From d405cbb77f180bba40195376f9c55fe4d71b4ef5 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Sun, 4 May 2025 23:27:35 +0200 Subject: [PATCH] Handle security header type "integrity protected with new 5G NAS security context" The Security Mode Command is the only NAS message sending a security header type "integrity protected with new 5G NAS security context". Such header type is indicating that there is no valid security context and it is indicating the current one configured by the AMF. When receiving a Security Mode Command the "AMF shall reset the downlink NAS COUNT" and use it to integrity protect the initial Security Mode Command. "The AMF shall send the SECURITY MODE COMMAND message unciphered, but shall integrity protect [...] The AMF shall set the security header type of the message to "integrity protected with new 5G NAS security context". See 5.4.2.2 3GPP TS 24.501. This commit is ensuring the NAS DL count is reset when the relevant security header is received. Also, the security container is deleted since no more valid and NAS_SECURITY_NO_SECURITY_CONTEXT is returned. The setup of the new security context is done by "handle_security_mode_command", --- openair3/NAS/NR_UE/nr_nas_msg.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/openair3/NAS/NR_UE/nr_nas_msg.c b/openair3/NAS/NR_UE/nr_nas_msg.c index 3ea9bea9e7..e5fea020c7 100644 --- a/openair3/NAS/NR_UE/nr_nas_msg.c +++ b/openair3/NAS/NR_UE/nr_nas_msg.c @@ -167,8 +167,13 @@ static security_state_t nas_security_rx_process(nr_ue_nas_t *nas, byte_array_t b case PLAIN_5GS_MSG: return unprotected_allowed(buffer, msg_type) ? NAS_SECURITY_UNPROTECTED : NAS_SECURITY_BAD_INPUT; break; - case INTEGRITY_PROTECTED: case INTEGRITY_PROTECTED_WITH_NEW_SECU_CTX: + stream_security_container_delete(nas->security_container); + nas->security_container = NULL; + nas->security.nas_count_dl = 0; + return NAS_SECURITY_NO_SECURITY_CONTEXT; + break; + case INTEGRITY_PROTECTED: case INTEGRITY_PROTECTED_AND_CIPHERED_WITH_NEW_SECU_CTX: /* only accept "integrity protected and ciphered" messages */ if (buffer.buf[6] == 0)