2 * Routines for SMB net logon packet dissection
3 * Copyright 2000, Jeffrey C. Foster <jfoste@woodward.com>
7 * Wireshark - Network traffic analyzer
8 * By Gerald Combs <gerald@wireshark.org>
9 * Copyright 1998 Gerald Combs
11 * Copied from packet-pop.c
13 * This program is free software; you can redistribute it and/or
14 * modify it under the terms of the GNU General Public License
15 * as published by the Free Software Foundation; either version 2
16 * of the License, or (at your option) any later version.
18 * This program is distributed in the hope that it will be useful,
19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21 * GNU General Public License for more details.
23 * You should have received a copy of the GNU General Public License
24 * along with this program; if not, write to the Free Software
25 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
34 #include <epan/packet.h>
35 #include "packet-windows-common.h"
36 #include "packet-smb-common.h"
38 static int proto_smb_logon = -1;
39 static int hf_command = -1;
40 static int hf_computer_name = -1;
41 static int hf_unicode_computer_name = -1;
42 static int hf_server_name = -1;
43 static int hf_user_name = -1;
44 static int hf_domain_name = -1;
45 static int hf_server_dns_name = -1;
46 static int hf_forest_dns_name = -1;
47 static int hf_domain_dns_name = -1;
48 static int hf_mailslot_name = -1;
49 static int hf_pdc_name = -1;
50 static int hf_unicode_pdc_name = -1;
51 static int hf_script_name = -1;
52 static int hf_nt_version = -1;
53 static int hf_lmnt_token = -1;
54 static int hf_lm_token = -1;
55 static int hf_major_version = -1;
56 static int hf_minor_version = -1;
57 static int hf_os_version = -1;
58 static int hf_date_time = -1;
59 static int hf_update_type = -1;
60 static int hf_request_count = -1;
61 static int hf_flags_autolock = -1;
62 static int hf_flags_expire = -1;
63 static int hf_flags_server_trust = -1;
64 static int hf_flags_workstation_trust = -1;
65 static int hf_flags_interdomain_trust = -1;
66 static int hf_flags_mns_user = -1;
67 static int hf_flags_normal_user = -1;
68 static int hf_flags_temp_dup_user = -1;
69 static int hf_flags_password_required = -1;
70 static int hf_flags_homedir_required = -1;
71 static int hf_flags_enabled = -1;
72 static int hf_domain_sid_size = -1;
73 static int hf_low_serial = -1;
74 static int hf_pulse = -1;
75 static int hf_random = -1;
76 static int hf_db_count = -1;
77 static int hf_db_index = -1;
78 static int hf_large_serial = -1;
79 static int hf_nt_date_time = -1;
81 static int hf_unknown8 = -1;
82 static int hf_unknown32 = -1;
84 static int hf_domain_guid = -1;
85 static int hf_server_ip = -1;
87 static int hf_server_site_name = -1;
88 static int hf_client_site_name = -1;
90 static int ett_smb_logon = -1;
91 static int ett_smb_account_flags = -1;
92 static int ett_smb_db_info = -1;
94 #define ACC_FLAG_AUTO_LOCKED 0x0400
95 #define ACC_FLAG_EXPIRE 0x0200
96 #define ACC_FLAG_SERVER_TRUST 0x0100
97 #define ACC_FLAG_WORKSTATION_TRUST 0x0080
98 #define ACC_FLAG_INTERDOMAIN_TRUST 0x0040
99 #define ACC_FLAG_MNS_USER 0x0020
100 #define ACC_FLAG_NORMAL_USER 0x0010
101 #define ACC_FLAG_TEMP_DUP_USER 0x0008
102 #define ACC_FLAG_PASSWORD_REQUIRED 0x0004
103 #define ACC_FLAG_HOMEDIR_REQUIRED 0x0002
104 #define ACC_FLAG_ENABLED 0x0001
106 static const true_false_string tfs_flags_autolock = {
107 "User account auto-locked",
108 "User account NOT auto-locked"
110 static const true_false_string tfs_flags_expire = {
111 "User password will NOT expire",
112 "User password will expire"
114 static const true_false_string tfs_flags_server_trust = {
115 "Server Trust user account",
116 "NOT a Server Trust user account"
118 static const true_false_string tfs_flags_workstation_trust = {
119 "Workstation Trust user account",
120 "NOT a Workstation Trust user account"
122 static const true_false_string tfs_flags_interdomain_trust = {
123 "Inter-domain Trust user account",
124 "NOT a Inter-domain Trust user account"
126 static const true_false_string tfs_flags_mns_user = {
127 "MNS Logon user account",
128 "NOT a MNS Logon user account"
130 static const true_false_string tfs_flags_normal_user = {
131 "Normal user account",
132 "NOT a normal user account"
134 static const true_false_string tfs_flags_temp_dup_user = {
135 "Temp duplicate user account",
136 "NOT a temp duplicate user account"
138 static const true_false_string tfs_flags_password_required = {
139 "NO password required",
142 static const true_false_string tfs_flags_homedir_required = {
143 "NO homedir required",
146 static const true_false_string tfs_flags_enabled = {
147 "User account enabled",
148 "User account disabled"
154 dissect_account_control(tvbuff_t *tvb, proto_tree *tree, int offset)
156 /* display the Allowable Account control bits */
158 proto_item *ti = NULL;
159 proto_tree *flags_tree = NULL;
162 flags = tvb_get_letohl(tvb, offset);
165 ti = proto_tree_add_text(tree, tvb, offset, 4,
166 "Account control = 0x%04x", flags);
168 flags_tree = proto_item_add_subtree(ti, ett_smb_account_flags);
171 proto_tree_add_boolean(flags_tree, hf_flags_autolock, tvb, offset, 4, flags);
172 proto_tree_add_boolean(flags_tree, hf_flags_expire, tvb, offset, 4, flags);
173 proto_tree_add_boolean(flags_tree, hf_flags_server_trust, tvb, offset, 4, flags);
174 proto_tree_add_boolean(flags_tree, hf_flags_workstation_trust, tvb, offset, 4, flags);
175 proto_tree_add_boolean(flags_tree, hf_flags_interdomain_trust, tvb, offset, 4, flags);
176 proto_tree_add_boolean(flags_tree, hf_flags_mns_user, tvb, offset, 4, flags);
177 proto_tree_add_boolean(flags_tree, hf_flags_normal_user, tvb, offset, 4, flags);
178 proto_tree_add_boolean(flags_tree, hf_flags_temp_dup_user, tvb, offset, 4, flags);
179 proto_tree_add_boolean(flags_tree, hf_flags_password_required, tvb, offset, 4, flags);
180 proto_tree_add_boolean(flags_tree, hf_flags_homedir_required, tvb, offset, 4, flags);
181 proto_tree_add_boolean(flags_tree, hf_flags_enabled, tvb, offset, 4, flags);
189 display_LM_token(tvbuff_t *tvb, int offset, proto_tree *tree)
193 Token = tvb_get_letohs(tvb, offset);
196 proto_tree_add_uint_format(tree, hf_lm_token, tvb, offset, 2,
198 "LM20 Token: 0x%04x (LanMan 2.0 or higher)", Token);
201 * XXX - are all values with the lower bit set LM 2.0,
202 * and all values with it not set LM 1.0?
203 * What do the other bits mean, if anything?
205 proto_tree_add_uint_format(tree, hf_lm_token, tvb, offset, 2,
207 "LM10 Token: 0x%04x (WFW Networking)", Token);
216 display_LMNT_token(tvbuff_t *tvb, int offset, proto_tree *tree)
220 Token = tvb_get_letohs(tvb, offset);
222 if (Token == 0xffff) {
223 proto_tree_add_uint_format(tree, hf_lmnt_token, tvb, offset, 2,
225 "LMNT Token: 0x%04x (Windows NT Networking)", Token);
228 * XXX - what is it if it's not 0xffff?
230 proto_tree_add_uint_format(tree, hf_lm_token, tvb, offset, 2,
232 "LMNT Token: 0x%04x (Unknown)", Token);
241 dissect_smb_logon_request(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
243 /*** 0x00 (LM1.0/LM2.0 LOGON Request) ***/
246 offset = display_ms_string(tvb, tree, offset, hf_computer_name, NULL);
249 offset = display_ms_string(tvb, tree, offset, hf_user_name, NULL);
252 offset = display_ms_string(tvb, tree, offset, hf_mailslot_name, NULL);
254 /*$$$$$ here add the Mailslot to the response list (if needed) */
257 proto_tree_add_item(tree, hf_request_count, tvb, offset, 1, TRUE);
261 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 2, TRUE);
265 offset = display_LM_token(tvb, offset, tree);
273 dissect_smb_logon_LM10_resp(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
275 /*** 0x01 LanMan 1.0 Logon response ***/
278 offset = display_ms_string(tvb, tree, offset, hf_user_name, NULL);
281 offset = display_ms_string(tvb, tree, offset, hf_script_name, NULL);
288 dissect_smb_logon_2(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
290 /*** 0x02 LM1.0 Query - Centralized Initialization ***/
291 /*** 0x03 LM1.0 Query - Distributed Initialization ***/
292 /*** 0x04 LM1.0 Query - Centralized Query Response ***/
293 /*** 0x04 LM1.0 Query - Distributed Query Response ***/
296 offset = display_ms_string(tvb, tree, offset, hf_computer_name, NULL);
299 offset = display_ms_string(tvb, tree, offset, hf_mailslot_name, NULL);
302 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 2, TRUE);
306 offset = display_LM_token(tvb, offset, tree);
314 dissect_smb_logon_LM20_resp(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
316 /*** 0x06 (LM2.0 LOGON Response) ***/
319 offset = display_ms_string(tvb, tree, offset, hf_server_name, NULL);
322 offset = display_LM_token(tvb, offset, tree);
330 dissect_smb_pdc_query(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
334 /*** 0x07 Query for Primary PDC ***/
337 offset = display_ms_string(tvb, tree, offset, hf_computer_name, &name);
339 if (check_col(pinfo->cinfo, COL_INFO))
340 col_append_fstr(pinfo->cinfo, COL_INFO, " from %s", name);
343 offset = display_ms_string(tvb, tree, offset, hf_mailslot_name, NULL);
345 if (tvb_reported_length_remaining(tvb, offset) > 2) {
347 * NT-style Query for PDC?
348 * If only 2 bytes remain, it's probably a Windows 95-style
349 * query, which has only an LM token after the mailslot
352 * XXX - base this on flags in the SMB header, e.g.
353 * the ASCII/Unicode strings flag?
355 if (offset % 2) offset++; /* word align ... */
357 /* Unicode computer name */
358 offset = display_unicode_string(tvb, tree, offset, hf_unicode_computer_name, NULL);
361 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
365 offset = display_LMNT_token(tvb, offset, tree);
369 offset = display_LM_token(tvb, offset, tree);
377 dissect_smb_pdc_startup(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
379 /*** 0x08 Announce startup of PDC ***/
382 offset = display_ms_string(tvb, tree, offset, hf_pdc_name, NULL);
384 /* A short Announce will not have the rest */
386 if (tvb_reported_length_remaining(tvb, offset) != 0) {
389 if (offset % 2) offset++; /* word align ... */
392 offset = display_unicode_string(tvb, tree, offset, hf_unicode_pdc_name, &name);
394 if (name && check_col(pinfo->cinfo, COL_INFO)) {
395 col_append_fstr(pinfo->cinfo, COL_INFO, ": host %s", name);
399 if (offset % 2) offset++;
402 offset = display_unicode_string(tvb, tree, offset, hf_domain_name, &name);
404 if (name && check_col(pinfo->cinfo, COL_INFO)) {
405 col_append_fstr(pinfo->cinfo, COL_INFO, ", domain %s", name);
410 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
414 offset = display_LMNT_token(tvb, offset, tree);
417 offset = display_LM_token(tvb, offset, tree);
426 dissect_smb_pdc_failure(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
428 /*** 0x09 Announce failure of the PDC ***/
429 /*** 0x0F LM2.0 Resp. during LOGON pause ***/
430 /*** 0x10 (LM 2.0 Unknown user response) ***/
433 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
437 offset = display_LM_token(tvb, offset, tree);
444 dissect_announce_change(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
446 /*** 0x0A ( Announce change to UAS or SAM ) ***/
448 proto_item *ti = NULL;
449 proto_tree *info_tree = NULL;
451 guint32 domain_sid_size;
453 /* low serial number */
454 proto_tree_add_item(tree, hf_low_serial, tvb, offset, 4, TRUE);
458 /* XXX - what format is this? Neither SMB_Date/SMB_Time nor
459 "time_t but in the local time zone" appear to be correct. */
460 proto_tree_add_item(tree, hf_date_time, tvb, offset, 4, TRUE);
464 proto_tree_add_item(tree, hf_pulse, tvb, offset, 4, TRUE);
468 proto_tree_add_item(tree, hf_random, tvb, offset, 4, TRUE);
472 offset = display_ms_string(tvb, tree, offset, hf_pdc_name, NULL);
475 offset = display_ms_string(tvb, tree, offset, hf_domain_name, NULL);
477 if (offset % 2) offset++; /* word align ... */
479 if (tvb_reported_length_remaining(tvb, offset) > 2) {
481 * XXX - older protocol versions don't have this stuff?
484 offset = display_unicode_string(tvb, tree, offset, hf_unicode_pdc_name, NULL);
487 offset = display_unicode_string(tvb, tree, offset, hf_domain_name, NULL);
490 info_count = tvb_get_letohl(tvb, offset);
491 proto_tree_add_uint(tree, hf_db_count, tvb, offset, 4, info_count);
494 while (info_count != 0) {
495 db_index = tvb_get_letohl(tvb, offset);
497 ti = proto_tree_add_text(tree, tvb, offset, 20,
498 "DBChange Info Structure: index %u", db_index);
499 info_tree = proto_item_add_subtree(ti, ett_smb_db_info);
502 proto_tree_add_uint(info_tree, hf_db_index, tvb, offset, 4,
506 proto_tree_add_item(info_tree, hf_large_serial, tvb, offset, 8,
510 offset = dissect_nt_64bit_time(tvb, info_tree, offset,
516 /* Domain SID Size */
517 domain_sid_size = tvb_get_letohl(tvb, offset);
518 proto_tree_add_uint(tree, hf_domain_sid_size, tvb, offset, 4,
522 if (domain_sid_size != 0) {
523 /* Align to four-byte boundary */
524 offset = ((offset + 3)/4)*4;
527 offset = dissect_nt_sid(
528 tvb, offset, tree, "Domain", NULL, -1);
532 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
536 offset = display_LMNT_token(tvb, offset, tree);
540 offset = display_LM_token(tvb, offset, tree);
547 dissect_smb_sam_logon_req(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
549 /* Netlogon command 0x12 - decode the SAM logon request from client */
551 guint32 domain_sid_size;
554 proto_tree_add_item(tree, hf_request_count, tvb, offset, 2, TRUE);
558 offset = display_unicode_string(tvb, tree, offset, hf_unicode_computer_name, NULL);
561 offset = display_unicode_string(tvb, tree, offset, hf_user_name, NULL);
564 offset = display_ms_string(tvb, tree, offset, hf_mailslot_name, NULL);
566 /* account control */
567 offset = dissect_account_control(tvb, tree, offset);
569 /* Domain SID Size */
570 domain_sid_size = tvb_get_letohl(tvb, offset);
571 proto_tree_add_uint(tree, hf_domain_sid_size, tvb, offset, 4,
575 if (domain_sid_size != 0) {
576 /* Align to four-byte boundary */
577 offset = ((offset + 3)/4)*4;
580 offset = dissect_nt_sid(tvb, offset, tree, "Domain", NULL, -1);
584 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
588 offset = display_LMNT_token(tvb, offset, tree);
591 offset = display_LM_token(tvb, offset, tree);
599 dissect_smb_no_user(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
601 /* 0x0B (Announce no user on machine) */
604 offset = display_ms_string(tvb, tree, offset, hf_computer_name, NULL);
612 dissect_smb_relogon_resp(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
614 /*** 0x0d LanMan Response to relogon request ***/
617 proto_tree_add_item(tree, hf_major_version, tvb, offset, 1, TRUE);
621 proto_tree_add_item(tree, hf_minor_version, tvb, offset, 1, TRUE);
625 proto_tree_add_item(tree, hf_os_version, tvb, offset, 1, TRUE);
629 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
633 offset = display_LM_token(tvb, offset, tree);
641 dissect_smb_acc_update(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
643 /*** 0x11 LM2.1 Announce Acc updates ***/
645 guint32 Temp1, Temp2;
647 Temp1 = tvb_get_letohl(tvb, offset);
648 Temp2 = tvb_get_letohl(tvb, offset + 4);
651 proto_tree_add_text(tree, tvb, offset, 8, "Signature: 0x%08x%08x",
656 /* XXX - what format is this? Neither SMB_Date/SMB_Time nor
657 "time_t but in the local time zone" appear to be correct. */
658 proto_tree_add_item(tree, hf_date_time, tvb, offset, 4, TRUE);
662 offset = display_ms_string(tvb, tree, offset, hf_computer_name, NULL);
665 offset = display_ms_string(tvb, tree, offset, hf_user_name, NULL);
668 proto_tree_add_item(tree, hf_update_type, tvb, offset, 2, TRUE);
672 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
676 offset = display_LM_token(tvb, offset, tree);
684 dissect_smb_inter_resp(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
686 /* 0x0e LanMan Response to interrogate request */
689 proto_tree_add_item(tree, hf_major_version, tvb, offset, 1, TRUE);
693 proto_tree_add_item(tree, hf_minor_version, tvb, offset, 1, TRUE);
697 proto_tree_add_item(tree, hf_os_version, tvb, offset, 1, TRUE);
701 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
705 offset = display_LMNT_token(tvb, offset, tree);
707 /* XXX - no LM token? Every other packet has one after the LMNT
715 dissect_smb_sam_logon_resp(tvbuff_t *tvb, packet_info *pinfo _U_,
716 proto_tree *tree, int offset)
718 /* Netlogon command 0x13 - decode the SAM logon response from server */
719 /* Netlogon command 0x15 - decode the SAM logon response from server unknown user */
722 offset = display_unicode_string(tvb, tree, offset, hf_server_name, NULL);
725 offset = display_unicode_string(tvb, tree, offset, hf_user_name, NULL);
728 offset = display_unicode_string(tvb, tree, offset, hf_domain_name, NULL);
731 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
735 offset = display_LMNT_token(tvb, offset, tree);
738 offset = display_LM_token(tvb, offset, tree);
744 dissect_smb_pdc_response_ads(tvbuff_t *tvb, packet_info *pinfo _U_,
745 proto_tree *tree, int offset)
747 /* Netlogon command 0x17 - decode the response from PDC ADS */
748 /* Netlogon command 0x19 - decode the response from PDC ADS USER ?*/
750 /* Align to four-byte boundary */
751 offset = ((offset + 3)/4)*4;
753 /* unknown uint32 type */
754 proto_tree_add_item(tree, hf_unknown32, tvb, offset, 4, TRUE);
758 proto_tree_add_item(tree, hf_domain_guid, tvb, offset, 16, TRUE);
761 /* forest dns name */
762 offset=dissect_ms_compressed_string(tvb, tree, offset, hf_forest_dns_name, FALSE, NULL);
764 /* domain dns name */
765 offset=dissect_ms_compressed_string(tvb, tree, offset, hf_domain_dns_name, FALSE, NULL);
767 /* server dns name */
768 offset=dissect_ms_compressed_string(tvb, tree, offset, hf_server_dns_name, FALSE, NULL);
771 offset=dissect_ms_compressed_string(tvb, tree, offset, hf_domain_name, FALSE, NULL);
774 offset=dissect_ms_compressed_string(tvb, tree, offset, hf_server_name, FALSE, NULL);
777 offset=dissect_ms_compressed_string(tvb, tree, offset, hf_user_name, FALSE, NULL);
779 /* server_site name */
780 offset=dissect_ms_compressed_string(tvb, tree, offset, hf_server_site_name, FALSE, NULL);
782 /* client_site name */
783 offset=dissect_ms_compressed_string(tvb, tree, offset, hf_client_site_name, FALSE, NULL);
785 /* unknown uint8 type */
786 proto_tree_add_item(tree, hf_unknown8, tvb, offset, 1, TRUE);
789 /* unknown uint32 type */
790 proto_tree_add_item(tree, hf_unknown32, tvb, offset, 4, TRUE);
794 proto_tree_add_item(tree, hf_server_ip, tvb, offset, 4, FALSE);
797 /* unknown uint32 type */
798 proto_tree_add_item(tree, hf_unknown32, tvb, offset, 4, TRUE);
801 /* unknown uint32 type */
802 proto_tree_add_item(tree, hf_unknown32, tvb, offset, 4, TRUE);
806 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
810 offset = display_LMNT_token(tvb, offset, tree);
813 offset = display_LM_token(tvb, offset, tree);
819 dissect_smb_unknown(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
821 /* display data as unknown */
823 proto_tree_add_text(tree, tvb, offset, -1, "Data (%u bytes)",
824 tvb_reported_length_remaining(tvb, offset));
826 return offset+tvb_length_remaining(tvb, offset);
829 #define LOGON_LM10_LOGON_REQUEST 0x00
830 #define LOGON_LM10_LOGON_RESPONSE 0x01
831 #define LOGON_LM10_QUERY_CI 0x02
832 #define LOGON_LM10_QUERY_DI 0x03
833 #define LOGON_LM10_RESPONSE_CI 0x04
834 #define LOGON_LM10_RESPONSE_DI 0x05
835 #define LOGON_LM20_LOGON_RESPONSE 0x06
836 #define LOGON_PDC_QUERY 0x07
837 #define LOGON_PDC_STARTUP 0x08
838 #define LOGON_PDC_FAILED 0x09
839 #define LOGON_UAS_SAM 0x0a
840 #define LOGON_NO_USER 0x0b
841 #define LOGON_PDC_RESPONSE 0x0c
842 #define LOGON_RELOGON_RESPONSE 0x0d
843 #define LOGON_INTERROGATE_RESPONSE 0x0e
844 #define LOGON_LM20_RESPONSE_DURING_LOGON 0x0f
845 #define LOGON_LM20_USER_UNKNOWN 0x10
846 #define LOGON_LM20_ACCOUNT_UPDATE 0x11
847 #define LOGON_SAM_LOGON_REQUEST 0x12
848 #define LOGON_SAM_LOGON_RESPONSE 0x13
849 #define LOGON_SAM_RESPONSE_DURING_LOGON 0x14
850 #define LOGON_SAM_USER_UNKNOWN 0x15
851 #define LOGON_SAM_INTERROGATE_RESPONSE 0x16
852 #define LOGON_SAM_AD_USER_UNKNOWN 0x17
853 #define LOGON_SAM_UNKNOWN_18 0x18
854 #define LOGON_SAM_AD_LOGON_RESPONSE 0x19
855 #define LOGON_LAST_CMD 0x19
857 static const value_string commands[] = {
858 {LOGON_LM10_LOGON_REQUEST, "LM1.0/LM2.0 LOGON Request"},
859 {LOGON_LM10_LOGON_RESPONSE, "LM1.0 LOGON Response"},
860 {LOGON_LM10_QUERY_CI, "LM1.0 Query - Centralized Initialization"},
861 {LOGON_LM10_QUERY_DI, "LM1.0 Query - Distributed Initialization"},
862 {LOGON_LM10_RESPONSE_CI, "LM1.0 Response - Centralized Query"},
863 {LOGON_LM10_RESPONSE_DI, "LM1.0 Response - Distributed Initialization"},
864 {LOGON_LM20_LOGON_RESPONSE, "LM2.0 Response to LOGON Request"},
865 {LOGON_PDC_QUERY, "Query for PDC"},
866 {LOGON_PDC_STARTUP, "Announce Startup of PDC"},
867 {LOGON_PDC_FAILED, "Announce Failed PDC"},
868 {LOGON_UAS_SAM, "Announce Change to UAS or SAM"},
869 {LOGON_NO_USER, "Announce no user on machine"},
870 {LOGON_PDC_RESPONSE, "Response from PDC"},
871 {LOGON_RELOGON_RESPONSE, "LM1.0/LM2.0 Response to re-LOGON Request"},
872 {LOGON_INTERROGATE_RESPONSE, "LM1.0/LM2.0 Response to Interrogate Request"},
873 {LOGON_LM20_RESPONSE_DURING_LOGON,"LM2.0 Response during LOGON pause"},
874 {LOGON_LM20_USER_UNKNOWN, "LM2.0 Response - user unknown"},
875 {LOGON_LM20_ACCOUNT_UPDATE, "LM2.0 Announce account updates"},
876 {LOGON_SAM_LOGON_REQUEST, "SAM LOGON request from client"},
877 {LOGON_SAM_LOGON_RESPONSE, "Response to SAM LOGON request"},
878 {LOGON_SAM_RESPONSE_DURING_LOGON,"SAM Response during LOGON pause"},
879 {LOGON_SAM_USER_UNKNOWN, "SAM Response - user unknown"},
880 {LOGON_SAM_INTERROGATE_RESPONSE,"SAM Response to Interrogate Request"},
881 {LOGON_SAM_AD_USER_UNKNOWN, "SAM Active Directory Response - user unknown"},
882 {LOGON_SAM_UNKNOWN_18, "SAM unknown command 0x18"},
883 {LOGON_SAM_AD_LOGON_RESPONSE, "Active Directory Response to SAM LOGON request"},
887 static int (*dissect_smb_logon_cmds[])(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset) = {
888 dissect_smb_logon_request, /* 0x00 (LM1.0/LM2.0 LOGON Request) */
889 dissect_smb_logon_LM10_resp,/* 0x01 (LM1.0 LOGON Response) */
890 dissect_smb_logon_2, /* 0x02 (LM1.0 Query Centralized Init.)*/
891 dissect_smb_logon_2, /* 0x03 (LM1.0 Query Distributed Init.)*/
892 dissect_smb_logon_2, /* 0x04 (LM1.0 Centralized Query Resp.)*/
893 dissect_smb_logon_2, /* 0x05 (LM1.0 Distributed Query Resp.) */
894 dissect_smb_logon_LM20_resp,/* 0x06 (LM2.0 LOGON Response) */
895 dissect_smb_pdc_query, /* 0x07 (Query for PDC) */
896 dissect_smb_pdc_startup, /* 0x08 (Announce PDC startup) */
897 dissect_smb_pdc_failure, /* 0x09 (Announce Failed PDC) */
898 dissect_announce_change, /* 0x0A (Announce Change to UAS or SAM)*/
899 dissect_smb_no_user, /* 0x0B (Announce no user on machine)*/
900 dissect_smb_pdc_startup, /* 0x0C (Response from PDC) */
901 dissect_smb_relogon_resp, /* 0x0D (Relogon response) */
902 dissect_smb_inter_resp, /* 0x0E (Interrogate response) */
903 dissect_smb_pdc_failure, /* 0x0F (LM2.0 Resp. during LOGON pause*/
904 dissect_smb_pdc_failure, /* 0x10 (LM 2.0 Unknown user response)*/
905 dissect_smb_acc_update, /* 0x11 (LM2.1 Announce Acc updates)*/
906 dissect_smb_sam_logon_req, /* 0x12 (SAM LOGON request ) */
907 dissect_smb_sam_logon_resp, /* 0x13 (SAM LOGON response) */
908 dissect_smb_unknown, /* 0x14 (SAM Response during LOGON Pause) */
909 dissect_smb_sam_logon_resp, /* 0x15 (SAM Response User Unknown) */
910 dissect_smb_unknown, /* 0x16 (SAM Response to Interrogate)*/
911 dissect_smb_pdc_response_ads, /* 0x17 (SAM AD response User Unknown*/
912 dissect_smb_unknown, /* 0x18 (Unknown command) */
913 dissect_smb_pdc_response_ads /* 0x19 (SAM LOGON AD response) */
918 dissect_smb_logon(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
922 proto_tree *smb_logon_tree = NULL;
923 proto_item *item = NULL;
925 col_set_str(pinfo->cinfo, COL_PROTOCOL, "SMB_NETLOGON");
926 if (check_col(pinfo->cinfo, COL_INFO))
927 col_clear(pinfo->cinfo, COL_INFO);
929 /* get the Command field */
930 cmd = tvb_get_guint8(tvb, offset);
932 if (check_col(pinfo->cinfo, COL_INFO))
933 col_add_str(pinfo->cinfo, COL_INFO, val_to_str(cmd, commands, "Unknown Command:%02x") );
936 item = proto_tree_add_item(tree, proto_smb_logon, tvb,
939 smb_logon_tree = proto_item_add_subtree(item, ett_smb_logon);
943 proto_tree_add_uint(smb_logon_tree, hf_command, tvb, offset, 1, cmd);
949 if (cmd<LOGON_LAST_CMD) {
950 offset = (dissect_smb_logon_cmds[cmd])(tvb, pinfo,
951 smb_logon_tree, offset);
953 /* unknown command */
954 offset = dissect_smb_unknown(tvb, pinfo, smb_logon_tree,
960 proto_register_smb_logon( void)
962 static hf_register_info hf[] = {
964 { "Command", "smb_netlogon.command", FT_UINT8, BASE_HEX,
965 VALS(commands), 0, "SMB NETLOGON Command", HFILL }},
968 { "Computer Name", "smb_netlogon.computer_name", FT_STRING, BASE_NONE,
969 NULL, 0, "SMB NETLOGON Computer Name", HFILL }},
971 { &hf_unicode_computer_name,
972 { "Unicode Computer Name", "smb_netlogon.unicode_computer_name", FT_STRING, BASE_NONE,
973 NULL, 0, "SMB NETLOGON Unicode Computer Name", HFILL }},
976 { "Server Name", "smb_netlogon.server_name", FT_STRING, BASE_NONE,
977 NULL, 0, "SMB NETLOGON Server Name", HFILL }},
979 { &hf_server_dns_name,
980 { "Server DNS Name", "smb_netlogon.server_dns_name", FT_STRING, BASE_NONE,
981 NULL, 0, "SMB NETLOGON Server DNS Name", HFILL }},
984 { "User Name", "smb_netlogon.user_name", FT_STRING, BASE_NONE,
985 NULL, 0, "SMB NETLOGON User Name", HFILL }},
988 { "Domain Name", "smb_netlogon.domain_name", FT_STRING, BASE_NONE,
989 NULL, 0, "SMB NETLOGON Domain Name", HFILL }},
991 { &hf_domain_dns_name,
992 { "Domain DNS Name", "smb_netlogon.domain_dns_name", FT_STRING, BASE_NONE,
993 NULL, 0, "SMB NETLOGON Domain DNS Name", HFILL }},
995 { &hf_forest_dns_name,
996 { "Forest DNS Name", "smb_netlogon.forest_dns_name", FT_STRING, BASE_NONE,
997 NULL, 0, "SMB NETLOGON Forest DNS Name", HFILL }},
1000 { "Mailslot Name", "smb_netlogon.mailslot_name", FT_STRING, BASE_NONE,
1001 NULL, 0, "SMB NETLOGON Mailslot Name", HFILL }},
1004 { "PDC Name", "smb_netlogon.pdc_name", FT_STRING, BASE_NONE,
1005 NULL, 0, "SMB NETLOGON PDC Name", HFILL }},
1007 { &hf_unicode_pdc_name,
1008 { "Unicode PDC Name", "smb_netlogon.unicode_pdc_name", FT_STRING, BASE_NONE,
1009 NULL, 0, "SMB NETLOGON Unicode PDC Name", HFILL }},
1012 { "Script Name", "smb_netlogon.script_name", FT_STRING, BASE_NONE,
1013 NULL, 0, "SMB NETLOGON Script Name", HFILL }},
1016 { "NT Version", "smb_netlogon.nt_version", FT_UINT32, BASE_DEC,
1017 NULL, 0, "SMB NETLOGON NT Version", HFILL }},
1019 /* An LMNT Token, if 0xffff, is "WindowsNT Networking";
1020 what is it otherwise? */
1022 { "LMNT Token", "smb_netlogon.lmnt_token", FT_UINT16, BASE_HEX,
1023 NULL, 0, "SMB NETLOGON LMNT Token", HFILL }},
1026 { "LM Token", "smb_netlogon.lm_token", FT_UINT16, BASE_HEX,
1027 NULL, 0, "SMB NETLOGON LM Token", HFILL }},
1029 { &hf_major_version,
1030 { "Workstation Major Version", "smb_netlogon.major_version", FT_UINT8, BASE_DEC,
1031 NULL, 0, "SMB NETLOGON Workstation Major Version", HFILL }},
1033 { &hf_minor_version,
1034 { "Workstation Minor Version", "smb_netlogon.minor_version", FT_UINT8, BASE_DEC,
1035 NULL, 0, "SMB NETLOGON Workstation Minor Version", HFILL }},
1038 { "Workstation OS Version", "smb_netlogon.os_version", FT_UINT8, BASE_DEC,
1039 NULL, 0, "SMB NETLOGON Workstation OS Version", HFILL }},
1042 { "Date/Time", "smb_netlogon.date_time", FT_UINT32, BASE_DEC,
1043 NULL, 0, "SMB NETLOGON Date/Time", HFILL }},
1046 { "Update Type", "smb_netlogon.update", FT_UINT16, BASE_DEC,
1047 NULL, 0, "SMB NETLOGON Update Type", HFILL }},
1049 { &hf_request_count,
1050 { "Request Count", "smb_netlogon.request_count", FT_UINT16, BASE_DEC,
1051 NULL, 0, "SMB NETLOGON Request Count", HFILL }},
1053 { &hf_flags_autolock,
1054 { "Autolock", "smb_netlogon.flags.autolock", FT_BOOLEAN, 32,
1055 TFS(&tfs_flags_autolock), ACC_FLAG_AUTO_LOCKED, "SMB NETLOGON Account Autolock", HFILL}},
1058 { "Expire", "smb_netlogon.flags.expire", FT_BOOLEAN, 32,
1059 TFS(&tfs_flags_expire), ACC_FLAG_EXPIRE, "SMB NETLOGON Will Account Expire", HFILL}},
1061 { &hf_flags_server_trust,
1062 { "Server Trust", "smb_netlogon.flags.server", FT_BOOLEAN, 32,
1063 TFS(&tfs_flags_server_trust), ACC_FLAG_SERVER_TRUST, "SMB NETLOGON Server Trust Account", HFILL}},
1065 { &hf_flags_workstation_trust,
1066 { "Workstation Trust", "smb_netlogon.flags.workstation", FT_BOOLEAN, 32,
1067 TFS(&tfs_flags_workstation_trust), ACC_FLAG_WORKSTATION_TRUST, "SMB NETLOGON Workstation Trust Account", HFILL}},
1069 { &hf_flags_interdomain_trust,
1070 { "Interdomain Trust", "smb_netlogon.flags.interdomain", FT_BOOLEAN, 32,
1071 TFS(&tfs_flags_interdomain_trust), ACC_FLAG_INTERDOMAIN_TRUST, "SMB NETLOGON Inter-domain Trust Account", HFILL}},
1073 { &hf_flags_mns_user,
1074 { "MNS User", "smb_netlogon.flags.mns", FT_BOOLEAN, 32,
1075 TFS(&tfs_flags_mns_user), ACC_FLAG_MNS_USER, "SMB NETLOGON MNS User Account", HFILL}},
1077 { &hf_flags_normal_user,
1078 { "Normal User", "smb_netlogon.flags.normal", FT_BOOLEAN, 32,
1079 TFS(&tfs_flags_normal_user), ACC_FLAG_NORMAL_USER, "SMB NETLOGON Normal User Account", HFILL}},
1081 { &hf_flags_temp_dup_user,
1082 { "Temp Duplicate User", "smb_netlogon.flags.temp_dup", FT_BOOLEAN, 32,
1083 TFS(&tfs_flags_temp_dup_user), ACC_FLAG_TEMP_DUP_USER, "SMB NETLOGON Temp Duplicate User Account", HFILL}},
1085 { &hf_flags_password_required,
1086 { "Password", "smb_netlogon.flags.password", FT_BOOLEAN, 32,
1087 TFS(&tfs_flags_password_required), ACC_FLAG_PASSWORD_REQUIRED, "SMB NETLOGON Password Required", HFILL}},
1089 { &hf_flags_homedir_required,
1090 { "Homedir", "smb_netlogon.flags.homedir", FT_BOOLEAN, 32,
1091 TFS(&tfs_flags_homedir_required), ACC_FLAG_HOMEDIR_REQUIRED, "SMB NETLOGON Homedir Required", HFILL}},
1093 { &hf_flags_enabled,
1094 { "Enabled", "smb_netlogon.flags.enabled", FT_BOOLEAN, 32,
1095 TFS(&tfs_flags_enabled), ACC_FLAG_ENABLED, "SMB NETLOGON Is This Account Enabled", HFILL}},
1097 { &hf_domain_sid_size,
1098 { "Domain SID Size", "smb_netlogon.domain_sid_size", FT_UINT32, BASE_DEC,
1099 NULL, 0, "SMB NETLOGON Domain SID Size", HFILL }},
1102 { "Low Serial Number", "smb_netlogon.low_serial", FT_UINT32, BASE_DEC,
1103 NULL, 0, "SMB NETLOGON Low Serial Number", HFILL }},
1106 { "Pulse", "smb_netlogon.pulse", FT_UINT32, BASE_DEC,
1107 NULL, 0, "SMB NETLOGON Pulse", HFILL }},
1110 { "Random", "smb_netlogon.random", FT_UINT32, BASE_DEC,
1111 NULL, 0, "SMB NETLOGON Random", HFILL }},
1114 { "DB Count", "smb_netlogon.db_count", FT_UINT32, BASE_DEC,
1115 NULL, 0, "SMB NETLOGON DB Count", HFILL }},
1118 { "Database Index", "smb_netlogon.db_index", FT_UINT32, BASE_DEC,
1119 NULL, 0, "SMB NETLOGON Database Index", HFILL }},
1122 { "Large Serial Number", "smb_netlogon.large_serial", FT_UINT64, BASE_DEC,
1123 NULL, 0, "SMB NETLOGON Large Serial Number", HFILL }},
1126 { "NT Date/Time", "smb_netlogon.nt_date_time", FT_ABSOLUTE_TIME, BASE_NONE,
1127 NULL, 0, "SMB NETLOGON NT Date/Time", HFILL }},
1130 { "Unknown", "smb_netlogon.unknown", FT_UINT8, BASE_HEX,
1131 NULL, 0, NULL, HFILL }},
1134 { "Unknown", "smb_netlogon.unknown", FT_UINT32, BASE_HEX,
1135 NULL, 0, NULL, HFILL }},
1138 { "Domain GUID", "smb_netlogon.domain.guid", FT_BYTES, BASE_NONE,
1139 NULL, 0x0, NULL, HFILL }},
1142 "Server IP", "smb_netlogon.server_ip", FT_IPv4, BASE_NONE,
1143 NULL, 0x0, "Server IP Address", HFILL }},
1145 { &hf_server_site_name,
1146 { "Server Site Name", "smb_netlogon.server_site_name", FT_STRING, BASE_NONE,
1147 NULL, 0, "SMB NETLOGON Server Site Name", HFILL }},
1149 { &hf_client_site_name,
1150 { "Client Site Name", "smb_netlogon.client_site_name", FT_STRING, BASE_NONE,
1151 NULL, 0, "SMB NETLOGON Client Site Name", HFILL }},
1154 static gint *ett[] = {
1156 &ett_smb_account_flags,
1160 proto_smb_logon = proto_register_protocol(
1161 "Microsoft Windows Logon Protocol (Old)", "SMB_NETLOGON", "smb_netlogon");
1163 proto_register_field_array(proto_smb_logon, hf, array_length(hf));
1164 proto_register_subtree_array(ett, array_length(ett));
1166 register_dissector("smb_netlogon", dissect_smb_logon, proto_smb_logon);