From 74832b4837f2d48fe21ea0439e70c329f5e41ee1 Mon Sep 17 00:00:00 2001 From: Alexis Falempin Date: Wed, 3 Jan 2024 10:45:20 +0000 Subject: [PATCH] NAS : Wrong security header type for PDU Session Establishment Request While testing the OAI 5G RAN in SA mode, it appears that the PDU session establishment request is using the wrong security header type. The current used header is: "Integrity protected and ciphered with new 5G NAS security context". However, according to TS 24.501, Table 9.3.1, this header can only be used by the "Security mode complete" procedure. Changes: - Hence, the new security header has been changed to "Integrity protected and ciphered", which will use the security context generated during the "Security mode complete". - Sequences numbers and NAS counters have been updated to reflect that change. --- openair3/NAS/NR_UE/nr_nas_msg_sim.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/openair3/NAS/NR_UE/nr_nas_msg_sim.c b/openair3/NAS/NR_UE/nr_nas_msg_sim.c index 4b7c4cc45c..5975aede08 100644 --- a/openair3/NAS/NR_UE/nr_nas_msg_sim.c +++ b/openair3/NAS/NR_UE/nr_nas_msg_sim.c @@ -741,7 +741,7 @@ static void generateDeregistrationRequest(nr_ue_nas_t *nas, as_nas_info_t *initi sp_msg->header.protocol_discriminator = FGS_MOBILITY_MANAGEMENT_MESSAGE; sp_msg->header.security_header_type = INTEGRITY_PROTECTED_AND_CIPHERED; sp_msg->header.message_authentication_code = 0; - sp_msg->header.sequence_number = 2; + sp_msg->header.sequence_number = 3; int size = sizeof(fgs_nas_message_security_header_t); fgs_deregistration_request_ue_originating_msg *dereg_req = &sp_msg->plain.mm_msg.fgs_deregistration_request_ue_originating; @@ -805,7 +805,9 @@ static void generatePduSessionEstablishRequest(nr_ue_nas_t *nas, as_nas_info_t * nas_stream_cipher_t stream_cipher; uint8_t mac[4]; nas_msg.header.protocol_discriminator = FGS_MOBILITY_MANAGEMENT_MESSAGE; - nas_msg.header.security_header_type = INTEGRITY_PROTECTED_AND_CIPHERED_WITH_NEW_SECU_CTX; + nas_msg.header.security_header_type = INTEGRITY_PROTECTED_AND_CIPHERED; + nas_msg.header.sequence_number = 2; + size += 7; mm_msg = &nas_msg.security_protected.plain.mm_msg; @@ -858,7 +860,7 @@ static void generatePduSessionEstablishRequest(nr_ue_nas_t *nas, as_nas_info_t * stream_cipher.key = nas->security.knas_int; stream_cipher.key_length = 16; - stream_cipher.count = nas->security.sm_counter++; + stream_cipher.count = nas->security.mm_counter++; stream_cipher.bearer = 1; stream_cipher.direction = 0; stream_cipher.message = (unsigned char *)(initialNasMsg->data + 6);