UE Authorization failed when running in docker container

[jaiglesias-optare]

When running open5GS v2.7.0 in docker container (directly from srsRAN project, main branch), I have the following error that prevents to register UE:

open5gs_5gc     | 05/21 14:13:49.499: [amf] INFO: InitialUEMessage (../src/amf/ngap-handler.c:401)
open5gs_5gc     | 05/21 14:13:49.499: [amf] INFO: [Added] Number of gNB-UEs is now 1 (../src/amf/context.c:2550)
open5gs_5gc     | 05/21 14:13:49.499: [amf] INFO:     RAN_UE_NGAP_ID[2] AMF_UE_NGAP_ID[3] TAC[7] CellID[0x66c000] (../src/amf/ngap-handler.c:562)
open5gs_5gc     | 05/21 14:13:49.499: [amf] INFO: [suci-0-001-01-0000-1-1-9e138854bb43c3de0f0eaa57fcc7605affa87a6a55df592b09ad777e260c462d9f010d6fd55201c02c0afed40d] Unknown UE by SUCI (../src/amf/context.c:1835)
open5gs_5gc     | 05/21 14:13:49.499: [amf] INFO: [Added] Number of AMF-UEs is now 1 (../src/amf/context.c:1616)
open5gs_5gc     | 05/21 14:13:49.499: [gmm] INFO: Registration request (../src/amf/gmm-sm.c:1165)
open5gs_5gc     | 05/21 14:13:49.499: [gmm] INFO: [suci-0-001-01-0000-1-1-9e138854bb43c3de0f0eaa57fcc7605affa87a6a55df592b09ad777e260c462d9f010d6fd55201c02c0afed40d]    SUCI (../src/amf/gmm-handler.c:166)
open5gs_5gc     | 05/21 14:13:49.501: [sbi] ERROR: HNET PKI Value Not Avaiable [1] (../lib/sbi/conv.c:140)
open5gs_5gc     | 05/21 14:13:49.501: [sbi] ERROR: ogs_supi_from_supi_or_suci: Expectation `supi' failed. (../lib/sbi/conv.c:262)
open5gs_5gc     | 05/21 14:13:49.501: [udm] ERROR: No memory for udm_ue->supi [suci-0-001-01-0000-1-1-9e138854bb43c3de0f0eaa57fcc7605affa87a6a55df592b09ad777e260c462d9f010d6fd55201c02c0afed40d] (../src/udm/context.c:168)
open5gs_5gc     | 05/21 14:13:49.501: [udm] ERROR: Invalid Request [suci-0-001-01-0000-1-1-9e138854bb43c3de0f0eaa57fcc7605affa87a6a55df592b09ad777e260c462d9f010d6fd55201c02c0afed40d] (../src/udm/udm-sm.c:167)
open5gs_5gc     | 05/21 14:13:49.502: [ausf] ERROR: [suci-0-001-01-0000-1-1-9e138854bb43c3de0f0eaa57fcc7605affa87a6a55df592b09ad777e260c462d9f010d6fd55201c02c0afed40d] HTTP response error [400] (../src/ausf/ue-sm.c:159)
open5gs_5gc     | 05/21 14:13:49.503: [gmm] ERROR: [suci-0-001-01-0000-1-1-9e138854bb43c3de0f0eaa57fcc7605affa87a6a55df592b09ad777e260c462d9f010d6fd55201c02c0afed40d] HTTP response error [400] (../src/amf/gmm-sm.c:1675)
open5gs_5gc     | 05/21 14:13:49.503: [amf] WARNING: [suci-0-001-01-0000-1-1-9e138854bb43c3de0f0eaa57fcc7605affa87a6a55df592b09ad777e260c462d9f010d6fd55201c02c0afed40d] Registration reject [95] (../src/amf/nas-path.c:219)
open5gs_5gc     | 05/21 14:13:49.639: [amf] INFO: UE Context Release [Action:3] (../src/amf/ngap-handler.c:1698)
open5gs_5gc     | 05/21 14:13:49.639: [amf] INFO:     RAN_UE_NGAP_ID[2] AMF_UE_NGAP_ID[3] (../src/amf/ngap-handler.c:1699)
open5gs_5gc     | 05/21 14:13:49.639: [amf] INFO:     SUCI[suci-0-001-01-0000-1-1-9e138854bb43c3de0f0eaa57fcc7605affa87a6a55df592b09ad777e260c462d9f010d6fd55201c02c0afed40d] (../src/amf/ngap-handler.c:1702)
open5gs_5gc     | 05/21 14:13:49.639: [amf] INFO: [Removed] Number of gNB-UEs is now 0 (../src/amf/context.c:2557)
open5gs_5gc     | 05/21 14:13:49.639: [amf] INFO: [Removed] Number of AMF-UEs is now 0 (../src/amf/context.c:1709)

It works ok when running Open5GS natively. I have checked that hnet directory contents are the same in both cases.

[jaiglesias-optare]

It seems that subscribers added via webui are not fully "registered". I mean, they are stored ok in MongoDB, but authorization still fails.
I have tried to define subscriber data in open5gs.env file, so that it is loaded by open5gs services at startup, but it has no option to declare my different apn (and changing it later through webui changes nothing about the problem).
Is there any way to restart open5gs services in docker container, so that they use info of new subscribers (or to force fully register of new subscribers)?

[jaiglesias-optare]

Additional info:

• The core log shows no differences compared to the case where the SIM was not previously registered (at least at the INFO debug level) => it seems that the registration is not being performed correctly.

• The SIM registered through the webui appears to be correctly registered in the MongoDB database, although it has a couple of differences compared to the behavior in the baremetal installation ("imeisv" and "security.sqn" fields). In any case, we have tried dumping the database from the baremetal installation and restoring it in the Dockerized installation, without observing any change in behavior. I have also used open5gs-dbctl tool to register the UE, but it does not change anything.

• I am using USRP B210 for the RAN, and a QUECTEL RM520N-GL modem with Sysmocom sims for the UE. However, using UE and gnb from UERANSIM it works ok!

[jaiglesias-optare]

Fixed!. The problem was that udm.hnet config was not set in config file (open5gs-5gc-yml). It is solved adding the following lines:

 udm:
+  hnet:
+    - id: 1
+      scheme: 1
+      key: /open5gs/install/etc/open5gs/hnet/curve25519-1.key
+    - id: 2
+      scheme: 2
+      key: /open5gs/install/etc/open5gs/hnet/secp256r1-2.key
+    - id: 3
+      scheme: 1
+      key: /open5gs/install/etc/open5gs/hnet/curve25519-3.key
+    - id: 4
+      scheme: 2
+      key: /open5gs/install/etc/open5gs/hnet/secp256r1-4.key
+    - id: 5
+      scheme: 1
+      key: /open5gs/install/etc/open5gs/hnet/curve25519-5.key
+    - id: 6
+      scheme: 2
+      key: /open5gs/install/etc/open5gs/hnet/secp256r1-6.key
   sbi:
     server:
       - address: 127.0.0.12