Merge branch 'fix_ue_ngap_context_check' into 'develop'

Fix potential AMF crash with UE/NGAP/NAS context

See merge request oai/cn5g/oai-cn5g-amf!49

src/amf-app/amf_n1.cpp

@@ -172,7 +172,14 @@ void amf_n1::handle_itti_message(itti_downlink_nas_transfer& itti_msg) {
     } else {
       string ue_context_key = "app_ue_ranid_" + to_string(ran_ue_ngap_id) +
                               ":amfid_" + to_string(amf_ue_ngap_id);
-      std::shared_ptr<ue_context> uc;
+
+      if (!amf_app_inst->is_ran_amf_id_2_ue_context(ue_context_key)) {
+        Logger::amf_n1().error(
+            "No UE context for %s exit", ue_context_key.c_str());
+        return;
+      }
+
+      std::shared_ptr<ue_context> uc = {};
       uc = amf_app_inst->ran_amf_id_2_ue_context(ue_context_key);
       if (uc.get() == nullptr) {
         // TODO:
@@ -559,7 +566,7 @@ void amf_n1::identity_response_handle(
                           ":amfid_" + to_string(amf_ue_ngap_id);
 
   if (amf_app_inst->is_ran_amf_id_2_ue_context(ue_context_key)) {
-    std::shared_ptr<ue_context> uc;
+    std::shared_ptr<ue_context> uc = {};
     uc = amf_app_inst->ran_amf_id_2_ue_context(ue_context_key);
     // Update UE context
     if (uc.get() != nullptr) {
@@ -571,7 +578,7 @@ void amf_n1::identity_response_handle(
     }
   }
 
-  std::shared_ptr<nas_context> nc;
+  std::shared_ptr<nas_context> nc = {};
   if (is_amf_ue_id_2_nas_context(amf_ue_ngap_id)) {
     nc = amf_ue_id_2_nas_context(amf_ue_ngap_id);
     Logger::amf_n1().debug(
@@ -600,10 +607,15 @@ void amf_n1::service_request_handle(
     long amf_ue_ngap_id, bstring nas) {
   string ue_context_key = "app_ue_ranid_" + to_string(ran_ue_ngap_id) +
                           ":amfid_" + to_string(amf_ue_ngap_id);
-  std::shared_ptr<ue_context> uc;
+
+  std::shared_ptr<ue_context> uc = {};
+  if (!amf_app_inst->is_ran_amf_id_2_ue_context(ue_context_key)) {
+    Logger::amf_n1().error("No UE context for %s exit", ue_context_key.c_str());
+  } else {
     uc = amf_app_inst->ran_amf_id_2_ue_context(ue_context_key);
+  }
 
-  if (!nc.get() or (uc.get() == nullptr)) {
+  if (!nc.get() or !uc.get()) {
     Logger::amf_n1().debug(
         "Cannot find NAS/UE context, send Service Reject to UE");
     // service reject
@@ -827,10 +839,16 @@ void amf_n1::registration_request_handle(
   // Find UE context
   string ue_context_key = "app_ue_ranid_" + to_string(ran_ue_ngap_id) +
                           ":amfid_" + to_string(amf_ue_ngap_id);
-  std::shared_ptr<ue_context> uc;
+  std::shared_ptr<ue_context> uc = {};
   Logger::amf_n1().info(
       "Try to find ue_context in amf_app using ran_amf_id (%s)",
       ue_context_key.c_str());
+
+  if (!amf_app_inst->is_ran_amf_id_2_ue_context(ue_context_key)) {
+    Logger::amf_n1().error("No UE context for %s exit", ue_context_key.c_str());
+    return;
+  }
+
   uc = amf_app_inst->ran_amf_id_2_ue_context(ue_context_key);
 
   // Check 5gs Mobility Identity (Mandatory IE)
@@ -963,6 +981,13 @@ void amf_n1::registration_request_handle(
           amf_ue_ngap_id);
       // release ue_ngap_context and ue_context
       if (uc.get()) uc.reset();
+
+      if (!amf_n2_inst->is_ran_ue_id_2_ue_ngap_context(ran_ue_ngap_id)) {
+        Logger::amf_n2().error(
+            "No UE NGAP context with ran_ue_ngap_id (%d)", ran_ue_ngap_id);
+        return;
+      }
+
       std::shared_ptr<ue_ngap_context> unc =
           amf_n2_inst->ran_ue_id_2_ue_ngap_context(ran_ue_ngap_id);
       if (unc.get()) unc.reset();
@@ -2026,13 +2051,20 @@ void amf_n1::security_mode_complete_handle(
   string ue_context_key = "app_ue_ranid_" + to_string(ran_ue_ngap_id) +
                           ":amfid_" + to_string(amf_ue_ngap_id);
   std::shared_ptr<ue_context> uc;
+  if (!amf_app_inst->is_ran_amf_id_2_ue_context(ue_context_key)) {
+    Logger::amf_n1().error("No UE context for %s exit", ue_context_key.c_str());
+    return;
+  }
+
   uc = amf_app_inst->ran_amf_id_2_ue_context(ue_context_key);
   if (uc.get() == nullptr) {
     // TODO:
     Logger::amf_n1().error(
         "ue_context in amf_app using ran_amf_id (%s) does not existed!",
         ue_context_key.c_str());
+    return;
   }
+
   Logger::amf_n1().info(
       "Found ue_context (%p) in amf_app using ran_amf_id (%s)", uc.get(),
       ue_context_key.c_str());
@@ -2093,7 +2125,13 @@ void amf_n1::security_mode_complete_handle(
     return;
   }
 
-  std::shared_ptr<nas_context> nc;
+  if (!is_amf_ue_id_2_nas_context(amf_ue_ngap_id)) {
+    Logger::amf_n2().error(
+        "No UE NAS context with amf_ue_ngap_id (0x%x)", amf_ue_ngap_id);
+    return;
+  }
+
+  std::shared_ptr<nas_context> nc = {};
   nc                              = amf_ue_id_2_nas_context(amf_ue_ngap_id);
   Logger::amf_n1().info(
       "UE (IMSI %s, GUTI %s, current RAN ID %d, current AMF ID %d) has been "
@@ -2724,6 +2762,11 @@ void amf_n1::run_mobility_registration_update_procedure(
   string ue_context_key = "app_ue_ranid_" + to_string(nc->ran_ue_ngap_id) +
                           ":amfid_" + to_string(nc->amf_ue_ngap_id);
   std::shared_ptr<ue_context> uc = {};
+  if (!amf_app_inst->is_ran_amf_id_2_ue_context(ue_context_key)) {
+    Logger::amf_n1().error("No UE context for %s exit", ue_context_key.c_str());
+    return;
+  }
+
   uc = amf_app_inst->ran_amf_id_2_ue_context(ue_context_key);
 
   if (uc.get() == nullptr) {
@@ -2731,6 +2774,7 @@ void amf_n1::run_mobility_registration_update_procedure(
         "Cannot find the UE context with key %s", ue_context_key.c_str());
     return;
   }
+
   // get PDU session status
   std::vector<uint8_t> pdu_session_to_be_activated = {};
   std::bitset<16> pdu_session_status_bits((uint16_t) pdu_session_status);

src/amf-app/amf_n11.cpp

@@ -163,12 +163,23 @@ void amf_n11::handle_itti_message(
   string ue_context_key = "app_ue_ranid_" + to_string(itti_msg.ran_ue_ngap_id) +
                           ":amfid_" + to_string(itti_msg.amf_ue_ngap_id);
   std::shared_ptr<ue_context> uc = {};
+  if (!amf_app_inst->is_ran_amf_id_2_ue_context(ue_context_key)) {
+    Logger::amf_n11().error(
+        "No UE context for %s exit", ue_context_key.c_str());
+    return;
+  }
+
   uc = amf_app_inst->ran_amf_id_2_ue_context(ue_context_key);
 
   std::string supi = {};
   if (uc.get() != nullptr) {
     supi = uc->supi;
+  } else {
+    Logger::amf_n11().error(
+        "Could not find UE context with key %s", ue_context_key.c_str());
+    return;
   }
+
   Logger::amf_n11().debug(
       "Send PDU Session Update SM Context Request to SMF (SUPI %s, PDU Session "
       "ID %d)",
@@ -241,6 +252,12 @@ void amf_n11::handle_itti_message(
 void amf_n11::handle_itti_message(itti_nsmf_pdusession_create_sm_context& smf) {
   Logger::amf_n11().debug("Handle ITTI SMF_PDU_SESSION_CREATE_SM_CTX");
 
+  if (!amf_n1_inst->is_amf_ue_id_2_nas_context(smf.amf_ue_ngap_id)) {
+    Logger::amf_n2().error(
+        "No UE NAS context with amf_ue_ngap_id (0x%x)", smf.amf_ue_ngap_id);
+    return;
+  }
+
   std::shared_ptr<nas_context> nc = {};
   nc               = amf_n1_inst->amf_ue_id_2_nas_context(smf.amf_ue_ngap_id);
   std::string supi = "imsi-" + nc.get()->imsi;
@@ -251,7 +268,20 @@ void amf_n11::handle_itti_message(itti_nsmf_pdusession_create_sm_context& smf) {
   Logger::amf_n11().info(
       "Find ue_context in amf_app using UE Context Key: %s",
       ue_context_key.c_str());
+  if (!amf_app_inst->is_ran_amf_id_2_ue_context(ue_context_key)) {
+    Logger::amf_n11().error(
+        "No UE context for %s exit", ue_context_key.c_str());
+    return;
+  }
+
   uc = amf_app_inst->ran_amf_id_2_ue_context(ue_context_key);
+
+  if (!uc.get()) {
+    Logger::amf_n11().error(
+        "No UE context for %s exit", ue_context_key.c_str());
+    return;
+  }
+
   std::shared_ptr<pdu_session_context> psc = {};
   if (!uc.get()->find_pdu_session_context(smf.pdu_sess_id, psc)) {
     psc = std::shared_ptr<pdu_session_context>(new pdu_session_context());
@@ -259,6 +289,11 @@ void amf_n11::handle_itti_message(itti_nsmf_pdusession_create_sm_context& smf) {
     Logger::amf_n11().debug("Create a PDU Session Context");
   }
 
+  if (!psc.get()) {
+    Logger::amf_n11().error("No PDU Session Context found");
+    return;
+  }
+
   psc.get()->amf_ue_ngap_id = nc.get()->amf_ue_ngap_id;
   psc.get()->ran_ue_ngap_id = nc.get()->ran_ue_ngap_id;
   psc.get()->req_type       = smf.req_type;

src/amf-app/amf_n2.cpp

@@ -656,11 +656,7 @@ void amf_n2::handle_itti_message(itti_ul_nas_transport& ul_nas_transport) {
         ran_ue_ngap_id, ul_nas_transport.assoc_id);
     return;
   }
-  if (!is_ran_ue_id_2_ue_ngap_context(ran_ue_ngap_id)) {
-    Logger::amf_n2().error(
-        "No UE NGAP context with ran_ue_ngap_id (%d)", ran_ue_ngap_id);
-    return;
-  }
+
   unc = ran_ue_id_2_ue_ngap_context(ran_ue_ngap_id);
   if (unc.get()->amf_ue_ngap_id != amf_ue_ngap_id) {
     Logger::amf_n2().error(
@@ -714,6 +710,15 @@ void amf_n2::handle_itti_message(itti_ul_nas_transport& ul_nas_transport) {
 //------------------------------------------------------------------------------
 void amf_n2::handle_itti_message(itti_dl_nas_transport& dl_nas_transport) {
   Logger::amf_n2().debug("Handle DL NAS Transport ...");
+
+  if (!amf_n2_inst->is_ran_ue_id_2_ue_ngap_context(
+          dl_nas_transport.ran_ue_ngap_id)) {
+    Logger::amf_n2().error(
+        "No UE NGAP context with ran_ue_ngap_id (%d)",
+        dl_nas_transport.ran_ue_ngap_id);
+    return;
+  }
+
   std::shared_ptr<ue_ngap_context> unc = {};
   unc = ran_ue_id_2_ue_ngap_context(dl_nas_transport.ran_ue_ngap_id);
   if (unc.get() == nullptr) {
@@ -748,6 +753,13 @@ void amf_n2::handle_itti_message(itti_dl_nas_transport& dl_nas_transport) {
 //------------------------------------------------------------------------------
 void amf_n2::handle_itti_message(itti_initial_context_setup_request& itti_msg) {
   Logger::amf_n2().debug("Handle Initial Context Setup Request ...");
+
+  if (!amf_n2_inst->is_ran_ue_id_2_ue_ngap_context(itti_msg.ran_ue_ngap_id)) {
+    Logger::amf_n2().error(
+        "No UE NGAP context with ran_ue_ngap_id (%d)", itti_msg.ran_ue_ngap_id);
+    return;
+  }
+
   std::shared_ptr<ue_ngap_context> unc = {};
   unc = ran_ue_id_2_ue_ngap_context(itti_msg.ran_ue_ngap_id);
   if (unc.get() == nullptr) {
@@ -879,7 +891,15 @@ void amf_n2::handle_itti_message(itti_initial_context_setup_request& itti_msg) {
 void amf_n2::handle_itti_message(
     itti_pdu_session_resource_setup_request& itti_msg) {
   Logger::amf_n2().debug("Handle PDU Session Resource Setup Request ...");
+
+  if (!amf_n2_inst->is_ran_ue_id_2_ue_ngap_context(itti_msg.ran_ue_ngap_id)) {
+    Logger::amf_n2().error(
+        "No UE NGAP context with ran_ue_ngap_id (%d)", itti_msg.ran_ue_ngap_id);
+    return;
+  }
+
   std::shared_ptr<ue_ngap_context> unc = {};
+
   unc = ran_ue_id_2_ue_ngap_context(itti_msg.ran_ue_ngap_id);
   if (unc.get() == nullptr) {
     Logger::amf_n2().error(
@@ -967,6 +987,12 @@ void amf_n2::handle_itti_message(
     itti_pdu_session_resource_release_command& itti_msg) {
   Logger::amf_n2().debug("Handle PDU Session Resource Release Command ...");
 
+  if (!amf_n2_inst->is_ran_ue_id_2_ue_ngap_context(itti_msg.ran_ue_ngap_id)) {
+    Logger::amf_n2().error(
+        "No UE NGAP context with ran_ue_ngap_id (%d)", itti_msg.ran_ue_ngap_id);
+    return;
+  }
+
   std::shared_ptr<ue_ngap_context> unc = {};
   unc = ran_ue_id_2_ue_ngap_context(itti_msg.ran_ue_ngap_id);
   if (unc.get() == nullptr) {
@@ -1043,6 +1069,12 @@ void amf_n2::handle_itti_message(itti_ue_context_release_request& itti_msg) {
 void amf_n2::handle_itti_message(itti_ue_context_release_command& itti_msg) {
   Logger::amf_n2().debug("Handling UE Context Release Command ...");
 
+  if (!amf_n2_inst->is_ran_ue_id_2_ue_ngap_context(itti_msg.ran_ue_ngap_id)) {
+    Logger::amf_n2().error(
+        "No UE NGAP context with ran_ue_ngap_id (%d)", itti_msg.ran_ue_ngap_id);
+    return;
+  }
+
   std::shared_ptr<ue_ngap_context> unc = {};
   unc = ran_ue_id_2_ue_ngap_context(itti_msg.ran_ue_ngap_id);
   if (unc.get() == nullptr) {
@@ -1249,6 +1281,12 @@ bool amf_n2::handle_itti_message(itti_handover_required& itti_msg) {
   handover_request->setGUAMI(m_plmnId, m_aMFRegionID, m_aMFSetID, m_aMFPointer);
 
   // Security context
+  if (!amf_n1_inst->is_amf_ue_id_2_nas_context(amf_ue_ngap_id)) {
+    Logger::amf_n2().error(
+        "No UE NAS context with amf_ue_ngap_id (0x%x)", amf_ue_ngap_id);
+    return false;
+  }
+
   std::shared_ptr<nas_context> nc =
       amf_n1_inst->amf_ue_id_2_nas_context(amf_ue_ngap_id);
   nas_secu_ctx* secu = nc.get()->security_ctx;
@@ -1429,6 +1467,12 @@ void amf_n2::handle_itti_message(itti_handover_request_Ack& itti_msg) {
   OCTET_STRING_t targetTosource =
       itti_msg.handoverrequestAck->getTargetToSource_TransparentContainer();
 
+  if (!amf_n1_inst->is_amf_ue_id_2_nas_context(amf_ue_ngap_id)) {
+    Logger::amf_n2().error(
+        "No UE NAS context with amf_ue_ngap_id (0x%x)", amf_ue_ngap_id);
+    return;
+  }
+
   std::shared_ptr<nas_context> nc =
       amf_n1_inst->amf_ue_id_2_nas_context(amf_ue_ngap_id);
   string supi = "imsi-" + nc.get()->imsi;
@@ -1573,6 +1617,12 @@ void amf_n2::handle_itti_message(itti_handover_notify& itti_msg) {
     return;
   }
 
+  if (!amf_n1_inst->is_amf_ue_id_2_nas_context(amf_ue_ngap_id)) {
+    Logger::amf_n2().error(
+        "No UE NAS context with amf_ue_ngap_id (0x%x)", amf_ue_ngap_id);
+    return;
+  }
+
   std::shared_ptr<nas_context> nc =
       amf_n1_inst->amf_ue_id_2_nas_context(amf_ue_ngap_id);
   string supi = "imsi-" + nc.get()->imsi;

src/ngap/ngap_app/ngap_message_callback.hpp

@@ -365,6 +365,11 @@ int ngap_amf_handle_pdu_session_resource_setup_response(
     itti_nsmf_pdusession_update_sm_context* itti_msg =
         new itti_nsmf_pdusession_update_sm_context(TASK_NGAP, TASK_AMF_N11);
     long amf_ue_ngap_id = pduresp->getAmfUeNgapId();
+    if (!amf_n1_inst->is_amf_ue_id_2_nas_context(amf_ue_ngap_id)) {
+      Logger::ngap().error(
+          "No UE NAS context with amf_ue_ngap_id (0x%x)", amf_ue_ngap_id);
+      return -1;
+    }
     std::shared_ptr<nas_context> nct =
         amf_n1_inst->amf_ue_id_2_nas_context(amf_ue_ngap_id);
     itti_msg->supi           = "imsi-" + nct.get()->imsi;
@@ -421,6 +426,13 @@ int ngap_amf_handle_pdu_session_resource_setup_response(
        not send ITTI message %s to task TASK_AMF_N2", i->get_msg_name());
        }*/
       long amf_ue_ngap_id = pduresp->getAmfUeNgapId();
+
+      if (!amf_n1_inst->is_amf_ue_id_2_nas_context(amf_ue_ngap_id)) {
+        Logger::ngap().error(
+            "No UE NAS context with amf_ue_ngap_id (0x%x)", amf_ue_ngap_id);
+        return -1;
+      }
+
       std::shared_ptr<nas_context> nct =
           amf_n1_inst->amf_ue_id_2_nas_context(amf_ue_ngap_id);
       string supi = "imsi-" + nct.get()->imsi;
@@ -428,7 +440,7 @@ int ngap_amf_handle_pdu_session_resource_setup_response(
       if (amf_app_inst->find_pdu_session_context(
               supi, list_fail[0].pduSessionId, psc)) {
         if (psc.get() == nullptr) {
-          Logger::amf_n1().error("Cannot get pdu_session_context");
+          Logger::ngap().error("Cannot get pdu_session_context");
           return -1;
         }
       }