packet-smb-logon.c

   1 /* packet-smb-logon.c
   2  * Routines for SMB net logon packet dissection
   3  * Copyright 2000, Jeffrey C. Foster <jfoste@woodward.com>
   4  *
   5  * $Id: packet-smb-logon.c,v 1.34 2003/06/12 08:33:30 guy Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * Copied from packet-pop.c
  12  *
  13  * This program is free software; you can redistribute it and/or
  14  * modify it under the terms of the GNU General Public License
  15  * as published by the Free Software Foundation; either version 2
  16  * of the License, or (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  26  */
  27
  28 #include "packet-smb-common.h"
  29 #include "packet-smb-logon.h"
  30
  31 static int proto_smb_logon = -1;
  32 static int hf_command = -1;
  33 static int hf_computer_name = -1;
  34 static int hf_unicode_computer_name = -1;
  35 static int hf_server_name = -1;
  36 static int hf_user_name = -1;
  37 static int hf_domain_name = -1;
  38 static int hf_mailslot_name = -1;
  39 static int hf_pdc_name = -1;
  40 static int hf_unicode_pdc_name = -1;
  41 static int hf_script_name = -1;
  42 static int hf_nt_version = -1;
  43 static int hf_lmnt_token = -1;
  44 static int hf_lm_token = -1;
  45 static int hf_major_version = -1;
  46 static int hf_minor_version = -1;
  47 static int hf_os_version = -1;
  48 static int hf_date_time = -1;
  49 static int hf_update_type = -1;
  50 static int hf_request_count = -1;
  51 static int hf_flags_autolock = -1;
  52 static int hf_flags_expire = -1;
  53 static int hf_flags_server_trust = -1;
  54 static int hf_flags_workstation_trust = -1;
  55 static int hf_flags_interdomain_trust = -1;
  56 static int hf_flags_mns_user = -1;
  57 static int hf_flags_normal_user = -1;
  58 static int hf_flags_temp_dup_user = -1;
  59 static int hf_flags_password_required = -1;
  60 static int hf_flags_homedir_required = -1;
  61 static int hf_flags_enabled = -1;
  62 static int hf_domain_sid_size = -1;
  63 static int hf_low_serial = -1;
  64 static int hf_pulse = -1;
  65 static int hf_random = -1;
  66 static int hf_db_count = -1;
  67 static int hf_db_index = -1;
  68 static int hf_large_serial = -1;
  69 static int hf_nt_date_time = -1;
  70
  71 static int ett_smb_logon = -1;
  72 static int ett_smb_account_flags = -1;
  73 static int ett_smb_db_info = -1;
  74
  75 #define ACC_FLAG_AUTO_LOCKED                    0x0400
  76 #define ACC_FLAG_EXPIRE                         0x0200
  77 #define ACC_FLAG_SERVER_TRUST                   0x0100
  78 #define ACC_FLAG_WORKSTATION_TRUST              0x0080
  79 #define ACC_FLAG_INTERDOMAIN_TRUST              0x0040
  80 #define ACC_FLAG_MNS_USER                       0x0020
  81 #define ACC_FLAG_NORMAL_USER                    0x0010
  82 #define ACC_FLAG_TEMP_DUP_USER                  0x0008
  83 #define ACC_FLAG_PASSWORD_REQUIRED              0x0004
  84 #define ACC_FLAG_HOMEDIR_REQUIRED               0x0002
  85 #define ACC_FLAG_ENABLED                        0x0001
  86
  87 static const true_false_string tfs_flags_autolock = {
  88         "User account auto-locked",
  89         "User account NOT auto-locked"
  90 };
  91 static const true_false_string tfs_flags_expire = {
  92         "User password will NOT expire",
  93         "User password will expire"
  94 };
  95 static const true_false_string tfs_flags_server_trust = {
  96         "Server Trust user account",
  97         "NOT a Server Trust user account"
  98 };
  99 static const true_false_string tfs_flags_workstation_trust = {
 100         "Workstation Trust user account",
 101         "NOT a Workstation Trust user account"
 102 };
 103 static const true_false_string tfs_flags_interdomain_trust = {
 104         "Inter-domain Trust user account",
 105         "NOT a Inter-domain Trust user account"
 106 };
 107 static const true_false_string tfs_flags_mns_user = {
 108         "MNS Logon user account",
 109         "NOT a MNS Logon user account"
 110 };
 111 static const true_false_string tfs_flags_normal_user = {
 112         "Normal user account",
 113         "NOT a normal user account"
 114 };
 115 static const true_false_string tfs_flags_temp_dup_user = {
 116         "Temp duplicate user account",
 117         "NOT a temp duplicate user account"
 118 };
 119 static const true_false_string tfs_flags_password_required = {
 120         "NO password required",
 121         "Password required"
 122 };
 123 static const true_false_string tfs_flags_homedir_required = {
 124         "NO homedir required",
 125         "Homedir required"
 126 };
 127 static const true_false_string tfs_flags_enabled = {
 128         "User account enabled",
 129         "User account disabled"
 130 };
 131
 132
 133
 134 static int
 135 dissect_account_control(tvbuff_t *tvb, proto_tree *tree, int offset)
 136 {
 137         /* display the Allowable Account control bits */
 138
 139         proto_item *ti = NULL;
 140         proto_tree *flags_tree = NULL;
 141         guint32 flags;
 142
 143         flags = tvb_get_letohl(tvb, offset);
 144
 145         if (tree) {
 146                 ti = proto_tree_add_text(tree, tvb, offset, 4,
 147                         "Account control  = 0x%04x", flags);
 148
 149                 flags_tree = proto_item_add_subtree(ti, ett_smb_account_flags);
 150         }
 151
 152         proto_tree_add_boolean(flags_tree, hf_flags_autolock, tvb, offset, 4, flags);
 153         proto_tree_add_boolean(flags_tree, hf_flags_expire, tvb, offset, 4, flags);
 154         proto_tree_add_boolean(flags_tree, hf_flags_server_trust, tvb, offset, 4, flags);
 155         proto_tree_add_boolean(flags_tree, hf_flags_workstation_trust, tvb, offset, 4, flags);
 156         proto_tree_add_boolean(flags_tree, hf_flags_interdomain_trust, tvb, offset, 4, flags);
 157         proto_tree_add_boolean(flags_tree, hf_flags_mns_user, tvb, offset, 4, flags);
 158         proto_tree_add_boolean(flags_tree, hf_flags_normal_user, tvb, offset, 4, flags);
 159         proto_tree_add_boolean(flags_tree, hf_flags_temp_dup_user, tvb, offset, 4, flags);
 160         proto_tree_add_boolean(flags_tree, hf_flags_password_required, tvb, offset, 4, flags);
 161         proto_tree_add_boolean(flags_tree, hf_flags_homedir_required, tvb, offset, 4, flags);
 162         proto_tree_add_boolean(flags_tree, hf_flags_enabled, tvb, offset, 4, flags);
 163
 164         offset += 4;
 165
 166         return offset;
 167 }
 168
 169 static int
 170 display_LM_token(tvbuff_t *tvb, int offset, proto_tree *tree)
 171 {
 172         guint16 Token;
 173
 174         Token = tvb_get_letohs(tvb, offset);
 175
 176         if (Token & 0x01) {
 177                 proto_tree_add_uint_format(tree, hf_lm_token, tvb, offset, 2,
 178                         Token,
 179                         "LM20 Token: 0x%04x (LanMan 2.0 or higher)", Token);
 180         } else {
 181                 /*
 182                  * XXX - are all values with the lower bit set LM 2.0,
 183                  * and all values with it not set LM 1.0?
 184                  * What do the other bits mean, if anything?
 185                  */
 186                 proto_tree_add_uint_format(tree, hf_lm_token, tvb, offset, 2,
 187                         Token,
 188                         "LM10 Token: 0x%04x (WFW Networking)", Token);
 189         }
 190
 191         offset += 2;
 192
 193         return offset;
 194 }
 195
 196 static int
 197 display_LMNT_token(tvbuff_t *tvb, int offset, proto_tree *tree)
 198 {
 199         guint16 Token;
 200
 201         Token = tvb_get_letohs(tvb, offset);
 202
 203         if (Token == 0xffff) {
 204                 proto_tree_add_uint_format(tree, hf_lmnt_token, tvb, offset, 2,
 205                         Token,
 206                         "LMNT Token: 0x%04x (Windows NT Networking)", Token);
 207         } else {
 208                 /*
 209                  * XXX - what is it if it's not 0xffff?
 210                  */
 211                 proto_tree_add_uint_format(tree, hf_lm_token, tvb, offset, 2,
 212                         Token,
 213                         "LMNT Token: 0x%04x (Unknown)", Token);
 214         }
 215
 216         offset += 2;
 217
 218         return offset;
 219 }
 220
 221 static int
 222 dissect_smb_logon_request(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 223 {
 224         /*** 0x00 (LM1.0/LM2.0 LOGON Request) ***/
 225
 226         /* computer name */
 227         offset = display_ms_string(tvb, tree, offset, hf_computer_name, NULL);
 228
 229         /* user name */
 230         offset = display_ms_string(tvb, tree, offset, hf_user_name, NULL);
 231
 232         /* mailslot name */
 233         offset = display_ms_string(tvb, tree, offset, hf_mailslot_name, NULL);
 234
 235         /*$$$$$ here add the Mailslot to the response list (if needed) */
 236
 237         /* Request count */
 238         proto_tree_add_item(tree, hf_request_count, tvb, offset, 1, TRUE);
 239         offset += 1;
 240
 241         /* NT version */
 242         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 2, TRUE);
 243         offset += 2;
 244
 245         /* LM token */
 246         offset = display_LM_token(tvb, offset, tree);
 247
 248         return offset;
 249 }
 250
 251
 252
 253 static int
 254 dissect_smb_logon_LM10_resp(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 255 {
 256         /*** 0x01 LanMan 1.0 Logon response ***/
 257
 258         /* user name */
 259         offset = display_ms_string(tvb, tree, offset, hf_user_name, NULL);
 260
 261         /* script name */
 262         offset = display_ms_string(tvb, tree, offset, hf_script_name, NULL);
 263
 264         return offset;
 265 }
 266
 267
 268 static int
 269 dissect_smb_logon_2(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 270 {
 271         /*** 0x02  LM1.0 Query - Centralized Initialization ***/
 272         /*** 0x03  LM1.0 Query - Distributed Initialization ***/
 273         /*** 0x04  LM1.0 Query - Centralized Query Response ***/
 274         /*** 0x04  LM1.0 Query - Distributed Query Response ***/
 275
 276         /* computer name */
 277         offset = display_ms_string(tvb, tree, offset, hf_computer_name, NULL);
 278
 279         /* mailslot name */
 280         offset = display_ms_string(tvb, tree, offset, hf_mailslot_name, NULL);
 281
 282         /* NT version */
 283         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 2, TRUE);
 284         offset += 2;
 285
 286         /* LM token */
 287         offset = display_LM_token(tvb, offset, tree);
 288
 289         return offset;
 290 }
 291
 292
 293
 294 static int
 295 dissect_smb_logon_LM20_resp(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 296 {
 297         /*** 0x06 (LM2.0 LOGON Response)        ***/
 298
 299         /* server name */
 300         offset = display_ms_string(tvb, tree, offset, hf_server_name, NULL);
 301
 302         /* LM token */
 303         offset = display_LM_token(tvb, offset, tree);
 304
 305         return offset;
 306 }
 307
 308
 309
 310 static int
 311 dissect_smb_pdc_query(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 312 {
 313         char *name;
 314
 315         /*** 0x07 Query for Primary PDC  ***/
 316
 317         /* computer name */
 318         offset = display_ms_string(tvb, tree, offset, hf_computer_name, &name);
 319
 320         if (check_col(pinfo->cinfo, COL_INFO))
 321                 col_append_fstr(pinfo->cinfo, COL_INFO, " from %s", name);
 322
 323         g_free(name);
 324
 325         /* mailslot name */
 326         offset = display_ms_string(tvb, tree, offset, hf_mailslot_name, NULL);
 327
 328         if (tvb_reported_length_remaining(tvb, offset) > 2) {
 329                 /*
 330                  * NT-style Query for PDC?
 331                  * If only 2 bytes remain, it's probably a Windows 95-style
 332                  * query, which has only an LM token after the mailslot
 333                  * name.
 334                  *
 335                  * XXX - base this on flags in the SMB header, e.g.
 336                  * the ASCII/Unicode strings flag?
 337                  */
 338                 if (offset % 2) offset++;      /* word align ... */
 339
 340                 /* Unicode computer name */
 341                 offset = display_unicode_string(tvb, tree, offset, hf_unicode_computer_name, NULL);
 342
 343                 /* NT version */
 344                 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
 345                 offset += 4;
 346
 347                 /* LMNT token */
 348                 offset = display_LMNT_token(tvb, offset, tree);
 349         }
 350
 351         /* LM token */
 352         offset = display_LM_token(tvb, offset, tree);
 353
 354         return offset;
 355 }
 356
 357
 358
 359 static int
 360 dissect_smb_pdc_startup(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 361 {
 362         /*** 0x08  Announce startup of PDC ***/
 363
 364         /* pdc name */
 365         offset = display_ms_string(tvb, tree, offset, hf_pdc_name, NULL);
 366
 367         /* A short Announce will not have the rest */
 368
 369         if (tvb_reported_length_remaining(tvb, offset) != 0) {
 370           char *name = NULL;
 371
 372           if (offset % 2) offset++;      /* word align ... */
 373
 374           /* pdc name */
 375           offset = display_unicode_string(tvb, tree, offset, hf_unicode_pdc_name, &name);
 376
 377           if (name && check_col(pinfo->cinfo, COL_INFO)) {
 378                   col_append_fstr(pinfo->cinfo, COL_INFO, ": host %s", name);
 379                   g_free(name);
 380                   name = NULL;
 381           }
 382
 383           if (offset % 2) offset++;
 384
 385           /* domain name */
 386           offset = display_unicode_string(tvb, tree, offset, hf_domain_name, &name);
 387
 388           if (name && check_col(pinfo->cinfo, COL_INFO)) {
 389                   col_append_fstr(pinfo->cinfo, COL_INFO, ", domain %s", name);
 390                   g_free(name);
 391                   name = NULL;
 392           }
 393
 394           /* NT version */
 395           proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
 396           offset += 4;
 397
 398           /* LMNT token */
 399           offset = display_LMNT_token(tvb, offset, tree);
 400
 401           /* LM token */
 402           offset = display_LM_token(tvb, offset, tree);
 403         }
 404
 405         return offset;
 406 }
 407
 408
 409
 410 static int
 411 dissect_smb_pdc_failure(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 412 {
 413         /*** 0x09 Announce failure of the PDC ***/
 414         /*** 0x0F LM2.0 Resp. during LOGON pause ***/
 415         /*** 0x10 (LM 2.0 Unknown user response) ***/
 416
 417         /* NT version */
 418         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
 419         offset += 4;
 420
 421         /* LM token */
 422         offset = display_LM_token(tvb, offset, tree);
 423
 424         return offset;
 425 }
 426
 427
 428 static int
 429 dissect_announce_change(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 430 {
 431         /*** 0x0A ( Announce change to UAS or SAM ) ***/
 432         guint32 info_count;
 433         proto_item *ti = NULL;
 434         proto_tree *info_tree = NULL;
 435         guint32 db_index;
 436         guint32 domain_sid_size;
 437
 438         /* low serial number */
 439         proto_tree_add_item(tree, hf_low_serial, tvb, offset, 4, TRUE);
 440         offset += 4;
 441
 442         /* date/time */
 443         /* XXX - what format is this?  Neither SMB_Date/SMB_Time nor
 444            "time_t but in the local time zone" appear to be correct. */
 445         proto_tree_add_item(tree, hf_date_time, tvb, offset, 4, TRUE);
 446         offset += 4;
 447
 448         /* pulse */
 449         proto_tree_add_item(tree, hf_pulse, tvb, offset, 4, TRUE);
 450         offset += 4;
 451
 452         /* random */
 453         proto_tree_add_item(tree, hf_random, tvb, offset, 4, TRUE);
 454         offset += 4;
 455
 456         /* pdc name */
 457         offset = display_ms_string(tvb, tree, offset, hf_pdc_name, NULL);
 458
 459         /* domain name */
 460         offset = display_ms_string(tvb, tree, offset, hf_domain_name, NULL);
 461
 462         if (offset % 2) offset++;      /* word align ... */
 463
 464         if (tvb_reported_length_remaining(tvb, offset) > 2) {
 465                 /*
 466                  * XXX - older protocol versions don't have this stuff?
 467                  */
 468                 /* pdc name */
 469                 offset = display_unicode_string(tvb, tree, offset, hf_unicode_pdc_name, NULL);
 470
 471                 /* domain name */
 472                 offset = display_unicode_string(tvb, tree, offset, hf_domain_name, NULL);
 473
 474                 /* DB count */
 475                 info_count = tvb_get_letohl(tvb, offset);
 476                 proto_tree_add_uint(tree, hf_db_count, tvb, offset, 4, info_count);
 477                 offset += 4;
 478
 479                 while (info_count != 0) {
 480                         db_index = tvb_get_letohl(tvb, offset);
 481                         if (tree) {
 482                                 ti = proto_tree_add_text(tree, tvb, offset, 20,
 483                                     "DBChange Info Structure: index %u", db_index);
 484                                 info_tree = proto_item_add_subtree(ti, ett_smb_db_info);
 485                         }
 486
 487                         proto_tree_add_uint(info_tree, hf_db_index, tvb, offset, 4,
 488                             db_index);
 489                         offset += 4;
 490
 491                         proto_tree_add_item(info_tree, hf_large_serial, tvb, offset, 8,
 492                             TRUE);
 493                         offset += 8;
 494
 495                         offset = dissect_smb_64bit_time(tvb, info_tree, offset,
 496                             hf_nt_date_time);
 497
 498                         info_count--;
 499                 }
 500
 501                 /* Domain SID Size */
 502                 domain_sid_size = tvb_get_letohl(tvb, offset);
 503                 proto_tree_add_uint(tree, hf_domain_sid_size, tvb, offset, 4,
 504                     domain_sid_size);
 505                 offset += 4;
 506
 507                 if (domain_sid_size != 0) {
 508                         /* Align to four-byte boundary */
 509                         offset = ((offset + 3)/4)*4;
 510
 511                         /* Domain SID */
 512                         offset = dissect_nt_sid(
 513                                 tvb, offset, tree, "Domain", NULL, -1);
 514                 }
 515
 516                 /* NT version */
 517                 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
 518                 offset += 4;
 519
 520                 /* LMNT token */
 521                 offset = display_LMNT_token(tvb, offset, tree);
 522         }
 523
 524         /* LM token */
 525         offset = display_LM_token(tvb, offset, tree);
 526
 527         return offset;
 528 }
 529
 530
 531
 532 static int
 533 dissect_smb_sam_logon_req(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 534 {
 535         /* Netlogon command 0x12 - decode the SAM logon request from client */
 536
 537         guint32 domain_sid_size;
 538
 539         /* Request count */
 540         proto_tree_add_item(tree, hf_request_count, tvb, offset, 2, TRUE);
 541         offset += 2;
 542
 543         /* computer name */
 544         offset = display_unicode_string(tvb, tree, offset, hf_unicode_computer_name, NULL);
 545
 546         /* user name */
 547         offset = display_unicode_string(tvb, tree, offset, hf_user_name, NULL);
 548
 549         /* mailslot name */
 550         offset = display_ms_string(tvb, tree, offset, hf_mailslot_name, NULL);
 551
 552         /* account control */
 553         offset = dissect_account_control(tvb, tree, offset);
 554
 555         /* Domain SID Size */
 556         domain_sid_size = tvb_get_letohl(tvb, offset);
 557         proto_tree_add_uint(tree, hf_domain_sid_size, tvb, offset, 4,
 558             domain_sid_size);
 559         offset += 4;
 560
 561         if (domain_sid_size != 0) {
 562                 /* Align to four-byte boundary */
 563                 offset = ((offset + 3)/4)*4;
 564
 565                 /* Domain SID */
 566                 offset = dissect_nt_sid(tvb, offset, tree, "Domain", NULL, -1);
 567         }
 568
 569         /* NT version */
 570         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
 571         offset += 4;
 572
 573         /* LMNT token */
 574         offset = display_LMNT_token(tvb, offset, tree);
 575
 576         /* LM token */
 577         offset = display_LM_token(tvb, offset, tree);
 578
 579         return offset;
 580 }
 581
 582
 583
 584 static int
 585 dissect_smb_no_user(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 586 {
 587         /* 0x0B (Announce no user on machine) */
 588
 589         /* computer name */
 590         offset = display_ms_string(tvb, tree, offset, hf_computer_name, NULL);
 591
 592         return offset;
 593 }
 594
 595
 596
 597 static int
 598 dissect_smb_relogon_resp(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 599 {
 600         /*** 0x0d LanMan Response to relogon request ***/
 601
 602         /* Major version */
 603         proto_tree_add_item(tree, hf_major_version, tvb, offset, 1, TRUE);
 604         offset += 1;
 605
 606         /* Minor version */
 607         proto_tree_add_item(tree, hf_minor_version, tvb, offset, 1, TRUE);
 608         offset += 1;
 609
 610         /* OS version */
 611         proto_tree_add_item(tree, hf_os_version, tvb, offset, 1, TRUE);
 612         offset += 1;
 613
 614         /* NT version */
 615         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
 616         offset += 4;
 617
 618         /* LM token */
 619         offset = display_LM_token(tvb, offset, tree);
 620
 621         return offset;
 622 }
 623
 624
 625
 626 static int
 627 dissect_smb_acc_update(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 628 {
 629         /*** 0x11  LM2.1 Announce Acc updates  ***/
 630
 631         guint32 Temp1, Temp2;
 632
 633         Temp1 = tvb_get_letohl(tvb, offset);
 634         Temp2 = tvb_get_letohl(tvb, offset + 4);
 635
 636         /* signature */
 637         proto_tree_add_text(tree, tvb, offset, 8, "Signature: 0x%08x%08x",
 638                 Temp1, Temp2);
 639         offset += 8;
 640
 641         /* date/time */
 642         /* XXX - what format is this?  Neither SMB_Date/SMB_Time nor
 643            "time_t but in the local time zone" appear to be correct. */
 644         proto_tree_add_item(tree, hf_date_time, tvb, offset, 4, TRUE);
 645         offset += 4;
 646
 647         /* computer name */
 648         offset = display_ms_string(tvb, tree, offset, hf_computer_name, NULL);
 649
 650         /* user name */
 651         offset = display_ms_string(tvb, tree, offset, hf_user_name, NULL);
 652
 653         /* update type */
 654         proto_tree_add_item(tree, hf_update_type, tvb, offset, 2, TRUE);
 655         offset += 2;
 656
 657         /* NT version */
 658         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
 659         offset += 4;
 660
 661         /* LM token */
 662         offset = display_LM_token(tvb, offset, tree);
 663
 664         return offset;
 665 }
 666
 667
 668
 669 static int
 670 dissect_smb_inter_resp(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 671 {
 672         /* 0x0e LanMan Response to interrogate request */
 673
 674         /* Major version */
 675         proto_tree_add_item(tree, hf_major_version, tvb, offset, 1, TRUE);
 676         offset += 1;
 677
 678         /* Minor version */
 679         proto_tree_add_item(tree, hf_minor_version, tvb, offset, 1, TRUE);
 680         offset += 1;
 681
 682         /* OS version */
 683         proto_tree_add_item(tree, hf_os_version, tvb, offset, 1, TRUE);
 684         offset += 1;
 685
 686         /* NT version */
 687         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
 688         offset += 4;
 689
 690         /* LMNT token */
 691         offset = display_LMNT_token(tvb, offset, tree);
 692
 693         /* XXX - no LM token?  Every other packet has one after the LMNT
 694            token. */
 695
 696         return offset;
 697 }
 698
 699
 700 static int
 701 dissect_smb_sam_logon_resp(tvbuff_t *tvb, packet_info *pinfo _U_,
 702         proto_tree *tree, int offset)
 703 {
 704         /* Netlogon command 0x13 - decode the SAM logon response from server */
 705
 706         /* server name */
 707         offset = display_unicode_string(tvb, tree, offset, hf_server_name, NULL);
 708
 709         /* user name */
 710         offset = display_unicode_string(tvb, tree, offset, hf_user_name, NULL);
 711
 712         /* domain name */
 713         offset = display_unicode_string(tvb, tree, offset, hf_domain_name, NULL);
 714
 715         /* NT version */
 716         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
 717         offset += 4;
 718
 719         /* LMNT token */
 720         offset = display_LMNT_token(tvb, offset, tree);
 721
 722         /* LM token */
 723         offset = display_LM_token(tvb, offset, tree);
 724
 725         return offset;
 726 }
 727
 728
 729 #define LOGON_LM10_LOGON_REQUEST                0x00
 730 #define LOGON_LM10_LOGON_RESPONSE               0x01
 731 #define LOGON_LM10_QUERY_CI                     0x02
 732 #define LOGON_LM10_QUERY_DI                     0x03
 733 #define LOGON_LM10_RESPONSE_CI                  0x04
 734 #define LOGON_LM10_RESPONSE_DI                  0x05
 735 #define LOGON_LM20_LOGON_RESPONSE               0x06
 736 #define LOGON_PDC_QUERY                         0x07
 737 #define LOGON_PDC_STARTUP                       0x08
 738 #define LOGON_PDC_FAILED                        0x09
 739 #define LOGON_UAS_SAM                           0x0a
 740 #define LOGON_NO_USER                           0x0b
 741 #define LOGON_PDC_RESPONSE                      0x0c
 742 #define LOGON_RELOGON_RESPONSE                  0x0d
 743 #define LOGON_INTERROGATE_RESPONSE              0x0e
 744 #define LOGON_LM20_RESPONSE_DURING_LOGON        0x0f
 745 #define LOGON_LM20_USER_UNKNOWN                 0x10
 746 #define LOGON_LM20_ACCOUNT_UPDATE               0x11
 747 #define LOGON_SAM_LOGON_REQUEST                 0x12
 748 #define LOGON_SAM_LOGON_RESPONSE                0x13
 749 #define LOGON_SAM_RESPONSE_DURING_LOGON         0x14
 750 #define LOGON_SAM_USER_UNKNOWN                  0x15
 751 #define LOGON_SAM_INTERROGATE_RESPONSE          0x16
 752 #define LOGON_SAM_AD_USER_UNKNOWN               0x17
 753 #define LOGON_SAM_UNKNOWN_18                    0x18
 754 #define LOGON_SAM_AD_LOGON_RESPONSE             0x19
 755 #define LOGON_LAST_CMD                          0x20
 756
 757 static const value_string commands[] = {
 758         {LOGON_LM10_LOGON_REQUEST,      "LM1.0/LM2.0 LOGON Request"},
 759         {LOGON_LM10_LOGON_RESPONSE,     "LM1.0 LOGON Response"},
 760         {LOGON_LM10_QUERY_CI,           "LM1.0 Query - Centralized Initialization"},
 761         {LOGON_LM10_QUERY_DI,           "LM1.0 Query - Distributed Initialization"},
 762         {LOGON_LM10_RESPONSE_CI,        "LM1.0 Response - Centralized Query"},
 763         {LOGON_LM10_RESPONSE_DI,        "LM1.0 Response - Distributed Initialization"},
 764         {LOGON_LM20_LOGON_RESPONSE,     "LM2.0 Response to LOGON Request"},
 765         {LOGON_PDC_QUERY,               "Query for PDC"},
 766         {LOGON_PDC_STARTUP,             "Announce Startup of PDC"},
 767         {LOGON_PDC_FAILED,              "Announce Failed PDC"},
 768         {LOGON_UAS_SAM,                 "Announce Change to UAS or SAM"},
 769         {LOGON_NO_USER,                 "Announce no user on machine"},
 770         {LOGON_PDC_RESPONSE,            "Response from PDC"},
 771         {LOGON_RELOGON_RESPONSE,        "LM1.0/LM2.0 Response to re-LOGON Request"},
 772         {LOGON_INTERROGATE_RESPONSE,    "LM1.0/LM2.0 Response to Interrogate Request"},
 773         {LOGON_LM20_RESPONSE_DURING_LOGON,"LM2.0 Response during LOGON pause"},
 774         {LOGON_LM20_USER_UNKNOWN,       "LM2.0 Response - user unknown"},
 775         {LOGON_LM20_ACCOUNT_UPDATE,     "LM2.0 Announce account updates"},
 776         {LOGON_SAM_LOGON_REQUEST,       "SAM LOGON request from client"},
 777         {LOGON_SAM_LOGON_RESPONSE,      "Response to SAM LOGON request"},
 778         {LOGON_SAM_RESPONSE_DURING_LOGON,"SAM Response during LOGON pause"},
 779         {LOGON_SAM_USER_UNKNOWN,        "SAM Response - user unknown"},
 780         {LOGON_SAM_INTERROGATE_RESPONSE,"SAM Response to Interrogate Request"},
 781         {LOGON_SAM_AD_USER_UNKNOWN,     "SAM Active Directory Response - user unknown"},
 782         {LOGON_SAM_UNKNOWN_18,          "SAM unknown command 0x18"},
 783         {LOGON_SAM_AD_LOGON_RESPONSE,   "Active Directory Response to SAM LOGON request"},
 784         {0,     NULL}
 785 };
 786
 787
 788 static int (*dissect_smb_logon_cmds[])(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset) = {
 789         dissect_smb_logon_request,  /* 0x00 (LM1.0/LM2.0 LOGON Request) */
 790         dissect_smb_logon_LM10_resp,/* 0x01 (LM1.0 LOGON Response)      */
 791         dissect_smb_logon_2,        /* 0x02 (LM1.0 Query Centralized Init.)*/
 792         dissect_smb_logon_2,        /* 0x03 (LM1.0 Query Distributed Init.)*/
 793         dissect_smb_logon_2,        /* 0x04 (LM1.0 Centralized Query Resp.)*/
 794         dissect_smb_logon_2,        /* 0x05 (LM1.0 Distributed Query Resp.) */
 795         dissect_smb_logon_LM20_resp,/* 0x06 (LM2.0 LOGON Response)      */
 796         dissect_smb_pdc_query,      /* 0x07 (Query for PDC)             */
 797         dissect_smb_pdc_startup,    /* 0x08 (Announce PDC startup)      */
 798         dissect_smb_pdc_failure,    /* 0x09 (Announce Failed PDC)       */
 799         dissect_announce_change,    /* 0x0A (Announce Change to UAS or SAM)*/
 800         dissect_smb_no_user,        /* 0x0B (Announce no user on machine)*/
 801         dissect_smb_pdc_startup,    /* 0x0C (Response from PDC)         */
 802         dissect_smb_relogon_resp,   /* 0x0D (Relogon response)          */
 803         dissect_smb_inter_resp,     /* 0x0E (Interrogate response)      */
 804         dissect_smb_pdc_failure,    /* 0x0F (LM2.0 Resp. during LOGON pause*/
 805         dissect_smb_pdc_failure,    /* 0x10 (LM 2.0 Unknown user response)*/
 806         dissect_smb_acc_update,     /* 0x11 (LM2.1 Announce Acc updates)*/
 807         dissect_smb_sam_logon_req,  /* 0x12 (SAM LOGON request )        */
 808         dissect_smb_sam_logon_resp, /* 0x13 (SAM LOGON response)        */
 809         dissect_smb_unknown,        /* 0x14 (SAM Response during LOGON Pause) */
 810         dissect_smb_unknown,        /* 0x15 (SAM Response User Unknown) */
 811         dissect_smb_unknown,        /* 0x16 (SAM Response to Interrogate)*/
 812         dissect_smb_unknown,        /* 0x17 (SAM AD response User Unknown*/
 813         dissect_smb_unknown,        /* 0x18 (Unknown command)           */
 814         dissect_smb_unknown         /* 0x19 (SAM LOGON AD response)     */
 815 };
 816
 817
 818 gboolean
 819 dissect_smb_logon(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 820 {
 821         int        offset = 0;
 822         guint8     cmd;
 823         proto_tree *smb_logon_tree = NULL;
 824         proto_item *item = NULL;
 825
 826         if (!proto_is_protocol_enabled(proto_smb_logon))
 827                 return FALSE;
 828
 829         pinfo->current_proto = "NETLOGON";
 830
 831         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 832                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "NETLOGON");
 833         if (check_col(pinfo->cinfo, COL_INFO))
 834                 col_clear(pinfo->cinfo, COL_INFO);
 835
 836         /* get the Command field */
 837         cmd = tvb_get_guint8(tvb, offset);
 838
 839         if (check_col(pinfo->cinfo, COL_INFO))
 840                 col_add_str(pinfo->cinfo, COL_INFO, val_to_str(cmd, commands, "Unknown Command:%02x") );
 841
 842         if (tree) {
 843                 item = proto_tree_add_item(tree, proto_smb_logon, tvb,
 844                         offset, -1, FALSE);
 845
 846                 smb_logon_tree = proto_item_add_subtree(item, ett_smb_logon);
 847         }
 848
 849         /* command */
 850         proto_tree_add_uint(smb_logon_tree, hf_command, tvb, offset, 1, cmd);
 851         offset += 1;
 852
 853         /* skip next byte */
 854         offset += 1;
 855
 856         if (cmd<LOGON_LAST_CMD) {
 857                 offset = (dissect_smb_logon_cmds[cmd])(tvb, pinfo,
 858                     smb_logon_tree, offset);
 859         } else {
 860                 /* unknown command */
 861                 offset = dissect_smb_unknown(tvb, pinfo, smb_logon_tree,
 862                     offset);
 863         }
 864
 865         return TRUE;
 866 }
 867
 868 void
 869 proto_register_smb_logon( void)
 870 {
 871         static hf_register_info hf[] = {
 872                 { &hf_command,
 873                         { "Command", "netlogon.command", FT_UINT8, BASE_HEX,
 874                           VALS(commands), 0, "NETLOGON Command", HFILL }},
 875
 876                 { &hf_computer_name,
 877                         { "Computer Name", "netlogon.computer_name", FT_STRING, BASE_NONE,
 878                           NULL, 0, "NETLOGON Computer Name", HFILL }},
 879
 880                 { &hf_unicode_computer_name,
 881                         { "Unicode Computer Name", "netlogon.unicode_computer_name", FT_STRING, BASE_NONE,
 882                           NULL, 0, "NETLOGON Unicode Computer Name", HFILL }},
 883
 884                 { &hf_server_name,
 885                         { "Server Name", "netlogon.server_name", FT_STRING, BASE_NONE,
 886                           NULL, 0, "NETLOGON Server Name", HFILL }},
 887
 888                 { &hf_user_name,
 889                         { "User Name", "netlogon.user_name", FT_STRING, BASE_NONE,
 890                           NULL, 0, "NETLOGON User Name", HFILL }},
 891
 892                 { &hf_domain_name,
 893                         { "Domain Name", "netlogon.domain_name", FT_STRING, BASE_NONE,
 894                           NULL, 0, "NETLOGON Domain Name", HFILL }},
 895
 896                 { &hf_mailslot_name,
 897                         { "Mailslot Name", "netlogon.mailslot_name", FT_STRING, BASE_NONE,
 898                           NULL, 0, "NETLOGON Mailslot Name", HFILL }},
 899
 900                 { &hf_pdc_name,
 901                         { "PDC Name", "netlogon.pdc_name", FT_STRING, BASE_NONE,
 902                           NULL, 0, "NETLOGON PDC Name", HFILL }},
 903
 904                 { &hf_unicode_pdc_name,
 905                         { "Unicode PDC Name", "netlogon.unicode_pdc_name", FT_STRING, BASE_NONE,
 906                           NULL, 0, "NETLOGON Unicode PDC Name", HFILL }},
 907
 908                 { &hf_script_name,
 909                         { "Script Name", "netlogon.script_name", FT_STRING, BASE_NONE,
 910                           NULL, 0, "NETLOGON Script Name", HFILL }},
 911
 912                 { &hf_nt_version,
 913                         { "NT Version", "netlogon.nt_version", FT_UINT32, BASE_DEC,
 914                           NULL, 0, "NETLOGON NT Version", HFILL }},
 915
 916                 /* An LMNT Token, if 0xffff, is "WindowsNT Networking";
 917                    what is it otherwise? */
 918                 { &hf_lmnt_token,
 919                         { "LMNT Token", "netlogon.lmnt_token", FT_UINT16, BASE_HEX,
 920                           NULL, 0, "NETLOGON LMNT Token", HFILL }},
 921
 922                 { &hf_lm_token,
 923                         { "LM Token", "netlogon.lm_token", FT_UINT16, BASE_HEX,
 924                           NULL, 0, "NETLOGON LM Token", HFILL }},
 925
 926                 { &hf_major_version,
 927                         { "Workstation Major Version", "netlogon.major_version", FT_UINT8, BASE_DEC,
 928                           NULL, 0, "NETLOGON Workstation Major Version", HFILL }},
 929
 930                 { &hf_minor_version,
 931                         { "Workstation Minor Version", "netlogon.minor_version", FT_UINT8, BASE_DEC,
 932                           NULL, 0, "NETLOGON Workstation Minor Version", HFILL }},
 933
 934                 { &hf_os_version,
 935                         { "Workstation OS Version", "netlogon.os_version", FT_UINT8, BASE_DEC,
 936                           NULL, 0, "NETLOGON Workstation OS Version", HFILL }},
 937
 938                 { &hf_date_time,
 939                         { "Date/Time", "netlogon.date_time", FT_UINT32, BASE_DEC,
 940                           NULL, 0, "NETLOGON Date/Time", HFILL }},
 941
 942                 { &hf_update_type,
 943                         { "Update Type", "netlogon.update", FT_UINT16, BASE_DEC,
 944                           NULL, 0, "NETLOGON Update Type", HFILL }},
 945
 946                 { &hf_request_count,
 947                         { "Request Count", "netlogon.request_count", FT_UINT16, BASE_DEC,
 948                           NULL, 0, "NETLOGON Request Count", HFILL }},
 949
 950                 { &hf_flags_autolock,
 951                         { "Autolock", "netlogon.flags.autolock", FT_BOOLEAN, 32,
 952                         TFS(&tfs_flags_autolock), ACC_FLAG_AUTO_LOCKED, "NETLOGON Account Autolock", HFILL}},
 953
 954                 { &hf_flags_expire,
 955                         { "Expire", "netlogon.flags.expire", FT_BOOLEAN, 32,
 956                         TFS(&tfs_flags_expire), ACC_FLAG_EXPIRE, "NETLOGON Will Account Expire", HFILL}},
 957
 958                 { &hf_flags_server_trust,
 959                         { "Server Trust", "netlogon.flags.server", FT_BOOLEAN, 32,
 960                         TFS(&tfs_flags_server_trust), ACC_FLAG_SERVER_TRUST, "NETLOGON Server Trust Account", HFILL}},
 961
 962                 { &hf_flags_workstation_trust,
 963                         { "Workstation Trust", "netlogon.flags.workstation", FT_BOOLEAN, 32,
 964                         TFS(&tfs_flags_workstation_trust), ACC_FLAG_WORKSTATION_TRUST, "NETLOGON Workstation Trust Account", HFILL}},
 965
 966                 { &hf_flags_interdomain_trust,
 967                         { "Interdomain Trust", "netlogon.flags.interdomain", FT_BOOLEAN, 32,
 968                         TFS(&tfs_flags_interdomain_trust), ACC_FLAG_INTERDOMAIN_TRUST, "NETLOGON Inter-domain Trust Account", HFILL}},
 969
 970                 { &hf_flags_mns_user,
 971                         { "MNS User", "netlogon.flags.mns", FT_BOOLEAN, 32,
 972                         TFS(&tfs_flags_mns_user), ACC_FLAG_MNS_USER, "NETLOGON MNS User Account", HFILL}},
 973
 974                 { &hf_flags_normal_user,
 975                         { "Normal User", "netlogon.flags.normal", FT_BOOLEAN, 32,
 976                         TFS(&tfs_flags_normal_user), ACC_FLAG_NORMAL_USER, "NETLOGON Normal User Account", HFILL}},
 977
 978                 { &hf_flags_temp_dup_user,
 979                         { "Temp Duplicate User", "netlogon.flags.temp_dup", FT_BOOLEAN, 32,
 980                         TFS(&tfs_flags_temp_dup_user), ACC_FLAG_TEMP_DUP_USER, "NETLOGON Temp Duplicate User Account", HFILL}},
 981
 982                 { &hf_flags_password_required,
 983                         { "Password", "netlogon.flags.password", FT_BOOLEAN, 32,
 984                         TFS(&tfs_flags_password_required), ACC_FLAG_PASSWORD_REQUIRED, "NETLOGON Password Required", HFILL}},
 985
 986                 { &hf_flags_homedir_required,
 987                         { "Homedir", "netlogon.flags.homedir", FT_BOOLEAN, 32,
 988                         TFS(&tfs_flags_homedir_required), ACC_FLAG_HOMEDIR_REQUIRED, "NETLOGON Homedir Required", HFILL}},
 989
 990                 { &hf_flags_enabled,
 991                         { "Enabled", "netlogon.flags.enabled", FT_BOOLEAN, 32,
 992                         TFS(&tfs_flags_enabled), ACC_FLAG_ENABLED, "NETLOGON Is This Account Enabled", HFILL}},
 993
 994                 { &hf_domain_sid_size,
 995                         { "Domain SID Size", "netlogon.domain_sid_size", FT_UINT32, BASE_DEC,
 996                           NULL, 0, "NETLOGON Domain SID Size", HFILL }},
 997
 998                 { &hf_low_serial,
 999                         { "Low Serial Number", "netlogon.low_serial", FT_UINT32, BASE_DEC,
1000                           NULL, 0, "NETLOGON Low Serial Number", HFILL }},
1001
1002                 { &hf_pulse,
1003                         { "Pulse", "netlogon.pulse", FT_UINT32, BASE_DEC,
1004                           NULL, 0, "NETLOGON Pulse", HFILL }},
1005
1006                 { &hf_random,
1007                         { "Random", "netlogon.random", FT_UINT32, BASE_DEC,
1008                           NULL, 0, "NETLOGON Random", HFILL }},
1009
1010                 { &hf_db_count,
1011                         { "DB Count", "netlogon.db_count", FT_UINT32, BASE_DEC,
1012                           NULL, 0, "NETLOGON DB Count", HFILL }},
1013
1014                 { &hf_db_index,
1015                         { "Database Index", "netlogon.db_index", FT_UINT32, BASE_DEC,
1016                           NULL, 0, "NETLOGON Database Index", HFILL }},
1017
1018                 { &hf_large_serial,
1019                         { "Large Serial Number", "netlogon.large_serial", FT_UINT64, BASE_DEC,
1020                           NULL, 0, "NETLOGON Large Serial Number", HFILL }},
1021
1022                 { &hf_nt_date_time,
1023                         { "NT Date/Time", "netlogon.nt_date_time", FT_ABSOLUTE_TIME, BASE_NONE,
1024                           NULL, 0, "NETLOGON NT Date/Time", HFILL }},
1025         };
1026
1027         static gint *ett[] = {
1028                 &ett_smb_logon,
1029                 &ett_smb_account_flags,
1030                 &ett_smb_db_info
1031         };
1032
1033         proto_smb_logon = proto_register_protocol(
1034                 "Microsoft Windows Logon Protocol", "NETLOGON", "netlogon");
1035
1036         proto_register_field_array(proto_smb_logon, hf, array_length(hf));
1037         proto_register_subtree_array(ett, array_length(ett));
1038 }