Rewrite our 2G downgrade analyzer

This commit is contained in:
Will Greenberg
2025-01-17 12:33:14 -08:00
committed by Cooper Quintin
parent 26eda5904f
commit 12640cc878
4 changed files with 33 additions and 65 deletions
+2 -2
View File
@@ -7,7 +7,7 @@ use crate::{diag::MessagesContainer, gsmtap_parser};
use super::{ use super::{
imsi_requested::ImsiRequestedAnalyzer, imsi_requested::ImsiRequestedAnalyzer,
information_element::InformationElement, information_element::InformationElement,
lte_downgrade::LteSib6And7DowngradeAnalyzer, lte_downgrade::ConnectionRedirect2GDowngradeAnalyzer,
null_cipher::NullCipherAnalyzer, null_cipher::NullCipherAnalyzer,
}; };
@@ -117,7 +117,7 @@ impl Harness {
pub fn new_with_all_analyzers() -> Self { pub fn new_with_all_analyzers() -> Self {
let mut harness = Harness::new(); let mut harness = Harness::new();
harness.add_analyzer(Box::new(LteSib6And7DowngradeAnalyzer{})); harness.add_analyzer(Box::new(ConnectionRedirect2GDowngradeAnalyzer{}));
harness.add_analyzer(Box::new(ImsiRequestedAnalyzer::new())); harness.add_analyzer(Box::new(ImsiRequestedAnalyzer::new()));
harness.add_analyzer(Box::new(NullCipherAnalyzer{})); harness.add_analyzer(Box::new(NullCipherAnalyzer{}));
+23 -63
View File
@@ -2,80 +2,40 @@ use std::borrow::Cow;
use super::analyzer::{Analyzer, Event, EventType, Severity}; use super::analyzer::{Analyzer, Event, EventType, Severity};
use super::information_element::{InformationElement, LteInformationElement}; use super::information_element::{InformationElement, LteInformationElement};
use telcom_parser::lte_rrc::{BCCH_DL_SCH_MessageType, BCCH_DL_SCH_MessageType_c1, CellReselectionPriority, SystemInformationBlockType7, SystemInformationCriticalExtensions, SystemInformation_r8_IEsSib_TypeAndInfo, SystemInformation_r8_IEsSib_TypeAndInfo_Entry}; use telcom_parser::lte_rrc::{DL_DCCH_Message, DL_DCCH_MessageType, DL_DCCH_MessageType_c1, RRCConnectionReleaseCriticalExtensions, RRCConnectionReleaseCriticalExtensions_c1, RedirectedCarrierInfo};
use super::util::unpack;
/// Based on heuristic T7 from Shinjo Park's "Why We Cannot Win". /// Based on heuristic T7 from Shinjo Park's "Why We Cannot Win".
pub struct LteSib6And7DowngradeAnalyzer { pub struct ConnectionRedirect2GDowngradeAnalyzer {
}
impl LteSib6And7DowngradeAnalyzer {
fn unpack_system_information<'a>(&self, ie: &'a InformationElement) -> Option<&'a SystemInformation_r8_IEsSib_TypeAndInfo> {
if let InformationElement::LTE(LteInformationElement::BcchDlSch(bcch_dl_sch_message)) = ie {
if let BCCH_DL_SCH_MessageType::C1(BCCH_DL_SCH_MessageType_c1::SystemInformation(system_information)) = &bcch_dl_sch_message.message {
if let SystemInformationCriticalExtensions::SystemInformation_r8(sib) = &system_information.critical_extensions {
return Some(&sib.sib_type_and_info);
}
}
}
None
}
} }
// TODO: keep track of SIB state to compare LTE reselection blocks w/ 2g/3g ones // TODO: keep track of SIB state to compare LTE reselection blocks w/ 2g/3g ones
impl Analyzer for LteSib6And7DowngradeAnalyzer { impl Analyzer for ConnectionRedirect2GDowngradeAnalyzer {
fn get_name(&self) -> Cow<str> { fn get_name(&self) -> Cow<str> {
Cow::from("LTE SIB 6/7 Downgrade") Cow::from("Connection Release/Redirected Carrier 2G Downgrade")
} }
fn get_description(&self) -> Cow<str> { fn get_description(&self) -> Cow<str> {
Cow::from("Tests for LTE cells broadcasting a SIB type 6 and 7 which include 2G/3G frequencies with higher priorities.") Cow::from("Tests if a cell releases our connection and redirects us to a 2G cell.")
} }
fn analyze_information_element(&mut self, ie: &InformationElement) -> Option<super::analyzer::Event> { fn analyze_information_element(&mut self, ie: &InformationElement) -> Option<Event> {
let sibs = &self.unpack_system_information(ie)?.0; unpack!(InformationElement::LTE(lte_ie) = ie);
for sib in sibs { unpack!(LteInformationElement::DlDcch(DL_DCCH_Message { message }) = lte_ie);
match sib { unpack!(DL_DCCH_MessageType::C1(c1) = message);
SystemInformation_r8_IEsSib_TypeAndInfo_Entry::Sib6(sib6) => { unpack!(DL_DCCH_MessageType_c1::RrcConnectionRelease(release) = c1);
if let Some(carrier_info_list) = sib6.carrier_freq_list_utra_fdd.as_ref() { unpack!(RRCConnectionReleaseCriticalExtensions::C1(c1) = &release.critical_extensions);
for carrier_info in &carrier_info_list.0 { unpack!(RRCConnectionReleaseCriticalExtensions_c1::RrcConnectionRelease_r8(r8_ies) = c1);
if let Some(CellReselectionPriority(p)) = carrier_info.cell_reselection_priority { unpack!(Some(carrier_info) = &r8_ies.redirected_carrier_info);
if p == 0 { match carrier_info {
return Some(Event { RedirectedCarrierInfo::Geran(_carrier_freqs_geran) => Some(Event {
event_type: EventType::QualitativeWarning { severity: Severity::High }, event_type: EventType::QualitativeWarning { severity: Severity::High },
message: "LTE cell advertised a 3G cell for priority 0 reselection".to_string(), message: format!("Detected 2G downgrade"),
}); }),
} _ => Some(Event {
} event_type: EventType::Informational,
} message: format!("RRCConnectionRelease CarrierInfo: {:?}", carrier_info),
} }),
if let Some(carrier_info_list) = sib6.carrier_freq_list_utra_tdd.as_ref() {
for carrier_info in &carrier_info_list.0 {
if let Some(CellReselectionPriority(p)) = carrier_info.cell_reselection_priority {
if p == 0 {
return Some(Event {
event_type: EventType::QualitativeWarning { severity: Severity::High },
message: "LTE cell advertised a 3G cell for priority 0 reselection".to_string(),
});
}
}
}
}
},
SystemInformation_r8_IEsSib_TypeAndInfo_Entry::Sib7(SystemInformationBlockType7 { carrier_freqs_info_list: Some(carrier_info_list), .. }) => {
for carrier_info in &carrier_info_list.0 {
if let Some(CellReselectionPriority(p)) = carrier_info.common_info.cell_reselection_priority {
if p == 0 {
return Some(Event {
event_type: EventType::QualitativeWarning { severity: Severity::High },
message: "LTE cell advertised a 2G cell for priority 0 reselection".to_string(),
});
}
}
}
},
_ => {},
}
} }
None
} }
} }
+1
View File
@@ -4,3 +4,4 @@ pub mod lte_downgrade;
pub mod imsi_provided; pub mod imsi_provided;
pub mod imsi_requested; pub mod imsi_requested;
pub mod null_cipher; pub mod null_cipher;
pub mod util;
+7
View File
@@ -0,0 +1,7 @@
macro_rules! unpack {
($pat:pat = $val:expr) => {
let $pat = $val else { return None; };
};
}
pub(crate) use unpack;