epan/dissectors/packet-smb-sidsnooping.c

   1 /* packet-smb-sidsnooping.c
   2  * Routines for snooping SID to name mappings
   3  * Copyright 2003, Ronnie Sahlberg
   4  *
   5  * $Id$
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 #ifdef HAVE_CONFIG_H
  27 # include "config.h"
  28 #endif
  29
  30 #include <stdio.h>
  31 #include <string.h>
  32 #include "epan/packet_info.h"
  33 #include "epan/epan_dissect.h"
  34 #include "epan/proto.h"
  35 #include <epan/tap.h>
  36 #include <epan/emem.h>
  37 #include "packet-dcerpc.h"
  38 #include "packet-dcerpc-nt.h"
  39 #include "register.h"
  40 #include <epan/dissectors/packet-smb.h>
  41 #include "packet-smb-sidsnooping.h"
  42
  43 static int hf_lsa = -1;
  44 static int hf_lsa_info_level = -1;
  45 static int hf_lsa_opnum = -1;
  46 static int hf_lsa_domain = -1;
  47 static int hf_nt_domain_sid = -1;
  48 static int hf_samr_hnd = -1;
  49 static int hf_samr_rid = -1;
  50 static int hf_samr_acct_name = -1;
  51 static int hf_samr_level = -1;
  52
  53
  54
  55 GHashTable *sid_name_table = NULL;
  56
  57
  58 static GHashTable *ctx_handle_table = NULL;
  59
  60
  61 static gboolean lsa_policy_information_tap_installed = FALSE;
  62 static gboolean samr_query_dispinfo_tap_installed = FALSE;
  63
  64
  65 char *
  66 find_sid_name(char *sid)
  67 {
  68         sid_name *sn;
  69         sid_name old_sn;
  70
  71         old_sn.sid=sid;
  72         sn=g_hash_table_lookup(sid_name_table, &old_sn);
  73         if(!sn){
  74                 return NULL;
  75         }
  76         return sn->name;
  77 }
  78
  79 static void
  80 add_sid_name_mapping(char *sid, char *name)
  81 {
  82         sid_name *sn;
  83         sid_name old_sn;
  84
  85         old_sn.sid=sid;
  86         sn=g_hash_table_lookup(sid_name_table, &old_sn);
  87         if(sn){
  88                 return;
  89         }
  90
  91         sn=se_alloc(sizeof(sid_name));
  92         sn->sid=g_strdup(sid);
  93         sn->name=g_strdup(name);
  94         g_hash_table_insert(sid_name_table, sn, sn);
  95 }
  96
  97
  98
  99 /*
 100  * QueryDispInfo :
 101  * level  1 : user displayinfo 1
 102  */
 103 static int
 104 samr_query_dispinfo(void *dummy _U_, packet_info *pinfo, epan_dissect_t *edt, const void *pri)
 105 {
 106         const dcerpc_info *ri=pri;
 107         void *old_ctx=NULL;
 108         char *pol_name;
 109         char *sid;
 110         int sid_len;
 111         int num_rids;
 112         int num_names;
 113         GPtrArray *gp;
 114         GPtrArray *gp_rids;
 115         GPtrArray *gp_names;
 116         field_info *fi;
 117         field_info *fi_rid;
 118         field_info *fi_name;
 119         char sid_name[256];
 120         int info_level;
 121
 122         gp=proto_get_finfo_ptr_array(edt->tree, hf_samr_level);
 123         if(!gp || gp->len!=1){
 124                 return 0;
 125         }
 126         fi=gp->pdata[0];
 127         info_level=fi->value.value.integer;
 128
 129         if(info_level!=1){
 130                 return 0;
 131         }
 132
 133         if(!ri){
 134                 return 0;
 135         }
 136         if(!ri->call_data){
 137                 return 0;
 138         }
 139         if(ri->ptype == PDU_REQ){
 140                 gp=proto_get_finfo_ptr_array(edt->tree, hf_samr_hnd);
 141                 if(!gp || gp->len!=1){
 142                         return 0;
 143                 }
 144                 fi=gp->pdata[0];
 145
 146                 old_ctx=g_hash_table_lookup(ctx_handle_table, GINT_TO_POINTER(pinfo->fd->num));
 147                 if(old_ctx){
 148                         g_hash_table_remove(ctx_handle_table, GINT_TO_POINTER(pinfo->fd->num));
 149                 }
 150                 if(!old_ctx){
 151                         old_ctx=se_alloc(20);
 152                         memcpy(old_ctx, fi->value.value.bytes->data, 20);
 153                 }
 154                 g_hash_table_insert(ctx_handle_table, GINT_TO_POINTER(pinfo->fd->num), old_ctx);
 155
 156                 return 0;
 157         }
 158
 159         if(!ri->call_data->req_frame){
 160                 return 0;
 161         }
 162
 163         old_ctx=g_hash_table_lookup(ctx_handle_table, GINT_TO_POINTER(ri->call_data->req_frame));
 164         if(!old_ctx){
 165                 return 0;
 166         }
 167
 168         if (!dcerpc_smb_fetch_pol(old_ctx, &pol_name, NULL, NULL, ri->call_data->req_frame)) {
 169                 return 0;
 170         }
 171
 172         if (!pol_name)
 173                 return 0;
 174
 175         sid=strstr(pol_name,"S-1-5");
 176         if(!sid){
 177                 return 0;
 178         }
 179
 180         for(sid_len=4;1;sid_len++){
 181                 if((sid[sid_len]>='0') && (sid[sid_len]<='9')){
 182                         continue;
 183                 }
 184                 if(sid[sid_len]=='-'){
 185                         continue;
 186                 }
 187                 break;
 188         }
 189
 190         gp_rids=proto_get_finfo_ptr_array(edt->tree, hf_samr_rid);
 191         if(!gp_rids || gp_rids->len<1){
 192                 return 0;
 193         }
 194         num_rids=gp_rids->len;
 195         gp_names=proto_get_finfo_ptr_array(edt->tree, hf_samr_acct_name);
 196         if(!gp_names || gp_names->len<1){
 197                 return 0;
 198         }
 199         num_names=gp_names->len;
 200
 201         if(num_rids>num_names){
 202                 num_rids=num_names;
 203         }
 204
 205         for(;num_rids;num_rids--){
 206                 int len=sid_len;
 207
 208                 fi_rid=gp_rids->pdata[num_rids-1];
 209                 fi_name=gp_names->pdata[num_rids-1];
 210                 strncpy(sid_name, sid, len);
 211                 sid_name[len++]='-';
 212                 len+=g_snprintf(sid_name+len, 256-len, "%d",fi_rid->value.value.integer);
 213                 sid_name[len]=0;
 214                 add_sid_name_mapping(sid_name, fi_name->value.value.string);
 215         }
 216         return 1;
 217 }
 218
 219 /*
 220  * PolicyInformation :
 221  * level  3 : PRIMARY_DOMAIN_INFO lsa.domain_sid -> lsa.domain
 222  * level  5 : ACCOUNT_DOMAIN_INFO lsa.domain_sid -> lsa.domain
 223  * level 12 : DNS_DOMAIN_INFO     lsa.domain_sid -> lsa.domain
 224  */
 225 static int
 226 lsa_policy_information(void *dummy _U_, packet_info *pinfo _U_, epan_dissect_t *edt, const void *pri _U_)
 227 {
 228         GPtrArray *gp;
 229         field_info *fi;
 230         char *domain;
 231         char *sid;
 232         int info_level;
 233
 234         gp=proto_get_finfo_ptr_array(edt->tree, hf_lsa_info_level);
 235         if(!gp || gp->len!=1){
 236                 return 0;
 237         }
 238         fi=gp->pdata[0];
 239         info_level=fi->value.value.integer;
 240
 241         switch(info_level){
 242         case 3:
 243         case 5:
 244         case 12:
 245                 gp=proto_get_finfo_ptr_array(edt->tree, hf_lsa_domain);
 246                 if(!gp || gp->len!=1){
 247                         return 0;
 248                 }
 249                 fi=gp->pdata[0];
 250                 domain=fi->value.value.string;
 251
 252                 gp=proto_get_finfo_ptr_array(edt->tree, hf_nt_domain_sid);
 253                 if(!gp || gp->len!=1){
 254                         return 0;
 255                 }
 256                 fi=gp->pdata[0];
 257                 sid=fi->value.value.string;
 258
 259                 add_sid_name_mapping(sid, domain);
 260                 break;
 261         }
 262         return 0;
 263 }
 264
 265 static gboolean
 266 free_all_sid_names(gpointer key_arg, gpointer value _U_, gpointer user_data _U_)
 267 {
 268         sid_name *sn = (sid_name *)key_arg;
 269
 270         if(sn->sid){
 271                 g_free((gpointer)sn->sid);
 272                 sn->sid=NULL;
 273         }
 274         if(sn->name){
 275                 g_free((gpointer)sn->name);
 276                 sn->name=NULL;
 277         }
 278         return TRUE;
 279 }
 280
 281 static gint
 282 sid_name_equal(gconstpointer k1, gconstpointer k2)
 283 {
 284         const sid_name *sn1 = (const sid_name *)k1;
 285         const sid_name *sn2 = (const sid_name *)k2;
 286
 287         return !strcmp(sn1->sid, sn2->sid);
 288 }
 289
 290 static guint
 291 sid_name_hash(gconstpointer k)
 292 {
 293         const sid_name *sn = (const sid_name *)k;
 294         int i, sum;
 295
 296         for(sum=0,i=strlen(sn->sid)-1;i>=0;i--){
 297                 sum+=sn->sid[i];
 298         }
 299
 300         return sum;
 301 }
 302
 303
 304 static gboolean
 305 free_all_ctx_handle(gpointer key_arg _U_, gpointer value _U_, gpointer user_data _U_)
 306 {
 307         return TRUE;
 308 }
 309 static gint
 310 ctx_handle_equal(gconstpointer k1, gconstpointer k2)
 311 {
 312         int sn1 = GPOINTER_TO_INT(k1);
 313         int sn2 = GPOINTER_TO_INT(k2);
 314
 315         return sn1==sn2;
 316 }
 317
 318 static guint
 319 ctx_handle_hash(gconstpointer k)
 320 {
 321         int sn = GPOINTER_TO_INT(k);
 322
 323         return sn;
 324 }
 325
 326
 327 static void
 328 sid_snooping_init(void)
 329 {
 330         header_field_info *hfi;
 331         GString *error_string;
 332
 333         if(lsa_policy_information_tap_installed){
 334                 remove_tap_listener(&lsa_policy_information_tap_installed);
 335                 lsa_policy_information_tap_installed=FALSE;
 336         }
 337         if(samr_query_dispinfo_tap_installed){
 338                 remove_tap_listener(&samr_query_dispinfo_tap_installed);
 339                 samr_query_dispinfo_tap_installed=FALSE;
 340         }
 341
 342         if(sid_name_table){
 343                 g_hash_table_foreach_remove(sid_name_table, free_all_sid_names, NULL);
 344                 sid_name_table=NULL;
 345         }
 346         if(ctx_handle_table){
 347                 g_hash_table_foreach_remove(ctx_handle_table, free_all_ctx_handle, NULL);
 348                 ctx_handle_table=NULL;
 349         }
 350
 351
 352         if(!sid_name_snooping){
 353                 return;
 354         }
 355
 356
 357         sid_name_table=g_hash_table_new(sid_name_hash, sid_name_equal);
 358
 359
 360         ctx_handle_table=g_hash_table_new(ctx_handle_hash, ctx_handle_equal);
 361
 362
 363         hf_lsa=proto_get_id_by_filter_name("lsa");
 364
 365         hfi=proto_registrar_get_byname("lsa.opnum");
 366         if(hfi){
 367                 hf_lsa_opnum=hfi->id;
 368         }
 369
 370         hfi=proto_registrar_get_byname("nt.domain_sid");
 371         if(hfi){
 372                 hf_nt_domain_sid=hfi->id;
 373         }
 374
 375         hfi=proto_registrar_get_byname("lsa.domain");
 376         if(hfi){
 377                 hf_lsa_domain=hfi->id;
 378         }
 379
 380         hfi=proto_registrar_get_byname("lsa.info.level");
 381         if(hfi){
 382                 hf_lsa_info_level=hfi->id;
 383         }
 384
 385         hfi=proto_registrar_get_byname("samr.hnd");
 386         if(hfi){
 387                 hf_samr_hnd=hfi->id;
 388         }
 389         hfi=proto_registrar_get_byname("samr.rid");
 390         if(hfi){
 391                 hf_samr_rid=hfi->id;
 392         }
 393         hfi=proto_registrar_get_byname("samr.acct_name");
 394         if(hfi){
 395                 hf_samr_acct_name=hfi->id;
 396         }
 397         hfi=proto_registrar_get_byname("samr.level");
 398         if(hfi){
 399                 hf_samr_level=hfi->id;
 400         }
 401
 402
 403
 404         error_string=register_tap_listener("dcerpc", &lsa_policy_information_tap_installed, "lsa.policy_information and ( lsa.info.level or lsa.domain or nt.domain_sid )", NULL, lsa_policy_information, NULL);
 405         if(error_string){
 406                 /* error, we failed to attach to the tap. clean up */
 407
 408                 fprintf(stderr, "tethereal: Couldn't register proto_reg_handoff_smb_sidsnooping()/lsa_policy_information tap: %s\n",
 409                     error_string->str);
 410                 g_string_free(error_string, TRUE);
 411                 exit(1);
 412         }
 413         lsa_policy_information_tap_installed=TRUE;
 414
 415         error_string=register_tap_listener("dcerpc", &samr_query_dispinfo_tap_installed, "samr and samr.opnum==40 and ( samr.hnd or samr.rid or samr.acct_name or samr.level )", NULL, samr_query_dispinfo, NULL);
 416         if(error_string){
 417                 /* error, we failed to attach to the tap. clean up */
 418
 419                 fprintf(stderr, "tethereal: Couldn't register proto_reg_handoff_smb_sidsnooping()/samr_query_dispinfo tap: %s\n",
 420                     error_string->str);
 421                 g_string_free(error_string, TRUE);
 422                 exit(1);
 423         }
 424         samr_query_dispinfo_tap_installed=TRUE;
 425 }
 426
 427 void
 428 proto_register_smb_sidsnooping(void)
 429 {
 430         register_init_routine(sid_snooping_init);
 431 }
 432
 433 void
 434 proto_reg_handoff_smb_sidsnooping(void)
 435 {
 436 }