NASHelperNGAP.cpp

#include "NASHelperNGAP.hpp"

#include <algorithm>

void NASHelperNGAP::applyCallerNullEncryptionHint(NasSecurityContextNullEncryptionIndicator hint) {
    if (hint != NasSecurityContextNullEncryptionIndicator::CipheringDisabled) {
        persisted_null_encryption_indicator_ = hint;
    }
}

void NASHelperNGAP::updatePersistedFromNasSecurityAlgorithmsOctet(std::uint8_t nasSecurityAlgorithmsOctet) {
    persisted_nas_security_algorithms_octet_ = nasSecurityAlgorithmsOctet;
    const std::uint8_t cipherNibble = nasSecurityAlgorithmsCipheringNibble(nasSecurityAlgorithmsOctet);
    if (cipherNibble == kNasCipheringAlgorithmNullEncryptionNibble) {
        persisted_null_encryption_indicator_ = NasSecurityContextNullEncryptionIndicator::NullEncryptionActive;
    } else {
        persisted_null_encryption_indicator_ = NasSecurityContextNullEncryptionIndicator::Encrypted;
    }
}

bool NASHelperNGAP::tryGetSecurityModeCommandNasSecurityAlgorithmsOctet(const PlainNasPrefix& plain,
                                                                        std::uint8_t& nasSecurityAlgorithmsOctetOut) {
    if (!is5gsMobilityManagementNas(plain.extended_protocol_discriminator)) {
        return false;
    }
    if (plain.message_type != k5gmmMessageTypeSecurityModeCommand) {
        return false;
    }
    if (plain.information_element_octet_count < 1U || plain.information_elements == nullptr) {
        return false;
    }
    nasSecurityAlgorithmsOctetOut = plain.information_elements[0];
    return true;
}

bool NASHelperNGAP::tryParseNasMessageContainerValueWithEmptyContext(const std::uint8_t* const valueOctets,
                                                                     const std::size_t valueOctetCount,
                                                                     ContainedNasPduParse& out) {
    out = ContainedNasPduParse{};

    if (valueOctets == nullptr || valueOctetCount == 0U) {
        return false;
    }

    PlainNasPrefix plain{};
    if (tryParsePlainNasPrefix(valueOctets, valueOctetCount, plain)) {
        out.kind = ContainedNasPduKind::Plain;
        out.plain = plain;
        return true;
    }

    NASHelperNGAP emptyContext{};
    SecurityProtectedNasEnvelope sec{};
    if (emptyContext.tryParseSecurityProtectedNasEnvelope(valueOctets, valueOctetCount, sec)) {
        out.kind = ContainedNasPduKind::SecurityProtected;
        out.secured = sec;
        return true;
    }

    return false;
}

bool NASHelperNGAP::tryParsePlainNasPrefix(const std::uint8_t* octets,
                                           std::size_t octetCount,
                                           PlainNasPrefix& out,
                                           const bool innerTreatCipheredSecurityAsPlainLayout) {
    if (octetCount < kPlain5gmmHeaderOctets) {
        return false;
    }
    const std::uint8_t secType = securityHeaderTypeFromOctet1(octets[1]);
    if (secType != 0U) {
        if (!innerTreatCipheredSecurityAsPlainLayout ||
            !securityHeaderTypeIndicatesCipheredNasPayload(octets[1])) {
            return false;
        }
    }

    out.extended_protocol_discriminator = octets[0];
    out.octet1 = octets[1];

    if (is5gsSessionManagementNas(octets[0])) {
        if (octetCount < kPlain5gsmHeaderOctets) {
            return false;
        }
        out.octet2 = octets[2];
        out.procedure_transaction_identity = octets[3];
        out.message_type = octets[4];
        out.information_elements = octets + kPlain5gsmHeaderOctets;
        out.information_element_octet_count = octetCount - kPlain5gsmHeaderOctets;
        return true;
    }

    out.octet2 = octets[2];
    out.procedure_transaction_identity = 0;
    out.message_type = octets[2];
    out.information_elements = octets + kPlain5gmmHeaderOctets;
    out.information_element_octet_count = octetCount - kPlain5gmmHeaderOctets;
    return true;
}

bool NASHelperNGAP::tryParseSecurityProtectedNasEnvelope(const std::uint8_t* octets,
                                                           std::size_t octetCount,
                                                           SecurityProtectedNasEnvelope& out) {
    if (octetCount < kSecurityProtectedOuterOctets) {
        return false;
    }
    if (securityHeaderTypeFromOctet1(octets[1]) == 0U) {
        return false;
    }

    out.preceding_message_nas_security_algorithms_octet = persisted_nas_security_algorithms_octet_;
    if (persisted_null_encryption_indicator_ != NasSecurityContextNullEncryptionIndicator::CipheringDisabled) {
        out.preceding_message_ciphering_indicator = persisted_null_encryption_indicator_;
    } else {
        out.preceding_message_ciphering_indicator.reset();
    }

    const std::uint8_t* const inner = octets + kSecurityProtectedOuterOctets;
    const std::size_t innerOctetCount = octetCount - kSecurityProtectedOuterOctets;

    out.extended_protocol_discriminator = octets[0];
    out.octet1_security_header = octets[1];
    out.security_header_type = securityHeaderTypeFromOctet1(octets[1]);
    static constexpr std::size_t kMacOffset = 2;
    std::copy_n(octets + kMacOffset, kMacOctets, out.message_authentication_code.begin());
    out.sequence_number = octets[kMacOffset + kMacOctets];
    out.inner_nas_octets = inner;
    out.inner_nas_octet_count = innerOctetCount;
    out.inner_ciphering_indicator.reset();
    out.inner_nas_security_algorithms_octet.reset();

    PlainNasPrefix innerPlain{};
    if (out.security_header_type == kSecurityHeaderTypeInnerNasSecurityAlgorithms &&
        tryParsePlainNasPrefix(inner, innerOctetCount, innerPlain, true)) {
        std::uint8_t nasSecAlg{};
        if (tryGetSecurityModeCommandNasSecurityAlgorithmsOctet(innerPlain, nasSecAlg)) {
            out.inner_nas_security_algorithms_octet = nasSecAlg;
            const std::uint8_t cipherNibble = nasSecurityAlgorithmsCipheringNibble(nasSecAlg);
            if (cipherNibble == kNasCipheringAlgorithmNullEncryptionNibble) {
                out.inner_ciphering_indicator = NasSecurityContextNullEncryptionIndicator::NullEncryptionActive;
            } else {
                out.inner_ciphering_indicator = NasSecurityContextNullEncryptionIndicator::Encrypted;
            }
        }
    }
    return true;
}

void NASHelperNGAP::processNasOctetStream(const std::uint8_t* octets,
                                          std::size_t octetCount,
                                          NasSecurityContextNullEncryptionIndicator nullEncryptionIndicator) {
    applyCallerNullEncryptionHint(nullEncryptionIndicator);

    PlainNasPrefix plain{};
    if (tryParsePlainNasPrefix(octets, octetCount, plain)) {
        std::uint8_t nasSecAlg{};
        if (tryGetSecurityModeCommandNasSecurityAlgorithmsOctet(plain, nasSecAlg)) {
            updatePersistedFromNasSecurityAlgorithmsOctet(nasSecAlg);
        }
        return;
    }

    SecurityProtectedNasEnvelope secured{};
    if (tryParseSecurityProtectedNasEnvelope(octets, octetCount, secured)) {
        if (secured.inner_nas_security_algorithms_octet.has_value()) {
            updatePersistedFromNasSecurityAlgorithmsOctet(*secured.inner_nas_security_algorithms_octet);
        }
        PlainNasPrefix inner_plain{};
        const bool innerLooksPlain =
            (persisted_null_encryption_indicator_ != NasSecurityContextNullEncryptionIndicator::Encrypted) &&
            tryParsePlainNasPrefix(secured.inner_nas_octets, secured.inner_nas_octet_count, inner_plain, true);
        (void)innerLooksPlain;
        (void)inner_plain;
        return;
    }
}

const char* NASHelperNGAP::describe5gsNasMessageType(const std::uint8_t extendedProtocolDiscriminator,
                                                     const std::uint8_t messageType) {
    if (is5gsMobilityManagementNas(extendedProtocolDiscriminator)) {
        switch (messageType) {
            case 0x41:
                return "Registration request";
            case 0x42:
                return "Registration accept";
            case 0x43:
                return "Registration complete";
            case 0x44:
                return "Registration reject";
            case 0x45:
                return "Deregistration request (UE originating)";
            case 0x46:
                return "Deregistration accept (UE originating)";
            case 0x47:
                return "Deregistration request (UE terminated)";
            case 0x48:
                return "Deregistration accept (UE terminated)";
            case 0x4C:
                return "Service request";
            case 0x4D:
                return "Service reject";
            case 0x4E:
                return "Service accept";
            case 0x4F:
                return "Control plane service request";
            case 0x50:
                return "Network slice-specific authentication command";
            case 0x51:
                return "Network slice-specific authentication complete";
            case 0x52:
                return "Network slice-specific authentication result";
            case 0x54:
                return "Configuration update command";
            case 0x55:
                return "Configuration update complete";
            case 0x56:
                return "Authentication request";
            case 0x57:
                return "Authentication response";
            case 0x58:
                return "Authentication reject";
            case 0x59:
                return "Authentication failure";
            case 0x5A:
                return "Authentication result";
            case 0x5B:
                return "Identity request";
            case 0x5C:
                return "Identity response";
            case 0x5D:
                return "Security mode command";
            case 0x5E:
                return "Security mode complete";
            case 0x5F:
                return "Security mode reject";
            case 0x64:
                return "5GMM status";
            case 0x65:
                return "Notification";
            case 0x66:
                return "Notification response";
            case 0x67:
                return "UL NAS transport";
            case 0x68:
                return "DL NAS transport";
            case 0x69:
                return "Relay key request";
            case 0x6A:
                return "Relay key accept";
            case 0x6B:
                return "Relay key reject";
            case 0x6C:
                return "Relay authentication request";
            case 0x6D:
                return "Relay authentication response";
            default:
                return nullptr;
        }
    }

    if (is5gsSessionManagementNas(extendedProtocolDiscriminator)) {
        switch (messageType) {
            case 0xC1:
                return "PDU session establishment request";
            case 0xC2:
                return "PDU session establishment accept";
            case 0xC3:
                return "PDU session establishment reject";
            case 0xC5:
                return "PDU session authentication command";
            case 0xC6:
                return "PDU session authentication complete";
            case 0xC7:
                return "PDU session authentication result";
            case 0xC9:
                return "PDU session modification request";
            case 0xCA:
                return "PDU session modification reject";
            case 0xCB:
                return "PDU session modification command";
            case 0xCC:
                return "PDU session modification complete";
            case 0xCD:
                return "PDU session modification command reject";
            case 0xD1:
                return "PDU session release request";
            case 0xD2:
                return "PDU session release reject";
            case 0xD3:
                return "PDU session release command";
            case 0xD4:
                return "PDU session release complete";
            case 0xD6:
                return "5GSM status";
            case 0xD8:
                return "Service-level authentication command";
            case 0xD9:
                return "Service-level authentication complete";
            case 0xDA:
                return "Remote UE report";
            case 0xDB:
                return "Remote UE report response";
            default:
                return nullptr;
        }
    }

    return nullptr;
}

namespace {

void pushUniqueString(std::vector<std::string>& v, const char* s) {
    for (const auto& x : v) {
        if (x == s) {
            return;
        }
    }
    v.emplace_back(s);
}

/// TS 24.501 §9.11.3.4 / table 9.11.3.4.1 — first value octet layout (3GPP bit numbers, **bit 1 = LSB** of octet):
/// - **Bits 1–3**: type of identity (3 bits; values 0–7). Extracted as @c (firstOctet & 0x07).
/// - **Bit 4**: odd/even indication for identity digits (IMEI/IMEISV-style figures); mask @c 0x08, shift >> 3.
/// - **Bits 5–8** (upper nibble): first identity digit(s) per figure 9.11.3.4.x; the lower nibble holds type and
///   odd/even.
/// Type 5 = IMEISV (e.g. 0x15: bits 1–3 = 101, bit 4 = 0 even).
unsigned fiveGsMobileIdentityTypeFromFirstOctet(const std::uint8_t firstOctet) {
    return static_cast<unsigned>(firstOctet & 0x07U);
}

void appendFiveGsMobileIdentityLabels(const std::uint8_t* value,
                                      const std::size_t len,
                                      std::vector<std::string>& labels) {
    if (value == nullptr || len < 1U) {
        return;
    }
    const unsigned t = fiveGsMobileIdentityTypeFromFirstOctet(value[0]);
    switch (t) {
        case 0U:
            return;
        case 1U:
            pushUniqueString(labels, "SUCI");
            // SUPI is not a separate NAS field here; it may be carried inside the SUCI (TS 24.501). Bare "SUPI"
            // is reserved for identifiers that are SUPI in their own right (add elsewhere when applicable).
            pushUniqueString(labels, "SUPI (via SUCI)");
            return;
        case 2U:
            pushUniqueString(labels, "5G-GUTI");
            return;
        case 3U:
            pushUniqueString(labels, "IMEI");
            return;
        case 4U:
            pushUniqueString(labels, "5G-S-TMSI");
            return;
        case 5U:
            pushUniqueString(labels, "IMEISV");
            return;
        case 6U:
            pushUniqueString(labels, "MAC_address");
            return;
        case 7U:
            pushUniqueString(labels, "EUI-64");
            return;
        default:
            pushUniqueString(labels, "5GS_mobile_identity");
            return;
    }
}

void pushFiveGsMobileIdentitySummary(std::vector<NASHelperNGAP::MobileIdentitySummaryEntry>& out,
                                     std::string layer,
                                     std::string field,
                                     std::string kind,
                                     const std::uint8_t* v,
                                     std::size_t n) {
    if (v == nullptr || n == 0U) {
        return;
    }
    NASHelperNGAP::MobileIdentitySummaryEntry e;
    e.layer = std::move(layer);
    e.field = std::move(field);
    e.kind = std::move(kind);
    e.value.assign(v, v + n);
    out.push_back(std::move(e));
}

}  // namespace

const char* NASHelperNGAP::describeFiveGsMobileIdentityTypeBits123(std::uint8_t firstValueOctet) {
    switch (firstValueOctet & 0x07U) {
        case 0:
            return "no identity";
        case 1:
            return "SUCI";
        case 2:
            return "5G-GUTI";
        case 3:
            return "IMEI";
        case 4:
            return "5G-S-TMSI";
        case 5:
            return "IMEISV";
        case 6:
            return "MAC_address";
        case 7:
            return "EUI-64";
        default:
            return "?";
    }
}

void NASHelperNGAP::appendMobileIdentitySummaries(const PlainNasPrefix& plain,
                                                  const std::string& layer,
                                                  std::vector<MobileIdentitySummaryEntry>& out) {
    if (!is5gsMobilityManagementNas(plain.extended_protocol_discriminator)) {
        return;
    }

    const std::uint8_t* const ie = plain.information_elements;
    const std::size_t n = plain.information_element_octet_count;

    switch (plain.message_type) {
        case k5gmmMessageTypeRegistrationRequest: {
            RegistrationRequestInformationElementsParse p{};
            if (!tryParseRegistrationRequestInformationElements(ie, n, p)) {
                break;
            }
            if (p.mandatory.five_gs_mobile_identity_value != nullptr &&
                p.mandatory.five_gs_mobile_identity_value_octet_count >= 1U) {
                const std::uint8_t* v = p.mandatory.five_gs_mobile_identity_value;
                pushFiveGsMobileIdentitySummary(
                    out, layer, "5GS_mobile_identity (Registration request mandatory)",
                    NASHelperNGAP::describeFiveGsMobileIdentityTypeBits123(v[0]), v,
                    p.mandatory.five_gs_mobile_identity_value_octet_count);
            }
            for (const auto& o : p.optionals) {
                if (o.encoding == RegistrationRequestOptionalInformationElement::Encoding::TlvE && o.iei == 0x77U &&
                    !o.value.empty()) {
                    const char* k = o.value.size() >= 1U
                                        ? NASHelperNGAP::describeFiveGsMobileIdentityTypeBits123(o.value[0])
                                        : "5G-GUTI";
                    pushFiveGsMobileIdentitySummary(out, layer, "5GS_mobile_identity (optional TLV-E IEI 0x77)", k,
                                                    o.value.data(), o.value.size());
                }
            }
            break;
        }
        case k5gmmMessageTypeRegistrationAccept: {
            RegistrationAcceptInformationElementsParse p{};
            if (!tryParseRegistrationAcceptInformationElements(ie, n, p)) {
                break;
            }
            for (const auto& o : p.optionals) {
                if (o.encoding == RegistrationAcceptOptionalInformationElement::Encoding::TlvE && o.iei == 0x77U &&
                    !o.value.empty()) {
                    const char* k = o.value.size() >= 1U
                                        ? NASHelperNGAP::describeFiveGsMobileIdentityTypeBits123(o.value[0])
                                        : "5G-GUTI";
                    pushFiveGsMobileIdentitySummary(out, layer, "5GS_mobile_identity (optional TLV-E IEI 0x77)", k,
                                                    o.value.data(), o.value.size());
                }
            }
            break;
        }
        case k5gmmMessageTypeDeregistrationRequestUeOriginating: {
            DeregistrationRequestUeOriginatingInformationElementsParse p{};
            if (!tryParseDeregistrationRequestUeOriginatingInformationElements(ie, n, p)) {
                break;
            }
            if (p.mandatory.five_gs_mobile_identity_value != nullptr &&
                p.mandatory.five_gs_mobile_identity_value_octet_count >= 1U) {
                const std::uint8_t* v = p.mandatory.five_gs_mobile_identity_value;
                pushFiveGsMobileIdentitySummary(
                    out, layer, "5GS_mobile_identity (Deregistration request mandatory)",
                    NASHelperNGAP::describeFiveGsMobileIdentityTypeBits123(v[0]), v,
                    p.mandatory.five_gs_mobile_identity_value_octet_count);
            }
            break;
        }
        case k5gmmMessageTypeServiceRequest: {
            ServiceRequestInformationElementsParse p{};
            if (!tryParseServiceRequestInformationElements(ie, n, p)) {
                break;
            }
            if (p.mandatory.five_g_s_tmsi_value != nullptr && p.mandatory.five_g_s_tmsi_value_octet_count > 0U) {
                pushFiveGsMobileIdentitySummary(out, layer, "5G-S-TMSI (Service request mandatory)",
                                                "5G-S-TMSI (figure 9.11.3.4.5)", p.mandatory.five_g_s_tmsi_value,
                                                p.mandatory.five_g_s_tmsi_value_octet_count);
            }
            break;
        }
        case k5gmmMessageTypeIdentityResponse: {
            IdentityResponseInformationElementsParse p{};
            if (!tryParseIdentityResponseInformationElements(ie, n, p)) {
                break;
            }
            if (p.mobile_identity_value != nullptr && p.mobile_identity_value_octet_count >= 1U) {
                const std::uint8_t* v = p.mobile_identity_value;
                pushFiveGsMobileIdentitySummary(out, layer, "5GS_mobile_identity (Identity response mandatory)",
                                                NASHelperNGAP::describeFiveGsMobileIdentityTypeBits123(v[0]), v,
                                                p.mobile_identity_value_octet_count);
            }
            break;
        }
        case k5gmmMessageTypeSecurityModeComplete: {
            SecurityModeCompleteInformationElementsParse p{};
            if (!tryParseSecurityModeCompleteInformationElements(ie, n, p)) {
                break;
            }
            const auto smcOptionalIsTlvE = [](std::uint8_t x) -> bool {
                return x == 0x77U || x == 0x71U || x == 0x78U;
            };
            std::size_t i = 0U;
            while (i < n) {
                const std::uint8_t b = ie[i];
                if (!smcOptionalIsTlvE(b)) {
                    break;
                }
                if (i + 3U > n) {
                    break;
                }
                const std::uint16_t vlen = static_cast<std::uint16_t>(
                    (static_cast<unsigned>(ie[i + 1]) << 8U) | static_cast<unsigned>(ie[i + 2]));
                const std::size_t chunk = 3U + static_cast<std::size_t>(vlen);
                if (i + chunk > n || i + chunk < i) {
                    break;
                }
                const std::uint8_t* vptr = ie + i + 3U;
                if (b == 0x77U || b == 0x78U) {
                    if (vlen > 0U) {
                        std::string field = (b == 0x77U)
                                                ? "5GS_mobile_identity (Security mode complete TLV-E IEI 0x77)"
                                                : "5GS_mobile_identity (Security mode complete TLV-E IEI 0x78)";
                        const char* k = vlen >= 1U ? NASHelperNGAP::describeFiveGsMobileIdentityTypeBits123(vptr[0])
                                                   : "5GS_mobile_identity";
                        pushFiveGsMobileIdentitySummary(out, layer, std::move(field), k, vptr, static_cast<std::size_t>(vlen));
                    }
                } else if (b == kIeiNasMessageContainer) {
                    ContainedNasPduParse nested{};
                    if (tryParseNasMessageContainerValueWithEmptyContext(vptr, static_cast<std::size_t>(vlen), nested) &&
                        nested.kind == ContainedNasPduKind::Plain) {
                        const std::string nestedLayer = layer + " / NAS_message_container (IEI 0x71)";
                        appendMobileIdentitySummaries(nested.plain, nestedLayer, out);
                    }
                }
                i += chunk;
            }
            break;
        }
        default:
            break;
    }
}

std::vector<NASHelperNGAP::MobileIdentitySummaryEntry> NASHelperNGAP::collectMobileIdentitySummaries(
    const PlainNasPrefix& plain,
    const std::string& layer) {
    std::vector<MobileIdentitySummaryEntry> v;
    appendMobileIdentitySummaries(plain, layer, v);
    return v;
}

std::vector<std::string> NASHelperNGAP::collectMobileIdentifierLabels(const PlainNasPrefix& plain) {
    std::vector<std::string> labels;
    if (!is5gsMobilityManagementNas(plain.extended_protocol_discriminator)) {
        return labels;
    }

    const std::uint8_t* const ie = plain.information_elements;
    const std::size_t n = plain.information_element_octet_count;

    switch (plain.message_type) {
        case k5gmmMessageTypeRegistrationRequest: {
            RegistrationRequestInformationElementsParse p{};
            if (!tryParseRegistrationRequestInformationElements(ie, n, p)) {
                break;
            }
            appendFiveGsMobileIdentityLabels(p.mandatory.five_gs_mobile_identity_value,
                                             p.mandatory.five_gs_mobile_identity_value_octet_count, labels);
            for (const auto& o : p.optionals) {
                if (o.encoding == RegistrationRequestOptionalInformationElement::Encoding::TlvE && o.iei == 0x77U) {
                    // IEI 0x77 is 5G-GUTI (TS 24.501); value may start with PLMN digits — do not infer type from
                    // first octet nibble (avoids false IMEISV etc.).
                    pushUniqueString(labels, "5G-GUTI");
                }
            }
            break;
        }
        case k5gmmMessageTypeRegistrationAccept: {
            RegistrationAcceptInformationElementsParse p{};
            if (!tryParseRegistrationAcceptInformationElements(ie, n, p)) {
                break;
            }
            for (const auto& o : p.optionals) {
                if (o.encoding == RegistrationAcceptOptionalInformationElement::Encoding::TlvE && o.iei == 0x77U) {
                    pushUniqueString(labels, "5G-GUTI");
                }
            }
            break;
        }
        case k5gmmMessageTypeDeregistrationRequestUeOriginating: {
            DeregistrationRequestUeOriginatingInformationElementsParse p{};
            if (!tryParseDeregistrationRequestUeOriginatingInformationElements(ie, n, p)) {
                break;
            }
            appendFiveGsMobileIdentityLabels(p.mandatory.five_gs_mobile_identity_value,
                                             p.mandatory.five_gs_mobile_identity_value_octet_count, labels);
            break;
        }
        case k5gmmMessageTypeServiceRequest: {
            ServiceRequestInformationElementsParse p{};
            if (!tryParseServiceRequestInformationElements(ie, n, p)) {
                break;
            }
            // Mandatory field is 5G-S-TMSI (figure 9.11.3.4.5); first octet is not a plain low-nibble type only —
            // do not run generic 5GS mobile identity decoding (avoids false SUCI/SUPI from TMSI bits).
            pushUniqueString(labels, "5G-S-TMSI");
            break;
        }
        case k5gmmMessageTypeIdentityResponse: {
            IdentityResponseInformationElementsParse p{};
            if (!tryParseIdentityResponseInformationElements(ie, n, p)) {
                break;
            }
            appendFiveGsMobileIdentityLabels(p.mobile_identity_value, p.mobile_identity_value_octet_count, labels);
            break;
        }
        case k5gmmMessageTypeSecurityModeComplete: {
            SecurityModeCompleteInformationElementsParse p{};
            if (!tryParseSecurityModeCompleteInformationElements(ie, n, p)) {
                break;
            }
            for (const auto& o : p.optionals) {
                // §8.2.26: IEI 0x77 is IMEISV (TLV-E), 0x78 is non-IMEISV PEI — both carry 5GS mobile identity
                // (§9.11.3.4). Same IEI 0x77 is "5G-GUTI" in registration accept; message type disambiguates.
                if (o.iei == 0x77U || o.iei == 0x78U) {
                    appendFiveGsMobileIdentityLabels(o.value.data(), o.value.size(), labels);
                }
                if (o.iei == kIeiNasMessageContainer) {
                    ContainedNasPduParse nested{};
                    if (tryParseNasMessageContainerValueWithEmptyContext(o.value.data(), o.value.size(), nested) &&
                        nested.kind == ContainedNasPduKind::Plain) {
                        const std::vector<std::string> inner = collectMobileIdentifierLabels(nested.plain);
                        for (const auto& s : inner) {
                            pushUniqueString(labels, s.c_str());
                        }
                    }
                }
            }
            break;
        }
        default:
            break;
    }

    return labels;
}