#include <epan/crypt/crypt-des.h>
#include "packet-dcerpc.h"
#include "packet-gssapi.h"
-#include <epan/crc32.h>
+#include <wsutil/crc32.h>
#include "packet-ntlmssp.h"
*
* See also
*
- * http://davenport.sourceforge.net/ntlm.html
+ * http://davenport.sourceforge.net/ntlm.html
*
* although that document says that:
*
- * 0x00010000 is "Target Type Domain";
- * 0x00020000 is "Target Type Server"
- * 0x00040000 is "Target Type Share";
+ * 0x00010000 is "Target Type Domain";
+ * 0x00020000 is "Target Type Server"
+ * 0x00040000 is "Target Type Share";
*
* and that 0x00100000, 0x00200000, and 0x00400000 are
* "Request Init Response", "Request Accept Response", and
* http://msdn2.microsoft.com/en-us/library/cc236621.aspx
*
*/
-#define NTLMSSP_NEGOTIATE_UNICODE 0x00000001
-#define NTLMSSP_NEGOTIATE_OEM 0x00000002
-#define NTLMSSP_REQUEST_TARGET 0x00000004
-#define NTLMSSP_NEGOTIATE_00000008 0x00000008
-#define NTLMSSP_NEGOTIATE_SIGN 0x00000010
-#define NTLMSSP_NEGOTIATE_SEAL 0x00000020
-#define NTLMSSP_NEGOTIATE_DATAGRAM 0x00000040
-#define NTLMSSP_NEGOTIATE_LM_KEY 0x00000080
-#define NTLMSSP_NEGOTIATE_00000100 0x00000100
-#define NTLMSSP_NEGOTIATE_NTLM 0x00000200
-#define NTLMSSP_NEGOTIATE_NT_ONLY 0x00000400
-#define NTLMSSP_NEGOTIATE_00000800 0x00000800
-#define NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0x00001000
+#define NTLMSSP_NEGOTIATE_UNICODE 0x00000001
+#define NTLMSSP_NEGOTIATE_OEM 0x00000002
+#define NTLMSSP_REQUEST_TARGET 0x00000004
+#define NTLMSSP_NEGOTIATE_00000008 0x00000008
+#define NTLMSSP_NEGOTIATE_SIGN 0x00000010
+#define NTLMSSP_NEGOTIATE_SEAL 0x00000020
+#define NTLMSSP_NEGOTIATE_DATAGRAM 0x00000040
+#define NTLMSSP_NEGOTIATE_LM_KEY 0x00000080
+#define NTLMSSP_NEGOTIATE_00000100 0x00000100
+#define NTLMSSP_NEGOTIATE_NTLM 0x00000200
+#define NTLMSSP_NEGOTIATE_NT_ONLY 0x00000400
+#define NTLMSSP_NEGOTIATE_00000800 0x00000800
+#define NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0x00001000
#define NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0x00002000
-#define NTLMSSP_NEGOTIATE_00004000 0x00004000
-#define NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0x00008000
-#define NTLMSSP_TARGET_TYPE_DOMAIN 0x00010000
-#define NTLMSSP_TARGET_TYPE_SERVER 0x00020000
-#define NTLMSSP_TARGET_TYPE_SHARE 0x00040000
-#define NTLMSSP_NEGOTIATE_EXTENDED_SECURITY 0x00080000
-#define NTLMSSP_NEGOTIATE_IDENTIFY 0x00100000
-#define NTLMSSP_NEGOTIATE_00200000 0x00200000
-#define NTLMSSP_REQUEST_NON_NT_SESSION 0x00400000
-#define NTLMSSP_NEGOTIATE_TARGET_INFO 0x00800000
-#define NTLMSSP_NEGOTIATE_01000000 0x01000000
-#define NTLMSSP_NEGOTIATE_VERSION 0x02000000
-#define NTLMSSP_NEGOTIATE_04000000 0x04000000
-#define NTLMSSP_NEGOTIATE_08000000 0x08000000
-#define NTLMSSP_NEGOTIATE_10000000 0x10000000
-#define NTLMSSP_NEGOTIATE_128 0x20000000
-#define NTLMSSP_NEGOTIATE_KEY_EXCH 0x40000000
-#define NTLMSSP_NEGOTIATE_56 0x80000000
+#define NTLMSSP_NEGOTIATE_00004000 0x00004000
+#define NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0x00008000
+#define NTLMSSP_TARGET_TYPE_DOMAIN 0x00010000
+#define NTLMSSP_TARGET_TYPE_SERVER 0x00020000
+#define NTLMSSP_TARGET_TYPE_SHARE 0x00040000
+#define NTLMSSP_NEGOTIATE_EXTENDED_SECURITY 0x00080000
+#define NTLMSSP_NEGOTIATE_IDENTIFY 0x00100000
+#define NTLMSSP_NEGOTIATE_00200000 0x00200000
+#define NTLMSSP_REQUEST_NON_NT_SESSION 0x00400000
+#define NTLMSSP_NEGOTIATE_TARGET_INFO 0x00800000
+#define NTLMSSP_NEGOTIATE_01000000 0x01000000
+#define NTLMSSP_NEGOTIATE_VERSION 0x02000000
+#define NTLMSSP_NEGOTIATE_04000000 0x04000000
+#define NTLMSSP_NEGOTIATE_08000000 0x08000000
+#define NTLMSSP_NEGOTIATE_10000000 0x10000000
+#define NTLMSSP_NEGOTIATE_128 0x20000000
+#define NTLMSSP_NEGOTIATE_KEY_EXCH 0x40000000
+#define NTLMSSP_NEGOTIATE_56 0x80000000
static int proto_ntlmssp = -1;
static int hf_ntlmssp_auth = -1;
fprintf(stderr,"%s",txt2);
}
#if 0
- static void printnchar(const guint8* tab,int nb,char* txt,char* txt2)
+static void printnchar(const guint8* tab,int nb,char* txt,char* txt2)
{
int i=0;
fprintf(stderr,"%s ",txt);
{
}
#endif
+
/*
* GSlist of decrypted payloads.
*/
static GSList *decrypted_payloads;
-int LEBE_Convert(int value)
+#if 0
+static int
+LEBE_Convert(int value)
{
char a,b,c,d;
/* Get each byte */
d=(value&0xFF000000) >> 24;
return (a << 24) | (b << 16) | (c << 8) | d;
}
+#endif
+
/*
Perform a DES encryption with a 16 bit key and 8bit data item.
It's in fact 3 susbsequent call to crypt_des_ecb with a 7 bit key.
Missing bits for the key are replaced by 0;
Returns output in response, which is expected to be 24 bytes.
*/
-static int crypt_des_ecb_long(guint8 *response,
- const guint8 *key,
- const guint8 *data)
+static int
+crypt_des_ecb_long(guint8 *response,
+ const guint8 *key,
+ const guint8 *data)
{
guint8 pw21[21]; /* 21 bytes place for the needed key */
return 1;
}
+
/*
Generate a challenge response, given an eight byte challenge and
either the NT or the Lan Manager password hash (16 bytes).
Returns output in response, which is expected to be 24 bytes.
*/
-static int ntlmssp_generate_challenge_response(guint8 *response,
- const guint8 *passhash,
- const guint8 *challenge)
+static int
+ntlmssp_generate_challenge_response(guint8 *response,
+ const guint8 *passhash,
+ const guint8 *challenge)
{
guint8 pw21[21]; /* Password hash padded to 21 bytes */
/* Ultra simple ainsi to unicode converter, will only work for ascii password ...*/
-static void str_to_unicode(const char *nt_password, char *nt_password_unicode)
+static void
+str_to_unicode(const char *nt_password, char *nt_password_unicode)
{
size_t password_len = 0;
size_t i;
}
}
}
+
#if defined(HAVE_HEIMDAL_KERBEROS) || defined(HAVE_MIT_KERBEROS)
static guint32
get_md4pass_list(md4_pass** p_pass_list,const char* nt_password)
{
- guint32 nb_pass = 0;
- enc_key_t *ek;
- unsigned char nt_password_hash[NTLMSSP_KEY_LEN];
- int password_len = 0;
- char nt_password_unicode[256];
- md4_pass* pass_list;
- int i = 0;
- if(!krb_decrypt){
- pass_list=NULL;
- return 0;
- }
- read_keytab_file_from_preferences();
-
- for(ek=enc_key_list;ek;ek=ek->next){
- if( ek->keylength == NTLMSSP_KEY_LEN ) {
- nb_pass++;
- }
- }
- memset(nt_password_hash,0,NTLMSSP_KEY_LEN);
- if (nt_password[0] != '\0' && ( strlen(nt_password) < 129 )) {
- nb_pass++;
- password_len = strlen(nt_password);
- str_to_unicode(nt_password,nt_password_unicode);
- crypt_md4(nt_password_hash,nt_password_unicode,password_len*2);
- }
- if( nb_pass == 0 ) {
- /* Unable to calculate the session key without a password or if password is more than 128 char ......*/
- return 0;
- }
- i = 0;
- *p_pass_list = ep_alloc(nb_pass*sizeof(md4_pass));
- pass_list=*p_pass_list;
-
- if( memcmp(nt_password_hash,gbl_zeros,NTLMSSP_KEY_LEN) != 0 ) {
- memcpy(pass_list[i].md4,nt_password_hash,NTLMSSP_KEY_LEN);
- i = 1;
- }
- for(ek=enc_key_list;ek;ek=ek->next){
- if( ek->keylength == NTLMSSP_KEY_LEN ) {
- memcpy(pass_list[i].md4,ek->keyvalue,NTLMSSP_KEY_LEN);
- i++;
- }
- }
- return nb_pass;
+ guint32 nb_pass = 0;
+ enc_key_t *ek;
+ unsigned char nt_password_hash[NTLMSSP_KEY_LEN];
+ int password_len = 0;
+ char nt_password_unicode[256];
+ md4_pass* pass_list;
+ int i = 0;
+ if(!krb_decrypt){
+ pass_list=NULL;
+ return 0;
+ }
+ read_keytab_file_from_preferences();
+
+ for(ek=enc_key_list;ek;ek=ek->next){
+ if( ek->keylength == NTLMSSP_KEY_LEN ) {
+ nb_pass++;
+ }
+ }
+ memset(nt_password_hash,0,NTLMSSP_KEY_LEN);
+ if (nt_password[0] != '\0' && ( strlen(nt_password) < 129 )) {
+ nb_pass++;
+ password_len = strlen(nt_password);
+ str_to_unicode(nt_password,nt_password_unicode);
+ crypt_md4(nt_password_hash,nt_password_unicode,password_len*2);
+ }
+ if( nb_pass == 0 ) {
+ /* Unable to calculate the session key without a password or if password is more than 128 char ......*/
+ return 0;
+ }
+ i = 0;
+ *p_pass_list = ep_alloc(nb_pass*sizeof(md4_pass));
+ pass_list=*p_pass_list;
+
+ if( memcmp(nt_password_hash,gbl_zeros,NTLMSSP_KEY_LEN) != 0 ) {
+ memcpy(pass_list[i].md4,nt_password_hash,NTLMSSP_KEY_LEN);
+ i = 1;
+ }
+ for(ek=enc_key_list;ek;ek=ek->next){
+ if( ek->keylength == NTLMSSP_KEY_LEN ) {
+ memcpy(pass_list[i].md4,ek->keyvalue,NTLMSSP_KEY_LEN);
+ i++;
+ }
+ }
+ return nb_pass;
}
#endif
+
/* Create an NTLMSSP version 2 key
*/
static void
create_ntlmssp_v2_key(const char *nt_password _U_, const guint8 *serverchallenge , const guint8 *clientchallenge ,
- guint8 *sessionkey ,const guint8 *encryptedsessionkey , int flags , ntlmssp_blob ntlm_response, ntlmssp_blob lm_response _U_, ntlmssp_header_t *ntlmssph ) {
+ guint8 *sessionkey ,const guint8 *encryptedsessionkey , int flags ,
+ const ntlmssp_blob *ntlm_response, const ntlmssp_blob *lm_response _U_, ntlmssp_header_t *ntlmssph )
+{
char domain_name_unicode[256];
char user_uppercase[256];
char buf[512];
memset(user_uppercase,0,256);
user_len = strlen(ntlmssph->acct_name);
if( user_len < 129 ) {
- memset(buf,0,512);
- str_to_unicode(ntlmssph->acct_name,buf);
- for (j = 0; j < (2*user_len); j++) {
- if( buf[j] != '\0' ) {
- user_uppercase[j] = toupper(buf[j]);
- }
- }
+ memset(buf,0,512);
+ str_to_unicode(ntlmssph->acct_name,buf);
+ for (j = 0; j < (2*user_len); j++) {
+ if( buf[j] != '\0' ) {
+ user_uppercase[j] = toupper(buf[j]);
+ }
+ }
}
else {
- /* Unable to calculate the session not enought space in buffer, note this is unlikely to happen but ......*/
- return;
+ /* Unable to calculate the session not enought space in buffer, note this is unlikely to happen but ......*/
+ return;
}
domain_len = strlen(ntlmssph->domain_name);
if( domain_len < 129 ) {
/* NT proof = First NTLMSSP_KEY_LEN bytes of NT response */
memset(buf,0,512);
memcpy(buf,serverchallenge,8);
- memcpy(buf+8,ntlm_response.contents+NTLMSSP_KEY_LEN,ntlm_response.length-NTLMSSP_KEY_LEN);
- md5_hmac(buf,ntlm_response.length-8,ntowf,NTLMSSP_KEY_LEN,nt_proof);
+ memcpy(buf+8,ntlm_response->contents+NTLMSSP_KEY_LEN,ntlm_response->length-NTLMSSP_KEY_LEN);
+ md5_hmac(buf,ntlm_response->length-8,ntowf,NTLMSSP_KEY_LEN,nt_proof);
printnbyte(nt_proof,NTLMSSP_KEY_LEN,"NT proof: ","\n");
- if( !memcmp(nt_proof,ntlm_response.contents,NTLMSSP_KEY_LEN) ) {
+ if( !memcmp(nt_proof,ntlm_response->contents,NTLMSSP_KEY_LEN) ) {
found = 1;
break;
}
*/
static void
create_ntlmssp_v1_key(const char *nt_password, const guint8 *serverchallenge, const guint8 *clientchallenge,
- guint8 *sessionkey,const guint8 *encryptedsessionkey, int flags, const guint8 *ref_nt_challenge_response,const guint8 *ref_lm_challenge_response)
+ guint8 *sessionkey,const guint8 *encryptedsessionkey, int flags,
+ const guint8 *ref_nt_challenge_response,const guint8 *ref_lm_challenge_response)
{
unsigned char lm_password_upper[NTLMSSP_KEY_LEN];
unsigned char lm_password_hash[NTLMSSP_KEY_LEN];
crypt_des_ecb(lm_password_hash, lmhash_key, lm_password_upper, 1);
crypt_des_ecb(lm_password_hash+8, lmhash_key, lm_password_upper+7, 1);
ntlmssp_generate_challenge_response(lm_challenge_response,
- lm_password_hash, serverchallenge);
+ lm_password_hash, serverchallenge);
memcpy(sessionbasekey,lm_password_hash,NTLMSSP_KEY_LEN);
}
else {
memcpy(sessionkey,keyexchangekey,NTLMSSP_KEY_LEN);
}
}
+
static void
get_siging_key(guint8 *sign_key_server,guint8* sign_key_client,const guint8 key[NTLMSSP_KEY_LEN], int keylen)
{
/* We return either a 128 or 64 bit key
*/
static void
-get_sealing_rc4key(const guint8 exportedsessionkey[NTLMSSP_KEY_LEN] ,const int flags ,int *keylen ,guint8 *clientsealkey ,guint8 *serversealkey)
+get_sealing_rc4key(const guint8 exportedsessionkey[NTLMSSP_KEY_LEN] ,const int flags ,int *keylen ,
+ guint8 *clientsealkey ,guint8 *serversealkey)
{
md5_state_t md5state;
md5_state_t md5state2;
clientsealkey[7]=0xb0;
}
}
- serversealkey = memcpy(serversealkey,clientsealkey,*keylen);
+ memcpy(serversealkey,clientsealkey,*keylen);
}
}
/* Create an NTLMSSP version 1 key.
*/
static int
dissect_ntlmssp_string (tvbuff_t *tvb, int offset,
- proto_tree *ntlmssp_tree,
- gboolean unicode_strings,
- int string_hf, int *start, int *end,
- const char **stringp)
+ proto_tree *ntlmssp_tree,
+ gboolean unicode_strings,
+ int string_hf, int *start, int *end,
+ const char **stringp)
{
proto_tree *tree = NULL;
proto_item *tf = NULL;
if (0 == string_length) {
*end = *start;
if (ntlmssp_tree)
- proto_tree_add_string(ntlmssp_tree, string_hf, tvb,
- offset, 8, "NULL");
+ proto_tree_add_string(ntlmssp_tree, string_hf, tvb,
+ offset, 8, "NULL");
if (stringp != NULL)
*stringp = "";
return offset+8;
bc = result_length = string_length;
string_text = get_unicode_or_ascii_string(tvb, &string_offset,
- unicode_strings, &result_length,
- FALSE, TRUE, &bc);
+ unicode_strings, &result_length,
+ FALSE, TRUE, &bc);
if (stringp != NULL) {
if (!string_text) string_text = ""; /* Make sure we don't blow up later */
if (ntlmssp_tree) {
tf = proto_tree_add_string(ntlmssp_tree, string_hf, tvb,
- string_offset, result_length, string_text);
+ string_offset, result_length, string_text);
tree = proto_item_add_subtree(tf, ett_ntlmssp_string);
}
proto_tree_add_uint(tree, hf_ntlmssp_string_len,
- tvb, offset, 2, string_length);
+ tvb, offset, 2, string_length);
offset += 2;
proto_tree_add_uint(tree, hf_ntlmssp_string_maxlen,
- tvb, offset, 2, string_maxlen);
+ tvb, offset, 2, string_maxlen);
offset += 2;
proto_tree_add_uint(tree, hf_ntlmssp_string_offset,
- tvb, offset, 4, string_offset);
+ tvb, offset, 4, string_offset);
offset += 4;
*end = string_offset + string_length;
*/
static int
dissect_ntlmssp_blob (tvbuff_t *tvb, int offset,
- proto_tree *ntlmssp_tree,
- int blob_hf, int *end, ntlmssp_blob *result)
+ proto_tree *ntlmssp_tree,
+ int blob_hf, int *end, ntlmssp_blob *result)
{
proto_item *tf = NULL;
proto_tree *tree = NULL;
if (0 == blob_length) {
*end = (blob_offset > ((guint)offset)+8 ? blob_offset : ((guint)offset)+8);
if (ntlmssp_tree)
- proto_tree_add_text(ntlmssp_tree, tvb, offset, 8, "%s: Empty",
- proto_registrar_get_name(blob_hf));
+ proto_tree_add_text(ntlmssp_tree, tvb, offset, 8, "%s: Empty",
+ proto_registrar_get_name(blob_hf));
return offset+8;
}
if (ntlmssp_tree) {
tf = proto_tree_add_item (ntlmssp_tree, blob_hf, tvb,
- blob_offset, blob_length, FALSE);
+ blob_offset, blob_length, FALSE);
tree = proto_item_add_subtree(tf, ett_ntlmssp_blob);
}
proto_tree_add_uint(tree, hf_ntlmssp_blob_len,
- tvb, offset, 2, blob_length);
+ tvb, offset, 2, blob_length);
offset += 2;
proto_tree_add_uint(tree, hf_ntlmssp_blob_maxlen,
- tvb, offset, 2, blob_maxlen);
+ tvb, offset, 2, blob_maxlen);
offset += 2;
proto_tree_add_uint(tree, hf_ntlmssp_blob_offset,
- tvb, offset, 4, blob_offset);
+ tvb, offset, 4, blob_offset);
offset += 4;
*end = blob_offset + blob_length;
if (blob_length < MAX_BLOB_SIZE)
{
tvb_memcpy(tvb, result->contents, blob_offset, blob_length);
- if (blob_hf == hf_ntlmssp_auth_lmresponse && !(memcmp(tvb->real_data+blob_offset+8,"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0",NTLMSSP_KEY_LEN)))
+ if (blob_hf == hf_ntlmssp_auth_lmresponse && !(tvb_memeql(tvb, blob_offset+8, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", NTLMSSP_KEY_LEN)))
{
proto_tree_add_item (ntlmssp_tree,
- hf_ntlmssp_ntlm_client_challenge,
- tvb, blob_offset, 8, FALSE);
+ hf_ntlmssp_ntlm_client_challenge,
+ tvb, blob_offset, 8, ENC_NA);
}
}
}
if (blob_hf == hf_ntlmssp_auth_ntresponse && blob_length > 24)
{
proto_tree_add_item (ntlmssp_tree,
- hf_ntlmssp_ntlm_client_challenge,
- tvb, blob_offset+32, 8, FALSE);
- dissect_ntlmv2_response(tvb, tree, blob_offset, blob_length);
+ hf_ntlmssp_ntlm_client_challenge,
+ tvb, blob_offset+32, 8, ENC_NA);
+ dissect_ntlmv2_response(tvb, tree, blob_offset, blob_length);
}
return offset;
static int
dissect_ntlmssp_negotiate_flags (tvbuff_t *tvb, int offset,
- proto_tree *ntlmssp_tree,
- guint32 negotiate_flags)
+ proto_tree *ntlmssp_tree,
+ guint32 negotiate_flags)
{
proto_tree *negotiate_flags_tree = NULL;
proto_item *tf = NULL;
if (ntlmssp_tree) {
tf = proto_tree_add_uint (ntlmssp_tree,
- hf_ntlmssp_negotiate_flags,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags,
+ tvb, offset, 4, negotiate_flags);
negotiate_flags_tree = proto_item_add_subtree (tf, ett_ntlmssp_negotiate_flags);
}
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_80000000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_80000000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_40000000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_40000000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_20000000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_20000000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_10000000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_10000000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_8000000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_8000000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_4000000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_4000000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_2000000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_2000000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_1000000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_1000000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_800000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_800000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_400000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_400000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_200000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_200000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_100000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_100000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_80000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_80000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_40000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_40000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_20000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_20000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_10000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_10000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_8000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_8000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_4000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_4000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_2000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_2000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_1000,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_1000,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_800,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_800,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_400,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_400,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_200,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_200,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_100,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_100,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_80,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_80,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_40,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_40,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_20,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_20,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_10,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_10,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_08,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_08,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_04,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_04,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_02,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_02,
+ tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_01,
- tvb, offset, 4, negotiate_flags);
+ hf_ntlmssp_negotiate_flags_01,
+ tvb, offset, 4, negotiate_flags);
return (offset + 4);
}
/* Dissect "version" */
/* From MS-NLMP:
- 0 Major Version Number 1 byte
- 1 Minor Version Number 1 byte
- 2 Build Number short(LE)
+ 0 Major Version Number 1 byte
+ 1 Minor Version Number 1 byte
+ 2 Build Number short(LE)
3 (Reserved) 3 bytes
- 4 NTLM Current Revision 1 byte
+ 4 NTLM Current Revision 1 byte
*/
static int
#define NTLM_TARGET_INFO_CHANNEL_BINDINGS 0x000A
static const value_string ntlm_name_types[] = {
- { NTLM_TARGET_INFO_END, "End of list" },
- { NTLM_TARGET_INFO_NB_COMPUTER_NAME, "NetBIOS computer name" },
- { NTLM_TARGET_INFO_NB_DOMAIN_NAME, "NetBIOS domain name" },
- { NTLM_TARGET_INFO_DNS_COMPUTER_NAME, "DNS computer name" },
- { NTLM_TARGET_INFO_DNS_DOMAIN_NAME, "DNS domain name" },
- { NTLM_TARGET_INFO_DNS_TREE_NAME, "DNS tree name" },
- { NTLM_TARGET_INFO_FLAGS, "Flags" },
- { NTLM_TARGET_INFO_TIMESTAMP, "Timestamp" },
- { NTLM_TARGET_INFO_RESTRICTIONS, "Restrictions" },
- { NTLM_TARGET_INFO_TARGET_NAME, "Target Name"},
- { NTLM_TARGET_INFO_CHANNEL_BINDINGS, "Channel Bindings"},
- { 0, NULL }
+ { NTLM_TARGET_INFO_END, "End of list" },
+ { NTLM_TARGET_INFO_NB_COMPUTER_NAME, "NetBIOS computer name" },
+ { NTLM_TARGET_INFO_NB_DOMAIN_NAME, "NetBIOS domain name" },
+ { NTLM_TARGET_INFO_DNS_COMPUTER_NAME, "DNS computer name" },
+ { NTLM_TARGET_INFO_DNS_DOMAIN_NAME, "DNS domain name" },
+ { NTLM_TARGET_INFO_DNS_TREE_NAME, "DNS tree name" },
+ { NTLM_TARGET_INFO_FLAGS, "Flags" },
+ { NTLM_TARGET_INFO_TIMESTAMP, "Timestamp" },
+ { NTLM_TARGET_INFO_RESTRICTIONS, "Restrictions" },
+ { NTLM_TARGET_INFO_TARGET_NAME, "Target Name"},
+ { NTLM_TARGET_INFO_CHANNEL_BINDINGS, "Channel Bindings"},
+ { 0, NULL }
};
/* The following *must* match the order of the list of attribute types */
proto_tree_add_item (target_info_tree, *tif_p->hf_item_type, tvb, type_offset, 2, ENC_LITTLE_ENDIAN);
proto_tree_add_item (target_info_tree, *tif_p->hf_item_length, tvb, len_offset, 2, ENC_LITTLE_ENDIAN);
- switch(item_type) {
+ switch (item_type) {
case NTLM_TARGET_INFO_NB_COMPUTER_NAME:
case NTLM_TARGET_INFO_NB_DOMAIN_NAME:
case NTLM_TARGET_INFO_DNS_COMPUTER_NAME:
int
dissect_ntlmv2_response(tvbuff_t *tvb, proto_tree *tree, int offset, int len)
{
- proto_item *ntlmv2_item = NULL;
- proto_tree *ntlmv2_tree = NULL;
- int orig_offset;
+ proto_item *ntlmv2_item = NULL;
+ proto_tree *ntlmv2_tree = NULL;
+ int orig_offset;
- /* Dissect NTLMv2 bits&pieces */
- orig_offset = offset;
+ /* Dissect NTLMv2 bits&pieces */
+ orig_offset = offset;
- if (tree) {
- ntlmv2_item = proto_tree_add_item(
- tree, hf_ntlmssp_ntlmv2_response, tvb,
- offset, len, TRUE);
- ntlmv2_tree = proto_item_add_subtree(
- ntlmv2_item, ett_ntlmssp_ntlmv2_response);
- }
+ if (tree) {
+ ntlmv2_item = proto_tree_add_item(
+ tree, hf_ntlmssp_ntlmv2_response, tvb,
+ offset, len, ENC_NA);
+ ntlmv2_tree = proto_item_add_subtree(
+ ntlmv2_item, ett_ntlmssp_ntlmv2_response);
+ }
- proto_tree_add_item(
- ntlmv2_tree, hf_ntlmssp_ntlmv2_response_hmac, tvb,
- offset, 16, TRUE);
+ proto_tree_add_item(
+ ntlmv2_tree, hf_ntlmssp_ntlmv2_response_hmac, tvb,
+ offset, 16, ENC_NA);
- offset += 16;
+ offset += 16;
- proto_tree_add_item(
- ntlmv2_tree, hf_ntlmssp_ntlmv2_response_header, tvb,
- offset, 4, TRUE);
+ proto_tree_add_item(
+ ntlmv2_tree, hf_ntlmssp_ntlmv2_response_header, tvb,
+ offset, 4, ENC_LITTLE_ENDIAN);
- offset += 4;
+ offset += 4;
- proto_tree_add_item(
- ntlmv2_tree, hf_ntlmssp_ntlmv2_response_reserved, tvb,
- offset, 4, TRUE);
+ proto_tree_add_item(
+ ntlmv2_tree, hf_ntlmssp_ntlmv2_response_reserved, tvb,
+ offset, 4, ENC_LITTLE_ENDIAN);
- offset += 4;
+ offset += 4;
- offset = dissect_nt_64bit_time(
- tvb, ntlmv2_tree, offset, hf_ntlmssp_ntlmv2_response_time);
+ offset = dissect_nt_64bit_time(
+ tvb, ntlmv2_tree, offset, hf_ntlmssp_ntlmv2_response_time);
- proto_tree_add_item(
- ntlmv2_tree, hf_ntlmssp_ntlmv2_response_chal, tvb,
- offset, 8, TRUE);
+ proto_tree_add_item(
+ ntlmv2_tree, hf_ntlmssp_ntlmv2_response_chal, tvb,
+ offset, 8, ENC_NA);
- offset += 8;
+ offset += 8;
- proto_tree_add_item(
- ntlmv2_tree, hf_ntlmssp_ntlmv2_response_unknown, tvb,
- offset, 4, TRUE);
+ proto_tree_add_item(
+ ntlmv2_tree, hf_ntlmssp_ntlmv2_response_unknown, tvb,
+ offset, 4, ENC_LITTLE_ENDIAN);
- offset += 4;
+ offset += 4;
- /* Variable length list of attributes */
- /*
- * XXX - Windows puts one or more sets of 4 bytes of additional stuff (all zeros ?)
- * at the end of the attributes.
- * Samba's smbclient doesn't.
- * Both of them appear to be able to connect to W2K SMB
- * servers.
- * The additional stuff will be dissected as extra "end" attributes.
- *
- */
- dissect_ntlmssp_target_info_list(tvb, ntlmv2_tree,
- offset, len - (offset - orig_offset),
- &ntlmssp_ntlmv2_response_tif);
+ /* Variable length list of attributes */
+ /*
+ * XXX - Windows puts one or more sets of 4 bytes of additional stuff (all zeros ?)
+ * at the end of the attributes.
+ * Samba's smbclient doesn't.
+ * Both of them appear to be able to connect to W2K SMB
+ * servers.
+ * The additional stuff will be dissected as extra "end" attributes.
+ *
+ */
+ dissect_ntlmssp_target_info_list(tvb, ntlmv2_tree,
+ offset, len - (offset - orig_offset),
+ &ntlmssp_ntlmv2_response_tif);
- return offset+len;
+ return offset+len;
}
/* tapping into ntlmssph not yet implemented */
/* NTLMSSP Negotiate Flags */
negotiate_flags = tvb_get_letohl (tvb, offset);
offset = dissect_ntlmssp_negotiate_flags (tvb, offset, ntlmssp_tree,
- negotiate_flags);
+ negotiate_flags);
/*
* XXX - the davenport document says that these might not be
* isn't enough to contain them.
*/
offset = dissect_ntlmssp_string(tvb, offset, ntlmssp_tree, FALSE,
- hf_ntlmssp_negotiate_domain,
- &data_start, &data_end, NULL);
+ hf_ntlmssp_negotiate_domain,
+ &data_start, &data_end, NULL);
offset = dissect_ntlmssp_string(tvb, offset, ntlmssp_tree, FALSE,
- hf_ntlmssp_negotiate_workstation,
- &item_start, &item_end, NULL);
+ hf_ntlmssp_negotiate_workstation,
+ &item_start, &item_end, NULL);
data_start = MIN(data_start, item_start);
data_end = MAX(data_end, item_end);
- /* If there are more bytes before the data block dissect a version field */
+ /* If there are more bytes before the data block dissect a version field
+ if NTLMSSP_NEGOTIATE_VERSION is set in the flags (see MS-NLMP) */
if (offset < data_start) {
- offset = dissect_ntlmssp_version(tvb, offset, ntlmssp_tree);
+ if (negotiate_flags & NTLMSSP_NEGOTIATE_VERSION)
+ offset = dissect_ntlmssp_version(tvb, offset, ntlmssp_tree);
}
return data_end;
}
if (0 == challenge_target_info_length) {
*end = (challenge_target_info_offset > ((guint)offset)+8 ? challenge_target_info_offset : ((guint)offset)+8);
if (ntlmssp_tree)
- proto_tree_add_text(ntlmssp_tree, tvb, offset, 8,
- "Target Info List: Empty");
+ proto_tree_add_text(ntlmssp_tree, tvb, offset, 8,
+ "Target Info List: Empty");
return offset+8;
}
if (ntlmssp_tree) {
tf = proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_challenge_target_info, tvb,
- challenge_target_info_offset, challenge_target_info_length, FALSE);
+ challenge_target_info_offset, challenge_target_info_length, ENC_NA);
challenge_target_info_tree = proto_item_add_subtree(tf, ett_ntlmssp_challenge_target_info);
}
proto_tree_add_uint(challenge_target_info_tree, hf_ntlmssp_challenge_target_info_len,
- tvb, offset, 2, challenge_target_info_length);
+ tvb, offset, 2, challenge_target_info_length);
offset += 2;
proto_tree_add_uint(challenge_target_info_tree, hf_ntlmssp_challenge_target_info_maxlen,
- tvb, offset, 2, challenge_target_info_maxlen);
+ tvb, offset, 2, challenge_target_info_maxlen);
offset += 2;
proto_tree_add_uint(challenge_target_info_tree, hf_ntlmssp_challenge_target_info_offset,
- tvb, offset, 4, challenge_target_info_offset);
+ tvb, offset, 4, challenge_target_info_offset);
offset += 4;
dissect_ntlmssp_target_info_list(tvb, challenge_target_info_tree,
/* tapping into ntlmssph not yet implemented */
static int
dissect_ntlmssp_challenge (tvbuff_t *tvb, packet_info *pinfo, int offset,
- proto_tree *ntlmssp_tree, ntlmssp_header_t *ntlmssph _U_)
+ proto_tree *ntlmssp_tree, ntlmssp_header_t *ntlmssph _U_)
{
guint32 negotiate_flags;
int item_start, item_end;
* XXX - Original name "domain" changed to "target_name" to match MS-NLMP
*/
offset = dissect_ntlmssp_string(tvb, offset, ntlmssp_tree, unicode_strings,
- hf_ntlmssp_challenge_target_name,
- &item_start, &item_end, NULL);
+ hf_ntlmssp_challenge_target_name,
+ &item_start, &item_end, NULL);
data_start = item_start;
data_end = item_end;
/* NTLMSSP Negotiate Flags */
offset = dissect_ntlmssp_negotiate_flags (tvb, offset, ntlmssp_tree,
- negotiate_flags);
+ negotiate_flags);
/* NTLMSSP NT Lan Manager Challenge */
proto_tree_add_item (ntlmssp_tree,
- hf_ntlmssp_ntlm_server_challenge,
- tvb, offset, 8, FALSE);
+ hf_ntlmssp_ntlm_server_challenge,
+ tvb, offset, 8, ENC_NA);
/*
* Store the flags and the RC4 state information with the conversation,
/*
* XXX - SSP key? The davenport document says
*
- * The context field is typically populated when Negotiate Local
- * Call is set. It contains an SSPI context handle, which allows
- * the client to "short-circuit" authentication and effectively
- * circumvent responding to the challenge. Physically, the context
- * is two long values. This is covered in greater detail later,
- * in the "Local Authentication" section.
+ * The context field is typically populated when Negotiate Local
+ * Call is set. It contains an SSPI context handle, which allows
+ * the client to "short-circuit" authentication and effectively
+ * circumvent responding to the challenge. Physically, the context
+ * is two long values. This is covered in greater detail later,
+ * in the "Local Authentication" section.
*
* It also says that that information may be omitted.
*/
proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_reserved,
- tvb, offset, 8, FALSE);
+ tvb, offset, 8, ENC_NA);
offset += 8;
/*
data_end = MAX(data_end, item_end);
}
- /* If there are more bytes before the data block dissect a version field */
+ /* If there are more bytes before the data block dissect a version field
+ if NTLMSSP_NEGOTIATE_VERSION is set in the flags (see MS-NLMP) */
if (offset < data_start) {
- offset = dissect_ntlmssp_version(tvb, offset, ntlmssp_tree);
+ if (negotiate_flags & NTLMSSP_NEGOTIATE_VERSION)
+ offset = dissect_ntlmssp_version(tvb, offset, ntlmssp_tree);
}
return MAX(offset, data_end);
static int
dissect_ntlmssp_auth (tvbuff_t *tvb, packet_info *pinfo, int offset,
- proto_tree *ntlmssp_tree, ntlmssp_header_t *ntlmssph)
+ proto_tree *ntlmssp_tree, ntlmssp_header_t *ntlmssph)
{
int item_start, item_end;
int data_start, data_end = 0;
/* Lan Manager response */
data_start = tvb_get_letohl(tvb, offset+4);
offset = dissect_ntlmssp_blob(tvb, offset, ntlmssp_tree,
- hf_ntlmssp_auth_lmresponse,
- &item_end,
- conv_ntlmssp_info == NULL ? NULL :
- &conv_ntlmssp_info->lm_response);
+ hf_ntlmssp_auth_lmresponse,
+ &item_end,
+ conv_ntlmssp_info == NULL ? NULL :
+ &conv_ntlmssp_info->lm_response);
data_end = MAX(data_end, item_end);
/* NTLM response */
item_start = tvb_get_letohl(tvb, offset+4);
offset = dissect_ntlmssp_blob(tvb, offset, ntlmssp_tree,
- hf_ntlmssp_auth_ntresponse,
- &item_end,
- conv_ntlmssp_info == NULL ? NULL :
- &conv_ntlmssp_info->ntlm_response);
+ hf_ntlmssp_auth_ntresponse,
+ &item_end,
+ conv_ntlmssp_info == NULL ? NULL :
+ &conv_ntlmssp_info->ntlm_response);
if( conv_ntlmssp_info != NULL && conv_ntlmssp_info->ntlm_response.length > 24 ) {
memcpy(conv_ntlmssp_info->client_challenge,conv_ntlmssp_info->ntlm_response.contents+32,8);
}
/* domain name */
item_start = tvb_get_letohl(tvb, offset+4);
offset = dissect_ntlmssp_string(tvb, offset, ntlmssp_tree,
- unicode_strings,
- hf_ntlmssp_auth_domain,
- &item_start, &item_end, &(ntlmssph->domain_name));
+ unicode_strings,
+ hf_ntlmssp_auth_domain,
+ &item_start, &item_end, &(ntlmssph->domain_name));
/*ntlmssph->domain_name_len=item_end-item_start;*/
data_start = MIN(data_start, item_start);
data_end = MAX(data_end, item_end);
/* user name */
item_start = tvb_get_letohl(tvb, offset+4);
offset = dissect_ntlmssp_string(tvb, offset, ntlmssp_tree,
- unicode_strings,
- hf_ntlmssp_auth_username,
- &item_start, &item_end, &(ntlmssph->acct_name));
+ unicode_strings,
+ hf_ntlmssp_auth_username,
+ &item_start, &item_end, &(ntlmssph->acct_name));
/*ntlmssph->acct_name_len=item_end-item_start;*/
data_start = MIN(data_start, item_start);
data_end = MAX(data_end, item_end);
- if (check_col(pinfo->cinfo, COL_INFO))
- col_append_fstr(pinfo->cinfo, COL_INFO, ", User: %s\\%s",
- ntlmssph->domain_name, ntlmssph->acct_name);
+ col_append_sep_fstr(pinfo->cinfo, COL_INFO, ", ", "User: %s\\%s",
+ ntlmssph->domain_name, ntlmssph->acct_name);
/* hostname */
item_start = tvb_get_letohl(tvb, offset+4);
offset = dissect_ntlmssp_string(tvb, offset, ntlmssp_tree,
- unicode_strings,
- hf_ntlmssp_auth_hostname,
- &item_start, &item_end, &(ntlmssph->host_name));
+ unicode_strings,
+ hf_ntlmssp_auth_hostname,
+ &item_start, &item_end, &(ntlmssph->host_name));
data_start = MIN(data_start, item_start);
data_end = MAX(data_end, item_end);
if (offset < data_start) {
/* Session Key */
offset = dissect_ntlmssp_blob(tvb, offset, ntlmssp_tree,
- hf_ntlmssp_auth_sesskey,
- &item_end, &sessionblob);
+ hf_ntlmssp_auth_sesskey,
+ &item_end, &sessionblob);
data_end = MAX(data_end, item_end);
}
if ((conv_ntlmssp_info != NULL) && (conv_ntlmssp_info->flags == 0)) {
conv_ntlmssp_info->flags = negotiate_flags;
}
- }
+ } else
+ negotiate_flags = 0;
- /* If there are more bytes before the data block dissect a version field */
+ /* If there are more bytes before the data block dissect a version field
+ if NTLMSSP_NEGOTIATE_VERSION is set in the flags (see MS-NLMP) */
if (offset < data_start) {
- offset = dissect_ntlmssp_version(tvb, offset, ntlmssp_tree);
+ if (negotiate_flags & NTLMSSP_NEGOTIATE_VERSION)
+ offset = dissect_ntlmssp_version(tvb, offset, ntlmssp_tree);
}
/* If there are still more bytes before the data block dissect an MIC (message integrity_code) field */
{
conv_ntlmssp_info->rc4_state_initialized = 0;
if( conv_ntlmssp_info->is_auth_ntlm_v2 ) {
- create_ntlmssp_v2_key(gbl_nt_password, conv_ntlmssp_info->server_challenge,conv_ntlmssp_info->client_challenge, sspkey,encryptedsessionkey,conv_ntlmssp_info->flags,conv_ntlmssp_info->ntlm_response,conv_ntlmssp_info->lm_response,ntlmssph);
+ create_ntlmssp_v2_key(gbl_nt_password, conv_ntlmssp_info->server_challenge,conv_ntlmssp_info->client_challenge, sspkey,encryptedsessionkey,conv_ntlmssp_info->flags,&conv_ntlmssp_info->ntlm_response,&conv_ntlmssp_info->lm_response,ntlmssph);
}
else
{
}
return MAX(offset, data_end);
}
+
static guint8*
get_sign_key(packet_info *pinfo, int cryptpeer)
{
ntlmssp_info *conv_ntlmssp_info;
conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst,
- pinfo->ptype, pinfo->srcport,
- pinfo->destport, 0);
+ pinfo->ptype, pinfo->srcport,
+ pinfo->destport, 0);
if (conversation == NULL) {
/* We don't have a conversation. In this case, stop processing
because we do not have enough info to decrypt the payload */
else {
/* We have a conversation, check for encryption state */
conv_ntlmssp_info = conversation_get_proto_data(conversation,
- proto_ntlmssp);
+ proto_ntlmssp);
if (conv_ntlmssp_info == NULL) {
/* No encryption state tied to the conversation. Therefore, we
- cannot decrypt the payload */
+ cannot decrypt the payload */
return NULL;
}
else {
/* We have the encryption state in the conversation. So return the
- crypt state tied to the requested peer
+ crypt state tied to the requested peer
*/
if (cryptpeer == 1) {
- return (guint8*)&conv_ntlmssp_info->sign_key_client;
+ return (guint8*)&conv_ntlmssp_info->sign_key_client;
} else {
- return (guint8*)&conv_ntlmssp_info->sign_key_server;
+ return (guint8*)&conv_ntlmssp_info->sign_key_server;
}
}
}
}
+
/*
* Get the encryption state tied to this conversation. cryptpeer indicates
* whether to retrieve the client key (1) or the server key (0)
ntlmssp_info *conv_ntlmssp_info;
conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst,
- pinfo->ptype, pinfo->srcport,
- pinfo->destport, 0);
+ pinfo->ptype, pinfo->srcport,
+ pinfo->destport, 0);
if (conversation == NULL) {
/* We don't have a conversation. In this case, stop processing
because we do not have enough info to decrypt the payload */
else {
/* We have a conversation, check for encryption state */
conv_ntlmssp_info = conversation_get_proto_data(conversation,
- proto_ntlmssp);
+ proto_ntlmssp);
if (conv_ntlmssp_info == NULL) {
/* No encryption state tied to the conversation. Therefore, we
- cannot decrypt the payload */
+ cannot decrypt the payload */
return NULL;
}
else {
/* We have the encryption state in the conversation. So return the
- crypt state tied to the requested peer
+ crypt state tied to the requested peer
*/
if (cryptpeer == 1) {
- return &conv_ntlmssp_info->rc4_state_client;
+ return &conv_ntlmssp_info->rc4_state_client;
} else {
- return &conv_ntlmssp_info->rc4_state_server;
+ return &conv_ntlmssp_info->rc4_state_server;
}
}
}
}
-void
+
+static void
decrypt_data_payload(tvbuff_t *tvb, int offset, guint32 encrypted_block_length,
- packet_info *pinfo, proto_tree *tree _U_,gpointer key);
+ packet_info *pinfo, proto_tree *tree _U_,gpointer key);
static void
decrypt_verifier(tvbuff_t *tvb, int offset, guint32 encrypted_block_length,
- packet_info *pinfo, proto_tree *tree,gpointer key);
-/*
-tvbuff_t *
+ packet_info *pinfo, proto_tree *tree,gpointer key);
+
+#if 0
+static tvbuff_t *
dissect_ntlmssp_encrypted_payload(tvbuff_t *data_tvb,
- tvbuff_t *auth_tvb _U_,
- int offset,
- packet_info *pinfo,
- dcerpc_auth_info *auth_info _U_)*/
+ tvbuff_t *auth_tvb _U_,
+ int offset,
+ packet_info *pinfo,
+ dcerpc_auth_info *auth_info _U_)
+#endif
-int
+static int
dissect_ntlmssp_payload(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree )
{
volatile int offset = 0;
guint32 ntlm_magic_size = 4;
guint32 ntlm_signature_size = 8;
guint32 ntlm_seq_size = 4;
+ void *pd_save;
+
length = tvb_length (tvb);
/* signature + seq + real payload */
encrypted_block_length = length - ntlm_magic_size;
/* Setup a new tree for the NTLMSSP payload */
if (tree) {
tf = proto_tree_add_item (tree,
- hf_ntlmssp_verf,
- tvb, offset, -1, FALSE);
+ hf_ntlmssp_verf,
+ tvb, offset, -1, ENC_NA);
ntlmssp_tree = proto_item_add_subtree (tf,
- ett_ntlmssp);
+ ett_ntlmssp);
}
/*
* in the packet after our blob to see, so we just re-throw the
* exception.
*/
+ pd_save = pinfo->private_data;
TRY {
/* Version number */
proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_verf_vers,
- tvb, offset, 4, TRUE);
+ tvb, offset, 4, ENC_LITTLE_ENDIAN);
offset += 4;
/* Encrypted body */
proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_verf_body,
- tvb, offset, ntlm_signature_size + ntlm_seq_size, TRUE);
+ tvb, offset, ntlm_signature_size + ntlm_seq_size, ENC_NA);
tvb_memcpy(tvb, key, offset, ntlm_signature_size + ntlm_seq_size);
/* Try to decrypt */
decrypt_data_payload (tvb, offset+(ntlm_signature_size + ntlm_seq_size), encrypted_block_length-(ntlm_signature_size + ntlm_seq_size), pinfo, ntlmssp_tree,key);
} CATCH(BoundsError) {
RETHROW;
} CATCH(ReportedBoundsError) {
+ /* Restore the private_data structure in case one of the
+ * called dissectors modified it (and, due to the exception,
+ * was unable to restore it).
+ */
+ pinfo->private_data = pd_save;
show_reported_bounds_error(tvb, pinfo, tree);
} ENDTRY;
return offset;
}
-void
+
+static void
decrypt_data_payload(tvbuff_t *tvb, int offset, guint32 encrypted_block_length,
- packet_info *pinfo, proto_tree *tree _U_,gpointer key)
+ packet_info *pinfo, proto_tree *tree _U_,gpointer key)
{
tvbuff_t *decr_tvb; /* Used to display decrypted buffer */
guint8 *peer_block;
if (!packet_ntlmssp_info->payload_decrypted) {
/* Pull the challenge info from the conversation */
conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst,
- pinfo->ptype, pinfo->srcport,
- pinfo->destport, 0);
+ pinfo->ptype, pinfo->srcport,
+ pinfo->destport, 0);
if (conversation == NULL) {
/* There is no conversation, thus no encryption state */
return ;
}
conv_ntlmssp_info = conversation_get_proto_data(conversation,
- proto_ntlmssp);
+ proto_ntlmssp);
if (conv_ntlmssp_info == NULL) {
/* There is no NTLMSSP state tied to the conversation */
- return ;
+ return ;
}
if (conv_ntlmssp_info->rc4_state_initialized != 1 ) {
- /* The crypto sybsystem is not initialized. This means that either
- the conversation did not include a challenge, or that we do not have the right password */
- return;
+ /* The crypto sybsystem is not initialized. This means that either
+ the conversation did not include a challenge, or that we do not have the right password */
+ return;
}
if( key != NULL ){
stored_packet_ntlmssp_info = g_hash_table_lookup(hash_packet,key);
/* Do the decryption of the payload */
crypt_rc4(rc4_state, packet_ntlmssp_info->decrypted_payload,
- encrypted_block_length);
+ encrypted_block_length);
/* decrypt the verifier */
/*printnchar(packet_ntlmssp_info->decrypted_payload,encrypted_block_length,"data: ","\n");*/
/* We setup a temporary buffer so we can re-encrypt the payload after
/* Show the decrypted buffer in a new window */
decr_tvb = tvb_new_real_data(packet_ntlmssp_info->decrypted_payload,
- encrypted_block_length,
- encrypted_block_length);
+ encrypted_block_length,
+ encrypted_block_length);
tvb_set_child_real_data_tvbuff(tvb, decr_tvb);
pinfo->gssapi_decrypted_tvb = decr_tvb;
}
+
static void
dissect_ntlmssp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
proto_tree *volatile ntlmssp_tree = NULL;
proto_item *tf = NULL;
ntlmssp_header_t *ntlmssph;
+ void *pd_save;
ntlmssph=ep_alloc(sizeof(ntlmssp_header_t));
ntlmssph->type=0;
/* Setup a new tree for the NTLMSSP payload */
if (tree) {
tf = proto_tree_add_item (tree,
- proto_ntlmssp,
- tvb, offset, -1, FALSE);
+ proto_ntlmssp,
+ tvb, offset, -1, ENC_NA);
ntlmssp_tree = proto_item_add_subtree (tf,
- ett_ntlmssp);
+ ett_ntlmssp);
}
/*
* in the packet after our blob to see, so we just re-throw the
* exception.
*/
+ pd_save = pinfo->private_data;
TRY {
/* NTLMSSP constant */
proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth,
- tvb, offset, 8, FALSE);
+ tvb, offset, 8, ENC_ASCII|ENC_NA);
offset += 8;
/* NTLMSSP Message Type */
proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_message_type,
- tvb, offset, 4, TRUE);
+ tvb, offset, 4, ENC_LITTLE_ENDIAN);
ntlmssph->type = tvb_get_letohl (tvb, offset);
offset += 4;
- if (check_col(pinfo->cinfo, COL_INFO))
- col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
- val_to_str(ntlmssph->type,
- ntlmssp_message_types,
- "Unknown message type"));
+ col_append_sep_fstr(pinfo->cinfo, COL_INFO, ", ","%s",
+ val_to_str(ntlmssph->type,
+ ntlmssp_message_types,
+ "Unknown message type"));
/* Call the appropriate dissector based on the Message Type */
switch (ntlmssph->type) {
default:
/* Unrecognized message type */
proto_tree_add_text (ntlmssp_tree, tvb, offset, -1,
- "Unrecognized NTLMSSP Message");
+ "Unrecognized NTLMSSP Message");
break;
}
} CATCH(BoundsError) {
RETHROW;
} CATCH(ReportedBoundsError) {
+ /* Restore the private_data structure in case one of the
+ * called dissectors modified it (and, due to the exception,
+ * was unable to restore it).
+ */
+ pinfo->private_data = pd_save;
show_reported_bounds_error(tvb, pinfo, tree);
} ENDTRY;
/*tap_queue_packet(ntlmssp_tap, pinfo, ntlmssph);*/
}
+static gboolean
+dissect_ntlmssp_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
+{
+
+ if(tvb_memeql(tvb, 0, "NTLMSSP", 8) == 0) {
+
+ dissect_ntlmssp(tvb, pinfo, parent_tree);
+ return TRUE;
+ }
+
+ return FALSE;
+}
/*
*/
static void
decrypt_verifier(tvbuff_t *tvb, int offset, guint32 encrypted_block_length,
- packet_info *pinfo, proto_tree *tree,gpointer key)
+ packet_info *pinfo, proto_tree *tree,gpointer key)
{
proto_tree *decr_tree = NULL;
proto_item *tf = NULL;
return;
}
conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst,
- pinfo->ptype, pinfo->srcport,
- pinfo->destport, 0);
+ pinfo->ptype, pinfo->srcport,
+ pinfo->destport, 0);
if (conversation == NULL) {
/* There is no conversation, thus no encryption state */
return;
}
conv_ntlmssp_info = conversation_get_proto_data(conversation,
- proto_ntlmssp);
+ proto_ntlmssp);
if (conv_ntlmssp_info == NULL) {
/* There is no NTLMSSP state tied to the conversation */
return;
if (!packet_ntlmssp_info->verifier_decrypted) {
if (conv_ntlmssp_info->rc4_state_initialized != 1 ) {
/* The crypto sybsystem is not initialized. This means that either
- the conversation did not include a challenge, or we are doing
- something other than NTLMSSP v1 */
+ the conversation did not include a challenge, or we are doing
+ something other than NTLMSSP v1 */
return;
}
if (conv_ntlmssp_info->server_dest_port == pinfo->destport) {
/* Setup the buffer to decrypt to */
tvb_memcpy(tvb, packet_ntlmssp_info->verifier,
- offset, encrypted_block_length);
+ offset, encrypted_block_length);
/*if( !(NTLMSSP_NEGOTIATE_KEY_EXCH & packet_ntlmssp_info->flags)) {*/
if( conv_ntlmssp_info->flags & NTLMSSP_NEGOTIATE_EXTENDED_SECURITY ) {
/* The spec says that if we have have a key exchange then we have a the signature that is crypted
* otherwise it's just a hmac_md5(keysign,concat(message,sequence))[0..7]
*/
- crypt_rc4(rc4_state, packet_ntlmssp_info->verifier,
- 8);
+ crypt_rc4(rc4_state, packet_ntlmssp_info->verifier, 8);
}
/*
* Try to check the HMAC MD5 of the message against those calculated works great with LDAP payload but
/* The packet has a PAD then a checksum then a sequence and they are encoded in this order so we can decrypt all at once */
/* Do the actual decryption of the verifier */
crypt_rc4(rc4_state, packet_ntlmssp_info->verifier,
- encrypted_block_length);
+ encrypted_block_length);
}
}
/* Show the decrypted buffer in a new window */
decr_tvb = tvb_new_child_real_data(tvb, packet_ntlmssp_info->verifier,
- encrypted_block_length,
- encrypted_block_length);
+ encrypted_block_length,
+ encrypted_block_length);
add_new_data_source(pinfo, decr_tvb,
- "Decrypted NTLMSSP Verifier");
+ "Decrypted NTLMSSP Verifier");
/* Show the decrypted payload in the tree */
tf = proto_tree_add_text(tree, decr_tvb, 0, -1,
- "Decrypted Verifier (%d byte%s)",
- encrypted_block_length,
- plurality(encrypted_block_length, "", "s"));
+ "Decrypted Verifier (%d byte%s)",
+ encrypted_block_length,
+ plurality(encrypted_block_length, "", "s"));
decr_tree = proto_item_add_subtree (tf, ett_ntlmssp);
if(( conv_ntlmssp_info->flags & NTLMSSP_NEGOTIATE_EXTENDED_SECURITY )) {
proto_tree_add_item (decr_tree, hf_ntlmssp_verf_hmacmd5,
- decr_tvb, decrypted_offset, 8,TRUE);
+ decr_tvb, decrypted_offset, 8,ENC_NA);
decrypted_offset += 8;
/* Incrementing sequence number of DCE conversation */
proto_tree_add_item (decr_tree, hf_ntlmssp_verf_sequence,
- decr_tvb, decrypted_offset, 4, TRUE);
+ decr_tvb, decrypted_offset, 4, ENC_NA);
decrypted_offset += 4;
}
else {
/* RANDOM PAD usually it's 0 */
proto_tree_add_item (decr_tree, hf_ntlmssp_verf_randompad,
- decr_tvb, decrypted_offset, 4, TRUE);
+ decr_tvb, decrypted_offset, 4, ENC_LITTLE_ENDIAN);
decrypted_offset += 4;
/* CRC32 of the DCE fragment data */
proto_tree_add_item (decr_tree, hf_ntlmssp_verf_crc32,
- decr_tvb, decrypted_offset, 4, TRUE);
+ decr_tvb, decrypted_offset, 4, ENC_LITTLE_ENDIAN);
decrypted_offset += 4;
/* Incrementing sequence number of DCE conversation */
proto_tree_add_item (decr_tree, hf_ntlmssp_verf_sequence,
- decr_tvb, decrypted_offset, 4, TRUE);
+ decr_tvb, decrypted_offset, 4, ENC_NA);
decrypted_offset += 4;
}
}
volatile int offset = 0;
proto_tree *volatile ntlmssp_tree = NULL;
guint32 encrypted_block_length;
+ void *pd_save;
+
/* the magic ntlm is the identifier of a NTLMSSP packet that's 00 00 00 01
*/
encrypted_block_length = tvb_length (tvb);
/* signature + seq + real payload */
/* Setup a new tree for the NTLMSSP payload */
- /*
+#if 0
if (tree) {
tf = proto_tree_add_item (tree,
- hf_ntlmssp_verf,
- tvb, offset, -1, FALSE);
+ hf_ntlmssp_verf,
+ tvb, offset, -1, ENC_NA);
ntlmssp_tree = proto_item_add_subtree (tf,
- ett_ntlmssp);
+ ett_ntlmssp);
}
- */
+#endif
/*
* Catch the ReportedBoundsError exception; the stuff we've been
* handed doesn't necessarily run to the end of the packet, it's
* in the packet after our blob to see, so we just re-throw the
* exception.
*/
+ pd_save = pinfo->private_data;
TRY {
/* Version number */
} CATCH(BoundsError) {
RETHROW;
} CATCH(ReportedBoundsError) {
+ /* Restore the private_data structure in case one of the
+ * called dissectors modified it (and, due to the exception,
+ * was unable to restore it).
+ */
+ pinfo->private_data = pd_save;
show_reported_bounds_error(tvb, pinfo, tree);
} ENDTRY;
return offset;
}
+
/* Used when NTLMSSP is done over DCE/RPC because in this case verifier and real payload are not contigious
* But in fact this function could be merged with wrap_dissect_ntlmssp_verf because it's only used there
*/
proto_item *tf = NULL;
guint32 verifier_length;
guint32 encrypted_block_length;
+ void *pd_save;
verifier_length = tvb_length (tvb);
encrypted_block_length = verifier_length - 4;
/* Setup a new tree for the NTLMSSP payload */
if (tree) {
tf = proto_tree_add_item (tree,
- hf_ntlmssp_verf,
- tvb, offset, -1, FALSE);
+ hf_ntlmssp_verf,
+ tvb, offset, -1, ENC_NA);
ntlmssp_tree = proto_item_add_subtree (tf,
- ett_ntlmssp);
+ ett_ntlmssp);
}
/*
* in the packet after our blob to see, so we just re-throw the
* exception.
*/
+ pd_save = pinfo->private_data;
TRY {
/* Version number */
proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_verf_vers,
- tvb, offset, 4, TRUE);
+ tvb, offset, 4, ENC_LITTLE_ENDIAN);
offset += 4;
/* Encrypted body */
proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_verf_body,
- tvb, offset, encrypted_block_length, TRUE);
+ tvb, offset, encrypted_block_length, ENC_NA);
/* Try to decrypt */
decrypt_verifier (tvb, offset, encrypted_block_length, pinfo, ntlmssp_tree,NULL);
} CATCH(BoundsError) {
RETHROW;
} CATCH(ReportedBoundsError) {
+ /* Restore the private_data structure in case one of the
+ * called dissectors modified it (and, due to the exception,
+ * was unable to restore it).
+ */
+ pinfo->private_data = pd_save;
show_reported_bounds_error(tvb, pinfo, tree);
} ENDTRY;
static tvbuff_t *
wrap_dissect_ntlmssp_payload_only(tvbuff_t *tvb,tvbuff_t *auth_tvb _U_,
- int offset, packet_info *pinfo,dcerpc_auth_info *auth_info _U_)
+ int offset, packet_info *pinfo,dcerpc_auth_info *auth_info _U_)
{
- tvbuff_t *data_tvb;
+ tvbuff_t *data_tvb;
- data_tvb = tvb_new_subset(
- tvb, offset, tvb_length_remaining(tvb, offset),
- tvb_length_remaining(tvb, offset));
- dissect_ntlmssp_payload_only(data_tvb, pinfo, NULL);
+ data_tvb = tvb_new_subset(
+ tvb, offset, tvb_length_remaining(tvb, offset),
+ tvb_length_remaining(tvb, offset));
+ dissect_ntlmssp_payload_only(data_tvb, pinfo, NULL);
return pinfo->gssapi_decrypted_tvb;
}
#if 0
-tvbuff_t *
+static tvbuff_t *
dissect_ntlmssp_encrypted_payload(tvbuff_t *data_tvb,
- tvbuff_t *auth_tvb _U_,
- int offset,
- packet_info *pinfo,
- dcerpc_auth_info *auth_info _U_)
+ tvbuff_t *auth_tvb _U_,
+ int offset,
+ packet_info *pinfo,
+ dcerpc_auth_info *auth_info _U_)
{
/* gssapi_decrypted_tvb=NULL */
tvbuff_t *decr_tvb; /* Used to display decrypted buffer */
if (!packet_ntlmssp_info->payload_decrypted) {
/* Pull the challenge info from the conversation */
conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst,
- pinfo->ptype, pinfo->srcport,
- pinfo->destport, 0);
+ pinfo->ptype, pinfo->srcport,
+ pinfo->destport, 0);
if (conversation == NULL) {
/* There is no conversation, thus no encryption state */
return NULL;
}
conv_ntlmssp_info = conversation_get_proto_data(conversation,
- proto_ntlmssp);
+ proto_ntlmssp);
if (conv_ntlmssp_info == NULL) {
/* There is no NTLMSSP state tied to the conversation */
return NULL;
/* Do the decryption of the payload */
crypt_rc4(rc4_state, packet_ntlmssp_info->decrypted_payload,
- encrypted_block_length);
+ encrypted_block_length);
/* We setup a temporary buffer so we can re-encrypt the payload after
decryption. This is to update the opposite peer's RC4 state */
/* Show the decrypted buffer in a new window */
decr_tvb = tvb_new_child_real_data(data_tvb, packet_ntlmssp_info->decrypted_payload,
- encrypted_block_length,
- encrypted_block_length);
+ encrypted_block_length,
+ encrypted_block_length);
offset += encrypted_block_length;
static void
free_payload(gpointer decrypted_payload, gpointer user_data _U_)
{
- g_free(decrypted_payload);
+ g_free(decrypted_payload);
}
-guint g_header_hash(gconstpointer pointer) {
+static guint
+header_hash(gconstpointer pointer)
+{
guint32 crc = ~crc32c_calculate(pointer,NTLMSSP_KEY_LEN,CRC32C_PRELOAD);
/* Mat TBD fprintf(stderr,"Val: %u\n",crc);*/
return crc;
}
-gboolean g_header_equal(gconstpointer pointer1, gconstpointer pointer2) {
+static gboolean
+header_equal(gconstpointer pointer1, gconstpointer pointer2)
+{
if(!memcmp(pointer1,pointer2,16)) {
return TRUE;
}
static void
ntlmssp_init_protocol(void)
{
- /*
- * Free the decrypted payloads, and then free the list of decrypted
- * payloads.
- */
- if (decrypted_payloads != NULL) {
- g_slist_foreach(decrypted_payloads, free_payload, NULL);
- g_slist_free(decrypted_payloads);
- decrypted_payloads = NULL;
- }
+ /*
+ * Free the decrypted payloads, and then free the list of decrypted
+ * payloads.
+ */
+ if (decrypted_payloads != NULL) {
+ g_slist_foreach(decrypted_payloads, free_payload, NULL);
+ g_slist_free(decrypted_payloads);
+ decrypted_payloads = NULL;
+ }
if(hash_packet == NULL) {
- hash_packet = g_hash_table_new(g_header_hash,g_header_equal);
+ hash_packet = g_hash_table_new(header_hash, header_equal);
}
}
+static int
+wrap_dissect_ntlmssp(tvbuff_t *tvb, int offset, packet_info *pinfo,
+ proto_tree *tree, guint8 *drep _U_)
+{
+ tvbuff_t *auth_tvb;
+
+ auth_tvb = tvb_new_subset(
+ tvb, offset, tvb_length_remaining(tvb, offset),
+ tvb_length_remaining(tvb, offset));
+
+ dissect_ntlmssp(auth_tvb, pinfo, tree);
+
+ return tvb_length_remaining(tvb, offset);
+}
+
+static int
+wrap_dissect_ntlmssp_verf(tvbuff_t *tvb, int offset, packet_info *pinfo,
+ proto_tree *tree, guint8 *drep _U_)
+{
+ tvbuff_t *auth_tvb;
+
+ auth_tvb = tvb_new_subset(
+ tvb, offset, tvb_length_remaining(tvb, offset),
+ tvb_length_remaining(tvb, offset));
+ return dissect_ntlmssp_verf(auth_tvb, pinfo, tree);
+}
+
+static dcerpc_auth_subdissector_fns ntlmssp_sign_fns = {
+ wrap_dissect_ntlmssp, /* Bind */
+ wrap_dissect_ntlmssp, /* Bind ACK */
+ wrap_dissect_ntlmssp, /* AUTH3 */
+ wrap_dissect_ntlmssp_verf, /* Request verifier */
+ wrap_dissect_ntlmssp_verf, /* Response verifier */
+ NULL, /* Request data */
+ NULL /* Response data */
+};
+
+static dcerpc_auth_subdissector_fns ntlmssp_seal_fns = {
+ wrap_dissect_ntlmssp, /* Bind */
+ wrap_dissect_ntlmssp, /* Bind ACK */
+ wrap_dissect_ntlmssp, /* AUTH3 */
+ wrap_dissect_ntlmssp_verf, /* Request verifier */
+ wrap_dissect_ntlmssp_verf, /* Response verifier */
+ wrap_dissect_ntlmssp_payload_only, /* Request data */
+ wrap_dissect_ntlmssp_payload_only /* Response data */
+};
+
void
proto_register_ntlmssp(void)
{
{ &hf_ntlmssp_version_minor,
{ "Minor Version", "ntlmssp.version.minor", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL}},
{ &hf_ntlmssp_version_build_number,
- { "Major Version", "ntlmssp.version.build_number", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL}},
+ { "Build Number", "ntlmssp.version.build_number", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL}},
{ &hf_ntlmssp_version_ntlm_current_revision,
{ "NTLM Current Revision", "ntlmssp.version.ntlm_current_revision", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL}},
module_t *ntlmssp_module;
proto_ntlmssp = proto_register_protocol (
- "NTLM Secure Service Provider", /* name */
- "NTLMSSP", /* short name */
- "ntlmssp" /* abbrev */
- );
+ "NTLM Secure Service Provider", /* name */
+ "NTLMSSP", /* short name */
+ "ntlmssp" /* abbrev */
+ );
proto_register_field_array (proto_ntlmssp, hf, array_length (hf));
proto_register_subtree_array (ett, array_length (ett));
register_init_routine(&ntlmssp_init_protocol);
ntlmssp_module = prefs_register_protocol(proto_ntlmssp, NULL);
prefs_register_string_preference(ntlmssp_module, "nt_password",
- "NT Password",
- "NT Password (used to decrypt payloads)",
- &gbl_nt_password);
+ "NT Password",
+ "NT Password (used to decrypt payloads)",
+ &gbl_nt_password);
register_dissector("ntlmssp", dissect_ntlmssp, proto_ntlmssp);
new_register_dissector("ntlmssp_payload", dissect_ntlmssp_payload, proto_ntlmssp);
new_register_dissector("ntlmssp_verf", dissect_ntlmssp_verf, proto_ntlmssp);
}
-static int wrap_dissect_ntlmssp(tvbuff_t *tvb, int offset, packet_info *pinfo,
- proto_tree *tree, guint8 *drep _U_)
-{
- tvbuff_t *auth_tvb;
-
- auth_tvb = tvb_new_subset(
- tvb, offset, tvb_length_remaining(tvb, offset),
- tvb_length_remaining(tvb, offset));
-
- dissect_ntlmssp(auth_tvb, pinfo, tree);
-
- return tvb_length_remaining(tvb, offset);
-}
-
-static int wrap_dissect_ntlmssp_verf(tvbuff_t *tvb, int offset, packet_info *pinfo,
- proto_tree *tree, guint8 *drep _U_)
-{
- tvbuff_t *auth_tvb;
-
- auth_tvb = tvb_new_subset(
- tvb, offset, tvb_length_remaining(tvb, offset),
- tvb_length_remaining(tvb, offset));
- return dissect_ntlmssp_verf(auth_tvb, pinfo, tree);
-}
-
-static dcerpc_auth_subdissector_fns ntlmssp_sign_fns = {
- wrap_dissect_ntlmssp, /* Bind */
- wrap_dissect_ntlmssp, /* Bind ACK */
- wrap_dissect_ntlmssp, /* AUTH3 */
- wrap_dissect_ntlmssp_verf, /* Request verifier */
- wrap_dissect_ntlmssp_verf, /* Response verifier */
- NULL, /* Request data */
- NULL /* Response data */
-};
-
-static dcerpc_auth_subdissector_fns ntlmssp_seal_fns = {
- wrap_dissect_ntlmssp, /* Bind */
- wrap_dissect_ntlmssp, /* Bind ACK */
- wrap_dissect_ntlmssp, /* AUTH3 */
- wrap_dissect_ntlmssp_verf, /* Request verifier */
- wrap_dissect_ntlmssp_verf, /* Response verifier */
- wrap_dissect_ntlmssp_payload_only, /* Request data */
- wrap_dissect_ntlmssp_payload_only /* Response data */
-};
-
void
proto_reg_handoff_ntlmssp(void)
{
ntlmssp_handle = find_dissector("ntlmssp");
ntlmssp_wrap_handle = find_dissector("ntlmssp_verf");
gssapi_init_oid("1.3.6.1.4.1.311.2.2.10", proto_ntlmssp, ett_ntlmssp,
- ntlmssp_handle, ntlmssp_wrap_handle,
- "NTLMSSP - Microsoft NTLM Security Support Provider");
+ ntlmssp_handle, ntlmssp_wrap_handle,
+ "NTLMSSP - Microsoft NTLM Security Support Provider");
/* Register authenticated pipe dissector */
* any other levels here?
*/
register_dcerpc_auth_subdissector(DCE_C_AUTHN_LEVEL_CONNECT,
- DCE_C_RPC_AUTHN_PROTOCOL_NTLMSSP,
- &ntlmssp_sign_fns);
+ DCE_C_RPC_AUTHN_PROTOCOL_NTLMSSP,
+ &ntlmssp_sign_fns);
register_dcerpc_auth_subdissector(DCE_C_AUTHN_LEVEL_PKT,
- DCE_C_RPC_AUTHN_PROTOCOL_NTLMSSP,
- &ntlmssp_sign_fns);
+ DCE_C_RPC_AUTHN_PROTOCOL_NTLMSSP,
+ &ntlmssp_sign_fns);
register_dcerpc_auth_subdissector(DCE_C_AUTHN_LEVEL_PKT_INTEGRITY,
- DCE_C_RPC_AUTHN_PROTOCOL_NTLMSSP,
- &ntlmssp_sign_fns);
+ DCE_C_RPC_AUTHN_PROTOCOL_NTLMSSP,
+ &ntlmssp_sign_fns);
register_dcerpc_auth_subdissector(DCE_C_AUTHN_LEVEL_PKT_PRIVACY,
- DCE_C_RPC_AUTHN_PROTOCOL_NTLMSSP,
- &ntlmssp_seal_fns);
+ DCE_C_RPC_AUTHN_PROTOCOL_NTLMSSP,
+ &ntlmssp_seal_fns);
ntlmssp_tap = register_tap("ntlmssp");
+
+ heur_dissector_add("credssp", dissect_ntlmssp_heur, proto_ntlmssp);
+
}
/*
* indent-tabs-mode: nil
* End:
*
- * vi: set shiftwidth=2 tabstop=8 expandtab
+ * vi: set shiftwidth=2 tabstop=8 expandtab:
* :indentSize=2:tabSize=8:noTabs=true:
*/
git.samba.org / obnox / wireshark / wip.git / blobdiff