-
Notifications
You must be signed in to change notification settings - Fork 167
/
packet-smb2.c
8284 lines (6890 loc) · 253 KB
/
packet-smb2.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/* packet-smb2.c
* Routines for smb2 packet dissection
* Ronnie Sahlberg 2005
*
* For documentation of this protocol, see:
*
* http://wiki.wireshark.org/SMB2
* http://msdn.microsoft.com/en-us/library/cc246482(PROT.10).aspx
*
* If you edit this file, keep the wiki updated as well.
*
* $Id$
*
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#include "config.h"
#include <epan/packet.h>
#include <epan/conversation.h>
#include <epan/tap.h>
#include <epan/wmem/wmem.h>
#include <epan/aftypes.h>
#include "packet-smb2.h"
#include "packet-dcerpc.h"
#include "packet-ntlmssp.h"
#include "packet-windows-common.h"
#include "packet-smb-common.h"
#include "packet-smb.h"
#include "packet-dcerpc-nt.h"
#include <string.h>
#include <epan/prefs.h>
#include <glib.h>
/* Use libgcrypt for cipher libraries. */
#ifdef HAVE_LIBGCRYPT
#include <wsutil/wsgcrypt.h>
#endif /* HAVE_LIBGCRYPT */
static char smb_header_label[] = "SMB2 Header";
static char smb_transform_header_label[] = "SMB2 Transform Header";
static int proto_smb2 = -1;
static int hf_smb2_cmd = -1;
static int hf_smb2_nt_status = -1;
static int hf_smb2_response_to = -1;
static int hf_smb2_response_in = -1;
static int hf_smb2_time = -1;
static int hf_smb2_header_len = -1;
static int hf_smb2_msg_id = -1;
static int hf_smb2_pid = -1;
static int hf_smb2_tid = -1;
static int hf_smb2_aid = -1;
static int hf_smb2_sesid = -1;
static int hf_smb2_previous_sesid = -1;
static int hf_smb2_flags_response = -1;
static int hf_smb2_flags_async_cmd = -1;
static int hf_smb2_flags_dfs_op = -1;
static int hf_smb2_flags_chained = -1;
static int hf_smb2_flags_signature = -1;
static int hf_smb2_flags_replay_operation = -1;
static int hf_smb2_chain_offset = -1;
static int hf_smb2_security_blob = -1;
static int hf_smb2_ioctl_in_data = -1;
static int hf_smb2_ioctl_out_data = -1;
static int hf_smb2_unknown = -1;
static int hf_smb2_twrp_timestamp = -1;
static int hf_smb2_mxac_timestamp = -1;
static int hf_smb2_mxac_status = -1;
static int hf_smb2_qfid_fid = -1;
static int hf_smb2_create_timestamp = -1;
static int hf_smb2_oplock = -1;
static int hf_smb2_close_flags = -1;
static int hf_smb2_notify_flags = -1;
static int hf_smb2_last_access_timestamp = -1;
static int hf_smb2_last_write_timestamp = -1;
static int hf_smb2_last_change_timestamp = -1;
static int hf_smb2_current_time = -1;
static int hf_smb2_boot_time = -1;
static int hf_smb2_filename = -1;
static int hf_smb2_filename_len = -1;
static int hf_smb2_nlinks = -1;
static int hf_smb2_delete_pending = -1;
static int hf_smb2_is_directory = -1;
static int hf_smb2_file_id = -1;
static int hf_smb2_allocation_size = -1;
static int hf_smb2_end_of_file = -1;
static int hf_smb2_tree = -1;
static int hf_smb2_find_pattern = -1;
static int hf_smb2_find_info_level = -1;
static int hf_smb2_find_info_blob = -1;
static int hf_smb2_client_guid = -1;
static int hf_smb2_server_guid = -1;
static int hf_smb2_object_id = -1;
static int hf_smb2_birth_volume_id = -1;
static int hf_smb2_birth_object_id = -1;
static int hf_smb2_domain_id = -1;
static int hf_smb2_class = -1;
static int hf_smb2_infolevel = -1;
static int hf_smb2_infolevel_file_info = -1;
static int hf_smb2_infolevel_fs_info = -1;
static int hf_smb2_infolevel_sec_info = -1;
static int hf_smb2_max_response_size = -1;
static int hf_smb2_max_ioctl_in_size = -1;
static int hf_smb2_max_ioctl_out_size = -1;
static int hf_smb2_required_buffer_size = -1;
static int hf_smb2_setinfo_size = -1;
static int hf_smb2_setinfo_offset = -1;
static int hf_smb2_file_basic_info = -1;
static int hf_smb2_file_standard_info = -1;
static int hf_smb2_file_internal_info = -1;
static int hf_smb2_file_ea_info = -1;
static int hf_smb2_file_access_info = -1;
static int hf_smb2_file_rename_info = -1;
static int hf_smb2_file_disposition_info = -1;
static int hf_smb2_file_position_info = -1;
static int hf_smb2_file_full_ea_info = -1;
static int hf_smb2_file_mode_info = -1;
static int hf_smb2_file_alignment_info = -1;
static int hf_smb2_file_all_info = -1;
static int hf_smb2_file_allocation_info = -1;
static int hf_smb2_file_endoffile_info = -1;
static int hf_smb2_file_alternate_name_info = -1;
static int hf_smb2_file_stream_info = -1;
static int hf_smb2_file_pipe_info = -1;
static int hf_smb2_file_compression_info = -1;
static int hf_smb2_file_network_open_info = -1;
static int hf_smb2_file_attribute_tag_info = -1;
static int hf_smb2_fs_info_01 = -1;
static int hf_smb2_fs_info_03 = -1;
static int hf_smb2_fs_info_04 = -1;
static int hf_smb2_fs_info_05 = -1;
static int hf_smb2_fs_info_06 = -1;
static int hf_smb2_fs_info_07 = -1;
static int hf_smb2_fs_objectid_info = -1;
static int hf_smb2_sec_info_00 = -1;
static int hf_smb2_fid = -1;
static int hf_smb2_write_length = -1;
static int hf_smb2_write_data = -1;
static int hf_smb2_write_flags = -1;
static int hf_smb2_write_flags_write_through = -1;
static int hf_smb2_write_count = -1;
static int hf_smb2_write_remaining = -1;
static int hf_smb2_read_length = -1;
static int hf_smb2_read_remaining = -1;
static int hf_smb2_file_offset = -1;
static int hf_smb2_read_data = -1;
static int hf_smb2_disposition_delete_on_close = -1;
static int hf_smb2_create_disposition = -1;
static int hf_smb2_create_chain_offset = -1;
static int hf_smb2_create_chain_data = -1;
static int hf_smb2_data_offset = -1;
static int hf_smb2_extrainfo = -1;
static int hf_smb2_create_action = -1;
static int hf_smb2_create_rep_flags = -1;
static int hf_smb2_create_rep_flags_reparse_point = -1;
static int hf_smb2_next_offset = -1;
static int hf_smb2_ea_size = -1;
static int hf_smb2_ea_flags = -1;
static int hf_smb2_ea_name_len = -1;
static int hf_smb2_ea_data_len = -1;
static int hf_smb2_ea_name = -1;
static int hf_smb2_ea_data = -1;
static int hf_smb2_buffer_code = -1;
static int hf_smb2_buffer_code_len = -1;
static int hf_smb2_buffer_code_flags_dyn = -1;
static int hf_smb2_olb_offset = -1;
static int hf_smb2_olb_length = -1;
static int hf_smb2_tag = -1;
static int hf_smb2_impersonation_level = -1;
static int hf_smb2_ioctl_function = -1;
static int hf_smb2_ioctl_function_device = -1;
static int hf_smb2_ioctl_function_access = -1;
static int hf_smb2_ioctl_function_function = -1;
static int hf_smb2_ioctl_function_method = -1;
static int hf_smb2_ioctl_resiliency_timeout = -1;
static int hf_smb2_ioctl_resiliency_reserved = -1;
static int hf_windows_sockaddr_family = -1;
static int hf_windows_sockaddr_port = -1;
static int hf_windows_sockaddr_in_addr = -1;
static int hf_windows_sockaddr_in6_flowinfo = -1;
static int hf_windows_sockaddr_in6_addr = -1;
static int hf_windows_sockaddr_in6_scope_id = -1;
static int hf_smb2_ioctl_network_interface_next_offset = -1;
static int hf_smb2_ioctl_network_interface_index = -1;
static int hf_smb2_ioctl_network_interface_rss_queue_count = -1;
static int hf_smb2_ioctl_network_interface_capabilities = -1;
static int hf_smb2_ioctl_network_interface_capability_rss = -1;
static int hf_smb2_ioctl_network_interface_capability_rdma = -1;
static int hf_smb2_ioctl_network_interface_link_speed = -1;
static int hf_smb2_ioctl_shadow_copy_num_volumes = -1;
static int hf_smb2_ioctl_shadow_copy_num_labels = -1;
static int hf_smb2_ioctl_shadow_copy_count = -1;
static int hf_smb2_ioctl_shadow_copy_label = -1;
static int hf_smb2_compression_format = -1;
static int hf_smb2_FILE_OBJECTID_BUFFER = -1;
static int hf_smb2_lease_key = -1;
static int hf_smb2_lease_state = -1;
static int hf_smb2_lease_state_read_caching = -1;
static int hf_smb2_lease_state_handle_caching = -1;
static int hf_smb2_lease_state_write_caching = -1;
static int hf_smb2_lease_flags = -1;
static int hf_smb2_lease_flags_break_ack_required = -1;
static int hf_smb2_lease_flags_parent_lease_key_set = -1;
static int hf_smb2_lease_flags_break_in_progress = -1;
static int hf_smb2_lease_duration = -1;
static int hf_smb2_parent_lease_key = -1;
static int hf_smb2_lease_epoch = -1;
static int hf_smb2_lease_break_reason = -1;
static int hf_smb2_lease_access_mask_hint = -1;
static int hf_smb2_lease_share_mask_hint = -1;
static int hf_smb2_acct_name = -1;
static int hf_smb2_domain_name = -1;
static int hf_smb2_host_name = -1;
static int hf_smb2_auth_frame = -1;
static int hf_smb2_tcon_frame = -1;
static int hf_smb2_share_type = -1;
static int hf_smb2_signature = -1;
static int hf_smb2_credit_charge = -1;
static int hf_smb2_credits_requested = -1;
static int hf_smb2_credits_granted = -1;
static int hf_smb2_channel_sequence = -1;
static int hf_smb2_dialect_count = -1;
static int hf_smb2_security_mode = -1;
static int hf_smb2_secmode_flags_sign_required = -1;
static int hf_smb2_secmode_flags_sign_enabled = -1;
static int hf_smb2_ses_req_flags = -1;
static int hf_smb2_ses_req_flags_session_binding = -1;
static int hf_smb2_capabilities = -1;
static int hf_smb2_cap_dfs = -1;
static int hf_smb2_cap_leasing = -1;
static int hf_smb2_cap_large_mtu = -1;
static int hf_smb2_cap_multi_channel = -1;
static int hf_smb2_cap_persistent_handles = -1;
static int hf_smb2_cap_directory_leasing = -1;
static int hf_smb2_cap_encryption = -1;
static int hf_smb2_dialect = -1;
static int hf_smb2_max_trans_size = -1;
static int hf_smb2_max_read_size = -1;
static int hf_smb2_max_write_size = -1;
static int hf_smb2_channel = -1;
static int hf_smb2_session_flags = -1;
static int hf_smb2_ses_flags_guest = -1;
static int hf_smb2_ses_flags_null = -1;
static int hf_smb2_share_flags = -1;
static int hf_smb2_share_flags_dfs = -1;
static int hf_smb2_share_flags_dfs_root = -1;
static int hf_smb2_share_flags_restrict_exclusive_opens = -1;
static int hf_smb2_share_flags_force_shared_delete = -1;
static int hf_smb2_share_flags_allow_namespace_caching = -1;
static int hf_smb2_share_flags_access_based_dir_enum = -1;
static int hf_smb2_share_flags_force_levelii_oplock = -1;
static int hf_smb2_share_flags_enable_hash_v1 = -1;
static int hf_smb2_share_flags_enable_hash_v2 = -1;
static int hf_smb2_share_flags_encrypt_data = -1;
static int hf_smb2_share_caching = -1;
static int hf_smb2_share_caps = -1;
static int hf_smb2_share_caps_dfs = -1;
static int hf_smb2_share_caps_continuous_availability = -1;
static int hf_smb2_share_caps_scaleout = -1;
static int hf_smb2_share_caps_cluster = -1;
static int hf_smb2_create_flags = -1;
static int hf_smb2_lock_count = -1;
static int hf_smb2_min_count = -1;
static int hf_smb2_remaining_bytes = -1;
static int hf_smb2_channel_info_offset = -1;
static int hf_smb2_channel_info_length = -1;
static int hf_smb2_ioctl_flags = -1;
static int hf_smb2_ioctl_is_fsctl = -1;
static int hf_smb2_close_pq_attrib = -1;
static int hf_smb2_notify_watch_tree = -1;
static int hf_smb2_output_buffer_len = -1;
static int hf_smb2_notify_out_data = -1;
static int hf_smb2_find_flags = -1;
static int hf_smb2_find_flags_restart_scans = -1;
static int hf_smb2_find_flags_single_entry = -1;
static int hf_smb2_find_flags_index_specified = -1;
static int hf_smb2_find_flags_reopen = -1;
static int hf_smb2_file_index = -1;
static int hf_smb2_file_directory_info = -1;
static int hf_smb2_both_directory_info = -1;
static int hf_smb2_short_name_len = -1;
static int hf_smb2_short_name = -1;
static int hf_smb2_id_both_directory_info = -1;
static int hf_smb2_full_directory_info = -1;
static int hf_smb2_lock_info = -1;
static int hf_smb2_lock_length = -1;
static int hf_smb2_lock_flags = -1;
static int hf_smb2_lock_flags_shared = -1;
static int hf_smb2_lock_flags_exclusive = -1;
static int hf_smb2_lock_flags_unlock = -1;
static int hf_smb2_lock_flags_fail_immediately = -1;
static int hf_smb2_dhnq_buffer_reserved = -1;
static int hf_smb2_dh2x_buffer_timeout = -1;
static int hf_smb2_dh2x_buffer_flags = -1;
static int hf_smb2_dh2x_buffer_flags_persistent_handle = -1;
static int hf_smb2_dh2x_buffer_reserved = -1;
static int hf_smb2_dh2x_buffer_create_guid = -1;
static int hf_smb2_APP_INSTANCE_buffer_struct_size = -1;
static int hf_smb2_APP_INSTANCE_buffer_reserved = -1;
static int hf_smb2_APP_INSTANCE_buffer_app_guid = -1;
static int hf_smb2_error_byte_count = -1;
static int hf_smb2_error_data = -1;
static int hf_smb2_error_reserved = -1;
static int hf_smb2_reserved = -1;
static int hf_smb2_transform_signature = -1;
static int hf_smb2_transform_nonce = -1;
static int hf_smb2_transform_msg_size = -1;
static int hf_smb2_transform_reserved = -1;
static int hf_smb2_encryption_aes128_ccm = -1;
static int hf_smb2_transform_enc_alg = -1;
static int hf_smb2_transform_encrypted_data = -1;
static gint ett_smb2 = -1;
static gint ett_smb2_olb = -1;
static gint ett_smb2_ea = -1;
static gint ett_smb2_header = -1;
static gint ett_smb2_encrypted = -1;
static gint ett_smb2_command = -1;
static gint ett_smb2_secblob = -1;
static gint ett_smb2_file_basic_info = -1;
static gint ett_smb2_file_standard_info = -1;
static gint ett_smb2_file_internal_info = -1;
static gint ett_smb2_file_ea_info = -1;
static gint ett_smb2_file_access_info = -1;
static gint ett_smb2_file_position_info = -1;
static gint ett_smb2_file_mode_info = -1;
static gint ett_smb2_file_alignment_info = -1;
static gint ett_smb2_file_all_info = -1;
static gint ett_smb2_file_allocation_info = -1;
static gint ett_smb2_file_endoffile_info = -1;
static gint ett_smb2_file_alternate_name_info = -1;
static gint ett_smb2_file_stream_info = -1;
static gint ett_smb2_file_pipe_info = -1;
static gint ett_smb2_file_compression_info = -1;
static gint ett_smb2_file_network_open_info = -1;
static gint ett_smb2_file_attribute_tag_info = -1;
static gint ett_smb2_file_rename_info = -1;
static gint ett_smb2_file_disposition_info = -1;
static gint ett_smb2_file_full_ea_info = -1;
static gint ett_smb2_fs_info_01 = -1;
static gint ett_smb2_fs_info_03 = -1;
static gint ett_smb2_fs_info_04 = -1;
static gint ett_smb2_fs_info_05 = -1;
static gint ett_smb2_fs_info_06 = -1;
static gint ett_smb2_fs_info_07 = -1;
static gint ett_smb2_fs_objectid_info = -1;
static gint ett_smb2_sec_info_00 = -1;
static gint ett_smb2_tid_tree = -1;
static gint ett_smb2_sesid_tree = -1;
static gint ett_smb2_create_chain_element = -1;
static gint ett_smb2_MxAc_buffer = -1;
static gint ett_smb2_QFid_buffer = -1;
static gint ett_smb2_RqLs_buffer = -1;
static gint ett_smb2_ioctl_function = -1;
static gint ett_smb2_FILE_OBJECTID_BUFFER = -1;
static gint ett_smb2_flags = -1;
static gint ett_smb2_sec_mode = -1;
static gint ett_smb2_capabilities = -1;
static gint ett_smb2_ses_req_flags = -1;
static gint ett_smb2_ses_flags = -1;
static gint ett_smb2_lease_state = -1;
static gint ett_smb2_lease_flags = -1;
static gint ett_smb2_share_flags = -1;
static gint ett_smb2_create_rep_flags = -1;
static gint ett_smb2_share_caps = -1;
static gint ett_smb2_ioctl_flags = -1;
static gint ett_smb2_ioctl_network_interface = -1;
static gint ett_windows_sockaddr = -1;
static gint ett_smb2_close_flags = -1;
static gint ett_smb2_notify_flags = -1;
static gint ett_smb2_write_flags = -1;
static gint ett_smb2_DH2Q_buffer = -1;
static gint ett_smb2_DH2C_buffer = -1;
static gint ett_smb2_dh2x_flags = -1;
static gint ett_smb2_APP_INSTANCE_buffer = -1;
static gint ett_smb2_find_flags = -1;
static gint ett_smb2_file_directory_info = -1;
static gint ett_smb2_both_directory_info = -1;
static gint ett_smb2_id_both_directory_info = -1;
static gint ett_smb2_full_directory_info = -1;
static gint ett_smb2_file_name_info = -1;
static gint ett_smb2_lock_info = -1;
static gint ett_smb2_lock_flags = -1;
static gint ett_smb2_transform_enc_alg = -1;
static gint ett_smb2_buffercode = -1;
static int smb2_tap = -1;
static int smb2_eo_tap = -1;
static dissector_handle_t gssapi_handle = NULL;
static dissector_handle_t ntlmssp_handle = NULL;
static heur_dissector_list_t smb2_heur_subdissector_list;
#define SMB2_CLASS_FILE_INFO 0x01
#define SMB2_CLASS_FS_INFO 0x02
#define SMB2_CLASS_SEC_INFO 0x03
static const value_string smb2_class_vals[] = {
{ SMB2_CLASS_FILE_INFO, "FILE_INFO"},
{ SMB2_CLASS_FS_INFO, "FS_INFO"},
{ SMB2_CLASS_SEC_INFO, "SEC_INFO"},
{ 0, NULL }
};
#define SMB2_SHARE_TYPE_DISK 0x01
#define SMB2_SHARE_TYPE_PIPE 0x02
#define SMB2_SHARE_TYPE_PRINT 0x03
static const value_string smb2_share_type_vals[] = {
{ SMB2_SHARE_TYPE_DISK, "Physical disk" },
{ SMB2_SHARE_TYPE_PIPE, "Named pipe" },
{ SMB2_SHARE_TYPE_PRINT, "Printer" },
{ 0, NULL }
};
#define SMB2_FILE_BASIC_INFO 0x04
#define SMB2_FILE_STANDARD_INFO 0x05
#define SMB2_FILE_INTERNAL_INFO 0x06
#define SMB2_FILE_EA_INFO 0x07
#define SMB2_FILE_ACCESS_INFO 0x08
#define SMB2_FILE_RENAME_INFO 0x0a
#define SMB2_FILE_DISPOSITION_INFO 0x0d
#define SMB2_FILE_POSITION_INFO 0x0e
#define SMB2_FILE_FULL_EA_INFO 0x0f
#define SMB2_FILE_MODE_INFO 0x10
#define SMB2_FILE_ALIGNMENT_INFO 0x11
#define SMB2_FILE_ALL_INFO 0x12
#define SMB2_FILE_ALLOCATION_INFO 0x13
#define SMB2_FILE_ENDOFFILE_INFO 0x14
#define SMB2_FILE_ALTERNATE_NAME_INFO 0x15
#define SMB2_FILE_STREAM_INFO 0x16
#define SMB2_FILE_PIPE_INFO 0x17
#define SMB2_FILE_COMPRESSION_INFO 0x1c
#define SMB2_FILE_NETWORK_OPEN_INFO 0x22
#define SMB2_FILE_ATTRIBUTE_TAG_INFO 0x23
static const value_string smb2_file_info_levels[] = {
{SMB2_FILE_BASIC_INFO, "SMB2_FILE_BASIC_INFO" },
{SMB2_FILE_STANDARD_INFO, "SMB2_FILE_STANDARD_INFO" },
{SMB2_FILE_INTERNAL_INFO, "SMB2_FILE_INTERNAL_INFO" },
{SMB2_FILE_EA_INFO, "SMB2_FILE_EA_INFO" },
{SMB2_FILE_ACCESS_INFO, "SMB2_FILE_ACCESS_INFO" },
{SMB2_FILE_RENAME_INFO, "SMB2_FILE_RENAME_INFO" },
{SMB2_FILE_DISPOSITION_INFO, "SMB2_FILE_DISPOSITION_INFO" },
{SMB2_FILE_POSITION_INFO, "SMB2_FILE_POSITION_INFO" },
{SMB2_FILE_FULL_EA_INFO, "SMB2_FILE_FULL_EA_INFO" },
{SMB2_FILE_MODE_INFO, "SMB2_FILE_MODE_INFO" },
{SMB2_FILE_ALIGNMENT_INFO, "SMB2_FILE_ALIGNMENT_INFO" },
{SMB2_FILE_ALL_INFO, "SMB2_FILE_ALL_INFO" },
{SMB2_FILE_ALLOCATION_INFO, "SMB2_FILE_ALLOCATION_INFO" },
{SMB2_FILE_ENDOFFILE_INFO, "SMB2_FILE_ENDOFFILE_INFO" },
{SMB2_FILE_ALTERNATE_NAME_INFO, "SMB2_FILE_ALTERNATE_NAME_INFO" },
{SMB2_FILE_STREAM_INFO, "SMB2_FILE_STREAM_INFO" },
{SMB2_FILE_PIPE_INFO, "SMB2_FILE_PIPE_INFO" },
{SMB2_FILE_COMPRESSION_INFO, "SMB2_FILE_COMPRESSION_INFO" },
{SMB2_FILE_NETWORK_OPEN_INFO, "SMB2_FILE_NETWORK_OPEN_INFO" },
{SMB2_FILE_ATTRIBUTE_TAG_INFO, "SMB2_FILE_ATTRIBUTE_TAG_INFO" },
{ 0, NULL }
};
#define SMB2_FS_INFO_01 0x01
#define SMB2_FS_INFO_03 0x03
#define SMB2_FS_INFO_04 0x04
#define SMB2_FS_INFO_05 0x05
#define SMB2_FS_INFO_06 0x06
#define SMB2_FS_INFO_07 0x07
#define SMB2_FS_OBJECTID_INFO 0x08
static const value_string smb2_fs_info_levels[] = {
{SMB2_FS_INFO_01, "SMB2_FS_INFO_01" },
{SMB2_FS_INFO_03, "SMB2_FS_INFO_03" },
{SMB2_FS_INFO_04, "SMB2_FS_INFO_04" },
{SMB2_FS_INFO_05, "SMB2_FS_INFO_05" },
{SMB2_FS_INFO_06, "SMB2_FS_INFO_06" },
{SMB2_FS_INFO_07, "SMB2_FS_INFO_07" },
{SMB2_FS_OBJECTID_INFO, "SMB2_FS_OBJECTID_INFO" },
{ 0, NULL }
};
#define SMB2_SEC_INFO_00 0x00
static const value_string smb2_sec_info_levels[] = {
{SMB2_SEC_INFO_00, "SMB2_SEC_INFO_00" },
{ 0, NULL }
};
#define SMB2_FIND_DIRECTORY_INFO 0x01
#define SMB2_FIND_FULL_DIRECTORY_INFO 0x02
#define SMB2_FIND_BOTH_DIRECTORY_INFO 0x03
#define SMB2_FIND_INDEX_SPECIFIED 0x04
#define SMB2_FIND_NAME_INFO 0x0C
#define SMB2_FIND_ID_BOTH_DIRECTORY_INFO 0x25
#define SMB2_FIND_ID_FULL_DIRECTORY_INFO 0x26
static const value_string smb2_find_info_levels[] = {
{ SMB2_FIND_DIRECTORY_INFO, "SMB2_FIND_DIRECTORY_INFO" },
{ SMB2_FIND_FULL_DIRECTORY_INFO, "SMB2_FIND_FULL_DIRECTORY_INFO" },
{ SMB2_FIND_BOTH_DIRECTORY_INFO, "SMB2_FIND_BOTH_DIRECTORY_INFO" },
{ SMB2_FIND_INDEX_SPECIFIED, "SMB2_FIND_INDEX_SPECIFIED" },
{ SMB2_FIND_NAME_INFO, "SMB2_FIND_NAME_INFO" },
{ SMB2_FIND_ID_BOTH_DIRECTORY_INFO, "SMB2_FIND_ID_BOTH_DIRECTORY_INFO" },
{ SMB2_FIND_ID_FULL_DIRECTORY_INFO, "SMB2_FIND_ID_FULL_DIRECTORY_INFO" },
{ 0, NULL }
};
static const gint8 zeros[NTLMSSP_KEY_LEN] = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
/* ExportObject preferences variable */
gboolean eosmb2_take_name_as_fid = FALSE ;
/* unmatched smb_saved_info structures.
For unmatched smb_saved_info structures we store the smb_saved_info
structure using the msg_id field.
*/
static gint
smb2_saved_info_equal_unmatched(gconstpointer k1, gconstpointer k2)
{
const smb2_saved_info_t *key1 = (const smb2_saved_info_t *)k1;
const smb2_saved_info_t *key2 = (const smb2_saved_info_t *)k2;
return key1->msg_id == key2->msg_id;
}
static guint
smb2_saved_info_hash_unmatched(gconstpointer k)
{
const smb2_saved_info_t *key = (const smb2_saved_info_t *)k;
guint32 hash;
hash = (guint32) (key->msg_id&0xffffffff);
return hash;
}
/* matched smb_saved_info structures.
For matched smb_saved_info structures we store the smb_saved_info
structure using the msg_id field.
*/
static gint
smb2_saved_info_equal_matched(gconstpointer k1, gconstpointer k2)
{
const smb2_saved_info_t *key1 = (const smb2_saved_info_t *)k1;
const smb2_saved_info_t *key2 = (const smb2_saved_info_t *)k2;
return key1->msg_id == key2->msg_id;
}
static guint
smb2_saved_info_hash_matched(gconstpointer k)
{
const smb2_saved_info_t *key = (const smb2_saved_info_t *)k;
guint32 hash;
hash = (guint32) (key->msg_id&0xffffffff);
return hash;
}
/* For Tids of a specific conversation.
This keeps track of tid->sharename mappings and other information about the
tid.
qqq
We might need to refine this if it occurs that tids are reused on a single
conversation. we dont worry about that yet for simplicity
*/
static gint
smb2_tid_info_equal(gconstpointer k1, gconstpointer k2)
{
const smb2_tid_info_t *key1 = (const smb2_tid_info_t *)k1;
const smb2_tid_info_t *key2 = (const smb2_tid_info_t *)k2;
return key1->tid == key2->tid;
}
static guint
smb2_tid_info_hash(gconstpointer k)
{
const smb2_tid_info_t *key = (const smb2_tid_info_t *)k;
guint32 hash;
hash = key->tid;
return hash;
}
/* For Uids of a specific conversation.
This keeps track of uid->acct_name mappings and other information about the
uid.
qqq
We might need to refine this if it occurs that uids are reused on a single
conversation. we dont worry about that yet for simplicity
*/
static gint
smb2_sesid_info_equal(gconstpointer k1, gconstpointer k2)
{
const smb2_sesid_info_t *key1 = (const smb2_sesid_info_t *)k1;
const smb2_sesid_info_t *key2 = (const smb2_sesid_info_t *)k2;
return key1->sesid == key2->sesid;
}
static guint
smb2_sesid_info_hash(gconstpointer k)
{
const smb2_sesid_info_t *key = (const smb2_sesid_info_t *)k;
guint32 hash;
hash = (guint32)( ((key->sesid>>32)&0xffffffff)+((key->sesid)&0xffffffff) );
return hash;
}
/* Callback for destroying the glib hash tables associated with a conversation
* struct. */
static gboolean
smb2_conv_destroy(wmem_allocator_t *allocator _U_, wmem_cb_event_t event _U_,
void *user_data)
{
smb2_conv_info_t *conv = (smb2_conv_info_t *)user_data;
g_hash_table_destroy(conv->matched);
g_hash_table_destroy(conv->unmatched);
g_hash_table_destroy(conv->sesids);
g_hash_table_destroy(conv->files);
/* This conversation is gone, return FALSE to indicate we don't
* want to be called again for this conversation. */
return FALSE;
}
static void smb2_key_derivation(const guint8 *KI _U_, guint32 KI_len _U_,
const guint8 *Label _U_, guint32 Label_len _U_,
const guint8 *Context _U_, guint32 Context_len _U_,
guint8 KO[16])
{
#ifdef HAVE_LIBGCRYPT
gcry_md_hd_t hd = NULL;
guint8 buf[4];
guint8 *digest = NULL;
/*
* a simplified version of
* "NIST Special Publication 800-108" section 5.1
* using hmac-sha256.
*/
gcry_md_open(&hd, GCRY_MD_SHA256, GCRY_MD_FLAG_HMAC);
gcry_md_setkey(hd, KI, KI_len);
memset(buf, 0, sizeof(buf));
buf[3] = 1;
gcry_md_write(hd, buf, sizeof(buf));
gcry_md_write(hd, Label, Label_len);
gcry_md_write(hd, buf, 1);
gcry_md_write(hd, Context, Context_len);
buf[3] = 128;
gcry_md_write(hd, buf, sizeof(buf));
digest = gcry_md_read(hd, GCRY_MD_SHA256);
memcpy(KO, digest, 16);
gcry_md_close(hd);
#else
memset(KO, 0, 16);
#endif
}
/* for export-object-smb2 */
static gchar *policy_hnd_to_file_id(const e_ctx_hnd *hnd) {
gchar *file_id;
file_id = wmem_strdup_printf(wmem_packet_scope(),
"%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
hnd->uuid.Data1,
hnd->uuid.Data2,
hnd->uuid.Data3,
hnd->uuid.Data4[0],
hnd->uuid.Data4[1],
hnd->uuid.Data4[2],
hnd->uuid.Data4[3],
hnd->uuid.Data4[4],
hnd->uuid.Data4[5],
hnd->uuid.Data4[6],
hnd->uuid.Data4[7]);
return file_id;
}
static guint smb2_eo_files_hash(gconstpointer k) {
return g_str_hash(policy_hnd_to_file_id((const e_ctx_hnd *)k));
}
static gint smb2_eo_files_equal(gconstpointer k1, gconstpointer k2) {
int are_equal;
const e_ctx_hnd *key1 = (const e_ctx_hnd *)k1;
const e_ctx_hnd *key2 = (const e_ctx_hnd *)k2;
are_equal = (key1->uuid.Data1==key2->uuid.Data1 &&
key1->uuid.Data2==key2->uuid.Data2 &&
key1->uuid.Data3==key2->uuid.Data3 &&
key1->uuid.Data4[0]==key2->uuid.Data4[0] &&
key1->uuid.Data4[1]==key2->uuid.Data4[1] &&
key1->uuid.Data4[2]==key2->uuid.Data4[2] &&
key1->uuid.Data4[3]==key2->uuid.Data4[3] &&
key1->uuid.Data4[4]==key2->uuid.Data4[4] &&
key1->uuid.Data4[5]==key2->uuid.Data4[5] &&
key1->uuid.Data4[6]==key2->uuid.Data4[6] &&
key1->uuid.Data4[7]==key2->uuid.Data4[7]);
return are_equal;
}
static void
feed_eo_smb2(tvbuff_t * tvb,packet_info *pinfo,smb2_info_t * si, guint16 dataoffset,guint32 length, guint64 file_offset) {
char *fid_name = NULL;
guint32 open_frame = 0, close_frame = 0;
tvbuff_t *data_tvb = NULL;
smb_eo_t *eo_info;
gchar *file_id;
gchar *auxstring;
gchar **aux_string_v;
/* Create a new tvb to point to the payload data */
data_tvb = tvb_new_subset(tvb, dataoffset, length, length);
/* Create the eo_info to pass to the listener */
eo_info = wmem_new(wmem_packet_scope(), smb_eo_t);
/* Fill in eo_info */
eo_info->smbversion=2;
/* cmd == opcode */
eo_info->cmd=si->opcode;
/* We don't keep track of uid in SMB v2 */
eo_info->uid=0;
/* Try to get file id and filename */
file_id=policy_hnd_to_file_id(&si->saved->policy_hnd);
dcerpc_fetch_polhnd_data(&si->saved->policy_hnd, &fid_name, NULL, &open_frame, &close_frame, pinfo->fd->num);
if (fid_name && g_strcmp0(fid_name,"File: ")!=0) {
auxstring=fid_name;
/* Remove "File: " from filename */
if (g_str_has_prefix(auxstring, "File: ")) {
aux_string_v = g_strsplit(auxstring, "File: ", -1);
eo_info->filename = wmem_strdup_printf(wmem_packet_scope(), "\\%s",aux_string_v[g_strv_length(aux_string_v)-1]);
g_strfreev(aux_string_v);
} else {
if (g_str_has_prefix(auxstring, "\\")) {
eo_info->filename = wmem_strdup(wmem_packet_scope(), auxstring);
} else {
eo_info->filename = wmem_strdup_printf(wmem_packet_scope(), "\\%s",auxstring);
}
}
} else {
auxstring=wmem_strdup_printf(wmem_packet_scope(), "File_Id_%s", file_id);
eo_info->filename=auxstring;
}
if (eosmb2_take_name_as_fid) {
eo_info->fid = g_str_hash(eo_info->filename);
} else {
eo_info->fid = g_str_hash(file_id);
}
/* tid, hostname, tree_id */
if (si->tree) {
eo_info->tid=si->tree->tid;
if (strlen(si->tree->name)>0 && strlen(si->tree->name)<=256) {
eo_info->hostname = wmem_strdup(wmem_packet_scope(), si->tree->name);
} else {
eo_info->hostname = wmem_strdup_printf(wmem_packet_scope(), "\\\\%s\\TREEID_%i",tree_ip_str(pinfo,si->opcode),si->tree->tid);
}
} else {
eo_info->tid=0;
eo_info->hostname = wmem_strdup_printf(wmem_packet_scope(), "\\\\%s\\TREEID_UNKNOWN",tree_ip_str(pinfo,si->opcode));
}
/* packet number */
eo_info->pkt_num = pinfo->fd->num;
/* fid type */
if (si->eo_file_info->attr_mask & SMB2_FLAGS_ATTR_DIRECTORY) {
eo_info->fid_type=SMB2_FID_TYPE_DIR;
} else {
if (si->eo_file_info->attr_mask &
(SMB2_FLAGS_ATTR_ARCHIVE | SMB2_FLAGS_ATTR_NORMAL |
SMB2_FLAGS_ATTR_HIDDEN | SMB2_FLAGS_ATTR_READONLY |
SMB2_FLAGS_ATTR_SYSTEM) ) {
eo_info->fid_type=SMB2_FID_TYPE_FILE;
} else {
eo_info->fid_type=SMB2_FID_TYPE_OTHER;
}
}
/* end_of_file */
eo_info->end_of_file=si->eo_file_info->end_of_file;
/* data offset and chunk length */
eo_info->smb_file_offset=file_offset;
eo_info->smb_chunk_len=length;
/* XXX is this right? */
if (length<si->saved->bytes_moved) {
si->saved->file_offset=si->saved->file_offset+length;
si->saved->bytes_moved=si->saved->bytes_moved-length;
}
/* Payload */
eo_info->payload_len = length;
eo_info->payload_data = tvb_get_ptr(data_tvb, 0, length);
tap_queue_packet(smb2_eo_tap, pinfo, eo_info);
}
static int dissect_smb2_file_full_ea_info(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, int offset, smb2_info_t *si);
/* This is a helper to dissect the common string type
* uint16 offset
* uint16 length
* ...
* char *string
*
* This function is called twice, first to decode the offset/length and
* second time to dissect the actual string.
* It is done this way since there is no guarantee that we have the full packet and we dont
* want to abort dissection too early if the packet ends somewhere between the
* length/offset and the actual buffer.
*
*/
enum offset_length_buffer_offset_size {
OLB_O_UINT16_S_UINT16,
OLB_O_UINT16_S_UINT32,
OLB_O_UINT32_S_UINT32,
OLB_S_UINT32_O_UINT32
};
typedef struct _offset_length_buffer_t {
guint32 off;
guint32 len;
int off_offset;
int len_offset;
enum offset_length_buffer_offset_size offset_size;
int hfindex;
} offset_length_buffer_t;
static int
dissect_smb2_olb_length_offset(tvbuff_t *tvb, int offset, offset_length_buffer_t *olb,
enum offset_length_buffer_offset_size offset_size, int hfindex)
{
olb->hfindex = hfindex;
olb->offset_size = offset_size;
switch (offset_size) {
case OLB_O_UINT16_S_UINT16:
olb->off = tvb_get_letohs(tvb, offset);
olb->off_offset = offset;
offset += 2;
olb->len = tvb_get_letohs(tvb, offset);
olb->len_offset = offset;
offset += 2;
break;
case OLB_O_UINT16_S_UINT32:
olb->off = tvb_get_letohs(tvb, offset);
olb->off_offset = offset;
offset += 2;
olb->len = tvb_get_letohl(tvb, offset);
olb->len_offset = offset;
offset += 4;
break;
case OLB_O_UINT32_S_UINT32:
olb->off = tvb_get_letohl(tvb, offset);
olb->off_offset = offset;
offset += 4;
olb->len = tvb_get_letohl(tvb, offset);
olb->len_offset = offset;
offset += 4;
break;
case OLB_S_UINT32_O_UINT32:
olb->len = tvb_get_letohl(tvb, offset);
olb->len_offset = offset;
offset += 4;
olb->off = tvb_get_letohl(tvb, offset);
olb->off_offset = offset;
offset += 4;
break;
}
return offset;
}
#define OLB_TYPE_UNICODE_STRING 0x01
#define OLB_TYPE_ASCII_STRING 0x02
static const char *
dissect_smb2_olb_string(packet_info *pinfo, proto_tree *parent_tree, tvbuff_t *tvb, offset_length_buffer_t *olb, int type)
{
int len, off;
proto_item *item = NULL;
proto_tree *tree = NULL;
const char *name = NULL;
guint16 bc;
int offset;
offset = olb->off;
len = olb->len;
off = olb->off;
bc = tvb_length_remaining(tvb, offset);
/* sanity check */
tvb_ensure_bytes_exist(tvb, off, len);
if (((off+len)<off)
|| ((off+len)>(off+tvb_reported_length_remaining(tvb, off)))) {
proto_tree_add_text(tree, tvb, offset, tvb_length_remaining(tvb, offset),
"Invalid offset/length. Malformed packet");
col_append_str(pinfo->cinfo, COL_INFO, " [Malformed packet]");
return NULL;
}
switch (type) {
case OLB_TYPE_UNICODE_STRING:
name = get_unicode_or_ascii_string(tvb, &off,
TRUE, &len, TRUE, TRUE, &bc);
if (!name) {
name = "";
}
if (parent_tree) {
item = proto_tree_add_string(parent_tree, olb->hfindex, tvb, offset, len, name);
tree = proto_item_add_subtree(item, ett_smb2_olb);
}
break;
case OLB_TYPE_ASCII_STRING:
name = get_unicode_or_ascii_string(tvb, &off,
FALSE, &len, TRUE, TRUE, &bc);
if (!name) {
name = "";
}
if (parent_tree) {
item = proto_tree_add_string(parent_tree, olb->hfindex, tvb, offset, len, name);
tree = proto_item_add_subtree(item, ett_smb2_olb);
}
break;
}
switch (olb->offset_size) {
case OLB_O_UINT16_S_UINT16:
proto_tree_add_item(tree, hf_smb2_olb_offset, tvb, olb->off_offset, 2, ENC_LITTLE_ENDIAN);
proto_tree_add_item(tree, hf_smb2_olb_length, tvb, olb->len_offset, 2, ENC_LITTLE_ENDIAN);
break;
case OLB_O_UINT16_S_UINT32:
proto_tree_add_item(tree, hf_smb2_olb_offset, tvb, olb->off_offset, 2, ENC_LITTLE_ENDIAN);
proto_tree_add_item(tree, hf_smb2_olb_length, tvb, olb->len_offset, 4, ENC_LITTLE_ENDIAN);
break;
case OLB_O_UINT32_S_UINT32:
proto_tree_add_item(tree, hf_smb2_olb_offset, tvb, olb->off_offset, 4, ENC_LITTLE_ENDIAN);
proto_tree_add_item(tree, hf_smb2_olb_length, tvb, olb->len_offset, 4, ENC_LITTLE_ENDIAN);
break;
case OLB_S_UINT32_O_UINT32:
proto_tree_add_item(tree, hf_smb2_olb_length, tvb, olb->len_offset, 4, ENC_LITTLE_ENDIAN);
proto_tree_add_item(tree, hf_smb2_olb_offset, tvb, olb->off_offset, 4, ENC_LITTLE_ENDIAN);
break;
}
return name;
}
static void
dissect_smb2_olb_buffer(packet_info *pinfo, proto_tree *parent_tree, tvbuff_t *tvb,
offset_length_buffer_t *olb, smb2_info_t *si,
void (*dissector)(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, smb2_info_t *si))
{
int len, off;
proto_item *sub_item = NULL;
proto_tree *sub_tree = NULL;
tvbuff_t *sub_tvb = NULL;
int offset;
offset = olb->off;
len = olb->len;
off = olb->off;
/* sanity check */
tvb_ensure_bytes_exist(tvb, off, len);
if (((off+len)<off)
|| ((off+len)>(off+tvb_reported_length_remaining(tvb, off)))) {
proto_tree_add_text(parent_tree, tvb, offset, tvb_length_remaining(tvb, offset),
"Invalid offset/length. Malformed packet");
col_append_str(pinfo->cinfo, COL_INFO, " [Malformed packet]");
return;
}
/* if we dont want/need a subtree */
if (olb->hfindex == -1) {
sub_item = parent_tree;
sub_tree = parent_tree;
} else {
if (parent_tree) {
sub_item = proto_tree_add_item(parent_tree, olb->hfindex, tvb, offset, len, ENC_NA);