- Modifications needed after only accepting NAS messages whose integrity check passes
- Turns off loading a (possibly) existing NAS ctxt
- Modifies some test vectors such that they have a zero MAC and counter 0
- With the current default tx queue length (16 SDUs) the BSR reported by the UE
is too low if the size of the SDU is relativly small (e.g. 100 B).
This effectivly causes the eNB to only allocate a small grant
to the UE and thus reduces the UL throughput for small SDUs.
* Fix SQN incrementation arithmetic
Current implementation of increment_sqn function increments the 48 bits
SQN directly by 1 which is incorrect according to 3GPP TS 33.102 version
11.5.1 Annex C. This bug causes commercial UEs to report AUTHENTICATION
FAILURE EMM cause #21 "synch failure" when SQN is out of sync.
According to 3GPP TS 33.102 version 11.5.1 Annex C, 48 bits SQN consists
of 43 bits SEQ and 5 bits IND parts where SEQ are incremented during
generation of authentication vector or resync procedure. A
new IND value is also assigned when an authentication vector is
generated. However, resync procedure will use the same IND value.
This patch implements the increment_sqn function according to 3GPP TS
33.102 version 11.5.1 Annex C. A new function increment_seq_after_resync
is added to handle the special case of SQN arithmetic during SQN
resynchronization.
This patch is tested with two comercial UEs (Oneplus One and Oneplus 3T).
* Fix the maximum value of SEQ value to be 2^43-1
The SEQ value is 43 bits long and previous maximum value has a typo (one
extra F) which allows SEQ value to be 2^47-1. This patch corrects the typo.
During the resync procedure, the security_milenage_f1_star generates a
MAC_S value that does not match the MAC_S value reported in AUTS. This
posts a security risk.
According to 3GPP TS 33.102 version 11.5.1 section 6.3.3, the AMF used
to calculate MAC-S assumes a dummy value of all zeros so that it does
not need to be transmitted in the clear in the re-synch message.
This patch corrects this problem. MAC_S reported by AUTS matches the
MAC_S calculated using f1_star function after the fix.