xref: /onnv-gate/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_netbios.c (revision 7280:2367302f7ecf)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

/*
 * References used throughout this code:
 *
 * [RFC1001] :	PROTOCOL STANDARD FOR A NetBIOS SERVICE
 *			ON A TCP/UDP TRANSPORT:
 *			CONCEPTS AND METHODS
 *		NetBIOS Working Group, March 1987
 *
 * [RFC1002] :	PROTOCOL STANDARD FOR A NetBIOS SERVICE
 *			ON A TCP/UDP TRANSPORT:
 *			DETAILED SPECIFICATIONS
 *		NetBIOS Working Group, March 1987
 */

#include <fcntl.h>
#include "snoop.h"
#include <stdio.h>
#include <ctype.h>
#include "snoop.h"

extern char *dlc_header;
char *show_type();

/* See snoop_smb.c */
extern void interpret_smb(int flags, uchar_t *data, int len);

/*
 * NBT Session Packet Header
 * [RFC 1002, Sec. 4.3.1]
 */
struct nbt_ss {
	uchar_t type;
	uchar_t flags;
	ushort_t length;
};

/*
 * NBT Session Request Packet trailer
 * [RFC 1002, Sec. 4.3.2]
 */
struct callnames {
	uchar_t space;		/* padding */
	uchar_t calledname[32];
	uchar_t nullchar;		/* padding */
	uchar_t space2;		/* padding */
	uchar_t callingname[32];
	uchar_t nullchar2;	/* padding */
};


static void interpret_netbios_names(int flags, uchar_t *data, int len,
					char *xtra);
static void netbiosname2ascii(char *asciiname, uchar_t *netbiosname);

/*
 * Helpers to read network-order values,
 * with NO alignment assumed.
 */
static ushort_t
getshort(uchar_t *p) {
	return (p[1] + (p[0]<<8));
}
static uint_t
getlong(uchar_t *p)
{
	return (p[3] + (p[2]<<8) + (p[1]<<16) + (p[0]<<24));
}

/*
 * NM_FLAGS fields in the NetBIOS Name Service Packet header.
 * [RFC 1002,  Sec. 4.2.1.1]
 */
static void
print_flag_details(int headerflags)
{
	if (headerflags & 1<<4)
		sprintf(get_line(0, 0), "   - Broadcast");
	if (headerflags & 1<<7)
		sprintf(get_line(0, 0), "   - Recursion Available");
	if (headerflags & 1<<8)
		sprintf(get_line(0, 0), "   - Recursion Desired");
	if (headerflags & 1<<9)
		sprintf(get_line(0, 0), "   - Truncation Flag");
	if (headerflags & 1<<10)
		sprintf(get_line(0, 0), "   - Authoritative Answer");
}

/*
 * Possible errors in NetBIOS name service packets.
 * [RFC 1002,  Sec. 4.2.6, 4.2.11, 4.2.14]
 */
static void
getrcodeerr(int headerflags, char *errortype)
{
	int error = (headerflags & 0xf);

	switch (error) {
	case 0:
		sprintf(errortype, "Success");
		break;
	case 1:
		sprintf(errortype, "Format Error");
		break;
	case 2:
		sprintf(errortype, "Server Failure");
		break;
	case 3:
		sprintf(errortype, "Name Error");
		break;
	case 4:
		sprintf(errortype, "Unsupported Request Error");
		break;
	case 5:
		sprintf(errortype, "Refused Error");
		break;
	case 6:
		sprintf(errortype, "Active Error");
		break;
	case 7:
		sprintf(errortype, "Name in Conflict Error");
		break;
	default:
		sprintf(errortype, "Unknown Error");
		break;
	}
}

/*
 * OPCODE fields in the NetBIOS Name Service Packet header.
 * [RFC 1002, Sec. 4.2.1.1]
 */
static void
print_ns_type(int flags, int headerflags, char *xtra)
{
	int opcode = (headerflags & 0x7800)>>11;
	int response = (headerflags & 1<<15);
	char *resptype = response ? "Response" : "Request";
	char *optype;

	switch (opcode) {
	case 0:
		optype = "Query";
		break;
	case 5:
		optype = "Registration";
		break;
	case 6:
		optype = "Release";
		break;
	case 7:
		optype = "WACK";
		break;
	case 8:
		optype = "Refresh";
		break;
	default:
		optype = "Unknown";
		break;
	}

	if (flags & F_DTAIL)
		sprintf(get_line(0, 0), "Type = %s %s", optype, resptype);
	else
		sprintf(xtra, "%s %s", optype, resptype);
}


/*
 * Interpret Datagram Packets
 * [RFC 1002, Sec. 4.4]
 */
void
interpret_netbios_datagram(int flags, uchar_t *data, int len)
{
	char name[24];
	int packettype = data[0];
	int packetlen;
	data++;

	if (packettype < 0x10 || packettype > 0x11)
		return;

	if (flags & F_SUM) {
		data += 14;
		netbiosname2ascii(name, data);
		sprintf(get_sum_line(),
				"NBT Datagram Service Type=%d Source=%s",
				packettype, name);
	}

	if (flags & F_DTAIL) {
		show_header("NBT:  ", "Netbios Datagram Service Header", len);
		show_space();
		sprintf(get_line(0, 0), "Datagram Packet Type = 0x%.2x",
					packettype);
		sprintf(get_line(0, 0), "Datagram Flags = 0x%.2x",
					data[0]);
		data++;
		sprintf(get_line(0, 0), "Datagram ID = 0x%.4x",
					getshort(data));
		data += 2;
		sprintf(get_line(0, 0), "Source IP = %d.%d.%d.%d",
					data[0], data[1], data[2], data[3]);
		data += 4;
		sprintf(get_line(0, 0), "Source Port = %d",
					getshort(data));
		data += 2;
		packetlen = getshort(data);
		sprintf(get_line(0, 0), "Datagram Length = 0x%.4x",
					packetlen);
		data += 2;
		sprintf(get_line(0, 0), "Packet Offset = 0x%.4x",
					getshort(data));
		data += 3;
		netbiosname2ascii(name, data);
		sprintf(get_line(0, 0), "Source Name = %s", name);
		data += 34;
		netbiosname2ascii(name, data);
		sprintf(get_line(0, 0), "Destination Name = %s", name);
		sprintf(get_line(0, 0), "Number of data bytes remaining = %d",
					packetlen - 68);
		show_trailer();
	}
}

/*
 * Interpret NetBIOS Name Service packets.
 * [RFC 1002, Sec. 4.2]
 */
void
interpret_netbios_ns(int flags, uchar_t *data, int len)
{
	int headerflags, qcount, acount, nscount, arcount;
	int transid;
	char name[24];
	char extra[256];
	char errortype[50];
	int rdatalen;
	int rrflags;
	int nameptr;
	int nodecode;
	char *nodetype;
	uchar_t *data0 = data;

	transid = getshort(data); data += 2;
	headerflags = getshort(data); data += 2;
	qcount = getshort(data); data += 2;
	acount = getshort(data); data += 2;
	nscount = getshort(data); data += 2;
	arcount = getshort(data); data += 2;
	getrcodeerr(headerflags, errortype);

	if (flags & F_SUM) {
		print_ns_type(flags, headerflags, extra);
		data++;
		netbiosname2ascii(name, data);
		sprintf(get_sum_line(), "NBT NS %s for %s, %s",
			extra, name, errortype);

	}


	if (flags & F_DTAIL) {
		show_header("NBT:  ", "Netbios Name Service Header", len);
		show_space();
		print_ns_type(flags, headerflags, 0);
		sprintf(get_line(0, 0), "Status = %s", errortype);
		sprintf(get_line(0, 0), "Transaction ID = 0x%.4x", transid);
		sprintf(get_line(0, 0), "Flags Summary = 0x%.4x",
					headerflags);
		print_flag_details(headerflags);
		sprintf(get_line(0, 0), "Question count = %d", qcount);
		sprintf(get_line(0, 0), "Answer Count = %d", acount);
		sprintf(get_line(0, 0), "Name Service Count = %d", nscount);
		sprintf(get_line(0, 0),
				"Additional Record Count = %d", arcount);

		/*
		 * Question Section Packet Description from
		 * [RFC 1002, Sec. 4.2.1.2]
		 */

		if (qcount) {
			data++;
			netbiosname2ascii(name, data);
			sprintf(get_line(0, 0), "Question Name = %s", name);
			data += 33;
			sprintf(get_line(0, 0), "Question Type = 0x%.4x",
						getshort(data));
			data += 2;
			sprintf(get_line(0, 0), "Question Class = 0x%.4x",
						getshort(data));
			data += 2;
		}

		/*
		 * Resrouce Record Packet Description from
		 * [RFC 1002, Sec. 4.2.1.3]
		 */

		if ((acount || nscount || arcount) ||
		    (qcount+acount+nscount+arcount == 0)) {
			/* Second level encoding from RFC883 (p.31, 32) */
			if (data[0] & 0xc0) {
				nameptr = getshort(data)&0x3fff;
				netbiosname2ascii(name, (data0+nameptr+1));
				sprintf(get_line(0, 0),
					"Resource Record Name = %s", name);
				data += 2;
			} else {
				data++;
				netbiosname2ascii(name, data);
				sprintf(get_line(0, 0),
					"Resource Record Name = %s", name);
				data += 33;
			}
			sprintf(get_line(0, 0),
					"Resource Record Type = 0x%.4x",
					getshort(data));
			data += 2;
			sprintf(get_line(0, 0),
					"Resource Record Class = 0x%.4x",
					getshort(data));
			data += 2;
			sprintf(get_line(0, 0),
				"Time to Live (Milliseconds) = %d",
				getlong(data));
			data += 4;
			rdatalen = getshort(data);
			sprintf(get_line(0, 0), "RDATA Length = 0x%.4x",
						rdatalen);
			data += 2;
			/* 15.4.2.1.3 */
			if (rdatalen == 6) {
				rrflags = getshort(data);
				data += 2;
				sprintf(get_line(0, 0),
					"Resource Record Flags = 0x%.4x",
					rrflags);
				nodecode = (rrflags>>13)& 0x11;
				if (nodecode == 0) nodetype = "B";
				if (nodecode == 1) nodetype = "P";
				if (nodecode == 2) nodetype = "M";
				sprintf(get_line(0, 0), "   - %s, %s node",
					(rrflags & 1<<15) ?
					"Group NetBIOS Name":
					"Unique NetBIOS Name", nodetype);
				sprintf(get_line(0, 0),
					"Owner IP Address = %d.%d.%d.%d",
					data[0], data[1], data[2], data[3]);
			}
		}
		show_trailer();

	}
}

/*
 * Interpret NetBIOS session packets.
 * [RFC 1002, Sec. 4.3]
 */
void
interpret_netbios_ses(int flags, uchar_t *data, int len)
{
	struct nbt_ss *ss;
	uchar_t *trailer;
	int length = len - 4;   /* NBT packet length without header */
	char *type;
	char extrainfo[300];

	if (len < sizeof (struct nbt_ss))
		return;

	/*
	 * Packets that are fragments of a large NetBIOS session
	 * message will have no NetBIOS header.  (Only the first
	 * TCP segment will have a NetBIOS header.)  It turns out
	 * that very often, such fragments start with SMB data, so
	 * we should try to recognize and decode them.
	 */
	if (data[0] == 0xff &&
	    data[1] == 'S' &&
	    data[2] == 'M' &&
	    data[3] == 'B') {
		interpret_smb(flags, data, len);
		return;
	}

	/* LINTED PTRALIGN */
	ss = (struct nbt_ss *)data;
	trailer = data + sizeof (*ss);
	extrainfo[0] = '\0';

	if (flags & F_SUM) {
		switch (ss->type) {
		case 0x00:
			type = "SESSION MESSAGE";
			break;
		case 0x81:
			type = "SESSION REQUEST";
			interpret_netbios_names(flags, trailer,
						length, extrainfo);
			break;
		case 0x82:
			type = "POSITIVE SESSION RESPONSE";
			break;
		case 0x83:
			type = "NEGATIVE SESSION RESPONSE";
			break;
		case 0x84:
			type = "RETARGET SESSION RESPONSE";
			break;
		case 0x85:
			type = "SESSION KEEP ALIVE";
			break;
		default:
			type = "Unknown";
			break;
		}
		(void) sprintf(get_sum_line(),
			"NBT Type=%s %sLength=%d", type, extrainfo, length);
	}

	if (flags & F_DTAIL) {
		show_header("NBT:  ", "NBT Header", len);
		show_space();

		switch (ss->type) {
		case 0x00:
			(void) sprintf(get_line(0, 0),
			"Type = SESSION MESSAGE");
			break;
		case 0x81:
			(void) sprintf(get_line(0, 0),
			"Type = SESSION REQUEST");
			interpret_netbios_names(flags, trailer, length, 0);
			break;
		case 0x82:
			(void) sprintf(get_line(0, 0),
			"Type = POSITIVE SESSION RESPONSE");
			break;
		case 0x83:
			(void) sprintf(get_line(0, 0),
			"Type = NEGATIVE SESSION RESPONSE");
			break;
		case 0x84:
			(void) sprintf(get_line(0, 0),
			"Type = RETARGET SESSION RESPONSE");
			break;
		case 0x85:
			(void) sprintf(get_line(0, 0),
			"Type = SESSION KEEP ALIVE");
			break;
		default:
			(void) sprintf(get_line(0, 0),
			"Type = Unknown");
			break;
		}

		(void) sprintf(get_line(0, 0), "Length = %d bytes", length);
		show_trailer();
	}

	/*
	 * SMB packets have { 0xff, 'S', 'M', 'B' }
	 * in the first four bytes.  If we find that,
	 * let snoop_smb.c have a look at it.
	 */
	if (ss->type == 0x00 &&
	    length > 0 &&
	    trailer[0] == 0xff &&
	    trailer[1] == 'S' &&
	    trailer[2] == 'M' &&
	    trailer[3] == 'B')
		interpret_smb(flags, trailer, length);
}

/*
 * NetBIOS name encoding (First Level Encoding)
 * [RFC 1001, Sec. 4.1]
 */
static void
netbiosname2ascii(char *aname, uchar_t *nbname)
{
	int c, i, j;

	i = j = 0;
	for (;;) {
		c = nbname[i++] - 'A';
		c = (c << 4) +
			nbname[i++] - 'A';
		/* 16th char is the "type" */
		if (i >= 32)
			break;
		if (iscntrl(c))
			c = '.';
		if (c != ' ')
			aname[j++] = c;
	}
	sprintf(&aname[j], "[%x]", c);
}

/*
 * Interpret the names in a Session Request packet.
 * [RFC 1002, Sec. 4.3.2]
 */
static void
interpret_netbios_names(int flags, uchar_t *data, int len, char *xtra)
{
	char  calledname[24];
	char callingname[24];
	struct callnames *names = (struct callnames *)data;

	if (len < sizeof (*names))
		return;

	netbiosname2ascii(calledname, names->calledname);
	netbiosname2ascii(callingname, names->callingname);

	if (flags & F_SUM) {
		sprintf(xtra, "Dest=%s Source=%s ", calledname, callingname);
	}

	if (flags & F_DTAIL) {
		sprintf(get_line(0, 0), "Destination = %s", calledname);
		sprintf(get_line(0, 0), "Source = %s", callingname);
	}
}