epan/dissectors/packet-smb-sidsnooping.c

   1 /* packet-smb-sidsnooping.c
   2  * Routines for snooping SID to name mappings
   3  * Copyright 2003, Ronnie Sahlberg
   4  *
   5  * $Id$
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 #ifdef HAVE_CONFIG_H
  27 # include "config.h"
  28 #endif
  29
  30 #include <stdio.h>
  31 #include <string.h>
  32 #include "epan/packet_info.h"
  33 #include "epan/epan_dissect.h"
  34 #include "epan/proto.h"
  35 #include <epan/tap.h>
  36 #include "packet-dcerpc.h"
  37 #include "packet-dcerpc-nt.h"
  38 #include "register.h"
  39 #include "smb.h"
  40 #include "packet-smb-sidsnooping.h"
  41
  42 static int hf_lsa = -1;
  43 static int hf_lsa_info_level = -1;
  44 static int hf_lsa_opnum = -1;
  45 static int hf_lsa_domain = -1;
  46 static int hf_nt_domain_sid = -1;
  47 static int hf_samr_hnd = -1;
  48 static int hf_samr_rid = -1;
  49 static int hf_samr_acct_name = -1;
  50 static int hf_samr_level = -1;
  51
  52
  53
  54 GHashTable *sid_name_table = NULL;
  55 static GMemChunk *sid_name_chunk = NULL;
  56 static int sid_name_init_count = 200;
  57
  58
  59
  60 static GMemChunk *ctx_handle_chunk = NULL;
  61 static int ctx_handle_init_count = 200;
  62 static GHashTable *ctx_handle_table = NULL;
  63
  64
  65 static void *lsa_policy_information_flag = NULL;
  66 static void *samr_query_dispinfo_flag = NULL;
  67
  68
  69 char *
  70 find_sid_name(char *sid)
  71 {
  72         sid_name *sn;
  73         sid_name old_sn;
  74
  75         old_sn.sid=sid;
  76         sn=g_hash_table_lookup(sid_name_table, &old_sn);
  77         if(!sn){
  78                 return NULL;
  79         }
  80         return sn->name;
  81 }
  82
  83 static void
  84 add_sid_name_mapping(char *sid, char *name)
  85 {
  86         sid_name *sn;
  87         sid_name old_sn;
  88
  89         old_sn.sid=sid;
  90         sn=g_hash_table_lookup(sid_name_table, &old_sn);
  91         if(sn){
  92                 return;
  93         }
  94
  95         sn=g_mem_chunk_alloc(sid_name_chunk);
  96         sn->sid=g_strdup(sid);
  97         sn->name=g_strdup(name);
  98         g_hash_table_insert(sid_name_table, sn, sn);
  99 }
 100
 101
 102
 103 /*
 104  * QueryDispInfo :
 105  * level  1 : user displayinfo 1
 106  */
 107 static int
 108 samr_query_dispinfo(void *dummy _U_, packet_info *pinfo, epan_dissect_t *edt, void *pri)
 109 {
 110         dcerpc_info *ri=pri;
 111         void *old_ctx=NULL;
 112         char *pol_name;
 113         char *sid;
 114         int sid_len;
 115         int num_rids;
 116         int num_names;
 117         GPtrArray *gp;
 118         GPtrArray *gp_rids;
 119         GPtrArray *gp_names;
 120         field_info *fi;
 121         field_info *fi_rid;
 122         field_info *fi_name;
 123         char sid_name[256];
 124         int info_level;
 125
 126         gp=proto_get_finfo_ptr_array(edt->tree, hf_samr_level);
 127         if(!gp || gp->len!=1){
 128                 return 0;
 129         }
 130         fi=gp->pdata[0];
 131         info_level=fi->value.value.integer;
 132
 133         if(info_level!=1){
 134                 return 0;
 135         }
 136
 137         if(!ri){
 138                 return 0;
 139         }
 140         if(!ri->call_data){
 141                 return 0;
 142         }
 143         if(ri->ptype == PDU_REQ){
 144                 gp=proto_get_finfo_ptr_array(edt->tree, hf_samr_hnd);
 145                 if(!gp || gp->len!=1){
 146                         return 0;
 147                 }
 148                 fi=gp->pdata[0];
 149
 150                 old_ctx=g_hash_table_lookup(ctx_handle_table, (gpointer)pinfo->fd->num);
 151                 if(old_ctx){
 152                         g_hash_table_remove(ctx_handle_table, (gpointer)pinfo->fd->num);
 153                 }
 154                 if(!old_ctx){
 155                         old_ctx=g_mem_chunk_alloc(ctx_handle_chunk);
 156                         memcpy(old_ctx, fi->value.value.bytes->data, 20);
 157                 }
 158                 g_hash_table_insert(ctx_handle_table, (gpointer)pinfo->fd->num, old_ctx);
 159
 160                 return 0;
 161         }
 162
 163         if(!ri->call_data->req_frame){
 164                 return 0;
 165         }
 166
 167         old_ctx=g_hash_table_lookup(ctx_handle_table, (gpointer)ri->call_data->req_frame);
 168         if(!old_ctx){
 169                 return 0;
 170         }
 171
 172         if (!dcerpc_smb_fetch_pol(old_ctx, &pol_name, NULL, NULL, ri->call_data->req_frame)) {
 173                 return 0;
 174         }
 175
 176         if (!pol_name)
 177                 return 0;
 178
 179         sid=strstr(pol_name,"S-1-5");
 180         if(!sid){
 181                 return 0;
 182         }
 183
 184         for(sid_len=4;1;sid_len++){
 185                 if((sid[sid_len]>='0') && (sid[sid_len]<='9')){
 186                         continue;
 187                 }
 188                 if(sid[sid_len]=='-'){
 189                         continue;
 190                 }
 191                 break;
 192         }
 193
 194         gp_rids=proto_get_finfo_ptr_array(edt->tree, hf_samr_rid);
 195         if(!gp_rids || gp_rids->len<1){
 196                 return 0;
 197         }
 198         num_rids=gp_rids->len;
 199         gp_names=proto_get_finfo_ptr_array(edt->tree, hf_samr_acct_name);
 200         if(!gp_names || gp_names->len<1){
 201                 return 0;
 202         }
 203         num_names=gp_names->len;
 204
 205         if(num_rids>num_names){
 206                 num_rids=num_names;
 207         }
 208
 209         for(;num_rids;num_rids--){
 210                 int len=sid_len;
 211
 212                 fi_rid=gp_rids->pdata[num_rids-1];
 213                 fi_name=gp_names->pdata[num_rids-1];
 214                 strncpy(sid_name, sid, len);
 215                 sid_name[len++]='-';
 216                 len+=sprintf(sid_name+len,"%d",fi_rid->value.value.integer);
 217                 sid_name[len]=0;
 218                 add_sid_name_mapping(sid_name, fi_name->value.value.string);
 219         }
 220         return 1;
 221 }
 222
 223 /*
 224  * PolicyInformation :
 225  * level  3 : PRIMARY_DOMAIN_INFO lsa.domain_sid -> lsa.domain
 226  * level  5 : ACCOUNT_DOMAIN_INFO lsa.domain_sid -> lsa.domain
 227  * level 12 : DNS_DOMAIN_INFO     lsa.domain_sid -> lsa.domain
 228  */
 229 static int
 230 lsa_policy_information(void *dummy _U_, packet_info *pinfo _U_, epan_dissect_t *edt, void *pri _U_)
 231 {
 232         GPtrArray *gp;
 233         field_info *fi;
 234         char *domain;
 235         char *sid;
 236         int info_level;
 237
 238         gp=proto_get_finfo_ptr_array(edt->tree, hf_lsa_info_level);
 239         if(!gp || gp->len!=1){
 240                 return 0;
 241         }
 242         fi=gp->pdata[0];
 243         info_level=fi->value.value.integer;
 244
 245         switch(info_level){
 246         case 3:
 247         case 5:
 248         case 12:
 249                 gp=proto_get_finfo_ptr_array(edt->tree, hf_lsa_domain);
 250                 if(!gp || gp->len!=1){
 251                         return 0;
 252                 }
 253                 fi=gp->pdata[0];
 254                 domain=fi->value.value.string;
 255
 256                 gp=proto_get_finfo_ptr_array(edt->tree, hf_nt_domain_sid);
 257                 if(!gp || gp->len!=1){
 258                         return 0;
 259                 }
 260                 fi=gp->pdata[0];
 261                 sid=fi->value.value.string;
 262
 263                 add_sid_name_mapping(sid, domain);
 264                 break;
 265         }
 266         return 0;
 267 }
 268
 269 static gboolean
 270 free_all_sid_names(gpointer key_arg, gpointer value _U_, gpointer user_data _U_)
 271 {
 272         sid_name *sn = (sid_name *)key_arg;
 273
 274         if(sn->sid){
 275                 g_free((gpointer)sn->sid);
 276                 sn->sid=NULL;
 277         }
 278         if(sn->name){
 279                 g_free((gpointer)sn->name);
 280                 sn->name=NULL;
 281         }
 282         return TRUE;
 283 }
 284
 285 static gint
 286 sid_name_equal(gconstpointer k1, gconstpointer k2)
 287 {
 288         const sid_name *sn1 = (const sid_name *)k1;
 289         const sid_name *sn2 = (const sid_name *)k2;
 290
 291         return !strcmp(sn1->sid, sn2->sid);
 292 }
 293
 294 static guint
 295 sid_name_hash(gconstpointer k)
 296 {
 297         const sid_name *sn = (const sid_name *)k;
 298         int i, sum;
 299
 300         for(sum=0,i=strlen(sn->sid)-1;i>=0;i--){
 301                 sum+=sn->sid[i];
 302         }
 303
 304         return sum;
 305 }
 306
 307
 308 static gboolean
 309 free_all_ctx_handle(gpointer key_arg _U_, gpointer value _U_, gpointer user_data _U_)
 310 {
 311         return TRUE;
 312 }
 313 static gint
 314 ctx_handle_equal(gconstpointer k1, gconstpointer k2)
 315 {
 316         int sn1 = (int)k1;
 317         int sn2 = (int)k2;
 318
 319         return sn1==sn2;
 320 }
 321
 322 static guint
 323 ctx_handle_hash(gconstpointer k)
 324 {
 325         int sn = (int)k;
 326
 327         return sn;
 328 }
 329
 330
 331 static void
 332 sid_snooping_init(void)
 333 {
 334         header_field_info *hfi;
 335         GString *error_string;
 336
 337         if(lsa_policy_information_flag){
 338                 remove_tap_listener(lsa_policy_information_flag);
 339                 lsa_policy_information_flag=NULL;
 340         }
 341         if(samr_query_dispinfo_flag){
 342                 remove_tap_listener(samr_query_dispinfo_flag);
 343                 samr_query_dispinfo_flag=NULL;
 344         }
 345
 346         if(sid_name_table){
 347                 g_hash_table_foreach_remove(sid_name_table, free_all_sid_names, NULL);
 348                 sid_name_table=NULL;
 349         }
 350         if(sid_name_chunk){
 351                 g_mem_chunk_destroy(sid_name_chunk);
 352                 sid_name_chunk=NULL;
 353         }
 354         if(ctx_handle_table){
 355                 g_hash_table_foreach_remove(ctx_handle_table, free_all_ctx_handle, NULL);
 356                 ctx_handle_table=NULL;
 357         }
 358         if(ctx_handle_chunk){
 359                 g_mem_chunk_destroy(ctx_handle_chunk);
 360                 ctx_handle_chunk=NULL;
 361         }
 362
 363
 364         if(!sid_name_snooping){
 365                 return;
 366         }
 367
 368
 369         sid_name_table=g_hash_table_new(sid_name_hash, sid_name_equal);
 370         sid_name_chunk = g_mem_chunk_new("sid_name_chunk",
 371             sizeof(sid_name),
 372             sid_name_init_count * sizeof(sid_name),
 373             G_ALLOC_ONLY);
 374
 375
 376         ctx_handle_table=g_hash_table_new(ctx_handle_hash, ctx_handle_equal);
 377         ctx_handle_chunk = g_mem_chunk_new("ctx_handle_chunk",
 378             20,  /* our dcerpc context handles are 20 bytes */
 379             ctx_handle_init_count * 20,
 380             G_ALLOC_ONLY);
 381
 382
 383         hf_lsa=proto_get_id_by_filter_name("lsa");
 384
 385         hfi=proto_registrar_get_byname("lsa.opnum");
 386         if(hfi){
 387                 hf_lsa_opnum=hfi->id;
 388         }
 389
 390         hfi=proto_registrar_get_byname("nt.domain_sid");
 391         if(hfi){
 392                 hf_nt_domain_sid=hfi->id;
 393         }
 394
 395         hfi=proto_registrar_get_byname("lsa.domain");
 396         if(hfi){
 397                 hf_lsa_domain=hfi->id;
 398         }
 399
 400         hfi=proto_registrar_get_byname("lsa.info.level");
 401         if(hfi){
 402                 hf_lsa_info_level=hfi->id;
 403         }
 404
 405         hfi=proto_registrar_get_byname("samr.hnd");
 406         if(hfi){
 407                 hf_samr_hnd=hfi->id;
 408         }
 409         hfi=proto_registrar_get_byname("samr.rid");
 410         if(hfi){
 411                 hf_samr_rid=hfi->id;
 412         }
 413         hfi=proto_registrar_get_byname("samr.acct_name");
 414         if(hfi){
 415                 hf_samr_acct_name=hfi->id;
 416         }
 417         hfi=proto_registrar_get_byname("samr.level");
 418         if(hfi){
 419                 hf_samr_level=hfi->id;
 420         }
 421
 422
 423
 424         error_string=register_tap_listener("dcerpc", lsa_policy_information, "lsa.policy_information and ( lsa.info.level or lsa.domain or nt.domain_sid )", NULL, lsa_policy_information, NULL);
 425         if(error_string){
 426                 /* error, we failed to attach to the tap. clean up */
 427
 428                 fprintf(stderr, "tethereal: Couldn't register proto_reg_handoff_smb_sidsnooping()/lsa_policy_information tap: %s\n",
 429                     error_string->str);
 430                 g_string_free(error_string, TRUE);
 431                 exit(1);
 432         }
 433         lsa_policy_information_flag=lsa_policy_information;
 434
 435         error_string=register_tap_listener("dcerpc", samr_query_dispinfo, "samr and samr.opnum==40 and ( samr.hnd or samr.rid or samr.acct_name or samr.level )", NULL, samr_query_dispinfo, NULL);
 436         if(error_string){
 437                 /* error, we failed to attach to the tap. clean up */
 438
 439                 fprintf(stderr, "tethereal: Couldn't register proto_reg_handoff_smb_sidsnooping()/samr_query_dispinfo tap: %s\n",
 440                     error_string->str);
 441                 g_string_free(error_string, TRUE);
 442                 exit(1);
 443         }
 444         samr_query_dispinfo_flag=samr_query_dispinfo;
 445 }
 446
 447 void
 448 proto_register_smb_sidsnooping(void)
 449 {
 450         register_init_routine(sid_snooping_init);
 451 }
 452
 453 void
 454 proto_reg_handoff_smb_sidsnooping(void)
 455 {
 456 }
 457