gtk/export_object_smb.c

   1 /* export_object_smb.c
   2  * Routines for tracking & saving objects (files) found in SMB streams
   3  * See also: export_object.c / export_object.h for common code
   4  * Initial file, prototypes and general structure initially copied
   5  * from export_object_http.c
   6  *
   7  * Copyright 2010, David Perez & Jose Pico from TADDONG S.L.
   8  *
   9  * $Id$
  10  *
  11  * Wireshark - Network traffic analyzer
  12  * By Gerald Combs <gerald@wireshark.org>
  13  * Copyright 1998 Gerald Combs
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License
  17  * as published by the Free Software Foundation; either version 2
  18  * of the License, or (at your option) any later version.
  19  *
  20  * This program is distributed in the hope that it will be useful,
  21  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  23  * GNU General Public License for more details.
  24  *
  25  * You should have received a copy of the GNU General Public License
  26  * along with this program; if not, write to the Free Software
  27  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301,
  28  * USA.
  29  */
  30
  31 #ifdef HAVE_CONFIG_H
  32 # include "config.h"
  33 #endif
  34
  35 #include <gtk/gtk.h>
  36
  37 #include <epan/packet.h>
  38 #include <epan/dissectors/packet-smb.h>
  39 #include <epan/tap.h>
  40
  41 #include "gtk/export_object.h"
  42
  43
  44 /* These flags show what kind of data the object contains
  45    (designed to be or'ed) */
  46 #define SMB_EO_CONTAINS_NOTHING         0x00
  47 #define SMB_EO_CONTAINS_READS           0x01
  48 #define SMB_EO_CONTAINS_WRITES          0x02
  49 #define SMB_EO_CONTAINS_READSANDWRITES  0x03
  50 #define LEGAL_FILENAME_CHARS "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVXYZ1234567890_."
  51
  52 static const value_string smb_eo_contains_string[]={
  53         {SMB_EO_CONTAINS_NOTHING,               ""},
  54         {SMB_EO_CONTAINS_READS,                 "R"},
  55         {SMB_EO_CONTAINS_WRITES,                "W"},
  56         {SMB_EO_CONTAINS_READSANDWRITES,        "R&W"},
  57         {0, NULL}
  58         };
  59
  60
  61 /* This struct contains the relationship between
  62    the row# in the export_object window and the file being captured;
  63    the row# in this GSList will match the row# in the entry list */
  64
  65 typedef struct _active_file {
  66         guint16         tid,uid,fid;
  67         guint64         file_length;    /* The last free reported offset */
  68                                         /* We treat it as the file length */
  69         guint64         data_gathered;  /* The actual total of data gathered */
  70         guint8          flag_contains;  /* What kind of data it contains */
  71         GSList          *free_chunk_list;
  72                                         /* A list of virtual "holes" in the */
  73                                         /* file stream stored in memory */
  74         gboolean        is_out_of_memory;
  75                                         /* TRUE if we cannot allocate memory */
  76                                         /* memory for this file */
  77         } active_file ;
  78
  79 /* This is the GSList that will contain all the files that we are tracking */
  80 static GSList   *GSL_active_files = NULL;
  81
  82 /* We define a free chunk in a file as an start offset and end offset
  83    Consider a free chunk as a "hole" in a file that we are capturing */
  84 typedef struct _free_chunk {
  85         guint64         start_offset;
  86         guint64         end_offset;
  87 } free_chunk;
  88
  89 /* insert_chunk function will recalculate the free_chunk_list, the data_size,
  90    the end_of_file, and the data_gathered as appropriate.
  91    It will also insert the data chunk that is coming in the right
  92    place of the file in memory.
  93    HINTS:
  94    file->data_gathered  contains the real data gathered independently
  95                         from the file length
  96    file->file_length    contains the length of the file in memory, i.e.,
  97                         the last offset captured. In most cases, the real
  98                         file length would be different.
  99 */
 100 static void
 101 insert_chunk(active_file   *file, export_object_entry_t *entry, const smb_eo_t *eo_info)
 102 {
 103         guint           nfreechunks = g_slist_length(file->free_chunk_list);
 104         guint           i;
 105         free_chunk      *current_free_chunk;
 106         free_chunk      *new_free_chunk;
 107         guint64         chunk_offset=eo_info->smb_file_offset;
 108         guint64         chunk_length=eo_info->payload_len;
 109         guint64         chunk_end_offset = chunk_offset+chunk_length-1;
 110         /* Size of file in memory */
 111         guint64         calculated_size = chunk_offset+chunk_length;
 112         gpointer        dest_memory_addr;
 113
 114         /* Let's recalculate the file length and data gathered */
 115         if (file->data_gathered==0 && nfreechunks==0) {
 116                 /* If this is the first entry for this file, we first
 117                    create an initial free chunk */
 118                 new_free_chunk=g_malloc(sizeof(free_chunk));
 119                 new_free_chunk->start_offset=0;
 120                 new_free_chunk->end_offset=MAX(file->file_length,chunk_end_offset+1)-1;
 121                 file->free_chunk_list=NULL;
 122                 file->free_chunk_list=g_slist_append(file->free_chunk_list,new_free_chunk);
 123                 nfreechunks+=1;
 124         } else {
 125                 if (chunk_end_offset > file->file_length-1) {
 126                         new_free_chunk=g_malloc(sizeof(free_chunk));
 127                         new_free_chunk->start_offset=file->file_length;
 128                         new_free_chunk->end_offset=chunk_end_offset;
 129                         file->free_chunk_list=g_slist_append(file->free_chunk_list,new_free_chunk);
 130                         nfreechunks+=1;
 131                         }
 132         }
 133         file->file_length = MAX(file->file_length,chunk_end_offset+1);
 134
 135         for (i=0;i<nfreechunks;i++) {
 136                 current_free_chunk = g_slist_nth_data(file->free_chunk_list,i);
 137                 if (chunk_offset <= current_free_chunk->start_offset ) {
 138                         if (chunk_end_offset >= current_free_chunk->start_offset) {
 139                                 if (chunk_end_offset < current_free_chunk->end_offset) {
 140                                         file->data_gathered+=
 141                                                 (chunk_end_offset-current_free_chunk->start_offset+1);
 142                                         current_free_chunk->start_offset=chunk_end_offset+1;
 143                                 } else {
 144                                         file->data_gathered+=
 145                                                 (current_free_chunk->end_offset-current_free_chunk->start_offset+1);
 146                                         file->free_chunk_list =
 147                                                 g_slist_remove(file->free_chunk_list,current_free_chunk);
 148                                         nfreechunks-=1;
 149                                         if (nfreechunks==0) { /* The free chunk list is empty */
 150                                                 g_slist_free(file->free_chunk_list);
 151                                                 file->free_chunk_list=NULL;
 152                                                 break;
 153                                         }
 154                                 }
 155                         } else {
 156                                 break;
 157                         }
 158                 } else {
 159                         if (chunk_offset <= current_free_chunk->end_offset) {
 160                                 if (chunk_end_offset < current_free_chunk->end_offset) {
 161                                         new_free_chunk=g_malloc(sizeof(free_chunk));
 162                                         new_free_chunk->start_offset=chunk_end_offset+1;
 163                                         new_free_chunk->end_offset=current_free_chunk->end_offset;
 164                                         current_free_chunk->end_offset=chunk_offset-1;
 165                                         file->free_chunk_list =
 166                                                 g_slist_insert(file->free_chunk_list,new_free_chunk,i+1);
 167                                         file->data_gathered+=chunk_length;
 168                                 } else {
 169                                         file->data_gathered+=current_free_chunk->end_offset-chunk_offset+1;
 170                                         current_free_chunk->end_offset=chunk_offset-1;
 171                                 }
 172                         }
 173                 }
 174         }
 175
 176         /* Now, let's insert the data chunk into memory
 177            ...first, we shall be able to allocate the memory */
 178         if (!entry->payload_data) {
 179                 /* This is a New file */
 180                 if (calculated_size > G_MAXSIZE) {
 181                         /*
 182                          * The argument to g_try_malloc() is
 183                          * a gsize, the maximum value of which is
 184                          * G_MAXSIZE.  If the calculated size is
 185                          * bigger than that, we just say the attempt
 186                          * to allocate memory failed.
 187                          */
 188                         entry->payload_data=NULL;
 189                 } else {
 190                         entry->payload_data = g_try_malloc((gsize)calculated_size);
 191                         entry->payload_len=calculated_size;
 192                 }
 193                 if (!entry->payload_data) {
 194                         /* Memory error */
 195                         file->is_out_of_memory=TRUE;
 196                 }
 197         } else {
 198                 /* This is an existing file in memory */
 199                 if (calculated_size > (guint64) entry->payload_len &&
 200                     !file->is_out_of_memory) {
 201                         /* We need more memory */
 202                         if (calculated_size > G_MAXSIZE) {
 203                                 /*
 204                                  * As for g_try_malloc(), so for
 205                                  * g_try_realloc().
 206                                  */
 207                                 dest_memory_addr=NULL;
 208                         } else {
 209                                 dest_memory_addr=g_try_realloc(
 210                                         entry->payload_data,
 211                                         (gsize)calculated_size);
 212                         }
 213                         if(!dest_memory_addr) {
 214                                 /* Memory error */
 215                                 file->is_out_of_memory=TRUE;
 216                                 /* We don't have memory for this file.
 217                                    Free the current file content from memory */
 218                                 g_free(entry->payload_data);
 219                                 entry->payload_data=NULL;
 220                                 entry->payload_len=0;
 221                         } else {
 222                                 entry->payload_data=dest_memory_addr;
 223                                 entry->payload_len=calculated_size;
 224                         }
 225                 }
 226         }
 227         /* ...then, put the chunk of the file in the right place */
 228         if(!file->is_out_of_memory) {
 229                 dest_memory_addr=entry->payload_data+chunk_offset;
 230                 g_memmove(dest_memory_addr,eo_info->payload_data,eo_info->payload_len);
 231         }
 232 }
 233
 234 /* We use this function to obtain the index in the GSL of a given file */
 235 static int
 236 find_incoming_file(GSList *GSL_active_files,active_file *incoming_file)
 237 {
 238         int     i,row,last;
 239         active_file     *in_list_file;
 240
 241         row=-1;
 242         last=g_slist_length(GSL_active_files)-1;
 243
 244         /* We lookup in reverse order because it is more likely that the file
 245            is one of the latest */
 246         for (i=last;i>=0;i--) {
 247                 in_list_file=g_slist_nth_data(GSL_active_files, i);
 248                 /* The best-working criteria of two identical files is that the file
 249                    that is the same of the file that we are analyzing is the last one
 250                    in the list that has the same tid and the same fid */
 251                 /* note that we have excluded in_list_file->uid == incoming_file->uid
 252                    from the comparison, because a file can be opened by different
 253                    SMB users and it is still the same file */
 254                 if (in_list_file->tid == incoming_file->tid &&
 255                                 in_list_file->fid == incoming_file->fid) {
 256                         row=i;
 257                         break;
 258                 }
 259         }
 260
 261         return row;
 262 }
 263
 264 #if !GLIB_CHECK_VERSION(2,6,0)
 265 /**
 266  * g_strv_length:
 267  * @str_array: a %NULL-terminated array of strings.
 268  *
 269  * Returns the length of the given %NULL-terminated
 270  * string array @str_array.
 271  *
 272  * Return value: length of @str_array.
 273  *
 274  * Since: 2.6
 275  **/
 276 static guint
 277 g_strv_length (gchar **str_array)
 278 {
 279         guint i = 0;
 280
 281         g_return_val_if_fail (str_array != NULL, 0);
 282
 283         while (str_array[i])
 284                 ++i;
 285
 286         return i;
 287 }
 288 #endif
 289
 290 /* This is the function answering to the registered tap listener call */
 291 static gboolean
 292 eo_smb_packet(void *tapdata, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data)
 293 {
 294         export_object_list_t *object_list = tapdata;
 295         const smb_eo_t *eo_info = data;
 296
 297         export_object_entry_t   *entry;
 298         export_object_entry_t   *current_entry;
 299         active_file             incoming_file;
 300         gint                    active_row;
 301         active_file             *new_file;
 302         active_file             *current_file;
 303         guint8                  contains;
 304         gboolean                is_supported_filetype;
 305         gfloat                  percent;
 306
 307         gchar                   **aux_string_v;
 308
 309         /* Is this an eo_smb supported file_type? (right now we only support FILE */
 310         is_supported_filetype = (eo_info->fid_type==SMB_FID_TYPE_FILE);
 311
 312         /* What kind of data this packet contains? */
 313         switch(eo_info->cmd) {
 314         case SMB_COM_READ_ANDX:
 315                 contains=SMB_EO_CONTAINS_READS;
 316                 break;
 317         case SMB_COM_WRITE_ANDX:
 318                 contains=SMB_EO_CONTAINS_WRITES;
 319                 break;
 320         default:
 321                 contains=SMB_EO_CONTAINS_NOTHING;
 322                 break;
 323         }
 324
 325         /* Is this data from an already tracked file or not? */
 326         incoming_file.tid=eo_info->tid;
 327         incoming_file.uid=eo_info->uid;
 328         incoming_file.fid=eo_info->fid;
 329         active_row=find_incoming_file(GSL_active_files, &incoming_file);
 330
 331         if (active_row==-1) { /* This is a new-tracked file */
 332                 /* Construct the entry in the list of active files */
 333                 entry = g_malloc(sizeof(export_object_entry_t));
 334                 entry->payload_data=NULL;
 335                 entry->payload_len=0;
 336                 new_file = g_malloc(sizeof(active_file));
 337                 new_file->tid=incoming_file.tid;
 338                 new_file->uid=incoming_file.uid;
 339                 new_file->fid=incoming_file.fid;
 340                 new_file->file_length = eo_info->end_of_file;
 341                 new_file->flag_contains=contains;
 342                 new_file->free_chunk_list=NULL;
 343                 new_file->data_gathered=0;
 344                 new_file->is_out_of_memory=FALSE;
 345                 entry->pkt_num = pinfo->fd->num;
 346                 entry->hostname = g_strdup(eo_info->hostname);
 347                 if (g_str_has_prefix(eo_info->filename,"\\")) {
 348                         aux_string_v = g_strsplit(eo_info->filename, "\\", -1);
 349                         entry->filename = g_strdup(aux_string_v[g_strv_length(aux_string_v)-1]);
 350                         g_strfreev(aux_string_v);
 351                 } else {
 352                         entry->filename = g_strdup(eo_info->filename);
 353                 }
 354
 355                 /* Insert the first chunk in the chunk list of this file */
 356                 if (is_supported_filetype) {
 357                         insert_chunk(new_file, entry, eo_info);
 358                 }
 359
 360                 if(new_file->is_out_of_memory) {
 361                         entry->content_type =
 362                                 g_strdup_printf("%s (%"G_GUINT64_FORMAT"?/%"G_GUINT64_FORMAT") %s [mem!!]",
 363                                                 match_strval(eo_info->fid_type, smb_fid_types),
 364                                                 new_file->data_gathered,
 365                                                 new_file->file_length,
 366                                                 match_strval(contains, smb_eo_contains_string));
 367                 } else {
 368                         if (new_file->file_length > 0) {
 369                                 percent=(gfloat) 100*new_file->data_gathered/new_file->file_length;
 370                         } else {
 371                                 percent = 0.0;
 372                         }
 373
 374                         entry->content_type =
 375                                 g_strdup_printf("%s (%"G_GUINT64_FORMAT"/%"G_GUINT64_FORMAT") %s [%5.2f%%]",
 376                                                 match_strval(eo_info->fid_type, smb_fid_types),
 377                                                 new_file->data_gathered,
 378                                                 new_file->file_length,
 379                                                 match_strval(contains, smb_eo_contains_string),
 380                                                 percent);
 381                 }
 382
 383                 object_list->entries =
 384                         g_slist_append(object_list->entries, entry);
 385                 GSL_active_files =
 386                         g_slist_append(GSL_active_files, new_file);
 387         }
 388         else if (is_supported_filetype) {
 389                 current_file=g_slist_nth_data(GSL_active_files,active_row);
 390                 /* Recalculate the current file flags */
 391                 current_file->flag_contains=current_file->flag_contains|contains;
 392                 current_entry=g_slist_nth_data(object_list->entries,active_row);
 393
 394                 insert_chunk(current_file, current_entry, eo_info);
 395
 396                 /* Modify the current_entry object_type string */
 397                 if(current_file->is_out_of_memory) {
 398                         current_entry->content_type =
 399                                 g_strdup_printf("%s (%"G_GUINT64_FORMAT"?/%"G_GUINT64_FORMAT") %s [mem!!]",
 400                                                 match_strval(eo_info->fid_type, smb_fid_types),
 401                                                 current_file->data_gathered,
 402                                                 current_file->file_length,
 403                                                 match_strval(current_file->flag_contains, smb_eo_contains_string));
 404                 } else {
 405                         percent=(gfloat) 100*current_file->data_gathered/current_file->file_length;
 406                         current_entry->content_type =
 407                                 g_strdup_printf("%s (%"G_GUINT64_FORMAT"/%"G_GUINT64_FORMAT") %s [%5.2f%%]",
 408                                                 match_strval(eo_info->fid_type, smb_fid_types),
 409                                                 current_file->data_gathered,
 410                                                 current_file->file_length,
 411                                                 match_strval(current_file->flag_contains, smb_eo_contains_string),
 412                                                 percent);
 413                 }
 414         }
 415
 416         return TRUE; /* State changed - window should be redrawn */
 417 }
 418 /* This is the eo_protocoldata_reset function that is used in the export_object module
 419    to cleanup any previous private data of the export object functionality before perform
 420    the eo_reset function or when the window closes */
 421 void
 422 eo_smb_cleanup(void)
 423 {
 424         int              i,last;
 425         active_file     *in_list_file;
 426
 427         /* Free any previous data structures used in previous invocation to the
 428            export_object_smb function */
 429         last=g_slist_length(GSL_active_files);
 430         if (GSL_active_files) {
 431                 for (i=last-1;i>=0;i--) {
 432                         in_list_file=g_slist_nth_data(GSL_active_files, i);
 433                         if (in_list_file->free_chunk_list) {
 434                                 g_slist_free(in_list_file->free_chunk_list);
 435                                 in_list_file->free_chunk_list=NULL;
 436                                 }
 437                         g_free(in_list_file);
 438                         }
 439                 g_slist_free(GSL_active_files);
 440                 GSL_active_files=NULL;
 441         }
 442 }
 443
 444 void
 445 eo_smb_cb(GtkWidget *widget _U_, gpointer data _U_)
 446 {
 447         /* Call the export_object window */
 448         export_object_window("smb_eo", "SMB", eo_smb_packet, eo_smb_cleanup);
 449 }