_smb.c

This directory contains source code for tcpdump, a tool for network monitoring and data acquisition

/*
 * Copyright (C) Andrew Tridgell 1995
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>

#include "interfac.h"
#include "smb.h"

uchar *nbt_startbuf = NULL;

#ifdef PRINT_NETBIOS_DETAILS

static int request = 0;

struct smbdescript {
       char *req_f1;
       char *req_f2;
       char *rep_f1;
       char *rep_f2;
       void (*fn)();
     };

struct smbfns {
       int    id;
       char  *name;
       int    flags;
       struct smbdescript descript;
     };

#define DEFDESCRIPT  { NULL,NULL,NULL,NULL,NULL }

#define FLG_CHAIN    (1<<0)

static struct smbfns *smbfind (int id, struct smbfns *list)
{
  int sindex;

  for (sindex = 0; list[sindex].name; sindex++)
     if (list[sindex].id == id)
        return (&list[sindex]);
  return (&list[0]);
}

static void trans2_findfirst (uchar * param, uchar * data, int pcnt, int dcnt)
{
  char *fmt;

  if (request)
       fmt = "Attribute=[A]\nSearchCount=[d]\nFlags=[w]\nLevel=[dP5]\nFile=[S]\n";
  else fmt = "Handle=[w]\nCount=[d]\nEOS=[w]\nEoffset=[d]\nLastNameOfs=[w]\n";

  fdata (param, fmt, param + pcnt);
  if (dcnt)
  {
    PUTS ("data:\n");
    print_data (data, dcnt);
  }
}

static void trans2_qfsinfo (uchar *param, uchar *data, int pcnt, int dcnt)
{
  static int level = 0;
  char  *fmt = "";

  if (request)
  {
    level = SVAL (param, 0);
    fmt = "InfoLevel=[d]\n";
    fdata (param, fmt, param + pcnt);
  }
  else
  {
    switch (level)
    {
      case 1:
           fmt = "idFileSystem=[W]\nSectorUnit=[D]\nUnit=[D]\nAvail=[D]\nSectorSize=[d]\n";
           break;
      case 2:
           fmt = "CreationTime=[T2]VolNameLength=[B]\nVolumeLabel=[s12]\n";
           break;
      case 0x105:
           fmt = "Capabilities=[W]\nMaxFileLen=[D]\nVolNameLen=[D]\nVolume=[S]\n";
           break;
      default:
           fmt = "UnknownLevel\n";
    }
    fdata (data, fmt, data + dcnt);
  }
  if (dcnt)
  {
    PUTS ("data:\n");
    print_data (data, dcnt);
  }
}


struct smbfns trans2_fns[] = {
    { 0, "TRANSACT2_OPEN", 0,
      { "Flags2=[w]\nMode=[w]\nSearchAttrib=[A]\nAttrib=[A]\nTime=[T2]\n"
        "OFun=[w]\nSize=[D]\nRes=([w,w,w,w,w])\nPath=[S]", NULL,
        "Handle=[d]\nAttrib=[A]\nTime=[T2]\nSize=[D]\nAccess=[w]\nType=[w]\n"
        "State=[w]\nAction=[w]\nInode=[W]\nOffErr=[d]\n|EALength=[d]\n",
        NULL, NULL
      }
    },

    { 1, "TRANSACT2_FINDFIRST", 0,
      { NULL, NULL, NULL, NULL, trans2_findfirst }
    },

    { 2, "TRANSACT2_FINDNEXT", 0, DEFDESCRIPT },

    { 3, "TRANSACT2_QFSINFO", 0,
      { NULL, NULL, NULL, NULL, trans2_qfsinfo }
    },

    { 4,  "TRANSACT2_SETFSINFO",       0, DEFDESCRIPT },
    { 5,  "TRANSACT2_QPATHINFO",       0, DEFDESCRIPT },
    { 6,  "TRANSACT2_SETPATHINFO",     0, DEFDESCRIPT },
    { 7,  "TRANSACT2_QFILEINFO",       0, DEFDESCRIPT },
    { 8,  "TRANSACT2_SETFILEINFO",     0, DEFDESCRIPT },
    { 9,  "TRANSACT2_FSCTL",           0, DEFDESCRIPT },
    { 10, "TRANSACT2_IOCTL",           0, DEFDESCRIPT },
    { 11, "TRANSACT2_FINDNOTIFYFIRST", 0, DEFDESCRIPT },
    { 12, "TRANSACT2_FINDNOTIFYNEXT",  0, DEFDESCRIPT },
    { 13, "TRANSACT2_MKDIR",           0, DEFDESCRIPT },
    { -1, NULL,                        0, DEFDESCRIPT }
  };

static void print_trans2 (uchar *words, uchar *dat, uchar *buf, uchar *maxbuf)
{
  static struct smbfns *fn = &trans2_fns[0];
  uchar  *data, *param;
  uchar  *f1 = NULL;
  uchar  *f2 = NULL;
  int     pcnt, dcnt;

  if (request)
  {
    fn    = smbfind (SVAL (words + 1, 14 * 2), trans2_fns);
    data  = buf + SVAL (words + 1, 12 * 2);
    param = buf + SVAL (words + 1, 10 * 2);
    pcnt  = SVAL (words + 1, 9 * 2);
    dcnt  = SVAL (words + 1, 11 * 2);
  }
  else
  {
    data  = buf + SVAL (words + 1, 7 * 2);
    param = buf + SVAL (words + 1, 4 * 2);
    pcnt  = SVAL (words + 1, 3 * 2);
    dcnt  = SVAL (words + 1, 6 * 2);
  }

  PRINTF ("%s param_length=%d data_length=%d\n",
          fn->name, pcnt, dcnt);

  if (request)
  {
    if (CVAL (words, 0) == 8)
    {
      fdata (words + 1,
             "Trans2Secondary\nTotParam=[d]\nTotData=[d]\nParamCnt=[d]\n"
             "ParamOff=[d]\nParamDisp=[d]\nDataCnt=[d]\nDataOff=[d]\n"
             "DataDisp=[d]\nHandle=[d]\n", maxbuf);
      return;
    }
    else
    {
      fdata (words + 1,
             "TotParam=[d]\nTotData=[d]\nMaxParam=[d]\nMaxData=[d]\n"
             "MaxSetup=[d]\nFlags=[w]\nTimeOut=[D]\nRes1=[w]\nParamCnt=[d]\n"
             "ParamOff=[d]\nDataCnt=[d]\nDataOff=[d]\nSetupCnt=[d]\n",
             words + 1 + 14 * 2);
      fdata (data + 1, "TransactionName=[S]\n%", maxbuf);
    }
    f1 = fn->descript.req_f1;
    f2 = fn->descript.req_f2;
  }
  else
  {
    if (CVAL (words, 0) == 0)
    {
      PUTS ("Trans2Interim\n");
      return;
    }
    fdata (words + 1,
           "TotParam=[d]\nTotData=[d]\nRes1=[w]\nParamCnt=[d]\n"
           "ParamOff=[d]\nParamDisp[d]\nDataCnt=[d]\nDataOff=[d]\n"
           "DataDisp=[d]\nSetupCnt=[d]\n", words + 1 + 10 * 2);
    f1 = fn->descript.rep_f1;
    f2 = fn->descript.rep_f2;
  }

  if (fn->descript.fn)
    fn->descript.fn (param, data, pcnt, dcnt);
  else
  {
    fdata (param, f1 ? f1 : (uchar *) "Paramaters=\n", param + pcnt);
    fdata (data, f2 ? f2 : (uchar *) "Data=\n", data + dcnt);
  }
}


static void print_browse (uchar *param, int paramlen, uchar *data, int datalen)
{
  uchar *maxbuf = data + datalen;
  int   command = CVAL (data, 0);

  fdata (param, "BROWSE PACKET\n|Param ", param + paramlen);

  switch (command)
  {
    case 0xF:
         data = fdata (data,
                       "BROWSE PACKET:\nType=[B] (LocalMasterAnnouncement)\n"
                       "UpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\n"
                       "Name=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\n"
                       "ServerType=[W]\nElectionVersion=[w]\n"
                       "BrowserConstant=[w]\n", maxbuf);
         break;

    case 0x1:
         data = fdata (data,
                       "BROWSE PACKET:\nType=[B] (HostAnnouncement)\n"
                       "UpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\n"
                       "Name=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\n"
                       "ServerType=[W]\nElectionVersion=[w]\n"
                       "BrowserConstant=[w]\n", maxbuf);
         break;

    case 0x2:
         data = fdata (data,
                       "BROWSE PACKET:\nType=[B] (AnnouncementRequest)\n"
                       "Flags=[B]\nReplySystemName=[S]\n", maxbuf);
         break;

    case 0xc:
         data = fdata (data,
                       "BROWSE PACKET:\nType=[B] (WorkgroupAnnouncement)\n"
                       "UpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\n"
                       "Name=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\n"
                       "ServerType=[W]\nCommentPointer=[W]\nServerName=[S]\n",
                       maxbuf);
         break;

    case 0x8:
         data = fdata (data,
                       "BROWSE PACKET:\nType=[B] (ElectionFrame)\n"
                       "ElectionVersion=[B]\nOSSummary=[W]\nUptime=[(W,W)]\n"
                       "ServerName=[S]\n", maxbuf);
         break;

    case 0xb:
         data = fdata (data,
                       "BROWSE PACKET:\nType=[B] (BecomeBackupBrowser)\n"
                       "Name=[S]\n", maxbuf);
         break;

    case 0x9:
         data = fdata (data,
                       "BROWSE PACKET:\nType=[B] (GetBackupList)"
                       "\nListCount?=[B]\nToken?=[B]\n", maxbuf);
         break;

    case 0xa:
         data = fdata (data,
                       "BROWSE PACKET:\nType=[B] (BackupListResponse)\n"
                       "ServerCount?=[B]\nToken?=[B]*Name=[S]\n", maxbuf);
         break;

    case 0xd:
         data = fdata (data,
                       "BROWSE PACKET:\nType=[B] (MasterAnnouncement)\n"
                       "MasterName=[S]\n", maxbuf);
         break;

    case 0xe:
         data = fdata (data,
                       "BROWSE PACKET:\nType=[B] (ResetBrowser)\n"
                       "Options=[B]\n", maxbuf);
         break;

    default:
         data = fdata (data, "Unknown Browser Frame ", maxbuf);
         break;
  }
}


static void print_ipc (uchar *param, int paramlen, uchar *data, int datalen)
{
  if (paramlen)
     fdata (param, "Command=[w]\nStr1=[S]\nStr2=[S]\n", param + paramlen);
  if (datalen)
     fdata (data, "IPC ", data + datalen);
}

static void print_trans (uchar *words, uchar *data1, uchar *buf, uchar *maxbuf)
{
  uchar *f1, *f2, *f3, *f4;
  uchar *data, *param;
  int    datalen, paramlen;

  if (request)
  {
    paramlen = SVAL (words + 1, 9 * 2);
    param    = buf + SVAL (words + 1, 10 * 2);
    datalen  = SVAL (words + 1, 11 * 2);
    data     = buf + SVAL (words + 1, 12 * 2);
    f1 = "TotParamCnt=[d]\nTotDataCnt=[d] \nMaxParmCnt=[d] \n"
         "MaxDataCnt=[d]\nMaxSCnt=[d] \nTransFlags=[w] \nRes1=[w] \n"
         "Res2=[w] \nRes3=[w]\nParamCnt=[d] \nParamOff=[d] \nDataCnt=[d] \n"
         "DataOff=[d] \nSUCnt=[d]\n";
    f2 = "|Name=[S]\n";
    f3 = "|Param ";
    f4 = "|Data ";
  }
  else
  {
    paramlen = SVAL (words + 1, 3 * 2);
    param    = buf + SVAL (words + 1, 4 * 2);
    datalen  = SVAL (words + 1, 6 * 2);
    data     = buf + SVAL (words + 1, 7 * 2);
    f1 = "TotParamCnt=[d] \nTotDataCnt=[d] \nRes1=[d]\nParamCnt=[d] \n"
         "ParamOff=[d] \nRes2=[d] \nDataCnt=[d] \nDataOff=[d] \nRes3=[d]\n"
         "Lsetup=[d]\n";
    f2 = "|Unknown ";
    f3 = "|Param ";
    f4 = "|Data ";
  }

  fdata (words + 1, f1, MIN (words + 1 + 2 * CVAL (words, 0), maxbuf));
  fdata (data1 + 2, f2, maxbuf - (paramlen + datalen));

  if (!strcmp (data1 + 2, "\\MAILSLOT\\BROWSE"))
  {
    print_browse (param, paramlen, data, datalen);
    return;
  }

  if (!strcmp (data1 + 2, "\\PIPE\\LANMAN"))
  {
    print_ipc (param, paramlen, data, datalen);
    return;
  }

  if (paramlen)
     fdata (param, f3, MIN (param + paramlen, maxbuf));
  if (datalen)
     fdata (data, f4, MIN (data + datalen, maxbuf));
}

static void print_negprot (uchar *words, uchar *data, uchar *buf, uchar *maxbuf)
{
  uchar *f1 = NULL, *f2 = NULL;

  if (request)
  {
    f2 = "*|Dialect=[Z]\n";
  }
  else
  {
    if (CVAL (words, 0) == 1)
      f1 = "Core Protocol\nDialectIndex=[d]";

    else if (CVAL (words, 0) == 17)
      f1 = "NT1 Protocol\nDialectIndex=[d]\nSecMode=[B]\nMaxMux=[d]\n"
           "NumVcs=[d]\nMaxBuffer=[D]\nRawSize=[D]\nSessionKey=[W]\n"
           "Capabilities=[W]\nServerTime=[T3]TimeZone=[d]\nCryptKey=";

    else if (CVAL (words, 0) == 13)
      f1 = "Coreplus/Lanman1/Lanman2 Protocol\nDialectIndex=[d]\n"
           "SecMode=[w]\nMaxXMit=[d]\nMaxMux=[d]\nMaxVcs=[d]\n"
           "BlkMode=[w]\nSessionKey=[W]\nServerTime=[T1]TimeZone=[d]\n"
           "Res=[W]\nCryptKey=";
  }

  if (f1)
       fdata (words + 1, f1, MIN (words + 1 + CVAL (words, 0) * 2, maxbuf));
  else print_data (words + 1, MIN (CVAL(words,0)*2, PTR_DIFF(maxbuf, words+1)));