@@ -2,7 +2,7 @@

 Source: open5gs

 Binary: open5gs-common, open5gs-mme, open5gs-sgwc, open5gs-smf, open5gs-amf, open5gs-sgwu, open5gs-upf, open5gs-hss, open5gs-pcrf, open5gs-nrf, open5gs-scp, open5gs-ausf, open5gs-udm, open5gs-pcf, open5gs-nssf, open5gs-bsf, open5gs-udr, open5gs, open5gs-dbg

 Architecture: any

-Version: 2.6.3.1.2a8a0.202305050026

+Version: 2.6.3.4.4265.202305060026

 Maintainer: Harald Welte <laforge@gnumonks.org>

 Uploaders: Sukchan Lee <acetcom@gmail.com>

 Homepage: https://open5gs.org

@@ -31,8 +31,8 @@

  open5gs-udr deb net optional arch=any

  open5gs-upf deb net optional arch=any

 Checksums-Sha1:

- 5de9bf58267826c0c8e61752c2f8362ca873adde 14116036 open5gs_2.6.3.1.2a8a0.202305050026.tar.xz

+ f2ec326806aa76f52aefc5c88d73c84e9f901b76 14117612 open5gs_2.6.3.4.4265.202305060026.tar.xz

 Checksums-Sha256:

- d48d7eda52d27cafb28c9b6c167bb04464596e2ebdcaaabda895a461d51482fe 14116036 open5gs_2.6.3.1.2a8a0.202305050026.tar.xz

+ 85e35b215e2e3eb56ba2544a65678d8c0d297520892e3e94a70aac90500c480e 14117612 open5gs_2.6.3.4.4265.202305060026.tar.xz

 Files:

- 9265443d1150ac92cb46264cc16efd3d 14116036 open5gs_2.6.3.1.2a8a0.202305050026.tar.xz

+ 22591641af636f67d97b4420b5bc115e 14117612 open5gs_2.6.3.4.4265.202305060026.tar.xz

​

@@ -1 +1 @@

-2.6.3.1-2a8a0.202305050026

+2.6.3.4-4265.202305060026

​

@@ -450,6 +450,24 @@

 #      - addr: 127.0.0.4

 #      - addr: 127.0.0.5

 #        apn: volte

+#

+# o SMF selection by eNodeB TAC

+#   (either single TAC or multiple TACs, DECIMAL representation)

+#

+#   gtpc:

+#     - addr: 127.0.0.4

+#       tac: 26000

+#     - addr: 127.0.2.4

+#       tac: 25000, 27000, 28000

+#

+# o SMF selection by e_cell_id(28bit)

+#   (either single or multiple e_cell_id, HEX representation)

+#

+#   gtpc:

+#     - addr: 127.0.0.4

+#       e_cell_id: abcde01

+#     - addr: 127.0.2.4

+#       e_cell_id: 12345, a9413, 98765

 smf:

     gtpc:

       - addr:

​

@@ -1,8 +1,8 @@

-open5gs (2.6.3.1.2a8a0.202305050026) unstable; urgency=medium

+open5gs (2.6.3.4.4265.202305060026) unstable; urgency=medium

   * Automatically generated changelog entry for building the Osmocom nightly feed

- -- Osmocom OBS scripts <info@osmocom.org>  Fri, 05 May 2023 00:27:48 +0000

+ -- Osmocom OBS scripts <info@osmocom.org>  Sat, 06 May 2023 00:27:41 +0000

 open5gs (2.6.3) unstable; urgency=medium

​

@@ -131,6 +131,11 @@

     subdir('tests')

 endif

+# Check if the 'fuzzing' option is defined

+if get_option('fuzzing')

+    subdir('tests/fuzzing')

+endif

+

 message('\n'.join(

   '',

   '        prefix:                       ' + prefix,

​

@@ -0,0 +1,2 @@

+option('fuzzing', type: 'boolean', value: false, description: 'Enable fuzzing tests')

+option('lib_fuzzing_engine', type : 'string', value : '', description : 'Path to the libFuzzer engine library')

​

@@ -1628,8 +1628,13 @@

                         int family = AF_UNSPEC;

                         int i, num = 0;

                         const char *hostnameOGS_MAX_NUM_OF_HOSTNAME;

-                        const char *apn = NULL;

                         uint16_t port = ogs_gtp_self()->gtpc_port;

+                        const char *apnOGS_MAX_NUM_OF_APN = {NULL,};

+                        uint8_t num_of_apn = 0;

+                        uint16_t tacOGS_MAX_NUM_OF_TAI = {0,};

+                        uint8_t num_of_tac = 0;

+                        uint32_t e_cell_idOGS_MAX_NUM_OF_CELL_ID = {0,};

+                        uint8_t num_of_e_cell_id = 0;

                         if (ogs_yaml_iter_type(&gtpc_array) ==

                                 YAML_MAPPING_NODE) {

@@ -1686,7 +1691,82 @@

                                 const char *v = ogs_yaml_iter_value(&gtpc_iter);

                                 if (v) port = atoi(v);

                             } else if (!strcmp(gtpc_key, "apn")) {

-                                apn = ogs_yaml_iter_value(&gtpc_iter);

+                                ogs_yaml_iter_t apn_iter;

+                                ogs_yaml_iter_recurse(&gtpc_iter, &apn_iter);

+                                ogs_assert(ogs_yaml_iter_type(&apn_iter) !=

+                                    YAML_MAPPING_NODE);

+

+                                do {

+                                    const char *v = NULL;

+

+                                    ogs_assert(num_of_apn <

+                                            OGS_MAX_NUM_OF_APN);

+                                    if (ogs_yaml_iter_type(&apn_iter) ==

+                                            YAML_SEQUENCE_NODE) {

+                                        if (!ogs_yaml_iter_next(&apn_iter))

+                                            break;

+                                    }

+

+                                    v = ogs_yaml_iter_value(&apn_iter);

+                                    if (v) {

+                                        apnnum_of_apn = v;

+                                        num_of_apn++;

+                                    }

+                                } while (

+                                    ogs_yaml_iter_type(&apn_iter) ==

+                                        YAML_SEQUENCE_NODE);

+                            } else if (!strcmp(gtpc_key, "tac")) {

+                                ogs_yaml_iter_t tac_iter;

+                                ogs_yaml_iter_recurse(&gtpc_iter, &tac_iter);

+                                ogs_assert(ogs_yaml_iter_type(&tac_iter) !=

+                                    YAML_MAPPING_NODE);

+

+                                do {

+                                    const char *v = NULL;

+

+                                    ogs_assert(num_of_tac <

+                                            OGS_MAX_NUM_OF_TAI);

+                                    if (ogs_yaml_iter_type(&tac_iter) ==

+                                            YAML_SEQUENCE_NODE) {

+                                        if (!ogs_yaml_iter_next(&tac_iter))

+                                            break;

+                                    }

+

+                                    v = ogs_yaml_iter_value(&tac_iter);

+                                    if (v) {

+                                        tacnum_of_tac = atoi(v);

+                                        num_of_tac++;

+                                    }

+                                } while (

+                                    ogs_yaml_iter_type(&tac_iter) ==

+                                        YAML_SEQUENCE_NODE);

+                            } else if (!strcmp(gtpc_key, "e_cell_id")) {

+                                ogs_yaml_iter_t e_cell_id_iter;

+                                ogs_yaml_iter_recurse(&gtpc_iter,

+                                        &e_cell_id_iter);

+                                ogs_assert(ogs_yaml_iter_type(&e_cell_id_iter)

+                                        != YAML_MAPPING_NODE);

+

+                                do {

+                                    const char *v = NULL;

+

+                                    ogs_assert(num_of_e_cell_id <

+                                            OGS_MAX_NUM_OF_CELL_ID);

+                                    if (ogs_yaml_iter_type(&e_cell_id_iter) ==

+                                            YAML_SEQUENCE_NODE) {

+                                        if (!ogs_yaml_iter_next(

+                                                    &e_cell_id_iter))

+                                            break;

+                                    }

+                                    v = ogs_yaml_iter_value(&e_cell_id_iter);

+                                    if (v) {

+                                        e_cell_idnum_of_e_cell_id

+                                            = ogs_uint64_from_string((char*)v);

+                                        num_of_e_cell_id++;

+                                    }

+                                } while (

+                                    ogs_yaml_iter_type(&e_cell_id_iter) ==

+                                        YAML_SEQUENCE_NODE);

                             } else

                                 ogs_warn("unknown key `%s`", gtpc_key);

                         }

@@ -1708,7 +1788,18 @@

                         pgw = mme_pgw_add(addr);

                         ogs_assert(pgw);

-                        pgw->apn = apn;

+                        pgw->num_of_apn = num_of_apn;

+                        if (num_of_apn != 0)

+                            memcpy(pgw->apn, apn, sizeof(pgw->apn));

+

+                        pgw->num_of_tac = num_of_tac;

+                        if (num_of_tac != 0)

+                            memcpy(pgw->tac, tac, sizeof(pgw->tac));

+

+                        pgw->num_of_e_cell_id = num_of_e_cell_id;

+                        if (num_of_e_cell_id != 0)

+                            memcpy(pgw->e_cell_id, e_cell_id,

+                                    sizeof(pgw->e_cell_id));

                     } while (ogs_yaml_iter_type(&gtpc_array) ==

                             YAML_SEQUENCE_NODE);

@@ -1881,8 +1972,33 @@

         mme_pgw_remove(pgw);

 }

-ogs_sockaddr_t *mme_pgw_addr_find_by_apn(

-        ogs_list_t *list, int family, char *apn)

+static bool compare_apn_enb_info(

+    mme_pgw_t *pgw, mme_sess_t *sess)

+{

+    mme_ue_t *mme_ue = NULL;

+    int i;

+

+    ogs_assert(pgw);

+    ogs_assert(sess);

+    ogs_assert(sess->session);

+    ogs_assert(sess->session->name);

+    mme_ue = sess->mme_ue;

+    ogs_assert(mme_ue);

+

+    for (i = 0; i < pgw->num_of_apn; i++)

+      if (!ogs_strcasecmp(pgw->apni, sess->session->name)) return true;

+

+    for (i = 0; i < pgw->num_of_e_cell_id; i++)

+      if (pgw->e_cell_idi == mme_ue->e_cgi.cell_id) return true;

+

+    for (i = 0; i < pgw->num_of_tac; i++)

+      if (pgw->taci == mme_ue->tai.tac) return true;

+

+    return false;

+}

+

+ogs_sockaddr_t *mme_pgw_addr_find_by_apn_enb(

+    ogs_list_t *list, int family, mme_sess_t *sess)

 {

     mme_pgw_t *pgw = NULL;

     ogs_assert(list);

@@ -1893,7 +2009,7 @@

         while (addr) {

             if (addr->ogs_sa_family == family &&

-                (!apn || (pgw->apn && !ogs_strcasecmp(apn, pgw->apn)))) {

+                (!sess || compare_apn_enb_info(pgw, sess))) {

                 return addr;

             }

             addr = addr->next;

@@ -3480,8 +3596,9 @@

     pti = message->esm.h.procedure_transaction_identity;

     ebi = message->esm.h.eps_bearer_identity;

-    ogs_debug("mme_bearer_find_or_add_by_message() PTI:%d, EBI:%d",

-            pti, ebi);

+    ogs_debug("mme_bearer_find_or_add_by_message() : "

+            "ESM message type:%d, PTI:%d, EBI:%d",

+            message->esm.h.message_type, pti, ebi);

     if (ebi != OGS_NAS_EPS_BEARER_IDENTITY_UNASSIGNED) {

         bearer = mme_bearer_find_by_ue_ebi(mme_ue, ebi);

@@ -3620,7 +3737,11 @@

     }

     bearer = mme_default_bearer_in_sess(sess);

-    ogs_assert(bearer);

+    if (!bearer) {

+        ogs_error("No Bearer(%d) : ESM message type:%d, PTI:%d, EBI:%d",

+                mme_sess_count(mme_ue), message->esm.h.message_type, pti, ebi);

+        ogs_assert_if_reached();

+    }

     return bearer;

 }

​

@@ -176,7 +176,13 @@

     ogs_lnode_t     lnode;

     ogs_sockaddr_t  *sa_list;

-    const char      *apn;

+

+    const char      *apnOGS_MAX_NUM_OF_APN;

+    uint8_t         num_of_apn;

+    uint16_t        tacOGS_MAX_NUM_OF_TAI;

+    uint8_t         num_of_tac;

+    uint32_t        e_cell_idOGS_MAX_NUM_OF_CELL_ID;

+    uint8_t         num_of_e_cell_id;

 } mme_pgw_t;

 #define MME_SGSAP_IS_CONNECTED(__mME) \

@@ -613,6 +619,20 @@

         ((__mME)->sgw_ue)->sgw_s11_teid = 0; \

     } while(0)

+#define MME_SESS_CLEAR(__sESS) \

+    do { \

+        mme_ue_t *mme_ue = NULL; \

+        ogs_assert(__sESS); \

+        mme_ue = __sESS->mme_ue; \

+        ogs_assert(mme_ue); \

+        ogs_info("Removed Session: UE IMSI:%s APN:%s", \

+                mme_ue->imsi_bcd, \

+                sess->session ? sess->session->name : "Unknown"); \

+        if (mme_sess_count(mme_ue) == 1) /* Last Session */ \

+            CLEAR_SESSION_CONTEXT(mme_ue); \

+        mme_sess_remove(sess); \

+    } while(0)

+

 #define ACTIVE_EPS_BEARERS_IS_AVAIABLE(__mME) \

     (mme_ue_have_active_eps_bearers(__mME))

 #define MME_SESSION_RELEASE_PENDING(__mME) \

@@ -764,8 +784,8 @@

 mme_pgw_t *mme_pgw_add(ogs_sockaddr_t *addr);

 void mme_pgw_remove(mme_pgw_t *pgw);

 void mme_pgw_remove_all(void);

-ogs_sockaddr_t *mme_pgw_addr_find_by_apn(

-        ogs_list_t *list, int family, char *apn);

+ogs_sockaddr_t *mme_pgw_addr_find_by_apn_enb(

+        ogs_list_t *list, int family, mme_sess_t *sess);

 mme_vlr_t *mme_vlr_add(ogs_sockaddr_t *sa_list, ogs_sockopt_t *option);

 void mme_vlr_remove(mme_vlr_t *vlr);

​

@@ -179,9 +179,9 @@

     OGS_SETUP_GTPC_SERVER;

-    mme_self()->pgw_addr = mme_pgw_addr_find_by_apn(

+    mme_self()->pgw_addr = mme_pgw_addr_find_by_apn_enb(

             &mme_self()->pgw_list, AF_INET, NULL);

-    mme_self()->pgw_addr6 = mme_pgw_addr_find_by_apn(

+    mme_self()->pgw_addr6 = mme_pgw_addr_find_by_apn_enb(

             &mme_self()->pgw_list, AF_INET6, NULL);

     ogs_assert(mme_self()->pgw_addr || mme_self()->pgw_addr6);

@@ -336,7 +336,7 @@

         if (MME_HAVE_SGW_S1U_PATH(sess)) {

             mme_gtp_send_delete_session_request(sgw_ue, sess, action);

         } else {

-            mme_sess_remove(sess);

+            MME_SESS_CLEAR(sess);

         }

     }

 }

​

@@ -145,10 +145,10 @@

         ogs_sockaddr_t *pgw_addr = NULL;

         ogs_sockaddr_t *pgw_addr6 = NULL;

-        pgw_addr = mme_pgw_addr_find_by_apn(

-                &mme_self()->pgw_list, AF_INET, session->name);

-        pgw_addr6 = mme_pgw_addr_find_by_apn(

-                &mme_self()->pgw_list, AF_INET6, session->name);

+        pgw_addr = mme_pgw_addr_find_by_apn_enb(

+                &mme_self()->pgw_list, AF_INET, sess);

+        pgw_addr6 = mme_pgw_addr_find_by_apn_enb(

+                &mme_self()->pgw_list, AF_INET6, sess);

         if (!pgw_addr && !pgw_addr6) {

             pgw_addr = mme_self()->pgw_addr;

             pgw_addr6 = mme_self()->pgw_addr6;

​

@@ -745,10 +745,7 @@

         ogs_assert_if_reached();

     }

-    if (mme_sess_count(mme_ue) == 1) /* Last Session */

-        CLEAR_SESSION_CONTEXT(mme_ue);

-

-    mme_sess_remove(sess);

+    MME_SESS_CLEAR(sess);

 }

 void mme_s11_handle_create_bearer_request(

​

@@ -365,7 +365,7 @@

             if (default_bearer->ebi == bearer->ebi) {

                 /* if the bearer is a default bearer,

                  * remove all session context linked the default bearer */

-                mme_sess_remove(sess);

+                MME_SESS_CLEAR(sess);

             } else {

                 /* if the bearer is not a default bearer,

                  * just remove the bearer context */

@@ -374,7 +374,7 @@

         } else if (OGS_FSM_CHECK(&bearer->sm, esm_state_pdn_did_disconnect)) {

             ogs_assert(default_bearer->ebi == bearer->ebi);

-            mme_sess_remove(sess);

+            MME_SESS_CLEAR(sess);

         } else if (OGS_FSM_CHECK(&bearer->sm, esm_state_exception)) {

@@ -386,7 +386,7 @@

              *

              * Just we'll remove MME session context.

              */

-            mme_sess_remove(sess);

+            MME_SESS_CLEAR(sess);

         }

         ogs_pkbuf_free(pkbuf);

​

+(directory)

​

@@ -0,0 +1,34 @@

+/*

+ * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>

+ *

+ * This file is part of Open5GS.

+ *

+ * This program is free software: you can redistribute it and/or modify

+ * it under the terms of the GNU Affero General Public License as published by

+ * the Free Software Foundation, either version 3 of the License, or

+ * (at your option) any later version.

+ *

+ * This program is distributed in the hope that it will be useful,

+ * but WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ * GNU General Public License for more details.

+ *

+ * You should have received a copy of the GNU General Public License

+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.

+ */

+#include "ogs-core.h"

+#include "core/abts.h"

+

+static int initialized = 0;

+

+void initialize(void) {

+

+    ogs_pkbuf_config_t config;

+

+    ogs_core_initialize();

+

+    ogs_pkbuf_default_init(&config);

+    ogs_pkbuf_default_create(&config);

+

+    initialized = 1;

+}

​

@@ -0,0 +1,58 @@

+/*

+ * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>

+ *

+ * This file is part of Open5GS.

+ *

+ * This program is free software: you can redistribute it and/or modify

+ * it under the terms of the GNU Affero General Public License as published by

+ * the Free Software Foundation, either version 3 of the License, or

+ * (at your option) any later version.

+ *

+ * This program is distributed in the hope that it will be useful,

+ * but WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ * GNU General Public License for more details.

+ *

+ * You should have received a copy of the GNU General Public License

+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.

+ */

+

+#include <stdio.h>

+#include <stdint.h>

+

+#include "fuzzing.h"

+#include "ogs-gtp.h"

+

+#define kMinInputLength 5

+#define kMaxInputLength 1024

+

+extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) 

+{ /* open5gs/tests/unit/gtp-message-test.c */

+

+    if (Size < kMinInputLength || Size > kMaxInputLength) {

+        return 1;

+    }

+

+    if (!initialized) {

+        initialize();

+        ogs_log_install_domain(&__ogs_gtp_domain, "gtp", OGS_LOG_NONE);

+        ogs_log_install_domain(&__ogs_tlv_domain, "tlv", OGS_LOG_NONE);

+    }

+

+    int result;

+    ogs_pkbuf_t *pkbuf;

+    ogs_gtp2_create_session_request_t req;

+

+    pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);

+    if (pkbuf == NULL) {

+        return 1;

+    }

+

+    ogs_pkbuf_put_data(pkbuf, Data, Size);

+

+    ogs_tlv_parse_msg(&req, &ogs_gtp2_tlv_desc_create_session_request, pkbuf, OGS_TLV_MODE_T1_L2_I1);

+

+    ogs_pkbuf_free(pkbuf);

+

+    return 0;

+}

​

@@ -0,0 +1,41 @@

+# Copyright (C) 2019 by Sukchan Lee <acetcom@gmail.com>

+

+# This file is part of Open5GS.

+

+# This program is free software: you can redistribute it and/or modify

+# it under the terms of the GNU Affero General Public License as published by

+# the Free Software Foundation, either version 3 of the License, or

+# (at your option) any later version.

+#

+# This program is distributed in the hope that it will be useful,

+# but WITHOUT ANY WARRANTY; without even the implied warranty of

+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+# GNU General Public License for more details.

+#

+# You should have received a copy of the GNU General Public License

+# along with this program.  If not, see <https://www.gnu.org/licenses/>.

+

+

+# Get the lib_fuzzing_engine build option.

+lib_fuzzing_engine = get_option('lib_fuzzing_engine')

+

+# All fuzzer sources.

+gtp_message_source = files('gtp-message-fuzz.c')

+nas_message_source = files('nas-message-fuzz.c')

+

+# Build all executable 

+executable(

+    'gtp_message_fuzz',

+    sources : gtp_message_source,

+    c_args : testunit_core_cc_flags, sbi_cc_flags,

+    dependencies : libgtp_dep,

+    link_args: lib_fuzzing_engine

+)

+

+executable(

+    'nas_message_fuzz',

+    sources : nas_message_source,

+    c_args : testunit_core_cc_flags, sbi_cc_flags,

+    dependencies : libnas_eps_dep,

+    link_args: lib_fuzzing_engine

+)

​

@@ -0,0 +1,57 @@

+/*

+ * Copyright (C) 2019-2023 by Sukchan Lee <acetcom@gmail.com>

+ *

+ * This file is part of Open5GS.

+ *

+ * This program is free software: you can redistribute it and/or modify

+ * it under the terms of the GNU Affero General Public License as published by

+ * the Free Software Foundation, either version 3 of the License, or

+ * (at your option) any later version.

+ *

+ * This program is distributed in the hope that it will be useful,

+ * but WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ * GNU General Public License for more details.

+ *

+ * You should have received a copy of the GNU General Public License

+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.

+ */

+

+#include <stdio.h>

+#include <stdint.h>

+

+#include "fuzzing.h"

+#include "ogs-nas-eps.h"

+

+#define kMinInputLength 5

+#define kMaxInputLength 1024

+

+extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) 

+{ /* open5gs/tests/unit/nas-message-test.c */

+

+    if (Size < kMinInputLength || Size > kMaxInputLength) {

+        return 1;

+    }

+

+    if (!initialized) {

+        initialize();

+        ogs_log_install_domain(&__ogs_nas_domain, "nas", OGS_LOG_NONE);

+    }

+

+    int result;

+    ogs_pkbuf_t *pkbuf;

+    ogs_nas_eps_message_t message;

+

+    pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);

+    if (pkbuf == NULL) {

+        return 1;

+    }

+

+    ogs_pkbuf_put_data(pkbuf, Data, Size);

+

+    result = ogs_nas_emm_decode(&message, pkbuf);

+

+    ogs_pkbuf_free(pkbuf);

+

+    return result;

+}

​