Handle NAS Authentication Reject in stack

Handle authentication not accepted by the network. The handler assumes the message
is not integrity protected, processes the received NAS message and logs whether a
EAP-failure is enclosed. The UE enters state: 5GMM-DEREGISTERED.

Not done in this commit: the UE shall performs actions as per 5.4.1.3.5 of
3GPP TS 24.501, including (1) Abort any ongoing 5GMM procedure
(2) Stop all active timers: T3510, T3516, T3517, T3519, T3520, T3521
(3) Delete stored SUCI. (4) handle EAP-failure message.

openair3/NAS/NR_UE/5GS/5GMM/MSG/fgmm_lib.c

@@ -30,7 +30,6 @@
 #define FGS_NAS_CAUSE_LENGTH 1
 #define MIN_EAP_MSG_LEN 7
 #define MIN_EAP_CONTENTS_LEN 4
-#define MAX_EAP_CONTENTS_LEN 1500
 
 /**
  * Encode PDU Session Status and PDU session reactivation result (optional IEs)

openair3/NAS/NR_UE/5GS/5GMM/MSG/fgmm_lib.h

@@ -39,6 +39,7 @@ both PDU Session Status and PDU session Reactivation Result IEs */
 #define MAX_PDU_SESSION_CONTENTS_LEN 32
 #define MAX_NUM_PSI 16
 #define MAX_NUM_PDU_ERRORS 256
+#define MAX_EAP_CONTENTS_LEN 1500
 
 /* This macro updates the local copy of
    a byte_array_t pointer used for enc/dec */

openair3/NAS/NR_UE/nr_nas_msg.c

@@ -70,6 +70,7 @@
 #include "fgs_nas_utils.h"
 #include "fgmm_service_accept.h"
 #include "fgmm_service_reject.h"
+#include "fgmm_authentication_reject.h"
 #include "ds/byte_array.h"
 #include "key_nas_deriver.h"
 
@@ -1062,6 +1063,33 @@ static void handle_fgmm_authentication_request(nr_ue_nas_t *nas, as_nas_info_t *
   generateAuthenticationResp(nas, initialNasMsg, buffer->buf);
 }
 
+/** @brief Handle authentication not accepted by the network
+ * This function assumes the message is not integrity protected, processes the received
+ * NAS message and logs whether a EAP-failure is enclosed. The UE enters state: 5GMM-DEREGISTERED.
+ * @todo The UE shall performs actions as per 5.4.1.3.5 of 3GPP TS 24.501, including
+ * (1) Abort any ongoing 5GMM procedure (2) Stop all active timers: T3510, T3516, T3517,
+ * T3519, T3520, T3521 (3) Delete stored SUCI. (4) handle EAP-failure message. */
+static void handle_authentication_reject(nr_ue_nas_t *nas, as_nas_info_t *initialNasMsg, uint8_t *pdu, int pdu_length)
+{
+  LOG_E(NAS, "Received Authentication Reject message from the network\n");
+  uint8_t eap_msg[MAX_EAP_CONTENTS_LEN] = {0};
+  fgmm_auth_reject_msg_t msg = {.eap_msg.buf = eap_msg};
+
+  byte_array_t ba = {.buf = pdu + 3 /* skip header */, .len = pdu_length};
+  if (decode_fgmm_auth_reject(&msg, &ba) < 0) {
+    LOG_E(NAS, "Could not decode Authentication Reject\n");
+    return;
+  }
+
+  if (msg.eap_msg.len > 0) {
+    /** @todo UE handling EAP-failure message (5.4.1.2.2.11 of 3GPP TS 24.501) */
+    LOG_W(NAS, "NAS Authentication Reject contains an EAP message: handling is not implemented\n");
+    log_hex_buffer("EAP-Failure", msg.eap_msg.buf, msg.eap_msg.len);
+  }
+
+  nas->fiveGMM_state = FGS_DEREGISTERED;
+}
+
 int nas_itti_kgnb_refresh_req(instance_t instance, const uint8_t kgnb[32])
 {
   MessageDef *message_p;
@@ -2059,6 +2087,9 @@ void *nas_nrue(void *args_p)
           case FGS_AUTHENTICATION_REQUEST:
             handle_fgmm_authentication_request(nas, &initialNasMsg, &buffer);
             break;
+          case FGS_AUTHENTICATION_REJECT:
+            handle_authentication_reject(nas, &initialNasMsg, pdu_buffer, pdu_length);
+            break;
           case FGS_SECURITY_MODE_COMMAND:
             handle_security_mode_command(nas, &initialNasMsg, pdu_buffer, pdu_length);
             break;

openair3/SECU/key_nas_deriver.c

@@ -57,7 +57,7 @@
 #define NR_FC_ALG_KEY_DER (0x69)
 #define NR_FC_ALG_KEY_NG_RAN_STAR_DER (0x70)
 
-static void log_hex_buffer(const char *label, const uint8_t *buf, const int len)
+void log_hex_buffer(const char *label, const uint8_t *buf, const int len)
 {
   char hex_str[len * 2 + 1];
   for (int i = 0; i < len; i++) {

openair3/SECU/key_nas_deriver.h

@@ -36,4 +36,6 @@ void nr_derive_key_ng_ran_star(uint16_t pci, uint64_t nr_arfcn_dl, const uint8_t
 
 void nr_derive_nh(const uint8_t k_amf[SECURITY_KEY_LEN], const uint8_t *sync_input, uint8_t *nh);
 
+void log_hex_buffer(const char *label, const uint8_t *buf, const int len);
+
 #endif