gtk/export_object_smb.c

   1 /* export_object_smb.c
   2  * Routines for tracking & saving objects (files) found in SMB streams
   3  * See also: export_object.c / export_object.h for common code
   4  * Initial file, prototypes and general structure initially copied
   5  * from export_object_http.c
   6  *
   7  * Copyright 2010, David Perez & Jose Pico from TADDONG S.L.
   8  *
   9  * $Id$
  10  *
  11  * Wireshark - Network traffic analyzer
  12  * By Gerald Combs <gerald@wireshark.org>
  13  * Copyright 1998 Gerald Combs
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License
  17  * as published by the Free Software Foundation; either version 2
  18  * of the License, or (at your option) any later version.
  19  *
  20  * This program is distributed in the hope that it will be useful,
  21  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  23  * GNU General Public License for more details.
  24  *
  25  * You should have received a copy of the GNU General Public License
  26  * along with this program; if not, write to the Free Software
  27  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301,
  28  * USA.
  29  */
  30
  31 #ifdef HAVE_CONFIG_H
  32 # include "config.h"
  33 #endif
  34
  35 #include <gtk/gtk.h>
  36
  37 #include <epan/packet.h>
  38 #include <epan/dissectors/packet-smb.h>
  39 #include <epan/tap.h>
  40
  41 #include "gtk/export_object.h"
  42
  43
  44 /* These flags show what kind of data the object contains
  45    (designed to be or'ed) */
  46 #define SMB_EO_CONTAINS_NOTHING         0x00
  47 #define SMB_EO_CONTAINS_READS           0x01
  48 #define SMB_EO_CONTAINS_WRITES          0x02
  49 #define SMB_EO_CONTAINS_READSANDWRITES  0x03
  50 #define LEGAL_FILENAME_CHARS "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVXYZ1234567890_."
  51
  52 static const value_string smb_eo_contains_string[]={
  53         {SMB_EO_CONTAINS_NOTHING,               ""},
  54         {SMB_EO_CONTAINS_READS,                 "R"},
  55         {SMB_EO_CONTAINS_WRITES,                "W"},
  56         {SMB_EO_CONTAINS_READSANDWRITES,        "R&W"},
  57         {0, NULL}
  58         };
  59
  60
  61 /* This struct contains the relationship between
  62    the row# in the export_object window and the file being captured;
  63    the row# in this GSList will match the row# in the entry list */
  64
  65 typedef struct _active_file {
  66         guint16         tid,uid,fid;
  67         guint64         file_length;    /* The last free reported offset */
  68                                         /* We treat it as the file length */
  69         guint64         data_gathered;  /* The actual total of data gathered */
  70         guint8          flag_contains;  /* What kind of data it contains */
  71         GSList          *free_chunk_list;
  72                                         /* A list of virtual "holes" in the */
  73                                         /* file stream stored in memory */
  74         gboolean        is_out_of_memory;
  75                                         /* TRUE if we cannot allocate memory */
  76                                         /* memory for this file */
  77         } active_file ;
  78
  79 /* This is the GSList that will contain all the files that we are tracking */
  80 static GSList   *GSL_active_files = NULL;
  81
  82 /* We define a free chunk in a file as an start offset and end offset
  83    Consider a free chunk as a "hole" in a file that we are capturing */
  84 typedef struct _free_chunk {
  85         guint64         start_offset;
  86         guint64         end_offset;
  87 } free_chunk;
  88
  89 /* insert_chunk function will recalculate the free_chunk_list, the data_size,
  90    the end_of_file, and the data_gathered as appropriate.
  91    It will also insert the data chunk that is coming in the right
  92    place of the file in memory.
  93    HINTS:
  94    file->data_gathered  contains the real data gathered independently
  95                         from the file length
  96    file->file_length    contains the length of the file in memory, i.e.,
  97                         the last offset captured. In most cases, the real
  98                         file length would be different.
  99 */
 100 static void
 101 insert_chunk(active_file   *file, export_object_entry_t *entry, const smb_eo_t *eo_info)
 102 {
 103         guint           nfreechunks = g_slist_length(file->free_chunk_list);
 104         guint           i;
 105         free_chunk      *current_free_chunk;
 106         free_chunk      *new_free_chunk;
 107         guint64         chunk_offset=eo_info->smb_file_offset;
 108         guint64         chunk_length=eo_info->payload_len;
 109         guint64         chunk_end_offset = chunk_offset+chunk_length-1;
 110         /* Size of file in memory */
 111         guint64         calculated_size = chunk_offset+chunk_length;
 112         gpointer        dest_memory_addr;
 113
 114         /* Let's recalculate the file length and data gathered */
 115         if (file->data_gathered==0 && nfreechunks==0) {
 116                 /* If this is the first entry for this file, we first
 117                    create an initial free chunk */
 118                 new_free_chunk=g_malloc(sizeof(free_chunk));
 119                 new_free_chunk->start_offset=0;
 120                 new_free_chunk->end_offset=MAX(file->file_length,chunk_end_offset+1)-1;
 121                 file->free_chunk_list=NULL;
 122                 file->free_chunk_list=g_slist_append(file->free_chunk_list,new_free_chunk);
 123                 nfreechunks+=1;
 124         } else {
 125                 if (chunk_end_offset > file->file_length-1) {
 126                         new_free_chunk=g_malloc(sizeof(free_chunk));
 127                         new_free_chunk->start_offset=file->file_length;
 128                         new_free_chunk->end_offset=chunk_end_offset;
 129                         file->free_chunk_list=g_slist_append(file->free_chunk_list,new_free_chunk);
 130                         nfreechunks+=1;
 131                         }
 132         }
 133         file->file_length = MAX(file->file_length,chunk_end_offset+1);
 134
 135         for (i=0;i<nfreechunks;i++) {
 136                 current_free_chunk = g_slist_nth_data(file->free_chunk_list,i);
 137                 if (chunk_offset <= current_free_chunk->start_offset ) {
 138                         if (chunk_end_offset >= current_free_chunk->start_offset) {
 139                                 if (chunk_end_offset < current_free_chunk->end_offset) {
 140                                         file->data_gathered+=
 141                                                 (chunk_end_offset-current_free_chunk->start_offset+1);
 142                                         current_free_chunk->start_offset=chunk_end_offset+1;
 143                                 } else {
 144                                         file->data_gathered+=
 145                                                 (current_free_chunk->end_offset-current_free_chunk->start_offset+1);
 146                                         file->free_chunk_list =
 147                                                 g_slist_remove(file->free_chunk_list,current_free_chunk);
 148                                         nfreechunks-=1;
 149                                         if (nfreechunks==0) { /* The free chunk list is empty */
 150                                                 g_slist_free(file->free_chunk_list);
 151                                                 file->free_chunk_list=NULL;
 152                                                 break;
 153                                         }
 154                                 }
 155                         } else {
 156                                 break;
 157                         }
 158                 } else {
 159                         if (chunk_offset <= current_free_chunk->end_offset) {
 160                                 if (chunk_end_offset < current_free_chunk->end_offset) {
 161                                         new_free_chunk=g_malloc(sizeof(free_chunk));
 162                                         new_free_chunk->start_offset=chunk_end_offset+1;
 163                                         new_free_chunk->end_offset=current_free_chunk->end_offset;
 164                                         current_free_chunk->end_offset=chunk_offset-1;
 165                                         file->free_chunk_list =
 166                                                 g_slist_insert(file->free_chunk_list,new_free_chunk,i+1);
 167                                         file->data_gathered+=chunk_length;
 168                                 } else {
 169                                         file->data_gathered+=current_free_chunk->end_offset-chunk_offset+1;
 170                                         current_free_chunk->end_offset=chunk_offset-1;
 171                                 }
 172                         }
 173                 }
 174         }
 175
 176         /* Now, let's insert the data chunk into memory
 177            ...first, we shall be able to allocate the memory */
 178         if (!entry->payload_data) {
 179                 /* This is a New file */
 180                 if (calculated_size > G_MAXSIZE) {
 181                         /*
 182                          * The argument to g_try_malloc() is
 183                          * a gsize, the maximum value of which is
 184                          * G_MAXSIZE.  If the calculated size is
 185                          * bigger than that, we just say the attempt
 186                          * to allocate memory failed.
 187                          */
 188                         entry->payload_data=NULL;
 189                 } else {
 190                         entry->payload_data = g_try_malloc((gsize)calculated_size);
 191                         entry->payload_len=calculated_size;
 192                 }
 193                 if (!entry->payload_data) {
 194                         /* Memory error */
 195                         file->is_out_of_memory=TRUE;
 196                 }
 197         } else {
 198                 /* This is an existing file in memory */
 199                 if (calculated_size > (guint64) entry->payload_len &&
 200                     !file->is_out_of_memory) {
 201                         /* We need more memory */
 202                         if (calculated_size > G_MAXSIZE) {
 203                                 /*
 204                                  * As for g_try_malloc(), so for
 205                                  * g_try_realloc().
 206                                  */
 207                                 dest_memory_addr=NULL;
 208                         } else {
 209                                 dest_memory_addr=g_try_realloc(
 210                                         entry->payload_data,
 211                                         (gsize)calculated_size);
 212                         }
 213                         if(!dest_memory_addr) {
 214                                 /* Memory error */
 215                                 file->is_out_of_memory=TRUE;
 216                                 /* We don't have memory for this file.
 217                                    Free the current file content from memory */
 218                                 g_free(entry->payload_data);
 219                                 entry->payload_data=NULL;
 220                                 entry->payload_len=0;
 221                         } else {
 222                                 entry->payload_data=dest_memory_addr;
 223                                 entry->payload_len=calculated_size;
 224                         }
 225                 }
 226         }
 227         /* ...then, put the chunk of the file in the right place */
 228         if(!file->is_out_of_memory) {
 229                 dest_memory_addr=entry->payload_data+chunk_offset;
 230                 g_memmove(dest_memory_addr,eo_info->payload_data,eo_info->payload_len);
 231         }
 232 }
 233
 234 /* We use this function to obtain the index in the GSL of a given file */
 235 static int
 236 find_incoming_file(GSList *GSL_active_files,active_file *incoming_file)
 237 {
 238         int     i,row,last;
 239         active_file     *in_list_file;
 240
 241         row=-1;
 242         last=g_slist_length(GSL_active_files)-1;
 243
 244         /* We lookup in reverse order because it is more likely that the file
 245            is one of the latest */
 246         for (i=last;i>=0;i--) {
 247                 in_list_file=g_slist_nth_data(GSL_active_files, i);
 248                 /* The best-working criteria of two identical files is that the file
 249                    that is the same of the file that we are analyzing is the last one
 250                    in the list that has the same tid and the same fid */
 251                 /* note that we have excluded in_list_file->uid == incoming_file->uid
 252                    from the comparison, because a file can be opened by different
 253                    SMB users and it is still the same file */
 254                 if (in_list_file->tid == incoming_file->tid &&
 255                                 in_list_file->fid == incoming_file->fid) {
 256                         row=i;
 257                         break;
 258                 }
 259         }
 260
 261         return row;
 262 }
 263
 264 /* This is the function answering to the registered tap listener call */
 265 static gboolean
 266 eo_smb_packet(void *tapdata, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data)
 267 {
 268         export_object_list_t *object_list = tapdata;
 269         const smb_eo_t *eo_info = data;
 270
 271         export_object_entry_t   *entry;
 272         export_object_entry_t   *current_entry;
 273         active_file             incoming_file;
 274         gint                    active_row;
 275         active_file             *new_file;
 276         active_file             *current_file;
 277         guint8                  contains;
 278         gboolean                is_supported_filetype;
 279         gfloat                  percent;
 280
 281         gchar                   **aux_string_v;
 282
 283         /* Is this an eo_smb supported file_type? (right now we only support FILE */
 284         is_supported_filetype = (eo_info->fid_type==SMB_FID_TYPE_FILE);
 285
 286         /* What kind of data this packet contains? */
 287         switch(eo_info->cmd) {
 288         case SMB_COM_READ_ANDX:
 289                 contains=SMB_EO_CONTAINS_READS;
 290                 break;
 291         case SMB_COM_WRITE_ANDX:
 292                 contains=SMB_EO_CONTAINS_WRITES;
 293                 break;
 294         default:
 295                 contains=SMB_EO_CONTAINS_NOTHING;
 296                 break;
 297         }
 298
 299         /* Is this data from an already tracked file or not? */
 300         incoming_file.tid=eo_info->tid;
 301         incoming_file.uid=eo_info->uid;
 302         incoming_file.fid=eo_info->fid;
 303         active_row=find_incoming_file(GSL_active_files, &incoming_file);
 304
 305         if (active_row==-1) { /* This is a new-tracked file */
 306                 /* Construct the entry in the list of active files */
 307                 entry = g_malloc(sizeof(export_object_entry_t));
 308                 entry->payload_data=NULL;
 309                 entry->payload_len=0;
 310                 new_file = g_malloc(sizeof(active_file));
 311                 new_file->tid=incoming_file.tid;
 312                 new_file->uid=incoming_file.uid;
 313                 new_file->fid=incoming_file.fid;
 314                 new_file->file_length = eo_info->end_of_file;
 315                 new_file->flag_contains=contains;
 316                 new_file->free_chunk_list=NULL;
 317                 new_file->data_gathered=0;
 318                 new_file->is_out_of_memory=FALSE;
 319                 entry->pkt_num = pinfo->fd->num;
 320                 entry->hostname = g_strdup(eo_info->hostname);
 321                 if (g_str_has_prefix(eo_info->filename,"\\")) {
 322                         aux_string_v = g_strsplit(eo_info->filename, "\\", -1);
 323                         entry->filename = g_strdup(aux_string_v[g_strv_length(aux_string_v)-1]);
 324                         g_strfreev(aux_string_v);
 325                 } else {
 326                         entry->filename = g_strdup(eo_info->filename);
 327                 }
 328
 329                 /* Insert the first chunk in the chunk list of this file */
 330                 if (is_supported_filetype) {
 331                         insert_chunk(new_file, entry, eo_info);
 332                 }
 333
 334                 if(new_file->is_out_of_memory) {
 335                         entry->content_type =
 336                                 g_strdup_printf("%s (%"G_GUINT64_FORMAT"?/%"G_GUINT64_FORMAT") %s [mem!!]",
 337                                                 match_strval(eo_info->fid_type, smb_fid_types),
 338                                                 new_file->data_gathered,
 339                                                 new_file->file_length,
 340                                                 match_strval(contains, smb_eo_contains_string));
 341                 } else {
 342                         if (new_file->file_length > 0) {
 343                                 percent=(gfloat) 100*new_file->data_gathered/new_file->file_length;
 344                         } else {
 345                                 percent = 0.0;
 346                         }
 347
 348                         entry->content_type =
 349                                 g_strdup_printf("%s (%"G_GUINT64_FORMAT"/%"G_GUINT64_FORMAT") %s [%5.2f%%]",
 350                                                 match_strval(eo_info->fid_type, smb_fid_types),
 351                                                 new_file->data_gathered,
 352                                                 new_file->file_length,
 353                                                 match_strval(contains, smb_eo_contains_string),
 354                                                 percent);
 355                 }
 356
 357                 object_list->entries =
 358                         g_slist_append(object_list->entries, entry);
 359                 GSL_active_files =
 360                         g_slist_append(GSL_active_files, new_file);
 361         }
 362         else if (is_supported_filetype) {
 363                 current_file=g_slist_nth_data(GSL_active_files,active_row);
 364                 /* Recalculate the current file flags */
 365                 current_file->flag_contains=current_file->flag_contains|contains;
 366                 current_entry=g_slist_nth_data(object_list->entries,active_row);
 367
 368                 insert_chunk(current_file, current_entry, eo_info);
 369
 370                 /* Modify the current_entry object_type string */
 371                 if(current_file->is_out_of_memory) {
 372                         current_entry->content_type =
 373                                 g_strdup_printf("%s (%"G_GUINT64_FORMAT"?/%"G_GUINT64_FORMAT") %s [mem!!]",
 374                                                 match_strval(eo_info->fid_type, smb_fid_types),
 375                                                 current_file->data_gathered,
 376                                                 current_file->file_length,
 377                                                 match_strval(current_file->flag_contains, smb_eo_contains_string));
 378                 } else {
 379                         percent=(gfloat) 100*current_file->data_gathered/current_file->file_length;
 380                         current_entry->content_type =
 381                                 g_strdup_printf("%s (%"G_GUINT64_FORMAT"/%"G_GUINT64_FORMAT") %s [%5.2f%%]",
 382                                                 match_strval(eo_info->fid_type, smb_fid_types),
 383                                                 current_file->data_gathered,
 384                                                 current_file->file_length,
 385                                                 match_strval(current_file->flag_contains, smb_eo_contains_string),
 386                                                 percent);
 387                 }
 388         }
 389
 390         return TRUE; /* State changed - window should be redrawn */
 391 }
 392 /* This is the eo_protocoldata_reset function that is used in the export_object module
 393    to cleanup any previous private data of the export object functionality before perform
 394    the eo_reset function or when the window closes */
 395 static void
 396 eo_smb_cleanup(void)
 397 {
 398         int              i,last;
 399         active_file     *in_list_file;
 400
 401         /* Free any previous data structures used in previous invocation to the
 402            export_object_smb function */
 403         last=g_slist_length(GSL_active_files);
 404         if (GSL_active_files) {
 405                 for (i=last-1;i>=0;i--) {
 406                         in_list_file=g_slist_nth_data(GSL_active_files, i);
 407                         if (in_list_file->free_chunk_list) {
 408                                 g_slist_free(in_list_file->free_chunk_list);
 409                                 in_list_file->free_chunk_list=NULL;
 410                                 }
 411                         g_free(in_list_file);
 412                         }
 413                 g_slist_free(GSL_active_files);
 414                 GSL_active_files=NULL;
 415         }
 416 }
 417
 418 void
 419 eo_smb_cb(GtkWidget *widget _U_, gpointer data _U_)
 420 {
 421         /* Call the export_object window */
 422         export_object_window("smb_eo", "SMB", eo_smb_packet, eo_smb_cleanup);
 423 }