AF Crashes when BaseURL is a int

[ErikGaida]

1. Create PS
2. Create CHC
   2.1. GET CHC for PS from step 1.
3. PUT {{m1_url}}/3gpp-m1/v2/provisioning-sessions/{{provisioning_session_id}}/content-hosting-configuration
   body for 3:

{
    "name": "BBC R&D Demo Streams",
    "ingestConfiguration": {
      "pull": true,
      "protocol": "urn:3gpp:5gms:content-protocol:http-pull-ingest",
      "baseURL": 123
    },
    "distributionConfigurations": [
      {
        "entryPoint": {
          "relativePath": "manifest(format=mpd-time-csf)",
          "contentType": "application/dash+xml",
          "profiles": ["urn:mpeg:dash:profile:isoff-live:2011"]
        }
      }
    ]
  }

THIS CHC IS NOT VAILD input
4. see SIGABRT

04/30 13:19:31.544: [app] INFO: Configuration: '/usr/local/etc/open5gs/msaf.yaml' (../subprojects/open5gs/lib/app/ogs-init.c:126)
04/30 13:19:31.549: [sbi] INFO: mhd_server() [127.0.0.23]:7777 (../subprojects/open5gs/lib/sbi/mhd-server.c:274)
04/30 13:19:31.550: [sbi] INFO: mhd_server() [0.0.0.0]:7778 (../subprojects/open5gs/lib/sbi/mhd-server.c:274)
04/30 13:19:31.550: [sbi] INFO: mhd_server() [127.0.0.25]:7777 (../subprojects/open5gs/lib/sbi/mhd-server.c:274)
04/30 13:19:31.550: [sbi] INFO: nghttp2_server() [http://127.0.0.22]:7777 (../subprojects/open5gs/lib/sbi/nghttp2-server.c:391)
04/30 13:19:31.550: [sbi] INFO: nghttp2_server() [http://127.0.0.99]:7779 (../subprojects/open5gs/lib/sbi/nghttp2-server.c:391)
[New Thread 0x7ffff45236c0 (LWP 167530)]
04/30 13:19:31.552: [app] INFO: 5GMSAF initialize...done (../src/5gmsaf/app.c:24)
04/30 13:19:31.570: [msaf] INFO: [75a89a70-4486-41f1-9213-7d28ea693336] MSAF M1 Running (../src/5gmsaf/msaf-m1-sm.c:144)
04/30 13:19:31.570: [msaf] INFO: [75a89a70-4486-41f1-9213-7d28ea693336] MSAF M5 Running (../src/5gmsaf/msaf-m5-sm.c:113)
04/30 13:19:31.570: [msaf] INFO: [75a89a70-4486-41f1-9213-7d28ea693336] MSAF Management Interface Running (../src/5gmsaf/msaf-mgmt-sm.c:60)
04/30 13:19:31.570: [msaf] INFO: [75a89a70-4486-41f1-9213-7d28ea693336] MSAF Running (../src/5gmsaf/msaf-sm.c:73)
04/30 13:19:31.573: [sbi] INFO: [75a89a70-4486-41f1-9213-7d28ea693336] NF registered [Heartbeat:10s] (../subprojects/open5gs/lib/sbi/nf-sm.c:214)
04/30 11:20:59.924: [core] ERROR: msaf_api_ingest_configuration_parseFromJSON() failed [base_url] (../src/5gmsaf/openapi/model/msaf_api_ingest_configuration.c:151)
04/30 11:20:59.924: [core] ERROR: msaf_api_ingest_configuration_parseFromJSON failed [ingest_configuration] (../src/5gmsaf/openapi/model/msaf_api_content_hosting_configuration.c:233)
04/30 11:20:59.924: [msaf] ERROR: JSON validation of ContentHostingConfiguration failed: Field "baseURL" is not a string or 'null' (../src/5gmsaf/provisioning-session.c:545)
04/30 11:20:59.924: [msaf] ERROR: Provisioning Session [8f80a168-4486-41f1-9213-7d28ea693336]: Update to Content Hosting Configuration failed: Field "baseURL" is not a string or 'null' (../src/5gmsaf/msaf-m1-sm.c:1159)
04/30 11:21:00.084: [core] FATAL: msaf_api_content_hosting_configuration_copy: Assertion `src' failed. (../src/5gmsaf/openapi/model/msaf_api_content_hosting_configuration.c:307)
Downloading separate debug info for /lib/x86_64-linux-gnu/libgcc_s.so.1
Download failed: Keine Route zum Zielrechner.  Continuing without separate debug info for /lib/x86_64-linux-gnu/libgcc_s.so.1.
04/30 11:21:00.743: [core] FATAL: backtrace() returned 13 addresses (../subprojects/open5gs/lib/core/ogs-abort.c:37)
/usr/local/bin/open5gs-msafd(+0x144ba) [0x5555555684ba]
/usr/local/bin/open5gs-msafd(+0x14692) [0x555555568692]
/usr/local/bin/open5gs-msafd(+0xd5df) [0x5555555615df]
/usr/local/bin/open5gs-msafd(+0x2eb9d) [0x555555582b9d]
/usr/local/bin/open5gs-msafd(+0x48631) [0x55555559c631]
/usr/local/lib/x86_64-linux-gnu/libogscore.so.2(ogs_fsm_dispatch+0x119) [0x7ffff7f2be59]
/usr/local/bin/open5gs-msafd(+0xb519) [0x55555555f519]
/usr/local/lib/x86_64-linux-gnu/libogscore.so.2(ogs_fsm_dispatch+0x119) [0x7ffff7f2be59]
/usr/local/bin/open5gs-msafd(+0x9f75) [0x55555555df75]
/usr/local/lib/x86_64-linux-gnu/libogscore.so.2(+0x11b1e) [0x7ffff7f1cb1e]
/lib/x86_64-linux-gnu/libc.so.6(+0x9caa4) [0x7ffff709caa4]
/lib/x86_64-linux-gnu/libc.so.6(+0x129c6c) [0x7ffff7129c6c]

Thread 2 "open5gs-msafd" received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffff45236c0 (LWP 167530)]
Download failed: Das Argument ist ungültig.  Continuing without source file ./nptl/./nptl/pthread_kill.c.
__pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
Warnung: 44	./nptl/pthread_kill.c: Datei oder Verzeichnis nicht gefunden
(gdb) bt
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff704527e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff70288ff in __GI_abort () at ./stdlib/abort.c:79
#5  0x00007ffff7f13eb5 in ogs_abort () at ../subprojects/open5gs/lib/core/ogs-abort.c:47
#6  0x00005555555684ba in msaf_api_content_hosting_configuration_copy (dst=0x0, src=0x0, 
    msaf_api_content_hosting_configuration_as_request=false)
    at ../src/5gmsaf/openapi/model/msaf_api_content_hosting_configuration.c:307
#7  0x0000555555568692 in msaf_api_content_hosting_configuration_copyResponse (dst=0x0, src=0x0)
    at ../src/5gmsaf/openapi/model/msaf_api_content_hosting_configuration.c:343
#8  0x00005555555615df in msaf_content_hosting_configuration_with_af_unique_cert_id (provisioning_session=0x7fffec005350)
    at ../src/5gmsaf/provisioning-session.c:77
#9  0x0000555555582b9d in next_action_for_application_server (as_state=0x5555556ae730)
    at ../src/5gmsaf/application-server-context.c:259
#10 0x000055555559c631 in msaf_m1_state_functional (s=0x555555673890, e=0x7fffec0471a0) at ../src/5gmsaf/msaf-m1-sm.c:2196
#11 0x00007ffff7f2be59 in ogs_fsm_dispatch (fsm=0x555555673890, event=0x7fffec0471a0)
    at ../subprojects/open5gs/lib/core/ogs-fsm.c:127
#12 0x000055555555f519 in msaf_state_functional (s=0x7ffff4522c20, e=0x7fffec0471a0) at ../src/5gmsaf/msaf-sm.c:207
#13 0x00007ffff7f2be59 in ogs_fsm_dispatch (fsm=0x7ffff4522c20, event=0x7fffec0471a0)
    at ../subprojects/open5gs/lib/core/ogs-fsm.c:127
#14 0x000055555555df75 in msaf_main (data=0x0) at ../src/5gmsaf/init.c:153
#15 0x00007ffff7f1cb1e in thread_worker (arg=0x5555556b1630) at ../subprojects/open5gs/lib/core/ogs-thread.c:67
#16 0x00007ffff709caa4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447
#17 0x00007ffff7129c6c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

[rjb1000]

This sounds like it's in a similar bucket to #186.

Overall, the input validation for the 5GMS AF is more primitive than what we have done in more recent projects (it uses very basic C template code generated by OpenAPI Generator rather than the C++ templates @davidjwbbc subsequently developed), so I'm not surprised.

@davidjwbbc will take a look.

[ErikGaida]

@rjb1000 Thank you for the feedback.

I think #186 is also related to generated code, but the root cause may be in the Mustache template used by the AF:

rt-5gms-application-function/subprojects/rt-common-shared/open5gs-tools/openapi-generator-templates/c/model-body-object-defs.mustache

The URI regex is currently missing an end-of-string anchor:

#define _OPENAPI_URI_REGEX "^" _OPENAPI_URI_RE_SCHEME ":" _OPENAPI_URI_RE_HIER_PART "(?:\\?" _OPENAPI_URI_RE_QUERY ")?(?:#" _OPENAPI_URI_RE_FRAGMENT ")?"

i think it should be:

#define _OPENAPI_URI_REGEX "^" _OPENAPI_URI_RE_SCHEME ":" _OPENAPI_URI_RE_HIER_PART "(?:\\?" _OPENAPI_URI_RE_QUERY ")?(?:#" _OPENAPI_URI_RE_FRAGMENT ")?$"

With that change, most of the validation changes in my PR #196 should no longer be needed, because invalid values such as "https:// example.com" would be rejected by the generated parser.

I also noticed a separate retry-loop issue in the M3 response handling in:

rt-5gms-application-function/src/5gmsaf/msaf-m1-sm.c

In the Content Hosting Configuration POST response handler, only status 201 removes the CHC from upload_content_hosting_configurations. For error responses such as:

405, 413, 414, 415, 422, 500, 503

the AF only logs the error and then calls next_action_for_application_server(as_state) again. Since the CHC remains in the upload list, the AF keeps retrying the same POST until the AS returns 201. This means the endless retry loop is not limited to 422, it can happen for the other error responses as well.