maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Handle security header type "integrity protected with new 5G NAS security context"

Browse Source 
The Security Mode Command is the only NAS message sending a security header
type "integrity protected with new 5G NAS security context". Such header
type is indicating that there is no valid security context and it is
indicating the current one configured by the AMF.

When receiving a Security Mode Command the "AMF shall reset the downlink NAS COUNT"
and use it to integrity protect the initial Security Mode Command. "The AMF shall
send the SECURITY MODE COMMAND message unciphered, but shall integrity protect [...]
The AMF shall set the security header type of the message to
"integrity protected with new 5G NAS security context".

See 5.4.2.2 3GPP TS 24.501.

This commit is ensuring the NAS DL count is reset when the relevant security header
is received. Also, the security container is deleted since no more valid and
NAS_SECURITY_NO_SECURITY_CONTEXT is returned. The setup of the new security context
is done by "handle_security_mode_command",
This commit is contained in:
Guido Casati
2025-05-26 17:05:00 +02:00
parent f672d9088c
commit d405cbb77f
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openair3/NAS/NR_UE/nr_nas_msg.c
+6 -1
View File
@@ -167,8 +167,13 @@ static security_state_t nas_security_rx_process(nr_ue_nas_t *nas, byte_array_t b
case PLAIN_5GS_MSG:
return unprotected_allowed(buffer, msg_type) ? NAS_SECURITY_UNPROTECTED : NAS_SECURITY_BAD_INPUT;
break;
case INTEGRITY_PROTECTED:
case INTEGRITY_PROTECTED_WITH_NEW_SECU_CTX:
stream_security_container_delete(nas->security_container);
nas->security_container = NULL;
nas->security.nas_count_dl = 0;
return NAS_SECURITY_NO_SECURITY_CONTEXT;
break;
case INTEGRITY_PROTECTED:
case INTEGRITY_PROTECTED_AND_CIPHERED_WITH_NEW_SECU_CTX:
/* only accept "integrity protected and ciphered" messages */
if (buffer.buf[6] == 0)