From 9072101a1a9c802de3334aa4e020417b6849b9ae Mon Sep 17 00:00:00 2001 From: Robert Schmidt Date: Wed, 15 Apr 2020 21:25:42 +0200 Subject: [PATCH] Correctly decode IMSI also when not integrity protected --- openair2/RRC/LTE/rrc_eNB_S1AP.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/openair2/RRC/LTE/rrc_eNB_S1AP.c b/openair2/RRC/LTE/rrc_eNB_S1AP.c index 27a442ed05..9f92be366b 100644 --- a/openair2/RRC/LTE/rrc_eNB_S1AP.c +++ b/openair2/RRC/LTE/rrc_eNB_S1AP.c @@ -96,36 +96,34 @@ void extract_imsi(uint8_t *pdu_buf, uint32_t pdu_len, rrc_eNB_ue_context_t *ue_c && pdu_len > NAS_MESSAGE_SECURITY_HEADER_SIZE)) return; + /* Decode plain NAS message */ + EMM_msg *e_msg = &nas_msg.plain.emm; + emm_msg_header_t *emm_header = &e_msg->header; + if (header->security_header_type != SECURITY_HEADER_TYPE_NOT_PROTECTED) { /* Decode the message authentication code */ DECODE_U32((char *) pdu_buf+size, header->message_authentication_code, size); /* Decode the sequence number */ DECODE_U8((char *) pdu_buf+size, header->sequence_number, size); - } + /* Decode the security header type and the protocol discriminator */ + DECODE_U8(pdu_buf + size, *(uint8_t *)(emm_header), size); - /* Note: the value of the pointer (i.e. the address) is given by value, so we - * can modify it as we want. The callee retains the original address! */ + /* Check that this is the right message */ + if (emm_header->protocol_discriminator != EPS_MOBILITY_MANAGEMENT_MESSAGE) + return; + } pdu_buf += size; pdu_len -= size; - /* Decode plain NAS message */ - EMM_msg *e_msg = &nas_msg.plain.emm; - emm_msg_header_t *emm_header = &e_msg->header; - /* First decode the EMM message header */ - int e_head_size = 0; /* Check that buffer contains more than only the header */ if (pdu_len <= sizeof(emm_msg_header_t)) return; - /* Decode the security header type and the protocol discriminator */ - DECODE_U8(pdu_buf + e_head_size, *(uint8_t *)(emm_header), e_head_size); + /* First decode the EMM message header */ + int e_head_size = 0; /* Decode the message type */ DECODE_U8(pdu_buf + e_head_size, emm_header->message_type, e_head_size); - /* Check that this is the right message */ - if (emm_header->protocol_discriminator != EPS_MOBILITY_MANAGEMENT_MESSAGE) - return; - pdu_buf += e_head_size; pdu_len -= e_head_size;