epan/dissectors/packet-smb-mailslot.c

   1 /* packet-smb-mailslot.c
   2  * Routines for SMB mailslot packet dissection
   3  * Copyright 2000, Jeffrey C. Foster <jfoste@woodward.com>
   4  *
   5  * Wireshark - Network traffic analyzer
   6  * By Gerald Combs <gerald@wireshark.org>
   7  * Copyright 1998 Gerald Combs
   8  *
   9  * Copied from packet-pop.c
  10  *
  11  * SPDX-License-Identifier: GPL-2.0-or-later
  12  */
  13
  14 #include "config.h"
  15
  16
  17 #include <epan/packet.h>
  18 #include "packet-smb.h"
  19 #include "packet-smb-mailslot.h"
  20
  21 void proto_register_smb_mailslot(void);
  22 void proto_reg_handoff_smb_mailslot(void);
  23
  24 static int proto_smb_msp;
  25 static int hf_opcode;
  26 static int hf_priority;
  27 static int hf_class;
  28 static int hf_size;
  29 static int hf_name;
  30
  31 static int ett_smb_msp;
  32
  33 static dissector_handle_t mailslot_browse_handle;
  34 static dissector_handle_t mailslot_lanman_handle;
  35 static dissector_handle_t netlogon_handle;
  36
  37 #define MAILSLOT_UNKNOWN              0
  38 #define MAILSLOT_BROWSE               1
  39 #define MAILSLOT_LANMAN               2
  40 #define MAILSLOT_NET                  3
  41 #define MAILSLOT_TEMP_NETLOGON        4
  42 #define MAILSLOT_MSSP                 5
  43
  44 static const value_string opcode_vals[] = {
  45         {1,     "Write Mail Slot"},
  46         {0,     NULL}
  47 };
  48
  49 static const value_string class_vals[] = {
  50         {1,     "Reliable"},
  51         {2,     "Unreliable & Broadcast"},
  52         {0,     NULL}
  53 };
  54
  55 /* decode the SMB mail slot protocol
  56    for requests
  57      mailslot is the name of the mailslot, e.g. BROWSE
  58      si->trans_subcmd is set to the symbolic constant matching the mailslot name.
  59    for responses
  60      mailslot is NULL
  61      si->trans_subcmd gives us which mailslot this response refers to.
  62 */
  63
  64 bool
  65 dissect_mailslot_smb(tvbuff_t *mshdr_tvb, tvbuff_t *setup_tvb,
  66                      tvbuff_t *tvb, const char *mailslot, packet_info *pinfo,
  67                      proto_tree *parent_tree, smb_info_t* smb_info)
  68 {
  69         smb_transact_info_t *tri;
  70         int             trans_subcmd;
  71         proto_tree      *tree = NULL;
  72         proto_item      *item = NULL;
  73         uint16_t        opcode;
  74         int             offset = 0;
  75         int             len;
  76
  77         if (!proto_is_protocol_enabled(find_protocol_by_id(proto_smb_msp))) {
  78                 return false;
  79         }
  80         pinfo->current_proto = "SMB Mailslot";
  81
  82         col_set_str(pinfo->cinfo, COL_PROTOCOL, "SMB Mailslot");
  83
  84         if ((tvb==NULL) || (tvb_reported_length(tvb)==0)) {
  85                 /* Interim reply */
  86                 col_set_str(pinfo->cinfo, COL_INFO, "Interim reply");
  87                 return true;
  88         }
  89
  90         col_clear(pinfo->cinfo, COL_INFO);
  91
  92         if (smb_info->sip != NULL && smb_info->sip->extra_info_type == SMB_EI_TRI)
  93                 tri = (smb_transact_info_t *)smb_info->sip->extra_info;
  94         else
  95                 tri = NULL;
  96
  97         /* check which mailslot this is about */
  98         trans_subcmd=MAILSLOT_UNKNOWN;
  99         if(smb_info->request){
 100                 if(strncmp(mailslot,"BROWSE",6) == 0){
 101                         trans_subcmd=MAILSLOT_BROWSE;
 102                 } else if(strncmp(mailslot,"LANMAN",6) == 0){
 103                         trans_subcmd=MAILSLOT_LANMAN;
 104                 } else if(strncmp(mailslot,"NET",3) == 0){
 105                         trans_subcmd=MAILSLOT_NET;
 106                 } else if(strncmp(mailslot,"TEMP\\NETLOGON",13) == 0){
 107                         trans_subcmd=MAILSLOT_TEMP_NETLOGON;
 108                 } else if(strncmp(mailslot,"MSSP",4) == 0){
 109                         trans_subcmd=MAILSLOT_MSSP;
 110                 }
 111                 if (!pinfo->fd->visited) {
 112                         if (tri != NULL)
 113                                 tri->trans_subcmd = trans_subcmd;
 114                 }
 115         } else {
 116                 if(!tri){
 117                         return false;
 118                 } else {
 119                         trans_subcmd = tri->trans_subcmd;
 120                 }
 121         }
 122
 123         /* Only do these ones if we have them. For fragmented SMB Transactions
 124            we may only have the setup area for the first fragment
 125         */
 126         if(mshdr_tvb && setup_tvb){
 127                 if (parent_tree) {
 128                         item = proto_tree_add_item(parent_tree, proto_smb_msp,
 129                                                    mshdr_tvb, 0, -1, ENC_NA);
 130                         tree = proto_item_add_subtree(item, ett_smb_msp);
 131                 }
 132
 133                 /* do the opcode field */
 134                 opcode = tvb_get_letohs(setup_tvb, offset);
 135
 136                 col_add_str(pinfo->cinfo, COL_INFO,
 137                                     val_to_str(opcode, opcode_vals, "Unknown opcode: 0x%04x"));
 138
 139
 140                 /* These are in the setup words; use "setup_tvb". */
 141
 142                 /* opcode */
 143                 proto_tree_add_uint(tree, hf_opcode, setup_tvb, offset, 2,
 144                     opcode);
 145                 offset += 2;
 146
 147                 /* priority */
 148                 proto_tree_add_item(tree, hf_priority, setup_tvb, offset, 2,
 149                     ENC_LITTLE_ENDIAN);
 150                 offset += 2;
 151
 152                 /* class */
 153                 proto_tree_add_item(tree, hf_class, setup_tvb, offset, 2, ENC_LITTLE_ENDIAN);
 154                 offset += 2;
 155
 156                 /* These are in the rest of the data; use "mshdr_tvb", which
 157                    starts at the same place "setup_tvb" does. */
 158
 159                 /* size */
 160                 /* this is actually bytecount in the SMB Transaction command */
 161                 proto_tree_add_item(tree, hf_size, mshdr_tvb, offset, 2, ENC_LITTLE_ENDIAN);
 162                 offset += 2;
 163
 164                 /* mailslot name */
 165                 len = tvb_strsize(mshdr_tvb, offset);
 166                 proto_tree_add_item(tree, hf_name, mshdr_tvb, offset, len, ENC_ASCII);
 167                 offset += len;
 168                 proto_item_set_len(item, offset);
 169         }
 170
 171         switch(trans_subcmd){
 172         case MAILSLOT_BROWSE:
 173                 call_dissector(mailslot_browse_handle, tvb, pinfo,
 174                     parent_tree);
 175                 break;
 176
 177         case MAILSLOT_LANMAN:
 178                 call_dissector(mailslot_lanman_handle, tvb, pinfo,
 179                     parent_tree);
 180                 break;
 181
 182         case MAILSLOT_NET:
 183         case MAILSLOT_TEMP_NETLOGON:
 184         case MAILSLOT_MSSP:
 185                 call_dissector(netlogon_handle, tvb, pinfo,
 186                     parent_tree);
 187                 break;
 188
 189         default:
 190                 /*
 191                  * We dissected the mailslot header, but we don't know
 192                  * how to dissect the message; dissect the latter as data,
 193                  * but indicate that we successfully dissected the mailslot
 194                  * stuff.
 195                  */
 196                 call_data_dissector(tvb, pinfo, parent_tree);
 197                 break;
 198         }
 199         return true;
 200 }
 201
 202 void
 203 proto_register_smb_mailslot(void)
 204 {
 205         static hf_register_info hf[] = {
 206                 { &hf_opcode,
 207                   { "Opcode", "mailslot.opcode", FT_UINT16, BASE_DEC,
 208                     VALS(opcode_vals), 0, "MAILSLOT OpCode", HFILL }},
 209
 210                 { &hf_priority,
 211                   { "Priority", "mailslot.priority", FT_UINT16, BASE_DEC,
 212                     NULL, 0, "MAILSLOT Priority of transaction", HFILL }},
 213
 214                 { &hf_class,
 215                   { "Class", "mailslot.class", FT_UINT16, BASE_DEC,
 216                     VALS(class_vals), 0, "MAILSLOT Class of transaction", HFILL }},
 217
 218                 { &hf_size,
 219                   { "Size", "mailslot.size", FT_UINT16, BASE_DEC,
 220                     NULL, 0, "MAILSLOT Total size of mail data", HFILL }},
 221
 222                 { &hf_name,
 223                   { "Mailslot Name", "mailslot.name", FT_STRING, BASE_NONE,
 224                     NULL, 0, "MAILSLOT Name of mailslot", HFILL }},
 225
 226         };
 227
 228         static int *ett[] = {
 229                 &ett_smb_msp
 230         };
 231
 232         proto_smb_msp = proto_register_protocol("SMB MailSlot Protocol", "SMB Mailslot", "mailslot");
 233
 234         proto_register_field_array(proto_smb_msp, hf, array_length(hf));
 235         proto_register_subtree_array(ett, array_length(ett));
 236 }
 237
 238 void
 239 proto_reg_handoff_smb_mailslot(void)
 240 {
 241         mailslot_browse_handle = find_dissector_add_dependency("mailslot_browse", proto_smb_msp);
 242         mailslot_lanman_handle = find_dissector_add_dependency("mailslot_lanman", proto_smb_msp);
 243         netlogon_handle = find_dissector_add_dependency("smb_netlogon", proto_smb_msp);
 244 }
 245
 246 /*
 247  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 248  *
 249  * Local variables:
 250  * c-basic-offset: 8
 251  * tab-width: 8
 252  * indent-tabs-mode: t
 253  * End:
 254  *
 255  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 256  * :indentSize=8:tabSize=8:noTabs=false:
 257  */