@@ -2,7 +2,7 @@

 Source: open5gs

 Binary: open5gs-common, open5gs-mme, open5gs-sgwc, open5gs-smf, open5gs-amf, open5gs-sgwu, open5gs-upf, open5gs-hss, open5gs-pcrf, open5gs-nrf, open5gs-scp, open5gs-sepp, open5gs-ausf, open5gs-udm, open5gs-pcf, open5gs-nssf, open5gs-bsf, open5gs-udr, open5gs, open5gs-dbg

 Architecture: any

-Version: 2.7.0.115.a667.202403232026

+Version: 2.7.0.118.390a9.202403242026

 Maintainer: Harald Welte <laforge@gnumonks.org>

 Uploaders: Sukchan Lee <acetcom@gmail.com>

 Homepage: https://open5gs.org

@@ -32,8 +32,8 @@

  open5gs-udr deb net optional arch=any

  open5gs-upf deb net optional arch=any

 Checksums-Sha1:

- 867212c8f8f23e1f9662d2ab44a9033d35e71d01 14485012 open5gs_2.7.0.115.a667.202403232026.tar.xz

+ 4d846787bcac6196229813eb41ccfb4f6f34b8e4 14485780 open5gs_2.7.0.118.390a9.202403242026.tar.xz

 Checksums-Sha256:

- f8d079bb16b2381a1f2f2a6bd17a5fb0ad3c2ff775a7ac76a1969677ae2026bd 14485012 open5gs_2.7.0.115.a667.202403232026.tar.xz

+ 4a75c7d2d3c632c8c300b07bd98e10b77c174943ce6f5f6496f806330587aebd 14485780 open5gs_2.7.0.118.390a9.202403242026.tar.xz

 Files:

- 9c66f34d17f5374571dd701501702105 14485012 open5gs_2.7.0.115.a667.202403232026.tar.xz

+ 423c359c929c804799c0fd1cd1866ea3 14485780 open5gs_2.7.0.118.390a9.202403242026.tar.xz

​

@@ -1 +1 @@

-2.7.0.115-a667.202403232026

+2.7.0.118-390a9.202403242026

​

@@ -1,8 +1,8 @@

-open5gs (2.7.0.115.a667.202403232026) unstable; urgency=medium

+open5gs (2.7.0.118.390a9.202403242026) unstable; urgency=medium

   * Automatically generated changelog entry for building the Osmocom nightly feed

- -- Osmocom OBS scripts <info@osmocom.org>  Sat, 23 Mar 2024 20:27:39 +0000

+ -- Osmocom OBS scripts <info@osmocom.org>  Sun, 24 Mar 2024 20:27:37 +0000

 open5gs (2.7.0) unstable; urgency=medium

​

@@ -334,7 +334,7 @@

 ```bash

 $ cp srsenb/enb.conf.example srsenb/enb.conf

 $ cp srsenb/rr.conf.example srsenb/rr.conf

-$ cp srsenb/drb.conf.example srsenb/drb.conf

+$ cp srsenb/rb.conf.example srsenb/rb.conf

 $ cp srsenb/sib.conf.example srsenb/sib.conf

 ```

​

@@ -199,6 +199,8 @@

         ogs_list_add(&list, &this->lnode);

     }

+    /* You should not perform a delete on a timer using ogs_timer_delete()

+     * in a callback function this->cb(). */

     ogs_list_for_each(&list, lnode) {

         this = ogs_rb_entry(lnode, ogs_timer_t, lnode);

         ogs_timer_stop(this);

​

@@ -4,6 +4,8 @@

 #include <string.h>

+#include "ogs-core.h"

+

 #define NUM_ECC_DIGITS (ECC_BYTES/8)

 #define MAX_TRIES 16

@@ -82,6 +84,7 @@

     HCRYPTPROV l_prov;

     if(!CryptAcquireContext(&l_prov, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))

     {

+        ogs_error("CryptAcquireContext() failed");

         return 0;

     }

@@ -107,9 +110,11 @@

     int l_fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC);

     if(l_fd == -1)

     {

+        ogs_error("open(/dev/urandom) failed");

         l_fd = open("/dev/random", O_RDONLY | O_CLOEXEC);

         if(l_fd == -1)

         {

+            ogs_error("open(/dev/random) failed");

             return 0;

         }

     }

@@ -122,6 +127,7 @@

         if(l_read <= 0)

         { // read failed

             close(l_fd);

+            ogs_error("read() failed");

             return 0;

         }

         l_left -= l_read;

@@ -1073,6 +1079,7 @@

     {

         if(!getRandomNumber(l_private) || (l_tries++ >= MAX_TRIES))

         {

+            ogs_error("getRandomNumber() failed %d", l_tries);

             return 0;

         }

         if(vli_isZero(l_private))

@@ -1096,6 +1103,45 @@

     return 1;

 }

+#define CURVE_A_32 {0xFFFFFFFFFFFFFFFCull, 0x00000000FFFFFFFFull, 0x0000000000000000ull, 0xFFFFFFFF00000001ull}

+

+static int ecdh_validate_pubkey(EccPoint l_public, uint64_t l_privateNUM_ECC_DIGITS) {

+    uint64_t leftNUM_ECC_DIGITS;

+    uint64_t rightNUM_ECC_DIGITS;

+    uint64_t curve_aNUM_ECC_DIGITS = CURVE_A_32;

+    /*

+     * To ensure l_public is a valid point on the curve, we need to check:

+     * y^2 % p == (x^3 + a * x + b) % p)

+     */

+

+    /* Compute y^2 % p and store in `left` */

+    vli_modSquare_fast(left, l_public.y);

+

+    /* Compute x^3 and store in `right` */

+    vli_modSquare_fast(right, l_public.x);

+    vli_modMult_fast(right, right, l_public.x);

+

+    /* Compute a * x and store in `curve_a` */

+    vli_modMult_fast(curve_a, curve_a, l_public.x);

+    /* Store ((a * x) + b) % p in `curve_a */

+    vli_modAdd(curve_a, curve_a, curve_b, curve_p);

+

+    /*

+     * Combine x^3 and ((a * x) + b) to make (x^3 + a * x + b) % p);

+     * store in `right`

+     */

+    vli_modAdd(right, right, curve_a, curve_p);

+

+    int i;

+    for (i = 0; i < NUM_ECC_DIGITS; i++) {

+        if (lefti != righti) {

+            return 0; // y^2 % p != (x^3 + a * x + b) % p)

+        }

+    }

+

+    return 1;

+}

+

 int ecdh_shared_secret(const uint8_t p_publicKeyECC_BYTES+1, const uint8_t p_privateKeyECC_BYTES, uint8_t p_secretECC_BYTES)

 {

     EccPoint l_public;

@@ -1104,12 +1150,23 @@

     if(!getRandomNumber(l_random))

     {

+        ogs_error("getRandomNumber() failed");

         return 0;

     }

     ecc_point_decompress(&l_public, p_publicKey);

     ecc_bytes2native(l_private, p_privateKey);

+    /*

+     * Validate received public key `p_publicKey` is a valid point

+     * on curve P-256

+     */

+    if (!ecdh_validate_pubkey(l_public, l_private))

+    {

+        ogs_error("ecdh_validate_pubkey() failed");

+        return 0;

+    }

+

     EccPoint l_product;

     EccPoint_mult(&l_product, &l_public, l_private, l_random);

@@ -1202,6 +1259,7 @@

     {

         if(!getRandomNumber(k) || (l_tries++ >= MAX_TRIES))

         {

+            ogs_error("getRandomNumber() failed %d", l_tries);

             return 0;

         }

         if(vli_isZero(k))

@@ -1256,11 +1314,13 @@

     if(vli_isZero(l_r) || vli_isZero(l_s))

     { /* r, s must not be 0. */

+        ogs_error("r, s must not be 0");

         return 0;

     }

     if(vli_cmp(curve_n, l_r) != 1 || vli_cmp(curve_n, l_s) != 1)

     { /* r, s must be < n. */

+        ogs_error("r, s must be < n");

         return 0;

     }

​

@@ -870,6 +870,11 @@

     return node;

 }

+ogs_pfcp_node_t *ogs_pfcp_node_cycle(ogs_pfcp_node_t *node)

+{

+    return ogs_pool_cycle(&ogs_pfcp_node_pool, node);

+}

+

 void ogs_pfcp_node_free(ogs_pfcp_node_t *node)

 {

     ogs_assert(node);

​

@@ -393,6 +393,7 @@

 int ogs_pfcp_context_parse_config(const char *local, const char *remote);

 ogs_pfcp_node_t *ogs_pfcp_node_new(ogs_sockaddr_t *sa_list);

+ogs_pfcp_node_t *ogs_pfcp_node_cycle(ogs_pfcp_node_t *node);

 void ogs_pfcp_node_free(ogs_pfcp_node_t *node);

 ogs_pfcp_node_t *ogs_pfcp_node_add(

​

@@ -161,11 +161,6 @@

     return xact;

 }

-ogs_pfcp_xact_t *ogs_pfcp_xact_cycle(ogs_pfcp_xact_t *xact)

-{

-    return ogs_pool_cycle(&pool, xact);

-}

-

 void ogs_pfcp_xact_delete_all(ogs_pfcp_node_t *node)

 {

     ogs_pfcp_xact_t *xact = NULL, *next_xact = NULL;

​

@@ -133,7 +133,6 @@

 ogs_pfcp_xact_t *ogs_pfcp_xact_local_create(ogs_pfcp_node_t *node,

         void (*cb)(ogs_pfcp_xact_t *xact, void *data), void *data);

-ogs_pfcp_xact_t *ogs_pfcp_xact_cycle(ogs_pfcp_xact_t *xact);

 void ogs_pfcp_xact_delete_all(ogs_pfcp_node_t *node);

 int ogs_pfcp_xact_update_tx(ogs_pfcp_xact_t *xact,

​

@@ -236,13 +236,17 @@

             mme_csmap_t *csmap = mme_csmap_find_by_tai(&mme_ue->tai);

             mme_ue->csmap = csmap;

-            if (csmap) {

-                ogs_assert(OGS_OK ==

-                    sgsap_send_location_update_request(mme_ue));

-            } else {

+            if (!csmap ||

+                mme_ue->network_access_mode ==

+                    OGS_NETWORK_ACCESS_MODE_ONLY_PACKET ||

+                mme_ue->nas_eps.attach.value ==

+                    OGS_NAS_ATTACH_TYPE_EPS_ATTACH) {

                 r = nas_eps_send_attach_accept(mme_ue);

                 ogs_expect(r == OGS_OK);

                 ogs_assert(r != OGS_ERROR);

+            } else {

+                ogs_assert(OGS_OK ==

+                    sgsap_send_location_update_request(mme_ue));

             }

         } else {

             ogs_assert(OGS_OK ==

​

@@ -427,17 +427,20 @@

         mme_csmap_t *csmap = mme_csmap_find_by_tai(&mme_ue->tai);

         mme_ue->csmap = csmap;

-        if (csmap) {

-            ogs_assert(OGS_PDU_SESSION_TYPE_IS_VALID(

-                        session->paa.session_type));

-            ogs_assert(OGS_OK ==

-                sgsap_send_location_update_request(mme_ue));

-        } else {

+        if (!csmap ||

+            mme_ue->network_access_mode ==

+                OGS_NETWORK_ACCESS_MODE_ONLY_PACKET ||

+            mme_ue->nas_eps.attach.value ==

+                OGS_NAS_ATTACH_TYPE_EPS_ATTACH) {

             ogs_assert(OGS_PDU_SESSION_TYPE_IS_VALID(

                         session->paa.session_type));

             r = nas_eps_send_attach_accept(mme_ue);

             ogs_expect(r == OGS_OK);

             ogs_assert(r != OGS_ERROR);

+        } else {

+            ogs_assert(OGS_PDU_SESSION_TYPE_IS_VALID(

+                        session->paa.session_type));

+            ogs_assert(OGS_OK == sgsap_send_location_update_request(mme_ue));

         }

     } else if (create_action == OGS_GTP_CREATE_IN_TRACKING_AREA_UPDATE) {

​

@@ -210,11 +210,9 @@

                     ogs_plmn_id_hexdump(&lai->nas_plmn_id), lai->lac);

     }

-    r = nas_eps_send_attach_reject(mme_ue->enb_ue, mme_ue,

-            emm_cause, OGS_NAS_ESM_CAUSE_PROTOCOL_ERROR_UNSPECIFIED);

+    r = nas_eps_send_attach_accept(mme_ue);

     ogs_expect(r == OGS_OK);

     ogs_assert(r != OGS_ERROR);

-    mme_send_delete_session_or_mme_ue_context_release(mme_ue);

     return;

​

@@ -356,10 +356,6 @@

         }

         break;

     case SGWC_EVT_SXA_NO_HEARTBEAT:

-

-        /* 'node' context was removed in ogs_pfcp_xact_delete(xact)

-         * So, we should not use PFCP node here */

-

         ogs_warn("No Heartbeat from SGW-U %s:%d",

                     OGS_ADDR(addr, buf), OGS_PORT(addr));

         OGS_FSM_TRAN(s, sgwc_pfcp_state_will_associate);

​

@@ -318,10 +318,6 @@

         }

         break;

     case SGWU_EVT_SXA_NO_HEARTBEAT:

-

-        /* 'node' context was removed in ogs_pfcp_xact_delete(xact)

-         * So, we should not use PFCP node here */

-

         ogs_warn("No Heartbeat from SGW-C %s:%d",

                     OGS_ADDR(addr, buf), OGS_PORT(addr));

         OGS_FSM_TRAN(s, sgwu_pfcp_state_will_associate);

​

@@ -222,8 +222,11 @@

     ogs_assert(xact);

     ogs_assert(data);

-    sess = data;

-    ogs_assert(sess);

+    sess = smf_sess_cycle(data);

+    if (!sess) {

+        ogs_warn("Session has already been removed");

+        return;

+    }

     smf_ue = sess->smf_ue;

     ogs_assert(smf_ue);

@@ -288,7 +291,21 @@

         ogs_free(strerror);

-        smf_sess_remove(sess);

+        /* We mustn't remove sess here. Removing a session may delete PFCP xact

+           timers and we must not delete any timers from within a timer

+           callback. Instead, we shall emit a new event to trigger session

+           removal from pfcp-sm state machine. */

+        e = smf_event_new(SMF_EVT_N4_TIMER);

+        ogs_assert(e);

+        e->sess = sess;

+        e->h.timer_id = SMF_TIMER_PFCP_NO_DELETION_RESPONSE;

+        e->pfcp_node = sess->pfcp_node;

+

+        rv = ogs_queue_push(ogs_app()->queue, e);

+        if (rv != OGS_OK) {

+            ogs_error("ogs_queue_push() failed:%d", (int)rv);

+            ogs_event_free(e);

+        }

         break;

     default:

         ogs_error("Not implemented type:%d", type);

​

@@ -117,14 +117,21 @@

             ogs_pfcp_cp_send_association_setup_request(node, node_timeout);

             break;

         case SMF_TIMER_PFCP_NO_ESTABLISHMENT_RESPONSE:

-            sess = e->sess;

-            sess = smf_sess_cycle(sess);

+            sess = smf_sess_cycle(e->sess);

             if (!sess) {

                 ogs_warn("Session has already been removed");

                 break;

             }

             ogs_fsm_dispatch(&sess->sm, e);

             break;

+        case SMF_TIMER_PFCP_NO_DELETION_RESPONSE:

+            sess = smf_sess_cycle(e->sess);

+            if (!sess) {

+                ogs_warn("Session has already been removed");

+                break;

+            }

+            SMF_SESS_CLEAR(sess);

+            break;

         default:

             ogs_error("Unknown timer%s:%d",

                     smf_timer_get_name(e->h.timer_id), e->h.timer_id);

@@ -386,14 +393,21 @@

                 ogs_pfcp_send_heartbeat_request(node, node_timeout));

             break;

         case SMF_TIMER_PFCP_NO_ESTABLISHMENT_RESPONSE:

-            sess = e->sess;

-            sess = smf_sess_cycle(sess);

+            sess = smf_sess_cycle(e->sess);

             if (!sess) {

                 ogs_warn("Session has already been removed");

                 break;

             }

             ogs_fsm_dispatch(&sess->sm, e);

             break;

+        case SMF_TIMER_PFCP_NO_DELETION_RESPONSE:

+            sess = smf_sess_cycle(e->sess);

+            if (!sess) {

+                ogs_warn("Session has already been removed");

+                break;

+            }

+            SMF_SESS_CLEAR(sess);

+            break;

         default:

             ogs_error("Unknown timer%s:%d",

                     smf_timer_get_name(e->h.timer_id), e->h.timer_id);

@@ -401,12 +415,19 @@

         }

         break;

     case SMF_EVT_N4_NO_HEARTBEAT:

-

-        /* 'node' context was removed in ogs_pfcp_xact_delete(xact)

-         * So, we should not use PFCP node here */

-

         ogs_warn("No Heartbeat from UPF %s:%d",

                     OGS_ADDR(addr, buf), OGS_PORT(addr));

+

+        /*

+         * reselect_upf() should not be executed on node_timeout

+         * because the timer cannot be deleted in the timer expiration function.

+         *

+         * Note that reselct_upf contains SMF_SESS_CLEAR.

+         */

+        node = e->pfcp_node;

+        ogs_assert(node);

+        reselect_upf(node);

+

         OGS_FSM_TRAN(s, smf_pfcp_state_will_associate);

         break;

     default:

@@ -550,7 +571,6 @@

     switch (type) {

     case OGS_PFCP_HEARTBEAT_REQUEST_TYPE:

         ogs_assert(data);

-        reselect_upf(data);

         e = smf_event_new(SMF_EVT_N4_NO_HEARTBEAT);

         e->pfcp_node = data;

​

@@ -42,6 +42,8 @@

         return "SMF_TIMER_PFCP_NO_HEARTBEAT";

     case SMF_TIMER_PFCP_NO_ESTABLISHMENT_RESPONSE:

         return "SMF_TIMER_PFCP_NO_ESTABLISHMENT_RESPONSE";

+    case SMF_TIMER_PFCP_NO_DELETION_RESPONSE:

+        return "SMF_TIMER_PFCP_NO_DELETION_RESPONSE";

     default: 

        break;

     }

​

@@ -33,6 +33,7 @@

     SMF_TIMER_PFCP_ASSOCIATION,

     SMF_TIMER_PFCP_NO_HEARTBEAT,

     SMF_TIMER_PFCP_NO_ESTABLISHMENT_RESPONSE,

+    SMF_TIMER_PFCP_NO_DELETION_RESPONSE,

     MAX_NUM_OF_SMF_TIMER,

​

@@ -322,10 +322,6 @@

         }

         break;

     case UPF_EVT_N4_NO_HEARTBEAT:

-

-        /* 'node' context was removed in ogs_pfcp_xact_delete(xact)

-         * So, we should not use PFCP node here */

-

         ogs_warn("No Heartbeat from SMF %s:%d",

                     OGS_ADDR(addr, buf), OGS_PORT(addr));

         OGS_FSM_TRAN(s, upf_pfcp_state_will_associate);

​

@@ -1,5 +1,5 @@

-if cc.has_function('regexec', prefix : '#include <regex.h>')

-  conf_data = configuration_data()

+conf_data = configuration_data()

+if cc.has_header_symbol('regex.h', 'REG_STARTEND')

   conf_data.set('HAVE_REG_STARTEND', 1)

 endif

 configure_file(output : 'rt_default-host.h',

​

@@ -470,11 +470,84 @@

     rv = testvlr_sgsap_send(sgsap, sendbuf);

     ABTS_INT_EQUAL(tc, OGS_OK, rv);

-    /* Receive Attach Reject */

+    /* Receive Initial Context Setup Request +

+     * Attach Accept +

+     * Activate Default Bearer Context Request */

     recvbuf = testenb_s1ap_read(s1ap);

     ABTS_PTR_NOTNULL(tc, recvbuf);

     tests1ap_recv(test_ue, recvbuf);

+    /* Send Initial Context Setup Response */

+    sendbuf = test_s1ap_build_initial_context_setup_response(test_ue);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Send Attach Complete + Activate default EPS bearer cotext accept */

+    test_ue->nr_cgi.cell_id = 0x1234502;

+    bearer = test_bearer_find_by_ue_ebi(test_ue, 5);

+    ogs_assert(bearer);

+    esmbuf = testesm_build_activate_default_eps_bearer_context_accept(

+            bearer, false);

+    ABTS_PTR_NOTNULL(tc, esmbuf);

+    emmbuf = testemm_build_attach_complete(test_ue, esmbuf);

+    ABTS_PTR_NOTNULL(tc, emmbuf);

+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Receive EMM information */

+    recvbuf = testenb_s1ap_read(s1ap);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(test_ue, recvbuf);

+

+    /* Send UE Context Release Request */

+    sendbuf = test_s1ap_build_ue_context_release_request(test_ue,

+            S1AP_Cause_PR_radioNetwork, S1AP_CauseRadioNetwork_user_inactivity);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Receive UE Context Release Command */

+    recvbuf = testenb_s1ap_read(s1ap);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(test_ue, recvbuf);

+

+    /* Send UE Context Release Complete */

+    sendbuf = test_s1ap_build_ue_context_release_complete(test_ue);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Send Service Request */

+    emmbuf = testemm_build_service_request(test_ue);

+    ABTS_PTR_NOTNULL(tc, emmbuf);

+    sendbuf = test_s1ap_build_initial_ue_message(

+            test_ue, emmbuf, S1AP_RRC_Establishment_Cause_mo_Data, true);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Receive Initial Context Setup Request */

+    recvbuf = testenb_s1ap_read(s1ap);

+    ABTS_PTR_NOTNULL(tc, recvbuf);

+    tests1ap_recv(test_ue, recvbuf);

+

+    /* Send Initial Context Setup Response */

+    sendbuf = test_s1ap_build_initial_context_setup_response(test_ue);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

+    /* Send Detach Request */

+    emmbuf = testemm_build_detach_request(test_ue, 1, true, true);

+    ABTS_PTR_NOTNULL(tc, emmbuf);

+    sendbuf = test_s1ap_build_uplink_nas_transport(test_ue, emmbuf);

+    ABTS_PTR_NOTNULL(tc, sendbuf);

+    rv = testenb_s1ap_send(s1ap, sendbuf);

+    ABTS_INT_EQUAL(tc, OGS_OK, rv);

+

     /* Receive UE Context Release Command */

     recvbuf = testenb_s1ap_read(s1ap);

     ABTS_PTR_NOTNULL(tc, recvbuf);

​