Commit e886ef17 authored by Stone WU's avatar Stone WU Committed by jperaldi

bug #122119: [eNB]fix AS security:Do not apply security ciphyering for...

bug #122119: [eNB]fix AS security:Do not apply security ciphyering for encrypting SecurityModeCommand and decrypting SecurityModeComplete in PDCP
parent 462b99be
...@@ -57,6 +57,7 @@ ...@@ -57,6 +57,7 @@
#include "intertask_interface.h" #include "intertask_interface.h"
#include "openair3/S1AP/s1ap_eNB.h" #include "openair3/S1AP/s1ap_eNB.h"
#include <pthread.h> #include <pthread.h>
#include "LTE_DL-DCCH-Message.h"
# include "gtpv1u_eNB_task.h" # include "gtpv1u_eNB_task.h"
#include <openair3/ocp-gtpu/gtp_itf.h> #include <openair3/ocp-gtpu/gtp_itf.h>
...@@ -439,7 +440,22 @@ boolean_t pdcp_data_req( ...@@ -439,7 +440,22 @@ boolean_t pdcp_data_req(
if ((pdcp_p->security_activated != 0) && if ((pdcp_p->security_activated != 0) &&
(((pdcp_p->cipheringAlgorithm) != 0) || (((pdcp_p->cipheringAlgorithm) != 0) ||
((pdcp_p->integrityProtAlgorithm) != 0))) { ((pdcp_p->integrityProtAlgorithm) != 0))) {
uint8_t ciphyeringAlgorithm = pdcp_p->cipheringAlgorithm;
if (ctxt_pP->enb_flag == ENB_FLAG_YES) { if (ctxt_pP->enb_flag == ENB_FLAG_YES) {
if(srb_flagP && rb_idP==1){
LTE_DL_DCCH_Message_t *dl_dcch_msg = NULL;
uper_decode(NULL, &asn_DEF_LTE_DL_DCCH_Message,
(void **)&dl_dcch_msg,
(const void *)sdu_buffer_pP,
sdu_buffer_sizeP, 0, 0);
if(dl_dcch_msg){
if(dl_dcch_msg->message.choice.c1.present == LTE_DL_DCCH_MessageType__c1_PR_securityModeCommand){
pdcp_p->cipheringAlgorithm = 0;
pdcp_p->security_confirmed= 0;
}
ASN_STRUCT_FREE(asn_DEF_LTE_DL_DCCH_Message,dl_dcch_msg);
}
}
start_meas(&eNB_pdcp_stats[ctxt_pP->module_id].apply_security); start_meas(&eNB_pdcp_stats[ctxt_pP->module_id].apply_security);
} else { } else {
start_meas(&UE_pdcp_stats[ctxt_pP->module_id].apply_security); start_meas(&UE_pdcp_stats[ctxt_pP->module_id].apply_security);
...@@ -454,7 +470,8 @@ boolean_t pdcp_data_req( ...@@ -454,7 +470,8 @@ boolean_t pdcp_data_req(
pdcp_pdu_p->data, pdcp_pdu_p->data,
sdu_buffer_sizeP); sdu_buffer_sizeP);
if (ctxt_pP->enb_flag == ENB_FLAG_NO) { if (ctxt_pP->enb_flag == ENB_FLAG_YES) {
pdcp_p->cipheringAlgorithm = ciphyeringAlgorithm;
stop_meas(&eNB_pdcp_stats[ctxt_pP->module_id].apply_security); stop_meas(&eNB_pdcp_stats[ctxt_pP->module_id].apply_security);
} else { } else {
stop_meas(&UE_pdcp_stats[ctxt_pP->module_id].apply_security); stop_meas(&UE_pdcp_stats[ctxt_pP->module_id].apply_security);
...@@ -805,7 +822,13 @@ pdcp_data_ind( ...@@ -805,7 +822,13 @@ pdcp_data_ind(
} }
if (pdcp_p->security_activated == 1) { if (pdcp_p->security_activated == 1) {
if (ctxt_pP->enb_flag == ENB_FLAG_NO) { uint8_t cipheringAlgorithm = pdcp_p->cipheringAlgorithm;
if (ctxt_pP->enb_flag == ENB_FLAG_YES) {
if(rb_idP == 1 && !pdcp_p->security_confirmed){
//When security_activated, the first UL control message on srb1 should be SecurityModeComplete which is not ciphered
pdcp_p->cipheringAlgorithm = 0;
pdcp_p->security_confirmed=1;
}
start_meas(&eNB_pdcp_stats[ctxt_pP->module_id].validate_security); start_meas(&eNB_pdcp_stats[ctxt_pP->module_id].validate_security);
} else { } else {
start_meas(&UE_pdcp_stats[ctxt_pP->module_id].validate_security); start_meas(&UE_pdcp_stats[ctxt_pP->module_id].validate_security);
...@@ -821,7 +844,8 @@ pdcp_data_ind( ...@@ -821,7 +844,8 @@ pdcp_data_ind(
sdu_buffer_pP->data, sdu_buffer_pP->data,
sdu_buffer_sizeP - pdcp_tailer_len) == 0; sdu_buffer_sizeP - pdcp_tailer_len) == 0;
if (ctxt_pP->enb_flag == ENB_FLAG_NO) { if (ctxt_pP->enb_flag == ENB_FLAG_YES) {
pdcp_p->cipheringAlgorithm = cipheringAlgorithm;
stop_meas(&eNB_pdcp_stats[ctxt_pP->module_id].validate_security); stop_meas(&eNB_pdcp_stats[ctxt_pP->module_id].validate_security);
} else { } else {
stop_meas(&UE_pdcp_stats[ctxt_pP->module_id].validate_security); stop_meas(&UE_pdcp_stats[ctxt_pP->module_id].validate_security);
...@@ -916,7 +940,7 @@ pdcp_data_ind( ...@@ -916,7 +940,7 @@ pdcp_data_ind(
} }
if (pdcp_p->security_activated == 1) { if (pdcp_p->security_activated == 1) {
if (ctxt_pP->enb_flag == ENB_FLAG_NO) { if (ctxt_pP->enb_flag == ENB_FLAG_YES) {
start_meas(&eNB_pdcp_stats[ctxt_pP->module_id].validate_security); start_meas(&eNB_pdcp_stats[ctxt_pP->module_id].validate_security);
} else { } else {
start_meas(&UE_pdcp_stats[ctxt_pP->module_id].validate_security); start_meas(&UE_pdcp_stats[ctxt_pP->module_id].validate_security);
...@@ -932,7 +956,7 @@ pdcp_data_ind( ...@@ -932,7 +956,7 @@ pdcp_data_ind(
sdu_buffer_pP->data, sdu_buffer_pP->data,
sdu_buffer_sizeP - pdcp_tailer_len) == 0; sdu_buffer_sizeP - pdcp_tailer_len) == 0;
if (ctxt_pP->enb_flag == ENB_FLAG_NO) { if (ctxt_pP->enb_flag == ENB_FLAG_YES) {
stop_meas(&eNB_pdcp_stats[ctxt_pP->module_id].validate_security); stop_meas(&eNB_pdcp_stats[ctxt_pP->module_id].validate_security);
} else { } else {
stop_meas(&UE_pdcp_stats[ctxt_pP->module_id].validate_security); stop_meas(&UE_pdcp_stats[ctxt_pP->module_id].validate_security);
...@@ -983,7 +1007,7 @@ pdcp_data_ind( ...@@ -983,7 +1007,7 @@ pdcp_data_ind(
} }
if (pdcp_p->security_activated == 1) { if (pdcp_p->security_activated == 1) {
if (ctxt_pP->enb_flag == ENB_FLAG_NO) { if (ctxt_pP->enb_flag == ENB_FLAG_YES) {
start_meas(&eNB_pdcp_stats[ctxt_pP->module_id].validate_security); start_meas(&eNB_pdcp_stats[ctxt_pP->module_id].validate_security);
} else { } else {
start_meas(&UE_pdcp_stats[ctxt_pP->module_id].validate_security); start_meas(&UE_pdcp_stats[ctxt_pP->module_id].validate_security);
...@@ -999,7 +1023,7 @@ pdcp_data_ind( ...@@ -999,7 +1023,7 @@ pdcp_data_ind(
sdu_buffer_pP->data, sdu_buffer_pP->data,
sdu_buffer_sizeP - pdcp_tailer_len) == 0; sdu_buffer_sizeP - pdcp_tailer_len) == 0;
if (ctxt_pP->enb_flag == ENB_FLAG_NO) { if (ctxt_pP->enb_flag == ENB_FLAG_YES) {
stop_meas(&eNB_pdcp_stats[ctxt_pP->module_id].validate_security); stop_meas(&eNB_pdcp_stats[ctxt_pP->module_id].validate_security);
} else { } else {
stop_meas(&UE_pdcp_stats[ctxt_pP->module_id].validate_security); stop_meas(&UE_pdcp_stats[ctxt_pP->module_id].validate_security);
...@@ -2475,6 +2499,7 @@ void rrc_pdcp_config_req ( ...@@ -2475,6 +2499,7 @@ void rrc_pdcp_config_req (
pdcp_p->seq_num_size = 0; pdcp_p->seq_num_size = 0;
pdcp_p->first_missing_pdu = -1; pdcp_p->first_missing_pdu = -1;
pdcp_p->security_activated = 0; pdcp_p->security_activated = 0;
pdcp_p->security_confirmed = 0;
h_rc = hashtable_remove(pdcp_coll_p, key); h_rc = hashtable_remove(pdcp_coll_p, key);
break; break;
......
...@@ -176,6 +176,7 @@ typedef struct pdcp_s { ...@@ -176,6 +176,7 @@ typedef struct pdcp_s {
uint8_t *kRRCenc; uint8_t *kRRCenc;
uint8_t security_activated; uint8_t security_activated;
uint8_t security_confirmed;
rlc_mode_t rlc_mode; rlc_mode_t rlc_mode;
uint8_t status_report; uint8_t status_report;
......
...@@ -127,7 +127,7 @@ pdcp_apply_security( ...@@ -127,7 +127,7 @@ pdcp_apply_security(
/* SRBs */ /* SRBs */
uint8_t *mac_i; uint8_t *mac_i;
LOG_D(PDCP, "[OSA][RB %ld] %s Applying control-plane security %d \n", LOG_D(PDCP, "[OSA][RB %ld] %s Applying control-plane integrity security %d \n",
rb_id, (pdcp_pP->is_ue != 0) ? "UE -> eNB" : "eNB -> UE", pdcp_pP->integrityProtAlgorithm); rb_id, (pdcp_pP->is_ue != 0) ? "UE -> eNB" : "eNB -> UE", pdcp_pP->integrityProtAlgorithm);
encrypt_params.message = pdcp_pdu_buffer; encrypt_params.message = pdcp_pdu_buffer;
...@@ -149,6 +149,9 @@ pdcp_apply_security( ...@@ -149,6 +149,9 @@ pdcp_apply_security(
encrypt_params.key = pdcp_pP->kUPenc;// + 128; encrypt_params.key = pdcp_pP->kUPenc;// + 128;
} }
LOG_D(PDCP, "[OSA][RB %ld] %s Applying ciphering security %d \n",
rb_id, (pdcp_pP->is_ue != 0) ? "UE -> eNB" : "eNB -> UE", pdcp_pP->cipheringAlgorithm);
encrypt_params.message = &pdcp_pdu_buffer[pdcp_header_len]; encrypt_params.message = &pdcp_pdu_buffer[pdcp_header_len];
encrypt_params.blength = (sdu_buffer_size + 4)<< 3; encrypt_params.blength = (sdu_buffer_size + 4)<< 3;
...@@ -199,8 +202,8 @@ pdcp_validate_security( ...@@ -199,8 +202,8 @@ pdcp_validate_security(
decrypt_params.key_length = 16; decrypt_params.key_length = 16;
if (srb_flagP) { if (srb_flagP) {
LOG_D(PDCP, "[OSA][RB %ld] %s Validating control-plane security\n", LOG_D(PDCP, "[OSA][RB %ld] %s Validating control-plane security: ciphering:%d integrity:%d\n",
rb_id, (pdcp_pP->is_ue != 0) ? "eNB -> UE" : "UE -> eNB"); rb_id, (pdcp_pP->is_ue != 0) ? "eNB -> UE" : "UE -> eNB", pdcp_pP->cipheringAlgorithm,pdcp_pP->integrityProtAlgorithm);
decrypt_params.key = pdcp_pP->kRRCenc;// + 128; decrypt_params.key = pdcp_pP->kRRCenc;// + 128;
} else { } else {
LOG_D(PDCP, "[OSA][RB %ld] %s Validating user-plane security\n", LOG_D(PDCP, "[OSA][RB %ld] %s Validating user-plane security\n",
......
...@@ -126,9 +126,6 @@ pthread_mutex_t rrc_release_freelist; ...@@ -126,9 +126,6 @@ pthread_mutex_t rrc_release_freelist;
RRC_release_list_t rrc_release_info; RRC_release_list_t rrc_release_info;
pthread_mutex_t lock_ue_freelist; pthread_mutex_t lock_ue_freelist;
uint8_t security_mode_command_send = TRUE;
uint8_t as_security_conf_ciphering;
LTE_CipheringAlgorithm_r12_t ciphering_algorithm;
uint8_t ul_sqn,dl_sqn; uint8_t ul_sqn,dl_sqn;
void void
...@@ -7716,7 +7713,6 @@ void rrc_eNB_as_security_configuration_req( ...@@ -7716,7 +7713,6 @@ void rrc_eNB_as_security_configuration_req(
} }
LOG_A(RRC,"Inside rrc_eNB_as_security_configuration_req \n"); LOG_A(RRC,"Inside rrc_eNB_as_security_configuration_req \n");
AssertFatal(ASSecConfReq!=NULL,"AS Security Config Request is NULL \n"); AssertFatal(ASSecConfReq!=NULL,"AS Security Config Request is NULL \n");
ciphering_algorithm = ASSecConfReq->Ciphering.ciphering_algorithm;
#ifndef NR_ENABLE #ifndef NR_ENABLE
for (int i = 0; i < MAX_RBS; i++) for (int i = 0; i < MAX_RBS; i++)
...@@ -7744,15 +7740,10 @@ void rrc_eNB_as_security_configuration_req( ...@@ -7744,15 +7740,10 @@ void rrc_eNB_as_security_configuration_req(
pdcp_p, pdcp_p,
DCCH, DCCH,
DCCH+2, DCCH+2,
(security_mode_command_send == TRUE) ? (ASSecConfReq->Ciphering.ciphering_algorithm ) |(ASSecConfReq->Integrity.integrity_algorithm << 4),
0 | (ASSecConfReq->Integrity.integrity_algorithm << 4) :
(ASSecConfReq->Ciphering.ciphering_algorithm ) |
(ASSecConfReq->Integrity.integrity_algorithm << 4),
ASSecConfReq->Ciphering.kRRCenc, ASSecConfReq->Ciphering.kRRCenc,
ASSecConfReq->Integrity.kRRCint, ASSecConfReq->Integrity.kRRCint,
ASSecConfReq->Ciphering.kUPenc); ASSecConfReq->Ciphering.kUPenc);
security_mode_command_send = FALSE;
as_security_conf_ciphering = ASSecConfReq->Ciphering.ciphering_algorithm;
rb_idx++; rb_idx++;
} else { } else {
LOG_A(RRC,"AS Security configuration received from TTCN didn't applied \n"); LOG_A(RRC,"AS Security configuration received from TTCN didn't applied \n");
...@@ -10466,30 +10457,7 @@ void *rrc_enb_process_itti_msg(void *notUsed) { ...@@ -10466,30 +10457,7 @@ void *rrc_enb_process_itti_msg(void *notUsed) {
{ {
xer_fprint(stdout, &asn_DEF_LTE_DL_DCCH_Message, (void *)dl_dcch_msg); xer_fprint(stdout, &asn_DEF_LTE_DL_DCCH_Message, (void *)dl_dcch_msg);
} }
if ((dl_dcch_msg->message.choice.c1.present == LTE_DL_DCCH_MessageType__c1_PR_ueCapabilityEnquiry || dl_dcch_msg->message.choice.c1.present == LTE_DL_DCCH_MessageType__c1_PR_dlInformationTransfer) && as_security_conf_ciphering) if (dl_dcch_msg->message.choice.c1.present == LTE_DL_DCCH_MessageType__c1_PR_rrcConnectionReconfiguration)
{
for (int i = 0; i < MAX_RBS; i++)
{
if (i < 3)
{
rbid_ = i;
key = PDCP_COLL_KEY_VALUE(ctxt.module_id, SS_RRC_PDU_REQ(msg_p).rnti, ctxt.enb_flag, rbid_, 1);
}
else
{
rbid_ = i - 3;
key = PDCP_COLL_KEY_VALUE(ctxt.module_id, SS_RRC_PDU_REQ(msg_p).rnti, ctxt.enb_flag, rbid_, 0);
}
h_rc = hashtable_get(pdcp_coll_p, key, (void **)&pdcp_p);
if (h_rc == HASH_TABLE_OK)
{
pdcp_fill_ss_pdcp_cnt(pdcp_p, rb_idx, &pc);
pdcp_config_set_security_cipher(pdcp_p, ciphering_algorithm);
}
}
}
else if (dl_dcch_msg->message.choice.c1.present == LTE_DL_DCCH_MessageType__c1_PR_rrcConnectionReconfiguration)
{ {
struct rrc_eNB_ue_context_s *ue_context_p = NULL; struct rrc_eNB_ue_context_s *ue_context_p = NULL;
ue_context_p = rrc_eNB_get_ue_context(RC.rrc[instance], SS_RRC_PDU_REQ(msg_p).rnti); ue_context_p = rrc_eNB_get_ue_context(RC.rrc[instance], SS_RRC_PDU_REQ(msg_p).rnti);
...@@ -10498,24 +10466,6 @@ void *rrc_enb_process_itti_msg(void *notUsed) { ...@@ -10498,24 +10466,6 @@ void *rrc_enb_process_itti_msg(void *notUsed) {
if (ue_context_p && ue_context_p->ue_context.UE_Capability == NULL) if (ue_context_p && ue_context_p->ue_context.UE_Capability == NULL)
{ {
LOG_A(RRC, "[eNB %ld] SRB2 reconfigure on rnti %d\n", instance, SS_RRC_PDU_REQ(msg_p).rnti); LOG_A(RRC, "[eNB %ld] SRB2 reconfigure on rnti %d\n", instance, SS_RRC_PDU_REQ(msg_p).rnti);
for (int i = 0; i < MAX_RBS; i++)
{
if (i < 3)
{
rbid_ = i;
key = PDCP_COLL_KEY_VALUE(ctxt.module_id, SS_RRC_PDU_REQ(msg_p).rnti, ctxt.enb_flag, rbid_, 1);
}
else
{
rbid_ = i - 3;
key = PDCP_COLL_KEY_VALUE(ctxt.module_id, SS_RRC_PDU_REQ(msg_p).rnti, ctxt.enb_flag, rbid_, 0);
}
h_rc = hashtable_get(pdcp_coll_p, key, (void **)&pdcp_p);
if (h_rc == HASH_TABLE_OK)
{
pdcp_config_set_security_cipher(pdcp_p, ciphering_algorithm);
}
}
rrc_eNB_generate_defaultRRCConnectionReconfiguration(&ctxt, ue_context_p, 0); rrc_eNB_generate_defaultRRCConnectionReconfiguration(&ctxt, ue_context_p, 0);
} }
} }
...@@ -10555,8 +10505,6 @@ void *rrc_enb_process_itti_msg(void *notUsed) { ...@@ -10555,8 +10505,6 @@ void *rrc_enb_process_itti_msg(void *notUsed) {
ue_context_pP->ue_context.ue_release_timer_rrc = 0; ue_context_pP->ue_context.ue_release_timer_rrc = 0;
ue_context_pP->ue_context.ue_release_timer_thres_rrc = 0; ue_context_pP->ue_context.ue_release_timer_thres_rrc = 0;
} }
security_mode_command_send = TRUE;
as_security_conf_ciphering = FALSE;
ciphering_algorithm = 0; ciphering_algorithm = 0;
if (RC.ss.CBRA_flag) if (RC.ss.CBRA_flag)
{ {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment