Commit graph

18 commits

Author SHA1 Message Date
Sukchan Lee
924cf71c9d pfcp: Fix crash on malformed Dropped-DL-Traffic-Threshold IE
UPF could crash when handling PFCP Session Establishment/Update
containing a CreateURR with a malformed Dropped-DL-Traffic-Threshold IE.
Added length validation for Dropped-DL-Traffic-Threshold and
Volume Measurement IEs to prevent buffer misuse and return an
appropriate PFCP cause and offending IE value.

Also removed assertion in IE parsing functions and replaced it with
error logging and validation checks.

Issues: #4154, #4152
2025-11-28 10:01:55 +09:00
Sukchan Lee
afe613a9c5 pfcp: Validate bitrate IE length and return proper cause value
Add explicit length checks for Maximum Bitrate and Guaranteed Bitrate
IEs in Create/Update QER handlers. When the IE length does not match
OGS_PFCP_BITRATE_LEN, return INVALID_LENGTH with the corresponding
offending IE type.

Also update ogs_pfcp_parse_bitrate() to log a detailed error message
and return 0 when the encoded IE length is invalid, instead of asserting.

This prevents crashes caused by malformed PFCP messages and ensures
correct cause/offending IE reporting to the peer.

Issues: #4152
2025-11-20 17:21:00 +09:00
shellwayxw
726b588d76 Fix integer overflow in PFCP ogs_pfcp_parse_sdf_filter() 2025-04-17 17:14:15 +09:00
Sukchan Lee
02d302b15a [SEC] Fix Assertion ogs_pfcp_parse_volume (#3207) 2024-05-18 21:37:28 +09:00
Sukchan Lee
15ff23de75 [SEC] Fix Assertion ogs_pfcp_parse_sdf_filter (#3207) 2024-05-18 21:37:28 +09:00
Sukchan Lee
bd4d925f0f [SEC] Fix Assertion ogs_pfcp_parse_user_plane_ip_resource_info() (#3207) 2024-05-18 21:37:28 +09:00
Sukchan Lee
05deed616c [SEC] fix Assertion 0 < ogs_fadn_parse (#3207) 2024-05-18 21:37:28 +09:00
Bostjan Meglic
9e20617a8f [PFCP] Fix calculation of AMBR
When converting bitrates from bits per second to kilobits per second,
if the conversion results in fractions, the resulting value should be
rounded upwards
2023-06-03 09:19:52 +09:00
Sukchan Lee
5128ebc6c6 [SMF] Added User-ID, APP_DNN, S-NSSAI (#1986)
Added User-ID, APP_DNN, S-NSSAI in N4 PFCP Session Establishment Request
2023-01-13 10:28:40 +09:00
Pau Espin Pedrol
c18e9f32cb
[PGW] Gy+PFCP improvements (#1555)
* [SMF] Gy,PFCP: Improve {Time,Volume} {Threshold,Quota} handling

* [UPF] Implement URR Usage Report for ValidityTime/TimeQuota/TimeThreshold

* [UPF] Implement Usage report trigger for Volume Quota/Threshold

* [SMF] Set Gy Reporting-Reason based on PFCP Report Trigger
2022-05-24 22:54:30 +09:00
Sukchan Lee
866ae78f5e [NRF] fix the crash for invalid FQDN (#1333) 2022-01-22 09:34:38 +09:00
Sukchan Lee
9b40fe25ff added "usage report" to user plane report (#1289)
Author: mhkndgn <hakan.dogan@b-ulltech.com>
Date:   Thu Dec 16 09:51:49 2021 +0300
2021-12-16 21:52:48 +09:00
Sukchan Lee
bfa34be222 fix the buffer overflow (CVE-2021-41794) 2021-11-15 15:49:58 +09:00
Sukchan Lee
5e016937c7 Update URR contribution (#1190) 2021-10-04 22:28:32 +09:00
Sukchan Lee
13f1b390ae CVE-2021-41794 from NCC Group by Mark Tedman
When connecting to the UPF port for the PFCP protocol (8805) and sending
an association setup request followed by a session establishment request
with a PDI Network Instance set to ‘internet’, it causes a stack corruption
to occur.

So, ogs_fqdn_parse() fixed.
2021-10-01 22:41:03 +09:00
Sukchan Lee
37e0a714f9 Fixes UE IPv6 BUG (#808) 2021-03-15 10:01:55 +09:00
Sukchan Lee
ae75f43a88 Initial proposal CUPS using PFCP 2020-04-26 15:36:05 -04:00
Sukchan Lee
896ca50253 PFCP interface added, but not tested. 2019-12-07 13:17:00 +09:00