Notify security keys change to CUUP during re-establishment

During re-establishment, new KgNB* is derived, requiring new UP keys (KUPint,
KUPenc) to be sent to CU-UP. When do_drb_integrity = true, CU-UP needs the
updated integrity keys to verify DRB PDUs. Without this update, CU-UP uses
old keys while the UE uses new keys, causing integrity failures.

The fix ensures security info is always sent during re-establishment,
which is critical for DRB integrity.
This commit is contained in:
Guido Casati
2025-11-19 11:36:39 +01:00
parent 92980ceb72
commit 6512a7a9ca
+2 -7
View File
@@ -1063,15 +1063,10 @@ static void cuup_notify_reestablishment(gNB_RRC_INST *rrc, gNB_RRC_UE_t *ue_p)
}
}
#if 0
/* According to current understanding of E1 specifications, it is not needed
* to send security information because this does not change.
* But let's keep the code here in case it's needed.
*/
// Always send security information
/* During reestablishment, for DRB integrity protection security keys change (KgNB* is derived),
* so security information MUST be sent to CU-UP to update DRB security keys. */
req.secInfo = malloc_or_fail(sizeof(*req.secInfo));
fill_security_info(rrc, ue_p, req.secInfo);
#endif
/* Send E1 Bearer Context Modification Request (3GPP TS 38.463) */
sctp_assoc_t assoc_id = get_existing_cuup_for_ue(rrc, ue_p);