Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix/second ue release context without authentication #134

Closed
wants to merge 2 commits into from
Closed

fix/second ue release context without authentication #134

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
424269b
fix: second UE release context without authentication
donald1218 Jul 12, 2024
5bb0da4
fix: add HoldingRanue
donald1218 Jul 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions internal/context/amf_ran.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@ func (ran *AmfRan) NewRanUe(ranUeNgapID int64) (*RanUe, error) {
ranUe.Ran = ran
ranUe.Log = ran.Log
ranUe.UpdateLogFields()
ranUe.IsSecured = false

if ranUeNgapID != RanUeNgapIdUnspecified {
// store to RanUeList only when RANUENGAPID is specified
Expand Down
4 changes: 3 additions & 1 deletion internal/context/amf_ue.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,7 +134,8 @@ type AmfUe struct {
/* Pdu Sesseion context */
SmContextList sync.Map // map[int32]*SmContext, pdu session id as key
/* Related Context */
RanUe map[models.AccessType]*RanUe
RanUe map[models.AccessType]*RanUe
HoldingRanUe map[models.AccessType]*RanUe
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. I think HoldingRanUe should support multiple RanUes per access type since more than 1 InitialUeMessage referring to the same AmfUe is possible.
  2. If a malicious UE sends InitialUeMessage without following actions, as my understanding to this PR, the original amfUe.ranUe will be replaced with this malicious UE and the genuine UE will be stored into HoldingRanUe. Will this cause any problem? (e.g. Can AmfUe still handle the request from the genuine UE?)

/* other */
onGoing map[models.AccessType]*OnGoing
UeRadioCapability string // OCTET string
Expand Down Expand Up @@ -272,6 +273,7 @@ func (ue *AmfUe) init() {
ue.UnauthenticatedSupi = true
ue.EventSubscriptionsInfo = make(map[string]*AmfUeEventSubscription)
ue.RanUe = make(map[models.AccessType]*RanUe)
ue.HoldingRanUe = make(map[models.AccessType]*RanUe)
ue.RegistrationArea = make(map[models.AccessType][]models.Tai)
ue.AllowedNssai = make(map[models.AccessType][]models.AllowedSnssai)
ue.N1N2MessageIDGenerator = idgenerator.NewGenerator(1, 2147483647)
Expand Down
5 changes: 3 additions & 2 deletions internal/context/ran_ue.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,8 +47,9 @@ type RanUe struct {
LastActTime *time.Time

/* Related Context*/
AmfUe *AmfUe
Ran *AmfRan
AmfUe *AmfUe
Ran *AmfRan
IsSecured bool

/* Routing ID */
RoutingID string
Expand Down
12 changes: 11 additions & 1 deletion internal/gmm/common/user_profile.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,11 +64,21 @@ func AttachRanUeToAmfUeAndReleaseOldIfAny(ue *context.AmfUe, ranUe *context.RanU
StopAll5GSMMTimers(ue)
causeGroup := ngapType.CausePresentRadioNetwork
causeValue := ngapType.CauseRadioNetworkPresentReleaseDueToNgranGeneratedReason
ngap_message.SendUEContextReleaseCommand(oldRanUe, context.UeContextReleaseUeContext, causeGroup, causeValue)
if ranUe.IsSecured {
ngap_message.SendUEContextReleaseCommand(oldRanUe, context.UeContextReleaseUeContext, causeGroup, causeValue)
}
}
ue.AttachRanUe(ranUe)
}

func ClearHoldingRanUeContext(ue *context.AmfUe, ranUe *context.RanUe) {
ranUe.Log.Infof("ClearHoldingRanUeContext - RanUeNgapID[%d]", ranUe.RanUeNgapId)
causeGroup := ngapType.CausePresentRadioNetwork
causeValue := ngapType.CauseRadioNetworkPresentReleaseDueToNgranGeneratedReason
ngap_message.SendUEContextReleaseCommand(ranUe, context.UeContextReleaseUeContext, causeGroup, causeValue)
ue.HoldingRanUe[ranUe.Ran.AnType] = nil
}

func PurgeSubscriberData(ue *context.AmfUe, accessType models.AccessType) error {
logger.GmmLog.Debugln("PurgeSubscriberData")

Expand Down
8 changes: 8 additions & 0 deletions internal/nas/handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,14 @@ func HandleNAS(ue *amf_context.RanUe, procedureCode int64, nasPdu []byte, initia
ue.AmfUe.NasPduValue = nasPdu
ue.AmfUe.MacFailed = !integrityProtected

if ue.AmfUe.SecurityContextIsValid() {
ue.IsSecured = true
}

if ue.AmfUe.HoldingRanUe[ue.Ran.AnType] != nil && ue.IsSecured {
gmm_common.ClearHoldingRanUeContext(ue.AmfUe, ue.AmfUe.HoldingRanUe[ue.Ran.AnType])
}

if errDispatch := Dispatch(ue.AmfUe, ue.Ran.AnType, procedureCode, msg); errDispatch != nil {
ue.AmfUe.NASLog.Errorf("Handle NAS Error: %v", errDispatch)
}
Expand Down
1 change: 1 addition & 0 deletions internal/ngap/handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -498,6 +498,7 @@ func handleInitialUEMessageMain(ran *context.AmfRan,
// Described in TS 23.502 4.2.2.2.2 step 4 (without UDSF deployment)
ranUe.Log.Infof("find AmfUe [%q:%q]", idType, id)
ranUe.Log.Debugf("AmfUe Attach RanUe [RanUeNgapID: %d]", ranUe.RanUeNgapId)
amfUe.HoldingRanUe[ranUe.Ran.AnType] = amfUe.RanUe[ranUe.Ran.AnType]
gmm_common.AttachRanUeToAmfUeAndReleaseOldIfAny(amfUe, ranUe)
} else if regReqType != nasMessage.RegistrationType5GSInitialRegistration {
if regReqType == nasMessage.RegistrationType5GSPeriodicRegistrationUpdating ||
Expand Down
Loading