maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bugfix in nas_security_rx_process: process first the security type and then the header length

Browse Source 
This commit restores the behaviour before the changes introduced in 611c0554. The NAS
Deregistration Accept message is unprotected, therefore the function will return
NAS_SECURITY_UNPROTECTED that would then be considered as NAS_SECURITY_INTEGRITY_PASSED

Unprotected message have a plain header of 3 octets, however security protected messages
have a 7 octets header.
This commit is contained in:
Guido Casati
2025-05-26 17:05:00 +02:00
parent f7a04de762
commit 4129619714
1 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openair3/NAS/NR_UE/nr_nas_msg.c
+14 -4
View File
@@ -133,11 +133,15 @@ static security_state_t nas_security_rx_process(nr_ue_nas_t *nas, uint8_t *pdu_b
{
if (nas->security_container == NULL)
return NAS_SECURITY_NO_SECURITY_CONTEXT;
/* header is 7 bytes, require at least one byte of payload */
if (pdu_length < 8)
return NAS_SECURITY_BAD_INPUT;
switch (pdu_buffer[1]) {
if (pdu_length < sizeof(fgmm_msg_header_t)) {
LOG_E(NAS, "Invalid buffer length = %d: must hold at least a plain 5GMM header\n", pdu_length);
return NAS_SECURITY_BAD_INPUT;
}
int security_type = pdu_buffer[1];
LOG_D(NAS, "Security type is: %s\n", print_info(security_type, security_header_type_s, sizeofArray(security_header_type_s)));
switch (security_type) {
case PLAIN_5GS_MSG:
return NAS_SECURITY_UNPROTECTED;
break;
@@ -154,6 +158,12 @@ static security_state_t nas_security_rx_process(nr_ue_nas_t *nas, uint8_t *pdu_b
break;
}
/* header is 7 bytes, require at least one byte of payload */
if (pdu_length < 8) {
LOG_E(NAS, "Invalid buffer length = %d\n", pdu_length);
return NAS_SECURITY_BAD_INPUT;
}
/* synchronize NAS SQN, based on 24.501 4.4.3.1 */
// Sequence number
int nas_sqn = pdu_buffer[6];