1 /* 2 * Copyright (C) Andrew Tridgell 1995-1999 3 * 4 * This software may be distributed either under the terms of the 5 * BSD-style license that accompanies tcpdump or the GNU GPL version 2 6 * or later 7 */ 8 9 #ifdef HAVE_CONFIG_H 10 #include "config.h" 11 #endif 12 13 #ifndef lint 14 static const char rcsid[] _U_ = 15 "@(#) $Header: /tcpdump/master/tcpdump/print-smb.c,v 1.47 2007-12-09 00:30:47 guy Exp $"; 16 #endif 17 18 #include <tcpdump-stdinc.h> 19 20 #include <stdio.h> 21 #include <string.h> 22 23 #include "interface.h" 24 #include "extract.h" 25 #include "smb.h" 26 27 static int request = 0; 28 static int unicodestr = 0; 29 30 const u_char *startbuf = NULL; 31 32 struct smbdescript { 33 const char *req_f1; 34 const char *req_f2; 35 const char *rep_f1; 36 const char *rep_f2; 37 void (*fn)(const u_char *, const u_char *, const u_char *, const u_char *); 38 }; 39 40 struct smbdescriptint { 41 const char *req_f1; 42 const char *req_f2; 43 const char *rep_f1; 44 const char *rep_f2; 45 void (*fn)(const u_char *, const u_char *, int, int); 46 }; 47 48 struct smbfns 49 { 50 int id; 51 const char *name; 52 int flags; 53 struct smbdescript descript; 54 }; 55 56 struct smbfnsint 57 { 58 int id; 59 const char *name; 60 int flags; 61 struct smbdescriptint descript; 62 }; 63 64 #define DEFDESCRIPT { NULL, NULL, NULL, NULL, NULL } 65 66 #define FLG_CHAIN (1 << 0) 67 68 static struct smbfns * 69 smbfind(int id, struct smbfns *list) 70 { 71 int sindex; 72 73 for (sindex = 0; list[sindex].name; sindex++) 74 if (list[sindex].id == id) 75 return(&list[sindex]); 76 77 return(&list[0]); 78 } 79 80 static struct smbfnsint * 81 smbfindint(int id, struct smbfnsint *list) 82 { 83 int sindex; 84 85 for (sindex = 0; list[sindex].name; sindex++) 86 if (list[sindex].id == id) 87 return(&list[sindex]); 88 89 return(&list[0]); 90 } 91 92 static void 93 trans2_findfirst(const u_char *param, const u_char *data, int pcnt, int dcnt) 94 { 95 const char *fmt; 96 97 if (request) 98 fmt = "Attribute=[A]\nSearchCount=[d]\nFlags=[w]\nLevel=[dP4]\nFile=[S]\n"; 99 else 100 fmt = "Handle=[w]\nCount=[d]\nEOS=[w]\nEoffset=[d]\nLastNameOfs=[w]\n"; 101 102 smb_fdata(param, fmt, param + pcnt, unicodestr); 103 if (dcnt) { 104 printf("data:\n"); 105 print_data(data, dcnt); 106 } 107 } 108 109 static void 110 trans2_qfsinfo(const u_char *param, const u_char *data, int pcnt, int dcnt) 111 { 112 static int level = 0; 113 const char *fmt=""; 114 115 if (request) { 116 TCHECK2(*param, 2); 117 level = EXTRACT_LE_16BITS(param); 118 fmt = "InfoLevel=[d]\n"; 119 smb_fdata(param, fmt, param + pcnt, unicodestr); 120 } else { 121 switch (level) { 122 case 1: 123 fmt = "idFileSystem=[W]\nSectorUnit=[D]\nUnit=[D]\nAvail=[D]\nSectorSize=[d]\n"; 124 break; 125 case 2: 126 fmt = "CreationTime=[T2]VolNameLength=[lb]\nVolumeLabel=[c]\n"; 127 break; 128 case 0x105: 129 fmt = "Capabilities=[W]\nMaxFileLen=[D]\nVolNameLen=[lD]\nVolume=[C]\n"; 130 break; 131 default: 132 fmt = "UnknownLevel\n"; 133 break; 134 } 135 smb_fdata(data, fmt, data + dcnt, unicodestr); 136 } 137 if (dcnt) { 138 printf("data:\n"); 139 print_data(data, dcnt); 140 } 141 return; 142 trunc: 143 printf("[|SMB]"); 144 return; 145 } 146 147 struct smbfnsint trans2_fns[] = { 148 { 0, "TRANSACT2_OPEN", 0, 149 { "Flags2=[w]\nMode=[w]\nSearchAttrib=[A]\nAttrib=[A]\nTime=[T2]\nOFun=[w]\nSize=[D]\nRes=([w, w, w, w, w])\nPath=[S]", 150 NULL, 151 "Handle=[d]\nAttrib=[A]\nTime=[T2]\nSize=[D]\nAccess=[w]\nType=[w]\nState=[w]\nAction=[w]\nInode=[W]\nOffErr=[d]\n|EALength=[d]\n", 152 NULL, NULL }}, 153 { 1, "TRANSACT2_FINDFIRST", 0, 154 { NULL, NULL, NULL, NULL, trans2_findfirst }}, 155 { 2, "TRANSACT2_FINDNEXT", 0, DEFDESCRIPT }, 156 { 3, "TRANSACT2_QFSINFO", 0, 157 { NULL, NULL, NULL, NULL, trans2_qfsinfo }}, 158 { 4, "TRANSACT2_SETFSINFO", 0, DEFDESCRIPT }, 159 { 5, "TRANSACT2_QPATHINFO", 0, DEFDESCRIPT }, 160 { 6, "TRANSACT2_SETPATHINFO", 0, DEFDESCRIPT }, 161 { 7, "TRANSACT2_QFILEINFO", 0, DEFDESCRIPT }, 162 { 8, "TRANSACT2_SETFILEINFO", 0, DEFDESCRIPT }, 163 { 9, "TRANSACT2_FSCTL", 0, DEFDESCRIPT }, 164 { 10, "TRANSACT2_IOCTL", 0, DEFDESCRIPT }, 165 { 11, "TRANSACT2_FINDNOTIFYFIRST", 0, DEFDESCRIPT }, 166 { 12, "TRANSACT2_FINDNOTIFYNEXT", 0, DEFDESCRIPT }, 167 { 13, "TRANSACT2_MKDIR", 0, DEFDESCRIPT }, 168 { -1, NULL, 0, DEFDESCRIPT } 169 }; 170 171 172 static void 173 print_trans2(const u_char *words, const u_char *dat, const u_char *buf, const u_char *maxbuf) 174 { 175 u_int bcc; 176 static struct smbfnsint *fn = &trans2_fns[0]; 177 const u_char *data, *param; 178 const u_char *w = words + 1; 179 const char *f1 = NULL, *f2 = NULL; 180 int pcnt, dcnt; 181 182 TCHECK(words[0]); 183 if (request) { 184 TCHECK2(w[14 * 2], 2); 185 pcnt = EXTRACT_LE_16BITS(w + 9 * 2); 186 param = buf + EXTRACT_LE_16BITS(w + 10 * 2); 187 dcnt = EXTRACT_LE_16BITS(w + 11 * 2); 188 data = buf + EXTRACT_LE_16BITS(w + 12 * 2); 189 fn = smbfindint(EXTRACT_LE_16BITS(w + 14 * 2), trans2_fns); 190 } else { 191 if (words[0] == 0) { 192 printf("%s\n", fn->name); 193 printf("Trans2Interim\n"); 194 return; 195 } 196 TCHECK2(w[7 * 2], 2); 197 pcnt = EXTRACT_LE_16BITS(w + 3 * 2); 198 param = buf + EXTRACT_LE_16BITS(w + 4 * 2); 199 dcnt = EXTRACT_LE_16BITS(w + 6 * 2); 200 data = buf + EXTRACT_LE_16BITS(w + 7 * 2); 201 } 202 203 printf("%s param_length=%d data_length=%d\n", fn->name, pcnt, dcnt); 204 205 if (request) { 206 if (words[0] == 8) { 207 smb_fdata(words + 1, 208 "Trans2Secondary\nTotParam=[d]\nTotData=[d]\nParamCnt=[d]\nParamOff=[d]\nParamDisp=[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nHandle=[d]\n", 209 maxbuf, unicodestr); 210 return; 211 } else { 212 smb_fdata(words + 1, 213 "TotParam=[d]\nTotData=[d]\nMaxParam=[d]\nMaxData=[d]\nMaxSetup=[b][P1]\nFlags=[w]\nTimeOut=[D]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nDataCnt=[d]\nDataOff=[d]\nSetupCnt=[b][P1]\n", 214 words + 1 + 14 * 2, unicodestr); 215 } 216 f1 = fn->descript.req_f1; 217 f2 = fn->descript.req_f2; 218 } else { 219 smb_fdata(words + 1, 220 "TotParam=[d]\nTotData=[d]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nParamDisp[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nSetupCnt=[b][P1]\n", 221 words + 1 + 10 * 2, unicodestr); 222 f1 = fn->descript.rep_f1; 223 f2 = fn->descript.rep_f2; 224 } 225 226 TCHECK2(*dat, 2); 227 bcc = EXTRACT_LE_16BITS(dat); 228 printf("smb_bcc=%u\n", bcc); 229 if (fn->descript.fn) 230 (*fn->descript.fn)(param, data, pcnt, dcnt); 231 else { 232 smb_fdata(param, f1 ? f1 : "Parameters=\n", param + pcnt, unicodestr); 233 smb_fdata(data, f2 ? f2 : "Data=\n", data + dcnt, unicodestr); 234 } 235 return; 236 trunc: 237 printf("[|SMB]"); 238 return; 239 } 240 241 242 static void 243 print_browse(const u_char *param, int paramlen, const u_char *data, int datalen) 244 { 245 const u_char *maxbuf = data + datalen; 246 int command; 247 248 TCHECK(data[0]); 249 command = data[0]; 250 251 smb_fdata(param, "BROWSE PACKET\n|Param ", param+paramlen, unicodestr); 252 253 switch (command) { 254 case 0xF: 255 data = smb_fdata(data, 256 "BROWSE PACKET:\nType=[B] (LocalMasterAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nElectionVersion=[w]\nBrowserConstant=[w]\n", 257 maxbuf, unicodestr); 258 break; 259 260 case 0x1: 261 data = smb_fdata(data, 262 "BROWSE PACKET:\nType=[B] (HostAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nElectionVersion=[w]\nBrowserConstant=[w]\n", 263 maxbuf, unicodestr); 264 break; 265 266 case 0x2: 267 data = smb_fdata(data, 268 "BROWSE PACKET:\nType=[B] (AnnouncementRequest)\nFlags=[B]\nReplySystemName=[S]\n", 269 maxbuf, unicodestr); 270 break; 271 272 case 0xc: 273 data = smb_fdata(data, 274 "BROWSE PACKET:\nType=[B] (WorkgroupAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nCommentPointer=[W]\nServerName=[S]\n", 275 maxbuf, unicodestr); 276 break; 277 278 case 0x8: 279 data = smb_fdata(data, 280 "BROWSE PACKET:\nType=[B] (ElectionFrame)\nElectionVersion=[B]\nOSSummary=[W]\nUptime=[(W, W)]\nServerName=[S]\n", 281 maxbuf, unicodestr); 282 break; 283 284 case 0xb: 285 data = smb_fdata(data, 286 "BROWSE PACKET:\nType=[B] (BecomeBackupBrowser)\nName=[S]\n", 287 maxbuf, unicodestr); 288 break; 289 290 case 0x9: 291 data = smb_fdata(data, 292 "BROWSE PACKET:\nType=[B] (GetBackupList)\nListCount?=[B]\nToken=[W]\n", 293 maxbuf, unicodestr); 294 break; 295 296 case 0xa: 297 data = smb_fdata(data, 298 "BROWSE PACKET:\nType=[B] (BackupListResponse)\nServerCount?=[B]\nToken=[W]\n*Name=[S]\n", 299 maxbuf, unicodestr); 300 break; 301 302 case 0xd: 303 data = smb_fdata(data, 304 "BROWSE PACKET:\nType=[B] (MasterAnnouncement)\nMasterName=[S]\n", 305 maxbuf, unicodestr); 306 break; 307 308 case 0xe: 309 data = smb_fdata(data, 310 "BROWSE PACKET:\nType=[B] (ResetBrowser)\nOptions=[B]\n", maxbuf, unicodestr); 311 break; 312 313 default: 314 data = smb_fdata(data, "Unknown Browser Frame ", maxbuf, unicodestr); 315 break; 316 } 317 return; 318 trunc: 319 printf("[|SMB]"); 320 return; 321 } 322 323 324 static void 325 print_ipc(const u_char *param, int paramlen, const u_char *data, int datalen) 326 { 327 if (paramlen) 328 smb_fdata(param, "Command=[w]\nStr1=[S]\nStr2=[S]\n", param + paramlen, 329 unicodestr); 330 if (datalen) 331 smb_fdata(data, "IPC ", data + datalen, unicodestr); 332 } 333 334 335 static void 336 print_trans(const u_char *words, const u_char *data1, const u_char *buf, const u_char *maxbuf) 337 { 338 u_int bcc; 339 const char *f1, *f2, *f3, *f4; 340 const u_char *data, *param; 341 const u_char *w = words + 1; 342 int datalen, paramlen; 343 344 if (request) { 345 TCHECK2(w[12 * 2], 2); 346 paramlen = EXTRACT_LE_16BITS(w + 9 * 2); 347 param = buf + EXTRACT_LE_16BITS(w + 10 * 2); 348 datalen = EXTRACT_LE_16BITS(w + 11 * 2); 349 data = buf + EXTRACT_LE_16BITS(w + 12 * 2); 350 f1 = "TotParamCnt=[d] \nTotDataCnt=[d] \nMaxParmCnt=[d] \nMaxDataCnt=[d]\nMaxSCnt=[d] \nTransFlags=[w] \nRes1=[w] \nRes2=[w] \nRes3=[w]\nParamCnt=[d] \nParamOff=[d] \nDataCnt=[d] \nDataOff=[d] \nSUCnt=[d]\n"; 351 f2 = "|Name=[S]\n"; 352 f3 = "|Param "; 353 f4 = "|Data "; 354 } else { 355 TCHECK2(w[7 * 2], 2); 356 paramlen = EXTRACT_LE_16BITS(w + 3 * 2); 357 param = buf + EXTRACT_LE_16BITS(w + 4 * 2); 358 datalen = EXTRACT_LE_16BITS(w + 6 * 2); 359 data = buf + EXTRACT_LE_16BITS(w + 7 * 2); 360 f1 = "TotParamCnt=[d] \nTotDataCnt=[d] \nRes1=[d]\nParamCnt=[d] \nParamOff=[d] \nRes2=[d] \nDataCnt=[d] \nDataOff=[d] \nRes3=[d]\nLsetup=[d]\n"; 361 f2 = "|Unknown "; 362 f3 = "|Param "; 363 f4 = "|Data "; 364 } 365 366 smb_fdata(words + 1, f1, SMBMIN(words + 1 + 2 * words[0], maxbuf), 367 unicodestr); 368 369 TCHECK2(*data1, 2); 370 bcc = EXTRACT_LE_16BITS(data1); 371 printf("smb_bcc=%u\n", bcc); 372 if (bcc > 0) { 373 smb_fdata(data1 + 2, f2, maxbuf - (paramlen + datalen), unicodestr); 374 375 if (strcmp((const char *)(data1 + 2), "\\MAILSLOT\\BROWSE") == 0) { 376 print_browse(param, paramlen, data, datalen); 377 return; 378 } 379 380 if (strcmp((const char *)(data1 + 2), "\\PIPE\\LANMAN") == 0) { 381 print_ipc(param, paramlen, data, datalen); 382 return; 383 } 384 385 if (paramlen) 386 smb_fdata(param, f3, SMBMIN(param + paramlen, maxbuf), unicodestr); 387 if (datalen) 388 smb_fdata(data, f4, SMBMIN(data + datalen, maxbuf), unicodestr); 389 } 390 return; 391 trunc: 392 printf("[|SMB]"); 393 return; 394 } 395 396 397 static void 398 print_negprot(const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf) 399 { 400 u_int wct, bcc; 401 const char *f1 = NULL, *f2 = NULL; 402 403 TCHECK(words[0]); 404 wct = words[0]; 405 if (request) 406 f2 = "*|Dialect=[Y]\n"; 407 else { 408 if (wct == 1) 409 f1 = "Core Protocol\nDialectIndex=[d]"; 410 else if (wct == 17) 411 f1 = "NT1 Protocol\nDialectIndex=[d]\nSecMode=[B]\nMaxMux=[d]\nNumVcs=[d]\nMaxBuffer=[D]\nRawSize=[D]\nSessionKey=[W]\nCapabilities=[W]\nServerTime=[T3]TimeZone=[d]\nCryptKey="; 412 else if (wct == 13) 413 f1 = "Coreplus/Lanman1/Lanman2 Protocol\nDialectIndex=[d]\nSecMode=[w]\nMaxXMit=[d]\nMaxMux=[d]\nMaxVcs=[d]\nBlkMode=[w]\nSessionKey=[W]\nServerTime=[T1]TimeZone=[d]\nRes=[W]\nCryptKey="; 414 } 415 416 if (f1) 417 smb_fdata(words + 1, f1, SMBMIN(words + 1 + wct * 2, maxbuf), 418 unicodestr); 419 else 420 print_data(words + 1, SMBMIN(wct * 2, PTR_DIFF(maxbuf, words + 1))); 421 422 TCHECK2(*data, 2); 423 bcc = EXTRACT_LE_16BITS(data); 424 printf("smb_bcc=%u\n", bcc); 425 if (bcc > 0) { 426 if (f2) 427 smb_fdata(data + 2, f2, SMBMIN(data + 2 + EXTRACT_LE_16BITS(data), 428 maxbuf), unicodestr); 429 else 430 print_data(data + 2, SMBMIN(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2))); 431 } 432 return; 433 trunc: 434 printf("[|SMB]"); 435 return; 436 } 437 438 static void 439 print_sesssetup(const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf) 440 { 441 u_int wct, bcc; 442 const char *f1 = NULL, *f2 = NULL; 443 444 TCHECK(words[0]); 445 wct = words[0]; 446 if (request) { 447 if (wct == 10) 448 f1 = "Com2=[w]\nOff2=[d]\nBufSize=[d]\nMpxMax=[d]\nVcNum=[d]\nSessionKey=[W]\nPassLen=[d]\nCryptLen=[d]\nCryptOff=[d]\nPass&Name=\n"; 449 else 450 f1 = "Com2=[B]\nRes1=[B]\nOff2=[d]\nMaxBuffer=[d]\nMaxMpx=[d]\nVcNumber=[d]\nSessionKey=[W]\nCaseInsensitivePasswordLength=[d]\nCaseSensitivePasswordLength=[d]\nRes=[W]\nCapabilities=[W]\nPass1&Pass2&Account&Domain&OS&LanMan=\n"; 451 } else { 452 if (wct == 3) { 453 f1 = "Com2=[w]\nOff2=[d]\nAction=[w]\n"; 454 } else if (wct == 13) { 455 f1 = "Com2=[B]\nRes=[B]\nOff2=[d]\nAction=[w]\n"; 456 f2 = "NativeOS=[S]\nNativeLanMan=[S]\nPrimaryDomain=[S]\n"; 457 } 458 } 459 460 if (f1) 461 smb_fdata(words + 1, f1, SMBMIN(words + 1 + wct * 2, maxbuf), 462 unicodestr); 463 else 464 print_data(words + 1, SMBMIN(wct * 2, PTR_DIFF(maxbuf, words + 1))); 465 466 TCHECK2(*data, 2); 467 bcc = EXTRACT_LE_16BITS(data); 468 printf("smb_bcc=%u\n", bcc); 469 if (bcc > 0) { 470 if (f2) 471 smb_fdata(data + 2, f2, SMBMIN(data + 2 + EXTRACT_LE_16BITS(data), 472 maxbuf), unicodestr); 473 else 474 print_data(data + 2, SMBMIN(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2))); 475 } 476 return; 477 trunc: 478 printf("[|SMB]"); 479 return; 480 } 481 482 static void 483 print_lockingandx(const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf) 484 { 485 u_int wct, bcc; 486 const u_char *maxwords; 487 const char *f1 = NULL, *f2 = NULL; 488 489 TCHECK(words[0]); 490 wct = words[0]; 491 if (request) { 492 f1 = "Com2=[w]\nOff2=[d]\nHandle=[d]\nLockType=[w]\nTimeOut=[D]\nUnlockCount=[d]\nLockCount=[d]\n"; 493 TCHECK(words[7]); 494 if (words[7] & 0x10) 495 f2 = "*Process=[d]\n[P2]Offset=[M]\nLength=[M]\n"; 496 else 497 f2 = "*Process=[d]\nOffset=[D]\nLength=[D]\n"; 498 } else { 499 f1 = "Com2=[w]\nOff2=[d]\n"; 500 } 501 502 maxwords = SMBMIN(words + 1 + wct * 2, maxbuf); 503 if (wct) 504 smb_fdata(words + 1, f1, maxwords, unicodestr); 505 506 TCHECK2(*data, 2); 507 bcc = EXTRACT_LE_16BITS(data); 508 printf("smb_bcc=%u\n", bcc); 509 if (bcc > 0) { 510 if (f2) 511 smb_fdata(data + 2, f2, SMBMIN(data + 2 + EXTRACT_LE_16BITS(data), 512 maxbuf), unicodestr); 513 else 514 print_data(data + 2, SMBMIN(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2))); 515 } 516 return; 517 trunc: 518 printf("[|SMB]"); 519 return; 520 } 521 522 523 static struct smbfns smb_fns[] = { 524 { -1, "SMBunknown", 0, DEFDESCRIPT }, 525 526 { SMBtcon, "SMBtcon", 0, 527 { NULL, "Path=[Z]\nPassword=[Z]\nDevice=[Z]\n", 528 "MaxXmit=[d]\nTreeId=[d]\n", NULL, 529 NULL } }, 530 531 { SMBtdis, "SMBtdis", 0, DEFDESCRIPT }, 532 { SMBexit, "SMBexit", 0, DEFDESCRIPT }, 533 { SMBioctl, "SMBioctl", 0, DEFDESCRIPT }, 534 535 { SMBecho, "SMBecho", 0, 536 { "ReverbCount=[d]\n", NULL, 537 "SequenceNum=[d]\n", NULL, 538 NULL } }, 539 540 { SMBulogoffX, "SMBulogoffX", FLG_CHAIN, DEFDESCRIPT }, 541 542 { SMBgetatr, "SMBgetatr", 0, 543 { NULL, "Path=[Z]\n", 544 "Attribute=[A]\nTime=[T2]Size=[D]\nRes=([w,w,w,w,w])\n", NULL, 545 NULL } }, 546 547 { SMBsetatr, "SMBsetatr", 0, 548 { "Attribute=[A]\nTime=[T2]Res=([w,w,w,w,w])\n", "Path=[Z]\n", 549 NULL, NULL, NULL } }, 550 551 { SMBchkpth, "SMBchkpth", 0, 552 { NULL, "Path=[Z]\n", NULL, NULL, NULL } }, 553 554 { SMBsearch, "SMBsearch", 0, 555 { "Count=[d]\nAttrib=[A]\n", 556 "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\n", 557 "Count=[d]\n", 558 "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n", 559 NULL } }, 560 561 { SMBopen, "SMBopen", 0, 562 { "Mode=[w]\nAttribute=[A]\n", "Path=[Z]\n", 563 "Handle=[d]\nOAttrib=[A]\nTime=[T2]Size=[D]\nAccess=[w]\n", 564 NULL, NULL } }, 565 566 { SMBcreate, "SMBcreate", 0, 567 { "Attrib=[A]\nTime=[T2]", "Path=[Z]\n", "Handle=[d]\n", NULL, NULL } }, 568 569 { SMBmknew, "SMBmknew", 0, 570 { "Attrib=[A]\nTime=[T2]", "Path=[Z]\n", "Handle=[d]\n", NULL, NULL } }, 571 572 { SMBunlink, "SMBunlink", 0, 573 { "Attrib=[A]\n", "Path=[Z]\n", NULL, NULL, NULL } }, 574 575 { SMBread, "SMBread", 0, 576 { "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL, 577 "Count=[d]\nRes=([w,w,w,w])\n", NULL, NULL } }, 578 579 { SMBwrite, "SMBwrite", 0, 580 { "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL, 581 "Count=[d]\n", NULL, NULL } }, 582 583 { SMBclose, "SMBclose", 0, 584 { "Handle=[d]\nTime=[T2]", NULL, NULL, NULL, NULL } }, 585 586 { SMBmkdir, "SMBmkdir", 0, 587 { NULL, "Path=[Z]\n", NULL, NULL, NULL } }, 588 589 { SMBrmdir, "SMBrmdir", 0, 590 { NULL, "Path=[Z]\n", NULL, NULL, NULL } }, 591 592 { SMBdskattr, "SMBdskattr", 0, 593 { NULL, NULL, 594 "TotalUnits=[d]\nBlocksPerUnit=[d]\nBlockSize=[d]\nFreeUnits=[d]\nMedia=[w]\n", 595 NULL, NULL } }, 596 597 { SMBmv, "SMBmv", 0, 598 { "Attrib=[A]\n", "OldPath=[Z]\nNewPath=[Z]\n", NULL, NULL, NULL } }, 599 600 /* 601 * this is a Pathworks specific call, allowing the 602 * changing of the root path 603 */ 604 { pSETDIR, "SMBsetdir", 0, { NULL, "Path=[Z]\n", NULL, NULL, NULL } }, 605 606 { SMBlseek, "SMBlseek", 0, 607 { "Handle=[d]\nMode=[w]\nOffset=[D]\n", "Offset=[D]\n", NULL, NULL, NULL } }, 608 609 { SMBflush, "SMBflush", 0, { "Handle=[d]\n", NULL, NULL, NULL, NULL } }, 610 611 { SMBsplopen, "SMBsplopen", 0, 612 { "SetupLen=[d]\nMode=[w]\n", "Ident=[Z]\n", "Handle=[d]\n", 613 NULL, NULL } }, 614 615 { SMBsplclose, "SMBsplclose", 0, 616 { "Handle=[d]\n", NULL, NULL, NULL, NULL } }, 617 618 { SMBsplretq, "SMBsplretq", 0, 619 { "MaxCount=[d]\nStartIndex=[d]\n", NULL, 620 "Count=[d]\nIndex=[d]\n", 621 "*Time=[T2]Status=[B]\nJobID=[d]\nSize=[D]\nRes=[B]Name=[s16]\n", 622 NULL } }, 623 624 { SMBsplwr, "SMBsplwr", 0, 625 { "Handle=[d]\n", NULL, NULL, NULL, NULL } }, 626 627 { SMBlock, "SMBlock", 0, 628 { "Handle=[d]\nCount=[D]\nOffset=[D]\n", NULL, NULL, NULL, NULL } }, 629 630 { SMBunlock, "SMBunlock", 0, 631 { "Handle=[d]\nCount=[D]\nOffset=[D]\n", NULL, NULL, NULL, NULL } }, 632 633 /* CORE+ PROTOCOL FOLLOWS */ 634 635 { SMBreadbraw, "SMBreadbraw", 0, 636 { "Handle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nRes=[d]\n", 637 NULL, NULL, NULL, NULL } }, 638 639 { SMBwritebraw, "SMBwritebraw", 0, 640 { "Handle=[d]\nTotalCount=[d]\nRes=[w]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nRes2=[W]\n|DataSize=[d]\nDataOff=[d]\n", 641 NULL, "WriteRawAck", NULL, NULL } }, 642 643 { SMBwritec, "SMBwritec", 0, 644 { NULL, NULL, "Count=[d]\n", NULL, NULL } }, 645 646 { SMBwriteclose, "SMBwriteclose", 0, 647 { "Handle=[d]\nCount=[d]\nOffset=[D]\nTime=[T2]Res=([w,w,w,w,w,w])", 648 NULL, "Count=[d]\n", NULL, NULL } }, 649 650 { SMBlockread, "SMBlockread", 0, 651 { "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL, 652 "Count=[d]\nRes=([w,w,w,w])\n", NULL, NULL } }, 653 654 { SMBwriteunlock, "SMBwriteunlock", 0, 655 { "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL, 656 "Count=[d]\n", NULL, NULL } }, 657 658 { SMBreadBmpx, "SMBreadBmpx", 0, 659 { "Handle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nRes=[w]\n", 660 NULL, 661 "Offset=[D]\nTotCount=[d]\nRemaining=[d]\nRes=([w,w])\nDataSize=[d]\nDataOff=[d]\n", 662 NULL, NULL } }, 663 664 { SMBwriteBmpx, "SMBwriteBmpx", 0, 665 { "Handle=[d]\nTotCount=[d]\nRes=[w]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nRes2=[W]\nDataSize=[d]\nDataOff=[d]\n", NULL, 666 "Remaining=[d]\n", NULL, NULL } }, 667 668 { SMBwriteBs, "SMBwriteBs", 0, 669 { "Handle=[d]\nTotCount=[d]\nOffset=[D]\nRes=[W]\nDataSize=[d]\nDataOff=[d]\n", 670 NULL, "Count=[d]\n", NULL, NULL } }, 671 672 { SMBsetattrE, "SMBsetattrE", 0, 673 { "Handle=[d]\nCreationTime=[T2]AccessTime=[T2]ModifyTime=[T2]", NULL, 674 NULL, NULL, NULL } }, 675 676 { SMBgetattrE, "SMBgetattrE", 0, 677 { "Handle=[d]\n", NULL, 678 "CreationTime=[T2]AccessTime=[T2]ModifyTime=[T2]Size=[D]\nAllocSize=[D]\nAttribute=[A]\n", 679 NULL, NULL } }, 680 681 { SMBtranss, "SMBtranss", 0, DEFDESCRIPT }, 682 { SMBioctls, "SMBioctls", 0, DEFDESCRIPT }, 683 684 { SMBcopy, "SMBcopy", 0, 685 { "TreeID2=[d]\nOFun=[w]\nFlags=[w]\n", "Path=[S]\nNewPath=[S]\n", 686 "CopyCount=[d]\n", "|ErrStr=[S]\n", NULL } }, 687 688 { SMBmove, "SMBmove", 0, 689 { "TreeID2=[d]\nOFun=[w]\nFlags=[w]\n", "Path=[S]\nNewPath=[S]\n", 690 "MoveCount=[d]\n", "|ErrStr=[S]\n", NULL } }, 691 692 { SMBopenX, "SMBopenX", FLG_CHAIN, 693 { "Com2=[w]\nOff2=[d]\nFlags=[w]\nMode=[w]\nSearchAttrib=[A]\nAttrib=[A]\nTime=[T2]OFun=[w]\nSize=[D]\nTimeOut=[D]\nRes=[W]\n", 694 "Path=[S]\n", 695 "Com2=[w]\nOff2=[d]\nHandle=[d]\nAttrib=[A]\nTime=[T2]Size=[D]\nAccess=[w]\nType=[w]\nState=[w]\nAction=[w]\nFileID=[W]\nRes=[w]\n", 696 NULL, NULL } }, 697 698 { SMBreadX, "SMBreadX", FLG_CHAIN, 699 { "Com2=[w]\nOff2=[d]\nHandle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nCountLeft=[d]\n", 700 NULL, 701 "Com2=[w]\nOff2=[d]\nRemaining=[d]\nRes=[W]\nDataSize=[d]\nDataOff=[d]\nRes=([w,w,w,w])\n", 702 NULL, NULL } }, 703 704 { SMBwriteX, "SMBwriteX", FLG_CHAIN, 705 { "Com2=[w]\nOff2=[d]\nHandle=[d]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nCountLeft=[d]\nRes=[w]\nDataSize=[d]\nDataOff=[d]\n", 706 NULL, 707 "Com2=[w]\nOff2=[d]\nCount=[d]\nRemaining=[d]\nRes=[W]\n", 708 NULL, NULL } }, 709 710 { SMBffirst, "SMBffirst", 0, 711 { "Count=[d]\nAttrib=[A]\n", 712 "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n", 713 "Count=[d]\n", 714 "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n", 715 NULL } }, 716 717 { SMBfunique, "SMBfunique", 0, 718 { "Count=[d]\nAttrib=[A]\n", 719 "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n", 720 "Count=[d]\n", 721 "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n", 722 NULL } }, 723 724 { SMBfclose, "SMBfclose", 0, 725 { "Count=[d]\nAttrib=[A]\n", 726 "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n", 727 "Count=[d]\n", 728 "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n", 729 NULL } }, 730 731 { SMBfindnclose, "SMBfindnclose", 0, 732 { "Handle=[d]\n", NULL, NULL, NULL, NULL } }, 733 734 { SMBfindclose, "SMBfindclose", 0, 735 { "Handle=[d]\n", NULL, NULL, NULL, NULL } }, 736 737 { SMBsends, "SMBsends", 0, 738 { NULL, "Source=[Z]\nDest=[Z]\n", NULL, NULL, NULL } }, 739 740 { SMBsendstrt, "SMBsendstrt", 0, 741 { NULL, "Source=[Z]\nDest=[Z]\n", "GroupID=[d]\n", NULL, NULL } }, 742 743 { SMBsendend, "SMBsendend", 0, 744 { "GroupID=[d]\n", NULL, NULL, NULL, NULL } }, 745 746 { SMBsendtxt, "SMBsendtxt", 0, 747 { "GroupID=[d]\n", NULL, NULL, NULL, NULL } }, 748 749 { SMBsendb, "SMBsendb", 0, 750 { NULL, "Source=[Z]\nDest=[Z]\n", NULL, NULL, NULL } }, 751 752 { SMBfwdname, "SMBfwdname", 0, DEFDESCRIPT }, 753 { SMBcancelf, "SMBcancelf", 0, DEFDESCRIPT }, 754 { SMBgetmac, "SMBgetmac", 0, DEFDESCRIPT }, 755 756 { SMBnegprot, "SMBnegprot", 0, 757 { NULL, NULL, NULL, NULL, print_negprot } }, 758 759 { SMBsesssetupX, "SMBsesssetupX", FLG_CHAIN, 760 { NULL, NULL, NULL, NULL, print_sesssetup } }, 761 762 { SMBtconX, "SMBtconX", FLG_CHAIN, 763 { "Com2=[w]\nOff2=[d]\nFlags=[w]\nPassLen=[d]\nPasswd&Path&Device=\n", 764 NULL, "Com2=[w]\nOff2=[d]\n", "ServiceType=[R]\n", NULL } }, 765 766 { SMBlockingX, "SMBlockingX", FLG_CHAIN, 767 { NULL, NULL, NULL, NULL, print_lockingandx } }, 768 769 { SMBtrans2, "SMBtrans2", 0, { NULL, NULL, NULL, NULL, print_trans2 } }, 770 771 { SMBtranss2, "SMBtranss2", 0, DEFDESCRIPT }, 772 { SMBctemp, "SMBctemp", 0, DEFDESCRIPT }, 773 { SMBreadBs, "SMBreadBs", 0, DEFDESCRIPT }, 774 { SMBtrans, "SMBtrans", 0, { NULL, NULL, NULL, NULL, print_trans } }, 775 776 { SMBnttrans, "SMBnttrans", 0, DEFDESCRIPT }, 777 { SMBnttranss, "SMBnttranss", 0, DEFDESCRIPT }, 778 779 { SMBntcreateX, "SMBntcreateX", FLG_CHAIN, 780 { "Com2=[w]\nOff2=[d]\nRes=[b]\nNameLen=[ld]\nFlags=[W]\nRootDirectoryFid=[D]\nAccessMask=[W]\nAllocationSize=[L]\nExtFileAttributes=[W]\nShareAccess=[W]\nCreateDisposition=[W]\nCreateOptions=[W]\nImpersonationLevel=[W]\nSecurityFlags=[b]\n", 781 "Path=[C]\n", 782 "Com2=[w]\nOff2=[d]\nOplockLevel=[b]\nFid=[d]\nCreateAction=[W]\nCreateTime=[T3]LastAccessTime=[T3]LastWriteTime=[T3]ChangeTime=[T3]ExtFileAttributes=[W]\nAllocationSize=[L]\nEndOfFile=[L]\nFileType=[w]\nDeviceState=[w]\nDirectory=[b]\n", 783 NULL, NULL } }, 784 785 { SMBntcancel, "SMBntcancel", 0, DEFDESCRIPT }, 786 787 { -1, NULL, 0, DEFDESCRIPT } 788 }; 789 790 791 /* 792 * print a SMB message 793 */ 794 static void 795 print_smb(const u_char *buf, const u_char *maxbuf) 796 { 797 u_int16_t flags2; 798 int nterrcodes; 799 int command; 800 u_int32_t nterror; 801 const u_char *words, *maxwords, *data; 802 struct smbfns *fn; 803 const char *fmt_smbheader = 804 "[P4]SMB Command = [B]\nError class = [BP1]\nError code = [d]\nFlags1 = [B]\nFlags2 = [B][P13]\nTree ID = [d]\nProc ID = [d]\nUID = [d]\nMID = [d]\nWord Count = [b]\n"; 805 int smboffset; 806 807 TCHECK(buf[9]); 808 request = (buf[9] & 0x80) ? 0 : 1; 809 flags2 = EXTRACT_LE_16BITS(&buf[10]); 810 unicodestr = flags2 & 0x8000; 811 nterrcodes = flags2 & 0x4000; 812 startbuf = buf; 813 814 command = buf[4]; 815 816 fn = smbfind(command, smb_fns); 817 818 if (vflag > 1) 819 printf("\n"); 820 821 printf("SMB PACKET: %s (%s)\n", fn->name, request ? "REQUEST" : "REPLY"); 822 823 if (vflag < 2) 824 return; 825 826 /* print out the header */ 827 smb_fdata(buf, fmt_smbheader, buf + 33, unicodestr); 828 829 if (nterrcodes) { 830 nterror = EXTRACT_LE_32BITS(&buf[5]); 831 if (nterror) 832 printf("NTError = %s\n", nt_errstr(nterror)); 833 } else { 834 if (buf[5]) 835 printf("SMBError = %s\n", smb_errstr(buf[5], EXTRACT_LE_16BITS(&buf[7]))); 836 } 837 838 smboffset = 32; 839 840 for (;;) { 841 const char *f1, *f2; 842 int wct; 843 u_int bcc; 844 int newsmboffset; 845 846 words = buf + smboffset; 847 TCHECK(words[0]); 848 wct = words[0]; 849 data = words + 1 + wct * 2; 850 maxwords = SMBMIN(data, maxbuf); 851 852 if (request) { 853 f1 = fn->descript.req_f1; 854 f2 = fn->descript.req_f2; 855 } else { 856 f1 = fn->descript.rep_f1; 857 f2 = fn->descript.rep_f2; 858 } 859 860 if (fn->descript.fn) 861 (*fn->descript.fn)(words, data, buf, maxbuf); 862 else { 863 if (wct) { 864 if (f1) 865 smb_fdata(words + 1, f1, words + 1 + wct * 2, unicodestr); 866 else { 867 int i; 868 int v; 869 870 for (i = 0; &words[1 + 2 * i] < maxwords; i++) { 871 TCHECK2(words[1 + 2 * i], 2); 872 v = EXTRACT_LE_16BITS(words + 1 + 2 * i); 873 printf("smb_vwv[%d]=%d (0x%X)\n", i, v, v); 874 } 875 } 876 } 877 878 TCHECK2(*data, 2); 879 bcc = EXTRACT_LE_16BITS(data); 880 printf("smb_bcc=%u\n", bcc); 881 if (f2) { 882 if (bcc > 0) 883 smb_fdata(data + 2, f2, data + 2 + bcc, unicodestr); 884 } else { 885 if (bcc > 0) { 886 printf("smb_buf[]=\n"); 887 print_data(data + 2, SMBMIN(bcc, PTR_DIFF(maxbuf, data + 2))); 888 } 889 } 890 } 891 892 if ((fn->flags & FLG_CHAIN) == 0) 893 break; 894 if (wct == 0) 895 break; 896 TCHECK(words[1]); 897 command = words[1]; 898 if (command == 0xFF) 899 break; 900 TCHECK2(words[3], 2); 901 newsmboffset = EXTRACT_LE_16BITS(words + 3); 902 903 fn = smbfind(command, smb_fns); 904 905 printf("\nSMB PACKET: %s (%s) (CHAINED)\n", 906 fn->name, request ? "REQUEST" : "REPLY"); 907 if (newsmboffset <= smboffset) { 908 printf("Bad andX offset: %u <= %u\n", newsmboffset, smboffset); 909 break; 910 } 911 smboffset = newsmboffset; 912 } 913 914 printf("\n"); 915 return; 916 trunc: 917 printf("[|SMB]"); 918 return; 919 } 920 921 922 /* 923 * print a NBT packet received across tcp on port 139 924 */ 925 void 926 nbt_tcp_print(const u_char *data, int length) 927 { 928 int caplen; 929 int type; 930 u_int nbt_len; 931 const u_char *maxbuf; 932 933 if (length < 4) 934 goto trunc; 935 if (snapend < data) 936 goto trunc; 937 caplen = snapend - data; 938 if (caplen < 4) 939 goto trunc; 940 maxbuf = data + caplen; 941 type = data[0]; 942 nbt_len = EXTRACT_16BITS(data + 2); 943 length -= 4; 944 caplen -= 4; 945 946 startbuf = data; 947 948 if (vflag < 2) { 949 printf(" NBT Session Packet: "); 950 switch (type) { 951 case 0x00: 952 printf("Session Message"); 953 break; 954 955 case 0x81: 956 printf("Session Request"); 957 break; 958 959 case 0x82: 960 printf("Session Granted"); 961 break; 962 963 case 0x83: 964 { 965 int ecode; 966 967 if (nbt_len < 4) 968 goto trunc; 969 if (length < 4) 970 goto trunc; 971 if (caplen < 4) 972 goto trunc; 973 ecode = data[4]; 974 975 printf("Session Reject, "); 976 switch (ecode) { 977 case 0x80: 978 printf("Not listening on called name"); 979 break; 980 case 0x81: 981 printf("Not listening for calling name"); 982 break; 983 case 0x82: 984 printf("Called name not present"); 985 break; 986 case 0x83: 987 printf("Called name present, but insufficient resources"); 988 break; 989 default: 990 printf("Unspecified error 0x%X", ecode); 991 break; 992 } 993 } 994 break; 995 996 case 0x85: 997 printf("Session Keepalive"); 998 break; 999 1000 default: 1001 data = smb_fdata(data, "Unknown packet type [rB]", maxbuf, 0); 1002 break; 1003 } 1004 } else { 1005 printf ("\n>>> NBT Session Packet\n"); 1006 switch (type) { 1007 case 0x00: 1008 data = smb_fdata(data, "[P1]NBT Session Message\nFlags=[B]\nLength=[rd]\n", 1009 data + 4, 0); 1010 if (data == NULL) 1011 break; 1012 if (nbt_len >= 4 && caplen >= 4 && memcmp(data,"\377SMB",4) == 0) { 1013 if ((int)nbt_len > caplen) { 1014 if ((int)nbt_len > length) 1015 printf("WARNING: Packet is continued in later TCP segments\n"); 1016 else 1017 printf("WARNING: Short packet. Try increasing the snap length by %d\n", 1018 nbt_len - caplen); 1019 } 1020 print_smb(data, maxbuf > data + nbt_len ? data + nbt_len : maxbuf); 1021 } else 1022 printf("Session packet:(raw data or continuation?)\n"); 1023 break; 1024 1025 case 0x81: 1026 data = smb_fdata(data, 1027 "[P1]NBT Session Request\nFlags=[B]\nLength=[rd]\nDestination=[n1]\nSource=[n1]\n", 1028 maxbuf, 0); 1029 break; 1030 1031 case 0x82: 1032 data = smb_fdata(data, "[P1]NBT Session Granted\nFlags=[B]\nLength=[rd]\n", maxbuf, 0); 1033 break; 1034 1035 case 0x83: 1036 { 1037 const u_char *origdata; 1038 int ecode; 1039 1040 origdata = data; 1041 data = smb_fdata(data, "[P1]NBT SessionReject\nFlags=[B]\nLength=[rd]\nReason=[B]\n", 1042 maxbuf, 0); 1043 if (data == NULL) 1044 break; 1045 if (nbt_len >= 1 && caplen >= 1) { 1046 ecode = origdata[4]; 1047 switch (ecode) { 1048 case 0x80: 1049 printf("Not listening on called name\n"); 1050 break; 1051 case 0x81: 1052 printf("Not listening for calling name\n"); 1053 break; 1054 case 0x82: 1055 printf("Called name not present\n"); 1056 break; 1057 case 0x83: 1058 printf("Called name present, but insufficient resources\n"); 1059 break; 1060 default: 1061 printf("Unspecified error 0x%X\n", ecode); 1062 break; 1063 } 1064 } 1065 } 1066 break; 1067 1068 case 0x85: 1069 data = smb_fdata(data, "[P1]NBT Session Keepalive\nFlags=[B]\nLength=[rd]\n", maxbuf, 0); 1070 break; 1071 1072 default: 1073 data = smb_fdata(data, "NBT - Unknown packet type\nType=[B]\n", maxbuf, 0); 1074 break; 1075 } 1076 printf("\n"); 1077 fflush(stdout); 1078 } 1079 return; 1080 trunc: 1081 printf("[|SMB]"); 1082 return; 1083 } 1084 1085 1086 /* 1087 * print a NBT packet received across udp on port 137 1088 */ 1089 void 1090 nbt_udp137_print(const u_char *data, int length) 1091 { 1092 const u_char *maxbuf = data + length; 1093 int name_trn_id, response, opcode, nm_flags, rcode; 1094 int qdcount, ancount, nscount, arcount; 1095 const char *opcodestr; 1096 const u_char *p; 1097 int total, i; 1098 1099 TCHECK2(data[10], 2); 1100 name_trn_id = EXTRACT_16BITS(data); 1101 response = (data[2] >> 7); 1102 opcode = (data[2] >> 3) & 0xF; 1103 nm_flags = ((data[2] & 0x7) << 4) + (data[3] >> 4); 1104 rcode = data[3] & 0xF; 1105 qdcount = EXTRACT_16BITS(data + 4); 1106 ancount = EXTRACT_16BITS(data + 6); 1107 nscount = EXTRACT_16BITS(data + 8); 1108 arcount = EXTRACT_16BITS(data + 10); 1109 startbuf = data; 1110 1111 if (maxbuf <= data) 1112 return; 1113 1114 if (vflag > 1) 1115 printf("\n>>> "); 1116 1117 printf("NBT UDP PACKET(137): "); 1118 1119 switch (opcode) { 1120 case 0: opcodestr = "QUERY"; break; 1121 case 5: opcodestr = "REGISTRATION"; break; 1122 case 6: opcodestr = "RELEASE"; break; 1123 case 7: opcodestr = "WACK"; break; 1124 case 8: opcodestr = "REFRESH(8)"; break; 1125 case 9: opcodestr = "REFRESH"; break; 1126 case 15: opcodestr = "MULTIHOMED REGISTRATION"; break; 1127 default: opcodestr = "OPUNKNOWN"; break; 1128 } 1129 printf("%s", opcodestr); 1130 if (response) { 1131 if (rcode) 1132 printf("; NEGATIVE"); 1133 else 1134 printf("; POSITIVE"); 1135 } 1136 1137 if (response) 1138 printf("; RESPONSE"); 1139 else 1140 printf("; REQUEST"); 1141 1142 if (nm_flags & 1) 1143 printf("; BROADCAST"); 1144 else 1145 printf("; UNICAST"); 1146 1147 if (vflag < 2) 1148 return; 1149 1150 printf("\nTrnID=0x%X\nOpCode=%d\nNmFlags=0x%X\nRcode=%d\nQueryCount=%d\nAnswerCount=%d\nAuthorityCount=%d\nAddressRecCount=%d\n", 1151 name_trn_id, opcode, nm_flags, rcode, qdcount, ancount, nscount, 1152 arcount); 1153 1154 p = data + 12; 1155 1156 total = ancount + nscount + arcount; 1157 1158 if (qdcount > 100 || total > 100) { 1159 printf("Corrupt packet??\n"); 1160 return; 1161 } 1162 1163 if (qdcount) { 1164 printf("QuestionRecords:\n"); 1165 for (i = 0; i < qdcount; i++) { 1166 p = smb_fdata(p, 1167 "|Name=[n1]\nQuestionType=[rw]\nQuestionClass=[rw]\n#", 1168 maxbuf, 0); 1169 if (p == NULL) 1170 goto out; 1171 } 1172 } 1173 1174 if (total) { 1175 printf("\nResourceRecords:\n"); 1176 for (i = 0; i < total; i++) { 1177 int rdlen; 1178 int restype; 1179 1180 p = smb_fdata(p, "Name=[n1]\n#", maxbuf, 0); 1181 if (p == NULL) 1182 goto out; 1183 restype = EXTRACT_16BITS(p); 1184 p = smb_fdata(p, "ResType=[rw]\nResClass=[rw]\nTTL=[rD]\n", p + 8, 0); 1185 if (p == NULL) 1186 goto out; 1187 rdlen = EXTRACT_16BITS(p); 1188 printf("ResourceLength=%d\nResourceData=\n", rdlen); 1189 p += 2; 1190 if (rdlen == 6) { 1191 p = smb_fdata(p, "AddrType=[rw]\nAddress=[b.b.b.b]\n", p + rdlen, 0); 1192 if (p == NULL) 1193 goto out; 1194 } else { 1195 if (restype == 0x21) { 1196 int numnames; 1197 1198 TCHECK(*p); 1199 numnames = p[0]; 1200 p = smb_fdata(p, "NumNames=[B]\n", p + 1, 0); 1201 if (p == NULL) 1202 goto out; 1203 while (numnames--) { 1204 p = smb_fdata(p, "Name=[n2]\t#", maxbuf, 0); 1205 if (p == NULL) 1206 goto out; 1207 TCHECK(*p); 1208 if (p[0] & 0x80) 1209 printf("<GROUP> "); 1210 switch (p[0] & 0x60) { 1211 case 0x00: printf("B "); break; 1212 case 0x20: printf("P "); break; 1213 case 0x40: printf("M "); break; 1214 case 0x60: printf("_ "); break; 1215 } 1216 if (p[0] & 0x10) 1217 printf("<DEREGISTERING> "); 1218 if (p[0] & 0x08) 1219 printf("<CONFLICT> "); 1220 if (p[0] & 0x04) 1221 printf("<ACTIVE> "); 1222 if (p[0] & 0x02) 1223 printf("<PERMANENT> "); 1224 printf("\n"); 1225 p += 2; 1226 } 1227 } else { 1228 print_data(p, min(rdlen, length - (p - data))); 1229 p += rdlen; 1230 } 1231 } 1232 } 1233 } 1234 1235 if (p < maxbuf) 1236 smb_fdata(p, "AdditionalData:\n", maxbuf, 0); 1237 1238 out: 1239 printf("\n"); 1240 fflush(stdout); 1241 return; 1242 trunc: 1243 printf("[|SMB]"); 1244 return; 1245 } 1246 1247 /* 1248 * Print an SMB-over-TCP packet received across tcp on port 445 1249 */ 1250 void 1251 smb_tcp_print (const u_char * data, int length) 1252 { 1253 int caplen; 1254 u_int smb_len; 1255 const u_char *maxbuf; 1256 1257 if (length < 4) 1258 goto trunc; 1259 if (snapend < data) 1260 goto trunc; 1261 caplen = snapend - data; 1262 if (caplen < 4) 1263 goto trunc; 1264 maxbuf = data + caplen; 1265 smb_len = EXTRACT_24BITS(data + 1); 1266 length -= 4; 1267 caplen -= 4; 1268 1269 startbuf = data; 1270 data += 4; 1271 1272 if (smb_len >= 4 && caplen >= 4 && memcmp(data,"\377SMB",4) == 0) { 1273 if ((int)smb_len > caplen) { 1274 if ((int)smb_len > length) 1275 printf("WARNING: Packet is continued in later TCP segments\n"); 1276 else 1277 printf("WARNING: Short packet. Try increasing the snap length by %d\n", 1278 smb_len - caplen); 1279 } 1280 print_smb(data, maxbuf > data + smb_len ? data + smb_len : maxbuf); 1281 } else 1282 printf("SMB-over-TCP packet:(raw data or continuation?)\n"); 1283 return; 1284 trunc: 1285 printf("[|SMB]"); 1286 return; 1287 } 1288 1289 /* 1290 * print a NBT packet received across udp on port 138 1291 */ 1292 void 1293 nbt_udp138_print(const u_char *data, int length) 1294 { 1295 const u_char *maxbuf = data + length; 1296 1297 if (maxbuf > snapend) 1298 maxbuf = snapend; 1299 if (maxbuf <= data) 1300 return; 1301 startbuf = data; 1302 1303 if (vflag < 2) { 1304 printf("NBT UDP PACKET(138)"); 1305 return; 1306 } 1307 1308 data = smb_fdata(data, 1309 "\n>>> NBT UDP PACKET(138) Res=[rw] ID=[rw] IP=[b.b.b.b] Port=[rd] Length=[rd] Res2=[rw]\nSourceName=[n1]\nDestName=[n1]\n#", 1310 maxbuf, 0); 1311 1312 if (data != NULL) { 1313 /* If there isn't enough data for "\377SMB", don't check for it. */ 1314 if (&data[3] >= maxbuf) 1315 goto out; 1316 1317 if (memcmp(data, "\377SMB",4) == 0) 1318 print_smb(data, maxbuf); 1319 } 1320 out: 1321 printf("\n"); 1322 fflush(stdout); 1323 } 1324 1325 1326 /* 1327 print netbeui frames 1328 */ 1329 struct nbf_strings { 1330 const char *name; 1331 const char *nonverbose; 1332 const char *verbose; 1333 } nbf_strings[0x20] = { 1334 { "Add Group Name Query", ", [P23]Name to add=[n2]#", 1335 "[P5]ResponseCorrelator=[w]\n[P16]Name to add=[n2]\n" }, 1336 { "Add Name Query", ", [P23]Name to add=[n2]#", 1337 "[P5]ResponseCorrelator=[w]\n[P16]Name to add=[n2]\n" }, 1338 { "Name In Conflict", NULL, NULL }, 1339 { "Status Query", NULL, NULL }, 1340 { NULL, NULL, NULL }, /* not used */ 1341 { NULL, NULL, NULL }, /* not used */ 1342 { NULL, NULL, NULL }, /* not used */ 1343 { "Terminate Trace", NULL, NULL }, 1344 { "Datagram", NULL, 1345 "[P7]Destination=[n2]\nSource=[n2]\n" }, 1346 { "Broadcast Datagram", NULL, 1347 "[P7]Destination=[n2]\nSource=[n2]\n" }, 1348 { "Name Query", ", [P7]Name=[n2]#", 1349 "[P1]SessionNumber=[B]\nNameType=[B][P2]\nResponseCorrelator=[w]\nName=[n2]\nName of sender=[n2]\n" }, 1350 { NULL, NULL, NULL }, /* not used */ 1351 { NULL, NULL, NULL }, /* not used */ 1352 { "Add Name Response", ", [P1]GroupName=[w] [P4]Destination=[n2] Source=[n2]#", 1353 "AddNameInProcess=[B]\nGroupName=[w]\nTransmitCorrelator=[w][P2]\nDestination=[n2]\nSource=[n2]\n" }, 1354 { "Name Recognized", NULL, 1355 "[P1]Data2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nDestination=[n2]\nSource=[n2]\n" }, 1356 { "Status Response", NULL, NULL }, 1357 { NULL, NULL, NULL }, /* not used */ 1358 { NULL, NULL, NULL }, /* not used */ 1359 { NULL, NULL, NULL }, /* not used */ 1360 { "Terminate Trace", NULL, NULL }, 1361 { "Data Ack", NULL, 1362 "[P3]TransmitCorrelator=[w][P2]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" }, 1363 { "Data First/Middle", NULL, 1364 "Flags=[{RECEIVE_CONTINUE|NO_ACK||PIGGYBACK_ACK_INCLUDED|}]\nResyncIndicator=[w][P2]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" }, 1365 { "Data Only/Last", NULL, 1366 "Flags=[{|NO_ACK|PIGGYBACK_ACK_ALLOWED|PIGGYBACK_ACK_INCLUDED|}]\nResyncIndicator=[w][P2]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" }, 1367 { "Session Confirm", NULL, 1368 "Data1=[B]\nData2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" }, 1369 { "Session End", NULL, 1370 "[P1]Data2=[w][P4]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" }, 1371 { "Session Initialize", NULL, 1372 "Data1=[B]\nData2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" }, 1373 { "No Receive", NULL, 1374 "Flags=[{|SEND_NO_ACK}]\nDataBytesAccepted=[b][P4]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" }, 1375 { "Receive Outstanding", NULL, 1376 "[P1]DataBytesAccepted=[b][P4]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" }, 1377 { "Receive Continue", NULL, 1378 "[P2]TransmitCorrelator=[w]\n[P2]RemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" }, 1379 { NULL, NULL, NULL }, /* not used */ 1380 { NULL, NULL, NULL }, /* not used */ 1381 { "Session Alive", NULL, NULL } 1382 }; 1383 1384 void 1385 netbeui_print(u_short control, const u_char *data, int length) 1386 { 1387 const u_char *maxbuf = data + length; 1388 int len; 1389 int command; 1390 const u_char *data2; 1391 int is_truncated = 0; 1392 1393 if (maxbuf > snapend) 1394 maxbuf = snapend; 1395 TCHECK(data[4]); 1396 len = EXTRACT_LE_16BITS(data); 1397 command = data[4]; 1398 data2 = data + len; 1399 if (data2 >= maxbuf) { 1400 data2 = maxbuf; 1401 is_truncated = 1; 1402 } 1403 1404 startbuf = data; 1405 1406 if (vflag < 2) { 1407 printf("NBF Packet: "); 1408 data = smb_fdata(data, "[P5]#", maxbuf, 0); 1409 } else { 1410 printf("\n>>> NBF Packet\nType=0x%X ", control); 1411 data = smb_fdata(data, "Length=[d] Signature=[w] Command=[B]\n#", maxbuf, 0); 1412 } 1413 if (data == NULL) 1414 goto out; 1415 1416 if (command > 0x1f || nbf_strings[command].name == NULL) { 1417 if (vflag < 2) 1418 data = smb_fdata(data, "Unknown NBF Command#", data2, 0); 1419 else 1420 data = smb_fdata(data, "Unknown NBF Command\n", data2, 0); 1421 } else { 1422 if (vflag < 2) { 1423 printf("%s", nbf_strings[command].name); 1424 if (nbf_strings[command].nonverbose != NULL) 1425 data = smb_fdata(data, nbf_strings[command].nonverbose, data2, 0); 1426 } else { 1427 printf("%s:\n", nbf_strings[command].name); 1428 if (nbf_strings[command].verbose != NULL) 1429 data = smb_fdata(data, nbf_strings[command].verbose, data2, 0); 1430 else 1431 printf("\n"); 1432 } 1433 } 1434 1435 if (vflag < 2) 1436 return; 1437 1438 if (data == NULL) 1439 goto out; 1440 1441 if (is_truncated) { 1442 /* data2 was past the end of the buffer */ 1443 goto out; 1444 } 1445 1446 /* If this isn't a command that would contain an SMB message, quit. */ 1447 if (command != 0x08 && command != 0x09 && command != 0x15 && 1448 command != 0x16) 1449 goto out; 1450 1451 /* If there isn't enough data for "\377SMB", don't look for it. */ 1452 if (&data2[3] >= maxbuf) 1453 goto out; 1454 1455 if (memcmp(data2, "\377SMB",4) == 0) 1456 print_smb(data2, maxbuf); 1457 else { 1458 int i; 1459 for (i = 0; i < 128; i++) { 1460 if (&data2[i + 3] >= maxbuf) 1461 break; 1462 if (memcmp(&data2[i], "\377SMB", 4) == 0) { 1463 printf("found SMB packet at %d\n", i); 1464 print_smb(&data2[i], maxbuf); 1465 break; 1466 } 1467 } 1468 } 1469 1470 out: 1471 printf("\n"); 1472 return; 1473 trunc: 1474 printf("[|SMB]"); 1475 return; 1476 } 1477 1478 1479 /* 1480 * print IPX-Netbios frames 1481 */ 1482 void 1483 ipx_netbios_print(const u_char *data, u_int length) 1484 { 1485 /* 1486 * this is a hack till I work out how to parse the rest of the 1487 * NetBIOS-over-IPX stuff 1488 */ 1489 int i; 1490 const u_char *maxbuf; 1491 1492 maxbuf = data + length; 1493 /* Don't go past the end of the captured data in the packet. */ 1494 if (maxbuf > snapend) 1495 maxbuf = snapend; 1496 startbuf = data; 1497 for (i = 0; i < 128; i++) { 1498 if (&data[i + 4] > maxbuf) 1499 break; 1500 if (memcmp(&data[i], "\377SMB", 4) == 0) { 1501 smb_fdata(data, "\n>>> IPX transport ", &data[i], 0); 1502 print_smb(&data[i], maxbuf); 1503 printf("\n"); 1504 fflush(stdout); 1505 break; 1506 } 1507 } 1508 if (i == 128) 1509 smb_fdata(data, "\n>>> Unknown IPX ", maxbuf, 0); 1510 } 1511
