Merge remote-tracking branch 'origin/bugfix-nas-security-msg-type' into integration_2025_w27 (!3494)

bugfix: read msg_type only after deciphering

There was a problem with accessing msg_type from the input buffer before
deciphering, giving obviously wrong value.

CI team: we should add a test in the CI with NAS ciphering + integrity
(connection to the core) set to not null (I suggest nea2/nia2). With
openair's core, this is done by setting this in the amf config file
(nia1 and nea2 at the top of the list):

    supported_integrity_algorithms:
      - "NIA2"
      - "NIA1"
      - "NIA0"
    supported_encryption_algorithms:
      - "NEA2"
      - "NEA1"
      - "NEA0"

And also put full security in the AS. This is done with this in the gnb
config file:

    security = {
      ciphering_algorithms = ( "nea2", "nea0" );
      integrity_algorithms = ( "nia2", "nia1", "nia0" );
      drb_ciphering = "yes";
      drb_integrity = "yes"
    };

Ideally we should test this with both openair UE and cots UE. But as a
strict minimum do for openair UE (this is where the bug was).

No need to do much traffic, a few ping is enough. But if you want to
check throughput with full security, why not.

ci-scripts/ci_infra.yaml

@@ -65,9 +65,9 @@ oc-cn5g:
   Host: avra
   NetworkScript: echo "inet 172.21.6.102"
   RunIperf3Server: False
-  Deploy: "! scripts/oc-cn5g-deploy.sh /opt/oai-cn5g-fed-develop-2025-jan oaicicd-core-for-ci-ran"
-  Undeploy: "! scripts/oc-cn5g-undeploy.sh /opt/oai-cn5g-fed-develop-2025-jan oaicicd-core-for-ci-ran"
-  LogCollect: "! scripts/oc-cn5g-logcollect.sh /opt/oai-cn5g-fed-develop-2025-jan oaicicd-core-for-ci-ran %%log_dir%%"
+  Deploy: "! scripts/oc-cn5g-deploy.sh /opt/oai-cn5g-fed-develop-2025-jun oaicicd-core-for-ci-ran"
+  Undeploy: "! scripts/oc-cn5g-undeploy.sh /opt/oai-cn5g-fed-develop-2025-jun oaicicd-core-for-ci-ran"
+  LogCollect: "! scripts/oc-cn5g-logcollect.sh /opt/oai-cn5g-fed-develop-2025-jun oaicicd-core-for-ci-ran %%log_dir%%"
 
 oc-cn5g-20897:
   Host: cacofonix
@@ -89,8 +89,8 @@ matix-cn5g:
   Host: matix
   NetworkScript: docker exec prod-trf-gen ip a show dev eth0
   RunIperf3Server: False
-  Deploy: "cd /opt/oai-cn5g-fed-v2/docker-compose && python3 ./core-network.py --type start-basic"
-  Undeploy: "cd /opt/oai-cn5g-fed-v2/docker-compose && python3 ./core-network.py --type stop-basic"
+  Deploy: "cd /opt/oai-cn5g-fed-v2-jun-2025/docker-compose && python3 ./core-network.py --type start-basic"
+  Undeploy: "cd /opt/oai-cn5g-fed-v2-jun-2025/docker-compose && python3 ./core-network.py --type stop-basic"
   LogCollect:
     - "docker logs oai-smf > %%log_dir%%/oai-smf.log"
     - "docker logs oai-amf > %%log_dir%%/oai-amf.log"

ci-scripts/conf_files/gnb.sa.band77.273prb.usrpn310.2x2.conf

@@ -213,7 +213,7 @@ security = {
   # preferred ciphering algorithms
   # the first one of the list that an UE supports in chosen
   # valid values: nea0, nea1, nea2, nea3
-  ciphering_algorithms = ( "nea0" );
+  ciphering_algorithms = ( "nea2", "nea0" );
 
   # preferred integrity algorithms
   # the first one of the list that an UE supports in chosen
@@ -223,7 +223,7 @@ security = {
   # setting 'drb_ciphering' to "no" disables ciphering for DRBs, no matter
   # what 'ciphering_algorithms' configures; same thing for 'drb_integrity'
   drb_ciphering = "yes";
-  drb_integrity = "no";
+  drb_integrity = "yes";
 };
 
 log_config :

ci-scripts/conf_files/gnb.sa.band78.106prb.n310.7ds2u.conf

@@ -212,7 +212,7 @@ security = {
   # preferred ciphering algorithms
   # the first one of the list that an UE supports in chosen
   # valid values: nea0, nea1, nea2, nea3
-  ciphering_algorithms = ( "nea0" );
+  ciphering_algorithms = ( "nea2", "nea0" );
 
   # preferred integrity algorithms
   # the first one of the list that an UE supports in chosen
@@ -222,7 +222,7 @@ security = {
   # setting 'drb_ciphering' to "no" disables ciphering for DRBs, no matter
   # what 'ciphering_algorithms' configures; same thing for 'drb_integrity'
   drb_ciphering = "yes";
-  drb_integrity = "no";
+  drb_integrity = "yes";
 };
 
 log_config :