Support layer 2 MAC packets

[wgreenberg]

What problem does this feature solve or what does it enhance?

We currently don't handle layer 2 packets at all, despite them containing some very useful information (e.g. https://www.sharetechnote.com/html/Handbook_LTE_TimingAdvance.html).

Proposed Solution

This kinda has two layers of support:

1. Simply relay layer 2 packets into the PCAP so we can analyze them there
2. Write a parser for layer 2 packets so we can inspect them via analyzers

The former is much easier than the latter.

Alternatives Considered

No response

[wgreenberg]

i started looking into this a bit, and looks like the diag log IDs we're looking for here are 0xB063 for LTE MAC DL and 0xB064 for LTE MAC UL.

relevant bit of SCAT's parser: https://github.com/fgsect/scat/blob/master/src/scat/parsers/qualcomm/diagltelogparser.py#L705-L725

stuct defs also appear here: https://github.com/vladimir-ponomarenko/Android/blob/bebb3ccd659c602a5672cd255355043d5a3cbc39/app/src/main/cpp/log_packet.h#L3398

[cooperq]

To clarify the exciting thing about timing advance is it lets us tell how far away a tower is which could tell us things like, "is this tower moving", and "how far away is this tower" the latter of which is step one in trilateration and the golden ticket of actually being able to run down an IMSI catcher.

[wgreenberg]

i had some time to poke around at this today and made some progress -- pushed my WIP here: https://github.com/EFForg/rayhunter/tree/fix-457

unfortunately, while this will now successfully save MAC UL/DL messages to our QMDL files and even output them to PCAPs, it seems that wireshark doesn't actually support MAC in their GSMTAP dissector? looking at https://github.com/wireshark/wireshark/blob/master/epan/dissectors/packet-gsmtap.c#L489, GSMTAP_TYPE_LTE_MAC isn't actually used anywhere

[wgreenberg]

seems there's a non-GSMTAP based dissector we'll need to use instead https://gitlab.com/wireshark/wireshark/-/blob/master/epan/dissectors/packet-mac-lte.h

[wgreenberg]

so i think this support can/should happen in three separate steps, possibly split across multiple releases:

1. enable LTE MAC logging on the diag side, which my fix-457 branch does. this'll immediately trigger a ton of informational logs about skipped messages due to MAC not being supported -- we should consider filtering these out from the web UI/rayhunter-check since they'll be numerous and unhelpful (we already know we don't support it!)
2. write LTE MAC packets to PCAPs. this should be relatively easy, and just entail writing out the UDP header wireshark expects in the dissector above
3. parse MAC for use in analyzers -- this'll be trickier

step 1 is pretty easy, and the earlier we do it the more historic QMDL data we'll have w/ MAC messages in them. then, once steps 2 and 3 are done at some later point, we can incorporate those messages into heuristics/analysis