From 4129619714371aecaf60723eaa243600dae5bad8 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Tue, 29 Apr 2025 15:57:16 +0200 Subject: [PATCH] Bugfix in nas_security_rx_process: process first the security type and then the header length This commit restores the behaviour before the changes introduced in 611c0554. The NAS Deregistration Accept message is unprotected, therefore the function will return NAS_SECURITY_UNPROTECTED that would then be considered as NAS_SECURITY_INTEGRITY_PASSED Unprotected message have a plain header of 3 octets, however security protected messages have a 7 octets header. --- openair3/NAS/NR_UE/nr_nas_msg.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/openair3/NAS/NR_UE/nr_nas_msg.c b/openair3/NAS/NR_UE/nr_nas_msg.c index b1378c3360..37ed60edaf 100644 --- a/openair3/NAS/NR_UE/nr_nas_msg.c +++ b/openair3/NAS/NR_UE/nr_nas_msg.c @@ -133,11 +133,15 @@ static security_state_t nas_security_rx_process(nr_ue_nas_t *nas, uint8_t *pdu_b { if (nas->security_container == NULL) return NAS_SECURITY_NO_SECURITY_CONTEXT; - /* header is 7 bytes, require at least one byte of payload */ - if (pdu_length < 8) - return NAS_SECURITY_BAD_INPUT; - switch (pdu_buffer[1]) { + if (pdu_length < sizeof(fgmm_msg_header_t)) { + LOG_E(NAS, "Invalid buffer length = %d: must hold at least a plain 5GMM header\n", pdu_length); + return NAS_SECURITY_BAD_INPUT; + } + int security_type = pdu_buffer[1]; + LOG_D(NAS, "Security type is: %s\n", print_info(security_type, security_header_type_s, sizeofArray(security_header_type_s))); + + switch (security_type) { case PLAIN_5GS_MSG: return NAS_SECURITY_UNPROTECTED; break; @@ -154,6 +158,12 @@ static security_state_t nas_security_rx_process(nr_ue_nas_t *nas, uint8_t *pdu_b break; } + /* header is 7 bytes, require at least one byte of payload */ + if (pdu_length < 8) { + LOG_E(NAS, "Invalid buffer length = %d\n", pdu_length); + return NAS_SECURITY_BAD_INPUT; + } + /* synchronize NAS SQN, based on 24.501 4.4.3.1 */ // Sequence number int nas_sqn = pdu_buffer[6];