SMB.cc

Go to the documentation of this file.

// $Id: SMB.cc,v 1.4 2005/09/08 22:29:07 kreibich Exp $
//
// Copyright (c) 1996-2004
//      The Regents of the University of California.  All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that: (1) source code distributions
// retain the above copyright notice and this paragraph in its entirety, (2)
// distributions including binary code include the above copyright notice and
// this paragraph in its entirety in the documentation or other materials
// provided with the distribution, and (3) all advertising materials mentioning
// features or use of this software display the following acknowledgement:
// ``This product includes software developed by the University of California,
// Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
// the University nor the names of its contributors may be used to endorse
// or promote products derived from this software without specific prior
// written permission.
// THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
// WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

#include "NetVar.h"
#include "SMB.h"
#include "smb_pac.h"
#include "Val.h"

enum SMB_Command {
#define SMB_COMMAND(name, value) name = value,
#include "SMB_COM.def"
#undef SMB_COMMAND
};

const char* SMB_command_name[256];
StringVal* SMB_command_str[256];

static void init_SMB_command_name()
        {
        static int initialized = 0;
        if ( initialized )
                return;

        initialized = 1;

        for ( int i = 0; i < 256; ++i )
                {
                SMB_command_name[i] = "<unknown>";
                SMB_command_str[i] = 0;
                }

#define SMB_COMMAND(name, value) SMB_command_name[value] = #name;
#include "SMB_COM.def"
        }

StringVal* get_SMB_command_str(int cmd)
        {
        if ( ! SMB_command_str[cmd] )
                SMB_command_str[cmd] = new StringVal(SMB_command_name[cmd]);

        return SMB_command_str[cmd];
        }

// ### TODO: the list of IPC pipes needs a lot of expansion
static int lookup_IPC_name(BroString* name)
        {
        static const char* IPC_pipe_names[] = {
                "\\locator", "\\epmapper", "\\samr", "\\lsarpc", 0
        };

        for ( int i = 0; IPC_pipe_names[i]; ++i )
                {
                if ( size_t(name->Len()) == strlen(IPC_pipe_names[i]) &&
                     strncmp((const char*) name->Bytes(),
                             IPC_pipe_names[i], name->Len()) == 0 )
                        return i + 1;
                }

        return IPC_NONE;
        }

SMB_Session::SMB_Session(Connection* c)
        {
        conn = c;
        dce_rpc_session = 0;
        init_SMB_command_name();

        // Strangely, one does not have to connect to IPC$ before
        // making DCE/RPC calls. So we assume that it's always IPC
        // unless confirmed otherwise.
        is_IPC = true;
        IPC_pipe = IPC_NONE;

        transaction_name = 0;
        transaction_subcmd = 0;

        andx(0) = andx(1) = 0;
        }

SMB_Session::~SMB_Session()
        {
        Unref(transaction_name);
        delete dce_rpc_session;
        }

void SMB_Session::Deliver(int is_orig, int len, const u_char* data)
        {
        if ( len == 0 )
                return;

        try
                {
                const u_char *data_start = data;
                const u_char *data_end = data + len;
                BinPAC::SMB_header hdr;
                int hdr_len = hdr.parse(data, data_end, 1);
                data += hdr_len;
                int next_command = hdr.command();
                while ( data < data_end )
                        {
                        SMB_Body body(data, data_end);
                        andx(is_orig) = 0;
                        ParseMessage(is_orig, next_command, hdr, body);
                        int next = AndxOffset(is_orig, next_command);
                        if ( next <= 0 )
                                break;
                        // Weird(fmt("ANDX! at %d", next));
                        if ( data_start + next < data + body.length() )
                                {
                                Weird(fmt("ANDX buffer overlapping: next = %d, buffer_end = %d", next, data + body.length() - data_start));
                                break;
                                }
                        data = data_start + next;
                        }
                }
        catch ( const BinPAC::Exception& e )
                {
                conn->Weird(e.msg().c_str());
                }
        }

void SMB_Session::ParseMessage(int is_orig, int cmd,
                BinPAC::SMB_header const &hdr, SMB_Body const &body)
        {
        if ( smb_message )
                {
                val_list* vl = new val_list;
                StringVal* cmd_str = get_SMB_command_str(cmd);
                Ref(cmd_str);

                vl->append(conn->BuildConnVal());
                vl->append(new Val(is_orig, TYPE_BOOL));
                vl->append(cmd_str);
                vl->append(new Val(body.length(), TYPE_COUNT));

                conn->ConnectionEvent(smb_message, vl);
                }

        if ( is_orig )
                req_cmd = cmd;

        int ret = 0;
        switch ( cmd ) {
        case SMB_COM_TREE_CONNECT_ANDX:
                if ( is_orig )
                        ret = ParseTreeConnectAndx(hdr, body);
                else
                        ret = ParseAndx(is_orig, hdr, body);
                break;

        case SMB_COM_NT_CREATE_ANDX:
                if ( is_orig )
                        ret = ParseNtCreateAndx(hdr, body);
                else
                        ret = ParseAndx(is_orig, hdr, body);
                break;

        case SMB_COM_TRANSACTION:
        case SMB_COM_TRANSACTION2:
        case SMB_COM_TRANSACTION_SECONDARY:
        case SMB_COM_TRANSACTION2_SECONDARY:
                ret = ParseTransaction(is_orig, cmd, hdr, body);
                break;

        case SMB_COM_READ_ANDX:
                if ( is_orig )
                        ret = ParseReadAndx(hdr, body);
                else
                        ret = ParseReadAndxResponse(hdr, body);
                break;

        case SMB_COM_WRITE_ANDX:
                if ( is_orig )
                        ret = ParseWriteAndx(hdr, body);
                else
                        ret = ParseWriteAndxResponse(hdr, body);
                break;

        case SMB_COM_NEGOTIATE:
        case SMB_COM_CLOSE:
        case SMB_COM_TREE_DISCONNECT:
                break;

        case SMB_COM_LOGOFF_ANDX:
        case SMB_COM_SESSION_SETUP_ANDX:
                ret = ParseAndx(is_orig, hdr, body);
                break;

        default:
                Weird(fmt("unknown_SMB_command(0x%x)", cmd));
                break;
        }

        if ( ret == -1 )
                Weird("SMB_parsing_error");
        }

int SMB_Session::ParseAndx(int is_orig,
                BinPAC::SMB_header const &hdr, SMB_Body const &body)
        {
        BinPAC::SMB_generic_andx msg;
        msg.parse(body.data(), body.data() + body.length(), 1);
        if ( msg.word_count() > 0 )
                andx(is_orig) = msg.andx();
        return 0;
        }

int SMB_Session::ParseTreeConnectAndx(BinPAC::SMB_header const &hdr, SMB_Body const &body)
        {
        BinPAC::SMB_tree_connect_andx req(hdr.unicode());

        req.parse(body.data(), body.data() + body.length(), 1);
        andx(1) = req.andx();

        BroString* path = ExtractString(req.path());
        BroString* service = ExtractString(req.service());

        // replicate path
        BroString* norm_path = new BroString(path->Bytes(), path->Len(), 1);
        norm_path->ToUpper();

        if ( strstr_n(norm_path->Len(), norm_path->Bytes(), 5,
                      (const u_char*) "\\IPC$") != -1 )
                is_IPC = true;  // TODO: change is_IPC to 0 on tree_disconnect
        else
                is_IPC = false;

        delete norm_path;

        if ( smb_com_tree_connect_andx )
                {
                val_list* vl = new val_list;
                vl->append(conn->BuildConnVal());
                vl->append(new StringVal(path));
                vl->append(new StringVal(service));
                conn->ConnectionEvent(smb_com_tree_connect_andx, vl);
                }
        else
                {
                delete path;
                delete service;
                }

        return 0;
        }

int SMB_Session::ParseNtCreateAndx(BinPAC::SMB_header const &hdr, SMB_Body const &body)
        {
        BinPAC::SMB_nt_create_andx req(hdr.unicode());

        req.parse(body.data(), body.data() + body.length(), 1);
        andx(1) = req.andx();

        BroString* name = ExtractString(req.name());

        IPC_pipe = (enum IPC_named_pipe) lookup_IPC_name(name);

        if ( smb_com_nt_create_andx )
                {
                val_list* vl = new val_list;
                vl->append(conn->BuildConnVal());
                vl->append(new StringVal(name));
                conn->ConnectionEvent(smb_com_nt_create_andx, vl);
                }
        else
                delete name;

        return 0;
        }

int SMB_Session::ParseReadAndx(BinPAC::SMB_header const &hdr, SMB_Body const &body)
        {
        BinPAC::SMB_read_andx req;
        req.parse(body.data(), body.data() + body.length(), 1);
        andx(1) = req.andx();
        return 0;
        }

int SMB_Session::ParseReadAndxResponse(BinPAC::SMB_header const &hdr, SMB_Body const &body)
        {
        BinPAC::SMB_read_andx_response resp;

        resp.parse(body.data(), body.data() + body.length(), 1);
        andx(0) = resp.andx();

        int data_count = resp.data_length();
        const u_char* data = resp.data().begin();

        if ( smb_com_read_andx )
                {
                val_list* vl = new val_list;
                vl->append(conn->BuildConnVal());
                vl->append(new StringVal(data_count, (const char*) data));
                conn->ConnectionEvent(smb_com_read_andx, vl);
                }

        CheckRPC(0, data_count, data);
        return 0;
        }

int SMB_Session::ParseWriteAndx(BinPAC::SMB_header const &hdr, SMB_Body const &body)
        {
        BinPAC::SMB_write_andx req;
        req.parse(body.data(), body.data() + body.length(), 1);
        andx(1) = req.andx();

        int data_count = req.data_length();
        const u_char* data = req.data().begin();

        if ( smb_com_write_andx )
                {
                val_list* vl = new val_list;
                vl->append(conn->BuildConnVal());
                vl->append(new StringVal(data_count, (const char*) data));
                conn->ConnectionEvent(smb_com_write_andx, vl);
                }

        CheckRPC(1, data_count, data);
        return 0;
        }

int SMB_Session::ParseWriteAndxResponse(BinPAC::SMB_header const &hdr, SMB_Body const &body)
        {
        BinPAC::SMB_write_andx_response resp;
        resp.parse(body.data(), body.data() + body.length(), 1);
        andx(0) = resp.andx();
        return 0;
        }

void SMB_Session::TransactionEvent(EventHandlerPtr f, int is_orig,
                                int data_count, const u_char* data)
        {
        if ( f )
                {
                val_list* vl = new val_list;

                vl->append(conn->BuildConnVal());
                vl->append(new Val(is_orig, TYPE_BOOL));
                vl->append(new Val(transaction_subcmd, TYPE_COUNT));
                if ( transaction_name )
                        {
                        Ref(transaction_name);
                        vl->append(transaction_name);
                        }
                else
                        vl->append(new StringVal(""));
                vl->append(new StringVal(data_count, (const char*) data));
                conn->ConnectionEvent(f, vl);
                }
        }

int SMB_Session::ParseTransaction(int is_orig, int cmd,
                BinPAC::SMB_header const &hdr, SMB_Body const &body)
        {
        EventHandlerPtr f = 0;
        if ( cmd == SMB_COM_TRANSACTION || cmd == SMB_COM_TRANSACTION_SECONDARY )
                f = smb_com_transaction;
        else if ( cmd == SMB_COM_TRANSACTION2 || cmd == SMB_COM_TRANSACTION2_SECONDARY )
                f = smb_com_transaction2;
        else
                internal_error("command mismatch for ParseTransaction");

        int ret;
        if ( is_orig )
                {
                if ( cmd == SMB_COM_TRANSACTION ||
                     cmd == SMB_COM_TRANSACTION2 )
                        ret = ParseTransactionRequest(cmd, hdr, body, f);
                else if ( cmd == SMB_COM_TRANSACTION_SECONDARY ||
                          cmd == SMB_COM_TRANSACTION2_SECONDARY )
                        ret = ParseTransactionSecondaryRequest(cmd, hdr, body, f);
                else
                        ret = 0;
                }
        else
                ret = ParseTransactionResponse(cmd, hdr, body, f);

        return ret;
        }

int SMB_Session::ParseTransactionRequest(int cmd,
                BinPAC::SMB_header const &hdr,
                SMB_Body const &body,
                EventHandlerPtr f)
        {
        BinPAC::SMB_transaction trans(
                cmd == SMB_COM_TRANSACTION ? 1 : 2,
                hdr.unicode());
        trans.parse(body.data(), body.data() + body.length(), 1);

        if ( transaction_name )
                {
                Unref(transaction_name);
                transaction_name = 0;
                }

        if ( cmd == SMB_COM_TRANSACTION )
                transaction_name = new StringVal(
                        ExtractString(trans.name()));

        // TODO: LANMAN transaction uses the first u_short of
        // parameters as subcmd
        if ( trans.setup_count() > 0 )
                transaction_subcmd = trans.setup()[0];
        else
                Weird("transaction_subcmd_missing");

        TransactionEvent(f, true, trans.data_count(), trans.data().begin());
        return ProcessTransactionData(true, cmd, hdr,
                trans.param_count(), trans.parameters().begin(),
                trans.data_count(), trans.data().begin());
        }

int SMB_Session::ParseTransactionSecondaryRequest(int cmd,
                BinPAC::SMB_header const &hdr,
                SMB_Body const &body,
                EventHandlerPtr f)
        {
        BinPAC::SMB_transaction_secondary trans(hdr.unicode());
        trans.parse(body.data(), body.data() + body.length(), 1);

        TransactionEvent(f, true, trans.data_count(), trans.data().begin());
        return ProcessTransactionData(true, cmd, hdr,
                trans.param_count(), trans.parameters().begin(),
                trans.data_count(), trans.data().begin());
        }

int SMB_Session::ParseTransactionResponse(int cmd,
                BinPAC::SMB_header const &hdr,
                SMB_Body const &body,
                EventHandlerPtr f)
        {
        if ( body.word_count() == 0 ) // interim response
                {
                TransactionEvent(f, false, 0, 0);
                return 0;
                }

        BinPAC::SMB_transaction_response trans(hdr.unicode());
        trans.parse(body.data(), body.data() + body.length(), 1);

        TransactionEvent(f, false, trans.data_count(), trans.data().begin());
        return ProcessTransactionData(false, cmd, hdr,
                trans.param_count(), trans.parameters().begin(),
                trans.data_count(), trans.data().begin());
        }

int SMB_Session::ProcessTransactionData(int is_orig, int cmd,
                BinPAC::SMB_header const &hdr,
                int param_count, const u_char* parameters,
                int data_count, const u_char* data)
        {
        if ( cmd == SMB_COM_TRANSACTION )
                {
                switch ( transaction_subcmd ) {
                case 0x26:
                        // Transact_named_pipe
                        break;
                default:
                        if ( is_orig )
                                Weird(fmt("unknown smb_transaction subcmd: 0x%x", transaction_subcmd));
                        break;
                }
                }

        int ret = 0;
        if ( cmd == SMB_COM_TRANSACTION2 )
                {
                switch ( transaction_subcmd ) {
                case 0x5:
                        // QueryPathInfo
                        // TODO
                        break;
                case 0x7:
                        // QueryFileInfo
                        // TODO
                        break;
                case 0x10:
                        if ( is_orig )
                                ret = ParseGetDFSReferral(hdr,
                                        param_count, parameters);
                        break;

                default:
                        if ( is_orig )
                                Weird(fmt("Unknown smb_transaction2 subcmd: 0x%x", transaction_subcmd));
                        break;
                }
                }

        if ( data_count > 0 )
                {
                if ( CheckRPC(is_orig, data_count, data) )
                        {
                        if ( cmd != SMB_COM_TRANSACTION ||
                             transaction_subcmd == 0x26 )
                                Weird(fmt("RPC through unknown command: 0x%x/0x%x",
                                        cmd, transaction_subcmd));
                        }
                }

        return ret;
        }

int SMB_Session::ParseGetDFSReferral(BinPAC::SMB_header const &hdr,
                int param_count, const u_char* param)
        {
        BinPAC::SMB_get_dfs_referral req(hdr.unicode());
        req.parse(param, param + param_count, 1);

        if ( smb_get_dfs_referral )
                {
                val_list* vl = new val_list;
                vl->append(conn->BuildConnVal());
                vl->append(new Val(req.max_referral_level(), TYPE_COUNT));
                vl->append(new StringVal(ExtractString(req.file_name())));
                conn->ConnectionEvent(smb_get_dfs_referral, vl);
                }

        return 0;
        }

int SMB_Session::AndxOffset(int is_orig, int& next_command) const
        {
        if ( ! andx(is_orig) )
                return -1;

        next_command = andx(is_orig)->command();
        if ( next_command != 0xff )
                return andx(is_orig)->offset();
        else
                return -1;
        }

void SMB_Session::Weird(const char* msg)
        {
        conn->Weird(msg);
        }

// Extract a NUL-terminated string from [data, data+len-1]. The
// input can be in Unicode (little endian), and the returned string
// will be in ASCII.

BroString* SMB_Session::ExtractString(BinPAC::SMB_string const* s)
        {
        return s->unicode() ? ExtractString(s->u()) : ExtractString(s->a());
        }

BroString* SMB_Session::ExtractString(BinPAC::SMB_ascii_string const* s)
        {
        return new BroString(s->val().begin(), s->val().size(), 1);
        }

BroString* SMB_Session::ExtractString(BinPAC::SMB_unicode_string const* s)
        {
        u_char* b = new u_char[s->s().size() + 1];
        int i;
        for ( i = 0; i < s->s().size(); ++i )
                {
                uint16 x = s->s()[i];
                if ( x & 0xff00 )
                        Weird(fmt("unicode string confusion: 0x%04x", x));
                b[i] = u_char(x & 0xff);
                }
        b[i] = 0;
        return new BroString(1, b, s->s().size());
        }

bool SMB_Session::LooksLikeRPC(int len, const u_char* msg)
        {
        // DEBUG_MSG("is_IPC = %d, IPC_pipe = %d\n", is_IPC, IPC_pipe);
        // if ( ! is_IPC )
        //      return false;

        try
                {
                BinPAC::DCE_RPC_Header h;
                h.parse(msg, msg + len, 0);
                if ( h.rpc_vers() == 5 && h.rpc_vers_minor() == 0 )
                        {
                        if ( h.frag_length() == len )
                                return true;
                        else
                                {
                                DEBUG_MSG("length mismatch: %d != %d\n",
                                        h.frag_length(), len);
                                return false;
                                }
                        }
                }
        catch ( const BinPAC::Exception& )
                {
                // do nothing
                }

        return false;
        }

bool SMB_Session::CheckRPC(int is_orig, int data_count, const u_char *data)
        {
        if ( LooksLikeRPC(data_count, data) )
                {
                if ( ! dce_rpc_session )
                        dce_rpc_session = new DCE_RPC_Session(conn);

                dce_rpc_session->DeliverPDU(is_orig, data_count, data);
                return true;
                }
        return false;
        }

TCP_Contents_SMB::TCP_Contents_SMB(TCP_Endpoint* arg_endp, SMB_Session* s)
: TCP_Contents(arg_endp, STOP_ON_GAP, PUNT_ON_PARTIAL)
        {
        smb_session = s;
        msg_buf = 0;
        msg_len = 0;
        buf_len = 0;
        buf_n = 0;
        }

void TCP_Contents_SMB::InitMsgBuf()
        {
        delete [] msg_buf;
        msg_buf = new u_char[msg_len];
        buf_len = msg_len;
        buf_n = 0;
        }

TCP_Contents_SMB::~TCP_Contents_SMB()
        {
        delete [] msg_buf;
        }

void TCP_Contents_SMB::DeliverSMB(int len, const u_char* data)
        {
        // Check the 4-byte header.
        if ( strncmp((const char*) data, "\xffSMB", 4) )
                {
                Conn()->Weird(fmt("SMB-over-TCP header error: %02x%02x%02x%02x, \\x%02x%c%c%c",
                        dshdr[0], dshdr[1], dshdr[2], dshdr[3],
                        data[0], data[1], data[2], data[3]));
                SetSkipDeliveries(1);
                }
        else
                smb_session->Deliver(IsOrig(), len, data);

        buf_n = 0;
        msg_len = 0;
        }

void TCP_Contents_SMB::Deliver(int /* seq */, int len, const u_char* data)
        {
        while ( len > 0 )
                {
                if ( ! msg_len )
                        {
                        // Get the SMB-over-TCP header (4 bytes).
                        while ( buf_n < 4 && len > 0 )
                                {
                                dshdr[buf_n] = *data;
                                ++buf_n; ++data; --len;
                                }

                        if ( buf_n < 4 )
                                return;

                        buf_n = 0;
                        for ( int i = 1; i < 4; ++i )
                                msg_len = ( msg_len << 8 ) + dshdr[i];

                        if ( dshdr[0] != 0 || msg_len <= 4 )
                                {
                                Conn()->Weird("SMB message length error");
                                SetSkipDeliveries(1);
                                return;
                                }
                        }

                if ( buf_n == 0 && msg_len <= len )
                        {
                        // The fast lane:
                        // Keep msg_len -- it will be changed in DeliverSMB
                        int mlen = msg_len;
                        DeliverSMB(msg_len, data);
                        len -= mlen;
                        data += mlen;
                        }

                else
                        {
                        if ( buf_len < msg_len )
                                InitMsgBuf();

                        while ( buf_n < msg_len && len > 0 )
                                {
                                msg_buf[buf_n] = *data;
                                ++buf_n;
                                ++data;
                                --len;
                                }

                        if ( buf_n < msg_len )
                                return;

                        DeliverSMB(msg_len, msg_buf);
                        }
                }
        }

SMB_TCP_Conn::SMB_TCP_Conn(NetSessions* s, HashKey* k, double t,
                                const ConnID* id, const struct tcphdr* tp)
:TCP_Connection(s, k, t, id, tp)
        {
        o_smb = r_smb = 0;
        smb_session = new SMB_Session(this);
        }

SMB_TCP_Conn::~SMB_TCP_Conn()
        {
        delete smb_session;
        }

void SMB_TCP_Conn::BuildEndpoints()
        {
        o_smb = new TCP_Contents_SMB(orig, smb_session);
        r_smb = new TCP_Contents_SMB(resp, smb_session);

        orig->AddContentsProcessor(o_smb);
        resp->AddContentsProcessor(r_smb);
        }

---