TS 23.003 limits an IMSI to 15 decimal digits, but several identity
conversion paths accepted overlong or non-decimal values.
Validate null-scheme SUCI MSINs before constructing SUCI and SUPI
strings. Centralize SUCI validation in the NAS conversion helper and
propagate failures through AMF Registration Request and Identity
Response handling with 5GMM cause 95. Keep detailed error logging at
each failure stage.
Validate MCC, MNC and MSIN components when reconstructing an IMSI SUPI
in the SBI layer, and improve UDM logging when SUCI conversion fails.
Validate EPS IMSIs before modifying MME context or hash state. Reject
non-decimal BCD values and invalid IMSI lengths in Attach Request and
Identity Response handling.
Also validate the peer-controlled IMSI IE in Gn SGSN Context Request
and Response messages. An 8-octet TBCD value without a filler nibble
decodes to 16 digits plus a trailing NUL, which overflowed the previous
16-byte stack buffer before validation. Use a 17-byte temporary decode
buffer, reject IMSI IEs longer than 8 octets, and continue enforcing the
15-digit IMSI limit after conversion.
Update registration tests to normalize MSIN padding only for
null-scheme SUCIs, preserve protected scheme output, assert successful
test SUCI conversion, record returned GMM causes, and verify rejection
of an overlong SUCI.
Add optional media_type mapping to the shared QoS profile configuration
for audio, video and control traffic.
Use the configured media type mapping in both PCF and PCRF. Fall back to
the existing QCI/5QI 1, 2 and 5 defaults when no matching profile is
configured.
Update PCRF control-media handling to compare the default bearer against
the configured signaling QCI instead of the fixed QCI 5 value.
Emit deprecation warnings for legacy inline policy and QoS profile
configuration, directing users to policy.yaml and the top-level
policy_file option.
Update policy.yaml documentation with the shared PCF/PCRF QoS profile
behavior and combined reference and media_type examples.
Move policy, slice and QoS profile parsing into lib/app so PCF and
PCRF use the same configuration structures and lookup functions.
Parse the optional policy_file during application initialization and
support supi_range, slice, session and qos_profiles sections. Use the
file-backed policy when a matching SUPI is found and retain the existing
MongoDB fallback when no file policy matches.
Update PCF and PCRF to use the shared policy parser, default slice
selection and QoS profile lookup. Keep the existing inline policy format
for compatibility, but reject configurations that mix inline policy data
with policy_file.
Limit policy matching to SUPI ranges and reject plmn_id in policy
configuration.
Add optional subscriber_file and policy_file settings to the global
application configuration.
Refactor the existing configuration reader into a common YAML document
loader shared by the main configuration, subscriber file and policy file.
Apply the same parser error reporting and root mapping validation to all
three document types.
Validate the top-level subscriber, policy and qos_profiles sections, and
store the parsed external documents in the application context for later
subscriber and policy processing.
Centralize YAML document cleanup in the application context to avoid
duplicate free logic.
Add common YAML files for file-backed subscriber provisioning and policy
configuration.
Add optional top-level subscriber_file and policy_file settings to HSS,
UDR, PCRF and PCF configurations. The options remain commented by default,
preserving the existing MongoDB-backed behavior.
Install the new subscriber.yaml and policy.yaml templates, and migrate the
multi-PLMN SEPP examples from inline PCF policies to per-instance external
policy files.
The subscriber template includes the default Open5GS test subscriber.
Runtime SQN updates are maintained in memory and recovered through AKA
resynchronization after restart.
Retrieve AM and SMF selection subscription data in a single Nudm_SDM
request using the dataset-names query parameter.
Parse combined Nudm_SDM responses as ProvisionedDataSets and process the
AM and SMF selection data sequentially while preserving the existing
UE context in SMF lookup.
Forward the requested serving PLMN from UDM to UDR, falling back to the
UE GUAMI PLMN when it is not provided.
Also limit the UDR UE-AMBR validation to requests that actually include
subscribedUeAmbr, and safely ignore delayed combined responses received
after the UE has moved to another GMM state.
Issues: #4683
Return 400 Bad Request for malformed SCP requests instead of falling
back to a generic 500 response. Distinguish missing and invalid
User-Agent headers, preserve the original header while parsing the NF
type, and validate mandatory discovery headers consistently.
Return 504 Gateway Timeout with TARGET_NF_NOT_REACHABLE when the target
NF cannot be reached, and NRF_NOT_REACHABLE when NRF discovery fails.
Avoid fallback 500 responses after a callback has already sent a
response by revalidating MHD sessions and HTTP/2 streams. Also fix
nnrf URI string leaks on error paths.
Issues #4681 and #4682
Validate that UE contexts referenced by partial NG RESET and S1 RESET
belong to the gNB or eNB that sent the request.
When both core-network and RAN UE identifiers are present, also verify
that they refer to the same UE association. This prevents a peer from
resetting a UE owned by another RAN node or supplying mismatched UE IDs.
Guard the deferred reset acknowledgement paths against a missing
acknowledgement buffer without aborting or interrupting the remaining
session cleanup.
Issues: #4680
Validate User-Name and Public-Identity before passing them to the HSS
context lookup functions.
A zero-length identity could otherwise be used as a hash key and trigger
an assertion in ogs_hash_get(), terminating the HSS.
Return DIAMETER_INVALID_AVP_VALUE for empty identities in UAR, MAR, SAR,
and LIR requests.
Issues #4675
Issues #4676
When processing a UE-requested PDU Session Modification Request, the
SMF treated every Requested QoS flow description as a QoS parameter
modification regardless of its operation code.
If the UE deletes a dedicated QoS flow by sending both:
- Delete existing QoS rule
- Delete existing QoS flow description
for the same QFI, the QoS rules handler sets OGS_PFCP_MODIFY_REMOVE,
but the QoS flow descriptions handler also set
OGS_PFCP_MODIFY_QOS_MODIFY. This produced an invalid
REMOVE|QOS_MODIFY combination and tripped the invariant in
gsm_handle_pdu_session_modification_request(), aborting smfd during
VoNR call teardown.
A "Delete existing QoS flow description" carries no QoS parameters, so
skip the QoS-parameter update path for that operation and let the QoS
rule deletion drive the actual PFCP removal.
Also update the test GSM message builder to encode QoS rule deletion
without packet filters, and add a VoNR regression test for the
UE-initiated dedicated QoS flow deletion case.
Issues #4672
Move the vendored cJSON copy out of the generated OpenAPI tree:
```
lib/sbi/openapi/external/cJSON.{c,h}
-> lib/third-party/cjson/cJSON.{c,h}
```
The copy under lib/sbi/openapi/external/ came from the OpenAPI generator
output, but cJSON is a third-party dependency rather than generated SBI
model code. Keep it in lib/third-party/cjson/ as the single canonical
vendored copy.
Update the current openapi-generator template sets accordingly so that
regenerated model code includes the relocated header directly:
```
```
This avoids any post-processing after regeneration and works regardless
of which generated source directory includes the header, since the path
no longer depends on "../" relative traversal.
Notes:
* The generator still emits an external/cJSON.{c,h} pair from
cJSON.{c,h}.mustache into its output directory. That generated copy is
no longer copied into the source tree.
* The older template sets (r16 5.2.0/6.4.0, r17 6.4.0/7.20.0) are left
untouched as a historical record of what generated past trees.
Validate Framed-IP-Address before using it as an IPv4 hash key in
Rx AAR handling. A malformed AVP shorter than 4 bytes could otherwise
lead to an out-of-bounds read.
Also validate Framed-IPv6-Prefix before casting it to ogs_paa_t in
Rx AAR and Gx CCR handling. This prevents dereferencing a short buffer
when checking the IPv6 prefix length.
Issues #4663 and #4664
UE-associated SCTP streams are allocated per RAN association.
During X2 or Xn handover, the UE context can retain a stream ID that
was valid for the source eNB or gNB but is outside the target RAN's
negotiated stream range. Sending Path Switch Request Acknowledge on
that stream then fails with EINVAL.
Rebind the stream using the target RAN allocator only when the
existing stream ID is out of range.
Issues: #4670
Avoid asserting when an S11 Delete Bearer Response arrives after its
associated S5-C transaction has already been removed.
There is no response left to relay to the PGW in this case, but the
SGW-C must still complete local cleanup. Delete the PFCP session for a
Linked EPS Bearer ID, or remove the affected PFCP bearer for an EPS
Bearer ID.
Keep the associated S5-C transaction assertion for the Bearer Resource
Command path, which requires transaction-specific data.
Issues: #4667
Do not send a GTP-U Error Indication when the received TEID is
owned by an existing PDR but the packet does not match its QFI or
SDF filter.
Such a packet is off-filter, not an unknown tunnel. Sending an Error
Indication can cause the peer to remove a live bearer, for example
after a stray uplink packet during X2 handover.
Keep the existing Error Indication behavior for TEIDs that are not
owned by any PDR.
Issues: #4665
On a GTP-U Error Indication for an EPC session, the SMF deleted the whole
PFCP session for any Error Indication and never notified the MME. A single
transient, handover-induced Error Indication on a dedicated (voice) bearer
therefore tore down the entire IMS PDN, and because no Delete Bearer
Request was sent to the MME, the MME and UE kept a stale IMS PDN
connection - the UE could not place a new VoLTE call until it re-attached.
SMF (src/smf/n4-handler.c, src/smf/pfcp-path.c):
Map the Error Indication FAR to its bearer and run a PGW-initiated bearer
deactivation instead of a blind session deletion, per 3GPP TS 23.007:
- dedicated bearer -> deactivate only that bearer (IMS PDN survives);
- default bearer -> deactivate the whole PDN connection.
smf_gtp2_send_delete_bearer_request() sets the Linked EBI (default) or the
EPS Bearer ID (dedicated), so the MME deactivates the EPS bearer toward the
UE and stays in sync. The PFCP session is deleted on the Delete Bearer
Response (wait_pfcp_deletion). The default-bearer case uses cause
"Reactivation requested" so the UE re-establishes the PDN.
MME (src/mme/mme-s11-handler.c, mme-path.c, mme-context.h, nas-path.c,
nas-path.h, esm-sm.c):
Map the GTPv2 Cause "Reactivation requested" (#8) on a default-bearer
Delete Bearer Request to NAS ESM cause #39 "reactivation requested"
(TS 29.274 Table C.3) so the UE re-establishes the IMS PDN. The mapping is
restricted to the default bearer (Linked EBI). Carry the ESM cause across
paging in mme_ue->paging.esm_cause so an ECM-IDLE UE also receives it after
paging; previously the post-paging path always used REGULAR_DEACTIVATION.
The TS 29.274 Table C.3 "re-attach required" mapping for the last PDN
connection is intentionally not implemented (Attach without PDN
connectivity and SCEF PDN connections are not supported here); the last
default bearer is deactivated with ESM cause #39 as well.
Issues: #4659
Remove local indirect forwarding tunnels after PFCP modification
synchronization even when the associated S11 transaction has expired.
Also release the PDR TEID node on per-session PDR ID allocation
failure and add diagnostics for PDR resource exhaustion.
Issues: #4653
OpenAPI_nf_profile_parseFromJSON() aborts via ogs_assert(data) in
listEntry_create() when an NFProfile carries a non-empty
nfSetRecoveryTimeList / serviceSetRecoveryTimeList. OSS-Fuzz:
listEntry_create: Assertion `data' failed (lib/sbi/openapi/src/list.c:10)
OpenAPI_list_add (list.c:116)
OpenAPI_nf_profile_parseFromJSON (nf_profile.c:3989)
Root cause is in the model-body.mustache map handler. The per-value
type dispatch only emits assignments to localMapKeyPair for
isString / isByteArray / isNumeric / isBoolean. For a map whose value
is a DateTime (map<string,DateTime>, e.g. NfSetRecoveryTimeList) or an
array (map<string,array<string>>, e.g. allowedOperationsPerNfType),
no branch fires, localMapKeyPair stays NULL, and the generated code
calls OpenAPI_list_add(list, NULL) -> listEntry_create(NULL) -> abort.
This is remotely triggerable: NFProfile is parsed from peer/NRF input.
Template fix (r19, openapitools 7.20.0):
- add isDate / isDateTime branches in both parseFromJSON and
convertToJSON map blocks (DateTime is carried as a JSON string,
handled like isString); convertToJSON previously also dropped the
value silently for these maps.
- guard OpenAPI_list_add with a NULL check so any remaining
unhandled value category (e.g. array-valued maps) fails the parse
gracefully instead of aborting the process.
Regenerated the two affected models (nf_profile, nf_service).
DateTime maps now round-trip correctly; the array-valued maps are
rejected instead of crashing pending full map<string,array> support.
Issues: #4649
ogs_fqdn_parse() returns -EINVAL on invalid FQDN encoding, but the DNN
and APN decoders stored the result directly into the uint8_t length
field. The negative value was truncated (-22 -> 234), so the
"if (length > 0)" guard passed and ogs_cpystrn() copied up to 101 bytes
from an uninitialized stack buffer that ogs_fqdn_parse() never wrote.
The guard was written when ogs_fqdn_parse() returned 0 on failure; the
later switch to -EINVAL broke it via the unsigned truncation.
Capture the return value in a signed int, take the error branch on
negative/zero, and assign to length only on success. Applied to both
ogs_nas_5gs_decode_dnn and ogs_nas_eps_decode_access_point_name via the
support/type-list.py templates; generated ies.c regenerated.
Found by OSS-Fuzz (nas_5gs_message_fuzz, MSan).
Issues: #4645
Accept NF status notifications only when they match a subscription
confirmed by the NRF. Reject notifications outside the confirmed
subscription state with 404 Not Found before updating or removing the
local NF cache.
Apply the same validation to both NF_REGISTERED and NF_DEREGISTERED
notifications.
Move the NF status subscription lookup from nf-sm.c to the SBI
context so it can be reused by notification handling.
Keep the existing lookup semantics for subscription creation, including
subscriptions that have been requested locally but are not yet confirmed
by the NRF.
Release RAN-UE and eNB-UE contexts when processing fails after a
new context has been allocated.
Malformed InitialUEMessage messages and failed handover target setup
could leave newly created contexts in their respective pools until the
peer association was closed. Repeated failures could therefore exhaust
the RAN/eNB UE context pool and prevent legitimate UE procedures.
Only contexts allocated for the current message are removed, preserving
pre-existing UE contexts on duplicate or malformed messages.
Validate that UE Context Release Request is received from the gNB/eNB
owning the resolved UE context and that the RAN-side UE ID matches.
Apply ownership validation to UE Context Release Complete as well, while
preserving its existing AMF/MME UE ID-based completion handling without
requiring a RAN-side UE ID consistency match.
Keep the procedure-specific lookup paths so unknown UE contexts retain
their existing warning-level handling and Error Indication behavior.
Cx User-Name may contain an IMSI-based IMPI in the form of <IMSI>@ims.mnc<MNC>.mcc<MCC>.3gppnetwork.org.
Do not parse digits from the realm portion when converting the
User-Name into a BCD subscriber identifier. Otherwise, digits in the
MNC, MCC, and domain name can cause a valid IMPI to be rejected as an
invalid or overlong IMSI.
Issues: #4633
Store the target RAN UE ID in the SBI transaction context when sending
an Update SM Context request. Use the saved ID when processing the SMF
response so that the target RAN context can still be released even if
the source RAN context has already been removed.
This also avoids an AMF assertion failure during the handover-cancel
response race.
Issues: #4631
This commit adds the network policy IE, part of ATTACH ACCEPT and
TAU ACCEPT messages. This prevents unsecured redirection to GERAN
or UTRAN, protecting the UEs from unsecured redirection attacks.
This IE is mandatory in Rel.19
This patch changes the default behavior!
In case you want to allow unsecured redirects, add the following:
```
global:
parameter:
allow_unsecured_redirection: true
```
to your mme.yaml
ogs_strtok_r() returns NULL when the flow description is empty or
contains only spaces. Check the first token before comparing it with
"permit" so that NULL is not passed to strcmp().
Invalid flow descriptions now return OGS_ERROR through the existing
error path instead of crashing the SMF or UPF process.
Issues: #4630
Handle failure to deactivate the old Non-3GPP session after a
Non-3GPP to 3GPP handover as a non-fatal error.
The Modify Bearer Response has already been sent at this point, so a
missing or already released WLAN session must not terminate the SMF.
Log the deactivation failure and continue instead of asserting.
Issues: #4636
In ngap_build_path_switch_ack(), the UESecurityCapabilities IE block passed
&PathSwitchRequestAcknowledge->protocolIEs to ASN_SEQUENCE_ADD(), while every
other IE block in the function correctly passes protocolIEs without the
address-of operator.
Since the asn1c v6->v7 migration, protocolIEs is a pointer returned by
ogs_asn_calloc_protocol_ies(), so the extra '&' passes a pointer-to-pointer.
asn_sequence_add() then casts it to _A_SEQUENCE_OF and reads/writes array,
count and size at that location, corrupting the protocolIEs pointer and
adjacent fields in the PDU. This leads to a heap/wild-pointer write and
crashes the AMF.
The block only runs when send_ue_security_capability_in_path_switch_ack is
set, i.e. on a UE security capability mismatch during PathSwitchRequest, so
the bug stayed hidden until exercised by the Xn handover path. When it
triggers, the AMF dies before sending PATH SWITCH REQUEST ACKNOWLEDGE,
causing a guard-timer timeout on the handover and NGAP socket failures on
subsequent procedures.
Drop the stray '&' so the IE is appended to the correct sequence, and add
the missing ogs_assert(ie) for consistency with the other IE blocks.
Upgrade to Release-19
Avoid ARG_MAX failures when linking generated ASN.1 and OpenAPI libraries
Update Debian package, documentation, and WebUI version metadata
MongoDB is required by database-backed components such as HSS/PCRF
and PCF/UDR, but it does not need to be installed locally when an
external MongoDB server is used.
Move the MongoDB package relationship from Depends to Recommends for
the affected Debian packages, so the default installation still pulls
MongoDB in while allowing users to opt out with --no-install-recommends.
Update the documentation to clarify which components use MongoDB and
explain that the MongoDB installation step can be skipped when using an
external database.
Regenerate GTPv1 and GTPv2 TLV message definitions from the latest
Release 19 3GPP specifications.
For GTPv1, update the generator and regenerate message definitions from
TS 29.060 V19.0.0. The generator now handles the unmodified Word document
without manual table-cell edits, including merged table cells and reference
values with suffixes such as 7.7.25A, 7.7.25B, and 7.7.45A.
For GTPv2, update the generator and regenerate message definitions from
TS 29.274 V19.6.0. This adds new Rel-19 IEs, updates changed message and
grouped IE definitions, and improves parsing of aliases such as APCO, LDN,
IP4CP, and PTI.
Also update the TLV regeneration documentation for GTPv1 and GTPv2.
Regenerate PFCP message definitions from 3GPP TS 29.244 V19.5.0.
This updates PFCP IE and grouped IE definitions for Rel-19, including
new N6 delay measurement, protocol description, RTP information,
header handling, MPQUIC, and other newly added information elements.
It also updates renamed IEs and fixes generator handling for duplicated
IE names and repeated IE types in the same message or grouped IE.
Remove obsolete User Plane IP Resource Information handling from PFCP
messages. Since this IE is no longer present in the generated PFCP
Association messages, remove the remote PFCP node GTP-U resource list
and related encode/decode helpers. Local configured GTP-U resource
handling is kept for CH F-TEID allocation.
