Find a file
Sukchan Lee d261bd43d8
Some checks are pending
CIFuzz / Fuzzing (push) Waiting to run
Meson Continuous Integration / Build and Test on Ubuntu Latest (push) Waiting to run
[AMF/MME] Reject setup responses on non-serving contexts
During handover the target ran_ue/enb_ue is linked to the same
amf_ue/mme_ue before the UE has moved, and after HandoverCancel it is
only unlinked and removed once the RAN node answers
UEContextReleaseCommand with UEContextReleaseComplete. A RAN node that
withholds the Release Complete therefore keeps an addressable context
that still resolves to the UE.

The setup response handlers only verified the message identifiers, the
sending RAN node's ownership of the context, and the existence of the
PDU session or bearer. They did not verify that the context is the one
currently serving the UE. A RAN node could therefore send an
unrequested PDUSessionResourceSetupResponse or E-RABSetupResponse over
such a context, and the AMF/MME would forward the supplied transport
layer address and TEID, redirecting the downlink of a session that is
still served by another RAN node.

Add RAN_UE_IS_SERVING()/ENB_UE_IS_SERVING(), which require that the
context is both the serving association and not already being released,
and apply them in InitialContextSetupResponse and in
PDUSessionResourceSetupResponse/E-RABSetupResponse. Rejected responses
are answered with an Error Indication and produce no SBI, PFCP, or S11
side effect.

Also set initial_context_setup_response_received after validation
instead of before, so a rejected response leaves no state behind.

This is not a general request-correlation mechanism. A RAN node that
has been selected as a handover target retains other ways to influence
the user plane, and HandoverNotify is deliberately left alone since
rejecting it would change the outcome of a HandoverCancel/HandoverNotify
race.
2026-08-21 17:32:11 +09:00
.github CI: Keep CIFuzz code scanning results up to date 2026-08-14 21:34:41 +09:00
configs MME: Learn HSS identity from successful S6a answers 2026-07-22 19:02:47 +09:00
debian [mme] Follow-up #4693: harden DNS-based gateway selection 2026-07-21 16:44:07 +09:00
docker [mme] Follow-up #4693: harden DNS-based gateway selection 2026-07-21 16:44:07 +09:00
docs [mme] Follow-up #4693: harden DNS-based gateway selection 2026-07-21 16:44:07 +09:00
lib [AMF] Validate AUSF authentication vector hex strings 2026-08-19 16:30:19 +09:00
misc Add roaming type toggle via command line (#4211) 2025-12-23 13:53:53 +09:00
src [AMF/MME] Reject setup responses on non-serving contexts 2026-08-21 17:32:11 +09:00
subprojects Tested on FreeBSD-14.1-STABLE (#3350) 2024-08-03 21:45:52 +09:00
tests [AMF] Validate AUSF authentication vector hex strings 2026-08-19 16:30:19 +09:00
vagrant Tested on FreeBSD-14.1-STABLE (#3350) 2024-08-03 21:45:52 +09:00
webui Release v2.8.0 2026-06-20 12:38:31 +09:00
.clang-tidy [MISC] Add support for static code analysis 2022-07-01 21:38:47 +09:00
.dockerignore [build] Use local sources to build applications (#1583) 2022-06-19 18:18:09 +09:00
.editorconfig editorconfig: new file (#2746) 2023-11-27 22:21:35 +09:00
.gitignore .gitignore: Add subprojects/.wraplock 2026-07-31 21:04:34 +09:00
LICENSE Change LICENSE to GNU AGPL v3.0 2017-12-18 10:35:54 +09:00
meson.build Release v2.8.0 2026-06-20 12:38:31 +09:00
meson_options.txt [Fuzzing] oss-fuzz support for fuzzing (#2283) 2023-05-05 17:20:11 +09:00
README.md nrf: Fix serving PLMN counter reset on NF register 2026-02-04 20:51:29 +09:00

Open5GS logo

Getting Started

Please follow the documentation at open5gs.org!

Sponsors

If you find Open5GS useful for work, please consider supporting this Open Source project by Becoming a sponsor. To manage the funding transactions transparently, you can donate through OpenCollective.

sponsors

Community

  • Problem with Open5GS can be filed as issues in this repository.
  • Other topics related to this project are happening on the discussions.
  • Voice and text chat are available in Open5GS's Discord workspace. Use this link to get started.

Contributing

If you're contributing through a pull request to Open5GS project on GitHub, please read the Contributor License Agreement in advance.

License

Support

Technical support and customized services for Open5GS are provided by NewPlane at support@newplane.io.