@@ -2,7 +2,7 @@

 Source: open5gs

 Binary: open5gs-common, open5gs-mme, open5gs-sgwc, open5gs-smf, open5gs-amf, open5gs-sgwu, open5gs-upf, open5gs-hss, open5gs-pcrf, open5gs-nrf, open5gs-scp, open5gs-sepp, open5gs-ausf, open5gs-udm, open5gs-pcf, open5gs-nssf, open5gs-bsf, open5gs-udr, open5gs, open5gs-dbg

 Architecture: any

-Version: 2.7.2.4536.c888.202411042026

+Version: 2.7.2.4538.4211.202411052026

 Maintainer: Harald Welte <laforge@gnumonks.org>

 Uploaders: Sukchan Lee <acetcom@gmail.com>

 Homepage: https://open5gs.org

@@ -32,8 +32,8 @@

  open5gs-udr deb net optional arch=any

  open5gs-upf deb net optional arch=any

 Checksums-Sha1:

- 1ec9bc6a95f2fe4da094390455921c86c7cf0100 14510900 open5gs_2.7.2.4536.c888.202411042026.tar.xz

+ b44d94f31d41e84a67e35b8ae78bbba8284656d2 14512008 open5gs_2.7.2.4538.4211.202411052026.tar.xz

 Checksums-Sha256:

- a18f3e9dfb5b5108f6b93bbadf893b292a7663c3b47b4f63c61d9dc990dea493 14510900 open5gs_2.7.2.4536.c888.202411042026.tar.xz

+ 5046214c77d12ca2289eba470278bf2cc86e6baffd6b54d30c0c341e251740e8 14512008 open5gs_2.7.2.4538.4211.202411052026.tar.xz

 Files:

- 209e3d71ff442175ba8d2496aacda390 14510900 open5gs_2.7.2.4536.c888.202411042026.tar.xz

+ f7418a2b3b2a9893a3850272f1ea1bb7 14512008 open5gs_2.7.2.4538.4211.202411052026.tar.xz

​

@@ -1 +1 @@

-2.7.2.4536-c888.202411042026

+2.7.2.4538-4211.202411052026

​

@@ -1,8 +1,8 @@

-open5gs (2.7.2.4536.c888.202411042026) unstable; urgency=medium

+open5gs (2.7.2.4538.4211.202411052026) unstable; urgency=medium

   * Automatically generated changelog entry for building the Osmocom nightly feed

- -- Osmocom OBS scripts <info@osmocom.org>  Mon, 04 Nov 2024 20:28:00 +0000

+ -- Osmocom OBS scripts <info@osmocom.org>  Tue, 05 Nov 2024 20:27:58 +0000

 open5gs (2.7.2) unstable; urgency=medium

​

@@ -205,8 +205,10 @@

         bit_string->buf = CALLOC(bit_string->size, sizeof(uint8_t));

         memcpy(bit_string->buf, &ip->addr6, OGS_IPV6_LEN);

         ogs_debug("    IPv6%s", OGS_INET_NTOP(&ip->addr6, buf));

-    } else

-        ogs_assert_if_reached();

+    } else {

+        ogs_error("No IPv4 or IPv6");

+        return OGS_ERROR;

+    }

     return OGS_OK;

 }

​

@@ -699,7 +699,7 @@

     void *data;

 } ogs_pco_id_t;

-#define OGS_MAX_NUM_OF_PROTOCOL_OR_CONTAINER_ID    16

+#define OGS_MAX_NUM_OF_PROTOCOL_OR_CONTAINER_ID    32

 typedef struct ogs_pco_s {

 ED3(uint8_t ext:1;,

     uint8_t spare:4;,

​

@@ -1,5 +1,5 @@

 /*

- * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>

+ * Copyright (C) 2019-2024 by Sukchan Lee <acetcom@gmail.com>

  *

  * This file is part of Open5GS.

  *

@@ -163,7 +163,7 @@

     attach_accept->esm_message_container.buffer = esmbuf->data;

     attach_accept->esm_message_container.length = esmbuf->len;

-    if (mme_ue->next.m_tmsi) {

+    if (MME_NEXT_GUTI_IS_AVAILABLE(mme_ue)) {

         attach_accept->presencemask |= OGS_NAS_EPS_ATTACH_ACCEPT_GUTI_PRESENT;

         ogs_debug("    %s    GUTIG:%d,C:%d,M_TMSI:0x%x",

@@ -207,9 +207,9 @@

     eps_network_feature_support->ims_voice_over_ps_session_in_s1_mode = 1;

     eps_network_feature_support->extended_protocol_configuration_options = 1;

-    if (MME_P_TMSI_IS_AVAILABLE(mme_ue)) {

+    if (MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue)) {

         ogs_assert(mme_ue->csmap);

-        ogs_assert(mme_ue->p_tmsi);

+        ogs_assert(mme_ue->next.p_tmsi);

         attach_accept->presencemask |=

             OGS_NAS_EPS_ATTACH_ACCEPT_LOCATION_AREA_IDENTIFICATION_PRESENT;

@@ -224,7 +224,7 @@

         tmsi->spare = 0xf;

         tmsi->odd_even = 0;

         tmsi->type = OGS_NAS_MOBILE_IDENTITY_TMSI;

-        tmsi->tmsi = mme_ue->p_tmsi;

+        tmsi->tmsi = mme_ue->next.p_tmsi;

         ogs_debug("    P-TMSI: 0x%08x", tmsi->tmsi);

     }

@@ -494,6 +494,10 @@

     ogs_nas_eps_tracking_area_update_accept_t *tau_accept =

         &message.emm.tracking_area_update_accept;

     ogs_nas_eps_mobile_identity_t *nas_guti = &tau_accept->guti;

+    ogs_nas_location_area_identification_t *lai =

+        &tau_accept->location_area_identification;

+    ogs_nas_mobile_identity_t *ms_identity = &tau_accept->ms_identity;

+    ogs_nas_mobile_identity_tmsi_t *tmsi = &ms_identity->tmsi;;

     ogs_nas_gprs_timer_t *t3412_value = &tau_accept->t3412_value;

     ogs_nas_gprs_timer_t *t3402_value = &tau_accept->t3402_value;

     ogs_nas_gprs_timer_t *t3423_value = &tau_accept->t3423_value;

@@ -530,7 +534,7 @@

             OGS_NAS_EPS_TRACKING_AREA_UPDATE_ACCEPT_T3412_VALUE_PRESENT ;

     }

-    if (mme_ue->next.m_tmsi) {

+    if (MME_NEXT_GUTI_IS_AVAILABLE(mme_ue)) {

         tau_accept->presencemask |=

             OGS_NAS_EPS_TRACKING_AREA_UPDATE_ACCEPT_GUTI_PRESENT;

@@ -595,6 +599,27 @@

         sess = mme_sess_next(sess);

     }

+    /* Location Area Identification & MS Identity */

+    if (MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue)) {

+        ogs_assert(mme_ue->csmap);

+        ogs_assert(mme_ue->next.p_tmsi);

+

+        tau_accept->presencemask |= OGS_NAS_EPS_TRACKING_AREA_UPDATE_ACCEPT_LOCATION_AREA_IDENTIFICATION_PRESENT;

+        lai->nas_plmn_id = mme_ue->csmap->lai.nas_plmn_id;

+        lai->lac = mme_ue->csmap->lai.lac;

+        ogs_debug("    LAIPLMN_ID:%06x,LAC:%d",

+                ogs_plmn_id_hexdump(&lai->nas_plmn_id), lai->lac);

+

+        tau_accept->presencemask |=

+            OGS_NAS_EPS_TRACKING_AREA_UPDATE_ACCEPT_MS_IDENTITY_PRESENT;

+        ms_identity->length = 5;

+        tmsi->spare = 0xf;

+        tmsi->odd_even = 0;

+        tmsi->type = OGS_NAS_MOBILE_IDENTITY_TMSI;

+        tmsi->tmsi = mme_ue->next.p_tmsi;

+        ogs_debug("    P-TMSI: 0x%08x", tmsi->tmsi);

+    }

+

     /* Set T3402 */

     if (mme_self()->time.t3402.value) {

         rv = ogs_nas_gprs_timer_from_sec(

​

@@ -260,7 +260,7 @@

              * the network, the network shall implicitly detach the UE.

              */

             mme_ue->detach_type = MME_DETACH_TYPE_MME_IMPLICIT;

-            if (MME_P_TMSI_IS_AVAILABLE(mme_ue)) {

+            if (MME_CURRENT_P_TMSI_IS_AVAILABLE(mme_ue)) {

                 ogs_assert(OGS_OK == sgsap_send_detach_indication(mme_ue));

             } else {

                 enb_ue_t *enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);

@@ -519,6 +519,8 @@

                              rai.lai.lac, rai.rac);

                     r = nas_eps_send_tau_reject(enb_ue, mme_ue,

                     OGS_NAS_EMM_CAUSE_UE_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK);

+                    ogs_expect(r == OGS_OK);

+                    ogs_assert(r != OGS_ERROR);

                     OGS_FSM_TRAN(s, &emm_state_exception);

                     break;

                 }

@@ -637,9 +639,36 @@

              * 10. UplinkNASTransport + Tracking area update complete (Target)

              */

-            if (e->s1ap_code == S1AP_ProcedureCode_id_initialUEMessage) {

-                ogs_debug("    Iniital UE Message");

-                if (mme_ue->nas_eps.update.active_flag) {

+            /* Update CSMAP from Tracking area update request */

+            mme_ue->csmap = mme_csmap_find_by_tai(&mme_ue->tai);

+            if (mme_ue->csmap &&

+                mme_ue->network_access_mode ==

+                    OGS_NETWORK_ACCESS_MODE_PACKET_AND_CIRCUIT &&

+                (mme_ue->nas_eps.update.value ==

+                 OGS_NAS_EPS_UPDATE_TYPE_COMBINED_TA_LA_UPDATING ||

+                 mme_ue->nas_eps.update.value ==

+                 OGS_NAS_EPS_UPDATE_TYPE_COMBINED_TA_LA_UPDATING_WITH_IMSI_ATTACH)) {

+

+                if (e->s1ap_code == S1AP_ProcedureCode_id_initialUEMessage)

+                    mme_ue->tracking_area_update_request_type =

+                        MME_TAU_TYPE_INITIAL_UE_MESSAGE;

+                else if (e->s1ap_code ==

+                        S1AP_ProcedureCode_id_uplinkNASTransport)

+                    mme_ue->tracking_area_update_request_type =

+                        MME_TAU_TYPE_UPLINK_NAS_TRANPORT;

+                else {

+                    ogs_error("Invalid Procedure Code%d", (int)e->s1ap_code);

+                    break;

+                }

+

+                ogs_assert(OGS_OK ==

+                    sgsap_send_location_update_request(mme_ue));

+

+            } else {

+

+                if (e->s1ap_code == S1AP_ProcedureCode_id_initialUEMessage) {

+                    ogs_debug("    Iniital UE Message");

+                    if (mme_ue->nas_eps.update.active_flag) {

     /*

      * TS33.401

@@ -652,39 +681,52 @@

      * UP data or pending downlink signalling, radio bearers will be established

      * as part of the TAU procedure and a KeNB derivation is necessary.

      */

-                    ogs_kdf_kenb(mme_ue->kasme, mme_ue->ul_count.i32,

-                            mme_ue->kenb);

-                    ogs_kdf_nh_enb(mme_ue->kasme, mme_ue->kenb, mme_ue->nh);

-                    mme_ue->nhcc = 1;

+                        ogs_kdf_kenb(mme_ue->kasme, mme_ue->ul_count.i32,

+                                mme_ue->kenb);

+                        ogs_kdf_nh_enb(mme_ue->kasme, mme_ue->kenb, mme_ue->nh);

+                        mme_ue->nhcc = 1;

-                    r = nas_eps_send_tau_accept(mme_ue,

-                            S1AP_ProcedureCode_id_InitialContextSetup);

-                    ogs_expect(r == OGS_OK);

-                    ogs_assert(r != OGS_ERROR);

-                } else {

+                        r = nas_eps_send_tau_accept(mme_ue,

+                                S1AP_ProcedureCode_id_InitialContextSetup);

+                        ogs_expect(r == OGS_OK);

+                        ogs_assert(r != OGS_ERROR);

+                    } else {

+                        r = nas_eps_send_tau_accept(mme_ue,

+                                S1AP_ProcedureCode_id_downlinkNASTransport);

+                        ogs_expect(r == OGS_OK);

+                        ogs_assert(r != OGS_ERROR);

+                    }

+                } else if (e->s1ap_code ==

+                        S1AP_ProcedureCode_id_uplinkNASTransport) {

+                    ogs_debug("    Uplink NAS Transport");

                     r = nas_eps_send_tau_accept(mme_ue,

                             S1AP_ProcedureCode_id_downlinkNASTransport);

                     ogs_expect(r == OGS_OK);

                     ogs_assert(r != OGS_ERROR);

+                } else {

+                    ogs_error("Invalid Procedure Code%d", (int)e->s1ap_code);

+                    break;

                 }

-            } else if (e->s1ap_code ==

-                    S1AP_ProcedureCode_id_uplinkNASTransport) {

-                ogs_debug("    Uplink NAS Transport");

-                r = nas_eps_send_tau_accept(mme_ue,

-                        S1AP_ProcedureCode_id_downlinkNASTransport);

-                ogs_expect(r == OGS_OK);

-                ogs_assert(r != OGS_ERROR);

-            } else {

-                ogs_fatal("Invalid Procedure Code%d", (int)e->s1ap_code);

-            }

-            if (!mme_ue->nas_eps.update.active_flag) {

-                enb_ue->relcause.group = S1AP_Cause_PR_nas;

-                enb_ue->relcause.cause = S1AP_CauseNas_normal_release;

-                mme_send_release_access_bearer_or_ue_context_release(enb_ue);

+        /*

+         * When active_flag is 0, check if the P-TMSI has been updated.

+         * If the P-TMSI has changed, wait to receive the TAU Complete message

+         * from the UE before sending the UEContextReleaseCommand.

+         *

+         * This ensures that the UE has acknowledged the new P-TMSI,

+         * allowing the TAU procedure to complete successfully

+         * and maintaining synchronization between the UE and the network.

+         */

+                if (!mme_ue->nas_eps.update.active_flag &&

+                    !MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue)) {

+                    enb_ue->relcause.group = S1AP_Cause_PR_nas;

+                    enb_ue->relcause.cause = S1AP_CauseNas_normal_release;

+                    mme_send_release_access_bearer_or_ue_context_release(

+                            enb_ue);

+                }

             }

-            if (mme_ue->next.m_tmsi) {

+            if (MME_NEXT_GUTI_IS_AVAILABLE(mme_ue)) {

                 ogs_fatal("MME does not create new GUTI");

                 ogs_assert_if_reached();

                 OGS_FSM_TRAN(s, &emm_state_initial_context_setup);

@@ -744,7 +786,7 @@

             if (e->s1ap_code == S1AP_ProcedureCode_id_initialUEMessage) {

                 ogs_debug("    Initial UE Message");

-                if (!MME_P_TMSI_IS_AVAILABLE(mme_ue)) {

+                if (!MME_CURRENT_P_TMSI_IS_AVAILABLE(mme_ue)) {

                     ogs_warn("No P-TMSI : UE%s", mme_ue->imsi_bcd);

                     r = nas_eps_send_service_reject(enb_ue, mme_ue,

                         OGS_NAS_EMM_CAUSE_UE_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK);

@@ -791,7 +833,7 @@

                     S1AP_ProcedureCode_id_uplinkNASTransport) {

                 ogs_debug("    Uplink NAS Transport");

-                if (!MME_P_TMSI_IS_AVAILABLE(mme_ue)) {

+                if (!MME_CURRENT_P_TMSI_IS_AVAILABLE(mme_ue)) {

                     ogs_warn("No P-TMSI : UE%s", mme_ue->imsi_bcd);

                     r = nas_eps_send_service_reject(enb_ue, mme_ue,

                         OGS_NAS_EMM_CAUSE_UE_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK);

@@ -874,7 +916,7 @@

              */

             CLEAR_S1_CONTEXT(mme_ue);

-            if (MME_P_TMSI_IS_AVAILABLE(mme_ue)) {

+            if (MME_CURRENT_P_TMSI_IS_AVAILABLE(mme_ue)) {

                 ogs_assert(OGS_OK == sgsap_send_detach_indication(mme_ue));

             } else {

                 mme_send_delete_session_or_detach(enb_ue, mme_ue);

@@ -932,8 +974,62 @@

             break;

         case OGS_NAS_EPS_TRACKING_AREA_UPDATE_COMPLETE:

-            ogs_error("%s Tracking area update complete in INVALID-STATE",

-                        mme_ue->imsi_bcd);

+            ogs_info("%s Tracking area update complete", mme_ue->imsi_bcd);

+

+        /*

+         * TS24.301

+         * Section 4.4.4.3

+         * Integrity checking of NAS signalling messages in the MME:

+         *

+         * Once the secure exchange of NAS messages has been established

+         * for the NAS signalling connection, the receiving EMM or ESM entity

+         * in the MME shall not process any NAS signalling messages

+         * unless they have been successfully integrity checked by the NAS.

+         * If any NAS signalling message, having not successfully passed

+         * the integrity check, is received, then the NAS in the MME shall

+         * discard that message. If any NAS signalling message is received,

+         * as not integrity protected even though the secure exchange

+         * of NAS messages has been established, then the NAS shall discard

+         * this message.

+         */

+            h.type = e->nas_type;

+            if (h.integrity_protected == 0) {

+                ogs_error("%s No Integrity Protected", mme_ue->imsi_bcd);

+                break;

+            }

+

+            if (!SECURITY_CONTEXT_IS_VALID(mme_ue)) {

+                ogs_error("%s No Security Context", mme_ue->imsi_bcd);

+                break;

+            }

+

+            /*

+             * If the OLD ENB_UE is being maintained in MME-UE Context,

+             * it deletes the S1 Context after exchanging

+             * the UEContextReleaseCommand/Complete with the eNB

+             */

+            CLEAR_S1_CONTEXT(mme_ue);

+

+            CLEAR_MME_UE_TIMER(mme_ue->t3450);

+

+            /* Confirm GUTI */

+            if (MME_NEXT_GUTI_IS_AVAILABLE(mme_ue))

+                mme_ue_confirm_guti(mme_ue);

+

+            /* Confirm P-TMSI */

+            if (MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue)) {

+                mme_ue_confirm_p_tmsi(mme_ue);

+

+                ogs_assert(OGS_OK ==

+                    sgsap_send_tmsi_reallocation_complete(mme_ue));

+

+                if (!mme_ue->nas_eps.update.active_flag) {

+                    enb_ue->relcause.group = S1AP_Cause_PR_nas;

+                    enb_ue->relcause.cause = S1AP_CauseNas_normal_release;

+                    mme_send_release_access_bearer_or_ue_context_release(

+                            enb_ue);

+                }

+            }

             break;

         default:

@@ -1117,7 +1213,7 @@

              */

             CLEAR_S1_CONTEXT(mme_ue);

-            if (MME_P_TMSI_IS_AVAILABLE(mme_ue)) {

+            if (MME_CURRENT_P_TMSI_IS_AVAILABLE(mme_ue)) {

                 ogs_assert(OGS_OK == sgsap_send_detach_indication(mme_ue));

             } else {

                 mme_send_delete_session_or_detach(enb_ue, mme_ue);

@@ -1283,7 +1379,7 @@

             mme_s6a_send_ulr(enb_ue, mme_ue);

-            if (mme_ue->next.m_tmsi) {

+            if (MME_NEXT_GUTI_IS_AVAILABLE(mme_ue)) {

                 OGS_FSM_TRAN(s, &emm_state_initial_context_setup);

             } else {

                 ogs_fatal("MME always creates new GUTI");

@@ -1358,7 +1454,7 @@

              */

             CLEAR_S1_CONTEXT(mme_ue);

-            if (MME_P_TMSI_IS_AVAILABLE(mme_ue)) {

+            if (MME_CURRENT_P_TMSI_IS_AVAILABLE(mme_ue)) {

                 ogs_assert(OGS_OK == sgsap_send_detach_indication(mme_ue));

             } else {

                 mme_send_delete_session_or_detach(enb_ue, mme_ue);

@@ -1496,18 +1592,21 @@

             }

             /* Confirm GUTI */

-            if (mme_ue->next.m_tmsi)

+            if (MME_NEXT_GUTI_IS_AVAILABLE(mme_ue))

                 mme_ue_confirm_guti(mme_ue);

-            if (MME_P_TMSI_IS_AVAILABLE(mme_ue))

+            /* Confirm P-TMSI */

+            if (MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue)) {

+                mme_ue_confirm_p_tmsi(mme_ue);

                 ogs_assert(OGS_OK ==

                     sgsap_send_tmsi_reallocation_complete(mme_ue));

+            }

             OGS_FSM_TRAN(s, &emm_state_registered);

             break;

         case OGS_NAS_EPS_TRACKING_AREA_UPDATE_COMPLETE:

-            ogs_debug("%s Tracking area update complete", mme_ue->imsi_bcd);

+            ogs_info("%s Tracking area update complete", mme_ue->imsi_bcd);

         /*

          * TS24.301

@@ -1546,9 +1645,24 @@

             CLEAR_MME_UE_TIMER(mme_ue->t3450);

             /* Confirm GUTI */

-            if (mme_ue->next.m_tmsi)

+            if (MME_NEXT_GUTI_IS_AVAILABLE(mme_ue))

                 mme_ue_confirm_guti(mme_ue);

+            /* Confirm P-TMSI */

+            if (MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue)) {

+                mme_ue_confirm_p_tmsi(mme_ue);

+

+                ogs_assert(OGS_OK ==

+                    sgsap_send_tmsi_reallocation_complete(mme_ue));

+

+                if (!mme_ue->nas_eps.update.active_flag) {

+                    enb_ue->relcause.group = S1AP_Cause_PR_nas;

+                    enb_ue->relcause.cause = S1AP_CauseNas_normal_release;

+                    mme_send_release_access_bearer_or_ue_context_release(

+                            enb_ue);

+                }

+            }

+

             OGS_FSM_TRAN(s, &emm_state_registered);

             break;

@@ -1613,7 +1727,7 @@

              */

             CLEAR_S1_CONTEXT(mme_ue);

-            if (MME_P_TMSI_IS_AVAILABLE(mme_ue)) {

+            if (MME_CURRENT_P_TMSI_IS_AVAILABLE(mme_ue)) {

                 ogs_assert(OGS_OK == sgsap_send_detach_indication(mme_ue));

             } else {

                 mme_send_delete_session_or_detach(enb_ue, mme_ue);

​

@@ -3300,7 +3300,7 @@

     ogs_assert(served_gummei->num_of_mme_gid > 0);

     ogs_assert(served_gummei->num_of_mme_code > 0);

-    if (mme_ue->next.m_tmsi) {

+    if (MME_NEXT_GUTI_IS_AVAILABLE(mme_ue)) {

         ogs_warn("GUTI has already been allocated");

         return;

     }

@@ -3320,9 +3320,9 @@

 void mme_ue_confirm_guti(mme_ue_t *mme_ue)

 {

-    ogs_assert(mme_ue->next.m_tmsi);

+    ogs_assert(MME_NEXT_GUTI_IS_AVAILABLE(mme_ue));

-    if (mme_ue->current.m_tmsi) {

+    if (MME_CURRENT_GUTI_IS_AVAILABLE(mme_ue)) {

         /* MME has a VALID GUTI

          * As such, we need to remove previous GUTI in hash table */

         ogs_hash_set(self.guti_ue_hash,

@@ -3348,6 +3348,37 @@

               mme_ue->current.guti.m_tmsi);

 }

+void mme_ue_set_p_tmsi(

+        mme_ue_t *mme_ue,

+        ogs_nas_mobile_identity_tmsi_t *nas_mobile_identity_tmsi)

+{

+    ogs_assert(mme_ue);

+    ogs_assert(nas_mobile_identity_tmsi);

+

+    /*

+     * If the P-TMSI received from MSC/VLR is different from the current P-TMSI

+     * known by the MME, store this new P-TMSI as 'Next P-TMSI'. This value will

+     * be sent to the UE through the Attach Accept or TAU Accept message.

+     *

+     * When the UE sends an Attach Complete or TAU Complete message,

+     * the MME updates the 'Current P-TMSI' with the value in 'Next P-TMSI',

+     * thereby confirming and saving the new P-TMSI.

+     */

+    mme_ue->next.p_tmsi = be32toh(nas_mobile_identity_tmsi->tmsi);

+    if (mme_ue->next.p_tmsi != INVALID_P_TMSI) {

+        if (mme_ue->current.p_tmsi == mme_ue->next.p_tmsi)

+            mme_ue->next.p_tmsi = INVALID_P_TMSI;

+    }

+}

+void mme_ue_confirm_p_tmsi(mme_ue_t *mme_ue)

+{

+    ogs_assert(mme_ue);

+    ogs_assert(mme_ue->next.p_tmsi);

+

+    mme_ue->current.p_tmsi = mme_ue->next.p_tmsi;

+    mme_ue->next.p_tmsi = INVALID_P_TMSI;

+}

+

 static bool compare_ue_info(mme_sgw_t *node, enb_ue_t *enb_ue)

 {

     int i;

@@ -3567,14 +3598,15 @@

         ogs_hash_set(mme_self()->imsi_ue_hash,

                 mme_ue->imsi, mme_ue->imsi_len, NULL);

-    if (mme_ue->current.m_tmsi) {

+    if (MME_CURRENT_GUTI_IS_AVAILABLE(mme_ue)) {

         ogs_hash_set(self.guti_ue_hash,

                 &mme_ue->current.guti, sizeof(ogs_nas_eps_guti_t), NULL);

         ogs_assert(mme_m_tmsi_free(mme_ue->current.m_tmsi) == OGS_OK);

     }

-    if (mme_ue->next.m_tmsi)

+    if (MME_NEXT_GUTI_IS_AVAILABLE(mme_ue)) {

         ogs_assert(mme_m_tmsi_free(mme_ue->next.m_tmsi) == OGS_OK);

+    }

     /* Clear the saved PDN Connectivity Request */

     OGS_NAS_CLEAR_DATA(&mme_ue->pdn_connectivity_request);

​

@@ -204,8 +204,6 @@

 #define MME_SGSAP_IS_CONNECTED(__mME) \

     ((__mME) && ((__mME)->csmap) && ((__mME)->csmap->vlr) && \

      (OGS_FSM_CHECK(&(__mME)->csmap->vlr->sm, sgsap_state_connected)))

-#define MME_P_TMSI_IS_AVAILABLE(__mME) \

-    (MME_SGSAP_IS_CONNECTED(__mME) && (__mME)->p_tmsi)

 typedef struct mme_vlr_s {

     ogs_lnode_t     lnode;

@@ -363,6 +361,11 @@

         ogs_nas_detach_type_t detach;

     } nas_eps;

+#define MME_TAU_TYPE_INITIAL_UE_MESSAGE    1

+#define MME_TAU_TYPE_UPLINK_NAS_TRANPORT   2

+#define MME_TAU_TYPE_UNPROTECTED_INGERITY  3

+    uint8_t tracking_area_update_request_type;

+

     /* 1. MME initiated detach request to the UE.

      *    (nas_eps.type = MME_EPS_TYPE_DETACH_REQUEST_TO_UE)

      * 2. If UE is IDLE, Paging sent to the UE

@@ -403,7 +406,6 @@

     int             a_msisdn_len;

     char            a_msisdn_bcdOGS_MAX_MSISDN_BCD_LEN+1;

-    mme_p_tmsi_t    p_tmsi;

     struct {

         ogs_pool_id_t   *mme_gn_teid_node; /* A node of MME-Gn-TEID */

         uint32_t        mme_gn_teid;   /* MME-Gn-TEID is derived from NODE */

@@ -416,8 +418,15 @@

     } gn;

     struct {

+#define MME_NEXT_GUTI_IS_AVAILABLE(__mME) ((__mME)->next.m_tmsi)

+#define MME_CURRENT_GUTI_IS_AVAILABLE(__mME) ((__mME)->current.m_tmsi)

         mme_m_tmsi_t *m_tmsi;

         ogs_nas_eps_guti_t guti;

+#define MME_NEXT_P_TMSI_IS_AVAILABLE(__mME) \

+    (MME_SGSAP_IS_CONNECTED(__mME) && (__mME)->next.p_tmsi)

+#define MME_CURRENT_P_TMSI_IS_AVAILABLE(__mME) \

+    (MME_SGSAP_IS_CONNECTED(__mME) && (__mME)->current.p_tmsi)

+        mme_p_tmsi_t    p_tmsi;

     } current, next;

     ogs_pool_id_t   *mme_s11_teid_node; /* A node of MME-S11-TEID */

@@ -659,10 +668,10 @@

     } while(0);

 #define CS_CALL_SERVICE_INDICATOR(__mME) \

-    (MME_P_TMSI_IS_AVAILABLE(__mME) && \

+    (MME_CURRENT_P_TMSI_IS_AVAILABLE(__mME) && \

      ((__mME)->service_indicator) == SGSAP_CS_CALL_SERVICE_INDICATOR)

 #define SMS_SERVICE_INDICATOR(__mME) \

-    (MME_P_TMSI_IS_AVAILABLE(__mME) && \

+    (MME_CURRENT_P_TMSI_IS_AVAILABLE(__mME) && \

      ((__mME)->service_indicator) == SGSAP_SMS_SERVICE_INDICATOR)

     uint8_t         service_indicator;

@@ -981,6 +990,12 @@

 void mme_ue_new_guti(mme_ue_t *mme_ue);

 void mme_ue_confirm_guti(mme_ue_t *mme_ue);

+#define INVALID_P_TMSI 0

+void mme_ue_set_p_tmsi(

+        mme_ue_t *mme_ue,

+        ogs_nas_mobile_identity_tmsi_t *nas_mobile_identity_tmsi);

+void mme_ue_confirm_p_tmsi(mme_ue_t *mme_ue);

+

 mme_ue_t *mme_ue_add(enb_ue_t *enb_ue);

 void mme_ue_remove(mme_ue_t *mme_ue);

 void mme_ue_remove_all(void);

​

@@ -302,7 +302,7 @@

             r = nas_eps_send_detach_request(mme_ue);

             ogs_expect(r == OGS_OK);

             ogs_assert(r != OGS_ERROR);

-            if (MME_P_TMSI_IS_AVAILABLE(mme_ue)) {

+            if (MME_CURRENT_P_TMSI_IS_AVAILABLE(mme_ue)) {

                 ogs_assert(OGS_OK == sgsap_send_detach_indication(mme_ue));

             } else {

                 enb_ue_t *enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);

​

@@ -123,10 +123,26 @@

             return OGS_NAS_EMM_CAUSE_NO_EPS_BEARER_CONTEXT_ACTIVATED;

         }

-        r = nas_eps_send_tau_accept(mme_ue,

-                S1AP_ProcedureCode_id_InitialContextSetup);

-        ogs_expect(r == OGS_OK);

-        ogs_assert(r != OGS_ERROR);

+        /* Update CSMAP from Tracking area update request */

+        mme_ue->csmap = mme_csmap_find_by_tai(&mme_ue->tai);

+        if (mme_ue->csmap &&

+            mme_ue->network_access_mode ==

+                OGS_NETWORK_ACCESS_MODE_PACKET_AND_CIRCUIT &&

+            (mme_ue->nas_eps.update.value ==

+             OGS_NAS_EPS_UPDATE_TYPE_COMBINED_TA_LA_UPDATING ||

+             mme_ue->nas_eps.update.value ==

+             OGS_NAS_EPS_UPDATE_TYPE_COMBINED_TA_LA_UPDATING_WITH_IMSI_ATTACH)) {

+

+            mme_ue->tracking_area_update_request_type =

+                MME_TAU_TYPE_UNPROTECTED_INGERITY;

+            ogs_assert(OGS_OK == sgsap_send_location_update_request(mme_ue));

+

+        } else {

+            r = nas_eps_send_tau_accept(mme_ue,

+                    S1AP_ProcedureCode_id_InitialContextSetup);

+            ogs_expect(r == OGS_OK);

+            ogs_assert(r != OGS_ERROR);

+        }

     } else {

         ogs_error("Invalid Type%d", mme_ue->nas_eps.type);

         return OGS_NAS_EMM_CAUSE_PROTOCOL_ERROR_UNSPECIFIED;

@@ -275,7 +291,7 @@

             r = nas_eps_send_detach_request(mme_ue);

             ogs_expect(r == OGS_OK);

             ogs_assert(r != OGS_ERROR);

-            if (MME_P_TMSI_IS_AVAILABLE(mme_ue)) {

+            if (MME_CURRENT_P_TMSI_IS_AVAILABLE(mme_ue)) {

                 ogs_assert(OGS_OK == sgsap_send_detach_indication(mme_ue));

             } else {

                 enb_ue_t *enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);

@@ -304,7 +320,7 @@

          * There is no need to send NAS or S1AP message to the UE.

          * So, we don't have to check whether UE is IDLE or not.

          */

-        if (MME_P_TMSI_IS_AVAILABLE(mme_ue)) {

+        if (MME_CURRENT_P_TMSI_IS_AVAILABLE(mme_ue)) {

             ogs_assert(OGS_OK == sgsap_send_detach_indication(mme_ue));

         } else {

             enb_ue_t *enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);

​

@@ -857,17 +857,15 @@

         return OGS_ERROR;

     }

-    if (mme_ue->next.m_tmsi) {

-        CLEAR_MME_UE_TIMER(mme_ue->t3450);

-        mme_ue->t3450.pkbuf = ogs_pkbuf_copy(emmbuf);

-        if (!mme_ue->t3450.pkbuf) {

-            ogs_error("ogs_pkbuf_copy(mme_ue->t3450.pkbuf) failed");

-            ogs_pkbuf_free(emmbuf);

-            return OGS_ERROR;

-        }

-        ogs_timer_start(mme_ue->t3450.timer,

-                mme_timer_cfg(MME_TIMER_T3450)->duration);

+    CLEAR_MME_UE_TIMER(mme_ue->t3450);

+    mme_ue->t3450.pkbuf = ogs_pkbuf_copy(emmbuf);

+    if (!mme_ue->t3450.pkbuf) {

+        ogs_error("ogs_pkbuf_copy(mme_ue->t3450.pkbuf) failed");

+        ogs_pkbuf_free(emmbuf);

+        return OGS_ERROR;

     }

+    ogs_timer_start(mme_ue->t3450.timer,

+            mme_timer_cfg(MME_TIMER_T3450)->duration);

     if (procedureCode == S1AP_ProcedureCode_id_InitialContextSetup) {

         ogs_pkbuf_t *s1apbuf = NULL;

​

@@ -692,7 +692,7 @@

     ogs_log_hexdump(OGS_LOG_DEBUG, SecurityKey->buf, SecurityKey->size);

     if (mme_ue->nas_eps.type == MME_EPS_TYPE_EXTENDED_SERVICE_REQUEST &&

-        MME_P_TMSI_IS_AVAILABLE(mme_ue)) {

+        MME_CURRENT_P_TMSI_IS_AVAILABLE(mme_ue)) {

         /* Set CS-Fallback */

         S1AP_CSFallbackIndicator_t *CSFallbackIndicator = NULL;

@@ -727,7 +727,7 @@

         ogs_s1ap_buffer_to_OCTET_STRING(

             &mme_ue->tai.plmn_id, sizeof(ogs_plmn_id_t), &LAI->pLMNidentity);

         ogs_assert(mme_ue->csmap);

-        ogs_assert(mme_ue->p_tmsi);

+        ogs_assert(mme_ue->current.p_tmsi);

         ogs_asn_uint16_to_OCTET_STRING(mme_ue->csmap->lai.lac, &LAI->lAC);

     }

@@ -891,7 +891,7 @@

             enb_ue->enb_ue_s1ap_id, enb_ue->mme_ue_s1ap_id);

     if (mme_ue->nas_eps.type == MME_EPS_TYPE_EXTENDED_SERVICE_REQUEST &&

-        MME_P_TMSI_IS_AVAILABLE(mme_ue)) {

+        MME_CURRENT_P_TMSI_IS_AVAILABLE(mme_ue)) {

         ie = CALLOC(1, sizeof(S1AP_UEContextModificationRequestIEs_t));

         ASN_SEQUENCE_ADD(&UEContextModificationRequest->protocolIEs, ie);

@@ -919,7 +919,7 @@

         ogs_s1ap_buffer_to_OCTET_STRING(

             &mme_ue->tai.plmn_id, sizeof(ogs_plmn_id_t), &LAI->pLMNidentity);

         ogs_assert(mme_ue->csmap);

-        ogs_assert(mme_ue->p_tmsi);

+        ogs_assert(mme_ue->current.p_tmsi);

         ogs_asn_uint16_to_OCTET_STRING(mme_ue->csmap->lai.lac, &LAI->lAC);

     } else {

​

@@ -101,6 +101,12 @@

         goto error;

     }

+    enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);

+    if (!enb_ue) {

+        ogs_error("!enb_ue");

+        goto error;

+    }

+

     ogs_debug("    IMSI%s", mme_ue->imsi_bcd);

     if (lai) {

         ogs_debug("    LAIPLMN_ID:%06x,LAC:%d",

@@ -109,38 +115,125 @@

     if (nas_mobile_identity_tmsi) {

         if (nas_mobile_identity_tmsi->type == OGS_NAS_MOBILE_IDENTITY_TMSI) {

-            mme_ue->p_tmsi = be32toh(nas_mobile_identity_tmsi->tmsi);

+            mme_ue_set_p_tmsi(mme_ue, nas_mobile_identity_tmsi);

         } else {

             ogs_error("Not supported Identity type%d",

                     nas_mobile_identity_tmsi->type);

             goto error;

         }

-        ogs_debug("    P-TMSI0x%08x", mme_ue->p_tmsi);

+        ogs_debug("    P-TMSI0x%08x", mme_ue->next.p_tmsi);

     }

-    r = nas_eps_send_attach_accept(mme_ue);

-    ogs_expect(r == OGS_OK);

-    ogs_assert(r != OGS_ERROR);

+    if (mme_ue->nas_eps.type == MME_EPS_TYPE_ATTACH_REQUEST) {

+        r = nas_eps_send_attach_accept(mme_ue);

+        ogs_expect(r == OGS_OK);

+        ogs_assert(r != OGS_ERROR);

+    } else if (mme_ue->nas_eps.type == MME_EPS_TYPE_TAU_REQUEST) {

+        if (mme_ue->tracking_area_update_request_type ==

+                MME_TAU_TYPE_INITIAL_UE_MESSAGE) {

+            ogs_debug("    Iniital UE Message");

+            if (mme_ue->nas_eps.update.active_flag) {

+

+/*

+* TS33.401

+* 7 Security procedures between UE and EPS access network elements

+* 7.2 Handling of user-related keys in E-UTRAN

+* 7.2.7 Key handling for the TAU procedure when registered in E-UTRAN

+*

+* If the "active flag" is set in the TAU request message or

+* the MME chooses to establish radio bearers when there is pending downlink

+* UP data or pending downlink signalling, radio bearers will be established

+* as part of the TAU procedure and a KeNB derivation is necessary.

+*/

+                ogs_kdf_kenb(mme_ue->kasme, mme_ue->ul_count.i32,

+                        mme_ue->kenb);

+                ogs_kdf_nh_enb(mme_ue->kasme, mme_ue->kenb, mme_ue->nh);

+                mme_ue->nhcc = 1;

+

+                r = nas_eps_send_tau_accept(mme_ue,

+                        S1AP_ProcedureCode_id_InitialContextSetup);

+                ogs_expect(r == OGS_OK);

+                ogs_assert(r != OGS_ERROR);

+            } else {

+                r = nas_eps_send_tau_accept(mme_ue,

+                        S1AP_ProcedureCode_id_downlinkNASTransport);

+                ogs_expect(r == OGS_OK);

+                ogs_assert(r != OGS_ERROR);

+            }

+        } else if (mme_ue->tracking_area_update_request_type ==

+                MME_TAU_TYPE_UPLINK_NAS_TRANPORT) {

+            ogs_debug("    Uplink NAS Transport");

+            r = nas_eps_send_tau_accept(mme_ue,

+                    S1AP_ProcedureCode_id_downlinkNASTransport);

+            ogs_expect(r == OGS_OK);

+            ogs_assert(r != OGS_ERROR);

+        } else if (mme_ue->tracking_area_update_request_type ==

+                MME_TAU_TYPE_UNPROTECTED_INGERITY) {

+            ogs_debug("    Unprotected Integrity");

+            r = nas_eps_send_tau_accept(mme_ue,

+                    S1AP_ProcedureCode_id_InitialContextSetup);

+            ogs_expect(r == OGS_OK);

+        } else {

+            ogs_error("Invalid TAU Type%d",

+                    mme_ue->tracking_area_update_request_type);

+            return;

+        }

+

+        /*

+         * When active_flag is 0, check if the P-TMSI has been updated.

+         * If the P-TMSI has changed, wait to receive the TAU Complete message

+         * from the UE before sending the UEContextReleaseCommand.

+         *

+         * This ensures that the UE has acknowledged the new P-TMSI,

+         * allowing the TAU procedure to complete successfully

+         * and maintaining synchronization between the UE and the network.

+         */

+        if (!mme_ue->nas_eps.update.active_flag &&

+            !MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue)) {

+            enb_ue->relcause.group = S1AP_Cause_PR_nas;

+            enb_ue->relcause.cause = S1AP_CauseNas_normal_release;

+            mme_send_release_access_bearer_or_ue_context_release(enb_ue);

+        }

+    } else {

+        ogs_fatal("%s Invalid EPS-Type%d",

+                mme_ue->imsi_bcd, mme_ue->nas_eps.type);

+        ogs_assert_if_reached();

+    }

     return;

 error:

-    /* Clang scan-build SA: NULL pointer dereference: mme_ue=NULL if root=NULL. */

+    /* Clang scan-build SA:

+     * NULL pointer dereference: mme_ue=NULL if root=NULL. */

     if (!mme_ue) {

         ogs_error("!mme_ue");

         return;

-    }  

+    }

     enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);

-    if (enb_ue) {

+    if (!enb_ue) {

+        ogs_error("ENB-S1 Context has already been removed");

+        return;

+    }

+

+    if (mme_ue->nas_eps.type == MME_EPS_TYPE_ATTACH_REQUEST) {

         r = nas_eps_send_attach_reject(

                 enb_ue, mme_ue,

                 OGS_NAS_EMM_CAUSE_PROTOCOL_ERROR_UNSPECIFIED,

                 OGS_NAS_ESM_CAUSE_PROTOCOL_ERROR_UNSPECIFIED);

         ogs_expect(r == OGS_OK);

         ogs_assert(r != OGS_ERROR);

-        mme_send_delete_session_or_mme_ue_context_release(enb_ue, mme_ue);

-    } else

-        ogs_error("ENB-S1 Context has already been removed");

+    } else if (mme_ue->nas_eps.type == MME_EPS_TYPE_TAU_REQUEST) {

+        r = nas_eps_send_tau_reject(

+                enb_ue, mme_ue,

+                OGS_NAS_EMM_CAUSE_UE_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK);

+        ogs_expect(r == OGS_OK);

+        ogs_assert(r != OGS_ERROR);

+    } else {

+        ogs_fatal("%s Invalid EPS-Type%d",

+                mme_ue->imsi_bcd, mme_ue->nas_eps.type);

+        ogs_assert_if_reached();

+    }

+    mme_send_delete_session_or_mme_ue_context_release(enb_ue, mme_ue);

 }

 void sgsap_handle_location_update_reject(mme_vlr_t *vlr, ogs_pkbuf_t *pkbuf)

@@ -148,6 +241,7 @@

     int r;

     ogs_tlv_t *root = NULL, *iter = NULL;

     mme_ue_t *mme_ue = NULL;

+    enb_ue_t *enb_ue = NULL;

     char imsi_bcdOGS_MAX_IMSI_BCD_LEN+1;

@@ -215,15 +309,94 @@

         return;

     }

+    enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);

+    if (!enb_ue) {

+        ogs_error("!enb_ue");

+        goto error;

+    }

+

     ogs_debug("    IMSI%s CAUSE%d", mme_ue->imsi_bcd, emm_cause);

     if (lai) {

         ogs_debug("    LAIPLMN_ID:%06x,LAC:%d",

                     ogs_plmn_id_hexdump(&lai->nas_plmn_id), lai->lac);

     }

-    r = nas_eps_send_attach_accept(mme_ue);

-    ogs_expect(r == OGS_OK);

-    ogs_assert(r != OGS_ERROR);

+    if (mme_ue->nas_eps.type == MME_EPS_TYPE_ATTACH_REQUEST) {

+        r = nas_eps_send_attach_accept(mme_ue);

+        ogs_expect(r == OGS_OK);

+        ogs_assert(r != OGS_ERROR);

+    } else if (mme_ue->nas_eps.type == MME_EPS_TYPE_TAU_REQUEST) {

+        if (mme_ue->tracking_area_update_request_type ==

+                MME_TAU_TYPE_INITIAL_UE_MESSAGE) {

+            ogs_debug("    Iniital UE Message");

+            if (mme_ue->nas_eps.update.active_flag) {

+

+/*

+* TS33.401

+* 7 Security procedures between UE and EPS access network elements

+* 7.2 Handling of user-related keys in E-UTRAN

+* 7.2.7 Key handling for the TAU procedure when registered in E-UTRAN

+*

+* If the "active flag" is set in the TAU request message or

+* the MME chooses to establish radio bearers when there is pending downlink

+* UP data or pending downlink signalling, radio bearers will be established

+* as part of the TAU procedure and a KeNB derivation is necessary.

+*/

+                ogs_kdf_kenb(mme_ue->kasme, mme_ue->ul_count.i32,

+                        mme_ue->kenb);

+                ogs_kdf_nh_enb(mme_ue->kasme, mme_ue->kenb, mme_ue->nh);

+                mme_ue->nhcc = 1;

+

+                r = nas_eps_send_tau_accept(mme_ue,

+                        S1AP_ProcedureCode_id_InitialContextSetup);

+                ogs_expect(r == OGS_OK);

+                ogs_assert(r != OGS_ERROR);

+            } else {

+                r = nas_eps_send_tau_accept(mme_ue,

+                        S1AP_ProcedureCode_id_downlinkNASTransport);

+                ogs_expect(r == OGS_OK);

+                ogs_assert(r != OGS_ERROR);

+            }

+        } else if (mme_ue->tracking_area_update_request_type ==

+                MME_TAU_TYPE_UPLINK_NAS_TRANPORT) {

+            ogs_debug("    Uplink NAS Transport");

+            r = nas_eps_send_tau_accept(mme_ue,

+                    S1AP_ProcedureCode_id_downlinkNASTransport);

+            ogs_expect(r == OGS_OK);

+            ogs_assert(r != OGS_ERROR);

+        } else if (mme_ue->tracking_area_update_request_type ==

+                MME_TAU_TYPE_UNPROTECTED_INGERITY) {

+            ogs_debug("    Unprotected Integrity");

+            r = nas_eps_send_tau_accept(mme_ue,

+                    S1AP_ProcedureCode_id_InitialContextSetup);

+            ogs_expect(r == OGS_OK);

+        } else {

+            ogs_error("Invalid TAU Type%d",

+                    mme_ue->tracking_area_update_request_type);

+            return;

+        }

+

+        /*

+         * When active_flag is 0, check if the P-TMSI has been updated.

+         * If the P-TMSI has changed, wait to receive the TAU Complete message

+         * from the UE before sending the UEContextReleaseCommand.

+         *

+         * This ensures that the UE has acknowledged the new P-TMSI,

+         * allowing the TAU procedure to complete successfully

+         * and maintaining synchronization between the UE and the network.

+         */

+        if (!mme_ue->nas_eps.update.active_flag &&

+            !MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue)) {

+            ogs_fatal("NEXT = %d", MME_NEXT_P_TMSI_IS_AVAILABLE(mme_ue));

+            enb_ue->relcause.group = S1AP_Cause_PR_nas;

+            enb_ue->relcause.cause = S1AP_CauseNas_normal_release;

+            mme_send_release_access_bearer_or_ue_context_release(enb_ue);

+        }

+    } else {

+        ogs_fatal("%s Invalid EPS-Type%d",

+                mme_ue->imsi_bcd, mme_ue->nas_eps.type);

+        ogs_assert_if_reached();

+    }

     return;

​

@@ -85,7 +85,8 @@

     ogs_assert(OGS_OK == ogs_sockaddr_to_ip(

                 sess->upf_n3_addr, sess->upf_n3_addr6, &upf_n3_ip));

-    ogs_asn_ip_to_BIT_STRING(&upf_n3_ip, &gTPTunnel->transportLayerAddress);

+    ogs_assert(OGS_OK == ogs_asn_ip_to_BIT_STRING(

+                &upf_n3_ip, &gTPTunnel->transportLayerAddress));

     ogs_asn_uint32_to_OCTET_STRING(sess->upf_n3_teid, &gTPTunnel->gTP_TEID);

     if (sess->handover.data_forwarding_not_possible == true) {

@@ -477,7 +478,8 @@

     ogs_assert(OGS_OK == ogs_sockaddr_to_ip(

                 sess->upf_n3_addr, sess->upf_n3_addr6, &upf_n3_ip));

-    ogs_asn_ip_to_BIT_STRING(&upf_n3_ip, &gTPTunnel->transportLayerAddress);

+    ogs_assert(OGS_OK == ogs_asn_ip_to_BIT_STRING(

+                &upf_n3_ip, &gTPTunnel->transportLayerAddress));

     ogs_asn_uint32_to_OCTET_STRING(sess->upf_n3_teid, &gTPTunnel->gTP_TEID);

 #endif

@@ -518,7 +520,8 @@

         ogs_assert(OGS_OK == ogs_sockaddr_to_ip(

                 sess->handover.upf_dl_addr, sess->handover.upf_dl_addr6,

                 &upf_dl_ip));

-        ogs_asn_ip_to_BIT_STRING(&upf_dl_ip, &gTPTunnel->transportLayerAddress);

+        ogs_assert(OGS_OK == ogs_asn_ip_to_BIT_STRING(

+                    &upf_dl_ip, &gTPTunnel->transportLayerAddress));

         ogs_asn_uint32_to_OCTET_STRING(

                 sess->handover.upf_dl_teid, &gTPTunnel->gTP_TEID);

​

@@ -129,7 +129,7 @@

      * 

      * If freeDiameter is not used, it uses a delay of less than 4 seconds.

      */

-    ogs_msleep(2000);

+    ogs_msleep(3000);

     return OGS_OK;

 }

​

@@ -26,13 +26,21 @@

     ogs_pkbuf_t *pkbuf = NULL;

     const char *payloadTEST_SGSAP_MAX_MESSAGE = {

         "0a01089999073746 000006040509f107 09260e05f49ee88e 64",

+        "0a01089999073746 000006040509f107 09260e05f49ee88e 65",

+        "0a01089999073746 000006040509f107 09260e05f49ee88e 66",

+

         "0a01087942120000 000030040527f412 c9580e05f437ab9c c5",

         "",

+        "",

     };

     uint16_t lenTEST_SGSAP_MAX_MESSAGE = {

         25,

         25,

+        25,

+

+        25,

+        0,

         0,

     };

     char hexbufOGS_HUGE_LEN;

​

@@ -25,6 +25,7 @@

 abts_suite *test_mt_active(abts_suite *suite);

 abts_suite *test_mo_sms(abts_suite *suite);

 abts_suite *test_mt_sms(abts_suite *suite);

+abts_suite *test_tau(abts_suite *suite);

 abts_suite *test_crash(abts_suite *suite);

 const struct testlist {

@@ -36,6 +37,7 @@

     {test_mt_active},

     {test_mo_sms},

     {test_mt_sms},

+    {test_tau},

     {test_crash},

     {NULL},

 };

​

@@ -23,6 +23,7 @@

     mt-active-test.c

     mo-sms-test.c

     mt-sms-test.c

+    tau-test.c

     crash-test.c

 '''.split())

​

@@ -0,0 +1,1538 @@

+/*

+ * Copyright (C) 2024 by Sukchan Lee <acetcom@gmail.com>

+ *

+ * This file is part of Open5GS.

+ *

+ * This program is free software: you can redistribute it and/or modify

+ * it under the terms of the GNU Affero General Public License as published by

+ * the Free Software Foundation, either version 3 of the License, or

+ * (at your option) any later version.

+ *

+ * This program is distributed in the hope that it will be useful,

+ * but WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ * GNU General Public License for more details.

+ *

+ * You should have received a copy of the GNU General Public License

+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.

+ */

+

+#include "test-common.h"

+

+extern ogs_socknode_t *sgsap;

+

+static void test_simple_func(abts_case *tc, void *data)

+{

+    int rv;

+    ogs_socknode_t *s1ap;

+    ogs_socknode_t *gtpu;

+    ogs_pkbuf_t *emmbuf;

+    ogs_pkbuf_t *esmbuf;

+    ogs_pkbuf_t *sendbuf;

+    ogs_pkbuf_t *recvbuf;

+    ogs_s1ap_message_t message;

+

+    ogs_nas_5gs_mobile_identity_suci_t mobile_identity_suci;

+    test_ue_t *test_ue = NULL;

+    test_sess_t *sess = NULL;

+    test_bearer_t *bearer = NULL;

+

+    uint32_t enb_ue_s1ap_id;

+    uint64_t mme_ue_s1ap_id;

+

+    bson_t *doc = NULL;

+

+    /* Setup Test UE & Session Context */

+    memset(&mobile_identity_suci, 0, sizeof(mobile_identity_suci));

+

+    mobile_identity_suci.h.supi_format = OGS_NAS_5GS_SUPI_FORMAT_IMSI;

+    mobile_identity_suci.h.type = OGS_NAS_5GS_MOBILE_IDENTITY_SUCI;

+    mobile_identity_suci.routing_indicator1 = 0;

+    mobile_identity_suci.routing_indicator2 = 0xf;

+    mobile_identity_suci.routing_indicator3 = 0xf;

+    mobile_identity_suci.routing_indicator4 = 0xf;

+    mobile_identity_suci.protection_scheme_id = OGS_PROTECTION_SCHEME_NULL;

+    mobile_identity_suci.home_network_pki_value = 0;

+

+    test_ue = test_ue_add_by_suci(&mobile_identity_suci, "3746000006");

+    ogs_assert(test_ue);

+

+    test_ue->e_cgi.cell_id = 0x54f6401;

+    test_ue->nas.ksi = OGS_NAS_KSI_NO_KEY_IS_AVAILABLE;

+    test_ue->nas.value = OGS_NAS_ATTACH_TYPE_COMBINED_EPS_IMSI_ATTACH;

+

+    test_ue->k_string = "465b5ce8b199b49faa5f0a2ee238a6bc";

+    test_ue->opc_string = "e8ed289deba952e4283b54e88e6183ca";

+

+    sess = test_sess_add_by_apn(test_ue, "internet", OGS_GTP2_RAT_TYPE_EUTRAN);

+    ogs_assert(sess);

+

+    /* eNB connects to MME */

+    s1ap = tests1ap_client(AF_INET);

+    ABTS_PTR_NOTNULL(tc, s1ap);

+

+    /* eNB connects to SGW */

+    gtpu = test_gtpu_server(1, AF_INET);

+    ABTS_PTR_NOTNULL(tc, gtpu);

+

+    /* Send S1-Setup Reqeust */

+    sendbuf = test_s1ap_build_s1_setup_request(

+            S1AP_ENB_ID_PR_macroENB_ID, 0x54f64);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Receive S1-Setup Response */

+    recvbuf = testenb_s1ap_read(s1ap);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(NULL, recvbuf);

+

+    /********** Insert Subscriber in Database */

+    doc = test_db_new_simple(test_ue);

+    ABTS_PTR_NOTNULL(tc, doc);

+    ABTS_INT_EQUAL(tc, OGS_OK, test_db_insert_ue(test_ue, doc));

+

+    /* Send Attach Request */

+    memset(&sess->pdn_connectivity_param,

+            0, sizeof(sess->pdn_connectivity_param));

+    sess->pdn_connectivity_param.eit = 1;

+    sess->pdn_connectivity_param.pco = 1;

+    sess->pdn_connectivity_param.request_type =

+        OGS_NAS_EPS_REQUEST_TYPE_INITIAL;

+    esmbuf = testesm_build_pdn_connectivity_request(

+            sess, false, OGS_NAS_EPS_PDN_TYPE_IPV4V6);

+    ABTS_PTR_NOTNULL(tc, esmbuf);

+

+    memset(&test_ue->attach_request_param,

+            0, sizeof(test_ue->attach_request_param));

+    test_ue->attach_request_param.ms_network_feature_support = 1;

+    emmbuf = testemm_build_attach_request(test_ue, esmbuf, false, false);

+    ABTS_PTR_NOTNULL(tc, emmbuf);

+

+    memset(&test_ue->initial_ue_param, 0, sizeof(test_ue->initial_ue_param));

+    sendbuf = test_s1ap_build_initial_ue_message(

+            test_ue, emmbuf, S1AP_RRC_Establishment_Cause_mo_Signalling, false);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+    rv = testenb_s1ap_send(s1ap, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Receive Authentication Request */

+    recvbuf = testenb_s1ap_read(s1ap);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(test_ue, recvbuf);

+

+    /* Send Authentication response */

+    emmbuf = testemm_build_authentication_response(test_ue);

+    ABTS_PTR_NOTNULL(tc, emmbuf);

+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Receive Security mode Command */

+    recvbuf = testenb_s1ap_read(s1ap);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(test_ue, recvbuf);

+

+    /* Send Security mode complete */

+    test_ue->mobile_identity_imeisv_presence = true;

+    emmbuf = testemm_build_security_mode_complete(test_ue);

+    ABTS_PTR_NOTNULL(tc, emmbuf);

+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Receive ESM Information Request */

+    recvbuf = testenb_s1ap_read(s1ap);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(test_ue, recvbuf);

+

+    /* Send ESM Information Response */

+    esmbuf = testesm_build_esm_information_response(sess);