Commit 9212b1b7 authored by Anatolii Pankevych's avatar Anatolii Pankevych Committed by Jerome Peraldi

fix security for SRB2/DRB; fix NAS memory issue

parent 1c3a2fdb
...@@ -1459,13 +1459,13 @@ static void rrc_gNB_process_RRCReconfigurationComplete(const protocol_ctxt_t *co ...@@ -1459,13 +1459,13 @@ static void rrc_gNB_process_RRCReconfigurationComplete(const protocol_ctxt_t *co
} }
} }
nr_pdcp_add_srbs(ctxt_pP->enb_flag, ctxt_pP->rntiMaybeUEid, SRB_configList, (ue_p->integrity_algorithm << 4) | ue_p->ciphering_algorithm, kRRCenc, kRRCint); nr_pdcp_add_srbs(ctxt_pP->enb_flag, ctxt_pP->rntiMaybeUEid, SRB_configList, (_int_algo << 4) | _cip_algo, kRRCenc, kRRCint);
nr_pdcp_add_drbs(ctxt_pP->enb_flag, nr_pdcp_add_drbs(ctxt_pP->enb_flag,
ctxt_pP->rntiMaybeUEid, ctxt_pP->rntiMaybeUEid,
reestablish_ue_id, reestablish_ue_id,
DRB_configList, DRB_configList,
(ue_p->integrity_algorithm << 4) | ue_p->ciphering_algorithm, (_int_algo << 4) | _cip_algo,
kUPenc, kUPenc,
kUPint, kUPint,
get_softmodem_params()->sa ? ue_p->masterCellGroup->rlc_BearerToAddModList : NULL); get_softmodem_params()->sa ? ue_p->masterCellGroup->rlc_BearerToAddModList : NULL);
......
...@@ -1710,11 +1710,11 @@ int8_t nr_rrc_ue_decode_ccch( const protocol_ctxt_t *const ctxt_pP, const NR_SRB ...@@ -1710,11 +1710,11 @@ int8_t nr_rrc_ue_decode_ccch( const protocol_ctxt_t *const ctxt_pP, const NR_SRB
} }
LOG_T(NR_RRC, "\n"); LOG_T(NR_RRC, "\n");
nr_pdcp_data_req_srb(ctxt_pP->rntiMaybeUEid, DCCH, nr_rrc_mui++, (enc_rval.encoded + 7) / 8, buffer, deliver_pdu_srb_rlc, NULL); // if (NR_UE_rrc_inst[ctxt_pP->module_id].cipheringAlgorithm != NR_CipheringAlgorithm_nea0) {
if (NR_UE_rrc_inst[ctxt_pP->module_id].cipheringAlgorithm != NR_CipheringAlgorithm_nea0) { // LOG_I(NR_RRC, "A new Security Mode Command received, reset status\n");
LOG_I(NR_RRC, "Calling nr_pdcp_config_set_smc"); // nr_pdcp_config_set_smc(ctxt_pP->rntiMaybeUEid, false);
nr_pdcp_config_set_smc(ctxt_pP->rntiMaybeUEid, false); // }
} nr_pdcp_data_req_srb(ctxt_pP->rntiMaybeUEid, DCCH, nr_rrc_mui++, (enc_rval.encoded + 7) / 8, buffer, deliver_pdu_srb_rlc, NULL);
} else { } else {
LOG_W(NR_RRC,"securityModeCommand->criticalExtensions.present (%d) != NR_SecurityModeCommand__criticalExtensions_PR_securityModeCommand\n", LOG_W(NR_RRC,"securityModeCommand->criticalExtensions.present (%d) != NR_SecurityModeCommand__criticalExtensions_PR_securityModeCommand\n",
securityModeCommand->criticalExtensions.present); securityModeCommand->criticalExtensions.present);
......
...@@ -1692,12 +1692,18 @@ void generateServiceRequest(as_nas_info_t *initialNasMsg, nr_ue_nas_t *nas) { ...@@ -1692,12 +1692,18 @@ void generateServiceRequest(as_nas_info_t *initialNasMsg, nr_ue_nas_t *nas) {
/* _encrypt_nas_msg(nas, _ul_nas_count, initialNasMsg->data + 11, initialNasMsg->length - 11); */ /* _encrypt_nas_msg(nas, _ul_nas_count, initialNasMsg->data + 11, initialNasMsg->length - 11); */
} }
uint8_t get_msg_type(uint8_t *pdu_buffer, uint32_t length) { uint8_t get_msg_type(uint8_t *pdu, uint32_t length) {
uint8_t pd = 0; uint8_t pd = 0;
uint8_t msg_type = 0; uint8_t msg_type = 0;
uint8_t offset = 0; uint8_t offset = 0;
uint8_t *pdu_buffer = NULL;
if ((pdu != NULL) && (length > 0)) {
pdu_buffer = malloc(length);
AssertFatal (pdu_buffer != NULL, "Failed to allocate memory\n");
memcpy(pdu_buffer, pdu, length);
printf("%s: pdu: ", __FUNCTION__); for(int i = 0; i < length; i++) printf("%02x", pdu_buffer[i]);printf("\n");
if ((pdu_buffer != NULL) && (length > 0)) {
if (((nas_msg_header_t *)(pdu_buffer))->choice.security_protected_nas_msg_header_t.security_header_type > 0) { if (((nas_msg_header_t *)(pdu_buffer))->choice.security_protected_nas_msg_header_t.security_header_type > 0) {
offset += SECURITY_PROTECTED_5GS_NAS_MESSAGE_HEADER_LENGTH; offset += SECURITY_PROTECTED_5GS_NAS_MESSAGE_HEADER_LENGTH;
if (offset < length) { if (offset < length) {
...@@ -1705,9 +1711,7 @@ uint8_t get_msg_type(uint8_t *pdu_buffer, uint32_t length) { ...@@ -1705,9 +1711,7 @@ uint8_t get_msg_type(uint8_t *pdu_buffer, uint32_t length) {
msg_type = ((mm_msg_header_t *)(pdu_buffer + offset))->message_type; msg_type = ((mm_msg_header_t *)(pdu_buffer + offset))->message_type;
if (msg_type == FGS_DOWNLINK_NAS_TRANSPORT) { if (msg_type == FGS_DOWNLINK_NAS_TRANSPORT) {
dl_nas_transport_t tmp; msg_type = ((dl_nas_transport_t *)(pdu_buffer+ offset))->sm_nas_msg_header.message_type;
memcpy(&tmp, pdu_buffer + offset, sizeof(tmp));
msg_type = tmp.sm_nas_msg_header.message_type;
} else if (pd == TEST_PD) { } else if (pd == TEST_PD) {
msg_type = *(pdu_buffer + offset + 1); msg_type = *(pdu_buffer + offset + 1);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment