mirror of
https://gitlab.eurecom.fr/oai/openairinterface5g.git
synced 2026-07-13 04:30:28 +00:00
607f9c0f33
Extend the UE 5GS Service Request path to carry `PDU session status` inside a NAS message container and cipher only that container value when valid NAS contexts exist. This aligns the initial Service Request handling with the TS 24.501 rules for non-cleartext IEs. Treat the generated Service Request as integrity-protected whenever an integrity context is available, and keep the post-request KgNB refresh aligned with the NAS UL count used for that protected message. Changes: - update `generateServiceRequest()` in `nr_nas_msg.c` to derive a `PDU session status` bitmap from configured UE PDU sessions and treat it as the non-cleartext trigger for the initial Service Request - build an inner plain Service Request carrying `PDU session status`, place it in the `NAS message container`, cipher only the container value with the NAS ciphering context, and keep the outer Service Request integrity protected - extend `fgs_service_request` lib to support optional `PDU session status` and `NAS message container` fields - decode known optional Service Request TLV IEs with a `switch` and skip unsupported ones - add `free_fgs_service_request()` and `eq_fgs_service_request()` - extend `nas_lib_test` to cover Service Request encoding and decoding with `PDU session status`, `NAS message container`, and skipped optional IEs, and initialize the test logging/config stubs - set the outgoing ngKSI with `set_fgs_ksi(nas)` instead of hardcoding `NAS_KEY_SET_IDENTIFIER_NOT_AVAILABLE` - move `initialNasMsg->nas_data` allocation into the protected and plain branches so each path allocates after its final size accounting - increment `nas->security.nas_count_ul` after integrity MAC computation - derive a refreshed KgNB with `derive_kgnb()` and send it through `nas_itti_kgnb_refresh_req()` after the protected Service Request is built Refs: - TS 24.501 §4.4.6 (protection of initial NAS signalling messages) - TS 24.501 §4.4.4.1 and §4.4.6 allow an initial Service Request to be integrity protected and unciphered when a valid 5G NAS security context exists and no NAS message container is included. - TS 24.501 §8.2.16.1 (Service Request message content) - TS 24.501 §8.2.16.3 (PDU session status) - TS 24.501 §9.11.3.33 (NAS message container) - TS 33.501 §6.4.3.1 (NAS integrity inputs) - TS 33.501 §6.4.4.1 (NAS confidentiality inputs) - TS 33.501 §6.8.1.2.2 derives KgNB from the UL NAS COUNT of the NAS message that moves the UE from CM-IDLE to CM-CONNECTED, unless a subsequent NAS Security Mode Complete exists, in which case that newer UL NAS COUNT becomes the freshness input. Signed-off-by: Guido Casati <guido.casati@openairinterface.org>