RRC fixes (#225)
- Hardens NR RRC re-establishment handling on the gNB and UE:
re-establishment requests with invalid PCI/C-RNTI or incomplete UE
context are rejected or fall back to RRCSetup per TS 38.33.
- Fixes an invalid post-release connected state after PDU session
teardown
- Stops gNB process aborts when a UE sends spare RRC establishment-cause
values.
- Fix RRCSetup fallback: the UE MAC layer is reset before bearer
teardown on RRCSetup fallback to avoid scheduler use of released RLC
entities.
Closes: #127Closes: #128Closes: #148
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-by: Francesco Mani <email@francescomani.it>
Clean up openair0_device, remove eth_params usage in L2/L3 (#243)
This PR has three goals
- Remove the usage of eth_params in L2/L3 code, and replace with
tailored data structures for IP connectivity where necessary
- Remove many of the includes of common_lib.h where possible
- Slightly clean up openair0_device and in particular move fields to
eth_state_t where appropriate
Reviewed-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
Reviewed-by: Teodora Vladić <teodora.vladic@openairinterface.org>
NAS: refactor Identity Request handler and enforce spec-compliant security checks (#217)
Align UE Identity Request handling with TS 24.501 by checking the NAS
security header and rejecting unprotected non-SUCI requests.
Also, refactor Identity Response identity selection based on the
requested identity types, add to a helper and handle unavailable
identities in the UE context.
Closes: #82
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-By: Rakesh Mundlamuri <rakesh.mundlamuri@openairinterface.org
A UE RRCSetupRequest with establishmentCause in the spare range (10–15)
could abort nr-softmodem: RRC asserted on cause >= NGAP_RRC_CAUSE_LAST,
and cause 11 failed NGAP ASN.1 encode when passed through by index.
NR RRC (TS 38.331) and NGAP RRCEstablishmentCause (TS 38.413 §9.3.1.111)
do not share one integer namespace: spare values must not be sent
as NGAP causes.
Remove the RRC AssertFatal on causes. When building
InitialUEMessage, map RRC indices 0–9 to the matching NGAP cause
and map anything else to notAvailable, as specified for unmapped UE
causes.
Changes:
- Drop establishment-cause range AssertFatal in rrc_gNB_send_NGAP_NAS_FIRST_REQ
- Add rrc2ngap_establishment_cause() and use it for InitialUEMessage RRCEstablishmentCause
- Remove redundant DevCheck on establishment_cause in ngap_gNB_handle_nas_first_req
- Adopt mapping logic in rrc_gNB_send_NGAP_NAS_FIRST_REQ
Closes: #127
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Align UE Identity Request handling with TS 24.501 by checking the NAS
security header and rejecting unprotected non-SUCI requests.
Also, refactor Identity Response identity selection based on the
requested identity types, add to a helper and handle unavailable
identities in the UE context.
Closes#82
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Cleanup: NGAP reconnection debug log (#227)
I was using this print statement just for debugging Also this debug
statement should be shown only after reconnecting not at the first
connection.
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
After having removed eth_params_t from all L2/L3 files, we can reduce
the scope of common_lib.h, and remove the include from many files.
Signed-off-by: Robert Schmidt <robert.schmidt@openairinterface.org>
NGAP Procedures for Xn Handover: Path Switch Request Path Switch Request Acknowledge (#194)
This PR adds the following NGAP Path Switch procedures to support Xn
handover in accordance with 3GPP TS 38.413v16.2.0.
NGAP Path Switch Request: add encode and ITTI support
- Add a case in TASK_NGAP to support ITTI message from RRC to NGAP
- Add Path Switch Request message type definitions
- Implement encoder for Path Switch Request (3GPP TS 38.413v16.2.0
§9.2.3.8)
* RAN UE NGAP ID (M)
* Source AMF UE NGAP ID (M)
* User Location Information (M)
* UE Security Capabilities (M)
* PDU Session Resource to be Switched in Downlink List (M)
- Add required ASN.1 header includes for Path Switch Request IEs
NGAP Path Switch Request Acknowledge: add decode and handler
- Add handler at NGAP for Path Switch Request Acknowledge from AMF
- Add Path Switch Request Acknowledge message type definitions
- Implement decoder for Path Switch Request Acknowledge (3GPP TS
38.413v16.2.0 §9.2.3.9)
* AMF UE NGAP ID (M)
* RAN UE NGAP ID (M)
* Security Context (M)
* PDU Session Resource Switched List (M)
* Allowed NSSAI (M)
- Add required ASN.1 header includes for Path Switch Request Acknowledge
IEs
Notes:
- Added a case NGAP_PATH_SWITCH_REQ in task_ngap to support ITTI message
from RRC, and this will be allocated at
- RRC when the target gNB receives the RRC complete message from the UE
during Xn handover.
- OAI CN5G does not support any of the NGAP path switch procedures
(request, ack, and failure) as of today to test Xn Handover.
- We tested the procedures in an E2E setup at IISc with two gNBs in
E1+F1+7.2x split containing the Xn handover code and connected to the
same 5G core (used Open5GS & Aether-OnRamp separately), and also did
not observe any Path Switch Failure.
- The implementation of Path Switch Failure at OAI RAN will be done
along with the implementation of Path Switch procedures in OAI CN5G
once the XNAP integration in OAI RAN is complete.
Acknowledgement:
> This work has been partially carried out as part of Xn Handover
development at the Indian Institute of Science (IISc), Bengaluru.
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-By: Guido Casati <guido.casati@openairinterface.org>
- Add a case in TASK_NGAP to support ITTI message from RRC to NGAP
- Add Path Switch Request message type definitions
- Implement encoder for Path Switch Request (3GPP TS 38.413v16.2.0 §9.2.3.8)
- RAN UE NGAP ID (M)
- Source AMF UE NGAP ID (M)
- User Location Information (M)
- UE Security Capabilities (M)
- PDU Session Resource to be Switched in Downlink List (M)
- Add required ASN.1 header includes for Path Switch Request IEs
Co-authored-by: Rakesh BB <rakesh.bb@fsid-iisc.in>
Signed-off-by: Venkatareddy Akumalla <venkatareddy.akumalla@openairinterface.org>
fix (nas): parse UE Registration Reject and add NAS connection release (#218)
The nrUE NAS task read the Registration Reject cause at a hardcoded
offset and called exit(1). This commits adds processing of
plain/security-protected 5GMM headers, decoding of the mandatory cause
per TS 24.501 §8.2.7, set 5GMM state.
Softmodem is stopped via termination_procedure and local AS detach
(send_nas_detach_req without wait_release -> 1) RRC IDLE 2)
NR_NAS_CONN_RELEASE_IND 3) itti_wait_tasks_unblock).
Changes:
- Add fgmm_registration_reject enc/dec
- Add handle_registration_reject()
- Replace inline FGS_REGISTRATION_REJECT case
- Fix unprotected_allowed() for plain Registration Reject
- Add nas_lib_test round-trip (Illegal_UE / 0x03)
Note: optional IEs (T3346, T3502, EAP) not decoded, §5.5.1.2.5 procedure TODO
Closes: #174
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
The nrUE NAS task mishandled FGS_REGISTRATION_REJECT: it read the 5GMM
cause at a hardcoded offset and called exit(1) from the NAS ITTI task,
which could abort the process while PHY threads were still running.
This commit adds processing of plain/security-protected 5GMM headers,
decoding of the mandatory cause per TS 24.501 §8.2.7, set 5GMM state.
Softmodem is stopped via termination_procedure and local AS detach
(send_nas_detach_req without wait_release -> 1) RRC IDLE 2)
NR_NAS_CONN_RELEASE_IND 3) itti_wait_tasks_unblock).
Ignore duplicate rejects once termination has started.
Changes:
- Add fgmm_registration_reject enc/dec
- Add handle_registration_reject()
- Replace inline FGS_REGISTRATION_REJECT case
- Fix unprotected_allowed() for plain Registration Reject
- Add nas_lib_test round-trip (Illegal_UE / 0x03)
Note: optional IEs (T3346, T3502, EAP) not decoded, stop-on-reject
replaces 21a7f99 exit(1), full §5.5.1.2.5 procedure remains TODO.
Closes#174
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
- Add a LOG_I to 'nr_sdap_add_entity' to inform the user
a SDAP entity is being created
- Add LOG_W to `nr_sdap_get_entity` to warn about
empty SDAP entity list
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
After the UE answers a network page with a NAS Service Request, it waits
in 5GMM-SERVICE-REQUEST-INITIATED until the AMF replies or the radio
connection drops.
While that wait is active, duplicate pages must be ignored. When SR ends,
NAS must return to 5GMM-REGISTERED so a later page can start a new SR
(TS 24.501).
Changes:
- handle_service_accept(): set FGS_REGISTERED on SERVICE ACCEPT (TS 24.501 §5.6.1.4)
- handle_service_reject(): if SR was pending, set FGS_REGISTERED (§5.6.1.5)
- NR_NAS_CONN_RELEASE_IND: if SR was pending, set FGS_REGISTERED (§5.3.1.3 and §5.6.1.7 l)
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
UE paging can recreate the AS-side SDAP entity while NAS still keeps the
PDU session established. Per TS 38.304 clause 7.1 and TS 24.501 clauses
5.6.2.2.1,5.6.1.2 paging/service request restores user-plane resources
for an established PDU session, it does not imply deleting the UE IP/TUN
interface.
Deleting the UE TUN with SDAP entity teardown breaks user-plane continuity
after re-attach. We need SDAP entity lifetime and UE TUN lifetime to be
decoupled. This commit keeps a UE/PDU-session TUN registry outside the
SDAP entity lifetime. When a UE SDAP entity is recreated, reattach it
to the preserved TUN socket and restart the reader thread. On first PDU
session setup, NAS registers the TUN before attaching the reader.
The sequence is the following: (1) NAS register the iface
(2) sdap entity attaches to the iface (3) UE goes IDLE, SDAP
entity is destroyed, iface is deatched and brought down (4)
UE Service Request, SDAP entity is created (5) iface reattaches
to the SDAP entity and is brought up
UE reattach assumes the PDU session TUN interface was registered
before the SDAP entity is recreated.
DL/UL data is intentionally dropped when SDAP is not yet attached
or QFI is unavailable, rather than queued in this layer.
Changes:
- `nr_sdap.c`: keep a UE/PDU-session TUN registry, duplicate the stored
socket into each SDAP entity, and add attach/detach/destroy helpers.
- `nr_sdap_entity.c`: detach SDAP entities from their TUN reader on
deletion, preserve UE TUN interfaces across idle cleanup, and destroy
gNB TUN interfaces when the gNB entity is removed. Drop downlink SDUs
if the UE SDAP entity is not attached to a TUN socket yet.
- `openair3/NAS/NR_UE/nr_nas_msg.c`: set QFI before UE TUN creation so
first attach can pick up cached QFI.
- `common/utils/tuntap_if.c`: add `tuntap_set_up`/`tuntap_set_down` helpers
for UE interface state reflection and initialize `flags` in `tuntap_destroy`
to avoid maybe-uninitialized build failures.
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Route paging-triggered Service Request through NAS_INITIAL_UL_TRANSFER_REQ so
RRC can buffer the PDU for RRCSetupComplete (dedicatedNAS-Message, TS 38.331)
when no UL-DCCH SRB exists, start MAC RA from RRC_IDLE, or drop the ITTI PDU
with LOG_W if SRB1/SRB2 is already established (NAS paging path is 5GMM-IDLE
only).
Changes:
- Define ITTI NAS_INITIAL_UL_TRANSFER_REQ and
NAS_INITIAL_UL_TRANSFER_REQ() (rrc_messages_def.h,
rrc_messages_types.h).
- Extend NR_UE_RRC_INST_t with pending_initial_nas for setup-complete
transport (rrc_defs.h).
- Refactor ULInformationTransfer+PDCP send into
nr_rrc_ue_send_ul_information_transfer_nas(): on NAS_UPLINK_DATA_REQ,
refuse PDCP when neither SRB1 nor SRB2 is established (free PDU).
- On NAS_INITIAL_UL_TRANSFER_REQ: store NAS in pending_initial_nas when
no SRB, in RRC_STATE_IDLE_NR set ra_trigger to RRC_CONNECTION_SETUP,
call nr_rrc_ue_prepare_RRCSetupRequest(), and nr_rrc_send_msg_to_mac()
with NR_MAC_RRC_START_RA, otherwise replace pending and send on SRB.
- Use forwarded initial NAS messafe in rrc_ue_generate_RRCSetupComplete():
if pending_initial_nas is set, move it into the NAS payload and refresh
security keys when integrity context exists, else generateRegistrationRequest().
- In nr_nas_msg.c, add send_nas_initial_ul_transfer_req() and use it for
paging Service Request instead of send_nas_uplink_data_req()
Refs: TS 24.501, TS 38.331 §5.3.3.4, TS 33.501 §6.8.1.2
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Transfer UE-side paging matches from RRC to NAS so a registered idle UE
can generate and send a Service Request after `NAS_PAGING_IND`. Guard
the path with explicit cause, identity, state, and mode checks so
unsupported cases are logged and ignored.
Changes:
- in `rrc_UE.c`, send `NAS_PAGING_IND` to TASK_NAS_NRUE with cause
`AS_CONNECTION_ESTABLISH` from `rrc_nrue()` when a paging match is found
- in `nr_nas_msg.c`, implement `NAS_PAGING_IND` handling in `nas_nrue()`
- accept only paging indications with cause
`AS_CONNECTION_ESTABLISH`, then require `nas->guti`,
`FGS_REGISTERED`, and `FGS_IDLE` before proceeding
- generate the Service Request with `generateServiceRequest()` and send
it through `send_nas_uplink_data_req()`
Refs:
- TS 23.502 §4.2.3.3 (Network Triggered Service Request)
- TS 24.501 §5.6.2.2.1 (Paging for 5GS services)
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
fix a few issues with unit tests
1. fix unused argument warnings - running ninja tests fails on my system
due to too many warnings.
2. fix google benchmark build - sometimes, when building from scratch
the build will fail due to compiler warnings. I don't know why it
only happens sometimes but I've instead added a warning suppression
as this is not an issue in our code.
3. fix memory leak I've found here: !3827 (comment 224369)
4. fix running two testcases with ninja test or ctest -R. Due to them
being dependent on dlopen they would automatically fail if the user
environemnt was not modified manually outside cmake. I've modified
LD_LIBRARY_PATH for those test cases, meaning you no longer need to
run it with LD_LIBRARY_PATH=. or similar prefix.
Reviewed-By: Robert Schmidt <robert.schmidt@openairinterface.org>
Replace duplicated KENB_STAR_TO_BIT_STRING and
KGNB_STAR_TO_BIT_STRING macros with the unified
AS_KEY_STAR_TO_BIT_STRING helper across X2AP,
XNAP, M2AP, and M3AP code paths.
Also switch allocation to calloc_or_fail for
safer memory handling.
No functional change intended.
Signed-off-by: Rakesh BB <rakesh.bb@fsid-iisc.in>
NAS UE Service Request fixes and improvements for Paging
This MR improves the NAS UE Service Request path and makes
paging-related resume handling more robust. It fixes KSI/KgNB
synchronization, corrects 5G-S-TMSI and encoder/decoder length handling,
and adds Service Accept handling in the NAS_CONN_ESTABLI_CNF path.
It also zero-initializes the initial NAS buffer used during RRC setup
complete to avoid carrying stale data into early NAS message handling.
Reviewed-By: Cedric Roux <cedric.roux@eurecom.fr>
Process Service Accept when it is delivered through NAS connection
establish confirm.
Changes:
- add `FGS_SERVICE_ACCEPT` branch in `NAS_CONN_ESTABLI_CNF` message
dispatch and call `handle_service_accept
Refs:
- TS 24.501 5.6.1.4, 8.2.17 (Service accept)
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Extend the UE 5GS Service Request path to carry `PDU session status`
inside a NAS message container and cipher only that container value when
valid NAS contexts exist. This aligns the initial Service
Request handling with the TS 24.501 rules for non-cleartext IEs.
Treat the generated Service Request as integrity-protected whenever an
integrity context is available, and keep the post-request KgNB refresh
aligned with the NAS UL count used for that protected message.
Changes:
- update `generateServiceRequest()` in `nr_nas_msg.c` to derive a
`PDU session status` bitmap from configured UE PDU sessions and treat
it as the non-cleartext trigger for the initial Service Request
- build an inner plain Service Request carrying `PDU session status`,
place it in the `NAS message container`, cipher only the container
value with the NAS ciphering context, and keep the outer Service
Request integrity protected
- extend `fgs_service_request` lib to support optional `PDU session status`
and `NAS message container` fields
- decode known optional Service Request TLV IEs with a `switch` and skip
unsupported ones
- add `free_fgs_service_request()` and `eq_fgs_service_request()`
- extend `nas_lib_test` to cover Service Request encoding and decoding
with `PDU session status`, `NAS message container`, and skipped
optional IEs, and initialize the test logging/config stubs
- set the outgoing ngKSI with `set_fgs_ksi(nas)` instead of hardcoding
`NAS_KEY_SET_IDENTIFIER_NOT_AVAILABLE`
- move `initialNasMsg->nas_data` allocation into the protected and plain
branches so each path allocates after its final size accounting
- increment `nas->security.nas_count_ul` after integrity MAC computation
- derive a refreshed KgNB with `derive_kgnb()` and send it through
`nas_itti_kgnb_refresh_req()` after the protected Service Request is
built
Refs:
- TS 24.501 §4.4.6 (protection of initial NAS signalling messages)
- TS 24.501 §4.4.4.1 and §4.4.6 allow an initial Service Request to be
integrity protected and unciphered when a valid 5G NAS security
context exists and no NAS message container is included.
- TS 24.501 §8.2.16.1 (Service Request message content)
- TS 24.501 §8.2.16.3 (PDU session status)
- TS 24.501 §9.11.3.33 (NAS message container)
- TS 33.501 §6.4.3.1 (NAS integrity inputs)
- TS 33.501 §6.4.4.1 (NAS confidentiality inputs)
- TS 33.501 §6.8.1.2.2 derives KgNB from the UL NAS COUNT of the NAS
message that moves the UE from CM-IDLE to CM-CONNECTED, unless a
subsequent NAS Security Mode Complete exists, in which case that newer
UL NAS COUNT becomes the freshness input.
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Without explicit casts, each buf byte was promoted to a 32-bit signed
int before shifting. For NR Cell Identity (36-bit, per 3GPP TS 38.423
§9.2.2.9), this causes two problems:
- Shifting buf[0] left by 28 can push bits into or past the sign bit,
producing undefined/implementation-defined behavior.
- The 32-bit intermediate result is too narrow to hold a 36-bit value,
causing silent truncation before the OR-reduction.
Fix by casting each byte to uint64_t prior to the shift, ensuring all
intermediate expressions are evaluated in a 64-bit unsigned domain and
all 36 bits are preserved without overflow.
Decode the FGC NAS message container length from the encoded 2-octet
field before validating and copying the payload. This matches TS
24.501, where the NAS message container is a type 6 TLV and its length
is carried in octets 2-3.
Changes:
- add `<arpa/inet.h>` for `ntohs`
- change `ielen` from `uint8_t` to `uint16_t` in
`decode_fgc_nas_message_container()`
- read the encoded length with `memcpy`, convert it from network byte
order, and advance the decode pointer by `sizeof(uint16_t)`
Refs:
- TS 124 501 clause 9.11.3.33 "NAS message container"
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Use the stored NAS KSI only when a valid integrity context is present,
instead of treating idle mode alone as proof that no KSI is available.
This keeps outgoing initial NAS messages aligned with the actual NAS
security state tracked by the UE (including when in IDLE state).
Changes:
- update `set_fgs_ksi()` in `openair3/NAS/NR_UE/nr_nas_msg.c` to return
`*nas->ksi & 0x07` only when `security_container`,
`integrity_context`, and `nas->ksi` are present
- remove the unconditional `FGS_IDLE` check and the hardcoded `0x0`
return path
- keep `NAS_KEY_SET_IDENTIFIER_NOT_AVAILABLE` as the fallback when no
valid integrity context is available
Refs:
- TS 24.501 (Service Request and ngKSI/security context handling)
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Move the `nas_itti_kgnb_refresh_req()` declaration to the NAS UE header
so call sites use a single shared prototype.
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Correct the encoded-size contribution returned by `fill_fgstmsi()` so
Service Request buffer sizing includes the full 5GS mobile identity field.
Changes:
- update `fill_fgstmsi()` return value from 10 to 11 octets: 2-octet length
field plus 7-octet 5G-S-TMSI payload
Refs:
- TS 24.501 8.2.16 (Service request)
- TS 24.501 9.11.3.4 (5GS mobile identity)
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Add defensive initialization and minimum-length validation in Service
Request decoding.
Changes:
- zero-initialize `fgs_service_request_msg_t` at decode entry
- return error when input length is shorter than the first mandatory octet
- add guard before decoding 5GS mobile identity length field to prevent
out-of-bounds access
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
This commit extends the PDU Session Resource Modify Request handling (within
PDU Session Modify) to fully support QoS Flow add/modify and release operations
(3GPP TS 38.413 section 9.3.4.3) via the Transfer IE. This is propagated to
RRC which performs PDU Session update, which occurs upon PDU Session Modify.
Refactoring was necessary since type `pdusession_transfer_t` and
`pdusession_resource_item_t` both for setup, were inaccurately used for the modify procedure.
The implementation adds proper type definitions, decoding logic,
and error handling for QoS flow management during PDU session modification transfer,
namely:
- Adds QoS add/modify and release lists to the NGAP Modify Request Transfer type
- Introduces QoS Flow With Cause IE
- Decode new IEs and propagate QoS changes to RRC session state
NGAP PDU Session Modify Request Transfer:
- Add qos_flow_to_release_t structure to represent QoS Flow to Release Items IE
with QFI and release cause (per 3GPP TS 38.413 section 9.3.1.13)
- Introduce pdusession_mod_req_transfer_t structure to properly represent
PDU Session Resource Modify Request Transfer IEs:
* QoS Flow Add or Modify Request List (mandatory)
* QoS Flow to Release List (optional)
- Add pdusession_resource_mod_item_t structure for PDU Session Resource
Modify Request Items, replacing pdusession_resource_item_t, which is for setup
- Update ngap_pdusession_modify_req_t to use the new type-specific structure
- Refactor decodePDUSessionResourceModify() to return
pdusession_mod_req_transfer_t instead of pdusession_transfer_t
- Implement proper decoding of QosFlowAddOrModifyRequestList IE
- Add decoding support for QosFlowToReleaseList (QosFlowListWithCause) IE:
* Extract QFI and cause for each QoS flow to be released
- Improve error handling throughout
ngap_msg_includes.h:
- Add includes for NGAP_QosFlowListWithCause.h and
NGAP_QosFlowWithCauseItem.h to support QoS flow release decoding
NGAP/RRC:
- Update nr_rrc_update_pdusession() function signature to accept
pdusession_resource_mod_item_t instead of pdusession_resource_item_t
- Remove references to unnecessary pdu_session_type and n3_incoming
fields that are not part of the Modify Request Transfer structure
- Update QoS flow update logic to use nb_qos_to_add_modify and
qos_to_add_modify fields from the new transfer structure
This implementation aligns NGAP with 3GPP TS 38.413 specifications
and provides a foundation for handling QoS flow modifications and releases
during PDU session resource modification procedures.
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Refactor GTP-U tunnel and send APIs so QFI is handled when sending packets,
not stored in tunnel creation state. Update SDAP and CU-UP integration to
use PDU-session keyed N3 mappings and explicit QFI-marked sends.
This commit clarifies layering ownership: GTP-U stays transport-only (TEID
lookup, decapsulation, extension parsing, callback dispatch), while SDAP
owns QoS semantics (QFI handling, QoS-flow-to-DRB policy, default DRB behavior,
and mapping updates); GTP-U does not perform runtime QFI-to-DRB mapping or
synthesize QFI.
Changes:
- remove `outgoing_qfi` from `gtpv1u_gnb_create_tunnel_req_t` and stop storing
QFI as tunnel creation metadata; `newGtpuCreateTunnel(...)` now carries only
transport/tunnel identity parameters (incoming_bearer_id, outgoing_bearer_id,
outgoing_teid, remote address, callbacks)
- add `gtpv1uSendDirectWithQFI()` and pass QFI into `_gtpv1uSendDirect`
to build UL PDU Session Container extensions
- shift QFI handling from tunnel provisioning to per-packet TX APIs: QFI is passed
explicitly only when sending (`gtpv1uSendDirectWithQFI(...)`) and is absent from
non-SDAP/F1 sends (`gtpv1uSendDirect(...)`)
- align N3 tunnel request semantics with session-level keys by setting incoming_rb_id
to PDU session ID on N3 paths, while F1 paths keep DRB ID
- keep `gtpv1uSendDirect()` and `gtpv1uSendDirectWithNRUSeqNum()` on
`NO_QFI`, and enforce non-SDAP RX callback path only when QFI is absent
- update `nr_sdap_rx_entity` to extract/validate QFI from SDAP UL headers,
send UL data with `gtpv1uSendDirectWithQFI`, and use non-QFI send when
SDAP header is disabled
- add disabled-SDAP safety checks in SDAP entity setup/mapping to enforce
single-DRB and single-flow constraints per PDU session
- extend `test_gtp.cpp` with a `multi_qos_flows` scenario and QFI-aware send calls
- update `nr-cuup-load-test.c` bearer setup fields and tunnel creation calls
to match the new API
- update tests/nr-cuup/nr-cuup-load-test.c to set explicit PDU session and
QoS/SDAP parameters (sessionType, qosFlows[0], SDAP header flags), and to
migrate both N3 and F1 tunnel creation calls to the new newGtpuCreateTunnel(...)
signature (without outgoing_qfi)
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Implement GBR (Guaranteed Bit Rate) QoS flow information extraction from NGAP.
This enables handling in CU of GBR QoS flows
(e.g., voice, video) that require guaranteed and maximum bit rates.
Changes:
- Define qos_bitrate_t structure to encapsulate GFBR and MFBR
- Define gbr_qos_flow_information_t structure for GBR QoS parameters
- Add optional gbr_qos_flow_information field to pdusession_level_qos_parameter_t
- Extract GBR information from NGAP_QosFlowLevelQosParameters in fill_qos()
- Add NGAP_GBR-QosInformation.h include to ngap_msg_includes.h
GBR information is optional in NGAP and is only present for GBR flows
(5QI < 5 for NonDynamic5QI, or Dynamic5QI flows with GBR characteristics).
Bit rates are in kbps.
This commit is a refactoring of commit 398ae02ab9 from !2836
Co-authored-by: Sriharsha Korada <sriharsha.korada@iis.fraunhofer.de>
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Model non-dynamic vs dynamic 5QI characteristics explicitly and propagate the
new layout through NGAP decode and RRC bearer/QoS handling.
Changes:
- Define `non_dynamic_5qi_t`/`dynamic_5qi_t`, PER/PDB bounds, and embed a
`qos_characteristics` union in `pdusession_level_qos_parameter_t`
- Populate the new QoS structures in `fill_qos()`, including optional
allocations for Dynamic 5QI `fiveQI` and NonDynamic `priorityLevelQos`
- Map QoS params to F1AP with `nr_rrc_get_f1_qos_flow_param()` and add range
validation for dynamic priority/PDB/PER and non-dynamic 5QI
- Populate E1 QoS characteristics from the new layout and update QoS modify
handling to manage optional pointer fields (`openair2/RRC/NR/rrc_gNB_NGAP.c`)
- Derive a numeric 5QI via `get_qos_fiveqi()`, handle missing-5QI dynamic flows
conservatively, and extend dedicated-DRB decisions to fall back to dynamic
characteristics
- Add a 5QI range assert in F1AP QoS encoding and extend bearer tests with a
Dynamic 5QI flow
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Refactor GTP-U tunnel creation to align for 3GPP architecture where N3
tunnels are created per PDU session (supporting multiple QoS flows) and
F1-U tunnels are created per DRB. This change simplifies the API and
prepares the codebase for supporting multiple DRBs and QoS flows per
PDU session.
This is the first step of a final design that will consist of:
- 1 GTP-U tunnel create call for each PDU session, each with a DRB mapping
- 1 GTP-U tunnel create call for each DRB (i.e. no QFI, no internal mapping)
API Changes:
- Convert gtpv1u_gnb_create_tunnel_req_t and gtpv1u_gnb_create_tunnel_resp_t
from array-based to scalar fields
* Remove num_tunnels field and array fields (outgoing_teid[], pdusession_id[], etc.)
* Use scalar fields: outgoing_teid, pdusession_id, incoming_rb_id, etc.
- Simplify gtpv1u_create_ngu_tunnel() to handle single tunnel per call
* Remove internal loop that processed multiple tunnels
* Call newGtpuCreateTunnel() once per invocation
* Update response handling to fill single tunnel response
Function Refactoring:
- Split generic drb_gtpu_create() into specialized functions:
* n3_gtpu_create(): Creates N3 tunnel (CU-UP to UPF/core network)
- callback assigned internally: nr_pdcp_data_req_drb, sdap_data_req
- One tunnel per PDU session
- QFI marking
- Supports multiple QoS flows per PDU session
* f1_drb_gtpu_create(): Creates F1-U tunnel (CU-UP to DU or DU side)
- callback assigned internally (cu_f1u_data_req or DURecvCb)
- One tunnel per DRB
- No QFI marking (QFI not used in F1-U)
- Each DRB can carry multiple QoS flows
- Update e1_bearer_context_setup() to loop over DRBs per PDU session
Each item in the PDU Session list contains a list of DRBs, thus
the function helper was adjusted to reflect that:
* Move DRB loop inside PDU session loop
* Create F1-U tunnel for each DRB individually
* Create single N3 tunnel per PDU session (outside DRB loop, with DRB mapping)
Also:
- Add comments to document and improve log messages for clarity
- Consistent error handling with AssertFatal checks
- Update NSA code path (rrc_gNB_nsa.c) to use new scalar API
Note: this commit is already taking into account the multi-QoS flows design
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Apply QoS flow id as soon as the accept message is parsed, before interface
setup and before any code path that starts the per-session interface thread,
so the first SDUs are not sent with the default 0-initialized QFI 0.
Changes:
- In handle_pdu_session_accept, move set_qfi(...) to immediately before
interface setup.
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Only build QoSFlowAddOrModifyResponseList when at least one QFI is present
and fail fast if PDUSessionResourceModifyResponseTransfer encoding does not
produce a valid buffer. This avoids sending malformed modify responses and
makes encoding failures explicit in the NGAP modify response path.
Changes:
- do QoS add/modify response list allocation when nb_of_qos_flow > 0
- add ASN.1 encode result validation
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Remove redundant allocation and duplicate add for AMF_UE_NGAP_ID (asn1cSequenceAdd
already allocates), fixing encoding failure and leak. Fix ASN_STRUCT_FREE_CONTENTS_ONLY
in the unsuccessful-transfer path to free the correct struct.
Changes:
- In ngap_gNB_pdusession_modify_resp(), for AMF_UE_NGAP_ID IE: remove redundant
calloc() and duplicate asn1cSeqAdd() after asn1cSequenceAdd (avoids uninitialized
list element, encoding assertion, and leak).
- In PDU Session Resource Modify Unsuccessful Transfer handling: pass
&pdusessionTransfer to ASN_STRUCT_FREE_CONTENTS_ONLY instead of the unused
NULL pointer pdusessionTransfer_p;
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Updated SCTP reconnect timer from TIMER_ONE_SHOT to
TIMER_PERIODIC so gNB continuously retries AMF lookup every
30 seconds after disconnect.
Timer is now removed only when ngap_amf_associated_nb > 0,
AMF association is actually back.
Further unused arguments cleanup
More fixes for unused function arguments (see #1057),
add_compile_options(-Wunused-parameter) added in folders:
- nfapi
- openair2
- openair3
- USRP
- rfsimulator
