From 05567b59f17e650d372c6e4c973d02f51a9e2ffa Mon Sep 17 00:00:00 2001 From: Vijay Chadachan Date: Tue, 26 Apr 2022 10:59:42 +0200 Subject: [PATCH 1/3] Fix for OAI UE AUTH_REQ processing additional check for RAND value It was observed in simulation test the OAI UE always sends the sucessful AUTH_RES when the AUTH_REQ has the RAND value "0". This opens a back door in the authentication process. The code is modified to fix this issue in OAI UE. --- openair3/NAS/UE/EMM/Authentication.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/openair3/NAS/UE/EMM/Authentication.c b/openair3/NAS/UE/EMM/Authentication.c index 850f97150a..97c7082be0 100644 --- a/openair3/NAS/UE/EMM/Authentication.c +++ b/openair3/NAS/UE/EMM/Authentication.c @@ -149,7 +149,8 @@ int emm_proc_authentication_request(nas_user_t *user, int native_ksi, int ksi, int rc = RETURNerror; authentication_data_t *authentication_data = user->authentication_data; emm_timers_t *emm_timers = user->emm_data->emm_timers; - + uint8_t nullRand[AUTH_CK_SIZE]; + memset(nullRand, 0, AUTH_CK_SIZE); LOG_TRACE(INFO, "EMM-PROC - Authentication requested ksi type = %s, ksi = %d", native_ksi ? "native" : "mapped", ksi); /* 3GPP TS 24.301, section 5.4.2.1 @@ -178,11 +179,13 @@ int emm_proc_authentication_request(nas_user_t *user, int native_ksi, int ksi, OctetString ik = {AUTH_IK_SIZE, authentication_data->ik}; OctetString res = {AUTH_RES_SIZE, authentication_data->res}; - if (memcmp(authentication_data->rand, rand->value, AUTH_CK_SIZE) != 0) { + if ((memcmp(authentication_data->rand, rand->value, AUTH_CK_SIZE) != 0) || + (memcmp(nullRand,authentication_data->rand, AUTH_CK_SIZE) == 0)) { /* * There is no valid stored RAND in the ME or the stored RAND is * different from the new received value in the AUTHENTICATION - * REQUEST message + * REQUEST message OR the received RAND is all "0" or "NULL" + * process the new received AUTHENTICATIOn REQUEST message */ OctetString auts; auts.length = 0; From a8f879ea128639048179ca34b98bcec763b55cd2 Mon Sep 17 00:00:00 2001 From: Vijay Chadachan Date: Thu, 28 Apr 2022 18:08:20 +0200 Subject: [PATCH 2/3] Update for the code review comment. Instead of NULL RAND value check, added the flag to indicate if the AUTH process started. The flag is used manage the timer handling for authentication process when stored RAND values is same as received RAND value in AUTH_REQ. --- openair3/NAS/UE/EMM/Authentication.c | 7 ++++--- openair3/NAS/UE/EMM/Authentication.h | 2 ++ 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/openair3/NAS/UE/EMM/Authentication.c b/openair3/NAS/UE/EMM/Authentication.c index 97c7082be0..36c90c4ab0 100644 --- a/openair3/NAS/UE/EMM/Authentication.c +++ b/openair3/NAS/UE/EMM/Authentication.c @@ -180,13 +180,14 @@ int emm_proc_authentication_request(nas_user_t *user, int native_ksi, int ksi, OctetString res = {AUTH_RES_SIZE, authentication_data->res}; if ((memcmp(authentication_data->rand, rand->value, AUTH_CK_SIZE) != 0) || - (memcmp(nullRand,authentication_data->rand, AUTH_CK_SIZE) == 0)) { + (authentication_data->auth_process_started == FALSE)) { /* * There is no valid stored RAND in the ME or the stored RAND is * different from the new received value in the AUTHENTICATION - * REQUEST message OR the received RAND is all "0" or "NULL" - * process the new received AUTHENTICATIOn REQUEST message + * REQUEST message OR if this is first time UE starting the + * Authentication process */ + authentication_data->auth_process_started = TRUE; OctetString auts; auts.length = 0; auts.value = (uint8_t *)malloc(AUTH_AUTS_SIZE); diff --git a/openair3/NAS/UE/EMM/Authentication.h b/openair3/NAS/UE/EMM/Authentication.h index 50b2d990aa..466d3256f3 100644 --- a/openair3/NAS/UE/EMM/Authentication.h +++ b/openair3/NAS/UE/EMM/Authentication.h @@ -18,6 +18,8 @@ typedef struct { unsigned char mac_count:2; /* MAC failure counter (#20) */ unsigned char umts_count:2; /* UMTS challenge failure counter (#26) */ unsigned char sync_count:2; /* Sync failure counter (#21) */ + unsigned char auth_process_started:1; /* Authentication started */ + unsigned char reserve:1; /* For future use, byte aligned */ } authentication_data_t; #endif From 139d20a9ba68595338bc8ce353e3339c74aade50 Mon Sep 17 00:00:00 2001 From: Vijay Chadachan Date: Tue, 3 May 2022 11:58:15 +0200 Subject: [PATCH 3/3] Removing unused variables --- openair3/NAS/UE/EMM/Authentication.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/openair3/NAS/UE/EMM/Authentication.c b/openair3/NAS/UE/EMM/Authentication.c index 36c90c4ab0..a2762d08e8 100644 --- a/openair3/NAS/UE/EMM/Authentication.c +++ b/openair3/NAS/UE/EMM/Authentication.c @@ -149,8 +149,7 @@ int emm_proc_authentication_request(nas_user_t *user, int native_ksi, int ksi, int rc = RETURNerror; authentication_data_t *authentication_data = user->authentication_data; emm_timers_t *emm_timers = user->emm_data->emm_timers; - uint8_t nullRand[AUTH_CK_SIZE]; - memset(nullRand, 0, AUTH_CK_SIZE); + LOG_TRACE(INFO, "EMM-PROC - Authentication requested ksi type = %s, ksi = %d", native_ksi ? "native" : "mapped", ksi); /* 3GPP TS 24.301, section 5.4.2.1