ACCESS;
+
+    ul_pdr->src_if_type_presence = true;
+    ul_pdr->src_if_type = OGS_PFCP_3GPP_INTERFACE_TYPE_N3_3GPP_ACCESS;
+
+    /* FAR */
+    dl_far = ogs_pfcp_far_add(&sess->pfcp);
+    ogs_assert(dl_far);
+    qos_flow->dl_far = dl_far;
+
+    ogs_assert(sess->session.name);
+    dl_far->apn = ogs_strdup(sess->session.name);
+    ogs_assert(dl_far->apn);
+
+    dl_far->dst_if = OGS_PFCP_INTERFACE_ACCESS;
+
+    dl_far->dst_if_type_presence = true;
+    dl_far->dst_if_type = OGS_PFCP_3GPP_INTERFACE_TYPE_N3_3GPP_ACCESS;
+
+    ogs_pfcp_pdr_associate_far(dl_pdr, dl_far);
+
+    ogs_assert(sess->pfcp.bar);
+    dl_far->apply_action =
+        OGS_PFCP_APPLY_ACTION_BUFF| OGS_PFCP_APPLY_ACTION_NOCP;
+
+    ul_far = ogs_pfcp_far_add(&sess->pfcp);
+    ogs_assert(ul_far);
+    qos_flow->ul_far = ul_far;
+
+    ogs_assert(sess->session.name);
+    ul_far->apn = ogs_strdup(sess->session.name);
+    ogs_assert(ul_far->apn);
+
+    ul_far->dst_if = OGS_PFCP_INTERFACE_CORE;
+
+    ul_far->dst_if_type_presence = true;
+    ul_far->dst_if_type = OGS_PFCP_3GPP_INTERFACE_TYPE_N9_FOR_ROAMING;
+
+    ogs_pfcp_pdr_associate_far(ul_pdr, ul_far);
+
+    ul_far->apply_action =
+        OGS_PFCP_APPLY_ACTION_BUFF| OGS_PFCP_APPLY_ACTION_NOCP;
+
+    /* URR --- SKIPPED */
+
+    /* QER --- SKIPPED */
+
+    qos_flow->sess_id = sess->id;
+
+    ogs_list_add(&sess->bearer_list, qos_flow);
+
+    return qos_flow;
+}
+
 void smf_sess_create_indirect_data_forwarding(smf_sess_t *sess)
 {
     smf_bearer_t *qos_flow = NULL;
@@ -2102,19 +2333,8 @@
             OGS_PFCP_3GPP_INTERFACE_TYPE_SGW_UPF_GTP_U_FOR_UL_DATA_FORWARDING;
 
         pdr->outer_header_removal_len = 1;
-        if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
-            pdr->outer_header_removal.description =
-                OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV4;
-        } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
-            pdr->outer_header_removal.description =
-                OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV6;
-        } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
-            pdr->outer_header_removal.description =
-                OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
-        } else {
-            ogs_error("Invalid session_type %d", sess->session.session_type);
-            ogs_assert_if_reached();
-        }
+        pdr->outer_header_removal.description =
+            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
 
         far = ogs_pfcp_far_add(&sess->pfcp);
         ogs_assert(far);
@@ -2134,11 +2354,11 @@
         far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
 
         qer = qos_flow->qer;
-        ogs_assert(qer);
+        if (qer) {
+            ogs_pfcp_pdr_associate_qer(pdr, qer);
 
-        ogs_pfcp_pdr_associate_qer(pdr, qer);
-
-        pdr->qfi = qos_flow->qfi;
+            pdr->qfi = qos_flow->qfi;
+        }
 
         ogs_assert(sess->pfcp_node);
         if (sess->pfcp_node->up_function_features.ftup) {
@@ -2167,17 +2387,17 @@
              * CHOOSE_ID is set in INDIRECT so that all PDRs must be set
              * to the same TEID.
              *
-             * If sess->handover.upf_dl_teid is set in the PDR of
+             * If sess->handover.local_dl_teid is set in the PDR of
              * the first QoS flow, the PDRs of the remaining QoS flows use
              * the same TEID.
              */
             if (ogs_list_first(&sess->bearer_list) == qos_flow) {
                 ogs_gtpu_resource_t *resource = NULL;
 
-                if (sess->handover.upf_dl_addr)
-                    ogs_freeaddrinfo(sess->handover.upf_dl_addr);
-                if (sess->handover.upf_dl_addr6)
-                    ogs_freeaddrinfo(sess->handover.upf_dl_addr6);
+                if (sess->handover.local_dl_addr)
+                    ogs_freeaddrinfo(sess->handover.local_dl_addr);
+                if (sess->handover.local_dl_addr6)
+                    ogs_freeaddrinfo(sess->handover.local_dl_addr6);
 
                 resource = ogs_pfcp_find_gtpu_resource(
                         &sess->pfcp_node->gtpu_resource_list,
@@ -2185,46 +2405,46 @@
 
                 if (resource) {
                     ogs_user_plane_ip_resource_info_to_sockaddr(&resource->info,
-                        &sess->handover.upf_dl_addr,
-                        &sess->handover.upf_dl_addr6);
+                        &sess->handover.local_dl_addr,
+                        &sess->handover.local_dl_addr6);
                     if (resource->info.teidri)
-                        sess->handover.upf_dl_teid =
+                        sess->handover.local_dl_teid =
                             OGS_PFCP_GTPU_INDEX_TO_TEID(
                                 pdr->teid, resource->info.teidri,
                                 resource->info.teid_range);
                     else
-                        sess->handover.upf_dl_teid = pdr->teid;
+                        sess->handover.local_dl_teid = pdr->teid;
                 } else {
                     ogs_assert(sess->pfcp_node->addr_list);
                     if (sess->pfcp_node->addr_list->ogs_sa_family == AF_INET)
                         ogs_assert(OGS_OK == ogs_copyaddrinfo(
-                            &sess->handover.upf_dl_addr,
+                            &sess->handover.local_dl_addr,
                             sess->pfcp_node->addr_list));
                     else if (sess->pfcp_node->addr_list->ogs_sa_family ==
                             AF_INET6)
                         ogs_assert(OGS_OK == ogs_copyaddrinfo(
-                            &sess->handover.upf_dl_addr6,
+                            &sess->handover.local_dl_addr6,
                             sess->pfcp_node->addr_list));
                     else
                         ogs_assert_if_reached();
 
-                    sess->handover.upf_dl_teid = pdr->teid;
+                    sess->handover.local_dl_teid = pdr->teid;
                 }
             }
 
             ogs_assert(OGS_OK ==
                 ogs_pfcp_sockaddr_to_f_teid(
-                    sess->handover.upf_dl_addr, sess->handover.upf_dl_addr6,
+                    sess->handover.local_dl_addr, sess->handover.local_dl_addr6,
                     &pdr->f_teid, &pdr->f_teid_len));
-            pdr->f_teid.teid = sess->handover.upf_dl_teid;
+            pdr->f_teid.teid = sess->handover.local_dl_teid;
         }
 
         ogs_assert(OGS_OK ==
             ogs_pfcp_ip_to_outer_header_creation(
-                    &sess->handover.gnb_dl_ip,
+                    &sess->handover.remote_dl_ip,
                     &far->outer_header_creation,
                     &far->outer_header_creation_len));
-        far->outer_header_creation.teid = sess->handover.gnb_dl_teid;
+        far->outer_header_creation.teid = sess->handover.remote_dl_teid;
 
         /* Indirect Data Forwarding PDRs is set to highest precedence
          * (lowest precedence value) */
@@ -2297,19 +2517,8 @@
     cp2up_pdr->src_if = OGS_PFCP_INTERFACE_CP_FUNCTION;
 
     cp2up_pdr->outer_header_removal_len = 1;
-    if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
-        cp2up_pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV4;
-    } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
-        cp2up_pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV6;
-    } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
-        cp2up_pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
-    } else {
-        ogs_error("Invalid session_type %d", sess->session.session_type);
-        ogs_assert_if_reached();
-    }
+    cp2up_pdr->outer_header_removal.description =
+        OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
 
     up2cp_pdr = ogs_pfcp_pdr_add(&sess->pfcp);
     ogs_assert(up2cp_pdr);
@@ -2321,22 +2530,14 @@
     up2cp_pdr->src_if = OGS_PFCP_INTERFACE_ACCESS;
 
     up2cp_pdr->src_if_type_presence = true;
-    up2cp_pdr->src_if_type = OGS_PFCP_3GPP_INTERFACE_TYPE_N3_3GPP_ACCESS;
+    if (HOME_ROUTED_ROAMING_IN_HSMF(sess))
+        up2cp_pdr->src_if_type = OGS_PFCP_3GPP_INTERFACE_TYPE_N9_FOR_ROAMING;
+    else
+        up2cp_pdr->src_if_type = OGS_PFCP_3GPP_INTERFACE_TYPE_N3_3GPP_ACCESS;
 
     up2cp_pdr->outer_header_removal_len = 1;
-    if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
-        up2cp_pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV4;
-    } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
-        up2cp_pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV6;
-    } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
-        up2cp_pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
-    } else {
-        ogs_error("Invalid session_type %d", sess->session.session_type);
-        ogs_assert_if_reached();
-    }
+    up2cp_pdr->outer_header_removal.description =
+        OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
 
     qos_flow = smf_default_bearer_in_sess(sess);
     ogs_assert(qos_flow);
@@ -2472,19 +2673,8 @@
     ul_pdr->src_if_type = OGS_PFCP_3GPP_INTERFACE_TYPE_N3_3GPP_ACCESS;
 
     ul_pdr->outer_header_removal_len = 1;
-    if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
-        ul_pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV4;
-    } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
-        ul_pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IPV6;
-    } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
-        ul_pdr->outer_header_removal.description =
-            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
-    } else {
-        ogs_error("Invalid session_type %d", sess->session.session_type);
-        ogs_assert_if_reached();
-    }
+    ul_pdr->outer_header_removal.description =
+        OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
 
     /* FAR */
     dl_far = ogs_pfcp_far_add(&sess->pfcp);

open5gs_2.7.6.tar.xz/src/smf/context.h -> open5gs_2.7.7.tar.xz/src/smf/context.h Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -64,6 +64,61 @@
 
 int smf_ctf_config_init(smf_ctf_config_t *ctf_config);
 
+typedef struct smf_nsmf_pdusession_param_s {
+    OpenAPI_request_indication_e request_indication;
+
+    OpenAPI_cause_e cause;
+
+    struct {
+        int group;
+        int value;
+    } ngap_cause;
+
+    int gmm_cause;
+    int gsm_cause;
+
+    struct {
+    ED4(uint8_t serving_network:1;,
+        uint8_t ue_location:1;,
+        uint8_t ue_timezone:1;,
+        uint8_t spare:4;)
+    };
+
+    uint32_t dl_teid;
+    ogs_ip_t dl_ip;
+
+    OpenAPI_access_type_e an_type;
+    OpenAPI_rat_type_e rat_type;
+
+    OpenAPI_up_cnx_state_e up_cnx_state;
+
+#define QOS_RULE_CODE_FROM_PFCP_FLAGS(pfcp_flags) \
+        (pfcp_flags & OGS_PFCP_MODIFY_CREATE) ? \
+            OGS_NAS_QOS_CODE_CREATE_NEW_QOS_RULE : \
+        (pfcp_flags & OGS_PFCP_MODIFY_REMOVE) ? \
+            OGS_NAS_QOS_CODE_DELETE_EXISTING_QOS_RULE : \
+        (pfcp_flags & OGS_PFCP_MODIFY_TFT_NEW) ? \
+            OGS_NAS_QOS_CODE_CREATE_NEW_QOS_RULE : \
+        (pfcp_flags & OGS_PFCP_MODIFY_TFT_ADD) ? \
+            OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_ADD_PACKET_FILTERS : \
+        (pfcp_flags & OGS_PFCP_MODIFY_TFT_REPLACE) ? \
+            OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_REPLACE_ALL_PACKET_FILTERS : \
+        (pfcp_flags & OGS_PFCP_MODIFY_TFT_DELETE) ? \
+            OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_DELETE_PACKET_FILTERS : 0
+    uint8_t qos_rule_code;
+#define QOS_RULE_FLOW_DESCRIPTION_CODE_FROM_PFCP_FLAGS(pfcp_flags) \
+        (pfcp_flags & OGS_PFCP_MODIFY_CREATE) ? \
+            OGS_NAS_CREATE_NEW_QOS_FLOW_DESCRIPTION : \
+        (pfcp_flags & OGS_PFCP_MODIFY_REMOVE) ? \
+            OGS_NAS_DELETE_NEW_QOS_FLOW_DESCRIPTION : \
+        (pfcp_flags & OGS_PFCP_MODIFY_QOS_MODIFY) ? \
+            OGS_NAS_MODIFY_NEW_QOS_FLOW_DESCRIPTION : 0
+    uint8_t qos_flow_description_code;
+
+    uint64_t pfcp_flags;
+
+} smf_nsmf_pdusession_param_t;
+
 typedef struct smf_context_s {
     smf_ctf_config_t    ctf_config;
     const char*         diam_conf_path;   /* SMF Diameter conf path */
@@ -74,10 +129,10 @@
     const char      *dns6MAX_NUM_OF_DNS;
 
 #define MAX_NUM_OF_P_CSCF           16
-    const char      *p_cscfMAX_NUM_OF_P_CSCF;
+    char            *p_cscfMAX_NUM_OF_P_CSCF;
     int             num_of_p_cscf;
     int             p_cscf_index;
-    const char      *p_cscf6MAX_NUM_OF_P_CSCF;
+    char            *p_cscf6MAX_NUM_OF_P_CSCF;
     int             num_of_p_cscf6;
     int             p_cscf6_index;
 
@@ -260,12 +315,16 @@
     uint64_t        smf_n4_seid;    /* SMF SEID is derived from NODE */
     uint64_t        upf_n4_seid;    /* UPF SEID is received from Peer */
 
-    uint32_t        upf_n3_teid;    /* UPF-N3 TEID */
-    ogs_sockaddr_t  *upf_n3_addr;   /* UPF-N3 IPv4 */
-    ogs_sockaddr_t  *upf_n3_addr6;  /* UPF-N3 IPv6 */
-
-    uint32_t        gnb_n3_teid;    /* gNB-N3 TEID */
-    ogs_ip_t        gnb_n3_ip;      /* gNB-N3 IPv4/IPv6 */
+    uint32_t        local_dl_teid;      /* Local Downlink TEID */
+    ogs_sockaddr_t  *local_dl_addr;     /* Local Downlink IPv4 */
+    ogs_sockaddr_t  *local_dl_addr6;    /* Local Downlink IPv6 */
+    uint32_t        remote_dl_teid;     /* Remote Downlink TEID */
+    ogs_ip_t        remote_dl_ip;       /* Remote Downlink IPv4/IPv6 */
+    uint32_t        local_ul_teid;      /* Local Uplink TEID */
+    ogs_sockaddr_t  *local_ul_addr;     /* Local Uplink IPv4 */
+    ogs_sockaddr_t  *local_ul_addr6;    /* Local Uplink IPv6 */
+    uint32_t        remote_ul_teid;     /* Remote Uplink TEID */
+    ogs_ip_t        remote_ul_ip;       /* Remote Uplink IPv4/IPv6 */
 
     char            *gx_sid;        /* Gx Session ID */
     char            *gy_sid;        /* Gx Session ID */
@@ -281,15 +340,48 @@
     } while(0)
     OGS_POOL(qfi_pool, uint8_t);
 
-    char            *sm_context_ref; /* smContextRef */
     uint8_t         psi; /* PDU session identity */
     uint8_t         pti; /* 5GS-NAS : Procedure transaction identity */
+    uint8_t         request_type;   /* Request type */
 
+    char            *sm_context_ref; /* smContextRef */
     char            *sm_context_status_uri; /* SmContextStatusNotification */
     struct {
         ogs_sbi_client_t *client;
     } namf;
 
+#define PDU_SESSION_IN_VSMF(__sESS)  \
+    ((__sESS) && (__sESS)->pdu_session_ref)
+#define STORE_PDU_SESSION(__sESS, __rESOURCE_URI, __rEF) \
+    do { \
+        ogs_assert(__sESS); \
+        ogs_assert(__rESOURCE_URI); \
+        ogs_assert(__rEF); \
+        CLEAR_PDU_SESSION(__sESS); \
+        (__sESS)->pdu_session_resource_uri = ogs_strdup(__rESOURCE_URI); \
+        ogs_assert((__sESS)->pdu_session_resource_uri); \
+        (__sESS)->pdu_session_ref = ogs_strdup(__rEF); \
+        ogs_assert((__sESS)->pdu_session_ref); \
+    } while(0);
+#define CLEAR_PDU_SESSION(__sESS) \
+    do { \
+        ogs_assert(__sESS); \
+        if ((__sESS)->pdu_session_ref) \
+            ogs_free((__sESS)->pdu_session_ref); \
+        (__sESS)->pdu_session_ref = NULL; \
+        if ((__sESS)->pdu_session_resource_uri) \
+            ogs_free((__sESS)->pdu_session_resource_uri); \
+        (__sESS)->pdu_session_resource_uri = NULL; \
+    } while(0);
+    char *pdu_session_ref;
+    char *pdu_session_resource_uri;
+
+    /* SMF sends the RESPONSE
+     * of POST /nsmf-pdusession/v1/pdu-sessions */
+    struct {
+        ogs_sbi_client_t *client;
+    } pdu_session;
+
     /* PCF sends the RESPONSE
      * of POST /npcf-smpolocycontrol/v1/policies */
 #define PCF_SM_POLICY_ASSOCIATED(__sESS) \
@@ -367,16 +459,88 @@
     ogs_nr_cgi_t    nr_cgi;
     ogs_time_t      ue_location_timestamp;
 
+#define HOME_ROUTED_ROAMING_IN_VSMF(__sESS) \
+    ((__sESS) && (__sESS)->h_smf_uri)
+    char            *h_smf_uri;
+    struct {
+        ogs_sbi_client_t *client;
+    } h_smf;
+
+    char            *h_smf_id;
+
+    /* Saved from H-SMF */
+    ogs_nas_extended_protocol_configuration_options_t
+        h_smf_extended_protocol_configuration_options;
+    ogs_nas_5gsm_cause_t h_smf_gsm_cause;
+
+    /* Saved from H-SMF */
+#define CLEAR_QOS_FLOWS_SETUP_LIST(__lIST) \
+    do { \
+        OpenAPI_lnode_t *node = NULL; \
+        OpenAPI_list_for_each((__lIST), node) { \
+            OpenAPI_qos_flow_setup_item_t *qosFlowSetupItem = node->data; \
+            if (qosFlowSetupItem) \
+                OpenAPI_qos_flow_setup_item_free(qosFlowSetupItem); \
+        } \
+        OpenAPI_list_free((__lIST)); \
+        (__lIST) = NULL; \
+    } while(0)
+    OpenAPI_list_t *h_smf_qos_flows_setup_list;
+#define CLEAR_QOS_FLOWS_ADD_MOD_REQUEST_LIST(__lIST) \
+    do { \
+        OpenAPI_lnode_t *node = NULL; \
+        OpenAPI_list_for_each((__lIST), node) { \
+            OpenAPI_qos_flow_add_modify_request_item_t \
+                *qosFlowAddModifyRequestItem = node->data; \
+            if (qosFlowAddModifyRequestItem) \
+                OpenAPI_qos_flow_add_modify_request_item_free( \
+                        qosFlowAddModifyRequestItem); \
+        } \
+        OpenAPI_list_free((__lIST)); \
+        (__lIST) = NULL; \
+    } while(0)
+    OpenAPI_list_t *h_smf_qos_flows_add_mod_request_list;
+#define CLEAR_QOS_FLOWS_REL_REQUEST_LIST(__lIST) \
+    do { \
+        OpenAPI_lnode_t *node = NULL; \
+        OpenAPI_list_for_each((__lIST), node) { \
+            OpenAPI_qos_flow_release_request_item_t \
+                *qosFlowReleaseRequestItem = node->data; \
+            if (qosFlowReleaseRequestItem) \
+                OpenAPI_qos_flow_release_request_item_free( \
+                        qosFlowReleaseRequestItem); \
+        } \
+        OpenAPI_list_free((__lIST)); \
+        (__lIST) = NULL; \
+    } while(0)
+    OpenAPI_list_t *h_smf_qos_flows_rel_request_list;
+
+#define HOME_ROUTED_ROAMING_IN_HSMF(__sESS) \
+    ((__sESS) && (__sESS)->vsmf_pdu_session_uri)
+    char            *vsmf_pdu_session_uri;
+    struct {
+        ogs_sbi_client_t *client;
+    } v_smf;
+
+    /*
+     * Keeps the n1SmMsg Content (n1smbuf) in the context of the V-SMF
+     * for use when creating the n1SmBufFromUe to send to the H-SMF.
+     */
+    ogs_pkbuf_t     *n1SmBufFromUe;
+
     /* PCF ID */
     char            *pcf_id;
 
     /* Serving NF (AMF) Id */
-    char            *serving_nf_id;
+    char            *amf_nf_id;
+
+    /* Guami */
+    ogs_guami_t     guami;
 
     /* Integrity protection maximum data rate */
     struct {
-        uint8_t mbr_dl;
-        uint8_t mbr_ul;
+        OpenAPI_max_integrity_protected_data_rate_e mbr_dl;
+        OpenAPI_max_integrity_protected_data_rate_e mbr_ul;
     } integrity_protection;
 
     /* S_NSSAI */
@@ -398,6 +562,9 @@
     ogs_pfcp_ue_ip_t *ipv4;
     ogs_pfcp_ue_ip_t *ipv6;
 
+    /* AN Type */
+    OpenAPI_access_type_e an_type;
+
     /* RAT Type */
     uint8_t gtp_rat_type;
     OpenAPI_rat_type_e sbi_rat_type;
@@ -462,11 +629,6 @@
         int pdu_session_resource_release;
     } ngap_state;
 
-#define SMF_UECM_STATE_NONE                                     0
-#define SMF_UECM_STATE_REGISTERED                               1
-#define SMF_UECM_STATE_DEREGISTERED_BY_AMF                      2
-#define SMF_UECM_STATE_DEREGISTERED_BY_N1_N2_RELEASE            3
-
     /* Handover */
     struct {
         bool prepared;
@@ -478,11 +640,11 @@
         ogs_ip_t gnb_n3_ip;
 
         /* Indirect DL Forwarding */
-        uint32_t upf_dl_teid;
-        ogs_sockaddr_t *upf_dl_addr;
-        ogs_sockaddr_t *upf_dl_addr6;
-        uint32_t gnb_dl_teid;
-        ogs_ip_t gnb_dl_ip;
+        uint32_t local_dl_teid;
+        ogs_sockaddr_t *local_dl_addr;
+        ogs_sockaddr_t *local_dl_addr6;
+        uint32_t remote_dl_teid;
+        ogs_ip_t remote_dl_ip;
     } handover;
 
     /* Charging */
@@ -512,8 +674,43 @@
 
     ogs_pool_id_t smf_ue_id;
 
+    OpenAPI_resource_status_e resource_status;
     bool n1_released;
     bool n2_released;
+/*
+ * Section 4.3.3.3 'UE or network requested PDU Session Modification
+ * (home-routed roaming)'
+ * - Step 1a: Nsmf_PDUSession_UpdateSMContext Request (AMF -> V-SMF):
+ * - Step 4a: Nsmf_PDUSession_UpdateSMContext Response (V-SMF -> AMF):
+ */
+    ogs_pool_id_t amf_to_vsmf_modify_stream_id;
+/*
+ * Section 4.3.3.3 'UE or network requested PDU Session Modification
+ * (home-routed roaming)'
+ * - Step 3:  Nsmf_PDUSession_UpdateSMContext Request (V-SMF -> H-SMF):
+ * - Step 15: Nsmf_PDUSession_UpdateSMContext Response (V-SMF -> H-SMF):
+ */
+    ogs_pool_id_t vsmf_to_hsmf_modify_stream_id;
+/*
+ * Section 4.3.4.3 'UE or network requested PDU Session Release for
+ * Home-routed Roaming'
+ * - Step 1a: Nsmf_PDUSession_UpdateSMContext Request (AMF -> V-SMF):
+ * - Step 5b: Nsmf_PDUSession_UpdateSMContext Response (V-SMF -> AMF):
+ */
+    ogs_pool_id_t amf_to_vsmf_release_stream_id;
+/*
+ * Section 4.3.4.3 'UE or network requested PDU Session Release for
+ * Home-routed Roaming'
+ * - Step 3a: Nsmf_PDUSession_UpdateSMContext Request (V-SMF -> H-SMF):
+ * - Step 14: Nsmf_PDUSession_UpdateSMContext Response (V-SMF -> H-SMF):
+ */
+    ogs_pool_id_t vsmf_to_hsmf_release_stream_id;
+
+    smf_nsmf_pdusession_param_t nsmf_param;
+
+    bool establishment_accept_sent;
+    ogs_sbi_xact_t *pending_modification_xact;
+
 } smf_sess_t;
 
 void smf_context_init(void);
@@ -538,7 +735,8 @@
 smf_sess_t *smf_sess_add_by_gtp2_message(ogs_gtp2_message_t *message);
 smf_sess_t *smf_sess_add_by_apn(smf_ue_t *smf_ue, char *apn, uint8_t rat_type);
 
-smf_sess_t *smf_sess_add_by_sbi_message(ogs_sbi_message_t *message);
+smf_sess_t *smf_sess_add_by_sm_context(ogs_sbi_message_t *message);
+smf_sess_t *smf_sess_add_by_pdu_session(ogs_sbi_message_t *message);
 smf_sess_t *smf_sess_add_by_psi(smf_ue_t *smf_ue, uint8_t psi);
 
 void smf_sess_select_upf(smf_sess_t *sess);
@@ -556,6 +754,7 @@
 smf_sess_t *smf_sess_find_by_psi(smf_ue_t *smf_ue, uint8_t psi);
 smf_sess_t *smf_sess_find_by_charging_id(uint32_t charging_id);
 smf_sess_t *smf_sess_find_by_sm_context_ref(char *sm_context_ref);
+smf_sess_t *smf_sess_find_by_pdu_session_ref(char *pdu_session_ref);
 smf_sess_t *smf_sess_find_by_ipv4(uint32_t addr);
 smf_sess_t *smf_sess_find_by_ipv6(uint32_t *addr6);
 smf_sess_t *smf_sess_find_by_paging_n1n2message_location(
@@ -575,6 +774,8 @@
 smf_bearer_t *smf_qos_flow_find_by_pcc_rule_id(
         smf_sess_t *sess, char *pcc_rule_id);
 
+smf_bearer_t *smf_vcn_tunnel_add(smf_sess_t *sess);
+
 smf_bearer_t *smf_bearer_add(smf_sess_t *sess);
 int smf_bearer_remove(smf_bearer_t *bearer);
 void smf_bearer_remove_all(smf_sess_t *sess);

open5gs_2.7.6.tar.xz/src/smf/event.c -> open5gs_2.7.7.tar.xz/src/smf/event.c Changed

open5gs_2.7.6.tar.xz/src/smf/event.h -> open5gs_2.7.7.tar.xz/src/smf/event.h Changed

open5gs_2.7.6.tar.xz/src/smf/fd-path.c -> open5gs_2.7.7.tar.xz/src/smf/fd-path.c Changed

open5gs_2.7.6.tar.xz/src/smf/gn-handler.c -> open5gs_2.7.7.tar.xz/src/smf/gn-handler.c Changed

@@ -109,6 +109,10 @@
         ogs_error("No User Location Info");
         cause_value = OGS_GTP1_CAUSE_MANDATORY_IE_MISSING;
     }
+    if (req->end_user_address.presence == 0) {
+        ogs_error("No End User Address");
+        cause_value = OGS_GTP1_CAUSE_MANDATORY_IE_MISSING;
+    }
 
     if (!ogs_diam_is_relay_or_app_advertised(OGS_DIAM_GX_APPLICATION_ID)) {
         ogs_error("No Gx Diameter Peer");
@@ -137,7 +141,10 @@
     rv = ogs_gtp1_gsn_addr_to_ip(req->sgsn_address_for_signalling.data,
                                  req->sgsn_address_for_signalling.len,
                                   &sess->sgw_s5c_ip);
-    ogs_assert(rv == OGS_OK);
+    if (rv != OGS_OK) {
+        ogs_error("Invalid SGSN Address for signalling");
+        return OGS_GTP1_CAUSE_MANDATORY_IE_INCORRECT;
+    }
     ogs_debug("    SGW_S5C_TEID0x%x SMF_N4_TEID0x%x",
             sess->sgw_s5c_teid, sess->smf_n4_teid);
 
@@ -179,7 +186,8 @@
     }
 
     /* Common Flags 7.7.48 */
-    if (req->common_flags.presence) {
+    if (req->common_flags.presence &&
+        req->common_flags.len >= sizeof(ogs_gtp1_common_flags_t)) {
         sess->gtp.v1.common_flags = *(ogs_gtp1_common_flags_t*)req->common_flags.data;
     }
 
@@ -234,6 +242,12 @@
 
     /* Set IMEI(SV) */
     if (req->imei.presence && req->imei.len > 0) {
+        if (req->imei.len > sizeof(smf_ue->imeisv)) {
+            ogs_error("IMEI(SV) wrong size %u > %zu",
+                    req->imei.len, sizeof(smf_ue->imeisv));
+            return OGS_GTP1_CAUSE_MANDATORY_IE_INCORRECT;
+        }
+
         smf_ue->imeisv_len = req->imei.len;
         memcpy(smf_ue->imeisv,
             (uint8_t*)req->imei.data, smf_ue->imeisv_len);
@@ -246,8 +260,10 @@
     ogs_assert(eua);
     rv = ogs_gtp1_eua_to_ip(eua, req->end_user_address.len, &sess->session.ue_ip,
             &sess->ue_session_type);
-    if(rv != OGS_OK)
+    if (rv != OGS_OK) {
+        ogs_error("Invalid End User Address");
         return OGS_GTP1_CAUSE_MANDATORY_IE_INCORRECT;
+    }
 
     /* Initially Set Session Type from UE */
     sess->session.session_type = sess->ue_session_type;
@@ -269,7 +285,10 @@
     rv = ogs_gtp1_gsn_addr_to_ip(req->sgsn_address_for_user_traffic.data,
                                  req->sgsn_address_for_user_traffic.len,
                                  &bearer->sgw_s5u_ip);
-    ogs_assert(rv == OGS_OK);
+    if (rv != OGS_OK) {
+        ogs_error("Invalid SGSN Address for user traffic");
+        return OGS_GTP1_CAUSE_MANDATORY_IE_INCORRECT;
+    }
     ogs_debug("    SGW_S5U_TEID0x%x PGW_S5U_TEID0x%x",
             bearer->sgw_s5u_teid, bearer->pgw_s5u_teid);
     if (qos_pdec->data_octet6_to_13_present) {
@@ -412,7 +431,8 @@
     }
 
     /* Common Flags 7.7.48 */
-    if (req->common_flags.presence) {
+    if (req->common_flags.presence &&
+        req->common_flags.len >= sizeof(ogs_gtp1_common_flags_t)) {
         sess->gtp.v1.common_flags = *(ogs_gtp1_common_flags_t*)req->common_flags.data;
     } else {
         /* Reset it to overwrite what was received during CreatePDPCtxReq time */
@@ -424,8 +444,14 @@
         sess->sgw_s5c_teid = req->tunnel_endpoint_identifier_control_plane.u32;
         rv = ogs_gtp1_gsn_addr_to_ip(req->sgsn_address_for_control_plane.data,
                                      req->sgsn_address_for_control_plane.len,
-                                      &sess->sgw_s5c_ip);
-        ogs_assert(rv == OGS_OK);
+                                     &sess->sgw_s5c_ip);
+        if (rv != OGS_OK) {
+            ogs_error("Invalid SGSN Address for control plane");
+            ogs_gtp1_send_error_message(xact, sess->sgw_s5c_teid,
+                    OGS_GTP1_UPDATE_PDP_CONTEXT_RESPONSE_TYPE,
+                    OGS_GTP1_CAUSE_MANDATORY_IE_INCORRECT);
+            return;
+        }
         ogs_debug("    Updated SGW_S5C_TEID0x%x SMF_N4_TEID0x%x",
                 sess->sgw_s5c_teid, sess->smf_n4_teid);
     }
@@ -435,7 +461,14 @@
     rv = ogs_gtp1_gsn_addr_to_ip(req->sgsn_address_for_user_traffic.data,
                                  req->sgsn_address_for_user_traffic.len,
                                  &bearer->sgw_s5u_ip);
-    ogs_assert(rv == OGS_OK);
+
+    if (rv != OGS_OK) {
+        ogs_error("Invalid SGSN Address for user traffic");
+        ogs_gtp1_send_error_message(xact, sess->sgw_s5c_teid,
+                OGS_GTP1_UPDATE_PDP_CONTEXT_RESPONSE_TYPE,
+                OGS_GTP1_CAUSE_MANDATORY_IE_INCORRECT);
+        return;
+    }
     ogs_debug("    Updated SGW_S5U_TEID0x%x PGW_S5U_TEID0x%x",
             bearer->sgw_s5u_teid, bearer->pgw_s5u_teid);
 
@@ -445,6 +478,7 @@
     qos_pdec = &sess->gtp.v1.qos_pdec;
     rv = ogs_gtp1_parse_qos_profile(qos_pdec, &req->quality_of_service_profile);
     if(rv < 0) {
+        ogs_error("ogs_gtp1_parse_qos_profile() failed");
         ogs_gtp1_send_error_message(xact, sess->sgw_s5c_teid,
                 OGS_GTP1_UPDATE_PDP_CONTEXT_RESPONSE_TYPE,
                 OGS_GTP1_CAUSE_MANDATORY_IE_INCORRECT);
@@ -499,7 +533,7 @@
     /* Update remote TEID and GTP-U IP address on the UPF. UpdatePDPContextResp
      * will be sent when UPF answers back this request
      */
-     ogs_list_for_each(&sess->pfcp.pdr_list, pdr) {
+    ogs_list_for_each(&sess->pfcp.pdr_list, pdr) {
         ogs_pfcp_far_t *far = pdr->far;
         ogs_assert(far);
 
@@ -510,10 +544,17 @@
             continue;
 
         if (pdr->id == bearer->dl_pdr->id) {
-            rv = ogs_pfcp_ip_to_outer_header_creation(&bearer->sgw_s5u_ip,
-                                                &far->outer_header_creation,
-                                                &far->outer_header_creation_len);
-            ogs_assert(rv == OGS_OK);
+            rv = ogs_pfcp_ip_to_outer_header_creation(
+                    &bearer->sgw_s5u_ip,
+                    &far->outer_header_creation,
+                    &far->outer_header_creation_len);
+            if (rv != OGS_OK) {
+                ogs_error("PFCP outer header creation failed");
+                ogs_gtp1_send_error_message(xact, sess->sgw_s5c_teid,
+                        OGS_GTP1_UPDATE_PDP_CONTEXT_RESPONSE_TYPE,
+                        OGS_GTP1_CAUSE_SYSTEM_FAILURE);
+                return;
+            }
             far->outer_header_creation.teid = bearer->sgw_s5u_teid;
         }
     }
@@ -522,7 +563,13 @@
             OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE,
             OGS_NAS_PROCEDURE_TRANSACTION_IDENTITY_UNASSIGNED,
             OGS_GTP1_CAUSE_REACTIACTION_REQUESTED);
-    ogs_assert(rv == OGS_OK);
+    if (rv != OGS_OK) {
+        ogs_error("PFCP Session Modification Request failed");
+        ogs_gtp1_send_error_message(xact, sess->sgw_s5c_teid,
+                OGS_GTP1_UPDATE_PDP_CONTEXT_RESPONSE_TYPE,
+                OGS_GTP1_CAUSE_SYSTEM_FAILURE);
+        return;
+    }
 
     /* TODO: TS 29.061: Upon reception of an UpdatePDPContextRequest from the
        SGSN, the GGSN may send an Accounting Request (Interim) to the Diameter

open5gs_2.7.6.tar.xz/src/smf/gsm-build.c -> open5gs_2.7.7.tar.xz/src/smf/gsm-build.c Changed

@@ -26,7 +26,7 @@
 {
     ogs_pkbuf_t *pkbuf = NULL;
     smf_bearer_t *qos_flow = NULL;
-    int num_of_param, rv;
+    int rv;
 
     ogs_nas_5gs_message_t message;
     ogs_nas_5gs_pdu_session_establishment_accept_t *
@@ -51,12 +51,18 @@
     uint8_t *epco_buf = NULL;
     int16_t epco_len;
 
+    OpenAPI_list_t *qosFlowsSetupList = NULL;
+    OpenAPI_qos_flow_setup_item_t *qosFlowSetupItem = NULL;
+    OpenAPI_lnode_t *node = NULL;
+    int len;
+
     selected_pdu_session_type = &pdu_session_establishment_accept->
         selected_pdu_session_type;
     ogs_assert(selected_pdu_session_type);
     authorized_qos_rules = &pdu_session_establishment_accept->
         authorized_qos_rules;
     ogs_assert(authorized_qos_rules);
+
     session_ambr = &pdu_session_establishment_accept->session_ambr;
     ogs_assert(session_ambr);
     pdu_address = &pdu_session_establishment_accept->pdu_address;
@@ -90,55 +96,40 @@
     selected_pdu_session_type->type = sess->session.ssc_mode;
     selected_pdu_session_type->value = sess->session.session_type;
 
-    /*
-     * TS23.501
-     * 5.7.1.3 QoS Rules
-     *
-     * A default QoS rule is required to be sent to the UE for every PDU
-     * Session establishment and it is associated with a QoS Flow. For IP type
-     * PDU Session or Ethernet type PDU Session, the default QoS rule is
-     * the only QoS rule of a PDU Session which may contain a Packet Filter
-     * Set that allows all UL packets, and in this case, the highest
-     * precedence value shall be used for the QoS rule.
-     *
-     * As long as the default QoS rule does not contain a Packet Filter Set or
-     * contains a Packet Filter Set that allows all UL packets, Reflective QoS
-     * should not be applied for the QoS Flow which the default QoS rule is
-     * associated with and the RQA should not be sent for this QoS Flow.
-     */
-    memset(qos_rule, 0, sizeof(qos_rule));
-    qos_rule0.identifier = qos_flow->qfi; /* Use QFI in Open5GS */
-    qos_rule0.code = OGS_NAS_QOS_CODE_CREATE_NEW_QOS_RULE;
-    qos_rule0.DQR_bit = 1;
-    qos_rule0.num_of_packet_filter = 1;
-
-    qos_rule0.pf0.direction = OGS_NAS_QOS_DIRECTION_BIDIRECTIONAL;
-    qos_rule0.pf0.identifier = 1;
-    qos_rule0.pf0.content.length = 1;
-    qos_rule0.pf0.content.num_of_component = 1;
-    qos_rule0.pf0.content.component0.type = OGS_PACKET_FILTER_MATCH_ALL;
+    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+        qosFlowsSetupList = sess->h_smf_qos_flows_setup_list;
+        ogs_assert(qosFlowsSetupList);
+
+        node = qosFlowsSetupList->first;
+        ogs_assert(node);
+        qosFlowSetupItem = node->data;
+        ogs_assert(qosFlowSetupItem);
+
+        len = ogs_base64_decode_len(qosFlowSetupItem->qos_rules);
+        ogs_assert(len);
+        authorized_qos_rules->buffer = ogs_calloc(1, len);
+        ogs_assert(authorized_qos_rules->buffer);
+        authorized_qos_rules->length =
+            ogs_base64_decode_binary(
+                    authorized_qos_rules->buffer, qosFlowSetupItem->qos_rules);
+        ogs_assert(authorized_qos_rules->length);
+
+    } else if (HOME_ROUTED_ROAMING_IN_HSMF(sess)) {
+        ogs_fatal("This should not be invoked from H-SMF during HR-Roaming");
+        ogs_assert_if_reached();
+    } else {
+        memset(qos_rule, 0, sizeof(qos_rule));
+        gsm_encode_default_qos_rule(&qos_rule0, qos_flow);
 
-    /*
-     * TS23.501
-     * 5.7.1.9 Precedence Value
-     *
-     * The QoS rule precedence value and the PDR precedence value determine
-     * the order in which a QoS rule or a PDR, respectively, shall be evaluated.
-     * The evaluation of the QoS rules or PDRs is performed in increasing order
-     * of their precedence value.
-     */
-    qos_rule0.precedence = 255; /* lowest precedence */
-    qos_rule0.flow.segregation = 0;
-    qos_rule0.flow.identifier = qos_flow->qfi;
-
-    rv = ogs_nas_build_qos_rules(authorized_qos_rules, qos_rule, 1);
-    if (rv != OGS_OK) {
-        ogs_error("ogs_nas_build_qos_rules() failed");
-        goto cleanup;
-    }
-    if (!authorized_qos_rules->length) {
-        ogs_error("No length");
-        goto cleanup;
+        rv = ogs_nas_build_qos_rules(authorized_qos_rules, qos_rule, 1);
+        if (rv != OGS_OK) {
+            ogs_error("ogs_nas_build_qos_rules() failed");
+            goto cleanup;
+        }
+        if (!authorized_qos_rules->length) {
+            ogs_error("No length");
+            goto cleanup;
+        }
     }
 
     /* Session-AMBR */
@@ -171,15 +162,27 @@
     }
 
     /* GSM cause */
-    if (sess->ue_session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
-        if (pdu_address->pdn_type == OGS_PDU_SESSION_TYPE_IPV4) {
+    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+        if (sess->h_smf_gsm_cause) {
             pdu_session_establishment_accept->presencemask |=
                 OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_5GSM_CAUSE_PRESENT;
-            *gsm_cause = OGS_5GSM_CAUSE_PDU_SESSION_TYPE_IPV4_ONLY_ALLOWED;
-        } else if (pdu_address->pdn_type == OGS_PDU_SESSION_TYPE_IPV6) {
-            pdu_session_establishment_accept->presencemask |=
-                OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_5GSM_CAUSE_PRESENT;
-            *gsm_cause = OGS_5GSM_CAUSE_PDU_SESSION_TYPE_IPV6_ONLY_ALLOWED;
+            *gsm_cause =  sess->h_smf_gsm_cause;
+        }
+        sess->h_smf_gsm_cause = 0; /* Clear GSM Cause */
+    } else if (HOME_ROUTED_ROAMING_IN_HSMF(sess)) {
+        ogs_fatal("This should not be invoked from H-SMF during HR-Roaming");
+        ogs_assert_if_reached();
+    } else {
+        if (sess->ue_session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
+            if (pdu_address->pdn_type == OGS_PDU_SESSION_TYPE_IPV4) {
+                pdu_session_establishment_accept->presencemask |=
+                    OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_5GSM_CAUSE_PRESENT;
+                *gsm_cause = OGS_5GSM_CAUSE_PDU_SESSION_TYPE_IPV4_ONLY_ALLOWED;
+            } else if (pdu_address->pdn_type == OGS_PDU_SESSION_TYPE_IPV6) {
+                pdu_session_establishment_accept->presencemask |=
+                    OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_5GSM_CAUSE_PRESENT;
+                *gsm_cause = OGS_5GSM_CAUSE_PDU_SESSION_TYPE_IPV6_ONLY_ALLOWED;
+            }
         }
     }
 
@@ -190,51 +193,75 @@
         (sess->mapped_hplmn_presence) ? &sess->mapped_hplmn : NULL);
 
     /* QoS flow descriptions */
-    memset(&qos_flow_description, 0, sizeof(qos_flow_description));
-    qos_flow_description0.identifier = qos_flow->qfi;
-    qos_flow_description0.code = OGS_NAS_CREATE_NEW_QOS_FLOW_DESCRIPTION;
-    qos_flow_description0.E_bit = 1;
-
-    num_of_param = 0;
+    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+        ogs_assert(qosFlowSetupItem);
 
-    qos_flow_description0.paramnum_of_param.identifier =
-        OGS_NAX_QOS_FLOW_PARAMETER_ID_5QI;
-    qos_flow_description0.paramnum_of_param.len =
-        sizeof(qos_flow_description0.paramnum_of_param.qos_index);
-    qos_flow_description0.paramnum_of_param.qos_index = qos_flow->qos.index;
-    num_of_param++;
+        if (qosFlowSetupItem->qos_flow_description) {
+            len = ogs_base64_decode_len(qosFlowSetupItem->qos_flow_description);
+            ogs_assert(len);
+            authorized_qos_flow_descriptions->buffer = ogs_calloc(1, len);
+            ogs_assert(authorized_qos_flow_descriptions->buffer);
+            authorized_qos_flow_descriptions->length =
+                ogs_base64_decode_binary(
+                        authorized_qos_flow_descriptions->buffer,
+                        qosFlowSetupItem->qos_flow_description);
+            ogs_assert(authorized_qos_flow_descriptions->length);
 
-    qos_flow_description0.num_of_parameter = num_of_param;
+            pdu_session_establishment_accept->presencemask |=
+                OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_AUTHORIZED_QOS_FLOW_DESCRIPTIONS_PRESENT;
+        }
+    } else if (HOME_ROUTED_ROAMING_IN_HSMF(sess)) {
+        ogs_fatal("This should not be invoked from H-SMF during HR-Roaming");
+        ogs_assert_if_reached();
+    } else {
+        memset(&qos_flow_description, 0, sizeof(qos_flow_description));
+        gsm_encode_default_qos_flow_description(
+                &qos_flow_description0, qos_flow);
 
-    pdu_session_establishment_accept->presencemask |=
-        OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_AUTHORIZED_QOS_FLOW_DESCRIPTIONS_PRESENT;
-    rv = ogs_nas_build_qos_flow_descriptions(
-            authorized_qos_flow_descriptions, qos_flow_description, 1);
-    if (rv != OGS_OK) {
-        ogs_error("ogs_nas_build_qos_flow_descriptions() failed");
-        goto cleanup;
-    }
-    if (!authorized_qos_flow_descriptions->length) {
-        ogs_error("No length");
-        goto cleanup;
+        pdu_session_establishment_accept->presencemask |=
+            OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_AUTHORIZED_QOS_FLOW_DESCRIPTIONS_PRESENT;
+        rv = ogs_nas_build_qos_flow_descriptions(
+                authorized_qos_flow_descriptions, qos_flow_description, 1);
+        if (rv != OGS_OK) {
+            ogs_error("ogs_nas_build_qos_flow_descriptions() failed");
+            goto cleanup;
+        }
+        if (!authorized_qos_flow_descriptions->length) {
+            ogs_error("No length");
+            goto cleanup;
+        }
     }
 
     /* Extended protocol configuration options */
-    if (sess->nas.ue_epco.buffer && sess->nas.ue_epco.length) {
-        epco_buf = ogs_calloc(OGS_MAX_EPCO_LEN, sizeof(uint8_t));
-        ogs_assert(epco_buf);
-        epco_len = smf_pco_build(epco_buf,
-                sess->nas.ue_epco.buffer, sess->nas.ue_epco.length);
-        if (epco_len <= 0) {
-            ogs_error("smf_pco_build() failed");
-            ogs_log_hexdump(OGS_LOG_ERROR,
+    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+        if (sess->h_smf_extended_protocol_configuration_options.buffer &&
+            sess->h_smf_extended_protocol_configuration_options.length) {
+            pdu_session_establishment_accept->presencemask |=
+                OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+            OGS_NAS_STORE_DATA(
+                    extended_protocol_configuration_options,
+                    &sess->h_smf_extended_protocol_configuration_options);
+        }
+    } else if (HOME_ROUTED_ROAMING_IN_HSMF(sess)) {
+        ogs_fatal("This should not be invoked from H-SMF during HR-Roaming");
+        ogs_assert_if_reached();
+    } else {
+        if (sess->nas.ue_epco.buffer && sess->nas.ue_epco.length) {
+            epco_buf = ogs_calloc(OGS_MAX_EPCO_LEN, sizeof(uint8_t));
+            ogs_assert(epco_buf);
+            epco_len = smf_pco_build(epco_buf,
                     sess->nas.ue_epco.buffer, sess->nas.ue_epco.length);
-            goto cleanup;
+            if (epco_len <= 0) {
+                ogs_error("smf_pco_build() failed");
+                ogs_log_hexdump(OGS_LOG_ERROR,
+                        sess->nas.ue_epco.buffer, sess->nas.ue_epco.length);
+                goto cleanup;
+            }
+            pdu_session_establishment_accept->presencemask |=
+                OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+            extended_protocol_configuration_options->buffer = epco_buf;
+            extended_protocol_configuration_options->length = epco_len;
         }
-        pdu_session_establishment_accept->presencemask |=
-            OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
-        extended_protocol_configuration_options->buffer = epco_buf;
-        extended_protocol_configuration_options->length = epco_len;
     }
 
     /* DNN */
@@ -248,14 +275,17 @@
     pkbuf = ogs_nas_5gs_plain_encode(&message);
     ogs_assert(pkbuf);
 
-cleanup:
-    if (epco_buf)
-        ogs_free(epco_buf);
+    sess->establishment_accept_sent = true;
 
+cleanup:
     if (authorized_qos_rules->buffer)
         ogs_free(authorized_qos_rules->buffer);
     if (authorized_qos_flow_descriptions->buffer)
         ogs_free(authorized_qos_flow_descriptions->buffer);
+    if (extended_protocol_configuration_options->buffer)
+        ogs_free(extended_protocol_configuration_options->buffer);
+
+    OGS_NAS_CLEAR_DATA(&sess->h_smf_extended_protocol_configuration_options);
 
     return pkbuf;
 }
@@ -283,49 +313,13 @@
     return ogs_nas_5gs_plain_encode(&message);
 }
 
-static void encode_qos_rule_packet_filter(
-        ogs_nas_qos_rule_t *qos_rule, smf_bearer_t *qos_flow)
-{
-    int i;
-    smf_pf_t *pf = NULL;
-
-    ogs_assert(qos_rule);
-    ogs_assert(qos_flow);
-
-    if (qos_rule->code == OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_DELETE_PACKET_FILTERS) {
-
-        for (i = 0; i < qos_flow->num_of_pf_to_delete; i++) {
-            qos_rule->pfi.identifier = qos_flow->pf_to_deletei;
-        }
-        qos_rule->num_of_packet_filter = qos_flow->num_of_pf_to_delete;
-
-    } else {
-
-        i = 0;
-        ogs_list_for_each_entry(&qos_flow->pf_to_add_list, pf, to_add_node) {
-            ogs_assert(i < OGS_MAX_NUM_OF_FLOW_IN_NAS);
-            qos_rule->pfi.direction = pf->direction;
-            qos_rule->pfi.identifier = pf->identifier;
-
-            ogs_pf_content_from_ipfw_rule(
-                    pf->direction, &qos_rule->pfi.content, &pf->ipfw_rule,
-                    ogs_global_conf()->parameter.
-                    no_ipv4v6_local_addr_in_packet_filter);
-            i++;
-        }
-        qos_rule->num_of_packet_filter = i;
-
-    }
-}
-
 ogs_pkbuf_t *gsm_build_pdu_session_modification_command(
         smf_sess_t *sess,
         uint8_t qos_rule_code, uint8_t qos_flow_description_code)
 {
     ogs_pkbuf_t *pkbuf = NULL;
     smf_bearer_t *qos_flow = NULL;
-    ogs_pfcp_pdr_t *dl_pdr = NULL;
-    int num_of_param, rv, i;
+    int rv, i;
 
     ogs_nas_5gs_message_t message;
     ogs_nas_5gs_pdu_session_modification_command_t
@@ -339,6 +333,11 @@
     ogs_nas_qos_flow_description_t
         qos_flow_descriptionOGS_NAS_MAX_NUM_OF_QOS_FLOW_DESCRIPTION;
 
+    OpenAPI_qos_flow_add_modify_request_item_t *qosFlowAddModRequestItem = NULL;
+    OpenAPI_qos_flow_release_request_item_t *qosFlowRelRequestItem = NULL;
+    OpenAPI_lnode_t *node = NULL;
+    int num, len;
+
     authorized_qos_rules = &pdu_session_modification_command->
         authorized_qos_rules;
     ogs_assert(authorized_qos_rules);
@@ -356,36 +355,75 @@
     message.gsm.h.message_type = OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND;
 
     /* QoS rule */
-    if (qos_rule_code) {
+    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+        num = 0;
+        OpenAPI_list_for_each(
+                sess->h_smf_qos_flows_add_mod_request_list, node) {
+            qosFlowAddModRequestItem = node->data;
+            if (qosFlowAddModRequestItem &&
+                qosFlowAddModRequestItem->qos_rules) {
+                ogs_nas_qos_rules_t qos_rules;
+
+                len = ogs_base64_decode_len(
+                        qosFlowAddModRequestItem->qos_rules);
+                ogs_assert(len);
+                qos_rules.buffer = ogs_calloc(1, len);
+                ogs_assert(qos_rules.buffer);
+                qos_rules.length = ogs_base64_decode_binary(
+                            qos_rules.buffer, qosFlowAddModRequestItem->qos_rules);
+                ogs_assert(qos_rules.length);
 
-        i = 0;
-        memset(qos_rule, 0, sizeof(qos_rule));
+                ogs_assert(1 ==
+                        ogs_nas_parse_qos_rules(&qos_rulenum, &qos_rules));
 
-        ogs_list_for_each_entry(
-                &sess->qos_flow_to_modify_list, qos_flow, to_modify_node) {
-            ogs_assert(i < OGS_MAX_NUM_OF_BEARER);
+                ogs_free(qos_rules.buffer);
 
-            dl_pdr = qos_flow->dl_pdr;
-            ogs_assert(dl_pdr);
+                num++;
+            }
+        }
 
-            qos_rulei.identifier = qos_flow->qfi; /* Use QFI in Open5GS */
-            qos_rulei.code = qos_rule_code;
+        OpenAPI_list_for_each(sess->h_smf_qos_flows_rel_request_list, node) {
+            qosFlowRelRequestItem = node->data;
+            if (qosFlowRelRequestItem && qosFlowRelRequestItem->qos_rules) {
+                ogs_nas_qos_rules_t qos_rules;
+
+                len = ogs_base64_decode_len(qosFlowRelRequestItem->qos_rules);
+                ogs_assert(len);
+                qos_rules.buffer = ogs_calloc(1, len);
+                ogs_assert(qos_rules.buffer);
+                qos_rules.length = ogs_base64_decode_binary(
+                            qos_rules.buffer, qosFlowRelRequestItem->qos_rules);
+                ogs_assert(qos_rules.length);
 
-            if (qos_rule_code != OGS_NAS_QOS_CODE_DELETE_EXISTING_QOS_RULE &&
-                qos_rule_code != OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_WITHOUT_MODIFYING_PACKET_FILTERS)
-                encode_qos_rule_packet_filter(&qos_rulei, qos_flow);
-
-            if (qos_rule_code != OGS_NAS_QOS_CODE_DELETE_EXISTING_QOS_RULE &&
-                qos_rule_code != OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_DELETE_PACKET_FILTERS &&
-                qos_rule_code != OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_WITHOUT_MODIFYING_PACKET_FILTERS) {
-                ogs_assert(dl_pdr->precedence > 0 && dl_pdr->precedence < 255);
-                /* Use PCC Rule Precedence */
-                qos_rulei.precedence = dl_pdr->precedence;
+                ogs_assert(1 ==
+                        ogs_nas_parse_qos_rules(&qos_rulenum, &qos_rules));
 
-                qos_rulei.flow.segregation = 0;
-                qos_rulei.flow.identifier = qos_flow->qfi;
+                ogs_free(qos_rules.buffer);
+
+                num++;
             }
+        }
+
+        if (num) {
+            ogs_assert(OGS_OK ==
+                    ogs_nas_build_qos_rules(
+                        authorized_qos_rules, qos_rule, num));
+
+            pdu_session_modification_command->presencemask |=
+                OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_AUTHORIZED_QOS_RULES_PRESENT;
+        }
+    } else if (HOME_ROUTED_ROAMING_IN_HSMF(sess)) {
+        ogs_fatal("This should not be invoked from H-SMF during HR-Roaming");
+        ogs_assert_if_reached();
+    } else if (qos_rule_code) {
+
+        i = 0;
+        memset(qos_rule, 0, sizeof(qos_rule));
 
+        ogs_list_for_each_entry(
+                &sess->qos_flow_to_modify_list, qos_flow, to_modify_node) {
+            ogs_assert(i < OGS_MAX_NUM_OF_BEARER);
+            gsm_encode_qos_rule(&qos_rulei, qos_flow, qos_rule_code);
             i++;
         }
 
@@ -404,7 +442,77 @@
     }
 
     /* QoS flow descriptions */
-    if (qos_flow_description_code) {
+    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+        num = 0;
+        OpenAPI_list_for_each(
+                sess->h_smf_qos_flows_add_mod_request_list, node) {
+            qosFlowAddModRequestItem = node->data;
+            if (qosFlowAddModRequestItem &&
+                qosFlowAddModRequestItem->qos_flow_description) {
+                ogs_nas_qos_flow_descriptions_t qos_flow_descriptions;
+
+                len = ogs_base64_decode_len(
+                        qosFlowAddModRequestItem->qos_flow_description);
+                ogs_assert(len);
+                qos_flow_descriptions.buffer = ogs_calloc(1, len);
+                ogs_assert(qos_flow_descriptions.buffer);
+                qos_flow_descriptions.length = ogs_base64_decode_binary(
+                            qos_flow_descriptions.buffer,
+                            qosFlowAddModRequestItem->qos_flow_description);
+                ogs_assert(qos_flow_descriptions.length);
+
+                ogs_assert(1 ==
+                        ogs_nas_parse_qos_flow_descriptions(
+                            &qos_flow_descriptionnum,
+                            &qos_flow_descriptions));
+
+                ogs_free(qos_flow_descriptions.buffer);
+
+                num++;
+            }
+        }
+
+        OpenAPI_list_for_each(
+                sess->h_smf_qos_flows_rel_request_list, node) {
+            qosFlowRelRequestItem = node->data;
+            if (qosFlowRelRequestItem &&
+                qosFlowRelRequestItem->qos_flow_description) {
+                ogs_nas_qos_flow_descriptions_t qos_flow_descriptions;
+
+                len = ogs_base64_decode_len(
+                        qosFlowRelRequestItem->qos_flow_description);
+                ogs_assert(len);
+                qos_flow_descriptions.buffer = ogs_calloc(1, len);
+                ogs_assert(qos_flow_descriptions.buffer);
+                qos_flow_descriptions.length = ogs_base64_decode_binary(
+                            qos_flow_descriptions.buffer,
+                            qosFlowRelRequestItem->qos_flow_description);
+                ogs_assert(qos_flow_descriptions.length);
+
+                ogs_assert(1 ==
+                        ogs_nas_parse_qos_flow_descriptions(
+                            &qos_flow_descriptionnum,
+                            &qos_flow_descriptions));
+
+                ogs_free(qos_flow_descriptions.buffer);
+
+                num++;
+            }
+        }
+
+        if (num) {
+            ogs_assert(OGS_OK ==
+                    ogs_nas_build_qos_flow_descriptions(
+                        authorized_qos_flow_descriptions,
+                        qos_flow_description, num));
+
+            pdu_session_modification_command->presencemask |=
+                OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_AUTHORIZED_QOS_FLOW_DESCRIPTIONS_PRESENT;
+        }
+    } else if (HOME_ROUTED_ROAMING_IN_HSMF(sess)) {
+        ogs_fatal("This should not be invoked from H-SMF during HR-Roaming");
+        ogs_assert_if_reached();
+    } else if (qos_flow_description_code) {
 
         i = 0;
         memset(&qos_flow_description, 0, sizeof(qos_flow_description));
@@ -413,67 +521,8 @@
                 &sess->qos_flow_to_modify_list, qos_flow, to_modify_node) {
             ogs_assert(i < OGS_MAX_NUM_OF_BEARER);
 
-            qos_flow_descriptioni.identifier = qos_flow->qfi;
-            qos_flow_descriptioni.code = qos_flow_description_code;
-
-            num_of_param = 0;
-
-            if (qos_flow_description_code !=
-                    OGS_NAS_DELETE_NEW_QOS_FLOW_DESCRIPTION) {
-                qos_flow_descriptioni.E_bit = 1;
-
-                qos_flow_descriptioni.paramnum_of_param.identifier =
-                    OGS_NAX_QOS_FLOW_PARAMETER_ID_5QI;
-                qos_flow_descriptioni.paramnum_of_param.len =
-                    sizeof(qos_flow_descriptioni.paramnum_of_param.
-                            qos_index);
-                qos_flow_descriptioni.paramnum_of_param.qos_index =
-                    qos_flow->qos.index;
-                num_of_param++;
-
-                if (qos_flow->qos.gbr.uplink) {
-                    qos_flow_descriptioni.paramnum_of_param.identifier =
-                        OGS_NAX_QOS_FLOW_PARAMETER_ID_GFBR_UPLINK;
-                    qos_flow_descriptioni.paramnum_of_param.len =
-                        sizeof(qos_flow_descriptioni.paramnum_of_param.br);
-                    ogs_nas_bitrate_from_uint64(
-                            &qos_flow_descriptioni.paramnum_of_param.br,
-                            qos_flow->qos.gbr.uplink);
-                    num_of_param++;
-                }
-                if (qos_flow->qos.gbr.downlink) {
-                    qos_flow_descriptioni.paramnum_of_param.identifier =
-                        OGS_NAX_QOS_FLOW_PARAMETER_ID_GFBR_DOWNLINK;
-                    qos_flow_descriptioni.paramnum_of_param.len =
-                        sizeof(qos_flow_descriptioni.paramnum_of_param.br);
-                    ogs_nas_bitrate_from_uint64(
-                            &qos_flow_descriptioni.paramnum_of_param.br,
-                            qos_flow->qos.gbr.downlink);
-                    num_of_param++;
-                }
-                if (qos_flow->qos.mbr.uplink) {
-                    qos_flow_descriptioni.paramnum_of_param.identifier =
-                        OGS_NAX_QOS_FLOW_PARAMETER_ID_MFBR_UPLINK;
-                    qos_flow_descriptioni.paramnum_of_param.len =
-                        sizeof(qos_flow_descriptioni.paramnum_of_param.br);
-                    ogs_nas_bitrate_from_uint64(
-                            &qos_flow_descriptioni.paramnum_of_param.br,
-                            qos_flow->qos.mbr.uplink);
-                    num_of_param++;
-                }
-                if (qos_flow->qos.mbr.downlink) {
-                    qos_flow_descriptioni.paramnum_of_param.identifier =
-                        OGS_NAX_QOS_FLOW_PARAMETER_ID_MFBR_DOWNLINK;
-                    qos_flow_descriptioni.paramnum_of_param.len =
-                        sizeof(qos_flow_descriptioni.paramnum_of_param.br);
-                    ogs_nas_bitrate_from_uint64(
-                            &qos_flow_descriptioni.paramnum_of_param.br,
-                            qos_flow->qos.mbr.downlink);
-                    num_of_param++;
-                }
-            }
-
-            qos_flow_descriptioni.num_of_parameter = num_of_param;
+            gsm_encode_qos_flow_description(
+                &qos_flow_descriptioni, qos_flow, qos_flow_description_code);
 
             i++;
         }
@@ -496,14 +545,11 @@
     pkbuf = ogs_nas_5gs_plain_encode(&message);
     ogs_assert(pkbuf);
 
-    if (pdu_session_modification_command->presencemask &
-        OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_AUTHORIZED_QOS_RULES_PRESENT) {
+cleanup:
+    if (authorized_qos_rules->buffer)
         ogs_free(authorized_qos_rules->buffer);
-    }
-    if (pdu_session_modification_command->presencemask &
-        OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_AUTHORIZED_QOS_FLOW_DESCRIPTIONS_PRESENT) {
+    if (authorized_qos_flow_descriptions->buffer)
         ogs_free(authorized_qos_flow_descriptions->buffer);
-    }
 
     return pkbuf;
 }
@@ -574,3 +620,206 @@
 
     return ogs_nas_5gs_plain_encode(&message);
 }
+
+void gsm_encode_default_qos_rule(
+        ogs_nas_qos_rule_t *qos_rule, smf_bearer_t *qos_flow)
+{
+    ogs_assert(qos_rule);
+    ogs_assert(qos_flow);
+
+    /*
+     * TS23.501
+     * 5.7.1.3 QoS Rules
+     *
+     * A default QoS rule is required to be sent to the UE for every PDU
+     * Session establishment and it is associated with a QoS Flow. For IP type
+     * PDU Session or Ethernet type PDU Session, the default QoS rule is
+     * the only QoS rule of a PDU Session which may contain a Packet Filter
+     * Set that allows all UL packets, and in this case, the highest
+     * precedence value shall be used for the QoS rule.
+     *
+     * As long as the default QoS rule does not contain a Packet Filter Set or
+     * contains a Packet Filter Set that allows all UL packets, Reflective QoS
+     * should not be applied for the QoS Flow which the default QoS rule is
+     * associated with and the RQA should not be sent for this QoS Flow.
+     */
+    qos_rule->identifier = qos_flow->qfi; /* Use QFI in Open5GS */
+    qos_rule->code = OGS_NAS_QOS_CODE_CREATE_NEW_QOS_RULE;
+    qos_rule->DQR_bit = 1;
+    qos_rule->num_of_packet_filter = 1;
+
+    qos_rule->pf0.direction = OGS_NAS_QOS_DIRECTION_BIDIRECTIONAL;
+    qos_rule->pf0.identifier = 1;
+    qos_rule->pf0.content.length = 1;
+    qos_rule->pf0.content.num_of_component = 1;
+    qos_rule->pf0.content.component0.type = OGS_PACKET_FILTER_MATCH_ALL;
+
+    /*
+     * TS23.501
+     * 5.7.1.9 Precedence Value
+     *
+     * The QoS rule precedence value and the PDR precedence value determine
+     * the order in which a QoS rule or a PDR, respectively, shall be evaluated.
+     * The evaluation of the QoS rules or PDRs is performed in increasing order
+     * of their precedence value.
+     */
+    qos_rule->precedence = 255; /* lowest precedence */
+    qos_rule->flow.segregation = 0;
+    qos_rule->flow.identifier = qos_flow->qfi;
+}
+
+void gsm_encode_default_qos_flow_description(
+        ogs_nas_qos_flow_description_t *qos_flow_description,
+        smf_bearer_t *qos_flow)
+{
+    int num_of_param;
+
+    ogs_assert(qos_flow_description);
+    ogs_assert(qos_flow);
+
+    qos_flow_description->identifier = qos_flow->qfi;
+    qos_flow_description->code = OGS_NAS_CREATE_NEW_QOS_FLOW_DESCRIPTION;
+    qos_flow_description->E_bit = 1;
+
+    num_of_param = 0;
+
+    qos_flow_description->paramnum_of_param.identifier =
+        OGS_NAX_QOS_FLOW_PARAMETER_ID_5QI;
+    qos_flow_description->paramnum_of_param.len =
+        sizeof(qos_flow_description->paramnum_of_param.qos_index);
+    qos_flow_description->paramnum_of_param.qos_index = qos_flow->qos.index;
+    num_of_param++;
+
+    qos_flow_description->num_of_parameter = num_of_param;
+}
+
+void gsm_encode_qos_rule_packet_filter(
+        ogs_nas_qos_rule_t *qos_rule, smf_bearer_t *qos_flow)
+{
+    int i;
+    smf_pf_t *pf = NULL;
+
+    ogs_assert(qos_rule);
+    ogs_assert(qos_flow);
+
+    if (qos_rule->code == OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_DELETE_PACKET_FILTERS) {
+
+        for (i = 0; i < qos_flow->num_of_pf_to_delete; i++) {
+            qos_rule->pfi.identifier = qos_flow->pf_to_deletei;
+        }
+        qos_rule->num_of_packet_filter = qos_flow->num_of_pf_to_delete;
+
+    } else {
+
+        i = 0;
+        ogs_list_for_each_entry(&qos_flow->pf_to_add_list, pf, to_add_node) {
+            ogs_assert(i < OGS_MAX_NUM_OF_FLOW_IN_NAS);
+            qos_rule->pfi.direction = pf->direction;
+            qos_rule->pfi.identifier = pf->identifier;
+
+            ogs_pf_content_from_ipfw_rule(
+                    pf->direction, &qos_rule->pfi.content, &pf->ipfw_rule,
+                    ogs_global_conf()->parameter.
+                    no_ipv4v6_local_addr_in_packet_filter);
+            i++;
+        }
+        qos_rule->num_of_packet_filter = i;
+
+    }
+}
+
+void gsm_encode_qos_rule(
+        ogs_nas_qos_rule_t *qos_rule,
+        smf_bearer_t *qos_flow, uint8_t qos_rule_code)
+{
+    ogs_pfcp_pdr_t *dl_pdr = NULL;
+
+    ogs_assert(qos_rule);
+    ogs_assert(qos_flow);
+    ogs_assert(qos_rule_code);
+
+    dl_pdr = qos_flow->dl_pdr;
+    ogs_assert(dl_pdr);
+
+    qos_rule->identifier = qos_flow->qfi;
+    qos_rule->code = qos_rule_code;
+
+    if (qos_rule_code != OGS_NAS_QOS_CODE_DELETE_EXISTING_QOS_RULE &&
+        qos_rule_code != OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_WITHOUT_MODIFYING_PACKET_FILTERS) {
+        gsm_encode_qos_rule_packet_filter(qos_rule, qos_flow);
+    }
+    if (qos_rule_code != OGS_NAS_QOS_CODE_DELETE_EXISTING_QOS_RULE &&
+        qos_rule_code != OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_DELETE_PACKET_FILTERS &&
+        qos_rule_code != OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_WITHOUT_MODIFYING_PACKET_FILTERS)
+    {
+        qos_rule->precedence = dl_pdr->precedence;
+        qos_rule->flow.segregation = 0;
+        qos_rule->flow.identifier = qos_flow->qfi;
+    }
+}
+
+void gsm_encode_qos_flow_description(
+        ogs_nas_qos_flow_description_t *qos_flow_description,
+        smf_bearer_t *qos_flow, uint8_t qos_flow_description_code)
+{
+    int num_of_param = 0;
+
+    ogs_assert(qos_flow_description);
+    ogs_assert(qos_flow);
+    ogs_assert(qos_flow_description_code);
+
+    qos_flow_description->identifier = qos_flow->qfi;
+    qos_flow_description->code = qos_flow_description_code;
+
+    if (qos_flow_description_code != OGS_NAS_DELETE_NEW_QOS_FLOW_DESCRIPTION) {
+        qos_flow_description->E_bit = 1;
+        qos_flow_description->paramnum_of_param.identifier =
+            OGS_NAX_QOS_FLOW_PARAMETER_ID_5QI;
+        qos_flow_description->paramnum_of_param.len =
+            sizeof(qos_flow_description->paramnum_of_param.qos_index);
+        qos_flow_description->paramnum_of_param++.qos_index =
+            qos_flow->qos.index;
+
+        if (qos_flow->qos.gbr.uplink) {
+            qos_flow_description->paramnum_of_param.identifier =
+                OGS_NAX_QOS_FLOW_PARAMETER_ID_GFBR_UPLINK;
+            qos_flow_description->paramnum_of_param.len =
+                sizeof(qos_flow_description->paramnum_of_param.br);
+            ogs_nas_bitrate_from_uint64(
+                &qos_flow_description->paramnum_of_param.br,
+                qos_flow->qos.gbr.uplink);
+            num_of_param++;
+        }
+        if (qos_flow->qos.gbr.downlink) {
+            qos_flow_description->paramnum_of_param.identifier =
+                OGS_NAX_QOS_FLOW_PARAMETER_ID_GFBR_DOWNLINK;
+            qos_flow_description->paramnum_of_param.len =
+                sizeof(qos_flow_description->paramnum_of_param.br);
+            ogs_nas_bitrate_from_uint64(
+                &qos_flow_description->paramnum_of_param.br,
+                qos_flow->qos.gbr.downlink);
+            num_of_param++;
+        }
+        if (qos_flow->qos.mbr.uplink) {
+            qos_flow_description->paramnum_of_param.identifier =
+                OGS_NAX_QOS_FLOW_PARAMETER_ID_MFBR_UPLINK;
+            qos_flow_description->paramnum_of_param.len =
+                sizeof(qos_flow_description->paramnum_of_param.br);
+            ogs_nas_bitrate_from_uint64(
+                &qos_flow_description->paramnum_of_param.br,
+                qos_flow->qos.mbr.uplink);
+            num_of_param++;
+        }
+        if (qos_flow->qos.mbr.downlink) {
+            qos_flow_description->paramnum_of_param.identifier =
+                OGS_NAX_QOS_FLOW_PARAMETER_ID_MFBR_DOWNLINK;
+            qos_flow_description->paramnum_of_param.len =
+                sizeof(qos_flow_description->paramnum_of_param.br);
+            ogs_nas_bitrate_from_uint64(
+                &qos_flow_description->paramnum_of_param.br,
+                qos_flow->qos.mbr.downlink);
+            num_of_param++;
+        }
+    }
+    qos_flow_description->num_of_parameter = num_of_param;
+}

open5gs_2.7.6.tar.xz/src/smf/gsm-build.h -> open5gs_2.7.7.tar.xz/src/smf/gsm-build.h Changed

open5gs_2.7.6.tar.xz/src/smf/gsm-handler.c -> open5gs_2.7.7.tar.xz/src/smf/gsm-handler.c Changed

@@ -47,10 +47,34 @@
     ogs_assert(pdu_session_type);
     ssc_mode = &pdu_session_establishment_request->ssc_mode;
 
-    sess->integrity_protection.mbr_dl =
-            integrity_protection_maximum_data_rate->dl;
-    sess->integrity_protection.mbr_ul =
-            integrity_protection_maximum_data_rate->ul;
+    switch (integrity_protection_maximum_data_rate->dl) {
+    case OGS_NAS_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_64KBPS:
+        sess->integrity_protection.mbr_dl =
+            OpenAPI_max_integrity_protected_data_rate__64_KBPS;
+        break;
+    case OGS_NAS_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_FULL:
+        sess->integrity_protection.mbr_dl =
+            OGS_NAS_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_FULL;
+        break;
+    default:
+        sess->integrity_protection.mbr_dl =
+            OGS_NAS_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_NULL;
+        break;
+    }
+    switch (integrity_protection_maximum_data_rate->ul) {
+    case OGS_NAS_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_64KBPS:
+        sess->integrity_protection.mbr_ul =
+            OpenAPI_max_integrity_protected_data_rate__64_KBPS;
+        break;
+    case OGS_NAS_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_FULL:
+        sess->integrity_protection.mbr_ul =
+            OGS_NAS_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_FULL;
+        break;
+    default:
+        sess->integrity_protection.mbr_ul =
+            OGS_NAS_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_NULL;
+        break;
+    }
 
     if (pdu_session_establishment_request->presencemask &
         OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_PDU_SESSION_TYPE_PRESENT)
@@ -88,6 +112,8 @@
     pf->direction = qos_rule->pfi.direction;
     for (j = 0; j < qos_rule->pfi.content.num_of_component; j++) {
         switch(qos_rule->pfi.content.componentj.type) {
+        case OGS_PACKET_FILTER_MATCH_ALL:
+            break;
         case OGS_PACKET_FILTER_PROTOCOL_IDENTIFIER_NEXT_HEADER_TYPE:
             pf->ipfw_rule.proto = qos_rule->pfi.content.componentj.proto;
             break;
@@ -187,22 +213,250 @@
         }                                               \
     } while(0);
 
-int gsm_handle_pdu_session_modification_request(
-        smf_sess_t *sess, ogs_sbi_stream_t *stream,
-        ogs_nas_5gs_pdu_session_modification_request_t *
-            pdu_session_modification_request)
+int gsm_handle_pdu_session_modification_qos_rules(
+        smf_sess_t *sess,
+        ogs_nas_qos_rules_t *requested_qos_rules,
+        uint64_t *pfcp_flags)
 {
-    int i, j;
+    smf_ue_t *smf_ue = NULL;
+    int i, j, num_of_rule = 0;
 
-    uint64_t pfcp_flags = 0;
+    ogs_nas_qos_rule_t qos_ruleOGS_NAS_MAX_NUM_OF_QOS_RULE;
 
-    smf_bearer_t *qos_flow = NULL;
-    smf_pf_t *pf = NULL;
+    ogs_assert(requested_qos_rules);
+    ogs_assert(pfcp_flags);
+
+    ogs_assert(sess);
+    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+    ogs_assert(smf_ue);
+
+    num_of_rule = ogs_nas_parse_qos_rules(qos_rule, requested_qos_rules);
+    if (!num_of_rule) {
+        ogs_error("%s:%d Invalid modification request",
+                smf_ue->supi, sess->psi);
+        return OGS_ERROR;
+    }
+
+    for (i = 0; i < num_of_rule; i++) {
+        smf_pf_t *pf = NULL;
+        smf_bearer_t *qos_flow =
+            smf_qos_flow_find_by_qfi(sess, qos_rulei.identifier);
+        if (!qos_flow) {
+            ogs_error("No Qos Flow");
+            continue;
+        }
+
+        ogs_list_init(&qos_flow->pf_to_add_list);
+
+        if (qos_rulei.code == OGS_NAS_QOS_CODE_DELETE_EXISTING_QOS_RULE) {
+            smf_pf_remove_all(qos_flow);
+
+            *pfcp_flags |= OGS_PFCP_MODIFY_REMOVE;
+            qos_flow_find_or_add(&sess->qos_flow_to_modify_list,
+                                    qos_flow, to_modify_node);
+        } else if (qos_rulei.code ==
+            OGS_NAS_QOS_CODE_CREATE_NEW_QOS_RULE ||
+                    qos_rulei.code ==
+            OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_ADD_PACKET_FILTERS ||
+                    qos_rulei.code ==
+            OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_REPLACE_ALL_PACKET_FILTERS) {
+
+            if (qos_rulei.code == OGS_NAS_QOS_CODE_CREATE_NEW_QOS_RULE ||
+                qos_rulei.code == OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_REPLACE_ALL_PACKET_FILTERS)
+                smf_pf_remove_all(qos_flow);
+
+            for (j = 0; j < qos_rulei.num_of_packet_filter &&
+                        j < OGS_MAX_NUM_OF_FLOW_IN_NAS; j++) {
+
+                pf = smf_pf_add(qos_flow);
+                ogs_assert(pf);
+
+                ogs_assert(
+                    reconfigure_packet_filter(pf, &qos_rulei, i) > 0);
+/*
+ * Refer to lib/ipfw/ogs-ipfw.h
+ * Issue #338
+ *
+ * <DOWNLINK/BI-DIRECTIONAL>
+ * TFT : Local <UE_IP> <UE_PORT> REMOTE <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT>
+ * -->
+ * RULE : Source <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT> Destination <UE_IP> <UE_PORT>
+ *
+ * <UPLINK>
+ * TFT : Local <UE_IP> <UE_PORT> REMOTE <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT>
+ * -->
+ * RULE : Source <UE_IP> <UE_PORT> Destination <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT>
+ */
+                if (pf->direction == OGS_FLOW_DOWNLINK_ONLY)
+                    ogs_ipfw_rule_swap(&pf->ipfw_rule);
+
+                if (pf->flow_description)
+                    ogs_free(pf->flow_description);
+
+/*
+ * Issue #338
+ *
+ * <DOWNLINK/BI-DIRECTIONAL>
+ * RULE : Source <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT> Destination <UE_IP> <UE_PORT>
+ * -->
+ * GX : permit out from <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT> to <UE_IP> <UE_PORT>
+ * PFCP : permit out from <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT> to <UE_IP> <UE_PORT>
+ *
+ * <UPLINK>
+ * RULE : Source <UE_IP> <UE_PORT> Destination <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT>
+ * -->
+ * GX : permit out from <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT> to <UE_IP> <UE_PORT>
+ * PFCP : permit out from <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT> to <UE_IP> <UE_PORT>
+ */
+                if (pf->direction == OGS_FLOW_UPLINK_ONLY) {
+                    ogs_ipfw_rule_t tmp;
+                    ogs_ipfw_copy_and_swap(&tmp, &pf->ipfw_rule);
+                    pf->flow_description =
+                        ogs_ipfw_encode_flow_description(&tmp);
+                    ogs_assert(pf->flow_description);
+                } else {
+                    pf->flow_description =
+                        ogs_ipfw_encode_flow_description(&pf->ipfw_rule);
+                    ogs_assert(pf->flow_description);
+                }
+
+                if (qos_rulei.code ==
+                        OGS_NAS_QOS_CODE_CREATE_NEW_QOS_RULE) {
+                    *pfcp_flags |= OGS_PFCP_MODIFY_TFT_NEW;
+                } else if (qos_rulei.code ==
+                        OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_ADD_PACKET_FILTERS) {
+                    *pfcp_flags |= OGS_PFCP_MODIFY_TFT_ADD;
+                } else if (qos_rulei.code ==
+                        OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_REPLACE_ALL_PACKET_FILTERS) {
+                    *pfcp_flags |= OGS_PFCP_MODIFY_TFT_REPLACE;
+                } else
+                    ogs_assert_if_reached();
+
+                qos_flow_find_or_add(&sess->qos_flow_to_modify_list,
+                                        qos_flow, to_modify_node);
+
+                ogs_list_add(
+                        &qos_flow->pf_to_add_list, &pf->to_add_node);
+            }
+        } else if (qos_rulei.code ==
+            OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_DELETE_PACKET_FILTERS) {
+
+            qos_flow->num_of_pf_to_delete = 0;
+            for (j = 0; j < qos_rulei.num_of_packet_filter &&
+                        j < OGS_MAX_NUM_OF_FLOW_IN_NAS; j++) {
+
+                pf = smf_pf_find_by_identifier(
+                        qos_flow, qos_rulei.pfj.identifier);
+                if (pf) {
+                    qos_flow->pf_to_delete
+                        qos_flow->num_of_pf_to_delete++ =
+                            qos_rulei.pfj.identifier;
+                    smf_pf_remove(pf);
+                }
+            }
+
+            if (ogs_list_count(&qos_flow->pf_list)) {
+                *pfcp_flags |= OGS_PFCP_MODIFY_TFT_DELETE;
+                qos_flow_find_or_add(&sess->qos_flow_to_modify_list,
+                                        qos_flow, to_modify_node);
+            } else {
+                *pfcp_flags |= OGS_PFCP_MODIFY_REMOVE;
+                qos_flow_find_or_add(&sess->qos_flow_to_modify_list,
+                                        qos_flow, to_modify_node);
+            }
+        }
+
+        if (*pfcp_flags &
+                (OGS_PFCP_MODIFY_TFT_NEW|OGS_PFCP_MODIFY_TFT_ADD|
+                OGS_PFCP_MODIFY_TFT_REPLACE|OGS_PFCP_MODIFY_TFT_DELETE))
+            smf_bearer_tft_update(qos_flow);
+    }
+
+    return OGS_OK;
+}
+
+int gsm_handle_pdu_session_modification_qos_flow_descriptions(
+        smf_sess_t *sess,
+        ogs_nas_qos_flow_descriptions_t *requested_qos_flow_descriptions,
+        uint64_t *pfcp_flags)
+{
+    smf_ue_t *smf_ue = NULL;
+    int i, j, num_of_description = 0;
 
-    ogs_nas_qos_rule_t qos_ruleOGS_NAS_MAX_NUM_OF_QOS_RULE;
     ogs_nas_qos_flow_description_t
         qos_flow_descriptionOGS_NAS_MAX_NUM_OF_QOS_FLOW_DESCRIPTION;
 
+    ogs_assert(requested_qos_flow_descriptions);
+    ogs_assert(pfcp_flags);
+
+    ogs_assert(sess);
+    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+    ogs_assert(smf_ue);
+
+    num_of_description = ogs_nas_parse_qos_flow_descriptions(
+            qos_flow_description, requested_qos_flow_descriptions);
+    if (!num_of_description) {
+        ogs_error("%s:%d Invalid modification request",
+                smf_ue->supi, sess->psi);
+        return OGS_ERROR;
+    }
+
+    for (i = 0; i < num_of_description; i++) {
+        smf_bearer_t *qos_flow =
+            smf_qos_flow_find_by_qfi(
+                    sess, qos_flow_descriptioni.identifier);
+        if (!qos_flow) {
+            ogs_error("No Qos Flow");
+            continue;
+        }
+
+        for (j = 0; j < qos_flow_descriptioni.num_of_parameter; j++) {
+            switch(qos_flow_descriptioni.paramj.identifier) {
+            case OGS_NAX_QOS_FLOW_PARAMETER_ID_5QI:
+                /* Nothing */
+                break;
+            case OGS_NAX_QOS_FLOW_PARAMETER_ID_GFBR_UPLINK:
+                qos_flow->qos.gbr.uplink = ogs_nas_bitrate_to_uint64(
+                        &qos_flow_descriptioni.paramj.br);
+                break;
+            case OGS_NAX_QOS_FLOW_PARAMETER_ID_GFBR_DOWNLINK:
+                qos_flow->qos.gbr.downlink = ogs_nas_bitrate_to_uint64(
+                        &qos_flow_descriptioni.paramj.br);
+                break;
+            case OGS_NAX_QOS_FLOW_PARAMETER_ID_MFBR_UPLINK:
+                qos_flow->qos.mbr.uplink = ogs_nas_bitrate_to_uint64(
+                        &qos_flow_descriptioni.paramj.br);
+                break;
+            case OGS_NAX_QOS_FLOW_PARAMETER_ID_MFBR_DOWNLINK:
+                qos_flow->qos.mbr.downlink = ogs_nas_bitrate_to_uint64(
+                        &qos_flow_descriptioni.paramj.br);
+                break;
+            default:
+                ogs_fatal("Unknown qos_flow parameter identifier %d",
+                        qos_flow_descriptioni.parami.identifier);
+                ogs_assert_if_reached();
+            }
+        }
+
+        *pfcp_flags |= OGS_PFCP_MODIFY_QOS_MODIFY;
+        qos_flow_find_or_add(&sess->qos_flow_to_modify_list,
+                                qos_flow, to_modify_node);
+
+        if (*pfcp_flags & OGS_PFCP_MODIFY_QOS_MODIFY)
+            smf_bearer_qos_update(qos_flow);
+    }
+
+    return OGS_OK;
+}
+
+int gsm_handle_pdu_session_modification_request(
+        smf_sess_t *sess, ogs_sbi_stream_t *stream,
+        ogs_nas_5gs_pdu_session_modification_request_t *
+            pdu_session_modification_request)
+{
+    int rv;
+    uint64_t pfcp_flags = 0;
+
     ogs_nas_qos_rules_t *requested_qos_rules =
         &pdu_session_modification_request->requested_qos_rules;
     ogs_nas_qos_flow_descriptions_t *requested_qos_flow_descriptions =
@@ -226,197 +480,23 @@
 
     if (pdu_session_modification_request->presencemask &
         OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_REQUESTED_QOS_RULES_PRESENT) {
-        int num_of_rule = 0;
-
-        num_of_rule = ogs_nas_parse_qos_rules(qos_rule, requested_qos_rules);
-        if (!num_of_rule) {
-            ogs_error("%s:%d Invalid modification request",
-                    smf_ue->supi, sess->psi);
+        rv = gsm_handle_pdu_session_modification_qos_rules(
+                sess, requested_qos_rules, &pfcp_flags);
+        if (rv != OGS_OK) {
+            ogs_error("gsm_handle_pdu_session_modification_qos_rules() failed");
             goto cleanup;
         }
-
-        for (i = 0; i < num_of_rule; i++) {
-            qos_flow = smf_qos_flow_find_by_qfi(
-                    sess, qos_rulei.identifier);
-            if (!qos_flow) {
-                ogs_error("No Qos Flow");
-                continue;
-            }
-
-            ogs_list_init(&qos_flow->pf_to_add_list);
-
-            if (qos_rulei.code == OGS_NAS_QOS_CODE_DELETE_EXISTING_QOS_RULE) {
-                smf_pf_remove_all(qos_flow);
-
-                pfcp_flags |= OGS_PFCP_MODIFY_REMOVE;
-                qos_flow_find_or_add(&sess->qos_flow_to_modify_list,
-                                        qos_flow, to_modify_node);
-            } else if (qos_rulei.code ==
-                OGS_NAS_QOS_CODE_CREATE_NEW_QOS_RULE ||
-                        qos_rulei.code ==
-                OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_ADD_PACKET_FILTERS ||
-                        qos_rulei.code ==
-                OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_REPLACE_ALL_PACKET_FILTERS) {
-
-                if (qos_rulei.code == OGS_NAS_QOS_CODE_CREATE_NEW_QOS_RULE ||
-                    qos_rulei.code == OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_REPLACE_ALL_PACKET_FILTERS)
-                    smf_pf_remove_all(qos_flow);
-
-                for (j = 0; j < qos_rulei.num_of_packet_filter &&
-                            j < OGS_MAX_NUM_OF_FLOW_IN_NAS; j++) {
-
-                    pf = smf_pf_add(qos_flow);
-                    ogs_assert(pf);
-
-                    ogs_assert(
-                        reconfigure_packet_filter(pf, &qos_rulei, i) > 0);
-        /*
-         * Refer to lib/ipfw/ogs-ipfw.h
-         * Issue #338
-         *
-         * <DOWNLINK/BI-DIRECTIONAL>
-         * TFT : Local <UE_IP> <UE_PORT> REMOTE <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT>
-         * -->
-         * RULE : Source <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT> Destination <UE_IP> <UE_PORT>
-         *
-         * <UPLINK>
-         * TFT : Local <UE_IP> <UE_PORT> REMOTE <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT>
-         * -->
-         * RULE : Source <UE_IP> <UE_PORT> Destination <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT>
-         */
-                    if (pf->direction == OGS_FLOW_DOWNLINK_ONLY)
-                        ogs_ipfw_rule_swap(&pf->ipfw_rule);
-
-                    if (pf->flow_description)
-                        ogs_free(pf->flow_description);
-
-        /*
-         * Issue #338
-         *
-         * <DOWNLINK/BI-DIRECTIONAL>
-         * RULE : Source <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT> Destination <UE_IP> <UE_PORT>
-         * -->
-         * GX : permit out from <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT> to <UE_IP> <UE_PORT>
-         * PFCP : permit out from <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT> to <UE_IP> <UE_PORT>
-         *
-         * <UPLINK>
-         * RULE : Source <UE_IP> <UE_PORT> Destination <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT>
-         * -->
-         * GX : permit out from <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT> to <UE_IP> <UE_PORT>
-         * PFCP : permit out from <P-CSCF_RTP_IP> <P-CSCF_RTP_PORT> to <UE_IP> <UE_PORT>
-         */
-                    if (pf->direction == OGS_FLOW_UPLINK_ONLY) {
-                        ogs_ipfw_rule_t tmp;
-                        ogs_ipfw_copy_and_swap(&tmp, &pf->ipfw_rule);
-                        pf->flow_description =
-                            ogs_ipfw_encode_flow_description(&tmp);
-                        ogs_assert(pf->flow_description);
-                    } else {
-                        pf->flow_description =
-                            ogs_ipfw_encode_flow_description(&pf->ipfw_rule);
-                        ogs_assert(pf->flow_description);
-                    }
-
-                    if (qos_rulei.code ==
-                            OGS_NAS_QOS_CODE_CREATE_NEW_QOS_RULE) {
-                        pfcp_flags |= OGS_PFCP_MODIFY_TFT_NEW;
-                    } else if (qos_rulei.code ==
-                            OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_ADD_PACKET_FILTERS) {
-                        pfcp_flags |= OGS_PFCP_MODIFY_TFT_ADD;
-                    } else if (qos_rulei.code ==
-                            OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_REPLACE_ALL_PACKET_FILTERS) {
-                        pfcp_flags |= OGS_PFCP_MODIFY_TFT_REPLACE;
-                    } else
-                        ogs_assert_if_reached();
-
-                    qos_flow_find_or_add(&sess->qos_flow_to_modify_list,
-                                            qos_flow, to_modify_node);
-
-                    ogs_list_add(
-                            &qos_flow->pf_to_add_list, &pf->to_add_node);
-                }
-            } else if (qos_rulei.code ==
-                OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_DELETE_PACKET_FILTERS) {
-
-                qos_flow->num_of_pf_to_delete = 0;
-                for (j = 0; j < qos_rulei.num_of_packet_filter &&
-                            j < OGS_MAX_NUM_OF_FLOW_IN_NAS; j++) {
-
-                    pf = smf_pf_find_by_identifier(
-                            qos_flow, qos_rulei.pfj.identifier);
-                    if (pf) {
-                        qos_flow->pf_to_delete
-                            qos_flow->num_of_pf_to_delete++ =
-                                qos_rulei.pfj.identifier;
-                        smf_pf_remove(pf);
-                    }
-                }
-
-                if (ogs_list_count(&qos_flow->pf_list)) {
-                    pfcp_flags |= OGS_PFCP_MODIFY_TFT_DELETE;
-                    qos_flow_find_or_add(&sess->qos_flow_to_modify_list,
-                                            qos_flow, to_modify_node);
-                } else {
-                    pfcp_flags |= OGS_PFCP_MODIFY_REMOVE;
-                    qos_flow_find_or_add(&sess->qos_flow_to_modify_list,
-                                            qos_flow, to_modify_node);
-                }
-            }
-        }
     }
 
     if (pdu_session_modification_request->presencemask &
         OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_REQUESTED_QOS_FLOW_DESCRIPTIONS_PRESENT) {
-        int num_of_description = 0;
-
-        num_of_description = ogs_nas_parse_qos_flow_descriptions(
-                qos_flow_description, requested_qos_flow_descriptions);
-        if (!num_of_description) {
-            ogs_error("%s:%d Invalid modification request",
-                    smf_ue->supi, sess->psi);
+        rv = gsm_handle_pdu_session_modification_qos_flow_descriptions(
+                sess, requested_qos_flow_descriptions, &pfcp_flags);
+        if (rv != OGS_OK) {
+            ogs_error("gsm_handle_pdu_session_modification_"
+                    "qos_flow_descriptions() failed");
             goto cleanup;
         }
-
-        for (i = 0; i < num_of_description; i++) {
-            qos_flow = smf_qos_flow_find_by_qfi(
-                    sess, qos_flow_descriptioni.identifier);
-            if (!qos_flow) {
-                ogs_error("No Qos Flow");
-                continue;
-            }
-
-            for (j = 0; j < qos_flow_descriptioni.num_of_parameter; j++) {
-                switch(qos_flow_descriptioni.paramj.identifier) {
-                case OGS_NAX_QOS_FLOW_PARAMETER_ID_5QI:
-                    /* Nothing */
-                    break;
-                case OGS_NAX_QOS_FLOW_PARAMETER_ID_GFBR_UPLINK:
-                    qos_flow->qos.gbr.uplink = ogs_nas_bitrate_to_uint64(
-                            &qos_flow_descriptioni.paramj.br);
-                    break;
-                case OGS_NAX_QOS_FLOW_PARAMETER_ID_GFBR_DOWNLINK:
-                    qos_flow->qos.gbr.downlink = ogs_nas_bitrate_to_uint64(
-                            &qos_flow_descriptioni.paramj.br);
-                    break;
-                case OGS_NAX_QOS_FLOW_PARAMETER_ID_MFBR_UPLINK:
-                    qos_flow->qos.mbr.uplink = ogs_nas_bitrate_to_uint64(
-                            &qos_flow_descriptioni.paramj.br);
-                    break;
-                case OGS_NAX_QOS_FLOW_PARAMETER_ID_MFBR_DOWNLINK:
-                    qos_flow->qos.mbr.downlink = ogs_nas_bitrate_to_uint64(
-                            &qos_flow_descriptioni.paramj.br);
-                    break;
-                default:
-                    ogs_fatal("Unknown qos_flow parameter identifier %d",
-                            qos_flow_descriptioni.parami.identifier);
-                    ogs_assert_if_reached();
-                }
-            }
-
-            pfcp_flags |= OGS_PFCP_MODIFY_QOS_MODIFY;
-            qos_flow_find_or_add(&sess->qos_flow_to_modify_list,
-                                    qos_flow, to_modify_node);
-        }
     }
 
     if (ogs_list_count(&sess->qos_flow_to_modify_list) != 1) {
@@ -439,14 +519,6 @@
 
         ogs_assert((pfcp_flags & OGS_PFCP_MODIFY_REMOVE) == 0);
 
-        if (pfcp_flags &
-                (OGS_PFCP_MODIFY_TFT_NEW|OGS_PFCP_MODIFY_TFT_ADD|
-                OGS_PFCP_MODIFY_TFT_REPLACE|OGS_PFCP_MODIFY_TFT_DELETE))
-            smf_bearer_tft_update(qos_flow);
-
-        if (pfcp_flags & OGS_PFCP_MODIFY_QOS_MODIFY)
-            smf_bearer_qos_update(qos_flow);
-
     } else {
         ogs_fatal("Unknown PFCP-Flags : 0x%llx", (long long)pfcp_flags);
         ogs_assert_if_reached();

open5gs_2.7.6.tar.xz/src/smf/gsm-handler.h -> open5gs_2.7.7.tar.xz/src/smf/gsm-handler.h Changed

open5gs_2.7.6.tar.xz/src/smf/gsm-sm.c -> open5gs_2.7.7.tar.xz/src/smf/gsm-sm.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -35,6 +35,7 @@
 #include "pfcp-path.h"
 #include "ngap-path.h"
 #include "fd-path.h"
+#include "local-path.h"
 
 static uint8_t gtp_cause_from_diameter(uint8_t gtp_version,
         const uint32_t dia_err, const uint32_t *dia_exp_err)
@@ -257,6 +258,8 @@
     case OGS_EVENT_SBI_SERVER:
         sbi_message = e->h.sbi.message;
         ogs_assert(sbi_message);
+        smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+        ogs_assert(smf_ue);
 
         stream_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
         ogs_assert(stream_id >= OGS_MIN_POOL_ID &&
@@ -270,24 +273,70 @@
 
         SWITCH(sbi_message->h.service.name)
         CASE(OGS_SBI_SERVICE_NAME_NSMF_PDUSESSION)
-            SWITCH(sbi_message->h.resource.component2)
-            CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
-            CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
+            SWITCH(sbi_message->h.resource.component0)
+            CASE(OGS_SBI_RESOURCE_NAME_SM_CONTEXTS)
+                SWITCH(sbi_message->h.resource.component2)
+                CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
+                CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
+                    ogs_error("Invalid resource name %s",
+                                sbi_message->h.resource.component2);
+                    ogs_assert(true ==
+                        ogs_sbi_server_send_error(stream,
+                            OGS_SBI_HTTP_STATUS_BAD_REQUEST, sbi_message,
+                            "Invalid resource name %s",
+                            sbi_message->h.resource.component2, NULL));
+                    OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                    break;
+                DEFAULT
+                    if (smf_nsmf_handle_create_sm_context(
+                            sess, stream, sbi_message) == false) {
+                        ogs_error("smf_nsmf_handle_create_sm_context() failed");
+                        OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                        break;
+                    }
+
+                    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+                        ogs_info("%s:%d SMContextCreate HR Roaming in V-SMF",
+                                smf_ue->supi, sess->psi);
+                        OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_establishment);
+                    }
+                END
+                break;
+            CASE(OGS_SBI_RESOURCE_NAME_PDU_SESSIONS)
+                SWITCH(sbi_message->h.resource.component2)
+                CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
+                CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
+                    ogs_error("Invalid resource name %s",
+                                sbi_message->h.resource.component2);
+                    ogs_assert(true ==
+                        ogs_sbi_server_send_error(stream,
+                            OGS_SBI_HTTP_STATUS_BAD_REQUEST, sbi_message,
+                            "Invalid resource name %s",
+                            sbi_message->h.resource.component2, NULL));
+                    OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                    break;
+                DEFAULT
+                    if (smf_nsmf_handle_create_data_in_hsmf(
+                            sess, stream, sbi_message) == false) {
+                        ogs_error(
+                                "smf_nsmf_handle_create_pdu_session_in_hsmf() "
+                                "failed");
+                        OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                        break;
+                    }
+                    OGS_FSM_TRAN(s,
+                            smf_gsm_state_wait_5gc_sm_policy_association);
+                END
+                break;
+
+            DEFAULT
                 ogs_error("Invalid resource name %s",
-                            sbi_message->h.resource.component2);
+                        sbi_message->h.resource.component0);
                 ogs_assert(true ==
                     ogs_sbi_server_send_error(stream,
                         OGS_SBI_HTTP_STATUS_BAD_REQUEST, sbi_message,
-                        "Invalid resource name %s",
-                        sbi_message->h.resource.component2, NULL));
-                OGS_FSM_TRAN(s, smf_gsm_state_exception);
-                break;
-            DEFAULT
-                if (smf_nsmf_handle_create_sm_context(
-                        sess, stream, sbi_message) == false) {
-                    ogs_error("smf_nsmf_handle_create_sm_context() failed");
-                    OGS_FSM_TRAN(s, smf_gsm_state_exception);
-                }
+                        "Invalid resource name",
+                        sbi_message->h.resource.component0, NULL));
             END
             break;
 
@@ -485,8 +534,6 @@
     ogs_pool_id_t stream_id = OGS_INVALID_POOL_ID;
     ogs_sbi_message_t *sbi_message = NULL;
 
-    int state = 0;
-
     ogs_assert(s);
     ogs_assert(e);
 
@@ -591,6 +638,11 @@
 
         CASE(OGS_SBI_SERVICE_NAME_NPCF_SMPOLICYCONTROL)
             /*
+             * TS23.502
+             * 4.3.2.2 UE Requested PDU Session Establishment
+             *
+             * 4.3.2.2.1 Non-roaming and Roaming with Local Breakout
+             *
              * By here, SMF has already sent a response to AMF in
              * smf_nudm_sdm_handle_get. Therefore, 'stream = e->h.sbi.data'
              * should not be used here. Instead of sending additional error
@@ -598,16 +650,22 @@
              * Namf_Communication_N1N2MessageTransfer request by transitioning
              * into smf_gsm_state_5gc_n1_n2_reject. This is according to
              *
-             * TS23.502
-             * 6.3.1.7 4.3.2.2 UE Requested PDU Session Establishment
-             * p100
              * 11.  ...
              * If the PDU session establishment failed anywhere between step 5
              * and step 11, then the Namf_Communication_N1N2MessageTransfer
              * request shall include the N1 SM container with a PDU Session
              * Establishment Reject message ...
+             *
+             * 4.3.2.2.2 Home-routed Roaming
+             * However, Home Routed Roaming requires a stream.
+             * This is because we need the stream
+             * when we send the Nsmf_PDUSession_Create Response in step 13.
+             *
+             * 13. H-SMF to V-SMF: Nsmf_PDUSession_Create Response ...
              */
-            state = e->h.sbi.state;
+            stream_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
+            if (stream_id >= OGS_MIN_POOL_ID && stream_id <= OGS_MAX_POOL_ID)
+                stream = ogs_sbi_stream_find_by_id(stream_id);
 
             SWITCH(sbi_message->h.resource.component0)
             CASE(OGS_SBI_RESOURCE_NAME_SM_POLICIES)
@@ -623,7 +681,7 @@
                             sbi_message->res_status);
                     OGS_FSM_TRAN(s, smf_gsm_state_5gc_n1_n2_reject);
                 } else if (smf_npcf_smpolicycontrol_handle_create(
-                        sess, state, sbi_message) == true) {
+                        sess, stream, sbi_message) == true) {
                     OGS_FSM_TRAN(s,
                         &smf_gsm_state_wait_pfcp_establishment);
                 } else {
@@ -665,6 +723,8 @@
     ogs_pfcp_message_t *pfcp_message = NULL;
     int rv;
 
+    ogs_sbi_stream_t *stream = NULL;
+
     ogs_assert(s);
     ogs_assert(e);
 
@@ -683,6 +743,10 @@
         pfcp_message = e->pfcp_message;
         ogs_assert(pfcp_message);
 
+        if (pfcp_xact->assoc_stream_id >= OGS_MIN_POOL_ID &&
+                pfcp_xact->assoc_stream_id <= OGS_MAX_POOL_ID)
+            stream = ogs_sbi_stream_find_by_id(pfcp_xact->assoc_stream_id);
+
         switch (pfcp_message->h.type) {
         case OGS_PFCP_SESSION_ESTABLISHMENT_RESPONSE_TYPE:
             if (pfcp_xact->epc) {
@@ -737,6 +801,7 @@
                 }
                 smf_bearer_binding(sess);
             } else {
+                int r = 0;
                 pfcp_cause = smf_5gc_n4_handle_session_establishment_response(
                         sess, pfcp_xact,
                         &pfcp_message->pfcp_session_establishment_response);
@@ -744,21 +809,41 @@
                     OGS_FSM_TRAN(s, smf_gsm_state_5gc_n1_n2_reject);
                     return;
                 }
-                memset(&param, 0, sizeof(param));
-                param.state = SMF_UE_REQUESTED_PDU_SESSION_ESTABLISHMENT;
-                param.n1smbuf =
-                    gsm_build_pdu_session_establishment_accept(sess);
-                if (!param.n1smbuf) {
-                    ogs_error("gsm_build_pdu_session_establishment_accept() "
-                            "failed");
-                    OGS_FSM_TRAN(s, smf_gsm_state_5gc_n1_n2_reject);
-                    return;
+                if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+                    r = smf_sbi_discover_and_send(
+                            OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                            smf_nsmf_pdusession_build_create_data,
+                            sess, NULL, 0, NULL);
+                    ogs_expect(r == OGS_OK);
+                    ogs_assert(r != OGS_ERROR);
+                } else if (HOME_ROUTED_ROAMING_IN_HSMF(sess)) {
+                    r = smf_sbi_discover_and_send(
+                            OGS_SBI_SERVICE_TYPE_NUDM_UECM, NULL,
+                            smf_nudm_uecm_build_registration,
+                            sess, stream,
+                            SMF_UECM_STATE_REGISTERED_HR,
+                            NULL);
+                    ogs_expect(r == OGS_OK);
+                    ogs_assert(r != OGS_ERROR);
+                } else {
+                    memset(&param, 0, sizeof(param));
+                    param.state = SMF_UE_REQUESTED_PDU_SESSION_ESTABLISHMENT;
+                    param.n1smbuf =
+                        gsm_build_pdu_session_establishment_accept(sess);
+                    if (!param.n1smbuf) {
+                        ogs_error(
+                                "gsm_build_pdu_session_establishment_accept() "
+                                "failed");
+                        OGS_FSM_TRAN(s, smf_gsm_state_5gc_n1_n2_reject);
+                        return;
+                    }
+                    param.n2smbuf =
+                        ngap_build_pdu_session_resource_setup_request_transfer(
+                                sess);
+                    ogs_assert(param.n2smbuf);
+                    smf_namf_comm_send_n1_n2_message_transfer(
+                            sess, NULL, &param);
                 }
-                param.n2smbuf =
-                    ngap_build_pdu_session_resource_setup_request_transfer(
-                            sess);
-                ogs_assert(param.n2smbuf);
-                smf_namf_comm_send_n1_n2_message_transfer(sess, &param);
             }
 
             OGS_FSM_TRAN(s, smf_gsm_state_operational);
@@ -791,11 +876,13 @@
 
 void smf_gsm_state_operational(ogs_fsm_t *s, smf_event_t *e)
 {
-    int rv, ngap_state;
+    int r, rv, ngap_state;
     char *strerror = NULL;
     smf_ue_t *smf_ue = NULL;
     smf_sess_t *sess = NULL;
+    smf_bearer_t *qos_flow = NULL;
     ogs_pkbuf_t *pkbuf = NULL;
+    ogs_pkbuf_t *n2smbuf = NULL;
 
     ogs_pfcp_xact_t *pfcp_xact = NULL;
     ogs_pfcp_message_t *pfcp_message = NULL;
@@ -814,10 +901,7 @@
     ogs_gtp1_message_t *gtp1_message = NULL;
     ogs_gtp2_message_t *gtp2_message = NULL;
     uint8_t gtp1_cause, gtp2_cause;
-    bool release;
-    int r;
-
-    int state = 0;
+    bool rc, release;
 
     ogs_assert(s);
     ogs_assert(e);
@@ -911,14 +995,14 @@
 
         case OGS_PFCP_SESSION_DELETION_RESPONSE_TYPE:
             ogs_error("EPC Session Released by Error Indication");
-            OGS_FSM_TRAN(s, smf_gsm_state_epc_session_will_release);
+            OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
             break;
 
         case OGS_PFCP_SESSION_REPORT_REQUEST_TYPE:
             pfcp_cause = smf_n4_handle_session_report_request(sess, pfcp_xact,
                             &pfcp_message->pfcp_session_report_request);
             if (pfcp_cause != OGS_PFCP_CAUSE_REQUEST_ACCEPTED) {
-               OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion);
+                OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion);
             }
             break;
 
@@ -952,6 +1036,9 @@
         sbi_message = e->h.sbi.message;
         ogs_assert(sbi_message);
 
+        smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+        ogs_assert(smf_ue);
+
         stream_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
         ogs_assert(stream_id >= OGS_MIN_POOL_ID &&
                 stream_id <= OGS_MAX_POOL_ID);
@@ -964,21 +1051,460 @@
 
         SWITCH(sbi_message->h.service.name)
         CASE(OGS_SBI_SERVICE_NAME_NSMF_PDUSESSION)
-            SWITCH(sbi_message->h.resource.component2)
-            CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
-                smf_nsmf_handle_update_sm_context(sess, stream, sbi_message);
+            SWITCH(sbi_message->h.resource.component0)
+            CASE(OGS_SBI_RESOURCE_NAME_SM_CONTEXTS)
+                SWITCH(sbi_message->h.resource.component2)
+                CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
+                    smf_nsmf_handle_update_sm_context(
+                            sess, stream, sbi_message);
+                    break;
+                CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
+    /*
+     * Network-requested PDU Session Release
+     *
+     * 1.  V*: smf_nsmf_handle_release_sm_context
+     * 2.  V*: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *         OGS_PFCP_MODIFY_DEACTIVATE
+     * 3.  V*: OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 4.  V: smf_nsmf_pdusession_build_release_data
+     * 5.  H: smf_nsmf_handle_release_data_in_hsmf
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 7.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 8.  H: ogs_sbi_send_http_status_no_content
+     * 9.  H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_AMF_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 11. H: SMF_SESS_CLEAR(sess)
+     * 12. V: smf_nsmf_handle_release_data_in_hsmf
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V*: ogs_sbi_send_http_status_no_content
+     * 16. V*: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                    smf_nsmf_handle_release_sm_context(
+                            sess, stream, sbi_message);
+
+                    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+                        ogs_assert(OGS_OK ==
+                            smf_5gc_pfcp_send_all_pdr_modification_request(
+                                sess, stream,
+                                OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+                                OGS_PFCP_MODIFY_UL_ONLY|
+                                OGS_PFCP_MODIFY_DEACTIVATE,
+                                OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT,
+                                0));
+                    } else {
+                        e->h.sbi.state =
+                            OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT;
+                        OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion);
+                    }
+                    break;
+                DEFAULT
+                    ogs_error("Invalid resource name %s",
+                                sbi_message->h.resource.component2);
+                    ogs_assert(true ==
+                        ogs_sbi_server_send_error(stream,
+                            OGS_SBI_HTTP_STATUS_BAD_REQUEST, sbi_message,
+                            "Invalid resource name %s",
+                            sbi_message->h.resource.component2, NULL));
+                    OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                END
+                break;
+
+            CASE(OGS_SBI_RESOURCE_NAME_PDU_SESSIONS)
+                SWITCH(sbi_message->h.resource.component2)
+                CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
+                    rc = smf_nsmf_handle_update_data_in_hsmf(
+                            sess, stream, sbi_message);
+                    if (rc == true) {
+                        switch (sess->nsmf_param.request_indication) {
+                        case OpenAPI_request_indication_UE_REQ_PDU_SES_MOD:
+                            if (sess->nsmf_param.up_cnx_state ==
+                                    OpenAPI_up_cnx_state_DEACTIVATED) {
+    /*
+     * UE-requested PDU Session Modification(DEACTIVATED)
+     *
+     * For Home Routed Roaming, delegate PFCP deactivation to H-SMF by
+     * sending UP_CNX_STATE=DEACTIVATED via HsmfUpdateData.
+     *
+     * 1.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 2.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     *        SMF_UPDATE_STATE_HR_DEACTIVATED
+     * 3.  H*: smf_nsmf_handle_update_data_in_hsmf
+     * 4.  H*: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 5.  H*: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_DL_ONLY|
+     *         OGS_PFCP_MODIFY_DEACTIVATE
+     * 6.  H: ogs_sbi_send_http_status_no_content
+     * 7.  V: case SMF_UPDATE_STATE_HR_DEACTIVATED:
+     * 8.  V: smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *          OpenAPI_up_cnx_state_DEACTIVATED)
+     */
+                                ogs_assert(OGS_OK ==
+                                    smf_5gc_pfcp_send_all_pdr_modification_request(
+                                        sess, stream,
+                                        OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+                                        OGS_PFCP_MODIFY_DL_ONLY|
+                                        OGS_PFCP_MODIFY_DEACTIVATE, 0, 0));
+                            } else if (sess->nsmf_param.up_cnx_state ==
+                                    OpenAPI_up_cnx_state_ACTIVATING) {
+    /*
+     * UE-requested PDU Session Modification(ACTIVATING)
+     *
+     * 1.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 2.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     *        SMF_UPDATE_STATE_HR_ACTIVATING
+     * 3.  H*: smf_nsmf_handle_update_data_in_hsmf
+     * 4.  H*: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 5.  H*: ogs_sbi_send_http_status_no_content
+     * 6.  V: ngap_build_pdu_session_resource_setup_request_transfer
+     * 7.  V: smf_sbi_send_sm_context_updated_data(
+     *          OpenAPI_up_cnx_state_ACTIVATING,
+     *          OpenAPI_n2_sm_info_type_PDU_RES_SETUP_REQ, n2smbuf)
+     */
+                                ogs_assert(true ==
+                                        ogs_sbi_send_http_status_no_content(
+                                            stream));
+                            } else if (sess->nsmf_param.up_cnx_state ==
+                                    OpenAPI_up_cnx_state_ACTIVATED) {
+    /*
+     * UE-requested PDU Session Modification(ACTIVATED)
+     *
+     * 1.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 2.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_DL_ONLY|
+     *        OGS_PFCP_MODIFY_OUTER_HEADER_REMOVAL|OGS_PFCP_MODIFY_ACTIVATE
+     * 3.  V: if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING)
+     *           pfcp_flags |= OGS_PFCP_MODIFY_FROM_ACTIVATING;
+     * 4.  V: flags & OGS_PFCP_MODIFY_FROM_ACTIVATING ?
+     *           SMF_UPDATE_STATE_HR_ACTIVATED_FROM_ACTIVATING :
+     *           SMF_UPDATE_STATE_HR_ACTIVATED_FROM_NON_ACTIVATING,
+     * 5.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 6.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 7.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 8.  H*: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_DL_ONLY|
+     *         OGS_PFCP_MODIFY_ACTIVATE
+     * 9.  H: ogs_sbi_send_http_status_no_content
+     * 10. V: case SMF_UPDATE_STATE_HR_ACTIVATED_FROM_ACTIVATING:
+     *           sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+     *           smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *               OpenAPI_up_cnx_state_ACTIVATED);
+     *        case SMF_UPDATE_STATE_HR_ACTIVATED_FROM_NON_ACTIVATING:
+     *           ogs_sbi_send_http_status_no_content
+     */
+                                bool far_update = false;
+
+                                if (memcmp(
+                                        &sess->nsmf_param.dl_ip,
+                                        &sess->remote_dl_ip,
+                                        sizeof(sess->nsmf_param.dl_ip)) != 0 ||
+                                    sess->nsmf_param.dl_teid !=
+                                        sess->remote_dl_teid)
+                                    far_update = true;
+
+                                ogs_list_for_each(
+                                        &sess->bearer_list, qos_flow) {
+                                    ogs_pfcp_far_t *dl_far = qos_flow->dl_far;
+                                    ogs_assert(dl_far);
+
+                                    if (dl_far->apply_action !=
+                                            OGS_PFCP_APPLY_ACTION_FORW)
+                                        far_update = true;
+
+                                    dl_far->apply_action =
+                                        OGS_PFCP_APPLY_ACTION_FORW;
+                                    ogs_assert(OGS_OK ==
+                                        ogs_pfcp_ip_to_outer_header_creation(
+                                            &sess->remote_dl_ip,
+                                            &dl_far->outer_header_creation,
+                                            &dl_far->outer_header_creation_len)
+                                        );
+                                    dl_far->outer_header_creation.teid =
+                                        sess->remote_dl_teid;
+                                }
+
+                                if (far_update) {
+                                    ogs_assert(OGS_OK ==
+                                        smf_5gc_pfcp_send_all_pdr_modification_request(
+                                            sess, stream,
+                                            OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+                                            OGS_PFCP_MODIFY_DL_ONLY|
+                                            OGS_PFCP_MODIFY_ACTIVATE, 0, 0));
+                                } else {
+                                    ogs_assert(true ==
+                                            ogs_sbi_send_http_status_no_content(
+                                                stream));
+                                }
+                            } else if (sess->nsmf_param.pfcp_flags) {
+                                ogs_assert(true ==
+                                        ogs_sbi_send_http_status_no_content(
+                                            stream));
+
+                                ogs_assert(OGS_OK ==
+                                        smf_5gc_pfcp_send_qos_flow_list_modification_request(
+                                            sess, NULL,
+                                            OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+                                            OGS_PFCP_MODIFY_UE_REQUESTED|
+                                            sess->nsmf_param.pfcp_flags, 0));
+                            } else {
+                                ogs_fatal("Invalid upCnxState:%d"
+                                        "pfcp_flags:0x%llx",
+                                        sess->nsmf_param.up_cnx_state,
+                                        (long long)sess->nsmf_param.pfcp_flags);
+                                ogs_assert_if_reached();
+                            }
+                            break;
+                        case OpenAPI_request_indication_UE_REQ_PDU_SES_REL:
+                        case OpenAPI_request_indication_NW_REQ_PDU_SES_REL:
+                            if (sess->nsmf_param.request_indication ==
+                                    OpenAPI_request_indication_UE_REQ_PDU_SES_REL) {
+    /*
+     * UE-requested PDU Session Release
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 3.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H*: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H*: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 6.  H*: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 7.  H*: ogs_sbi_send_http_status_no_content
+     * 8.  H*: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_wait_5gc_n1_n2_release);
+     * 11. V: smf_nsmf_handle_update_data_in_vsmf
+     * 12. V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V: ngap_build_pdu_session_resource_release_command_transfer+
+     *        gsm_build_pdu_session_release_command
+     * 16  V: OGS_FSM_TRAN(&sess->sm, smf_gsm_state_wait_5gc_n1_n2_release)
+     * 17. V: ogs_sbi_send_http_status_no_content(stream)
+     * 18. V: case OpenAPI_n2_sm_info_type_PDU_RES_REL_RSP:
+     *        case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE:
+     * 19. V: ogs_sbi_send_http_status_no_content(vsmf_to_hsmf_release_stream)
+     * 20. V: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 21. H: case OGS_EVENT_SBI_CLIENT:
+     * 22. H: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 23. H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_N1N2_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 24. H: smf_sbi_send_status_notify+SMF_SESS_CLEAR(sess)
+     * 25. V: case OGS_EVENT_SBI_SERVER:
+     * 26. V: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 27. V: ogs_sbi_send_http_status_no_content+
+     *        smf_sbi_send_sm_context_status_notify
+     * 28. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                                e->h.sbi.state =
+                                    OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED;
+                            } else if (sess->nsmf_param.request_indication ==
+                                    OpenAPI_request_indication_NW_REQ_PDU_SES_REL) {
+    /*
+     * Network-requested PDU Session Release(DUPLICATED)
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT,
+     * 3.  V: OpenAPI_request_indication_NW_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H*: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H*: OpenAPI_request_indication_NW_REQ_PDU_SES_REL
+     * 6.  H*: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT
+     * 7.  H*: ogs_sbi_send_http_status_no_content
+     * 8.  H*: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_AMF_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 11. H: SMF_SESS_CLEAR(sess)
+     * 12. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT
+     * 13. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 14. V: ogs_sbi_send_http_status_no_content
+     * 15. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                                e->h.sbi.state =
+                                OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT;
+                            }
+    /*
+     * TS23.502 clause 4.3.4.3 UE or network requested PDU Session Release
+     * for Home-routed Roaming.
+     *
+     * In step 1a/1f, upon receiving Nsmf_PDUSession_Update from V-SMF,
+     * H-SMF SHALL immediately send the Update Response, then issue PFCP
+     * Session Deletion. This ordering is per the standard, even for duplicate
+     * sessions, and may overlap with AMF’s concurrent Create Session.
+     *
+     * 1a. (UE initiated release)
+     * 1f. This step is the same as step 1f in clause 4.3.4.2,
+     *     with the addition that:
+     *  - the V-SMF initiates N4 Session Modification to instruct the V-UPF
+     *    to stop forwarding uplink traffic; and
+     *  - the V-SMF invokes the Nsmf_PDUSession_Update Request towards H-SMF.
+     *    (OpenAPI_cause_REL_DUE_TO_DUPLICATE_SESSION_ID);
+     */
+                            ogs_assert(true ==
+                                    ogs_sbi_send_http_status_no_content(
+                                        stream));
+
+                            OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion);
+                            break;
+                        default:
+                            ogs_error("Unknown request_indication:%d",
+                                    sess->nsmf_param.request_indication);
+                        }
+                    } else {
+                        ogs_error("smf_nsmf_handle_update_data_in_hsmf() "
+                                "failed");
+                    }
+                    break;
+                CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
+    /*
+     * Network-requested PDU Session Release
+     *
+     * 1.  V: smf_nsmf_handle_release_sm_context
+     * 2.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 3.  V: OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 4.  V: smf_nsmf_pdusession_build_release_data
+     * 5.  H*: smf_nsmf_handle_release_data_in_hsmf
+     * 6.  H*: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 7.  H*: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 8.  H: ogs_sbi_send_http_status_no_content
+     * 9.  H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_AMF_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 11. H: SMF_SESS_CLEAR(sess)
+     * 12. V*: smf_nsmf_handle_release_data_in_hsmf
+     * 13. V*: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 14. V*: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V: ogs_sbi_send_http_status_no_content
+     * 16. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                    smf_nsmf_handle_release_data_in_hsmf(
+                            sess, stream, sbi_message);
+                    e->h.sbi.state =
+                        OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT;
+                    OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion);
+                    break;
+                DEFAULT
+                    ogs_error("Invalid resource name %s",
+                                sbi_message->h.resource.component2);
+                    ogs_assert(true ==
+                        ogs_sbi_server_send_error(stream,
+                            OGS_SBI_HTTP_STATUS_BAD_REQUEST, sbi_message,
+                            "Invalid resource name %s",
+                            sbi_message->h.resource.component2, NULL));
+                    OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                END
                 break;
-            CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
-                smf_nsmf_handle_release_sm_context(sess, stream, sbi_message);
+
+            CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+                SWITCH(sbi_message->h.resource.component2)
+                CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
+    /*
+     * Network-requested PDU Session Modification
+     *
+     * 1.  H: OpenAPI_request_indication_NW_REQ_PDU_SES_MOD
+     *        QOS_RULE_CODE_FROM_PFCP_FLAGS
+     *        QOS_RULE_FLOW_DESCRIPTION_CODE_FROM_PFCP_FLAGS
+     * 2.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 3.  V*: smf_nsmf_handle_update_data_in_vsmf
+     * 4.  V: gsm_build_pdu_session_modification_command+
+     *        ngap_build_pdu_session_resource_modify_request_transfer
+     * 5.  V: OpenAPI_n2_sm_info_type_PDU_RES_MOD_RSP
+     *        if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING)
+     *            sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+     *            smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *                  OpenAPI_up_cnx_state_ACTIVATED)
+     *        else
+     *            ogs_sbi_send_http_status_no_content(stream)
+     * 6.  V: ogs_sbi_send_http_status_no_content(stream)
+     *        OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMPLETE:
+     *        ogs_sbi_send_http_status_no_content(vsmf_to_hsmf_modify_stream));
+     * 7.  V: case OGS_EVENT_SBI_CLIENT
+     *        CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 8.  H: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+     *        OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE
+     */
+                    rc = smf_nsmf_handle_update_data_in_vsmf(
+                            sess, stream, sbi_message);
+
+                    if (rc == true) {
+                        switch (sess->nsmf_param.request_indication) {
+                        case OpenAPI_request_indication_UE_REQ_PDU_SES_MOD:
+                        case OpenAPI_request_indication_NW_REQ_PDU_SES_MOD:
+                            break;
+                        case OpenAPI_request_indication_UE_REQ_PDU_SES_REL:
+                        case OpenAPI_request_indication_NW_REQ_PDU_SES_REL:
+    /*
+     * UE-requested PDU Session Release
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 3.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_wait_5gc_n1_n2_release);
+     * 11. V*: smf_nsmf_handle_update_data_in_vsmf
+     * 12. V*: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 13. V*: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 14. V*: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V: ngap_build_pdu_session_resource_release_command_transfer+
+     *        gsm_build_pdu_session_release_command
+     * 16  V: OGS_FSM_TRAN(&sess->sm, smf_gsm_state_wait_5gc_n1_n2_release)
+     * 17. V: ogs_sbi_send_http_status_no_content(stream)
+     * 18. V: case OpenAPI_n2_sm_info_type_PDU_RES_REL_RSP:
+              case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE:
+     * 19. V: ogs_sbi_send_http_status_no_content(vsmf_to_hsmf_release_stream)
+     * 20. V: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 21. H: case OGS_EVENT_SBI_CLIENT:
+     * 22. H: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 23. H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_N1N2_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 24. H: smf_sbi_send_status_notify+SMF_SESS_CLEAR(sess)
+     * 25. V: case OGS_EVENT_SBI_SERVER:
+     * 26. V: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 27. V: ogs_sbi_send_http_status_no_content+
+     *        smf_sbi_send_sm_context_status_notify
+     * 28. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                            e->h.sbi.state =
+                                OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED;
+                            OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion);
+                            break;
+                        default:
+                            ogs_error("Unknown request_indication:%d",
+                                    sess->nsmf_param.request_indication);
+                        }
+                    } else {
+                        ogs_error("smf_nsmf_handle_update_data_in_vsmf() "
+                                "failed");
+                    }
+                    break;
+                DEFAULT
+                    ogs_error("Invalid resource name %s",
+                                sbi_message->h.resource.component2);
+                    ogs_assert(true ==
+                        ogs_sbi_server_send_error(stream,
+                            OGS_SBI_HTTP_STATUS_BAD_REQUEST, sbi_message,
+                            "Invalid resource name %s",
+                            sbi_message->h.resource.component2, NULL));
+                    OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                END
                 break;
+
             DEFAULT
                 ogs_error("Invalid resource name %s",
-                            sbi_message->h.resource.component2);
+                            sbi_message->h.resource.component0);
                 ogs_assert(true ==
                     ogs_sbi_server_send_error(stream,
                         OGS_SBI_HTTP_STATUS_BAD_REQUEST, sbi_message,
                         "Invalid resource name %s",
-                        sbi_message->h.resource.component2, NULL));
+                        sbi_message->h.resource.component0, NULL));
                 OGS_FSM_TRAN(s, smf_gsm_state_exception);
             END
             break;
@@ -1001,141 +1527,285 @@
         smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
         ogs_assert(smf_ue);
 
+        stream_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
+        if (stream_id >= OGS_MIN_POOL_ID && stream_id <= OGS_MAX_POOL_ID)
+            stream = ogs_sbi_stream_find_by_id(stream_id);
+
         SWITCH(sbi_message->h.service.name)
-        CASE(OGS_SBI_SERVICE_NAME_NPCF_SMPOLICYCONTROL)
+        CASE(OGS_SBI_SERVICE_NAME_NAMF_COMM)
+            SWITCH(sbi_message->h.resource.component0)
+            CASE(OGS_SBI_RESOURCE_NAME_UE_CONTEXTS)
+                smf_namf_comm_handle_n1_n2_message_transfer(
+                        sess, stream, e->h.sbi.state, sbi_message);
+                break;
+
+            DEFAULT
+                ogs_error("%s:%d Invalid resource name %s",
+                        smf_ue->supi, sess->psi,
+                        sbi_message->h.resource.component0);
+                ogs_assert_if_reached();
+            END
+            break;
+
+        CASE(OGS_SBI_SERVICE_NAME_NSMF_PDUSESSION)
             stream_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
             if (stream_id >= OGS_MIN_POOL_ID && stream_id <= OGS_MAX_POOL_ID)
                 stream = ogs_sbi_stream_find_by_id(stream_id);
 
-            state = e->h.sbi.state;
-
             SWITCH(sbi_message->h.resource.component0)
-            CASE(OGS_SBI_RESOURCE_NAME_SM_POLICIES)
-                if (!sbi_message->h.resource.component1) {
-                    ogs_assert(stream);
-                    strerror = ogs_msprintf(
-                            "%s:%d HTTP response error %d",
-                            smf_ue->supi, sess->psi,
-                            sbi_message->res_status);
-                    ogs_assert(strerror);
-
-                    ogs_error("%s", strerror);
-                    ogs_assert(true ==
-                        ogs_sbi_server_send_error(
-                            stream, sbi_message->res_status,
-                            sbi_message, strerror, NULL,
-                            (sbi_message->ProblemDetails) ?
-                                    sbi_message->ProblemDetails->cause : NULL));
-                    ogs_free(strerror);
-
-                    OGS_FSM_TRAN(s, smf_gsm_state_exception);
-                    break;
-                } else {
+            CASE(OGS_SBI_RESOURCE_NAME_PDU_SESSIONS)
+                SWITCH(sbi_message->h.method)
+                CASE(OGS_SBI_HTTP_METHOD_POST)
                     SWITCH(sbi_message->h.resource.component2)
-                    CASE(OGS_SBI_RESOURCE_NAME_DELETE)
-                        PCF_SM_POLICY_CLEAR(sess);
-
-                        if (sbi_message->res_status !=
-                                OGS_SBI_HTTP_STATUS_NO_CONTENT) {
-                            ogs_error("%s:%d HTTP response error %d",
-                                    smf_ue->supi, sess->psi,
-                                    sbi_message->res_status);
-                            /* In spite of error from PCF, continue with
-                               session teardown, so as to not leave stale
-                               sessions. */
-                        }
-
-                        if (state == OGS_PFCP_DELETE_TRIGGER_SMF_INITIATED) {
-                            OGS_FSM_TRAN(&sess->sm, smf_gsm_state_wait_5gc_n1_n2_release);
-
-                            smf_n1_n2_message_transfer_param_t param;
-
-                            memset(&param, 0, sizeof(param));
-                            param.state = SMF_NETWORK_REQUESTED_PDU_SESSION_RELEASE;
-                            sess->pti = OGS_NAS_PROCEDURE_TRANSACTION_IDENTITY_UNASSIGNED;
-                            param.n1smbuf = gsm_build_pdu_session_release_command(
-                                sess, OGS_5GSM_CAUSE_REACTIVATION_REQUESTED);
-                            ogs_assert(param.n1smbuf);
-
-                            param.n2smbuf =
-                                ngap_build_pdu_session_resource_release_command_transfer(
-                                    sess, SMF_NGAP_STATE_DELETE_TRIGGER_SMF_INITIATED,
-                                    NGAP_Cause_PR_nas, NGAP_CauseNas_normal_release);
-                            ogs_assert(param.n2smbuf);
-
+                    CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
+/*
+ * PFCP delete triggers are defined in lib/pfcp/xact.h (values 1–7).
+ * To avoid overlap with OGS_PFCP_DELETE_TRIGGER_*, SMF states use:
+ *   - UPDATE_STATE_BASE at 0x10–0x14
+ *   - UECM_STATE_BASE   at 0x20–0x23
+ * HR flag is bit 7 (0x80).
+ */
+                        switch (e->h.sbi.state) {
+                        case OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED:
+                            if (sess->amf_to_vsmf_release_stream_id >=
+                                    OGS_MIN_POOL_ID &&
+                                sess->amf_to_vsmf_release_stream_id <=
+                                    OGS_MAX_POOL_ID)
+                                ogs_error("UE requested release stream ID %d"
+                                        "has not been used yet",
+                                        sess->amf_to_vsmf_release_stream_id);
+                            /* Store Stream ID */
+                            sess->amf_to_vsmf_release_stream_id =
+                                ogs_sbi_id_from_stream(stream);
+                            break;
+                        case OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT:
     /*
-     * Skip_ind is not used when changing the PDU Session Anchor.
-     * param.skip_ind = false;
+     * Network-requested PDU Session Release(DUPLICATED)
      *
-     * TS23.502
-     * 4.3.4 PDU Session Release
-     * 4.3.4.2 UE or network requested PDU Session Release for Non-Roaming
-     * and Roaming with Local Breakout
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT,
+     * 3.  V: OpenAPI_request_indication_NW_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_NW_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_AMF_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 11. H: SMF_SESS_CLEAR(sess)
+     * 12. V*: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT
+     * 13. V*: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 14. V: ogs_sbi_send_http_status_no_content
+     * 15. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                            OGS_FSM_TRAN(&sess->sm,
+                                    &smf_gsm_state_wait_pfcp_deletion);
+                            break;
+                        case SMF_UPDATE_STATE_DEACTIVATED:
+    /*
+     * UE-requested PDU Session Modification(DEACTIVATED)
      *
-     * 3b. ...
+     * For Home Routed Roaming, delegate PFCP deactivation to H-SMF by
+     * sending UP_CNX_STATE=DEACTIVATED via HsmfUpdateData.
      *
-     * The "skip indicator" tells the AMF whether it may skip sending
-     * the N1 SM container to the UE (e.g. when the UE is in CM-IDLE state).
-     * SMF includes the "skip indicator"
-     * in the Namf_Communication_N1N2MessageTransfer
-     * except when the procedure is triggered to change PDU Session Anchor
-     * of a PDU Session with SSC mode 2.
+     * 1.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 2.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     *        SMF_UPDATE_STATE_HR_DEACTIVATED
+     * 3.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 4.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 5.  H: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_DL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 6.  H: ogs_sbi_send_http_status_no_content
+     * 7.  V*: case SMF_UPDATE_STATE_HR_DEACTIVATED:
+     * 8.  V*: smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *           OpenAPI_up_cnx_state_DEACTIVATED)
+     */
+                            smf_sbi_send_sm_context_updated_data_up_cnx_state(
+                                    sess, stream,
+                                    OpenAPI_up_cnx_state_DEACTIVATED);
+                            break;
+                        case SMF_UPDATE_STATE_ACTIVATING:
+    /*
+     * UE-requested PDU Session Modification(ACTIVATING)
      *
-     * Related Issue #2396
+     * 1.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 2.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     *        SMF_UPDATE_STATE_HR_ACTIVATING
+     * 3.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 4.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 5.  H: ogs_sbi_send_http_status_no_content
+     * 6.  V*: ngap_build_pdu_session_resource_setup_request_transfer
+     * 7.  V*: smf_sbi_send_sm_context_updated_data(
+     *           OpenAPI_up_cnx_state_ACTIVATING,
+     *           OpenAPI_n2_sm_info_type_PDU_RES_SETUP_REQ, n2smbuf)
      */
-
-                            smf_namf_comm_send_n1_n2_message_transfer(sess, &param);
-                        } else {
+                            n2smbuf =
+                                ngap_build_pdu_session_resource_setup_request_transfer(sess);
+                            ogs_assert(n2smbuf);
+
+                            smf_sbi_send_sm_context_updated_data(
+                                    sess, stream,
+                                    OpenAPI_up_cnx_state_ACTIVATING, 0,
+                                    NULL,
+                                    OpenAPI_n2_sm_info_type_PDU_RES_SETUP_REQ,
+                                    n2smbuf);
+                            break;
+                        case SMF_UPDATE_STATE_ACTIVATED_FROM_ACTIVATING:
+                            sess->up_cnx_state =
+                                OpenAPI_up_cnx_state_ACTIVATED;
+                            smf_sbi_send_sm_context_updated_data_up_cnx_state(
+                                    sess, stream,
+                                    OpenAPI_up_cnx_state_ACTIVATED);
+                            break;
+                        case SMF_UPDATE_STATE_ACTIVATED_FROM_NON_ACTIVATING:
+                            ogs_assert(true ==
+                                    ogs_sbi_send_http_status_no_content(
+                                        stream));
+                            break;
+                        case SMF_UPDATE_STATE_ACTIVATED_FROM_XN_HANDOVER:
+                            n2smbuf =
+                                ngap_build_path_switch_request_ack_transfer(
+                                        sess);
+                            ogs_assert(n2smbuf);
+
+                            smf_sbi_send_sm_context_updated_data_n2smbuf(
+                                    sess, stream,
+                                    OpenAPI_n2_sm_info_type_PATH_SWITCH_REQ_ACK,
+                                    n2smbuf);
+                            break;
+                        case SMF_UPDATE_STATE_ACTIVATED_FROM_N2_HANDOVER:
+                            if (smf_sess_have_indirect_data_forwarding(sess) ==
+                                    true) {
+                                ogs_assert(OGS_OK ==
+                                    smf_5gc_pfcp_send_all_pdr_modification_request(
+                                        sess, stream,
+                                        OGS_PFCP_MODIFY_INDIRECT|
+                                        OGS_PFCP_MODIFY_REMOVE,
+                                        0,
+                                        ogs_local_conf()->
+                                            time.handover.duration));
+                            }
+
+                            smf_sbi_send_sm_context_updated_data_ho_state(
+                                    sess, stream, OpenAPI_ho_state_COMPLETED);
+                            break;
+                        case SMF_UPDATE_STATE_UE_REQ_MOD:
+                            if (sess->amf_to_vsmf_modify_stream_id >=
+                                    OGS_MIN_POOL_ID &&
+                                sess->amf_to_vsmf_modify_stream_id <=
+                                    OGS_MAX_POOL_ID)
+                                ogs_error("UE requested modification stream ID "
+                                        "%d has not been used yet",
+                                        sess->amf_to_vsmf_modify_stream_id);
+                            sess->amf_to_vsmf_modify_stream_id =
+                                ogs_sbi_id_from_stream(stream);
+                            break;
+                        default:
+                            ogs_fatal("Unknown state 0x%x", e->h.sbi.state);
+                            ogs_assert_if_reached();
+                        }
+                        break;
+                    CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
+                        if (e->h.sbi.state ==
+                                OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT)
                             OGS_FSM_TRAN(&sess->sm,
                                     &smf_gsm_state_wait_pfcp_deletion);
-                        }
                         break;
-
                     DEFAULT
-                        strerror = ogs_msprintf("%s:%d "
-                                "Unknown resource name %s",
-                                smf_ue->supi, sess->psi,
-                                sbi_message->h.resource.component2);
-                        ogs_assert(strerror);
-
-                        ogs_error("%s", strerror);
-                        if (stream)
-                            ogs_assert(true ==
-                                ogs_sbi_server_send_error(stream,
-                                    OGS_SBI_HTTP_STATUS_BAD_REQUEST,
-                                    sbi_message, strerror, NULL, NULL));
-                        ogs_free(strerror);
-                        OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                        if (smf_nsmf_handle_created_data_in_vsmf(
+                                    sess, sbi_message) == false) {
+                            ogs_error("%s:%d create_pdu_session "
+                                    "failed() %d",
+                                    smf_ue->supi, sess->psi,
+                                    sbi_message->res_status);
+                            OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                        }
                     END
-                }
-                break;
+                    break;
 
-            DEFAULT
-                strerror = ogs_msprintf("%s:%d Invalid resource name %s",
-                        smf_ue->supi, sess->psi,
-                        sbi_message->h.resource.component0);
-                ogs_assert(strerror);
+                DEFAULT
+                    ogs_error("Invalid HTTP method %s",
+                            sbi_message->h.method);
+                    ogs_assert_if_reached();
+                END
+                break;
 
-                ogs_error("%s", strerror);
-                ogs_assert(true ==
-                    ogs_sbi_server_send_error(stream,
-                        OGS_SBI_HTTP_STATUS_BAD_REQUEST,
-                        sbi_message, strerror, NULL, NULL));
-                ogs_free(strerror);
-                OGS_FSM_TRAN(s, smf_gsm_state_exception);
-            END
-            break;
+            CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+                SWITCH(sbi_message->h.resource.component2)
+                CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
+    /*
+     * Network-requested PDU Session Modification
+     *
+     * 1.  H: OpenAPI_request_indication_NW_REQ_PDU_SES_MOD
+     *        QOS_RULE_CODE_FROM_PFCP_FLAGS
+     *        QOS_RULE_FLOW_DESCRIPTION_CODE_FROM_PFCP_FLAGS
+     * 2.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 3.  V: smf_nsmf_handle_update_data_in_vsmf
+     * 4.  V: gsm_build_pdu_session_modification_command+
+     *        ngap_build_pdu_session_resource_modify_request_transfer
+     * 5.  V: OpenAPI_n2_sm_info_type_PDU_RES_MOD_RSP
+     *        if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING)
+     *            sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+     *            smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *                  OpenAPI_up_cnx_state_ACTIVATED)
+     *        else
+     *            ogs_sbi_send_http_status_no_content(stream)
+     * 6.  V: ogs_sbi_send_http_status_no_content(stream)
+     *         OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMPLETE:
+     *         ogs_sbi_send_http_status_no_content(vsmf_to_hsmf_modify_stream));
+     * 7.  V*: case OGS_EVENT_SBI_CLIENT
+     *         CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 8.  H*: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+     *         OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE
+     */
+                    switch (e->h.sbi.state) {
+                    case SMF_CREATE_STATE_NONE:
+                        ogs_list_for_each_entry(
+                                &sess->qos_flow_to_modify_list,
+                                qos_flow, to_modify_node) {
+                            ogs_pfcp_far_t *dl_far = qos_flow->dl_far;
+                            ogs_assert(dl_far);
+
+                            dl_far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
+                            ogs_assert(OGS_OK ==
+                                ogs_pfcp_ip_to_outer_header_creation(
+                                    &sess->remote_dl_ip,
+                                    &dl_far->outer_header_creation,
+                                    &dl_far->outer_header_creation_len));
+                            dl_far->outer_header_creation.teid =
+                                sess->remote_dl_teid;
+                        }
 
-        CASE(OGS_SBI_SERVICE_NAME_NAMF_COMM)
-            SWITCH(sbi_message->h.resource.component0)
-            CASE(OGS_SBI_RESOURCE_NAME_UE_CONTEXTS)
-                smf_namf_comm_handle_n1_n2_message_transfer(
-                        sess, e->h.sbi.state, sbi_message);
+                        ogs_assert(OGS_OK ==
+                                smf_5gc_pfcp_send_qos_flow_list_modification_request(
+                                    sess, NULL,
+                                    OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+                                    OGS_PFCP_MODIFY_DL_ONLY|
+                                    OGS_PFCP_MODIFY_ACTIVATE, 0));
+                        break;
+                    case SMF_UPDATE_STATE_NONE:
+                        /* Nothing to do */
+                        break;
+                    case SMF_REMOVE_STATE_NONE:
+                        /* Nothing to do */
+                        break;
+                    default:
+                        ogs_fatal("Unknown state %d", e->h.sbi.state);
+                        ogs_assert_if_reached();
+                    }
+                    break;
+                DEFAULT
+                    ogs_error("Invalid resource name %s",
+                            sbi_message->h.resource.component0);
+                    ogs_assert_if_reached();
+                END
                 break;
 
             DEFAULT
-                ogs_error("%s:%d Invalid resource name %s",
-                        smf_ue->supi, sess->psi,
+                ogs_error("Invalid resource name %s",
                         sbi_message->h.resource.component0);
                 ogs_assert_if_reached();
             END
@@ -1166,56 +1836,91 @@
 
         switch (nas_message->gsm.h.message_type) {
         case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST:
-            rv = gsm_handle_pdu_session_modification_request(sess, stream,
-                    &nas_message->gsm.pdu_session_modification_request);
-            if (rv != OGS_OK) {
-                ogs_error("%s:%d Cannot handle NAS message",
-                        smf_ue->supi, sess->psi);
-                OGS_FSM_TRAN(s, smf_gsm_state_exception);
+            if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+                sess->nsmf_param.request_indication =
+                    OpenAPI_request_indication_UE_REQ_PDU_SES_MOD;
+
+                r = smf_sbi_discover_and_send(
+                        OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                        smf_nsmf_pdusession_build_hsmf_update_data,
+                        sess, stream, SMF_UPDATE_STATE_UE_REQ_MOD, NULL);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
+            } else {
+                rv = gsm_handle_pdu_session_modification_request(sess, stream,
+                        &nas_message->gsm.pdu_session_modification_request);
+                if (rv != OGS_OK) {
+                    ogs_error("%s:%d Cannot handle NAS message",
+                            smf_ue->supi, sess->psi);
+                    OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                }
             }
             break;
 
         case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMPLETE:
             ogs_assert(true == ogs_sbi_send_http_status_no_content(stream));
+            if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+    /*
+     * Network-requested PDU Session Modification
+     *
+     * 1.  H: OpenAPI_request_indication_NW_REQ_PDU_SES_MOD
+     *        QOS_RULE_CODE_FROM_PFCP_FLAGS
+     *        QOS_RULE_FLOW_DESCRIPTION_CODE_FROM_PFCP_FLAGS
+     * 2.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 3.  V: smf_nsmf_handle_update_data_in_vsmf
+     * 4.  V: gsm_build_pdu_session_modification_command+
+     *        ngap_build_pdu_session_resource_modify_request_transfer
+     * 5.  V: OpenAPI_n2_sm_info_type_PDU_RES_MOD_RSP
+     *        if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING)
+     *            sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+     *            smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *                  OpenAPI_up_cnx_state_ACTIVATED)
+     *        else
+     *            ogs_sbi_send_http_status_no_content(stream)
+     * 6.  V*: ogs_sbi_send_http_status_no_content(stream)
+     *         OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMPLETE:
+     *         ogs_sbi_send_http_status_no_content(vsmf_to_hsmf_modify_stream));
+     * 7.  V: case OGS_EVENT_SBI_CLIENT
+     *        CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 8.  H: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+     *        OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE
+     */
+                ogs_sbi_stream_t *vsmf_to_hsmf_modify_stream = NULL;
+                if (sess->vsmf_to_hsmf_modify_stream_id >= OGS_MIN_POOL_ID &&
+                    sess->vsmf_to_hsmf_modify_stream_id <= OGS_MAX_POOL_ID)
+                    vsmf_to_hsmf_modify_stream =
+                        ogs_sbi_stream_find_by_id(
+                                sess->vsmf_to_hsmf_modify_stream_id);
+
+                if (vsmf_to_hsmf_modify_stream) {
+                    ogs_assert(true ==
+                            ogs_sbi_send_http_status_no_content(
+                                vsmf_to_hsmf_modify_stream));
+                    sess->vsmf_to_hsmf_modify_stream_id = OGS_INVALID_POOL_ID;
+                }
+            }
             break;
 
         case OGS_NAS_5GS_PDU_SESSION_RELEASE_REQUEST:
-            if (PCF_SM_POLICY_ASSOCIATED(sess)) {
-                smf_npcf_smpolicycontrol_param_t param;
-
-                memset(&param, 0, sizeof(param));
+            memset(&sess->nsmf_param, 0, sizeof(sess->nsmf_param));
 
-                param.ran_nas_release.gsm_cause =
-                    OGS_5GSM_CAUSE_REGULAR_DEACTIVATION;
-                param.ran_nas_release.ngap_cause.group = NGAP_Cause_PR_nas;
-                param.ran_nas_release.ngap_cause.value =
-                    NGAP_CauseNas_normal_release;
-
-                r = smf_sbi_discover_and_send(
-                        OGS_SBI_SERVICE_TYPE_NPCF_SMPOLICYCONTROL, NULL,
-                        smf_npcf_smpolicycontrol_build_delete,
+            sess->nsmf_param.gsm_cause =
+                OGS_5GSM_CAUSE_REGULAR_DEACTIVATION;
+            sess->nsmf_param.ngap_cause.group = NGAP_Cause_PR_nas;
+            sess->nsmf_param.ngap_cause.value =
+                NGAP_CauseNas_normal_release;
+
+            e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED;
+
+            if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+                ogs_assert(OGS_OK ==
+                    smf_5gc_pfcp_send_all_pdr_modification_request(
                         sess, stream,
-                        OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED, &param);
-                ogs_expect(r == OGS_OK);
-                ogs_assert(r != OGS_ERROR);
-            } else if (UDM_SDM_SUBSCRIBED(sess)) {
-                ogs_warn("%s:%d No PolicyAssociationId. "
-                        "Forcibly remove SESSION", smf_ue->supi, sess->psi);
-                r = smf_sbi_discover_and_send(
-                    OGS_SBI_SERVICE_TYPE_NUDM_SDM, NULL,
-                    smf_nudm_sdm_build_subscription_delete, sess, stream,
-                    SMF_UECM_STATE_DEREGISTERED_BY_AMF, NULL);
-                ogs_expect(r == OGS_OK);
-                ogs_assert(r != OGS_ERROR);
+                        OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+                        OGS_PFCP_MODIFY_UL_ONLY|OGS_PFCP_MODIFY_DEACTIVATE,
+                        e->h.sbi.state, 0));
             } else {
-                ogs_warn("%s:%d No SDM Subscription. "
-                        "Forcibly remove SESSION", smf_ue->supi, sess->psi);
-                r = smf_sbi_discover_and_send(
-                        OGS_SBI_SERVICE_TYPE_NUDM_UECM, NULL,
-                        smf_nudm_uecm_build_deregistration, sess, stream,
-                        SMF_UECM_STATE_DEREGISTERED_BY_AMF, NULL);
-                ogs_expect(r == OGS_OK);
-                ogs_assert(r != OGS_ERROR);
+                OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion);
             }
             break;
 
@@ -1272,6 +1977,31 @@
             break;
 
         case OpenAPI_n2_sm_info_type_PDU_RES_MOD_RSP:
+    /*
+     * Network-requested PDU Session Modification
+     *
+     * 1.  H: OpenAPI_request_indication_NW_REQ_PDU_SES_MOD
+     *        QOS_RULE_CODE_FROM_PFCP_FLAGS
+     *        QOS_RULE_FLOW_DESCRIPTION_CODE_FROM_PFCP_FLAGS
+     * 2.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 3.  V: smf_nsmf_handle_update_data_in_vsmf
+     * 4.  V: gsm_build_pdu_session_modification_command+
+     *        ngap_build_pdu_session_resource_modify_request_transfer
+     * 5.  V*: OpenAPI_n2_sm_info_type_PDU_RES_MOD_RSP
+     *        if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING)
+     *            sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+     *            smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *                  OpenAPI_up_cnx_state_ACTIVATED)
+     *        else
+     *            ogs_sbi_send_http_status_no_content(stream)
+     * 6.  V: ogs_sbi_send_http_status_no_content(stream)
+     *        OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMPLETE:
+     *        ogs_sbi_send_http_status_no_content(vsmf_to_hsmf_modify_stream));
+     * 7.  V: case OGS_EVENT_SBI_CLIENT
+     *        CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 8.  H: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+     *        OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE
+     */
             rv = ngap_handle_pdu_session_resource_modify_response_transfer(
                     sess, stream, pkbuf);
             if (rv != OGS_OK) {
@@ -1314,7 +2044,7 @@
 
                 param.n1n2_failure_txf_notif_uri = true;
 
-                smf_namf_comm_send_n1_n2_message_transfer(sess, &param);
+                smf_namf_comm_send_n1_n2_message_transfer(sess, NULL, &param);
             } else {
                 ogs_fatal("Invalid state %d", ngap_state);
                 ogs_assert_if_reached();
@@ -1353,16 +2083,76 @@
         }
         break;
 
-        case SMF_EVT_N4_TIMER:
-            switch (e->h.timer_id) {
-            case SMF_TIMER_PFCP_NO_ESTABLISHMENT_RESPONSE:
-                OGS_FSM_TRAN(s, smf_gsm_state_5gc_n1_n2_reject);
-                break;
-            default:
-                ogs_error("Unknown timer%s:%d",
-                        ogs_timer_get_name(e->h.timer_id), e->h.timer_id);
+    case SMF_EVT_SESSION_RELEASE:
+        smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+        ogs_assert(smf_ue);
+
+        ogs_info("%s:%d Session Release PFCP-Delete-Trigger:%d",
+            smf_ue->supi, sess->psi, e->h.sbi.state);
+
+        if (e->h.sbi.state == OGS_PFCP_DELETE_TRIGGER_SMF_INITIATED) {
+            if (HOME_ROUTED_ROAMING_IN_HSMF(sess)) {
+                memset(&sess->nsmf_param, 0, sizeof(sess->nsmf_param));
+
+                /* Network Requested PDU Session Release */
+                sess->nsmf_param.request_indication =
+                    OpenAPI_request_indication_NW_REQ_PDU_SES_REL;
+
+                r = smf_sbi_discover_and_send(
+                        OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                        smf_nsmf_pdusession_build_vsmf_update_data,
+                        sess, NULL, e->h.sbi.state, NULL);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
+
+            } else {
+                smf_n1_n2_message_transfer_param_t param;
+
+                memset(&param, 0, sizeof(param));
+                param.state = SMF_UE_OR_NETWORK_REQUESTED_PDU_SESSION_RELEASE;
+                sess->pti = OGS_NAS_PROCEDURE_TRANSACTION_IDENTITY_UNASSIGNED;
+                param.n1smbuf = gsm_build_pdu_session_release_command(
+                    sess, OGS_5GSM_CAUSE_REACTIVATION_REQUESTED);
+                ogs_assert(param.n1smbuf);
+
+                param.n2smbuf =
+                    ngap_build_pdu_session_resource_release_command_transfer(
+                        sess, SMF_NGAP_STATE_DELETE_TRIGGER_SMF_INITIATED,
+                        NGAP_Cause_PR_nas, NGAP_CauseNas_normal_release);
+                ogs_assert(param.n2smbuf);
+
+    /*
+     * Skip_ind is not used when changing the PDU Session Anchor.
+     * param.skip_ind = false;
+     *
+     * TS23.502
+     * 4.3.4 PDU Session Release
+     * 4.3.4.2 UE or network requested PDU Session Release for Non-Roaming
+     * and Roaming with Local Breakout
+     *
+     * 3b. ...
+     *
+     * The "skip indicator" tells the AMF whether it may skip sending
+     * the N1 SM container to the UE (e.g. when the UE is in CM-IDLE state).
+     * SMF includes the "skip indicator"
+     * in the Namf_Communication_N1N2MessageTransfer
+     * except when the procedure is triggered to change PDU Session Anchor
+     * of a PDU Session with SSC mode 2.
+     *
+     * Related Issue #2396
+     */
+
+                smf_namf_comm_send_n1_n2_message_transfer(sess, NULL, &param);
             }
-            break;
+
+            OGS_FSM_TRAN(s, smf_gsm_state_wait_5gc_n1_n2_release);
+
+        } else {
+
+            OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion);
+
+        }
+        break;
 
     default:
         ogs_error("Unknown event %s", smf_event_get_name(e));
@@ -1375,6 +2165,7 @@
 
     smf_ue_t *smf_ue = NULL;
     smf_sess_t *sess = NULL;
+    ogs_pkbuf_t *n2smbuf = NULL;
 
     ogs_sbi_stream_t *stream = NULL;
     ogs_pool_id_t stream_id = OGS_INVALID_POOL_ID;
@@ -1407,14 +2198,8 @@
         } else {
             /* 5GC */
             stream_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
-            ogs_assert(stream_id >= OGS_MIN_POOL_ID &&
-                    stream_id <= OGS_MAX_POOL_ID);
-
-            stream = ogs_sbi_stream_find_by_id(stream_id);
-            if (!stream) {
-                ogs_error("STREAM has already been removed %d", stream_id);
-                break;
-            }
+            if (stream_id >= OGS_MIN_POOL_ID && stream_id <= OGS_MAX_POOL_ID)
+                stream = ogs_sbi_stream_find_by_id(stream_id);
 
             ogs_assert(OGS_OK ==
                 smf_5gc_pfcp_send_session_deletion_request(
@@ -1456,7 +2241,7 @@
                     OGS_FSM_TRAN(s, smf_gsm_state_wait_epc_auth_release);
                 /* else: free session? */
             } else {
-                int trigger;
+                int r, trigger;
 
                 if (pfcp_xact->assoc_stream_id >= OGS_MIN_POOL_ID &&
                         pfcp_xact->assoc_stream_id <= OGS_MAX_POOL_ID)
@@ -1488,60 +2273,380 @@
                 } else if (trigger == OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED) {
                     ogs_pkbuf_t *n1smbuf = NULL, *n2smbuf = NULL;
 
-                    n1smbuf = gsm_build_pdu_session_release_command(
-                            sess, OGS_5GSM_CAUSE_REGULAR_DEACTIVATION);
-                    ogs_assert(n1smbuf);
-
-                    n2smbuf = ngap_build_pdu_session_resource_release_command_transfer(
-                            sess, SMF_NGAP_STATE_DELETE_TRIGGER_UE_REQUESTED,
-                            NGAP_Cause_PR_nas, NGAP_CauseNas_normal_release);
-                    ogs_assert(n2smbuf);
+                    if (HOME_ROUTED_ROAMING_IN_HSMF(sess)) {
+    /*
+     * UE-requested PDU Session Release
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 3.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H*: smf_nsmf_pdusession_build_vsmf_update_data
+     * 10. H*: OGS_FSM_TRAN(s, smf_gsm_state_wait_5gc_n1_n2_release);
+     * 11. V: smf_nsmf_handle_update_data_in_vsmf
+     * 12. V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V: ngap_build_pdu_session_resource_release_command_transfer+
+     *        gsm_build_pdu_session_release_command
+     * 16  V: OGS_FSM_TRAN(&sess->sm, smf_gsm_state_wait_5gc_n1_n2_release)
+     * 17. V: ogs_sbi_send_http_status_no_content(stream)
+     * 18. V: case OpenAPI_n2_sm_info_type_PDU_RES_REL_RSP:
+              case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE:
+     * 19. V: ogs_sbi_send_http_status_no_content(vsmf_to_hsmf_release_stream)
+     * 20. V: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 21. H: case OGS_EVENT_SBI_CLIENT:
+     * 22. H: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 23. H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_N1N2_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 24. H: smf_sbi_send_status_notify+SMF_SESS_CLEAR(sess)
+     * 25. V: case OGS_EVENT_SBI_SERVER:
+     * 26. V: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 27. V: ogs_sbi_send_http_status_no_content+
+     *        smf_sbi_send_sm_context_status_notify
+     * 28. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
 
-                    ogs_assert(stream);
-                    smf_sbi_send_sm_context_updated_data_n1_n2_message(
-                            sess, stream,
-                            n1smbuf, OpenAPI_n2_sm_info_type_PDU_RES_REL_CMD,
-                            n2smbuf);
+                        if (sess->nsmf_param.request_indication !=
+                                OpenAPI_request_indication_UE_REQ_PDU_SES_REL) {
+                            ogs_fatal("Invalid request_indication = %d",
+                                    sess->nsmf_param.request_indication);
+                            ogs_assert_if_reached();
+                        }
+
+                        r = smf_sbi_discover_and_send(
+                                OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                                smf_nsmf_pdusession_build_vsmf_update_data,
+                                sess, NULL, trigger, NULL);
+                        ogs_expect(r == OGS_OK);
+                        ogs_assert(r != OGS_ERROR);
+
+                    } else if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+    /*
+     * UE-requested PDU Session Release
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 3.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_wait_5gc_n1_n2_release);
+     * 11. V: smf_nsmf_handle_update_data_in_vsmf
+     * 12. V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V*: ngap_build_pdu_session_resource_release_command_transfer+
+     *         gsm_build_pdu_session_release_command
+     * 16  V*: OGS_FSM_TRAN(&sess->sm, smf_gsm_state_wait_5gc_n1_n2_release)
+     * 17. V: ogs_sbi_send_http_status_no_content(stream)
+     * 18. V: case OpenAPI_n2_sm_info_type_PDU_RES_REL_RSP:
+              case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE:
+     * 19. V: ogs_sbi_send_http_status_no_content(vsmf_to_hsmf_release_stream)
+     * 20. V: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 21. H: case OGS_EVENT_SBI_CLIENT:
+     * 22. H: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 23. H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_N1N2_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 24. H: smf_sbi_send_status_notify+SMF_SESS_CLEAR(sess)
+     * 25. V: case OGS_EVENT_SBI_SERVER:
+     * 26. V: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 27. V: ogs_sbi_send_http_status_no_content+
+     *        smf_sbi_send_sm_context_status_notify
+     * 28. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+
+                        smf_n1_n2_message_transfer_param_t param;
+                        ogs_sbi_stream_t *amf_to_vsmf_release_stream = NULL;
+
+                        if (sess->amf_to_vsmf_release_stream_id >=
+                                OGS_MIN_POOL_ID &&
+                            sess->amf_to_vsmf_release_stream_id <=
+                                OGS_MAX_POOL_ID)
+                            amf_to_vsmf_release_stream =
+                                ogs_sbi_stream_find_by_id(
+                                        sess->amf_to_vsmf_release_stream_id);
+
+                        if (amf_to_vsmf_release_stream) {
+                            ogs_assert(true ==
+                                    ogs_sbi_send_http_status_no_content(
+                                        amf_to_vsmf_release_stream));
+                            sess->amf_to_vsmf_release_stream_id =
+                                OGS_INVALID_POOL_ID;
+                        }
+
+                        memset(&param, 0, sizeof(param));
+                        param.state =
+                            SMF_UE_OR_NETWORK_REQUESTED_PDU_SESSION_RELEASE;
+                        param.n1smbuf = gsm_build_pdu_session_release_command(
+                            sess, OGS_5GSM_CAUSE_REACTIVATION_REQUESTED);
+                        ogs_assert(param.n1smbuf);
+
+                        param.n2smbuf =
+                            ngap_build_pdu_session_resource_release_command_transfer(
+                                sess,
+                                SMF_NGAP_STATE_DELETE_TRIGGER_UE_REQUESTED,
+                                NGAP_Cause_PR_nas,
+                                NGAP_CauseNas_normal_release);
+                        ogs_assert(param.n2smbuf);
+
+        /*
+         * Skip_ind is not used when changing the PDU Session Anchor.
+         * param.skip_ind = false;
+         *
+         * TS23.502
+         * 4.3.4 PDU Session Release
+         * 4.3.4.2 UE or network requested PDU Session Release for Non-Roaming
+         * and Roaming with Local Breakout
+         *
+         * 3b. ...
+         *
+         * The "skip indicator" tells the AMF whether it may skip sending
+         * the N1 SM container to the UE (e.g. when the UE is in CM-IDLE state).
+         * SMF includes the "skip indicator"
+         * in the Namf_Communication_N1N2MessageTransfer
+         * except when the procedure is triggered to change PDU Session Anchor
+         * of a PDU Session with SSC mode 2.
+         *
+         * Related Issue #2396
+         */
+
+                        smf_namf_comm_send_n1_n2_message_transfer(
+                                sess, stream, &param);
+
+                        OGS_FSM_TRAN(&sess->sm,
+                                smf_gsm_state_wait_5gc_n1_n2_release);
+
+                    } else {
+
+                        n1smbuf = gsm_build_pdu_session_release_command(
+                                sess, OGS_5GSM_CAUSE_REGULAR_DEACTIVATION);
+                        ogs_assert(n1smbuf);
+
+                        n2smbuf =
+                            ngap_build_pdu_session_resource_release_command_transfer(
+                                    sess,
+                                    SMF_NGAP_STATE_DELETE_TRIGGER_UE_REQUESTED,
+                                    NGAP_Cause_PR_nas,
+                                    NGAP_CauseNas_normal_release);
+                        ogs_assert(n2smbuf);
+
+                        ogs_assert(stream);
+                        smf_sbi_send_sm_context_updated_data_n1_n2_message(
+                                sess, stream, n1smbuf,
+                                OpenAPI_n2_sm_info_type_PDU_RES_REL_CMD,
+                                n2smbuf);
+                    }
 
                     OGS_FSM_TRAN(s, smf_gsm_state_wait_5gc_n1_n2_release);
 
                 } else if (trigger ==
-                            OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT ||
-                            trigger ==
-                            OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT) {
+                            OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT) {
 
-                    if (UDM_SDM_SUBSCRIBED(sess)) {
-                        int r = smf_sbi_discover_and_send(
-                                OGS_SBI_SERVICE_TYPE_NUDM_SDM, NULL,
-                                smf_nudm_sdm_build_subscription_delete, sess, stream,
-                                SMF_UECM_STATE_DEREGISTERED_BY_AMF, NULL);
+                    if (HOME_ROUTED_ROAMING_IN_HSMF(sess)) {
+    /*
+     * Network-requested PDU Session Release(DUPLICATED)
+     *
+     * TS23.502 clause 4.3.4.3 UE or network requested PDU Session Release
+     * for Home-routed Roaming.
+     *
+     * In step 1f, upon receiving Nsmf_PDUSession_Update from V-SMF, H-SMF
+     * SHALL immediately send the Update Response, then issue PFCP Session
+     * Deletion. This ordering is per the standard, even for duplicate
+     * sessions, and may overlap with AMF’s concurrent Create Session.
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT,
+     * 3.  V: OpenAPI_request_indication_NW_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_NW_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H*: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_AMF_HR
+     *                                 SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 10. H*: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 11. H: SMF_SESS_CLEAR(sess)
+     * 12. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT
+     * 13. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 14. V: ogs_sbi_send_http_status_no_content
+     * 15. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                        r = smf_sbi_cleanup_session(
+                                sess, NULL,
+                                SMF_UECM_STATE_DEREG_BY_AMF_HR,
+                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
                         ogs_expect(r == OGS_OK);
                         ogs_assert(r != OGS_ERROR);
-                    }
-                    else {
-                        int r = smf_sbi_discover_and_send(
-                                OGS_SBI_SERVICE_TYPE_NUDM_UECM, NULL,
-                                smf_nudm_uecm_build_deregistration, sess, stream,
-                                SMF_UECM_STATE_DEREGISTERED_BY_AMF, NULL);
+
+                        OGS_FSM_TRAN(s,
+                                smf_gsm_state_5gc_session_will_deregister);
+
+                    } else if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+
+    /*
+     * Network-requested PDU Session Release(DUPLICATED)
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT,
+     * 3.  V: OpenAPI_request_indication_NW_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_NW_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_AMF_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 11. H: SMF_SESS_CLEAR(sess)
+     * 12. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT
+     * 13. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 14. V*: ogs_sbi_send_http_status_no_content
+     * 15. V*: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                        ogs_assert(true ==
+                                ogs_sbi_send_http_status_no_content(stream));
+                        OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+
+                    } else {
+
+                        r = smf_sbi_cleanup_session(
+                                sess, stream,
+                                SMF_UECM_STATE_DEREG_BY_AMF,
+                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
                         ogs_expect(r == OGS_OK);
                         ogs_assert(r != OGS_ERROR);
+
+                        OGS_FSM_TRAN(s,
+                                smf_gsm_state_5gc_session_will_deregister);
                     }
 
-                    OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+                } else if (trigger ==
+                            OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT) {
+
+                    if (HOME_ROUTED_ROAMING_IN_HSMF(sess)) {
+    /*
+     * Network-requested PDU Session Release
+     *
+     * TS23.502
+     * 4.3.4.3 UE or network requested PDU Session Release
+     *         for Home-routed Roaming
+     *
+     * 1b. (Serving network initiated release)
+     *
+     * 1.  V*: smf_nsmf_handle_release_sm_context
+     * 2.  V*: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *         OGS_PFCP_MODIFY_DEACTIVATE
+     * 3.  V*: OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 4.  V: smf_nsmf_pdusession_build_release_data
+     * 5.  H: smf_nsmf_handle_release_data_in_hsmf
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 7.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 8.  H*: ogs_sbi_send_http_status_no_content
+     * 9.  H*: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_AMF_HR
+     *                                 SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 10. H*: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 11. H*: SMF_SESS_CLEAR(sess)
+     * 12. V: smf_nsmf_handle_release_data_in_hsmf
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V*: ogs_sbi_send_http_status_no_content
+     * 16. V*: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                        ogs_assert(true ==
+                                ogs_sbi_send_http_status_no_content(stream));
+
+                        r = smf_sbi_cleanup_session(
+                                sess, NULL,
+                                SMF_UECM_STATE_DEREG_BY_AMF_HR,
+                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+                        ogs_expect(r == OGS_OK);
+                        ogs_assert(r != OGS_ERROR);
+
+                        OGS_FSM_TRAN(s,
+                                smf_gsm_state_5gc_session_will_deregister);
+
+                    } else if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+
+    /*
+     * Network-requested PDU Session Release
+     *
+     * 1.  V: smf_nsmf_handle_release_sm_context
+     * 2.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 3.  V: OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 4.  V: smf_nsmf_pdusession_build_release_data
+     * 5.  H: smf_nsmf_handle_release_data_in_hsmf
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 7.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 8.  H: ogs_sbi_send_http_status_no_content
+     * 9.  H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_AMF_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 11. H: SMF_SESS_CLEAR(sess)
+     * 12. V: smf_nsmf_handle_release_data_in_hsmf
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V*: ogs_sbi_send_http_status_no_content
+     * 16. V*: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                        ogs_assert(true ==
+                                ogs_sbi_send_http_status_no_content(stream));
+                        OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+
+                    } else {
+
+                        r = smf_sbi_cleanup_session(
+                                sess, stream,
+                                SMF_UECM_STATE_DEREG_BY_AMF,
+                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+                        ogs_expect(r == OGS_OK);
+                        ogs_assert(r != OGS_ERROR);
+
+                        OGS_FSM_TRAN(s,
+                                smf_gsm_state_5gc_session_will_deregister);
+                    }
 
                 } else if (trigger == OGS_PFCP_DELETE_TRIGGER_PCF_INITIATED) {
-                    smf_n1_n2_message_transfer_param_t param;
 
-                    memset(&param, 0, sizeof(param));
-                    param.state = SMF_NETWORK_REQUESTED_PDU_SESSION_RELEASE;
-                    param.n2smbuf = ngap_build_pdu_session_resource_release_command_transfer(
-                            sess, SMF_NGAP_STATE_DELETE_TRIGGER_PCF_INITIATED,
-                            NGAP_Cause_PR_nas, NGAP_CauseNas_normal_release);
-                    ogs_assert(param.n2smbuf);
+                    if (HOME_ROUTED_ROAMING_IN_HSMF(sess)) {
+
+                        ogs_assert(true ==
+                                ogs_sbi_send_http_status_no_content(stream));
 
-                    param.skip_ind = true;
+                    } else {
 
-                    smf_namf_comm_send_n1_n2_message_transfer(sess, &param);
+                        smf_n1_n2_message_transfer_param_t param;
+
+                        memset(&param, 0, sizeof(param));
+                        param.state = SMF_UE_OR_NETWORK_REQUESTED_PDU_SESSION_RELEASE;
+                        param.n2smbuf = ngap_build_pdu_session_resource_release_command_transfer(
+                                sess,
+                                SMF_NGAP_STATE_DELETE_TRIGGER_PCF_INITIATED,
+                                NGAP_Cause_PR_nas,
+                                NGAP_CauseNas_normal_release);
+                        ogs_assert(param.n2smbuf);
+
+                        param.skip_ind = true;
+
+                        smf_namf_comm_send_n1_n2_message_transfer(
+                                sess, NULL, &param);
+                    }
 
                     OGS_FSM_TRAN(s, smf_gsm_state_wait_5gc_n1_n2_release);
                 } else {
@@ -1589,6 +2694,117 @@
                     stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
                     n1smbuf, OpenAPI_n2_sm_info_type_NULL, NULL);
             break;
+        CASE(OGS_SBI_SERVICE_NAME_NSMF_PDUSESSION)
+            stream_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
+            if (stream_id >= OGS_MIN_POOL_ID && stream_id <= OGS_MAX_POOL_ID)
+                stream = ogs_sbi_stream_find_by_id(stream_id);
+
+            SWITCH(sbi_message->h.resource.component0)
+            CASE(OGS_SBI_RESOURCE_NAME_PDU_SESSIONS)
+                SWITCH(sbi_message->h.method)
+                CASE(OGS_SBI_HTTP_METHOD_POST)
+                    SWITCH(sbi_message->h.resource.component2)
+                    CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
+                        switch (e->h.sbi.state) {
+                        case OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED:
+/*
+ * Handle unexpected arrival of Nsmf_PDUSession_UpdateSMContext Response
+ * (step 1a) after PFCP deletion triggered by UE (step 3a).
+ * In Home-routed Roaming (TS 23.502 Section 4.3.4.3) SMContext Response is
+ * expected before SMContext Request (step 3a), but races can invert order,
+ * causing smf_gsm_state_wait_pfcp_deletion on PFCP release (steps 4a/4b).
+ * Without handling the delayed Response here, no handler exists and a crash
+ * results. Storing the stream ID lets the Response be processed safely.
+ */
+                            if (sess->amf_to_vsmf_release_stream_id >=
+                                    OGS_MIN_POOL_ID &&
+                                sess->amf_to_vsmf_release_stream_id <=
+                                    OGS_MAX_POOL_ID)
+                                ogs_error("UE requested release stream ID %d"
+                                        "has not been used yet",
+                                        sess->amf_to_vsmf_release_stream_id);
+                            /* Store Stream ID */
+                            sess->amf_to_vsmf_release_stream_id =
+                                ogs_sbi_id_from_stream(stream);
+                            break;
+/*
+ * Assume PDU session establishment and deregistration occur simultaneously.
+ * In Non-Roaming or LBO scenarios, no issues arise. However, in Home Routed
+ * Roaming, the following problem may occur:
+ *
+ * The final step of PDU session establishment is activation via the
+ * PDUSessionResourceSetupResponse. At this point, the V-SMF sends a
+ * /pdu-sessions/{xx}/modify request to the H-SMF. Meanwhile, the deregistration
+ * process advances the state to smf_gsm_state_wait_pfcp_deletion as part
+ * of the PFCP deletion procedure.
+ *
+ * When the H-SMF then sends the OGS_EVENT_SBI_CLIENT event, a corresponding
+ * handler is required to process this state. The code below implements this
+ * handler to address the race condition.
+ */
+                        case SMF_UPDATE_STATE_ACTIVATED_FROM_ACTIVATING:
+                            sess->up_cnx_state =
+                                OpenAPI_up_cnx_state_ACTIVATED;
+                            smf_sbi_send_sm_context_updated_data_up_cnx_state(
+                                    sess, stream,
+                                    OpenAPI_up_cnx_state_ACTIVATED);
+                            break;
+                        case SMF_UPDATE_STATE_ACTIVATED_FROM_NON_ACTIVATING:
+                            ogs_assert(true ==
+                                    ogs_sbi_send_http_status_no_content(
+                                        stream));
+                            break;
+                        case SMF_UPDATE_STATE_ACTIVATED_FROM_XN_HANDOVER:
+                            n2smbuf =
+                                ngap_build_path_switch_request_ack_transfer(
+                                        sess);
+                            ogs_assert(n2smbuf);
+
+                            smf_sbi_send_sm_context_updated_data_n2smbuf(
+                                    sess, stream,
+                                    OpenAPI_n2_sm_info_type_PATH_SWITCH_REQ_ACK,
+                                    n2smbuf);
+                            break;
+                        case SMF_UPDATE_STATE_ACTIVATED_FROM_N2_HANDOVER:
+                            if (smf_sess_have_indirect_data_forwarding(sess) ==
+                                    true) {
+                                ogs_assert(OGS_OK ==
+                                    smf_5gc_pfcp_send_all_pdr_modification_request(
+                                        sess, stream,
+                                        OGS_PFCP_MODIFY_INDIRECT|
+                                        OGS_PFCP_MODIFY_REMOVE,
+                                        0,
+                                        ogs_local_conf()->
+                                            time.handover.duration));
+                            }
+
+                            smf_sbi_send_sm_context_updated_data_ho_state(
+                                    sess, stream, OpenAPI_ho_state_COMPLETED);
+                            break;
+                        default:
+                            ogs_fatal("Unknown state 0x%x", e->h.sbi.state);
+                            ogs_assert_if_reached();
+                        }
+                        break;
+                    DEFAULT
+                        ogs_error("Invalid resource name %s",
+                                    sbi_message->h.resource.component2);
+                        ogs_assert_if_reached();
+                    END
+                    break;
+                DEFAULT
+                    ogs_error("Invalid HTTP method %s",
+                            sbi_message->h.method);
+                    ogs_assert_if_reached();
+                END
+                break;
+            DEFAULT
+                ogs_error("Invalid resource name %s",
+                            sbi_message->h.resource.component0);
+                ogs_assert_if_reached();
+            END
+            break;
+
         CASE(OGS_SBI_SERVICE_NAME_NAMF_COMM)
             SWITCH(sbi_message->h.resource.component0)
             CASE(OGS_SBI_RESOURCE_NAME_UE_CONTEXTS)
@@ -1736,7 +2952,7 @@
                 send_gtp_delete_err_msg(sess, gtp_xact, gtp_cause);
             }
         }
-        OGS_FSM_TRAN(s, smf_gsm_state_epc_session_will_release);
+        OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
     }
 }
 
@@ -1755,6 +2971,8 @@
     ogs_pool_id_t stream_id = OGS_INVALID_POOL_ID;
     ogs_sbi_message_t *sbi_message = NULL;
 
+    int r;
+
     ogs_assert(s);
     ogs_assert(e);
 
@@ -1763,6 +2981,9 @@
     sess = smf_sess_find_by_id(e->sess_id);
     ogs_assert(sess);
 
+    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+    ogs_assert(smf_ue);
+
     switch (e->h.id) {
     case OGS_FSM_ENTRY_SIG:
         break;
@@ -1785,21 +3006,150 @@
 
         SWITCH(sbi_message->h.service.name)
         CASE(OGS_SBI_SERVICE_NAME_NSMF_PDUSESSION)
-            SWITCH(sbi_message->h.resource.component2)
-            CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
-                smf_nsmf_handle_update_sm_context(sess, stream, sbi_message);
+            SWITCH(sbi_message->h.resource.component0)
+            CASE(OGS_SBI_RESOURCE_NAME_SM_CONTEXTS)
+                SWITCH(sbi_message->h.resource.component2)
+                CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
+                    smf_nsmf_handle_update_sm_context(
+                            sess, stream, sbi_message);
+                    break;
+    /*
+     * Network-requested PDU Session Release
+     *
+     * 1.  V*: smf_nsmf_handle_release_sm_context
+     * 2.  V*: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *         OGS_PFCP_MODIFY_DEACTIVATE
+     * 3.  V*: OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 4.  V: smf_nsmf_pdusession_build_release_data
+     * 5.  H: smf_nsmf_handle_release_data_in_hsmf
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 7.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 8.  H*: ogs_sbi_send_http_status_no_content
+     * 9.  H*: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_AMF_HR
+     *                                 SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 10. H*: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 11. H*: SMF_SESS_CLEAR(sess)
+     * 12. V: smf_nsmf_handle_release_data_in_hsmf
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V*: ogs_sbi_send_http_status_no_content
+     * 16. V*: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
+                    smf_nsmf_handle_release_sm_context(
+                            sess, stream, sbi_message);
+
+                    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+                        ogs_assert(OGS_OK ==
+                            smf_5gc_pfcp_send_all_pdr_modification_request(
+                                sess, stream,
+                                OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+                                OGS_PFCP_MODIFY_UL_ONLY|
+                                OGS_PFCP_MODIFY_DEACTIVATE,
+                                OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT,
+                                0));
+                    } else {
+                        ogs_warn("%s:%d Session Release "
+                                "PFCP-Delete-Trigger:%d",
+                            smf_ue->supi, sess->psi, e->h.sbi.state);
+
+                        r = smf_sbi_cleanup_session(
+                                sess, stream,
+                                SMF_UECM_STATE_DEREG_BY_AMF,
+                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+                        ogs_expect(r == OGS_OK);
+                        ogs_assert(r != OGS_ERROR);
+
+                        OGS_FSM_TRAN(s,
+                                smf_gsm_state_5gc_session_will_deregister);
+                    }
+                    break;
+                DEFAULT
+                    ogs_error("Invalid resource name %s",
+                                sbi_message->h.resource.component2);
+                    ogs_assert(true ==
+                        ogs_sbi_server_send_error(stream,
+                            OGS_SBI_HTTP_STATUS_BAD_REQUEST, sbi_message,
+                            "Invalid resource name %s",
+                            sbi_message->h.resource.component2, NULL));
+                    OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                END
                 break;
-            CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
-                smf_nsmf_handle_release_sm_context(sess, stream, sbi_message);
+
+            CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+                SWITCH(sbi_message->h.resource.component2)
+                CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
+                    ogs_error("Invalid resource name %s",
+                                sbi_message->h.resource.component2);
+                    ogs_assert(true ==
+                        ogs_sbi_server_send_error(stream,
+                            OGS_SBI_HTTP_STATUS_BAD_REQUEST, sbi_message,
+                            "Invalid resource name %s",
+                            sbi_message->h.resource.component2, NULL));
+                    OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                    break;
+                DEFAULT
+    /*
+     * UE-requested PDU Session Release
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 3.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_wait_5gc_n1_n2_release);
+     * 11. V: smf_nsmf_handle_update_data_in_vsmf
+     * 12. V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V: ngap_build_pdu_session_resource_release_command_transfer+
+     *        gsm_build_pdu_session_release_command
+     * 16  V: OGS_FSM_TRAN(&sess->sm, smf_gsm_state_wait_5gc_n1_n2_release)
+     * 17. V: ogs_sbi_send_http_status_no_content(stream)
+     * 18. V: case OpenAPI_n2_sm_info_type_PDU_RES_REL_RSP:
+     *        case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE:
+     * 19. V: ogs_sbi_send_http_status_no_content(vsmf_to_hsmf_release_stream)
+     * 20. V: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 21. H: case OGS_EVENT_SBI_CLIENT:
+     * 22. H: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 23. H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_N1N2_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 24. H: smf_sbi_send_status_notify+SMF_SESS_CLEAR(sess)
+     * 25. V*: case OGS_EVENT_SBI_SERVER:
+     * 26. V*: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 27. V*: ogs_sbi_send_http_status_no_content+
+     *         smf_sbi_send_sm_context_status_notify
+     * 28. V*: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                    ogs_assert(true ==
+                            ogs_sbi_send_http_status_no_content(stream));
+
+                    sess->resource_status = OpenAPI_resource_status_RELEASED;
+                    if (sess->n1_released == true &&
+                        sess->n2_released == true &&
+                        sess->resource_status ==
+                            OpenAPI_resource_status_RELEASED) {
+                        ogs_assert(true ==
+                                smf_sbi_send_sm_context_status_notify(sess));
+                        OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+                    }
+                END
                 break;
+
             DEFAULT
                 ogs_error("Invalid resource name %s",
-                            sbi_message->h.resource.component2);
+                            sbi_message->h.resource.component0);
                 ogs_assert(true ==
                     ogs_sbi_server_send_error(stream,
                         OGS_SBI_HTTP_STATUS_BAD_REQUEST, sbi_message,
                         "Invalid resource name %s",
-                        sbi_message->h.resource.component2, NULL));
+                        sbi_message->h.resource.component0, NULL));
                 OGS_FSM_TRAN(s, smf_gsm_state_exception);
             END
             break;
@@ -1819,18 +3169,97 @@
         sbi_message = e->h.sbi.message;
         ogs_assert(sbi_message);
 
-        smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
-        ogs_assert(smf_ue);
+        stream_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
+        if (stream_id >= OGS_MIN_POOL_ID && stream_id <= OGS_MAX_POOL_ID)
+            stream = ogs_sbi_stream_find_by_id(stream_id);
 
         SWITCH(sbi_message->h.service.name)
+        CASE(OGS_SBI_SERVICE_NAME_NSMF_PDUSESSION)
+            SWITCH(sbi_message->h.resource.component0)
+            CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+                SWITCH(sbi_message->h.method)
+                CASE(OGS_SBI_HTTP_METHOD_POST)
+                    SWITCH(sbi_message->h.resource.component2)
+                    CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
+    /*
+     * UE-requested PDU Session Release
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 3.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_wait_5gc_n1_n2_release);
+     * 11. V: smf_nsmf_handle_update_data_in_vsmf
+     * 12. V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V: ngap_build_pdu_session_resource_release_command_transfer+
+     *        gsm_build_pdu_session_release_command
+     * 16  V: OGS_FSM_TRAN(&sess->sm, smf_gsm_state_wait_5gc_n1_n2_release)
+     * 17. V: ogs_sbi_send_http_status_no_content(stream)
+     * 18. V: case OpenAPI_n2_sm_info_type_PDU_RES_REL_RSP:
+     *        case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE:
+     * 19. V: ogs_sbi_send_http_status_no_content(vsmf_to_hsmf_release_stream)
+     * 20. V: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 21. H*: case OGS_EVENT_SBI_CLIENT:
+     * 22. H*: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 23. H*: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_N1N2_HR
+     *                                 SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 24. H: smf_sbi_send_status_notify+SMF_SESS_CLEAR(sess)
+     * 25. V: case OGS_EVENT_SBI_SERVER:
+     * 26. V: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 27. V: ogs_sbi_send_http_status_no_content+
+     *        smf_sbi_send_sm_context_status_notify
+     * 28. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                        r = smf_sbi_cleanup_session(
+                                sess, NULL,
+                                SMF_UECM_STATE_DEREG_BY_N1N2_HR,
+                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+                        ogs_expect(r == OGS_OK);
+                        ogs_assert(r != OGS_ERROR);
+
+                        OGS_FSM_TRAN(s,
+                                smf_gsm_state_5gc_session_will_deregister);
+                        break;
+                    DEFAULT
+                        ogs_error("%s:%d Invalid resource name %s",
+                                smf_ue->supi, sess->psi,
+                                sbi_message->h.resource.component2);
+                        ogs_assert_if_reached();
+                    END
+                    break;
+
+                DEFAULT
+                    ogs_error("%s:%d Invalid HTTP method %s",
+                            smf_ue->supi, sess->psi, sbi_message->h.method);
+                    ogs_assert_if_reached();
+                END
+                break;
+            DEFAULT
+                ogs_error("%s:%d Invalid resource name %s",
+                        smf_ue->supi, sess->psi,
+                        sbi_message->h.resource.component0);
+                ogs_assert_if_reached();
+            END
+            break;
+
         CASE(OGS_SBI_SERVICE_NAME_NAMF_COMM)
             SWITCH(sbi_message->h.resource.component0)
             CASE(OGS_SBI_RESOURCE_NAME_UE_CONTEXTS)
-                ogs_error("%s:%d state %d res_status %d",
+                ogs_info("%s:%d state %d res_status %d, stream %p:%d",
                     smf_ue->supi, sess->psi,
-                    e->h.sbi.state, sbi_message->res_status);
+                    e->h.sbi.state, sbi_message->res_status,
+                    stream, stream_id);
                 smf_namf_comm_handle_n1_n2_message_transfer(
-                        sess, e->h.sbi.state, sbi_message);
+                        sess, stream, e->h.sbi.state, sbi_message);
                 break;
 
             DEFAULT
@@ -1844,16 +3273,6 @@
         CASE(OGS_SBI_SERVICE_NAME_NPCF_SMPOLICYCONTROL)
             ogs_pkbuf_t *n1smbuf = NULL;
 
-            stream_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
-            ogs_assert(stream_id >= OGS_MIN_POOL_ID &&
-                    stream_id <= OGS_MAX_POOL_ID);
-
-            stream = ogs_sbi_stream_find_by_id(stream_id);
-            if (!stream) {
-                ogs_error("STREAM has already been removed %d", stream_id);
-                break;
-            }
-
             ogs_error("%s:%d state %d res_status %d",
                 smf_ue->supi, sess->psi,
                 e->h.sbi.state, sbi_message->res_status);
@@ -1873,25 +3292,14 @@
                 SWITCH(sbi_message->h.method)
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
 
-                    if (e->h.sbi.data) {
-                        /* stream is optional here in this case,
-                         * depending on the different code paths */
-                        stream_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
-                        ogs_assert(stream_id >= OGS_MIN_POOL_ID &&
-                                stream_id <= OGS_MAX_POOL_ID);
-
-                        stream = ogs_sbi_stream_find_by_id(stream_id);
-                    }
-                    int state = e->h.sbi.state;
-
                     UDM_SDM_CLEAR(sess);
 
-                    int r = smf_sbi_discover_and_send(
-                        OGS_SBI_SERVICE_TYPE_NUDM_UECM, NULL,
-                        smf_nudm_uecm_build_deregistration,
-                        sess, stream, state, NULL);
+                    r = smf_sbi_cleanup_session(
+                            sess, stream, e->h.sbi.state,
+                            SMF_SBI_CLEANUP_MODE_CONTEXT_ONLY);
                     ogs_expect(r == OGS_OK);
                     ogs_assert(r != OGS_ERROR);
+
                     break;
 
                 DEFAULT
@@ -1915,8 +3323,6 @@
         break;
 
     case SMF_EVT_NGAP_MESSAGE:
-        smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
-        ogs_assert(smf_ue);
         pkbuf = e->pkbuf;
         ogs_assert(pkbuf);
         ogs_assert(e->ngap.type);
@@ -1972,18 +3378,82 @@
 
                 ogs_assert(true == ogs_sbi_send_http_status_no_content(stream));
 
+    /*
+     * UE-requested PDU Session Release
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 3.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_wait_5gc_n1_n2_release);
+     * 11. V: smf_nsmf_handle_update_data_in_vsmf
+     * 12. V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V: ngap_build_pdu_session_resource_release_command_transfer+
+     *        gsm_build_pdu_session_release_command
+     * 16  V: OGS_FSM_TRAN(&sess->sm, smf_gsm_state_wait_5gc_n1_n2_release)
+     * 17. V*: ogs_sbi_send_http_status_no_content(stream)
+     * 18. V*: case OpenAPI_n2_sm_info_type_PDU_RES_REL_RSP:
+     *         case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE:
+     * 19. V*: ogs_sbi_send_http_status_no_content(vsmf_to_hsmf_release_stream)
+     * 20. V*: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 21. H: case OGS_EVENT_SBI_CLIENT:
+     * 22. H: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 23. H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_N1N2_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 24. H: smf_sbi_send_status_notify+SMF_SESS_CLEAR(sess)
+     * 25. V: case OGS_EVENT_SBI_SERVER:
+     * 26. V: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 27. V: ogs_sbi_send_http_status_no_content+
+     *        smf_sbi_send_sm_context_status_notify
+     * 28. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
                 sess->n2_released = true;
-                if ((sess->n1_released) && (sess->n2_released)) {
-                    int r = smf_sbi_discover_and_send(
-                            OGS_SBI_SERVICE_TYPE_NUDM_SDM, NULL,
-                            smf_nudm_sdm_build_subscription_delete, sess, NULL,
-                            SMF_UECM_STATE_DEREGISTERED_BY_N1_N2_RELEASE, NULL);
+                if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+                    ogs_sbi_stream_t *vsmf_to_hsmf_release_stream = NULL;
+                    if (sess->vsmf_to_hsmf_release_stream_id >=
+                            OGS_MIN_POOL_ID &&
+                        sess->vsmf_to_hsmf_release_stream_id <= OGS_MAX_POOL_ID)
+                        vsmf_to_hsmf_release_stream =
+                            ogs_sbi_stream_find_by_id(
+                                    sess->vsmf_to_hsmf_release_stream_id);
+
+                    if (vsmf_to_hsmf_release_stream) {
+                        ogs_assert(true ==
+                                ogs_sbi_send_http_status_no_content(
+                                    vsmf_to_hsmf_release_stream));
+                        sess->vsmf_to_hsmf_release_stream_id =
+                            OGS_INVALID_POOL_ID;
+                    }
+
+                    if (sess->n1_released == true &&
+                        sess->n2_released == true &&
+                        sess->resource_status ==
+                            OpenAPI_resource_status_RELEASED) {
+                        ogs_assert(true ==
+                                smf_sbi_send_sm_context_status_notify(sess));
+                        OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+                    }
+                } else if (sess->n1_released == true &&
+                           sess->n2_released == true) {
+                    r = smf_sbi_cleanup_session(
+                            sess, NULL,
+                            SMF_UECM_STATE_DEREG_BY_N1N2,
+                            SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
                     ogs_expect(r == OGS_OK);
                     ogs_assert(r != OGS_ERROR);
 
-                    OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+                    OGS_FSM_TRAN(s,
+                            smf_gsm_state_5gc_session_will_deregister);
                 }
-
             } else {
                 ogs_fatal("Invalid state %d", ngap_state);
                 ogs_assert_if_reached();
@@ -1997,8 +3467,6 @@
     case SMF_EVT_5GSM_MESSAGE:
         nas_message = e->nas.message;
         ogs_assert(nas_message);
-        smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
-        ogs_assert(smf_ue);
 
         stream_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
         ogs_assert(stream_id >= OGS_MIN_POOL_ID &&
@@ -2014,12 +3482,72 @@
         case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE:
             ogs_assert(true == ogs_sbi_send_http_status_no_content(stream));
 
+    /*
+     * UE-requested PDU Session Release
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 3.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_wait_5gc_n1_n2_release);
+     * 11. V: smf_nsmf_handle_update_data_in_vsmf
+     * 12. V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V: ngap_build_pdu_session_resource_release_command_transfer+
+     *        gsm_build_pdu_session_release_command
+     * 16  V: OGS_FSM_TRAN(&sess->sm, smf_gsm_state_wait_5gc_n1_n2_release)
+     * 17. V*: ogs_sbi_send_http_status_no_content(stream)
+     * 18. V*: case OpenAPI_n2_sm_info_type_PDU_RES_REL_RSP:
+     *         case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE:
+     * 19. V*: ogs_sbi_send_http_status_no_content(vsmf_to_hsmf_release_stream)
+     * 20. V*: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 21. H: case OGS_EVENT_SBI_CLIENT:
+     * 22. H: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 23. H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_N1N2_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 24. H: smf_sbi_send_status_notify+SMF_SESS_CLEAR(sess)
+     * 25. V: case OGS_EVENT_SBI_SERVER:
+     * 26. V: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 27. V: ogs_sbi_send_http_status_no_content+
+     *        smf_sbi_send_sm_context_status_notify
+     * 28. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
             sess->n1_released = true;
-            if ((sess->n1_released) && (sess->n2_released)) {
-                int r = smf_sbi_discover_and_send(
-                        OGS_SBI_SERVICE_TYPE_NUDM_SDM, NULL,
-                        smf_nudm_sdm_build_subscription_delete, sess, NULL,
-                        SMF_UECM_STATE_DEREGISTERED_BY_N1_N2_RELEASE, NULL);
+            if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+                ogs_sbi_stream_t *vsmf_to_hsmf_release_stream = NULL;
+                if (sess->vsmf_to_hsmf_release_stream_id >= OGS_MIN_POOL_ID &&
+                    sess->vsmf_to_hsmf_release_stream_id <= OGS_MAX_POOL_ID)
+                    vsmf_to_hsmf_release_stream =
+                        ogs_sbi_stream_find_by_id(
+                                sess->vsmf_to_hsmf_release_stream_id);
+
+                if (vsmf_to_hsmf_release_stream) {
+                    ogs_assert(true ==
+                            ogs_sbi_send_http_status_no_content(
+                                vsmf_to_hsmf_release_stream));
+                    sess->vsmf_to_hsmf_release_stream_id = OGS_INVALID_POOL_ID;
+                }
+
+                if (sess->n1_released == true &&
+                    sess->n2_released == true &&
+                    sess->resource_status == OpenAPI_resource_status_RELEASED) {
+                    ogs_assert(true ==
+                            smf_sbi_send_sm_context_status_notify(sess));
+                    OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+                }
+            } else if (sess->n1_released == true && sess->n2_released == true) {
+                r = smf_sbi_cleanup_session(
+                        sess, NULL,
+                        SMF_UECM_STATE_DEREG_BY_N1N2,
+                        SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
                 ogs_expect(r == OGS_OK);
                 ogs_assert(r != OGS_ERROR);
 
@@ -2040,6 +3568,9 @@
             ogs_free(strerror);
         }
         break;
+
+    default:
+        ogs_error("Unknown event %s", smf_event_get_name(e));
     }
 }
 
@@ -2060,22 +3591,21 @@
     switch (e->h.id) {
     case OGS_FSM_ENTRY_SIG:
         if (PCF_SM_POLICY_ASSOCIATED(sess)) {
-            smf_npcf_smpolicycontrol_param_t param;
             int r = 0;
 
-            memset(&param, 0, sizeof(param));
+            memset(&sess->nsmf_param, 0, sizeof(sess->nsmf_param));
 
-            param.ue_location = true;
-            param.ue_timezone = true;
+            sess->nsmf_param.ue_location = true;
+            sess->nsmf_param.ue_timezone = true;
 
             r = smf_sbi_discover_and_send(
                     OGS_SBI_SERVICE_TYPE_NPCF_SMPOLICYCONTROL, NULL,
                     smf_npcf_smpolicycontrol_build_delete,
                     sess, NULL,
-                    OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT, &param);
+                    OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT, NULL);
             ogs_expect(r == OGS_OK);
         } else {
-            smf_namf_comm_send_n1_n2_pdu_establishment_reject(sess);
+            smf_namf_comm_send_n1_n2_pdu_establishment_reject(sess, NULL);
         }
         break;
     case OGS_FSM_EXIT_SIG:
@@ -2113,7 +3643,8 @@
                                sessions. */
                         }
 
-                        smf_namf_comm_send_n1_n2_pdu_establishment_reject(sess);
+                        smf_namf_comm_send_n1_n2_pdu_establishment_reject(
+                                sess, NULL);
                         break;
                     DEFAULT
                         ogs_error("%s:%d Unknown resource name %s",
@@ -2135,7 +3666,7 @@
         CASE(OGS_SBI_SERVICE_NAME_NAMF_COMM)
             SWITCH(sbi_message->h.resource.component0)
             CASE(OGS_SBI_RESOURCE_NAME_UE_CONTEXTS)
-                OGS_FSM_TRAN(s, smf_gsm_state_epc_session_will_release);
+                OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
                 break;
 
             DEFAULT
@@ -2161,12 +3692,17 @@
 
 void smf_gsm_state_5gc_session_will_deregister(ogs_fsm_t *s, smf_event_t *e)
 {
+    char *strerror = NULL;
+
+    smf_ue_t *smf_ue = NULL;
     smf_sess_t *sess = NULL;
 
     ogs_sbi_stream_t *stream = NULL;
     ogs_pool_id_t stream_id = OGS_INVALID_POOL_ID;
     ogs_sbi_message_t *sbi_message = NULL;
 
+    int r;
+
     ogs_assert(s);
     ogs_assert(e);
 
@@ -2198,19 +3734,33 @@
 
         SWITCH(sbi_message->h.service.name)
         CASE(OGS_SBI_SERVICE_NAME_NSMF_PDUSESSION)
-            SWITCH(sbi_message->h.resource.component2)
-            CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
-                ogs_assert(true == ogs_sbi_send_response(
-                            stream, OGS_SBI_HTTP_STATUS_TOO_MANY_REQUESTS));
+            SWITCH(sbi_message->h.resource.component0)
+            CASE(OGS_SBI_RESOURCE_NAME_SM_CONTEXTS)
+                SWITCH(sbi_message->h.resource.component2)
+                CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
+                    ogs_assert(true == ogs_sbi_send_response(
+                                stream, OGS_SBI_HTTP_STATUS_TOO_MANY_REQUESTS));
+                    break;
+                DEFAULT
+                    ogs_error("Invalid resource name %s",
+                                sbi_message->h.resource.component2);
+                    ogs_assert(true ==
+                        ogs_sbi_server_send_error(stream,
+                            OGS_SBI_HTTP_STATUS_BAD_REQUEST, sbi_message,
+                            "Invalid resource name %s",
+                            sbi_message->h.resource.component2, NULL));
+                    OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                END
                 break;
+
             DEFAULT
                 ogs_error("Invalid resource name %s",
-                            sbi_message->h.resource.component2);
+                            sbi_message->h.resource.component0);
                 ogs_assert(true ==
                     ogs_sbi_server_send_error(stream,
                         OGS_SBI_HTTP_STATUS_BAD_REQUEST, sbi_message,
                         "Invalid resource name %s",
-                        sbi_message->h.resource.component2, NULL));
+                        sbi_message->h.resource.component0, NULL));
                 OGS_FSM_TRAN(s, smf_gsm_state_exception);
             END
             break;
@@ -2230,20 +3780,95 @@
         sbi_message = e->h.sbi.message;
         ogs_assert(sbi_message);
 
+        smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+        ogs_assert(smf_ue);
+
+        stream_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
+        if (stream_id >= OGS_MIN_POOL_ID && stream_id <= OGS_MAX_POOL_ID)
+            stream = ogs_sbi_stream_find_by_id(stream_id);
+
         SWITCH(sbi_message->h.service.name)
-        CASE(OGS_SBI_SERVICE_NAME_NUDM_SDM)
+        CASE(OGS_SBI_SERVICE_NAME_NPCF_SMPOLICYCONTROL)
+            SWITCH(sbi_message->h.resource.component0)
+            CASE(OGS_SBI_RESOURCE_NAME_SM_POLICIES)
+                if (!sbi_message->h.resource.component1) {
+                    ogs_assert(stream);
+                    strerror = ogs_msprintf(
+                            "%s:%d HTTP response error %d",
+                            smf_ue->supi, sess->psi,
+                            sbi_message->res_status);
+                    ogs_assert(strerror);
+
+                    ogs_error("%s", strerror);
+                    ogs_assert(true ==
+                        ogs_sbi_server_send_error(
+                            stream, sbi_message->res_status,
+                            sbi_message, strerror, NULL,
+                            (sbi_message->ProblemDetails) ?
+                                    sbi_message->ProblemDetails->cause : NULL));
+                    ogs_free(strerror);
 
-            if (e->h.sbi.data) {
-                /* stream is optional here in this case,
-                 * depending on the different code paths */
-                stream_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
-                ogs_assert(stream_id >= OGS_MIN_POOL_ID &&
-                        stream_id <= OGS_MAX_POOL_ID);
+                    OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                    break;
+                } else {
+                    SWITCH(sbi_message->h.resource.component2)
+                    CASE(OGS_SBI_RESOURCE_NAME_DELETE)
+                        PCF_SM_POLICY_CLEAR(sess);
 
-                stream = ogs_sbi_stream_find_by_id(stream_id);
-            }
-            int state = e->h.sbi.state;
+                        if (sbi_message->res_status !=
+                                OGS_SBI_HTTP_STATUS_NO_CONTENT) {
+                            ogs_error("%s:%d HTTP response error %d",
+                                    smf_ue->supi, sess->psi,
+                                    sbi_message->res_status);
+                            /* In spite of error from PCF, continue with
+                               session teardown, so as to not leave stale
+                               sessions. */
+                        }
 
+                        r = smf_sbi_cleanup_session(
+                                sess, stream, e->h.sbi.state,
+                                SMF_SBI_CLEANUP_MODE_SUBSCRIPTION_FIRST);
+                        ogs_expect(r == OGS_OK);
+                        ogs_assert(r != OGS_ERROR);
+
+                        break;
+
+                    DEFAULT
+                        strerror = ogs_msprintf("%s:%d "
+                                "Unknown resource name %s",
+                                smf_ue->supi, sess->psi,
+                                sbi_message->h.resource.component2);
+                        ogs_assert(strerror);
+
+                        ogs_error("%s", strerror);
+                        if (stream)
+                            ogs_assert(true ==
+                                ogs_sbi_server_send_error(stream,
+                                    OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                                    sbi_message, strerror, NULL, NULL));
+                        ogs_free(strerror);
+                        OGS_FSM_TRAN(s, smf_gsm_state_exception);
+                    END
+                }
+                break;
+
+            DEFAULT
+                strerror = ogs_msprintf("%s:%d Invalid resource name %s",
+                        smf_ue->supi, sess->psi,
+                        sbi_message->h.resource.component0);
+                ogs_assert(strerror);
+
+                ogs_error("%s", strerror);
+                ogs_assert(true ==
+                    ogs_sbi_server_send_error(stream,
+                        OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                        sbi_message, strerror, NULL, NULL));
+                ogs_free(strerror);
+                OGS_FSM_TRAN(s, smf_gsm_state_exception);
+            END
+            break;
+
+        CASE(OGS_SBI_SERVICE_NAME_NUDM_SDM)
             SWITCH(sbi_message->h.resource.component1)
             CASE(OGS_SBI_RESOURCE_NAME_SDM_SUBSCRIPTIONS)
                 SWITCH(sbi_message->h.method)
@@ -2251,12 +3876,12 @@
 
                     UDM_SDM_CLEAR(sess);
 
-                    int r = smf_sbi_discover_and_send(
-                        OGS_SBI_SERVICE_TYPE_NUDM_UECM, NULL,
-                        smf_nudm_uecm_build_deregistration,
-                        sess, stream, state, NULL);
+                    r = smf_sbi_cleanup_session(
+                            sess, stream, e->h.sbi.state,
+                            SMF_SBI_CLEANUP_MODE_CONTEXT_ONLY);
                     ogs_expect(r == OGS_OK);
                     ogs_assert(r != OGS_ERROR);
+
                     break;
 
                 DEFAULT
@@ -2283,7 +3908,7 @@
     }
 }
 
-void smf_gsm_state_epc_session_will_release(ogs_fsm_t *s, smf_event_t *e)
+void smf_gsm_state_session_will_release(ogs_fsm_t *s, smf_event_t *e)
 {
     smf_sess_t *sess = NULL;
     ogs_assert(s);

open5gs_2.7.7.tar.xz/src/smf/gsmue-message.c Added

@@ -0,0 +1,1644 @@
+/*
+ * Copyright (C) 2024 by Sukchan Lee <acetcom@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include "gsmue-message.h"
+
+#undef OGS_LOG_DOMAIN
+#define OGS_LOG_DOMAIN __gsm_log_domain
+
+static int encode_pdu_session_establishment_request(
+        ogs_pkbuf_t *pkbuf, ogs_nas_5gs_message_t *message)
+{
+    ogs_nas_5gs_pdu_session_establishment_request_t
+        *pdu_session_establishment_request = NULL;
+    int encoded = 0;
+    int size = 0;
+
+    ogs_assert(message);
+    pdu_session_establishment_request =
+        &message->gsm.pdu_session_establishment_request;
+
+    if (pdu_session_establishment_request->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_PDU_SESSION_TYPE_PRESENT) {
+        size = ogs_nas_5gs_encode_pdu_session_type(pkbuf, &pdu_session_establishment_request->pdu_session_type);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_establishment_request->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_SSC_MODE_PRESENT) {
+        size = ogs_nas_5gs_encode_ssc_mode(pkbuf, &pdu_session_establishment_request->ssc_mode);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_establishment_request->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_MAXIMUM_NUMBER_OF_SUPPORTED_PACKET_FILTERS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_MAXIMUM_NUMBER_OF_SUPPORTED_PACKET_FILTERS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_maximum_number_of_supported_packet_filters(pkbuf, &pdu_session_establishment_request->maximum_number_of_supported_packet_filters);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_establishment_request->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_SM_PDU_DN_REQUEST_CONTAINER_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_SM_PDU_DN_REQUEST_CONTAINER_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_sm_pdu_dn_request_container(pkbuf, &pdu_session_establishment_request->sm_pdu_dn_request_container);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_establishment_request->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_extended_protocol_configuration_options(pkbuf, &pdu_session_establishment_request->extended_protocol_configuration_options);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_establishment_request->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_5GSM_CAPABILITY_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_5GSM_CAPABILITY_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_5gsm_capability(pkbuf, &pdu_session_establishment_request->gsm_capability);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    return encoded;
+}
+
+static int encode_pdu_session_establishment_accept(
+        ogs_pkbuf_t *pkbuf, ogs_nas_5gs_message_t *message)
+{
+    ogs_nas_5gs_pdu_session_establishment_accept_t
+        *pdu_session_establishment_accept = NULL;
+    int encoded = 0;
+    int size = 0;
+
+    ogs_assert(message);
+    pdu_session_establishment_accept =
+        &message->gsm.pdu_session_establishment_accept;
+
+    if (pdu_session_establishment_accept->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_RQ_TIMER_VALUE_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_RQ_TIMER_VALUE_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_gprs_timer(pkbuf, &pdu_session_establishment_accept->rq_timer_value);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_establishment_accept->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_EAP_MESSAGE_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_EAP_MESSAGE_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_eap_message(pkbuf, &pdu_session_establishment_accept->eap_message);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_establishment_accept->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_extended_protocol_configuration_options(pkbuf, &pdu_session_establishment_accept->extended_protocol_configuration_options);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_establishment_accept->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_5GSM_CAUSE_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_5GSM_CAUSE_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_5gsm_cause(pkbuf, &pdu_session_establishment_accept->gsm_cause);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_establishment_accept->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_MAPPED_EPS_BEARER_CONTEXTS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_MAPPED_EPS_BEARER_CONTEXTS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_mapped_eps_bearer_contexts(pkbuf, &pdu_session_establishment_accept->mapped_eps_bearer_contexts);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_establishment_accept->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_ATSSS_CONTAINER_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_ATSSS_CONTAINER_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_atsss_container(pkbuf, &pdu_session_establishment_accept->atsss_container);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    return encoded;
+}
+
+static int encode_pdu_session_establishment_reject(
+        ogs_pkbuf_t *pkbuf, ogs_nas_5gs_message_t *message)
+{
+    ogs_nas_5gs_pdu_session_establishment_reject_t
+        *pdu_session_establishment_reject = NULL;
+    int encoded = 0;
+    int size = 0;
+
+    ogs_assert(message);
+    pdu_session_establishment_reject =
+        &message->gsm.pdu_session_establishment_reject;
+
+    if (pdu_session_establishment_reject->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REJECT_EAP_MESSAGE_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REJECT_EAP_MESSAGE_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_eap_message(pkbuf, &pdu_session_establishment_reject->eap_message);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_establishment_reject->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REJECT_ALLOWED_SSC_MODE_PRESENT) {
+        pdu_session_establishment_reject->allowed_ssc_mode.type = (OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REJECT_ALLOWED_SSC_MODE_TYPE >> 4);
+
+        size = ogs_nas_5gs_encode_allowed_ssc_mode(pkbuf, &pdu_session_establishment_reject->allowed_ssc_mode);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_establishment_reject->presencemask & OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_extended_protocol_configuration_options(pkbuf, &pdu_session_establishment_reject->extended_protocol_configuration_options);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    return encoded;
+}
+
+static int encode_pdu_session_modification_request(
+        ogs_pkbuf_t *pkbuf, ogs_nas_5gs_message_t *message)
+{
+    ogs_nas_5gs_pdu_session_modification_request_t
+        *pdu_session_modification_request = NULL;
+    int encoded = 0;
+    int size = 0;
+
+    ogs_assert(message);
+    pdu_session_modification_request =
+        &message->gsm.pdu_session_modification_request;
+
+    if (pdu_session_modification_request->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_MAXIMUM_NUMBER_OF_SUPPORTED_PACKET_FILTERS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_MAXIMUM_NUMBER_OF_SUPPORTED_PACKET_FILTERS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_maximum_number_of_supported_packet_filters(pkbuf, &pdu_session_modification_request->maximum_number_of_supported_packet_filters);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_modification_request->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_integrity_protection_maximum_data_rate(pkbuf, &pdu_session_modification_request->integrity_protection_maximum_data_rate);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_modification_request->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_extended_protocol_configuration_options(pkbuf, &pdu_session_modification_request->extended_protocol_configuration_options);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_modification_request->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_REQUESTED_QOS_RULES_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_REQUESTED_QOS_RULES_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_qos_rules(pkbuf, &pdu_session_modification_request->requested_qos_rules);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_modification_request->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_REQUESTED_QOS_FLOW_DESCRIPTIONS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_REQUESTED_QOS_FLOW_DESCRIPTIONS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_qos_flow_descriptions(pkbuf, &pdu_session_modification_request->requested_qos_flow_descriptions);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_modification_request->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_5GSM_CAUSE_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_5GSM_CAUSE_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_5gsm_cause(pkbuf, &pdu_session_modification_request->gsm_cause);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_modification_request->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_5GSM_CAPABILITY_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_5GSM_CAPABILITY_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_5gsm_capability(pkbuf, &pdu_session_modification_request->gsm_capability);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_modification_request->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_MAPPED_EPS_BEARER_CONTEXTS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_MAPPED_EPS_BEARER_CONTEXTS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_mapped_eps_bearer_contexts(pkbuf, &pdu_session_modification_request->mapped_eps_bearer_contexts);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    return encoded;
+}
+
+static int encode_pdu_session_modification_reject(
+        ogs_pkbuf_t *pkbuf, ogs_nas_5gs_message_t *message)
+{
+    ogs_nas_5gs_pdu_session_modification_reject_t
+        *pdu_session_modification_reject = NULL;
+    int encoded = 0;
+    int size = 0;
+
+    ogs_assert(message);
+    pdu_session_modification_reject =
+        &message->gsm.pdu_session_modification_reject;
+
+    if (pdu_session_modification_reject->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_extended_protocol_configuration_options(pkbuf, &pdu_session_modification_reject->extended_protocol_configuration_options);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    return encoded;
+}
+
+static int encode_pdu_session_modification_command(
+        ogs_pkbuf_t *pkbuf, ogs_nas_5gs_message_t *message)
+{
+    ogs_nas_5gs_pdu_session_modification_command_t
+        *pdu_session_modification_command = NULL;
+    int encoded = 0;
+    int size = 0;
+
+    ogs_assert(message);
+    pdu_session_modification_command =
+        &message->gsm.pdu_session_modification_command;
+
+    if (pdu_session_modification_command->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_RQ_TIMER_VALUE_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_RQ_TIMER_VALUE_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_gprs_timer(pkbuf, &pdu_session_modification_command->rq_timer_value);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_modification_command->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_extended_protocol_configuration_options(pkbuf, &pdu_session_modification_command->extended_protocol_configuration_options);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_modification_command->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_5GSM_CAUSE_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_5GSM_CAUSE_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_5gsm_cause(pkbuf, &pdu_session_modification_command->gsm_cause);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_modification_command->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_MAPPED_EPS_BEARER_CONTEXTS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_MAPPED_EPS_BEARER_CONTEXTS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_mapped_eps_bearer_contexts(pkbuf, &pdu_session_modification_command->mapped_eps_bearer_contexts);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_modification_command->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_ATSSS_CONTAINER_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_ATSSS_CONTAINER_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_atsss_container(pkbuf, &pdu_session_modification_command->atsss_container);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    return encoded;
+}
+
+static int encode_pdu_session_modification_complete(
+        ogs_pkbuf_t *pkbuf, ogs_nas_5gs_message_t *message)
+{
+    ogs_nas_5gs_pdu_session_modification_complete_t
+        *pdu_session_modification_complete = NULL;
+    int encoded = 0;
+    int size = 0;
+
+    ogs_assert(message);
+    pdu_session_modification_complete =
+        &message->gsm.pdu_session_modification_complete;
+
+
+    if (pdu_session_modification_complete->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMPLETE_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMPLETE_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_extended_protocol_configuration_options(pkbuf, &pdu_session_modification_complete->extended_protocol_configuration_options);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    return encoded;
+}
+
+static int encode_pdu_session_modification_command_reject(
+        ogs_pkbuf_t *pkbuf, ogs_nas_5gs_message_t *message)
+{
+    ogs_nas_5gs_pdu_session_modification_command_reject_t
+        *pdu_session_modification_command_reject = NULL;
+    int encoded = 0;
+    int size = 0;
+
+    ogs_assert(message);
+    pdu_session_modification_command_reject =
+        &message->gsm.pdu_session_modification_command_reject;
+
+
+    if (pdu_session_modification_command_reject->presencemask & OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_extended_protocol_configuration_options(pkbuf, &pdu_session_modification_command_reject->extended_protocol_configuration_options);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    return encoded;
+}
+
+static int encode_pdu_session_release_request(
+        ogs_pkbuf_t *pkbuf, ogs_nas_5gs_message_t *message)
+{
+    ogs_nas_5gs_pdu_session_release_request_t
+        *pdu_session_release_request = NULL;
+    int encoded = 0;
+    int size = 0;
+
+    ogs_assert(message);
+    pdu_session_release_request = &message->gsm.pdu_session_release_request;
+
+    if (pdu_session_release_request->presencemask & OGS_NAS_5GS_PDU_SESSION_RELEASE_REQUEST_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_RELEASE_REQUEST_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_extended_protocol_configuration_options(pkbuf, &pdu_session_release_request->extended_protocol_configuration_options);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_release_request->presencemask & OGS_NAS_5GS_PDU_SESSION_RELEASE_REQUEST_5GSM_CAUSE_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_RELEASE_REQUEST_5GSM_CAUSE_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_5gsm_cause(pkbuf, &pdu_session_release_request->gsm_cause);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    return encoded;
+}
+
+static int encode_pdu_session_release_reject(
+        ogs_pkbuf_t *pkbuf, ogs_nas_5gs_message_t *message)
+{
+    ogs_nas_5gs_pdu_session_release_reject_t
+        *pdu_session_release_reject = NULL;
+    int encoded = 0;
+    int size = 0;
+
+    ogs_assert(message);
+    pdu_session_release_reject =
+        &message->gsm.pdu_session_release_reject;
+
+    if (pdu_session_release_reject->presencemask & OGS_NAS_5GS_PDU_SESSION_RELEASE_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_RELEASE_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_extended_protocol_configuration_options(pkbuf, &pdu_session_release_reject->extended_protocol_configuration_options);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    return encoded;
+}
+
+static int encode_pdu_session_release_command(
+        ogs_pkbuf_t *pkbuf, ogs_nas_5gs_message_t *message)
+{
+    ogs_nas_5gs_pdu_session_release_command_t
+        *pdu_session_release_command = NULL;
+    int encoded = 0;
+    int size = 0;
+
+    ogs_assert(message);
+    pdu_session_release_command =
+        &message->gsm.pdu_session_release_command;
+
+    if (pdu_session_release_command->presencemask & OGS_NAS_5GS_PDU_SESSION_RELEASE_COMMAND_EAP_MESSAGE_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_RELEASE_COMMAND_EAP_MESSAGE_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_eap_message(pkbuf, &pdu_session_release_command->eap_message);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_release_command->presencemask & OGS_NAS_5GS_PDU_SESSION_RELEASE_COMMAND_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_RELEASE_COMMAND_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_extended_protocol_configuration_options(pkbuf, &pdu_session_release_command->extended_protocol_configuration_options);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    return encoded;
+}
+
+static int encode_pdu_session_release_complete(
+        ogs_pkbuf_t *pkbuf, ogs_nas_5gs_message_t *message)
+{
+    ogs_nas_5gs_pdu_session_release_complete_t
+        *pdu_session_release_complete = NULL;
+    int encoded = 0;
+    int size = 0;
+
+    ogs_assert(message);
+    pdu_session_release_complete = &message->gsm.pdu_session_release_complete;
+
+    if (pdu_session_release_complete->presencemask & OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_extended_protocol_configuration_options(pkbuf, &pdu_session_release_complete->extended_protocol_configuration_options);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    if (pdu_session_release_complete->presencemask & OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE_5GSM_CAUSE_PRESENT) {
+        size = ogs_nas_5gs_encode_optional_type(pkbuf, OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE_5GSM_CAUSE_TYPE);
+        ogs_assert(size >= 0);
+        encoded += size;
+
+        size = ogs_nas_5gs_encode_5gsm_cause(pkbuf, &pdu_session_release_complete->gsm_cause);
+        ogs_assert(size >= 0);
+        encoded += size;
+    }
+
+    return encoded;
+}
+
+static int decode_pdu_session_establishment_request(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf)
+{
+    ogs_nas_5gs_pdu_session_establishment_request_t *pdu_session_establishment_request = &message->gsm.pdu_session_establishment_request;
+    int decoded = 0;
+    int size = 0;
+
+    ogs_trace("NAS Decode PDU_SESSION_ESTABLISHMENT_REQUEST\n");
+
+    while (pkbuf->len > 0) {
+        uint8_t *buffer = pkbuf->data;
+        uint8_t type = (*buffer) >= 0x80 ? ((*buffer) & 0xf0) : (*buffer);
+
+        size = sizeof(uint8_t);
+        if (ogs_pkbuf_pull(pkbuf, size) == NULL) {
+           ogs_error("ogs_pkbuf_pull() failed size:%d", (int)size);
+           return OGS_ERROR;
+        }
+        decoded += size;
+
+        switch(type) {
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_PDU_SESSION_TYPE_TYPE:
+            decoded--;
+            ogs_assert(ogs_pkbuf_push(pkbuf, 1));
+            size = ogs_nas_5gs_decode_pdu_session_type(&pdu_session_establishment_request->pdu_session_type, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_pdu_session_type() failed");
+               return size;
+            }
+
+            pdu_session_establishment_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_PDU_SESSION_TYPE_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_SSC_MODE_TYPE:
+            decoded--;
+            ogs_assert(ogs_pkbuf_push(pkbuf, 1));
+            size = ogs_nas_5gs_decode_ssc_mode(&pdu_session_establishment_request->ssc_mode, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_ssc_mode() failed");
+               return size;
+            }
+
+            pdu_session_establishment_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_SSC_MODE_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_MAXIMUM_NUMBER_OF_SUPPORTED_PACKET_FILTERS_TYPE:
+            size = ogs_nas_5gs_decode_maximum_number_of_supported_packet_filters(&pdu_session_establishment_request->maximum_number_of_supported_packet_filters, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_maximum_number_of_supported_packet_filters() failed");
+               return size;
+            }
+
+            pdu_session_establishment_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_MAXIMUM_NUMBER_OF_SUPPORTED_PACKET_FILTERS_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_SM_PDU_DN_REQUEST_CONTAINER_TYPE:
+            size = ogs_nas_5gs_decode_sm_pdu_dn_request_container(&pdu_session_establishment_request->sm_pdu_dn_request_container, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_sm_pdu_dn_request_container() failed");
+               return size;
+            }
+
+            pdu_session_establishment_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_SM_PDU_DN_REQUEST_CONTAINER_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE:
+            size = ogs_nas_5gs_decode_extended_protocol_configuration_options(&pdu_session_establishment_request->extended_protocol_configuration_options, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_extended_protocol_configuration_options() failed");
+               return size;
+            }
+
+            pdu_session_establishment_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_5GSM_CAPABILITY_TYPE:
+            size = ogs_nas_5gs_decode_5gsm_capability(&pdu_session_establishment_request->gsm_capability, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_5gsm_capability() failed");
+               return size;
+            }
+
+            pdu_session_establishment_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_5GSM_CAPABILITY_PRESENT;
+            decoded += size;
+            break;
+        default:
+            ogs_error("Unknown type(0x%x) or not implemented\n", type);
+            break;
+        }
+    }
+
+    return decoded;
+}
+
+static int decode_pdu_session_establishment_accept(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf)
+{
+    ogs_nas_5gs_pdu_session_establishment_accept_t *pdu_session_establishment_accept = &message->gsm.pdu_session_establishment_accept;
+    int decoded = 0;
+    int size = 0;
+
+    ogs_trace("NAS Decode PDU_SESSION_ESTABLISHMENT_ACCEPT\n");
+
+    while (pkbuf->len > 0) {
+        uint8_t *buffer = pkbuf->data;
+        uint8_t type = (*buffer) >= 0x80 ? ((*buffer) & 0xf0) : (*buffer);
+
+        size = sizeof(uint8_t);
+        if (ogs_pkbuf_pull(pkbuf, size) == NULL) {
+           ogs_error("ogs_pkbuf_pull() failed size:%d", (int)size);
+           return OGS_ERROR;
+        }
+        decoded += size;
+
+        switch(type) {
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_RQ_TIMER_VALUE_TYPE:
+            size = ogs_nas_5gs_decode_gprs_timer(&pdu_session_establishment_accept->rq_timer_value, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_gprs_timer() failed");
+               return size;
+            }
+
+            pdu_session_establishment_accept->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_RQ_TIMER_VALUE_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_EAP_MESSAGE_TYPE:
+            size = ogs_nas_5gs_decode_eap_message(&pdu_session_establishment_accept->eap_message, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_eap_message() failed");
+               return size;
+            }
+
+            pdu_session_establishment_accept->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_EAP_MESSAGE_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE:
+            size = ogs_nas_5gs_decode_extended_protocol_configuration_options(&pdu_session_establishment_accept->extended_protocol_configuration_options, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_extended_protocol_configuration_options() failed");
+               return size;
+            }
+
+            pdu_session_establishment_accept->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_5GSM_CAUSE_TYPE:
+            size = ogs_nas_5gs_decode_5gsm_cause(&pdu_session_establishment_accept->gsm_cause, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_5gsm_cause() failed");
+               return size;
+            }
+
+            pdu_session_establishment_accept->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_5GSM_CAUSE_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_MAPPED_EPS_BEARER_CONTEXTS_TYPE:
+            size = ogs_nas_5gs_decode_mapped_eps_bearer_contexts(&pdu_session_establishment_accept->mapped_eps_bearer_contexts, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_mapped_eps_bearer_contexts() failed");
+               return size;
+            }
+
+            pdu_session_establishment_accept->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_MAPPED_EPS_BEARER_CONTEXTS_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_ATSSS_CONTAINER_TYPE:
+            size = ogs_nas_5gs_decode_atsss_container(&pdu_session_establishment_accept->atsss_container, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_atsss_container() failed");
+               return size;
+            }
+
+            pdu_session_establishment_accept->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_ATSSS_CONTAINER_PRESENT;
+            decoded += size;
+            break;
+        default:
+            ogs_error("Unknown type(0x%x) or not implemented\n", type);
+            break;
+        }
+    }
+
+    return decoded;
+}
+
+static int decode_pdu_session_establishment_reject(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf)
+{
+    ogs_nas_5gs_pdu_session_establishment_reject_t *pdu_session_establishment_reject = &message->gsm.pdu_session_establishment_reject;
+    int decoded = 0;
+    int size = 0;
+
+    ogs_trace("NAS Decode PDU_SESSION_ESTABLISHMENT_REJECT\n");
+
+    while (pkbuf->len > 0) {
+        uint8_t *buffer = pkbuf->data;
+        uint8_t type = (*buffer) >= 0x80 ? ((*buffer) & 0xf0) : (*buffer);
+
+        size = sizeof(uint8_t);
+        if (ogs_pkbuf_pull(pkbuf, size) == NULL) {
+           ogs_error("ogs_pkbuf_pull() failed size:%d", (int)size);
+           return OGS_ERROR;
+        }
+        decoded += size;
+
+        switch(type) {
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REJECT_EAP_MESSAGE_TYPE:
+            size = ogs_nas_5gs_decode_eap_message(&pdu_session_establishment_reject->eap_message, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_eap_message() failed");
+               return size;
+            }
+
+            pdu_session_establishment_reject->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REJECT_EAP_MESSAGE_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REJECT_ALLOWED_SSC_MODE_TYPE:
+            decoded--;
+            ogs_assert(ogs_pkbuf_push(pkbuf, 1));
+            size = ogs_nas_5gs_decode_allowed_ssc_mode(&pdu_session_establishment_reject->allowed_ssc_mode, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_allowed_ssc_mode() failed");
+               return size;
+            }
+
+            pdu_session_establishment_reject->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REJECT_ALLOWED_SSC_MODE_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE:
+            size = ogs_nas_5gs_decode_extended_protocol_configuration_options(&pdu_session_establishment_reject->extended_protocol_configuration_options, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_extended_protocol_configuration_options() failed");
+               return size;
+            }
+
+            pdu_session_establishment_reject->presencemask |= OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+            decoded += size;
+            break;
+        default:
+            ogs_error("Unknown type(0x%x) or not implemented\n", type);
+            break;
+        }
+    }
+
+    return decoded;
+}
+
+static int decode_pdu_session_modification_request(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf)
+{
+    ogs_nas_5gs_pdu_session_modification_request_t *pdu_session_modification_request = &message->gsm.pdu_session_modification_request;
+    int decoded = 0;
+    int size = 0;
+
+    ogs_trace("NAS Decode PDU_SESSION_MODIFICATION_REQUEST\n");
+
+    while (pkbuf->len > 0) {
+        uint8_t *buffer = pkbuf->data;
+        uint8_t type = (*buffer) >= 0x80 ? ((*buffer) & 0xf0) : (*buffer);
+
+        size = sizeof(uint8_t);
+        if (ogs_pkbuf_pull(pkbuf, size) == NULL) {
+           ogs_error("ogs_pkbuf_pull() failed size:%d", (int)size);
+           return OGS_ERROR;
+        }
+        decoded += size;
+
+        switch(type) {
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_MAXIMUM_NUMBER_OF_SUPPORTED_PACKET_FILTERS_TYPE:
+            size = ogs_nas_5gs_decode_maximum_number_of_supported_packet_filters(&pdu_session_modification_request->maximum_number_of_supported_packet_filters, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_maximum_number_of_supported_packet_filters() failed");
+               return size;
+            }
+
+            pdu_session_modification_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_MAXIMUM_NUMBER_OF_SUPPORTED_PACKET_FILTERS_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_TYPE:
+            size = ogs_nas_5gs_decode_integrity_protection_maximum_data_rate(&pdu_session_modification_request->integrity_protection_maximum_data_rate, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_integrity_protection_maximum_data_rate() failed");
+               return size;
+            }
+
+            pdu_session_modification_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE:
+            size = ogs_nas_5gs_decode_extended_protocol_configuration_options(&pdu_session_modification_request->extended_protocol_configuration_options, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_extended_protocol_configuration_options() failed");
+               return size;
+            }
+
+            pdu_session_modification_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_REQUESTED_QOS_RULES_TYPE:
+            size = ogs_nas_5gs_decode_qos_rules(&pdu_session_modification_request->requested_qos_rules, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_qos_rules() failed");
+               return size;
+            }
+
+            pdu_session_modification_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_REQUESTED_QOS_RULES_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_REQUESTED_QOS_FLOW_DESCRIPTIONS_TYPE:
+            size = ogs_nas_5gs_decode_qos_flow_descriptions(&pdu_session_modification_request->requested_qos_flow_descriptions, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_qos_flow_descriptions() failed");
+               return size;
+            }
+
+            pdu_session_modification_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_REQUESTED_QOS_FLOW_DESCRIPTIONS_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_5GSM_CAUSE_TYPE:
+            size = ogs_nas_5gs_decode_5gsm_cause(&pdu_session_modification_request->gsm_cause, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_5gsm_cause() failed");
+               return size;
+            }
+
+            pdu_session_modification_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_5GSM_CAUSE_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_5GSM_CAPABILITY_TYPE:
+            size = ogs_nas_5gs_decode_5gsm_capability(&pdu_session_modification_request->gsm_capability, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_5gsm_capability() failed");
+               return size;
+            }
+
+            pdu_session_modification_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_5GSM_CAPABILITY_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_MAPPED_EPS_BEARER_CONTEXTS_TYPE:
+            size = ogs_nas_5gs_decode_mapped_eps_bearer_contexts(&pdu_session_modification_request->mapped_eps_bearer_contexts, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_mapped_eps_bearer_contexts() failed");
+               return size;
+            }
+
+            pdu_session_modification_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_MAPPED_EPS_BEARER_CONTEXTS_PRESENT;
+            decoded += size;
+            break;
+        default:
+            ogs_error("Unknown type(0x%x) or not implemented\n", type);
+            break;
+        }
+    }
+
+    return decoded;
+}
+
+static int decode_pdu_session_modification_reject(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf)
+{
+    ogs_nas_5gs_pdu_session_modification_reject_t *pdu_session_modification_reject = &message->gsm.pdu_session_modification_reject;
+    int decoded = 0;
+    int size = 0;
+
+    ogs_trace("NAS Decode PDU_SESSION_MODIFICATION_REJECT\n");
+
+    while (pkbuf->len > 0) {
+        uint8_t *buffer = pkbuf->data;
+        uint8_t type = (*buffer) >= 0x80 ? ((*buffer) & 0xf0) : (*buffer);
+
+        size = sizeof(uint8_t);
+        if (ogs_pkbuf_pull(pkbuf, size) == NULL) {
+           ogs_error("ogs_pkbuf_pull() failed size:%d", (int)size);
+           return OGS_ERROR;
+        }
+        decoded += size;
+
+        switch(type) {
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE:
+            size = ogs_nas_5gs_decode_extended_protocol_configuration_options(&pdu_session_modification_reject->extended_protocol_configuration_options, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_extended_protocol_configuration_options() failed");
+               return size;
+            }
+
+            pdu_session_modification_reject->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+            decoded += size;
+            break;
+        default:
+            ogs_error("Unknown type(0x%x) or not implemented\n", type);
+            break;
+        }
+    }
+
+    return decoded;
+}
+
+static int decode_pdu_session_modification_command(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf)
+{
+    ogs_nas_5gs_pdu_session_modification_command_t *pdu_session_modification_command = &message->gsm.pdu_session_modification_command;
+    int decoded = 0;
+    int size = 0;
+
+    ogs_trace("NAS Decode PDU_SESSION_MODIFICATION_COMMAND\n");
+
+    while (pkbuf->len > 0) {
+        uint8_t *buffer = pkbuf->data;
+        uint8_t type = (*buffer) >= 0x80 ? ((*buffer) & 0xf0) : (*buffer);
+
+        size = sizeof(uint8_t);
+        if (ogs_pkbuf_pull(pkbuf, size) == NULL) {
+           ogs_error("ogs_pkbuf_pull() failed size:%d", (int)size);
+           return OGS_ERROR;
+        }
+        decoded += size;
+
+        switch(type) {
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_RQ_TIMER_VALUE_TYPE:
+            size = ogs_nas_5gs_decode_gprs_timer(&pdu_session_modification_command->rq_timer_value, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_gprs_timer() failed");
+               return size;
+            }
+
+            pdu_session_modification_command->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_RQ_TIMER_VALUE_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE:
+            size = ogs_nas_5gs_decode_extended_protocol_configuration_options(&pdu_session_modification_command->extended_protocol_configuration_options, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_extended_protocol_configuration_options() failed");
+               return size;
+            }
+
+            pdu_session_modification_command->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_5GSM_CAUSE_TYPE:
+            size = ogs_nas_5gs_decode_5gsm_cause(&pdu_session_modification_command->gsm_cause, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_5gsm_cause() failed");
+               return size;
+            }
+
+            pdu_session_modification_command->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_5GSM_CAUSE_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_MAPPED_EPS_BEARER_CONTEXTS_TYPE:
+            size = ogs_nas_5gs_decode_mapped_eps_bearer_contexts(&pdu_session_modification_command->mapped_eps_bearer_contexts, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_mapped_eps_bearer_contexts() failed");
+               return size;
+            }
+
+            pdu_session_modification_command->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_MAPPED_EPS_BEARER_CONTEXTS_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_ATSSS_CONTAINER_TYPE:
+            size = ogs_nas_5gs_decode_atsss_container(&pdu_session_modification_command->atsss_container, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_atsss_container() failed");
+               return size;
+            }
+
+            pdu_session_modification_command->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_ATSSS_CONTAINER_PRESENT;
+            decoded += size;
+            break;
+        default:
+            ogs_error("Unknown type(0x%x) or not implemented\n", type);
+            break;
+        }
+    }
+
+    return decoded;
+}
+
+static int decode_pdu_session_modification_complete(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf)
+{
+    ogs_nas_5gs_pdu_session_modification_complete_t *pdu_session_modification_complete = &message->gsm.pdu_session_modification_complete;
+    int decoded = 0;
+    int size = 0;
+
+    ogs_trace("NAS Decode PDU_SESSION_MODIFICATION_COMPLETE\n");
+
+    while (pkbuf->len > 0) {
+        uint8_t *buffer = pkbuf->data;
+        uint8_t type = (*buffer) >= 0x80 ? ((*buffer) & 0xf0) : (*buffer);
+
+        size = sizeof(uint8_t);
+        if (ogs_pkbuf_pull(pkbuf, size) == NULL) {
+           ogs_error("ogs_pkbuf_pull() failed size:%d", (int)size);
+           return OGS_ERROR;
+        }
+        decoded += size;
+
+        switch(type) {
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMPLETE_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE:
+            size = ogs_nas_5gs_decode_extended_protocol_configuration_options(&pdu_session_modification_complete->extended_protocol_configuration_options, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_extended_protocol_configuration_options() failed");
+               return size;
+            }
+
+            pdu_session_modification_complete->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMPLETE_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+            decoded += size;
+            break;
+        default:
+            ogs_error("Unknown type(0x%x) or not implemented\n", type);
+            break;
+        }
+    }
+
+    return decoded;
+}
+
+static int decode_pdu_session_modification_command_reject(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf)
+{
+    ogs_nas_5gs_pdu_session_modification_command_reject_t *pdu_session_modification_command_reject = &message->gsm.pdu_session_modification_command_reject;
+    int decoded = 0;
+    int size = 0;
+
+    ogs_trace("NAS Decode PDU_SESSION_MODIFICATION_COMMAND_REJECT\n");
+
+    while (pkbuf->len > 0) {
+        uint8_t *buffer = pkbuf->data;
+        uint8_t type = (*buffer) >= 0x80 ? ((*buffer) & 0xf0) : (*buffer);
+
+        size = sizeof(uint8_t);
+        if (ogs_pkbuf_pull(pkbuf, size) == NULL) {
+           ogs_error("ogs_pkbuf_pull() failed size:%d", (int)size);
+           return OGS_ERROR;
+        }
+        decoded += size;
+
+        switch(type) {
+        case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE:
+            size = ogs_nas_5gs_decode_extended_protocol_configuration_options(&pdu_session_modification_command_reject->extended_protocol_configuration_options, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_extended_protocol_configuration_options() failed");
+               return size;
+            }
+
+            pdu_session_modification_command_reject->presencemask |= OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+            decoded += size;
+            break;
+        default:
+            ogs_error("Unknown type(0x%x) or not implemented\n", type);
+            break;
+        }
+    }
+
+    return decoded;
+}
+
+static int decode_pdu_session_release_request(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf)
+{
+    ogs_nas_5gs_pdu_session_release_request_t *pdu_session_release_request = &message->gsm.pdu_session_release_request;
+    int decoded = 0;
+    int size = 0;
+
+    ogs_trace("NAS Decode PDU_SESSION_RELEASE_REQUEST\n");
+
+    while (pkbuf->len > 0) {
+        uint8_t *buffer = pkbuf->data;
+        uint8_t type = (*buffer) >= 0x80 ? ((*buffer) & 0xf0) : (*buffer);
+
+        size = sizeof(uint8_t);
+        if (ogs_pkbuf_pull(pkbuf, size) == NULL) {
+           ogs_error("ogs_pkbuf_pull() failed size:%d", (int)size);
+           return OGS_ERROR;
+        }
+        decoded += size;
+
+        switch(type) {
+        case OGS_NAS_5GS_PDU_SESSION_RELEASE_REQUEST_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE:
+            size = ogs_nas_5gs_decode_extended_protocol_configuration_options(&pdu_session_release_request->extended_protocol_configuration_options, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_extended_protocol_configuration_options() failed");
+               return size;
+            }
+
+            pdu_session_release_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_RELEASE_REQUEST_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_RELEASE_REQUEST_5GSM_CAUSE_TYPE:
+            size = ogs_nas_5gs_decode_5gsm_cause(&pdu_session_release_request->gsm_cause, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_5gsm_cause() failed");
+               return size;
+            }
+
+            pdu_session_release_request->presencemask |= OGS_NAS_5GS_PDU_SESSION_RELEASE_REQUEST_5GSM_CAUSE_PRESENT;
+            decoded += size;
+            break;
+        default:
+            ogs_error("Unknown type(0x%x) or not implemented\n", type);
+            break;
+        }
+    }
+
+    return decoded;
+}
+
+static int decode_pdu_session_release_reject(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf)
+{
+    ogs_nas_5gs_pdu_session_release_reject_t *pdu_session_release_reject = &message->gsm.pdu_session_release_reject;
+    int decoded = 0;
+    int size = 0;
+
+    ogs_trace("NAS Decode PDU_SESSION_RELEASE_REJECT\n");
+
+    while (pkbuf->len > 0) {
+        uint8_t *buffer = pkbuf->data;
+        uint8_t type = (*buffer) >= 0x80 ? ((*buffer) & 0xf0) : (*buffer);
+
+        size = sizeof(uint8_t);
+        if (ogs_pkbuf_pull(pkbuf, size) == NULL) {
+           ogs_error("ogs_pkbuf_pull() failed size:%d", (int)size);
+           return OGS_ERROR;
+        }
+        decoded += size;
+
+        switch(type) {
+        case OGS_NAS_5GS_PDU_SESSION_RELEASE_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE:
+            size = ogs_nas_5gs_decode_extended_protocol_configuration_options(&pdu_session_release_reject->extended_protocol_configuration_options, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_extended_protocol_configuration_options() failed");
+               return size;
+            }
+
+            pdu_session_release_reject->presencemask |= OGS_NAS_5GS_PDU_SESSION_RELEASE_REJECT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+            decoded += size;
+            break;
+        default:
+            ogs_error("Unknown type(0x%x) or not implemented\n", type);
+            break;
+        }
+    }
+
+    return decoded;
+}
+
+static int decode_pdu_session_release_command(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf)
+{
+    ogs_nas_5gs_pdu_session_release_command_t *pdu_session_release_command = &message->gsm.pdu_session_release_command;
+    int decoded = 0;
+    int size = 0;
+
+    ogs_trace("NAS Decode PDU_SESSION_RELEASE_COMMAND\n");
+
+    while (pkbuf->len > 0) {
+        uint8_t *buffer = pkbuf->data;
+        uint8_t type = (*buffer) >= 0x80 ? ((*buffer) & 0xf0) : (*buffer);
+
+        size = sizeof(uint8_t);
+        if (ogs_pkbuf_pull(pkbuf, size) == NULL) {
+           ogs_error("ogs_pkbuf_pull() failed size:%d", (int)size);
+           return OGS_ERROR;
+        }
+        decoded += size;
+
+        switch(type) {
+        case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMMAND_EAP_MESSAGE_TYPE:
+            size = ogs_nas_5gs_decode_eap_message(&pdu_session_release_command->eap_message, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_eap_message() failed");
+               return size;
+            }
+
+            pdu_session_release_command->presencemask |= OGS_NAS_5GS_PDU_SESSION_RELEASE_COMMAND_EAP_MESSAGE_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMMAND_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE:
+            size = ogs_nas_5gs_decode_extended_protocol_configuration_options(&pdu_session_release_command->extended_protocol_configuration_options, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_extended_protocol_configuration_options() failed");
+               return size;
+            }
+
+            pdu_session_release_command->presencemask |= OGS_NAS_5GS_PDU_SESSION_RELEASE_COMMAND_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+            decoded += size;
+            break;
+        default:
+            ogs_error("Unknown type(0x%x) or not implemented\n", type);
+            break;
+        }
+    }
+
+    return decoded;
+}
+
+static int decode_pdu_session_release_complete(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf)
+{
+    ogs_nas_5gs_pdu_session_release_complete_t *pdu_session_release_complete = &message->gsm.pdu_session_release_complete;
+    int decoded = 0;
+    int size = 0;
+
+    ogs_trace("NAS Decode PDU_SESSION_RELEASE_COMPLETE\n");
+
+    while (pkbuf->len > 0) {
+        uint8_t *buffer = pkbuf->data;
+        uint8_t type = (*buffer) >= 0x80 ? ((*buffer) & 0xf0) : (*buffer);
+
+        size = sizeof(uint8_t);
+        if (ogs_pkbuf_pull(pkbuf, size) == NULL) {
+           ogs_error("ogs_pkbuf_pull() failed size:%d", (int)size);
+           return OGS_ERROR;
+        }
+        decoded += size;
+
+        switch(type) {
+        case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_TYPE:
+            size = ogs_nas_5gs_decode_extended_protocol_configuration_options(&pdu_session_release_complete->extended_protocol_configuration_options, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_extended_protocol_configuration_options() failed");
+               return size;
+            }
+
+            pdu_session_release_complete->presencemask |= OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+            decoded += size;
+            break;
+        case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE_5GSM_CAUSE_TYPE:
+            size = ogs_nas_5gs_decode_5gsm_cause(&pdu_session_release_complete->gsm_cause, pkbuf);
+            if (size < 0) {
+               ogs_error("ogs_nas_5gs_decode_5gsm_cause() failed");
+               return size;
+            }
+
+            pdu_session_release_complete->presencemask |= OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE_5GSM_CAUSE_PRESENT;
+            decoded += size;
+            break;
+        default:
+            ogs_error("Unknown type(0x%x) or not implemented\n", type);
+            break;
+        }
+    }
+
+    return decoded;
+}
+
+ogs_pkbuf_t *gsmue_encode_n1_sm_info(ogs_nas_5gs_message_t *message)
+{
+    ogs_pkbuf_t *pkbuf = NULL;
+    int size = 0;
+    int encoded = 0;
+
+    ogs_assert(message);
+
+    /* The Packet Buffer(ogs_pkbuf_t) for NAS message MUST make a HEADROOM.
+     * When calculating AES_CMAC, we need to use the headroom of the packet. */
+    pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    if (!pkbuf) {
+        ogs_error("ogs_pkbuf_alloc() failed");
+        return NULL;
+    }
+
+    ogs_pkbuf_reserve(pkbuf, OGS_NAS_HEADROOM);
+    ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-OGS_NAS_HEADROOM);
+
+    /* Message type */
+    size = sizeof(uint8_t);
+    ogs_assert(ogs_pkbuf_pull(pkbuf, size));
+    memcpy(pkbuf->data - size, &message->gsm.h.message_type, size);
+    encoded += size;
+
+    switch(message->gsm.h.message_type) {
+    case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST:
+        size = encode_pdu_session_establishment_request(pkbuf, message);
+        ogs_assert(size >= 0);
+        encoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT:
+        size = encode_pdu_session_establishment_accept(pkbuf, message);
+        ogs_assert(size >= 0);
+        encoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REJECT:
+        size = encode_pdu_session_establishment_reject(pkbuf, message);
+        ogs_assert(size >= 0);
+        encoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST:
+        size = encode_pdu_session_modification_request(pkbuf, message);
+        ogs_assert(size >= 0);
+        encoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REJECT:
+        size = encode_pdu_session_modification_reject(pkbuf, message);
+        ogs_assert(size >= 0);
+        encoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND:
+        size = encode_pdu_session_modification_command(pkbuf, message);
+        ogs_assert(size >= 0);
+        encoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMPLETE:
+        size = encode_pdu_session_modification_complete(pkbuf, message);
+        ogs_assert(size >= 0);
+        encoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_REJECT:
+        size = encode_pdu_session_modification_command_reject(
+                pkbuf, message);
+        ogs_assert(size >= 0);
+        encoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_RELEASE_REQUEST:
+        size = encode_pdu_session_release_request(pkbuf, message);
+        ogs_assert(size >= 0);
+        encoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_RELEASE_REJECT:
+        size = encode_pdu_session_release_reject(pkbuf, message);
+        ogs_assert(size >= 0);
+        encoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMMAND:
+        size = encode_pdu_session_release_command(pkbuf, message);
+        ogs_assert(size >= 0);
+        encoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE:
+        size = encode_pdu_session_release_complete(pkbuf, message);
+        ogs_assert(size >= 0);
+        encoded += size;
+        break;
+    default:
+        ogs_error("Unknown message type (0x%x) or not implemented",
+                message->gsm.h.message_type);
+        ogs_pkbuf_free(pkbuf);
+        return NULL;
+    }
+
+    ogs_assert(ogs_pkbuf_push(pkbuf, encoded));
+    pkbuf->len = encoded;
+
+    return pkbuf;
+}
+
+int gsmue_decode_n1_sm_info(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf)
+{
+    int size = 0;
+    int decoded = 0;
+
+    ogs_assert(message);
+    ogs_assert(pkbuf);
+    ogs_assert(pkbuf->data);
+
+    size = sizeof(uint8_t);
+    if (ogs_pkbuf_pull(pkbuf, size) == NULL) {
+       ogs_error("ogs_pkbuf_pull() failed size:%d", (int)size);
+       return OGS_ERROR;
+    }
+
+    memset(message, 0, sizeof(ogs_nas_5gs_message_t));
+    memcpy(&message->gsm.h.message_type, pkbuf->data - size, size);
+    decoded += size;
+
+    switch(message->gsm.h.message_type) {
+    case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST:
+        size = decode_pdu_session_establishment_request(message, pkbuf);
+        if (size < 0) {
+           ogs_error("decode_pdu_session_establishment_request() failed");
+           return size;
+        }
+
+        decoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT:
+        size = decode_pdu_session_establishment_accept(message, pkbuf);
+        if (size < 0) {
+           ogs_error("decode_pdu_session_establishment_accept() failed");
+           return size;
+        }
+
+        decoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REJECT:
+        size = decode_pdu_session_establishment_reject(message, pkbuf);
+        if (size < 0) {
+           ogs_error("decode_pdu_session_establishment_reject() failed");
+           return size;
+        }
+
+        decoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST:
+        size = decode_pdu_session_modification_request(message, pkbuf);
+        if (size < 0) {
+           ogs_error("decode_pdu_session_modification_request() failed");
+           return size;
+        }
+
+        decoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REJECT:
+        size = decode_pdu_session_modification_reject(message, pkbuf);
+        if (size < 0) {
+           ogs_error("decode_pdu_session_modification_reject() failed");
+           return size;
+        }
+
+        decoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND:
+        size = decode_pdu_session_modification_command(message, pkbuf);
+        if (size < 0) {
+           ogs_error("decode_pdu_session_modification_command() failed");
+           return size;
+        }
+
+        decoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMPLETE:
+        size = decode_pdu_session_modification_complete(message, pkbuf);
+        if (size < 0) {
+           ogs_error("decode_pdu_session_modification_complete() failed");
+           return size;
+        }
+
+        decoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND_REJECT:
+        size = decode_pdu_session_modification_command_reject(message, pkbuf);
+        if (size < 0) {
+           ogs_error("decode_pdu_session_modification_command_reject() failed");
+           return size;
+        }
+
+        decoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_RELEASE_REQUEST:
+        size = decode_pdu_session_release_request(message, pkbuf);
+        if (size < 0) {
+           ogs_error("decode_pdu_session_release_request() failed");
+           return size;
+        }
+
+        decoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_RELEASE_REJECT:
+        size = decode_pdu_session_release_reject(message, pkbuf);
+        if (size < 0) {
+           ogs_error("decode_pdu_session_release_reject() failed");
+           return size;
+        }
+
+        decoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMMAND:
+        size = decode_pdu_session_release_command(message, pkbuf);
+        if (size < 0) {
+           ogs_error("decode_pdu_session_release_command() failed");
+           return size;
+        }
+
+        decoded += size;
+        break;
+    case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE:
+        size = decode_pdu_session_release_complete(message, pkbuf);
+        if (size < 0) {
+           ogs_error("decode_pdu_session_release_complete() failed");
+           return size;
+        }
+
+        decoded += size;
+        break;
+    default:
+        ogs_error("Unknown message type (0x%x) or not implemented",
+                message->gsm.h.message_type);
+        break;
+    }
+
+    ogs_assert(ogs_pkbuf_push(pkbuf, decoded));
+
+    return OGS_OK;
+}
+
+ogs_pkbuf_t *gsmue_build_pdu_session_establishment_accept(smf_sess_t *sess)
+{
+    ogs_pkbuf_t *pkbuf = NULL;
+
+    ogs_nas_5gs_message_t message;
+    ogs_nas_5gs_pdu_session_establishment_accept_t *
+        pdu_session_establishment_accept =
+            &message.gsm.pdu_session_establishment_accept;
+
+    ogs_nas_5gsm_cause_t *gsm_cause = NULL;
+    ogs_nas_extended_protocol_configuration_options_t
+        *extended_protocol_configuration_options = NULL;
+
+    uint8_t *epco_buf = NULL;
+    int16_t epco_len;
+
+    gsm_cause = &pdu_session_establishment_accept->gsm_cause;
+    ogs_assert(gsm_cause);
+    extended_protocol_configuration_options =
+        &pdu_session_establishment_accept->
+            extended_protocol_configuration_options;
+    ogs_assert(extended_protocol_configuration_options);
+
+    ogs_assert(sess);
+
+    memset(&message, 0, sizeof(message));
+    message.gsm.h.message_type = OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT;
+
+    /* GSM cause */
+    if (sess->ue_session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
+        if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
+            pdu_session_establishment_accept->presencemask |=
+                OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_5GSM_CAUSE_PRESENT;
+            *gsm_cause = OGS_5GSM_CAUSE_PDU_SESSION_TYPE_IPV4_ONLY_ALLOWED;
+        } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
+            pdu_session_establishment_accept->presencemask |=
+                OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_5GSM_CAUSE_PRESENT;
+            *gsm_cause = OGS_5GSM_CAUSE_PDU_SESSION_TYPE_IPV6_ONLY_ALLOWED;
+        }
+    }
+
+    /* Extended protocol configuration options */
+    if (sess->nas.ue_epco.buffer && sess->nas.ue_epco.length) {
+        epco_buf = ogs_calloc(OGS_MAX_EPCO_LEN, sizeof(uint8_t));
+        ogs_assert(epco_buf);
+        epco_len = smf_pco_build(epco_buf,
+                sess->nas.ue_epco.buffer, sess->nas.ue_epco.length);
+        ogs_assert(epco_len > 0);
+        pdu_session_establishment_accept->presencemask |=
+            OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT;
+        extended_protocol_configuration_options->buffer = epco_buf;
+        extended_protocol_configuration_options->length = epco_len;
+    }
+
+    pkbuf = gsmue_encode_n1_sm_info(&message);
+    ogs_assert(pkbuf);
+
+cleanup:
+    if (epco_buf)
+        ogs_free(epco_buf);
+
+    return pkbuf;
+}
+
+ogs_pkbuf_t *gsmue_build_pdu_session_modification_command(smf_sess_t *sess)
+{
+    ogs_pkbuf_t *pkbuf = NULL;
+
+    ogs_nas_5gs_message_t message;
+
+    ogs_assert(sess);
+
+    memset(&message, 0, sizeof(message));
+    message.gsm.h.message_type = OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMMAND;
+
+    pkbuf = gsmue_encode_n1_sm_info(&message);
+    ogs_assert(pkbuf);
+
+    return pkbuf;
+}
+
+ogs_pkbuf_t *gsmue_build_pdu_session_release_command(smf_sess_t *sess)
+{
+    ogs_pkbuf_t *pkbuf = NULL;
+
+    ogs_nas_5gs_message_t message;
+
+    ogs_assert(sess);
+
+    memset(&message, 0, sizeof(message));
+    message.gsm.h.message_type = OGS_NAS_5GS_PDU_SESSION_RELEASE_COMMAND;
+
+    pkbuf = gsmue_encode_n1_sm_info(&message);
+    ogs_assert(pkbuf);
+
+    return pkbuf;
+}

open5gs_2.7.7.tar.xz/src/smf/gsmue-message.h Added

@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2024 by Sukchan Lee <acetcom@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#ifndef GSM_MESSAGE_H
+#define GSM_MESSAGE_H
+
+#include "context.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+ogs_pkbuf_t *gsmue_encode_n1_sm_info(ogs_nas_5gs_message_t *message);
+int gsmue_decode_n1_sm_info(ogs_nas_5gs_message_t *message, ogs_pkbuf_t *pkbuf);
+
+ogs_pkbuf_t *gsmue_build_pdu_session_establishment_accept(smf_sess_t *sess);
+ogs_pkbuf_t *gsmue_build_pdu_session_modification_command(smf_sess_t *sess);
+ogs_pkbuf_t *gsmue_build_pdu_session_release_command(smf_sess_t *sess);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* GSM_MESSAGE_H */

open5gs_2.7.6.tar.xz/src/smf/gtp-path.c -> open5gs_2.7.7.tar.xz/src/smf/gtp-path.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -710,17 +710,17 @@
     ogs_list_for_each(&sess->pfcp.pdr_list, pdr) {
         if (pdr->src_if == OGS_PFCP_INTERFACE_CP_FUNCTION && pdr->gnode) {
             ogs_gtp2_header_desc_t header_desc;
-            ogs_pkbuf_t *newbuf = NULL;
+            ogs_gtp_node_t *gnode = pdr->gnode;
+            ogs_assert(gnode);
+            ogs_assert(gnode->sock);
 
             memset(&header_desc, 0, sizeof(header_desc));
-
             header_desc.type = OGS_GTPU_MSGTYPE_GPDU;
-            header_desc.teid = pdr->f_teid.teid;
 
-            newbuf = ogs_pkbuf_copy(pkbuf);
-            ogs_assert(newbuf);
+            ogs_gtp2_encapsulate_header(&header_desc, pkbuf);
 
-            ogs_gtp2_send_user_plane(pdr->gnode, &header_desc, newbuf);
+            ogs_gtp_send_with_teid(
+                    gnode->sock, pkbuf, pdr->f_teid.teid, &gnode->addr);
 
             ogs_debug("      Send Router Advertisement");
             break;

open5gs_2.7.6.tar.xz/src/smf/gx-path.c -> open5gs_2.7.7.tar.xz/src/smf/gx-path.c Changed

@@ -1,5 +1,5 @@
 /* Gx Interface, 3GPP TS 29.212 section 4
- * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2026 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -138,7 +138,17 @@
         size_t sidlen = strlen(sess->gx_sid);
         ret = fd_sess_fromsid_msg((os0_t)sess->gx_sid, sidlen, &session, &new);
         ogs_assert(ret == 0);
-        ogs_assert(new == 0);
+        if (new) {
+            ogs_error("Gx Session %s missing in Diameter stack. "
+                    "Releasing PDU Session to recover.", sess->gx_sid);
+            ret = fd_msg_free(req);
+            ogs_assert(ret == 0);
+
+            ogs_free(sess->gx_sid);
+            sess->gx_sid = NULL;
+
+            return;
+        }
 
         ogs_debug("    Found Gx Session-Id: %s", sess->gx_sid);
 
@@ -752,6 +762,7 @@
     smf_sess_t *sess = NULL;
     ogs_diam_gx_message_t *gx_message = NULL;
     uint32_t req_slot, cc_request_number = 0;
+    int cleanup_needed = 0;
 
     ogs_debug("Credit-Control-Answer");
 
@@ -765,7 +776,10 @@
     /* Search the session, retrieve its data */
     ret = fd_msg_sess_get(fd_g_config->cnf_dict, *msg, &session, &new);
     ogs_assert(ret == 0);
-    ogs_assert(new == 0);
+    if (new != 0) {
+        ogs_error("Session should already exist, but new session flag is set");
+        goto cleanup;
+    }
 
     ogs_debug("    Search the session");
 
@@ -773,7 +787,7 @@
     ogs_assert(ret == 0);
     if (!sess_data) {
         ogs_error("No Session Data");
-        return;
+        goto cleanup;
     }
     ogs_assert((void *)sess_data == data);
 
@@ -784,14 +798,15 @@
     ogs_assert(ret == 0);
     if (!avp && req) {
         /* Attempt searching for CC-Request-* in original request. Error
-         * messages (like DIAMETER_UNABLE_TO_DELIVER) crafted internally may not
-         * have them. */
+         * messages (like DIAMETER_UNABLE_TO_DELIVER) crafted internally may
+         * not have them. */
         ret = fd_msg_search_avp(req, ogs_diam_gx_cc_request_number, &avp);
         ogs_assert(ret == 0);
     }
     if (!avp) {
         ogs_error("no_CC-Request-Number");
-        ogs_assert_if_reached();
+        error++;
+        goto cleanup;
     }
     ret = fd_msg_avp_hdr(avp, &hdr);
     ogs_assert(ret == 0);
@@ -801,11 +816,26 @@
     ogs_debug("    CC-Request-Number%d", cc_request_number);
 
     sess = smf_sess_find_by_id(sess_data->sess_id);
-    ogs_assert(sess_data->xact_datareq_slot.cc_req_no == cc_request_number);
-    ogs_assert(sess);
+    if (!sess) {
+        ogs_error("Cannot find session by ID%d", sess_data->sess_id);
+        error++;
+        goto cleanup;
+    }
+
+    if (sess_data->xact_datareq_slot.cc_req_no != cc_request_number) {
+        ogs_error("CC-Request-Number mismatch: expected%d, got%d",
+                sess_data->xact_datareq_slot.cc_req_no, cc_request_number);
+        error++;
+        goto cleanup;
+    }
 
+    /* Allocate message structure */
     gx_message = ogs_calloc(1, sizeof(ogs_diam_gx_message_t));
-    ogs_assert(gx_message);
+    if (!gx_message) {
+        ogs_error("Failed to allocate gx_message");
+        error++;
+        goto cleanup;
+    }
 
     /* Set Credit Control Command */
     gx_message->cmd_code = OGS_DIAM_GX_CMD_CODE_CREDIT_CONTROL;
@@ -837,6 +867,7 @@
         } else {
             ogs_error("no Result-Code");
             error++;
+            goto cleanup;
         }
     }
 
@@ -848,9 +879,22 @@
         ogs_assert(ret == 0);
         ogs_debug("    From '%.*s'",
                 (int)hdr->avp_value->os.len, hdr->avp_value->os.data);
+
+        /* Update peer host information */
+        if (sess_data->peer_host)
+            ogs_free(sess_data->peer_host);
+        sess_data->peer_host =
+            (os0_t)ogs_strndup((char *)hdr->avp_value->os.data,
+                             hdr->avp_value->os.len);
+        if (!sess_data->peer_host) {
+            ogs_error("Failed to allocate peer_host");
+            error++;
+            goto cleanup;
+        }
     } else {
         ogs_error("no_Origin-Host");
         error++;
+        goto cleanup;
     }
 
     /* Value of Origin-Realm */
@@ -864,6 +908,7 @@
     } else {
         ogs_error("no_Origin-Realm");
         error++;
+        goto cleanup;
     }
 
     /* Value of CC-Request-Type */
@@ -871,14 +916,15 @@
     ogs_assert(ret == 0);
     if (!avp && req) {
         /* Attempt searching for CC-Request-* in original request. Error
-         * messages (like DIAMETER_UNABLE_TO_DELIVER) crafted internally may not
-         * have them. */
+         * messages (like DIAMETER_UNABLE_TO_DELIVER) crafted internally may
+         * not have them. */
         ret = fd_msg_search_avp(req, ogs_diam_gx_cc_request_type, &avp);
         ogs_assert(ret == 0);
     }
     if (!avp) {
-        ogs_error("no_CC-Request-Number");
+        ogs_error("no_CC-Request-Type");
         error++;
+        goto cleanup;
     }
     ret = fd_msg_avp_hdr(avp, &hdr);
     ogs_assert(ret == 0);
@@ -886,9 +932,10 @@
 
     if (gx_message->result_code != ER_DIAMETER_SUCCESS) {
         ogs_warn("ERROR DIAMETER Result Code(%d)", gx_message->result_code);
-        goto out;
+        goto process_message;
     }
 
+    /* Process QoS Information */
     ret = fd_msg_search_avp(*msg, ogs_diam_gx_qos_information, &avp);
     ogs_assert(ret == 0);
     if (avp) {
@@ -911,6 +958,7 @@
         }
     }
 
+    /* Process Default EPS Bearer QoS */
     ret = fd_msg_search_avp(*msg, ogs_diam_gx_default_eps_bearer_qos, &avp);
     ogs_assert(ret == 0);
     if (avp) {
@@ -983,6 +1031,7 @@
         }
     }
 
+    /* Process Charging Rule Install */
     ret = fd_msg_browse(*msg, MSG_BRW_FIRST_CHILD, &avp, NULL);
     ogs_assert(ret == 0);
     while (avp) {
@@ -991,25 +1040,18 @@
         switch (hdr->avp_code) {
         case AC_SESSION_ID:
         case AC_ORIGIN_HOST:
-            if (sess_data->peer_host)
-                ogs_free(sess_data->peer_host);
-            sess_data->peer_host =
-                (os0_t)ogs_strdup((char *)hdr->avp_value->os.data);
-            ogs_assert(sess_data->peer_host);
-            break;
         case AC_ORIGIN_REALM:
         case AC_DESTINATION_REALM:
         case AC_RESULT_CODE:
         case AC_ROUTE_RECORD:
         case AC_PROXY_INFO:
         case AC_AUTH_APPLICATION_ID:
-            break;
         case OGS_DIAM_GX_AVP_CODE_CC_REQUEST_TYPE:
         case OGS_DIAM_GX_AVP_CODE_CC_REQUEST_NUMBER:
         case OGS_DIAM_GX_AVP_CODE_SUPPORTED_FEATURES:
-            break;
         case OGS_DIAM_GX_AVP_CODE_QOS_INFORMATION:
         case OGS_DIAM_GX_AVP_CODE_DEFAULT_EPS_BEARER_QOS:
+            /* Already processed above */
             break;
         case OGS_DIAM_GX_AVP_CODE_CHARGING_RULE_INSTALL:
             ret = fd_msg_browse(avp, MSG_BRW_FIRST_CHILD, &avpch1, NULL);
@@ -1024,13 +1066,19 @@
                         ogs_pcc_rule_t *pcc_rule = NULL;
                         smf_bearer_t *bearer = NULL;
                         int num_of_flow = 0;
+                        int decode_error = 0;
 
                         pcc_rule = &gx_message->session_data.pcc_rule
                                 gx_message->session_data.num_of_pcc_rule;
 
                         rv = decode_pcc_rule_definition(
-                                pcc_rule, avpch1, &error);
-                        ogs_assert(rv == OGS_OK);
+                                pcc_rule, avpch1, &decode_error);
+                        if (rv != OGS_OK || decode_error) {
+                            ogs_error("decode_pcc_rule_definition() failed");
+                            OGS_PCC_RULE_FREE(pcc_rule);
+                            error++;
+                            break;
+                        }
 
                         num_of_flow = pcc_rule->num_of_flow;
 
@@ -1066,10 +1114,15 @@
         fd_msg_browse(avp, MSG_BRW_NEXT, &avp, NULL);
     }
 
-out:
-    if (!error) {
+process_message:
+    /* Send message to application if no critical errors occurred */
+    if (!error && gx_message) {
         e = smf_event_new(SMF_EVT_GX_MESSAGE);
-        ogs_assert(e);
+        if (!e) {
+            ogs_error("Failed to create SMF event");
+            error++;
+            goto cleanup;
+        }
 
         e->sess_id = sess->id;
         e->gx_message = gx_message;
@@ -1077,36 +1130,45 @@
         rv = ogs_queue_push(ogs_app()->queue, e);
         if (rv != OGS_OK) {
             ogs_error("ogs_queue_push() failed:%d", (int)rv);
-            OGS_SESSION_DATA_FREE(&gx_message->session_data);
-            ogs_free(gx_message);
             ogs_event_free(e);
+            error++;
+            goto cleanup;
         } else {
             ogs_pollset_notify(ogs_app()->pollset);
+            gx_message = NULL; /* Transfer ownership to event */
         }
-    } else {
+    }
+
+cleanup:
+    /* Clean up allocated resources */
+    if (gx_message) {
         OGS_SESSION_DATA_FREE(&gx_message->session_data);
         ogs_free(gx_message);
     }
 
-    /* Free the message */
+    /* Update statistics */
     ogs_assert(pthread_mutex_lock(&ogs_diam_stats_self()->stats_lock) == 0);
-    dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
-        ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-    if (ogs_diam_stats_self()->stats.nb_recv) {
-        /* Ponderate in the avg */
-        ogs_diam_stats_self()->stats.avg = (ogs_diam_stats_self()->stats.avg *
-            ogs_diam_stats_self()->stats.nb_recv + dur) /
-            (ogs_diam_stats_self()->stats.nb_recv + 1);
-        /* Min, max */
-        if (dur < ogs_diam_stats_self()->stats.shortest)
+    if (sess_data) {
+        dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
+            ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+        if (ogs_diam_stats_self()->stats.nb_recv) {
+            /* Ponderate in the avg */
+            ogs_diam_stats_self()->stats.avg =
+                (ogs_diam_stats_self()->stats.avg *
+                 ogs_diam_stats_self()->stats.nb_recv + dur) /
+                (ogs_diam_stats_self()->stats.nb_recv + 1);
+            /* Min, max */
+            if (dur < ogs_diam_stats_self()->stats.shortest)
+                ogs_diam_stats_self()->stats.shortest = dur;
+            if (dur > ogs_diam_stats_self()->stats.longest)
+                ogs_diam_stats_self()->stats.longest = dur;
+        } else {
             ogs_diam_stats_self()->stats.shortest = dur;
-        if (dur > ogs_diam_stats_self()->stats.longest)
             ogs_diam_stats_self()->stats.longest = dur;
-    } else {
-        ogs_diam_stats_self()->stats.shortest = dur;
-        ogs_diam_stats_self()->stats.longest = dur;
-        ogs_diam_stats_self()->stats.avg = dur;
+            ogs_diam_stats_self()->stats.avg = dur;
+        }
     }
+
     if (error)
         ogs_diam_stats_self()->stats.nb_errs++;
     else
@@ -1114,34 +1176,49 @@
 
     ogs_assert(pthread_mutex_unlock(&ogs_diam_stats_self()->stats_lock) == 0);
 
-    /* Display how long it took */
-    if (ts.tv_nsec > sess_data->ts.tv_nsec)
-        ogs_trace("in %d.%06ld sec",
-                (int)(ts.tv_sec - sess_data->ts.tv_sec),
-                (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-    else
-        ogs_trace("in %d.%06ld sec",
-                (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
-                (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+    /* Display timing information */
+    if (sess_data) {
+        if (ts.tv_nsec > sess_data->ts.tv_nsec)
+            ogs_trace("in %d.%06ld sec",
+                    (int)(ts.tv_sec - sess_data->ts.tv_sec),
+                    (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+        else
+            ogs_trace("in %d.%06ld sec",
+                    (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
+                    (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec)
+                    / 1000);
+
+        ogs_debug("    CC-Request-Type%d Number%d in Session Data",
+            sess_data->cc_request_type, sess_data->cc_request_number);
+        ogs_debug("    Current CC-Request-Number%d", cc_request_number);
+
+        /* Determine if session cleanup is needed */
+        if (sess_data->cc_request_type ==
+                OGS_DIAM_GX_CC_REQUEST_TYPE_TERMINATION_REQUEST &&
+            sess_data->cc_request_number <= cc_request_number) {
+            ogs_debug("    LAST state_cleanup(): %s", sess_data->gx_sid);
+            cleanup_needed = 1;
+        }
+    }
 
-    ogs_debug("    CC-Request-Type%d Number%d in Session Data",
-        sess_data->cc_request_type, sess_data->cc_request_number);
-    ogs_debug("    Current CC-Request-Number%d", cc_request_number);
-    if (sess_data->cc_request_type ==
-            OGS_DIAM_GX_CC_REQUEST_TYPE_TERMINATION_REQUEST &&
-        sess_data->cc_request_number <= cc_request_number) {
-        ogs_debug("    LAST state_cleanup(): %s", sess_data->gx_sid);
-        state_cleanup(sess_data, NULL, NULL);
-    } else {
-        ogs_debug("    fd_sess_state_store(): %s", sess_data->gx_sid);
-        ret = fd_sess_state_store(smf_gx_reg, session, &sess_data);
-        ogs_assert(ret == 0);
-        ogs_assert(sess_data == NULL);
+    /* Manage session state */
+    if (sess_data) {
+        if (cleanup_needed) {
+            state_cleanup(sess_data, NULL, NULL);
+        } else {
+            ogs_debug("    fd_sess_state_store(): %s", sess_data->gx_sid);
+            ret = fd_sess_state_store(smf_gx_reg, session, &sess_data);
+            ogs_assert(ret == 0);
+            ogs_assert(sess_data == NULL);
+        }
     }
 
-    ret = fd_msg_free(*msg);
-    ogs_assert(ret == 0);
-    *msg = NULL;
+    /* Free the message */
+    if (*msg) {
+        ret = fd_msg_free(*msg);
+        ogs_assert(ret == 0);
+        *msg = NULL;
+    }
 
     return;
 }
@@ -1194,6 +1271,7 @@
     ogs_assert(ret == 0);
     if (!sess_data) {
         ogs_error("No Session Data");
+        error = 1;
         goto out;
     }
 
@@ -1201,6 +1279,7 @@
     sess = smf_sess_find_by_id(sess_data->sess_id);
     if (!sess) {
         ogs_error("No Session ID %d", sess_data->sess_id);
+        error = 1;
         goto out;
     }
 
@@ -1267,6 +1346,9 @@
                         }
                     } else {
                         ogs_error("Overflow: Number of PCCRule");
+                        error = 1;
+                        result_code = OGS_DIAM_GX_DIAMETER_PCC_RULE_EVENT;
+                        goto out;
                     }
                     break;
                 default:
@@ -1290,14 +1372,26 @@
                             &gx_message->session_data.pcc_rule
                                 gx_message->session_data.num_of_pcc_rule;
 
-                        pcc_rule->name = ogs_strdup(
-                                (char*)hdr->avp_value->os.data);
-                        ogs_assert(pcc_rule->name);
+                        /* Initialize the rule before setting name */
+                        memset(pcc_rule, 0, sizeof(*pcc_rule));
+
+                        pcc_rule->name = ogs_strndup(
+                                (char*)hdr->avp_value->os.data,
+                                hdr->avp_value->os.len);
+                        if (!pcc_rule->name) {
+                            ogs_error("Failed to allocate PCC rule name");
+                            error = 1;
+                            result_code = OGS_DIAM_GX_DIAMETER_PCC_RULE_EVENT;
+                            goto out;
+                        }
 
                         pcc_rule->type = OGS_PCC_RULE_TYPE_REMOVE;
                         gx_message->session_data.num_of_pcc_rule++;
                     } else {
                         ogs_error("Overflow: Number of PCCRule");
+                        error = 1;
+                        result_code = OGS_DIAM_GX_DIAMETER_PCC_RULE_EVENT;
+                        goto out;
                     }
                     break;
                 default:
@@ -1314,20 +1408,27 @@
         fd_msg_browse(avp, MSG_BRW_NEXT, &avp, NULL);
     }
 
-    /* Send Gx Event to SMF State Machine */
-    e = smf_event_new(SMF_EVT_GX_MESSAGE);
-    ogs_assert(e);
-
-    e->sess_id = sess->id;
-    e->gx_message = gx_message;
-    rv = ogs_queue_push(ogs_app()->queue, e);
-    if (rv != OGS_OK) {
-        ogs_error("ogs_queue_push() failed:%d", (int)rv);
-        OGS_SESSION_DATA_FREE(&gx_message->session_data);
-        ogs_free(gx_message);
-        ogs_event_free(e);
-    } else {
-        ogs_pollset_notify(ogs_app()->pollset);
+    /* Send Gx Event to SMF State Machine only if no error occurred */
+    if (!error) {
+        e = smf_event_new(SMF_EVT_GX_MESSAGE);
+        ogs_assert(e);
+
+        e->sess_id = sess->id;
+        e->gx_message = gx_message;
+        rv = ogs_queue_push(ogs_app()->queue, e);
+        if (rv != OGS_OK) {
+            ogs_error("ogs_queue_push() failed:%d", (int)rv);
+            OGS_SESSION_DATA_FREE(&gx_message->session_data);
+            ogs_free(gx_message);
+            ogs_event_free(e);
+            error = 1;
+            result_code = OGS_DIAM_UNABLE_TO_DELIVER;
+            goto out;
+        } else {
+            ogs_pollset_notify(ogs_app()->pollset);
+            /* gx_message ownership transferred to event queue */
+            gx_message = NULL;
+        }
     }
 
     /* Set the Auth-Application-Id AVP */
@@ -1339,7 +1440,7 @@
     ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
     ogs_assert(ret == 0);
 
-    /* Set the Origin-Host, Origin-Realm, andResult-Code AVPs */
+    /* Set the Origin-Host, Origin-Realm, and Result-Code AVPs */
     ret = fd_msg_rescode_set(ans, (char *)"DIAMETER_SUCCESS", NULL, NULL, 1);
     ogs_assert(ret == 0);
 
@@ -1362,6 +1463,12 @@
     return 0;
 
 out:
+    /* Clean up gx_message if it still exists */
+    if (gx_message) {
+        OGS_SESSION_DATA_FREE(&gx_message->session_data);
+        ogs_free(gx_message);
+    }
+
     if (result_code == OGS_DIAM_UNKNOWN_SESSION_ID) {
         ret = fd_msg_rescode_set(ans,
                     (char *)"DIAMETER_UNKNOWN_SESSION_ID", NULL, NULL, 1);
@@ -1372,15 +1479,14 @@
     }
 
     /* Store this value in the session */
-    ret = fd_sess_state_store(smf_gx_reg, session, &sess_data);
-    ogs_assert(sess_data == NULL);
+    if (sess_data) {
+        ret = fd_sess_state_store(smf_gx_reg, session, &sess_data);
+        ogs_assert(sess_data == NULL);
+    }
 
     ret = fd_msg_send(msg, NULL, NULL);
     ogs_assert(ret == 0);
 
-    OGS_SESSION_DATA_FREE(&gx_message->session_data);
-    ogs_free(gx_message);
-
     return 0;
 }

open5gs_2.7.6.tar.xz/src/smf/gy-path.c -> open5gs_2.7.7.tar.xz/src/smf/gy-path.c Changed

@@ -1,6 +1,7 @@
 /* Gy Interface, 3GPP TS 32.299
  * Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
  * Copyright (C) 2022 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * Copyright (C) 2025-2026 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -672,7 +673,17 @@
         size_t sidlen = strlen(sess->gy_sid);
         ret = fd_sess_fromsid_msg((os0_t)sess->gy_sid, sidlen, &session, &new);
         ogs_assert(ret == 0);
-        ogs_assert(new == 0);
+        if (new) {
+            ogs_error("Gy Session %s missing in Diameter stack. "
+                    "Releasing PDU Session to recover.", sess->gy_sid);
+            ret = fd_msg_free(req);
+            ogs_assert(ret == 0);
+
+            ogs_free(sess->gy_sid);
+            sess->gy_sid = NULL;
+
+            return;
+        }
 
         ogs_debug("    Found Gy Session-Id: %s", sess->gy_sid);
         /* Add Session-Id to the message */
@@ -995,7 +1006,10 @@
     /* Search the session, retrieve its data */
     ret = fd_msg_sess_get(fd_g_config->cnf_dict, *msg, &session, &new);
     ogs_assert(ret == 0);
-    ogs_assert(new == 0);
+    if (new != 0) {
+        ogs_error("Session should already exist, but new session flag is set");
+        goto cleanup;
+    }
 
     ogs_debug("    Search the Gy session");
 
@@ -1003,25 +1017,38 @@
     ogs_assert(ret == 0);
     if (!sess_data) {
         ogs_error("No Session Data");
-        return;
+        goto cleanup;
     }
     ogs_assert((void *)sess_data == data);
 
     ogs_debug("    Retrieve its data: %s", sess_data->gy_sid);
 
+    /* Allocate gy_message early to ensure proper cleanup */
+    gy_message = ogs_calloc(1, sizeof(ogs_diam_gy_message_t));
+    if (!gy_message) {
+        ogs_error("Failed to allocate gy_message");
+        error++;
+        goto cleanup;
+    }
+
+    /* Set Credit Control Command */
+    gy_message->cmd_code = OGS_DIAM_GY_CMD_CODE_CREDIT_CONTROL;
+
+    /* Initialize some values */
+    gy_message->cca.result_code = ER_DIAMETER_SUCCESS;
+
     /* Value of CC-Request-Number */
     ret = fd_msg_search_avp(*msg, ogs_diam_gy_cc_request_number, &avp);
     ogs_assert(ret == 0);
     if (!avp && req) {
-        /* Attempt searching for CC-Request-* in original request. Error
-         * messages (like DIAMETER_UNABLE_TO_DELIVER) crafted internally may not
-         * have them. */
+        /* Attempt searching for CC-Request-* in original request */
         ret = fd_msg_search_avp(req, ogs_diam_gy_cc_request_number, &avp);
         ogs_assert(ret == 0);
     }
     if (!avp) {
         ogs_error("no_CC-Request-Number");
-        ogs_assert_if_reached();
+        error++;
+        goto cleanup;
     }
     ret = fd_msg_avp_hdr(avp, &hdr);
     ogs_assert(ret == 0);
@@ -1030,18 +1057,19 @@
 
     ogs_debug("    CC-Request-Number%d", cc_request_number);
 
-    ogs_assert(sess_data->xact_datareq_slot.cc_req_no == cc_request_number);
-    sess = smf_sess_find_by_id(sess_data->sess_id);
-    ogs_assert(sess);
-
-    gy_message = ogs_calloc(1, sizeof(ogs_diam_gy_message_t));
-    ogs_assert(gy_message);
-
-    /* Set Credit Control Command */
-    gy_message->cmd_code = OGS_DIAM_GY_CMD_CODE_CREDIT_CONTROL;
+    if (sess_data->xact_datareq_slot.cc_req_no != cc_request_number) {
+        ogs_error("CC-Request-Number mismatch: expected %d, got %d",
+                  sess_data->xact_datareq_slot.cc_req_no, cc_request_number);
+        error++;
+        goto cleanup;
+    }
 
-    /* Initialize some values: */
-    gy_message->cca.result_code = ER_DIAMETER_SUCCESS;
+    sess = smf_sess_find_by_id(sess_data->sess_id);
+    if (!sess) {
+        ogs_error("Session not found: %d", sess_data->sess_id);
+        error++;
+        goto cleanup;
+    }
 
     /* Value of Result Code */
     ret = fd_msg_search_avp(*msg, ogs_diam_result_code, &avp);
@@ -1070,6 +1098,7 @@
         } else {
             ogs_error("no Result-Code");
             error++;
+            goto cleanup;
         }
     }
 
@@ -1084,6 +1113,7 @@
     } else {
         ogs_error("no_Origin-Host");
         error++;
+        goto cleanup;
     }
 
     /* Value of Origin-Realm */
@@ -1097,21 +1127,21 @@
     } else {
         ogs_error("no_Origin-Realm");
         error++;
+        goto cleanup;
     }
 
     /* Value of CC-Request-Type */
     ret = fd_msg_search_avp(*msg, ogs_diam_gy_cc_request_type, &avp);
     ogs_assert(ret == 0);
     if (!avp && req) {
-        /* Attempt searching for CC-Request-* in original request. Error
-         * messages (like DIAMETER_UNABLE_TO_DELIVER) crafted internally may not
-         * have them. */
+        /* Attempt searching for CC-Request-* in original request */
         ret = fd_msg_search_avp(req, ogs_diam_gy_cc_request_type, &avp);
         ogs_assert(ret == 0);
     }
     if (!avp) {
-        ogs_error("no_CC-Request-Number");
+        ogs_error("no_CC-Request-Type");
         error++;
+        goto cleanup;
     }
     ret = fd_msg_avp_hdr(avp, &hdr);
     ogs_assert(ret == 0);
@@ -1119,9 +1149,10 @@
 
     if (gy_message->result_code != ER_DIAMETER_SUCCESS) {
         ogs_warn("ERROR DIAMETER Result Code(%d)", gy_message->result_code);
-        goto out;
+        /* Continue processing even with error result code */
     }
 
+    /* Parse message AVPs */
     ret = fd_msg_browse(*msg, MSG_BRW_FIRST_CHILD, &avp, NULL);
     ogs_assert(ret == 0);
     while (avp) {
@@ -1134,7 +1165,11 @@
                 ogs_free(sess_data->peer_host);
             sess_data->peer_host =
                 (os0_t)ogs_strdup((char *)hdr->avp_value->os.data);
-            ogs_assert(sess_data->peer_host);
+            if (!sess_data->peer_host) {
+                ogs_error("Failed to allocate peer_host");
+                error++;
+                goto cleanup;
+            }
             break;
         case AC_ORIGIN_REALM:
         case AC_DESTINATION_REALM:
@@ -1161,8 +1196,10 @@
                 case OGS_DIAM_GY_AVP_CODE_GRANTED_SERVICE_UNIT:
                     rv = decode_granted_service_unit(
                             &gy_message->cca.granted, avpch1, &error);
-                    ogs_assert(rv == OGS_OK);
-                    /*TODO: apply gsu */
+                    if (rv != OGS_OK) {
+                        ogs_error("Failed to decode granted service unit");
+                        goto cleanup;
+                    }
                     break;
                 case OGS_DIAM_GY_AVP_CODE_VALIDITY_TIME:
                     gy_message->cca.validity_time = hdr->avp_value->u32;
@@ -1176,7 +1213,10 @@
                 case OGS_DIAM_GY_AVP_CODE_FINAL_UNIT_INDICATION:
                     rv = decode_final_unit_indication(
                             &gy_message->cca.final, avpch1, &error);
-                    ogs_assert(rv == OGS_OK);
+                    if (rv != OGS_OK) {
+                        ogs_error("Failed to decode final unit indication");
+                        goto cleanup;
+                    }
                     break;
                 default:
                     ogs_warn("Not supported(%d)", hdr->avp_code);
@@ -1192,10 +1232,14 @@
         fd_msg_browse(avp, MSG_BRW_NEXT, &avp, NULL);
     }
 
-out:
+    /* Send event to SMF if no errors */
     if (!error) {
         e = smf_event_new(SMF_EVT_GY_MESSAGE);
-        ogs_assert(e);
+        if (!e) {
+            ogs_error("Failed to create SMF event");
+            error++;
+            goto cleanup;
+        }
 
         e->sess_id = sess->id;
         e->gy_message = gy_message;
@@ -1207,34 +1251,45 @@
         rv = ogs_queue_push(ogs_app()->queue, e);
         if (rv != OGS_OK) {
             ogs_error("ogs_queue_push() failed:%d", (int)rv);
-            ogs_free(gy_message);
             ogs_event_free(e);
+            error++;
+            goto cleanup;
         } else {
             ogs_pollset_notify(ogs_app()->pollset);
+            /* Transfer ownership of gy_message to event */
+            gy_message = NULL;
         }
-    } else {
+    }
+
+cleanup:
+    /* Free gy_message if it wasn't transferred to event */
+    if (gy_message) {
         ogs_free(gy_message);
     }
 
-    /* Free the message */
+    /* Update statistics */
     ogs_assert(pthread_mutex_lock(&ogs_diam_stats_self()->stats_lock) == 0);
-    dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
-        ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-    if (ogs_diam_stats_self()->stats.nb_recv) {
-        /* Ponderate in the avg */
-        ogs_diam_stats_self()->stats.avg = (ogs_diam_stats_self()->stats.avg *
-            ogs_diam_stats_self()->stats.nb_recv + dur) /
-            (ogs_diam_stats_self()->stats.nb_recv + 1);
-        /* Min, max */
-        if (dur < ogs_diam_stats_self()->stats.shortest)
+    if (sess_data) {
+        dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
+            ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+        if (ogs_diam_stats_self()->stats.nb_recv) {
+            /* Ponderate in the avg */
+            ogs_diam_stats_self()->stats.avg =
+                (ogs_diam_stats_self()->stats.avg *
+                 ogs_diam_stats_self()->stats.nb_recv + dur) /
+                (ogs_diam_stats_self()->stats.nb_recv + 1);
+            /* Min, max */
+            if (dur < ogs_diam_stats_self()->stats.shortest)
+                ogs_diam_stats_self()->stats.shortest = dur;
+            if (dur > ogs_diam_stats_self()->stats.longest)
+                ogs_diam_stats_self()->stats.longest = dur;
+        } else {
             ogs_diam_stats_self()->stats.shortest = dur;
-        if (dur > ogs_diam_stats_self()->stats.longest)
             ogs_diam_stats_self()->stats.longest = dur;
-    } else {
-        ogs_diam_stats_self()->stats.shortest = dur;
-        ogs_diam_stats_self()->stats.longest = dur;
-        ogs_diam_stats_self()->stats.avg = dur;
+            ogs_diam_stats_self()->stats.avg = dur;
+        }
     }
+
     if (error)
         ogs_diam_stats_self()->stats.nb_errs++;
     else
@@ -1242,36 +1297,40 @@
 
     ogs_assert(pthread_mutex_unlock(&ogs_diam_stats_self()->stats_lock) == 0);
 
-    /* Display how long it took */
-    if (ts.tv_nsec > sess_data->ts.tv_nsec)
-        ogs_trace("in %d.%06ld sec",
-                (int)(ts.tv_sec - sess_data->ts.tv_sec),
-                (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-    else
-        ogs_trace("in %d.%06ld sec",
-                (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
-                (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-
-    ogs_debug("    CC-Request-Type%d Number%d in Session Data",
-        sess_data->cc_request_type, sess_data->cc_request_number);
-    ogs_debug("    Current CC-Request-Number%d", cc_request_number);
-    if (sess_data->cc_request_type ==
-            OGS_DIAM_GY_CC_REQUEST_TYPE_TERMINATION_REQUEST &&
-        sess_data->cc_request_number <= cc_request_number) {
-        ogs_debug("    LAST state_cleanup(): %s", sess_data->gy_sid);
-        state_cleanup(sess_data, NULL, NULL);
-    } else {
-        ogs_debug("    fd_sess_state_store(): %s", sess_data->gy_sid);
-        ret = fd_sess_state_store(smf_gy_reg, session, &sess_data);
-        ogs_assert(ret == 0);
-        ogs_assert(sess_data == NULL);
+    /* Display timing information */
+    if (sess_data) {
+        if (ts.tv_nsec > sess_data->ts.tv_nsec)
+            ogs_trace("in %d.%06ld sec",
+                    (int)(ts.tv_sec - sess_data->ts.tv_sec),
+                    (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+        else
+            ogs_trace("in %d.%06ld sec",
+                    (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
+                    (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec)
+                    / 1000);
+
+        ogs_debug("    CC-Request-Type%d Number%d in Session Data",
+            sess_data->cc_request_type, sess_data->cc_request_number);
+        ogs_debug("    Current CC-Request-Number%d", cc_request_number);
+
+        /* Clean up session if termination request */
+        if (sess_data->cc_request_type ==
+                OGS_DIAM_GY_CC_REQUEST_TYPE_TERMINATION_REQUEST &&
+            sess_data->cc_request_number <= cc_request_number) {
+            ogs_debug("    LAST state_cleanup(): %s", sess_data->gy_sid);
+            state_cleanup(sess_data, NULL, NULL);
+        } else {
+            ogs_debug("    fd_sess_state_store(): %s", sess_data->gy_sid);
+            ret = fd_sess_state_store(smf_gy_reg, session, &sess_data);
+            ogs_assert(ret == 0);
+            ogs_assert(sess_data == NULL);
+        }
     }
 
+    /* Free the message */
     ret = fd_msg_free(*msg);
     ogs_assert(ret == 0);
     *msg = NULL;
-
-    return;
 }
 
 static int smf_gy_fb_cb(struct msg **msg, struct avp *avp,
@@ -1283,7 +1342,7 @@
     return ENOTSUP;
 }
 
-static int smf_gy_rar_cb( struct msg **msg, struct avp *avp,
+static int smf_gy_rar_cb(struct msg **msg, struct avp *avp,
         struct session *session, void *opaque, enum disp_action *act)
 {
     int rv;
@@ -1292,68 +1351,92 @@
     struct msg *ans;
     union avp_value val;
     struct sess_state *sess_data = NULL;
-
     smf_event_t *e = NULL;
     smf_sess_t *sess = NULL;
     ogs_diam_gy_message_t *gy_message = NULL;
-
     uint32_t result_code = OGS_DIAM_UNKNOWN_SESSION_ID;
 
     ogs_assert(msg);
 
     ogs_debug("Re-Auth-Request");
 
-    gy_message = ogs_calloc(1, sizeof(ogs_diam_gy_message_t));
-    ogs_assert(gy_message);
-
-    /* Set Credit Control Command */
-    gy_message->cmd_code = OGS_DIAM_GY_CMD_RE_AUTH;
-
     /* Create answer header */
     ret = fd_msg_new_answer_from_req(fd_g_config->cnf_dict, msg, 0);
     ogs_assert(ret == 0);
     ans = *msg;
 
+    /* Allocate gy_message early for proper cleanup */
+    gy_message = ogs_calloc(1, sizeof(ogs_diam_gy_message_t));
+    if (!gy_message) {
+        ogs_error("Failed to allocate gy_message");
+        result_code = OGS_DIAM_OUT_OF_SPACE;
+        goto error_out;
+    }
+
+    /* Set Credit Control Command */
+    gy_message->cmd_code = OGS_DIAM_GY_CMD_RE_AUTH;
+
+    /* Retrieve session state */
     ret = fd_sess_state_retrieve(smf_gy_reg, session, &sess_data);
     ogs_assert(ret == 0);
     if (!sess_data) {
         ogs_error("No Session Data");
-        goto out;
+        result_code = OGS_DIAM_UNKNOWN_SESSION_ID;
+        goto error_out;
     }
 
     /* Get Session Information */
     sess = smf_sess_find_by_id(sess_data->sess_id);
-    ogs_assert(sess);
+    if (!sess) {
+        ogs_error("Session not found: %d", sess_data->sess_id);
+        result_code = OGS_DIAM_UNKNOWN_SESSION_ID;
+        goto error_out;
+    }
 
     /* TODO: parsing of msg into gy_message */
 
     /* Send Gy Event to SMF State Machine */
     e = smf_event_new(SMF_EVT_GY_MESSAGE);
-    ogs_assert(e);
+    if (!e) {
+        ogs_error("Failed to create SMF event");
+        result_code = OGS_DIAM_OUT_OF_SPACE;
+        goto error_out;
+    }
 
     e->sess_id = sess->id;
     e->gy_message = gy_message;
     rv = ogs_queue_push(ogs_app()->queue, e);
     if (rv != OGS_OK) {
         ogs_error("ogs_queue_push() failed:%d", (int)rv);
-        ogs_free(gy_message);
         ogs_event_free(e);
+        result_code = OGS_DIAM_OUT_OF_SPACE;
+        goto error_out;
     } else {
         ogs_pollset_notify(ogs_app()->pollset);
+        /* Transfer ownership of gy_message to event */
+        gy_message = NULL;
     }
 
     /* Set the Auth-Application-Id AVP */
     ret = fd_msg_avp_new(ogs_diam_auth_application_id, 0, &avp);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to create Auth-Application-Id AVP");
+        result_code = OGS_DIAM_OUT_OF_SPACE;
+        goto error_out;
+    }
     val.i32 = OGS_DIAM_GY_APPLICATION_ID;
     ret = fd_msg_avp_setvalue(avp, &val);
     ogs_assert(ret == 0);
     ret = fd_msg_avp_add(ans, MSG_BRW_LAST_CHILD, avp);
     ogs_assert(ret == 0);
 
-    /* Set the Origin-Host, Origin-Realm, andResult-Code AVPs */
+    /* Set the Origin-Host, Origin-Realm, and Result-Code AVPs */
     ret = fd_msg_rescode_set(ans, (char *)"DIAMETER_SUCCESS", NULL, NULL, 1);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to set result code");
+        result_code = OGS_DIAM_OUT_OF_SPACE;
+        goto error_out;
+    }
 
     /* Store this value in the session */
     ret = fd_sess_state_store(smf_gy_reg, session, &sess_data);
@@ -1362,7 +1445,11 @@
 
     /* Send the answer */
     ret = fd_msg_send(msg, NULL, NULL);
-    ogs_assert(ret == 0);
+    if (ret != 0) {
+        ogs_error("Failed to send answer message");
+        /* Message is already freed by fd_msg_send on error */
+        return ret;
+    }
 
     ogs_debug("Re-Auth-Answer");
 
@@ -1373,7 +1460,13 @@
 
     return 0;
 
-out:
+error_out:
+    /* Free gy_message if it wasn't transferred to event */
+    if (gy_message) {
+        ogs_free(gy_message);
+    }
+
+    /* Set appropriate error result code */
     if (result_code == OGS_DIAM_UNKNOWN_SESSION_ID) {
         ret = fd_msg_rescode_set(ans,
                     (char *)"DIAMETER_UNKNOWN_SESSION_ID", NULL, NULL, 1);
@@ -1383,15 +1476,14 @@
         ogs_assert(ret == 0);
     }
 
-    /* Store this value in the session */
+    /* Store session state (may be NULL) */
     ret = fd_sess_state_store(smf_gy_reg, session, &sess_data);
     ogs_assert(sess_data == NULL);
 
+    /* Send error response */
     ret = fd_msg_send(msg, NULL, NULL);
     ogs_assert(ret == 0);
 
-    ogs_free(gy_message);
-
     return 0;
 }

open5gs_2.7.6.tar.xz/src/smf/init.c -> open5gs_2.7.7.tar.xz/src/smf/init.c Changed

open5gs_2.7.7.tar.xz/src/smf/local-path.c Added

@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2019,2020 by Sukchan Lee <acetcom@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include "local-path.h"
+
+void smf_trigger_session_release(smf_sess_t *sess,
+    ogs_sbi_stream_t *stream, int pfcp_trigger)
+{
+    int rv;
+    smf_event_t *e;
+    ogs_pool_id_t sid;
+
+    /* Ensure session is valid */
+    ogs_assert(sess);
+
+    /* Create a session release event */
+    e = smf_event_new(SMF_EVT_SESSION_RELEASE);
+    ogs_assert(e);
+
+    /* Assign session ID */
+    e->sess_id = sess->id;
+
+    /* Store the PFCP trigger in the SBI state field */
+    e->h.sbi.state = pfcp_trigger;
+
+    /* Attach SBI stream ID if provided */
+    if (stream) {
+        sid = ogs_sbi_id_from_stream(stream);
+        ogs_assert(sid >= OGS_MIN_POOL_ID &&
+                   sid <= OGS_MAX_POOL_ID);
+        e->h.sbi.data = OGS_UINT_TO_POINTER(sid);
+    }
+
+    /* Push event to the application queue */
+    rv = ogs_queue_push(ogs_app()->queue, e);
+    if (rv != OGS_OK) {
+        ogs_error("ogs_queue_push failed:%d", rv);
+        ogs_event_free(e);
+    }
+}

open5gs_2.7.7.tar.xz/src/smf/local-path.h Added

@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2025 by Sukchan Lee <acetcom@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#ifndef SMF_LOCAL_PATH_H
+#define SMF_LOCAL_PATH_H
+
+#include "context.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void smf_trigger_session_release(smf_sess_t *sess,
+    ogs_sbi_stream_t *stream, int pfcp_trigger);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* SMF_LOCAL_PATH_H */

open5gs_2.7.6.tar.xz/src/smf/meson.build -> open5gs_2.7.7.tar.xz/src/smf/meson.build Changed

open5gs_2.7.6.tar.xz/src/smf/n4-build.c -> open5gs_2.7.7.tar.xz/src/smf/n4-build.c Changed

@@ -115,8 +115,10 @@
     }
 
     /* PDN Type */
-    req->pdn_type.presence = 1;
-    req->pdn_type.u8 = sess->session.session_type;
+    if (sess->session.session_type) {
+        req->pdn_type.presence = 1;
+        req->pdn_type.u8 = sess->session.session_type;
+    }
 
     /* User ID */
     memset(&user_id, 0, sizeof(ogs_pfcp_user_id_t));
@@ -183,7 +185,6 @@
 {
     ogs_pfcp_pdr_t *pdr = NULL;
     ogs_pfcp_urr_t *urr = NULL;
-    int i;
 
     ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_session_modification_request_t *req = NULL;
@@ -193,7 +194,10 @@
     int num_of_remove_far = 0;
     int num_of_create_pdr = 0;
     int num_of_create_far = 0;
+    int num_of_update_pdr = 0;
     int num_of_update_far = 0;
+    int num_of_update_qer = 0;
+    int num_of_update_urr = 0;
 
     uint64_t modify_flags = 0;
 
@@ -264,6 +268,13 @@
                         num_of_create_far, far);
 
                 num_of_create_far++;
+            }
+
+            if (modify_flags & OGS_PFCP_MODIFY_DEACTIVATE) {
+                ogs_pfcp_build_update_far_deactivate(
+                        &req->update_farnum_of_update_far,
+                        num_of_update_far, far);
+                num_of_update_far++;
             } else if (modify_flags & OGS_PFCP_MODIFY_ACTIVATE) {
                 if (far->apply_action & OGS_PFCP_APPLY_ACTION_FORW) {
 
@@ -280,26 +291,52 @@
 
                     num_of_update_far++;
                 }
-            } else if (modify_flags & OGS_PFCP_MODIFY_DEACTIVATE) {
-                ogs_pfcp_build_update_far_deactivate(
-                        &req->update_farnum_of_update_far,
-                        num_of_update_far, far);
-                num_of_update_far++;
-            } else if (modify_flags == 0) {
-                ogs_fatal("Invalid modify_flags = %lld",
-                        (long long)modify_flags);
-                ogs_assert_if_reached();
             }
-        }
 
+            if (modify_flags &
+                    (OGS_PFCP_MODIFY_TFT_NEW|OGS_PFCP_MODIFY_TFT_ADD|
+                     OGS_PFCP_MODIFY_TFT_REPLACE|OGS_PFCP_MODIFY_TFT_DELETE|
+                     OGS_PFCP_MODIFY_EPC_TFT_UPDATE|
+                     OGS_PFCP_MODIFY_OUTER_HEADER_REMOVAL)) {
+                /* Update PDR */
+                ogs_pfcp_build_update_pdr(
+                        &req->update_pdrnum_of_update_pdr,
+                        num_of_update_pdr, pdr, modify_flags);
+                num_of_update_pdr++;
+            }
+            if (modify_flags &
+                    (OGS_PFCP_MODIFY_QOS_MODIFY|
+                     OGS_PFCP_MODIFY_EPC_QOS_UPDATE)) {
+                /* Update QER */
+                if (pdr->qer) {
+                    ogs_pfcp_build_update_qer(
+                            &req->update_qernum_of_update_qer,
+                            num_of_update_qer, pdr->qer, modify_flags);
+                    num_of_update_qer++;
+                }
+            }
+        }
     }
 
-    /* Update URR */
-    i = 0;
-    ogs_list_for_each(&sess->pfcp.urr_list, urr) {
-        ogs_pfcp_build_update_urr(&req->update_urri, i, urr, modify_flags);
-        i++;
+    if (modify_flags &
+            (OGS_PFCP_MODIFY_URR_MEAS_METHOD|
+             OGS_PFCP_MODIFY_URR_REPORT_TRIGGER|
+             OGS_PFCP_MODIFY_URR_VOLUME_THRESH|
+             OGS_PFCP_MODIFY_URR_VOLUME_QUOTA|
+             OGS_PFCP_MODIFY_URR_TIME_THRESH|
+             OGS_PFCP_MODIFY_URR_TIME_QUOTA|
+             OGS_PFCP_MODIFY_URR_QUOTA_VALIDITY_TIME)) {
+        /* Update URR */
+        ogs_list_for_each(&sess->pfcp.urr_list, urr) {
+            ogs_pfcp_build_update_urr(
+                    &req->update_urrnum_of_update_urr,
+                    num_of_update_urr, urr, modify_flags);
+            num_of_update_urr++;
+        }
     }
+    ogs_assert(num_of_remove_pdr + num_of_remove_far + num_of_create_pdr +
+            num_of_create_far + num_of_update_pdr + num_of_update_far +
+            num_of_update_qer + num_of_update_urr);
 
     pfcp_message->h.type = type;
     pkbuf = ogs_pfcp_build_msg(pfcp_message);
@@ -357,7 +394,8 @@
             (OGS_PFCP_MODIFY_CREATE|
              OGS_PFCP_MODIFY_TFT_NEW|OGS_PFCP_MODIFY_TFT_ADD|
              OGS_PFCP_MODIFY_TFT_REPLACE|OGS_PFCP_MODIFY_TFT_DELETE|
-             OGS_PFCP_MODIFY_EPC_TFT_UPDATE)) {
+             OGS_PFCP_MODIFY_EPC_TFT_UPDATE|
+             OGS_PFCP_MODIFY_OUTER_HEADER_REMOVAL)) {
         ogs_pfcp_pdrbuf_init();
     }
 
@@ -366,7 +404,8 @@
 
         if (modify_flags & OGS_PFCP_MODIFY_REMOVE) {
             /* Remove PDR */
-            if (qos_flow->dl_pdr) {
+            if ((modify_flags & OGS_PFCP_MODIFY_UL_ONLY) == 0 &&
+                qos_flow->dl_pdr) {
                 ogs_pfcp_tlv_remove_pdr_t *message =
                     &req->remove_pdrnum_of_remove_pdr;
 
@@ -375,7 +414,8 @@
                 message->pdr_id.u16 = qos_flow->dl_pdr->id;
                 num_of_remove_pdr++;
             }
-            if (qos_flow->ul_pdr) {
+            if ((modify_flags & OGS_PFCP_MODIFY_DL_ONLY) == 0 &&
+                qos_flow->ul_pdr) {
                 ogs_pfcp_tlv_remove_pdr_t *message =
                     &req->remove_pdrnum_of_remove_pdr;
 
@@ -386,7 +426,8 @@
             }
 
             /* Remove FAR */
-            if (qos_flow->dl_far) {
+            if ((modify_flags & OGS_PFCP_MODIFY_UL_ONLY) == 0 &&
+                qos_flow->dl_far) {
                 ogs_pfcp_tlv_remove_far_t *message =
                     &req->remove_farnum_of_remove_far;
 
@@ -395,7 +436,8 @@
                 message->far_id.u32 = qos_flow->dl_far->id;
                 num_of_remove_far++;
             }
-            if (qos_flow->ul_far) {
+            if ((modify_flags & OGS_PFCP_MODIFY_DL_ONLY) == 0 &&
+                qos_flow->ul_far) {
                 ogs_pfcp_tlv_remove_far_t *message =
                     &req->remove_farnum_of_remove_far;
 
@@ -427,126 +469,173 @@
                 num_of_remove_urr++;
             }
 
-        } else {
-            if (modify_flags & OGS_PFCP_MODIFY_CREATE) {
-
-                /* Create PDR */
-                if (qos_flow->dl_pdr) {
-                    ogs_pfcp_build_create_pdr(
-                            &req->create_pdrnum_of_create_pdr,
-                            num_of_create_pdr, qos_flow->dl_pdr);
-                    num_of_create_pdr++;
+        } else if (modify_flags & OGS_PFCP_MODIFY_CREATE) {
+            /* Create PDR */
+            if ((modify_flags & OGS_PFCP_MODIFY_UL_ONLY) == 0 &&
+                qos_flow->dl_pdr) {
+                ogs_pfcp_build_create_pdr(
+                        &req->create_pdrnum_of_create_pdr,
+                        num_of_create_pdr, qos_flow->dl_pdr);
+                num_of_create_pdr++;
 
-                    ogs_list_add(&xact->pdr_to_create_list,
-                                    &qos_flow->dl_pdr->to_create_node);
-                }
-                if (qos_flow->ul_pdr) {
-                    ogs_pfcp_build_create_pdr(
-                            &req->create_pdrnum_of_create_pdr,
-                            num_of_create_pdr, qos_flow->ul_pdr);
-                    num_of_create_pdr++;
+                ogs_list_add(&xact->pdr_to_create_list,
+                                &qos_flow->dl_pdr->to_create_node);
+            }
+            if ((modify_flags & OGS_PFCP_MODIFY_DL_ONLY) == 0 &&
+                qos_flow->ul_pdr) {
+                ogs_pfcp_build_create_pdr(
+                        &req->create_pdrnum_of_create_pdr,
+                        num_of_create_pdr, qos_flow->ul_pdr);
+                num_of_create_pdr++;
 
-                    ogs_list_add(&xact->pdr_to_create_list,
-                                    &qos_flow->ul_pdr->to_create_node);
-                }
+                ogs_list_add(&xact->pdr_to_create_list,
+                                &qos_flow->ul_pdr->to_create_node);
+            }
 
-                /* Create FAR */
-                if (qos_flow->dl_far) {
-                    ogs_pfcp_build_create_far(
-                            &req->create_farnum_of_create_far,
-                            num_of_create_far, qos_flow->dl_far);
-                    num_of_create_far++;
-                }
-                if (qos_flow->ul_far) {
-                    ogs_pfcp_build_create_far(
-                            &req->create_farnum_of_create_far,
-                            num_of_create_far, qos_flow->ul_far);
-                    num_of_create_far++;
-                }
+            /* Create FAR */
+            if ((modify_flags & OGS_PFCP_MODIFY_UL_ONLY) == 0 &&
+                qos_flow->dl_far) {
+                ogs_pfcp_build_create_far(
+                        &req->create_farnum_of_create_far,
+                        num_of_create_far, qos_flow->dl_far);
+                num_of_create_far++;
+            }
+            if ((modify_flags & OGS_PFCP_MODIFY_DL_ONLY) == 0 &&
+                qos_flow->ul_far) {
+                ogs_pfcp_build_create_far(
+                        &req->create_farnum_of_create_far,
+                        num_of_create_far, qos_flow->ul_far);
+                num_of_create_far++;
+            }
 
-                /* Create QER */
-                if (qos_flow->qer) {
-                    ogs_pfcp_build_create_qer(
-                            &req->create_qernum_of_create_qer,
-                            num_of_create_qer, qos_flow->qer);
-                    num_of_create_qer++;
-                }
+            /* Create QER */
+            if (qos_flow->qer) {
+                ogs_pfcp_build_create_qer(
+                        &req->create_qernum_of_create_qer,
+                        num_of_create_qer, qos_flow->qer);
+                num_of_create_qer++;
+            }
 
-                /* Create URR */
-                if (qos_flow->urr) {
-                    ogs_pfcp_build_create_urr(
-                            &req->create_urrnum_of_create_urr,
-                            num_of_create_urr, qos_flow->urr);
-                    num_of_create_urr++;
-                }
+            /* Create URR */
+            if (qos_flow->urr) {
+                ogs_pfcp_build_create_urr(
+                        &req->create_urrnum_of_create_urr,
+                        num_of_create_urr, qos_flow->urr);
+                num_of_create_urr++;
             }
-            if (modify_flags &
-                    (OGS_PFCP_MODIFY_TFT_NEW|OGS_PFCP_MODIFY_TFT_ADD|
-                     OGS_PFCP_MODIFY_TFT_REPLACE|OGS_PFCP_MODIFY_TFT_DELETE|
-                     OGS_PFCP_MODIFY_EPC_TFT_UPDATE)) {
+        }
 
-                /* Update PDR */
-                if (qos_flow->dl_pdr) {
-                    ogs_pfcp_build_update_pdr(
-                            &req->update_pdrnum_of_update_pdr,
-                            num_of_update_pdr, qos_flow->dl_pdr, modify_flags);
-                    num_of_update_pdr++;
-                }
-                if (qos_flow->ul_pdr) {
-                    ogs_pfcp_build_update_pdr(
-                            &req->update_pdrnum_of_update_pdr,
-                            num_of_update_pdr, qos_flow->ul_pdr, modify_flags);
-                    num_of_update_pdr++;
-                }
-                if (qos_flow->urr) {
-                    ogs_pfcp_build_update_urr(
-                            &req->update_urrnum_of_update_urr,
-                            num_of_update_urr, qos_flow->urr, modify_flags);
-                    num_of_update_urr++;
-                }
+        if (modify_flags & OGS_PFCP_MODIFY_DEACTIVATE) {
+            if ((modify_flags & OGS_PFCP_MODIFY_UL_ONLY) == 0 &&
+                qos_flow->dl_far) {
+                ogs_pfcp_build_update_far_deactivate(
+                        &req->update_farnum_of_update_far,
+                        num_of_update_far, qos_flow->dl_far);
+                num_of_update_far++;
+            }
+            if ((modify_flags & OGS_PFCP_MODIFY_DL_ONLY) == 0 &&
+                qos_flow->ul_far) {
+                ogs_pfcp_build_update_far_deactivate(
+                        &req->update_farnum_of_update_far,
+                        num_of_update_far, qos_flow->ul_far);
+                num_of_update_far++;
             }
-            if (modify_flags & OGS_PFCP_MODIFY_ACTIVATE) {
-                /* Update FAR - Only DL */
-                if (qos_flow->dl_far) {
-                    if (qos_flow->dl_far->apply_action &
-                            OGS_PFCP_APPLY_ACTION_FORW) {
-
-                        if (modify_flags & OGS_PFCP_MODIFY_END_MARKER) {
-                            qos_flow->dl_far->
-                                smreq_flags.send_end_marker_packets = 1;
-                        }
-
-                        ogs_pfcp_build_update_far_activate(
-                                &req->update_farnum_of_update_far,
-                                num_of_update_far, qos_flow->dl_far);
-                        num_of_update_far++;
+        } else if (modify_flags & OGS_PFCP_MODIFY_ACTIVATE) {
+            if ((modify_flags & OGS_PFCP_MODIFY_UL_ONLY) == 0 &&
+                qos_flow->dl_far) {
+                if (qos_flow->dl_far->apply_action &
+                        OGS_PFCP_APPLY_ACTION_FORW) {
 
-                        /* Clear all FAR flags */
-                        qos_flow->dl_far->smreq_flags.value = 0;
+                    if (modify_flags & OGS_PFCP_MODIFY_END_MARKER) {
+                        qos_flow->dl_far->
+                            smreq_flags.send_end_marker_packets = 1;
                     }
-                }
-            } else if (modify_flags & OGS_PFCP_MODIFY_DEACTIVATE) {
-                if (qos_flow->dl_far) {
-                    ogs_pfcp_build_update_far_deactivate(
+
+                    ogs_pfcp_build_update_far_activate(
                             &req->update_farnum_of_update_far,
                             num_of_update_far, qos_flow->dl_far);
                     num_of_update_far++;
+
+                    /* Clear all FAR flags */
+                    qos_flow->dl_far->smreq_flags.value = 0;
                 }
             }
-            if (modify_flags &
-                    (OGS_PFCP_MODIFY_QOS_MODIFY|
-                     OGS_PFCP_MODIFY_EPC_QOS_UPDATE)) {
-                /* Update QER */
-                if (qos_flow->qer) {
-                    ogs_pfcp_build_update_qer(
-                            &req->update_qernum_of_update_qer,
-                            num_of_update_qer, qos_flow->qer);
-                    num_of_update_qer++;
+            if ((modify_flags & OGS_PFCP_MODIFY_DL_ONLY) == 0 &&
+                qos_flow->ul_far) {
+                if (qos_flow->ul_far->apply_action &
+                        OGS_PFCP_APPLY_ACTION_FORW) {
+
+                    if (modify_flags & OGS_PFCP_MODIFY_END_MARKER) {
+                        qos_flow->ul_far->
+                            smreq_flags.send_end_marker_packets = 1;
+                    }
+
+                    ogs_pfcp_build_update_far_activate(
+                            &req->update_farnum_of_update_far,
+                            num_of_update_far, qos_flow->ul_far);
+                    num_of_update_far++;
+
+                    /* Clear all FAR flags */
+                    qos_flow->ul_far->smreq_flags.value = 0;
                 }
             }
         }
+
+        if (modify_flags &
+                (OGS_PFCP_MODIFY_TFT_NEW|OGS_PFCP_MODIFY_TFT_ADD|
+                 OGS_PFCP_MODIFY_TFT_REPLACE|OGS_PFCP_MODIFY_TFT_DELETE|
+                 OGS_PFCP_MODIFY_EPC_TFT_UPDATE|
+                 OGS_PFCP_MODIFY_OUTER_HEADER_REMOVAL)) {
+            /* Update PDR */
+            if ((modify_flags & OGS_PFCP_MODIFY_UL_ONLY) == 0 &&
+                qos_flow->dl_pdr) {
+                ogs_pfcp_build_update_pdr(
+                        &req->update_pdrnum_of_update_pdr,
+                        num_of_update_pdr, qos_flow->dl_pdr, modify_flags);
+                num_of_update_pdr++;
+            }
+            if ((modify_flags & OGS_PFCP_MODIFY_DL_ONLY) == 0 &&
+                qos_flow->ul_pdr) {
+                ogs_pfcp_build_update_pdr(
+                        &req->update_pdrnum_of_update_pdr,
+                        num_of_update_pdr, qos_flow->ul_pdr, modify_flags);
+                num_of_update_pdr++;
+            }
+        }
+        if (modify_flags &
+                (OGS_PFCP_MODIFY_QOS_MODIFY|
+                 OGS_PFCP_MODIFY_EPC_QOS_UPDATE)) {
+            /* Update QER */
+            if (qos_flow->qer) {
+                ogs_pfcp_build_update_qer(
+                        &req->update_qernum_of_update_qer,
+                        num_of_update_qer, qos_flow->qer, modify_flags);
+                num_of_update_qer++;
+            }
+        }
+        if (modify_flags &
+                (OGS_PFCP_MODIFY_URR_MEAS_METHOD|
+                 OGS_PFCP_MODIFY_URR_REPORT_TRIGGER|
+                 OGS_PFCP_MODIFY_URR_VOLUME_THRESH|
+                 OGS_PFCP_MODIFY_URR_VOLUME_QUOTA|
+                 OGS_PFCP_MODIFY_URR_TIME_THRESH|
+                 OGS_PFCP_MODIFY_URR_TIME_QUOTA|
+                 OGS_PFCP_MODIFY_URR_QUOTA_VALIDITY_TIME)) {
+            /* Update URR */
+            if (qos_flow->urr) {
+                ogs_pfcp_build_update_urr(
+                        &req->update_urrnum_of_update_urr,
+                        num_of_update_urr, qos_flow->urr, modify_flags);
+                num_of_update_urr++;
+            }
+        }
     }
 
+    ogs_assert(num_of_remove_pdr + num_of_remove_far + num_of_remove_qer +
+            num_of_remove_urr + num_of_create_pdr + num_of_create_far +
+            num_of_create_qer + num_of_create_urr + num_of_update_pdr +
+            num_of_update_far + num_of_update_qer + num_of_update_urr);
+
     pfcp_message->h.type = type;
     pkbuf = ogs_pfcp_build_msg(pfcp_message);
     ogs_expect(pkbuf);
@@ -555,7 +644,8 @@
             (OGS_PFCP_MODIFY_CREATE|
              OGS_PFCP_MODIFY_TFT_NEW|OGS_PFCP_MODIFY_TFT_ADD|
              OGS_PFCP_MODIFY_TFT_REPLACE|OGS_PFCP_MODIFY_TFT_DELETE|
-             OGS_PFCP_MODIFY_EPC_TFT_UPDATE)) {
+             OGS_PFCP_MODIFY_EPC_TFT_UPDATE|
+             OGS_PFCP_MODIFY_OUTER_HEADER_REMOVAL)) {
         ogs_pfcp_pdrbuf_clear();
     }

open5gs_2.7.6.tar.xz/src/smf/n4-handler.c -> open5gs_2.7.7.tar.xz/src/smf/n4-handler.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -197,23 +197,38 @@
         far = pdr->far;
         ogs_assert(far);
 
-        if (pdr->src_if == OGS_PFCP_INTERFACE_ACCESS) {
+        if (pdr->src_if == OGS_PFCP_INTERFACE_CORE) {
+            ogs_assert(sess->pfcp_node);
+            if (sess->pfcp_node->up_function_features.ftup &&
+                pdr->f_teid_len) {
+                if (sess->local_dl_addr)
+                    ogs_freeaddrinfo(sess->local_dl_addr);
+                if (sess->local_dl_addr6)
+                    ogs_freeaddrinfo(sess->local_dl_addr6);
+
+                ogs_assert(OGS_OK ==
+                    ogs_pfcp_f_teid_to_sockaddr(
+                        &pdr->f_teid, pdr->f_teid_len,
+                        &sess->local_dl_addr, &sess->local_dl_addr6));
+                sess->local_dl_teid = pdr->f_teid.teid;
+            }
+        } else if (pdr->src_if == OGS_PFCP_INTERFACE_ACCESS) {
             if (far->dst_if == OGS_PFCP_INTERFACE_CP_FUNCTION)
                 ogs_pfcp_far_teid_hash_set(far);
 
             ogs_assert(sess->pfcp_node);
             if (sess->pfcp_node->up_function_features.ftup &&
                 pdr->f_teid_len) {
-                if (sess->upf_n3_addr)
-                    ogs_freeaddrinfo(sess->upf_n3_addr);
-                if (sess->upf_n3_addr6)
-                    ogs_freeaddrinfo(sess->upf_n3_addr6);
+                if (sess->local_ul_addr)
+                    ogs_freeaddrinfo(sess->local_ul_addr);
+                if (sess->local_ul_addr6)
+                    ogs_freeaddrinfo(sess->local_ul_addr6);
 
                 ogs_assert(OGS_OK ==
                     ogs_pfcp_f_teid_to_sockaddr(
                         &pdr->f_teid, pdr->f_teid_len,
-                        &sess->upf_n3_addr, &sess->upf_n3_addr6));
-                sess->upf_n3_teid = pdr->f_teid.teid;
+                        &sess->local_ul_addr, &sess->local_ul_addr6));
+                sess->local_ul_teid = pdr->f_teid.teid;
             }
         } else if (pdr->src_if == OGS_PFCP_INTERFACE_CP_FUNCTION) {
             ogs_assert(OGS_ERROR != ogs_pfcp_setup_pdr_gtpu_node(pdr));
@@ -225,7 +240,7 @@
         return cause_value;
     }
 
-    if (sess->upf_n3_addr == NULL && sess->upf_n3_addr6 == NULL) {
+    if (sess->local_ul_addr == NULL && sess->local_ul_addr6 == NULL) {
         ogs_error("No UP F-TEID");
         return OGS_PFCP_CAUSE_SESSION_CONTEXT_NOT_FOUND;
     }
@@ -242,8 +257,9 @@
         smf_sess_t *sess, ogs_pfcp_xact_t *xact,
         ogs_pfcp_session_modification_response_t *rsp)
 {
-    int status = 0;
+    int r, status = 0;
     uint64_t flags = 0;
+    int trigger = 0;
     ogs_sbi_stream_t *stream = NULL;
     smf_bearer_t *qos_flow = NULL;
 
@@ -256,6 +272,7 @@
 
     flags = xact->modify_flags;
     ogs_assert(flags);
+    trigger = xact->delete_trigger;
 
     /* 'stream' could be NULL in smf_qos_flow_binding() */
     if (xact->assoc_stream_id >= OGS_MIN_POOL_ID &&
@@ -314,7 +331,22 @@
             far = pdr->far;
             ogs_assert(far);
 
-            if (pdr->src_if == OGS_PFCP_INTERFACE_ACCESS) {
+            if (pdr->src_if == OGS_PFCP_INTERFACE_CORE) {
+                ogs_assert(sess->pfcp_node);
+                if (sess->pfcp_node->up_function_features.ftup &&
+                    pdr->f_teid_len) {
+                    if (sess->local_dl_addr)
+                        ogs_freeaddrinfo(sess->local_dl_addr);
+                    if (sess->local_dl_addr6)
+                        ogs_freeaddrinfo(sess->local_dl_addr6);
+
+                    ogs_assert(OGS_OK ==
+                        ogs_pfcp_f_teid_to_sockaddr(
+                            &pdr->f_teid, pdr->f_teid_len,
+                            &sess->local_dl_addr, &sess->local_dl_addr6));
+                    sess->local_dl_teid = pdr->f_teid.teid;
+                }
+            } else if (pdr->src_if == OGS_PFCP_INTERFACE_ACCESS) {
                 if (far->dst_if == OGS_PFCP_INTERFACE_CP_FUNCTION)
                     ogs_pfcp_far_teid_hash_set(far);
 
@@ -323,28 +355,28 @@
                     pdr->f_teid_len) {
 
                     if (far->dst_if == OGS_PFCP_INTERFACE_CORE) {
-                        if (sess->upf_n3_addr)
-                            ogs_freeaddrinfo(sess->upf_n3_addr);
-                        if (sess->upf_n3_addr6)
-                            ogs_freeaddrinfo(sess->upf_n3_addr6);
+                        if (sess->local_ul_addr)
+                            ogs_freeaddrinfo(sess->local_ul_addr);
+                        if (sess->local_ul_addr6)
+                            ogs_freeaddrinfo(sess->local_ul_addr6);
 
                         ogs_assert(OGS_OK ==
                             ogs_pfcp_f_teid_to_sockaddr(
                                 &pdr->f_teid, pdr->f_teid_len,
-                                &sess->upf_n3_addr, &sess->upf_n3_addr6));
-                        sess->upf_n3_teid = pdr->f_teid.teid;
+                                &sess->local_ul_addr, &sess->local_ul_addr6));
+                        sess->local_ul_teid = pdr->f_teid.teid;
                     } else if (far->dst_if == OGS_PFCP_INTERFACE_ACCESS) {
-                        if (sess->handover.upf_dl_addr)
-                            ogs_freeaddrinfo(sess->handover.upf_dl_addr);
-                        if (sess->handover.upf_dl_addr6)
-                            ogs_freeaddrinfo(sess->handover.upf_dl_addr6);
+                        if (sess->handover.local_dl_addr)
+                            ogs_freeaddrinfo(sess->handover.local_dl_addr);
+                        if (sess->handover.local_dl_addr6)
+                            ogs_freeaddrinfo(sess->handover.local_dl_addr6);
 
                         ogs_assert(OGS_OK ==
                             ogs_pfcp_f_teid_to_sockaddr(
                                 &pdr->f_teid, pdr->f_teid_len,
-                                &sess->handover.upf_dl_addr,
-                                &sess->handover.upf_dl_addr6));
-                        sess->handover.upf_dl_teid = pdr->f_teid.teid;
+                                &sess->handover.local_dl_addr,
+                                &sess->handover.local_dl_addr6));
+                        sess->handover.local_dl_teid = pdr->f_teid.teid;
                     }
                 }
             } else if (pdr->src_if == OGS_PFCP_INTERFACE_CP_FUNCTION) {
@@ -368,14 +400,396 @@
 
     ogs_assert(sess);
 
-    if (sess->upf_n3_addr == NULL && sess->upf_n3_addr6 == NULL) {
+    if (sess->local_ul_addr == NULL && sess->local_ul_addr6 == NULL) {
         if (stream)
             smf_sbi_send_sm_context_update_error_log(
                     stream, status, "No UP F_TEID", NULL);
         return;
     }
 
-    if (flags & OGS_PFCP_MODIFY_ACTIVATE) {
+    if (flags & OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING) {
+        if (flags & OGS_PFCP_MODIFY_ACTIVATE) {
+            if ((flags & OGS_PFCP_MODIFY_XN_HANDOVER) ||
+                (flags & OGS_PFCP_MODIFY_N2_HANDOVER)) {
+                sess->nsmf_param.request_indication =
+                    OpenAPI_request_indication_UE_REQ_PDU_SES_MOD;
+
+                sess->nsmf_param.up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+
+                sess->nsmf_param.serving_network = true;
+
+                ogs_assert(OGS_OK ==
+                        ogs_sockaddr_to_ip(
+                            sess->local_dl_addr, sess->local_dl_addr6,
+                            &sess->nsmf_param.dl_ip));
+                sess->nsmf_param.dl_teid = sess->local_dl_teid;
+
+                sess->nsmf_param.an_type = sess->an_type;
+                sess->nsmf_param.rat_type = sess->sbi_rat_type;
+
+                r = smf_sbi_discover_and_send(
+                        OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                        smf_nsmf_pdusession_build_hsmf_update_data,
+                        sess, stream,
+                        flags & OGS_PFCP_MODIFY_XN_HANDOVER ?
+                            SMF_UPDATE_STATE_ACTIVATED_FROM_XN_HANDOVER :
+                            SMF_UPDATE_STATE_ACTIVATED_FROM_N2_HANDOVER,
+                        NULL);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
+
+            } else if (flags & OGS_PFCP_MODIFY_DL_ONLY) {
+    /*
+     * UE-requested PDU Session Modification(ACTIVATED)
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_DL_ONLY|
+     *        OGS_PFCP_MODIFY_OUTER_HEADER_REMOVAL|OGS_PFCP_MODIFY_ACTIVATE
+     * 2.  V: if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING)
+     *           pfcp_flags |= OGS_PFCP_MODIFY_FROM_ACTIVATING;
+     * 3.  V*: flags & OGS_PFCP_MODIFY_FROM_ACTIVATING ?
+     *            SMF_UPDATE_STATE_HR_ACTIVATED_FROM_ACTIVATING :
+     *            SMF_UPDATE_STATE_HR_ACTIVATED_FROM_NON_ACTIVATING,
+     * 4.  V*: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 5.  V*: smf_nsmf_pdusession_build_hsmf_update_data
+     * 6.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 7.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 8.  H: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_DL_ONLY|
+     *        OGS_PFCP_MODIFY_ACTIVATE
+     * 9.  H*: ogs_sbi_send_http_status_no_content
+     * 10. V: case SMF_UPDATE_STATE_HR_ACTIVATED_FROM_ACTIVATING:
+     *           sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+     *           smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *               OpenAPI_up_cnx_state_ACTIVATED);
+     *        case SMF_UPDATE_STATE_HR_ACTIVATED_FROM_NON_ACTIVATING:
+     *           ogs_sbi_send_http_status_no_content
+     */
+                if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+                    ogs_assert(stream);
+
+                    sess->nsmf_param.request_indication =
+                        OpenAPI_request_indication_UE_REQ_PDU_SES_MOD;
+
+                    sess->nsmf_param.up_cnx_state =
+                        OpenAPI_up_cnx_state_ACTIVATED;
+
+                    sess->nsmf_param.serving_network = true;
+
+                    ogs_assert(OGS_OK ==
+                            ogs_sockaddr_to_ip(
+                                sess->local_dl_addr, sess->local_dl_addr6,
+                                &sess->nsmf_param.dl_ip));
+                    sess->nsmf_param.dl_teid = sess->local_dl_teid;
+
+                    sess->nsmf_param.an_type = sess->an_type;
+                    sess->nsmf_param.rat_type = sess->sbi_rat_type;
+
+                    r = smf_sbi_discover_and_send(
+                            OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                            smf_nsmf_pdusession_build_hsmf_update_data,
+                            sess, stream,
+                            flags & OGS_PFCP_MODIFY_FROM_ACTIVATING ?
+                                SMF_UPDATE_STATE_ACTIVATED_FROM_ACTIVATING :
+                                SMF_UPDATE_STATE_ACTIVATED_FROM_NON_ACTIVATING,
+                            NULL);
+                    ogs_expect(r == OGS_OK);
+                    ogs_assert(r != OGS_ERROR);
+                } else if (HOME_ROUTED_ROAMING_IN_HSMF(sess)) {
+    /*
+     * Network-requested PDU Session Modification
+     *
+     * 1.  H: OpenAPI_request_indication_NW_REQ_PDU_SES_MOD
+     *        QOS_RULE_CODE_FROM_PFCP_FLAGS
+     *        QOS_RULE_FLOW_DESCRIPTION_CODE_FROM_PFCP_FLAGS
+     * 2.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 3.  V: smf_nsmf_handle_update_data_in_vsmf
+     * 4.  V: gsm_build_pdu_session_modification_command+
+     *        ngap_build_pdu_session_resource_modify_request_transfer
+     * 5.  V: OpenAPI_n2_sm_info_type_PDU_RES_MOD_RSP
+     *        if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING)
+     *            sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+     *            smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *                  OpenAPI_up_cnx_state_ACTIVATED)
+     *        else
+     *            ogs_sbi_send_http_status_no_content(stream)
+     * 6.  V: ogs_sbi_send_http_status_no_content(stream)
+     *         OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMPLETE:
+     *         ogs_sbi_send_http_status_no_content(n1_n2_modified_stream));
+     * 7.  V: case OGS_EVENT_SBI_CLIENT
+     *        CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 8.  H: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+     *        OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE
+     * 9.  H*: ogs_sbi_send_http_status_no_content
+     */
+                    if (stream)
+                        ogs_assert(true ==
+                            ogs_sbi_send_http_status_no_content(stream));
+                } else {
+                    ogs_fatal("Invalid flags 0x%llx", (long long)flags);
+                    ogs_assert_if_reached();
+                }
+            } else if (flags & OGS_PFCP_MODIFY_UL_ONLY) {
+                smf_n1_n2_message_transfer_param_t param;
+
+                memset(&param, 0, sizeof(param));
+                param.state = SMF_UE_REQUESTED_PDU_SESSION_ESTABLISHMENT;
+                param.n1smbuf =
+                    gsm_build_pdu_session_establishment_accept(sess);
+                ogs_assert(param.n1smbuf);
+                param.n2smbuf =
+                    ngap_build_pdu_session_resource_setup_request_transfer(
+                            sess);
+                ogs_assert(param.n2smbuf);
+
+                smf_namf_comm_send_n1_n2_message_transfer(sess, NULL, &param);
+
+                if (sess->pending_modification_xact) {
+                    if (ogs_sbi_discover_and_send(
+                                sess->pending_modification_xact) != OGS_OK) {
+                        ogs_error("ogs_sbi_discover_and_send() failed");
+                        ogs_sbi_xact_remove(sess->pending_modification_xact);
+                    }
+
+                    sess->pending_modification_xact = NULL;
+                }
+            } else {
+                ogs_fatal("Invalid flags 0x%llx", (long long)flags);
+                ogs_assert_if_reached();
+            }
+        } else if (flags & OGS_PFCP_MODIFY_DEACTIVATE) {
+            if (flags & OGS_PFCP_MODIFY_DL_ONLY) {
+    /*
+     * UE-requested PDU Session Modification(DEACTIVATED)
+     *
+     * For Home Routed Roaming, delegate PFCP deactivation to H-SMF by
+     * sending UP_CNX_STATE=DEACTIVATED via HsmfUpdateData.
+     *
+     * 1.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 2.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     *        SMF_UPDATE_STATE_HR_DEACTIVATED
+     * 3.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 4.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 5.  H: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_DL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 6.  H*: ogs_sbi_send_http_status_no_content
+     * 7.  V: case SMF_UPDATE_STATE_HR_DEACTIVATED:
+     * 8.  V: smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *          OpenAPI_up_cnx_state_DEACTIVATED)
+     */
+                ogs_assert(true == ogs_sbi_send_http_status_no_content(stream));
+            } else if (flags & OGS_PFCP_MODIFY_UL_ONLY) {
+                ogs_assert(trigger);
+
+                if (trigger == OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED) {
+    /*
+     * UE-requested PDU Session Release
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 3.  V*: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 4.  V*: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_wait_5gc_n1_n2_release);
+     * 11. V: smf_nsmf_handle_update_data_in_vsmf
+     * 12. V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V: ngap_build_pdu_session_resource_release_command_transfer+
+     *        gsm_build_pdu_session_release_command
+     * 16  V: OGS_FSM_TRAN(&sess->sm, smf_gsm_state_wait_5gc_n1_n2_release)
+       17. V: case OpenAPI_n2_sm_info_type_PDU_RES_REL_RSP:
+              case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE:
+     * 18. V: ogs_sbi_send_http_status_no_content(n1_n2_released_stream)
+     * 19. V: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 20. H: case OGS_EVENT_SBI_CLIENT:
+     * 21. H: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 22. H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_N1N2_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 23. H: smf_sbi_send_status_notify+SMF_SESS_CLEAR(sess)
+     * 24. V: case OGS_EVENT_SBI_SERVER:
+     * 25. V: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 26. V: ogs_sbi_send_http_status_no_content+
+     *        smf_sbi_send_sm_context_status_notify
+     * 27. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                    sess->nsmf_param.request_indication =
+                        OpenAPI_request_indication_UE_REQ_PDU_SES_REL;
+
+                    r = smf_sbi_discover_and_send(
+                            OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                            smf_nsmf_pdusession_build_hsmf_update_data,
+                            sess, stream, trigger, NULL);
+                    ogs_expect(r == OGS_OK);
+                    ogs_assert(r != OGS_ERROR);
+                } else if (trigger ==
+                        OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT) {
+    /*
+     * Network-requested PDU Session Release(DUPLICATED)
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT,
+     * 3.  V*: OpenAPI_request_indication_NW_REQ_PDU_SES_REL
+     * 4.  V*: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_NW_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_AMF_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 11. H: SMF_SESS_CLEAR(sess)
+     * 12. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT
+     * 13. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 14. V: ogs_sbi_send_http_status_no_content
+     * 15. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                    sess->nsmf_param.request_indication =
+                        OpenAPI_request_indication_NW_REQ_PDU_SES_REL;
+
+                    r = smf_sbi_discover_and_send(
+                            OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                            smf_nsmf_pdusession_build_hsmf_update_data,
+                            sess, stream, trigger, NULL);
+                    ogs_expect(r == OGS_OK);
+                    ogs_assert(r != OGS_ERROR);
+                } else if (trigger ==
+                        OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT) {
+    /*
+     * Network-requested PDU Session Release
+     *
+     * 1.  V: smf_nsmf_handle_release_sm_context
+     * 2.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 3.  V: OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 4.  V*: smf_nsmf_pdusession_build_release_data
+     * 5.  H: smf_nsmf_handle_release_data_in_hsmf
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 7.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 8.  H: ogs_sbi_send_http_status_no_content
+     * 9.  H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_AMF_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 11. H: SMF_SESS_CLEAR(sess)
+     * 12. V: smf_nsmf_handle_release_data_in_hsmf
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V: ogs_sbi_send_http_status_no_content
+     * 16. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                    r = smf_sbi_discover_and_send(
+                            OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                            smf_nsmf_pdusession_build_release_data,
+                            sess, stream, trigger, NULL);
+                    ogs_expect(r == OGS_OK);
+                    ogs_assert(r != OGS_ERROR);
+                } else {
+                    ogs_fatal("Invalid delete trigger%d", trigger);
+                    ogs_assert_if_reached();
+                }
+            } else {
+                ogs_fatal("Invalid flags 0x%llx", (long long)flags);
+                ogs_assert_if_reached();
+            }
+        } else if (
+                (flags & OGS_PFCP_MODIFY_REMOVE) ||
+                (flags & OGS_PFCP_MODIFY_CREATE) ||
+                (flags &
+                 (OGS_PFCP_MODIFY_TFT_NEW|OGS_PFCP_MODIFY_TFT_ADD|
+                 OGS_PFCP_MODIFY_TFT_REPLACE|OGS_PFCP_MODIFY_TFT_DELETE|
+                 OGS_PFCP_MODIFY_QOS_MODIFY))) {
+    /*
+     * UE or Network requested PDU Session Modification
+     *
+     * 1.  H*: OpenAPI_request_indication_NW_REQ_PDU_SES_MOD
+     *         QOS_RULE_CODE_FROM_PFCP_FLAGS
+     *         QOS_RULE_FLOW_DESCRIPTION_CODE_FROM_PFCP_FLAGS
+     * 2.  H*: smf_nsmf_pdusession_build_vsmf_update_data
+     * 3.  V: smf_nsmf_handle_update_data_in_vsmf
+     * 4.  V: gsm_build_pdu_session_modification_command+
+     *        ngap_build_pdu_session_resource_modify_request_transfer
+     * 5.  V: OpenAPI_n2_sm_info_type_PDU_RES_MOD_RSP
+     *        if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING)
+     *            sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+     *            smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *                  OpenAPI_up_cnx_state_ACTIVATED)
+     *        else
+     *            ogs_sbi_send_http_status_no_content(stream)
+     * 6.  V: ogs_sbi_send_http_status_no_content(stream)
+     *        OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMPLETE:
+     *        ogs_sbi_send_http_status_no_content(n1_n2_modified_stream));
+     * 7.  V: case OGS_EVENT_SBI_CLIENT
+     *        CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 8.  H: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+     *        OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE
+     */
+            int state = 0;
+
+            memset(&sess->nsmf_param, 0, sizeof(sess->nsmf_param));
+            if (flags & OGS_PFCP_MODIFY_NETWORK_REQUESTED) {
+                sess->nsmf_param.request_indication =
+                    OpenAPI_request_indication_NW_REQ_PDU_SES_MOD;
+            } else if (flags & OGS_PFCP_MODIFY_UE_REQUESTED) {
+                sess->nsmf_param.request_indication =
+                    OpenAPI_request_indication_UE_REQ_PDU_SES_MOD;
+            } else {
+                ogs_fatal("Invalid flags 0x%llx", (long long)flags);
+                ogs_assert_if_reached();
+            }
+            sess->nsmf_param.qos_rule_code =
+                QOS_RULE_CODE_FROM_PFCP_FLAGS(flags);
+            sess->nsmf_param.qos_flow_description_code =
+                QOS_RULE_FLOW_DESCRIPTION_CODE_FROM_PFCP_FLAGS(flags);
+
+            if (flags & OGS_PFCP_MODIFY_REMOVE) {
+                if (flags & OGS_PFCP_MODIFY_INDIRECT) {
+                    ogs_fatal("Invalid flags 0x%llx", (long long)flags);
+                    ogs_assert_if_reached();
+                }
+
+                state = SMF_REMOVE_STATE_NONE;
+            } else if (flags & OGS_PFCP_MODIFY_CREATE) {
+                state = SMF_CREATE_STATE_NONE;
+            } else if (flags &
+                    (OGS_PFCP_MODIFY_TFT_NEW|OGS_PFCP_MODIFY_TFT_ADD|
+                     OGS_PFCP_MODIFY_TFT_REPLACE|OGS_PFCP_MODIFY_TFT_DELETE|
+                     OGS_PFCP_MODIFY_QOS_MODIFY)) {
+                state = SMF_UPDATE_STATE_NONE;
+            }
+
+            r = smf_sbi_discover_and_send(
+                    OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                    smf_nsmf_pdusession_build_vsmf_update_data,
+                    sess, NULL, state, NULL);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+
+            if (state == SMF_REMOVE_STATE_NONE) {
+                smf_bearer_t *next = NULL;
+                ogs_list_for_each_entry_safe(&sess->qos_flow_to_modify_list,
+                        next, qos_flow, to_modify_node) {
+                    smf_sess_t *sess = smf_sess_find_by_id(qos_flow->sess_id);
+                    ogs_assert(sess);
+                    smf_metrics_inst_by_5qi_add(
+                            &sess->serving_plmn_id,
+                            &sess->s_nssai,
+                            sess->session.qos.index,
+                            SMF_METR_GAUGE_SM_QOSFLOWNBR, -1);
+                    smf_bearer_remove(qos_flow);
+                }
+            }
+
+        } else {
+            ogs_fatal("Invalid flags 0x%llx", (long long)flags);
+            ogs_assert_if_reached();
+        }
+    } else if (flags & OGS_PFCP_MODIFY_ACTIVATE) {
         if (flags & OGS_PFCP_MODIFY_XN_HANDOVER) {
             ogs_pkbuf_t *n2smbuf =
                 ngap_build_path_switch_request_ack_transfer(sess);
@@ -390,19 +804,18 @@
                     smf_5gc_pfcp_send_all_pdr_modification_request(
                         sess, stream,
                         OGS_PFCP_MODIFY_INDIRECT|OGS_PFCP_MODIFY_REMOVE,
-                        ogs_local_conf()->time.handover.duration));
+                        0, ogs_local_conf()->time.handover.duration));
             }
 
             smf_sbi_send_sm_context_updated_data_ho_state(
                     sess, stream, OpenAPI_ho_state_COMPLETED);
-
         } else {
             if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING) {
                 sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
                 smf_sbi_send_sm_context_updated_data_up_cnx_state(
                         sess, stream, OpenAPI_up_cnx_state_ACTIVATED);
             } else {
-                int r = smf_sbi_discover_and_send(
+                r = smf_sbi_discover_and_send(
                         OGS_SBI_SERVICE_TYPE_NUDM_UECM, NULL,
                         smf_nudm_uecm_build_registration,
                         sess, stream, SMF_UECM_STATE_REGISTERED, NULL);
@@ -425,7 +838,7 @@
 
             param.skip_ind = true;
 
-            smf_namf_comm_send_n1_n2_message_transfer(sess, &param);
+            smf_namf_comm_send_n1_n2_message_transfer(sess, NULL, &param);
         } else {
             smf_sbi_send_sm_context_updated_data_up_cnx_state(
                     sess, stream, OpenAPI_up_cnx_state_DEACTIVATED);
@@ -454,7 +867,7 @@
                     smf_5gc_pfcp_send_all_pdr_modification_request(
                         sess, stream,
                         OGS_PFCP_MODIFY_INDIRECT|OGS_PFCP_MODIFY_CREATE,
-                        0));
+                        0, 0));
             } else if (flags & OGS_PFCP_MODIFY_HANDOVER_CANCEL) {
                 smf_sbi_send_sm_context_updated_data_ho_state(
                         sess, stream, OpenAPI_ho_state_CANCELLED);
@@ -491,7 +904,7 @@
                         NGAP_Cause_PR_nas, NGAP_CauseNas_normal_release);
             ogs_assert(param.n2smbuf);
 
-            smf_namf_comm_send_n1_n2_message_transfer(sess, &param);
+            smf_namf_comm_send_n1_n2_message_transfer(sess, NULL, &param);
 
             ogs_list_for_each_entry_safe(&sess->qos_flow_to_modify_list,
                     next, qos_flow, to_modify_node) {
@@ -582,7 +995,7 @@
                         sess, true);
             ogs_assert(param.n2smbuf);
 
-            smf_namf_comm_send_n1_n2_message_transfer(sess, &param);
+            smf_namf_comm_send_n1_n2_message_transfer(sess, NULL, &param);
 
         } else {
             ogs_fatal("Unknown flags 0x%llx", (long long)flags);
@@ -597,23 +1010,9 @@
         uint8_t qos_rule_code = 0;
         uint8_t qos_flow_description_code = 0;
 
-        if (flags & OGS_PFCP_MODIFY_TFT_NEW) {
-            qos_rule_code = OGS_NAS_QOS_CODE_CREATE_NEW_QOS_RULE;
-        } else if (flags & OGS_PFCP_MODIFY_TFT_ADD) {
-            qos_rule_code = OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_ADD_PACKET_FILTERS;
-        } else if (flags & OGS_PFCP_MODIFY_TFT_REPLACE) {
-            qos_rule_code = OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_REPLACE_ALL_PACKET_FILTERS;
-        } else if (flags & OGS_PFCP_MODIFY_TFT_DELETE) {
-            qos_rule_code = OGS_NAS_QOS_CODE_MODIFY_EXISTING_QOS_RULE_AND_DELETE_PACKET_FILTERS;
-        }
-
-        if (flags & OGS_PFCP_MODIFY_QOS_CREATE) {
-            ogs_assert_if_reached();
-        } else if (flags & OGS_PFCP_MODIFY_QOS_MODIFY) {
-            qos_flow_description_code = OGS_NAS_MODIFY_NEW_QOS_FLOW_DESCRIPTION;
-        } else if (flags & OGS_PFCP_MODIFY_QOS_DELETE) {
-            ogs_assert_if_reached();
-        }
+        qos_rule_code = QOS_RULE_CODE_FROM_PFCP_FLAGS(flags);
+        qos_flow_description_code =
+                QOS_RULE_FLOW_DESCRIPTION_CODE_FROM_PFCP_FLAGS(flags);
 
         if (flags & OGS_PFCP_MODIFY_NETWORK_REQUESTED) {
             ogs_assert(flags & OGS_PFCP_MODIFY_SESSION);
@@ -642,7 +1041,7 @@
                     (flags & OGS_PFCP_MODIFY_QOS_MODIFY) ? true : false);
             ogs_assert(param.n2smbuf);
 
-            smf_namf_comm_send_n1_n2_message_transfer(sess, &param);
+            smf_namf_comm_send_n1_n2_message_transfer(sess, NULL, &param);
 
         } else if (flags & OGS_PFCP_MODIFY_UE_REQUESTED) {
             ogs_pkbuf_t *n1smbuf = NULL, *n2smbuf = NULL;
@@ -1136,6 +1535,7 @@
         ogs_pfcp_tlv_usage_report_session_deletion_response_t *use_rep =
             &rsp->usage_reporti;
         uint32_t urr_id;
+        int16_t decoded;
         ogs_pfcp_volume_measurement_t volume;
         ogs_pfcp_usage_report_trigger_t rep_trig;
         if (use_rep->presence == 0)
@@ -1145,8 +1545,12 @@
         urr_id = use_rep->urr_id.u32;
         if (!bearer || !bearer->urr || bearer->urr->id != urr_id)
             continue;
-        ogs_pfcp_parse_volume_measurement(
+        decoded = ogs_pfcp_parse_volume_measurement(
                 &volume, &use_rep->volume_measurement);
+        if (use_rep->volume_measurement.len != decoded) {
+            ogs_error("Invalid Volume Measurement");
+            continue;
+        }
         if (volume.ulvol)
             sess->gy.ul_octets += volume.uplink_volume;
         if (volume.dlvol)
@@ -1302,7 +1706,7 @@
 
             param.n1n2_failure_txf_notif_uri = true;
 
-            smf_namf_comm_send_n1_n2_message_transfer(sess, &param);
+            smf_namf_comm_send_n1_n2_message_transfer(sess, NULL, &param);
             break;
         case OpenAPI_up_cnx_state_SUSPENDED:
             ogs_error("%s:%s PDU Session had been SUSPENDED",
@@ -1327,6 +1731,7 @@
             ogs_pfcp_tlv_usage_report_session_report_request_t *use_rep =
                 &pfcp_req->usage_reporti;
             uint32_t urr_id;
+            int16_t decoded;
             ogs_pfcp_volume_measurement_t volume;
             ogs_pfcp_usage_report_trigger_t rep_trig;
             if (use_rep->presence == 0)
@@ -1336,8 +1741,12 @@
             urr_id = use_rep->urr_id.u32;
             if (!bearer || !bearer->urr || bearer->urr->id != urr_id)
                 continue;
-            ogs_pfcp_parse_volume_measurement(
+            decoded = ogs_pfcp_parse_volume_measurement(
                     &volume, &use_rep->volume_measurement);
+            if (use_rep->volume_measurement.len != decoded) {
+                ogs_error("Invalid Volume Measurement");
+                continue;
+            }
             if (volume.ulvol)
                 sess->gy.ul_octets += volume.uplink_volume;
             if (volume.dlvol)
@@ -1400,7 +1809,7 @@
                     sess, NULL,
                     OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_DEACTIVATE|
                     OGS_PFCP_MODIFY_ERROR_INDICATION,
-                    0));
+                    0, 0));
         }
     }
     return cause_value;

open5gs_2.7.6.tar.xz/src/smf/namf-build.c -> open5gs_2.7.7.tar.xz/src/smf/namf-build.c Changed

open5gs_2.7.6.tar.xz/src/smf/namf-build.h -> open5gs_2.7.7.tar.xz/src/smf/namf-build.h Changed

open5gs_2.7.6.tar.xz/src/smf/namf-handler.c -> open5gs_2.7.7.tar.xz/src/smf/namf-handler.c Changed

@@ -23,7 +23,8 @@
 #include "namf-handler.h"
 
 bool smf_namf_comm_handle_n1_n2_message_transfer(
-        smf_sess_t *sess, int state, ogs_sbi_message_t *recvmsg)
+        smf_sess_t *sess, ogs_sbi_stream_t *stream,
+        int state, ogs_sbi_message_t *recvmsg)
 {
     smf_ue_t *smf_ue = NULL;
     OpenAPI_n1_n2_message_transfer_rsp_data_t *N1N2MessageTransferRspData;
@@ -37,6 +38,15 @@
     switch (state) {
     case SMF_UE_REQUESTED_PDU_SESSION_ESTABLISHMENT:
         if (recvmsg->res_status == OGS_SBI_HTTP_STATUS_OK) {
+/*
+ * Non-roaming/LBO: start network-triggered PDU Session Modification at step 11
+ * after N1N2 transfer (Establishment Accept) and N2/N4 context sync, ensuring
+ * the session is active on UE, RAN, and SMF before applying QoS updates.
+ *
+ * Home-Routed Roaming: trigger PDU Session Modification at step 13
+ * immediately after H-SMF’s CreateSMContext response and H-UPF N4 setup
+ * to apply QoS updates without waiting for V-SMF or RAN setup.
+ */
             smf_qos_flow_binding(sess);
         } else {
             ogs_error("%s:%d HTTP response error %d",
@@ -56,7 +66,17 @@
         if (recvmsg->res_status == OGS_SBI_HTTP_STATUS_OK) {
             if (N1N2MessageTransferRspData->cause ==
                 OpenAPI_n1_n2_message_transfer_cause_N1_N2_TRANSFER_INITIATED) {
-                /* Nothing */
+                if (stream) {
+                    if (sess->vsmf_to_hsmf_modify_stream_id >=
+                            OGS_MIN_POOL_ID &&
+                        sess->vsmf_to_hsmf_modify_stream_id <=
+                            OGS_MAX_POOL_ID)
+                        ogs_error("N1 N2 modified stream ID %d"
+                                "has not been used yet",
+                                sess->vsmf_to_hsmf_modify_stream_id);
+                    sess->vsmf_to_hsmf_modify_stream_id =
+                        ogs_sbi_id_from_stream(stream);
+                }
             } else {
                 ogs_error("Not implemented cause:%d",
                         N1N2MessageTransferRspData->cause);
@@ -70,6 +90,18 @@
                             sess, recvmsg->http.location);
                 else
                     ogs_error("No HTTP Location");
+
+                if (stream) {
+                    if (sess->vsmf_to_hsmf_modify_stream_id >=
+                            OGS_MIN_POOL_ID &&
+                        sess->vsmf_to_hsmf_modify_stream_id <=
+                            OGS_MAX_POOL_ID)
+                        ogs_error("N1 N2 modified stream ID %d"
+                                "has not been used yet",
+                                sess->vsmf_to_hsmf_modify_stream_id);
+                    sess->vsmf_to_hsmf_modify_stream_id =
+                        ogs_sbi_id_from_stream(stream);
+                }
             } else {
                 ogs_error("Not implemented cause:%d",
                         N1N2MessageTransferRspData->cause);
@@ -104,7 +136,7 @@
         }
         break;
 
-    case SMF_NETWORK_REQUESTED_PDU_SESSION_RELEASE:
+    case SMF_UE_OR_NETWORK_REQUESTED_PDU_SESSION_RELEASE:
     case SMF_ERROR_INDICATON_RECEIVED_FROM_5G_AN:
 
         N1N2MessageTransferRspData = recvmsg->N1N2MessageTransferRspData;
@@ -158,10 +190,19 @@
 
                 param.n1n2_failure_txf_notif_uri = true;
 
-                smf_namf_comm_send_n1_n2_message_transfer(sess, &param);
+                smf_namf_comm_send_n1_n2_message_transfer(sess, NULL, &param);
             } else if (N1N2MessageTransferRspData->cause ==
                 OpenAPI_n1_n2_message_transfer_cause_N1_N2_TRANSFER_INITIATED) {
-                /* Nothing */
+                if (stream) {
+                    if (sess->vsmf_to_hsmf_release_stream_id >=
+                            OGS_MIN_POOL_ID &&
+                        sess->vsmf_to_hsmf_release_stream_id <= OGS_MAX_POOL_ID)
+                        ogs_error("N1 N2 released stream ID %d"
+                                "has not been used yet",
+                                sess->vsmf_to_hsmf_release_stream_id);
+                    sess->vsmf_to_hsmf_release_stream_id =
+                        ogs_sbi_id_from_stream(stream);
+                }
             } else {
                 ogs_error("Not implemented cause:%d",
                         N1N2MessageTransferRspData->cause);

open5gs_2.7.6.tar.xz/src/smf/namf-handler.h -> open5gs_2.7.7.tar.xz/src/smf/namf-handler.h Changed

open5gs_2.7.6.tar.xz/src/smf/ngap-build.c -> open5gs_2.7.7.tar.xz/src/smf/ngap-build.c Changed

@@ -19,6 +19,73 @@
 
 #include "ngap-build.h"
 
+/**
+ * Fill common QoS flow level parameters: 5QI, ARP, and optional GBR/MBR.
+ */
+static void fill_qos_level_parameters(
+    NGAP_QosFlowLevelQosParameters_t *params,
+    const ogs_qos_t *qos,
+    bool include_gbr)
+{
+    NGAP_AllocationAndRetentionPriority_t
+        *allocationAndRetentionPriority = NULL;
+    NGAP_QosCharacteristics_t *qosCharacteristics = NULL;
+    NGAP_NonDynamic5QIDescriptor_t *nonDynamic5QI = NULL;
+
+    /* Allocation and Retention Priority */
+    allocationAndRetentionPriority =
+        &params->allocationAndRetentionPriority;
+
+    allocationAndRetentionPriority->priorityLevelARP = qos->arp.priority_level;
+    if (qos->arp.pre_emption_capability == OGS_5GC_PRE_EMPTION_ENABLED)
+        allocationAndRetentionPriority->pre_emptionCapability =
+            NGAP_Pre_emptionCapability_may_trigger_pre_emption;
+    if (qos->arp.pre_emption_vulnerability == OGS_5GC_PRE_EMPTION_ENABLED)
+        allocationAndRetentionPriority->pre_emptionVulnerability =
+            NGAP_Pre_emptionVulnerability_pre_emptable;
+
+    /* Non-Dynamic 5QI Descriptor */
+    qosCharacteristics = &params->qosCharacteristics;
+    qosCharacteristics->choice.nonDynamic5QI = nonDynamic5QI =
+        CALLOC(1, sizeof(struct NGAP_NonDynamic5QIDescriptor));
+    ogs_assert(nonDynamic5QI);
+    qosCharacteristics->present = NGAP_QosCharacteristics_PR_nonDynamic5QI;
+
+    nonDynamic5QI->fiveQI = qos->index;
+
+    /* Optional GBR/MBR Information */
+    if (include_gbr &&
+        qos->mbr.downlink && qos->mbr.uplink &&
+        qos->gbr.downlink && qos->gbr.uplink) {
+        NGAP_GBR_QosInformation_t *gBR_QosInformation =
+            params->gBR_QosInformation = CALLOC(1, sizeof(*gBR_QosInformation));
+        ogs_assert(gBR_QosInformation);
+
+        ogs_assert(qos->mbr.downlink <= OGS_MAX_BITRATE_NGAP);
+        ogs_assert(qos->mbr.uplink <= OGS_MAX_BITRATE_NGAP);
+        ogs_assert(qos->gbr.downlink <= OGS_MAX_BITRATE_NGAP);
+        ogs_assert(qos->gbr.uplink <= OGS_MAX_BITRATE_NGAP);
+
+        asn_uint642INTEGER(&gBR_QosInformation->maximumFlowBitRateDL,
+                qos->mbr.downlink);
+        asn_uint642INTEGER(&gBR_QosInformation->maximumFlowBitRateUL,
+                qos->mbr.uplink);
+        asn_uint642INTEGER(&gBR_QosInformation->
+                guaranteedFlowBitRateDL, qos->gbr.downlink);
+        asn_uint642INTEGER(&gBR_QosInformation->
+                guaranteedFlowBitRateUL, qos->gbr.uplink);
+    } else if (include_gbr &&
+               (qos->mbr.downlink || qos->mbr.uplink ||
+                qos->gbr.downlink || qos->gbr.uplink)) {
+        ogs_error("Missing one or more MBR/GBR parameters; "
+                "defaulting to Non-GBR flow ");
+        ogs_error("    MBRDL:%lld,UL:%lld",
+            (long long)qos->mbr.downlink, (long long)qos->mbr.uplink);
+        ogs_error("    GBRDL:%lld,UL:%lld",
+            (long long)qos->gbr.downlink, (long long)qos->gbr.uplink);
+    }
+}
+
 ogs_pkbuf_t *ngap_build_pdu_session_resource_setup_request_transfer(
         smf_sess_t *sess)
 {
@@ -36,12 +103,6 @@
     NGAP_SecurityIndication_t *SecurityIndication = NULL;
     NGAP_QosFlowSetupRequestList_t *QosFlowSetupRequestList = NULL;
     NGAP_QosFlowSetupRequestItem_t *QosFlowSetupRequestItem = NULL;
-    NGAP_QosFlowIdentifier_t *qosFlowIdentifier = NULL;
-    NGAP_QosFlowLevelQosParameters_t *qosFlowLevelQosParameters = NULL;
-    NGAP_QosCharacteristics_t *qosCharacteristics = NULL;
-    NGAP_NonDynamic5QIDescriptor_t *nonDynamic5QI = NULL;
-    NGAP_AllocationAndRetentionPriority_t *allocationAndRetentionPriority;
-    NGAP_GBR_QosInformation_t *gBR_QosInformation = NULL;
 
     ogs_assert(sess);
 
@@ -84,10 +145,10 @@
     UPTransportLayerInformation->choice.gTPTunnel = gTPTunnel;
 
     ogs_assert(OGS_OK == ogs_sockaddr_to_ip(
-                sess->upf_n3_addr, sess->upf_n3_addr6, &upf_n3_ip));
+                sess->local_ul_addr, sess->local_ul_addr6, &upf_n3_ip));
     ogs_assert(OGS_OK == ogs_asn_ip_to_BIT_STRING(
                 &upf_n3_ip, &gTPTunnel->transportLayerAddress));
-    ogs_asn_uint32_to_OCTET_STRING(sess->upf_n3_teid, &gTPTunnel->gTP_TEID);
+    ogs_asn_uint32_to_OCTET_STRING(sess->local_ul_teid, &gTPTunnel->gTP_TEID);
 
     if (sess->handover.data_forwarding_not_possible == true) {
         ie = CALLOC(1,
@@ -181,7 +242,8 @@
 
             if (smf_self()->security_indication.
                     maximum_integrity_protected_data_rate_downlink) {
-                NGAP_ProtocolExtensionContainer_11905P297_t *extContainer = NULL;
+                NGAP_ProtocolExtensionContainer_11905P297_t
+                    *extContainer = NULL;
                 NGAP_SecurityIndication_ExtIEs_t *extIe = NULL;
                 NGAP_MaximumIntegrityProtectedDataRate_t
                     *MaximumIntegrityProtectedDataRate = NULL;
@@ -224,69 +286,79 @@
 
     QosFlowSetupRequestList = &ie->value.choice.QosFlowSetupRequestList;
 
-    ogs_list_for_each(&sess->bearer_list, qos_flow) {
+    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+        OpenAPI_list_t *qosFlowsSetupList = NULL;
+        OpenAPI_qos_flow_setup_item_t *qosFlowSetupItem = NULL;
+        OpenAPI_qos_flow_profile_t *qosFlowProfile = NULL;
+        OpenAPI_lnode_t *node = NULL;
+
+        ogs_qos_t qos;
+
+        qosFlowsSetupList = sess->h_smf_qos_flows_setup_list;
+        ogs_assert(qosFlowsSetupList);
+
+        node = qosFlowsSetupList->first;
+        ogs_assert(node);
+        qosFlowSetupItem = node->data;
+        ogs_assert(qosFlowSetupItem);
+
+        qosFlowProfile = qosFlowSetupItem->qos_flow_profile;
+        ogs_assert(qosFlowProfile);
+
+        memset(&qos, 0, sizeof(qos));
+
+        qos.index = qosFlowProfile->_5qi;
+        ogs_assert(qosFlowProfile->arp);
+        qos.arp.priority_level = qosFlowProfile->arp->priority_level;
+        if (qosFlowProfile->arp->preempt_cap ==
+            OpenAPI_preemption_capability_NOT_PREEMPT)
+            qos.arp.pre_emption_capability = OGS_5GC_PRE_EMPTION_DISABLED;
+        else if (qosFlowProfile->arp->preempt_cap ==
+            OpenAPI_preemption_capability_MAY_PREEMPT)
+            qos.arp.pre_emption_capability = OGS_5GC_PRE_EMPTION_ENABLED;
+        else {
+            ogs_error("Invalid preempt_cap %d",
+                    qosFlowProfile->arp->preempt_cap);
+            ogs_assert_if_reached();
+        }
+
+        if (qosFlowProfile->arp->preempt_vuln ==
+            OpenAPI_preemption_vulnerability_NOT_PREEMPTABLE)
+            qos.arp.pre_emption_vulnerability = OGS_5GC_PRE_EMPTION_DISABLED;
+        else if (qosFlowProfile->arp->preempt_vuln ==
+            OpenAPI_preemption_vulnerability_PREEMPTABLE)
+            qos.arp.pre_emption_vulnerability = OGS_5GC_PRE_EMPTION_ENABLED;
+        else {
+            ogs_error("Invalid preempt_vuln %d",
+                    qosFlowProfile->arp->preempt_vuln);
+            ogs_assert_if_reached();
+        }
+
         QosFlowSetupRequestItem =
             CALLOC(1, sizeof(struct NGAP_QosFlowSetupRequestItem));
         ogs_assert(QosFlowSetupRequestItem);
         ASN_SEQUENCE_ADD(&QosFlowSetupRequestList->list,
             QosFlowSetupRequestItem);
 
-        qosFlowIdentifier = &QosFlowSetupRequestItem->qosFlowIdentifier;
-        qosFlowLevelQosParameters =
-            &QosFlowSetupRequestItem->qosFlowLevelQosParameters;
-
-        allocationAndRetentionPriority =
-            &qosFlowLevelQosParameters->allocationAndRetentionPriority;
-        qosCharacteristics = &qosFlowLevelQosParameters->qosCharacteristics;
-        nonDynamic5QI = CALLOC(1, sizeof(struct NGAP_NonDynamic5QIDescriptor));
-        ogs_assert(nonDynamic5QI);
-        qosCharacteristics->choice.nonDynamic5QI = nonDynamic5QI;
-        qosCharacteristics->present = NGAP_QosCharacteristics_PR_nonDynamic5QI;
-
-        *qosFlowIdentifier = qos_flow->qfi;
-
-        nonDynamic5QI->fiveQI = qos_flow->qos.index;
-
-        allocationAndRetentionPriority->priorityLevelARP =
-            qos_flow->qos.arp.priority_level;
-        if (qos_flow->qos.arp.pre_emption_capability ==
-                OGS_5GC_PRE_EMPTION_ENABLED)
-            allocationAndRetentionPriority->pre_emptionCapability =
-                NGAP_Pre_emptionCapability_may_trigger_pre_emption;
-        if (qos_flow->qos.arp.pre_emption_vulnerability ==
-                OGS_5GC_PRE_EMPTION_ENABLED)
-            allocationAndRetentionPriority->pre_emptionVulnerability =
-                NGAP_Pre_emptionVulnerability_pre_emptable;
-
-        if (qos_flow->qos.mbr.downlink || qos_flow->qos.mbr.uplink ||
-            qos_flow->qos.gbr.downlink || qos_flow->qos.gbr.uplink) {
-
-            if (qos_flow->qos.mbr.downlink && qos_flow->qos.mbr.uplink &&
-                qos_flow->qos.gbr.downlink && qos_flow->qos.gbr.uplink) {
-
-                qosFlowLevelQosParameters->gBR_QosInformation =
-                    gBR_QosInformation = CALLOC(1, sizeof(*gBR_QosInformation));
-                ogs_assert(gBR_QosInformation);
-
-                asn_uint642INTEGER(&gBR_QosInformation->maximumFlowBitRateDL,
-                        qos_flow->qos.mbr.downlink);
-                asn_uint642INTEGER(&gBR_QosInformation->maximumFlowBitRateUL,
-                        qos_flow->qos.mbr.uplink);
-                asn_uint642INTEGER(&gBR_QosInformation->
-                        guaranteedFlowBitRateDL, qos_flow->qos.gbr.downlink);
-                asn_uint642INTEGER(&gBR_QosInformation->
-                        guaranteedFlowBitRateUL, qos_flow->qos.gbr.uplink);
-
-            } else {
-                ogs_error("Missing one or more MBR/GBR parameters; "
-                        "defaulting to Non-GBR flow ");
-                ogs_error("    MBRDL:%lld,UL:%lld",
-                    (long long)qos_flow->qos.mbr.downlink,
-                    (long long)qos_flow->qos.mbr.uplink);
-                ogs_error("    GBRDL:%lld,UL:%lld",
-                    (long long)qos_flow->qos.gbr.downlink,
-                    (long long)qos_flow->qos.gbr.uplink);
-            }
+        QosFlowSetupRequestItem->qosFlowIdentifier = qosFlowSetupItem->qfi;
+
+        fill_qos_level_parameters(
+                &QosFlowSetupRequestItem->qosFlowLevelQosParameters,
+                &qos, true);
+
+    } else {
+        ogs_list_for_each(&sess->bearer_list, qos_flow) {
+            QosFlowSetupRequestItem =
+                CALLOC(1, sizeof(struct NGAP_QosFlowSetupRequestItem));
+            ogs_assert(QosFlowSetupRequestItem);
+            ASN_SEQUENCE_ADD(&QosFlowSetupRequestList->list,
+                QosFlowSetupRequestItem);
+
+            QosFlowSetupRequestItem->qosFlowIdentifier = qos_flow->qfi;
+
+            fill_qos_level_parameters(
+                    &QosFlowSetupRequestItem->qosFlowLevelQosParameters,
+                    &qos_flow->qos, true);
         }
     }
 
@@ -295,7 +367,7 @@
 }
 
 ogs_pkbuf_t *ngap_build_pdu_session_resource_modify_request_transfer(
-        smf_sess_t *sess, bool qos_presence)
+        smf_sess_t *sess, bool include_gbr)
 {
     NGAP_PDUSessionResourceModifyRequestTransfer_t message;
 
@@ -303,12 +375,6 @@
 
     NGAP_QosFlowAddOrModifyRequestList_t *QosFlowAddOrModifyRequestList = NULL;
     NGAP_QosFlowAddOrModifyRequestItem_t *QosFlowAddOrModifyRequestItem = NULL;
-    NGAP_QosFlowIdentifier_t *qosFlowIdentifier = NULL;
-    NGAP_QosFlowLevelQosParameters_t *qosFlowLevelQosParameters = NULL;
-    NGAP_QosCharacteristics_t *qosCharacteristics = NULL;
-    NGAP_NonDynamic5QIDescriptor_t *nonDynamic5QI = NULL;
-    NGAP_AllocationAndRetentionPriority_t *allocationAndRetentionPriority;
-    NGAP_GBR_QosInformation_t *gBR_QosInformation;
 
     smf_bearer_t *qos_flow = NULL;
 
@@ -318,80 +384,126 @@
     memset(&message, 0, sizeof(NGAP_PDUSessionResourceModifyRequestTransfer_t));
 
     ie = CALLOC(1, sizeof(NGAP_PDUSessionResourceModifyRequestTransferIEs_t));
+    ogs_assert(ie);
     ASN_SEQUENCE_ADD(&message.protocolIEs, ie);
 
     ie->id = NGAP_ProtocolIE_ID_id_QosFlowAddOrModifyRequestList;
     ie->criticality = NGAP_Criticality_reject;
     ie->value.present = NGAP_PDUSessionResourceModifyRequestTransferIEs__value_PR_QosFlowAddOrModifyRequestList;
 
-    QosFlowAddOrModifyRequestList = &ie->value.choice.QosFlowAddOrModifyRequestList;
-
-    ogs_list_for_each_entry(
-            &sess->qos_flow_to_modify_list, qos_flow, to_modify_node) {
+    QosFlowAddOrModifyRequestList =
+        &ie->value.choice.QosFlowAddOrModifyRequestList;
 
-        QosFlowAddOrModifyRequestItem =
-            CALLOC(1, sizeof(*QosFlowAddOrModifyRequestItem));
-        ASN_SEQUENCE_ADD(&QosFlowAddOrModifyRequestList->list, QosFlowAddOrModifyRequestItem);
-
-        qosFlowIdentifier = &QosFlowAddOrModifyRequestItem->qosFlowIdentifier;
-
-        QosFlowAddOrModifyRequestItem->qosFlowLevelQosParameters =
-            qosFlowLevelQosParameters =
-                CALLOC(1, sizeof(*qosFlowLevelQosParameters));
-
-        allocationAndRetentionPriority =
-            &qosFlowLevelQosParameters->allocationAndRetentionPriority;
-        qosCharacteristics = &qosFlowLevelQosParameters->qosCharacteristics;
-
-        qosCharacteristics->present = NGAP_QosCharacteristics_PR_nonDynamic5QI;
-        qosCharacteristics->choice.nonDynamic5QI =
-            nonDynamic5QI = CALLOC(1, sizeof(struct NGAP_NonDynamic5QIDescriptor));
-
-        *qosFlowIdentifier = qos_flow->qfi;
-
-        nonDynamic5QI->fiveQI = qos_flow->qos.index;
-
-        allocationAndRetentionPriority->priorityLevelARP =
-            qos_flow->qos.arp.priority_level;
-        if (qos_flow->qos.arp.pre_emption_capability ==
-                OGS_5GC_PRE_EMPTION_ENABLED)
-            allocationAndRetentionPriority->pre_emptionCapability =
-                NGAP_Pre_emptionCapability_may_trigger_pre_emption;
-        if (qos_flow->qos.arp.pre_emption_vulnerability ==
-                OGS_5GC_PRE_EMPTION_ENABLED)
-            allocationAndRetentionPriority->pre_emptionVulnerability =
-                NGAP_Pre_emptionVulnerability_pre_emptable;
-
-        if (qos_presence == true &&
-            (qos_flow->qos.mbr.downlink || qos_flow->qos.mbr.uplink ||
-             qos_flow->qos.gbr.downlink || qos_flow->qos.gbr.uplink)) {
-
-            if (qos_flow->qos.mbr.downlink && qos_flow->qos.mbr.uplink &&
-                qos_flow->qos.gbr.downlink && qos_flow->qos.gbr.uplink) {
-
-                qosFlowLevelQosParameters->gBR_QosInformation =
-                    gBR_QosInformation = CALLOC(1, sizeof(*gBR_QosInformation));
-
-                asn_uint642INTEGER(&gBR_QosInformation->maximumFlowBitRateDL,
-                        qos_flow->qos.mbr.downlink);
-                asn_uint642INTEGER(&gBR_QosInformation->maximumFlowBitRateUL,
-                        qos_flow->qos.mbr.uplink);
-                asn_uint642INTEGER(&gBR_QosInformation->
-                        guaranteedFlowBitRateDL, qos_flow->qos.gbr.downlink);
-                asn_uint642INTEGER(&gBR_QosInformation->
-                        guaranteedFlowBitRateUL, qos_flow->qos.gbr.uplink);
-
-            } else {
-                ogs_error("Missing one or more MBR/GBR parameters; "
-                        "defaulting to Non-GBR flow ");
-                ogs_error("    MBRDL:%lld,UL:%lld",
-                    (long long)qos_flow->qos.mbr.downlink,
-                    (long long)qos_flow->qos.mbr.uplink);
-                ogs_error("    GBRDL:%lld,UL:%lld",
-                    (long long)qos_flow->qos.gbr.downlink,
-                    (long long)qos_flow->qos.gbr.uplink);
+    /* Home-Routed V-SMF: QoS flow */
+    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+        OpenAPI_lnode_t *node = NULL;
+        OpenAPI_list_for_each(
+                sess->h_smf_qos_flows_add_mod_request_list, node) {
+            OpenAPI_qos_flow_add_modify_request_item_t
+                *qosFlowAddModRequestItem = node->data;
+            if (qosFlowAddModRequestItem) {
+                OpenAPI_qos_flow_profile_t *qosFlowProfile =
+                    qosFlowAddModRequestItem->qos_flow_profile;
+                if (qosFlowProfile) {
+                    ogs_qos_t qos;
+
+                    memset(&qos, 0, sizeof(qos));
+
+                    qos.index = qosFlowProfile->_5qi;
+                    ogs_assert(qosFlowProfile->arp);
+                    qos.arp.priority_level =
+                        qosFlowProfile->arp->priority_level;
+                    if (qosFlowProfile->arp->preempt_cap ==
+                        OpenAPI_preemption_capability_NOT_PREEMPT)
+                        qos.arp.pre_emption_capability =
+                            OGS_5GC_PRE_EMPTION_DISABLED;
+                    else if (qosFlowProfile->arp->preempt_cap ==
+                        OpenAPI_preemption_capability_MAY_PREEMPT)
+                        qos.arp.pre_emption_capability =
+                            OGS_5GC_PRE_EMPTION_ENABLED;
+                    else {
+                        ogs_error("Invalid preempt_cap %d",
+                                qosFlowProfile->arp->preempt_cap);
+                        ogs_assert_if_reached();
+                    }
+
+                    if (qosFlowProfile->arp->preempt_vuln ==
+                        OpenAPI_preemption_vulnerability_NOT_PREEMPTABLE)
+                        qos.arp.pre_emption_vulnerability =
+                            OGS_5GC_PRE_EMPTION_DISABLED;
+                    else if (qosFlowProfile->arp->preempt_vuln ==
+                        OpenAPI_preemption_vulnerability_PREEMPTABLE)
+                        qos.arp.pre_emption_vulnerability =
+                            OGS_5GC_PRE_EMPTION_ENABLED;
+                    else {
+                        ogs_error("Invalid preempt_vuln %d",
+                                qosFlowProfile->arp->preempt_vuln);
+                        ogs_assert_if_reached();
+                    }
+
+                    if (qosFlowProfile->gbr_qos_flow_info) {
+                        OpenAPI_gbr_qos_flow_information_t *gbrQosFlowInfo =
+                                qosFlowProfile->gbr_qos_flow_info;
+                        if (gbrQosFlowInfo->max_fbr_dl)
+                            qos.mbr.downlink =
+                                ogs_sbi_bitrate_from_string(
+                                        gbrQosFlowInfo->max_fbr_dl);
+                        if (gbrQosFlowInfo->max_fbr_ul)
+                            qos.mbr.uplink =
+                                ogs_sbi_bitrate_from_string(
+                                        gbrQosFlowInfo->max_fbr_ul);
+                        if (gbrQosFlowInfo->gua_fbr_dl)
+                            qos.gbr.downlink =
+                                ogs_sbi_bitrate_from_string(
+                                        gbrQosFlowInfo->gua_fbr_dl);
+                        if (gbrQosFlowInfo->gua_fbr_ul)
+                            qos.gbr.uplink =
+                                ogs_sbi_bitrate_from_string(
+                                        gbrQosFlowInfo->gua_fbr_ul);
+                    }
+
+                    QosFlowAddOrModifyRequestItem =
+                        CALLOC(1, sizeof(*QosFlowAddOrModifyRequestItem));
+                    ogs_assert(QosFlowAddOrModifyRequestItem);
+                    ASN_SEQUENCE_ADD(
+                            &QosFlowAddOrModifyRequestList->list,
+                            QosFlowAddOrModifyRequestItem);
+
+                    QosFlowAddOrModifyRequestItem->qosFlowIdentifier =
+                        qosFlowAddModRequestItem->qfi;
+
+                    QosFlowAddOrModifyRequestItem->qosFlowLevelQosParameters =
+                            CALLOC(1, sizeof(NGAP_QosFlowLevelQosParameters_t));
+                    ogs_assert(QosFlowAddOrModifyRequestItem->
+                            qosFlowLevelQosParameters);
+
+                    fill_qos_level_parameters(
+                            QosFlowAddOrModifyRequestItem->
+                                qosFlowLevelQosParameters, &qos, true);
+                }
             }
         }
+
+    } else {
+        /* Default: iterate modify-list */
+        ogs_list_for_each_entry(&sess->qos_flow_to_modify_list,
+                                 qos_flow, to_modify_node) {
+            QosFlowAddOrModifyRequestItem =
+                CALLOC(1, sizeof(*QosFlowAddOrModifyRequestItem));
+            ogs_assert(QosFlowAddOrModifyRequestItem);
+            ASN_SEQUENCE_ADD(
+                    &QosFlowAddOrModifyRequestList->list,
+                    QosFlowAddOrModifyRequestItem);
+            QosFlowAddOrModifyRequestItem->qosFlowIdentifier = qos_flow->qfi;
+
+            QosFlowAddOrModifyRequestItem->qosFlowLevelQosParameters =
+                    CALLOC(1, sizeof(NGAP_QosFlowLevelQosParameters_t));
+            ogs_assert(
+                    QosFlowAddOrModifyRequestItem->qosFlowLevelQosParameters);
+            fill_qos_level_parameters(
+                    QosFlowAddOrModifyRequestItem->qosFlowLevelQosParameters,
+                    &qos_flow->qos, include_gbr);
+        }
     }
 
     return ogs_asn_encode(
@@ -426,20 +538,43 @@
 
     QosFlowListWithCause = &ie->value.choice.QosFlowListWithCause;
 
-    ogs_list_for_each_entry(
-            &sess->qos_flow_to_modify_list, qos_flow, to_modify_node) {
+    /* Home-Routed V-SMF: QoS flow */
+    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+        OpenAPI_lnode_t *node = NULL;
+        OpenAPI_list_for_each(sess->h_smf_qos_flows_rel_request_list, node) {
+            OpenAPI_qos_flow_release_request_item_t
+                *qosFlowRelRequestItem = node->data;
+            if (qosFlowRelRequestItem) {
+
+                QosFlowWithCauseItem = CALLOC(1, sizeof(*QosFlowWithCauseItem));
+                ASN_SEQUENCE_ADD(&QosFlowListWithCause->list,
+                        QosFlowWithCauseItem);
+
+                qosFlowIdentifier = &QosFlowWithCauseItem->qosFlowIdentifier;
+
+                *qosFlowIdentifier = qosFlowRelRequestItem->qfi;
+
+                Cause = &QosFlowWithCauseItem->cause;
+                Cause->present = group;
+                Cause->choice.radioNetwork = cause;
+            }
+        }
+    } else {
+        ogs_list_for_each_entry(
+                &sess->qos_flow_to_modify_list, qos_flow, to_modify_node) {
 
-        QosFlowWithCauseItem = CALLOC(1, sizeof(*QosFlowWithCauseItem));
-        ASN_SEQUENCE_ADD(&QosFlowListWithCause->list, QosFlowWithCauseItem);
+            QosFlowWithCauseItem = CALLOC(1, sizeof(*QosFlowWithCauseItem));
+            ASN_SEQUENCE_ADD(&QosFlowListWithCause->list, QosFlowWithCauseItem);
 
-        qosFlowIdentifier = &QosFlowWithCauseItem->qosFlowIdentifier;
+            qosFlowIdentifier = &QosFlowWithCauseItem->qosFlowIdentifier;
 
-        *qosFlowIdentifier = qos_flow->qfi;
+            *qosFlowIdentifier = qos_flow->qfi;
 
-        Cause = &QosFlowWithCauseItem->cause;
-        Cause->present = group;
-        Cause->choice.radioNetwork = cause;
+            Cause = &QosFlowWithCauseItem->cause;
+            Cause->present = group;
+            Cause->choice.radioNetwork = cause;
 
+        }
     }
 
     return ogs_asn_encode(
@@ -497,10 +632,10 @@
     UPTransportLayerInformation->choice.gTPTunnel = gTPTunnel;
 
     ogs_assert(OGS_OK == ogs_sockaddr_to_ip(
-                sess->upf_n3_addr, sess->upf_n3_addr6, &upf_n3_ip));
+                sess->local_ul_addr, sess->local_ul_addr6, &upf_n3_ip));
     ogs_assert(OGS_OK == ogs_asn_ip_to_BIT_STRING(
                 &upf_n3_ip, &gTPTunnel->transportLayerAddress));
-    ogs_asn_uint32_to_OCTET_STRING(sess->upf_n3_teid, &gTPTunnel->gTP_TEID);
+    ogs_asn_uint32_to_OCTET_STRING(sess->local_ul_teid, &gTPTunnel->gTP_TEID);
 
 #endif
 
@@ -512,7 +647,7 @@
 {
     NGAP_HandoverCommandTransfer_t message;
 
-    ogs_ip_t upf_dl_ip;
+    ogs_ip_t local_dl_ip;
 
     ogs_assert(sess);
 
@@ -538,12 +673,12 @@
         ogs_assert(gTPTunnel);
 
         ogs_assert(OGS_OK == ogs_sockaddr_to_ip(
-                sess->handover.upf_dl_addr, sess->handover.upf_dl_addr6,
-                &upf_dl_ip));
+                sess->handover.local_dl_addr, sess->handover.local_dl_addr6,
+                &local_dl_ip));
         ogs_assert(OGS_OK == ogs_asn_ip_to_BIT_STRING(
-                    &upf_dl_ip, &gTPTunnel->transportLayerAddress));
+                    &local_dl_ip, &gTPTunnel->transportLayerAddress));
         ogs_asn_uint32_to_OCTET_STRING(
-                sess->handover.upf_dl_teid, &gTPTunnel->gTP_TEID);
+                sess->handover.local_dl_teid, &gTPTunnel->gTP_TEID);
 
         ogs_list_for_each(&sess->pfcp.pdr_list, pdr) {
             ogs_pfcp_far_t *far = pdr->far;

open5gs_2.7.6.tar.xz/src/smf/ngap-build.h -> open5gs_2.7.7.tar.xz/src/smf/ngap-build.h Changed

open5gs_2.7.6.tar.xz/src/smf/ngap-handler.c -> open5gs_2.7.7.tar.xz/src/smf/ngap-handler.c Changed

@@ -26,10 +26,12 @@
         smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_pkbuf_t *pkbuf)
 {
     smf_ue_t *smf_ue = NULL;
-    int rv, i;
+    smf_bearer_t *qos_flow = NULL;
 
-    uint32_t gnb_n3_teid;
-    ogs_ip_t gnb_n3_ip;
+    int rv, i, r;
+
+    uint32_t remote_dl_teid;
+    ogs_ip_t remote_dl_ip;
 
     bool far_update = false;
 
@@ -92,7 +94,7 @@
     }
 
     rv = ogs_asn_BIT_STRING_to_ip(
-            &gTPTunnel->transportLayerAddress, &gnb_n3_ip);
+            &gTPTunnel->transportLayerAddress, &remote_dl_ip);
     if (rv != OGS_OK) {
         ogs_error("%s:%d No transportLayerAddress", smf_ue->supi, sess->psi);
         smf_sbi_send_sm_context_update_error_log(
@@ -100,67 +102,150 @@
                 "No transportLayerAddress", smf_ue->supi);
         goto cleanup;
     }
-    ogs_asn_OCTET_STRING_to_uint32(&gTPTunnel->gTP_TEID, &gnb_n3_teid);
+    if (!remote_dl_ip.ipv4 && !remote_dl_ip.ipv6) {
+        ogs_error("%s:%d Invalid GTP Tunnel IP (IPv4/IPv6 all zero)",
+                smf_ue->supi, sess->psi);
+        smf_sbi_send_sm_context_update_error_log(
+                stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                "Invalid GTP Tunnel IP (IPv4/IPv6 all zero)", smf_ue->supi);
+        goto cleanup;
+    }
+
+    ogs_asn_OCTET_STRING_to_uint32(&gTPTunnel->gTP_TEID, &remote_dl_teid);
 
     /* Need to Update? */
-    if (memcmp(&sess->gnb_n3_ip, &gnb_n3_ip, sizeof(sess->gnb_n3_ip)) != 0 ||
-        sess->gnb_n3_teid != gnb_n3_teid)
+    if (memcmp(&sess->remote_dl_ip,
+                &remote_dl_ip, sizeof(sess->remote_dl_ip)) != 0 ||
+        sess->remote_dl_teid != remote_dl_teid)
         far_update = true;
 
     /* Setup FAR */
-    memcpy(&sess->gnb_n3_ip, &gnb_n3_ip, sizeof(sess->gnb_n3_ip));
-    sess->gnb_n3_teid = gnb_n3_teid;
+    memcpy(&sess->remote_dl_ip, &remote_dl_ip, sizeof(sess->remote_dl_ip));
+    sess->remote_dl_teid = remote_dl_teid;
 
-    associatedQosFlowList = &dLQosFlowPerTNLInformation->associatedQosFlowList;
-    for (i = 0; i < associatedQosFlowList->list.count; i++) {
-        NGAP_AssociatedQosFlowItem_t *associatedQosFlowItem = NULL;
-        associatedQosFlowItem = (NGAP_AssociatedQosFlowItem_t *)
-                associatedQosFlowList->list.arrayi;
-
-        if (associatedQosFlowItem) {
-            smf_bearer_t *qos_flow = smf_qos_flow_find_by_qfi(
-                    sess, associatedQosFlowItem->qosFlowIdentifier);
-
-            if (qos_flow) {
-                ogs_pfcp_far_t *dl_far = qos_flow->dl_far;
-                ogs_assert(dl_far);
-                if (dl_far->apply_action != OGS_PFCP_APPLY_ACTION_FORW) {
-                    far_update = true;
-                }
+    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+        ogs_list_for_each(&sess->bearer_list, qos_flow) {
+            ogs_pfcp_far_t *dl_far = qos_flow->dl_far;
+            ogs_assert(dl_far);
+            if (dl_far->apply_action != OGS_PFCP_APPLY_ACTION_FORW) {
+                far_update = true;
+            }
 
-                dl_far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
-                ogs_assert(OGS_OK ==
-                    ogs_pfcp_ip_to_outer_header_creation(
-                            &sess->gnb_n3_ip,
-                            &dl_far->outer_header_creation,
-                            &dl_far->outer_header_creation_len));
-                dl_far->outer_header_creation.teid = sess->gnb_n3_teid;
-            } else {
-                ogs_error("%s:%d No QoS flow", smf_ue->supi, sess->psi);
-                smf_sbi_send_sm_context_update_error_log(
-                        stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
-                        "No QoS flow", smf_ue->supi);
-                goto cleanup;
+            dl_far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
+            ogs_assert(OGS_OK ==
+                ogs_pfcp_ip_to_outer_header_creation(
+                        &sess->remote_dl_ip,
+                        &dl_far->outer_header_creation,
+                        &dl_far->outer_header_creation_len));
+            dl_far->outer_header_creation.teid = sess->remote_dl_teid;
+        }
+    } else {
+        associatedQosFlowList =
+            &dLQosFlowPerTNLInformation->associatedQosFlowList;
+        for (i = 0; i < associatedQosFlowList->list.count; i++) {
+            NGAP_AssociatedQosFlowItem_t *associatedQosFlowItem = NULL;
+            associatedQosFlowItem = (NGAP_AssociatedQosFlowItem_t *)
+                    associatedQosFlowList->list.arrayi;
+
+            if (associatedQosFlowItem) {
+                qos_flow = smf_qos_flow_find_by_qfi(
+                        sess, associatedQosFlowItem->qosFlowIdentifier);
+
+                if (qos_flow) {
+                    ogs_pfcp_far_t *dl_far = qos_flow->dl_far;
+                    ogs_assert(dl_far);
+                    if (dl_far->apply_action != OGS_PFCP_APPLY_ACTION_FORW) {
+                        far_update = true;
+                    }
+
+                    dl_far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
+                    ogs_assert(OGS_OK ==
+                        ogs_pfcp_ip_to_outer_header_creation(
+                                &sess->remote_dl_ip,
+                                &dl_far->outer_header_creation,
+                                &dl_far->outer_header_creation_len));
+                    dl_far->outer_header_creation.teid = sess->remote_dl_teid;
+                }
             }
         }
     }
 
     if (far_update) {
+        uint64_t pfcp_flags = OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE;
+    /*
+     * UE-requested PDU Session Modification(ACTIVATED)
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_DL_ONLY|
+     *        OGS_PFCP_MODIFY_OUTER_HEADER_REMOVAL|OGS_PFCP_MODIFY_ACTIVATE
+     * 2.  V*: if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING)
+     *            pfcp_flags |= OGS_PFCP_MODIFY_FROM_ACTIVATING;
+     * 3.  V: flags & OGS_PFCP_MODIFY_FROM_ACTIVATING ?
+     *           SMF_UPDATE_STATE_HR_ACTIVATED_FROM_ACTIVATING :
+     *           SMF_UPDATE_STATE_HR_ACTIVATED_FROM_NON_ACTIVATING,
+     * 4.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 5.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 6.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 7.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 8.  H: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_DL_ONLY|
+     *        OGS_PFCP_MODIFY_ACTIVATE
+     * 9.  H: ogs_sbi_send_http_status_no_content
+     * 10. V: case SMF_UPDATE_STATE_HR_ACTIVATED_FROM_ACTIVATING:
+     *           sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+     *           smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *               OpenAPI_up_cnx_state_ACTIVATED);
+     *        case SMF_UPDATE_STATE_HR_ACTIVATED_FROM_NON_ACTIVATING:
+     *           ogs_sbi_send_http_status_no_content
+     */
+        if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+            pfcp_flags |= OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING;
+            pfcp_flags |= OGS_PFCP_MODIFY_OUTER_HEADER_REMOVAL;
+
+            if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING)
+                pfcp_flags |= OGS_PFCP_MODIFY_FROM_ACTIVATING;
+        }
+
         ogs_assert(OGS_OK ==
             smf_5gc_pfcp_send_all_pdr_modification_request(
-                sess, stream, OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE,
-                0));
+                sess, stream, pfcp_flags, 0, 0));
     } else {
 #if 0 /* Modified by pull request #1729 */
         /* ACTIVATED Is NOT Included in RESPONSE */
         ogs_assert(true == ogs_sbi_send_http_status_no_content(stream));
 #else
-        if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING) {
-            sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
-            smf_sbi_send_sm_context_updated_data_up_cnx_state(
-                    sess, stream, OpenAPI_up_cnx_state_ACTIVATED);
+        if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+            sess->nsmf_param.request_indication =
+                OpenAPI_request_indication_UE_REQ_PDU_SES_MOD;
+
+            sess->nsmf_param.up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+
+            sess->nsmf_param.serving_network = true;
+
+            ogs_assert(OGS_OK ==
+                    ogs_sockaddr_to_ip(
+                        sess->local_dl_addr, sess->local_dl_addr6,
+                        &sess->nsmf_param.dl_ip));
+            sess->nsmf_param.dl_teid = sess->local_dl_teid;
+
+            sess->nsmf_param.an_type = sess->an_type;
+            sess->nsmf_param.rat_type = sess->sbi_rat_type;
+
+            r = smf_sbi_discover_and_send(
+                    OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                    smf_nsmf_pdusession_build_hsmf_update_data, sess, stream,
+                    sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING ?
+                        SMF_UPDATE_STATE_ACTIVATED_FROM_ACTIVATING :
+                        SMF_UPDATE_STATE_ACTIVATED_FROM_NON_ACTIVATING,
+                    NULL);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
         } else {
-            ogs_assert(true == ogs_sbi_send_http_status_no_content(stream));
+            if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING) {
+                sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+                smf_sbi_send_sm_context_updated_data_up_cnx_state(
+                        sess, stream, OpenAPI_up_cnx_state_ACTIVATED);
+            } else {
+                ogs_assert(true == ogs_sbi_send_http_status_no_content(stream));
+            }
         }
 #endif
     }
@@ -176,7 +261,7 @@
         smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_pkbuf_t *pkbuf)
 {
     smf_ue_t *smf_ue = NULL;
-    int rv;
+    int r, rv;
 
     NGAP_PDUSessionResourceSetupUnsuccessfulTransfer_t message;
     NGAP_Cause_t *Cause = NULL;
@@ -216,6 +301,40 @@
                 Cause->present, (int)Cause->choice.radioNetwork);
     }
 
+    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+    /*
+     * UE-requested PDU Session Modification(DEACTIVATED)
+     *
+     * For Home Routed Roaming, delegate PFCP deactivation to H-SMF by
+     * sending UP_CNX_STATE=DEACTIVATED via HsmfUpdateData.
+     *
+     * 1.  V*: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 2.  V*: smf_nsmf_pdusession_build_hsmf_update_data
+     *         SMF_UPDATE_STATE_HR_DEACTIVATED
+     * 3.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 4.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 5.  H: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_DL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 6.  H: ogs_sbi_send_http_status_no_content
+     * 7.  V: case SMF_UPDATE_STATE_HR_DEACTIVATED:
+     * 8.  V: smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *          OpenAPI_up_cnx_state_DEACTIVATED)
+     */
+        sess->nsmf_param.request_indication =
+            OpenAPI_request_indication_UE_REQ_PDU_SES_MOD;
+
+        sess->nsmf_param.up_cnx_state = OpenAPI_up_cnx_state_DEACTIVATED;
+
+        sess->nsmf_param.ngap_cause.group = Cause->present;
+        sess->nsmf_param.ngap_cause.value = (int)Cause->choice.radioNetwork;
+
+        r = smf_sbi_discover_and_send(
+                OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                smf_nsmf_pdusession_build_hsmf_update_data,
+                sess, stream, SMF_UPDATE_STATE_DEACTIVATED, NULL);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+    } else {
     /*
      * TS23.502
      * 4.2.3 Service Request procedures
@@ -255,11 +374,11 @@
      *   has failed and set the upCnxState attribute to DEACTIVATED"
      *   otherwise.
      */
-
-    ogs_assert(OGS_OK ==
-        smf_5gc_pfcp_send_all_pdr_modification_request(
-            sess, stream,
-            OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_DEACTIVATE, 0));
+        ogs_assert(OGS_OK ==
+            smf_5gc_pfcp_send_all_pdr_modification_request(
+                sess, stream,
+                OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_DEACTIVATE, 0, 0));
+    }
 
     rv = OGS_OK;
 cleanup:
@@ -304,6 +423,21 @@
 
     rv = OGS_ERROR;
 
+    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+        /* Home Routed Roaming */
+        rv = OGS_OK;
+
+        if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING) {
+            sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+            smf_sbi_send_sm_context_updated_data_up_cnx_state(
+                    sess, stream, OpenAPI_up_cnx_state_ACTIVATED);
+        } else {
+            ogs_assert(true == ogs_sbi_send_http_status_no_content(stream));
+        }
+
+        goto cleanup;
+    }
+
     qosFlowAddOrModifyResponseList = message.qosFlowAddOrModifyResponseList;
     if (!qosFlowAddOrModifyResponseList) {
         /* QosFlow Release */
@@ -334,10 +468,10 @@
                     dl_far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
                     ogs_assert(OGS_OK ==
                         ogs_pfcp_ip_to_outer_header_creation(
-                            &sess->gnb_n3_ip,
+                            &sess->remote_dl_ip,
                             &dl_far->outer_header_creation,
                             &dl_far->outer_header_creation_len));
-                    dl_far->outer_header_creation.teid = sess->gnb_n3_teid;
+                    dl_far->outer_header_creation.teid = sess->remote_dl_teid;
 
                     ogs_list_add(&sess->qos_flow_to_modify_list,
                                     &qos_flow->to_modify_node);
@@ -371,10 +505,11 @@
         smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_pkbuf_t *pkbuf)
 {
     smf_ue_t *smf_ue = NULL;
-    int rv, i;
+    smf_bearer_t *qos_flow = NULL;
+    int r, rv, i;
 
-    uint32_t gnb_n3_teid;
-    ogs_ip_t gnb_n3_ip;
+    uint32_t remote_dl_teid;
+    ogs_ip_t remote_dl_ip;
 
     bool far_update = false;
 
@@ -430,7 +565,7 @@
     }
 
     rv = ogs_asn_BIT_STRING_to_ip(
-            &gTPTunnel->transportLayerAddress, &gnb_n3_ip);
+            &gTPTunnel->transportLayerAddress, &remote_dl_ip);
     if (rv != OGS_OK) {
         ogs_error("%s:%d No transportLayerAddress", smf_ue->supi, sess->psi);
         smf_sbi_send_sm_context_update_error_log(
@@ -438,63 +573,115 @@
                 "No transportLayerAddress", smf_ue->supi);
         goto cleanup;
     }
-    ogs_asn_OCTET_STRING_to_uint32(&gTPTunnel->gTP_TEID, &gnb_n3_teid);
+    if (!remote_dl_ip.ipv4 && !remote_dl_ip.ipv6) {
+        ogs_error("%s:%d Invalid GTP Tunnel IP (IPv4/IPv6 all zero)",
+                smf_ue->supi, sess->psi);
+        smf_sbi_send_sm_context_update_error_log(
+                stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                "Invalid GTP Tunnel IP (IPv4/IPv6 all zero)", smf_ue->supi);
+        goto cleanup;
+    }
+    ogs_asn_OCTET_STRING_to_uint32(&gTPTunnel->gTP_TEID, &remote_dl_teid);
 
     /* Need to Update? */
-    if (memcmp(&sess->gnb_n3_ip, &gnb_n3_ip, sizeof(sess->gnb_n3_ip)) != 0 ||
-        sess->gnb_n3_teid != gnb_n3_teid)
+    if (memcmp(&sess->remote_dl_ip, &remote_dl_ip, sizeof(sess->remote_dl_ip)) != 0 ||
+        sess->remote_dl_teid != remote_dl_teid)
         far_update = true;
 
     /* Setup FAR */
-    memcpy(&sess->gnb_n3_ip, &gnb_n3_ip, sizeof(sess->gnb_n3_ip));
-    sess->gnb_n3_teid = gnb_n3_teid;
+    memcpy(&sess->remote_dl_ip, &remote_dl_ip, sizeof(sess->remote_dl_ip));
+    sess->remote_dl_teid = remote_dl_teid;
 
-    qosFlowAcceptedList = &message.qosFlowAcceptedList;
-    for (i = 0; i < qosFlowAcceptedList->list.count; i++) {
-        acceptedQosFlowItem = (NGAP_QosFlowAcceptedItem_t *)
-                qosFlowAcceptedList->list.arrayi;
-        if (acceptedQosFlowItem) {
-            smf_bearer_t *qos_flow = smf_qos_flow_find_by_qfi(
-                    sess, acceptedQosFlowItem->qosFlowIdentifier);
-
-            if (qos_flow) {
-                ogs_pfcp_far_t *dl_far = qos_flow->dl_far;
-                ogs_assert(dl_far);
-                if (dl_far->apply_action != OGS_PFCP_APPLY_ACTION_FORW) {
-                    far_update = true;
-                }
+    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+        ogs_list_for_each(&sess->bearer_list, qos_flow) {
+            ogs_pfcp_far_t *dl_far = qos_flow->dl_far;
+            ogs_assert(dl_far);
+            if (dl_far->apply_action != OGS_PFCP_APPLY_ACTION_FORW) {
+                far_update = true;
+            }
 
-                dl_far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
-                ogs_assert(OGS_OK ==
-                    ogs_pfcp_ip_to_outer_header_creation(
-                        &sess->gnb_n3_ip,
+            dl_far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
+            ogs_assert(OGS_OK ==
+                ogs_pfcp_ip_to_outer_header_creation(
+                        &sess->remote_dl_ip,
                         &dl_far->outer_header_creation,
                         &dl_far->outer_header_creation_len));
-                dl_far->outer_header_creation.teid = sess->gnb_n3_teid;
-            } else {
-                ogs_error("%s:%d No QoS flow", smf_ue->supi, sess->psi);
-                smf_sbi_send_sm_context_update_error_log(
-                        stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
-                        "No QoS flow", smf_ue->supi);
-                goto cleanup;
+            dl_far->outer_header_creation.teid = sess->remote_dl_teid;
+        }
+    } else {
+        qosFlowAcceptedList = &message.qosFlowAcceptedList;
+        for (i = 0; i < qosFlowAcceptedList->list.count; i++) {
+            acceptedQosFlowItem = (NGAP_QosFlowAcceptedItem_t *)
+                    qosFlowAcceptedList->list.arrayi;
+            if (acceptedQosFlowItem) {
+                smf_bearer_t *qos_flow = smf_qos_flow_find_by_qfi(
+                        sess, acceptedQosFlowItem->qosFlowIdentifier);
+
+                if (qos_flow) {
+                    ogs_pfcp_far_t *dl_far = qos_flow->dl_far;
+                    ogs_assert(dl_far);
+                    if (dl_far->apply_action != OGS_PFCP_APPLY_ACTION_FORW) {
+                        far_update = true;
+                    }
+
+                    dl_far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
+                    ogs_assert(OGS_OK ==
+                        ogs_pfcp_ip_to_outer_header_creation(
+                            &sess->remote_dl_ip,
+                            &dl_far->outer_header_creation,
+                            &dl_far->outer_header_creation_len));
+                    dl_far->outer_header_creation.teid = sess->remote_dl_teid;
+                }
             }
         }
     }
 
     if (far_update) {
+        uint64_t pfcp_flags =
+            OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE|
+            OGS_PFCP_MODIFY_XN_HANDOVER|OGS_PFCP_MODIFY_END_MARKER;
+
+        if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+            pfcp_flags |= OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING;
+            pfcp_flags |= OGS_PFCP_MODIFY_OUTER_HEADER_REMOVAL;
+        }
+
         ogs_assert(OGS_OK ==
             smf_5gc_pfcp_send_all_pdr_modification_request(
-                sess, stream,
-                OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE|
-                OGS_PFCP_MODIFY_XN_HANDOVER|OGS_PFCP_MODIFY_END_MARKER,
-                0));
+                sess, stream, pfcp_flags, 0, 0));
     } else {
-        ogs_pkbuf_t *n2smbuf =
-            ngap_build_path_switch_request_ack_transfer(sess);
-        ogs_assert(n2smbuf);
+        if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+            sess->nsmf_param.request_indication =
+                OpenAPI_request_indication_UE_REQ_PDU_SES_MOD;
+
+            sess->nsmf_param.up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+
+            sess->nsmf_param.serving_network = true;
 
-        smf_sbi_send_sm_context_updated_data_n2smbuf(sess, stream,
-            OpenAPI_n2_sm_info_type_PATH_SWITCH_REQ_ACK, n2smbuf);
+            ogs_assert(OGS_OK ==
+                    ogs_sockaddr_to_ip(
+                        sess->local_dl_addr, sess->local_dl_addr6,
+                        &sess->nsmf_param.dl_ip));
+            sess->nsmf_param.dl_teid = sess->local_dl_teid;
+
+            sess->nsmf_param.an_type = sess->an_type;
+            sess->nsmf_param.rat_type = sess->sbi_rat_type;
+
+            r = smf_sbi_discover_and_send(
+                    OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                    smf_nsmf_pdusession_build_hsmf_update_data, sess, stream,
+                    SMF_UPDATE_STATE_ACTIVATED_FROM_XN_HANDOVER,
+                    NULL);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+        } else {
+            ogs_pkbuf_t *n2smbuf =
+                ngap_build_path_switch_request_ack_transfer(sess);
+            ogs_assert(n2smbuf);
+
+            smf_sbi_send_sm_context_updated_data_n2smbuf(sess, stream,
+                OpenAPI_n2_sm_info_type_PATH_SWITCH_REQ_ACK, n2smbuf);
+        }
     }
 
     rv = OGS_OK;
@@ -559,7 +746,9 @@
         smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_pkbuf_t *pkbuf)
 {
     smf_ue_t *smf_ue = NULL;
+    smf_bearer_t *qos_flow = NULL;
     int rv, i;
+    ogs_ip_t remote_dl_ip;
 
     NGAP_HandoverRequestAcknowledgeTransfer_t message;
 
@@ -613,7 +802,7 @@
     }
 
     rv = ogs_asn_BIT_STRING_to_ip(&gTPTunnel->transportLayerAddress,
-            &sess->handover.gnb_n3_ip);
+            &remote_dl_ip);
     if (rv != OGS_OK) {
         ogs_error("%s:%d No transportLayerAddress", smf_ue->supi, sess->psi);
         smf_sbi_send_sm_context_update_error_log(
@@ -621,29 +810,41 @@
                 "No transportLayerAddress", smf_ue->supi);
         goto cleanup;
     }
+    if (!remote_dl_ip.ipv4 && !remote_dl_ip.ipv6) {
+        ogs_error("%s:%d Invalid GTP Tunnel IP (IPv4/IPv6 all zero)",
+                smf_ue->supi, sess->psi);
+        smf_sbi_send_sm_context_update_error_log(
+                stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                "Invalid GTP Tunnel IP (IPv4/IPv6 all zero)", smf_ue->supi);
+        goto cleanup;
+    }
+    memcpy(&sess->handover.remote_dl_ip, &remote_dl_ip,
+            sizeof(sess->handover.remote_dl_ip));
     ogs_asn_OCTET_STRING_to_uint32(&gTPTunnel->gTP_TEID,
-            &sess->handover.gnb_n3_teid);
+            &sess->handover.remote_dl_teid);
 
-    qosFlowSetupResponseList = &message.qosFlowSetupResponseList;
-    for (i = 0; i < qosFlowSetupResponseList->list.count; i++) {
-        qosFlowSetupResponseItem = (NGAP_QosFlowItemWithDataForwarding_t *)
-                qosFlowSetupResponseList->list.arrayi;
-        if (qosFlowSetupResponseItem) {
-            smf_bearer_t *qos_flow = smf_qos_flow_find_by_qfi(
-                    sess, qosFlowSetupResponseItem->qosFlowIdentifier);
-
-            if (qos_flow) {
-                ogs_pfcp_far_t *dl_far = qos_flow->dl_far;
-                ogs_assert(dl_far);
+    if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+        ogs_list_for_each(&sess->bearer_list, qos_flow) {
+            ogs_pfcp_far_t *dl_far = qos_flow->dl_far;
+            ogs_assert(dl_far);
 
-                dl_far->handover.prepared = true;
+            dl_far->handover.prepared = true;
+        }
+    } else {
+        qosFlowSetupResponseList = &message.qosFlowSetupResponseList;
+        for (i = 0; i < qosFlowSetupResponseList->list.count; i++) {
+            qosFlowSetupResponseItem = (NGAP_QosFlowItemWithDataForwarding_t *)
+                    qosFlowSetupResponseList->list.arrayi;
+            if (qosFlowSetupResponseItem) {
+                smf_bearer_t *qos_flow = smf_qos_flow_find_by_qfi(
+                        sess, qosFlowSetupResponseItem->qosFlowIdentifier);
 
-            } else {
-                ogs_error("%s:%d No QoS flow", smf_ue->supi, sess->psi);
-                smf_sbi_send_sm_context_update_error_log(
-                        stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
-                        "No QoS flow", smf_ue->supi);
-                goto cleanup;
+                if (qos_flow) {
+                    ogs_pfcp_far_t *dl_far = qos_flow->dl_far;
+                    ogs_assert(dl_far);
+
+                    dl_far->handover.prepared = true;
+                }
             }
         }
     }
@@ -672,7 +873,7 @@
         }
 
         rv = ogs_asn_BIT_STRING_to_ip(&gTPTunnel->transportLayerAddress,
-                &sess->handover.gnb_dl_ip);
+                &remote_dl_ip);
         if (rv != OGS_OK) {
             ogs_error("%s:%d No transportLayerAddress",
                     smf_ue->supi, sess->psi);
@@ -681,8 +882,18 @@
                     "No transportLayerAddress", smf_ue->supi);
             goto cleanup;
         }
+        if (!remote_dl_ip.ipv4 && !remote_dl_ip.ipv6) {
+            ogs_error("%s:%d Invalid GTP Tunnel IP (IPv4/IPv6 all zero)",
+                    smf_ue->supi, sess->psi);
+            smf_sbi_send_sm_context_update_error_log(
+                    stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                    "Invalid GTP Tunnel IP (IPv4/IPv6 all zero)", smf_ue->supi);
+            goto cleanup;
+        }
+        memcpy(&sess->handover.remote_dl_ip, &remote_dl_ip,
+                sizeof(sess->handover.remote_dl_ip));
         ogs_asn_OCTET_STRING_to_uint32(&gTPTunnel->gTP_TEID,
-                &sess->handover.gnb_dl_teid);
+                &sess->handover.remote_dl_teid);
 
         sess->handover.indirect_data_forwarding = true;
     }
@@ -711,7 +922,7 @@
                      * ...
                      */
                     OGS_PFCP_MODIFY_REMOVE|OGS_PFCP_MODIFY_CREATE,
-                    0));
+                    0, 0));
         } else {
 
             smf_sess_create_indirect_data_forwarding(sess);
@@ -720,7 +931,7 @@
                 smf_5gc_pfcp_send_all_pdr_modification_request(
                     sess, stream,
                     OGS_PFCP_MODIFY_INDIRECT|OGS_PFCP_MODIFY_CREATE,
-                    0));
+                    0, 0));
         }
     } else {
         ogs_pkbuf_t *n2smbuf = ngap_build_handover_command_transfer(sess);

open5gs_2.7.6.tar.xz/src/smf/npcf-build.c -> open5gs_2.7.7.tar.xz/src/smf/npcf-build.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019,2020 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -115,17 +115,16 @@
      * and Operator Identifier, or a DNN with the Network Identifier only
      */
     if (ogs_sbi_supi_in_vplmn(smf_ue->supi) == true) {
-        char *home_network_domain = NULL;
+        char *dnn_oi = NULL;
 
-        home_network_domain =
-            ogs_home_network_domain_from_plmn_id(&sess->home_plmn_id);
-        ogs_assert(home_network_domain);
+        dnn_oi = ogs_dnn_oi_from_plmn_id(&sess->home_plmn_id);
+        ogs_assert(dnn_oi);
 
         SmPolicyContextData.dnn =
-            ogs_msprintf("%s.%s", sess->session.name, home_network_domain);
+            ogs_msprintf("%s.%s", sess->session.name, dnn_oi);
         ogs_assert(SmPolicyContextData.dnn);
 
-        ogs_free(home_network_domain);
+        ogs_free(dnn_oi);
 
     } else {
         SmPolicyContextData.dnn = ogs_strdup(sess->session.name);
@@ -165,12 +164,9 @@
         ogs_error("ueLocation.nr_location");
         goto end;
     }
-    ueLocation.nr_location->ue_location_timestamp =
-        ogs_sbi_gmtime_string(sess->ue_location_timestamp);
-    if (!ueLocation.nr_location->ue_location_timestamp) {
-        ogs_error("ueLocation.nr_location->ue_location_timestamp");
-        goto end;
-    }
+    if (sess->ue_location_timestamp)
+        ueLocation.nr_location->ue_location_timestamp =
+            ogs_sbi_gmtime_string(sess->ue_location_timestamp);
 
     SmPolicyContextData.user_location_info = &ueLocation;
 
@@ -327,8 +323,6 @@
 ogs_sbi_request_t *smf_npcf_smpolicycontrol_build_delete(
         smf_sess_t *sess, void *data)
 {
-    smf_npcf_smpolicycontrol_param_t *param = data;
-
     smf_ue_t *smf_ue = NULL;
 
     ogs_sbi_message_t message;
@@ -356,70 +350,69 @@
 
     memset(&ueLocation, 0, sizeof(ueLocation));
 
-    if (param) {
-        if (param->ran_nas_release.gmm_cause ||
-            param->ran_nas_release.gsm_cause ||
-            param->ran_nas_release.ngap_cause.group) {
-
-            ranNasRelCauseList = OpenAPI_list_create();
-            if (!ranNasRelCauseList) {
-                ogs_error("No ranNasRelCauseList");
-                goto end;
-            }
-
-            ranNasRelCause = ogs_calloc(1, sizeof(*ranNasRelCause));
-            if (!ranNasRelCause) {
-                ogs_error("No ranNasRelCause");
-                goto end;
-            }
+    if (sess->nsmf_param.gmm_cause ||
+        sess->nsmf_param.gsm_cause ||
+        sess->nsmf_param.ngap_cause.group) {
+
+        ranNasRelCauseList = OpenAPI_list_create();
+        if (!ranNasRelCauseList) {
+            ogs_error("No ranNasRelCauseList");
+            goto end;
+        }
 
-            if (param->ran_nas_release.ngap_cause.group) {
-                OpenAPI_ng_ap_cause_t *ngApCause = NULL;
+        ranNasRelCause = ogs_calloc(1, sizeof(*ranNasRelCause));
+        if (!ranNasRelCause) {
+            ogs_error("No ranNasRelCause");
+            goto end;
+        }
 
-                ranNasRelCause->ng_ap_cause = ngApCause =
-                    ogs_calloc(1, sizeof(*ngApCause));
-                if (!ranNasRelCause->ng_ap_cause) {
-                    ogs_error("No ranNasRelCause->ng_ap_cause");
-                    if (ranNasRelCause)
-                        ogs_free(ranNasRelCause);
-                    goto end;
-                }
+        if (sess->nsmf_param.ngap_cause.group) {
+            OpenAPI_ng_ap_cause_t *ngApCause = NULL;
 
-                ngApCause->group = param->ran_nas_release.ngap_cause.group;
-                ngApCause->value = param->ran_nas_release.ngap_cause.value;
+            ranNasRelCause->ng_ap_cause = ngApCause =
+                ogs_calloc(1, sizeof(*ngApCause));
+            if (!ranNasRelCause->ng_ap_cause) {
+                ogs_error("No ranNasRelCause->ng_ap_cause");
+                if (ranNasRelCause)
+                    ogs_free(ranNasRelCause);
+                goto end;
             }
 
+            ngApCause->group = sess->nsmf_param.ngap_cause.group;
+            ngApCause->value = sess->nsmf_param.ngap_cause.value;
+        }
+
+        if (sess->nsmf_param.gmm_cause) {
             ranNasRelCause->is__5g_mm_cause = true;
-            ranNasRelCause->_5g_mm_cause = param->ran_nas_release.gmm_cause;
+            ranNasRelCause->_5g_mm_cause = sess->nsmf_param.gmm_cause;
+        }
+        if (sess->nsmf_param.gsm_cause) {
             ranNasRelCause->is__5g_sm_cause = true;
-            ranNasRelCause->_5g_sm_cause = param->ran_nas_release.gsm_cause;
-
-            OpenAPI_list_add(ranNasRelCauseList, ranNasRelCause);
+            ranNasRelCause->_5g_sm_cause = sess->nsmf_param.gsm_cause;
         }
 
-        if (param->ue_location) {
-            ueLocation.nr_location = ogs_sbi_build_nr_location(
-                    &sess->nr_tai, &sess->nr_cgi);
-            if (!ueLocation.nr_location) {
-                ogs_error("ueLocation.nr_location");
-                goto end;
-            }
+        OpenAPI_list_add(ranNasRelCauseList, ranNasRelCause);
+    }
+
+    if (sess->nsmf_param.ue_location) {
+        ueLocation.nr_location = ogs_sbi_build_nr_location(
+                &sess->nr_tai, &sess->nr_cgi);
+        if (!ueLocation.nr_location) {
+            ogs_error("ueLocation.nr_location");
+            goto end;
+        }
+        if (sess->ue_location_timestamp)
             ueLocation.nr_location->ue_location_timestamp =
                 ogs_sbi_gmtime_string(sess->ue_location_timestamp);
-            if (!ueLocation.nr_location->ue_location_timestamp) {
-                ogs_error("ueLocation.nr_location->ue_location_timestamp");
-                goto end;
-            }
 
-            SmPolicyDeleteData.user_location_info = &ueLocation;
-        }
-        if (param->ue_timezone) {
-            SmPolicyDeleteData.ue_time_zone =
-                ogs_sbi_timezone_string(ogs_timezone());
-            if (!SmPolicyDeleteData.ue_time_zone) {
-                ogs_error("SmPolicyDeleteData.ue_time_zone");
-                goto end;
-            }
+        SmPolicyDeleteData.user_location_info = &ueLocation;
+    }
+    if (sess->nsmf_param.ue_timezone) {
+        SmPolicyDeleteData.ue_time_zone =
+            ogs_sbi_timezone_string(ogs_timezone());
+        if (!SmPolicyDeleteData.ue_time_zone) {
+            ogs_error("SmPolicyDeleteData.ue_time_zone");
+            goto end;
         }
     }

open5gs_2.7.6.tar.xz/src/smf/npcf-build.h -> open5gs_2.7.7.tar.xz/src/smf/npcf-build.h Changed

open5gs_2.7.6.tar.xz/src/smf/npcf-handler.c -> open5gs_2.7.7.tar.xz/src/smf/npcf-handler.c Changed

open5gs_2.7.6.tar.xz/src/smf/npcf-handler.h -> open5gs_2.7.7.tar.xz/src/smf/npcf-handler.h Changed

open5gs_2.7.7.tar.xz/src/smf/nsmf-build.c Added

@@ -0,0 +1,881 @@
+/*
+ * Copyright (C) 2024-2025 by Sukchan Lee <acetcom@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include "nsmf-build.h"
+#include "gsm-build.h"
+
+ogs_sbi_request_t *smf_nsmf_pdusession_build_create_data(
+        smf_sess_t *sess, void *data)
+{
+    ogs_sbi_message_t message;
+    ogs_sbi_request_t *request = NULL;
+
+    ogs_sbi_server_t *server = NULL;
+    ogs_sbi_header_t header;
+
+    smf_ue_t *smf_ue = NULL;
+
+    OpenAPI_pdu_session_create_data_t PduSessionCreateData;
+    OpenAPI_snssai_t sNssai;
+    OpenAPI_snssai_t hplmnSnssai;
+    OpenAPI_tunnel_info_t vcnTunnelInfo;
+    OpenAPI_ref_to_binary_data_t n1SmInfoFromUe;
+    OpenAPI_user_location_t ueLocation;
+
+#if 0 /* Needs to be checked against AMF's nsmf-build.c */
+    ogs_sbi_nf_instance_t *pcf_nf_instance = NULL;
+#endif
+
+    int rv;
+    ogs_nas_5gs_message_t nas_message;
+    ogs_nas_5gs_pdu_session_establishment_request_t
+        *pdu_session_establishment_request = NULL;
+    ogs_nas_integrity_protection_maximum_data_rate_t
+        *integrity_protection_maximum_data_rate = NULL;
+    ogs_pkbuf_t *n1SmBufFromUe = NULL;
+
+    ogs_assert(sess);
+    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+    ogs_assert(smf_ue);
+
+    memset(&message, 0, sizeof(message));
+    message.h.method = (char *)OGS_SBI_HTTP_METHOD_POST;
+    ogs_assert(sess->h_smf_uri);
+    message.h.uri = sess->h_smf_uri;
+
+    memset(&header, 0, sizeof(header));
+    memset(&PduSessionCreateData, 0, sizeof(PduSessionCreateData));
+    memset(&sNssai, 0, sizeof(sNssai));
+    memset(&hplmnSnssai, 0, sizeof(hplmnSnssai));
+    memset(&vcnTunnelInfo, 0, sizeof(vcnTunnelInfo));
+    memset(&ueLocation, 0, sizeof(ueLocation));
+
+    PduSessionCreateData.supi = smf_ue->supi;
+    if (smf_ue->imeisv_len) {
+        PduSessionCreateData.pei = ogs_msprintf("%s-%s",
+                OGS_ID_SUPI_TYPE_IMEISV, smf_ue->imeisv_bcd);
+    }
+    if (smf_ue->msisdn_len) {
+        PduSessionCreateData.gpsi = ogs_msprintf("%s-%s",
+                OGS_ID_GPSI_TYPE_MSISDN, smf_ue->msisdn_bcd);
+    }
+    PduSessionCreateData.is_pdu_session_id = true;
+    PduSessionCreateData.pdu_session_id = sess->psi;
+    if (!PduSessionCreateData.pdu_session_id) {
+        ogs_error("No pdu_session_id");
+        goto end;
+    }
+
+    /*
+     * TS29.502
+     * 6.1 Nsmf_PDUSession Service API
+     * Table 6.1.6.2.2-1: Definition of type PduSessionCreateData
+     *
+     * NAME: dnn
+     * Data type: Dnn
+     * P: C
+     * Cardinality: 0..1
+     *
+     * This IE shall be present, except during an EPS to 5GS Idle mode mobility
+     * or handover using the N26 interface.
+     *
+     * When present, it shall contain the requested DNN; the DNN shall
+     * be the full DNN (i.e. with both the Network Identifier and
+     * Operator Identifier) for a HR PDU session, and it should be
+     * the full DNN in LBO and non-roaming scenarios. If the Operator Identifier
+     * is absent, the serving core network operator shall be assumed.
+     */
+    PduSessionCreateData.dnn = ogs_strdup(sess->full_dnn);
+    ogs_assert(PduSessionCreateData.dnn);
+
+    sNssai.sst = sess->s_nssai.sst;
+    sNssai.sd = ogs_s_nssai_sd_to_string(sess->s_nssai.sd);
+    PduSessionCreateData.s_nssai = &sNssai;
+
+    if (sess->mapped_hplmn.sst) {
+        hplmnSnssai.sst = sess->mapped_hplmn.sst;
+        hplmnSnssai.sd = ogs_s_nssai_sd_to_string(sess->mapped_hplmn.sd);
+        PduSessionCreateData.hplmn_snssai = &hplmnSnssai;
+    }
+
+    PduSessionCreateData.vsmf_id = NF_INSTANCE_ID(ogs_sbi_self()->nf_instance);
+    if (!PduSessionCreateData.vsmf_id) {
+        ogs_error("No vsmfId");
+        goto end;
+    }
+
+    PduSessionCreateData.serving_network =
+        ogs_sbi_build_plmn_id_nid(&sess->nr_tai.plmn_id);
+    if (!PduSessionCreateData.serving_network) {
+        ogs_error("No serving_network");
+        goto end;
+    }
+
+    if (sess->request_type >= OpenAPI_request_type_INITIAL_REQUEST &&
+            sess->request_type <=
+            OpenAPI_request_type_EXISTING_EMERGENCY_PDU_SESSION)
+        PduSessionCreateData.request_type = sess->request_type;
+
+    header.service.name = (char *)OGS_SBI_SERVICE_NAME_NSMF_PDUSESSION;
+    header.api.version = (char *)OGS_SBI_API_V1;
+    header.resource.component0 =
+        (char *)OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS;
+    header.resource.component1 = sess->sm_context_ref;
+    if (!header.resource.component1) {
+        ogs_error("No header.resource.component1");
+        goto end;
+    }
+
+    server = ogs_sbi_server_first();
+    if (!server) {
+        ogs_error("No server");
+        goto end;
+    }
+    PduSessionCreateData.vsmf_pdu_session_uri =
+        ogs_sbi_server_uri(server, &header);
+
+    if (sess->local_dl_addr)
+        vcnTunnelInfo.ipv4_addr = ogs_ipstrdup(sess->local_dl_addr);
+    if (sess->local_dl_addr6)
+        vcnTunnelInfo.ipv6_addr = ogs_ipstrdup(sess->local_dl_addr6);
+    vcnTunnelInfo.gtp_teid = ogs_uint32_to_0string(sess->local_dl_teid);
+    PduSessionCreateData.vcn_tunnel_info = &vcnTunnelInfo;
+
+    PduSessionCreateData.an_type = sess->an_type;
+    PduSessionCreateData.rat_type = sess->sbi_rat_type;
+
+    ueLocation.nr_location = ogs_sbi_build_nr_location(
+            &sess->nr_tai, &sess->nr_cgi);
+    if (!ueLocation.nr_location) {
+        ogs_error("No ueLocation.nr_location");
+        goto end;
+    }
+    if (sess->ue_location_timestamp)
+        ueLocation.nr_location->ue_location_timestamp =
+            ogs_sbi_gmtime_string(sess->ue_location_timestamp);
+
+    PduSessionCreateData.ue_location = &ueLocation;
+    PduSessionCreateData.ue_time_zone = ogs_sbi_timezone_string(ogs_timezone());
+    if (!PduSessionCreateData.ue_time_zone) {
+        ogs_error("No ue_time_zone");
+        goto end;
+    }
+
+    /*
+     * We're experiencing an issue after changing SearchResult.validityTime
+     * from 3600 seconds to 30 seconds. (#3210)
+     *
+     * When AMF finds a PCF through Discovery, it can be deleted
+     * after 30 seconds by ValidityTime.
+     *
+     * We have changed our implementation to not send the PCF-ID in this case.
+     *
+     * What we need to do is proactively add a part that will re-discover
+     * the PCF when a situation arises where we really need the PCF-ID.
+     */
+#if 0 /* Needs to be checked against AMF's nsmf-build.c */
+    pcf_nf_instance = OGS_SBI_GET_NF_INSTANCE(
+            amf_ue->sbi.service_type_array
+            OGS_SBI_SERVICE_TYPE_NPCF_AM_POLICY_CONTROL);
+    if (pcf_nf_instance)
+        PduSessionCreateData.pcf_id = pcf_nf_instance->id;
+    else
+        ogs_error("No pcf_nf_instance");
+#endif
+
+    ogs_assert(sess->amf_nf_id);
+    PduSessionCreateData.amf_nf_id = sess->amf_nf_id;
+
+    PduSessionCreateData.guami = ogs_sbi_build_guami(&sess->guami);
+    if (!PduSessionCreateData.guami) {
+        ogs_error("No guami");
+        goto end;
+    }
+
+    ogs_assert(sess->n1SmBufFromUe);
+    rv = ogs_nas_5gsm_decode(&nas_message, sess->n1SmBufFromUe);
+
+    if (rv == OGS_OK) {
+        n1SmBufFromUe = gsmue_encode_n1_sm_info(&nas_message);
+        message.partmessage.num_of_part.pkbuf = n1SmBufFromUe;
+        if (message.partmessage.num_of_part.pkbuf) {
+            message.partmessage.num_of_part.content_id =
+                (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
+            message.partmessage.num_of_part.content_type =
+                (char *)OGS_SBI_CONTENT_5GNAS_TYPE;
+            message.num_of_part++;
+
+            n1SmInfoFromUe.content_id = (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
+            PduSessionCreateData.n1_sm_info_from_ue = &n1SmInfoFromUe;
+
+            pdu_session_establishment_request =
+                &nas_message.gsm.pdu_session_establishment_request;
+            integrity_protection_maximum_data_rate =
+                &pdu_session_establishment_request->
+                integrity_protection_maximum_data_rate;
+
+            switch (integrity_protection_maximum_data_rate->ul) {
+            case OGS_NAS_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_64KBPS:
+                PduSessionCreateData.max_integrity_protected_data_rate_ul =
+                    OpenAPI_max_integrity_protected_data_rate__64_KBPS;
+                break;
+            case OGS_NAS_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_NULL:
+                PduSessionCreateData.max_integrity_protected_data_rate_ul =
+                    OpenAPI_max_integrity_protected_data_rate_NULL;
+                break;
+            case OGS_NAS_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_FULL:
+                PduSessionCreateData.max_integrity_protected_data_rate_ul =
+                    OpenAPI_max_integrity_protected_data_rate_MAX_UE_RATE;
+                break;
+            default:
+                ogs_error("Unknown Integrity Protection "
+                        "Maximum Data Rate UL:%d",
+                        integrity_protection_maximum_data_rate->ul);
+                break;
+            }
+
+            switch (integrity_protection_maximum_data_rate->dl) {
+            case OGS_NAS_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_64KBPS:
+                PduSessionCreateData.max_integrity_protected_data_rate_dl =
+                    OpenAPI_max_integrity_protected_data_rate__64_KBPS;
+                break;
+            case OGS_NAS_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_NULL:
+                PduSessionCreateData.max_integrity_protected_data_rate_dl =
+                    OpenAPI_max_integrity_protected_data_rate_NULL;
+                break;
+            case OGS_NAS_INTEGRITY_PROTECTION_MAXIMUM_DATA_RATE_FULL:
+                PduSessionCreateData.max_integrity_protected_data_rate_dl =
+                    OpenAPI_max_integrity_protected_data_rate_MAX_UE_RATE;
+                break;
+            defadlt:
+                ogs_error("Unknown Integrity Protection "
+                        "Maximum Data Rate DL:%d",
+                        integrity_protection_maximum_data_rate->dl);
+                break;
+            }
+        } else {
+            ogs_error("gsm_encode_n1_sm_info() failed %d", rv);
+            ogs_log_hexdump(OGS_LOG_ERROR,
+                    sess->n1SmBufFromUe->data, sess->n1SmBufFromUe->len);
+        }
+    } else {
+        ogs_error("ogs_nas_5gsm_decode() failed %d", rv);
+        ogs_log_hexdump(OGS_LOG_ERROR, sess->n1SmBufFromUe->data, sess->n1SmBufFromUe->len);
+    }
+
+    message.PduSessionCreateData = &PduSessionCreateData;
+
+    message.http.accept = (char *)(OGS_SBI_CONTENT_JSON_TYPE ","
+        OGS_SBI_CONTENT_NGAP_TYPE "," OGS_SBI_CONTENT_PROBLEM_TYPE);
+
+    request = ogs_sbi_build_request(&message);
+    ogs_expect(request);
+
+end:
+    if (header.resource.component2)
+        ogs_free(header.resource.component2);
+
+    if (PduSessionCreateData.serving_network)
+        ogs_sbi_free_plmn_id_nid(PduSessionCreateData.serving_network);
+    if (PduSessionCreateData.dnn)
+        ogs_free(PduSessionCreateData.dnn);
+    if (PduSessionCreateData.vsmf_pdu_session_uri)
+        ogs_free(PduSessionCreateData.vsmf_pdu_session_uri);
+    if (vcnTunnelInfo.ipv4_addr)
+        ogs_free(vcnTunnelInfo.ipv4_addr);
+    if (vcnTunnelInfo.ipv6_addr)
+        ogs_free(vcnTunnelInfo.ipv6_addr);
+    if (vcnTunnelInfo.gtp_teid)
+        ogs_free(vcnTunnelInfo.gtp_teid);
+    if (sNssai.sd)
+        ogs_free(sNssai.sd);
+    if (hplmnSnssai.sd)
+        ogs_free(hplmnSnssai.sd);
+    if (PduSessionCreateData.guami)
+        ogs_sbi_free_guami(PduSessionCreateData.guami);
+    if (PduSessionCreateData.pei)
+        ogs_free(PduSessionCreateData.pei);
+    if (PduSessionCreateData.gpsi)
+        ogs_free(PduSessionCreateData.gpsi);
+    if (ueLocation.nr_location) {
+        if (ueLocation.nr_location->ue_location_timestamp)
+            ogs_free(ueLocation.nr_location->ue_location_timestamp);
+        ogs_sbi_free_nr_location(ueLocation.nr_location);
+    }
+    if (PduSessionCreateData.ue_time_zone)
+        ogs_free(PduSessionCreateData.ue_time_zone);
+
+    if (sess->n1SmBufFromUe) {
+        ogs_pkbuf_free(sess->n1SmBufFromUe);
+        sess->n1SmBufFromUe = NULL;
+    }
+
+    if (n1SmBufFromUe)
+        ogs_pkbuf_free(n1SmBufFromUe);
+
+    if (message.http.custom.nrf_uri)
+        ogs_free(message.http.custom.nrf_uri);
+
+    return request;
+}
+
+ogs_sbi_request_t *smf_nsmf_pdusession_build_hsmf_update_data(
+        smf_sess_t *sess, void *data)
+{
+    ogs_sbi_message_t message;
+    ogs_sbi_request_t *request = NULL;
+
+    smf_ue_t *smf_ue = NULL;
+
+    OpenAPI_hsmf_update_data_t HsmfUpdateData;
+    OpenAPI_ng_ap_cause_t ngApCause;
+    OpenAPI_tunnel_info_t vcnTunnelInfo;
+    OpenAPI_user_location_t ueLocation;
+
+    int rv;
+    ogs_nas_5gs_message_t nas_message;
+    ogs_pkbuf_t *n1SmBufFromUe = NULL;
+    OpenAPI_ref_to_binary_data_t n1SmInfoFromUe;
+
+    ogs_assert(sess);
+    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+    ogs_assert(smf_ue);
+
+    memset(&message, 0, sizeof(message));
+    message.h.method = (char *)OGS_SBI_HTTP_METHOD_POST;
+    ogs_assert(sess->pdu_session_resource_uri);
+    message.h.uri = ogs_msprintf("%s/%s",
+            sess->pdu_session_resource_uri, OGS_SBI_RESOURCE_NAME_MODIFY);
+    ogs_assert(message.h.uri);
+
+    memset(&HsmfUpdateData, 0, sizeof(HsmfUpdateData));
+    memset(&ngApCause, 0, sizeof(ngApCause));
+    memset(&vcnTunnelInfo, 0, sizeof(vcnTunnelInfo));
+    memset(&ueLocation, 0, sizeof(ueLocation));
+
+    HsmfUpdateData.request_indication = sess->nsmf_param.request_indication;
+    ogs_assert(HsmfUpdateData.request_indication);
+
+    HsmfUpdateData.cause = sess->nsmf_param.cause;
+
+    HsmfUpdateData.up_cnx_state = sess->nsmf_param.up_cnx_state;
+
+    if (sess->nsmf_param.ngap_cause.group) {
+        HsmfUpdateData.ng_ap_cause = &ngApCause;
+        ngApCause.group = sess->nsmf_param.ngap_cause.group;
+        ngApCause.value = sess->nsmf_param.ngap_cause.value;
+    }
+
+    if (sess->nsmf_param.gmm_cause) {
+        HsmfUpdateData.is__5g_mm_cause_value = true;
+        HsmfUpdateData._5g_mm_cause_value = sess->nsmf_param.gmm_cause;
+    }
+
+    if (sess->nsmf_param.serving_network) {
+        HsmfUpdateData.serving_network =
+            ogs_sbi_build_plmn_id_nid(&sess->nr_tai.plmn_id);
+        if (!HsmfUpdateData.serving_network) {
+            ogs_error("No serving_network");
+            goto end;
+        }
+    }
+
+    if (sess->nsmf_param.dl_ip.ipv4)
+        vcnTunnelInfo.ipv4_addr = ogs_ipv4_to_string(
+                sess->nsmf_param.dl_ip.addr);
+
+    if (sess->nsmf_param.dl_ip.ipv6)
+        vcnTunnelInfo.ipv6_addr = ogs_ipv6addr_to_string(
+                sess->nsmf_param.dl_ip.addr6);
+
+    if (vcnTunnelInfo.ipv4_addr || vcnTunnelInfo.ipv6_addr) {
+        vcnTunnelInfo.gtp_teid = ogs_uint32_to_0string(
+                sess->nsmf_param.dl_teid);
+        HsmfUpdateData.vcn_tunnel_info = &vcnTunnelInfo;
+    }
+
+    HsmfUpdateData.an_type = sess->nsmf_param.an_type;
+    HsmfUpdateData.rat_type = sess->nsmf_param.rat_type;
+
+    if (sess->nsmf_param.ue_location) {
+        ueLocation.nr_location = ogs_sbi_build_nr_location(
+                &sess->nr_tai, &sess->nr_cgi);
+        if (!ueLocation.nr_location) {
+            ogs_error("No ueLocation.nr_location");
+            goto end;
+        }
+        if (sess->ue_location_timestamp)
+            ueLocation.nr_location->ue_location_timestamp =
+                ogs_sbi_gmtime_string(sess->ue_location_timestamp);
+
+        HsmfUpdateData.ue_location = &ueLocation;
+    }
+    if (sess->nsmf_param.ue_timezone) {
+        HsmfUpdateData.ue_time_zone = ogs_sbi_timezone_string(ogs_timezone());
+        if (!HsmfUpdateData.ue_time_zone) {
+            ogs_error("No ue_time_zone");
+            goto end;
+        }
+    }
+
+    if (sess->n1SmBufFromUe) {
+        rv = ogs_nas_5gsm_decode(&nas_message, sess->n1SmBufFromUe);
+
+        if (rv == OGS_OK) {
+            n1SmBufFromUe = gsmue_encode_n1_sm_info(&nas_message);
+            message.partmessage.num_of_part.pkbuf = n1SmBufFromUe;
+            if (message.partmessage.num_of_part.pkbuf) {
+                message.partmessage.num_of_part.content_id =
+                    (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
+                message.partmessage.num_of_part.content_type =
+                    (char *)OGS_SBI_CONTENT_5GNAS_TYPE;
+                message.num_of_part++;
+
+                n1SmInfoFromUe.content_id = (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
+                HsmfUpdateData.n1_sm_info_from_ue = &n1SmInfoFromUe;
+            } else {
+                ogs_error("gsm_encode_n1_sm_info() failed %d", rv);
+                ogs_log_hexdump(OGS_LOG_ERROR,
+                        sess->n1SmBufFromUe->data, sess->n1SmBufFromUe->len);
+            }
+        } else {
+            ogs_error("ogs_nas_5gsm_decode() failed %d", rv);
+            ogs_log_hexdump(OGS_LOG_ERROR,
+                    sess->n1SmBufFromUe->data, sess->n1SmBufFromUe->len);
+        }
+    }
+
+    message.HsmfUpdateData = &HsmfUpdateData;
+
+    request = ogs_sbi_build_request(&message);
+    ogs_expect(request);
+
+end:
+    if (message.h.uri)
+        ogs_free(message.h.uri);
+
+    if (HsmfUpdateData.serving_network)
+        ogs_sbi_free_plmn_id_nid(HsmfUpdateData.serving_network);
+
+    if (vcnTunnelInfo.ipv4_addr)
+        ogs_free(vcnTunnelInfo.ipv4_addr);
+    if (vcnTunnelInfo.ipv6_addr)
+        ogs_free(vcnTunnelInfo.ipv6_addr);
+    if (vcnTunnelInfo.gtp_teid)
+        ogs_free(vcnTunnelInfo.gtp_teid);
+
+    if (ueLocation.nr_location) {
+        if (ueLocation.nr_location->ue_location_timestamp)
+            ogs_free(ueLocation.nr_location->ue_location_timestamp);
+        ogs_sbi_free_nr_location(ueLocation.nr_location);
+    }
+    if (HsmfUpdateData.ue_time_zone)
+        ogs_free(HsmfUpdateData.ue_time_zone);
+
+    if (sess->n1SmBufFromUe) {
+        ogs_pkbuf_free(sess->n1SmBufFromUe);
+        sess->n1SmBufFromUe = NULL;
+    }
+
+    return request;
+}
+
+ogs_sbi_request_t *smf_nsmf_pdusession_build_vsmf_update_data(
+        smf_sess_t *sess, void *data)
+{
+    ogs_sbi_message_t message;
+    ogs_sbi_request_t *request = NULL;
+
+    OpenAPI_vsmf_update_data_t VsmfUpdateData;
+
+    OpenAPI_ref_to_binary_data_t n1SmInfoToUe;
+    ogs_pkbuf_t *n1SmBufToUe = NULL;
+
+    OpenAPI_list_t *qosFlowsAddModRequestList = NULL;
+    OpenAPI_qos_flow_add_modify_request_item_t *qosFlowAddModRequestItem =
+        NULL;
+    OpenAPI_list_t *qosFlowsRelRequestList = NULL;
+    OpenAPI_qos_flow_release_request_item_t *qosFlowRelRequestItem = NULL;
+
+    smf_bearer_t *qos_flow = NULL;
+
+    ogs_assert(sess);
+
+    memset(&message, 0, sizeof(message));
+    message.h.method = (char *)OGS_SBI_HTTP_METHOD_POST;
+    ogs_assert(sess->vsmf_pdu_session_uri);
+    message.h.uri = ogs_msprintf("%s/%s",
+            sess->vsmf_pdu_session_uri, OGS_SBI_RESOURCE_NAME_MODIFY);
+    ogs_assert(message.h.uri);
+
+    memset(&VsmfUpdateData, 0, sizeof(VsmfUpdateData));
+
+    VsmfUpdateData.request_indication = sess->nsmf_param.request_indication;
+    ogs_assert(VsmfUpdateData.request_indication);
+
+    switch (VsmfUpdateData.request_indication) {
+    case OpenAPI_request_indication_UE_REQ_PDU_SES_MOD:
+    case OpenAPI_request_indication_NW_REQ_PDU_SES_MOD:
+        n1SmBufToUe = gsmue_build_pdu_session_modification_command(sess);
+        ogs_assert(n1SmBufToUe);
+
+        qosFlowsAddModRequestList = OpenAPI_list_create();
+        ogs_assert(qosFlowsAddModRequestList);
+        qosFlowsRelRequestList = OpenAPI_list_create();
+        ogs_assert(qosFlowsRelRequestList);
+
+        int i = 0;
+
+        ogs_list_for_each_entry(
+                &sess->qos_flow_to_modify_list, qos_flow, to_modify_node) {
+
+            int rv, enc_len = 0;
+
+            OpenAPI_qos_flow_profile_t *qosFlowProfile = NULL;
+            OpenAPI_arp_t *Arp = NULL;
+            OpenAPI_gbr_qos_flow_information_t *gbrQosFlowInfo = NULL;
+
+            char *encoded_qos_rules = NULL;
+            char *encoded_qos_flow_description = NULL;
+
+            ogs_assert(i < OGS_MAX_NUM_OF_BEARER);
+
+            if (sess->nsmf_param.qos_rule_code) {
+                ogs_nas_qos_rules_t authorized_qos_rules;
+                ogs_nas_qos_rule_t qos_rule;
+
+                memset(&qos_rule, 0, sizeof(qos_rule));
+                gsm_encode_qos_rule(
+                        &qos_rule, qos_flow, sess->nsmf_param.qos_rule_code);
+
+                rv = ogs_nas_build_qos_rules(
+                        &authorized_qos_rules, &qos_rule, 1);
+                if (rv != OGS_OK) {
+                    ogs_error("ogs_nas_build_qos_rules() failed");
+                    goto end;
+                }
+                if (!authorized_qos_rules.length) {
+                    ogs_error("No length");
+                    goto end;
+                }
+
+                enc_len = ogs_base64_encode_len(authorized_qos_rules.length);
+                encoded_qos_rules = ogs_calloc(1, enc_len);
+                ogs_assert(encoded_qos_rules);
+                ogs_base64_encode(
+                        encoded_qos_rules,
+                        authorized_qos_rules.buffer,
+                        authorized_qos_rules.length);
+
+                ogs_free(authorized_qos_rules.buffer);
+            }
+
+            if (sess->nsmf_param.qos_flow_description_code) {
+                ogs_nas_qos_flow_descriptions_t
+                    authorized_qos_flow_descriptions;
+                ogs_nas_qos_flow_description_t qos_flow_description;
+
+                memset(&qos_flow_description, 0, sizeof(qos_flow_description));
+                gsm_encode_qos_flow_description(
+                        &qos_flow_description, qos_flow,
+                        sess->nsmf_param.qos_flow_description_code);
+                rv = ogs_nas_build_qos_flow_descriptions(
+                        &authorized_qos_flow_descriptions,
+                        &qos_flow_description, 1);
+                if (rv != OGS_OK) {
+                    ogs_error("ogs_nas_build_qos_flow_descriptions() failed");
+                    goto end;
+                }
+                if (!authorized_qos_flow_descriptions.length) {
+                    ogs_error("No length");
+                    goto end;
+                }
+
+                enc_len = ogs_base64_encode_len(
+                        authorized_qos_flow_descriptions.length);
+                encoded_qos_flow_description = ogs_calloc(1, enc_len);
+                ogs_assert(encoded_qos_flow_description);
+                ogs_base64_encode(
+                        encoded_qos_flow_description,
+                        authorized_qos_flow_descriptions.buffer,
+                        authorized_qos_flow_descriptions.length);
+
+                ogs_free(authorized_qos_flow_descriptions.buffer);
+            }
+
+            if (sess->nsmf_param.qos_rule_code ==
+                    OGS_NAS_QOS_CODE_DELETE_EXISTING_QOS_RULE ||
+                sess->nsmf_param.qos_flow_description_code ==
+                    OGS_NAS_DELETE_NEW_QOS_FLOW_DESCRIPTION) {
+
+                if (sess->nsmf_param.qos_rule_code !=
+                        OGS_NAS_QOS_CODE_DELETE_EXISTING_QOS_RULE ||
+                    sess->nsmf_param.qos_flow_description_code !=
+                        OGS_NAS_DELETE_NEW_QOS_FLOW_DESCRIPTION)
+                    ogs_error("Invalid qosRule%d/qosFlowDesc%d",
+                        sess->nsmf_param.qos_rule_code,
+                        sess->nsmf_param.qos_flow_description_code);
+
+                qosFlowRelRequestItem =
+                    ogs_calloc(1, sizeof(*qosFlowRelRequestItem));
+                ogs_assert(qosFlowRelRequestItem);
+
+                qosFlowRelRequestItem->qfi = qos_flow->qfi;
+
+                qosFlowRelRequestItem->qos_rules = encoded_qos_rules;
+                qosFlowRelRequestItem->qos_flow_description =
+                    encoded_qos_flow_description;
+
+                OpenAPI_list_add(qosFlowsRelRequestList, qosFlowRelRequestItem);
+
+            } else if (sess->nsmf_param.qos_rule_code ||
+                    sess->nsmf_param.qos_flow_description_code) {
+                Arp = ogs_calloc(1, sizeof(*Arp));
+                ogs_assert(Arp);
+                if (qos_flow->qos.arp.pre_emption_capability ==
+                        OGS_5GC_PRE_EMPTION_ENABLED)
+                    Arp->preempt_cap =
+                        OpenAPI_preemption_capability_MAY_PREEMPT;
+                else if (qos_flow->qos.arp.pre_emption_capability ==
+                        OGS_5GC_PRE_EMPTION_DISABLED)
+                    Arp->preempt_cap =
+                        OpenAPI_preemption_capability_NOT_PREEMPT;
+                else {
+                    ogs_error("No Arp->preempt_cap");
+                    goto end;
+                }
+
+                if (qos_flow->qos.arp.pre_emption_vulnerability ==
+                        OGS_5GC_PRE_EMPTION_ENABLED)
+                    Arp->preempt_vuln =
+                        OpenAPI_preemption_vulnerability_PREEMPTABLE;
+                else if (qos_flow->qos.arp.pre_emption_vulnerability ==
+                        OGS_5GC_PRE_EMPTION_DISABLED)
+                    Arp->preempt_vuln =
+                        OpenAPI_preemption_vulnerability_NOT_PREEMPTABLE;
+                else {
+                    ogs_error("No Arp->preempt_vuln");
+                    goto end;
+                }
+                Arp->priority_level = qos_flow->qos.arp.priority_level;
+
+                if (qos_flow->qos.mbr.downlink && qos_flow->qos.mbr.uplink &&
+                    qos_flow->qos.gbr.downlink && qos_flow->qos.gbr.uplink) {
+                    gbrQosFlowInfo = ogs_calloc(1, sizeof(*gbrQosFlowInfo));
+                    ogs_assert(gbrQosFlowInfo);
+
+                    gbrQosFlowInfo->max_fbr_ul = ogs_sbi_bitrate_to_string(
+                            qos_flow->qos.mbr.uplink, OGS_SBI_BITRATE_BPS);
+                    gbrQosFlowInfo->max_fbr_dl = ogs_sbi_bitrate_to_string(
+                            qos_flow->qos.mbr.downlink, OGS_SBI_BITRATE_BPS);
+
+                    gbrQosFlowInfo->gua_fbr_ul = ogs_sbi_bitrate_to_string(
+                            qos_flow->qos.gbr.uplink, OGS_SBI_BITRATE_BPS);
+                    gbrQosFlowInfo->gua_fbr_dl = ogs_sbi_bitrate_to_string(
+                            qos_flow->qos.gbr.downlink, OGS_SBI_BITRATE_BPS);
+                }
+
+                qosFlowProfile = ogs_calloc(1, sizeof(*qosFlowProfile));
+                ogs_assert(qosFlowProfile);
+                qosFlowProfile->arp = Arp;
+                qosFlowProfile->_5qi = qos_flow->qos.index;
+                qosFlowProfile->gbr_qos_flow_info = gbrQosFlowInfo;
+
+                qosFlowAddModRequestItem =
+                    ogs_calloc(1, sizeof(*qosFlowAddModRequestItem));
+                ogs_assert(qosFlowAddModRequestItem);
+
+                qosFlowAddModRequestItem->qfi = qos_flow->qfi;
+
+                qosFlowAddModRequestItem->qos_rules = encoded_qos_rules;
+                qosFlowAddModRequestItem->qos_flow_description =
+                    encoded_qos_flow_description;
+
+                qosFlowAddModRequestItem->qos_flow_profile = qosFlowProfile;
+
+                OpenAPI_list_add(qosFlowsAddModRequestList,
+                        qosFlowAddModRequestItem);
+            } else {
+                ogs_error("Invalid qosRule%d/qosFlowDesc%d",
+                    sess->nsmf_param.qos_rule_code,
+                    sess->nsmf_param.qos_flow_description_code);
+            }
+
+            i++;
+        }
+
+        if (qosFlowsAddModRequestList->count)
+            VsmfUpdateData.qos_flows_add_mod_request_list =
+                qosFlowsAddModRequestList;
+        else
+            OpenAPI_list_free(qosFlowsAddModRequestList);
+
+        if (qosFlowsRelRequestList->count)
+            VsmfUpdateData.qos_flows_rel_request_list = qosFlowsRelRequestList;
+        else
+            OpenAPI_list_free(qosFlowsRelRequestList);
+
+        break;
+    case OpenAPI_request_indication_NW_REQ_PDU_SES_REL:
+    case OpenAPI_request_indication_UE_REQ_PDU_SES_REL:
+        n1SmBufToUe = gsmue_build_pdu_session_release_command(sess);
+        ogs_assert(n1SmBufToUe);
+        break;
+    default:
+        ogs_fatal("Not implemented request_indication:%d",
+                VsmfUpdateData.request_indication);
+
+    }
+
+    n1SmInfoToUe.content_id = (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
+    VsmfUpdateData.n1_sm_info_to_ue = &n1SmInfoToUe;
+
+    message.partmessage.num_of_part.pkbuf = n1SmBufToUe;
+    message.partmessage.num_of_part.content_id =
+        (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
+    message.partmessage.num_of_part.content_type =
+        (char *)OGS_SBI_CONTENT_5GNAS_TYPE;
+    message.num_of_part++;
+
+    message.VsmfUpdateData = &VsmfUpdateData;
+
+    request = ogs_sbi_build_request(&message);
+    ogs_expect(request);
+
+end:
+    if (message.h.uri)
+        ogs_free(message.h.uri);
+
+    CLEAR_QOS_FLOWS_ADD_MOD_REQUEST_LIST(
+            VsmfUpdateData.qos_flows_add_mod_request_list);
+    CLEAR_QOS_FLOWS_REL_REQUEST_LIST(VsmfUpdateData.qos_flows_rel_request_list);
+
+    return request;
+}
+
+ogs_sbi_request_t *smf_nsmf_pdusession_build_release_data(
+        smf_sess_t *sess, void *data)
+{
+    ogs_sbi_message_t message;
+    ogs_sbi_request_t *request = NULL;
+
+    smf_ue_t *smf_ue = NULL;
+
+    OpenAPI_release_data_t ReleaseData;
+    OpenAPI_ng_ap_cause_t ngApCause;
+    OpenAPI_user_location_t ueLocation;
+
+    ogs_assert(sess);
+    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+    ogs_assert(smf_ue);
+
+    memset(&message, 0, sizeof(message));
+    message.h.method = (char *)OGS_SBI_HTTP_METHOD_POST;
+    ogs_assert(sess->pdu_session_resource_uri);
+    message.h.uri = ogs_msprintf("%s/%s",
+            sess->pdu_session_resource_uri, OGS_SBI_RESOURCE_NAME_RELEASE);
+    ogs_assert(message.h.uri);
+
+    memset(&ReleaseData, 0, sizeof(ReleaseData));
+    memset(&ngApCause, 0, sizeof(ngApCause));
+    memset(&ueLocation, 0, sizeof(ueLocation));
+
+    ReleaseData.cause = sess->nsmf_param.cause;
+
+    if (sess->nsmf_param.ngap_cause.group) {
+        ReleaseData.ng_ap_cause = &ngApCause;
+        ngApCause.group = sess->nsmf_param.ngap_cause.group;
+        ngApCause.value = sess->nsmf_param.ngap_cause.value;
+    }
+
+    if (sess->nsmf_param.gmm_cause) {
+        ReleaseData.is__5g_mm_cause_value = true;
+        ReleaseData._5g_mm_cause_value = sess->nsmf_param.gmm_cause;
+    }
+
+    if (sess->nsmf_param.ue_location) {
+        ueLocation.nr_location = ogs_sbi_build_nr_location(
+                &sess->nr_tai, &sess->nr_cgi);
+        if (!ueLocation.nr_location) {
+            ogs_error("No ueLocation.nr_location");
+            goto end;
+        }
+        if (sess->ue_location_timestamp)
+            ueLocation.nr_location->ue_location_timestamp =
+                ogs_sbi_gmtime_string(sess->ue_location_timestamp);
+
+        ReleaseData.ue_location = &ueLocation;
+    }
+    if (sess->nsmf_param.ue_timezone) {
+        ReleaseData.ue_time_zone = ogs_sbi_timezone_string(ogs_timezone());
+        if (!ReleaseData.ue_time_zone) {
+            ogs_error("No ue_time_zone");
+            goto end;
+        }
+    }
+
+    message.ReleaseData = &ReleaseData;
+
+    request = ogs_sbi_build_request(&message);
+    ogs_expect(request);
+
+end:
+    if (message.h.uri)
+        ogs_free(message.h.uri);
+
+    if (ueLocation.nr_location) {
+        if (ueLocation.nr_location->ue_location_timestamp)
+            ogs_free(ueLocation.nr_location->ue_location_timestamp);
+        ogs_sbi_free_nr_location(ueLocation.nr_location);
+    }
+    if (ReleaseData.ue_time_zone)
+        ogs_free(ReleaseData.ue_time_zone);
+
+    return request;
+}
+
+ogs_sbi_request_t *smf_nsmf_pdusession_build_status(
+        smf_sess_t *sess, void *data)
+{
+    ogs_sbi_message_t message;
+    ogs_sbi_request_t *request = NULL;
+
+    OpenAPI_status_notification_t StatusNotification;
+    OpenAPI_status_info_t StatusInfo;
+
+    ogs_assert(sess);
+    ogs_assert(sess->vsmf_pdu_session_uri);
+
+    memset(&StatusInfo, 0, sizeof(StatusInfo));
+    StatusInfo.resource_status = OpenAPI_resource_status_RELEASED;
+
+    memset(&StatusNotification, 0, sizeof(StatusNotification));
+    StatusNotification.status_info = &StatusInfo;
+
+    memset(&message, 0, sizeof(message));
+    message.h.method = (char *)OGS_SBI_HTTP_METHOD_POST;
+    message.h.uri = sess->vsmf_pdu_session_uri;
+
+    message.StatusNotification = &StatusNotification;
+
+    request = ogs_sbi_build_request(&message);
+    ogs_expect(request);
+
+    return request;
+}

open5gs_2.7.7.tar.xz/src/smf/nsmf-build.h Added

@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2024-2025 by Sukchan Lee <acetcom@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#ifndef SMF_NSMF_BUILD_H
+#define SMF_NSMF_BUILD_H
+
+#include "context.h"
+#include "gsmue-message.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+ogs_sbi_request_t *smf_nsmf_pdusession_build_create_data(
+        smf_sess_t *sess, void *data);
+ogs_sbi_request_t *smf_nsmf_pdusession_build_hsmf_update_data(
+        smf_sess_t *sess, void *data);
+ogs_sbi_request_t *smf_nsmf_pdusession_build_vsmf_update_data(
+        smf_sess_t *sess, void *data);
+ogs_sbi_request_t *smf_nsmf_pdusession_build_release_data(
+        smf_sess_t *sess, void *data);
+
+ogs_sbi_request_t *smf_nsmf_pdusession_build_status(
+        smf_sess_t *sess, void *data);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* SMF_NSMF_BUILD_H */

open5gs_2.7.6.tar.xz/src/smf/nsmf-handler.c -> open5gs_2.7.7.tar.xz/src/smf/nsmf-handler.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -21,6 +21,8 @@
 #include "nas-path.h"
 #include "ngap-path.h"
 #include "pfcp-path.h"
+#include "local-path.h"
+#include "gsm-handler.h"
 #include "nsmf-handler.h"
 
 bool smf_nsmf_handle_create_sm_context(
@@ -28,6 +30,9 @@
 {
     bool rc;
     smf_ue_t *smf_ue = NULL;
+    smf_bearer_t *qos_flow = NULL;
+    ogs_pfcp_pdr_t *dl_pdr = NULL;
+    ogs_pfcp_pdr_t *ul_pdr = NULL;
     char *type = NULL;
 
     ogs_nas_5gsm_header_t *gsm_header = NULL;
@@ -38,6 +43,7 @@
     char *fqdn = NULL;
     uint16_t fqdn_port = 0;
     ogs_sockaddr_t *addr = NULL, *addr6 = NULL;
+    char *dnn_oi = NULL;
 
     OpenAPI_sm_context_create_data_t *SmContextCreateData = NULL;
     OpenAPI_nr_location_t *NrLocation = NULL;
@@ -94,6 +100,16 @@
 
     }
 
+    if (!SmContextCreateData->dnn) {
+        ogs_error("%s:%d No DNN", smf_ue->supi, sess->psi);
+        n1smbuf = gsm_build_pdu_session_establishment_reject(sess,
+            OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION);
+        smf_sbi_send_sm_context_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                "No DNN", smf_ue->supi, n1smbuf);
+        return false;
+    }
+
     sNssai = SmContextCreateData->s_nssai;
     if (!sNssai) {
         ogs_error("%s:%d No sNssai", smf_ue->supi, sess->psi);
@@ -105,10 +121,29 @@
         return false;
     }
 
+    if (!SmContextCreateData->serving_nf_id) {
+        ogs_error("%s:%d No Serving AMF NF-ID", smf_ue->supi, sess->psi);
+        n1smbuf = gsm_build_pdu_session_establishment_reject(sess,
+            OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION);
+        smf_sbi_send_sm_context_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                "No Serving AMF NF-ID", smf_ue->supi, n1smbuf);
+        return false;
+    }
+
+    if (!SmContextCreateData->guami) {
+        ogs_error("%s:%d No Guami", smf_ue->supi, sess->psi);
+        n1smbuf = gsm_build_pdu_session_establishment_reject(sess,
+            OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION);
+        smf_sbi_send_sm_context_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                "No Guami", smf_ue->supi, n1smbuf);
+        return false;
+    }
+
     servingNetwork = SmContextCreateData->serving_network;
     if (!servingNetwork || !servingNetwork->mnc || !servingNetwork->mcc) {
-        ogs_error("%s:%d No servingNetwork",
-                smf_ue->supi, sess->psi);
+        ogs_error("%s:%d No servingNetwork", smf_ue->supi, sess->psi);
         n1smbuf = gsm_build_pdu_session_establishment_reject(sess,
             OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION);
         smf_sbi_send_sm_context_create_error(stream,
@@ -117,6 +152,26 @@
         return false;
     }
 
+    if (!SmContextCreateData->an_type) {
+        ogs_error("%s:%d No anType", smf_ue->supi, sess->psi);
+        n1smbuf = gsm_build_pdu_session_establishment_reject(sess,
+            OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION);
+        smf_sbi_send_sm_context_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                "No anType", smf_ue->supi, n1smbuf);
+        return false;
+    }
+
+    if (!SmContextCreateData->rat_type) {
+        ogs_error("%s:%d No ratType", smf_ue->supi, sess->psi);
+        n1smbuf = gsm_build_pdu_session_establishment_reject(sess,
+            OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION);
+        smf_sbi_send_sm_context_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                "No ratType", smf_ue->supi, n1smbuf);
+        return false;
+    }
+
     if (!SmContextCreateData->ue_location ||
         !SmContextCreateData->ue_location->nr_location) {
         ogs_error("%s:%d No UeLocation", smf_ue->supi, sess->psi);
@@ -226,10 +281,12 @@
         smf_ue->gpsi = ogs_strdup(SmContextCreateData->gpsi);
     }
 
-    /* Serving PLMN & Home PLMN */
+    sess->request_type = SmContextCreateData->request_type;
+
     ogs_sbi_parse_plmn_id_nid(&sess->serving_plmn_id, servingNetwork);
     memcpy(&sess->home_plmn_id, &sess->serving_plmn_id, OGS_PLMN_ID_LEN);
 
+    sess->an_type = SmContextCreateData->an_type;
     sess->sbi_rat_type = SmContextCreateData->rat_type;
 
     ogs_sbi_parse_nr_location(&sess->nr_tai, &sess->nr_cgi, NrLocation);
@@ -296,66 +353,70 @@
      * the full DNN in LBO and non-roaming scenarios. If the Operator Identifier
      * is absent, the serving core network operator shall be assumed.
      */
-    if (SmContextCreateData->dnn) {
-        char *home_network_domain =
-            ogs_home_network_domain_from_fqdn(SmContextCreateData->dnn);
-
-        if (home_network_domain) {
-            char dnn_network_identiferOGS_MAX_DNN_LEN+1;
-            uint16_t mcc = 0, mnc = 0;
-
-            ogs_assert(home_network_domain > SmContextCreateData->dnn);
-
-            ogs_cpystrn(dnn_network_identifer, SmContextCreateData->dnn,
-                ogs_min(OGS_MAX_DNN_LEN,
-                    home_network_domain - SmContextCreateData->dnn));
-
-            if (sess->session.name)
-                ogs_free(sess->session.name);
-            sess->session.name = ogs_strdup(dnn_network_identifer);
-            ogs_assert(sess->session.name);
-
-            if (sess->full_dnn)
-                ogs_free(sess->full_dnn);
-            sess->full_dnn = ogs_strdup(SmContextCreateData->dnn);
-            ogs_assert(sess->full_dnn);
+    dnn_oi = ogs_dnn_oi_from_fqdn(SmContextCreateData->dnn);
 
-            mcc = ogs_plmn_id_mcc_from_fqdn(sess->full_dnn);
-            mnc = ogs_plmn_id_mnc_from_fqdn(sess->full_dnn);
+    if (dnn_oi) {
+        char dnn_niOGS_MAX_DNN_LEN+1;
+        uint16_t mcc = 0, mnc = 0;
 
-            /*
-             * To generate the Home PLMN ID of the SMF-UE,
-             * the length of the MNC is obtained
-             * by comparing the MNC part of the SUPI and full-DNN.
-             */
-            if (mcc && mnc &&
-                strncmp(smf_ue->supi, "imsi-", strlen("imsi-")) == 0) {
-                int mnc_len = 0;
-                char bufOGS_PLMNIDSTRLEN;
-
-                ogs_snprintf(buf, OGS_PLMNIDSTRLEN, "%03d%02d", mcc, mnc);
-                if (strncmp(smf_ue->supi + 5, buf, strlen(buf)) == 0)
-                    mnc_len = 2;
-
-                ogs_snprintf(buf, OGS_PLMNIDSTRLEN, "%03d%03d", mcc, mnc);
-                if (strncmp(smf_ue->supi + 5, buf, strlen(buf)) == 0)
-                    mnc_len = 3;
-
-                /* Change Home PLMN for VPLMN */
-                if (mnc_len == 2 || mnc_len == 3)
-                    ogs_plmn_id_build(&sess->home_plmn_id, mcc, mnc, mnc_len);
-            }
-        } else {
-            if (sess->session.name)
-                ogs_free(sess->session.name);
-            sess->session.name = ogs_strdup(SmContextCreateData->dnn);
-            ogs_assert(sess->session.name);
-
-            if (sess->full_dnn)
-                ogs_free(sess->full_dnn);
-            sess->full_dnn = NULL;
+        ogs_assert(dnn_oi > SmContextCreateData->dnn);
+
+        ogs_cpystrn(dnn_ni, SmContextCreateData->dnn,
+            ogs_min(OGS_MAX_DNN_LEN, dnn_oi - SmContextCreateData->dnn));
+
+        if (sess->session.name)
+            ogs_free(sess->session.name);
+        sess->session.name = ogs_strdup(dnn_ni);
+        ogs_assert(sess->session.name);
+
+        if (sess->full_dnn)
+            ogs_free(sess->full_dnn);
+        sess->full_dnn = ogs_strdup(SmContextCreateData->dnn);
+        ogs_assert(sess->full_dnn);
+
+        mcc = ogs_plmn_id_mcc_from_fqdn(sess->full_dnn);
+        mnc = ogs_plmn_id_mnc_from_fqdn(sess->full_dnn);
+
+        /*
+         * To generate the Home PLMN ID of the SMF-UE,
+         * the length of the MNC is obtained
+         * by comparing the MNC part of the SUPI and full-DNN.
+         */
+        if (mcc && mnc &&
+            strncmp(smf_ue->supi, "imsi-", strlen("imsi-")) == 0) {
+            int mnc_len = 0;
+            char bufOGS_PLMNIDSTRLEN;
+
+            ogs_snprintf(buf, OGS_PLMNIDSTRLEN, "%03d%02d", mcc, mnc);
+            if (strncmp(smf_ue->supi + 5, buf, strlen(buf)) == 0)
+                mnc_len = 2;
+
+            ogs_snprintf(buf, OGS_PLMNIDSTRLEN, "%03d%03d", mcc, mnc);
+            if (strncmp(smf_ue->supi + 5, buf, strlen(buf)) == 0)
+                mnc_len = 3;
+
+            /* Change Home PLMN for VPLMN */
+            if (mnc_len == 2 || mnc_len == 3)
+                ogs_plmn_id_build(&sess->home_plmn_id, mcc, mnc, mnc_len);
         }
-    }
+    } else {
+        if (sess->session.name)
+            ogs_free(sess->session.name);
+        sess->session.name = ogs_strdup(SmContextCreateData->dnn);
+        ogs_assert(sess->session.name);
+
+        if (sess->full_dnn)
+            ogs_free(sess->full_dnn);
+        sess->full_dnn = NULL;
+    }
+
+    ogs_assert(SmContextCreateData->serving_nf_id);
+    if (sess->amf_nf_id) ogs_free(sess->amf_nf_id);
+    sess->amf_nf_id = ogs_strdup(SmContextCreateData->serving_nf_id);
+    ogs_assert(sess->amf_nf_id);
+
+    ogs_assert(SmContextCreateData->guami);
+    ogs_sbi_parse_guami(&sess->guami, SmContextCreateData->guami);
 
     if (SmContextCreateData->pcf_id) {
         if (sess->pcf_id) ogs_free(sess->pcf_id);
@@ -363,20 +424,190 @@
         ogs_assert(sess->pcf_id);
     }
 
-    if (SmContextCreateData->serving_nf_id) {
-        if (sess->serving_nf_id) ogs_free(sess->serving_nf_id);
-        sess->serving_nf_id = ogs_strdup(SmContextCreateData->serving_nf_id);
-        ogs_assert(sess->serving_nf_id);
+    if (SmContextCreateData->h_smf_uri) {
+        if (sess->h_smf_uri) ogs_free(sess->h_smf_uri);
+        sess->h_smf_uri = ogs_strdup(SmContextCreateData->h_smf_uri);
+        ogs_assert(sess->h_smf_uri);
+
+        rc = ogs_sbi_getaddr_from_uri(
+                &scheme, &fqdn, &fqdn_port, &addr, &addr6, sess->h_smf_uri);
+        if (rc == false || scheme == OpenAPI_uri_scheme_NULL) {
+            ogs_error("%s:%d Invalid URI %s",
+                    smf_ue->supi, sess->psi, sess->h_smf_uri);
+            return OGS_ERROR;
+        }
+
+        client = ogs_sbi_client_find(scheme, fqdn, fqdn_port, addr, addr6);
+        if (!client) {
+            ogs_debug("%s: ogs_sbi_client_add()", OGS_FUNC);
+            client = ogs_sbi_client_add(scheme, fqdn, fqdn_port, addr, addr6);
+            if (!client) {
+                ogs_error("%s: ogs_sbi_client_add() failed", OGS_FUNC);
+
+                ogs_free(fqdn);
+                ogs_freeaddrinfo(addr);
+                ogs_freeaddrinfo(addr6);
+
+                return OGS_ERROR;
+            }
+        }
+        OGS_SBI_SETUP_CLIENT(&sess->h_smf, client);
+
+        ogs_free(fqdn);
+        ogs_freeaddrinfo(addr);
+        ogs_freeaddrinfo(addr6);
     }
 
-    /*
-     * NOTE : The pkbuf created in the SBI message will be removed
-     *        from ogs_sbi_message_free().
-     *        So it must be copied and push a event queue.
-     */
-    n1smbuf = ogs_pkbuf_copy(n1smbuf);
-    ogs_assert(n1smbuf);
-    nas_5gs_send_to_gsm(sess, stream, n1smbuf);
+    if (!HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+    /***********************************************************************
+     * CASE 1 - Non-Roaming or LBO
+     * Send N1 Message to the GSM Message Handler
+     ***********************************************************************/
+        /*
+         * NOTE : The pkbuf created in the SBI message will be removed
+         *        from ogs_sbi_message_free().
+         *        So it must be copied and push a event queue.
+         */
+        n1smbuf = ogs_pkbuf_copy(n1smbuf);
+        ogs_assert(n1smbuf);
+        nas_5gs_send_to_gsm(sess, stream, n1smbuf);
+
+        return true;
+    }
+
+    /***********************************************************************
+     * CASE 2 - Home-Routed Roaming (In VSMF)
+     * Send PFCP Session Establiashment Request to the UPF
+     ***********************************************************************/
+
+    /*********************************************************************
+     * If Home-Routed Roaming,
+     * Send HTTP_STATUS_CREATED(/nsmf-pdusession/v1/sm-context) to the AMF
+     *********************************************************************/
+    smf_sbi_send_sm_context_created_data(sess, stream);
+
+    /* Select UPF based on UE Location Information */
+    smf_sess_select_upf(sess);
+
+    /* Check if UPF selection was successful */
+    if (!sess->pfcp_node) {
+        ogs_error("%s:%d No UPF available for session",
+                  smf_ue->supi, sess->psi);
+        return false;
+    }
+
+    /* Check if selected UPF is associated with SMF */
+    if (!OGS_FSM_CHECK(&sess->pfcp_node->sm, smf_pfcp_state_associated)) {
+        ogs_error("%s:%d No associated UPF", smf_ue->supi, sess->psi);
+        return false;
+    }
+
+    /* Remove all previous QoS flow */
+    smf_bearer_remove_all(sess);
+
+    /* Setup Visited CN Tunnel */
+    qos_flow = smf_vcn_tunnel_add(sess);
+    ogs_assert(qos_flow);
+
+    /* Setup PDR */
+    dl_pdr = qos_flow->dl_pdr;
+    ogs_assert(dl_pdr);
+    ul_pdr = qos_flow->ul_pdr;
+    ogs_assert(ul_pdr);
+
+    ogs_assert(sess->pfcp_node);
+    if (sess->pfcp_node->up_function_features.ftup) {
+        dl_pdr->f_teid.ipv4 = 1;
+        dl_pdr->f_teid.ipv6 = 1;
+        dl_pdr->f_teid.ch = 1;
+        dl_pdr->f_teid_len = 1;
+
+        ul_pdr->f_teid.ipv4 = 1;
+        ul_pdr->f_teid.ipv6 = 1;
+        ul_pdr->f_teid.ch = 1;
+        ul_pdr->f_teid_len = 1;
+    } else {
+        ogs_gtpu_resource_t *resource = NULL;
+
+        resource = ogs_pfcp_find_gtpu_resource(
+                &sess->pfcp_node->gtpu_resource_list,
+                sess->session.name, dl_pdr->src_if);
+        if (resource) {
+            ogs_user_plane_ip_resource_info_to_sockaddr(&resource->info,
+                &sess->local_dl_addr, &sess->local_dl_addr6);
+            if (resource->info.teidri)
+                sess->local_dl_teid = OGS_PFCP_GTPU_INDEX_TO_TEID(
+                        dl_pdr->teid, resource->info.teidri,
+                        resource->info.teid_range);
+            else
+                sess->local_dl_teid = dl_pdr->teid;
+        } else {
+            ogs_assert(sess->pfcp_node->addr_list);
+            if (sess->pfcp_node->addr_list->ogs_sa_family == AF_INET)
+                ogs_assert(OGS_OK ==
+                    ogs_copyaddrinfo(
+                        &sess->local_dl_addr, sess->pfcp_node->addr_list));
+            else if (sess->pfcp_node->addr_list->ogs_sa_family == AF_INET6)
+                ogs_assert(OGS_OK ==
+                    ogs_copyaddrinfo(
+                        &sess->local_dl_addr6, sess->pfcp_node->addr_list));
+            else
+                ogs_assert_if_reached();
+
+            sess->local_dl_teid = dl_pdr->teid;
+        }
+
+        ogs_assert(OGS_OK ==
+            ogs_pfcp_sockaddr_to_f_teid(
+                sess->local_ul_addr, sess->local_ul_addr6,
+                &dl_pdr->f_teid, &dl_pdr->f_teid_len));
+        dl_pdr->f_teid.teid = sess->local_ul_teid;
+
+        resource = ogs_pfcp_find_gtpu_resource(
+                &sess->pfcp_node->gtpu_resource_list,
+                sess->session.name, ul_pdr->src_if);
+        if (resource) {
+            ogs_user_plane_ip_resource_info_to_sockaddr(&resource->info,
+                &sess->local_ul_addr, &sess->local_ul_addr6);
+            if (resource->info.teidri)
+                sess->local_ul_teid = OGS_PFCP_GTPU_INDEX_TO_TEID(
+                        ul_pdr->teid, resource->info.teidri,
+                        resource->info.teid_range);
+            else
+                sess->local_ul_teid = ul_pdr->teid;
+        } else {
+            ogs_assert(sess->pfcp_node->addr_list);
+            if (sess->pfcp_node->addr_list->ogs_sa_family == AF_INET)
+                ogs_assert(OGS_OK ==
+                    ogs_copyaddrinfo(
+                        &sess->local_ul_addr, sess->pfcp_node->addr_list));
+            else if (sess->pfcp_node->addr_list->ogs_sa_family == AF_INET6)
+                ogs_assert(OGS_OK ==
+                    ogs_copyaddrinfo(
+                        &sess->local_ul_addr6, sess->pfcp_node->addr_list));
+            else
+                ogs_assert_if_reached();
+
+            sess->local_ul_teid = ul_pdr->teid;
+        }
+
+        ogs_assert(OGS_OK ==
+            ogs_pfcp_sockaddr_to_f_teid(
+                sess->local_ul_addr, sess->local_ul_addr6,
+                &ul_pdr->f_teid, &ul_pdr->f_teid_len));
+        ul_pdr->f_teid.teid = sess->local_ul_teid;
+    }
+
+    dl_pdr->precedence = OGS_PFCP_DEFAULT_PDR_PRECEDENCE;
+    ul_pdr->precedence = OGS_PFCP_DEFAULT_PDR_PRECEDENCE;
+
+    /* Save N1 SM Message and send it to H-SMF */
+    if (sess->n1SmBufFromUe) ogs_pkbuf_free(sess->n1SmBufFromUe);
+    sess->n1SmBufFromUe = ogs_pkbuf_copy(n1smbuf);
+    ogs_assert(sess->n1SmBufFromUe);
+
+    ogs_assert(OGS_OK ==
+            smf_5gc_pfcp_send_session_establishment_request(sess, NULL, 0));
 
     return true;
 }
@@ -384,7 +615,6 @@
 bool smf_nsmf_handle_update_sm_context(
     smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_sbi_message_t *message)
 {
-    int i;
     int r;
     smf_ue_t *smf_ue = NULL;
 
@@ -416,6 +646,14 @@
         return false;
     }
 
+    memset(&sess->nsmf_param, 0, sizeof(sess->nsmf_param));
+
+    /* Remove N1 SM Message From UE */
+    if (sess->n1SmBufFromUe) {
+        ogs_pkbuf_free(sess->n1SmBufFromUe);
+        sess->n1SmBufFromUe = NULL;
+    }
+
     if (SmContextUpdateData->ue_location &&
         SmContextUpdateData->ue_location->nr_location) {
         OpenAPI_nr_location_t *NrLocation =
@@ -436,8 +674,21 @@
                 ogs_plmn_id_hexdump(&sess->nr_cgi.plmn_id),
                 (long long)sess->nr_cgi.cell_id);
         }
+
+        sess->nsmf_param.ue_location = true;
+        sess->nsmf_param.ue_timezone = true;
     }
 
+    if (SmContextUpdateData->ng_ap_cause) {
+        sess->nsmf_param.ngap_cause.group =
+            SmContextUpdateData->ng_ap_cause->group;
+        sess->nsmf_param.ngap_cause.value =
+            SmContextUpdateData->ng_ap_cause->value;
+    }
+    sess->nsmf_param.gmm_cause =
+        SmContextUpdateData->_5g_mm_cause_value;
+    sess->nsmf_param.cause = SmContextUpdateData->cause;
+
     if (SmContextUpdateData->n1_sm_msg) {
         n1SmMsg = SmContextUpdateData->n1_sm_msg;
         if (!n1SmMsg || !n1SmMsg->content_id) {
@@ -462,11 +713,20 @@
         ogs_assert(gsm_header);
         sess->pti = gsm_header->procedure_transaction_identity;
 
-        /*
-         * NOTE : The pkbuf created in the SBI message will be removed
-         *        from ogs_sbi_message_free().
-         *        So it must be copied and push a event queue.
-         */
+        if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+            switch (gsm_header->message_type) {
+            case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST:
+            case OGS_NAS_5GS_PDU_SESSION_RELEASE_REQUEST:
+                /* Save N1 SM Message and send it to H-SMF */
+                sess->n1SmBufFromUe = ogs_pkbuf_copy(n1smbuf);
+                ogs_assert(sess->n1SmBufFromUe);
+                break;
+
+            default:
+                break;
+            }
+        }
+
         n1smbuf = ogs_pkbuf_copy(n1smbuf);
         ogs_assert(n1smbuf);
         nas_5gs_send_to_gsm(sess, stream, n1smbuf);
@@ -506,6 +766,37 @@
             return false;
         }
 
+        if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+    /*
+     * UE-requested PDU Session Modification(ACTIVATED)
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_DL_ONLY|
+     *        OGS_PFCP_MODIFY_OUTER_HEADER_REMOVAL|OGS_PFCP_MODIFY_ACTIVATE
+     * 2.  V: if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING)
+     *            pfcp_flags |= OGS_PFCP_MODIFY_FROM_ACTIVATING;
+     * 3.  V: flags & OGS_PFCP_MODIFY_FROM_ACTIVATING ?
+     *           SMF_UPDATE_STATE_HR_ACTIVATED_FROM_ACTIVATING :
+     *           SMF_UPDATE_STATE_HR_ACTIVATED_FROM_NON_ACTIVATING,
+     * 4.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 5.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 6.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 7.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 8.  H: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_DL_ONLY|
+     *        OGS_PFCP_MODIFY_ACTIVATE
+     * 9.  H: ogs_sbi_send_http_status_no_content
+     * 10. V: case SMF_UPDATE_STATE_HR_ACTIVATED_FROM_ACTIVATING:
+     *           sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+     *           smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *               OpenAPI_up_cnx_state_ACTIVATED);
+     *        case SMF_UPDATE_STATE_HR_ACTIVATED_FROM_NON_ACTIVATING:
+     *           ogs_sbi_send_http_status_no_content
+     */
+            if (SmContextUpdateData->ue_location)
+                sess->nsmf_param.ue_location = true;
+            if (SmContextUpdateData->ue_time_zone)
+                sess->nsmf_param.ue_timezone = true;
+        }
+
         /*
          * NOTE : The pkbuf created in the SBI message will be removed
          *        from ogs_sbi_message_free().
@@ -528,27 +819,77 @@
          ********************************************************/
             if (sess->ngap_state.pdu_session_resource_release ==
                     SMF_NGAP_STATE_DELETE_TRIGGER_UE_REQUESTED) {
-                /*
-                 * 1. UE->SMF: PDU session release request
-                 * 2. PFCP Session Deletion Request/Response
-                 * 3. AMF/SMF->UE : PDUSessionResourceReleaseCommand +
-                 *                  PDU session release command
-                 *    sess->ngap_state.pdu_session_resource_release is set
-                 *      to SMF_NGAP_STATE_DELETE_TRIGGER_UE_REQUESTED
-                 * 4. UE->AMF/SMF : PDUSessionResourceReleaseResponse
-                 *
-                 * If UE sends UEContextReleaseRequest to the AMF/SMF,
-                 * there is no PFCP context in the SMF/UPF.
-                 *
-                 * So, PFCP deactivation is skipped.
-                 */
+/*
+ * If UE initiates PDU Session Release, PFCP context is already removed.
+ * In this case, skip PFCP deactivation and only send UP_CNX_STATE=DEACTIVATED.
+ *
+ * Typical flow:
+ * 1. UE -> SMF: PDU Session Release Request
+ * 2. SMF -> UPF: PFCP Session Deletion
+ * 3. SMF -> UE : ReleaseCommand (NAS + NGAP)
+ * 4. UE -> SMF: PDU Session Release Response
+ *
+ * If UE sends UEContextReleaseRequest after step 4,
+ * PFCP session no longer exists in UPF.
+ */
                 smf_sbi_send_sm_context_updated_data_up_cnx_state(
                         sess, stream, OpenAPI_up_cnx_state_DEACTIVATED);
             } else {
-                ogs_assert(OGS_OK ==
-                    smf_5gc_pfcp_send_all_pdr_modification_request(
-                        sess, stream,
-                        OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_DEACTIVATE, 0));
+                if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+    /*
+     * UE-requested PDU Session Modification(DEACTIVATED)
+     *
+     * For Home Routed Roaming, delegate PFCP deactivation to H-SMF by
+     * sending UP_CNX_STATE=DEACTIVATED via HsmfUpdateData.
+     *
+     * 1.  V*: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 2.  V*: smf_nsmf_pdusession_build_hsmf_update_data
+     *         SMF_UPDATE_STATE_HR_DEACTIVATED
+     * 3.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 4.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 5.  H: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_DL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 6.  H: ogs_sbi_send_http_status_no_content
+     * 7.  V: case SMF_UPDATE_STATE_HR_DEACTIVATED:
+     * 8.  V: smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *          OpenAPI_up_cnx_state_DEACTIVATED)
+     */
+                    sess->nsmf_param.request_indication =
+                        OpenAPI_request_indication_UE_REQ_PDU_SES_MOD;
+
+                    sess->nsmf_param.up_cnx_state =
+                        OpenAPI_up_cnx_state_DEACTIVATED;
+
+                    if (SmContextUpdateData->ue_location)
+                        sess->nsmf_param.ue_location = true;
+                    if (SmContextUpdateData->ue_time_zone)
+                        sess->nsmf_param.ue_timezone = true;
+
+                    if (SmContextUpdateData->ng_ap_cause) {
+                        OpenAPI_ng_ap_cause_t *ngApCause =
+                            SmContextUpdateData->ng_ap_cause;
+                        sess->nsmf_param.ngap_cause.group = ngApCause->group;
+                        sess->nsmf_param.ngap_cause.value = ngApCause->value;
+                    }
+
+                    r = smf_sbi_discover_and_send(
+                            OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                            smf_nsmf_pdusession_build_hsmf_update_data,
+                            sess, stream, SMF_UPDATE_STATE_DEACTIVATED, NULL);
+                    ogs_expect(r == OGS_OK);
+                    ogs_assert(r != OGS_ERROR);
+
+                } else {
+/*
+ * For non-HRR sessions, directly send PFCP PDR modification with
+ * DL-only deactivation to the local UPF.
+ */
+                    ogs_assert(OGS_OK ==
+                        smf_5gc_pfcp_send_all_pdr_modification_request(
+                            sess, stream,
+                            OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_DEACTIVATE,
+                            0, 0));
+                }
             }
 
         } else if (SmContextUpdateData->up_cnx_state ==
@@ -557,9 +898,6 @@
         /*********************************************************
          * Handle ACTIVATING
          ********************************************************/
-            OpenAPI_sm_context_updated_data_t SmContextUpdatedData;
-            OpenAPI_ref_to_binary_data_t n2SmInfo;
-
             if (!OGS_FSM_CHECK(&sess->sm, smf_gsm_state_operational)) {
             /*
              * TS29.502 5.2.2.3.2.2
@@ -605,38 +943,45 @@
                 return false;
             }
 
-            memset(&sendmsg, 0, sizeof(sendmsg));
-            sendmsg.SmContextUpdatedData = &SmContextUpdatedData;
+            if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+    /*
+     * UE-requested PDU Session Modification(ACTIVATING)
+     *
+     * 1.  V*: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 2.  V*: smf_nsmf_pdusession_build_hsmf_update_data
+     *         SMF_UPDATE_STATE_HR_ACTIVATING
+     * 3.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 4.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_MOD
+     * 5.  H: ogs_sbi_send_http_status_no_content
+     * 6.  V: ngap_build_pdu_session_resource_setup_request_transfer
+     * 7.  V: smf_sbi_send_sm_context_updated_data(
+     *          OpenAPI_up_cnx_state_ACTIVATING,
+     *          OpenAPI_n2_sm_info_type_PDU_RES_SETUP_REQ, n2smbuf)
+     */
+                sess->nsmf_param.request_indication =
+                    OpenAPI_request_indication_UE_REQ_PDU_SES_MOD;
 
-            memset(&SmContextUpdatedData, 0, sizeof(SmContextUpdatedData));
-            SmContextUpdatedData.up_cnx_state = OpenAPI_up_cnx_state_ACTIVATING;
-            SmContextUpdatedData.n2_sm_info_type =
-                OpenAPI_n2_sm_info_type_PDU_RES_SETUP_REQ;
-            SmContextUpdatedData.n2_sm_info = &n2SmInfo;
-
-            memset(&n2SmInfo, 0, sizeof(n2SmInfo));
-            n2SmInfo.content_id = (char *)OGS_SBI_CONTENT_NGAP_SM_ID;
-
-            sendmsg.num_of_part = 0;
-
-            sendmsg.partsendmsg.num_of_part.pkbuf =
-                ngap_build_pdu_session_resource_setup_request_transfer(sess);
-            if (sendmsg.partsendmsg.num_of_part.pkbuf) {
-                sendmsg.partsendmsg.num_of_part.content_id =
-                    (char *)OGS_SBI_CONTENT_NGAP_SM_ID;
-                sendmsg.partsendmsg.num_of_part.content_type =
-                    (char *)OGS_SBI_CONTENT_NGAP_TYPE;
-                sendmsg.num_of_part++;
-            }
+                sess->nsmf_param.up_cnx_state =
+                    SmContextUpdateData->up_cnx_state;
 
-            response = ogs_sbi_build_response(&sendmsg, OGS_SBI_HTTP_STATUS_OK);
-            ogs_assert(response);
-            ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+                r = smf_sbi_discover_and_send(
+                        OGS_SBI_SERVICE_TYPE_NSMF_PDUSESSION, NULL,
+                        smf_nsmf_pdusession_build_hsmf_update_data,
+                        sess, stream, SMF_UPDATE_STATE_ACTIVATING, NULL);
+                ogs_expect(r == OGS_OK);
+                ogs_assert(r != OGS_ERROR);
 
-            for (i = 0; i < sendmsg.num_of_part; i++)
-                if (sendmsg.parti.pkbuf)
-                    ogs_pkbuf_free(sendmsg.parti.pkbuf);
+            } else {
+                ogs_pkbuf_t *n2smbuf =
+                    ngap_build_pdu_session_resource_setup_request_transfer(
+                            sess);
+                ogs_assert(n2smbuf);
 
+                smf_sbi_send_sm_context_updated_data(
+                        sess, stream,
+                        OpenAPI_up_cnx_state_ACTIVATING, 0, NULL,
+                        OpenAPI_n2_sm_info_type_PDU_RES_SETUP_REQ, n2smbuf);
+            }
         } else {
             char *strerror = ogs_msprintf("%s:%d Invalid upCnxState %d",
                 smf_ue->supi, sess->psi, SmContextUpdateData->up_cnx_state);
@@ -656,14 +1001,14 @@
 
             if (sess->handover.prepared == true) {
                 /* Need to Update? */
-                if (memcmp(&sess->gnb_n3_ip, &sess->handover.gnb_n3_ip,
-                            sizeof(sess->gnb_n3_ip)) != 0 ||
-                    sess->gnb_n3_teid != sess->handover.gnb_n3_teid)
+                if (memcmp(&sess->remote_dl_ip, &sess->handover.remote_dl_ip,
+                            sizeof(sess->remote_dl_ip)) != 0 ||
+                    sess->remote_dl_teid != sess->handover.remote_dl_teid)
                     far_update = true;
 
-                memcpy(&sess->gnb_n3_ip,
-                        &sess->handover.gnb_n3_ip, sizeof(sess->gnb_n3_ip));
-                sess->gnb_n3_teid = sess->handover.gnb_n3_teid;
+                memcpy(&sess->remote_dl_ip,
+                        &sess->handover.remote_dl_ip, sizeof(sess->remote_dl_ip));
+                sess->remote_dl_teid = sess->handover.remote_dl_teid;
             }
             sess->handover.prepared = false;
 
@@ -680,21 +1025,27 @@
                     dl_far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
                     ogs_assert(OGS_OK ==
                         ogs_pfcp_ip_to_outer_header_creation(
-                            &sess->gnb_n3_ip,
+                            &sess->remote_dl_ip,
                             &dl_far->outer_header_creation,
                             &dl_far->outer_header_creation_len));
-                    dl_far->outer_header_creation.teid = sess->gnb_n3_teid;
+                    dl_far->outer_header_creation.teid = sess->remote_dl_teid;
                 }
                 dl_far->handover.prepared = false;
             }
 
             if (far_update) {
+                uint64_t pfcp_flags =
+                    OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE|
+                    OGS_PFCP_MODIFY_N2_HANDOVER|OGS_PFCP_MODIFY_END_MARKER;
+
+                if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+                    pfcp_flags |= OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING;
+                    pfcp_flags |= OGS_PFCP_MODIFY_OUTER_HEADER_REMOVAL;
+                }
+
                 ogs_assert(OGS_OK ==
                     smf_5gc_pfcp_send_all_pdr_modification_request(
-                        sess, stream,
-                        OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE|
-                        OGS_PFCP_MODIFY_N2_HANDOVER|OGS_PFCP_MODIFY_END_MARKER,
-                        0));
+                        sess, stream, pfcp_flags, 0, 0));
             } else {
                 char *strerror = ogs_msprintf(
                         "%s:%d No FAR Update", smf_ue->supi, sess->psi);
@@ -727,7 +1078,7 @@
                         sess, stream,
                         OGS_PFCP_MODIFY_INDIRECT|OGS_PFCP_MODIFY_REMOVE|
                         OGS_PFCP_MODIFY_HANDOVER_CANCEL,
-                        0));
+                        0, 0));
             } else {
                 smf_sbi_send_sm_context_updated_data_ho_state(
                         sess, stream, OpenAPI_ho_state_CANCELLED);
@@ -761,48 +1112,51 @@
             ogs_assert(true ==
                     ogs_sbi_server_send_response(stream, response));
 
-        } else if (PCF_SM_POLICY_ASSOCIATED(sess)) {
-            smf_npcf_smpolicycontrol_param_t param;
-
-            memset(&param, 0, sizeof(param));
-
-            param.ue_location = true;
-            param.ue_timezone = true;
-
-            r = smf_sbi_discover_and_send(
-                    OGS_SBI_SERVICE_TYPE_NPCF_SMPOLICYCONTROL, NULL,
-                    smf_npcf_smpolicycontrol_build_delete,
-                    sess, stream,
-                    OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT, &param);
-            ogs_expect(r == OGS_OK);
-            ogs_assert(r != OGS_ERROR);
-        } else if (UDM_SDM_SUBSCRIBED(sess)) {
-            ogs_warn("%s:%d No PolicyAssociationId. Forcibly remove SESSION",
-                    smf_ue->supi, sess->psi);
-            r = smf_sbi_discover_and_send(
-                    OGS_SBI_SERVICE_TYPE_NUDM_SDM, NULL,
-                    smf_nudm_sdm_build_subscription_delete, sess, stream,
-                    SMF_UECM_STATE_DEREGISTERED_BY_AMF, NULL);
-            ogs_expect(r == OGS_OK);
-            ogs_assert(r != OGS_ERROR);
         } else {
-            ogs_warn("%s:%d No UDM Subscription. Forcibly remove SESSION",
-                    smf_ue->supi, sess->psi);
-            r = smf_sbi_discover_and_send(
-                    OGS_SBI_SERVICE_TYPE_NUDM_UECM, NULL,
-                    smf_nudm_uecm_build_deregistration, sess, stream,
-                    SMF_UECM_STATE_DEREGISTERED_BY_AMF, NULL);
-            ogs_expect(r == OGS_OK);
-            ogs_assert(r != OGS_ERROR);
+            if (HOME_ROUTED_ROAMING_IN_VSMF(sess)) {
+    /*
+     * Network-requested PDU Session Release(DUPLICATED)
+     *
+     * 1.  V*: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *         OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V*: OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT,
+     * 3.  V: OpenAPI_request_indication_NW_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_NW_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_AMF_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 11. H: SMF_SESS_CLEAR(sess)
+     * 12. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT
+     * 13. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 14. V: ogs_sbi_send_http_status_no_content
+     * 15. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                ogs_assert(OGS_OK ==
+                    smf_5gc_pfcp_send_all_pdr_modification_request(
+                        sess, stream,
+                        OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+                        OGS_PFCP_MODIFY_UL_ONLY|
+                        OGS_PFCP_MODIFY_DEACTIVATE,
+                        OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT, 0));
+            } else {
+                smf_trigger_session_release(
+                        sess, stream,
+                        OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT);
+            }
         }
     } else if (SmContextUpdateData->serving_nf_id) {
-        ogs_debug("Old serving_nf_id: %s, new serving_nf_id: %s",
-            sess->serving_nf_id, SmContextUpdateData->serving_nf_id);
+        ogs_debug("Old amf_nf_id: %s, new amf_nf_id: %s",
+            sess->amf_nf_id, SmContextUpdateData->serving_nf_id);
 
-        if (sess->serving_nf_id)
-            ogs_free(sess->serving_nf_id);
-        sess->serving_nf_id = ogs_strdup(SmContextUpdateData->serving_nf_id);
-        ogs_assert(sess->serving_nf_id);
+        if (sess->amf_nf_id)
+            ogs_free(sess->amf_nf_id);
+        sess->amf_nf_id = ogs_strdup(SmContextUpdateData->serving_nf_id);
+        ogs_assert(sess->amf_nf_id);
 
         memset(&sendmsg, 0, sizeof(sendmsg));
         response = ogs_sbi_build_response(
@@ -823,8 +1177,6 @@
 bool smf_nsmf_handle_release_sm_context(
     smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_sbi_message_t *message)
 {
-    int r;
-    smf_npcf_smpolicycontrol_param_t param;
     smf_ue_t *smf_ue = NULL;
 
     OpenAPI_sm_context_release_data_t *SmContextReleaseData = NULL;
@@ -835,7 +1187,7 @@
     smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
     ogs_assert(smf_ue);
 
-    memset(&param, 0, sizeof(param));
+    memset(&sess->nsmf_param, 0, sizeof(sess->nsmf_param));
 
     SmContextReleaseData = message->SmContextReleaseData;
     if (SmContextReleaseData) {
@@ -862,51 +1214,1443 @@
                     (long long)sess->nr_cgi.cell_id);
             }
 
-            param.ue_location = true;
-            param.ue_timezone = true;
+            sess->nsmf_param.ue_location = true;
+            sess->nsmf_param.ue_timezone = true;
         }
 
         if (SmContextReleaseData->ng_ap_cause) {
-            param.ran_nas_release.ngap_cause.group =
+            sess->nsmf_param.ngap_cause.group =
                 SmContextReleaseData->ng_ap_cause->group;
-            param.ran_nas_release.ngap_cause.value =
+            sess->nsmf_param.ngap_cause.value =
                 SmContextReleaseData->ng_ap_cause->value;
         }
-        param.ran_nas_release.gmm_cause =
+        sess->nsmf_param.gmm_cause =
             SmContextReleaseData->_5g_mm_cause_value;
+        sess->nsmf_param.cause = SmContextReleaseData->cause;
+    }
+
+    return true;
+}
+
+bool smf_nsmf_handle_create_data_in_hsmf(
+    smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_sbi_message_t *recvmsg)
+{
+    bool rc;
+    smf_ue_t *smf_ue = NULL;
+    char *type = NULL;
+
+    int rv, r;
+    ogs_nas_5gs_message_t nas_message;
+    ogs_pkbuf_t *n1SmBufFromUe = NULL;
+    ogs_nas_pdu_session_type_t *pdu_session_type = NULL;
+
+    ogs_nas_5gs_pdu_session_establishment_request_t
+        *pdu_session_establishment_request = NULL;
+    ogs_nas_ssc_mode_t *ssc_mode = NULL;
+
+    ogs_sbi_client_t *client = NULL;
+    OpenAPI_uri_scheme_e scheme = OpenAPI_uri_scheme_NULL;
+    char *fqdn = NULL;
+    uint16_t fqdn_port = 0;
+    ogs_sockaddr_t *addr = NULL, *addr6 = NULL;
+    char *dnn_oi = NULL;
+
+    OpenAPI_pdu_session_create_data_t *PduSessionCreateData = NULL;
+    OpenAPI_nr_location_t *NrLocation = NULL;
+    OpenAPI_snssai_t *sNssai = NULL;
+    OpenAPI_plmn_id_nid_t *servingNetwork = NULL;
+    OpenAPI_ref_to_binary_data_t *n1SmInfoFromUe = NULL;
+    OpenAPI_tunnel_info_t *vcnTunnelInfo = NULL;
+
+    ogs_assert(stream);
+    ogs_assert(recvmsg);
+
+    ogs_assert(sess);
+    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+    ogs_assert(smf_ue);
+
+    PduSessionCreateData = recvmsg->PduSessionCreateData;
+    if (!PduSessionCreateData) {
+        ogs_error("%s:%d No PduSessionCreateData",
+                smf_ue->supi, sess->psi);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No PduSessionCreateData", smf_ue->supi, NULL);
+        return false;
+    }
+
+    n1SmInfoFromUe = PduSessionCreateData->n1_sm_info_from_ue;
+    if (!n1SmInfoFromUe || !n1SmInfoFromUe->content_id) {
+        ogs_error("%s:%d No n1SmInfoFromUe", smf_ue->supi, sess->psi);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No n1SmInfoFromUe", smf_ue->supi, NULL);
+        return false;
+    }
+
+    n1SmBufFromUe = ogs_sbi_find_part_by_content_id(
+            recvmsg, n1SmInfoFromUe->content_id);
+    if (!n1SmBufFromUe) {
+        ogs_error("%s:%d No N1 SM Content %s",
+                smf_ue->supi, sess->psi, n1SmInfoFromUe->content_id);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No N1 SM Content", smf_ue->supi, NULL);
+        return false;
+    }
+
+    rv = gsmue_decode_n1_sm_info(&nas_message, n1SmBufFromUe);
+    if (rv != OGS_OK) {
+        ogs_error("%s:%d cannot decode N1 SM Content %s",
+                smf_ue->supi, sess->psi, n1SmInfoFromUe->content_id);
+        ogs_log_hexdump(OGS_LOG_ERROR, n1SmBufFromUe->data, n1SmBufFromUe->len);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_SEMANTICALLY_INCORRECT_MESSAGE,
+                "cannot decode N1 SM Content", smf_ue->supi, NULL);
+        return false;
+    }
+
+    if (!PduSessionCreateData->dnn) {
+        ogs_error("%s:%d No DNN", smf_ue->supi, sess->psi);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No DNN", smf_ue->supi, NULL);
+        return false;
+    }
+
+    dnn_oi = ogs_dnn_oi_from_fqdn(PduSessionCreateData->dnn);
+
+    if (dnn_oi) {
+        char dnn_niOGS_MAX_DNN_LEN+1;
+
+        ogs_assert(dnn_oi > PduSessionCreateData->dnn);
+
+        ogs_cpystrn(dnn_ni, PduSessionCreateData->dnn,
+            ogs_min(OGS_MAX_DNN_LEN, dnn_oi - PduSessionCreateData->dnn));
+
+        if (sess->session.name)
+            ogs_free(sess->session.name);
+        sess->session.name = ogs_strdup(dnn_ni);
+        ogs_assert(sess->session.name);
+
+        if (sess->full_dnn)
+            ogs_free(sess->full_dnn);
+        sess->full_dnn = ogs_strdup(PduSessionCreateData->dnn);
+        ogs_assert(sess->full_dnn);
+    } else {
+        if (sess->session.name)
+            ogs_free(sess->session.name);
+        sess->session.name = ogs_strdup(PduSessionCreateData->dnn);
+        ogs_assert(sess->session.name);
+
+        if (sess->full_dnn)
+            ogs_free(sess->full_dnn);
+        sess->full_dnn = NULL;
+    }
+
+    sNssai = PduSessionCreateData->s_nssai;
+    if (!sNssai) {
+        ogs_error("%s:%d No sNssai", smf_ue->supi, sess->psi);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No sNssai", smf_ue->supi, NULL);
+        return false;
+    }
+
+    if (!PduSessionCreateData->vsmf_id) {
+        ogs_error("%s:%d No vsmfId", smf_ue->supi, sess->psi);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No vsmfId", smf_ue->supi, NULL);
+        return false;
+    }
+
+    servingNetwork = PduSessionCreateData->serving_network;
+    if (!servingNetwork || !servingNetwork->mnc || !servingNetwork->mcc) {
+        ogs_error("%s:%d No servingNetwork",
+                smf_ue->supi, sess->psi);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No servingNetwork", smf_ue->supi, NULL);
+        return false;
+    }
+
+    if (!PduSessionCreateData->an_type) {
+        ogs_error("%s:%d No anType", smf_ue->supi, sess->psi);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No anType", smf_ue->supi, NULL);
+        return false;
+    }
+
+    if (!PduSessionCreateData->rat_type) {
+        ogs_error("%s:%d No ratType", smf_ue->supi, sess->psi);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No ratType", smf_ue->supi, NULL);
+        return false;
+    }
+
+    if (!PduSessionCreateData->ue_location ||
+        !PduSessionCreateData->ue_location->nr_location) {
+        ogs_error("%s:%d No UeLocation", smf_ue->supi, sess->psi);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No UeLocation", smf_ue->supi, NULL);
+        return false;
+    }
+
+    NrLocation = PduSessionCreateData->ue_location->nr_location;
+    if (!NrLocation->tai ||
+        !NrLocation->tai->plmn_id || !NrLocation->tai->tac ||
+        !NrLocation->ncgi ||
+        !NrLocation->ncgi->plmn_id || !NrLocation->ncgi->nr_cell_id) {
+        ogs_error("%s:%d No NrLocation", smf_ue->supi, sess->psi);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No UeLocation", smf_ue->supi, NULL);
+        return false;
+    }
+
+    if (!PduSessionCreateData->amf_nf_id) {
+        ogs_error("%s:%d No Serving AMF NF-ID", smf_ue->supi, sess->psi);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No Serving AMF NF-ID", smf_ue->supi, NULL);
+        return false;
+    }
+
+    if (!PduSessionCreateData->guami) {
+        ogs_error("%s:%d No Guami", smf_ue->supi, sess->psi);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No Guami", smf_ue->supi, NULL);
+        return false;
+    }
+
+    vcnTunnelInfo = PduSessionCreateData->vcn_tunnel_info;
+    if (!vcnTunnelInfo ||
+        !(vcnTunnelInfo->ipv4_addr || vcnTunnelInfo->ipv6_addr) ||
+        !vcnTunnelInfo->gtp_teid) {
+        ogs_error("%s:%d No vcnTunnelInfo %s:%s:%s",
+                smf_ue->supi, sess->psi,
+                vcnTunnelInfo->ipv4_addr ? vcnTunnelInfo->ipv4_addr : "NULL",
+                vcnTunnelInfo->ipv6_addr ? vcnTunnelInfo->ipv6_addr : "NULL",
+                vcnTunnelInfo->gtp_teid ? vcnTunnelInfo->gtp_teid : "NULL");
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No vcnTunnelInfo", smf_ue->supi, NULL);
+        return false;
+    }
+
+    memset(&sess->remote_dl_ip, 0, sizeof(sess->remote_dl_ip));
+    if (vcnTunnelInfo->ipv4_addr) {
+        rv = ogs_ipv4_from_string(
+                &sess->remote_dl_ip.addr, vcnTunnelInfo->ipv4_addr);
+        if (rv != OGS_OK) {
+            ogs_error("ogs_ipv4_from_string() %s failed",
+                    vcnTunnelInfo->ipv4_addr);
+            smf_sbi_send_pdu_session_create_error(stream,
+                    OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                    OGS_5GSM_CAUSE_SEMANTICALLY_INCORRECT_MESSAGE,
+                    "ogs_ipv4_from_string() failed",
+                    vcnTunnelInfo->ipv4_addr, NULL);
+            return false;
+        }
+        sess->remote_dl_ip.ipv4 = 1;
+        sess->remote_dl_ip.len = OGS_IPV4_LEN;
+    }
+    if (vcnTunnelInfo->ipv6_addr) {
+        rv = ogs_ipv6addr_from_string(
+                sess->remote_dl_ip.addr6, vcnTunnelInfo->ipv6_addr);
+        if (rv != OGS_OK) {
+            ogs_error("ogs_ipv6addr_from_string() %s failed",
+                    vcnTunnelInfo->ipv6_addr);
+            smf_sbi_send_pdu_session_create_error(stream,
+                    OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                    OGS_5GSM_CAUSE_SEMANTICALLY_INCORRECT_MESSAGE,
+                    "ogs_ipv6addr_from_string() failed",
+                    vcnTunnelInfo->ipv6_addr, NULL);
+            return false;
+        }
+        sess->remote_dl_ip.ipv6 = 1;
+        sess->remote_dl_ip.len = OGS_IPV6_LEN;
+    }
+
+    if (sess->remote_dl_ip.ipv4 && sess->remote_dl_ip.ipv6)
+        sess->remote_dl_ip.len = OGS_IPV4V6_LEN;
+
+    if (vcnTunnelInfo->gtp_teid)
+        sess->remote_dl_teid =
+            ogs_uint64_from_string_hexadecimal(vcnTunnelInfo->gtp_teid);
+    ogs_debug("vcnTunnelInfo->ipv4 = 0x%x", sess->remote_dl_ip.addr);
+    ogs_log_hexdump(OGS_LOG_DEBUG, sess->remote_dl_ip.addr6, OGS_IPV6_LEN);
+    ogs_debug("vcnTunnelInfo->gtp_teid = 0x%x", sess->remote_dl_teid);
+
+    if (!PduSessionCreateData->max_integrity_protected_data_rate_ul ||
+        !PduSessionCreateData->max_integrity_protected_data_rate_dl) {
+        ogs_error("%s:%d No Max Integrity Protected Data",
+                smf_ue->supi, sess->psi);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No Max Integrity Protected Data", smf_ue->supi, NULL);
+        return false;
+    }
+
+    sess->integrity_protection.mbr_dl =
+        PduSessionCreateData->max_integrity_protected_data_rate_dl;
+    sess->integrity_protection.mbr_ul =
+        PduSessionCreateData->max_integrity_protected_data_rate_ul;
+
+    if (!PduSessionCreateData->vsmf_pdu_session_uri) {
+        ogs_error("%s:%d No PduSessionStatusNotification",
+                smf_ue->supi, sess->psi);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No PduSessionStatusNotification", smf_ue->supi, NULL);
+        return false;
+    }
+
+    rc = ogs_sbi_getaddr_from_uri(&scheme, &fqdn, &fqdn_port, &addr, &addr6,
+            PduSessionCreateData->vsmf_pdu_session_uri);
+    if (rc == false || scheme == OpenAPI_uri_scheme_NULL) {
+        ogs_error("%s:%d Invalid URI %s",
+                smf_ue->supi, sess->psi,
+                PduSessionCreateData->vsmf_pdu_session_uri);
+        smf_sbi_send_pdu_session_create_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_SEMANTICALLY_INCORRECT_MESSAGE,
+                "Invalid URI",
+                PduSessionCreateData->vsmf_pdu_session_uri, NULL);
+        return false;
+    }
+
+    if (sess->vsmf_pdu_session_uri)
+        ogs_free(sess->vsmf_pdu_session_uri);
+    sess->vsmf_pdu_session_uri =
+        ogs_strdup(PduSessionCreateData->vsmf_pdu_session_uri);
+    ogs_assert(sess->vsmf_pdu_session_uri);
+
+    client = ogs_sbi_client_find(scheme, fqdn, fqdn_port, addr, addr6);
+    if (!client) {
+        ogs_debug("%s: ogs_sbi_client_add()", OGS_FUNC);
+        client = ogs_sbi_client_add(scheme, fqdn, fqdn_port, addr, addr6);
+        if (!client) {
+            ogs_error("%s: ogs_sbi_client_add() failed", OGS_FUNC);
+
+            ogs_free(fqdn);
+            ogs_freeaddrinfo(addr);
+            ogs_freeaddrinfo(addr6);
+
+            return false;
+        }
+    }
+    OGS_SBI_SETUP_CLIENT(&sess->v_smf, client);
+
+    ogs_free(fqdn);
+    ogs_freeaddrinfo(addr);
+    ogs_freeaddrinfo(addr6);
+
+    if (PduSessionCreateData->supi) {
+        type = ogs_id_get_type(PduSessionCreateData->supi);
+        if (type) {
+            if (strncmp(type, OGS_ID_SUPI_TYPE_IMSI,
+                        strlen(OGS_ID_SUPI_TYPE_IMSI)) == 0) {
+                char *imsi_bcd = ogs_id_get_value(PduSessionCreateData->supi);
+
+                ogs_cpystrn(smf_ue->imsi_bcd, imsi_bcd,
+                        ogs_min(strlen(imsi_bcd), OGS_MAX_IMSI_BCD_LEN)+1);
+                ogs_bcd_to_buffer(smf_ue->imsi_bcd,
+                        smf_ue->imsi, &smf_ue->imsi_len);
+
+                ogs_free(imsi_bcd);
+            }
+            ogs_free(type);
+        }
+    }
+
+    if (PduSessionCreateData->pei) {
+        type = ogs_id_get_type(PduSessionCreateData->pei);
+        if (type) {
+            if (strncmp(type, OGS_ID_SUPI_TYPE_IMEISV,
+                        strlen(OGS_ID_SUPI_TYPE_IMEISV)) == 0) {
+                char *imeisv_bcd = ogs_id_get_value(PduSessionCreateData->pei);
+
+                ogs_cpystrn(smf_ue->imeisv_bcd, imeisv_bcd,
+                        ogs_min(strlen(imeisv_bcd), OGS_MAX_IMEISV_BCD_LEN)+1);
+                ogs_bcd_to_buffer(smf_ue->imeisv_bcd,
+                        smf_ue->imeisv, &smf_ue->imeisv_len);
+
+                ogs_free(imeisv_bcd);
+            }
+            ogs_free(type);
+        }
+    }
+
+    if (PduSessionCreateData->gpsi) {
+        type = ogs_id_get_type(PduSessionCreateData->gpsi);
+        if (type) {
+            if (strncmp(type, OGS_ID_GPSI_TYPE_MSISDN,
+                        strlen(OGS_ID_GPSI_TYPE_MSISDN)) == 0) {
+                char *msisdn_bcd = ogs_id_get_value(PduSessionCreateData->gpsi);
+
+                ogs_cpystrn(smf_ue->msisdn_bcd, msisdn_bcd,
+                        ogs_min(strlen(msisdn_bcd), OGS_MAX_MSISDN_BCD_LEN)+1);
+                ogs_bcd_to_buffer(smf_ue->msisdn_bcd,
+                        smf_ue->msisdn, &smf_ue->msisdn_len);
+
+                ogs_free(msisdn_bcd);
+            }
+            ogs_free(type);
+        }
+    }
+
+    sess->request_type = PduSessionCreateData->request_type;
+
+    ogs_sbi_parse_plmn_id_nid(&sess->serving_plmn_id, servingNetwork);
+    memcpy(&sess->home_plmn_id, &sess->serving_plmn_id, OGS_PLMN_ID_LEN);
+
+    sess->an_type = PduSessionCreateData->an_type;
+    sess->sbi_rat_type = PduSessionCreateData->rat_type;
+
+    ogs_sbi_parse_nr_location(&sess->nr_tai, &sess->nr_cgi, NrLocation);
+    if (NrLocation->ue_location_timestamp)
+        ogs_sbi_time_from_string(&sess->ue_location_timestamp,
+                NrLocation->ue_location_timestamp);
+
+    if (sess->amf_nf_id)
+        ogs_free(sess->amf_nf_id);
+    sess->amf_nf_id = ogs_strdup(PduSessionCreateData->amf_nf_id);
+    ogs_assert(sess->amf_nf_id);
+
+    ogs_sbi_parse_guami(&sess->guami, PduSessionCreateData->guami);
+
+    sess->s_nssai.sst = sNssai->sst;
+    sess->s_nssai.sd = ogs_s_nssai_sd_from_string(sNssai->sd);
+    if (PduSessionCreateData->hplmn_snssai) {
+        sess->mapped_hplmn.sst = PduSessionCreateData->hplmn_snssai->sst;
+        sess->mapped_hplmn.sd = ogs_s_nssai_sd_from_string(
+                                    PduSessionCreateData->hplmn_snssai->sd);
+    }
+
+    /* Handle GSM Message from n1SmInfoFromUe */
+    pdu_session_establishment_request =
+        &nas_message.gsm.pdu_session_establishment_request;
+    pdu_session_type = &pdu_session_establishment_request->pdu_session_type;
+    ssc_mode = &pdu_session_establishment_request->ssc_mode;
+
+    if (pdu_session_establishment_request->presencemask &
+        OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_PDU_SESSION_TYPE_PRESENT)
+        sess->ue_session_type = pdu_session_type->value;
+
+    if (pdu_session_establishment_request->presencemask &
+        OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_SSC_MODE_PRESENT)
+        sess->ue_ssc_mode = ssc_mode->value;
+
+    if (pdu_session_establishment_request->presencemask &
+        OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_REQUEST_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT) {
+        OGS_NAS_STORE_DATA(&sess->nas.ue_epco,
+            &pdu_session_establishment_request->
+                extended_protocol_configuration_options);
     }
 
-    if (PCF_SM_POLICY_ASSOCIATED(sess)) {
-        r = smf_sbi_discover_and_send(
-                OGS_SBI_SERVICE_TYPE_NPCF_SMPOLICYCONTROL, NULL,
-                smf_npcf_smpolicycontrol_build_delete,
-                sess, stream,
-                OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT, &param);
-        ogs_expect(r == OGS_OK);
-        ogs_assert(r != OGS_ERROR);
-    } else if (UDM_SDM_SUBSCRIBED(sess)) {
-        ogs_warn("%s:%d No PolicyAssociationId. Forcibly remove SESSION",
-                smf_ue->supi, sess->psi);
-        r = smf_sbi_discover_and_send(
-                OGS_SBI_SERVICE_TYPE_NUDM_SDM, NULL,
-                smf_nudm_sdm_build_subscription_delete, sess, stream,
-                SMF_UECM_STATE_DEREGISTERED_BY_AMF, NULL);
-        ogs_expect(r == OGS_OK);
-        ogs_assert(r != OGS_ERROR);
+    smf_metrics_inst_by_slice_add(&sess->serving_plmn_id, &sess->s_nssai,
+            SMF_METR_GAUGE_SM_SESSIONNBR, 1);
+    smf_metrics_inst_by_slice_add(&sess->serving_plmn_id, &sess->s_nssai,
+            SMF_METR_CTR_SM_PDUSESSIONCREATIONREQ, 1);
+
+    r = smf_sbi_discover_and_send(OGS_SBI_SERVICE_TYPE_NUDM_SDM, NULL,
+            smf_nudm_sdm_build_get,
+            sess, stream, 0, (char *)OGS_SBI_RESOURCE_NAME_SM_DATA);
+    ogs_expect(r == OGS_OK);
+    ogs_assert(r != OGS_ERROR);
+
+    return true;
+}
+
+bool smf_nsmf_handle_created_data_in_vsmf(
+    smf_sess_t *sess, ogs_sbi_message_t *recvmsg)
+{
+    int rv;
+
+    smf_ue_t *smf_ue = NULL;
+
+    ogs_assert(recvmsg);
+
+    ogs_assert(sess);
+    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+    ogs_assert(smf_ue);
+
+    if (recvmsg->res_status == OGS_SBI_HTTP_STATUS_CREATED) {
+        OpenAPI_pdu_session_created_data_t *PduSessionCreatedData = NULL;
+
+        ogs_sbi_message_t message;
+        ogs_sbi_header_t header;
+
+        bool rc;
+        ogs_sbi_client_t *client = NULL;
+        OpenAPI_uri_scheme_e scheme = OpenAPI_uri_scheme_NULL;
+        char *fqdn = NULL;
+        uint16_t fqdn_port = 0;
+        ogs_sockaddr_t *addr = NULL, *addr6 = NULL;
+
+        ogs_ip_t ue_ip;
+        uint8_t prefixlen;
+
+        OpenAPI_tunnel_info_t *hcnTunnelInfo = NULL;
+        OpenAPI_ambr_t *sessionAmbr = NULL;
+        OpenAPI_list_t *qosFlowsSetupList = NULL;
+        OpenAPI_qos_flow_profile_t *qosFlowProfile = NULL;
+        OpenAPI_lnode_t *node = NULL;
+
+        ogs_nas_5gs_message_t nas_message;
+        ogs_pkbuf_t *n1SmBufToUe = NULL;
+        OpenAPI_ref_to_binary_data_t *n1SmInfoToUe = NULL;
+
+        ogs_nas_5gs_pdu_session_establishment_accept_t
+            *pdu_session_establishment_accept = NULL;
+
+        smf_bearer_t *qos_flow = NULL;
+        ogs_pfcp_pdr_t *dl_pdr = NULL;
+        ogs_pfcp_pdr_t *ul_pdr = NULL;
+        ogs_pfcp_far_t *ul_far = NULL;
+
+        qos_flow = smf_default_bearer_in_sess(sess);
+        ogs_assert(qos_flow);
+        ogs_assert(ogs_list_next(qos_flow) == NULL);
+
+        PduSessionCreatedData = recvmsg->PduSessionCreatedData;
+
+        n1SmInfoToUe = PduSessionCreatedData->n1_sm_info_to_ue;
+        if (!n1SmInfoToUe || !n1SmInfoToUe->content_id) {
+            ogs_error("%s:%d No n1SmInfoToUe", smf_ue->supi, sess->psi);
+            return false;
+        }
+
+        n1SmBufToUe = ogs_sbi_find_part_by_content_id(
+                recvmsg, n1SmInfoToUe->content_id);
+        if (!n1SmBufToUe) {
+            ogs_error("%s:%d No N1 SM Content %s",
+                    smf_ue->supi, sess->psi, n1SmInfoToUe->content_id);
+            return false;
+        }
+
+        rv = gsmue_decode_n1_sm_info(&nas_message, n1SmBufToUe);
+        if (rv != OGS_OK) {
+            ogs_error("%s:%d cannot decode N1 SM Content %s",
+                    smf_ue->supi, sess->psi, n1SmInfoToUe->content_id);
+            ogs_log_hexdump(OGS_LOG_ERROR, n1SmBufToUe->data, n1SmBufToUe->len);
+            return false;
+        }
+
+        if (!PduSessionCreatedData->pdu_session_type) {
+            ogs_error("%s:%d No pduSessionType", smf_ue->supi, sess->psi);
+            return false;
+        }
+
+        sess->paa.session_type = sess->session.session_type =
+            PduSessionCreatedData->pdu_session_type;
+
+        memset(&ue_ip, 0, sizeof(ue_ip));
+        prefixlen = 0;
+
+        if (PduSessionCreatedData->ue_ipv4_address) {
+            rv = ogs_ipv4_from_string(
+                &ue_ip.addr, PduSessionCreatedData->ue_ipv4_address);
+            if (rv != OGS_OK) {
+                ogs_error("%s:%d Invalid ue_ipv4_address %s",
+                        smf_ue->supi, sess->psi,
+                        PduSessionCreatedData->ue_ipv4_address);
+                return false;
+            }
+            ue_ip.ipv4 = 1;
+        }
+        if (PduSessionCreatedData->ue_ipv6_prefix &&
+            PduSessionCreatedData->ue_ipv6_interface_id) {
+            rv = ogs_ipv6prefix_from_string(
+                ue_ip.addr6, &prefixlen, PduSessionCreatedData->ue_ipv6_prefix);
+            if (rv != OGS_OK) {
+                ogs_error("%s:%d Invalid ue_ipv6_prefix %s",
+                        smf_ue->supi, sess->psi,
+                        PduSessionCreatedData->ue_ipv6_prefix);
+                return false;
+            }
+            ogs_hex_from_string(
+                    PduSessionCreatedData->ue_ipv6_interface_id,
+                    ue_ip.addr6+(OGS_IPV6_LEN>>1), OGS_IPV6_LEN>>1);
+            ue_ip.ipv6 = 1;
+        }
+
+        if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
+            if (ue_ip.ipv4 == 0) {
+                ogs_error("%s:%d No ue_ipv4_address",
+                        smf_ue->supi, sess->psi);
+                return false;
+            }
+            sess->paa.addr = ue_ip.addr;
+        } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
+            if (ue_ip.ipv6 == 0) {
+                ogs_error("%s:%d No ue_ipv6_prefix", smf_ue->supi, sess->psi);
+                return false;
+            }
+            sess->paa.len = prefixlen;
+            memcpy(sess->paa.addr6, ue_ip.addr6, OGS_IPV6_LEN);
+        } else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
+            if (ue_ip.ipv4 == 0) {
+                ogs_error("%s:%d No ue_ipv4_address",
+                        smf_ue->supi, sess->psi);
+                return false;
+            }
+            if (ue_ip.ipv6 == 0) {
+                ogs_error("%s:%d No ue_ipv6_prefix", smf_ue->supi, sess->psi);
+                return false;
+            }
+            sess->paa.both.addr = ue_ip.addr;
+            sess->paa.both.len = prefixlen;
+            memcpy(sess->paa.both.addr6, ue_ip.addr6, OGS_IPV6_LEN);
+        } else {
+            ogs_error("%s:%d Invalid sess->session.session_type %d",
+                    smf_ue->supi, sess->psi, sess->session.session_type);
+            return false;
+        }
+
+        if (!PduSessionCreatedData->ssc_mode) {
+            ogs_error("%s:%d No sscMode", smf_ue->supi, sess->psi);
+            return false;
+        }
+
+        sess->session.ssc_mode =
+            ogs_from_hex(PduSessionCreatedData->ssc_mode0);
+        if (sess->session.ssc_mode < OGS_SSC_MODE_1 ||
+                sess->session.ssc_mode > OGS_SSC_MODE_3) {
+            ogs_error("%s:%d Invalid sscMode %d:%s",
+                    smf_ue->supi, sess->psi, sess->session.ssc_mode,
+                    PduSessionCreatedData->ssc_mode);
+            return false;
+        }
+
+        hcnTunnelInfo = PduSessionCreatedData->hcn_tunnel_info;
+        if (!hcnTunnelInfo ||
+            !(hcnTunnelInfo->ipv4_addr || hcnTunnelInfo->ipv6_addr) ||
+            !hcnTunnelInfo->gtp_teid) {
+            ogs_error("%s:%d No hcnTunnelInfo %s:%s:%s",
+                smf_ue->supi, sess->psi,
+                hcnTunnelInfo->ipv4_addr ? hcnTunnelInfo->ipv4_addr : "NULL",
+                hcnTunnelInfo->ipv6_addr ? hcnTunnelInfo->ipv6_addr : "NULL",
+                hcnTunnelInfo->gtp_teid ? hcnTunnelInfo->gtp_teid : "NULL");
+            return false;
+        }
+
+        memset(&sess->remote_ul_ip, 0, sizeof(sess->remote_ul_ip));
+
+        if (hcnTunnelInfo->ipv4_addr) {
+            rv = ogs_ipv4_from_string(
+                    &sess->remote_ul_ip.addr, hcnTunnelInfo->ipv4_addr);
+            if (rv != OGS_OK) {
+                ogs_error("ogs_ipv4_from_string() %s failed",
+                        hcnTunnelInfo->ipv4_addr);
+                return false;
+            }
+            sess->remote_ul_ip.ipv4 = 1;
+            sess->remote_ul_ip.len = OGS_IPV4_LEN;
+        }
+        if (hcnTunnelInfo->ipv6_addr) {
+            rv = ogs_ipv6addr_from_string(
+                    sess->remote_ul_ip.addr6, hcnTunnelInfo->ipv6_addr);
+            if (rv != OGS_OK) {
+                ogs_error("ogs_ipv6addr_from_string() %s failed",
+                        hcnTunnelInfo->ipv6_addr);
+                return false;
+            }
+            sess->remote_ul_ip.ipv6 = 1;
+            sess->remote_ul_ip.len = OGS_IPV6_LEN;
+        }
+
+        if (sess->remote_ul_ip.ipv4 && sess->remote_ul_ip.ipv6)
+            sess->remote_ul_ip.len = OGS_IPV4V6_LEN;
+
+        if (hcnTunnelInfo->gtp_teid) {
+            sess->remote_ul_teid =
+                ogs_uint64_from_string_hexadecimal(hcnTunnelInfo->gtp_teid);
+            ogs_debug("hcnTunnelInfo->ipv4 = 0x%x", sess->remote_ul_ip.addr);
+            ogs_log_hexdump(OGS_LOG_DEBUG,
+                    sess->remote_ul_ip.addr6, OGS_IPV6_LEN);
+            ogs_debug("hcnTunnelInfo->gtp_teid = 0x%x", sess->remote_ul_teid);
+        }
+
+        dl_pdr = qos_flow->dl_pdr;
+        ogs_assert(dl_pdr);
+
+        dl_pdr->outer_header_removal_len = 1;
+        dl_pdr->outer_header_removal.description =
+            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
+
+        ul_pdr = qos_flow->ul_pdr;
+        ogs_assert(ul_pdr);
+
+        ul_pdr->outer_header_removal_len = 1;
+        ul_pdr->outer_header_removal.description =
+            OGS_PFCP_OUTER_HEADER_REMOVAL_GTPU_UDP_IP;
+
+        ul_far = qos_flow->ul_far;
+        ogs_assert(ul_far);
+
+        ul_far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
+        ogs_assert(OGS_OK ==
+            ogs_pfcp_ip_to_outer_header_creation(
+                &sess->remote_ul_ip,
+                &ul_far->outer_header_creation,
+                &ul_far->outer_header_creation_len));
+        ul_far->outer_header_creation.teid = sess->remote_ul_teid;
+
+        CLEAR_QOS_FLOWS_SETUP_LIST(sess->h_smf_qos_flows_setup_list);
+
+        qosFlowsSetupList = OpenAPI_list_create();
+        ogs_assert(qosFlowsSetupList);
+        OpenAPI_list_for_each(
+                PduSessionCreatedData->qos_flows_setup_list, node) {
+            OpenAPI_qos_flow_setup_item_t *dst = NULL, *src = NULL;
+
+            src = node->data;
+            if (!src ||
+                !src->qfi ||
+                !src->qos_rules ||
+                !src->qos_flow_description ||
+                !src->qos_flow_profile) {
+                ogs_error("%s:%d No src %d:%s:%s",
+                        smf_ue->supi, sess->psi, src->qfi,
+                        src->qos_rules ?
+                            src->qos_rules : "NULL",
+                        src->qos_flow_description ?
+                            src->qos_flow_description : "NULL");
+                return false;
+            }
+
+            qosFlowProfile = src->qos_flow_profile;
+            if (!qosFlowProfile ||
+                !qosFlowProfile->_5qi ||
+                !qosFlowProfile->arp ||
+                !qosFlowProfile->arp->priority_level ||
+                !(qosFlowProfile->arp->preempt_cap ==
+                    OpenAPI_preemption_capability_NOT_PREEMPT ||
+                 qosFlowProfile->arp->preempt_cap ==
+                    OpenAPI_preemption_capability_MAY_PREEMPT) ||
+                !(qosFlowProfile->arp->preempt_vuln ==
+                     OpenAPI_preemption_vulnerability_NOT_PREEMPTABLE ||
+                 qosFlowProfile->arp->preempt_vuln ==
+                     OpenAPI_preemption_vulnerability_PREEMPTABLE)) {
+                ogs_error("%s:%d Invalid qosFlowProfile %d:%p:%d",
+                        smf_ue->supi, sess->psi,
+                        qosFlowProfile->_5qi,
+                        qosFlowProfile->arp,
+                        qosFlowProfile->arp ?
+                            qosFlowProfile->arp->priority_level : 0);
+                return false;
+            }
+
+            dst = OpenAPI_qos_flow_setup_item_copy(dst, src);
+            ogs_assert(dst);
+            OpenAPI_list_add(qosFlowsSetupList, dst);
+        }
+
+        if (qosFlowsSetupList->count)
+            sess->h_smf_qos_flows_setup_list = qosFlowsSetupList;
+        else
+            OpenAPI_list_free(qosFlowsSetupList);
+
+        sessionAmbr = PduSessionCreatedData->session_ambr;
+        if (sessionAmbr) {
+            if (sessionAmbr->uplink)
+                sess->session.ambr.uplink =
+                    ogs_sbi_bitrate_from_string(sessionAmbr->uplink);
+            if (sessionAmbr->downlink)
+                sess->session.ambr.downlink =
+                    ogs_sbi_bitrate_from_string(sessionAmbr->downlink);
+        }
+
+        sess->h_smf_id = PduSessionCreatedData->h_smf_instance_id;
+
+        if (!recvmsg->http.location) {
+            ogs_error("%s:%d No http.location", smf_ue->supi, sess->psi);
+            return false;
+        }
+
+        memset(&header, 0, sizeof(header));
+        header.uri = recvmsg->http.location;
+
+        rv = ogs_sbi_parse_header(&message, &header);
+        if (rv != OGS_OK) {
+            ogs_error("%s:%d Cannot parse http.location %s",
+                    smf_ue->supi, sess->psi, recvmsg->http.location);
+            return false;
+        }
+
+        if (!message.h.resource.component1) {
+            ogs_error("%s:%d No PduSessionRef %s",
+                    smf_ue->supi, sess->psi, recvmsg->http.location);
+
+            ogs_sbi_header_free(&header);
+            return false;
+        }
+
+        rc = ogs_sbi_getaddr_from_uri(
+                &scheme, &fqdn, &fqdn_port, &addr, &addr6, header.uri);
+        if (rc == false || scheme == OpenAPI_uri_scheme_NULL) {
+            ogs_error("%s:%d Invalid URI %s",
+                    smf_ue->supi, sess->psi, header.uri);
+
+            ogs_sbi_header_free(&header);
+            return false;
+        }
+
+        client = ogs_sbi_client_find(scheme, fqdn, fqdn_port, addr, addr6);
+        if (!client) {
+            ogs_debug("%s:%d ogs_sbi_client_add()", smf_ue->supi, sess->psi);
+            client = ogs_sbi_client_add(scheme, fqdn, fqdn_port, addr, addr6);
+            if (!client) {
+                ogs_error("%s:%d ogs_sbi_client_add() failed",
+                        smf_ue->supi, sess->psi);
+
+                ogs_sbi_header_free(&header);
+
+                ogs_free(fqdn);
+                ogs_freeaddrinfo(addr);
+                ogs_freeaddrinfo(addr6);
+
+                return false;
+            }
+        }
+        OGS_SBI_SETUP_CLIENT(&sess->pdu_session, client);
+
+        ogs_free(fqdn);
+        ogs_freeaddrinfo(addr);
+        ogs_freeaddrinfo(addr6);
+
+        STORE_PDU_SESSION(
+                sess, header.uri, message.h.resource.component1);
+
+        ogs_sbi_header_free(&header);
+
+        /* Handle GSM Message from n1SmInfoToUe */
+        pdu_session_establishment_accept =
+            &nas_message.gsm.pdu_session_establishment_accept;
+
+        if (pdu_session_establishment_accept->presencemask &
+            OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_5GSM_CAUSE_PRESENT) {
+            ogs_nas_5gsm_cause_t *gsm_cause =
+                &pdu_session_establishment_accept->gsm_cause;
+            sess->h_smf_gsm_cause = *gsm_cause;
+        }
+
+        if (pdu_session_establishment_accept->presencemask &
+            OGS_NAS_5GS_PDU_SESSION_ESTABLISHMENT_ACCEPT_EXTENDED_PROTOCOL_CONFIGURATION_OPTIONS_PRESENT) {
+            OGS_NAS_STORE_DATA(
+                &sess->h_smf_extended_protocol_configuration_options,
+                &pdu_session_establishment_accept->
+                    extended_protocol_configuration_options);
+        }
+
+        ogs_assert(OGS_OK ==
+                smf_5gc_pfcp_send_one_qos_flow_modification_request(
+                    qos_flow, NULL,
+                    OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+                    OGS_PFCP_MODIFY_UL_ONLY|
+                    OGS_PFCP_MODIFY_OUTER_HEADER_REMOVAL|
+                    OGS_PFCP_MODIFY_ACTIVATE, 0));
+
+        ogs_info("UE SUPI%s DNN%s S_NSSAISST:%d SD:0x%x "
+                "pduSessionRef%s pduSessionResourceURI%s",
+            smf_ue->supi, sess->session.name,
+            sess->s_nssai.sst, sess->s_nssai.sd.v,
+            sess->pdu_session_ref ? sess->pdu_session_ref : "NULL",
+            sess->pdu_session_resource_uri ?
+                sess->pdu_session_resource_uri : "NULL");
+
     } else {
-        ogs_warn("%s:%d No UDM Subscription. Forcibly remove SESSION",
+        OpenAPI_pdu_session_create_error_t *PduSessionCreateError = NULL;
+        ogs_nas_5gsm_cause_t gsm_cause = 0;
+
+        PduSessionCreateError = recvmsg->PduSessionCreateError;
+        if (!PduSessionCreateError) {
+            ogs_error("%s:%d No PduSessionCreateError",
+                    smf_ue->supi, sess->psi);
+            return false;
+        }
+
+        if (!PduSessionCreateError->error) {
+            ogs_error("%s:%d No Error", smf_ue->supi, sess->psi);
+            return false;
+        }
+
+        if (PduSessionCreateError->n1sm_cause)
+            gsm_cause = ogs_uint64_from_string_hexadecimal(
+                    PduSessionCreateError->n1sm_cause);
+
+        ogs_error("CreatePduSession() failed %d cause %d",
+                recvmsg->res_status, gsm_cause);
+
+        return false;
+    }
+
+    return true;
+}
+
+bool smf_nsmf_handle_update_data_in_hsmf(
+    smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_sbi_message_t *message)
+{
+    int rv;
+    smf_ue_t *smf_ue = NULL;
+
+    OpenAPI_hsmf_update_data_t *HsmfUpdateData = NULL;
+
+    OpenAPI_plmn_id_nid_t *servingNetwork = NULL;
+    OpenAPI_tunnel_info_t *vcnTunnelInfo = NULL;
+    OpenAPI_ref_to_binary_data_t *n1SmInfoFromUe = NULL;
+
+    ogs_nas_5gs_message_t nas_message;
+    ogs_pkbuf_t *n1SmBufFromUe = NULL;
+
+    ogs_nas_5gs_pdu_session_modification_request_t
+        *pdu_session_modification_request = NULL;
+
+    ogs_assert(stream);
+    ogs_assert(message);
+    ogs_assert(sess);
+    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+    ogs_assert(smf_ue);
+
+    memset(&sess->nsmf_param, 0, sizeof(sess->nsmf_param));
+
+    HsmfUpdateData = message->HsmfUpdateData;
+    if (!HsmfUpdateData) {
+        ogs_error("%s:%d No HsmfUpdateData",
+                smf_ue->supi, sess->psi);
+        smf_sbi_send_hsmf_update_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No HsmfUpdateData", smf_ue->supi, NULL);
+        return false;
+    }
+
+    if (!HsmfUpdateData->request_indication) {
+        ogs_error("%s:%d No requestIndication",
                 smf_ue->supi, sess->psi);
-        r = smf_sbi_discover_and_send(
-                OGS_SBI_SERVICE_TYPE_NUDM_UECM, NULL,
-                smf_nudm_uecm_build_deregistration, sess, stream,
-                SMF_UECM_STATE_DEREGISTERED_BY_AMF, NULL);
-        ogs_expect(r == OGS_OK);
-        ogs_assert(r != OGS_ERROR);
+        smf_sbi_send_hsmf_update_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No requestIndication", smf_ue->supi, NULL);
+        return false;
+    }
+
+    sess->nsmf_param.request_indication = HsmfUpdateData->request_indication;
+
+    sess->nsmf_param.up_cnx_state = HsmfUpdateData->up_cnx_state;
+
+    vcnTunnelInfo = HsmfUpdateData->vcn_tunnel_info;
+    if (vcnTunnelInfo) {
+        if (vcnTunnelInfo->ipv4_addr) {
+            rv = ogs_ipv4_from_string(
+                    &sess->nsmf_param.dl_ip.addr, vcnTunnelInfo->ipv4_addr);
+            if (rv != OGS_OK) {
+                ogs_error("ogs_ipv4_from_string() %s failed",
+                        vcnTunnelInfo->ipv4_addr);
+                smf_sbi_send_hsmf_update_error(stream,
+                        OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                        OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                        "ogs_ipv4_from_string() failed",
+                        vcnTunnelInfo->ipv4_addr, NULL);
+                return false;
+            }
+            sess->nsmf_param.dl_ip.ipv4 = 1;
+            sess->nsmf_param.dl_ip.len = OGS_IPV4_LEN;
+        }
+        if (vcnTunnelInfo->ipv6_addr) {
+            rv = ogs_ipv6addr_from_string(
+                    sess->nsmf_param.dl_ip.addr6, vcnTunnelInfo->ipv6_addr);
+            if (rv != OGS_OK) {
+                ogs_error("ogs_ipv6addr_from_string() %s failed",
+                        vcnTunnelInfo->ipv6_addr);
+                smf_sbi_send_hsmf_update_error(stream,
+                        OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                        OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                        "ogs_ipv6addr_from_string() failed",
+                        vcnTunnelInfo->ipv6_addr, NULL);
+                return false;
+            }
+            sess->nsmf_param.dl_ip.ipv6 = 1;
+            sess->nsmf_param.dl_ip.len = OGS_IPV6_LEN;
+        }
+        if (sess->remote_dl_ip.ipv4 && sess->remote_dl_ip.ipv6)
+            sess->remote_dl_ip.len = OGS_IPV4V6_LEN;
+
+        if (vcnTunnelInfo->gtp_teid)
+            sess->nsmf_param.dl_teid =
+                ogs_uint64_from_string_hexadecimal(vcnTunnelInfo->gtp_teid);
+    }
+
+    sess->nsmf_param.an_type = HsmfUpdateData->an_type;
+    sess->nsmf_param.rat_type = HsmfUpdateData->rat_type;
+
+    servingNetwork = HsmfUpdateData->serving_network;
+    if (servingNetwork && servingNetwork->mcc && servingNetwork->mnc)
+        sess->nsmf_param.serving_network = true;
+
+    if (HsmfUpdateData->ue_location &&
+        HsmfUpdateData->ue_location->nr_location) {
+        OpenAPI_nr_location_t *NrLocation =
+            HsmfUpdateData->ue_location->nr_location;
+        if (NrLocation->tai &&
+            NrLocation->tai->plmn_id && NrLocation->tai->tac &&
+            NrLocation->ncgi &&
+            NrLocation->ncgi->plmn_id && NrLocation->ncgi->nr_cell_id) {
+
+            ogs_sbi_parse_nr_location(
+                    &sess->nr_tai, &sess->nr_cgi, NrLocation);
+            if (NrLocation->ue_location_timestamp)
+                ogs_sbi_time_from_string(&sess->ue_location_timestamp,
+                        NrLocation->ue_location_timestamp);
+
+            ogs_debug("    TAIPLMN_ID:%06x,TAC:%d",
+                ogs_plmn_id_hexdump(&sess->nr_tai.plmn_id),
+                sess->nr_tai.tac.v);
+            ogs_debug("    NR_CGIPLMN_ID:%06x,CELL_ID:0x%llx",
+                ogs_plmn_id_hexdump(&sess->nr_cgi.plmn_id),
+                (long long)sess->nr_cgi.cell_id);
+        }
+
+        sess->nsmf_param.ue_location = true;
+        sess->nsmf_param.ue_timezone = true;
+    }
+
+    if (HsmfUpdateData->ng_ap_cause) {
+        sess->nsmf_param.ngap_cause.group =
+            HsmfUpdateData->ng_ap_cause->group;
+        sess->nsmf_param.ngap_cause.value =
+            HsmfUpdateData->ng_ap_cause->value;
+    }
+    sess->nsmf_param.gmm_cause = HsmfUpdateData->_5g_mm_cause_value;
+    sess->nsmf_param.cause = HsmfUpdateData->cause;
+
+    n1SmInfoFromUe = HsmfUpdateData->n1_sm_info_from_ue;
+    if (n1SmInfoFromUe) {
+        n1SmBufFromUe = ogs_sbi_find_part_by_content_id(
+                message, n1SmInfoFromUe->content_id);
+
+        if (n1SmBufFromUe) {
+            rv = gsmue_decode_n1_sm_info(&nas_message, n1SmBufFromUe);
+            if (rv != OGS_OK) {
+                ogs_error("%s:%d cannot decode N1 SM Content %s",
+                        smf_ue->supi, sess->psi, n1SmInfoFromUe->content_id);
+                ogs_log_hexdump(OGS_LOG_ERROR,
+                        n1SmBufFromUe->data, n1SmBufFromUe->len);
+                smf_sbi_send_hsmf_update_error(stream,
+                        OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                        OGS_5GSM_CAUSE_SEMANTICALLY_INCORRECT_MESSAGE,
+                        "cannot decode N1 SM Content", smf_ue->supi, NULL);
+                return false;
+            }
+        }
+    }
+
+    switch(nas_message.gsm.h.message_type) {
+    case OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST:
+        pdu_session_modification_request =
+            &nas_message.gsm.pdu_session_modification_request;
+
+        if (pdu_session_modification_request->presencemask &
+            (OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_REQUESTED_QOS_RULES_PRESENT|
+             OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_REQUESTED_QOS_FLOW_DESCRIPTIONS_PRESENT))
+            ogs_list_init(&sess->qos_flow_to_modify_list);
+
+        if (pdu_session_modification_request->presencemask &
+            OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_REQUESTED_QOS_RULES_PRESENT) {
+            rv = gsm_handle_pdu_session_modification_qos_rules(
+                    sess,
+                    &pdu_session_modification_request->requested_qos_rules,
+                    &sess->nsmf_param.pfcp_flags);
+            if (rv != OGS_OK) {
+                ogs_error("%s:%d Invalid requested_qos_rules",
+                        smf_ue->supi, sess->psi);
+                smf_sbi_send_hsmf_update_error(stream,
+                        OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                        OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                        "Invalid requested_qos_rules", smf_ue->supi, NULL);
+                return false;
+            }
+        }
+
+        if (pdu_session_modification_request->presencemask &
+            OGS_NAS_5GS_PDU_SESSION_MODIFICATION_REQUEST_REQUESTED_QOS_FLOW_DESCRIPTIONS_PRESENT) {
+            rv = gsm_handle_pdu_session_modification_qos_flow_descriptions(
+                    sess,
+                    &pdu_session_modification_request->
+                        requested_qos_flow_descriptions,
+                    &sess->nsmf_param.pfcp_flags);
+            if (rv != OGS_OK) {
+                ogs_error("%s:%d Invalid requested_qos_flow_descriptions",
+                        smf_ue->supi, sess->psi);
+                smf_sbi_send_hsmf_update_error(stream,
+                        OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                        OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                        "Invalid qos_flow_descriptions", smf_ue->supi, NULL);
+                return false;
+            }
+        }
+        break;
+    default:
+        break;
     }
 
     return true;
 }
 
+bool smf_nsmf_handle_update_data_in_vsmf(
+    smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_sbi_message_t *message)
+{
+    int rv;
+    smf_ue_t *smf_ue = NULL;
+
+    OpenAPI_vsmf_update_data_t *VsmfUpdateData = NULL;
+
+    OpenAPI_list_t *qosFlowsAddModRequestList = NULL;
+    OpenAPI_list_t *qosFlowsRelRequestList = NULL;
+    OpenAPI_qos_flow_profile_t *qosFlowProfile = NULL;
+    OpenAPI_lnode_t *node = NULL;
+
+    ogs_nas_5gs_message_t nas_message;
+    ogs_pkbuf_t *n1SmBufToUe = NULL;
+    OpenAPI_ref_to_binary_data_t *n1SmInfoToUe = NULL;
+
+    smf_n1_n2_message_transfer_param_t param;
+
+    ogs_assert(stream);
+    ogs_assert(message);
+    ogs_assert(sess);
+    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+    ogs_assert(smf_ue);
+
+    memset(&sess->nsmf_param, 0, sizeof(sess->nsmf_param));
+
+    VsmfUpdateData = message->VsmfUpdateData;
+    if (!VsmfUpdateData) {
+        ogs_error("%s:%d No VsmfUpdateData",
+                smf_ue->supi, sess->psi);
+        smf_sbi_send_vsmf_update_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No VsmfUpdateData", smf_ue->supi, NULL);
+        return false;
+    }
+
+    if (!VsmfUpdateData->request_indication) {
+        ogs_error("%s:%d No requestIndication",
+                smf_ue->supi, sess->psi);
+        smf_sbi_send_vsmf_update_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "No requestIndication", smf_ue->supi, NULL);
+        return false;
+    }
+
+    sess->nsmf_param.request_indication = VsmfUpdateData->request_indication;
+
+    n1SmInfoToUe = VsmfUpdateData->n1_sm_info_to_ue;
+    if (n1SmInfoToUe) {
+        n1SmBufToUe = ogs_sbi_find_part_by_content_id(
+                message, n1SmInfoToUe->content_id);
+
+        if (n1SmBufToUe) {
+            rv = gsmue_decode_n1_sm_info(&nas_message, n1SmBufToUe);
+            if (rv != OGS_OK) {
+                ogs_error("%s:%d cannot decode N1 SM Content %s",
+                        smf_ue->supi, sess->psi, n1SmInfoToUe->content_id);
+                ogs_log_hexdump(OGS_LOG_ERROR,
+                        n1SmBufToUe->data, n1SmBufToUe->len);
+                smf_sbi_send_vsmf_update_error(stream,
+                        OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                        OGS_5GSM_CAUSE_SEMANTICALLY_INCORRECT_MESSAGE,
+                        "cannot decode N1 SM Content", smf_ue->supi, NULL);
+                return false;
+            }
+        }
+    }
+
+    switch (sess->nsmf_param.request_indication) {
+    case OpenAPI_request_indication_UE_REQ_PDU_SES_MOD:
+    case OpenAPI_request_indication_NW_REQ_PDU_SES_MOD:
+        CLEAR_QOS_FLOWS_ADD_MOD_REQUEST_LIST(
+                sess->h_smf_qos_flows_add_mod_request_list);
+
+        qosFlowsAddModRequestList = OpenAPI_list_create();
+        ogs_assert(qosFlowsAddModRequestList);
+        OpenAPI_list_for_each(
+                VsmfUpdateData->qos_flows_add_mod_request_list, node) {
+            OpenAPI_qos_flow_add_modify_request_item_t *dst = NULL, *src = NULL;
+
+            src = node->data;
+            if (!src ||
+                !src->qfi ||
+                !(src->qos_flow_description || src->qos_flow_profile)) {
+                ogs_error("%s:%d No src %d:%s:%p",
+                        smf_ue->supi, sess->psi, src->qfi,
+                        src->qos_flow_description ?
+                            src->qos_flow_description : "NULL",
+                        src->qos_flow_profile ?
+                            src->qos_flow_profile : NULL);
+                smf_sbi_send_vsmf_update_error(stream,
+                        OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                        OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                        "No src", smf_ue->supi, NULL);
+                return false;
+            }
+
+            qosFlowProfile = src->qos_flow_profile;
+            if (!qosFlowProfile ||
+                !qosFlowProfile->_5qi ||
+                !qosFlowProfile->arp ||
+                !qosFlowProfile->arp->priority_level ||
+                !(qosFlowProfile->arp->preempt_cap ==
+                    OpenAPI_preemption_capability_NOT_PREEMPT ||
+                 qosFlowProfile->arp->preempt_cap ==
+                    OpenAPI_preemption_capability_MAY_PREEMPT) ||
+                !(qosFlowProfile->arp->preempt_vuln ==
+                     OpenAPI_preemption_vulnerability_NOT_PREEMPTABLE ||
+                 qosFlowProfile->arp->preempt_vuln ==
+                     OpenAPI_preemption_vulnerability_PREEMPTABLE)) {
+                ogs_error("%s:%d Invalid qosFlowProfile %d:%p:%d",
+                        smf_ue->supi, sess->psi,
+                        qosFlowProfile->_5qi,
+                        qosFlowProfile->arp,
+                        qosFlowProfile->arp ?
+                            qosFlowProfile->arp->priority_level : 0);
+                smf_sbi_send_vsmf_update_error(stream,
+                        OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                        OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                        "Invalid qosFlowProfile", smf_ue->supi, NULL);
+                return false;
+            }
+
+            dst = OpenAPI_qos_flow_add_modify_request_item_copy(dst, src);
+            ogs_assert(dst);
+            OpenAPI_list_add(qosFlowsAddModRequestList, dst);
+        }
+
+        if (qosFlowsAddModRequestList->count)
+            sess->h_smf_qos_flows_add_mod_request_list =
+                qosFlowsAddModRequestList;
+        else
+            OpenAPI_list_free(qosFlowsAddModRequestList);
+
+        CLEAR_QOS_FLOWS_REL_REQUEST_LIST(
+                sess->h_smf_qos_flows_rel_request_list);
+
+        qosFlowsRelRequestList = OpenAPI_list_create();
+        ogs_assert(qosFlowsRelRequestList);
+        OpenAPI_list_for_each(VsmfUpdateData->qos_flows_rel_request_list, node) {
+            OpenAPI_qos_flow_release_request_item_t *dst = NULL, *src = NULL;
+
+            src = node->data;
+            if (!src ||
+                !src->qfi ||
+                !src->qos_rules ||
+                !src->qos_flow_description) {
+                ogs_error("%s:%d No src %d:%s:%s",
+                        smf_ue->supi, sess->psi, src->qfi,
+                        src->qos_rules ?
+                            src->qos_rules : "NULL",
+                        src->qos_flow_description ?
+                            src->qos_flow_description : "NULL");
+                smf_sbi_send_vsmf_update_error(stream,
+                        OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                        OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                        "No src", smf_ue->supi, NULL);
+                return false;
+            }
+
+            dst = OpenAPI_qos_flow_release_request_item_copy(dst, src);
+            ogs_assert(dst);
+            OpenAPI_list_add(qosFlowsRelRequestList, dst);
+        }
+
+        if (qosFlowsRelRequestList->count)
+            sess->h_smf_qos_flows_rel_request_list = qosFlowsRelRequestList;
+        else
+            OpenAPI_list_free(qosFlowsRelRequestList);
+
+        sess->pti = OGS_NAS_PROCEDURE_TRANSACTION_IDENTITY_UNASSIGNED;
+
+    /*
+     * Network-requested PDU Session Modification
+     *
+     * 1.  H: OpenAPI_request_indication_NW_REQ_PDU_SES_MOD
+     *        QOS_RULE_CODE_FROM_PFCP_FLAGS
+     *        QOS_RULE_FLOW_DESCRIPTION_CODE_FROM_PFCP_FLAGS
+     * 2.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 3.  V: smf_nsmf_handle_update_data_in_vsmf
+     * 4.  V*: gsm_build_pdu_session_modification_command+
+     *         ngap_build_pdu_session_resource_modify_request_transfer
+     * 5.  V: OpenAPI_n2_sm_info_type_PDU_RES_MOD_RSP
+     *        if (sess->up_cnx_state == OpenAPI_up_cnx_state_ACTIVATING)
+     *            sess->up_cnx_state = OpenAPI_up_cnx_state_ACTIVATED;
+     *            smf_sbi_send_sm_context_updated_data_up_cnx_state(
+     *                  OpenAPI_up_cnx_state_ACTIVATED)
+     *        else
+     *            ogs_sbi_send_http_status_no_content(stream)
+     * 6.  V: ogs_sbi_send_http_status_no_content(stream)
+     *        OGS_NAS_5GS_PDU_SESSION_MODIFICATION_COMPLETE:
+     *        ogs_sbi_send_http_status_no_content(n1_n2_modified_stream));
+     * 7.  V: case OGS_EVENT_SBI_CLIENT
+     *        CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 8.  H: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|
+     *        OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE
+     */
+        memset(&param, 0, sizeof(param));
+
+        param.state = SMF_NETWORK_REQUESTED_QOS_FLOW_MODIFICATION;
+        param.n1smbuf = gsm_build_pdu_session_modification_command(sess, 0, 0);
+        ogs_assert(param.n1smbuf);
+
+        if (sess->h_smf_qos_flows_rel_request_list) {
+            param.n2smbuf =
+                ngap_build_pdu_session_resource_release_request_transfer(
+                        sess, NGAP_Cause_PR_nas, NGAP_CauseNas_normal_release);
+            ogs_assert(param.n2smbuf);
+        } else if (sess->h_smf_qos_flows_add_mod_request_list) {
+            param.n2smbuf =
+                ngap_build_pdu_session_resource_modify_request_transfer(sess,
+                        qosFlowProfile->gbr_qos_flow_info ? true : false);
+            ogs_assert(param.n2smbuf);
+        } else
+            ogs_error("No LIST");
+
+        if (sess->nsmf_param.request_indication ==
+                OpenAPI_request_indication_NW_REQ_PDU_SES_MOD) {
+            if (sess->establishment_accept_sent == true) {
+                smf_namf_comm_send_n1_n2_message_transfer(sess, stream, &param);
+            } else {
+                if (sess->pending_modification_xact)
+                    ogs_sbi_xact_remove(sess->pending_modification_xact);
+
+                sess->pending_modification_xact =
+                    smf_namf_comm_create_n1_n2_message_xact(
+                            sess, stream, &param);
+            }
+        } else if (sess->nsmf_param.request_indication ==
+                OpenAPI_request_indication_UE_REQ_PDU_SES_MOD) {
+            ogs_sbi_stream_t *amf_to_vsmf_modify_stream = NULL;
+            if (sess->amf_to_vsmf_modify_stream_id >= OGS_MIN_POOL_ID &&
+                sess->amf_to_vsmf_modify_stream_id <= OGS_MAX_POOL_ID)
+                amf_to_vsmf_modify_stream =
+                    ogs_sbi_stream_find_by_id(
+                            sess->amf_to_vsmf_modify_stream_id);
+
+            if (amf_to_vsmf_modify_stream) {
+                smf_sbi_send_sm_context_updated_data_n1_n2_message(
+                        sess, amf_to_vsmf_modify_stream, param.n1smbuf,
+                        OpenAPI_n2_sm_info_type_PDU_RES_MOD_REQ, param.n2smbuf);
+
+                sess->amf_to_vsmf_modify_stream_id = OGS_INVALID_POOL_ID;
+
+                if (sess->vsmf_to_hsmf_modify_stream_id >= OGS_MIN_POOL_ID &&
+                    sess->vsmf_to_hsmf_modify_stream_id <= OGS_MAX_POOL_ID)
+                    ogs_error("N1 N2 modified stream ID %d"
+                            "has not been used yet",
+                            sess->vsmf_to_hsmf_modify_stream_id);
+                sess->vsmf_to_hsmf_modify_stream_id =
+                    ogs_sbi_id_from_stream(stream);
+            }
+        }
+        break;
+
+    case OpenAPI_request_indication_UE_REQ_PDU_SES_REL:
+    case OpenAPI_request_indication_NW_REQ_PDU_SES_REL:
+        break;
+    default:
+        ogs_error("%s:%d Unknown requestIndication %d",
+                smf_ue->supi, sess->psi, sess->nsmf_param.request_indication);
+        smf_sbi_send_vsmf_update_error(stream,
+                OGS_SBI_HTTP_STATUS_BAD_REQUEST, OGS_SBI_APP_ERRNO_NULL,
+                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                "Unknown requestIndication", smf_ue->supi, NULL);
+        return false;
+    }
+
+    return true;
+}
+
+bool smf_nsmf_handle_release_data_in_hsmf(
+    smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_sbi_message_t *message)
+{
+    smf_ue_t *smf_ue = NULL;
+
+    OpenAPI_release_data_t *ReleaseData = NULL;
+
+    ogs_assert(stream);
+    ogs_assert(message);
+    ogs_assert(sess);
+    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+    ogs_assert(smf_ue);
+
+    memset(&sess->nsmf_param, 0, sizeof(sess->nsmf_param));
+
+    ReleaseData = message->ReleaseData;
+    if (ReleaseData) {
+        if (ReleaseData->ue_location &&
+            ReleaseData->ue_location->nr_location) {
+            OpenAPI_nr_location_t *NrLocation =
+                ReleaseData->ue_location->nr_location;
+            if (NrLocation->tai &&
+                NrLocation->tai->plmn_id && NrLocation->tai->tac &&
+                NrLocation->ncgi &&
+                NrLocation->ncgi->plmn_id && NrLocation->ncgi->nr_cell_id) {
+
+                ogs_sbi_parse_nr_location(
+                        &sess->nr_tai, &sess->nr_cgi, NrLocation);
+                if (NrLocation->ue_location_timestamp)
+                    ogs_sbi_time_from_string(&sess->ue_location_timestamp,
+                            NrLocation->ue_location_timestamp);
+
+                ogs_debug("    TAIPLMN_ID:%06x,TAC:%d",
+                    ogs_plmn_id_hexdump(&sess->nr_tai.plmn_id),
+                    sess->nr_tai.tac.v);
+                ogs_debug("    NR_CGIPLMN_ID:%06x,CELL_ID:0x%llx",
+                    ogs_plmn_id_hexdump(&sess->nr_cgi.plmn_id),
+                    (long long)sess->nr_cgi.cell_id);
+            }
+
+            sess->nsmf_param.ue_location = true;
+            sess->nsmf_param.ue_timezone = true;
+        }
+
+        if (ReleaseData->ng_ap_cause) {
+            sess->nsmf_param.ngap_cause.group =
+                ReleaseData->ng_ap_cause->group;
+            sess->nsmf_param.ngap_cause.value =
+                ReleaseData->ng_ap_cause->value;
+        }
+        sess->nsmf_param.gmm_cause = ReleaseData->_5g_mm_cause_value;
+        sess->nsmf_param.cause = ReleaseData->cause;
+    }
+
+    return true;
+}
 
 bool smf_nsmf_callback_handle_sdm_data_change_notify(
     ogs_sbi_stream_t *stream, ogs_sbi_message_t *recvmsg)
@@ -998,4 +2742,3 @@
 
     return true;
 }
-

open5gs_2.7.6.tar.xz/src/smf/nsmf-handler.h -> open5gs_2.7.7.tar.xz/src/smf/nsmf-handler.h Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -33,6 +33,19 @@
 bool smf_nsmf_handle_release_sm_context(
     smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_sbi_message_t *message);
 
+bool smf_nsmf_handle_create_data_in_hsmf(
+    smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_sbi_message_t *recvmsg);
+bool smf_nsmf_handle_created_data_in_vsmf(
+    smf_sess_t *sess, ogs_sbi_message_t *recvmsg);
+
+bool smf_nsmf_handle_update_data_in_hsmf(
+    smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_sbi_message_t *message);
+bool smf_nsmf_handle_update_data_in_vsmf(
+    smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_sbi_message_t *message);
+
+bool smf_nsmf_handle_release_data_in_hsmf(
+    smf_sess_t *sess, ogs_sbi_stream_t *stream, ogs_sbi_message_t *message);
+
 bool smf_nsmf_callback_handle_sdm_data_change_notify(
     ogs_sbi_stream_t *stream, ogs_sbi_message_t *recvmsg);

open5gs_2.7.6.tar.xz/src/smf/nudm-build.c -> open5gs_2.7.7.tar.xz/src/smf/nudm-build.c Changed

open5gs_2.7.6.tar.xz/src/smf/nudm-handler.c -> open5gs_2.7.7.tar.xz/src/smf/nudm-handler.c Changed

@@ -50,7 +50,6 @@
     ogs_assert(smf_ue);
     ogs_assert(recvmsg);
 
-
     if ((!recvmsg->SessionManagementSubscriptionDataList) ||
         (recvmsg->SessionManagementSubscriptionDataList->count == 0))
     {
@@ -389,12 +388,8 @@
     char *strerror = NULL;
     smf_ue_t *smf_ue;
 
-    ogs_sbi_server_t *server = NULL;
     ogs_sbi_header_t header;
-    ogs_sbi_message_t sendmsg;
     ogs_sbi_message_t message;
-    ogs_sbi_response_t *response = NULL;
-    OpenAPI_sm_context_created_data_t SmContextCreatedData;
 
     bool rc;
     ogs_sbi_client_t *client = NULL;
@@ -470,35 +465,11 @@
 
 
     /*********************************************************************
+     * If NOT Home-Routed Roaming,
      * Send HTTP_STATUS_CREATED(/nsmf-pdusession/v1/sm-context) to the AMF
      *********************************************************************/
-
-    memset(&SmContextCreatedData, 0, sizeof(SmContextCreatedData));
-    memset(&sendmsg, 0, sizeof(sendmsg));
-    memset(&header, 0, sizeof(header));
-
-    header.service.name = (char *)OGS_SBI_SERVICE_NAME_NSMF_PDUSESSION;
-    header.api.version = (char *)OGS_SBI_API_V1;
-    header.resource.component0 =
-        (char *)OGS_SBI_RESOURCE_NAME_SM_CONTEXTS;
-    header.resource.component1 = sess->sm_context_ref;
-
-    server = ogs_sbi_server_from_stream(stream);
-    ogs_assert(server);
-
-    sendmsg.http.location = ogs_sbi_server_uri(server, &header);
-    ogs_assert(sendmsg.http.location);
-
-    sendmsg.SmContextCreatedData = &SmContextCreatedData;
-
-    response = ogs_sbi_build_response(&sendmsg, OGS_SBI_HTTP_STATUS_CREATED);
-    ogs_assert(response);
-    ogs_assert(true == ogs_sbi_server_send_response(stream, response));
-
-    smf_metrics_inst_by_slice_add(&sess->serving_plmn_id, &sess->s_nssai,
-            SMF_METR_CTR_SM_PDUSESSIONCREATIONSUCC, 1);
-
-    ogs_free(sendmsg.http.location);
+    if (!HOME_ROUTED_ROAMING_IN_HSMF(sess))
+        smf_sbi_send_sm_context_created_data(sess, stream);
 
     r = smf_sbi_discover_and_send(
             OGS_SBI_SERVICE_TYPE_NPCF_SMPOLICYCONTROL, NULL,

open5gs_2.7.7.tar.xz/src/smf/pdu-info.c Added

@@ -0,0 +1,705 @@
+/*
+ * Copyright (C) 2025 by Juraj Elias <juraj.elias@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/*
+ * Connected PDUs JSON dumper for the Prometheus HTTP server (/pdu-info).
+ * - 5G PDUs:  psi+dnn, snssai, qos_flows {qfi,5qi}, n3.{gnb,upf}, handover{}, pdu_state
+ * - LTE PDUs: ebi(+psi if non-zero)+apn, qos_flows {ebi,qci}, pdu_state ("unknown" at SMF scope)
+ * - UE-level: ue_activity ("active"/"unknown"/"idle")
+ * - pager: /pdu-info?page=0&page_size=100 (0-based, page=SIZE_MAX -> no paging)
+ *
+ * path: http://SMF_IP:9090/pdu-info
+ *
+ * curl -s "http://127.0.0.4:9090/pdu-info?page_size=1" |jq . 
+ * {
+ *   "items": 
+ *     {
+ *       "supi": "imsi-231510000114763",
+ *       "pdu": 
+ *         {
+ *           "psi": 1,
+ *           "dnn": "internet",
+ *           "ipv4": "10.45.0.11",
+ *           "snssai": {
+ *             "sst": 1,
+ *             "sd": "ffffff"
+ *           },
+ *           "qos_flows": 
+ *             {
+ *               "qfi": 1,
+ *               "5qi": 9
+ *             }
+ *           ,
+ *           "n3": {
+ *             "gnb": {
+ *               "teid": 76,
+ *               "addr": "192.168.168.100:2152"
+ *             },
+ *             "upf": {
+ *               "teid": 11426,
+ *               "addr": "192.168.168.7:2152",
+ *               "pdr_id": 2
+ *             }
+ *           },
+ *           "pdu_state": "inactive"
+ *         }
+ *       ,
+ *       "ue_activity": "idle"
+ *     }
+ *   ,
+ *   "pager": {
+ *     "page": 0,
+ *     "page_size": 100,
+ *     "count": 1,
+ *   }
+ * }
+ */ 
+
+#include <string.h>
+#include <stdbool.h>
+#include <limits.h>
+
+#include "ogs-core.h"
+#include "context.h"
+#include "pdu-info.h"
+#include "sbi/openapi/external/cJSON.h"
+#include "metrics/prometheus/json_pager.h"
+
+#ifndef OGS_GTPV1_U_UDP_PORT
+#define OGS_GTPV1_U_UDP_PORT 2152
+#endif
+
+/* Only used in ip_is_unspecified (currently disabled) */
+/* static const uint8_t zero6OGS_IPV6_LEN = {0}; */
+
+static int ip_to_text(const ogs_ip_t *ip, char *out, size_t outlen)
+{
+    const char *ret;
+
+    if (!ip || !out || outlen == 0)
+        return 0;
+
+    out0 = '\0';
+
+    if (ip->ipv4) {
+        ret = OGS_INET_NTOP(&ip->addr, out);
+        if (ret)
+            return 1;
+    }
+
+    if (ip->ipv6) {
+        ret = OGS_INET6_NTOP(ip->addr6, out);
+        if (ret)
+            return 1;
+    }
+
+    return 0;
+}
+
+/* Only used in handover function (currently disabled) */
+/*
+static bool ip_is_unspecified(const ogs_ip_t *ip)
+{
+    if (!ip)
+        return true;
+
+    if (ip->ipv4 && ip->addr == 0)
+        return true;
+
+    if (ip->ipv6 && memcmp(ip->addr6, zero6, sizeof(zero6)) == 0)
+        return true;
+
+    if (!ip->ipv4 && !ip->ipv6)
+        return true;
+
+    return false;
+}
+*/
+
+static cJSON *addr_string_item(const ogs_ip_t *ip, int port)
+{
+    if (!ip) return NULL;
+    char ipbufOGS_ADDRSTRLEN = "";
+    if (!ip_to_text(ip, ipbuf, sizeof ipbuf)) return NULL;
+    char bufOGS_ADDRSTRLEN + 16;
+    snprintf(buf, sizeof buf, "%s:%d", ipbuf, port);
+    return cJSON_CreateString(buf);
+}
+
+/* Only used in handover function (currently disabled) */
+/*
+static cJSON *addr_string_from_sockaddr(ogs_sockaddr_t *sa4, ogs_sockaddr_t *sa6, int default_port)
+{
+    ogs_ip_t ip;
+    memset(&ip, 0, sizeof(ip));
+    if (OGS_OK != ogs_sockaddr_to_ip(sa4, sa6, &ip))
+        return NULL;
+    return addr_string_item(&ip, default_port);
+}
+*/
+
+static inline uint32_t u24_to_u32(ogs_uint24_t v)
+{
+    uint32_t x = 0;
+    memcpy(&x, &v, sizeof(v) < sizeof(x) ? sizeof(v) : sizeof(x));
+    return (x & 0xFFFFFFu);
+}
+
+static inline int up_state_of(const smf_sess_t *s)
+{
+    if (!s) return 0;
+    int u = (int)s->up_cnx_state;
+    if (u == 0) u = (int)s->nsmf_param.up_cnx_state;
+    return u;
+}
+
+static inline bool has_n3_teid(const smf_sess_t *s)
+{
+    return s && (s->remote_ul_teid != 0U || s->remote_dl_teid != 0U);
+}
+
+static inline bool bearer_list_has_qfi(const smf_sess_t *s)
+{
+    if (!s) return false;
+    smf_bearer_t *b = NULL;
+    ogs_list_for_each(&((smf_sess_t *)s)->bearer_list, b) {
+        if (b && b->qfi > 0) return true;
+    }
+    return false;
+}
+
+/* 5G heuristic: S-NSSAI present or any QFI bearer */
+static inline bool looks_5g_sess(const smf_sess_t *s)
+{
+    if (!s) return false;
+    if (s->s_nssai.sst != 0) return true;
+    if (u24_to_u32(s->s_nssai.sd) != 0) return true;
+    if (bearer_list_has_qfi(s)) return true;
+    return false;
+}
+
+static const char *pdu_state_from_5g(const smf_sess_t *sess)
+{
+    if (!sess) return "unknown";
+    if ((int)sess->resource_status == (int)OpenAPI_resource_status_RELEASED)
+        return "inactive";
+    if (up_state_of(sess) == (int)OpenAPI_up_cnx_state_DEACTIVATED)
+        return "inactive";
+    if (sess->n1_released || sess->n2_released)
+        return "inactive";
+    if (!has_n3_teid(sess))
+        return "inactive";
+    return "active";
+}
+
+/* LTE/EPC state at SMF scope: unknown */
+static const char *pdu_state_from_lte(const smf_sess_t *sess)
+{
+    (void)sess;
+    return "unknown";
+}
+
+/* ---------- N3 object (gNB from sess->remote_dl_*, UPF from PDR F-TEID) ---------- */
+
+static cJSON *build_n3_object_5g(const smf_sess_t *sess)
+{
+    /* Build n3 object with "gnb" and "upf" children. If nothing to emit or OOM, return NULL. */
+    if (!sess) return NULL;
+
+    cJSON *n3  = cJSON_CreateObject();
+    if (!n3) return NULL;
+
+    /* -------- gNB (DL endpoint) from sess->remote_dl_* -------- */
+    if (sess->remote_dl_teid || sess->remote_dl_ip.ipv4 || sess->remote_dl_ip.ipv6) {
+        cJSON *gnb = cJSON_CreateObject();
+        if (!gnb) { cJSON_Delete(n3); return NULL; }
+        bool has_content = false;
+
+        if (sess->remote_dl_teid) {
+            cJSON *t = cJSON_CreateNumber((double)(unsigned)sess->remote_dl_teid);
+            if (!t) { cJSON_Delete(gnb); cJSON_Delete(n3); return NULL; }
+            cJSON_AddItemToObjectCS(gnb, "teid", t);
+            has_content = true;
+        }
+
+        cJSON *gs = addr_string_item(&sess->remote_dl_ip, OGS_GTPV1_U_UDP_PORT);
+        if (gs) {
+            cJSON_AddItemToObjectCS(gnb, "addr", gs);
+            has_content = true;
+        }
+
+        if (has_content) {
+            cJSON_AddItemToObjectCS(n3, "gnb", gnb);
+        } else {
+            cJSON_Delete(gnb);
+        }
+    }
+
+    /* -------- UPF (UL endpoint) from PFCP PDR F-TEID -------- */
+    do {
+        ogs_pfcp_pdr_t *pdr = NULL, *pick = NULL;
+        ogs_list_for_each(&((smf_sess_t *)sess)->pfcp.pdr_list, pdr) {
+            if (pdr && pdr->f_teid_len > 0 &&
+                pdr->src_if == OGS_PFCP_INTERFACE_ACCESS) { pick = pdr; break; }
+        }
+        if (!pick) {
+            ogs_list_for_each(&((smf_sess_t *)sess)->pfcp.pdr_list, pdr) {
+                if (pdr && pdr->f_teid_len > 0) { pick = pdr; break; }
+            }
+        }
+        if (!pick) break;
+
+        ogs_ip_t ip;
+        memset(&ip, 0, sizeof(ip));
+
+        if (OGS_OK == ogs_pfcp_f_teid_to_ip(&pick->f_teid, &ip)) {
+            cJSON *upf = cJSON_CreateObject();
+            if (!upf) { cJSON_Delete(n3); return NULL; }
+
+            bool has_content = false;
+
+            if (pick->f_teid.teid) {
+                cJSON *t = cJSON_CreateNumber((double)(unsigned)pick->f_teid.teid);
+                if (!t) { cJSON_Delete(upf); cJSON_Delete(n3); return NULL; }
+                cJSON_AddItemToObjectCS(upf, "teid", t);
+                has_content = true;
+            }
+
+            cJSON *addr = addr_string_item(&ip, OGS_GTPV1_U_UDP_PORT);
+            if (addr) {
+                cJSON_AddItemToObjectCS(upf, "addr", addr);
+                has_content = true;
+            }
+
+            if (pick->id) {
+                cJSON *pid = cJSON_CreateNumber((double)(unsigned)pick->id);
+                if (!pid) { cJSON_Delete(upf); cJSON_Delete(n3); return NULL; }
+                cJSON_AddItemToObjectCS(upf, "pdr_id", pid);
+                has_content = true;
+            }
+
+            if (has_content) {
+                cJSON_AddItemToObjectCS(n3, "upf", upf);
+            } else {
+                cJSON_Delete(upf);
+            }
+        }
+    } while (0);
+
+    if (n3->child == NULL) { cJSON_Delete(n3); return NULL; }
+    return n3;
+}
+
+/* Handover function disabled */
+/*
+static cJSON *build_handover_object_5g(const smf_sess_t *sess)
+{
+    if (!sess) return NULL;
+    int any = 0;
+    cJSON *ho = cJSON_CreateObject();
+    if (!ho) return NULL;
+
+    if (sess->handover.prepared) {
+        cJSON *b = cJSON_CreateBool(1);
+        if (!b) { cJSON_Delete(ho); return NULL; }
+        cJSON_AddItemToObjectCS(ho, "prepared", b);
+        any = 1;
+    }
+    if (sess->handover.indirect_data_forwarding) {
+        cJSON *b = cJSON_CreateBool(1);
+        if (!b) { cJSON_Delete(ho); return NULL; }
+        cJSON_AddItemToObjectCS(ho, "indirect_data_forwarding", b);
+        any = 1;
+    }
+    if (sess->handover.data_forwarding_not_possible) {
+        cJSON *b = cJSON_CreateBool(1);
+        if (!b) { cJSON_Delete(ho); return NULL; }
+        cJSON_AddItemToObjectCS(ho, "data_forwarding_not_possible", b);
+        any = 1;
+    }
+
+    // Target gNB (N3 for target cell)
+    if (sess->handover.gnb_n3_teid || !ip_is_unspecified(&sess->handover.gnb_n3_ip)) {
+        cJSON *gnb = cJSON_CreateObject();
+        if (!gnb) { cJSON_Delete(ho); return NULL; }
+        bool has_content = false;
+
+        if (sess->handover.gnb_n3_teid) {
+            cJSON *t = cJSON_CreateNumber((double)(unsigned)sess->handover.gnb_n3_teid);
+            if (!t) { cJSON_Delete(gnb); cJSON_Delete(ho); return NULL; }
+            cJSON_AddItemToObjectCS(gnb, "teid", t);
+            has_content = true;
+        }
+        cJSON *addr = addr_string_item(&sess->handover.gnb_n3_ip, OGS_GTPV1_U_UDP_PORT);
+        if (addr) {
+            cJSON_AddItemToObjectCS(gnb, "addr", addr);
+            has_content = true;
+        }
+
+        if (has_content) {
+            cJSON_AddItemToObjectCS(ho, "target_gnb", gnb);
+            any = 1;
+        } else {
+            cJSON_Delete(gnb);
+        }
+    }
+
+    if (sess->handover.local_dl_teid || sess->handover.remote_dl_teid ||
+        sess->handover.local_dl_addr || sess->handover.local_dl_addr6 ||
+        !ip_is_unspecified(&sess->handover.remote_dl_ip)) {
+
+        cJSON *fwd = cJSON_CreateObject();
+        if (!fwd) { cJSON_Delete(ho); return NULL; }
+
+        // Local endpoint (SMF side of indirect forwarding tunnel)
+        if (sess->handover.local_dl_teid || sess->handover.local_dl_addr || sess->handover.local_dl_addr6) {
+            cJSON *loc = cJSON_CreateObject();
+            if (!loc) { cJSON_Delete(fwd); cJSON_Delete(ho); return NULL; }
+            bool has_content = false;
+
+            if (sess->handover.local_dl_teid) {
+                cJSON *t = cJSON_CreateNumber((double)(unsigned)sess->handover.local_dl_teid);
+                if (!t) { cJSON_Delete(loc); cJSON_Delete(fwd); cJSON_Delete(ho); return NULL; }
+                cJSON_AddItemToObjectCS(loc, "teid", t);
+                has_content = true;
+            }
+            cJSON *laddr = addr_string_from_sockaddr(sess->handover.local_dl_addr,
+                                                     sess->handover.local_dl_addr6,
+                                                     OGS_GTPV1_U_UDP_PORT);
+            if (laddr) {
+                cJSON_AddItemToObjectCS(loc, "addr", laddr);
+                has_content = true;
+            }
+
+            if (has_content) {
+                cJSON_AddItemToObjectCS(fwd, "local", loc);
+            } else {
+                cJSON_Delete(loc);
+            }
+        }
+
+        // Remote endpoint (UPF side of indirect forwarding tunnel)
+        if (sess->handover.remote_dl_teid || !ip_is_unspecified(&sess->handover.remote_dl_ip)) {
+            cJSON *rem = cJSON_CreateObject();
+            if (!rem) { cJSON_Delete(fwd); cJSON_Delete(ho); return NULL; }
+            bool has_content = false;
+
+            if (sess->handover.remote_dl_teid) {
+                cJSON *t = cJSON_CreateNumber((double)(unsigned)sess->handover.remote_dl_teid);
+                if (!t) { cJSON_Delete(rem); cJSON_Delete(fwd); cJSON_Delete(ho); return NULL; }
+                cJSON_AddItemToObjectCS(rem, "teid", t);
+                has_content = true;
+            }
+            cJSON *raddr = addr_string_item(&sess->handover.remote_dl_ip, OGS_GTPV1_U_UDP_PORT);
+            if (raddr) {
+                cJSON_AddItemToObjectCS(rem, "addr", raddr);
+                has_content = true;
+            }
+
+            if (has_content) {
+                cJSON_AddItemToObjectCS(fwd, "upf", rem);
+            } else {
+                cJSON_Delete(rem);
+            }
+        }
+
+        if (fwd->child != NULL) {
+            cJSON_AddItemToObjectCS(ho, "dl_forwarding", fwd);
+            any = 1;
+        } else {
+            cJSON_Delete(fwd);
+        }
+    }
+
+    if (!any) { cJSON_Delete(ho); return NULL; }
+    return ho;
+}
+*/
+
+static cJSON *build_snssai_object(const smf_sess_t *sess)
+{
+    cJSON *sn = cJSON_CreateObject();
+    if (!sn) return NULL;
+
+    cJSON *sst = cJSON_CreateNumber((double)sess->s_nssai.sst);
+    if (!sst) { cJSON_Delete(sn); return NULL; }
+    cJSON_AddItemToObjectCS(sn, "sst", sst);
+
+    char sd7;
+    snprintf(sd, sizeof sd, "%06x", (unsigned)u24_to_u32(sess->s_nssai.sd));
+    cJSON *sdj = cJSON_CreateString(sd);
+    if (!sdj) { cJSON_Delete(sn); return NULL; }
+    cJSON_AddItemToObjectCS(sn, "sd", sdj);
+
+    return sn;
+}
+
+static cJSON *build_qos_flows_array_5g(const smf_sess_t *sess)
+{
+    cJSON *arr = cJSON_CreateArray();
+    if (!arr) return NULL;
+
+    smf_bearer_t *b = NULL;
+    ogs_list_for_each(&((smf_sess_t *)sess)->bearer_list, b) {
+        if (!b || b->qfi == 0) continue;
+
+        cJSON *q = cJSON_CreateObject();
+        if (!q) { cJSON_Delete(arr); return NULL; }
+
+        cJSON *qfi = cJSON_CreateNumber((double)(unsigned)b->qfi);
+        if (!qfi) { cJSON_Delete(q); cJSON_Delete(arr); return NULL; }
+        cJSON_AddItemToObjectCS(q, "qfi", qfi);
+
+        if (b->qos.index > 0) {
+            cJSON *q5 = cJSON_CreateNumber((double)(unsigned)b->qos.index);
+            if (!q5) { cJSON_Delete(q); cJSON_Delete(arr); return NULL; }
+            cJSON_AddItemToObjectCS(q, "5qi", q5);
+        }
+
+        cJSON_AddItemToArray(arr, q);
+    }
+
+    return arr;
+}
+
+static cJSON *build_qos_flows_array_lte(const smf_sess_t *sess)
+{
+    cJSON *arr = cJSON_CreateArray();
+    if (!arr) return NULL;
+
+    smf_bearer_t *b = NULL;
+    ogs_list_for_each(&((smf_sess_t *)sess)->bearer_list, b) {
+        if (!b || b->ebi == 0) continue;
+
+        unsigned qci_val = (unsigned)b->qos.index;
+        if (qci_val == 0) qci_val = (unsigned)sess->session.qos.index;
+
+        cJSON *q = cJSON_CreateObject();
+        if (!q) { cJSON_Delete(arr); return NULL; }
+
+        cJSON *ebi = cJSON_CreateNumber((double)(unsigned)b->ebi);
+        if (!ebi) { cJSON_Delete(q); cJSON_Delete(arr); return NULL; }
+        cJSON_AddItemToObjectCS(q, "ebi", ebi);
+
+        if (qci_val > 0) {
+            cJSON *qci = cJSON_CreateNumber((double)qci_val);
+            if (!qci) { cJSON_Delete(q); cJSON_Delete(arr); return NULL; }
+            cJSON_AddItemToObjectCS(q, "qci", qci);
+        }
+
+        cJSON_AddItemToArray(arr, q);
+    }
+
+    return arr;
+}
+
+static cJSON *build_single_pdu_object(const smf_sess_t *sess, int *any_active, int *any_unknown)
+{
+    cJSON *pdu = cJSON_CreateObject();
+    if (!pdu) return NULL;
+
+    /* 5G vs LTE fields */
+    const bool is5g = looks_5g_sess(sess);
+    if (is5g) {
+        cJSON *psi = cJSON_CreateNumber((double)(unsigned)sess->psi);
+        if (!psi) { cJSON_Delete(pdu); return NULL; }
+        cJSON_AddItemToObjectCS(pdu, "psi", psi);
+
+        const char *dnn_c = (sess->session.name ? sess->session.name : "");
+        cJSON *dnn = cJSON_CreateString(dnn_c);
+        if (!dnn) { cJSON_Delete(pdu); return NULL; }
+        cJSON_AddItemToObjectCS(pdu, "dnn", dnn);
+    } else {
+        if (sess->psi > 0) {
+            cJSON *psi = cJSON_CreateNumber((double)(unsigned)sess->psi);
+            if (!psi) { cJSON_Delete(pdu); return NULL; }
+            cJSON_AddItemToObjectCS(pdu, "psi", psi);
+        }
+
+        /* EBI root if present */
+        unsigned ebi_root = 0;
+        smf_bearer_t *b0 = NULL;
+        ogs_list_for_each(&((smf_sess_t *)sess)->bearer_list, b0) {
+            if (b0 && b0->ebi > 0) { ebi_root = (unsigned)b0->ebi; break; }
+        }
+        cJSON *ebi = cJSON_CreateNumber((double)ebi_root);
+        if (!ebi) { cJSON_Delete(pdu); return NULL; }
+        cJSON_AddItemToObjectCS(pdu, "ebi", ebi);
+
+        const char *apn_c = (sess->session.name ? sess->session.name : "");
+        cJSON *apn = cJSON_CreateString(apn_c);
+        if (!apn) { cJSON_Delete(pdu); return NULL; }
+        cJSON_AddItemToObjectCS(pdu, "apn", apn);
+    }
+
+    /* IPs */
+    {
+        char ip4OGS_ADDRSTRLEN = "";
+        char ip6OGS_ADDRSTRLEN = "";
+        if (sess->ipv4) OGS_INET_NTOP(&sess->ipv4->addr, ip4);
+        if (sess->ipv6) OGS_INET6_NTOP(&sess->ipv6->addr, ip6);
+
+        if (ip40) {
+            cJSON *s = cJSON_CreateString(ip4);
+            if (!s) { cJSON_Delete(pdu); return NULL; }
+            cJSON_AddItemToObjectCS(pdu, "ipv4", s);
+        }
+        if (ip60) {
+            cJSON *s = cJSON_CreateString(ip6);
+            if (!s) { cJSON_Delete(pdu); return NULL; }
+            cJSON_AddItemToObjectCS(pdu, "ipv6", s);
+        }
+    }
+
+    /* S-NSSAI */
+    {
+        cJSON *sn = build_snssai_object(sess);
+        if (!sn) { cJSON_Delete(pdu); return NULL; }
+        cJSON_AddItemToObjectCS(pdu, "snssai", sn);
+    }
+
+    /* QoS flows */
+    {
+        cJSON *qarr = is5g ? build_qos_flows_array_5g(sess)
+                           : build_qos_flows_array_lte(sess);
+        if (!qarr) { cJSON_Delete(pdu); return NULL; }
+        cJSON_AddItemToObjectCS(pdu, "qos_flows", qarr);
+    }
+
+    /* N3 + Handover (5GS only) */
+    if (is5g) {
+        cJSON *n3 = build_n3_object_5g(sess);
+        if (n3) cJSON_AddItemToObjectCS(pdu, "n3", n3);
+
+        /* Handover disabled */
+        /*
+        cJSON *ho = build_handover_object_5g(sess);
+        if (ho) cJSON_AddItemToObjectCS(pdu, "handover", ho);
+        */
+    }
+
+    /* PDU state + UE activity aggregation */
+    {
+        const char *state = is5g ? pdu_state_from_5g(sess) : pdu_state_from_lte(sess);
+        cJSON *st = cJSON_CreateString(state);
+        if (!st) { cJSON_Delete(pdu); return NULL; }
+        cJSON_AddItemToObjectCS(pdu, "pdu_state", st);
+
+        if (any_active && !strcmp(state, "active")) *any_active = 1;
+        else if (any_unknown && !strcmp(state, "unknown")) *any_unknown = 1;
+    }
+
+    return pdu;
+}
+
+static cJSON *build_ue_object(const smf_ue_t *ue)
+{
+    cJSON *ueo = cJSON_CreateObject();
+    if (!ueo) return NULL;
+
+    /* UE identity */
+    const char *id = (ue->supi && ue->supi0) ? ue->supi :
+                     (ue->imsi_bcd0 ? ue->imsi_bcd : "");
+    cJSON *idj = cJSON_CreateString(id);
+    if (!idj) { cJSON_Delete(ueo); return NULL; }
+    cJSON_AddItemToObjectCS(ueo, "supi", idj);
+
+    /* PDUs */
+    cJSON *pdus = cJSON_CreateArray();
+    if (!pdus) { cJSON_Delete(ueo); return NULL; }
+
+    int any_active = 0, any_unknown = 0;
+
+    smf_sess_t *sess = NULL;
+    ogs_list_for_each(&ue->sess_list, sess) {
+        cJSON *pdu = build_single_pdu_object(sess, &any_active, &any_unknown);
+        if (!pdu) { cJSON_Delete(pdus); cJSON_Delete(ueo); return NULL; }
+        cJSON_AddItemToArray(pdus, pdu);
+    }
+    cJSON_AddItemToObjectCS(ueo, "pdu", pdus);
+
+    /* UE activity */
+    {
+        const char *ue_act = any_active ? "active" : (any_unknown ? "unknown" : "idle");
+        cJSON *ua = cJSON_CreateString(ue_act);
+        if (!ua) { cJSON_Delete(ueo); return NULL; }
+        cJSON_AddItemToObjectCS(ueo, "ue_activity", ua);
+    }
+
+    return ueo;
+}
+
+size_t smf_dump_pdu_info_paged(char *buf, size_t buflen, size_t page, size_t page_size)
+{
+    if (!buf || buflen == 0) return 0;
+
+    const bool no_paging = (page == SIZE_MAX);
+    if (!no_paging) {
+        if (page_size == 0) page_size = PDU_INFO_PAGE_SIZE_DEFAULT;
+        if (page_size > PDU_INFO_PAGE_SIZE_DEFAULT) page_size = PDU_INFO_PAGE_SIZE_DEFAULT;
+    } else {
+        page_size = SIZE_MAX;
+        page = 0;
+    }
+
+    const size_t start_index = json_pager_safe_start_index(no_paging, page, page_size);
+
+    cJSON *root = cJSON_CreateObject();
+    if (!root) { if (buflen >= 3) { memcpy(buf, "{}", 3); return 2; } if (buflen) buf0 = '\0'; return 0; }
+
+    cJSON *items = cJSON_CreateArray();
+    if (!items) { cJSON_Delete(root); if (buflen >= 3) { memcpy(buf, "{}", 3); return 2; } if (buflen) buf0 = '\0'; return 0; }
+
+    size_t idx = 0, emitted = 0;
+    bool has_next = false, oom = false;
+
+    smf_context_t *smf = smf_self();
+    smf_ue_t *ue = NULL;
+
+    ogs_list_for_each(&smf->smf_ue_list, ue) {
+        int act = json_pager_advance(no_paging, idx, start_index, emitted, page_size, &has_next);
+        if (act == 1) { idx++; continue; }
+        if (act == 2) break;
+
+        cJSON *ueo = build_ue_object(ue);
+        if (!ueo) { oom = true; break; }
+
+        cJSON_AddItemToArray(items, ueo);
+        emitted++;
+        idx++;
+    }
+
+    cJSON_AddItemToObjectCS(root, "items", items);
+    json_pager_add_trailing(root, no_paging, page, page_size, emitted, has_next && !oom, "/pdu-info", oom);
+
+    return json_pager_finalize(root, buf, buflen);
+}
+
+size_t smf_dump_pdu_info(char *buf, size_t buflen, size_t page, size_t page_size)
+{
+    if (page == SIZE_MAX) {
+        page = 0;
+        page_size = PDU_INFO_PAGE_SIZE_DEFAULT;
+    } else if (page_size == 0) {
+        page_size = PDU_INFO_PAGE_SIZE_DEFAULT;
+    }
+
+    return smf_dump_pdu_info_paged(buf, buflen, page, page_size);
+}
+

open5gs_2.7.7.tar.xz/src/smf/pdu-info.h Added

@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2025 by Juraj Elias <juraj.elias@gmail.com>
+ *
+ * This file is part of Open5GS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/*
+ * Minimal public API for /pdu-info
+ */
+#ifndef SMF_PDU_INFO_H
+#define SMF_PDU_INFO_H
+
+#include <stddef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+#ifndef PDU_INFO_PAGE_SIZE_DEFAULT
+#define PDU_INFO_PAGE_SIZE_DEFAULT 100U
+#endif
+
+size_t smf_dump_pdu_info(char *buf, size_t buflen,
+        size_t page, size_t page_size);
+size_t smf_dump_pdu_info_paged(char *buf, size_t buflen,
+        size_t page, size_t page_size);
+#ifdef __cplusplus
+}
+#endif
+
+#endif

open5gs_2.7.6.tar.xz/src/smf/pfcp-path.c -> open5gs_2.7.7.tar.xz/src/smf/pfcp-path.c Changed

@@ -372,6 +372,58 @@
     }
 }
 
+static void qos_flow_5gc_timeout(ogs_pfcp_xact_t *xact, void *data)
+{
+    ogs_pool_id_t qos_flow_id = OGS_INVALID_POOL_ID;
+    smf_ue_t *smf_ue = NULL;
+    smf_sess_t *sess = NULL;
+    smf_bearer_t *qos_flow = NULL;
+    ogs_sbi_stream_t *stream = NULL;
+    char *strerror = NULL;
+    uint8_t type;
+
+    ogs_assert(xact);
+    ogs_assert(data);
+
+    if (xact->assoc_stream_id >= OGS_MIN_POOL_ID &&
+            xact->assoc_stream_id <= OGS_MAX_POOL_ID)
+        stream = ogs_sbi_stream_find_by_id(xact->assoc_stream_id);
+
+    type = xact->seq0.type;
+
+    qos_flow_id = OGS_POINTER_TO_UINT(data);
+    ogs_assert(qos_flow_id >= OGS_MIN_POOL_ID &&
+            qos_flow_id <= OGS_MAX_POOL_ID);
+
+    qos_flow = smf_qos_flow_find_by_id(qos_flow_id);
+    if (!qos_flow) {
+        ogs_error("QoS Flow has already been removed %d", type);
+        return;
+    }
+    sess = smf_sess_find_by_id(qos_flow->sess_id);
+    ogs_assert(sess);
+    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+    ogs_assert(smf_ue);
+
+    switch (type) {
+    case OGS_PFCP_SESSION_MODIFICATION_REQUEST_TYPE:
+        strerror = ogs_msprintf("%s:%d No PFCP session modification response",
+                smf_ue->supi, sess->psi);
+        ogs_assert(strerror);
+
+        ogs_error("%s", strerror);
+        if (stream) {
+            smf_sbi_send_sm_context_update_error_log(
+                stream, OGS_SBI_HTTP_STATUS_GATEWAY_TIMEOUT, strerror, NULL);
+        }
+        ogs_free(strerror);
+        break;
+    default:
+        ogs_error("Not implemented type:%d", type);
+        break;
+    }
+}
+
 static void sess_epc_timeout(ogs_pfcp_xact_t *xact, void *data)
 {
     smf_sess_t *sess = NULL;
@@ -480,7 +532,7 @@
 }
 
 int smf_5gc_pfcp_send_session_establishment_request(
-        smf_sess_t *sess, uint64_t flags)
+        smf_sess_t *sess, ogs_sbi_stream_t *stream, uint64_t flags)
 {
     int rv;
     ogs_pkbuf_t *n4buf = NULL;
@@ -496,6 +548,12 @@
         return OGS_ERROR;
     }
 
+    if (stream) {
+        xact->assoc_stream_id = ogs_sbi_id_from_stream(stream);
+        ogs_assert(xact->assoc_stream_id >= OGS_MIN_POOL_ID &&
+                xact->assoc_stream_id <= OGS_MAX_POOL_ID);
+    }
+
     xact->local_seid = sess->smf_n4_seid;
     xact->create_flags = flags;
 
@@ -553,7 +611,7 @@
 
 int smf_5gc_pfcp_send_all_pdr_modification_request(
         smf_sess_t *sess, ogs_sbi_stream_t *stream,
-        uint64_t flags, ogs_time_t duration)
+        uint64_t flags, int trigger, ogs_time_t duration)
 {
     int rv;
     ogs_pfcp_xact_t *xact = NULL;
@@ -578,6 +636,7 @@
 
     xact->local_seid = sess->smf_n4_seid;
     xact->modify_flags = flags | OGS_PFCP_MODIFY_SESSION;
+    xact->delete_trigger = trigger;
 
     ogs_list_init(&sess->pdr_to_modify_list);
     ogs_list_for_each(&sess->pfcp.pdr_list, pdr)
@@ -617,6 +676,45 @@
 
     rv = smf_pfcp_send_modify_list(
             sess, smf_n4_build_qos_flow_to_modify_list, xact, duration);
+    ogs_expect(rv == OGS_OK);
+
+    return rv;
+}
+
+int smf_5gc_pfcp_send_one_qos_flow_modification_request(
+        smf_bearer_t *qos_flow, ogs_sbi_stream_t *stream,
+        uint64_t flags, ogs_time_t duration)
+{
+    int rv;
+    ogs_pfcp_xact_t *xact = NULL;
+    smf_sess_t *sess = NULL;
+
+    ogs_assert(qos_flow);
+    sess = smf_sess_find_by_id(qos_flow->id);
+    ogs_assert(sess);
+
+    xact = ogs_pfcp_xact_local_create(
+            sess->pfcp_node, qos_flow_5gc_timeout,
+            OGS_UINT_TO_POINTER(qos_flow->id));
+    if (!xact) {
+        ogs_error("ogs_pfcp_xact_local_create() failed");
+        return OGS_ERROR;
+    }
+
+    if (stream) {
+        xact->assoc_stream_id = ogs_sbi_id_from_stream(stream);
+        ogs_assert(xact->assoc_stream_id >= OGS_MIN_POOL_ID &&
+                xact->assoc_stream_id <= OGS_MAX_POOL_ID);
+    }
+
+    xact->local_seid = sess->smf_n4_seid;
+    xact->modify_flags = flags;
+
+    ogs_list_init(&sess->qos_flow_to_modify_list);
+    ogs_list_add(&sess->qos_flow_to_modify_list, &qos_flow->to_modify_node);
+
+    rv = smf_pfcp_send_modify_list(
+            sess, smf_n4_build_qos_flow_to_modify_list, xact, duration);
     ogs_expect(rv == OGS_OK);
 
     return rv;

open5gs_2.7.6.tar.xz/src/smf/pfcp-path.h -> open5gs_2.7.7.tar.xz/src/smf/pfcp-path.h Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -36,13 +36,16 @@
         ogs_pfcp_xact_t *xact, ogs_time_t duration);
 
 int smf_5gc_pfcp_send_session_establishment_request(
-        smf_sess_t *sess, uint64_t flags);
+        smf_sess_t *sess, ogs_sbi_stream_t *stream, uint64_t flags);
 int smf_5gc_pfcp_send_all_pdr_modification_request(
         smf_sess_t *sess, ogs_sbi_stream_t *stream,
-        uint64_t flags, ogs_time_t duration);
+        uint64_t flags, int trigger, ogs_time_t duration);
 int smf_5gc_pfcp_send_qos_flow_list_modification_request(
         smf_sess_t *sess, ogs_sbi_stream_t *stream,
         uint64_t flags, ogs_time_t duration);
+int smf_5gc_pfcp_send_one_qos_flow_modification_request(
+        smf_bearer_t *qos_flow, ogs_sbi_stream_t *stream,
+        uint64_t flags, ogs_time_t duration);
 int smf_5gc_pfcp_send_session_deletion_request(
         smf_sess_t *sess, ogs_sbi_stream_t *stream, int trigger);

open5gs_2.7.6.tar.xz/src/smf/pfcp-sm.c -> open5gs_2.7.7.tar.xz/src/smf/pfcp-sm.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -19,6 +19,7 @@
 
 #include "sbi-path.h"
 #include "pfcp-path.h"
+#include "local-path.h"
 
 #include "n4-handler.h"
 
@@ -480,7 +481,8 @@
                             OGS_INET6_NTOP(&sess->ipv6->addr, buf2) : "");
                     ogs_assert(OGS_OK ==
                             smf_5gc_pfcp_send_session_establishment_request(
-                                sess, OGS_PFCP_CREATE_RESTORATION_INDICATION));
+                                sess, NULL,
+                                OGS_PFCP_CREATE_RESTORATION_INDICATION));
                 }
             }
         }
@@ -489,7 +491,6 @@
 
 static void reselect_upf(ogs_pfcp_node_t *node)
 {
-    int r;
     smf_ue_t *smf_ue = NULL;
     ogs_pfcp_node_t *iter = NULL;
 
@@ -522,27 +523,9 @@
                     ogs_error("%s:%s EPC restoration is not implemented",
                             smf_ue->imsi_bcd, sess->session.name);
                 } else {
-                    if (PCF_SM_POLICY_ASSOCIATED(sess)) {
-                        smf_npcf_smpolicycontrol_param_t param;
-
-                        ogs_info("%s:%d SMF-initiated Deletion",
-                                smf_ue->supi, sess->psi);
-                        ogs_assert(sess->sm_context_ref);
-                        memset(&param, 0, sizeof(param));
-                        r = smf_sbi_discover_and_send(
-                                OGS_SBI_SERVICE_TYPE_NPCF_SMPOLICYCONTROL, NULL,
-                                smf_npcf_smpolicycontrol_build_delete,
-                                sess, NULL,
-                                OGS_PFCP_DELETE_TRIGGER_SMF_INITIATED,
-                                &param);
-                        ogs_expect(r == OGS_OK);
-                        ogs_assert(r != OGS_ERROR);
-                    } else {
-                        ogs_error("%s:%d No PolicyAssociationId. "
-                                "Forcibly remove SESSION",
-                                smf_ue->supi, sess->psi);
-                        SMF_SESS_CLEAR(sess);
-                    }
+                    smf_trigger_session_release(
+                            sess, NULL,
+                            OGS_PFCP_DELETE_TRIGGER_SMF_INITIATED);
                 }
             }
         }

open5gs_2.7.6.tar.xz/src/smf/s5c-handler.c -> open5gs_2.7.7.tar.xz/src/smf/s5c-handler.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2026 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -96,6 +96,7 @@
     char buf2OGS_ADDRSTRLEN;
 
     int i, rv;
+    int bearer_count;
     uint8_t cause_value = 0;
 
     ogs_gtp2_uli_t uli;
@@ -318,9 +319,16 @@
     sgw_s5c_teid = req->sender_f_teid_for_control_plane.data;
     ogs_assert(sgw_s5c_teid);
     /* sess->sgw_s5c_teid has already been updated in SMF-SM */
-    ogs_assert(sess->sgw_s5c_teid == be32toh(sgw_s5c_teid->teid));
+    if (sess->sgw_s5c_teid != be32toh(sgw_s5c_teid->teid)) {
+        ogs_error("SGW-S5C TEID mismatch (sess=0x%x, msg=0x%x)",
+                sess->sgw_s5c_teid, be32toh(sgw_s5c_teid->teid));
+        return OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND;
+    }
     rv = ogs_gtp2_f_teid_to_ip(sgw_s5c_teid, &sess->sgw_s5c_ip);
-    ogs_assert(rv == OGS_OK);
+    if (rv != OGS_OK) {
+        ogs_error("Invalid SGW-S5C TEID");
+        return OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+    }
 
     ogs_debug("    SGW_S5C_TEID0x%x SMF_N4_TEID0x%x",
             sess->sgw_s5c_teid, sess->smf_n4_teid);
@@ -329,23 +337,50 @@
     smf_bearer_remove_all(sess);
 
     /* Setup Bearer */
+    bearer_count = 0;
+
     for (i = 0; i < OGS_BEARER_PER_UE; i++) {
         if (req->bearer_contexts_to_be_createdi.presence == 0)
             break;
+
+        bearer_count++;
+
+        if (bearer_count > 1) {
+            ogs_error("Unexpected multiple Bearer Contexts in "
+                    "Create Session Request");
+            smf_bearer_remove_all(sess);
+            return OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+        }
+
         if (req->bearer_contexts_to_be_createdi.eps_bearer_id.presence == 0) {
             ogs_error("No EPS Bearer ID");
-            break;
+            smf_bearer_remove_all(sess);
+            return OGS_GTP2_CAUSE_MANDATORY_IE_MISSING;
+        }
+        if (smf_bearer_find_by_ebi(sess,
+                    req->bearer_contexts_to_be_createdi.eps_bearer_id.u8)) {
+            ogs_error("Duplicate EPS Bearer ID %u in "
+                    "Create Session Request",
+                    req->bearer_contexts_to_be_createdi.eps_bearer_id.u8);
+            smf_bearer_remove_all(sess);
+            return OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
         }
+
         if (req->bearer_contexts_to_be_createdi.
                 bearer_level_qos.presence == 0) {
             ogs_error("No Bearer QoS");
-            break;
+            smf_bearer_remove_all(sess);
+            return OGS_GTP2_CAUSE_MANDATORY_IE_MISSING;
         }
 
         decoded = ogs_gtp2_parse_bearer_qos(&bearer_qos,
                 &req->bearer_contexts_to_be_createdi.bearer_level_qos);
-        ogs_assert(decoded ==
-                req->bearer_contexts_to_be_createdi.bearer_level_qos.len);
+        if (GTP2_BEARER_QOS_LEN != decoded) {
+            ogs_error("Invalid Bearer QoS IE in Create Session Request "
+                    "(decoded=%d, expected=%d)", decoded, GTP2_BEARER_QOS_LEN);
+            smf_bearer_remove_all(sess);
+            return OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+        }
 
         bearer = smf_bearer_add(sess);
         ogs_assert(bearer);
@@ -360,8 +395,11 @@
             ogs_assert(sgw_s5u_teid);
             bearer->sgw_s5u_teid = be32toh(sgw_s5u_teid->teid);
             rv = ogs_gtp2_f_teid_to_ip(sgw_s5u_teid, &bearer->sgw_s5u_ip);
-            ogs_assert(rv == OGS_OK);
-
+            if (rv != OGS_OK) {
+                ogs_error("Invalid SGW-S5U TEID");
+                smf_bearer_remove_all(sess);
+                return OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+            }
             break;
         case OGS_GTP2_RAT_TYPE_WLAN:
             sgw_s5u_teid = req->bearer_contexts_to_be_createdi.
@@ -369,7 +407,11 @@
             ogs_assert(sgw_s5u_teid);
             bearer->sgw_s5u_teid = be32toh(sgw_s5u_teid->teid);
             rv = ogs_gtp2_f_teid_to_ip(sgw_s5u_teid, &bearer->sgw_s5u_ip);
-            ogs_assert(rv == OGS_OK);
+            if (rv != OGS_OK) {
+                ogs_error("Invalid SGW-S5U TEID");
+                smf_bearer_remove_all(sess);
+                return OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
+            }
             break;
         default:
             ogs_error("Unknown RAT Type %d", sess->gtp_rat_type);
@@ -390,6 +432,12 @@
         }
     }
 
+    if (bearer_count == 0) {
+        ogs_error("No Bearer Context");
+        smf_bearer_remove_all(sess);
+        return OGS_GTP2_CAUSE_MANDATORY_IE_MISSING;
+    }
+
     /* Set AMBR if available */
     if (req->aggregate_maximum_bit_rate.presence) {
         /*
@@ -893,7 +941,8 @@
 
     ogs_assert(OGS_OK ==
         smf_epc_pfcp_send_one_bearer_modification_request(
-            bearer, OGS_INVALID_POOL_ID, OGS_PFCP_MODIFY_ACTIVATE,
+            bearer, OGS_INVALID_POOL_ID,
+            OGS_PFCP_MODIFY_DL_ONLY|OGS_PFCP_MODIFY_ACTIVATE,
             OGS_NAS_PROCEDURE_TRANSACTION_IDENTITY_UNASSIGNED,
             OGS_GTP2_CAUSE_UNDEFINED_VALUE));
 }
@@ -1487,7 +1536,15 @@
 
         decoded = ogs_gtp2_parse_flow_qos(
                 &flow_qos, &cmd->flow_quality_of_service);
-        ogs_assert(cmd->flow_quality_of_service.len == decoded);
+        if (GTP2_FLOW_QOS_LEN != decoded) {
+            ogs_error("Invalid Flow QoS IE length (decoded=%d, ie_len=%u)",
+                      decoded, GTP2_FLOW_QOS_LEN);
+            ogs_gtp2_send_error_message(
+                    xact, get_sender_f_teid(sess, sender_f_teid),
+                    OGS_GTP2_BEARER_RESOURCE_FAILURE_INDICATION_TYPE,
+                    OGS_GTP2_CAUSE_INVALID_MESSAGE_FORMAT);
+            return;
+        }
 
         bearer->qos.mbr.uplink = flow_qos.ul_mbr;
         bearer->qos.mbr.downlink = flow_qos.dl_mbr;

open5gs_2.7.6.tar.xz/src/smf/s6b-path.c -> open5gs_2.7.7.tar.xz/src/smf/s6b-path.c Changed

@@ -1,5 +1,5 @@
 /* 3GPP TS 29.273 section 9
- * Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2026 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -128,7 +128,17 @@
         size_t sidlen = strlen(sess->s6b_sid);
         ret = fd_sess_fromsid_msg((os0_t)sess->s6b_sid, sidlen, &session, &new);
         ogs_assert(ret == 0);
-        ogs_assert(new == 0);
+        if (new) {
+            ogs_error("S6b Session %s missing in Diameter stack. "
+                    "Releasing PDU Session to recover.", sess->s6b_sid);
+            ret = fd_msg_free(req);
+            ogs_assert(ret == 0);
+
+            ogs_free(sess->s6b_sid);
+            sess->s6b_sid = NULL;
+
+            return;
+        }
 
         ogs_debug("    Found S6b Session-Id: %s", sess->s6b_sid);
 
@@ -357,7 +367,6 @@
 static void smf_s6b_aaa_cb(void *data, struct msg **msg)
 {
     int ret;
-
     struct sess_state *sess_data = NULL;
     struct timespec ts;
     struct session *session;
@@ -366,7 +375,6 @@
     unsigned long dur;
     int error = 0;
     int new;
-
     smf_sess_t *sess = NULL;
     smf_event_t *e = NULL;
     ogs_diam_s6b_message_t *s6b_message = NULL;
@@ -379,7 +387,10 @@
     /* Search the session, retrieve its data */
     ret = fd_msg_sess_get(fd_g_config->cnf_dict, *msg, &session, &new);
     ogs_assert(ret == 0);
-    ogs_assert(new == 0);
+    if (new != 0) {
+        ogs_error("Session should already exist, but new session flag is set");
+        goto cleanup;
+    }
 
     ogs_debug("    Search the session");
 
@@ -387,7 +398,7 @@
     ogs_assert(ret == 0);
     if (!sess_data) {
         ogs_error("No Session Data");
-        return;
+        goto cleanup;
     }
     ogs_assert((void *)sess_data == data);
 
@@ -396,9 +407,14 @@
     sess = sess_data->sess;
     ogs_assert(sess);
 
+    /* Allocate S6B message structure */
     s6b_message = ogs_calloc(1, sizeof(ogs_diam_s6b_message_t));
-    ogs_assert(s6b_message);
-    /* Set Session Termination Command */
+    if (!s6b_message) {
+        ogs_error("Failed to allocate s6b_message");
+        goto cleanup;
+    }
+
+    /* Set Authentication Authorization Command */
     s6b_message->cmd_code = OGS_DIAM_S6B_CMD_AUTHENTICATION_AUTHORIZATION;
 
     /* Value of Result Code */
@@ -425,7 +441,8 @@
                 ret = fd_msg_avp_hdr(avpch1, &hdr);
                 ogs_assert(ret == 0);
                 s6b_message->result_code = hdr->avp_value->i32;
-                ogs_error("Experimental Result Code: %d", s6b_message->result_code);
+                ogs_error("Experimental Result Code: %d",
+                         s6b_message->result_code);
             }
         } else {
             ogs_error("no Result-Code");
@@ -458,34 +475,52 @@
         error++;
     }
 
+    /* Create and queue the event */
     e = smf_event_new(SMF_EVT_S6B_MESSAGE);
-    ogs_assert(e);
+    if (!e) {
+        ogs_error("Failed to create SMF event");
+        goto cleanup;
+    }
 
-    if (error && s6b_message->result_code == ER_DIAMETER_SUCCESS)
-            s6b_message->result_code = error;
+    /* Override result code if there were parsing errors */
+    if (error && s6b_message->result_code == ER_DIAMETER_SUCCESS) {
+        s6b_message->result_code = error;
+    }
 
     e->sess_id = sess->id;
     e->gtp_xact_id = sess_data->xact_id;
     e->s6b_message = s6b_message;
+
     ret = ogs_queue_push(ogs_app()->queue, e);
     if (ret != OGS_OK) {
         ogs_error("ogs_queue_push() failed:%d", (int)ret);
-        ogs_free(s6b_message);
         ogs_event_free(e);
-    } else {
-        ogs_pollset_notify(ogs_app()->pollset);
+        goto cleanup;
     }
 
-    /* Free the message */
+    /* Notify the event loop */
+    ogs_pollset_notify(ogs_app()->pollset);
+
+    /* Event successfully queued, clear pointer to avoid double-free */
+    s6b_message = NULL;
+    e = NULL;
+
+cleanup:
+    /* Update statistics and cleanup */
     ogs_assert(pthread_mutex_lock(&ogs_diam_stats_self()->stats_lock) == 0);
+
+    /* Calculate response time */
     dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
         ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+
     if (ogs_diam_stats_self()->stats.nb_recv) {
-        /* Ponderate in the avg */
-        ogs_diam_stats_self()->stats.avg = (ogs_diam_stats_self()->stats.avg *
-            ogs_diam_stats_self()->stats.nb_recv + dur) /
+        /* Update average response time */
+        ogs_diam_stats_self()->stats.avg =
+            (ogs_diam_stats_self()->stats.avg *
+             ogs_diam_stats_self()->stats.nb_recv + dur) /
             (ogs_diam_stats_self()->stats.nb_recv + 1);
-        /* Min, max */
+
+        /* Update min/max response times */
         if (dur < ogs_diam_stats_self()->stats.shortest)
             ogs_diam_stats_self()->stats.shortest = dur;
         if (dur > ogs_diam_stats_self()->stats.longest)
@@ -495,27 +530,39 @@
         ogs_diam_stats_self()->stats.longest = dur;
         ogs_diam_stats_self()->stats.avg = dur;
     }
-    if (error)
+
+    /* Update error/success counters */
+    if (error || s6b_message) /* s6b_message != NULL means cleanup case */
         ogs_diam_stats_self()->stats.nb_errs++;
     else
         ogs_diam_stats_self()->stats.nb_recv++;
 
     ogs_assert(pthread_mutex_unlock(&ogs_diam_stats_self()->stats_lock) == 0);
 
-    /* Display how long it took */
-    if (ts.tv_nsec > sess_data->ts.tv_nsec)
-        ogs_debug("in %d.%06ld sec",
-                (int)(ts.tv_sec - sess_data->ts.tv_sec),
-                (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-    else
-        ogs_debug("in %d.%06ld sec",
-                (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
-                (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+    /* Display response time */
+    if (sess_data) {
+        if (ts.tv_nsec > sess_data->ts.tv_nsec)
+            ogs_debug("in %d.%06ld sec",
+                    (int)(ts.tv_sec - sess_data->ts.tv_sec),
+                    (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+        else
+            ogs_debug("in %d.%06ld sec",
+                    (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
+                    (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec)
+                    / 1000);
 
-    ret = fd_sess_state_store(smf_s6b_reg, session, &sess_data);
-    ogs_assert(ret == 0);
-    ogs_assert(sess_data == NULL);
+        /* Store session state */
+        ret = fd_sess_state_store(smf_s6b_reg, session, &sess_data);
+        ogs_assert(ret == 0);
+        ogs_assert(sess_data == NULL);
+    }
 
+    /* Free allocated memory if not successfully queued */
+    if (s6b_message) {
+        ogs_free(s6b_message);
+    }
+
+    /* Free the Diameter message */
     ret = fd_msg_free(*msg);
     ogs_assert(ret == 0);
     *msg = NULL;
@@ -560,7 +607,17 @@
     sidlen = strlen(sess->s6b_sid);
     ret = fd_sess_fromsid_msg((os0_t)sess->s6b_sid, sidlen, &session, &new);
     ogs_assert(ret == 0);
-    ogs_assert(new == 0);
+    if (new) {
+        ogs_error("S6b Session %s missing in Diameter stack. "
+                "Releasing PDU Session to recover.", sess->s6b_sid);
+        ret = fd_msg_free(req);
+        ogs_assert(ret == 0);
+
+        ogs_free(sess->s6b_sid);
+        sess->s6b_sid = NULL;
+
+        return;
+    }
 
     ogs_debug("    Found S6b Session-Id: %s", sess->s6b_sid);
 
@@ -656,7 +713,6 @@
 {
     int ret;
     int rv;
-
     struct sess_state *sess_data = NULL;
     struct timespec ts;
     struct session *session;
@@ -665,7 +721,6 @@
     unsigned long dur;
     int error = 0;
     int new;
-
     smf_event_t *e = NULL;
     smf_sess_t *sess = NULL;
     ogs_diam_s6b_message_t *s6b_message = NULL;
@@ -678,7 +733,10 @@
     /* Search the session, retrieve its data */
     ret = fd_msg_sess_get(fd_g_config->cnf_dict, *msg, &session, &new);
     ogs_assert(ret == 0);
-    ogs_assert(new == 0);
+    if (new != 0) {
+        ogs_error("Session should already exist, but new session flag is set");
+        goto cleanup;
+    }
 
     ogs_debug("    Search the session");
 
@@ -686,7 +744,7 @@
     ogs_assert(ret == 0);
     if (!sess_data) {
         ogs_error("No Session Data");
-        return;
+        goto cleanup;
     }
     ogs_assert((void *)sess_data == data);
 
@@ -695,8 +753,13 @@
     sess = sess_data->sess;
     ogs_assert(sess);
 
+    /* Allocate S6B message structure */
     s6b_message = ogs_calloc(1, sizeof(ogs_diam_s6b_message_t));
-    ogs_assert(s6b_message);
+    if (!s6b_message) {
+        ogs_error("Failed to allocate s6b_message");
+        goto cleanup;
+    }
+
     /* Set Session Termination Command */
     s6b_message->cmd_code = OGS_DIAM_S6B_CMD_SESSION_TERMINATION;
 
@@ -760,64 +823,92 @@
         error++;
     }
 
+    /* Create and queue the event only if no critical errors */
     if (!error) {
         e = smf_event_new(SMF_EVT_S6B_MESSAGE);
-        ogs_assert(e);
+        if (!e) {
+            ogs_error("Failed to create SMF event");
+            goto cleanup;
+        }
 
         e->sess_id = sess->id;
         e->s6b_message = s6b_message;
+
         rv = ogs_queue_push(ogs_app()->queue, e);
         if (rv != OGS_OK) {
             ogs_error("ogs_queue_push() failed:%d", (int)rv);
-            ogs_free(s6b_message);
             ogs_event_free(e);
-        } else {
-            ogs_pollset_notify(ogs_app()->pollset);
+            goto cleanup;
         }
-    } else {
-        ogs_free(s6b_message);
+
+        /* Notify the event loop */
+        ogs_pollset_notify(ogs_app()->pollset);
+
+        /* Event successfully queued, clear pointer to avoid double-free */
+        s6b_message = NULL;
+        e = NULL;
     }
 
-    /* Free the message */
+cleanup:
+    /* Update statistics */
     ogs_assert(pthread_mutex_lock(&ogs_diam_stats_self()->stats_lock) == 0);
-    dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
-        ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-    if (ogs_diam_stats_self()->stats.nb_recv) {
-        /* Ponderate in the avg */
-        ogs_diam_stats_self()->stats.avg = (ogs_diam_stats_self()->stats.avg *
-            ogs_diam_stats_self()->stats.nb_recv + dur) /
-            (ogs_diam_stats_self()->stats.nb_recv + 1);
-        /* Min, max */
-        if (dur < ogs_diam_stats_self()->stats.shortest)
+
+    /* Calculate response time */
+    if (sess_data) {
+        dur = ((ts.tv_sec - sess_data->ts.tv_sec) * 1000000) +
+            ((ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+
+        if (ogs_diam_stats_self()->stats.nb_recv) {
+            /* Update average response time */
+            ogs_diam_stats_self()->stats.avg =
+                (ogs_diam_stats_self()->stats.avg *
+                 ogs_diam_stats_self()->stats.nb_recv + dur) /
+                (ogs_diam_stats_self()->stats.nb_recv + 1);
+
+            /* Update min/max response times */
+            if (dur < ogs_diam_stats_self()->stats.shortest)
+                ogs_diam_stats_self()->stats.shortest = dur;
+            if (dur > ogs_diam_stats_self()->stats.longest)
+                ogs_diam_stats_self()->stats.longest = dur;
+        } else {
             ogs_diam_stats_self()->stats.shortest = dur;
-        if (dur > ogs_diam_stats_self()->stats.longest)
             ogs_diam_stats_self()->stats.longest = dur;
-    } else {
-        ogs_diam_stats_self()->stats.shortest = dur;
-        ogs_diam_stats_self()->stats.longest = dur;
-        ogs_diam_stats_self()->stats.avg = dur;
+            ogs_diam_stats_self()->stats.avg = dur;
+        }
     }
-    if (error)
+
+    /* Update error/success counters */
+    if (error || s6b_message) /* s6b_message != NULL means cleanup case */
         ogs_diam_stats_self()->stats.nb_errs++;
     else
         ogs_diam_stats_self()->stats.nb_recv++;
 
     ogs_assert(pthread_mutex_unlock(&ogs_diam_stats_self()->stats_lock) == 0);
 
-    /* Display how long it took */
-    if (ts.tv_nsec > sess_data->ts.tv_nsec)
-        ogs_debug("in %d.%06ld sec",
-                (int)(ts.tv_sec - sess_data->ts.tv_sec),
-                (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
-    else
-        ogs_debug("in %d.%06ld sec",
-                (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
-                (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+    /* Display response time */
+    if (sess_data) {
+        if (ts.tv_nsec > sess_data->ts.tv_nsec)
+            ogs_debug("in %d.%06ld sec",
+                    (int)(ts.tv_sec - sess_data->ts.tv_sec),
+                    (long)(ts.tv_nsec - sess_data->ts.tv_nsec) / 1000);
+        else
+            ogs_debug("in %d.%06ld sec",
+                    (int)(ts.tv_sec + 1 - sess_data->ts.tv_sec),
+                    (long)(1000000000 + ts.tv_nsec - sess_data->ts.tv_nsec)
+                    / 1000);
 
-    ret = fd_sess_state_store(smf_s6b_reg, session, &sess_data);
-    ogs_assert(ret == 0);
-    ogs_assert(sess_data == NULL);
+        /* Store session state */
+        ret = fd_sess_state_store(smf_s6b_reg, session, &sess_data);
+        ogs_assert(ret == 0);
+        ogs_assert(sess_data == NULL);
+    }
+
+    /* Free allocated memory if not successfully queued */
+    if (s6b_message) {
+        ogs_free(s6b_message);
+    }
 
+    /* Free the Diameter message */
     ret = fd_msg_free(*msg);
     ogs_assert(ret == 0);
     *msg = NULL;

open5gs_2.7.6.tar.xz/src/smf/sbi-path.c -> open5gs_2.7.7.tar.xz/src/smf/sbi-path.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2022 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -44,6 +44,7 @@
     ogs_sbi_nf_instance_build_default(nf_instance);
     ogs_sbi_nf_instance_add_allowed_nf_type(nf_instance, OpenAPI_nf_type_SCP);
     ogs_sbi_nf_instance_add_allowed_nf_type(nf_instance, OpenAPI_nf_type_AMF);
+    ogs_sbi_nf_instance_add_allowed_nf_type(nf_instance, OpenAPI_nf_type_SMF);
 
     /* Build NF service information. It will be transmitted to NRF. */
     if (ogs_sbi_nf_service_is_available(OGS_SBI_SERVICE_NAME_NSMF_PDUSESSION)) {
@@ -53,6 +54,7 @@
         ogs_sbi_nf_service_add_version(
                     service, OGS_SBI_API_V1, OGS_SBI_API_V1_0_0, NULL);
         ogs_sbi_nf_service_add_allowed_nf_type(service, OpenAPI_nf_type_AMF);
+        ogs_sbi_nf_service_add_allowed_nf_type(service, OpenAPI_nf_type_SMF);
     }
 
     /* Initialize NRF NF Instance */
@@ -234,13 +236,13 @@
     return OGS_OK;
 }
 
-void smf_namf_comm_send_n1_n2_message_transfer(
-        smf_sess_t *sess, smf_n1_n2_message_transfer_param_t *param)
+ogs_sbi_xact_t *smf_namf_comm_create_n1_n2_message_xact(
+        smf_sess_t *sess, ogs_sbi_stream_t *stream,
+        smf_n1_n2_message_transfer_param_t *param)
 {
     smf_ue_t *smf_ue = NULL;
     ogs_sbi_xact_t *xact = NULL;
     ogs_sbi_discovery_option_t *discovery_option = NULL;
-    int r;
 
     ogs_assert(sess);
     smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
@@ -253,7 +255,7 @@
     discovery_option = ogs_sbi_discovery_option_new();
     ogs_assert(discovery_option);
     ogs_sbi_discovery_option_set_target_nf_instance_id(
-            discovery_option, sess->serving_nf_id);
+            discovery_option, sess->amf_nf_id);
 
     xact = ogs_sbi_xact_add(
             sess->id, &sess->sbi, OGS_SBI_SERVICE_TYPE_NAMF_COMM,
@@ -261,12 +263,39 @@
             (ogs_sbi_build_f)smf_namf_comm_build_n1_n2_message_transfer,
             sess, param);
     if (!xact) {
-        ogs_error("smf_namf_comm_send_n1_n2_message_transfer() failed");
-        return;
+        ogs_error("ogs_sbi_xact_add() failed");
+        return NULL;
     }
 
     xact->state = param->state;
 
+    if (stream) {
+        xact->assoc_stream_id = ogs_sbi_id_from_stream(stream);
+        ogs_assert(xact->assoc_stream_id >= OGS_MIN_POOL_ID &&
+                xact->assoc_stream_id <= OGS_MAX_POOL_ID);
+    }
+
+    return xact;
+}
+
+void smf_namf_comm_send_n1_n2_message_transfer(
+        smf_sess_t *sess, ogs_sbi_stream_t *stream,
+        smf_n1_n2_message_transfer_param_t *param)
+{
+    ogs_sbi_xact_t *xact = NULL;
+    int r;
+
+    ogs_assert(sess);
+    ogs_assert(param);
+    ogs_assert(param->state);
+    ogs_assert(param->n1smbuf || param->n2smbuf);
+
+    xact = smf_namf_comm_create_n1_n2_message_xact(sess, stream, param);
+    if (!xact) {
+        ogs_error("smf_namf_comm_create_n1_n2_message_xact() failed");
+        return;
+    }
+
     r = ogs_sbi_discover_and_send(xact);
     if (r != OGS_OK) {
         ogs_error("smf_namf_comm_send_n1_n2_message_transfer() failed");
@@ -276,17 +305,55 @@
 }
 
 void smf_namf_comm_send_n1_n2_pdu_establishment_reject(
-        smf_sess_t *sess)
+        smf_sess_t *sess, ogs_sbi_stream_t *stream)
 {
     smf_n1_n2_message_transfer_param_t param;
 
     memset(&param, 0, sizeof(param));
-    param.state = SMF_NETWORK_REQUESTED_PDU_SESSION_RELEASE;
+    param.state = SMF_UE_OR_NETWORK_REQUESTED_PDU_SESSION_RELEASE;
     param.n1smbuf = gsm_build_pdu_session_establishment_reject(sess,
         OGS_5GSM_CAUSE_NETWORK_FAILURE);
     ogs_assert(param.n1smbuf);
 
-    smf_namf_comm_send_n1_n2_message_transfer(sess, &param);
+    smf_namf_comm_send_n1_n2_message_transfer(sess, stream, &param);
+}
+
+void smf_sbi_send_sm_context_created_data(
+        smf_sess_t *sess, ogs_sbi_stream_t *stream)
+{
+    OpenAPI_sm_context_created_data_t SmContextCreatedData;
+
+    ogs_sbi_server_t *server = NULL;
+    ogs_sbi_header_t header;
+    ogs_sbi_message_t sendmsg;
+    ogs_sbi_response_t *response = NULL;
+
+    memset(&SmContextCreatedData, 0, sizeof(SmContextCreatedData));
+
+    memset(&sendmsg, 0, sizeof(sendmsg));
+
+    memset(&header, 0, sizeof(header));
+    header.service.name = (char *)OGS_SBI_SERVICE_NAME_NSMF_PDUSESSION;
+    header.api.version = (char *)OGS_SBI_API_V1;
+    header.resource.component0 =
+        (char *)OGS_SBI_RESOURCE_NAME_SM_CONTEXTS;
+    header.resource.component1 = sess->sm_context_ref;
+
+    server = ogs_sbi_server_from_stream(stream);
+    ogs_assert(server);
+    sendmsg.http.location = ogs_sbi_server_uri(server, &header);
+    ogs_assert(sendmsg.http.location);
+
+    sendmsg.SmContextCreatedData = &SmContextCreatedData;
+
+    response = ogs_sbi_build_response(&sendmsg, OGS_SBI_HTTP_STATUS_CREATED);
+    ogs_assert(response);
+    ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+
+    smf_metrics_inst_by_slice_add(&sess->serving_plmn_id, &sess->s_nssai,
+            SMF_METR_CTR_SM_PDUSESSIONCREATIONSUCC, 1);
+
+    ogs_free(sendmsg.http.location);
 }
 
 void smf_sbi_send_sm_context_create_error(
@@ -340,6 +407,267 @@
         ogs_pkbuf_free(n1smbuf);
 }
 
+void smf_sbi_send_pdu_session_created_data(
+        smf_sess_t *sess, ogs_sbi_stream_t *stream)
+{
+    int rv;
+    OpenAPI_pdu_session_created_data_t PduSessionCreatedData;
+
+    OpenAPI_tunnel_info_t hcnTunnelInfo;
+    char ssc_mode2;
+    OpenAPI_ambr_t sessionAmbr;
+    OpenAPI_list_t *qosFlowsSetupList = NULL;
+    OpenAPI_qos_flow_setup_item_t *qosFlowSetupItem = NULL;
+    OpenAPI_qos_flow_profile_t *qosFlowProfile = NULL;
+    OpenAPI_arp_t *Arp = NULL;
+
+    ogs_nas_qos_rule_t qos_ruleOGS_NAS_MAX_NUM_OF_QOS_RULE;
+    ogs_nas_qos_rules_t authorized_qos_rules;
+
+    ogs_nas_qos_flow_description_t
+        qos_flow_descriptionOGS_NAS_MAX_NUM_OF_QOS_FLOW_DESCRIPTION;
+    ogs_nas_qos_flow_descriptions_t authorized_qos_flow_descriptions;
+
+    /*
+     * TS29.502
+     * 6.1.6.2.10 Type: PduSessionCreatedData
+     *
+     * This IE shall be present if the H-SMF/SMF has assigned
+     * IPv6 interface identifier to the UE during
+     * the PDU session establishment for the Home-routed Roaming scenario
+     * or for a PDU session with an I-SMF.
+     *
+     * When present, it shall encode the UE IPv6 Interface Identifier
+     * to be used by the UE for its link-local address configuration
+     * with 16 hexadecimal digits.
+     *
+     * Pattern: "^A-Fa-f0-9{16}$"
+     */
+    char ue_ipv6_interface_id16+1; /* 16 + 1(string-termiante:'\0') */
+
+    int enc_len = 0;
+
+    OpenAPI_ref_to_binary_data_t n1SmInfoToUe;
+    ogs_pkbuf_t *n1SmBufToUe = NULL;
+
+    ogs_sbi_server_t *server = NULL;
+    ogs_sbi_header_t header;
+    ogs_sbi_message_t sendmsg;
+    ogs_sbi_response_t *response = NULL;
+
+    smf_bearer_t *qos_flow = NULL;
+
+    memset(&PduSessionCreatedData, 0, sizeof(PduSessionCreatedData));
+    memset(ssc_mode, 0, sizeof(ssc_mode));
+    memset(&hcnTunnelInfo, 0, sizeof(hcnTunnelInfo));
+    memset(&sessionAmbr, 0, sizeof(sessionAmbr));
+
+    ogs_assert(sess->session.session_type);
+    PduSessionCreatedData.pdu_session_type = sess->session.session_type;
+
+    ogs_assert(sess->session.ssc_mode);
+    ssc_mode0 = ogs_to_hex(sess->session.ssc_mode);
+    PduSessionCreatedData.ssc_mode = ssc_mode;
+
+    if (sess->local_ul_addr)
+        hcnTunnelInfo.ipv4_addr = ogs_ipstrdup(sess->local_ul_addr);
+    if (sess->local_ul_addr6)
+        hcnTunnelInfo.ipv6_addr = ogs_ipstrdup(sess->local_ul_addr6);
+    hcnTunnelInfo.gtp_teid = ogs_uint32_to_0string(sess->local_ul_teid);
+    PduSessionCreatedData.hcn_tunnel_info = &hcnTunnelInfo;
+
+    if (sess->session.ambr.uplink)
+        sessionAmbr.uplink = ogs_sbi_bitrate_to_string(
+            sess->session.ambr.uplink, OGS_SBI_BITRATE_KBPS);
+    if (sess->session.ambr.downlink)
+        sessionAmbr.downlink = ogs_sbi_bitrate_to_string(
+            sess->session.ambr.downlink, OGS_SBI_BITRATE_KBPS);
+
+    if (sessionAmbr.uplink || sessionAmbr.downlink)
+        PduSessionCreatedData.session_ambr = &sessionAmbr;
+
+    qos_flow = smf_default_bearer_in_sess(sess);
+    ogs_assert(qos_flow);
+    ogs_assert(ogs_list_next(qos_flow) == NULL);
+
+    memset(qos_rule, 0, sizeof(qos_rule));
+    gsm_encode_default_qos_rule(&qos_rule0, qos_flow);
+
+    memset(&authorized_qos_rules, 0, sizeof(authorized_qos_rules));
+    rv = ogs_nas_build_qos_rules(&authorized_qos_rules, qos_rule, 1);
+    ogs_assert(rv == OGS_OK);
+    ogs_assert(authorized_qos_rules.length);
+
+    /* QoS flow descriptions */
+    memset(&qos_flow_description, 0, sizeof(qos_flow_description));
+    gsm_encode_default_qos_flow_description(&qos_flow_description0, qos_flow);
+
+    memset(&authorized_qos_flow_descriptions, 0,
+            sizeof(authorized_qos_flow_descriptions));
+    rv = ogs_nas_build_qos_flow_descriptions(
+            &authorized_qos_flow_descriptions, qos_flow_description, 1);
+    ogs_assert(rv == OGS_OK);
+    ogs_assert(authorized_qos_flow_descriptions.length);
+
+    qosFlowsSetupList = OpenAPI_list_create();
+    ogs_assert(qosFlowsSetupList);
+
+    qosFlowSetupItem = ogs_calloc(1, sizeof(*qosFlowSetupItem));
+    ogs_assert(qosFlowSetupItem);
+
+    qosFlowSetupItem->qfi = qos_flow->qfi;
+    if (qos_rule0.DQR_bit) {
+        qosFlowSetupItem->is_default_qos_rule_ind = true;
+        qosFlowSetupItem->default_qos_rule_ind = true;
+    }
+
+    enc_len = ogs_base64_encode_len(authorized_qos_rules.length);
+    qosFlowSetupItem->qos_rules = ogs_calloc(1, enc_len);
+    ogs_assert(qosFlowSetupItem->qos_rules);
+    ogs_base64_encode(qosFlowSetupItem->qos_rules,
+            authorized_qos_rules.buffer, authorized_qos_rules.length);
+
+    ogs_free(authorized_qos_rules.buffer);
+
+    enc_len = ogs_base64_encode_len(
+            authorized_qos_flow_descriptions.length);
+    qosFlowSetupItem->qos_flow_description = ogs_calloc(1, enc_len);
+    ogs_assert(qosFlowSetupItem->qos_flow_description);
+    ogs_base64_encode(qosFlowSetupItem->qos_flow_description,
+            authorized_qos_flow_descriptions.buffer,
+            authorized_qos_flow_descriptions.length);
+
+    ogs_free(authorized_qos_flow_descriptions.buffer);
+
+    Arp = ogs_calloc(1, sizeof(*Arp));
+    ogs_assert(Arp);
+    if (qos_flow->qos.arp.pre_emption_capability ==
+            OGS_5GC_PRE_EMPTION_ENABLED)
+        Arp->preempt_cap = OpenAPI_preemption_capability_MAY_PREEMPT;
+    else if (qos_flow->qos.arp.pre_emption_capability ==
+            OGS_5GC_PRE_EMPTION_DISABLED)
+        Arp->preempt_cap = OpenAPI_preemption_capability_NOT_PREEMPT;
+    else {
+        ogs_error("No Arp->preempt_cap");
+        goto end;
+    }
+
+    if (qos_flow->qos.arp.pre_emption_vulnerability ==
+            OGS_5GC_PRE_EMPTION_ENABLED)
+        Arp->preempt_vuln = OpenAPI_preemption_vulnerability_PREEMPTABLE;
+    else if (qos_flow->qos.arp.pre_emption_vulnerability ==
+            OGS_5GC_PRE_EMPTION_DISABLED)
+        Arp->preempt_vuln = OpenAPI_preemption_vulnerability_NOT_PREEMPTABLE;
+    else {
+        ogs_error("No Arp->preempt_vuln");
+        goto end;
+    }
+    Arp->priority_level = qos_flow->qos.arp.priority_level;
+
+    qosFlowProfile = ogs_calloc(1, sizeof(*qosFlowProfile));
+    ogs_assert(qosFlowProfile);
+    qosFlowProfile->arp = Arp;
+    qosFlowProfile->_5qi = qos_flow->qos.index;
+
+    qosFlowSetupItem->qos_flow_profile = qosFlowProfile;
+
+    OpenAPI_list_add(qosFlowsSetupList, qosFlowSetupItem);
+
+    if (qosFlowsSetupList->count)
+        PduSessionCreatedData.qos_flows_setup_list = qosFlowsSetupList;
+    else
+        OpenAPI_list_free(qosFlowsSetupList);
+
+    PduSessionCreatedData.h_smf_instance_id =
+        NF_INSTANCE_ID(ogs_sbi_self()->nf_instance);
+    ogs_assert(PduSessionCreatedData.h_smf_instance_id);
+
+    memset(ue_ipv6_interface_id, 0, sizeof(ue_ipv6_interface_id));
+    if (sess->paa.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
+        PduSessionCreatedData.ue_ipv4_address =
+            ogs_ipv4_to_string(sess->paa.addr);
+    } else if (sess->paa.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
+        PduSessionCreatedData.ue_ipv6_prefix =
+            ogs_ipv6prefix_to_string(
+                    sess->paa.addr6, OGS_IPV6_DEFAULT_PREFIX_LEN);
+        ogs_hex_to_ascii(
+                sess->paa.addr6+(OGS_IPV6_LEN>>1), OGS_IPV6_LEN>>1,
+                ue_ipv6_interface_id, sizeof(ue_ipv6_interface_id));
+        PduSessionCreatedData.ue_ipv6_interface_id = ue_ipv6_interface_id;
+    } else if (sess->paa.session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
+        PduSessionCreatedData.ue_ipv4_address =
+            ogs_ipv4_to_string(sess->paa.both.addr);
+        PduSessionCreatedData.ue_ipv6_prefix =
+            ogs_ipv6prefix_to_string(
+                    sess->paa.both.addr6, OGS_IPV6_DEFAULT_PREFIX_LEN);
+        ogs_hex_to_ascii(
+                sess->paa.addr6+(OGS_IPV6_LEN>>1), OGS_IPV6_LEN>>1,
+                ue_ipv6_interface_id, sizeof(ue_ipv6_interface_id));
+        PduSessionCreatedData.ue_ipv6_interface_id = ue_ipv6_interface_id;
+    } else {
+        ogs_error("Invalid sess->session.session_type%d",
+                sess->paa.session_type);
+        goto end;
+    }
+
+    memset(&sendmsg, 0, sizeof(sendmsg));
+
+    n1SmBufToUe = gsmue_build_pdu_session_establishment_accept(sess);
+    ogs_assert(n1SmBufToUe);
+
+    n1SmInfoToUe.content_id = (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
+    PduSessionCreatedData.n1_sm_info_to_ue = &n1SmInfoToUe;
+
+    sendmsg.partsendmsg.num_of_part.pkbuf = n1SmBufToUe;
+    sendmsg.partsendmsg.num_of_part.content_id =
+        (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
+    sendmsg.partsendmsg.num_of_part.content_type =
+        (char *)OGS_SBI_CONTENT_5GNAS_TYPE;
+    sendmsg.num_of_part++;
+
+    memset(&header, 0, sizeof(header));
+    header.service.name = (char *)OGS_SBI_SERVICE_NAME_NSMF_PDUSESSION;
+    header.api.version = (char *)OGS_SBI_API_V1;
+    header.resource.component0 =
+        (char *)OGS_SBI_RESOURCE_NAME_PDU_SESSIONS;
+    ogs_assert(sess->pdu_session_ref);
+    header.resource.component1 = sess->pdu_session_ref;
+
+    server = ogs_sbi_server_from_stream(stream);
+    ogs_assert(server);
+    sendmsg.http.location = ogs_sbi_server_uri(server, &header);
+    ogs_assert(sendmsg.http.location);
+
+    sendmsg.PduSessionCreatedData = &PduSessionCreatedData;
+
+    response = ogs_sbi_build_response(&sendmsg,
+            OGS_SBI_HTTP_STATUS_CREATED);
+    ogs_assert(response);
+    ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+
+    ogs_free(sendmsg.http.location);
+
+end:
+    if (hcnTunnelInfo.ipv4_addr)
+        ogs_free(hcnTunnelInfo.ipv4_addr);
+    if (hcnTunnelInfo.ipv6_addr)
+        ogs_free(hcnTunnelInfo.ipv6_addr);
+    if (hcnTunnelInfo.gtp_teid)
+        ogs_free(hcnTunnelInfo.gtp_teid);
+
+    if (sessionAmbr.uplink)
+        ogs_free(sessionAmbr.uplink);
+    if (sessionAmbr.downlink)
+        ogs_free(sessionAmbr.downlink);
+
+    CLEAR_QOS_FLOWS_SETUP_LIST(PduSessionCreatedData.qos_flows_setup_list);
+
+    if (PduSessionCreatedData.ue_ipv4_address)
+        ogs_free(PduSessionCreatedData.ue_ipv4_address);
+    if (PduSessionCreatedData.ue_ipv6_prefix)
+        ogs_free(PduSessionCreatedData.ue_ipv6_prefix);
+}
+
 void smf_sbi_send_sm_context_updated_data(
         smf_sess_t *sess, ogs_sbi_stream_t *stream,
         OpenAPI_up_cnx_state_e up_cnx_state,
@@ -514,6 +842,92 @@
     return OGS_OK;
 }
 
+int smf_sbi_cleanup_session(
+    smf_sess_t              *sess,
+    ogs_sbi_stream_t        *stream,
+    int                      state,
+    smf_sbi_cleanup_mode_t   mode)
+{
+    smf_ue_t *smf_ue = NULL;
+    int r = OGS_ERROR;
+
+    ogs_assert(mode);
+
+    ogs_assert(sess);
+    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+    ogs_assert(smf_ue);
+
+    ogs_assert(state);
+
+    switch (mode) {
+    case SMF_SBI_CLEANUP_MODE_POLICY_FIRST:
+        if (PCF_SM_POLICY_ASSOCIATED(sess)) {
+            r = smf_sbi_discover_and_send(
+                OGS_SBI_SERVICE_TYPE_NPCF_SMPOLICYCONTROL,
+                NULL,
+                smf_npcf_smpolicycontrol_build_delete,
+                sess, stream, state, NULL);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+        } else if (UDM_SDM_SUBSCRIBED(sess)) {
+            ogs_error("%s:%d No PolicyAssociationId. Forcibly remove SESSION",
+                    smf_ue->supi, sess->psi);
+            r = smf_sbi_discover_and_send(
+                OGS_SBI_SERVICE_TYPE_NUDM_SDM,
+                NULL,
+                smf_nudm_sdm_build_subscription_delete,
+                sess, stream, state, NULL);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+        } else {
+            ogs_error("%s:%d No UDM Subscription. Forcibly remove SESSION",
+                    smf_ue->supi, sess->psi);
+            r = smf_sbi_discover_and_send(
+                OGS_SBI_SERVICE_TYPE_NUDM_UECM,
+                NULL,
+                smf_nudm_uecm_build_deregistration,
+                sess, stream, state, NULL);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+        }
+        break;
+
+    case SMF_SBI_CLEANUP_MODE_SUBSCRIPTION_FIRST:
+        if (UDM_SDM_SUBSCRIBED(sess)) {
+            r = smf_sbi_discover_and_send(
+                OGS_SBI_SERVICE_TYPE_NUDM_SDM,
+                NULL,
+                smf_nudm_sdm_build_subscription_delete,
+                sess, stream, state, NULL);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+        } else {
+            ogs_error("%s:%d No UDM Subscription. Forcibly remove SESSION",
+                    smf_ue->supi, sess->psi);
+            r = smf_sbi_discover_and_send(
+                OGS_SBI_SERVICE_TYPE_NUDM_UECM,
+                NULL,
+                smf_nudm_uecm_build_deregistration,
+                sess, stream, state, NULL);
+            ogs_expect(r == OGS_OK);
+            ogs_assert(r != OGS_ERROR);
+        }
+        break;
+
+    case SMF_SBI_CLEANUP_MODE_CONTEXT_ONLY:
+        r = smf_sbi_discover_and_send(
+            OGS_SBI_SERVICE_TYPE_NUDM_UECM,
+            NULL,
+            smf_nudm_uecm_build_deregistration,
+            sess, stream, state, NULL);
+        ogs_expect(r == OGS_OK);
+        ogs_assert(r != OGS_ERROR);
+        break;
+    }
+
+    return r;
+}
+
 bool smf_sbi_send_sm_context_status_notify(smf_sess_t *sess)
 {
     bool rc;
@@ -530,6 +944,217 @@
         return false;
     }
 
+    rc = ogs_sbi_send_request_to_client(
+            client, client_notify_cb, request, NULL);
+    ogs_expect(rc == true);
+
+    ogs_sbi_request_free(request);
+
+    return rc;
+}
+
+void smf_sbi_send_pdu_session_create_error(
+        ogs_sbi_stream_t *stream,
+        int status, ogs_sbi_app_errno_e err, int n1SmCause,
+        const char *title, const char *detail,
+        ogs_pkbuf_t *n1SmBufToUe)
+{
+    ogs_sbi_message_t sendmsg;
+    ogs_sbi_response_t *response = NULL;
+
+    OpenAPI_pdu_session_create_error_t PduSessionCreateError;
+    OpenAPI_problem_details_t problem;
+    OpenAPI_ref_to_binary_data_t n1SmMsgToUe;
+
+    ogs_assert(stream);
+
+    memset(&sendmsg, 0, sizeof(sendmsg));
+    memset(&problem, 0, sizeof(problem));
+    memset(&PduSessionCreateError, 0, sizeof(PduSessionCreateError));
+
+    if (status) {
+        problem.is_status = true;
+        problem.status = status;
+    }
+    problem.title = (char*)title;
+    problem.detail = (char*)detail;
+    if (err > OGS_SBI_APP_ERRNO_NULL && err < OGS_SBI_MAX_NUM_OF_APP_ERRNO)
+        problem.cause = (char*)ogs_sbi_app_strerror(err);
+
+    sendmsg.PduSessionCreateError = &PduSessionCreateError;
+
+    memset(&PduSessionCreateError, 0, sizeof(PduSessionCreateError));
+    PduSessionCreateError.error = &problem;
+
+    if (n1SmCause)
+        PduSessionCreateError.n1sm_cause = ogs_msprintf("%02x", n1SmCause);
+
+    if (n1SmBufToUe) {
+        PduSessionCreateError.n1_sm_info_to_ue = &n1SmMsgToUe;
+        n1SmMsgToUe.content_id = (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
+        sendmsg.part0.content_id = (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
+        sendmsg.part0.content_type = (char *)OGS_SBI_CONTENT_5GNAS_TYPE;
+        sendmsg.part0.pkbuf = n1SmBufToUe;
+        sendmsg.num_of_part = 1;
+    }
+
+    response = ogs_sbi_build_response(&sendmsg, problem.status);
+    ogs_assert(response);
+    ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+
+    smf_metrics_inst_by_cause_add(problem.status,
+            SMF_METR_CTR_SM_PDUSESSIONCREATIONFAIL, 1);
+
+    if (PduSessionCreateError.n1sm_cause)
+        ogs_free(PduSessionCreateError.n1sm_cause);
+    if (n1SmBufToUe)
+        ogs_pkbuf_free(n1SmBufToUe);
+}
+
+void smf_sbi_send_hsmf_update_error(
+        ogs_sbi_stream_t *stream,
+        int status, ogs_sbi_app_errno_e err, int n1SmCause,
+        const char *title, const char *detail,
+        ogs_pkbuf_t *n1SmBufToUe)
+{
+    ogs_sbi_message_t sendmsg;
+    ogs_sbi_response_t *response = NULL;
+
+    OpenAPI_hsmf_update_error_t HsmfUpdateError;
+    OpenAPI_problem_details_t problem;
+    OpenAPI_ref_to_binary_data_t n1SmMsgToUe;
+
+    ogs_assert(stream);
+
+    memset(&sendmsg, 0, sizeof(sendmsg));
+    memset(&problem, 0, sizeof(problem));
+    memset(&HsmfUpdateError, 0, sizeof(HsmfUpdateError));
+
+    if (status) {
+        problem.is_status = true;
+        problem.status = status;
+    }
+    problem.title = (char*)title;
+    problem.detail = (char*)detail;
+    if (err > OGS_SBI_APP_ERRNO_NULL && err < OGS_SBI_MAX_NUM_OF_APP_ERRNO)
+        problem.cause = (char*)ogs_sbi_app_strerror(err);
+
+    sendmsg.HsmfUpdateError = &HsmfUpdateError;
+
+    memset(&HsmfUpdateError, 0, sizeof(HsmfUpdateError));
+    HsmfUpdateError.error = &problem;
+
+    if (n1SmCause)
+        HsmfUpdateError.n1sm_cause = ogs_msprintf("%02x", n1SmCause);
+
+    if (n1SmBufToUe) {
+        HsmfUpdateError.n1_sm_info_to_ue = &n1SmMsgToUe;
+        n1SmMsgToUe.content_id = (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
+        sendmsg.part0.content_id = (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
+        sendmsg.part0.content_type = (char *)OGS_SBI_CONTENT_5GNAS_TYPE;
+        sendmsg.part0.pkbuf = n1SmBufToUe;
+        sendmsg.num_of_part = 1;
+    }
+
+    response = ogs_sbi_build_response(&sendmsg, problem.status);
+    ogs_assert(response);
+    ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+
+    if (HsmfUpdateError.n1sm_cause)
+        ogs_free(HsmfUpdateError.n1sm_cause);
+    if (n1SmBufToUe)
+        ogs_pkbuf_free(n1SmBufToUe);
+}
+
+void smf_sbi_send_vsmf_update_error(
+        ogs_sbi_stream_t *stream,
+        int status, ogs_sbi_app_errno_e err, int n1SmCause,
+        const char *title, const char *detail,
+        ogs_pkbuf_t *n1SmBufFromUe)
+{
+    ogs_sbi_message_t sendmsg;
+    ogs_sbi_response_t *response = NULL;
+
+    OpenAPI_vsmf_update_error_t VsmfUpdateError;
+    OpenAPI_ext_problem_details_t problem;
+    OpenAPI_ref_to_binary_data_t n1SmMsgFromUe;
+
+    ogs_assert(stream);
+
+    memset(&sendmsg, 0, sizeof(sendmsg));
+    memset(&problem, 0, sizeof(problem));
+    memset(&VsmfUpdateError, 0, sizeof(VsmfUpdateError));
+
+    if (status) {
+        problem.is_status = true;
+        problem.status = status;
+    }
+    problem.title = (char*)title;
+    problem.detail = (char*)detail;
+    if (err > OGS_SBI_APP_ERRNO_NULL && err < OGS_SBI_MAX_NUM_OF_APP_ERRNO)
+        problem.cause = (char*)ogs_sbi_app_strerror(err);
+
+    sendmsg.VsmfUpdateError = &VsmfUpdateError;
+
+    memset(&VsmfUpdateError, 0, sizeof(VsmfUpdateError));
+    VsmfUpdateError.error = &problem;
+
+    if (n1SmCause)
+        VsmfUpdateError.n1sm_cause = ogs_msprintf("%02x", n1SmCause);
+
+    if (n1SmBufFromUe) {
+        VsmfUpdateError.n1_sm_info_from_ue = &n1SmMsgFromUe;
+        n1SmMsgFromUe.content_id = (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
+        sendmsg.part0.content_id = (char *)OGS_SBI_CONTENT_5GNAS_SM_ID;
+        sendmsg.part0.content_type = (char *)OGS_SBI_CONTENT_5GNAS_TYPE;
+        sendmsg.part0.pkbuf = n1SmBufFromUe;
+        sendmsg.num_of_part = 1;
+    }
+
+    response = ogs_sbi_build_response(&sendmsg, problem.status);
+    ogs_assert(response);
+    ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+
+    if (VsmfUpdateError.n1sm_cause)
+        ogs_free(VsmfUpdateError.n1sm_cause);
+    if (n1SmBufFromUe)
+        ogs_pkbuf_free(n1SmBufFromUe);
+}
+
+void smf_sbi_send_released_data(
+        smf_sess_t *sess, ogs_sbi_stream_t *stream)
+{
+    OpenAPI_released_data_t ReleasedData;
+
+    ogs_sbi_message_t sendmsg;
+    ogs_sbi_response_t *response = NULL;
+
+    memset(&ReleasedData, 0, sizeof(ReleasedData));
+    memset(&sendmsg, 0, sizeof(sendmsg));
+
+    sendmsg.ReleasedData = &ReleasedData;
+
+    response = ogs_sbi_build_response(&sendmsg, OGS_SBI_HTTP_STATUS_OK);
+    ogs_assert(response);
+    ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+}
+
+bool smf_sbi_send_status_notify(smf_sess_t *sess)
+{
+    bool rc;
+    ogs_sbi_request_t *request = NULL;
+    ogs_sbi_client_t *client = NULL;
+
+    ogs_assert(sess);
+    client = sess->v_smf.client;
+    ogs_assert(client);
+
+    request = smf_nsmf_pdusession_build_status(sess, NULL);
+    if (!request) {
+        ogs_error("smf_nsmf_pdusession_build_status() failed");
+        return false;
+    }
+
     rc = ogs_sbi_send_request_to_client(
             client, client_notify_cb, request, NULL);
     ogs_expect(rc == true);

open5gs_2.7.6.tar.xz/src/smf/sbi-path.h -> open5gs_2.7.7.tar.xz/src/smf/sbi-path.h Changed

@@ -22,6 +22,7 @@
 
 #include "nudm-build.h"
 #include "namf-build.h"
+#include "nsmf-build.h"
 #include "gsm-build.h"
 #include "nnrf-build.h"
 #include "npcf-build.h"
@@ -35,17 +36,107 @@
 
 bool smf_sbi_send_request(
         ogs_sbi_nf_instance_t *nf_instance, ogs_sbi_xact_t *xact);
+
+/*
+ * PFCP delete triggers are defined in lib/pfcp/xact.h (values 1–7).
+ * To avoid overlap with OGS_PFCP_DELETE_TRIGGER_*, SMF states use:
+ *   - UPDATE_STATE_BASE at 0x10–0x14
+ *   - UECM_STATE_BASE   at 0x20–0x23
+ * HR flag is bit 7 (0x80).
+ */
+
+/* Common HR flag (bit 7) */
+#define SMF_STATE_HR             (1U << 7)          /* 0x80 */
+
+/* Base offset for SMF_CREATE states */
+#define SMF_CREATE_STATE_BASE       0x10U           /* CREATE at 0x10 */
+
+#define SMF_CREATE_STATE_NONE                       \
+    (SMF_CREATE_STATE_BASE + 0x00U)  /* 0x00 */
+
+/* Base offset for SMF_UPDATE states */
+#define SMF_UPDATE_STATE_BASE       0x20U           /* UPDATE at 0x20–0x24 */
+
+/* SMF_UPDATE base states */
+#define SMF_UPDATE_STATE_NONE                       \
+    (SMF_UPDATE_STATE_BASE + 0x00U)  /* 0x00 */
+#define SMF_UPDATE_STATE_ACTIVATING                 \
+    (SMF_UPDATE_STATE_BASE + 0x01U)  /* 0x01 */
+#define SMF_UPDATE_STATE_ACTIVATED_FROM_ACTIVATING  \
+    (SMF_UPDATE_STATE_BASE + 0x02U)  /* 0x02 */
+#define SMF_UPDATE_STATE_ACTIVATED_FROM_NON_ACTIVATING  \
+    (SMF_UPDATE_STATE_BASE + 0x03U)  /* 0x03 */
+#define SMF_UPDATE_STATE_ACTIVATED_FROM_XN_HANDOVER \
+    (SMF_UPDATE_STATE_BASE + 0x04U)  /* 0x04 */
+#define SMF_UPDATE_STATE_ACTIVATED_FROM_N2_HANDOVER \
+    (SMF_UPDATE_STATE_BASE + 0x05U)  /* 0x05 */
+#define SMF_UPDATE_STATE_DEACTIVATED                \
+    (SMF_UPDATE_STATE_BASE + 0x06U)  /* 0x06 */
+#define SMF_UPDATE_STATE_UE_REQ_MOD                 \
+    (SMF_UPDATE_STATE_BASE + 0x07U)  /* 0x07 */
+
+/* Base offset for SMF_REMOVE states */
+#define SMF_REMOVE_STATE_BASE       0x30U           /* REMOVE at 0x30 */
+
+#define SMF_REMOVE_STATE_NONE                       \
+    (SMF_REMOVE_STATE_BASE + 0x00U)  /* 0x00 */
+
+/* Base offset for SMF_UECM states */
+#define SMF_UECM_STATE_BASE         0x40U           /* UECM at 0x40–0x43 */
+
+/* SMF_UECM base states */
+#define SMF_UECM_STATE_NONE                 \
+    (SMF_UECM_STATE_BASE + 0x00U)  /* 0x20 */
+#define SMF_UECM_STATE_REGISTERED           \
+    (SMF_UECM_STATE_BASE + 0x01U)  /* 0x21 */
+#define SMF_UECM_STATE_DEREG_BY_AMF         \
+    (SMF_UECM_STATE_BASE + 0x02U)  /* 0x22 */
+#define SMF_UECM_STATE_DEREG_BY_N1N2        \
+    (SMF_UECM_STATE_BASE + 0x03U)  /* 0x23 */
+
+/* HR variants for SMF_UECM */
+#define SMF_UECM_STATE_REGISTERED_HR                \
+    (SMF_UECM_STATE_REGISTERED | SMF_STATE_HR)      /* 0xC1 */
+#define SMF_UECM_STATE_DEREG_BY_AMF_HR              \
+    (SMF_UECM_STATE_DEREG_BY_AMF | SMF_STATE_HR)    /* 0xC2 */
+#define SMF_UECM_STATE_DEREG_BY_N1N2_HR             \
+    (SMF_UECM_STATE_DEREG_BY_N1N2 | SMF_STATE_HR)   /* 0xC3 */
+
 int smf_sbi_discover_and_send(
         ogs_sbi_service_type_e service_type,
         ogs_sbi_discovery_option_t *discovery_option,
         ogs_sbi_request_t *(*build)(smf_sess_t *sess, void *data),
         smf_sess_t *sess, ogs_sbi_stream_t *stream, int state, void *data);
 
+/**
+ * Return true if the PDU session anchor SMF is in the HPLMN
+ * (Home-Routed Roaming, HR)
+ */
+static inline bool smf_uecm_anchor_in_hplmn(int state)
+{
+    return !!(state & SMF_STATE_HR);
+}
+
+/**
+ * Return true if the PDU session anchor SMF is in the VPLMN
+ * (Non-Roaming or Local Break-Out Roaming, LBO)
+ */
+static inline bool smf_uecm_anchor_in_vplmn(int state)
+{
+    return !(state & SMF_STATE_HR);
+}
+
+ogs_sbi_xact_t *smf_namf_comm_create_n1_n2_message_xact(
+        smf_sess_t *sess, ogs_sbi_stream_t *stream,
+        smf_n1_n2_message_transfer_param_t *param);
 void smf_namf_comm_send_n1_n2_message_transfer(
-        smf_sess_t *sess, smf_n1_n2_message_transfer_param_t *param);
+        smf_sess_t *sess, ogs_sbi_stream_t *stream,
+        smf_n1_n2_message_transfer_param_t *param);
 void smf_namf_comm_send_n1_n2_pdu_establishment_reject(
-        smf_sess_t *sess);
+        smf_sess_t *sess, ogs_sbi_stream_t *stream);
 
+void smf_sbi_send_sm_context_created_data(
+        smf_sess_t *sess, ogs_sbi_stream_t *stream);
 void smf_sbi_send_sm_context_create_error(
         ogs_sbi_stream_t *stream,
         int status, ogs_sbi_app_errno_e err,
@@ -101,8 +192,54 @@
         OpenAPI_n2_sm_info_type_e n2_sm_info_type,
         OpenAPI_up_cnx_state_e up_cnx_state);
 
+/* Cleanup modes for session resources via SBI */
+typedef enum {
+    SMF_SBI_CLEANUP_MODE_POLICY_FIRST = 1,   /* Policy→Subscr→Context */
+    SMF_SBI_CLEANUP_MODE_SUBSCRIPTION_FIRST, /* Subscr→Context */
+    SMF_SBI_CLEANUP_MODE_CONTEXT_ONLY        /* Context only */
+} smf_sbi_cleanup_mode_t;
+
+/**
+ * Send SBI request to clean up session resources.
+ *
+ * @param sess   Session object pointer.
+ * @param stream SBI stream object pointer.
+ * @param state  State code for the cleanup action.
+ * @param mode   Cleanup mode to select the workflow.
+ * @return OGS_OK on success, else OGS_ERROR.
+ */
+int smf_sbi_cleanup_session(
+    smf_sess_t              *sess,
+    ogs_sbi_stream_t        *stream,
+    int                      state,
+    smf_sbi_cleanup_mode_t   mode);
+
 bool smf_sbi_send_sm_context_status_notify(smf_sess_t *sess);
 
+void smf_sbi_send_pdu_session_created_data(
+        smf_sess_t *sess, ogs_sbi_stream_t *stream);
+void smf_sbi_send_pdu_session_create_error(
+        ogs_sbi_stream_t *stream,
+        int status, ogs_sbi_app_errno_e err, int n1SmCause,
+        const char *title, const char *detail,
+        ogs_pkbuf_t *n1SmBufToUe);
+
+void smf_sbi_send_hsmf_update_error(
+        ogs_sbi_stream_t *stream,
+        int status, ogs_sbi_app_errno_e err, int n1SmCause,
+        const char *title, const char *detail,
+        ogs_pkbuf_t *n1SmBufToUe);
+void smf_sbi_send_vsmf_update_error(
+        ogs_sbi_stream_t *stream,
+        int status, ogs_sbi_app_errno_e err, int n1SmCause,
+        const char *title, const char *detail,
+        ogs_pkbuf_t *n1SmBufFromUe);
+
+void smf_sbi_send_released_data(
+        smf_sess_t *sess, ogs_sbi_stream_t *stream);
+
+bool smf_sbi_send_status_notify(smf_sess_t *sess);
+
 #ifdef __cplusplus
 }
 #endif

open5gs_2.7.6.tar.xz/src/smf/smf-sm.c -> open5gs_2.7.7.tar.xz/src/smf/smf-sm.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2026 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -30,6 +30,8 @@
 #include "namf-handler.h"
 #include "nsmf-handler.h"
 #include "npcf-handler.h"
+#include "nsmf-handler.h"
+#include "binding.h"
 
 void smf_state_initial(ogs_fsm_t *s, smf_event_t *e)
 {
@@ -73,6 +75,8 @@
     ogs_sbi_stream_t *stream = NULL;
     ogs_pool_id_t stream_id = OGS_INVALID_POOL_ID;
     ogs_sbi_request_t *sbi_request = NULL;
+    int state = 0;
+    bool unknown_res_status = false;
 
     ogs_sbi_nf_instance_t *nf_instance = NULL;
     ogs_sbi_subscription_data_t *subscription_data = NULL;
@@ -123,16 +127,16 @@
         }
         e->gtp_xact_id = gtp_xact ? gtp_xact->id : OGS_INVALID_POOL_ID;
 
-        if (gtp2_message.h.teid_presence && gtp2_message.h.teid != 0) {
+        if (gtp2_message.h.teid_presence && gtp2_message.h.teid != 0)
             sess = smf_sess_find_by_teid(gtp2_message.h.teid);
-        } else if (gtp_xact->local_teid) { /* rx no TEID or TEID=0 */
+
+        if (!sess && gtp_xact->local_teid) /* rx no TEID or TEID=0 */
             /* 3GPP TS 29.274 5.5.2: we receive TEID=0 under some
              * conditions, such as cause "Session context not found". In those
              * cases, we still want to identify the local session which
              * originated the message, so try harder by using the TEID we
              * locally stored in xact when sending the original request: */
             sess = smf_sess_find_by_teid(gtp_xact->local_teid);
-        }
 
         switch(gtp2_message.h.type) {
         case OGS_GTP2_ECHO_REQUEST_TYPE:
@@ -206,6 +210,12 @@
             break;
         case OGS_GTP2_CREATE_BEARER_RESPONSE_TYPE:
             if (!gtp2_message.h.teid_presence) ogs_error("No TEID");
+            if (!sess) {
+                ogs_error("No Session");
+                rv = ogs_gtp_xact_commit(gtp_xact);
+                ogs_expect(rv == OGS_OK);
+                break;
+            }
             smf_s5c_handle_create_bearer_response(
                 sess, gtp_xact, &gtp2_message.create_bearer_response);
             break;
@@ -550,7 +560,7 @@
                         break;
 
                     DEFAULT
-                        sess = smf_sess_add_by_sbi_message(&sbi_message);
+                        sess = smf_sess_add_by_sm_context(&sbi_message);
                         if (!sess) {
                             ogs_error("smf_sess_add_by_sbi_message() failed");
                             smf_sbi_send_sm_context_create_error(stream,
@@ -587,6 +597,124 @@
                 }
                 break;
 
+            CASE(OGS_SBI_RESOURCE_NAME_PDU_SESSIONS)
+                SWITCH(sbi_message.h.method)
+                CASE(OGS_SBI_HTTP_METHOD_POST)
+                    SWITCH(sbi_message.h.resource.component2)
+                    CASE(OGS_SBI_RESOURCE_NAME_MODIFY)
+                    CASE(OGS_SBI_RESOURCE_NAME_RELEASE)
+                        if (!sbi_message.h.resource.component1) {
+                            ogs_error("No pduSessionRef %s",
+                                    sbi_message.h.resource.component1);
+                            smf_sbi_send_hsmf_update_error(stream,
+                                    OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                                    OGS_SBI_APP_ERRNO_NULL,
+                                    OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                                    "No pduSessionRef",
+                                    sbi_message.h.resource.component1, NULL);
+                            break;
+                        }
+
+                        sess = smf_sess_find_by_pdu_session_ref(
+                                sbi_message.h.resource.component1);
+
+                        if (!sess) {
+                            ogs_warn("Not found %s", sbi_message.h.uri);
+                            smf_sbi_send_hsmf_update_error(stream,
+                                    OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                                    OGS_SBI_APP_ERRNO_NULL,
+                                    OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                                    "Not found", sbi_message.h.uri, NULL);
+                        }
+                        break;
+
+                    DEFAULT
+                        sess = smf_sess_add_by_pdu_session(&sbi_message);
+                        if (!sess) {
+                            ogs_error("smf_sess_add_by_sbi_message() failed");
+                            smf_sbi_send_pdu_session_create_error(stream,
+                                OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                                OGS_SBI_APP_ERRNO_NULL,
+                                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                                "smf_sess_add_by_sbi_message() failed",
+                                NULL, NULL);
+                            break;
+                        }
+
+                        smf_metrics_inst_by_slice_add(NULL, NULL,
+                                SMF_METR_CTR_SM_PDUSESSIONCREATIONREQ, 1);
+                    END
+                    break;
+
+                DEFAULT
+                    ogs_error("Invalid HTTP method %s", sbi_message.h.method);
+                    ogs_assert(true ==
+                        ogs_sbi_server_send_error(stream,
+                            OGS_SBI_HTTP_STATUS_BAD_REQUEST, &sbi_message,
+                            "Invalid HTTP method", sbi_message.h.method,
+                            NULL));
+                END
+
+                if (sess) {
+                    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+                    ogs_assert(smf_ue);
+                    ogs_assert(OGS_FSM_STATE(&sess->sm));
+
+                    e->sess_id = sess->id;
+                    e->h.sbi.message = &sbi_message;
+                    ogs_fsm_dispatch(&sess->sm, e);
+                }
+                break;
+
+            CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+                SWITCH(sbi_message.h.method)
+                CASE(OGS_SBI_HTTP_METHOD_POST)
+                    if (!sbi_message.h.resource.component1) {
+                        ogs_error("No smContextRef %s",
+                                sbi_message.h.resource.component1);
+                        smf_sbi_send_vsmf_update_error(stream,
+                                OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                                OGS_SBI_APP_ERRNO_NULL,
+                                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                                "No smContextRef",
+                                sbi_message.h.resource.component1, NULL);
+                        break;
+                    }
+
+                    sess = smf_sess_find_by_sm_context_ref(
+                            sbi_message.h.resource.component1);
+
+                    if (!sess) {
+                        ogs_warn("Not found %s", sbi_message.h.uri);
+                        smf_sbi_send_vsmf_update_error(stream,
+                                OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                                OGS_SBI_APP_ERRNO_NULL,
+                                OGS_5GSM_CAUSE_INVALID_MANDATORY_INFORMATION,
+                                "Not found", sbi_message.h.uri, NULL);
+                    }
+                    break;
+
+                DEFAULT
+                    ogs_error("Invalid HTTP method %s", sbi_message.h.method);
+                    ogs_assert(true ==
+                        ogs_sbi_server_send_error(stream,
+                            OGS_SBI_HTTP_STATUS_BAD_REQUEST, &sbi_message,
+                            "Invalid HTTP method", sbi_message.h.method,
+                            NULL));
+                    break;
+                END
+
+                if (sess) {
+                    smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
+                    ogs_assert(smf_ue);
+                    ogs_assert(OGS_FSM_STATE(&sess->sm));
+
+                    e->sess_id = sess->id;
+                    e->h.sbi.message = &sbi_message;
+                    ogs_fsm_dispatch(&sess->sm, e);
+                }
+                break;
+
             DEFAULT
                 ogs_error("Invalid resource name %s",
                         sbi_message.h.resource.component0);
@@ -631,10 +759,13 @@
 
                 SWITCH(sbi_message.h.resource.component2)
                 CASE(OGS_SBI_RESOURCE_NAME_UPDATE)
+#define ENABLE_PCF_INITIATED_SESSION_RELEASE 0
+#if !ENABLE_PCF_INITIATED_SESSION_RELEASE
                     smf_npcf_smpolicycontrol_handle_update_notify(
                             sess, stream, &sbi_message);
                     break;
                 CASE(OGS_SBI_RESOURCE_NAME_TERMINATE)
+#endif
                     smf_npcf_smpolicycontrol_handle_terminate_notify(
                             sess, stream, &sbi_message);
                     break;
@@ -772,14 +903,17 @@
 
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
                     if (sbi_message.res_status ==
-                            OGS_SBI_HTTP_STATUS_NO_CONTENT) {
-                        ogs_sbi_subscription_data_remove(subscription_data);
-                    } else {
+                            OGS_SBI_HTTP_STATUS_NO_CONTENT)
+                        ogs_info("%s Subscription deleted",
+                                subscription_data->id ?
+                                    subscription_data->id : "Unknown");
+                    else
                         ogs_error("%s HTTP response error %d",
                                 subscription_data->id ?
                                     subscription_data->id : "Unknown",
                                 sbi_message.res_status);
-                    }
+
+                    ogs_sbi_subscription_data_remove(subscription_data);
                     break;
 
                 DEFAULT
@@ -836,6 +970,7 @@
         CASE(OGS_SBI_SERVICE_NAME_NUDM_SDM)
         CASE(OGS_SBI_SERVICE_NAME_NPCF_SMPOLICYCONTROL)
         CASE(OGS_SBI_SERVICE_NAME_NAMF_COMM)
+        CASE(OGS_SBI_SERVICE_NAME_NSMF_PDUSESSION)
             sbi_xact_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
             ogs_assert(sbi_xact_id >= OGS_MIN_POOL_ID &&
                     sbi_xact_id <= OGS_MAX_POOL_ID);
@@ -877,9 +1012,6 @@
             break;
 
         CASE(OGS_SBI_SERVICE_NAME_NUDM_UECM)
-            int state = 0;
-            bool unknown_res_status = false;
-
             sbi_xact_id = OGS_POINTER_TO_UINT(e->h.sbi.data);
             ogs_assert(sbi_xact_id >= OGS_MIN_POOL_ID &&
                     sbi_xact_id <= OGS_MAX_POOL_ID);
@@ -914,13 +1046,16 @@
             smf_ue = smf_ue_find_by_id(sess->smf_ue_id);
             ogs_assert(smf_ue);
 
-            if (state == SMF_UECM_STATE_REGISTERED) {
+            if (state == SMF_UECM_STATE_REGISTERED ||
+                state == SMF_UECM_STATE_REGISTERED_HR) {
                 /* SMF Registration */
                 if (sbi_message.res_status != OGS_SBI_HTTP_STATUS_OK &&
                     sbi_message.res_status != OGS_SBI_HTTP_STATUS_CREATED)
                     unknown_res_status = true;
-            } else if (state == SMF_UECM_STATE_DEREGISTERED_BY_AMF ||
-                        state == SMF_UECM_STATE_DEREGISTERED_BY_N1_N2_RELEASE) {
+            } else if (state == SMF_UECM_STATE_DEREG_BY_AMF ||
+                        state == SMF_UECM_STATE_DEREG_BY_AMF_HR ||
+                        state == SMF_UECM_STATE_DEREG_BY_N1N2 ||
+                        state == SMF_UECM_STATE_DEREG_BY_N1N2_HR) {
                 /* SMF Deregistration */
                 if (sbi_message.res_status != OGS_SBI_HTTP_STATUS_NO_CONTENT)
                     unknown_res_status = true;
@@ -946,23 +1081,176 @@
             }
 
             if (state == SMF_UECM_STATE_REGISTERED) {
-                /* SMF Registration */
-                ogs_assert(stream);
-                ogs_assert(true == ogs_sbi_send_http_status_no_content(stream));
-            } else if (state == SMF_UECM_STATE_DEREGISTERED_BY_AMF) {
-                /* SMF Deregistration */
                 if (stream)
                     ogs_assert(true ==
                             ogs_sbi_send_http_status_no_content(stream));
                 else
                     ogs_error("Stream has already been removed");
 
-                SMF_SESS_CLEAR(sess);
+                smf_metrics_inst_by_slice_add(
+                        &sess->serving_plmn_id, &sess->s_nssai,
+                        SMF_METR_CTR_SM_PDUSESSIONCREATIONSUCC, 1);
+            } else if (state == SMF_UECM_STATE_REGISTERED_HR) {
+                if (stream)
+                    smf_sbi_send_pdu_session_created_data(sess, stream);
+                else
+                    ogs_error("Stream has already been removed");
+
+                smf_metrics_inst_by_slice_add(
+                        &sess->serving_plmn_id, &sess->s_nssai,
+                        SMF_METR_CTR_SM_PDUSESSIONCREATIONSUCC, 1);
+
+/*
+ * Non-roaming/LBO: start network-triggered PDU Session Modification at step 11
+ * after N1N2 transfer (Establishment Accept) and N2/N4 context sync, ensuring
+ * the session is active on UE, RAN, and SMF before applying QoS updates.
+ *
+ * Home-Routed Roaming: trigger PDU Session Modification at step 13
+ * immediately after H-SMF’s CreateSMContext response and H-UPF N4 setup
+ * to apply QoS updates without waiting for V-SMF or RAN setup.
+ */
+                smf_qos_flow_binding(sess);
 
-            } else if (state == SMF_UECM_STATE_DEREGISTERED_BY_N1_N2_RELEASE) {
+            } else if (state == SMF_UECM_STATE_DEREG_BY_AMF) {
+/*
+ * Handle deregistration states SMF_UECM_STATE_DEREG_BY_AMF and
+ * SMF_UECM_STATE_DEREG_BY_N1N2: context has been removed by AMF or
+ * by NAS (N1/N2) procedures, respectively.
+ *
+ * In 3GPP TS 23.501, two related flows must be coordinated:
+ *  - PDU Session Release: Figure 4.3.4.2-1, steps 11 to 15
+ *  - PDU Session Establishment: Figure 4.3.2.2.1-1, steps 16a to 16c
+ *
+ * Normally, step 11 (SMContextStatusNotify) informs the AMF that the SM
+ * Context has been released, and SMF would then delete the session state.
+ * However, if the AMF triggers a release while a new establishment is still
+ * underway (the PFCP Modification and NAS Registration in steps 16a–16c),
+ * deleting the context too early causes those procedures to fail.
+ *
+ * To avoid this race, we defer step 11 until after steps 12–15 complete:
+ * subscription termination, policy cleanup, and UDM deregistration. This
+ * delay allows both the old (released) context and the new (establishing)
+ * context to coexist in SMF, so that PFCP and NAS messages can still find
+ * the correct context. Only once all cleanup is done do we invoke the
+ * SMContextStatusNotify and remove the session state.
+ *
+ * This ensures:
+ *  - PFCP Modification (step 16a) still locates its context
+ *  - NAS Registration (steps 16b–16c) can finish successfully
+ *  - The final cleanup (deferred step 11) does not interrupt any in-flight
+ *    procedures
+ *
+ * If you attempt to address this:
+ *
+ * Legacy flow:
+ *   sess = smf_sess_find_by_psi(...);
+ *   if (sess) { smf_sess_remove(sess); }
+ *   sess = smf_sess_add_by_psi(...);
+ *
+ *  - Do not use smf_sess_find_by_psi() to remove old contexts here.
+ *  - Call only smf_sess_add_by_psi() to add the new session.
+ *  - Since PSI duplicates may occur without an explicit release, you must
+ *    design a separate cleanup mechanism (e.g., periodic purge, release
+ *    tracking, or context deduplication) that safely detects and removes
+ *    stale SM Context entries outside of this path.
+ */
                 /* SMF Deregistration */
+                if (stream)
+                    ogs_assert(true ==
+                            ogs_sbi_send_http_status_no_content(stream));
+                else
+                    ogs_error("Stream has already been removed");
+
+                SMF_SESS_CLEAR(sess);
+            } else if (state == SMF_UECM_STATE_DEREG_BY_N1N2) {
                 ogs_assert(true == smf_sbi_send_sm_context_status_notify(sess));
                 SMF_SESS_CLEAR(sess);
+            } else if (state == SMF_UECM_STATE_DEREG_BY_AMF_HR) {
+    /*
+     * Network-requested PDU Session Release(DUPLICATED)
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT,
+     * 3.  V: OpenAPI_request_indication_NW_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_NW_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_AMF_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 11. H*: SMF_SESS_CLEAR(sess)
+     * 12. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_UPDATE_SM_CONTEXT
+     * 13. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 14. V: ogs_sbi_send_http_status_no_content
+     * 15. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     *
+     * Network-requested PDU Session Release
+     *
+     * 1.  V: smf_nsmf_handle_release_sm_context
+     * 2.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 3.  V: OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 4.  V: smf_nsmf_pdusession_build_release_data
+     * 5.  H: smf_nsmf_handle_release_data_in_hsmf
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 7.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 8.  H: ogs_sbi_send_http_status_no_content
+     * 9.  H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_AMF_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 11. H*: SMF_SESS_CLEAR(sess)
+     * 12. V: smf_nsmf_handle_release_data_in_hsmf
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_AMF_RELEASE_SM_CONTEXT
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V: ogs_sbi_send_http_status_no_content
+     * 16. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                SMF_SESS_CLEAR(sess);
+            } else if (state == SMF_UECM_STATE_DEREG_BY_N1N2_HR) {
+    /*
+     * UE-requested PDU Session Release
+     *
+     * 1.  V: OGS_PFCP_MODIFY_HOME_ROUTED_ROAMING|OGS_PFCP_MODIFY_UL_ONLY|
+     *        OGS_PFCP_MODIFY_DEACTIVATE
+     * 2.  V: OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 3.  V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 4.  V: smf_nsmf_pdusession_build_hsmf_update_data
+     * 5.  H: smf_nsmf_handle_update_data_in_hsmf
+     * 6.  H: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 6.  H: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 7.  H: ogs_sbi_send_http_status_no_content
+     * 8.  H: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 9.  H: smf_nsmf_pdusession_build_vsmf_update_data
+     * 10. H: OGS_FSM_TRAN(s, smf_gsm_state_wait_5gc_n1_n2_release);
+     * 11. V: smf_nsmf_handle_update_data_in_vsmf
+     * 12. V: OpenAPI_request_indication_UE_REQ_PDU_SES_REL
+     * 13. V: e->h.sbi.state = OGS_PFCP_DELETE_TRIGGER_UE_REQUESTED
+     * 14. V: OGS_FSM_TRAN(s, smf_gsm_state_wait_pfcp_deletion)
+     * 15. V: ngap_build_pdu_session_resource_release_command_transfer+
+     *        gsm_build_pdu_session_release_command
+     * 16  V: OGS_FSM_TRAN(&sess->sm, smf_gsm_state_wait_5gc_n1_n2_release)
+     * 17. V: ogs_sbi_send_http_status_no_content(stream)
+     * 18. V: case OpenAPI_n2_sm_info_type_PDU_RES_REL_RSP:
+     *        case OGS_NAS_5GS_PDU_SESSION_RELEASE_COMPLETE:
+     * 19. V: ogs_sbi_send_http_status_no_content(n1_n2_released_stream)
+     * 20. V: OGS_FSM_TRAN(s, smf_gsm_state_5gc_session_will_deregister);
+     * 21. H: case OGS_EVENT_SBI_CLIENT:
+     * 22. H: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 23. H: smf_sbi_cleanup_session(SMF_UECM_STATE_DEREG_BY_N1N2_HR
+     *                                SMF_SBI_CLEANUP_MODE_POLICY_FIRST);
+     * 24. H*: smf_sbi_send_status_notify+SMF_SESS_CLEAR(sess)
+     * 25. V: case OGS_EVENT_SBI_SERVER:
+     * 26. V: CASE(OGS_SBI_RESOURCE_NAME_VSMF_PDU_SESSIONS)
+     * 27. V: ogs_sbi_send_http_status_no_content+
+     *        smf_sbi_send_sm_context_status_notify
+     * 28. V: OGS_FSM_TRAN(s, smf_gsm_state_session_will_release);
+     */
+                ogs_assert(true == smf_sbi_send_status_notify(sess));
+                SMF_SESS_CLEAR(sess);
             }
 
             break;
@@ -1142,6 +1430,16 @@
         ogs_pkbuf_free(pkbuf);
         break;
 
+    case SMF_EVT_SESSION_RELEASE:
+        sess = smf_sess_find_by_id(e->sess_id);
+        if (!sess) {
+            ogs_error("Session has already been removed");
+            break;
+        }
+
+        ogs_fsm_dispatch(&sess->sm, e);
+        break;
+
     default:
         ogs_error("No handler for event %s", smf_event_get_name(e));
         break;

open5gs_2.7.6.tar.xz/src/smf/smf-sm.h -> open5gs_2.7.7.tar.xz/src/smf/smf-sm.h Changed

open5gs_2.7.6.tar.xz/src/udm/context.c -> open5gs_2.7.7.tar.xz/src/udm/context.c Changed

open5gs_2.7.6.tar.xz/src/udm/context.h -> open5gs_2.7.7.tar.xz/src/udm/context.h Changed

open5gs_2.7.6.tar.xz/src/udm/nudr-build.c -> open5gs_2.7.7.tar.xz/src/udm/nudr-build.c Changed

open5gs_2.7.6.tar.xz/src/udm/nudr-handler.c -> open5gs_2.7.7.tar.xz/src/udm/nudr-handler.c Changed

@@ -622,6 +622,37 @@
 
     ogs_assert(recvmsg);
 
+    if (state == UDM_SBI_UE_PROVISIONED_DATASETS) {
+        OpenAPI_provisioned_data_sets_t *ProvisionedDataSets;
+
+        ProvisionedDataSets = recvmsg->ProvisionedDataSets;
+        if (!ProvisionedDataSets) {
+            ogs_error("%s No ProvisionedDataSets",
+                    udm_ue->supi);
+            ogs_assert(true ==
+                ogs_sbi_server_send_error(
+                    stream, OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                    recvmsg, "No ProvisionedDataSets",
+                    udm_ue->supi, NULL));
+            return false;
+        }
+
+        memset(&sendmsg, 0, sizeof(sendmsg));
+
+        sendmsg.ProvisionedDataSets =
+            OpenAPI_provisioned_data_sets_copy(
+                sendmsg.ProvisionedDataSets,
+                    recvmsg->ProvisionedDataSets);
+
+        response = ogs_sbi_build_response(&sendmsg, recvmsg->res_status);
+        ogs_assert(response);
+        ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+
+        OpenAPI_provisioned_data_sets_free(sendmsg.ProvisionedDataSets);
+
+        return true;
+    }
+
     SWITCH(recvmsg->h.resource.component4)
     CASE(OGS_SBI_RESOURCE_NAME_AM_DATA)
         OpenAPI_access_and_mobility_subscription_data_t

open5gs_2.7.6.tar.xz/src/udm/sbi-path.h -> open5gs_2.7.7.tar.xz/src/udm/sbi-path.h Changed

open5gs_2.7.6.tar.xz/src/udm/udm-sm.c -> open5gs_2.7.7.tar.xz/src/udm/udm-sm.c Changed

@@ -38,6 +38,7 @@
 {
     int rv;
     const char *api_version = NULL;
+    char *supi = NULL;
 
     ogs_sbi_stream_t *stream = NULL;
     ogs_pool_id_t stream_id = OGS_INVALID_POOL_ID;
@@ -153,28 +154,34 @@
                 break;
             }
 
-            if (!message.h.resource.component1) {
-                ogs_error("Invalid resource name %s", message.h.method);
-                ogs_assert(true ==
-                    ogs_sbi_server_send_error(stream,
-                        OGS_SBI_HTTP_STATUS_BAD_REQUEST,
-                        &message, "Invalid resource name", message.h.method,
-                        NULL));
-                break;
-            }
-
-            SWITCH(message.h.resource.component1)
-            CASE(OGS_SBI_RESOURCE_NAME_AUTH_EVENTS)
-                if (message.h.resource.component2) {
-                    udm_ue = udm_ue_find_by_ctx_id(
-                            message.h.resource.component2);
+            if (!message.param.num_of_dataset_names) {
+                if (!message.h.resource.component1) {
+                    ogs_error("Invalid resource name %s", message.h.method);
+                    ogs_assert(true ==
+                        ogs_sbi_server_send_error(stream,
+                            OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                            &message, "Invalid resource name", message.h.method,
+                            NULL));
+                    break;
                 }
-            DEFAULT
-            END
+
+                SWITCH(message.h.resource.component1)
+                CASE(OGS_SBI_RESOURCE_NAME_AUTH_EVENTS)
+                    if (message.h.resource.component2) {
+                        udm_ue = udm_ue_find_by_ctx_id(
+                                message.h.resource.component2);
+                    }
+                DEFAULT
+                END
+            }
 
             if (!udm_ue) {
-                udm_ue = udm_ue_find_by_suci_or_supi(
-                        message.h.resource.component0);
+                supi = ogs_supi_from_supi_or_suci(
+                    message.h.resource.component0);
+                if (supi) {
+                    udm_ue = udm_ue_find_by_supi(supi);
+                }
+                ogs_free(supi);
                 if (!udm_ue) {
                     SWITCH(message.h.method)
                     CASE(OGS_SBI_HTTP_METHOD_POST)
@@ -205,6 +212,16 @@
             CASE(OGS_SBI_RESOURCE_NAME_SMF_REGISTRATIONS)
                 if (message.h.resource.component3) {
                     uint8_t psi = atoi(message.h.resource.component3);
+                    if (psi == OGS_NAS_PDU_SESSION_IDENTITY_UNASSIGNED) {
+                        ogs_error("PDU Session Identitiy unassigned %s",
+                                message.h.resource.component3);
+                        ogs_assert(true ==
+                            ogs_sbi_server_send_error(stream,
+                                OGS_SBI_HTTP_STATUS_BAD_REQUEST,
+                                &message, "PDU Session Identitiy unassigned",
+                                message.h.resource.component3, NULL));
+                        break;
+                    }
 
                     sess = udm_sess_find_by_psi(udm_ue, psi);
                     if (!sess) {
@@ -347,15 +364,17 @@
                     break;
 
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
-                    if (message.res_status ==
-                            OGS_SBI_HTTP_STATUS_NO_CONTENT) {
-                        ogs_sbi_subscription_data_remove(subscription_data);
-                    } else {
+                    if (message.res_status == OGS_SBI_HTTP_STATUS_NO_CONTENT)
+                        ogs_info("%s Subscription deleted",
+                                subscription_data->id ?
+                                    subscription_data->id : "Unknown");
+                    else
                         ogs_error("%s HTTP response error %d",
                                 subscription_data->id ?
                                     subscription_data->id : "Unknown",
                                 message.res_status);
-                    }
+
+                    ogs_sbi_subscription_data_remove(subscription_data);
                     break;
 
                 DEFAULT

open5gs_2.7.6.tar.xz/src/udm/ue-sm.c -> open5gs_2.7.7.tar.xz/src/udm/ue-sm.c Changed

open5gs_2.7.6.tar.xz/src/udr/nudr-handler.c -> open5gs_2.7.7.tar.xz/src/udr/nudr-handler.c Changed

@@ -425,17 +425,61 @@
     int rv, status = 0;
     char *strerror = NULL;
 
+    bool processAmData = false;
+    bool processSmfSel = false;
+    bool processSmData = false;
+    bool returnProvisionedData = false;
+
     ogs_sbi_message_t sendmsg;
     ogs_sbi_response_t *response = NULL;
     ogs_subscription_data_t subscription_data;
     ogs_slice_data_t *slice_data = NULL;
 
+    OpenAPI_access_and_mobility_subscription_data_t
+        AccessAndMobilitySubscriptionData;
+    OpenAPI_list_t *SessionManagementSubscriptionDataList = NULL;
+    OpenAPI_session_management_subscription_data_t
+        *SessionManagementSubscriptionData = NULL;
+    OpenAPI_smf_selection_subscription_data_t SmfSelectionSubscriptionData;
+
+    OpenAPI_list_t *GpsiList = NULL;
+    OpenAPI_ambr_rm_t SubscribedUeAmbr;
+    OpenAPI_list_t *DefaultSingleNssaiList = NULL;
+    OpenAPI_list_t *SingleNssaiList = NULL;
+    OpenAPI_nssai_t NSSAI;
+    OpenAPI_snssai_t *Snssai = NULL;
+
+    OpenAPI_list_t *SubscribedSnssaiInfoList = NULL;
+    OpenAPI_map_t *SubscribedSnssaiInfoMap = NULL;
+    OpenAPI_snssai_info_t *SubscribedSnssaiInfo = NULL;
+    OpenAPI_list_t *DnnInfoList = NULL;
+    OpenAPI_dnn_info_t *DnnInfo = NULL;
+
+    OpenAPI_snssai_t *singleNSSAI = NULL;
+    OpenAPI_list_t *dnnConfigurationList = NULL;
+    OpenAPI_map_t *dnnConfigurationMap = NULL;
+    OpenAPI_dnn_configuration_t *dnnConfiguration = NULL;
+    OpenAPI_pdu_session_types_t *pduSessionTypeList = NULL;
+    OpenAPI_ssc_modes_t *sscModeList = NULL;
+    OpenAPI_subscribed_default_qos_t *_5gQoSProfile = NULL;
+    OpenAPI_ambr_t *sessionAmbr = NULL;
+    OpenAPI_list_t *staticIpAddress = NULL;
+    OpenAPI_ip_address_t *ipAddress = NULL;
+    OpenAPI_list_t *FrameRouteList = NULL;
+    OpenAPI_sm_subs_data_t smSubsData;
+
     char *supi = NULL;
 
     ogs_assert(stream);
     ogs_assert(recvmsg);
 
+    memset(&AccessAndMobilitySubscriptionData, 0,
+            sizeof(AccessAndMobilitySubscriptionData));
+    memset(&SubscribedUeAmbr, 0, sizeof(SubscribedUeAmbr));
+    memset(&NSSAI, 0, sizeof(NSSAI));
     memset(&subscription_data, 0, sizeof(ogs_subscription_data_t));
+    memset(&SmfSelectionSubscriptionData, 0,
+            sizeof(SmfSelectionSubscriptionData));
 
     supi = recvmsg->h.resource.component1;
     if (!supi) {
@@ -464,31 +508,64 @@
         goto cleanup;
     }
 
-    SWITCH(recvmsg->h.resource.component4)
-    CASE(OGS_SBI_RESOURCE_NAME_AM_DATA)
+    if (recvmsg->h.resource.component4) {
+        SWITCH(recvmsg->h.resource.component4)
+        CASE(OGS_SBI_RESOURCE_NAME_AM_DATA)
+            processAmData = true;
+            break;
+        CASE(OGS_SBI_RESOURCE_NAME_SMF_SELECTION_SUBSCRIPTION_DATA)
+            processSmfSel = true;
+            break;
+        CASE(OGS_SBI_RESOURCE_NAME_SM_DATA)
+            processSmData = true;
+            break;
+        DEFAULT
+            strerror = ogs_msprintf("Invalid resource name %s",
+                    recvmsg->h.resource.component4);
+            status = OGS_SBI_HTTP_STATUS_METHOD_NOT_ALLOWED;
+            goto cleanup;
+        END
+    } else {
+        returnProvisionedData = true;
+        if (recvmsg->param.num_of_dataset_names) {
+            int i, validParams = false;
+            for (i = 0; i < recvmsg->param.num_of_dataset_names; i++) {
+                SWITCH(recvmsg->param.dataset_namesi)
+                CASE(OGS_SBI_PARAM_DATASET_NAME_AM)
+                    processAmData = true;
+                    validParams = true;
+                    break;
+                CASE(OGS_SBI_PARAM_DATASET_NAME_SMF_SEL)
+                    processSmfSel = true;
+                    validParams = true;
+                    break;
+                CASE(OGS_SBI_PARAM_DATASET_NAME_SM)
+                    processSmData = true;
+                    validParams = true;
+                    break;
+                DEFAULT
+                    ogs_error("Unexpected dataset-name! %s",
+                            recvmsg->param.dataset_namesi);
+                END
+            }
+            if (!validParams) {
+                strerror = ogs_msprintf("No valid dataset-names");
+                status = OGS_SBI_HTTP_STATUS_BAD_REQUEST;
+                goto cleanup;
+            }
+        } else {
+            processAmData = true;
+            processSmfSel = true;
+            processSmData = true;
+        }
+    }
+
+    if (processAmData) {
         int i;
         bool processGpsi = false;
         bool processUeAmbr = false;
         bool processNssai = false;
 
-        OpenAPI_access_and_mobility_subscription_data_t
-            AccessAndMobilitySubscriptionData;
-        OpenAPI_list_t *GpsiList = NULL;
-        OpenAPI_ambr_rm_t SubscribedUeAmbr;
-
-        OpenAPI_nssai_t NSSAI;
-        OpenAPI_list_t *DefaultSingleNssaiList = NULL;
-        OpenAPI_list_t *SingleNssaiList = NULL;
-        OpenAPI_snssai_t *Snssai = NULL;
-
-        OpenAPI_lnode_t *node = NULL;
-
-        memset(&AccessAndMobilitySubscriptionData, 0,
-                sizeof(AccessAndMobilitySubscriptionData));
-
-        memset(&SubscribedUeAmbr, 0, sizeof(SubscribedUeAmbr));
-        memset(&NSSAI, 0, sizeof(NSSAI));
-
         /* Apply filtering based on fields query parameter */
         if (recvmsg->param.num_of_fields) {
             for (i = 0; i < recvmsg->param.num_of_fields; i++) {
@@ -588,61 +665,19 @@
                 AccessAndMobilitySubscriptionData.nssai = &NSSAI;
         }
 
-        memset(&sendmsg, 0, sizeof(sendmsg));
-        sendmsg.AccessAndMobilitySubscriptionData =
-            &AccessAndMobilitySubscriptionData;
-
-        response = ogs_sbi_build_response(&sendmsg, OGS_SBI_HTTP_STATUS_OK);
-        ogs_assert(response);
-        ogs_assert(true == ogs_sbi_server_send_response(stream, response));
-
-        OpenAPI_list_for_each(GpsiList, node) {
-            if (node->data) ogs_free(node->data);
-        }
-        OpenAPI_list_free(GpsiList);
-
-        if (SubscribedUeAmbr.uplink)
-            ogs_free(SubscribedUeAmbr.uplink);
-        if (SubscribedUeAmbr.downlink)
-            ogs_free(SubscribedUeAmbr.downlink);
-
-        OpenAPI_list_for_each(DefaultSingleNssaiList, node) {
-            OpenAPI_snssai_t *Snssai = node->data;
-            if (Snssai) {
-                if (Snssai->sd)
-                    ogs_free(Snssai->sd);
-                ogs_free(Snssai);
-            }
-        }
-        OpenAPI_list_free(DefaultSingleNssaiList);
-        OpenAPI_list_for_each(SingleNssaiList, node) {
-            OpenAPI_snssai_t *Snssai = node->data;
-            if (Snssai) {
-                if (Snssai->sd)
-                    ogs_free(Snssai->sd);
-                ogs_free(Snssai);
-            }
+        if (!returnProvisionedData) {
+            memset(&sendmsg, 0, sizeof(sendmsg));
+            sendmsg.AccessAndMobilitySubscriptionData =
+                &AccessAndMobilitySubscriptionData;
+
+            response = ogs_sbi_build_response(&sendmsg, OGS_SBI_HTTP_STATUS_OK);
+            ogs_assert(response);
+            ogs_assert(true == ogs_sbi_server_send_response(stream, response));
         }
-        OpenAPI_list_free(SingleNssaiList);
-        break;
-
-    CASE(OGS_SBI_RESOURCE_NAME_SMF_SELECTION_SUBSCRIPTION_DATA)
+    }
+    if (processSmfSel) {
         int i, j;
 
-        OpenAPI_smf_selection_subscription_data_t SmfSelectionSubscriptionData;
-
-        OpenAPI_list_t *SubscribedSnssaiInfoList = NULL;
-        OpenAPI_map_t *SubscribedSnssaiInfoMap = NULL;
-        OpenAPI_snssai_info_t *SubscribedSnssaiInfo = NULL;
-
-        OpenAPI_list_t *DnnInfoList = NULL;
-        OpenAPI_dnn_info_t *DnnInfo = NULL;
-
-        OpenAPI_lnode_t *node = NULL, *node2 = NULL;
-
-        memset(&SmfSelectionSubscriptionData, 0,
-                sizeof(SmfSelectionSubscriptionData));
-
         SubscribedSnssaiInfoList = OpenAPI_list_create();
         ogs_assert(SubscribedSnssaiInfoList);
 
@@ -681,6 +716,11 @@
                     DnnInfo->default_dnn_indicator = true;
                 }
 
+                if (session->lbo_roaming_allowed == true) {
+                    DnnInfo->is_lbo_roaming_allowed = true;
+                    DnnInfo->lbo_roaming_allowed = true;
+                }
+
                 OpenAPI_list_add(DnnInfoList, DnnInfo);
             }
 
@@ -707,374 +747,487 @@
         else
             OpenAPI_list_free(SubscribedSnssaiInfoList);
 
-        memset(&sendmsg, 0, sizeof(sendmsg));
-        sendmsg.SmfSelectionSubscriptionData = &SmfSelectionSubscriptionData;
+        if (!returnProvisionedData) {
+            memset(&sendmsg, 0, sizeof(sendmsg));
+            sendmsg.SmfSelectionSubscriptionData =
+                    &SmfSelectionSubscriptionData;
+
+            response = ogs_sbi_build_response(&sendmsg, OGS_SBI_HTTP_STATUS_OK);
+            ogs_assert(response);
+            ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+        }
+    }
+    if (processSmData) {
+        int i, j;
 
-        response = ogs_sbi_build_response(&sendmsg, OGS_SBI_HTTP_STATUS_OK);
-        ogs_assert(response);
-        ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+        if (recvmsg->param.single_nssai_presence && !returnProvisionedData) {
+            slice_data = ogs_slice_find_by_s_nssai(
+                    subscription_data.slice, subscription_data.num_of_slice,
+                    &recvmsg->param.s_nssai);
+
+            if (!slice_data) {
+                strerror = ogs_msprintf("%s Cannot find S_NSSAI"
+                        "SST:%d SD:0x%x",
+                        supi,
+                        recvmsg->param.s_nssai.sst,
+                        recvmsg->param.s_nssai.sd.v);
+                status = OGS_SBI_HTTP_STATUS_NOT_FOUND;
+                goto cleanup;
+            }
+        }
 
-        SubscribedSnssaiInfoList =
-            SmfSelectionSubscriptionData.subscribed_snssai_infos;
-        OpenAPI_list_for_each(SubscribedSnssaiInfoList, node) {
-            SubscribedSnssaiInfoMap = node->data;
-            if (SubscribedSnssaiInfoMap) {
-                SubscribedSnssaiInfo = SubscribedSnssaiInfoMap->value;
-                if (SubscribedSnssaiInfo) {
-                    DnnInfoList = SubscribedSnssaiInfo->dnn_infos;
-                    if (DnnInfoList) {
-                        OpenAPI_list_for_each(DnnInfoList, node2) {
-                            DnnInfo = node2->data;
-                            if (DnnInfo) {
-                                ogs_free(DnnInfo);
-                            }
-                        }
-                        OpenAPI_list_free(DnnInfoList);
-                    }
-                    ogs_free(SubscribedSnssaiInfo);
+        /* According to 29.503 6.1.3.8.3.1
+        * sm-data can be filtered by singleNssai or dnn query params.
+        * If there is no filtering, then all NSSAIs and all DNNs are returned.
+        */
+
+        SessionManagementSubscriptionDataList = OpenAPI_list_create();
+        ogs_assert(SessionManagementSubscriptionDataList);
+
+        ogs_assert(subscription_data.num_of_slice);
+
+        for (j = 0; j < subscription_data.num_of_slice; j++) {
+            slice_data = &subscription_data.slicej;
+
+            if (!slice_data) {
+                continue;
+            }
+
+            if (recvmsg->param.single_nssai_presence
+                    && !returnProvisionedData) {
+                if (slice_data->s_nssai.sst != recvmsg->param.s_nssai.sst ||
+                        slice_data->s_nssai.sd.v !=
+                        recvmsg->param.s_nssai.sd.v) {
+                    continue;
                 }
-                if (SubscribedSnssaiInfoMap->key)
-                    ogs_free(SubscribedSnssaiInfoMap->key);
-                ogs_free(SubscribedSnssaiInfoMap);
             }
-        }
-        OpenAPI_list_free(SubscribedSnssaiInfoList);
-        break;
 
-    CASE(OGS_SBI_RESOURCE_NAME_SM_DATA)
-        int i;
+            singleNSSAI = ogs_calloc(1, sizeof(*singleNSSAI));
+            ogs_assert(singleNSSAI);
 
-        OpenAPI_session_management_subscription_data_t
-            SessionManagementSubscriptionData;
-        OpenAPI_snssai_t singleNSSAI;
-        OpenAPI_list_t *dnnConfigurationList = NULL;
-        OpenAPI_map_t *dnnConfigurationMap = NULL;
-        OpenAPI_dnn_configuration_t *dnnConfiguration = NULL;
-        OpenAPI_pdu_session_types_t *pduSessionTypeList = NULL;
-        OpenAPI_ssc_modes_t *sscModeList = NULL;
-        OpenAPI_subscribed_default_qos_t *_5gQoSProfile = NULL;
-        OpenAPI_ambr_t *sessionAmbr = NULL;
-        OpenAPI_list_t *staticIpAddress = NULL;
-        OpenAPI_ip_address_t *ipAddress = NULL;
-        OpenAPI_list_t *FrameRouteList = NULL;
-        OpenAPI_lnode_t *node = NULL, *node2 = NULL;
+            dnnConfigurationList = ogs_calloc(1, sizeof(*dnnConfigurationList));
+            ogs_assert(dnnConfigurationList);
 
-        if (!recvmsg->param.single_nssai_presence) {
-            strerror = ogs_msprintf("%s No S_NSSAI", supi);
-            status = OGS_SBI_HTTP_STATUS_BAD_REQUEST;
-            goto cleanup;
-        };
+            singleNSSAI->sst = slice_data->s_nssai.sst;
+            singleNSSAI->sd = ogs_s_nssai_sd_to_string(slice_data->s_nssai.sd);
 
-        ogs_assert(subscription_data.num_of_slice);
-        slice_data = ogs_slice_find_by_s_nssai(
-                subscription_data.slice, subscription_data.num_of_slice,
-                &recvmsg->param.s_nssai);
-
-        if (!slice_data) {
-            strerror = ogs_msprintf("%s Cannot find S_NSSAISST:%d SD:0x%x",
-                    supi,
-                    recvmsg->param.s_nssai.sst,
-                    recvmsg->param.s_nssai.sd.v);
-            status = OGS_SBI_HTTP_STATUS_BAD_REQUEST;
-            goto cleanup;
-        }
+            for (i = 0; i < slice_data->num_of_session; i++) {
+                ogs_session_t *session = NULL;
 
-        singleNSSAI.sst = slice_data->s_nssai.sst;
-        singleNSSAI.sd = ogs_s_nssai_sd_to_string(slice_data->s_nssai.sd);
+                if (i >= OGS_MAX_NUM_OF_SESS) {
+                    ogs_warn("Ignore max session count overflow %d>=%d",
+                        slice_data->num_of_session, OGS_MAX_NUM_OF_SESS);
+                    break;
+                }
 
-        dnnConfigurationList = OpenAPI_list_create();
+                session = &slice_data->sessioni;
+                ogs_assert(session);
+                ogs_assert(session->name);
 
-        for (i = 0; i < slice_data->num_of_session; i++) {
-            ogs_session_t *session = NULL;
+                if (recvmsg->param.dnn &&
+                    ogs_strcasecmp(recvmsg->param.dnn, session->name) != 0 &&
+                    !returnProvisionedData)
+                    continue;
 
-            if (i >= OGS_MAX_NUM_OF_SESS) {
-                ogs_warn("Ignore max session count overflow %d>=%d",
-                    slice_data->num_of_session, OGS_MAX_NUM_OF_SESS);
-                break;
-            }
+                if (!session->qos.index) {
+                    ogs_error("No 5QI");
+                    continue;
+                }
+                if (!session->qos.arp.priority_level) {
+                    ogs_error("No Priority Level");
+                    continue;
+                }
 
-            session = &slice_data->sessioni;
-            ogs_assert(session);
-            ogs_assert(session->name);
+                if (!session->ambr.uplink && !session->ambr.downlink) {
+                    ogs_error("No Session-AMBR");
+                    continue;
+                }
 
-            if (recvmsg->param.dnn &&
-                ogs_strcasecmp(recvmsg->param.dnn, session->name) != 0)
-                continue;
+                dnnConfiguration = ogs_calloc(1, sizeof(*dnnConfiguration));
+                ogs_assert(dnnConfiguration);
 
-            if (!session->qos.index) {
-                ogs_error("No 5QI");
-                continue;
-            }
-            if (!session->qos.arp.priority_level) {
-                ogs_error("No Priority Level");
-                continue;
-            }
+                pduSessionTypeList = ogs_calloc(1, sizeof(*pduSessionTypeList));
+                ogs_assert(pduSessionTypeList);
+                pduSessionTypeList->default_session_type =
+                        session->session_type;
+
+                pduSessionTypeList->allowed_session_types =
+                        OpenAPI_list_create();
+                ogs_assert(pduSessionTypeList->allowed_session_types);
+                switch (pduSessionTypeList->default_session_type) {
+                case OpenAPI_pdu_session_type_IPV4:
+                    OpenAPI_list_add(pduSessionTypeList->allowed_session_types,
+                            (void *)OpenAPI_pdu_session_type_IPV4);
+                    break;
+                case OpenAPI_pdu_session_type_IPV6:
+                    OpenAPI_list_add(pduSessionTypeList->allowed_session_types,
+                            (void *)OpenAPI_pdu_session_type_IPV6);
+                    break;
+                case OpenAPI_pdu_session_type_IPV4V6:
+                    OpenAPI_list_add(pduSessionTypeList->allowed_session_types,
+                            (void *)OpenAPI_pdu_session_type_IPV4);
+                    OpenAPI_list_add(pduSessionTypeList->allowed_session_types,
+                            (void *)OpenAPI_pdu_session_type_IPV6);
+                    OpenAPI_list_add(pduSessionTypeList->allowed_session_types,
+                            (void *)OpenAPI_pdu_session_type_IPV4V6);
+                    break;
+                default:
+                    ogs_fatal("Unsupported PDN_TYPE%d",
+                            pduSessionTypeList->default_session_type);
+                    ogs_assert_if_reached();
+                }
 
-            if (!session->ambr.uplink && !session->ambr.downlink) {
-                ogs_error("No Session-AMBR");
-                continue;
-            }
+                dnnConfiguration->pdu_session_types = pduSessionTypeList;
 
-            dnnConfiguration = ogs_calloc(1, sizeof(*dnnConfiguration));
-            ogs_assert(dnnConfiguration);
+                sscModeList = ogs_calloc(1, sizeof(*sscModeList));
+                ogs_assert(sscModeList);
+                sscModeList->default_ssc_mode = OpenAPI_ssc_mode_SSC_MODE_1;
+
+                sscModeList->allowed_ssc_modes = OpenAPI_list_create();
+                ogs_assert(sscModeList->allowed_ssc_modes);
+                OpenAPI_list_add(sscModeList->allowed_ssc_modes,
+                        (void *)OpenAPI_ssc_mode_SSC_MODE_1);
+                OpenAPI_list_add(sscModeList->allowed_ssc_modes,
+                        (void *)OpenAPI_ssc_mode_SSC_MODE_2);
+                OpenAPI_list_add(sscModeList->allowed_ssc_modes,
+                        (void *)OpenAPI_ssc_mode_SSC_MODE_3);
+
+                dnnConfiguration->ssc_modes = sscModeList;
+
+                _5gQoSProfile = ogs_calloc(1, sizeof(*_5gQoSProfile));
+                ogs_assert(_5gQoSProfile);
+                _5gQoSProfile->_5qi = session->qos.index;
+                _5gQoSProfile->is_priority_level = true;
+                _5gQoSProfile->priority_level = session->qos.arp.priority_level;
+                _5gQoSProfile->arp = ogs_calloc(1, sizeof(OpenAPI_arp_t));
+                ogs_assert(_5gQoSProfile->arp);
+                _5gQoSProfile->arp->priority_level =
+                    session->qos.arp.priority_level;
+                if (session->qos.arp.pre_emption_capability ==
+                        OGS_5GC_PRE_EMPTION_ENABLED)
+                    _5gQoSProfile->arp->preempt_cap =
+                            OpenAPI_preemption_capability_MAY_PREEMPT;
+                else if (session->qos.arp.pre_emption_capability ==
+                        OGS_5GC_PRE_EMPTION_DISABLED)
+                    _5gQoSProfile->arp->preempt_cap =
+                            OpenAPI_preemption_capability_NOT_PREEMPT;
+                ogs_assert(_5gQoSProfile->arp->preempt_cap);
 
-            pduSessionTypeList = ogs_calloc(1, sizeof(*pduSessionTypeList));
-            ogs_assert(pduSessionTypeList);
-            pduSessionTypeList->default_session_type = session->session_type;
-
-            pduSessionTypeList->allowed_session_types = OpenAPI_list_create();
-            ogs_assert(pduSessionTypeList->allowed_session_types);
-            switch (pduSessionTypeList->default_session_type) {
-            case OpenAPI_pdu_session_type_IPV4:
-                OpenAPI_list_add(pduSessionTypeList->allowed_session_types,
-                        (void *)OpenAPI_pdu_session_type_IPV4);
-                break;
-            case OpenAPI_pdu_session_type_IPV6:
-                OpenAPI_list_add(pduSessionTypeList->allowed_session_types,
-                        (void *)OpenAPI_pdu_session_type_IPV6);
-                break;
-            case OpenAPI_pdu_session_type_IPV4V6:
-                OpenAPI_list_add(pduSessionTypeList->allowed_session_types,
-                        (void *)OpenAPI_pdu_session_type_IPV4);
-                OpenAPI_list_add(pduSessionTypeList->allowed_session_types,
-                        (void *)OpenAPI_pdu_session_type_IPV6);
-                OpenAPI_list_add(pduSessionTypeList->allowed_session_types,
-                        (void *)OpenAPI_pdu_session_type_IPV4V6);
-                break;
-            default:
-                ogs_fatal("Unsupported PDN_TYPE%d",
-                        pduSessionTypeList->default_session_type);
-                ogs_assert_if_reached();
-            }
-
-            dnnConfiguration->pdu_session_types = pduSessionTypeList;
-
-            sscModeList = ogs_calloc(1, sizeof(*sscModeList));
-            ogs_assert(sscModeList);
-            sscModeList->default_ssc_mode = OpenAPI_ssc_mode_SSC_MODE_1;
-
-            sscModeList->allowed_ssc_modes = OpenAPI_list_create();
-            ogs_assert(sscModeList->allowed_ssc_modes);
-            OpenAPI_list_add(sscModeList->allowed_ssc_modes,
-                    (void *)OpenAPI_ssc_mode_SSC_MODE_1);
-            OpenAPI_list_add(sscModeList->allowed_ssc_modes,
-                    (void *)OpenAPI_ssc_mode_SSC_MODE_2);
-            OpenAPI_list_add(sscModeList->allowed_ssc_modes,
-                    (void *)OpenAPI_ssc_mode_SSC_MODE_3);
-
-            dnnConfiguration->ssc_modes = sscModeList;
-
-            _5gQoSProfile = ogs_calloc(1, sizeof(*_5gQoSProfile));
-            ogs_assert(_5gQoSProfile);
-            _5gQoSProfile->_5qi = session->qos.index;
-            _5gQoSProfile->is_priority_level = true;
-            _5gQoSProfile->priority_level = session->qos.arp.priority_level;
-            _5gQoSProfile->arp = ogs_calloc(1, sizeof(OpenAPI_arp_t));
-            ogs_assert(_5gQoSProfile->arp);
-            _5gQoSProfile->arp->priority_level =
-                session->qos.arp.priority_level;
-            if (session->qos.arp.pre_emption_capability ==
+                if (session->qos.arp.pre_emption_vulnerability ==
                     OGS_5GC_PRE_EMPTION_ENABLED)
-                _5gQoSProfile->arp->preempt_cap =
-                        OpenAPI_preemption_capability_MAY_PREEMPT;
-            else if (session->qos.arp.pre_emption_capability ==
+                    _5gQoSProfile->arp->preempt_vuln =
+                        OpenAPI_preemption_vulnerability_PREEMPTABLE;
+                else if (session->qos.arp.pre_emption_vulnerability ==
                     OGS_5GC_PRE_EMPTION_DISABLED)
-                _5gQoSProfile->arp->preempt_cap =
-                        OpenAPI_preemption_capability_NOT_PREEMPT;
-            ogs_assert(_5gQoSProfile->arp->preempt_cap);
-
-            if (session->qos.arp.pre_emption_vulnerability ==
-                OGS_5GC_PRE_EMPTION_ENABLED)
-                _5gQoSProfile->arp->preempt_vuln =
-                    OpenAPI_preemption_vulnerability_PREEMPTABLE;
-            else if (session->qos.arp.pre_emption_vulnerability ==
-                OGS_5GC_PRE_EMPTION_DISABLED)
-                _5gQoSProfile->arp->preempt_vuln =
-                    OpenAPI_preemption_vulnerability_NOT_PREEMPTABLE;
-            ogs_assert(_5gQoSProfile->arp->preempt_vuln);
-
-            dnnConfiguration->_5g_qos_profile = _5gQoSProfile;
-
-            ogs_assert(session->ambr.uplink || session->ambr.downlink);
-            sessionAmbr = ogs_calloc(1, sizeof(*sessionAmbr));
-            ogs_assert(sessionAmbr);
-            sessionAmbr->uplink = ogs_sbi_bitrate_to_string(
-                    session->ambr.uplink, OGS_SBI_BITRATE_KBPS);
-            sessionAmbr->downlink = ogs_sbi_bitrate_to_string(
-                    session->ambr.downlink, OGS_SBI_BITRATE_KBPS);
-
-            dnnConfiguration->session_ambr = sessionAmbr;
-
-            staticIpAddress = OpenAPI_list_create();
-            ogs_assert(staticIpAddress);
-
-            if (session->ue_ip.ipv4 || session->ue_ip.ipv6) {
-                ipAddress = ogs_calloc(1, sizeof(*ipAddress));
-                ogs_assert(ipAddress);
-
-                if (session->ue_ip.ipv4) {
-                    ipAddress->ipv4_addr =
-                        ogs_ipv4_to_string(session->ue_ip.addr);
-                    ogs_assert(ipAddress->ipv4_addr);
-                }
-                if (session->ue_ip.ipv6) {
-                    ipAddress->ipv6_addr =
-                        ogs_ipv6addr_to_string(session->ue_ip.addr6);
-                    ogs_assert(ipAddress->ipv6_addr);
+                    _5gQoSProfile->arp->preempt_vuln =
+                        OpenAPI_preemption_vulnerability_NOT_PREEMPTABLE;
+                ogs_assert(_5gQoSProfile->arp->preempt_vuln);
+
+                dnnConfiguration->_5g_qos_profile = _5gQoSProfile;
+
+                ogs_assert(session->ambr.uplink || session->ambr.downlink);
+                sessionAmbr = ogs_calloc(1, sizeof(*sessionAmbr));
+                ogs_assert(sessionAmbr);
+                sessionAmbr->uplink = ogs_sbi_bitrate_to_string(
+                        session->ambr.uplink, OGS_SBI_BITRATE_KBPS);
+                sessionAmbr->downlink = ogs_sbi_bitrate_to_string(
+                        session->ambr.downlink, OGS_SBI_BITRATE_KBPS);
+
+                dnnConfiguration->session_ambr = sessionAmbr;
+
+                staticIpAddress = OpenAPI_list_create();
+                ogs_assert(staticIpAddress);
+
+                if (session->ue_ip.ipv4 || session->ue_ip.ipv6) {
+                    ipAddress = ogs_calloc(1, sizeof(*ipAddress));
+                    ogs_assert(ipAddress);
+
+                    if (session->ue_ip.ipv4) {
+                        ipAddress->ipv4_addr =
+                            ogs_ipv4_to_string(session->ue_ip.addr);
+                        ogs_assert(ipAddress->ipv4_addr);
+                    }
+                    if (session->ue_ip.ipv6) {
+                        ipAddress->ipv6_addr =
+                            ogs_ipv6addr_to_string(session->ue_ip.addr6);
+                        ogs_assert(ipAddress->ipv6_addr);
+                    }
+
+                    if (ipAddress->ipv4_addr || ipAddress->ipv6_addr)
+                        OpenAPI_list_add(staticIpAddress, ipAddress);
+                    else
+                        ogs_free(ipAddress);
                 }
 
-                if (ipAddress->ipv4_addr || ipAddress->ipv6_addr)
-                    OpenAPI_list_add(staticIpAddress, ipAddress);
+                if (staticIpAddress->count)
+                    dnnConfiguration->static_ip_address = staticIpAddress;
                 else
-                    ogs_free(ipAddress);
-            }
-
-            if (staticIpAddress->count)
-                dnnConfiguration->static_ip_address = staticIpAddress;
-            else
-                OpenAPI_list_free(staticIpAddress);
-
-            dnnConfigurationMap = OpenAPI_map_create(
-                    session->name, dnnConfiguration);
-            ogs_assert(dnnConfigurationMap);
-            OpenAPI_list_add(dnnConfigurationList, dnnConfigurationMap);
+                    OpenAPI_list_free(staticIpAddress);
 
-            if (session->ipv4_framed_routes) {
-                int i;
-                FrameRouteList = OpenAPI_list_create();
+                dnnConfigurationMap = OpenAPI_map_create(
+                        session->name, dnnConfiguration);
+                ogs_assert(dnnConfigurationMap);
+                OpenAPI_list_add(dnnConfigurationList, dnnConfigurationMap);
+
+                if (session->ipv4_framed_routes) {
+                    int i;
+                    FrameRouteList = OpenAPI_list_create();
+
+                    for (i = 0; i < OGS_MAX_NUM_OF_FRAMED_ROUTES_IN_PDI; i++) {
+                        const char *route = session->ipv4_framed_routesi;
+                        if (!route) break;
+                        OpenAPI_list_add(FrameRouteList,
+                                        OpenAPI_frame_route_info_create(
+                                                ogs_strdup(route), NULL));
+                    }
+                    dnnConfiguration->ipv4_frame_route_list = FrameRouteList;
+                }
 
-                for (i = 0; i < OGS_MAX_NUM_OF_FRAMED_ROUTES_IN_PDI; i++) {
-                    const char *route = session->ipv4_framed_routesi;
-                    if (!route) break;
-                    OpenAPI_list_add(FrameRouteList,
-                                     OpenAPI_frame_route_info_create(
-                                             ogs_strdup(route), NULL));
+                if (session->ipv6_framed_routes) {
+                    int i;
+                    FrameRouteList = OpenAPI_list_create();
+
+                    for (i = 0; i < OGS_MAX_NUM_OF_FRAMED_ROUTES_IN_PDI; i++) {
+                        const char *route = session->ipv6_framed_routesi;
+                        if (!route) break;
+                        OpenAPI_list_add(FrameRouteList,
+                                        OpenAPI_frame_route_info_create(
+                                                NULL, ogs_strdup(route)));
+                    }
+                    dnnConfiguration->ipv6_frame_route_list = FrameRouteList;
                 }
-                dnnConfiguration->ipv4_frame_route_list = FrameRouteList;
             }
 
-            if (session->ipv6_framed_routes) {
-                int i;
-                FrameRouteList = OpenAPI_list_create();
-
-                for (i = 0; i < OGS_MAX_NUM_OF_FRAMED_ROUTES_IN_PDI; i++) {
-                    const char *route = session->ipv6_framed_routesi;
-                    if (!route) break;
-                    OpenAPI_list_add(FrameRouteList,
-                                     OpenAPI_frame_route_info_create(
-                                             NULL, ogs_strdup(route)));
-                }
-                dnnConfiguration->ipv6_frame_route_list = FrameRouteList;
+            if (dnnConfigurationList->count) {
+                SessionManagementSubscriptionData = ogs_calloc(1,
+                        sizeof(*SessionManagementSubscriptionData));
+                ogs_assert(SessionManagementSubscriptionData);
+                SessionManagementSubscriptionData->single_nssai = singleNSSAI;
+                SessionManagementSubscriptionData->dnn_configurations =
+                    dnnConfigurationList;
+                OpenAPI_list_add(SessionManagementSubscriptionDataList,
+                    SessionManagementSubscriptionData);
+            } else {
+                if (singleNSSAI->sd)
+                    ogs_free(singleNSSAI->sd);
+                ogs_free(singleNSSAI);
+                OpenAPI_list_free(dnnConfigurationList);
             }
         }
 
-        memset(&SessionManagementSubscriptionData, 0,
-                sizeof(SessionManagementSubscriptionData));
-        SessionManagementSubscriptionData.single_nssai = &singleNSSAI;
-        if (dnnConfigurationList->count)
-            SessionManagementSubscriptionData.dnn_configurations =
-                dnnConfigurationList;
+        memset(&smSubsData, 0, sizeof(smSubsData));
+        smSubsData.session_management_subscription_data_list =
+            SessionManagementSubscriptionDataList;
+
+        if (!returnProvisionedData) {
+            if (!SessionManagementSubscriptionDataList->count) {
+                OpenAPI_list_free(SessionManagementSubscriptionDataList);
+
+                strerror = ogs_msprintf("%s Cannot find S_NSSAI with DNN"
+                        "SST:%d SD:0x%x, DNN:%s",
+                        supi,
+                        recvmsg->param.s_nssai.sst,
+                        recvmsg->param.s_nssai.sd.v,
+                        recvmsg->param.dnn);
+                status = OGS_SBI_HTTP_STATUS_NOT_FOUND;
+                goto cleanup;
+            }
+            memset(&sendmsg, 0, sizeof(sendmsg));
+
+            sendmsg.SessionManagementSubscriptionDataList =
+                    SessionManagementSubscriptionDataList;
+            ogs_assert(sendmsg.SessionManagementSubscriptionDataList);
+
+            response = ogs_sbi_build_response(&sendmsg, OGS_SBI_HTTP_STATUS_OK);
+            ogs_assert(response);
+            ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+        }
+    }
 
-        memset(&sendmsg, 0, sizeof(sendmsg));
-        
-        sendmsg.SessionManagementSubscriptionDataList = OpenAPI_list_create();
-        ogs_assert(sendmsg.SessionManagementSubscriptionDataList);
+    /* Build Provisioned Data Sets */
+    if (returnProvisionedData) {
+        OpenAPI_provisioned_data_sets_t ProvisionedDataSets;
 
-        OpenAPI_list_add(sendmsg.SessionManagementSubscriptionDataList,
-            &SessionManagementSubscriptionData);
+        memset(&ProvisionedDataSets, 0,
+                sizeof(ProvisionedDataSets));
+
+        if (processAmData) {
+            ProvisionedDataSets.am_data = &AccessAndMobilitySubscriptionData;
+        }
+        if (processSmfSel) {
+            ProvisionedDataSets.smf_sel_data = &SmfSelectionSubscriptionData;
+        }
+        if (processSmData) {
+            ProvisionedDataSets.sm_data = &smSubsData;
+        }
+        memset(&sendmsg, 0, sizeof(sendmsg));
+        sendmsg.ProvisionedDataSets = &ProvisionedDataSets;
 
         response = ogs_sbi_build_response(&sendmsg, OGS_SBI_HTTP_STATUS_OK);
         ogs_assert(response);
         ogs_assert(true == ogs_sbi_server_send_response(stream, response));
+    }
 
-        OpenAPI_list_free(sendmsg.SessionManagementSubscriptionDataList);
+    /* Free resources used above */
+    if (processAmData) {
+        OpenAPI_lnode_t *node = NULL;
 
-        if (singleNSSAI.sd)
-            ogs_free(singleNSSAI.sd);
+        OpenAPI_list_for_each(GpsiList, node) {
+            if (node->data) ogs_free(node->data);
+        }
+        OpenAPI_list_free(GpsiList);
 
-        OpenAPI_list_for_each(dnnConfigurationList, node) {
-            dnnConfigurationMap = node->data;
-            if (dnnConfigurationMap) {
-                dnnConfiguration = dnnConfigurationMap->value;
-                if (dnnConfiguration) {
-                    pduSessionTypeList = dnnConfiguration->pdu_session_types;
-                    if (pduSessionTypeList) {
-                        if (pduSessionTypeList->allowed_session_types)
-                            OpenAPI_list_free(
-                                    pduSessionTypeList->allowed_session_types);
-                        ogs_free(pduSessionTypeList);
-                    }
-                    sscModeList = dnnConfiguration->ssc_modes;;
-                    if (sscModeList) {
-                        if (sscModeList->allowed_ssc_modes)
-                            OpenAPI_list_free(sscModeList->allowed_ssc_modes);
-                        ogs_free(sscModeList);
-                    }
-                    _5gQoSProfile = dnnConfiguration->_5g_qos_profile;
-                    if (_5gQoSProfile) {
-                        if (_5gQoSProfile->arp)
-                            ogs_free(_5gQoSProfile->arp);
-                        ogs_free(_5gQoSProfile);
-                    }
+        if (SubscribedUeAmbr.uplink)
+            ogs_free(SubscribedUeAmbr.uplink);
+        if (SubscribedUeAmbr.downlink)
+            ogs_free(SubscribedUeAmbr.downlink);
 
-                    sessionAmbr = dnnConfiguration->session_ambr;
-                    if (sessionAmbr) {
-                        if (sessionAmbr->uplink)
-                            ogs_free(sessionAmbr->uplink);
-                        if (sessionAmbr->downlink)
-                            ogs_free(sessionAmbr->downlink);
-                        ogs_free(sessionAmbr);
-                    }
+        OpenAPI_list_for_each(DefaultSingleNssaiList, node) {
+            OpenAPI_snssai_t *Snssai = node->data;
+            if (Snssai) {
+                if (Snssai->sd)
+                    ogs_free(Snssai->sd);
+                ogs_free(Snssai);
+            }
+        }
+        OpenAPI_list_free(DefaultSingleNssaiList);
+        OpenAPI_list_for_each(SingleNssaiList, node) {
+            OpenAPI_snssai_t *Snssai = node->data;
+            if (Snssai) {
+                if (Snssai->sd)
+                    ogs_free(Snssai->sd);
+                ogs_free(Snssai);
+            }
+        }
+        OpenAPI_list_free(SingleNssaiList);
+    }
+    if (processSmfSel) {
+        OpenAPI_lnode_t *node = NULL, *node2 = NULL;
 
-                    staticIpAddress = dnnConfiguration->static_ip_address;
-                    if (staticIpAddress) {
-                        OpenAPI_list_for_each(staticIpAddress, node2) {
-                            if (node2->data) {
-                                ipAddress = node2->data;
-                                if (ipAddress) {
-                                    if (ipAddress->ipv4_addr)
-                                        ogs_free(ipAddress->ipv4_addr);
-                                    if (ipAddress->ipv6_addr)
-                                        ogs_free(ipAddress->ipv6_addr);
-                                    ogs_free(ipAddress);
-                                }
+        SubscribedSnssaiInfoList =
+            SmfSelectionSubscriptionData.subscribed_snssai_infos;
+        OpenAPI_list_for_each(SubscribedSnssaiInfoList, node) {
+            SubscribedSnssaiInfoMap = node->data;
+            if (SubscribedSnssaiInfoMap) {
+                SubscribedSnssaiInfo = SubscribedSnssaiInfoMap->value;
+                if (SubscribedSnssaiInfo) {
+                    DnnInfoList = SubscribedSnssaiInfo->dnn_infos;
+                    if (DnnInfoList) {
+                        OpenAPI_list_for_each(DnnInfoList, node2) {
+                            DnnInfo = node2->data;
+                            if (DnnInfo) {
+                                ogs_free(DnnInfo);
                             }
                         }
-                        OpenAPI_list_free(staticIpAddress);
-                    }
-
-                    FrameRouteList = dnnConfiguration->ipv4_frame_route_list;
-                    OpenAPI_list_for_each(FrameRouteList, node2) {
-                        OpenAPI_frame_route_info_t *frame = node2->data;
-                        if (frame)
-                            ogs_free(frame);
-                    }
-                    OpenAPI_list_free(FrameRouteList);
-
-                    FrameRouteList = dnnConfiguration->ipv6_frame_route_list;
-                    OpenAPI_list_for_each(FrameRouteList, node2) {
-                        OpenAPI_frame_route_info_t *frame = node2->data;
-                        if (frame)
-                            ogs_free(frame);
+                        OpenAPI_list_free(DnnInfoList);
                     }
-                    OpenAPI_list_free(FrameRouteList);
-
-                    ogs_free(dnnConfiguration);
+                    ogs_free(SubscribedSnssaiInfo);
                 }
-                ogs_free(dnnConfigurationMap);
+                if (SubscribedSnssaiInfoMap->key)
+                    ogs_free(SubscribedSnssaiInfoMap->key);
+                ogs_free(SubscribedSnssaiInfoMap);
             }
         }
+        OpenAPI_list_free(SubscribedSnssaiInfoList);
+    }
+    if (processSmData) {
+        OpenAPI_lnode_t *node = NULL, *node2 = NULL, *node3 = NULL;
 
-        OpenAPI_list_free(dnnConfigurationList);
+        OpenAPI_list_for_each(SessionManagementSubscriptionDataList, node) {
+            SessionManagementSubscriptionData = node->data;
+            if (SessionManagementSubscriptionData->single_nssai) {
+                singleNSSAI = SessionManagementSubscriptionData->single_nssai;
+                if (singleNSSAI->sd)
+                    ogs_free(singleNSSAI->sd);
+                ogs_free(singleNSSAI);
+            }
+
+            if (SessionManagementSubscriptionData->dnn_configurations) {
+                dnnConfigurationList =
+                        SessionManagementSubscriptionData->dnn_configurations;
+                OpenAPI_list_for_each(dnnConfigurationList, node2) {
+                    dnnConfigurationMap = node2->data;
+                    if (dnnConfigurationMap) {
+                        dnnConfiguration = dnnConfigurationMap->value;
+                        if (dnnConfiguration) {
+                            pduSessionTypeList =
+                                    dnnConfiguration->pdu_session_types;
+                            if (pduSessionTypeList) {
+                                if (pduSessionTypeList->allowed_session_types)
+                                    OpenAPI_list_free(
+                                            pduSessionTypeList->allowed_session_types);
+                                ogs_free(pduSessionTypeList);
+                            }
+                            sscModeList = dnnConfiguration->ssc_modes;;
+                            if (sscModeList) {
+                                if (sscModeList->allowed_ssc_modes)
+                                    OpenAPI_list_free(
+                                            sscModeList->allowed_ssc_modes);
+                                ogs_free(sscModeList);
+                            }
+                            _5gQoSProfile = dnnConfiguration->_5g_qos_profile;
+                            if (_5gQoSProfile) {
+                                if (_5gQoSProfile->arp)
+                                    ogs_free(_5gQoSProfile->arp);
+                                ogs_free(_5gQoSProfile);
+                            }
 
-        break;
+                            sessionAmbr = dnnConfiguration->session_ambr;
+                            if (sessionAmbr) {
+                                if (sessionAmbr->uplink)
+                                    ogs_free(sessionAmbr->uplink);
+                                if (sessionAmbr->downlink)
+                                    ogs_free(sessionAmbr->downlink);
+                                ogs_free(sessionAmbr);
+                            }
 
-    DEFAULT
-        strerror = ogs_msprintf("Invalid resource name %s",
-                recvmsg->h.resource.component3);
-        status = OGS_SBI_HTTP_STATUS_METHOD_NOT_ALLOWED;
-        goto cleanup;
-    END
+                            staticIpAddress =
+                                    dnnConfiguration->static_ip_address;
+                            if (staticIpAddress) {
+                                OpenAPI_list_for_each(staticIpAddress, node3) {
+                                    if (node3->data) {
+                                        ipAddress = node3->data;
+                                        if (ipAddress) {
+                                            if (ipAddress->ipv4_addr)
+                                                ogs_free(ipAddress->ipv4_addr);
+                                            if (ipAddress->ipv6_addr)
+                                                ogs_free(ipAddress->ipv6_addr);
+                                            ogs_free(ipAddress);
+                                        }
+                                    }
+                                }
+                                OpenAPI_list_free(staticIpAddress);
+                            }
+
+                            FrameRouteList =
+                                    dnnConfiguration->ipv4_frame_route_list;
+                            OpenAPI_list_for_each(FrameRouteList, node3) {
+                                OpenAPI_frame_route_info_t *frame = node3->data;
+                                if (frame)
+                                    ogs_free(frame);
+                            }
+                            OpenAPI_list_free(FrameRouteList);
+
+                            FrameRouteList =
+                                    dnnConfiguration->ipv6_frame_route_list;
+                            OpenAPI_list_for_each(FrameRouteList, node3) {
+                                OpenAPI_frame_route_info_t *frame = node3->data;
+                                if (frame)
+                                    ogs_free(frame);
+                            }
+                            OpenAPI_list_free(FrameRouteList);
+
+                            ogs_free(dnnConfiguration);
+                        }
+                        ogs_free(dnnConfigurationMap);
+                    }
+                }
+                OpenAPI_list_free(dnnConfigurationList);
+            }
+            ogs_free(SessionManagementSubscriptionData);
+        }
+        OpenAPI_list_free(SessionManagementSubscriptionDataList);
+    }
 
     ogs_subscription_data_free(&subscription_data);

open5gs_2.7.6.tar.xz/src/udr/udr-sm.c -> open5gs_2.7.7.tar.xz/src/udr/udr-sm.c Changed

@@ -284,17 +284,20 @@
                     break;
 
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
-                    if (message.res_status ==
-                            OGS_SBI_HTTP_STATUS_NO_CONTENT) {
-                        ogs_sbi_subscription_data_remove(subscription_data);
-                    } else {
+                    if (message.res_status == OGS_SBI_HTTP_STATUS_NO_CONTENT)
+                        ogs_info("%s Subscription deleted",
+                                subscription_data->id ?
+                                    subscription_data->id : "Unknown");
+                    else
                         ogs_error("%s HTTP response error %d",
                                 subscription_data->id ?
                                     subscription_data->id : "Unknown",
                                 message.res_status);
-                    }
+
+                    ogs_sbi_subscription_data_remove(subscription_data);
                     break;
 
+
                 DEFAULT
                     ogs_error("%s Invalid HTTP method %s",
                             subscription_data->id, message.h.method);

open5gs_2.7.6.tar.xz/src/upf/gtp-path.c -> open5gs_2.7.7.tar.xz/src/upf/gtp-path.c Changed

@@ -151,7 +151,7 @@
         if (replybuf) {
             if (ogs_tun_write(fd, replybuf) != OGS_OK)
                 ogs_warn("ogs_tun_write() for reply failed");
-            
+
             ogs_pkbuf_free(replybuf);
             goto cleanup;
         }
@@ -214,7 +214,7 @@
         upf_sess_urr_acc_add(sess, pdr->urri, recvbuf->len, false);
 
     ogs_assert(true == ogs_pfcp_up_handle_pdr(
-                pdr, OGS_GTPU_MSGTYPE_GPDU, NULL, recvbuf, &report));
+                pdr, OGS_GTPU_MSGTYPE_GPDU, 0, NULL, recvbuf, &report));
 
     /*
      * Issue #2210, Discussion #2208, #2209
@@ -316,14 +316,14 @@
     if (header_desc.type == OGS_GTPU_MSGTYPE_ECHO_REQ) {
         ogs_pkbuf_t *echo_rsp;
 
-        ogs_debug("RECV Echo Request from %s", OGS_ADDR(&from, buf1));
+        ogs_info("RECV Echo Request from %s", OGS_ADDR(&from, buf1));
         echo_rsp = ogs_gtp2_handle_echo_req(pkbuf);
         ogs_expect(echo_rsp);
         if (echo_rsp) {
             ssize_t sent;
 
             /* Echo reply */
-            ogs_debug("SEND Echo Response to %s", OGS_ADDR(&from, buf1));
+            ogs_info("SEND Echo Response to %s", OGS_ADDR(&from, buf1));
 
             sent = ogs_sendto(fd, echo_rsp->data, echo_rsp->len, 0, &from);
             if (sent < 0 || sent != echo_rsp->len) {
@@ -440,10 +440,23 @@
 
             ogs_list_for_each(&pfcp_sess->pdr_list, pdr) {
 
-                /* Check if Source Interface */
+                /*
+                 * Originally, we checked the Source Interface
+                 * for packets received with a TEID.
+                 *
+                 * However, in the case of Home Routed Roaming,
+                 * packets arriving at the V-UPF from the Core
+                 * do not come through a TUN interface
+                 * but as standard GTP-U packets.
+                 *
+                 * Therefore, this code has been removed to support
+                 * the roaming functionality.
+                 */
+#if 0 /* <DEPRECATED> */
                 if (pdr->src_if != OGS_PFCP_INTERFACE_ACCESS &&
                     pdr->src_if != OGS_PFCP_INTERFACE_CP_FUNCTION)
                     continue;
+#endif
 
                 /* Check if TEID */
                 if (header_desc.teid != pdr->f_teid.teid)
@@ -503,18 +516,92 @@
         far = pdr->far;
         ogs_assert(far);
 
-        if (ip_h->ip_v == 4 && sess->ipv4) {
-            src_addr = (void *)&ip_h->ip_src.s_addr;
-            ogs_assert(src_addr);
+        /*
+         * From Issue #1354
+         *
+         * Do not check Router Advertisement
+         *    pdr->src_if = OGS_PFCP_INTERFACE_CP_FUNCTION;
+         *    far->dst_if = OGS_PFCP_INTERFACE_ACCESS;
+         *
+         * Do not check Indirect Tunnel
+         *    pdr->dst_if = OGS_PFCP_INTERFACE_ACCESS;
+         *    far->dst_if = OGS_PFCP_INTERFACE_ACCESS;
+         */
 
-            /*
-             * From Issue #1354
-             *
-             * Do not check Indirect Tunnel
-             *    pdr->dst_if = OGS_PFCP_INTERFACE_ACCESS;
-             *    far->dst_if = OGS_PFCP_INTERFACE_ACCESS;
-             */
-            if (far->dst_if != OGS_PFCP_INTERFACE_ACCESS) {
+        /*
+         * The implementation was initially based on Issue #1354,
+         * where the system was designed not to perform checks
+         * when FAR->dst_if was set to ACCESS.
+         *
+         * However, this has now been updated
+         * to a new approach that checks for IP source spoofing
+         * only when PDR->src_if is set to ACCESS.
+         *
+         * That said, for Home Routed Roaming scenarios, the system skips
+         * this process during uplink traffic, as the V-UPF does not hold
+         * IP address information in such cases.
+         *
+         * <Normal>
+         * o DL
+         *  PDR->src : Core/N6
+         *  FAT->dst : Access/N3
+         * o UL
+         *  PDR->src : Access/N3
+         *  FAT->dst : Core/N6
+         * o CP2UP
+         *  PDR->src : CP-function
+         *  FAT->dst : Access/N3
+         * o UP2CP
+         *  PDR->src : Access/N3
+         *  FAT->dst : CP-function
+         *
+         * <Indirect>
+         *  PDR->src : Access/UL-Forwarding
+         *  FAT->dst : Access/DL-Forwarding
+         *
+         * <Home Routed Roaming>
+         * - VPLMN
+         * o DL
+         *  PDR->src : Core/N9-for-roaming
+         *  FAT->dst : Access/N3
+         * o UL
+         *  PDR->src : Access/N3
+         *  FAT->dst : Core/N9-for-roaming
+         * - HPLMN
+         * o DL
+         *  PDR->src : Core/N6
+         *  FAT->dst : Access/N9-for-roaming
+         * o UL
+         *  PDR->src : Access/N9-for-roaming
+         *  FAT->dst : Core/N6
+         */
+
+        /*
+         * We first verify whether the Source Interface of the PDR is set
+         * to ACCESS and if it corresponds to N3 3GPP ACCESS.
+         *
+         * This is because IP source spoofing checks are performed only
+         * in such cases.
+         */
+        if (pdr->src_if == OGS_PFCP_INTERFACE_ACCESS &&
+            pdr->src_if_type_presence == true &&
+            (pdr->src_if_type == OGS_PFCP_3GPP_INTERFACE_TYPE_N3_3GPP_ACCESS ||
+             pdr->src_if_type == OGS_PFCP_3GPP_INTERFACE_TYPE_N9_FOR_ROAMING)) {
+
+            if (far->dst_if_type_presence == true &&
+                far->dst_if_type ==
+                    OGS_PFCP_3GPP_INTERFACE_TYPE_N9_FOR_ROAMING) {
+                /*
+                 * <SKIP>
+                 *
+                 * However, Home Routed Roaming is excluded from this check,
+                 * as the V-UPF does not have the necessary IP address
+                 * information to perform the verification.
+                 */
+
+            } else if (ip_h->ip_v == 4 && sess->ipv4) {
+                src_addr = (void *)&ip_h->ip_src.s_addr;
+                ogs_assert(src_addr);
 
                 if (src_addr0 == sess->ipv4->addr0) {
                     /* Source IP address should be matched in uplink */
@@ -529,60 +616,46 @@
 
                     goto cleanup;
                 }
-            }
-
-            subnet = sess->ipv4->subnet;
-            eth_type = ETHERTYPE_IP;
 
-        } else if (ip_h->ip_v == 6 && sess->ipv6) {
-            struct ip6_hdr *ip6_h = (struct ip6_hdr *)pkbuf->data;
-            ogs_assert(ip6_h);
-            src_addr = (void *)ip6_h->ip6_src.s6_addr;
-            ogs_assert(src_addr);
+                subnet = sess->ipv4->subnet;
+                eth_type = ETHERTYPE_IP;
 
-            /*
-             * From Issue #1354
-             *
-             * Do not check Router Advertisement
-             *    pdr->src_if = OGS_PFCP_INTERFACE_CP_FUNCTION;
-             *    far->dst_if = OGS_PFCP_INTERFACE_ACCESS;
-             *
-             * Do not check Indirect Tunnel
-             *    pdr->dst_if = OGS_PFCP_INTERFACE_ACCESS;
-             *    far->dst_if = OGS_PFCP_INTERFACE_ACCESS;
-             */
-            if (far->dst_if != OGS_PFCP_INTERFACE_ACCESS) {
+            } else if (ip_h->ip_v == 6 && sess->ipv6) {
+                struct ip6_hdr *ip6_h = (struct ip6_hdr *)pkbuf->data;
+                ogs_assert(ip6_h);
+                src_addr = (void *)ip6_h->ip6_src.s6_addr;
+                ogs_assert(src_addr);
 
-/*
- * Discussion #1776 was raised,
- * but we decided not to allow unspecified addresses
- * because Open5GS has already sent interface identifiers
- * in the registgration/attach process.
- *
- *
- * RFC4861
- * 4.  Message Formats
- * 4.1.  Router Solicitation Message Format
- * IP Fields:
- *    Source Address
- *                  An IP address assigned to the sending interface, or
- *                  the unspecified address if no address is assigned
- *                  to the sending interface.
- *
- * 6.1.  Message Validation
- * 6.1.1.  Validation of Router Solicitation Messages
- *  Hosts MUST silently discard any received Router Solicitation
- *  Messages.
- *
- *  A router MUST silently discard any received Router Solicitation
- *  messages that do not satisfy all of the following validity checks:
- *
- *  ..
- *  ..
- *
- *  - If the IP source address is the unspecified address, there is no
- *    source link-layer address option in the message.
- */
+    /*
+     * Discussion #1776 was raised,
+     * but we decided not to allow unspecified addresses
+     * because Open5GS has already sent interface identifiers
+     * in the registgration/attach process.
+     *
+     *
+     * RFC4861
+     * 4.  Message Formats
+     * 4.1.  Router Solicitation Message Format
+     * IP Fields:
+     *    Source Address
+     *                  An IP address assigned to the sending interface, or
+     *                  the unspecified address if no address is assigned
+     *                  to the sending interface.
+     *
+     * 6.1.  Message Validation
+     * 6.1.1.  Validation of Router Solicitation Messages
+     *  Hosts MUST silently discard any received Router Solicitation
+     *  Messages.
+     *
+     *  A router MUST silently discard any received Router Solicitation
+     *  messages that do not satisfy all of the following validity checks:
+     *
+     *  ..
+     *  ..
+     *
+     *  - If the IP source address is the unspecified address, there is no
+     *    source link-layer address option in the message.
+     */
                 if (IN6_IS_ADDR_LINKLOCAL((struct in6_addr *)src_addr) &&
                     src_addr2 == sess->ipv6->addr2 &&
                     src_addr3 == sess->ipv6->addr3) {
@@ -613,19 +686,28 @@
 
                     goto cleanup;
                 }
-            }
 
-            subnet = sess->ipv6->subnet;
-            eth_type = ETHERTYPE_IPV6;
+                subnet = sess->ipv6->subnet;
+                eth_type = ETHERTYPE_IPV6;
+
+            } else {
+                ogs_error("Invalid packet IP version:%d, Packet Length:%d",
+                        ip_h->ip_v, pkbuf->len);
+                ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len);
+                goto cleanup;
+            }
 
-        } else {
-            ogs_error("Invalid packet IP version:%d, Packet Length:%d",
-                    ip_h->ip_v, pkbuf->len);
-            ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len);
-            goto cleanup;
         }
 
-        if (far->dst_if == OGS_PFCP_INTERFACE_CORE) {
+        if (far->dst_if == OGS_PFCP_INTERFACE_CORE &&
+            far->dst_if_type_presence == true &&
+            far->dst_if_type == OGS_PFCP_3GPP_INTERFACE_TYPE_N6) {
+
+            upf_sess_t *dst_sess = NULL;
+            ogs_pfcp_pdr_t *dl_pdr = NULL;
+            ogs_pfcp_pdr_t *dl_fallback_pdr = NULL;
+            ogs_pfcp_far_t *dl_far = NULL;
+            ogs_pfcp_user_plane_report_t dl_report;
 
             if (!subnet) {
 #if 0 /* It's redundant log message */
@@ -643,6 +725,103 @@
             for (i = 0; i < pdr->num_of_urr; i++)
                 upf_sess_urr_acc_add(sess, pdr->urri, pkbuf->len, true);
 
+            /*
+             * If destined to another UE on the same subnet,
+             * hairpin back out.
+             *
+             * subnet is already resolved from the source UE
+             * (sess->ipv4->subnet or sess->ipv6->subnet).
+             * A cheap subnet check gates the session lookup so that
+             * normal internet traffic does not touch the hash table.
+             */
+            if (ip_h->ip_v == 4 && subnet->family == AF_INET) {
+                if (ogs_unlikely(
+                        (ip_h->ip_dst.s_addr & subnet->sub.mask0) ==
+                        subnet->sub.sub0))
+                    dst_sess = upf_sess_find_by_ipv4(ip_h->ip_dst.s_addr);
+            } else if (ip_h->ip_v == 6 && subnet->family == AF_INET6) {
+                struct ip6_hdr *ip6_h = (struct ip6_hdr *)ip_h;
+                uint32_t *dst6 = (void *)ip6_h->ip6_dst.s6_addr;
+
+                if (ogs_unlikely(
+                    (dst60 & subnet->sub.mask0) == subnet->sub.sub0 &&
+                    (dst61 & subnet->sub.mask1) == subnet->sub.sub1 &&
+                    (dst62 & subnet->sub.mask2) == subnet->sub.sub2 &&
+                    (dst63 & subnet->sub.mask3) == subnet->sub.sub3))
+                    dst_sess = upf_sess_find_by_ipv6(dst6);
+            }
+
+            if (ogs_unlikely(dst_sess != NULL) && dst_sess != sess) {
+                memset(&dl_report, 0, sizeof(dl_report));
+
+                ogs_list_for_each(&dst_sess->pfcp.pdr_list, dl_pdr) {
+                    dl_far = dl_pdr->far;
+                    ogs_assert(dl_far);
+
+                    /* Check if PDR is Downlink */
+                    if (dl_pdr->src_if != OGS_PFCP_INTERFACE_CORE)
+                        continue;
+
+                    /* Save the Fallback PDR : Lowest presedence downlink PDR */
+                    dl_fallback_pdr = dl_pdr;
+
+                    /* Check if FAR is Downlink */
+                    if (dl_far->dst_if != OGS_PFCP_INTERFACE_ACCESS)
+                        continue;
+
+                    /* Check if Outer header creation */
+                    if (dl_far->outer_header_creation.gtpu4 == 0 &&
+                        dl_far->outer_header_creation.gtpu6 == 0)
+                        continue;
+
+                    /* Check if Rule List in PDR */
+                    if (ogs_list_first(&dl_pdr->rule_list) &&
+                        ogs_pfcp_pdr_rule_find_by_packet(
+                            dl_pdr, pkbuf) == NULL)
+                        continue;
+
+                    break;
+                }
+
+                if (!dl_pdr)
+                    dl_pdr = dl_fallback_pdr;
+
+                if (dl_pdr) {
+                    /* Increment dl octets + pkts */
+                    for (i = 0; i < dl_pdr->num_of_urr; i++)
+                        upf_sess_urr_acc_add(
+                            dst_sess, dl_pdr->urri,
+                            pkbuf->len, false);
+
+                    ogs_assert(true == ogs_pfcp_up_handle_pdr(
+                        dl_pdr, OGS_GTPU_MSGTYPE_GPDU,
+                        0, NULL, pkbuf, &dl_report));
+
+                    if (dl_report.type.downlink_data_report) {
+                        upf_sess_t *dl_sess = NULL;
+
+                        ogs_assert(dl_pdr->sess);
+                        dl_sess = UPF_SESS(dl_pdr->sess);
+                        ogs_assert(dl_sess);
+
+                        dl_report.downlink_data.pdr_id = dl_pdr->id;
+                        if (dl_pdr->qer && dl_pdr->qer->qfi)
+                            dl_report.downlink_data.qfi =
+                                dl_pdr->qer->qfi; /* for 5GC */
+
+                        ogs_assert(OGS_OK ==
+                            upf_pfcp_send_session_report_request(dl_sess, &dl_report));
+                    }
+
+                    /*
+                    * The ogs_pfcp_up_handle_pdr() function
+                    * buffers or frees the Packet Buffer(pkbuf) memory.
+                    */
+                    return;
+                }
+                /* No matching downlink PDR - fall through to TUN */
+            }
+
             if (dev->is_tap) {
                 ogs_assert(eth_type);
                 eth_type = htobe16(eth_type);
@@ -654,16 +833,42 @@
                 memcpy(pkbuf->data, dev->mac_addr, ETHER_ADDR_LEN);
             }
 
-            /* TODO: if destined to another UE, hairpin back out. */
             if (ogs_tun_write(dev->fd, pkbuf) != OGS_OK)
                 ogs_warn("ogs_tun_write() failed");
 
-        } else if (far->dst_if == OGS_PFCP_INTERFACE_ACCESS) {
+        } else {
+
+            /*
+             * The following code is unnecessary and has been removed.
+             * The reason for its initial implementation is unclear.
+             */
+#if 0 /* <DEPRECATED> */
+            if (far->dst_if == OGS_PFCP_INTERFACE_CP_FUNCTION) {
+                if (!far->gnode) {
+                    ogs_error("No Outer Header Creation in FAR");
+                    goto cleanup;
+                }
+
+                if ((far->apply_action & OGS_PFCP_APPLY_ACTION_FORW) == 0) {
+                    ogs_error("Not supported Apply Action 0x%x",
+                                far->apply_action);
+                    goto cleanup;
+                }
+            }
+#endif
+
             ogs_assert(true == ogs_pfcp_up_handle_pdr(
-                        pdr, header_desc.type, &header_desc, pkbuf, &report));
+                        pdr, header_desc.type, len, &header_desc,
+                        pkbuf, &report));
+
+#if 0 /* <DEPRECATED> */
+            if (far->dst_if == OGS_PFCP_INTERFACE_CP_FUNCTION) {
+                ogs_assert(report.type.downlink_data_report == 0);
+            }
+#endif
 
             if (report.type.downlink_data_report) {
-                ogs_error("Indirect Data Fowarding Buffered");
+                ogs_error("User Traffic Buffered");
 
                 report.downlink_data.pdr_id = pdr->id;
                 if (pdr->qer && pdr->qer->qfi)
@@ -678,34 +883,6 @@
              * buffers or frees the Packet Buffer(pkbuf) memory.
              */
             return;
-
-        } else if (far->dst_if == OGS_PFCP_INTERFACE_CP_FUNCTION) {
-
-            if (!far->gnode) {
-                ogs_error("No Outer Header Creation in FAR");
-                goto cleanup;
-            }
-
-            if ((far->apply_action & OGS_PFCP_APPLY_ACTION_FORW) == 0) {
-                ogs_error("Not supported Apply Action 0x%x",
-                            far->apply_action);
-                goto cleanup;
-            }
-
-            ogs_assert(true == ogs_pfcp_up_handle_pdr(
-                        pdr, header_desc.type, &header_desc, pkbuf, &report));
-
-            ogs_assert(report.type.downlink_data_report == 0);
-
-            /*
-             * The ogs_pfcp_up_handle_pdr() function
-             * buffers or frees the Packet Buffer(pkbuf) memory.
-             */
-            return;
-
-        } else {
-            ogs_fatal("Not implemented : FAR-DST_IF%d", far->dst_if);
-            ogs_assert_if_reached();
         }
     } else {
         ogs_error("DROP Invalid GTPU Type %d", header_desc.type);
@@ -721,7 +898,7 @@
     ogs_pkbuf_config_t config;
     memset(&config, 0, sizeof config);
 
-    config.cluster_2048_pool = ogs_app()->pool.packet;
+    config.cluster_2048_pool = ogs_app()->pool.gtpu;
 
 #if OGS_USE_TALLOC == 1
     /* allocate a talloc pool for GTP to ensure it doesn't have to go back
@@ -892,7 +1069,7 @@
                             ogs_assert(sendbuf);
                             ogs_assert(true ==
                                 ogs_pfcp_up_handle_pdr(
-                                    pdr, OGS_GTPU_MSGTYPE_GPDU,
+                                    pdr, OGS_GTPU_MSGTYPE_GPDU, 0,
                                     NULL, sendbuf, &report));
                             break;
                         }

open5gs_2.7.6.tar.xz/src/upf/n4-handler.c -> open5gs_2.7.7.tar.xz/src/upf/n4-handler.c Changed

@@ -203,15 +203,18 @@
         }
 
         /* Setup UPF-N3-TEID & QFI Hash */
-        if (pdr->f_teid_len)
-            ogs_pfcp_object_teid_hash_set(
+        if (pdr->f_teid_len) {
+            cause_value = ogs_pfcp_object_teid_hash_set(
                     OGS_PFCP_OBJ_SESS_TYPE, pdr, restoration_indication);
+            if (cause_value != OGS_PFCP_CAUSE_REQUEST_ACCEPTED)
+                goto cleanup;
+        }
     }
 
     /* Send Buffered Packet to gNB/SGW */
     ogs_list_for_each(&sess->pfcp.pdr_list, pdr) {
         if (pdr->src_if == OGS_PFCP_INTERFACE_CORE) { /* Downlink */
-            ogs_pfcp_send_buffered_packet(pdr);
+            ogs_pfcp_send_buffered_gtpu(pdr);
         }
     }
 
@@ -407,14 +410,18 @@
         ogs_assert(pdr);
 
         /* Setup UPF-N3-TEID & QFI Hash */
-        if (pdr->f_teid_len)
-            ogs_pfcp_object_teid_hash_set(OGS_PFCP_OBJ_SESS_TYPE, pdr, false);
+        if (pdr->f_teid_len) {
+            cause_value = ogs_pfcp_object_teid_hash_set(
+                    OGS_PFCP_OBJ_SESS_TYPE, pdr, false);
+            if (cause_value != OGS_PFCP_CAUSE_REQUEST_ACCEPTED)
+                goto cleanup;
+        }
     }
 
     /* Send Buffered Packet to gNB/SGW */
     ogs_list_for_each(&sess->pfcp.pdr_list, pdr) {
         if (pdr->src_if == OGS_PFCP_INTERFACE_CORE) { /* Downlink */
-            ogs_pfcp_send_buffered_packet(pdr);
+            ogs_pfcp_send_buffered_gtpu(pdr);
         }
     }

open5gs_2.7.6.tar.xz/tests/af/af-sm.c -> open5gs_2.7.7.tar.xz/tests/af/af-sm.c Changed

@@ -262,16 +262,20 @@
                     break;
 
                 CASE(OGS_SBI_HTTP_METHOD_DELETE)
-                    if (message.res_status == OGS_SBI_HTTP_STATUS_NO_CONTENT) {
-                        ogs_sbi_subscription_data_remove(subscription_data);
-                    } else {
+                    if (message.res_status == OGS_SBI_HTTP_STATUS_NO_CONTENT)
+                        ogs_info("%s Subscription deleted",
+                                subscription_data->id ?
+                                    subscription_data->id : "Unknown");
+                    else
                         ogs_error("%s HTTP response error %d",
                                 subscription_data->id ?
                                     subscription_data->id : "Unknown",
                                 message.res_status);
-                    }
+
+                    ogs_sbi_subscription_data_remove(subscription_data);
                     break;
 
+
                 DEFAULT
                     ogs_error("Invalid HTTP method %s", message.h.method);
                     ogs_assert_if_reached();

open5gs_2.7.6.tar.xz/tests/af/sbi-path.c -> open5gs_2.7.7.tar.xz/tests/af/sbi-path.c Changed

open5gs_2.7.6.tar.xz/tests/attach/auth-test.c -> open5gs_2.7.7.tar.xz/tests/attach/auth-test.c Changed

open5gs_2.7.6.tar.xz/tests/attach/crash-test.c -> open5gs_2.7.7.tar.xz/tests/attach/crash-test.c Changed

@@ -304,7 +304,7 @@
     test_ue->tau_request_param.ue_network_capability = 1;
     test_ue->tau_request_param.last_visited_registered_tai = 1;
     test_ue->tau_request_param.drx_parameter = 1;
-    test_ue->tau_request_param.eps_bearer_context_status = 1;
+    test_ue->tau_request_param.ebcs_value = 0x20; /* EBI:5 */
     test_ue->tau_request_param.ms_network_capability = 1;
     test_ue->tau_request_param.tmsi_status = 1;
     test_ue->tau_request_param.mobile_station_classmark_2 = 1;
@@ -442,6 +442,375 @@
     testenb_s1ap_close(s1ap);
 }
 
+#if 0
+static void test6_issues4357_func(abts_case *tc, void *data)
+{
+    int rv;
+    ogs_socknode_t *s1ap;
+    ogs_socknode_t *gtpu;
+    ogs_pkbuf_t *emmbuf;
+    ogs_pkbuf_t *esmbuf;
+    ogs_pkbuf_t *sendbuf;
+    ogs_pkbuf_t *recvbuf;
+    ogs_s1ap_message_t message;
+
+    ogs_nas_5gs_mobile_identity_suci_t mobile_identity_suci;
+    test_ue_t *test_ue = NULL;
+    test_sess_t *sess = NULL;
+    test_bearer_t *bearer = NULL;
+
+    uint32_t enb_ue_s1ap_id;
+    uint64_t mme_ue_s1ap_id;
+
+    bson_t *doc = NULL;
+
+    /* Setup Test UE & Session Context */
+    memset(&mobile_identity_suci, 0, sizeof(mobile_identity_suci));
+
+    mobile_identity_suci.h.supi_format = OGS_NAS_5GS_SUPI_FORMAT_IMSI;
+    mobile_identity_suci.h.type = OGS_NAS_5GS_MOBILE_IDENTITY_SUCI;
+    mobile_identity_suci.routing_indicator1 = 0;
+    mobile_identity_suci.routing_indicator2 = 0xf;
+    mobile_identity_suci.routing_indicator3 = 0xf;
+    mobile_identity_suci.routing_indicator4 = 0xf;
+    mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
+    mobile_identity_suci.home_network_pki_value = 0;
+
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000010");
+    ogs_assert(test_ue);
+
+    test_ue->e_cgi.cell_id = 0x1079baf0;
+    test_ue->nas.ksi = OGS_NAS_KSI_NO_KEY_IS_AVAILABLE;
+    test_ue->nas.value = OGS_NAS_ATTACH_TYPE_COMBINED_EPS_IMSI_ATTACH;
+
+    test_ue->k_string = "465b5ce8b199b49faa5f0a2ee238a6bc";
+    test_ue->opc_string = "e8ed289deba952e4283b54e88e6183ca";
+
+    sess = test_sess_add_by_apn(test_ue, "internet", OGS_GTP2_RAT_TYPE_EUTRAN);
+    ogs_assert(sess);
+
+    /* eNB connects to MME */
+    s1ap = tests1ap_client(AF_INET);
+    ABTS_PTR_NOTNULL(tc, s1ap);
+
+    /* eNB connects to SGW */
+    gtpu = test_gtpu_server(1, AF_INET);
+    ABTS_PTR_NOTNULL(tc, gtpu);
+
+    /* Send S1-Setup Reqeust */
+    sendbuf = test_s1ap_build_s1_setup_request(
+            S1AP_ENB_ID_PR_macroENB_ID, 0x54f64);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive S1-Setup Response */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(NULL, recvbuf);
+
+    /********** Insert Subscriber in Database */
+    doc = test_db_new_simple(test_ue);
+    ABTS_PTR_NOTNULL(tc, doc);
+    ABTS_INT_EQUAL(tc, OGS_OK, test_db_insert_ue(test_ue, doc));
+
+    /* Send Attach Request */
+    memset(&sess->pdn_connectivity_param,
+            0, sizeof(sess->pdn_connectivity_param));
+    sess->pdn_connectivity_param.eit = 1;
+    sess->pdn_connectivity_param.request_type =
+        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+
+    memset(&test_ue->attach_request_param,
+            0, sizeof(test_ue->attach_request_param));
+    test_ue->attach_request_param.drx_parameter = 1;
+    test_ue->attach_request_param.ms_network_capability = 1;
+    test_ue->attach_request_param.tmsi_status = 1;
+    test_ue->attach_request_param.mobile_station_classmark_2 = 1;
+    test_ue->attach_request_param.ue_usage_setting = 1;
+    emmbuf = testemm_build_attach_request(test_ue, esmbuf, true, false);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+
+    memset(&test_ue->initial_ue_param, 0, sizeof(test_ue->initial_ue_param));
+    sendbuf = test_s1ap_build_initial_ue_message(
+            test_ue, emmbuf, S1AP_RRC_Establishment_Cause_mo_Signalling, false);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Authentication Request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send Authentication response */
+    emmbuf = testemm_build_authentication_response(test_ue);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Security mode Command */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send Security mode complete */
+    test_ue->mobile_identity_imeisv_presence = true;
+    emmbuf = testemm_build_security_mode_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive ESM Information Request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send ESM Information Response */
+    sess->esm_information_param.epco = 1;
+    esmbuf = testesm_build_esm_information_response(sess);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Initial Context Setup Request +
+     * Attach Accept +
+     * Activate Default Bearer Context Request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send UE Capability Info Indication */
+    sendbuf = tests1ap_build_ue_radio_capability_info_indication(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Initial Context Setup Response */
+    sendbuf = test_s1ap_build_initial_context_setup_response(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Attach Complete + Activate default EPS bearer cotext accept */
+    test_ue->nr_cgi.cell_id = 0x1234502;
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 5);
+    ogs_assert(bearer);
+    esmbuf = testesm_build_activate_default_eps_bearer_context_accept(
+            bearer, false);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    emmbuf = testemm_build_attach_complete(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive EMM information */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send Attach Request - INVALID IMSI */
+    sess->pti = 1;
+    test_ue->mobile_identity_imsi.odd_even = 0;
+
+    memset(&sess->pdn_connectivity_param,
+            0, sizeof(sess->pdn_connectivity_param));
+    sess->pdn_connectivity_param.request_type =
+        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+
+    memset(&test_ue->attach_request_param,
+            0, sizeof(test_ue->attach_request_param));
+    emmbuf = testemm_build_attach_request(test_ue, esmbuf, true, true);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Attach Reject */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Receive UE Context Release Command */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send UE Context Release Complete */
+    sendbuf = test_s1ap_build_ue_context_release_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Attach Request - Valid IMSI */
+    sess->pti = 1;
+    test_ue->mobile_identity_imsi.odd_even = 1;
+
+    memset(&sess->pdn_connectivity_param,
+            0, sizeof(sess->pdn_connectivity_param));
+    sess->pdn_connectivity_param.request_type =
+        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+
+    memset(&test_ue->attach_request_param,
+            0, sizeof(test_ue->attach_request_param));
+    emmbuf = testemm_build_attach_request(test_ue, esmbuf, false, false);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+
+    memset(&test_ue->initial_ue_param, 0, sizeof(test_ue->initial_ue_param));
+    sendbuf = test_s1ap_build_initial_ue_message(
+            test_ue, emmbuf, S1AP_RRC_Establishment_Cause_mo_Signalling, false);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Authentication Request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send Authentication response */
+    emmbuf = testemm_build_authentication_response(test_ue);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Security mode Command */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send Security mode complete */
+    test_ue->mobile_identity_imeisv_presence = true;
+    emmbuf = testemm_build_security_mode_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive ESM Information Request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send ESM Information Response */
+    sess->esm_information_param.epco = 1;
+    esmbuf = testesm_build_esm_information_response(sess);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Initial Context Setup Request +
+     * Attach Accept +
+     * Activate Default Bearer Context Request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send UE Capability Info Indication */
+    sendbuf = tests1ap_build_ue_radio_capability_info_indication(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Initial Context Setup Response */
+    sendbuf = test_s1ap_build_initial_context_setup_response(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Attach Complete + Activate default EPS bearer cotext accept */
+    test_ue->nr_cgi.cell_id = 0x1234502;
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 5);
+    ogs_assert(bearer);
+    esmbuf = testesm_build_activate_default_eps_bearer_context_accept(
+            bearer, false);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    emmbuf = testemm_build_attach_complete(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive EMM information */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send Detach Request */
+    emmbuf = testemm_build_detach_request(test_ue, 1, true, false);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+    sendbuf = test_s1ap_build_initial_ue_message(
+            test_ue, emmbuf, S1AP_RRC_Establishment_Cause_mo_Signalling, true);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive OLD UE Context Release Command */
+    enb_ue_s1ap_id = test_ue->enb_ue_s1ap_id;
+
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send OLD UE Context Release Complete */
+    sendbuf = test_s1ap_build_ue_context_release_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    test_ue->enb_ue_s1ap_id = enb_ue_s1ap_id;
+
+    /* Receive UE Context Release Command */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send UE Context Release Complete */
+    sendbuf = test_s1ap_build_ue_context_release_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    ogs_msleep(300);
+
+    /********** Remove Subscriber in Database */
+    ABTS_INT_EQUAL(tc, OGS_OK, test_db_remove_ue(test_ue));
+
+    /* eNB disonncect from MME */
+    testenb_s1ap_close(s1ap);
+
+    /* eNB disonncect from SGW */
+    test_gtpu_close(gtpu);
+
+    test_ue_remove(test_ue);
+}
+#endif
+
 abts_suite *test_crash(abts_suite *suite)
 {
     suite = ADD_SUITE(suite)
@@ -484,6 +853,9 @@
 #endif
 
     abts_run_test(suite, test5_func, NULL);
+#if 0 /* Commenting to suppress error messages */
+    abts_run_test(suite, test6_issues4357_func, NULL);
+#endif
 
     return suite;
 }

open5gs_2.7.6.tar.xz/tests/attach/guti-test.c -> open5gs_2.7.7.tar.xz/tests/attach/guti-test.c Changed

@@ -1065,7 +1065,7 @@
     test_ue->tau_request_param.ue_network_capability = 1;
     test_ue->tau_request_param.last_visited_registered_tai = 1;
     test_ue->tau_request_param.drx_parameter = 1;
-    test_ue->tau_request_param.eps_bearer_context_status = 1;
+    test_ue->tau_request_param.eps_bearer_context_status = 0x20; /* EBI:5 */
     test_ue->tau_request_param.ms_network_capability = 1;
     test_ue->tau_request_param.tmsi_status = 1;
     test_ue->tau_request_param.mobile_station_classmark_2 = 1;
@@ -1165,7 +1165,7 @@
     test_ue->tau_request_param.ue_network_capability = 1;
     test_ue->tau_request_param.last_visited_registered_tai = 1;
     test_ue->tau_request_param.drx_parameter = 1;
-    test_ue->tau_request_param.eps_bearer_context_status = 1;
+    test_ue->tau_request_param.eps_bearer_context_status = 0x20; /* EBI:5 */
     test_ue->tau_request_param.ms_network_capability = 1;
     test_ue->tau_request_param.tmsi_status = 1;
     test_ue->tau_request_param.mobile_station_classmark_2 = 1;

open5gs_2.7.6.tar.xz/tests/attach/idle-test.c -> open5gs_2.7.7.tar.xz/tests/attach/idle-test.c Changed

@@ -241,7 +241,7 @@
     test_ue->tau_request_param.ue_network_capability = 1;
     test_ue->tau_request_param.last_visited_registered_tai = 1;
     test_ue->tau_request_param.drx_parameter = 1;
-    test_ue->tau_request_param.eps_bearer_context_status = 1;
+    test_ue->tau_request_param.eps_bearer_context_status = 0x20; /* EBI:5 */
     test_ue->tau_request_param.ms_network_capability = 1;
     test_ue->tau_request_param.tmsi_status = 1;
     test_ue->tau_request_param.mobile_station_classmark_2 = 1;
@@ -287,7 +287,7 @@
     test_ue->tau_request_param.ue_network_capability = 1;
     test_ue->tau_request_param.last_visited_registered_tai = 1;
     test_ue->tau_request_param.drx_parameter = 1;
-    test_ue->tau_request_param.eps_bearer_context_status = 1;
+    test_ue->tau_request_param.eps_bearer_context_status = 0x20; /* EBI:5 */
     test_ue->tau_request_param.ms_network_capability = 1;
     test_ue->tau_request_param.tmsi_status = 1;
     test_ue->tau_request_param.mobile_station_classmark_2 = 1;
@@ -527,7 +527,7 @@
     test_ue->tau_request_param.ue_network_capability = 1;
     test_ue->tau_request_param.last_visited_registered_tai = 1;
     test_ue->tau_request_param.drx_parameter = 1;
-    test_ue->tau_request_param.eps_bearer_context_status = 1;
+    test_ue->tau_request_param.eps_bearer_context_status = 0x20; /* EBI:5 */
     test_ue->tau_request_param.ms_network_capability = 1;
     test_ue->tau_request_param.tmsi_status = 1;
     test_ue->tau_request_param.mobile_station_classmark_2 = 1;

open5gs_2.7.6.tar.xz/tests/common/context.c -> open5gs_2.7.7.tar.xz/tests/common/context.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2025 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -1599,6 +1599,11 @@
                             "pre_emption_capability", BCON_INT32(1),
                         "}",
                     "}",
+#if 0
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                 "}", "",
             "}", "",
             "security", "{",
@@ -1704,6 +1709,11 @@
                                  "description", BCON_UTF8("permit out udp from 10.200.136.98/32 1-65535 to assigned 50021"), "}",
                         "",
                     "}", "",
+#if 0
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                 "}", "",
             "}", "",
             "security", "{",
@@ -1805,6 +1815,11 @@
                                  "description", BCON_UTF8("permit out udp from 10.200.136.98/32 23455 to assigned 1-65535"), "}",
                         "",
                     "}", "",
+#if 0
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                 "}", "",
             "}", "",
             "security", "{",
@@ -1871,6 +1886,11 @@
                             "pre_emption_capability", BCON_INT32(1),
                         "}",
                     "}",
+#if 0
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                   "{",
                     "name", BCON_UTF8("ims"),
@@ -1933,6 +1953,11 @@
                                  "description", BCON_UTF8("permit out udp from 10.200.136.98/32 1-65535 to assigned 50021"), "}",
                         "",
                     "}", "",
+#if 0
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                 "",
             "}", "",
@@ -2000,6 +2025,11 @@
                             "pre_emption_capability", BCON_INT32(1),
                         "}",
                     "}",
+#if 0
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                   "{",
                     "name", BCON_UTF8("ims"),
@@ -2084,6 +2114,11 @@
                         "}",
                       "}",
                     "",
+#if 0
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                 "",
             "}", "",
@@ -2152,6 +2187,11 @@
                             "pre_emption_capability", BCON_INT32(1),
                         "}",
                     "}",
+#if 1
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                   "{",
                     "name", BCON_UTF8("ims"),
@@ -2236,6 +2276,11 @@
                         "}",
                       "}",
                     "",
+#if 1
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                 "",
               "}",
@@ -2264,6 +2309,11 @@
                             "pre_emption_capability", BCON_INT32(1),
                         "}",
                     "}",
+#if 1
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                   "{",
                     "name", BCON_UTF8("ims"),
@@ -2348,6 +2398,11 @@
                         "}",
                       "}",
                     "",
+#if 1
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                 "",
               "}",
@@ -2377,6 +2432,11 @@
                             "pre_emption_capability", BCON_INT32(1),
                         "}",
                     "}",
+#if 1
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                   "{",
                     "name", BCON_UTF8("ims"),
@@ -2461,6 +2521,11 @@
                         "}",
                       "}",
                     "",
+#if 1
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                 "",
               "}",
@@ -2530,6 +2595,11 @@
                             "pre_emption_capability", BCON_INT32(1),
                         "}",
                     "}",
+#if 1
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                   "{",
                     "name", BCON_UTF8("ims"),
@@ -2614,6 +2684,11 @@
                         "}",
                       "}",
                     "",
+#if 1
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                 "",
               "}",
@@ -2642,6 +2717,11 @@
                             "pre_emption_capability", BCON_INT32(1),
                         "}",
                     "}",
+#if 1
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                   "{",
                     "name", BCON_UTF8("ims2"),
@@ -2726,6 +2806,11 @@
                         "}",
                       "}",
                     "",
+#if 1
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                 "",
               "}",
@@ -2755,6 +2840,11 @@
                             "pre_emption_capability", BCON_INT32(1),
                         "}",
                     "}",
+#if 1
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                   "{",
                     "name", BCON_UTF8("ims3"),
@@ -2839,6 +2929,11 @@
                         "}",
                       "}",
                     "",
+#if 1
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                 "",
               "}",
@@ -2911,6 +3006,11 @@
                         "addr", BCON_UTF8("127.0.0.4"),
                         "addr6", BCON_UTF8("::1"),
                     "}",
+#if 1
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                   "{",
                     "name", BCON_UTF8("wlan"),
@@ -2995,6 +3095,11 @@
                         "}",
                       "}",
                     "",
+#if 1
+                    "lbo_roaming_allowed", BCON_BOOL(true),
+#else
+                    "lbo_roaming_allowed", BCON_BOOL(false),
+#endif
                   "}",
                 "",
             "}", "",

open5gs_2.7.6.tar.xz/tests/common/context.h -> open5gs_2.7.7.tar.xz/tests/common/context.h Changed

open5gs_2.7.6.tar.xz/tests/common/emm-build.c -> open5gs_2.7.7.tar.xz/tests/common/emm-build.c Changed

@@ -67,7 +67,8 @@
         *ue_additional_security_capability =
             &attach_request->ue_additional_security_capability;
 
-    uint8_t classmark_311 = "\x60\x14\x04\xef\x65\x23\x3b\x88\x78\xd2\x90";
+    uint8_t classmark_311 = {
+        0x60, 0x14, 0x04, 0xef, 0x65, 0x23, 0x3b, 0x88, 0x78, 0xd2, 0x90 };
 
     ogs_assert(test_ue);
     ogs_assert(esmbuf);
@@ -591,7 +592,7 @@
         *ue_additional_security_capability =
             &tau_request->ue_additional_security_capability;
 
-    uint8_t classmark_311 = "\x60\x14\x04\xef\x65\x23\x3b\x88\x78\xd2\x90";
+    uint8_t classmark_311 = { 0x60, 0x14, 0x04, 0xef, 0x65, 0x23, 0x3b, 0x88, 0x78, 0xd2, 0x90 };
 
     ogs_assert(test_ue);
 
@@ -649,20 +650,12 @@
     }
 
     if (test_ue->tau_request_param.eps_bearer_context_status) {
-        test_sess_t *sess = NULL;
-        test_bearer_t *bearer = NULL;
-
         tau_request->presencemask |=
             OGS_NAS_EPS_TRACKING_AREA_UPDATE_REQUEST_EPS_BEARER_CONTEXT_STATUS_PRESENT;
         eps_bearer_context_status->length = 2;
 
-        ogs_list_for_each(&test_ue->sess_list, sess) {
-            ogs_list_for_each(&sess->bearer_list, bearer) {
-                if (bearer->ebi == 5) eps_bearer_context_status->ebi5 = 1;
-                else if (bearer->ebi == 6) eps_bearer_context_status->ebi6 = 1;
-                else if (bearer->ebi == 7) eps_bearer_context_status->ebi7 = 1;
-            }
-        }
+        eps_bearer_context_status->value =
+            test_ue->tau_request_param.eps_bearer_context_status;
     }
 
     if (test_ue->tau_request_param.ms_network_capability) {

open5gs_2.7.6.tar.xz/tests/common/esm-build.c -> open5gs_2.7.7.tar.xz/tests/common/esm-build.c Changed

@@ -37,15 +37,15 @@
     ogs_nas_extended_protocol_configuration_options_t *extended_protocol_configuration_options =
         &pdn_connectivity_request->extended_protocol_configuration_options;
 #if 0
-    uint8_t ue_pco29 =
-            "\x80\x80\x21\x10\x01\x01\x00\x10\x81\x06\x00\x00\x00\x00"
-            "\x83\x06\x00\x00\x00\x00\x00\x03\x00\x00\x0a\x00\x00\x0d\x00";
-    uint8_t ue_pco7 = "\x80\x00\x0a\x00\x00\x0d\x00";
+    uint8_t ue_pco29 = {
+        0x80, 0x80, 0x21, 0x10, 0x01, 0x01, 0x00, 0x10, 0x81, 0x06, 0x00, 0x00, 0x00, 0x00,
+        0x83, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x0d, 0x00 };
+    uint8_t ue_pco7 = { 0x80, 0x00, 0x0a, 0x00, 0x00, 0x0d, 0x00 };
 #else
-    uint8_t ue_pco35 =
-        "\x80\x80\x21\x10\x01\x00\x00\x10\x81\x06\x00\x00\x00\x00"
-        "\x83\x06\x00\x00\x00\x00\x00\x0c\x00\x00\x0d\x00\x00\x02\x00\x00"
-        "\x0a\x00\x00\x10\x00";
+    uint8_t ue_pco35 = {
+        0x80, 0x80, 0x21, 0x10, 0x01, 0x00, 0x00, 0x10, 0x81, 0x06, 0x00, 0x00, 0x00, 0x00,
+        0x83, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x02, 0x00, 0x00,
+        0x0a, 0x00, 0x00, 0x10, 0x00 };
 #endif
 
     test_ue_t *test_ue = NULL;
@@ -170,27 +170,27 @@
         &esm_information_response->extended_protocol_configuration_options;
 
 #if 0
-    uint8_t ue_pco29 =
-            "\x80\x80\x21\x10\x01\x01\x00\x10\x81\x06\x00\x00\x00\x00"
-            "\x83\x06\x00\x00\x00\x00\x00\x03\x00\x00\x0a\x00\x00\x0d\x00";
-    uint8_t ue_pco94 =
-        "\x80\xc2\x23"
-        "\x23\x01\x01\x00\x23\x10\xec\xa3\x90\x00\x3e\xdb\xf9\x17\xbe\xcf"
-        "\xa8\x14\x8a\xcd\xde\x56\x55\x4d\x54\x53\x5f\x43\x48\x41\x50\x5f"
-        "\x53\x52\x56\x52\xc2\x23\x15\x02\x01\x00\x15\x10\xb6\xfa\xad\xc5"
-        "\x6a\x43\x6b\x2f\x0f\x9f\x82\x35\x6e\x07\xd9\xd9\x80\x21\x1c\x01"
-        "\x00\x00\x1c\x81\x06\x00\x00\x00\x00\x82\x06\x00\x00\x00\x00\x83"
-        "\x06\x00\x00\x00\x00\x84\x06\x00\x00\x00\x00";
-    uint8_t ue_pco35 =
-        "\x80\x80\x21\x10\x01\x00\x00\x10\x81\x06\x00\x00\x00\x00"
-        "\x83\x06\x00\x00\x00\x00\x00\x0c\x00\x00\x0d\x00\x00\x02\x00\x00"
-        "\x0a\x00\x00\x10\x00";
+    uint8_t ue_pco29 = {
+        0x80, 0x80, 0x21, 0x10, 0x01, 0x01, 0x00, 0x10, 0x81, 0x06, 0x00, 0x00, 0x00, 0x00,
+        0x83, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x0d, 0x00 };
+    uint8_t ue_pco94 = {
+        0x80, 0xc2, 0x23,
+        0x23, 0x01, 0x01, 0x00, 0x23, 0x10, 0xec, 0xa3, 0x90, 0x00, 0x3e, 0xdb, 0xf9, 0x17, 0xbe, 0xcf,
+        0xa8, 0x14, 0x8a, 0xcd, 0xde, 0x56, 0x55, 0x4d, 0x54, 0x53, 0x5f, 0x43, 0x48, 0x41, 0x50, 0x5f,
+        0x53, 0x52, 0x56, 0x52, 0xc2, 0x23, 0x15, 0x02, 0x01, 0x00, 0x15, 0x10, 0xb6, 0xfa, 0xad, 0xc5,
+        0x6a, 0x43, 0x6b, 0x2f, 0x0f, 0x9f, 0x82, 0x35, 0x6e, 0x07, 0xd9, 0xd9, 0x80, 0x21, 0x1c, 0x01,
+        0x00, 0x00, 0x1c, 0x81, 0x06, 0x00, 0x00, 0x00, 0x00, 0x82, 0x06, 0x00, 0x00, 0x00, 0x00, 0x83,
+        0x06, 0x00, 0x00, 0x00, 0x00, 0x84, 0x06, 0x00, 0x00, 0x00, 0x00 };
+    uint8_t ue_pco35 = {
+        0x80, 0x80, 0x21, 0x10, 0x01, 0x00, 0x00, 0x10, 0x81, 0x06, 0x00, 0x00, 0x00, 0x00,
+        0x83, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x02, 0x00, 0x00,
+        0x0a, 0x00, 0x00, 0x10, 0x00 };
 #endif
-    uint8_t ue_pco47 =
-        "\x80\x80\x21\x0a\x01\x0a"
-        "\x00\x0a\x81\x06\x00\x00\x00\x00\x80\x21\x0a\x01\x0b\x00\x0a\x83"
-        "\x06\x00\x00\x00\x00\xc0\x23\x11\x01\x0c\x00\x11\x03\x72\x69\x6d"
-        "\x08\x70\x61\x73\x73\x77\x6f\x72\x64";
+    uint8_t ue_pco47 = {
+        0x80, 0x80, 0x21, 0x0a, 0x01, 0x0a,
+        0x00, 0x0a, 0x81, 0x06, 0x00, 0x00, 0x00, 0x00, 0x80, 0x21, 0x0a, 0x01, 0x0b, 0x00, 0x0a, 0x83,
+        0x06, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x23, 0x11, 0x01, 0x0c, 0x00, 0x11, 0x03, 0x72, 0x69, 0x6d,
+        0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64 };
 
     test_ue_t *test_ue = NULL;
     ogs_pkbuf_t *pkbuf = NULL;
@@ -425,7 +425,7 @@
     ogs_nas_eps_quality_of_service_t *required_traffic_flow_qos =
         &bearer_resource_allocation_request->required_traffic_flow_qos;
 
-    uint8_t tft4 = "\x21\x20\x01\x00";
+    uint8_t tft4 = { 0x21, 0x20, 0x01, 0x00 };
 
     test_ue_t *test_ue = NULL;
     test_sess_t *sess = NULL;

open5gs_2.7.6.tar.xz/tests/common/gsm-build.c -> open5gs_2.7.7.tar.xz/tests/common/gsm-build.c Changed

@@ -39,19 +39,19 @@
      *        Response (2)
      */
 #if 0
-    uint8_t ue_pco94 =
-        "\x80\xc2\x23\x16\x01\x00\x00\x16\x10\xa1\x53\x8b\x8b"
-        "\xa1\x53\x8b\x8b\xa1\x53\x8b\x8b\xa1\x53\x8b\x8b\x2a\xc2\x23\x16"
-        "\x02\x00\x00\x16\x10\x52\xfb\x1e\xd0\x6e\x58\xd6\x5c\xb6\x3f\x54"
-        "\x45\x9c\x94\x84\xaa\x2a\x80\x21\x10\x01\x00\x00\x10\x81\x06\x00"
-        "\x00\x00\x00\x83\x06\x00\x00\x00\x00\x00\x0d\x00\x00\x03\x00\x00"
-        "\x0a\x00\x00\x05\x00\x00\x10\x00\x00\x11\x00\x00\x23\x00\x00\x24"
-        "\x00";
+    uint8_t ue_pco94 = {
+        0x80, 0xc2, 0x23, 0x16, 0x01, 0x00, 0x00, 0x16, 0x10, 0xa1, 0x53, 0x8b, 0x8b,
+        0xa1, 0x53, 0x8b, 0x8b, 0xa1, 0x53, 0x8b, 0x8b, 0xa1, 0x53, 0x8b, 0x8b, 0x2a, 0xc2, 0x23, 0x16,
+        0x02, 0x00, 0x00, 0x16, 0x10, 0x52, 0xfb, 0x1e, 0xd0, 0x6e, 0x58, 0xd6, 0x5c, 0xb6, 0x3f, 0x54,
+        0x45, 0x9c, 0x94, 0x84, 0xaa, 0x2a, 0x80, 0x21, 0x10, 0x01, 0x00, 0x00, 0x10, 0x81, 0x06, 0x00,
+        0x00, 0x00, 0x00, 0x83, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x03, 0x00, 0x00,
+        0x0a, 0x00, 0x00, 0x05, 0x00, 0x00, 0x10, 0x00, 0x00, 0x11, 0x00, 0x00, 0x23, 0x00, 0x00, 0x24,
+        0x00 };
 #endif
-    uint8_t ue_pco35 =
-        "\x80\x80\x21\x10\x01\x00\x00\x10\x81\x06\x00\x00\x00\x00"
-        "\x83\x06\x00\x00\x00\x00\x00\x0c\x00\x00\x0d\x00\x00\x02\x00\x00"
-        "\x0a\x00\x00\x10\x00";
+    uint8_t ue_pco35 = {
+        0x80, 0x80, 0x21, 0x10, 0x01, 0x00, 0x00, 0x10, 0x81, 0x06, 0x00, 0x00, 0x00, 0x00,
+        0x83, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x02, 0x00, 0x00,
+        0x0a, 0x00, 0x00, 0x10, 0x00 };
 
     test_ue_t *test_ue = NULL;
     ogs_pkbuf_t *pkbuf = NULL;

open5gs_2.7.6.tar.xz/tests/common/gtpu.c -> open5gs_2.7.7.tar.xz/tests/common/gtpu.c Changed

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019,2020 by Sukchan Lee <acetcom@gmail.com>
+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>
  *
  * This file is part of Open5GS.
  *
@@ -189,6 +189,7 @@
 
     gnode.addr.ogs_sin_port = htobe16(OGS_GTPV1_U_UDP_PORT);
     gnode.sock = node->sock;
+    ogs_assert(gnode.sock);
 
     if (bearer->qfi) {
         if (sess->upf_n3_ip.ipv4) {
@@ -220,7 +221,14 @@
         ogs_assert_if_reached();
     }
 
-    return ogs_gtp2_send_user_plane(&gnode, header_desc, pkbuf);
+    ogs_gtp2_encapsulate_header(header_desc, pkbuf);
+
+    ogs_assert(OGS_OK == ogs_gtp_send_with_teid(
+            gnode.sock, pkbuf, header_desc->teid, &gnode.addr));
+
+    ogs_pkbuf_free(pkbuf);
+
+    return OGS_OK;
 }
 
 int test_gtpu_send_ping(
@@ -464,6 +472,45 @@
     return test_gtpu_send(node, bearer, &header_desc, pkbuf);
 }
 
+int test_gtpu_send_end_marker(
+        ogs_socknode_t *node, test_bearer_t *bearer)
+{
+    test_sess_t *sess = NULL;
+
+    ogs_gtp2_header_desc_t header_desc;
+
+    ogs_pkbuf_t *pkbuf = NULL;
+
+    ogs_assert(bearer);
+    sess = bearer->sess;
+    ogs_assert(sess);
+
+    pkbuf = ogs_pkbuf_alloc(NULL, OGS_GTPV1U_5GC_HEADER_LEN);
+    ogs_assert(pkbuf);
+    ogs_pkbuf_reserve(pkbuf, OGS_GTPV1U_5GC_HEADER_LEN);
+
+    memset(&header_desc, 0, sizeof(header_desc));
+
+    header_desc.type = OGS_GTPU_MSGTYPE_END_MARKER;
+
+    if (bearer->qfi) {
+        /* 5GC */
+        header_desc.teid = sess->upf_n3_teid;
+        header_desc.pdu_type =
+            OGS_GTP2_EXTENSION_HEADER_PDU_TYPE_UL_PDU_SESSION_INFORMATION;
+        header_desc.qos_flow_identifier = bearer->qfi;
+
+    } else if (bearer->ebi) {
+        /* EPC */
+        header_desc.teid = bearer->sgw_s1u_teid;
+
+    } else {
+        ogs_fatal("No QFI%d and EBI%d", bearer->qfi, bearer->ebi);
+        ogs_assert_if_reached();
+    }
+
+    return test_gtpu_send(node, bearer, &header_desc, pkbuf);
+}
 
 int test_gtpu_send_error_indication(
         ogs_socknode_t *node, test_bearer_t *bearer)

open5gs_2.7.6.tar.xz/tests/common/gtpu.h -> open5gs_2.7.7.tar.xz/tests/common/gtpu.h Changed

open5gs_2.7.6.tar.xz/tests/common/ngap-build.c -> open5gs_2.7.7.tar.xz/tests/common/ngap-build.c Changed

open5gs_2.7.6.tar.xz/tests/common/ngap-build.h -> open5gs_2.7.7.tar.xz/tests/common/ngap-build.h Changed

open5gs_2.7.6.tar.xz/tests/common/test-common.h -> open5gs_2.7.7.tar.xz/tests/common/test-common.h Changed

open5gs_2.7.6.tar.xz/tests/core/conv-test.c -> open5gs_2.7.7.tar.xz/tests/core/conv-test.c Changed

@@ -26,12 +26,18 @@
 #define OP "5F1D289C  5D354D0A 140C2548   F5F3E3BA"
 #define OPc "E8ED2 89D EBA9 52E4 283B 54E8 8E61 83CA"
 #define AMF "8000"
-    uint8_t k16 = "\x46\x5B\x5C\xE8\xB1\x99\xB4\x9F\xAA\x5F\x0A\x2E\xE2\x38\xA6\xBC";
-    uint8_t op16 = "\x5F\x1D\x28\x9C\x5D\x35\x4D\x0A\x14\x0C\x25\x48\xF5\xF3\xE3\xBA";
-    uint8_t opc16 = "\xE8\xED\x28\x9D\xEB\xA9\x52\xE4\x28\x3B\x54\xE8\x8E\x61\x83\xCA";
+    uint8_t k16 = {
+        0x46, 0x5B, 0x5C, 0xE8, 0xB1, 0x99, 0xB4, 0x9F,
+        0xAA, 0x5F, 0x0A, 0x2E, 0xE2, 0x38, 0xA6, 0xBC };
+    uint8_t op16 = {
+        0x5F, 0x1D, 0x28, 0x9C, 0x5D, 0x35, 0x4D, 0x0A,
+        0x14, 0x0C, 0x25, 0x48, 0xF5, 0xF3, 0xE3, 0xBA };
+    uint8_t opc16 = {
+        0xE8, 0xED, 0x28, 0x9D, 0xEB, 0xA9, 0x52, 0xE4,
+        0x28, 0x3B, 0x54, 0xE8, 0x8E, 0x61, 0x83, 0xCA };
     uint8_t amf2 = { 0x80, 0x00 };
 #define LOWER "    12abcdE   F"
-    uint8_t lower4 = "\x12\xab\xcd\xef";
+    uint8_t lower4 = { 0x12, 0xab, 0xcd, 0xef };
 
     char buffer16;
 
@@ -53,11 +59,17 @@
 
 static void conv_test3(abts_case *tc, void *data)
 {
-    uint8_t k16 = "\x46\x5B\x5C\xE8\xB1\x99\xB4\x9F\xAA\x5F\x0A\x2E\xE2\x38\xA6\xBC";
-    uint8_t op16 = "\x5F\x1D\x28\x9C\x5D\x35\x4D\x0A\x14\x0C\x25\x48\xF5\xF3\xE3\xBA";
-    uint8_t opc16 = "\xE8\xED\x28\x9D\xEB\xA9\x52\xE4\x28\x3B\x54\xE8\x8E\x61\x83\xCA";
+    uint8_t k16 = {
+        0x46, 0x5B, 0x5C, 0xE8, 0xB1, 0x99, 0xB4, 0x9F,
+        0xAA, 0x5F, 0x0A, 0x2E, 0xE2, 0x38, 0xA6, 0xBC };
+    uint8_t op16 = {
+        0x5F, 0x1D, 0x28, 0x9C, 0x5D, 0x35, 0x4D, 0x0A,
+        0x14, 0x0C, 0x25, 0x48, 0xF5, 0xF3, 0xE3, 0xBA };
+    uint8_t opc16 = {
+        0xE8, 0xED, 0x28, 0x9D, 0xEB, 0xA9, 0x52, 0xE4,
+        0x28, 0x3B, 0x54, 0xE8, 0x8E, 0x61, 0x83, 0xCA };
     uint8_t amf2 = { 0x80, 0x00 };
-    uint8_t lower4 = "\x12\xab\xcd\xef";
+    uint8_t lower4 = { 0x12, 0xab, 0xcd, 0xef };
     uint8_t buffer128;
 
     ABTS_TRUE(tc, strcmp("465b5ce8b199b49faa5f0a2ee238a6bc",
@@ -75,7 +87,7 @@
 static void conv_test4(abts_case *tc, void *data)
 {
 #define MAX_SIZE 8
-    uint8_t tmpMAX_SIZE = "\x01\x23\x45\x67\x89\xab\xcd\xef";
+    uint8_t tmpMAX_SIZE = { 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef };
     uint8_t bufMAX_SIZE;
     uint64_t num;
 
@@ -137,11 +149,11 @@
 static void conv_test7(abts_case *tc, void *data)
 {
     char out32;
-    uint8_t buf16 = "\x94\x71\x52\x76\x00\x41";
+    uint8_t buf16 = { 0x94, 0x71, 0x52, 0x76, 0x00, 0x41 };
     int buf1_len = 6;
-    uint8_t buf28 = "\x53\x61\x20\x00\x91\x78\x84\x00";
+    uint8_t buf28 = { 0x53, 0x61, 0x20, 0x00, 0x91, 0x78, 0x84, 0x00 };
     int buf2_len = 8;
-    uint8_t buf38 = "\x00\x01\x01\x21\x43\x65\x18\xf9";
+    uint8_t buf38 = { 0x00, 0x01, 0x01, 0x21, 0x43, 0x65, 0x18, 0xf9 };
     int buf3_len = 8;
 
     ogs_buffer_to_bcd(buf1, buf1_len, out);

open5gs_2.7.6.tar.xz/tests/crypt/aes-test.c -> open5gs_2.7.7.tar.xz/tests/crypt/aes-test.c Changed

open5gs_2.7.6.tar.xz/tests/csfb/tau-test.c -> open5gs_2.7.7.tar.xz/tests/csfb/tau-test.c Changed

@@ -215,7 +215,7 @@
     test_ue->tau_request_param.ue_network_capability = 1;
     test_ue->tau_request_param.last_visited_registered_tai = 1;
     test_ue->tau_request_param.drx_parameter = 1;
-    test_ue->tau_request_param.eps_bearer_context_status = 1;
+    test_ue->tau_request_param.eps_bearer_context_status = 0x20; /* EBI:5 */
     test_ue->tau_request_param.ms_network_capability = 1;
     test_ue->tau_request_param.tmsi_status = 1;
     test_ue->tau_request_param.mobile_station_classmark_2 = 1;
@@ -493,7 +493,7 @@
     test_ue->tau_request_param.ue_network_capability = 1;
     test_ue->tau_request_param.last_visited_registered_tai = 1;
     test_ue->tau_request_param.drx_parameter = 1;
-    test_ue->tau_request_param.eps_bearer_context_status = 1;
+    test_ue->tau_request_param.eps_bearer_context_status = 0x20; /* EBI:5 */
     test_ue->tau_request_param.ms_network_capability = 1;
     test_ue->tau_request_param.tmsi_status = 1;
     test_ue->tau_request_param.mobile_station_classmark_2 = 1;
@@ -773,7 +773,7 @@
     test_ue->tau_request_param.ue_network_capability = 1;
     test_ue->tau_request_param.last_visited_registered_tai = 1;
     test_ue->tau_request_param.drx_parameter = 1;
-    test_ue->tau_request_param.eps_bearer_context_status = 1;
+    test_ue->tau_request_param.eps_bearer_context_status = 0x20; /* EBI:5 */
     test_ue->tau_request_param.ms_network_capability = 1;
     test_ue->tau_request_param.tmsi_status = 1;
     test_ue->tau_request_param.mobile_station_classmark_2 = 1;
@@ -1289,7 +1289,8 @@
     test_ue->tau_request_param.ue_network_capability = 1;
     test_ue->tau_request_param.last_visited_registered_tai = 1;
     test_ue->tau_request_param.drx_parameter = 1;
-    test_ue->tau_request_param.eps_bearer_context_status = 1;
+    test_ue->tau_request_param.eps_bearer_context_status =
+        0x60; /* EBI:5, EBI:6 */
     test_ue->tau_request_param.ms_network_capability = 1;
     test_ue->tau_request_param.tmsi_status = 1;
     test_ue->tau_request_param.mobile_station_classmark_2 = 1;

open5gs_2.7.6.tar.xz/tests/handover/5gc-n2-test.c -> open5gs_2.7.7.tar.xz/tests/handover/5gc-n2-test.c Changed

@@ -56,7 +56,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000001");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -487,7 +487,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000002");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -849,10 +849,12 @@
     ABTS_PTR_NOTNULL(tc, recvbuf);
     ogs_pkbuf_free(recvbuf);
 
+#if !HOME_ROUTED_ROAMING_TEST
     /* Receive End Mark */
     recvbuf = test_gtpu_read(gtpu1);
     ABTS_PTR_NOTNULL(tc, recvbuf);
     ogs_pkbuf_free(recvbuf);
+#endif
 
     /* Receive UEContextReleaseCommand */
     amf_ue_ngap_id = test_ue->amf_ue_ngap_id;
@@ -966,10 +968,12 @@
     ABTS_PTR_NOTNULL(tc, recvbuf);
     ogs_pkbuf_free(recvbuf);
 
+#if !HOME_ROUTED_ROAMING_TEST
     /* Receive End Mark */
     recvbuf = test_gtpu_read(gtpu2);
     ABTS_PTR_NOTNULL(tc, recvbuf);
     ogs_pkbuf_free(recvbuf);
+#endif
 
     /* Receive UEContextReleaseCommand */
     amf_ue_ngap_id = test_ue->amf_ue_ngap_id;
@@ -1101,7 +1105,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000003");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -1515,7 +1519,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000004");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -1881,10 +1885,12 @@
     ABTS_PTR_NOTNULL(tc, recvbuf);
     ogs_pkbuf_free(recvbuf);
 
+#if !HOME_ROUTED_ROAMING_TEST
     /* Receive End Mark */
     recvbuf = test_gtpu_read(gtpu1);
     ABTS_PTR_NOTNULL(tc, recvbuf);
     ogs_pkbuf_free(recvbuf);
+#endif
 
     /* Receive UEContextReleaseCommand */
     amf_ue_ngap_id = test_ue->amf_ue_ngap_id;
@@ -2029,10 +2035,12 @@
     ABTS_PTR_NOTNULL(tc, recvbuf);
     ogs_pkbuf_free(recvbuf);
 
+#if !HOME_ROUTED_ROAMING_TEST
     /* Receive End Mark */
     recvbuf = test_gtpu_read(gtpu2);
     ABTS_PTR_NOTNULL(tc, recvbuf);
     ogs_pkbuf_free(recvbuf);
+#endif
 
     /* Receive UEContextReleaseCommand */
     amf_ue_ngap_id = test_ue->amf_ue_ngap_id;
@@ -2168,7 +2176,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000005");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -2534,10 +2542,12 @@
     ABTS_PTR_NOTNULL(tc, recvbuf);
     ogs_pkbuf_free(recvbuf);
 
+#if !HOME_ROUTED_ROAMING_TEST
     /* Receive End Mark */
     recvbuf = test_gtpu_read(gtpu1);
     ABTS_PTR_NOTNULL(tc, recvbuf);
     ogs_pkbuf_free(recvbuf);
+#endif
 
     /* Receive UEContextReleaseCommand */
     amf_ue_ngap_id = test_ue->amf_ue_ngap_id;
@@ -2755,7 +2765,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000006");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;

open5gs_2.7.6.tar.xz/tests/handover/5gc-xn-test.c -> open5gs_2.7.7.tar.xz/tests/handover/5gc-xn-test.c Changed

open5gs_2.7.6.tar.xz/tests/handover/epc-s1-test.c -> open5gs_2.7.7.tar.xz/tests/handover/epc-s1-test.c Changed

open5gs_2.7.6.tar.xz/tests/non3gpp/epdg-test.c -> open5gs_2.7.7.tar.xz/tests/non3gpp/epdg-test.c Changed

open5gs_2.7.6.tar.xz/tests/registration/auth-test.c -> open5gs_2.7.7.tar.xz/tests/registration/auth-test.c Changed

open5gs_2.7.6.tar.xz/tests/registration/crash-test.c -> open5gs_2.7.7.tar.xz/tests/registration/crash-test.c Changed

open5gs_2.7.6.tar.xz/tests/registration/dereg-test.c -> open5gs_2.7.7.tar.xz/tests/registration/dereg-test.c Changed

@@ -51,7 +51,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000001");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -292,7 +292,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000002");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -499,7 +499,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000003");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -946,7 +946,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000004");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -1240,7 +1240,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000005");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -1616,7 +1616,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000006");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -1882,6 +1882,501 @@
     test_ue_remove(test_ue);
 }
 
+#define TEST7_ISSUES4209_WITH_SESSION 1
+
+static void test7_issues4209_func(abts_case *tc, void *data)
+{
+    int rv;
+    ogs_socknode_t *ngap;
+    ogs_socknode_t *gtpu;
+    ogs_pkbuf_t *gmmbuf;
+    ogs_pkbuf_t *gsmbuf;
+    ogs_pkbuf_t *nasbuf;
+    ogs_pkbuf_t *sendbuf;
+    ogs_pkbuf_t *recvbuf;
+    ogs_ngap_message_t message;
+    int i;
+
+    ogs_nas_5gs_mobile_identity_suci_t mobile_identity_suci;
+    test_ue_t *test_ue = NULL;
+    test_sess_t *sess = NULL;
+    test_bearer_t *qos_flow = NULL;
+
+    bson_t *doc = NULL;
+
+    /* Setup Test UE & Session Context */
+    memset(&mobile_identity_suci, 0, sizeof(mobile_identity_suci));
+
+    mobile_identity_suci.h.supi_format = OGS_NAS_5GS_SUPI_FORMAT_IMSI;
+    mobile_identity_suci.h.type = OGS_NAS_5GS_MOBILE_IDENTITY_SUCI;
+    mobile_identity_suci.routing_indicator1 = 0;
+    mobile_identity_suci.routing_indicator2 = 0xf;
+    mobile_identity_suci.routing_indicator3 = 0xf;
+    mobile_identity_suci.routing_indicator4 = 0xf;
+    mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
+    mobile_identity_suci.home_network_pki_value = 0;
+
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000007");
+    ogs_assert(test_ue);
+
+    test_ue->nr_cgi.cell_id = 0x40001;
+
+    test_ue->nas.registration.tsc = 0;
+    test_ue->nas.registration.ksi = OGS_NAS_KSI_NO_KEY_IS_AVAILABLE;
+    test_ue->nas.registration.follow_on_request = 1;
+    test_ue->nas.registration.value = OGS_NAS_5GS_REGISTRATION_TYPE_INITIAL;
+
+    test_ue->k_string = "465b5ce8b199b49faa5f0a2ee238a6bc";
+    test_ue->opc_string = "e8ed289deba952e4283b54e88e6183ca";
+
+    /* gNB connects to AMF */
+    ngap = testngap_client(1, AF_INET);
+    ABTS_PTR_NOTNULL(tc, ngap);
+
+    /* gNB connects to UPF */
+    gtpu = test_gtpu_server(1, AF_INET);
+    ABTS_PTR_NOTNULL(tc, gtpu);
+
+    /* Send NG-Setup Reqeust */
+    sendbuf = testngap_build_ng_setup_request(0x4000, 22);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive NG-Setup Response */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    /********** Insert Subscriber in Database */
+    doc = test_db_new_simple(test_ue);
+    ABTS_PTR_NOTNULL(tc, doc);
+    ABTS_INT_EQUAL(tc, OGS_OK, test_db_insert_ue(test_ue, doc));
+
+    /* Send Registration request */
+    test_ue->registration_request_param.guti = 1;
+
+    gmmbuf = testgmm_build_registration_request(test_ue, NULL, false, false);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+
+    test_ue->registration_request_param.gmm_capability = 1;
+    test_ue->registration_request_param.s1_ue_network_capability = 1;
+    test_ue->registration_request_param.requested_nssai = 1;
+    test_ue->registration_request_param.last_visited_registered_tai = 1;
+    test_ue->registration_request_param.ue_usage_setting = 1;
+    nasbuf = testgmm_build_registration_request(test_ue, NULL, false, false);
+    ABTS_PTR_NOTNULL(tc, nasbuf);
+
+    sendbuf = testngap_build_initial_ue_message(test_ue, gmmbuf,
+                NGAP_RRCEstablishmentCause_mo_Signalling, false, true);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Identity request */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    /* Send Identity response */
+    gmmbuf = testgmm_build_identity_response(test_ue);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Authentication request */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    /* Send Authentication response */
+    gmmbuf = testgmm_build_authentication_response(test_ue);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Security mode command */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    /* Send Security mode complete */
+    gmmbuf = testgmm_build_security_mode_complete(test_ue, nasbuf);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive InitialContextSetupRequest +
+     * Registration accept */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_InitialContextSetup,
+            test_ue->ngap_procedure_code);
+
+    /* Send UERadioCapabilityInfoIndication */
+    sendbuf = testngap_build_ue_radio_capability_info_indication(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send InitialContextSetupResponse */
+    sendbuf = testngap_build_initial_context_setup_response(test_ue, false);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Registration complete */
+    gmmbuf = testgmm_build_registration_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Configuration update command */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    if (OGS_POINTER_TO_UINT(data) == TEST7_ISSUES4209_WITH_SESSION) {
+        /* Send PDU session establishment request */
+        sess = test_sess_add_by_dnn_and_psi(test_ue, "internet", 5);
+        ogs_assert(sess);
+
+        sess->ul_nas_transport_param.request_type =
+            OGS_NAS_5GS_REQUEST_TYPE_INITIAL;
+        sess->ul_nas_transport_param.dnn = 1;
+        sess->ul_nas_transport_param.s_nssai = 0;
+
+        sess->pdu_session_establishment_param.ssc_mode = 1;
+        sess->pdu_session_establishment_param.epco = 1;
+
+        gsmbuf = testgsm_build_pdu_session_establishment_request(sess);
+        ABTS_PTR_NOTNULL(tc, gsmbuf);
+        gmmbuf = testgmm_build_ul_nas_transport(sess,
+                OGS_NAS_PAYLOAD_CONTAINER_N1_SM_INFORMATION, gsmbuf);
+        ABTS_PTR_NOTNULL(tc, gmmbuf);
+        sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+        ABTS_PTR_NOTNULL(tc, sendbuf);
+        rv = testgnb_ngap_send(ngap, sendbuf);
+        ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+        /* Receive PDUSessionResourceSetupRequest +
+         * DL NAS transport +
+         * PDU session establishment accept */
+        recvbuf = testgnb_ngap_read(ngap);
+        ABTS_PTR_NOTNULL(tc, recvbuf);
+        testngap_recv(test_ue, recvbuf);
+        ABTS_INT_EQUAL(tc,
+                NGAP_ProcedureCode_id_PDUSessionResourceSetup,
+                test_ue->ngap_procedure_code);
+
+        /* Send PDUSessionResourceSetupResponse */
+        sendbuf = testngap_sess_build_pdu_session_resource_setup_response(sess);
+        ABTS_PTR_NOTNULL(tc, sendbuf);
+        rv = testgnb_ngap_send(ngap, sendbuf);
+        ABTS_INT_EQUAL(tc, OGS_OK, rv);
+    }
+
+    /* Send De-registration request */
+    gmmbuf = testgmm_build_de_registration_request(test_ue, 1, true, false);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_initial_ue_message(test_ue, gmmbuf,
+                NGAP_RRCEstablishmentCause_mo_Signalling, false, false);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Registration request */
+    memset(&test_ue->registration_request_param, 0,
+            sizeof(test_ue->registration_request_param));
+
+    gmmbuf = testgmm_build_registration_request(test_ue, NULL, false, false);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+
+    test_ue->registration_request_param.gmm_capability = 1;
+    test_ue->registration_request_param.s1_ue_network_capability = 1;
+    test_ue->registration_request_param.requested_nssai = 1;
+    test_ue->registration_request_param.last_visited_registered_tai = 1;
+    test_ue->registration_request_param.ue_usage_setting = 1;
+    nasbuf = testgmm_build_registration_request(test_ue, NULL, false, false);
+    ABTS_PTR_NOTNULL(tc, nasbuf);
+
+    sendbuf = testngap_build_initial_ue_message(test_ue, gmmbuf,
+                NGAP_RRCEstablishmentCause_mo_Signalling, false, true);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* OLD Receive UEContextReleaseCommand */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_UEContextRelease,
+            test_ue->ngap_procedure_code);
+
+    /* Send OLD UEContextReleaseComplete */
+    sendbuf = testngap_build_ue_context_release_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Authentication request */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    /* Send Authentication response */
+    gmmbuf = testgmm_build_authentication_response(test_ue);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Security mode command */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    /* Send Security mode complete */
+    gmmbuf = testgmm_build_security_mode_complete(test_ue, nasbuf);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* OLD Receive UEContextReleaseCommand */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_UEContextRelease,
+            test_ue->ngap_procedure_code);
+
+    /* Send OLD UEContextReleaseComplete */
+    sendbuf = testngap_build_ue_context_release_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive InitialContextSetupRequest +
+     * Registration accept */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_InitialContextSetup,
+            test_ue->ngap_procedure_code);
+
+    /* Send UERadioCapabilityInfoIndication */
+    sendbuf = testngap_build_ue_radio_capability_info_indication(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send InitialContextSetupResponse */
+    sendbuf = testngap_build_initial_context_setup_response(test_ue, false);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Registration complete */
+    gmmbuf = testgmm_build_registration_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Configuration update command */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    if (OGS_POINTER_TO_UINT(data) == TEST7_ISSUES4209_WITH_SESSION) {
+        /* Send PDU session establishment request */
+        sess = test_sess_find_by_psi(test_ue, 5);
+        ogs_assert(sess);
+
+        sess->ul_nas_transport_param.request_type =
+            OGS_NAS_5GS_REQUEST_TYPE_INITIAL;
+        sess->ul_nas_transport_param.dnn = 1;
+        sess->ul_nas_transport_param.s_nssai = 0;
+
+        sess->pdu_session_establishment_param.ssc_mode = 1;
+        sess->pdu_session_establishment_param.epco = 1;
+
+        gsmbuf = testgsm_build_pdu_session_establishment_request(sess);
+        ABTS_PTR_NOTNULL(tc, gsmbuf);
+        gmmbuf = testgmm_build_ul_nas_transport(sess,
+                OGS_NAS_PAYLOAD_CONTAINER_N1_SM_INFORMATION, gsmbuf);
+        ABTS_PTR_NOTNULL(tc, gmmbuf);
+        sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+        ABTS_PTR_NOTNULL(tc, sendbuf);
+        rv = testgnb_ngap_send(ngap, sendbuf);
+        ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+        /* Receive PDUSessionResourceSetupRequest +
+         * DL NAS transport +
+         * PDU session establishment accept */
+        recvbuf = testgnb_ngap_read(ngap);
+        ABTS_PTR_NOTNULL(tc, recvbuf);
+        testngap_recv(test_ue, recvbuf);
+        ABTS_INT_EQUAL(tc,
+                NGAP_ProcedureCode_id_PDUSessionResourceSetup,
+                test_ue->ngap_procedure_code);
+
+        /* Send PDUSessionResourceSetupResponse */
+        sendbuf = testngap_sess_build_pdu_session_resource_setup_response(sess);
+        ABTS_PTR_NOTNULL(tc, sendbuf);
+        rv = testgnb_ngap_send(ngap, sendbuf);
+        ABTS_INT_EQUAL(tc, OGS_OK, rv);
+    }
+
+    /* Send De-registration request */
+    gmmbuf = testgmm_build_de_registration_request(test_ue, 1, true, false);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_initial_ue_message(test_ue, gmmbuf,
+                NGAP_RRCEstablishmentCause_mo_Signalling, false, false);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Registration request
+     * - Update Registration request type
+     * - Uplink Data Status */
+    test_ue->nas.registration.value =
+        OGS_NAS_5GS_REGISTRATION_TYPE_MOBILITY_UPDATING;
+
+    if (sess) {
+        test_ue->registration_request_param.uplink_data_status = 1;
+        test_ue->registration_request_param.psimask.uplink_data_status =
+            1 << sess->psi;
+    }
+    nasbuf = testgmm_build_registration_request(test_ue, NULL, false, false);
+    ABTS_PTR_NOTNULL(tc, nasbuf);
+
+    memset(&test_ue->registration_request_param, 0,
+            sizeof(test_ue->registration_request_param));
+    test_ue->registration_request_param.guti = 1;
+    gmmbuf = testgmm_build_registration_request(test_ue, nasbuf, true, false);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+
+    sendbuf = testngap_build_initial_ue_message(test_ue, gmmbuf,
+                NGAP_RRCEstablishmentCause_mo_Signalling, true, true);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* OLD Receive UEContextReleaseCommand */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_UEContextRelease,
+            test_ue->ngap_procedure_code);
+
+    /* Send OLD UEContextReleaseComplete */
+    sendbuf = testngap_build_ue_context_release_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* OLD Receive UEContextReleaseCommand */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_UEContextRelease,
+            test_ue->ngap_procedure_code);
+
+    /* Send OLD UEContextReleaseComplete */
+    sendbuf = testngap_build_ue_context_release_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive InitialContextSetupRequest +
+     * Registration accept */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_InitialContextSetup,
+            test_ue->ngap_procedure_code);
+    if (OGS_POINTER_TO_UINT(data) == TEST7_ISSUES4209_WITH_SESSION) {
+        ABTS_INT_EQUAL(tc, 0x2000, test_ue->pdu_session_reactivation_result);
+    } else {
+        ABTS_INT_EQUAL(tc, 0x0000, test_ue->pdu_session_reactivation_result);
+    }
+
+    /* Send Registration complete */
+    gmmbuf = testgmm_build_registration_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send InitialContextSetupResponse */
+    sendbuf = testngap_build_initial_context_setup_response(test_ue, false);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Configuration update command */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    /* Send UEContextReleaseRequest */
+    sendbuf = testngap_build_ue_context_release_request(test_ue,
+            NGAP_Cause_PR_radioNetwork, NGAP_CauseRadioNetwork_user_inactivity,
+            true);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive UEContextReleaseCommand */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_UEContextRelease,
+            test_ue->ngap_procedure_code);
+
+    /* Send UEContextReleaseComplete */
+    sendbuf = testngap_build_ue_context_release_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    ogs_msleep(300);
+
+    /********** Remove Subscriber in Database */
+    ABTS_INT_EQUAL(tc, OGS_OK, test_db_remove_ue(test_ue));
+
+    /* gNB disonncect from UPF */
+    testgnb_gtpu_close(gtpu);
+
+    /* gNB disonncect from AMF */
+    testgnb_ngap_close(ngap);
+
+    /* Clear Test UE Context */
+    test_ue_remove(test_ue);
+}
+
 abts_suite *test_dereg(abts_suite *suite)
 {
     suite = ADD_SUITE(suite)
@@ -1892,6 +2387,9 @@
     abts_run_test(suite, test4_func, NULL);
     abts_run_test(suite, test5_func, NULL);
     abts_run_test(suite, test6_issues2917_func, NULL);
+    abts_run_test(suite, test7_issues4209_func, NULL);
+    abts_run_test(suite, test7_issues4209_func,
+            OGS_UINT_TO_POINTER(TEST7_ISSUES4209_WITH_SESSION));
 
     return suite;
 }

open5gs_2.7.6.tar.xz/tests/registration/guti-test.c -> open5gs_2.7.7.tar.xz/tests/registration/guti-test.c Changed

@@ -1220,7 +1220,7 @@
     test_ue_remove(test_ue);
 }
 
-static void test4_issues2839_func(abts_case *tc, void *data)
+static void test_issues2839_func(abts_case *tc, void *data)
 {
     int rv;
     ogs_socknode_t *ngap;
@@ -1517,6 +1517,319 @@
     test_ue_remove(test_ue);
 }
 
+static void test_issues4174_func(abts_case *tc, void *data)
+{
+    int rv;
+    ogs_socknode_t *ngap;
+    ogs_socknode_t *gtpu;
+    ogs_pkbuf_t *gmmbuf;
+    ogs_pkbuf_t *gsmbuf;
+    ogs_pkbuf_t *nasbuf;
+    ogs_pkbuf_t *sendbuf;
+    ogs_pkbuf_t *recvbuf;
+    ogs_ngap_message_t message;
+    int i;
+
+    ogs_nas_5gs_mobile_identity_suci_t mobile_identity_suci;
+    test_ue_t *test_ue = NULL;
+    test_sess_t *sess = NULL;
+    test_bearer_t *qos_flow = NULL;
+
+    bson_t *doc = NULL;
+
+    /* Setup Test UE & Session Context */
+    memset(&mobile_identity_suci, 0, sizeof(mobile_identity_suci));
+
+    mobile_identity_suci.h.supi_format = OGS_NAS_5GS_SUPI_FORMAT_IMSI;
+    mobile_identity_suci.h.type = OGS_NAS_5GS_MOBILE_IDENTITY_SUCI;
+    mobile_identity_suci.routing_indicator1 = 0;
+    mobile_identity_suci.routing_indicator2 = 0xf;
+    mobile_identity_suci.routing_indicator3 = 0xf;
+    mobile_identity_suci.routing_indicator4 = 0xf;
+    mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
+    mobile_identity_suci.home_network_pki_value = 0;
+
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    ogs_assert(test_ue);
+
+    test_ue->nr_cgi.cell_id = 0x40001;
+
+    test_ue->nas.registration.tsc = 0;
+    test_ue->nas.registration.ksi = OGS_NAS_KSI_NO_KEY_IS_AVAILABLE;
+    test_ue->nas.registration.follow_on_request = 1;
+    test_ue->nas.registration.value = OGS_NAS_5GS_REGISTRATION_TYPE_INITIAL;
+
+    test_ue->k_string = "465b5ce8b199b49faa5f0a2ee238a6bc";
+    test_ue->opc_string = "e8ed289deba952e4283b54e88e6183ca";
+
+    /* gNB connects to AMF */
+    ngap = testngap_client(1, AF_INET);
+    ABTS_PTR_NOTNULL(tc, ngap);
+
+    /* gNB connects to UPF */
+    gtpu = test_gtpu_server(1, AF_INET);
+    ABTS_PTR_NOTNULL(tc, gtpu);
+
+    /* Send NG-Setup Reqeust */
+    sendbuf = testngap_build_ng_setup_request(0x4000, 22);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive NG-Setup Response */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    /********** Insert Subscriber in Database */
+    doc = test_db_new_simple(test_ue);
+    ABTS_PTR_NOTNULL(tc, doc);
+    ABTS_INT_EQUAL(tc, OGS_OK, test_db_insert_ue(test_ue, doc));
+
+    /* Send Registration request */
+    test_ue->registration_request_param.guti = 1;
+    gmmbuf = testgmm_build_registration_request(test_ue, NULL, false, false);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+
+    test_ue->registration_request_param.gmm_capability = 1;
+    test_ue->registration_request_param.s1_ue_network_capability = 1;
+    test_ue->registration_request_param.requested_nssai = 1;
+    test_ue->registration_request_param.last_visited_registered_tai = 1;
+    test_ue->registration_request_param.ue_usage_setting = 1;
+    nasbuf = testgmm_build_registration_request(test_ue, NULL, false, false);
+    ABTS_PTR_NOTNULL(tc, nasbuf);
+
+    sendbuf = testngap_build_initial_ue_message(test_ue, gmmbuf,
+                NGAP_RRCEstablishmentCause_mo_Signalling, false, true);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Identity request */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    /* Send Identity response */
+    gmmbuf = testgmm_build_identity_response(test_ue);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Authentication request */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    /* Send Authentication response */
+    gmmbuf = testgmm_build_authentication_response(test_ue);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Security mode command */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    /* Send Security mode complete */
+    gmmbuf = testgmm_build_security_mode_complete(test_ue, nasbuf);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive InitialContextSetupRequest +
+     * Registration accept */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_InitialContextSetup,
+            test_ue->ngap_procedure_code);
+
+    /* Send UERadioCapabilityInfoIndication */
+    sendbuf = testngap_build_ue_radio_capability_info_indication(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send InitialContextSetupResponse */
+    sendbuf = testngap_build_initial_context_setup_response(test_ue, false);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Registration complete */
+    gmmbuf = testgmm_build_registration_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Configuration update command */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    /* Send PDU session establishment request */
+    sess = test_sess_add_by_dnn_and_psi(test_ue, "internet", 5);
+    ogs_assert(sess);
+
+    sess->ul_nas_transport_param.request_type =
+        OGS_NAS_5GS_REQUEST_TYPE_INITIAL;
+    sess->ul_nas_transport_param.dnn = 1;
+    sess->ul_nas_transport_param.s_nssai = 0;
+
+    sess->pdu_session_establishment_param.ssc_mode = 1;
+    sess->pdu_session_establishment_param.epco = 1;
+
+    gsmbuf = testgsm_build_pdu_session_establishment_request(sess);
+    ABTS_PTR_NOTNULL(tc, gsmbuf);
+    gmmbuf = testgmm_build_ul_nas_transport(sess,
+            OGS_NAS_PAYLOAD_CONTAINER_N1_SM_INFORMATION, gsmbuf);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive PDUSessionResourceSetupRequest +
+     * DL NAS transport +
+     * PDU session establishment accept */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_PDUSessionResourceSetup,
+            test_ue->ngap_procedure_code);
+
+    /* Send PDUSessionResourceSetupResponse */
+    sendbuf = testngap_sess_build_pdu_session_resource_setup_response(sess);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    ogs_msleep(100);
+
+    /* Send UEContextReleaseRequest */
+    sendbuf = testngap_build_ue_context_release_request(test_ue,
+            NGAP_Cause_PR_radioNetwork, NGAP_CauseRadioNetwork_user_inactivity,
+            true);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Registration request
+     * - Update Registration request type
+     * - Uplink Data Status */
+    test_ue->nas.registration.value =
+        OGS_NAS_5GS_REGISTRATION_TYPE_MOBILITY_UPDATING;
+
+    test_ue->registration_request_param.uplink_data_status = 1;
+    test_ue->registration_request_param.psimask.uplink_data_status =
+        1 << sess->psi;
+    nasbuf = testgmm_build_registration_request(test_ue, NULL, false, false);
+    ABTS_PTR_NOTNULL(tc, nasbuf);
+
+    memset(&test_ue->registration_request_param, 0,
+            sizeof(test_ue->registration_request_param));
+    test_ue->registration_request_param.guti = 1;
+    gmmbuf = testgmm_build_registration_request(test_ue, nasbuf, true, false);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+
+    sendbuf = testngap_build_initial_ue_message(test_ue, gmmbuf,
+                NGAP_RRCEstablishmentCause_mo_Signalling, true, true);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive UEContextReleaseCommand */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_UEContextRelease,
+            test_ue->ngap_procedure_code);
+
+    /* Send UEContextReleaseComplete */
+    sendbuf = testngap_build_ue_context_release_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive InitialContextSetupRequest +
+     * Registration accept */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_InitialContextSetup,
+            test_ue->ngap_procedure_code);
+    ABTS_INT_EQUAL(tc, 0x0000, test_ue->pdu_session_reactivation_result);
+
+    /* Send Registration complete */
+    gmmbuf = testgmm_build_registration_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send InitialContextSetupResponse */
+    sendbuf = testngap_build_initial_context_setup_response(test_ue, true);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Configuration update command */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    /* Send UEContextReleaseRequest */
+    sendbuf = testngap_build_ue_context_release_request(test_ue,
+            NGAP_Cause_PR_radioNetwork, NGAP_CauseRadioNetwork_user_inactivity,
+            true);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive UEContextReleaseCommand */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_UEContextRelease,
+            test_ue->ngap_procedure_code);
+
+    /* Send UEContextReleaseComplete */
+    sendbuf = testngap_build_ue_context_release_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    ogs_msleep(300);
+
+    /********** Remove Subscriber in Database */
+    ABTS_INT_EQUAL(tc, OGS_OK, test_db_remove_ue(test_ue));
+
+    /* gNB disonncect from UPF */
+    testgnb_gtpu_close(gtpu);
+
+    /* gNB disonncect from AMF */
+    testgnb_ngap_close(ngap);
+
+    /* Clear Test UE Context */
+    test_ue_remove(test_ue);
+}
+
 #define CONTEXT_TRANSFER_TEST 0
 #define OLD_AMF_NOT_FOUND 0
 
@@ -2006,7 +2319,8 @@
     abts_run_test(suite, test1_func, NULL);
     abts_run_test(suite, test2_func, NULL);
     abts_run_test(suite, test3_func, NULL);
-    abts_run_test(suite, test4_issues2839_func, NULL);
+    abts_run_test(suite, test_issues2839_func, NULL);
+    abts_run_test(suite, test_issues4174_func, NULL);
 #else
     abts_run_test(suite, context_transfer_func, NULL);
 #endif

open5gs_2.7.6.tar.xz/tests/registration/multi-ue-test.c -> open5gs_2.7.7.tar.xz/tests/registration/multi-ue-test.c Changed

open5gs_2.7.6.tar.xz/tests/registration/simple-test.c -> open5gs_2.7.7.tar.xz/tests/registration/simple-test.c Changed

@@ -19,6 +19,8 @@
 
 #include "test-common.h"
 
+#define ENABLE_SMF_INITIATED_SESSION_RELEASE 0
+
 static void test1_func(abts_case *tc, void *data)
 {
     int rv;
@@ -258,6 +260,44 @@
     ogs_pkbuf_free(recvbuf);
 #endif
 
+#if ENABLE_SMF_INITIATED_SESSION_RELEASE
+    /* Receive PDUSessionResourceReleaseCommand +
+     * DL NAS transport +
+     * PDU session release command */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_PDUSessionResourceRelease,
+            test_ue->ngap_procedure_code);
+
+    /* Send PDUSessionResourceReleaseResponse */
+    sendbuf = testngap_build_pdu_session_resource_release_response(sess);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send UplinkNASTransport +
+     * UL NAS trasnport +
+     * PDU session resource release complete */
+    sess->ul_nas_transport_param.request_type = 0;
+    sess->ul_nas_transport_param.dnn = 0;
+    sess->ul_nas_transport_param.s_nssai = 0;
+
+    sess->pdu_session_establishment_param.ssc_mode = 0;
+    sess->pdu_session_establishment_param.epco = 0;
+
+    gsmbuf = testgsm_build_pdu_session_release_complete(sess);
+    ABTS_PTR_NOTNULL(tc, gsmbuf);
+    gmmbuf = testgmm_build_ul_nas_transport(sess,
+            OGS_NAS_PAYLOAD_CONTAINER_N1_SM_INFORMATION, gsmbuf);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+#endif
+
     /* Send UEContextReleaseRequest */
     sendbuf = testngap_build_ue_context_release_request(test_ue,
             NGAP_Cause_PR_radioNetwork, NGAP_CauseRadioNetwork_user_inactivity,

open5gs_2.7.6.tar.xz/tests/unit/proto-message-test.c -> open5gs_2.7.7.tar.xz/tests/unit/proto-message-test.c Changed

@@ -49,29 +49,29 @@
 
 static void proto_message_test2(abts_case *tc, void *data)
 {
-    char *home_network_domain = NULL;
+    char *dnn_oi = NULL;
     char *full_dnn = NULL;
     char dnn_niOGS_MAX_DNN_LEN+1;
     ogs_plmn_id_t plmn_id1, plmn_id2;
 
     ogs_plmn_id_build(&plmn_id1, 456, 123, 3);
-    home_network_domain = ogs_home_network_domain_from_plmn_id(&plmn_id1);
+    dnn_oi = ogs_dnn_oi_from_plmn_id(&plmn_id1);
     ABTS_STR_EQUAL(tc,
-            "5gc.mnc123.mcc456.3gppnetwork.org", home_network_domain);
-    full_dnn = ogs_msprintf("internet.realm.%s", home_network_domain);
+            "mnc123.mcc456.gprs", dnn_oi);
+    full_dnn = ogs_msprintf("internet.realm.%s", dnn_oi);
     ABTS_STR_EQUAL(tc,
-            "internet.realm.5gc.mnc123.mcc456.3gppnetwork.org", full_dnn);
+            "internet.realm.mnc123.mcc456.gprs", full_dnn);
     ABTS_STR_EQUAL(tc,
-            home_network_domain, ogs_home_network_domain_from_fqdn(full_dnn));
+            dnn_oi, ogs_dnn_oi_from_fqdn(full_dnn));
 
     ogs_cpystrn(dnn_ni, full_dnn,
             ogs_min(OGS_MAX_DNN_LEN,
-                ogs_home_network_domain_from_fqdn(full_dnn) - full_dnn));
+                ogs_dnn_oi_from_fqdn(full_dnn) - full_dnn));
     ABTS_STR_EQUAL(tc, "internet.realm", dnn_ni);
 
     ABTS_INT_EQUAL(tc, 456, ogs_plmn_id_mcc_from_fqdn(full_dnn));
     ABTS_INT_EQUAL(tc, 123, ogs_plmn_id_mnc_from_fqdn(full_dnn));
-    ogs_free(home_network_domain);
+    ogs_free(dnn_oi);
     ogs_free(full_dnn);
 }

open5gs_2.7.6.tar.xz/tests/volte/rx-test.c -> open5gs_2.7.7.tar.xz/tests/volte/rx-test.c Changed

open5gs_2.7.6.tar.xz/tests/volte/session-test.c -> open5gs_2.7.7.tar.xz/tests/volte/session-test.c Changed

@@ -364,11 +364,660 @@
     test_ue_remove(test_ue);
 }
 
+static void test2_func(abts_case *tc, void *data)
+{
+    int rv;
+    ogs_socknode_t *s1ap;
+    ogs_socknode_t *gtpu;
+    ogs_pkbuf_t *emmbuf;
+    ogs_pkbuf_t *esmbuf;
+    ogs_pkbuf_t *sendbuf;
+    ogs_pkbuf_t *recvbuf;
+    ogs_s1ap_message_t message;
+
+    ogs_nas_5gs_mobile_identity_suci_t mobile_identity_suci;
+    test_ue_t *test_ue = NULL;
+    test_sess_t *sess = NULL;
+    test_bearer_t *bearer = NULL;
+
+    uint32_t enb_ue_s1ap_id;
+
+    bson_t *doc = NULL;
+
+    /* Setup Test UE & Session Context */
+    memset(&mobile_identity_suci, 0, sizeof(mobile_identity_suci));
+
+    mobile_identity_suci.h.supi_format = OGS_NAS_5GS_SUPI_FORMAT_IMSI;
+    mobile_identity_suci.h.type = OGS_NAS_5GS_MOBILE_IDENTITY_SUCI;
+    mobile_identity_suci.routing_indicator1 = 0;
+    mobile_identity_suci.routing_indicator2 = 0xf;
+    mobile_identity_suci.routing_indicator3 = 0xf;
+    mobile_identity_suci.routing_indicator4 = 0xf;
+    mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
+    mobile_identity_suci.home_network_pki_value = 0;
+
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "1032548691");
+    ogs_assert(test_ue);
+
+    test_ue->e_cgi.cell_id = 0x1079baf;
+    test_ue->nas.ksi = OGS_NAS_KSI_NO_KEY_IS_AVAILABLE;
+    test_ue->nas.value = OGS_NAS_ATTACH_TYPE_COMBINED_EPS_IMSI_ATTACH;
+
+    test_ue->k_string = "465b5ce8b199b49faa5f0a2ee238a6bc";
+    test_ue->opc_string = "e8ed289deba952e4283b54e88e6183ca";
+
+    sess = test_sess_add_by_apn(test_ue, "internet", OGS_GTP2_RAT_TYPE_EUTRAN);
+    ogs_assert(sess);
+
+    /* eNB connects to MME */
+    s1ap = tests1ap_client(AF_INET);
+    ABTS_PTR_NOTNULL(tc, s1ap);
+
+    /* eNB connects to SGW */
+    gtpu = test_gtpu_server(1, AF_INET);
+    ABTS_PTR_NOTNULL(tc, gtpu);
+
+    /* Send S1-Setup Reqeust */
+    sendbuf = test_s1ap_build_s1_setup_request(
+            S1AP_ENB_ID_PR_macroENB_ID, 0x54f64);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive S1-Setup Response */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(NULL, recvbuf);
+
+    /********** Insert Subscriber in Database */
+    doc = test_db_new_session(test_ue);
+    ABTS_PTR_NOTNULL(tc, doc);
+    ABTS_INT_EQUAL(tc, OGS_OK, test_db_insert_ue(test_ue, doc));
+
+    /* Send Attach Request */
+    memset(&sess->pdn_connectivity_param,
+            0, sizeof(sess->pdn_connectivity_param));
+    sess->pdn_connectivity_param.eit = 1;
+    sess->pdn_connectivity_param.request_type =
+        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+
+    memset(&test_ue->attach_request_param,
+            0, sizeof(test_ue->attach_request_param));
+    test_ue->attach_request_param.drx_parameter = 1;
+    test_ue->attach_request_param.ms_network_capability = 1;
+    test_ue->attach_request_param.tmsi_status = 1;
+    test_ue->attach_request_param.mobile_station_classmark_2 = 1;
+    test_ue->attach_request_param.ue_usage_setting = 1;
+    emmbuf = testemm_build_attach_request(test_ue, esmbuf, true, false);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+
+    memset(&test_ue->initial_ue_param, 0, sizeof(test_ue->initial_ue_param));
+    sendbuf = test_s1ap_build_initial_ue_message(
+            test_ue, emmbuf, S1AP_RRC_Establishment_Cause_mo_Signalling, false);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Authentication Request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send Authentication response */
+    emmbuf = testemm_build_authentication_response(test_ue);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Security mode Command */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send Security mode complete */
+    test_ue->mobile_identity_imeisv_presence = true;
+    emmbuf = testemm_build_security_mode_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive ESM Information Request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send ESM Information Response */
+    sess->esm_information_param.pco = 1;
+    esmbuf = testesm_build_esm_information_response(sess);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Initial Context Setup Request +
+     * Attach Accept +
+     * Activate Default Bearer Context Request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send UE Capability Info Indication */
+    sendbuf = tests1ap_build_ue_radio_capability_info_indication(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Initial Context Setup Response */
+    sendbuf = test_s1ap_build_initial_context_setup_response(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Attach Complete + Activate default EPS bearer cotext accept */
+    test_ue->nr_cgi.cell_id = 0x1234502;
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 5);
+    ogs_assert(bearer);
+    esmbuf = testesm_build_activate_default_eps_bearer_context_accept(
+            bearer, false);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    emmbuf = testemm_build_attach_complete(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive EMM information */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send PDN Connectivity Request */
+    sess = test_sess_add_by_apn(test_ue, "ims", OGS_GTP2_RAT_TYPE_EUTRAN);
+    ogs_assert(sess);
+    sess->pti = 5;
+
+    sess->pdn_connectivity_param.apn = 1;
+    sess->pdn_connectivity_param.pco = 1;
+    sess->pdn_connectivity_param.request_type =
+        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive E-RABSetupRequest +
+     * Activate default EPS bearer context request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            S1AP_ProcedureCode_id_E_RABSetup,
+            test_ue->s1ap_procedure_code);
+
+    /* Send E-RABSetupResponse */
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 6);
+    ogs_assert(bearer);
+    sendbuf = test_s1ap_build_e_rab_setup_response(bearer);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Activate default EPS bearer context accept */
+    esmbuf = testesm_build_activate_default_eps_bearer_context_accept(
+            bearer, true);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive E-RABSetupRequest +
+     * Activate dedicated EPS bearer context request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            S1AP_ProcedureCode_id_E_RABSetup,
+            test_ue->s1ap_procedure_code);
+
+    /* Send Activate dedicated EPS bearer context accept */
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
+    ogs_assert(bearer);
+    esmbuf = testesm_build_activate_dedicated_eps_bearer_context_accept(bearer);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send E-RABSetupResponse */
+    sendbuf = test_s1ap_build_e_rab_setup_response(bearer);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* DELAY is needed in dedicated EPS bearer */
+    ogs_msleep(100);
+
+    /* Send GTP-U ICMP Packet */
+    rv = test_gtpu_send_ping(gtpu, bearer, TEST_PING_IPV4);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive GTP-U ICMP Packet */
+    recvbuf = test_gtpu_read(gtpu);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    ogs_pkbuf_free(recvbuf);
+
+    /* Send TAU Request */
+    memset(&test_ue->tau_request_param, 0, sizeof(test_ue->tau_request_param));
+    test_ue->tau_request_param.ue_network_capability = 1;
+    test_ue->tau_request_param.last_visited_registered_tai = 1;
+    test_ue->tau_request_param.drx_parameter = 1;
+    test_ue->tau_request_param.eps_bearer_context_status =
+        0x20; /* EBI:5-ACTIVE, EBI:6-Inactive, EBI:7-Inactive */
+    test_ue->tau_request_param.ms_network_capability = 1;
+    test_ue->tau_request_param.tmsi_status = 1;
+    test_ue->tau_request_param.mobile_station_classmark_2 = 1;
+    test_ue->tau_request_param.ue_usage_setting = 1;
+    test_ue->tau_request_param.device_properties = 1;
+    emmbuf = testemm_build_tau_request(
+            test_ue, false,
+            OGS_NAS_EPS_UPDATE_TYPE_COMBINED_TA_LA_UPDATING_WITH_IMSI_ATTACH,
+            true, true);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+    sendbuf = test_s1ap_build_initial_ue_message(
+            test_ue, emmbuf, S1AP_RRC_Establishment_Cause_mo_Signalling, true);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive OLD UEContextReleaseCommand */
+    enb_ue_s1ap_id = test_ue->enb_ue_s1ap_id;
+
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send OLD UEContextReleaseComplete */
+    sendbuf = test_s1ap_build_ue_context_release_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    test_ue->enb_ue_s1ap_id = enb_ue_s1ap_id;
+
+    /* Receive TAU Accept */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Receive UEContextReleaseCommand */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send UEContextReleaseComplete */
+    sendbuf = test_s1ap_build_ue_context_release_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    ogs_msleep(300);
+
+    /********** Remove Subscriber in Database */
+    ABTS_INT_EQUAL(tc, OGS_OK, test_db_remove_ue(test_ue));
+
+    /* eNB disonncect from MME */
+    testenb_s1ap_close(s1ap);
+
+    /* eNB disonncect from SGW */
+    test_gtpu_close(gtpu);
+
+    test_ue_remove(test_ue);
+}
+
+static void test_issues4141_func(abts_case *tc, void *data)
+{
+    int rv;
+    ogs_socknode_t *s1ap;
+    ogs_socknode_t *gtpu;
+    ogs_pkbuf_t *emmbuf;
+    ogs_pkbuf_t *esmbuf;
+    ogs_pkbuf_t *sendbuf;
+    ogs_pkbuf_t *recvbuf;
+    ogs_s1ap_message_t message;
+
+    ogs_nas_5gs_mobile_identity_suci_t mobile_identity_suci;
+    test_ue_t *test_ue = NULL;
+    test_sess_t *sess = NULL;
+    test_bearer_t *bearer = NULL;
+
+    bson_t *doc = NULL;
+
+    /* Setup Test UE & Session Context */
+    memset(&mobile_identity_suci, 0, sizeof(mobile_identity_suci));
+
+    mobile_identity_suci.h.supi_format = OGS_NAS_5GS_SUPI_FORMAT_IMSI;
+    mobile_identity_suci.h.type = OGS_NAS_5GS_MOBILE_IDENTITY_SUCI;
+    mobile_identity_suci.routing_indicator1 = 0;
+    mobile_identity_suci.routing_indicator2 = 0xf;
+    mobile_identity_suci.routing_indicator3 = 0xf;
+    mobile_identity_suci.routing_indicator4 = 0xf;
+    mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
+    mobile_identity_suci.home_network_pki_value = 0;
+
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "1032548691");
+    ogs_assert(test_ue);
+
+    test_ue->e_cgi.cell_id = 0x1079baf;
+    test_ue->nas.ksi = OGS_NAS_KSI_NO_KEY_IS_AVAILABLE;
+    test_ue->nas.value = OGS_NAS_ATTACH_TYPE_COMBINED_EPS_IMSI_ATTACH;
+
+    test_ue->k_string = "465b5ce8b199b49faa5f0a2ee238a6bc";
+    test_ue->opc_string = "e8ed289deba952e4283b54e88e6183ca";
+
+    sess = test_sess_add_by_apn(test_ue, "internet", OGS_GTP2_RAT_TYPE_EUTRAN);
+    ogs_assert(sess);
+
+    /* eNB connects to MME */
+    s1ap = tests1ap_client(AF_INET);
+    ABTS_PTR_NOTNULL(tc, s1ap);
+
+    /* eNB connects to SGW */
+    gtpu = test_gtpu_server(1, AF_INET);
+    ABTS_PTR_NOTNULL(tc, gtpu);
+
+    /* Send S1-Setup Reqeust */
+    sendbuf = test_s1ap_build_s1_setup_request(
+            S1AP_ENB_ID_PR_macroENB_ID, 0x54f64);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive S1-Setup Response */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(NULL, recvbuf);
+
+    /********** Insert Subscriber in Database */
+    doc = test_db_new_session(test_ue);
+    ABTS_PTR_NOTNULL(tc, doc);
+    ABTS_INT_EQUAL(tc, OGS_OK, test_db_insert_ue(test_ue, doc));
+
+    /* Send Attach Request */
+    memset(&sess->pdn_connectivity_param,
+            0, sizeof(sess->pdn_connectivity_param));
+    sess->pdn_connectivity_param.eit = 1;
+    sess->pdn_connectivity_param.request_type =
+        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+
+    memset(&test_ue->attach_request_param,
+            0, sizeof(test_ue->attach_request_param));
+    test_ue->attach_request_param.drx_parameter = 1;
+    test_ue->attach_request_param.ms_network_capability = 1;
+    test_ue->attach_request_param.tmsi_status = 1;
+    test_ue->attach_request_param.mobile_station_classmark_2 = 1;
+    test_ue->attach_request_param.ue_usage_setting = 1;
+    emmbuf = testemm_build_attach_request(test_ue, esmbuf, true, false);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+
+    memset(&test_ue->initial_ue_param, 0, sizeof(test_ue->initial_ue_param));
+    sendbuf = test_s1ap_build_initial_ue_message(
+            test_ue, emmbuf, S1AP_RRC_Establishment_Cause_mo_Signalling, false);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Authentication Request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send Authentication response */
+    emmbuf = testemm_build_authentication_response(test_ue);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Security mode Command */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send Security mode complete */
+    test_ue->mobile_identity_imeisv_presence = true;
+    emmbuf = testemm_build_security_mode_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive ESM Information Request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send ESM Information Response */
+    sess->esm_information_param.pco = 1;
+    esmbuf = testesm_build_esm_information_response(sess);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive Initial Context Setup Request +
+     * Attach Accept +
+     * Activate Default Bearer Context Request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send UE Capability Info Indication */
+    sendbuf = tests1ap_build_ue_radio_capability_info_indication(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Initial Context Setup Response */
+    sendbuf = test_s1ap_build_initial_context_setup_response(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Attach Complete + Activate default EPS bearer cotext accept */
+    test_ue->nr_cgi.cell_id = 0x1234502;
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 5);
+    ogs_assert(bearer);
+    esmbuf = testesm_build_activate_default_eps_bearer_context_accept(
+            bearer, false);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    emmbuf = testemm_build_attach_complete(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, emmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive EMM information */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send PDN Connectivity Request */
+    sess = test_sess_add_by_apn(test_ue, "ims", OGS_GTP2_RAT_TYPE_EUTRAN);
+    ogs_assert(sess);
+    sess->pti = 5;
+
+    sess->pdn_connectivity_param.apn = 1;
+    sess->pdn_connectivity_param.pco = 1;
+    sess->pdn_connectivity_param.request_type =
+        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive E-RABSetupRequest +
+     * Activate default EPS bearer context request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            S1AP_ProcedureCode_id_E_RABSetup,
+            test_ue->s1ap_procedure_code);
+
+    /* Send E-RABSetupResponse */
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 6);
+    ogs_assert(bearer);
+    sendbuf = test_s1ap_build_e_rab_failed_setup_response(
+            bearer,
+            S1AP_Cause_PR_radioNetwork,
+            S1AP_CauseRadioNetwork_failure_in_radio_interface_procedure);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    ogs_msleep(100);
+
+    /* Again - Send PDN Connectivity Request */
+    sess->pti = 6;
+
+    sess->pdn_connectivity_param.apn = 1;
+    sess->pdn_connectivity_param.pco = 1;
+    sess->pdn_connectivity_param.request_type =
+        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;
+    esmbuf = testesm_build_pdn_connectivity_request(
+            sess, true, OGS_NAS_EPS_PDN_TYPE_IPV4V6);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive E-RABSetupRequest +
+     * Activate default EPS bearer context request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            S1AP_ProcedureCode_id_E_RABSetup,
+            test_ue->s1ap_procedure_code);
+
+    /* Send E-RABSetupResponse */
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 6);
+    ogs_assert(bearer);
+    sendbuf = test_s1ap_build_e_rab_setup_response(bearer);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send Activate default EPS bearer context accept */
+    esmbuf = testesm_build_activate_default_eps_bearer_context_accept(
+            bearer, true);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive E-RABSetupRequest +
+     * Activate dedicated EPS bearer context request */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            S1AP_ProcedureCode_id_E_RABSetup,
+            test_ue->s1ap_procedure_code);
+
+    /* Send Activate dedicated EPS bearer context accept */
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
+    ogs_assert(bearer);
+    esmbuf = testesm_build_activate_dedicated_eps_bearer_context_accept(bearer);
+    ABTS_PTR_NOTNULL(tc, esmbuf);
+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, esmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send E-RABSetupResponse */
+    sendbuf = test_s1ap_build_e_rab_setup_response(bearer);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* DELAY is needed in dedicated EPS bearer */
+    ogs_msleep(100);
+
+    /* Send GTP-U ICMP Packet */
+    rv = test_gtpu_send_ping(gtpu, bearer, TEST_PING_IPV4);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive GTP-U ICMP Packet */
+    recvbuf = test_gtpu_read(gtpu);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    ogs_pkbuf_free(recvbuf);
+
+    /* Send UE Context Release Request */
+    sendbuf = test_s1ap_build_ue_context_release_request(test_ue,
+            S1AP_Cause_PR_radioNetwork, S1AP_CauseRadioNetwork_user_inactivity);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Receive UE Context Release Command */
+    recvbuf = testenb_s1ap_read(s1ap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    tests1ap_recv(test_ue, recvbuf);
+
+    /* Send UE Context Release Complete */
+    sendbuf = test_s1ap_build_ue_context_release_complete(test_ue);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testenb_s1ap_send(s1ap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    ogs_msleep(300);
+
+    /********** Remove Subscriber in Database */
+    ABTS_INT_EQUAL(tc, OGS_OK, test_db_remove_ue(test_ue));
+
+    /* eNB disonncect from MME */
+    testenb_s1ap_close(s1ap);
+
+    /* eNB disonncect from SGW */
+    test_gtpu_close(gtpu);
+
+    test_ue_remove(test_ue);
+}
+
 abts_suite *test_session(abts_suite *suite)
 {
     suite = ADD_SUITE(suite)
 
     abts_run_test(suite, test1_func, NULL);
+    abts_run_test(suite, test2_func, NULL);
+    abts_run_test(suite, test_issues4141_func, NULL);
 
     return suite;
 }

open5gs_2.7.6.tar.xz/tests/volte/video-test.c -> open5gs_2.7.7.tar.xz/tests/volte/video-test.c Changed

@@ -444,7 +444,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABSetupResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 9);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_setup_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -460,7 +460,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send E-RABSetupResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 10);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_setup_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -479,7 +479,7 @@
     ogs_msleep(100);
 
     /* Send GTP-U ICMP Packet */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 9);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     rv = test_gtpu_send_ping(gtpu, bearer, TEST_PING_IPV4);
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
@@ -490,7 +490,7 @@
     ogs_pkbuf_free(recvbuf);
 
     /* Send GTP-U ICMP Packet */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 10);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     rv = test_gtpu_send_ping(gtpu, bearer, TEST_PING_IPV4);
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
@@ -502,7 +502,7 @@
 
     /* Send Bearer resource modification request */
     sess->pti = 20;
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 9);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     esmbuf = testesm_build_bearer_resource_modification_request(
             bearer, OGS_GTP2_TFT_CODE_DELETE_PACKET_FILTERS_FROM_EXISTING, 0,
@@ -523,7 +523,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABReleaseResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 9);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_release_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -531,7 +531,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send Deactivate EPS bearer context accept */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 9);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     esmbuf = testesm_build_deactivate_eps_bearer_context_accept(bearer);
     ABTS_PTR_NOTNULL(tc, esmbuf);
@@ -559,7 +559,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABReleaseResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 10);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_release_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -567,7 +567,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send Deactivate EPS bearer context accept */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 10);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     esmbuf = testesm_build_deactivate_eps_bearer_context_accept(bearer);
     ABTS_PTR_NOTNULL(tc, esmbuf);
@@ -606,7 +606,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABSetupResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 11);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_setup_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -622,7 +622,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send E-RABSetupResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 12);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_setup_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -641,7 +641,7 @@
     ogs_msleep(100);
 
     /* Send GTP-U ICMP Packet */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 11);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     rv = test_gtpu_send_ping(gtpu, bearer, TEST_PING_IPV4);
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
@@ -652,7 +652,7 @@
     ogs_pkbuf_free(recvbuf);
 
     /* Send GTP-U ICMP Packet */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 12);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     rv = test_gtpu_send_ping(gtpu, bearer, TEST_PING_IPV4);
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
@@ -664,7 +664,7 @@
 
     /* Send Bearer resource modification request */
     sess->pti = 30;
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 11);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     esmbuf = testesm_build_bearer_resource_modification_request(
             bearer, OGS_GTP2_TFT_CODE_DELETE_PACKET_FILTERS_FROM_EXISTING, 0,
@@ -685,7 +685,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABReleaseResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 11);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_release_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -693,7 +693,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send Deactivate EPS bearer context accept */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 11);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     esmbuf = testesm_build_deactivate_eps_bearer_context_accept(bearer);
     ABTS_PTR_NOTNULL(tc, esmbuf);
@@ -721,7 +721,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABReleaseResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 12);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_release_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -729,7 +729,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send Deactivate EPS bearer context accept */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 12);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     esmbuf = testesm_build_deactivate_eps_bearer_context_accept(bearer);
     ABTS_PTR_NOTNULL(tc, esmbuf);
@@ -768,7 +768,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABSetupResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 13);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_setup_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -784,7 +784,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send E-RABSetupResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 14);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_setup_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -803,7 +803,7 @@
     ogs_msleep(100);
 
     /* Send GTP-U ICMP Packet */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 13);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     rv = test_gtpu_send_ping(gtpu, bearer, TEST_PING_IPV4);
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
@@ -814,7 +814,7 @@
     ogs_pkbuf_free(recvbuf);
 
     /* Send GTP-U ICMP Packet */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 14);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     rv = test_gtpu_send_ping(gtpu, bearer, TEST_PING_IPV4);
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
@@ -826,7 +826,7 @@
 
     /* Send Bearer resource modification request */
     sess->pti = 40;
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 13);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     esmbuf = testesm_build_bearer_resource_modification_request(
             bearer, OGS_GTP2_TFT_CODE_DELETE_PACKET_FILTERS_FROM_EXISTING, 0,
@@ -847,7 +847,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABReleaseResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 13);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_release_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -855,7 +855,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send Deactivate EPS bearer context accept */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 13);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     esmbuf = testesm_build_deactivate_eps_bearer_context_accept(bearer);
     ABTS_PTR_NOTNULL(tc, esmbuf);
@@ -883,7 +883,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABReleaseResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 14);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_release_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -891,7 +891,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send Deactivate EPS bearer context accept */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 14);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     esmbuf = testesm_build_deactivate_eps_bearer_context_accept(bearer);
     ABTS_PTR_NOTNULL(tc, esmbuf);
@@ -930,7 +930,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABSetupResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 15);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_setup_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -946,7 +946,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send E-RABSetupResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_setup_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -965,7 +965,7 @@
     ogs_msleep(100);
 
     /* Send GTP-U ICMP Packet */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 15);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     rv = test_gtpu_send_ping(gtpu, bearer, TEST_PING_IPV4);
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
@@ -976,7 +976,7 @@
     ogs_pkbuf_free(recvbuf);
 
     /* Send GTP-U ICMP Packet */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     rv = test_gtpu_send_ping(gtpu, bearer, TEST_PING_IPV4);
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
@@ -988,7 +988,7 @@
 
     /* Send Bearer resource modification request */
     sess->pti = 50;
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 15);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     esmbuf = testesm_build_bearer_resource_modification_request(
             bearer, OGS_GTP2_TFT_CODE_DELETE_PACKET_FILTERS_FROM_EXISTING, 0,
@@ -1009,7 +1009,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABReleaseResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 15);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_release_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -1017,7 +1017,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send Deactivate EPS bearer context accept */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 15);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     esmbuf = testesm_build_deactivate_eps_bearer_context_accept(bearer);
     ABTS_PTR_NOTNULL(tc, esmbuf);
@@ -1045,7 +1045,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABReleaseResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_release_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -1053,7 +1053,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send Deactivate EPS bearer context accept */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     esmbuf = testesm_build_deactivate_eps_bearer_context_accept(bearer);
     ABTS_PTR_NOTNULL(tc, esmbuf);
@@ -1092,7 +1092,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABSetupResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_setup_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -1108,7 +1108,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send E-RABSetupResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 9);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_setup_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -1127,7 +1127,7 @@
     ogs_msleep(100);
 
     /* Send GTP-U ICMP Packet */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     rv = test_gtpu_send_ping(gtpu, bearer, TEST_PING_IPV4);
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
@@ -1138,7 +1138,7 @@
     ogs_pkbuf_free(recvbuf);
 
     /* Send GTP-U ICMP Packet */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 9);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     rv = test_gtpu_send_ping(gtpu, bearer, TEST_PING_IPV4);
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
@@ -1150,7 +1150,7 @@
 
     /* Send Bearer resource modification request */
     sess->pti = 55;
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     esmbuf = testesm_build_bearer_resource_modification_request(
             bearer, OGS_GTP2_TFT_CODE_DELETE_PACKET_FILTERS_FROM_EXISTING, 0,
@@ -1171,7 +1171,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABReleaseResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_release_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -1179,7 +1179,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send Deactivate EPS bearer context accept */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 7);
     ogs_assert(bearer);
     esmbuf = testesm_build_deactivate_eps_bearer_context_accept(bearer);
     ABTS_PTR_NOTNULL(tc, esmbuf);
@@ -1207,7 +1207,7 @@
             test_ue->s1ap_procedure_code);
 
     /* Send E-RABReleaseResponse */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 9);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     sendbuf = test_s1ap_build_e_rab_release_response(bearer);
     ABTS_PTR_NOTNULL(tc, sendbuf);
@@ -1215,7 +1215,7 @@
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
     /* Send Deactivate EPS bearer context accept */
-    bearer = test_bearer_find_by_ue_ebi(test_ue, 9);
+    bearer = test_bearer_find_by_ue_ebi(test_ue, 8);
     ogs_assert(bearer);
     esmbuf = testesm_build_deactivate_eps_bearer_context_accept(bearer);
     ABTS_PTR_NOTNULL(tc, esmbuf);

open5gs_2.7.6.tar.xz/tests/vonr/af-test.c -> open5gs_2.7.7.tar.xz/tests/vonr/af-test.c Changed

@@ -60,7 +60,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000001");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -740,7 +740,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000002");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -1215,7 +1215,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000003");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -1670,7 +1670,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000004");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -2296,7 +2296,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000005");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -3013,7 +3013,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000006");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -3550,7 +3550,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000007");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -3966,6 +3966,18 @@
     test_ue_remove(test_ue);
 }
 
+#if !HOME_ROUTED_ROAMING_TEST
+/**
+ * test8_func:
+ *   - Simulates absence of N2 Resource Release Ack (step 8)
+ *     and PDU Session Release Accept (step 11) from gNB/UE.
+ *   - In Home Routed Roaming, V-SMF will not send the
+ *     Nsmf_PDUSession_Update Response (step 14), causing
+ *     the SBI client to timeout after 10 seconds.
+ *   - Subsequent deregistration triggers a PFCP deactivation
+ *     modification, but UPF has no session, leading to
+ *     a No Context error.
+ */
 static void test8_func(abts_case *tc, void *data)
 {
     int rv;
@@ -4003,7 +4015,7 @@
     mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;
     mobile_identity_suci.home_network_pki_value = 0;
 
-    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000203190");
+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "0000000008");
     ogs_assert(test_ue);
 
     test_ue->nr_cgi.cell_id = 0x40001;
@@ -4327,12 +4339,19 @@
     /* Clear Test UE Context */
     test_ue_remove(test_ue);
 }
+#endif
 
 
 abts_suite *test_af(abts_suite *suite)
 {
     suite = ADD_SUITE(suite)
 
+/**
+ * abts_suite test_af:
+ *   - Always run test1_func through test7_func.
+ *   - Conditionally include test8_func based on
+ *     HOME_ROUTED_ROAMING_TEST flag.
+ */
     abts_run_test(suite, test1_func, NULL);
     abts_run_test(suite, test2_func, NULL);
     abts_run_test(suite, test3_func, NULL);
@@ -4340,7 +4359,9 @@
     abts_run_test(suite, test5_func, NULL);
     abts_run_test(suite, test6_func, NULL);
     abts_run_test(suite, test7_func, NULL);
+#if !HOME_ROUTED_ROAMING_TEST
     abts_run_test(suite, test8_func, NULL);
+#endif
 
     return suite;
 }

open5gs_2.7.6.tar.xz/tests/vonr/session-test.c -> open5gs_2.7.7.tar.xz/tests/vonr/session-test.c Changed

@@ -1367,6 +1367,8 @@
 
     bson_t *doc = NULL;
 
+    NGAP_ProcedureCode_t ngap_procedure_code;
+
     /* Setup Test UE & Session Context */
     memset(&mobile_identity_suci, 0, sizeof(mobile_identity_suci));
 
@@ -1551,23 +1553,62 @@
     rv = testgnb_ngap_send(ngap, sendbuf);
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
 
-    /* Receive PDUSessionResourceSetupRequest +
+    /*
+     * Receive PDUSessionResourceSetupRequest +
+     * DL NAS transport +
+     * PDU session establishment accept
+     *
+     * OR
+     *
+     * Receive PDUSessionResourceModifyRequest +
      * DL NAS transport +
-     * PDU session establishment accept */
+     * PDU session modification command
+     */
     recvbuf = testgnb_ngap_read(ngap);
     ABTS_PTR_NOTNULL(tc, recvbuf);
     testngap_recv(test_ue, recvbuf);
-    ABTS_INT_EQUAL(tc,
-            NGAP_ProcedureCode_id_PDUSessionResourceSetup,
-            test_ue->ngap_procedure_code);
 
-    /* Receive PDU session establishment accept */
+    ngap_procedure_code = test_ue->ngap_procedure_code;
+
+    /*
+     * Receive PDUSessionResourceSetupRequest +
+     * DL NAS transport +
+     * PDU session establishment accept
+     *
+     * OR
+     *
+     * Receive PDUSessionResourceModifyRequest +
+     * DL NAS transport +
+     * PDU session modification command
+     */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+
+    ngap_procedure_code += test_ue->ngap_procedure_code;
+
+    /*
+     * Receive PDUSessionResourceSetupRequest +
+     * DL NAS transport +
+     * PDU session establishment accept
+     *
+     * OR
+     *
+     * Receive PDUSessionResourceModifyRequest +
+     * DL NAS transport +
+     * PDU session modification command
+     */
     recvbuf = testgnb_ngap_read(ngap);
     ABTS_PTR_NOTNULL(tc, recvbuf);
     testngap_recv(test_ue, recvbuf);
+
+    ngap_procedure_code += test_ue->ngap_procedure_code;
+
     ABTS_INT_EQUAL(tc,
-            NGAP_ProcedureCode_id_PDUSessionResourceSetup,
-            test_ue->ngap_procedure_code);
+            NGAP_ProcedureCode_id_PDUSessionResourceSetup +
+            NGAP_ProcedureCode_id_PDUSessionResourceSetup +
+            NGAP_ProcedureCode_id_PDUSessionResourceModify,
+            ngap_procedure_code);
 
     /* Send GTP-U ICMP Packet */
     qos_flow1 = test_qos_flow_find_by_qfi(sess5, 1);
@@ -1601,16 +1642,6 @@
     ABTS_PTR_NOTNULL(tc, recvbuf);
     ogs_pkbuf_free(recvbuf);
 
-    /* Receive PDUSessionResourceModifyRequest +
-     * DL NAS transport +
-     * PDU session modification command */
-    recvbuf = testgnb_ngap_read(ngap);
-    ABTS_PTR_NOTNULL(tc, recvbuf);
-    testngap_recv(test_ue, recvbuf);
-    ABTS_INT_EQUAL(tc,
-            NGAP_ProcedureCode_id_PDUSessionResourceModify,
-            test_ue->ngap_procedure_code);
-
     /* Send PDU session resource modify response */
     qos_flow2 = test_qos_flow_find_by_qfi(sess6, 2);
     ogs_assert(qos_flow2);

open5gs_2.7.6.tar.xz/tests/vonr/simple-test.c -> open5gs_2.7.7.tar.xz/tests/vonr/simple-test.c Changed

@@ -20,6 +20,8 @@
 #include "test-common.h"
 #include "af/sbi-path.h"
 
+#define ENABLE_PCF_INITIATED_SESSION_RELEASE 0
+
 static void test1_func(abts_case *tc, void *data)
 {
     int rv;
@@ -315,6 +317,7 @@
     af_local_send_to_pcf(af_sess, &af_param,
             af_npcf_policyauthorization_build_create);
 
+#if !ENABLE_PCF_INITIATED_SESSION_RELEASE
     /* Receive PDUSessionResourceModifyRequest +
      * DL NAS transport +
      * PDU session modification command */
@@ -411,10 +414,48 @@
     ABTS_PTR_NOTNULL(tc, sendbuf);
     rv = testgnb_ngap_send(ngap, sendbuf);
     ABTS_INT_EQUAL(tc, OGS_OK, rv);
+#else
+    /* Receive PDUSessionResourceReleaseCommand +
+     * DL NAS transport +
+     * PDU session release command */
+    recvbuf = testgnb_ngap_read(ngap);
+    ABTS_PTR_NOTNULL(tc, recvbuf);
+    testngap_recv(test_ue, recvbuf);
+    ABTS_INT_EQUAL(tc,
+            NGAP_ProcedureCode_id_PDUSessionResourceRelease,
+            test_ue->ngap_procedure_code);
+
+    /* Send PDUSessionResourceReleaseResponse */
+    sendbuf = testngap_build_pdu_session_resource_release_response(sess);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+
+    /* Send UplinkNASTransport +
+     * UL NAS trasnport +
+     * PDU session resource release complete */
+    sess->ul_nas_transport_param.request_type = 0;
+    sess->ul_nas_transport_param.dnn = 0;
+    sess->ul_nas_transport_param.s_nssai = 0;
+
+    sess->pdu_session_establishment_param.ssc_mode = 0;
+    sess->pdu_session_establishment_param.epco = 0;
+
+    gsmbuf = testgsm_build_pdu_session_release_complete(sess);
+    ABTS_PTR_NOTNULL(tc, gsmbuf);
+    gmmbuf = testgmm_build_ul_nas_transport(sess,
+            OGS_NAS_PAYLOAD_CONTAINER_N1_SM_INFORMATION, gsmbuf);
+    ABTS_PTR_NOTNULL(tc, gmmbuf);
+    sendbuf = testngap_build_uplink_nas_transport(test_ue, gmmbuf);
+    ABTS_PTR_NOTNULL(tc, sendbuf);
+    rv = testgnb_ngap_send(ngap, sendbuf);
+    ABTS_INT_EQUAL(tc, OGS_OK, rv);
+#endif
 
     /* Wait for PDU session resource modify complete */
     ogs_msleep(100);
 
+#if !ENABLE_PCF_INITIATED_SESSION_RELEASE
     /* Test Bearer Remove */
     test_bearer_remove(qos_flow);
 
@@ -431,6 +472,7 @@
 
     /* Wait for PDU session resource modify complete */
     ogs_msleep(100);
+#endif
 
     /* Send UEContextReleaseRequest */
     sendbuf = testngap_build_ue_context_release_request(test_ue,

open5gs_2.7.6.tar.xz/webui/package-lock.json -> open5gs_2.7.7.tar.xz/webui/package-lock.json Changed

open5gs_2.7.6.tar.xz/webui/package.json -> open5gs_2.7.7.tar.xz/webui/package.json Changed

open5gs_2.7.7.tar.xz/webui/server/ensure-secret.js Added

@@ -0,0 +1,38 @@
+const fs = require('fs');
+const crypto = require('crypto');
+const path = require('path');
+
+const envPath = path.join(__dirname, '../.env');
+
+module.exports = function() {
+    // List of keys we want to ensure exist
+    const keysToEnsure = 'SECRET_KEY', 'JWT_SECRET_KEY';
+
+    let envContent = '';
+    if (fs.existsSync(envPath)) {
+        envContent = fs.readFileSync(envPath, 'utf8');
+    } else {
+        fs.writeFileSync(envPath, '', 'utf8');
+    }
+
+    keysToEnsure.forEach(key => {
+        // Dynamic Regex: looks for the specific key at the start of a line
+        const regex = new RegExp(`^${key}=(.*)$`, 'm');
+        const match = envContent.match(regex);
+
+        if (match && match1) {
+            process.envkey = match1.trim();
+            console.log(`--- ${key} loaded from .env ---`);
+        } else {
+            // Key missing: Generate, Set, and Append
+            const newSecret = crypto.randomBytes(32).toString('hex');
+            process.envkey = newSecret;
+
+            const secretLine = `\n# Generated automatically\n${key}=${newSecret}\n`;
+            fs.appendFileSync(envPath, secretLine, 'utf8');
+            // Update envContent string so the next loop knows this key now exists
+            envContent += secretLine;
+            console.log(`--- Created and stored new unique ${key} ---`);
+        }
+    });
+};

open5gs_2.7.6.tar.xz/webui/server/index.js -> open5gs_2.7.7.tar.xz/webui/server/index.js Changed

open5gs_2.7.6.tar.xz/webui/server/models/profile.js -> open5gs_2.7.7.tar.xz/webui/server/models/profile.js Changed

open5gs_2.7.6.tar.xz/webui/server/models/subscriber.js -> open5gs_2.7.7.tar.xz/webui/server/models/subscriber.js Changed

open5gs_2.7.6.tar.xz/webui/server/routes/auth.js -> open5gs_2.7.7.tar.xz/webui/server/routes/auth.js Changed

open5gs_2.7.6.tar.xz/webui/server/routes/index.js -> open5gs_2.7.7.tar.xz/webui/server/routes/index.js Changed

open5gs_2.7.6.tar.xz/webui/src/components/Profile/Edit.js -> open5gs_2.7.7.tar.xz/webui/src/components/Profile/Edit.js Changed

@@ -114,6 +114,30 @@
         }
       }
     },
+    "subscriber_status": {
+      "type": "number",
+      "title": "Subscriber Status (TS 29.272 7.3.29)",
+      "enum":  0, 1 ,
+      "enumNames": "SERVICE_GRANTED", "OPERATOR_DETERMINED_BARRING",
+      "default": 0,
+    },
+    "operator_determined_barring": {
+      "type": "number",
+      "title": "Operator Determined Barring (TS 29.272 7.3.30)",
+      "enum":  0, 1, 2, 3, 4, 5, 6, 7, 8 ,
+      "enumNames": 
+        "(0) All Packet Oriented Services Barred",
+        "(1) Roamer Access HPLMN-AP Barred",
+        "(2) Roamer Access to VPLMN-AP Barred",
+        "(3) Barring of all outgoing calls",
+        "(4) Barring of all outgoing international calls",
+        "(5) Barring of all outgoing international calls except those directed to the home PLMN country",
+        "(6) Barring of all outgoing inter-zonal calls",
+        "(7) Barring of all outgoing inter-zonal calls except those directed to the home PLMN country",
+        "(8) Barring of all outgoing international calls except those directed to the home PLMN country and Barring of all outgoing inter-zonal calls"
+      ,
+      "default": 0,
+    },
     "slice": {
       "type": "array",
       "title": "Slice Configurations",
@@ -170,6 +194,10 @@
                   "enumNames": "IPv4", "IPv6", "IPv4v6",
                   "default": 3,
                 },
+                "lbo_roaming_allowed": {
+                  "type": "boolean",
+                  "title": "LBO Roaming Allowed",
+                },
                 "qos": {
                   "type": "object",
                   "title": "",
@@ -520,6 +548,9 @@
           "type": {
             classNames: "col-xs-4",
           },
+          "lbo_roaming_allowed": {
+            classNames: "col-xs-12",
+          },
           "qos": {
             classNames: "col-xs-12",
             "index": {

open5gs_2.7.6.tar.xz/webui/src/components/Profile/View.js -> open5gs_2.7.7.tar.xz/webui/src/components/Profile/View.js Changed

@@ -172,6 +172,8 @@
   const imeisv = (profile || {}).imeisv;
   const security = ((profile || {}).security || {});
   const ambr = ((profile || {}).ambr || {});
+  const subscriber_status = (profile || {}).subscriber_status;
+  const operator_determined_barring = (profile || {}).operator_determined_barring;
   const slice_list = ((profile || {}).slice || );
 
   return (
@@ -260,6 +262,23 @@
                 <div className="sectioncolumn">
                   <div className="body">
                     <div className="left">
+                      <SecurityIcon/>
+                    </div>
+                    <div className="right">
+                      <div className="data">
+                        {subscriber_status == 0 ? ( "SERVICE_GRANTED (0)" ) : ( "OPERATOR_DETERMINED_BARRING (1)" )}
+                        <span style={{color:oc.gray5}}><KeyboardControlIcon/>Subscriber Status (TS 29.272 7.3.29)</span>
+                      </div>
+                      <div className="data">
+                        {operator_determined_barring}
+                        <span style={{color:oc.gray5}}><KeyboardControlIcon/>Operator Determined Barring (TS 29.272 7.3.30)</span>
+                      </div>
+                    </div>
+                  </div>
+                </div>
+                <div className="sectioncolumn">
+                  <div className="body">
+                    <div className="left">
                       <PdnIcon/>
                     </div>
                     <div className="right">
@@ -314,6 +333,7 @@
                   <div className="body" style={{color:oc.gray5}}>
                     <div className="large_data">DNN/APN</div>
                     <div className="medium_data">Type</div>
+                    <div className="medium_data">LBO</div>
                     <div className="small_data">5QI/QCI</div>
                     <div className="small_data">ARP</div>
                     <div className="medium_data">Capability</div>
@@ -332,6 +352,10 @@
                             session.type === 3 ? "IPv4v6" :
                             "Unknown"
                         }</div>
+                        <div className="medium_data">{
+                            session.lbo_roaming_allowed == true ? "Allowed" :
+                            "Not allowed"
+                        }</div>
                         <div className="small_data">{session.qos.index}</div>
                         <div className="small_data">{session.qos.arp.priority_level}</div>
                         <div className="medium_data">
@@ -411,6 +435,7 @@
                             <div className="body">
                               <div className="large_data"></div>
                               <div className="medium_data"></div>
+                              <div className="medium_data"></div>
                               <div className="small_data">{pcc_rule.qos.index}</div>
                               <div className="small_data">{pcc_rule.qos.arp.priority_level}</div>
                               <div className="medium_data">

open5gs_2.7.6.tar.xz/webui/src/components/Subscriber/Edit.js -> open5gs_2.7.7.tar.xz/webui/src/components/Subscriber/Edit.js Changed

open5gs_2.7.6.tar.xz/webui/src/components/Subscriber/View.js -> open5gs_2.7.7.tar.xz/webui/src/components/Subscriber/View.js Changed

@@ -359,6 +359,7 @@
                   <div className="body" style={{color:oc.gray5}}>
                     <div className="large_data">DNN/APN</div>
                     <div className="medium_data">Type</div>
+                    <div className="medium_data">LBO</div>
                     <div className="small_data">5QI/QCI</div>
                     <div className="small_data">ARP</div>
                     <div className="medium_data">Capability</div>
@@ -377,6 +378,10 @@
                             session.type === 3 ? "IPv4v6" :
                             "Unknown"
                         }</div>
+                        <div className="medium_data">{
+                            session.lbo_roaming_allowed == true ? "Allowed" :
+                            "Not allowed"
+                        }</div>
                         <div className="small_data">{session.qos.index}</div>
                         <div className="small_data">{session.qos.arp.priority_level}</div>
                         <div className="medium_data">
@@ -456,6 +461,7 @@
                             <div className="body">
                               <div className="large_data"></div>
                               <div className="medium_data"></div>
+                              <div className="medium_data"></div>
                               <div className="small_data">{pcc_rule.qos.index}</div>
                               <div className="small_data">{pcc_rule.qos.arp.priority_level}</div>
                               <div className="medium_data">