From 20653cd31b3c9e27c7af664ffd1eef14fdc504ae Mon Sep 17 00:00:00 2001 From: matzakos Date: Tue, 27 Apr 2021 13:26:06 +0200 Subject: [PATCH 1/6] Modify configuration of NGAP and NAS messages to comply with OAI CN configuration according to Fujitsu patch -Hardcodings to be removed later when the NAS extensions will be integrated for OAI UE --- openair3/NAS/NR_UE/nr_nas_msg_sim.c | 34 ++++++++++++++++++----------- openair3/NGAP/ngap_common.h | 1 - openair3/NGAP/ngap_gNB_handlers.c | 34 +++++++++++++++++++++++------ 3 files changed, 48 insertions(+), 21 deletions(-) diff --git a/openair3/NAS/NR_UE/nr_nas_msg_sim.c b/openair3/NAS/NR_UE/nr_nas_msg_sim.c index 008ecc8e36..d862091776 100644 --- a/openair3/NAS/NR_UE/nr_nas_msg_sim.c +++ b/openair3/NAS/NR_UE/nr_nas_msg_sim.c @@ -40,12 +40,20 @@ #include "PduSessionEstablishRequest.h" # include "intertask_interface.h" -char netName[] = "5G:mnc093.mcc208.3gppnetwork.org"; +/*char netName[] = "5G:mnc093.mcc208.3gppnetwork.org"; char imsi[] = "2089300007487"; // USIM_API_K: 5122250214c33e723a5dd523fc145fc0 uint8_t k[16] = {0x51, 0x22, 0x25, 0x02, 0x14,0xc3, 0x3e, 0x72, 0x3a, 0x5d, 0xd5, 0x23, 0xfc, 0x14, 0x5f, 0xc0}; // OPC: 981d464c7c52eb6e5036234984ad0bcf -const uint8_t opc[16] = {0x98, 0x1d, 0x46, 0x4c,0x7c,0x52,0xeb, 0x6e, 0x50, 0x36, 0x23, 0x49, 0x84, 0xad, 0x0b, 0xcf}; +const uint8_t opc[16] = {0x98, 0x1d, 0x46, 0x4c,0x7c,0x52,0xeb, 0x6e, 0x50, 0x36, 0x23, 0x49, 0x84, 0xad, 0x0b, 0xcf};*/ + + +char netName[] = "5G:mnc099.mcc208.3gppnetwork.org"; +char imsi[] = "2089900007487"; //"208990100001100"; +// USIM_API_K: fe c8 6b a6 eb 70 7e d0 89 05 75 7b 1b b4 4b 8f +uint8_t k[16] = {0xfe, 0xc8, 0x6b, 0xa6, 0xeb, 0x70, 0x7e, 0xd0, 0x89, 0x05, 0x75, 0x7b, 0x1b, 0xb4, 0x4b, 0x8f}; +// OPC: c4 24 49 36 3b ba d0 2b 66 d1 6b c9 75 d7 7c c1 +const uint8_t opc[16] = {0xc4, 0x24, 0x49, 0x36, 0x3b, 0xba, 0xd0, 0x2b, 0x66, 0xd1, 0x6b, 0xc9, 0x75, 0xd7, 0x7c, 0xc1}; uint8_t *registration_request_buf; uint32_t registration_request_len; @@ -275,14 +283,14 @@ void generateRegistrationRequest(as_nas_info_t *initialNasMsg) { mm_msg->registration_request.fgsregistrationtype = INITIAL_REGISTRATION; mm_msg->registration_request.naskeysetidentifier.naskeysetidentifier = 1; size += 1; - if(1){ + if(0){ mm_msg->registration_request.fgsmobileidentity.guti.typeofidentity = FGS_MOBILE_IDENTITY_5G_GUTI; mm_msg->registration_request.fgsmobileidentity.guti.amfregionid = 0xca; mm_msg->registration_request.fgsmobileidentity.guti.amfpointer = 0; mm_msg->registration_request.fgsmobileidentity.guti.amfsetid = 1016; mm_msg->registration_request.fgsmobileidentity.guti.tmsi = 10; mm_msg->registration_request.fgsmobileidentity.guti.mncdigit1 = 9; - mm_msg->registration_request.fgsmobileidentity.guti.mncdigit2 = 3; + mm_msg->registration_request.fgsmobileidentity.guti.mncdigit2 = 9; mm_msg->registration_request.fgsmobileidentity.guti.mncdigit3 = 0xf; mm_msg->registration_request.fgsmobileidentity.guti.mccdigit1 = 2; mm_msg->registration_request.fgsmobileidentity.guti.mccdigit2 = 0; @@ -293,7 +301,7 @@ void generateRegistrationRequest(as_nas_info_t *initialNasMsg) { } else { mm_msg->registration_request.fgsmobileidentity.suci.typeofidentity = FGS_MOBILE_IDENTITY_SUCI; mm_msg->registration_request.fgsmobileidentity.suci.mncdigit1 = 9; - mm_msg->registration_request.fgsmobileidentity.suci.mncdigit2 = 3; + mm_msg->registration_request.fgsmobileidentity.suci.mncdigit2 = 9; mm_msg->registration_request.fgsmobileidentity.suci.mncdigit3 = 0xf; mm_msg->registration_request.fgsmobileidentity.suci.mccdigit1 = 2; mm_msg->registration_request.fgsmobileidentity.suci.mccdigit2 = 0; @@ -350,7 +358,7 @@ void generateIdentityResponse(as_nas_info_t *initialNasMsg, uint8_t identitytype if(identitytype == FGS_MOBILE_IDENTITY_SUCI){ mm_msg->fgs_identity_response.fgsmobileidentity.suci.typeofidentity = FGS_MOBILE_IDENTITY_SUCI; mm_msg->fgs_identity_response.fgsmobileidentity.suci.mncdigit1 = 9; - mm_msg->fgs_identity_response.fgsmobileidentity.suci.mncdigit2 = 3; + mm_msg->fgs_identity_response.fgsmobileidentity.suci.mncdigit2 = 9; mm_msg->fgs_identity_response.fgsmobileidentity.suci.mncdigit3 = 0xf; mm_msg->fgs_identity_response.fgsmobileidentity.suci.mccdigit1 = 2; mm_msg->fgs_identity_response.fgsmobileidentity.suci.mccdigit2 = 0; @@ -614,14 +622,15 @@ void generatePduSessionEstablishRequest(as_nas_info_t *initialNasMsg){ memset(&nas_msg, 0, sizeof(fgs_nas_message_t)); // setup pdu session establishment request - uint16_t req_length = 6; + uint16_t req_length = 7; uint8_t *req_buffer = malloc(req_length); pdu_session_establishment_request_msg pdu_session_establish; pdu_session_establish.protocoldiscriminator = FGS_SESSION_MANAGEMENT_MESSAGE; pdu_session_establish.pdusessionid = 10; - pdu_session_establish.pti = 0; + pdu_session_establish.pti = 1; pdu_session_establish.pdusessionestblishmsgtype = FGS_PDU_SESSION_ESTABLISHMENT_REQ; pdu_session_establish.maxdatarate = 0xffff; + pdu_session_establish.pdusessiontype = 0x91; encode_pdu_session_establishment_request(&pdu_session_establish, req_buffer); @@ -629,9 +638,8 @@ void generatePduSessionEstablishRequest(as_nas_info_t *initialNasMsg){ MM_msg *mm_msg; nas_stream_cipher_t stream_cipher; uint8_t mac[4]; - uint8_t nssai[]={1,1,2,3}; - uint8_t dnn[9]={0x8,0x69,0x6e,0x74,0x65,0x72,0x6e,0x65,0x74}; - // set security protected header + uint8_t nssai[]={1,0,0,1}; //Corresponding to SST:1, SD:1 + uint8_t dnn[4]={0x4,0x6f,0x61,0x69}; //Corresponding to dnn:"oai" nas_msg.header.protocol_discriminator = FGS_MOBILITY_MANAGEMENT_MESSAGE; nas_msg.header.security_header_type = INTEGRITY_PROTECTED_AND_CIPHERED_WITH_NEW_SECU_CTX; size += 7; @@ -663,9 +671,9 @@ void generatePduSessionEstablishRequest(as_nas_info_t *initialNasMsg){ mm_msg->uplink_nas_transport.snssai.length = 4; mm_msg->uplink_nas_transport.snssai.value = nssai; size += (1+1+4); - mm_msg->uplink_nas_transport.dnn.length = 9; + mm_msg->uplink_nas_transport.dnn.length = 4; mm_msg->uplink_nas_transport.dnn.value = dnn; - size += (1+1+9); + size += (1+1+4); // encode the message initialNasMsg->data = (Byte_t *)malloc(size * sizeof(Byte_t)); diff --git a/openair3/NGAP/ngap_common.h b/openair3/NGAP/ngap_common.h index f0302a88c7..6803adb0dd 100644 --- a/openair3/NGAP/ngap_common.h +++ b/openair3/NGAP/ngap_common.h @@ -144,7 +144,6 @@ extern int asn1_xer_print; if (ie == NULL ) { \ NGAP_ERROR("NGAP_FIND_PROTOCOLIE_BY_ID: %s %d: ie is NULL\n",__FILE__,__LINE__);\ } \ - if (mandatory) DevAssert(ie != NULL); \ } while(0) /** \brief Function callback prototype. **/ diff --git a/openair3/NGAP/ngap_gNB_handlers.c b/openair3/NGAP/ngap_gNB_handlers.c index f143002537..e398f8fa3e 100644 --- a/openair3/NGAP/ngap_gNB_handlers.c +++ b/openair3/NGAP/ngap_gNB_handlers.c @@ -1061,12 +1061,31 @@ int ngap_gNB_handle_initial_context_request(uint32_t assoc_id, NGAP_FIND_PROTOCOLIE_BY_ID(NGAP_InitialContextSetupRequestIEs_t, ie, container, NGAP_ProtocolIE_ID_id_AllowedNSSAI, true); - if (ie != NULL) { /* checked by macro but cppcheck doesn't see it */ + //if (ie != NULL) { /* checked by macro but cppcheck doesn't see it */ NGAP_AllowedNSSAI_Item_t *allow_nssai_item_p = NULL; - NGAP_DEBUG("AllowedNSSAI.list.count %d\n", ie->value.choice.AllowedNSSAI.list.count); - DevAssert(ie->value.choice.AllowedNSSAI.list.count > 0); - DevAssert(ie->value.choice.AllowedNSSAI.list.count <= NGAP_maxnoofAllowedS_NSSAIs); + NGAP_WARN("AllowedNSSAI.list.count %d\n", ie != NULL ? ie->value.choice.AllowedNSSAI.list.count : 2); + //NGAP_DEBUG("AllowedNSSAI.list.count %d\n", ie->value.choice.AllowedNSSAI.list.count); + //DevAssert(ie->value.choice.AllowedNSSAI.list.count > 0); + //DevAssert(ie->value.choice.AllowedNSSAI.list.count <= NGAP_maxnoofAllowedS_NSSAIs); + + if (ie == NULL) { + NGAP_INITIAL_CONTEXT_SETUP_REQ(message_p).nb_allowed_nssais = 2; + + NGAP_INITIAL_CONTEXT_SETUP_REQ(message_p).allowed_nssai[0].sST = 01; + + NGAP_INITIAL_CONTEXT_SETUP_REQ(message_p).allowed_nssai[0].sD_flag = 1; + NGAP_INITIAL_CONTEXT_SETUP_REQ(message_p).allowed_nssai[0].sD[0] = 01; + NGAP_INITIAL_CONTEXT_SETUP_REQ(message_p).allowed_nssai[0].sD[1] = 02; + NGAP_INITIAL_CONTEXT_SETUP_REQ(message_p).allowed_nssai[0].sD[2] = 03; + + NGAP_INITIAL_CONTEXT_SETUP_REQ(message_p).allowed_nssai[1].sST = 01; + + NGAP_INITIAL_CONTEXT_SETUP_REQ(message_p).allowed_nssai[1].sD_flag = 1; + NGAP_INITIAL_CONTEXT_SETUP_REQ(message_p).allowed_nssai[1].sD[0] = 00;//11; + NGAP_INITIAL_CONTEXT_SETUP_REQ(message_p).allowed_nssai[1].sD[1] = 00;//22; + NGAP_INITIAL_CONTEXT_SETUP_REQ(message_p).allowed_nssai[1].sD[2] = 01;//33; + } else { NGAP_INITIAL_CONTEXT_SETUP_REQ(message_p).nb_allowed_nssais = ie->value.choice.AllowedNSSAI.list.count; @@ -1082,9 +1101,10 @@ int ngap_gNB_handle_initial_context_request(uint32_t assoc_id, NGAP_INITIAL_CONTEXT_SETUP_REQ(message_p).allowed_nssai[i].sD[2] = allow_nssai_item_p->s_NSSAI.sD->buf[2]; } } - } else {/* ie != NULL */ - return -1; - } + } + //} else {/* ie != NULL */ + // return -1; + //} /* id-UESecurityCapabilities */ NGAP_FIND_PROTOCOLIE_BY_ID(NGAP_InitialContextSetupRequestIEs_t, ie, container, From ee3b913864a0b8c121eb3aaadc65338f77a1fc77 Mon Sep 17 00:00:00 2001 From: matzakos Date: Tue, 27 Apr 2021 13:28:03 +0200 Subject: [PATCH 2/6] Small correction in NGAP UERadioCapabilityInfoIndication message --- openair3/NGAP/ngap_gNB_nas_procedures.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair3/NGAP/ngap_gNB_nas_procedures.c b/openair3/NGAP/ngap_gNB_nas_procedures.c index 3711072682..6b61643588 100644 --- a/openair3/NGAP/ngap_gNB_nas_procedures.c +++ b/openair3/NGAP/ngap_gNB_nas_procedures.c @@ -932,7 +932,7 @@ int ngap_gNB_ue_capabilities(instance_t instance, /* mandatory */ ie = (NGAP_UERadioCapabilityInfoIndicationIEs_t *)calloc(1, sizeof(NGAP_UERadioCapabilityInfoIndicationIEs_t)); ie->id = NGAP_ProtocolIE_ID_id_UERadioCapability; - ie->criticality = NGAP_Criticality_reject; + ie->criticality = NGAP_Criticality_ignore; ie->value.present = NGAP_UERadioCapabilityInfoIndicationIEs__value_PR_UERadioCapability; ie->value.choice.UERadioCapability.buf = ue_cap_info_ind_p->ue_radio_cap.buffer; ie->value.choice.UERadioCapability.size = ue_cap_info_ind_p->ue_radio_cap.length; From 9f0c10617a8e254e63552203a41a08994a97e623 Mon Sep 17 00:00:00 2001 From: matzakos Date: Tue, 27 Apr 2021 13:28:59 +0200 Subject: [PATCH 3/6] Include rlc bearer configuration list for the configuration of RLC and PDCP RBs --- openair2/RRC/NR/rrc_gNB.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/openair2/RRC/NR/rrc_gNB.c b/openair2/RRC/NR/rrc_gNB.c index f360e966b2..b0ece1f374 100755 --- a/openair2/RRC/NR/rrc_gNB.c +++ b/openair2/RRC/NR/rrc_gNB.c @@ -1042,14 +1042,14 @@ rrc_gNB_process_RRCReconfigurationComplete( SRB_configList, // NULL, DRB_configList, DRB_Release_configList2, - 0xff, // already configured during the securitymodecommand + 0, // already configured during the securitymodecommand kRRCenc, kRRCint, kUPenc, NULL, NULL, NULL, - NULL); + ue_context_pP->ue_context.masterCellGroup->rlc_BearerToAddModList); /* Refresh SRBs/DRBs */ if (!NODE_IS_CU(RC.nrrrc[ctxt_pP->module_id]->node_type)) { nr_rrc_rlc_config_asn1_req(ctxt_pP, @@ -1057,7 +1057,7 @@ rrc_gNB_process_RRCReconfigurationComplete( DRB_configList, DRB_Release_configList2, NULL, - NULL, + ue_context_pP->ue_context.masterCellGroup->rlc_BearerToAddModList, NULL); } #endif From 52f8506b5c3d58a28567d365d62c3daa4d80c919 Mon Sep 17 00:00:00 2001 From: matzakos Date: Tue, 27 Apr 2021 13:30:02 +0200 Subject: [PATCH 4/6] Include PDU session type field in PDU Session Establishment Request NAS message --- openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishRequest.c | 2 ++ openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishRequest.h | 1 + 2 files changed, 3 insertions(+) diff --git a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishRequest.c b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishRequest.c index bc4d34d650..1c9198b720 100644 --- a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishRequest.c +++ b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishRequest.c @@ -54,6 +54,8 @@ int encode_pdu_session_establishment_request(pdu_session_establishment_request_m encoded++; IES_ENCODE_U16(buffer, encoded, pdusessionestablishrequest->maxdatarate); + *(buffer + encoded) = pdusessionestablishrequest->pdusessiontype; + encoded++; return encoded; } diff --git a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishRequest.h b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishRequest.h index ac5b250f66..e2742ebc38 100644 --- a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishRequest.h +++ b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishRequest.h @@ -53,6 +53,7 @@ typedef struct pdu_session_establishment_request_msg_tag { uint8_t pti; MessageType pdusessionestblishmsgtype; uint16_t maxdatarate; + uint8_t pdusessiontype; /* Optional fields */ } pdu_session_establishment_request_msg; From 19ba8dd7a90e2aefe7967e88649629b264bc3566 Mon Sep 17 00:00:00 2001 From: matzakos Date: Tue, 27 Apr 2021 13:31:41 +0200 Subject: [PATCH 5/6] Call the right function for the initiation of gtp-u task at gNB --- executables/nr-softmodem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/executables/nr-softmodem.c b/executables/nr-softmodem.c index 52d7648f5e..f99f6fd869 100644 --- a/executables/nr-softmodem.c +++ b/executables/nr-softmodem.c @@ -364,7 +364,7 @@ int create_gNB_tasks(uint32_t gnb_nb) { } } - if (itti_create_task (TASK_GTPV1_U, >pv1u_gNB_task, NULL) < 0) { + if (itti_create_task (TASK_GTPV1_U, &nr_gtpv1u_gNB_task, NULL) < 0) { LOG_E(GTPU, "Create task for GTPV1U failed\n"); return -1; } From 3633bcd36727551f8ed364a28fa6251df2426160 Mon Sep 17 00:00:00 2001 From: Cedric Roux Date: Tue, 27 Apr 2021 14:44:24 +0200 Subject: [PATCH 6/6] nr pdcp: bugfixes - use bearer-1 in compute_t of integrity NIA2 - compare integrity at the right place in nr_pdcp_entity_recv_pdu - proper handling of security parameters settings (algos, keys) --- openair2/LAYER2/nr_pdcp/nr_pdcp_entity.c | 72 ++++++++++++------- .../LAYER2/nr_pdcp/nr_pdcp_integrity_nia2.c | 2 +- 2 files changed, 46 insertions(+), 28 deletions(-) diff --git a/openair2/LAYER2/nr_pdcp/nr_pdcp_entity.c b/openair2/LAYER2/nr_pdcp/nr_pdcp_entity.c index ac438136ac..99c12b256e 100644 --- a/openair2/LAYER2/nr_pdcp/nr_pdcp_entity.c +++ b/openair2/LAYER2/nr_pdcp/nr_pdcp_entity.c @@ -101,7 +101,7 @@ static void nr_pdcp_entity_recv_pdu(nr_pdcp_entity_t *entity, entity->integrity(entity->integrity_context, integrity, buffer, size - integrity_size, entity->rb_id, rcvd_count, entity->is_gnb ? 0 : 1); - if (memcmp(integrity, buffer, 4) != 0) { + if (memcmp(integrity, buffer + size - integrity_size, 4) != 0) { LOG_E(PDCP, "discard NR PDU, integrity failed\n"); return; } @@ -212,6 +212,7 @@ static void nr_pdcp_entity_recv_sdu(nr_pdcp_entity_t *entity, header_size + size + integrity_size, sdu_id); } +/* may be called several times, take care to clean previous settings */ static void nr_pdcp_entity_set_security(nr_pdcp_entity_t *entity, int integrity_algorithm, char *integrity_key, @@ -226,6 +227,46 @@ static void nr_pdcp_entity_set_security(nr_pdcp_entity_t *entity, memcpy(entity->integrity_key, integrity_key, 16); if (ciphering_key != NULL) memcpy(entity->ciphering_key, ciphering_key, 16); + + if (integrity_algorithm == 0) { + entity->has_integrity = 0; + if (entity->free_integrity != NULL) + entity->free_integrity(entity->integrity_context); + entity->free_integrity = NULL; + } + + if (integrity_algorithm != 0 && integrity_algorithm != -1) { + if (integrity_algorithm != 2) { + LOG_E(PDCP, "FATAL: only nia2 supported for the moment\n"); + exit(1); + } + entity->has_integrity = 1; + if (entity->free_integrity != NULL) + entity->free_integrity(entity->integrity_context); + entity->integrity_context = nr_pdcp_integrity_nia2_init(entity->integrity_key); + entity->integrity = nr_pdcp_integrity_nia2_integrity; + entity->free_integrity = nr_pdcp_integrity_nia2_free_integrity; + } + + if (ciphering_algorithm == 0) { + entity->has_ciphering = 0; + if (entity->free_security != NULL) + entity->free_security(entity->security_context); + entity->free_security = NULL; + } + + if (ciphering_algorithm != 0 && ciphering_algorithm != -1) { + if (ciphering_algorithm != 2) { + LOG_E(PDCP, "FATAL: only nea2 supported for the moment\n"); + exit(1); + } + entity->has_ciphering = 1; + if (entity->free_security != NULL) + entity->free_security(entity->security_context); + entity->security_context = nr_pdcp_security_nea2_init(entity->ciphering_key); + entity->cipher = nr_pdcp_security_nea2_cipher; + entity->free_security = nr_pdcp_security_nea2_free_security; + } } static void check_t_reordering(nr_pdcp_entity_t *entity) @@ -339,34 +380,11 @@ nr_pdcp_entity_t *new_nr_pdcp_entity( ret->sn_max = (1 << sn_size) - 1; ret->window_size = 1 << (sn_size - 1); - if (ciphering_key != NULL && ciphering_algorithm != 0) { - if (ciphering_algorithm != 2) { - LOG_E(PDCP, "FATAL: only nea2 supported for the moment\n"); - exit(1); - } - ret->has_ciphering = 1; - ret->ciphering_algorithm = ciphering_algorithm; - memcpy(ret->ciphering_key, ciphering_key, 16); - - ret->security_context = nr_pdcp_security_nea2_init(ciphering_key); - ret->cipher = nr_pdcp_security_nea2_cipher; - ret->free_security = nr_pdcp_security_nea2_free_security; - } ret->is_gnb = is_gnb; - if (integrity_key != NULL && integrity_algorithm != 0) { - if (integrity_algorithm != 2) { - LOG_E(PDCP, "FATAL: only nia2 supported for the moment\n"); - exit(1); - } - ret->has_integrity = 1; - ret->integrity_algorithm = integrity_algorithm; - memcpy(ret->integrity_key, integrity_key, 16); - - ret->integrity_context = nr_pdcp_integrity_nia2_init(integrity_key); - ret->integrity = nr_pdcp_integrity_nia2_integrity; - ret->free_integrity = nr_pdcp_integrity_nia2_free_integrity; - } + nr_pdcp_entity_set_security(ret, + integrity_algorithm, (char *)integrity_key, + ciphering_algorithm, (char *)ciphering_key); return ret; } diff --git a/openair2/LAYER2/nr_pdcp/nr_pdcp_integrity_nia2.c b/openair2/LAYER2/nr_pdcp/nr_pdcp_integrity_nia2.c index 5553662ac5..b2bb0662d6 100644 --- a/openair2/LAYER2/nr_pdcp/nr_pdcp_integrity_nia2.c +++ b/openair2/LAYER2/nr_pdcp/nr_pdcp_integrity_nia2.c @@ -45,7 +45,7 @@ static void compute_t(unsigned char *t, uint32_t count, int bearer, t[1] = (count >> 16) & 255; t[2] = (count >> 8) & 255; t[3] = (count ) & 255; - t[4] = (bearer << 3) | (direction << 2); + t[4] = ((bearer-1) << 3) | (direction << 2); memset(&t[5], 0, 8-5); }