packetgen-plugin-smb 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5b854bf1526a2a21067f2a2620c5b36fcd129509bd78ed450c04caf9d6070ed6
-  data.tar.gz: c2e0de100ede2ffc1d10e88261fc6b97a38267800d6f7a92ed73e76e4f09ac4f
+  metadata.gz: cc233d3dcb94925757db9c4f5dde9647f97cce4d1e73001f3bbbcb41309ed435
+  data.tar.gz: 50d2ebf353a37d073bae3f6f7458057e4db8a7f2b5c0932094e1820056ab2746
 SHA512:
-  metadata.gz: b225195fc718a67bcbc0410c9cf0aa3e9f0825410270c8c8a0a3e97aed0ceb82ed36f07f50a52665f894928fefdfbd6ad6fa57466e8da5d213a545a3248504ad
-  data.tar.gz: e4c0f6f4d4af861ce63c8cf11d9b672fc070d6ad6215dcc441662eeb7445d98710aff05330a38e640d805c82372b5ba4b1076e9edfc5ef4ab4a313839d26d5f5
+  metadata.gz: 5862b573e7b9bba3826f10ef8e1ac8bbb34817e49f93338223ca5fbfcd0ad19cbeb65b64428fc1832c7603fe8a5a5cfc32cb6ac31d63c2e66de4a518ab89de6d
+  data.tar.gz: bb9a3e27eb4c36e3b6197d6450bef4efd73af1e3a0849c07383ea32924d155e0e21f975f7c91b4092ba70cce3d03cb368f92d38311a1a6585c946b5c1462dae5

data/lib/packetgen-plugin-smb.rb

@@ -1,10 +1,12 @@
-# This file is part of PacketGen
+# This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
-# Copyright (C) 2016 Sylvain Daubert <sylvain.daubert@laposte.net>
+# Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
 # frozen_string_literal: true
 
-require "packetgen"
-require_relative "packetgen/plugin/smb_version"
-require_relative "packetgen/plugin/smb"
+require 'packetgen'
+require_relative 'packetgen/plugin/smb_version'
+require_relative 'packetgen/plugin/gssapi'
+require_relative 'packetgen/plugin/smb'
+require_relative 'packetgen/plugin/smb2'

data/lib/packetgen/plugin/gssapi.rb

@@ -0,0 +1,125 @@
+# This file is part of packetgen-plugin-smb.
+# See https://github.com/sdaubert/packetgen-plugin-smb for more informations
+# Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
+# This program is published under MIT license.
+
+# frozen_string_literal: true
+
+require 'rasn1'
+
+module PacketGen::Plugin
+  # GSS API, from RFC 4178
+  #
+  #    GSSAPI ::= CHOICE {
+  #       init        InitialContextToken,
+  #       token_resp  NegTokenResp
+  #    }
+  #
+  #    InitialContextToken ::= [APPLICATION 0] IMPLICIT SEQUENCE {
+  #       oid         OBJECT IDENTIFIER,
+  #       token_init  NegTokenInit
+  #    }
+  #
+  #    NegTokenInit ::= [0] EXPLICIT SEQUENCE {
+  #       mechTypes       [0] MechTypeList,
+  #       reqFlags        [1] BIT STRING    OPTIONAL, -- No more used
+  #       mechToken       [2] OCTET STRING  OPTIONAL,
+  #       mechListMIC     [3] OCTET STRING  OPTIONAL,
+  #    }
+  #
+  #    NegTokenResp ::= [1] EXPLICIT SEQUENCE {
+  #       negState       [0] ENUMERATED {
+  #         accept-completed    (0),
+  #         accept-incomplete   (1),
+  #         reject              (2),
+  #         request-mic         (3)
+  #       }                                 OPTIONAL,
+  #       supportedMech   [1] MechType      OPTIONAL,
+  #       responseToken   [2] OCTET STRING  OPTIONAL,
+  #       mechListMIC     [3] OCTET STRING  OPTIONAL,
+  #    }
+  #
+  # @example initial context
+  #   gssapi.chosen   #=> 0
+  #   # Access to oid of initial context
+  #   gssapi[:oid]        #=> RASN1::Types::ObjectId
+  #   gssapi[:oid].value  #=> "1.3.6.1.5.5.2"
+  #   # Access to token_init
+  #   gssapi[:token_init]                #=> PacketGen::Plugin::GSSAPI::NegTokenInit
+  #   gssapi[:token_init][:mech_types]   #=> RASN1::Types::SequenceOf
+  #   # Get mech_types as an array of OID strings
+  #   gssapi[:token_init][:mech_types].value.map(&:value)
+  #   # Get mech_token value
+  #   gssapi[:token_init][:mech_token].value
+  #
+  # @example response token
+  #   gssapi.chosen   #=> 1
+  #   gssapi[:token_resp][:negstate]             #=> RASN1::Types::Enumerated
+  #   gssapi[:token_resp][:negstate].value       #=> String
+  #   gssapi[:token_resp][:supported_mech]       #=> RASN1::Types::ObjectId
+  #   gssapi[:token_resp][:supported_mech].value #=> String
+  #   gssapi[:token_resp][:response]             #=> RASN1::Types::OctetString
+  # @author Sylvain Daubert
+  class GSSAPI < RASN1::Model
+    # GSS API Negotiation Token Init
+    #
+    # A GSSAPI Negotiation Token Init is a ASN.1 SEQUENCE, explicitly tagged 0,
+    # containing from 1 up to 4 elements:
+    # * +mech_types+ is a mandatory SEQUENCE OF OBJECT ID. This SEQUENCE OF
+    #   is explicitly tagged 0.
+    # * +req_flags+ is an optional BIT STRING, explicitly tagged 1.
+    # * +mech_token+ is an optional OCTET STRING, explicitly tagged 2.
+    # * +mech_list_mic+ is an optional OCTET STRING, explicitly tagged 3.
+    class NegTokenInit < RASN1::Model
+      sequence :token, explicit: 0, class: :context, constructed: true,
+               content: [sequence_of(:mech_types, RASN1::Types::ObjectId, explicit: 0, class: :context),
+                         bit_string(:req_flags, explicit: 1, class: :context, constructed: true, optional: true),
+                         octet_string(:mech_token, explicit: 2, class: :context, constructed: true, optional: true),
+                         octet_string(:mech_list_mic, explicit: 3, class: :context, constructed: true, optional: true)]
+    end
+
+    # GSS API Negotiation Token Response
+    class NegTokenResp < RASN1::Model
+      # Negotiation states
+      NEG_STATES = {
+        'accept-completed' => 0,
+        'accept-incomplete' => 1,
+        'reject' => 2,
+        'request-mic' => 3
+      }
+      sequence :token, explicit: 1, class: :context, constructed: true,
+               content: [enumerated(:negstate, enum: NEG_STATES, explicit: 0, class: :context, constructed: true, optional: true),
+                         objectid(:supported_mech, explicit: 1, class: :context, constructed: true, optional: true),
+                         octet_string(:response, explicit: 2, class: :context, constructed: true, optional: true),
+                         octet_string(:mech_list_mic, explicit: 3, class: :context, constructed: true, optional: true)]
+    end
+
+    choice :gssapi,
+           content: [sequence(:init, implicit: 0, class: :application,
+                              content: [objectid(:oid, value: '1.3.6.1.5.5.2'),
+                                        model(:token_init, NegTokenInit)]),
+                     model(:token_resp, NegTokenResp)]
+
+    # @param [Hash] args
+    # @param [Symbol] :type +:init+ or +:response+ to force selection of
+    #  token CHOICE.
+    def initialize(args={})
+      token = args.delete(:token)
+      super
+      self[:gssapi].chosen = (token == :init) ? 0 : 1
+    end
+    # Populate Object from +str+
+    # @param [String] str
+    # @return [self]
+    def read(str)
+      parse!(str, ber: true)
+      self
+    end
+
+    # Get size of GSSAPI DER string, in bytes
+    # @return [Integer]
+    def sz
+      to_der.size
+    end
+  end
+end

data/lib/packetgen/plugin/smb.rb

@@ -1,6 +1,6 @@
-# This file is part of PacketGen
+# This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
-# Copyright (C) 2016 Sylvain Daubert <sylvain.daubert@laposte.net>
+# Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
 # frozen_string_literal: true
@@ -86,24 +86,24 @@ module PacketGen::Plugin
     # @!attribute body
     #  @return [String]
     define_field :body, PacketGen::Types::String
-    # @!attribute flags_reply
+    # @!attribute flags_reply?
     #  When set, the message is a reply from server to client.
     #  @return [Boolean]
-    # @!attribute flags_opbatch
+    # @!attribute flags_opbatch?
     #  Obsolescent.
     #  @return [Boolean]
-    # @!attribute flags_oplock
+    # @!attribute flags_oplock?
     #  Obsolescent.
     #  @return [Boolean]
-    # @!attribute flags_canon_paths
+    # @!attribute flags_canon_paths?
     #  Obsolescent.
     #  @return [Boolean]
-    # @!attribute flags_case_insensitive
+    # @!attribute flags_case_insensitive?
     #  Obsolete.
     #  @return [Boolean]
-    # @!attribute flags_reserved
+    # @!attribute flags_reserved?
     #  @return [Boolean]
-    # @!attribute flags_rbuf_avail
+    # @!attribute flags_rbuf_avail?
     #  Obsolete.
     #  @return [Boolean]
     # @!attribute flags_locknread
@@ -113,42 +113,42 @@ module PacketGen::Plugin
     define_bit_fields_on :flags, :flags_reply, :flags_opbatch, :flags_oplock,
                          :flags_canon_paths, :flags_case_insensitive,
                          :flags_reserved, :flags_buf_avail, :flags_locknread
-    # @!attribute flags2_unicode
+    # @!attribute flags2_unicode?
     #  If set, each field that contains a string in this message is encoded
     #  as UTF-16.
     #  @return [Boolean]
-    # @!attribute flags2_ntstatus
+    # @!attribute flags2_ntstatus?
     #  If set in a client request, server must return errors as NTSTATUS, else
     #  as SMBSTATUS.
     #  @return [Boolean]
-    # @!attribute flags2_paging_io
+    # @!attribute flags2_paging_io?
     #  Client may read a file if it does not have read permission but have
     #  execute one.
     #  @return [Boolean]
-    # @!attribute flags2_dfs
+    # @!attribute flags2_dfs?
     #  If set, any pathnames should be resolved in the Distributed File System
     #  (DFS).
     #  @return [Boolean]
-    # @!attribute flags2_extended_security
+    # @!attribute flags2_extended_security?
     #  @return [Boolean]
-    # @!attribute flags2_reparse_path
+    # @!attribute flags2_reparse_path?
     #  @return [Boolean]
     # @!attribute flags2_reserved
     #  3-bit reserved field
     #  @return [Integer]
-    # @!attribute flags2_is_long_name
+    # @!attribute flags2_is_long_name?
     #  @return [Boolean]
-    # @!attribute flags2_rsv
+    # @!attribute flags2_rsv?
     #  @return [Boolean]
-    # @!attribute flags2_security_signature_required
+    # @!attribute flags2_security_signature_required?
     #  @return [Boolean]
-    # @!attribute flags2_compressed
+    # @!attribute flags2_compressed?
     #  @return [Boolean]
-    # @!attribute flags2_signature
+    # @!attribute flags2_signature?
     #  @return [Boolean]
-    # @!attribute flags2_eas
+    # @!attribute flags2_eas?
     #  @return [Boolean]
-    # @!attribute flags2_long_names
+    # @!attribute flags2_long_names?
     #  If unset, file names must adhere to the 8.3 naming convention.
     #  @return [Boolean]
     define_bit_fields_on :flags2, :flags2_unicode, :flags2_ntstatus,
@@ -163,8 +163,8 @@ module PacketGen::Plugin
     # @return [void]
     def self.bind_command(command)
       contantized = command.capitalize.gsub(/_(\w)/) { $1.upcase }
-      krequest = self.const_get("#{contantized}Request")
-      kresponse = self.const_get("#{contantized}Response")
+      krequest = self.const_get("#{contantized}::Request")
+      kresponse = self.const_get("#{contantized}::Response")
       PacketGen::Header.add_class krequest
       self.bind krequest, command: SMB::COMMANDS[command], flags: ->(v) { v.nil? ? 0 : (v & 0x80).zero? }
       PacketGen::Header.add_class kresponse
@@ -172,10 +172,7 @@ module PacketGen::Plugin
     end
 
     def inspect
-      str = PacketGen::Inspect.dashed_line(self.class, 1)
-      fields.each do |attr|
-        next if attr == :body
-
+      super do |attr|
         case attr
         when :flags, :flags2
           value = bits_on(attr).reject { |_, v| v > 1 }
@@ -185,14 +182,11 @@ module PacketGen::Plugin
                                .join(',')
                                .gsub!(/#{attr}_/, '')
           value = '%-16s (0x%02x)' % [value, self[attr].to_i]
-          str << PacketGen::Inspect.shift_level(1)
+          str = PacketGen::Inspect.shift_level
           str << PacketGen::Inspect::FMT_ATTR % [self[attr].class.to_s.sub(/.*::/, ''),
                                                  attr, value]
-        else
-          str << PacketGen::Inspect.inspect_attribute(attr, self[attr], 1)
         end
       end
-      str
     end
   end
   PacketGen::Header.add_class SMB

data/lib/packetgen/plugin/smb/blocks.rb

@@ -1,6 +1,6 @@
-# This file is part of PacketGen
+# This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
-# Copyright (C) 2016 Sylvain Daubert <sylvain.daubert@laposte.net>
+# Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
 # frozen_string_literal: true

data/lib/packetgen/plugin/smb/browser.rb

@@ -1,6 +1,6 @@
-# This file is part of PacketGen
+# This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
-# Copyright (C) 2016 Sylvain Daubert <sylvain.daubert@laposte.net>
+# Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
 # frozen_string_literal: true
@@ -81,7 +81,7 @@ module PacketGen::Plugin
       end
     end
     PacketGen::Header.add_class Browser
-    SMB::TransRequest.bind Browser, name: '\\MAILSLOT\\BROWSE'
+    Trans::Request.bind Browser, name: '\\MAILSLOT\\BROWSE'
   end
 end
 

data/lib/packetgen/plugin/smb/browser/domain_announcement.rb

@@ -1,6 +1,6 @@
-# This file is part of PacketGen
+# This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
-# Copyright (C) 2016 Sylvain Daubert <sylvain.daubert@laposte.net>
+# Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
 # frozen_string_literal: true
@@ -27,7 +27,7 @@ module PacketGen::Plugin
         end
       end
       PacketGen::Header.add_class DomainAnnouncement
-      SMB::TransRequest.bind DomainAnnouncement, name: '\\MAILSLOT\\BROWSE', body: ->(v) { v[0] == OPCODES['DomainAnnouncement'] }
+      SMB::Trans::Request.bind DomainAnnouncement, name: '\\MAILSLOT\\BROWSE', body: ->(v) { v[0] == OPCODES['DomainAnnouncement'] }
     end
   end
 end

data/lib/packetgen/plugin/smb/browser/host_announcement.rb

@@ -1,6 +1,6 @@
-# This file is part of PacketGen
+# This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
-# Copyright (C) 2016 Sylvain Daubert <sylvain.daubert@laposte.net>
+# Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
 # frozen_string_literal: true
@@ -14,7 +14,7 @@ module PacketGen::Plugin
       # specify the types of resources and services it supports.
       # @author Sylvain Daubert
       class HostAnnouncement < Browser
-        delete_field :body
+        remove_field :body
         update_field :opcode, default: 1
         # @!attribute update_count
         #  8-bit integer. Not used. Should be 0
@@ -65,7 +65,7 @@ module PacketGen::Plugin
         end
       end
       PacketGen::Header.add_class HostAnnouncement
-      SMB::TransRequest.bind HostAnnouncement, name: '\\MAILSLOT\\BROWSE', body: ->(v) { v[0] == OPCODES['HostAnnouncement'] }
+      SMB::Trans::Request.bind HostAnnouncement, name: '\\MAILSLOT\\BROWSE', body: ->(v) { v[0] == OPCODES['HostAnnouncement'] }
     end
   end
 end

data/lib/packetgen/plugin/smb/browser/local_master_announcement.rb

@@ -1,6 +1,6 @@
-# This file is part of PacketGen
+# This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
-# Copyright (C) 2016 Sylvain Daubert <sylvain.daubert@laposte.net>
+# Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
 # frozen_string_literal: true
@@ -22,7 +22,7 @@ module PacketGen::Plugin
         end
       end
       PacketGen::Header.add_class LocalMasterAnnouncement
-      SMB::TransRequest.bind LocalMasterAnnouncement, name: '\\MAILSLOT\\BROWSE', body: ->(v) { v[0] == OPCODES['LocalMasterAnnouncement'] }
+      SMB::Trans::Request.bind LocalMasterAnnouncement, name: '\\MAILSLOT\\BROWSE', body: ->(v) { v[0] == OPCODES['LocalMasterAnnouncement'] }
     end
   end
 end

data/lib/packetgen/plugin/smb/close.rb

@@ -1,68 +1,18 @@
-# This file is part of PacketGen
+# This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
-# Copyright (C) 2016 Sylvain Daubert <sylvain.daubert@laposte.net>
+# Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
 # frozen_string_literal: true
 
 module PacketGen::Plugin
   class SMB
-    # Close Request.
-    # @author Sylvain Daubert
-    class CloseRequest < PacketGen::Header::Base
-      # @!attribute word_count
-      #  The size, in 2-byte words, of the SMB command parameters. It should
-      #  be +3+.
-      #  @return [Integer]
-      define_field :word_count, PacketGen::Types::Int8, default: 3
-      # @!attribute fid
-      #  16-bit FID of the object to close
-      #  @return [Integer]
-      define_field :fid, PacketGen::Types::Int16le, default: 3
-      # @!attribute last_modified
-      #  32-bit time value encoded as the number of seconds since January
-      #  1, 1970 00:00:00.0. The client can request that the last modification
-      #  time for the file be updated to this time value. A value of +0x00000000+
-      #  or +0xFFFFFFFF+ results in the server not updating the last modification
-      #  time.
-      #  @return [Integer]
-      define_field :last_modified, PacketGen::Types::Int32le
-      # @!attribute byte_count
-      #  Should be 0.
-      #  @return [Integer]
-      define_field :byte_count, PacketGen::Types::Int16le, default: 0
-
-      # Give protocol name for this class
-      # @return [String]
-      def protocol_name
-        'SMB::CloseRequest'
-      end
-    end
-
-    # Close Response.
-    #
-    # This is a void container. {#word_count} and {#byte_count} should be 0.
-    # @author Sylvain Daubert
-    # @since 0.1.0
-    class CloseResponse < PacketGen::Header::Base
-      # @!attribute word_count
-      #  The size, in 2-byte words, of the SMB command parameters. It should
-      #  be +0+.
-      #  @return [Integer]
-      define_field :word_count, PacketGen::Types::Int8, default: 3
-      define_field :last_modified, PacketGen::Types::Int32le
-      # @!attribute byte_count
-      #  Should be 0.
-      #  @return [Integer]
-      define_field :byte_count, PacketGen::Types::Int16le, default: 0
-
-      # Give protocol name for this class
-      # @return [String]
-      def protocol_name
-        'SMB::CloseResponse'
-      end
-    end
-
-    self.bind_command 'close'
+    # Namespace for CLOSE related classes
+    module Close; end
   end
 end
+
+require_relative 'close/request'
+require_relative 'close/response'
+
+PacketGen::Plugin::SMB.bind_command 'close'