Mirror/rayhunter
1
0
Fork 0
mirror of https://github.com/EFForg/rayhunter.git synced 2026-05-30 08:19:26 -07:00
Code Issues Packages Projects Releases Wiki Activity

cargo fmt

Browse Source
This commit is contained in:
Cooper Quintin
2026-05-01 12:34:38 -07:00
parent ebc0ddb6b3
commit 1471bb6f0b
1 changed files with 54 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
lib/src/analysis/imsi_requested.rs
View File

@@ -7,13 +7,13 @@ use super::analyzer::{Analyzer, Event, EventType};
use super::information_element::{InformationElement, LteInformationElement};
use log::debug;
use telcom_parser::lte_rrc::{
DL_DCCH_MessageType, DL_DCCH_MessageType_c1, UL_CCCH_MessageType, UL_CCCH_MessageType_c1,
};
use telcom_parser::lte_rrc::{BCCH_DL_SCH_MessageType, BCCH_DL_SCH_MessageType_c1};
use telcom_parser::lte_rrc::{PLMN_Identity, PLMN_IdentityList, MCC_MNC_Digit};
use pycrate_rs::nas::generated::emm::emm_attach_request::TAI;
use pycrate_rs::nas::generated::emm::emm_attach_reject::EMMCauseEMMCause as AttachRejectEMMCause;
use pycrate_rs::nas::generated::emm::emm_attach_request::TAI;
use telcom_parser::lte_rrc::{BCCH_DL_SCH_MessageType, BCCH_DL_SCH_MessageType_c1};
use telcom_parser::lte_rrc::{
/* DL_DCCH_MessageType, DL_DCCH_MessageType_c1,*/ UL_CCCH_MessageType, UL_CCCH_MessageType_c1,
};
use telcom_parser::lte_rrc::{MCC_MNC_Digit, PLMN_Identity, PLMN_IdentityList};
const TIMEOUT_THRESHHOLD: usize = 50;
@@ -46,8 +46,8 @@ impl ImsiRequestedAnalyzer {
state: State::Unattached,
timeout_counter: 0,
flag: None,
// You will likely wonder why this isn't an Option<PLMN{mcc: u32, mnc: u32}>
// The answer is that I like strings.
// You will likely wonder why this isn't an Option<PLMN{mcc: u32, mnc: u32}>
// The answer is that I like strings.
likely_enb_plmn: "Unknown".to_string(),
likely_ue_plmn: "Unknown".to_string(),
}
@@ -85,14 +85,18 @@ impl ImsiRequestedAnalyzer {
if self.likely_enb_plmn == self.likely_ue_plmn {
self.flag = Some(Event {
event_type: EventType::High,
message: format!("Disconnected after Identity Request without Auth Accept on home network!"),
message: format!(
"Disconnected after Identity Request without Auth Accept on home network!"
),
});
} else {
self.flag = Some(Event {
event_type: EventType::Low,
message: format!("Disconnected after Identity Request without Auth Accept, but this could be a false positive roaming issue - Tower PLMN: {}, UE PLMN: {}", self.likely_enb_plmn, self.likely_ue_plmn),
message: format!(
"Disconnected after Identity Request without Auth Accept, but this could be a false positive roaming issue - Tower PLMN: {}, UE PLMN: {}",
self.likely_enb_plmn, self.likely_ue_plmn
),
});
}
}
@@ -113,33 +117,41 @@ impl ImsiRequestedAnalyzer {
// Sometimes an ENB can have multiple PLMNS
fn format_plmn_list(&mut self, plmn_list: &PLMN_IdentityList) -> String {
plmn_list.0.iter()
plmn_list
.0
.iter()
.map(|info| self.plmn_identity_to_str(&info.plmn_identity))
.collect::<Vec<_>>()
.join(", ")
}
// PLMN is represented in two very different ways in the LTE spec so we need
// two very different functions to decode them. I hate this.
// two very different functions to decode them. I hate this.
fn plmn_identity_to_str(&mut self, plmn: &PLMN_Identity) -> String {
let mcc_digits: String = plmn.mcc
let mcc_digits: String = plmn
.mcc
.as_ref()
.map(|mcc| mcc.0.iter()
.filter_map(|d| match d {
MCC_MNC_Digit(n) => Some(n.to_string()),
})
.collect::<Vec<_>>()
.join(""))
.map(|mcc| {
mcc.0
.iter()
.filter_map(|d| match d {
MCC_MNC_Digit(n) => Some(n.to_string()),
})
.collect::<Vec<_>>()
.join("")
})
.unwrap_or_default();
let mnc_digits: String = plmn.mnc
.0.iter()
let mnc_digits: String = plmn
.mnc
.0
.iter()
.filter_map(|d| match d {
MCC_MNC_Digit(n) => Some(n.to_string()),
})
.collect::<Vec<_>>()
.join("");
format!("{}-{}", mcc_digits, mnc_digits)
}
@@ -158,7 +170,10 @@ impl ImsiRequestedAnalyzer {
let mnc_str = if mnc_digit3 == 0xF {
format!("{:02}", mnc_digit1 * 10 + mnc_digit2)
} else {
format!("{:03}", mnc_digit1 as u32 * 100 + mnc_digit2 as u32 * 10 + mnc_digit3 as u32)
format!(
"{:03}",
mnc_digit1 as u32 * 100 + mnc_digit2 as u32 * 10 + mnc_digit3 as u32
)
};
format!("{}-{}", mcc_str, mnc_str)
@@ -166,12 +181,9 @@ impl ImsiRequestedAnalyzer {
fn extract_plmn(&mut self, old_tai: &Option<TAI>) -> String {
match old_tai {
Some(t) => {
self.plmn_vec_to_str(&t.plmn)
},
None => "Unknown".to_string()
Some(t) => self.plmn_vec_to_str(&t.plmn),
None => "Unknown".to_string(),
}
}
}
@@ -195,19 +207,18 @@ impl Analyzer for ImsiRequestedAnalyzer {
ie: &InformationElement,
packet_num: usize,
) -> Option<Event> {
// Set the enodeb plmn to the last sib1 we got, we should improve this once we have PCI data, this
// is a naive approach.
// Set the enodeb plmn to the last sib1 we got, we should improve this once we have PCI data, this
// is a naive approach.
if let InformationElement::LTE(lte_ie) = ie
&& let LteInformationElement::BcchDlSch(sch_msg) = &**lte_ie
&& let BCCH_DL_SCH_MessageType::C1(c1) = &sch_msg.message
&& let BCCH_DL_SCH_MessageType_c1::SystemInformationBlockType1(sib1) = c1 {
let plmn = &sib1.cell_access_related_info.plmn_identity_list;
self.likely_enb_plmn = self.format_plmn_list(plmn);
return None;
}
&& let BCCH_DL_SCH_MessageType_c1::SystemInformationBlockType1(sib1) = c1
{
let plmn = &sib1.cell_access_related_info.plmn_identity_list;
self.likely_enb_plmn = self.format_plmn_list(plmn);
return None;
}
if let InformationElement::LTE(inner) = ie {
match &**inner {
@@ -236,7 +247,9 @@ impl Analyzer for ImsiRequestedAnalyzer {
}
NASMessage::EMMMessage(EMMMessage::EMMAttachReject(reject)) => {
self.transition(State::Disconnect, packet_num);
if reject.emm_cause.inner == AttachRejectEMMCause::EPSServicesAndNonEPSServicesNotAllowed {
if reject.emm_cause.inner
== AttachRejectEMMCause::EPSServicesAndNonEPSServicesNotAllowed
{
self.flag = Some(Event {
event_type: EventType::Low,
message: "Identity requested without authentication but its likely a false positive unless your SIM card has an active plan".to_string(),
@@ -257,7 +270,7 @@ impl Analyzer for ImsiRequestedAnalyzer {
},
// This causes two messages in the event of a false positive when we should always get an attach reject anyway so
// I'm commentingit out until I figure out a smarter way to deal with it.
// I'm commentingit out until I figure out a smarter way to deal with it.
/*
LteInformationElement::DlDcch(rrc_payload) => {
if let DL_DCCH_MessageType::C1(DL_DCCH_MessageType_c1::RrcConnectionRelease(