Mirror/rayhunter
1
0
Fork 0
mirror of https://github.com/EFForg/rayhunter.git synced 2026-05-24 08:44:45 -07:00
Code Issues Packages Projects Releases Wiki Activity

show false postive attach reject message

Browse Source
This commit is contained in:
Cooper Quintin
2025-11-12 10:19:09 -08:00
committed by Cooper Quintin
parent e44230c043
commit 2cd49b3757
1 changed files with 24 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
lib/src/analysis/imsi_attach.rs
View File

@@ -92,7 +92,11 @@ impl Analyzer for ImsiAttachAnalyzer {
1 1
} }
fn analyze_information_element(&mut self, ie: &InformationElement, _packet_num: usize) -> Option<Event> { fn analyze_information_element(
&mut self,
ie: &InformationElement,
_packet_num: usize,
) -> Option<Event> {
let lte_ie = match ie { let lte_ie = match ie {
InformationElement::LTE(inner) => inner, InformationElement::LTE(inner) => inner,
_ => return None, _ => return None,
@@ -102,24 +106,30 @@ impl Analyzer for ImsiAttachAnalyzer {
LteInformationElement::NAS(nas_msg) => { LteInformationElement::NAS(nas_msg) => {
if self.is_imsi_exposing_nas(nas_msg) { if self.is_imsi_exposing_nas(nas_msg) {
let message_type = match nas_msg { let message_type = match nas_msg {
NASMessage::EMMMessage(emm_msg) => match emm_msg { NASMessage::EMMMessage(emm_msg) => {
EMMMessage::EMMIdentityRequest(_) => "EMM Identity Request (IMSI)", match emm_msg {
EMMMessage::EMMTrackingAreaUpdateReject(_) => { EMMMessage::EMMIdentityRequest(_) => "EMM Identity Request (IMSI)",
"EMM Tracking Area Update Reject" EMMMessage::EMMTrackingAreaUpdateReject(_) => {
"EMM Tracking Area Update Reject"
}
EMMMessage::EMMAttachReject(reject) => {
if reject.emm_cause.inner == AttachRejectEMMCause::EPSServicesAndNonEPSServicesNotAllowed {
"EMM Attach Reject (EPS and Non EPS not allowed"
} else {
"EMM Attach Reject"
}
}
EMMMessage::EMMDetachRequestMT(_) => "EMM Detach Request (MT)",
EMMMessage::EMMServiceReject(_) => "EMM Service Reject",
_ => "Unknown EMM Message",
} }
EMMMessage::EMMAttachReject(_) => "EMM Attach Reject", }
EMMMessage::EMMDetachRequestMT(_) => "EMM Detach Request (MT)",
EMMMessage::EMMServiceReject(_) => "EMM Service Reject",
_ => "Unknown EMM Message",
},
_ => "Unknown NAS Message", _ => "Unknown NAS Message",
}; };
Some(Event { Some(Event {
event_type: EventType::Informational, event_type: EventType::Informational,
message: format!( message: format!("IMSI-exposing NAS message detected: {message_type}."),
"IMSI-exposing NAS message detected: {message_type}."
),
}) })
} else { } else {
None None