[srslte-users] service reject error

[Pedro Alvarez]

Hi Joe --

Thanks a lot for reporting this. I think the issue here is in the way
the short MAC integrity is calculated at the MME.
Basically, the MME (and the UE) need to keep an NAS COUNT, which can
be decomposed into an overflow counter (16 most significant bits) and
an NAS sequence number (8 least significant bits).

To check the integrity we should do the following, see section 4.4.3.3:

> The receiver shall use the NAS sequence number included in the received message (or estimated from the 5 bits of the
> NAS sequence number received in the message) and an estimate for the NAS overflow counter as defined in
> subclause 4.4.3.1 to form the NAS COUNT input to the integrity verification algorithm.

We correctly used the received sequence number in the normal integrity
protection checks, but it seems that the short integrity check is
incorrect.
Could you try the attached patch?

On Mon, Jun 7, 2021 at 8:33 PM J Giovatto <jgiovatto at adjacentlink.com> wrote:
>
> Hi Folks
>
> I was wondering if anyone else has seen this...
>
> To reproduce:
>
> 1) with a "ping 172.16.0.101 -p aa" running to the epc, break rf link
> between established ue/enb pair to the epc for 2 minutes or more.
>
> 2) re-establish rf link, ping completion never resumes.
>
>
> Log highlights below...
>
> epc log ==================================
>
> 18:24:17.322551 [NAS    ] [W] Short integrity check failure. Local:
> count=3, [88 0d ae 3c], Received: count=6, [75 06]
>
> ue log ===================================
>
> 18:24:17.328535 [NAS    ] [I] Received service reject with EMM cause=0x9
> and t3446=0
>
> 18:24:18.109605 [RLC    ] [I] SRB1 SN=0 outside rx window [1:513] - AM
> discarding
>
> enb log ==================================
>
> 8:24:17.323345 [PDCP   ] [I] TX SRB1 PDU, SN=0, integrity=none,
> encryption=none
>
> Thanks
>
> Joe
> _______________________________________________
> srslte-users mailing list
> srslte-users at lists.softwareradiosystems.com
> https://lists.softwareradiosystems.com/mailman/listinfo/srslte-users
-------------- next part --------------
A non-text attachment was scrubbed...
Name: short_mac_fix.patch
Type: text/x-patch
Size: 3152 bytes
Desc: not available
URL: <https://lists.srsran.com/pipermail/srsran-users/attachments/20210608/e9be3f95/attachment.bin>