AF crashes on PUT Update Policy Template with empty or non-existent policy-template-id

[ErikGaida]

Summary

This bug was found while reviewing the Insomnia setup (see PR #97).

1. start AF
2. POST create provisioning session => {{_['m1_url']}}/3gpp-m1/v2/provisioning-sessions
3. PUT Update Policy Template => http://127.0.0.23:7777/3gpp-m1/v2/provisioning-sessions/2ba94b6e-1a8c-41f1-91eb-65520209584c/policy-templates/07959062-1a8b-41f1-acc4-73a6c78027f4

After creating a provisioning session (step 2), I sent a PUT Update Policy Template request for that session using a non-existing policy-template-id. The AF crashes; logs are below.

(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/local/bin/open5gs-msafd 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Warnung: could not find '.gnu_debugaltlink' file for /lib/x86_64-linux-gnu/liblber.so.2
Open5GS daemon v2.6.4-10-gb9dd812+

03/08 02:14:15.424: [app] INFO: Configuration: '/usr/local/etc/open5gs/msaf.yaml' (../subprojects/open5gs/lib/app/ogs-init.c:126)
03/08 02:14:15.430: [sbi] INFO: mhd_server() [127.0.0.23]:7777 (../subprojects/open5gs/lib/sbi/mhd-server.c:274)
03/08 02:14:15.430: [sbi] INFO: mhd_server() [0.0.0.0]:7778 (../subprojects/open5gs/lib/sbi/mhd-server.c:274)
03/08 02:14:15.430: [sbi] INFO: mhd_server() [127.0.0.25]:7777 (../subprojects/open5gs/lib/sbi/mhd-server.c:274)
03/08 02:14:15.430: [sbi] INFO: nghttp2_server() [http://127.0.0.22]:7777 (../subprojects/open5gs/lib/sbi/nghttp2-server.c:391)
03/08 02:14:15.430: [sbi] INFO: nghttp2_server() [http://127.0.0.99]:7779 (../subprojects/open5gs/lib/sbi/nghttp2-server.c:391)
[New Thread 0x7ffff451d6c0 (LWP 59602)]
03/08 02:14:15.432: [app] INFO: 5GMSAF initialize...done (../src/5gmsaf/app.c:24)
03/08 02:14:15.439: [msaf] INFO: [1fabea9c-1a8c-41f1-91eb-65520209584c] MSAF M1 Running (../src/5gmsaf/msaf-m1-sm.c:144)
03/08 02:14:15.439: [msaf] INFO: [1fabea9c-1a8c-41f1-91eb-65520209584c] MSAF M5 Running (../src/5gmsaf/msaf-m5-sm.c:113)
03/08 02:14:15.439: [msaf] INFO: [1fabea9c-1a8c-41f1-91eb-65520209584c] MSAF Management Interface Running (../src/5gmsaf/msaf-mgmt-sm.c:60)
03/08 02:14:15.439: [msaf] INFO: [1fabea9c-1a8c-41f1-91eb-65520209584c] MSAF Running (../src/5gmsaf/msaf-sm.c:73)
03/08 02:14:15.441: [sbi] INFO: [1fabea9c-1a8c-41f1-91eb-65520209584c] NF registered [Heartbeat:10s] (../subprojects/open5gs/lib/sbi/nf-sm.c:214)
03/08 01:16:34.667: [sbi] FATAL: An HTTP request was received, but the HTTP response is missing. (../subprojects/open5gs/lib/sbi/mhd-server.c:177)
03/08 01:16:34.667: [sbi] FATAL: Please send the related pcap files for this case. (../subprojects/open5gs/lib/sbi/mhd-server.c:179)
03/08 01:16:34.667: [sbi] FATAL: session_timer_expired: should not be reached. (../subprojects/open5gs/lib/sbi/mhd-server.c:183)
03/08 01:16:34.672: [core] FATAL: backtrace() returned 7 addresses (../subprojects/open5gs/lib/core/ogs-abort.c:37)
/usr/local/lib/x86_64-linux-gnu/libogssbi.so.2(+0x29949) [0x7ffff7f75949]
/usr/local/lib/x86_64-linux-gnu/libogscore.so.2(ogs_timer_mgr_expire+0x154) [0x7ffff7f1c133]
/usr/local/bin/open5gs-msafd(+0x9e57) [0x55555555de57]
/usr/local/lib/x86_64-linux-gnu/libogscore.so.2(+0x11b1e) [0x7ffff7f1cb1e]
/lib/x86_64-linux-gnu/libc.so.6(+0x9caa4) [0x7ffff709caa4]
/lib/x86_64-linux-gnu/libc.so.6(+0x129c6c) [0x7ffff7129c6c]

Thread 2 "open5gs-msafd" received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffff451d6c0 (LWP 59602)]
Download failed: Das Argument ist ungültig.  Continuing without source file ./nptl/./nptl/pthread_kill.c.
__pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
Warnung: 44     ./nptl/pthread_kill.c: Datei oder Verzeichnis nicht gefunden

---

1. start AF
2. POST create provisioning session => {{_['m1_url']}}/3gpp-m1/v2/provisioning-sessions
3. PUT Update Policy Template => http://127.0.0.23:7777/3gpp-m1/v2/provisioning-sessions/67ef2e44-1a8d-41f1-b38b-59408cad7613/policy-templates/

After creating a provisioning session (step 2), I sent a PUT Update Policy Template request for that session with an empty policy-template-id. The AF crashes; logs are below.

03/08 02:23:21.078: [app] INFO: Configuration: '/usr/local/etc/open5gs/msaf.yaml' (../subprojects/open5gs/lib/app/ogs-init.c:126)
03/08 02:23:21.084: [sbi] INFO: mhd_server() [127.0.0.23]:7777 (../subprojects/open5gs/lib/sbi/mhd-server.c:274)
03/08 02:23:21.084: [sbi] INFO: mhd_server() [0.0.0.0]:7778 (../subprojects/open5gs/lib/sbi/mhd-server.c:274)
03/08 02:23:21.084: [sbi] INFO: mhd_server() [127.0.0.25]:7777 (../subprojects/open5gs/lib/sbi/mhd-server.c:274)
03/08 02:23:21.084: [sbi] INFO: nghttp2_server() [http://127.0.0.22]:7777 (../subprojects/open5gs/lib/sbi/nghttp2-server.c:391)
03/08 02:23:21.084: [sbi] INFO: nghttp2_server() [http://127.0.0.99]:7779 (../subprojects/open5gs/lib/sbi/nghttp2-server.c:391)
[New Thread 0x7ffff451d6c0 (LWP 60637)]
03/08 02:23:21.085: [app] INFO: 5GMSAF initialize...done (../src/5gmsaf/app.c:24)
03/08 02:23:21.093: [msaf] INFO: [64e80eaa-1a8d-41f1-b38b-59408cad7613] MSAF M1 Running (../src/5gmsaf/msaf-m1-sm.c:144)
03/08 02:23:21.093: [msaf] INFO: [64e80eaa-1a8d-41f1-b38b-59408cad7613] MSAF M5 Running (../src/5gmsaf/msaf-m5-sm.c:113)
03/08 02:23:21.093: [msaf] INFO: [64e80eaa-1a8d-41f1-b38b-59408cad7613] MSAF Management Interface Running (../src/5gmsaf/msaf-mgmt-sm.c:60)
03/08 02:23:21.093: [msaf] INFO: [64e80eaa-1a8d-41f1-b38b-59408cad7613] MSAF Running (../src/5gmsaf/msaf-sm.c:73)
03/08 02:23:21.094: [sbi] INFO: [64e80eaa-1a8d-41f1-b38b-59408cad7613] NF registered [Heartbeat:10s] (../subprojects/open5gs/lib/sbi/nf-sm.c:214)
03/08 01:24:04.213: [core] FATAL: ogs_hash_get_debug: Assertion `key' failed. (../subprojects/open5gs/lib/core/ogs-hash.c:326)
Downloading separate debug info for /lib/x86_64-linux-gnu/libgcc_s.so.1
[###                                                                                                                                                                                                                                        03/08 01:24:04.485: [core] FATAL: backtrace() returned 11 addresses (../subprojects/open5gs/lib/core/ogs-abort.c:37)
/usr/local/lib/x86_64-linux-gnu/libogscore.so.2(ogs_hash_get_debug+0xe1) [0x7ffff7f2cc6e]
/usr/local/bin/open5gs-msafd(+0xecc8) [0x555555562cc8]
/usr/local/bin/open5gs-msafd(+0x41a71) [0x555555595a71]
/usr/local/lib/x86_64-linux-gnu/libogscore.so.2(ogs_fsm_dispatch+0x119) [0x7ffff7f2be67]
/usr/local/bin/open5gs-msafd(+0xadc5) [0x55555555edc5]
/usr/local/lib/x86_64-linux-gnu/libogscore.so.2(ogs_fsm_dispatch+0x119) [0x7ffff7f2be67]
/usr/local/bin/open5gs-msafd(+0x9f75) [0x55555555df75]
/usr/local/lib/x86_64-linux-gnu/libogscore.so.2(+0x11b1e) [0x7ffff7f1cb1e]
/lib/x86_64-linux-gnu/libc.so.6(+0x9caa4) [0x7ffff709caa4]
/lib/x86_64-linux-gnu/libc.so.6(+0x129c6c) [0x7ffff7129c6c]

Thread 2 "open5gs-msafd" received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffff451d6c0 (LWP 60637)]
Download failed: Das Argument ist ungültig.  Continuing without source file ./nptl/./nptl/pthread_kill.c.
__pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
Warnung: 44     ./nptl/pthread_kill.c: Datei oder Verzeichnis nicht gefunden

[rjb1000]

Need to check the Rel-17 OpenAPI YAML for readOnly, but I thought the Policy Template identifier is supposed to be allocated by the 5GMS AF as a side effect of the create service operation. If this is the case, any identifier value in the document POSTed in should be ignored by the 5GMS AF and replaced with a value it has allocated.

Am I remembering this correctly, @davidjwbbc? (I know we fixed this in Rel-18, but can't remember what we did for Rel-17.)

[davidjwbbc]

Yes, but this is reporting a bug for when a PUT is received for an unknown or missing {policyTemplateId}. It's probably a code path that we didn't test due to the inability of Open5GS to handle QoS properly. We halted work because we couldn't take it any further, which likely means there's still some bugs in there.

[davidjwbbc]

This should be a simple fix to fill in the code paths for when the policy template cannot be found or when the API path is incomplete.