1 /* Do not modify this file. Changes will be overwritten. */
2 /* Generated automatically by the ASN.1 to Wireshark dissector compiler */
3 /* packet-credssp.c */
4 /* asn2wrs.py -b -C -p credssp -c ./credssp.cnf -s ./packet-credssp-template -D . -O ../.. CredSSP.asn */
5
6 /* Input file: packet-credssp-template.c */
7
8 #line 1 "./asn1/credssp/packet-credssp-template.c"
9 /* packet-credssp.c
10 * Routines for CredSSP (Credential Security Support Provider) packet dissection
11 * Graeme Lunt 2011
12 *
13 * Wireshark - Network traffic analyzer
14 * By Gerald Combs <gerald@wireshark.org>
15 * Copyright 1998 Gerald Combs
16 *
17 * SPDX-License-Identifier: GPL-2.0-or-later
18 */
19
20 #include "config.h"
21
22 #include <epan/packet.h>
23 #include <epan/asn1.h>
24 #include <epan/tap.h>
25 #include <epan/exported_pdu.h>
26
27 #include "packet-ber.h"
28 #include "packet-dcerpc.h"
29 #include "packet-gssapi.h"
30 #include "packet-kerberos.h"
31 #include "packet-ntlmssp.h"
32 #include "packet-credssp.h"
33
34 #define PNAME "Credential Security Support Provider"
35 #define PSNAME "CredSSP"
36 #define PFNAME "credssp"
37
38 #define TS_PASSWORD_CREDS 1
39 #define TS_SMARTCARD_CREDS 2
40 #define TS_REMOTEGUARD_CREDS 6
41
42 static gint creds_type;
43 static gint credssp_ver;
44
45 static char kerberos_pname[] = "K\0e\0r\0b\0e\0r\0o\0s";
46 static char ntlm_pname[] = "N\0T\0L\0M";
47
48 #define TS_RGC_UNKNOWN 0
49 #define TS_RGC_KERBEROS 1
50 #define TS_RGC_NTLM 2
51
52 static gint credssp_TS_RGC_package;
53
54 static gint exported_pdu_tap = -1;
55
56 /* Initialize the protocol and registered fields */
57 static int proto_credssp = -1;
58
59 /* List of dissectors to call for negoToken data */
60 static heur_dissector_list_t credssp_heur_subdissector_list;
61
62 static dissector_handle_t gssapi_handle;
63 static dissector_handle_t gssapi_wrap_handle;
64
65 static int hf_credssp_TSPasswordCreds = -1; /* TSPasswordCreds */
66 static int hf_credssp_TSSmartCardCreds = -1; /* TSSmartCardCreds */
67 static int hf_credssp_TSRemoteGuardCreds = -1;/* TSRemoteGuardCreds */
68 static int hf_credssp_TSCredentials = -1; /* TSCredentials */
69 static int hf_credssp_decr_PublicKeyAuth = -1;/* decr_PublicKeyAuth */
70
71 /*--- Included file: packet-credssp-hf.c ---*/
72 #line 1 "./asn1/credssp/packet-credssp-hf.c"
73 static int hf_credssp_TSRequest_PDU = -1; /* TSRequest */
74 static int hf_credssp_NegoData_item = -1; /* NegoData_item */
75 static int hf_credssp_negoToken = -1; /* T_negoToken */
76 static int hf_credssp_domainName = -1; /* OCTET_STRING */
77 static int hf_credssp_userName = -1; /* OCTET_STRING */
78 static int hf_credssp_password = -1; /* OCTET_STRING */
79 static int hf_credssp_keySpec = -1; /* INTEGER */
80 static int hf_credssp_cardName = -1; /* OCTET_STRING */
81 static int hf_credssp_readerName = -1; /* OCTET_STRING */
82 static int hf_credssp_containerName = -1; /* OCTET_STRING */
83 static int hf_credssp_cspName = -1; /* OCTET_STRING */
84 static int hf_credssp_pin = -1; /* OCTET_STRING */
85 static int hf_credssp_cspData = -1; /* TSCspDataDetail */
86 static int hf_credssp_userHint = -1; /* OCTET_STRING */
87 static int hf_credssp_domainHint = -1; /* OCTET_STRING */
88 static int hf_credssp_packageName = -1; /* T_packageName */
89 static int hf_credssp_credBuffer = -1; /* T_credBuffer */
90 static int hf_credssp_logonCred = -1; /* TSRemoteGuardPackageCred */
91 static int hf_credssp_supplementalCreds = -1; /* SEQUENCE_OF_TSRemoteGuardPackageCred */
92 static int hf_credssp_supplementalCreds_item = -1; /* TSRemoteGuardPackageCred */
93 static int hf_credssp_credType = -1; /* T_credType */
94 static int hf_credssp_credentials = -1; /* T_credentials */
95 static int hf_credssp_version = -1; /* T_version */
96 static int hf_credssp_negoTokens = -1; /* NegoData */
97 static int hf_credssp_authInfo = -1; /* T_authInfo */
98 static int hf_credssp_pubKeyAuth = -1; /* T_pubKeyAuth */
99 static int hf_credssp_errorCode = -1; /* T_errorCode */
100 static int hf_credssp_clientNonce = -1; /* T_clientNonce */
101
102 /*--- End of included file: packet-credssp-hf.c ---*/
103 #line 63 "./asn1/credssp/packet-credssp-template.c"
104
105 /* Initialize the subtree pointers */
106 static gint ett_credssp = -1;
107 static gint ett_credssp_RGC_CredBuffer = -1;
108
109
110 /*--- Included file: packet-credssp-ett.c ---*/
111 #line 1 "./asn1/credssp/packet-credssp-ett.c"
112 static gint ett_credssp_NegoData = -1;
113 static gint ett_credssp_NegoData_item = -1;
114 static gint ett_credssp_TSPasswordCreds = -1;
115 static gint ett_credssp_TSCspDataDetail = -1;
116 static gint ett_credssp_TSSmartCardCreds = -1;
117 static gint ett_credssp_TSRemoteGuardPackageCred = -1;
118 static gint ett_credssp_TSRemoteGuardCreds = -1;
119 static gint ett_credssp_SEQUENCE_OF_TSRemoteGuardPackageCred = -1;
120 static gint ett_credssp_TSCredentials = -1;
121 static gint ett_credssp_TSRequest = -1;
122
123 /*--- End of included file: packet-credssp-ett.c ---*/
124 #line 69 "./asn1/credssp/packet-credssp-template.c"
125
126
127 /*--- Included file: packet-credssp-fn.c ---*/
128 #line 1 "./asn1/credssp/packet-credssp-fn.c"
129
130
131 static int
dissect_credssp_T_negoToken(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)132 dissect_credssp_T_negoToken(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
133 #line 81 "./asn1/credssp/credssp.cnf"
134 tvbuff_t *token_tvb = NULL;
135
136 offset = dissect_ber_octet_string(implicit_tag, actx, tree, tvb, offset, hf_index,
137 &token_tvb);
138
139
140 if(token_tvb != NULL)
141 call_dissector(gssapi_handle, token_tvb, actx->pinfo, tree);
142
143
144
145
146 return offset;
147 }
148
149
150 static const ber_sequence_t NegoData_item_sequence[] = {
151 { &hf_credssp_negoToken , BER_CLASS_CON, 0, 0, dissect_credssp_T_negoToken },
152 { NULL, 0, 0, 0, NULL }
153 };
154
155 static int
dissect_credssp_NegoData_item(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)156 dissect_credssp_NegoData_item(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
157 offset = dissect_ber_sequence(implicit_tag, actx, tree, tvb, offset,
158 NegoData_item_sequence, hf_index, ett_credssp_NegoData_item);
159
160 return offset;
161 }
162
163
164 static const ber_sequence_t NegoData_sequence_of[1] = {
165 { &hf_credssp_NegoData_item, BER_CLASS_UNI, BER_UNI_TAG_SEQUENCE, BER_FLAGS_NOOWNTAG, dissect_credssp_NegoData_item },
166 };
167
168 static int
dissect_credssp_NegoData(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)169 dissect_credssp_NegoData(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
170 offset = dissect_ber_sequence_of(implicit_tag, actx, tree, tvb, offset,
171 NegoData_sequence_of, hf_index, ett_credssp_NegoData);
172
173 return offset;
174 }
175
176
177
178 static int
dissect_credssp_OCTET_STRING(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)179 dissect_credssp_OCTET_STRING(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
180 offset = dissect_ber_octet_string(implicit_tag, actx, tree, tvb, offset, hf_index,
181 NULL);
182
183 return offset;
184 }
185
186
187 static const ber_sequence_t TSPasswordCreds_sequence[] = {
188 { &hf_credssp_domainName , BER_CLASS_CON, 0, 0, dissect_credssp_OCTET_STRING },
189 { &hf_credssp_userName , BER_CLASS_CON, 1, 0, dissect_credssp_OCTET_STRING },
190 { &hf_credssp_password , BER_CLASS_CON, 2, 0, dissect_credssp_OCTET_STRING },
191 { NULL, 0, 0, 0, NULL }
192 };
193
194 static int
dissect_credssp_TSPasswordCreds(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)195 dissect_credssp_TSPasswordCreds(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
196 offset = dissect_ber_sequence(implicit_tag, actx, tree, tvb, offset,
197 TSPasswordCreds_sequence, hf_index, ett_credssp_TSPasswordCreds);
198
199 return offset;
200 }
201
202
203
204 static int
dissect_credssp_INTEGER(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)205 dissect_credssp_INTEGER(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
206 offset = dissect_ber_integer(implicit_tag, actx, tree, tvb, offset, hf_index,
207 NULL);
208
209 return offset;
210 }
211
212
213 static const ber_sequence_t TSCspDataDetail_sequence[] = {
214 { &hf_credssp_keySpec , BER_CLASS_CON, 0, 0, dissect_credssp_INTEGER },
215 { &hf_credssp_cardName , BER_CLASS_CON, 1, BER_FLAGS_OPTIONAL, dissect_credssp_OCTET_STRING },
216 { &hf_credssp_readerName , BER_CLASS_CON, 2, BER_FLAGS_OPTIONAL, dissect_credssp_OCTET_STRING },
217 { &hf_credssp_containerName, BER_CLASS_CON, 3, BER_FLAGS_OPTIONAL, dissect_credssp_OCTET_STRING },
218 { &hf_credssp_cspName , BER_CLASS_CON, 4, BER_FLAGS_OPTIONAL, dissect_credssp_OCTET_STRING },
219 { NULL, 0, 0, 0, NULL }
220 };
221
222 static int
dissect_credssp_TSCspDataDetail(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)223 dissect_credssp_TSCspDataDetail(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
224 offset = dissect_ber_sequence(implicit_tag, actx, tree, tvb, offset,
225 TSCspDataDetail_sequence, hf_index, ett_credssp_TSCspDataDetail);
226
227 return offset;
228 }
229
230
231 static const ber_sequence_t TSSmartCardCreds_sequence[] = {
232 { &hf_credssp_pin , BER_CLASS_CON, 0, 0, dissect_credssp_OCTET_STRING },
233 { &hf_credssp_cspData , BER_CLASS_CON, 1, 0, dissect_credssp_TSCspDataDetail },
234 { &hf_credssp_userHint , BER_CLASS_CON, 2, BER_FLAGS_OPTIONAL, dissect_credssp_OCTET_STRING },
235 { &hf_credssp_domainHint , BER_CLASS_CON, 3, BER_FLAGS_OPTIONAL, dissect_credssp_OCTET_STRING },
236 { NULL, 0, 0, 0, NULL }
237 };
238
239 static int
dissect_credssp_TSSmartCardCreds(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)240 dissect_credssp_TSSmartCardCreds(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
241 offset = dissect_ber_sequence(implicit_tag, actx, tree, tvb, offset,
242 TSSmartCardCreds_sequence, hf_index, ett_credssp_TSSmartCardCreds);
243
244 return offset;
245 }
246
247
248
249 static int
dissect_credssp_T_packageName(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)250 dissect_credssp_T_packageName(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
251 #line 93 "./asn1/credssp/credssp.cnf"
252 tvbuff_t *pname = NULL;
253
254 offset = dissect_ber_octet_string(implicit_tag, actx, NULL, tvb, offset, hf_index, &pname);
255
256 if(pname != NULL) {
257 gint nlen = tvb_captured_length(pname);
258
259 if (nlen == sizeof(kerberos_pname) && memcmp(tvb_get_ptr(pname, 0, nlen), kerberos_pname, nlen) == 0) {
260 credssp_TS_RGC_package = TS_RGC_KERBEROS;
261 } else if (nlen == sizeof(ntlm_pname) && memcmp(tvb_get_ptr(pname, 0, nlen), ntlm_pname, nlen) == 0) {
262 credssp_TS_RGC_package = TS_RGC_NTLM;
263 }
264 proto_tree_add_item(tree, hf_index, pname, 0, -1, ENC_UTF_16|ENC_LITTLE_ENDIAN);
265 }
266
267
268
269 return offset;
270 }
271
272
273
274 static int
dissect_credssp_T_credBuffer(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)275 dissect_credssp_T_credBuffer(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
276 #line 109 "./asn1/credssp/credssp.cnf"
277 tvbuff_t *creds= NULL;
278 proto_tree *subtree;
279
280 offset = dissect_ber_octet_string(implicit_tag, actx, tree, tvb, offset, hf_index,
281 &creds);
282
283
284 if (!creds)
285 return offset;
286
287 switch(credssp_TS_RGC_package) {
288 case TS_RGC_KERBEROS:
289 subtree = proto_item_add_subtree(actx->created_item, ett_credssp_RGC_CredBuffer);
290 dissect_kerberos_KERB_TICKET_LOGON(creds, 0, actx, subtree);
291 break;
292 case TS_RGC_NTLM:
293 subtree = proto_item_add_subtree(actx->created_item, ett_credssp_RGC_CredBuffer);
294 dissect_ntlmssp_NTLM_REMOTE_SUPPLEMENTAL_CREDENTIAL(creds, 0, subtree);
295 break;
296 }
297
298
299
300 return offset;
301 }
302
303
304 static const ber_sequence_t TSRemoteGuardPackageCred_sequence[] = {
305 { &hf_credssp_packageName , BER_CLASS_CON, 0, 0, dissect_credssp_T_packageName },
306 { &hf_credssp_credBuffer , BER_CLASS_CON, 1, 0, dissect_credssp_T_credBuffer },
307 { NULL, 0, 0, 0, NULL }
308 };
309
310 static int
dissect_credssp_TSRemoteGuardPackageCred(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)311 dissect_credssp_TSRemoteGuardPackageCred(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
312 offset = dissect_ber_sequence(implicit_tag, actx, tree, tvb, offset,
313 TSRemoteGuardPackageCred_sequence, hf_index, ett_credssp_TSRemoteGuardPackageCred);
314
315 return offset;
316 }
317
318
319 static const ber_sequence_t SEQUENCE_OF_TSRemoteGuardPackageCred_sequence_of[1] = {
320 { &hf_credssp_supplementalCreds_item, BER_CLASS_UNI, BER_UNI_TAG_SEQUENCE, BER_FLAGS_NOOWNTAG, dissect_credssp_TSRemoteGuardPackageCred },
321 };
322
323 static int
dissect_credssp_SEQUENCE_OF_TSRemoteGuardPackageCred(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)324 dissect_credssp_SEQUENCE_OF_TSRemoteGuardPackageCred(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
325 offset = dissect_ber_sequence_of(implicit_tag, actx, tree, tvb, offset,
326 SEQUENCE_OF_TSRemoteGuardPackageCred_sequence_of, hf_index, ett_credssp_SEQUENCE_OF_TSRemoteGuardPackageCred);
327
328 return offset;
329 }
330
331
332 static const ber_sequence_t TSRemoteGuardCreds_sequence[] = {
333 { &hf_credssp_logonCred , BER_CLASS_CON, 0, 0, dissect_credssp_TSRemoteGuardPackageCred },
334 { &hf_credssp_supplementalCreds, BER_CLASS_CON, 1, BER_FLAGS_OPTIONAL, dissect_credssp_SEQUENCE_OF_TSRemoteGuardPackageCred },
335 { NULL, 0, 0, 0, NULL }
336 };
337
338 static int
dissect_credssp_TSRemoteGuardCreds(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)339 dissect_credssp_TSRemoteGuardCreds(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
340 offset = dissect_ber_sequence(implicit_tag, actx, tree, tvb, offset,
341 TSRemoteGuardCreds_sequence, hf_index, ett_credssp_TSRemoteGuardCreds);
342
343 return offset;
344 }
345
346
347
348 static int
dissect_credssp_T_credType(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)349 dissect_credssp_T_credType(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
350 offset = dissect_ber_integer(implicit_tag, actx, tree, tvb, offset, hf_index,
351 &creds_type);
352
353 return offset;
354 }
355
356
357
358 static int
dissect_credssp_T_credentials(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)359 dissect_credssp_T_credentials(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
360 #line 61 "./asn1/credssp/credssp.cnf"
361 tvbuff_t *creds_tvb = NULL;
362
363 offset = dissect_ber_octet_string(implicit_tag, actx, tree, tvb, offset, hf_index,
364 &creds_tvb);
365
366
367 switch(creds_type) {
368 case TS_PASSWORD_CREDS:
369 dissect_credssp_TSPasswordCreds(FALSE, creds_tvb, 0, actx, tree, hf_credssp_TSPasswordCreds);
370 break;
371 case TS_SMARTCARD_CREDS:
372 dissect_credssp_TSSmartCardCreds(FALSE, creds_tvb, 0, actx, tree, hf_credssp_TSSmartCardCreds);
373 break;
374 case TS_REMOTEGUARD_CREDS:
375 dissect_credssp_TSRemoteGuardCreds(FALSE, creds_tvb, 0, actx, tree, hf_credssp_TSRemoteGuardCreds);
376 break;
377 }
378
379
380
381
382 return offset;
383 }
384
385
386 static const ber_sequence_t TSCredentials_sequence[] = {
387 { &hf_credssp_credType , BER_CLASS_CON, 0, 0, dissect_credssp_T_credType },
388 { &hf_credssp_credentials , BER_CLASS_CON, 1, 0, dissect_credssp_T_credentials },
389 { NULL, 0, 0, 0, NULL }
390 };
391
392 static int
dissect_credssp_TSCredentials(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)393 dissect_credssp_TSCredentials(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
394 offset = dissect_ber_sequence(implicit_tag, actx, tree, tvb, offset,
395 TSCredentials_sequence, hf_index, ett_credssp_TSCredentials);
396
397 return offset;
398 }
399
400
401
402 static int
dissect_credssp_T_version(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)403 dissect_credssp_T_version(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
404 offset = dissect_ber_integer(implicit_tag, actx, tree, tvb, offset, hf_index,
405 &credssp_ver);
406
407 return offset;
408 }
409
410
411
412 static int
dissect_credssp_T_authInfo(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)413 dissect_credssp_T_authInfo(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
414 #line 10 "./asn1/credssp/credssp.cnf"
415 tvbuff_t *auth_tvb = NULL;
416 tvbuff_t *decr_tvb = NULL;
417 gssapi_encrypt_info_t gssapi_encrypt;
418
419 offset = dissect_ber_octet_string(implicit_tag, actx, tree, tvb, offset, hf_index,
420 &auth_tvb);
421
422
423 memset(&gssapi_encrypt, 0, sizeof(gssapi_encrypt));
424 gssapi_encrypt.decrypt_gssapi_tvb=DECRYPT_GSSAPI_NORMAL;
425 call_dissector_with_data(gssapi_wrap_handle, auth_tvb, actx->pinfo, tree, &gssapi_encrypt);
426 decr_tvb = gssapi_encrypt.gssapi_decrypted_tvb;
427
428 if(decr_tvb != NULL)
429 dissect_credssp_TSCredentials(FALSE, decr_tvb, 0, actx, tree, hf_credssp_TSCredentials);
430
431
432
433 return offset;
434 }
435
436
437
438 static int
dissect_credssp_T_pubKeyAuth(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)439 dissect_credssp_T_pubKeyAuth(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
440 #line 25 "./asn1/credssp/credssp.cnf"
441 tvbuff_t *auth_tvb = NULL;
442 tvbuff_t *decr_tvb = NULL;
443 gssapi_encrypt_info_t gssapi_encrypt;
444
445 offset = dissect_ber_octet_string(implicit_tag, actx, tree, tvb, offset, hf_index,
446 &auth_tvb);
447
448
449 memset(&gssapi_encrypt, 0, sizeof(gssapi_encrypt));
450 gssapi_encrypt.decrypt_gssapi_tvb=DECRYPT_GSSAPI_NORMAL;
451 call_dissector_with_data(gssapi_wrap_handle, auth_tvb, actx->pinfo, tree, &gssapi_encrypt);
452 decr_tvb = gssapi_encrypt.gssapi_decrypted_tvb;
453
454 if(decr_tvb != NULL)
455 proto_tree_add_item(tree, hf_credssp_decr_PublicKeyAuth, decr_tvb, 0, -1, ENC_NA);
456
457
458
459 return offset;
460 }
461
462
463
464 static int
dissect_credssp_T_errorCode(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)465 dissect_credssp_T_errorCode(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
466 #line 40 "./asn1/credssp/credssp.cnf"
467
468 if (credssp_ver < 3) {
469 return 0;
470 }
471
472 offset = dissect_ber_integer(implicit_tag, actx, tree, tvb, offset, hf_index,
473 NULL);
474
475
476
477
478
479 return offset;
480 }
481
482
483
484 static int
dissect_credssp_T_clientNonce(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)485 dissect_credssp_T_clientNonce(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
486 #line 49 "./asn1/credssp/credssp.cnf"
487
488 if (credssp_ver < 5) {
489 return 0;
490 }
491
492 offset = dissect_ber_octet_string(implicit_tag, actx, tree, tvb, offset, hf_index,
493 NULL);
494
495
496
497
498
499 return offset;
500 }
501
502
503 static const ber_sequence_t TSRequest_sequence[] = {
504 { &hf_credssp_version , BER_CLASS_CON, 0, 0, dissect_credssp_T_version },
505 { &hf_credssp_negoTokens , BER_CLASS_CON, 1, BER_FLAGS_OPTIONAL, dissect_credssp_NegoData },
506 { &hf_credssp_authInfo , BER_CLASS_CON, 2, BER_FLAGS_OPTIONAL, dissect_credssp_T_authInfo },
507 { &hf_credssp_pubKeyAuth , BER_CLASS_CON, 3, BER_FLAGS_OPTIONAL, dissect_credssp_T_pubKeyAuth },
508 { &hf_credssp_errorCode , BER_CLASS_CON, 4, BER_FLAGS_OPTIONAL, dissect_credssp_T_errorCode },
509 { &hf_credssp_clientNonce , BER_CLASS_CON, 5, BER_FLAGS_OPTIONAL, dissect_credssp_T_clientNonce },
510 { NULL, 0, 0, 0, NULL }
511 };
512
513 static int
dissect_credssp_TSRequest(gboolean implicit_tag _U_,tvbuff_t * tvb _U_,int offset _U_,asn1_ctx_t * actx _U_,proto_tree * tree _U_,int hf_index _U_)514 dissect_credssp_TSRequest(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
515 offset = dissect_ber_sequence(implicit_tag, actx, tree, tvb, offset,
516 TSRequest_sequence, hf_index, ett_credssp_TSRequest);
517
518 return offset;
519 }
520
521 /*--- PDUs ---*/
522
dissect_TSRequest_PDU(tvbuff_t * tvb _U_,packet_info * pinfo _U_,proto_tree * tree _U_,void * data _U_)523 static int dissect_TSRequest_PDU(tvbuff_t *tvb _U_, packet_info *pinfo _U_, proto_tree *tree _U_, void *data _U_) {
524 int offset = 0;
525 asn1_ctx_t asn1_ctx;
526 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, TRUE, pinfo);
527 offset = dissect_credssp_TSRequest(FALSE, tvb, offset, &asn1_ctx, tree, hf_credssp_TSRequest_PDU);
528 return offset;
529 }
530
531
532 /*--- End of included file: packet-credssp-fn.c ---*/
533 #line 71 "./asn1/credssp/packet-credssp-template.c"
534
535 /*
536 * Dissect CredSSP PDUs
537 */
538 static int
dissect_credssp(tvbuff_t * tvb,packet_info * pinfo,proto_tree * parent_tree,void * data)539 dissect_credssp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void *data)
540 {
541 proto_item *item=NULL;
542 proto_tree *tree=NULL;
543
544 if(parent_tree){
545 item = proto_tree_add_item(parent_tree, proto_credssp, tvb, 0, -1, ENC_NA);
546 tree = proto_item_add_subtree(item, ett_credssp);
547 }
548 col_set_str(pinfo->cinfo, COL_PROTOCOL, "CredSSP");
549 col_clear(pinfo->cinfo, COL_INFO);
550
551 creds_type = -1;
552 credssp_ver = -1;
553
554 return dissect_TSRequest_PDU(tvb, pinfo, tree, data);
555 }
556
557 static gboolean
dissect_credssp_heur(tvbuff_t * tvb,packet_info * pinfo,proto_tree * parent_tree,void * data _U_)558 dissect_credssp_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void *data _U_)
559 {
560 asn1_ctx_t asn1_ctx;
561 int offset = 0;
562 gint8 ber_class;
563 gboolean pc;
564 gint32 tag;
565 guint32 length;
566 gint8 ver;
567
568 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, TRUE, pinfo);
569
570 /* Look for SEQUENCE, CONTEXT 0, and INTEGER 2 */
571 if(tvb_captured_length(tvb) > 7) {
572 offset = get_ber_identifier(tvb, offset, &ber_class, &pc, &tag);
573 if((ber_class == BER_CLASS_UNI) && (tag == BER_UNI_TAG_SEQUENCE) && (pc == TRUE)) {
574 offset = get_ber_length(tvb, offset, NULL, NULL);
575 offset = get_ber_identifier(tvb, offset, &ber_class, &pc, &tag);
576 if((ber_class == BER_CLASS_CON) && (tag == 0)) {
577 offset = get_ber_length(tvb, offset, NULL, NULL);
578 offset = get_ber_identifier(tvb, offset, &ber_class, &pc, &tag);
579 if((ber_class == BER_CLASS_UNI) && (tag == BER_UNI_TAG_INTEGER)) {
580 offset = get_ber_length(tvb, offset, &length, NULL);
581 ver = tvb_get_guint8(tvb, offset);
582 if((length == 1) && (ver > 1) && (ver < 99)) {
583 if (have_tap_listener(exported_pdu_tap)) {
584 exp_pdu_data_t *exp_pdu_data = export_pdu_create_common_tags(pinfo, "credssp", EXP_PDU_TAG_PROTO_NAME);
585
586 exp_pdu_data->tvb_captured_length = tvb_captured_length(tvb);
587 exp_pdu_data->tvb_reported_length = tvb_reported_length(tvb);
588 exp_pdu_data->pdu_tvb = tvb;
589
590 tap_queue_packet(exported_pdu_tap, pinfo, exp_pdu_data);
591 }
592 dissect_credssp(tvb, pinfo, parent_tree, NULL);
593 return TRUE;
594 }
595 }
596 }
597 }
598 }
599 return FALSE;
600 }
601
602
603 /*--- proto_register_credssp -------------------------------------------*/
proto_register_credssp(void)604 void proto_register_credssp(void) {
605
606 /* List of fields */
607 static hf_register_info hf[] =
608 {
609 { &hf_credssp_TSPasswordCreds,
610 { "TSPasswordCreds", "credssp.TSPasswordCreds",
611 FT_NONE, BASE_NONE, NULL, 0,
612 NULL, HFILL }},
613 { &hf_credssp_TSSmartCardCreds,
614 { "TSSmartCardCreds", "credssp.TSSmartCardCreds",
615 FT_NONE, BASE_NONE, NULL, 0,
616 NULL, HFILL }},
617 { &hf_credssp_TSRemoteGuardCreds,
618 { "TSRemoteGuardCreds", "credssp.TSRemoteGuardCreds",
619 FT_NONE, BASE_NONE, NULL, 0,
620 NULL, HFILL }},
621 { &hf_credssp_TSCredentials,
622 { "TSCredentials", "credssp.TSCredentials",
623 FT_NONE, BASE_NONE, NULL, 0,
624 NULL, HFILL }},
625 { &hf_credssp_decr_PublicKeyAuth,
626 { "Decrypted PublicKeyAuth (sha256)", "credssp.decr_PublicKeyAuth",
627 FT_BYTES, BASE_NONE, NULL, 0,
628 NULL, HFILL }},
629
630 /*--- Included file: packet-credssp-hfarr.c ---*/
631 #line 1 "./asn1/credssp/packet-credssp-hfarr.c"
632 { &hf_credssp_TSRequest_PDU,
633 { "TSRequest", "credssp.TSRequest_element",
634 FT_NONE, BASE_NONE, NULL, 0,
635 NULL, HFILL }},
636 { &hf_credssp_NegoData_item,
637 { "NegoData item", "credssp.NegoData_item_element",
638 FT_NONE, BASE_NONE, NULL, 0,
639 NULL, HFILL }},
640 { &hf_credssp_negoToken,
641 { "negoToken", "credssp.negoToken",
642 FT_BYTES, BASE_NONE, NULL, 0,
643 NULL, HFILL }},
644 { &hf_credssp_domainName,
645 { "domainName", "credssp.domainName",
646 FT_BYTES, BASE_NONE, NULL, 0,
647 "OCTET_STRING", HFILL }},
648 { &hf_credssp_userName,
649 { "userName", "credssp.userName",
650 FT_BYTES, BASE_NONE, NULL, 0,
651 "OCTET_STRING", HFILL }},
652 { &hf_credssp_password,
653 { "password", "credssp.password",
654 FT_BYTES, BASE_NONE, NULL, 0,
655 "OCTET_STRING", HFILL }},
656 { &hf_credssp_keySpec,
657 { "keySpec", "credssp.keySpec",
658 FT_INT32, BASE_DEC, NULL, 0,
659 "INTEGER", HFILL }},
660 { &hf_credssp_cardName,
661 { "cardName", "credssp.cardName",
662 FT_BYTES, BASE_NONE, NULL, 0,
663 "OCTET_STRING", HFILL }},
664 { &hf_credssp_readerName,
665 { "readerName", "credssp.readerName",
666 FT_BYTES, BASE_NONE, NULL, 0,
667 "OCTET_STRING", HFILL }},
668 { &hf_credssp_containerName,
669 { "containerName", "credssp.containerName",
670 FT_BYTES, BASE_NONE, NULL, 0,
671 "OCTET_STRING", HFILL }},
672 { &hf_credssp_cspName,
673 { "cspName", "credssp.cspName",
674 FT_BYTES, BASE_NONE, NULL, 0,
675 "OCTET_STRING", HFILL }},
676 { &hf_credssp_pin,
677 { "pin", "credssp.pin",
678 FT_BYTES, BASE_NONE, NULL, 0,
679 "OCTET_STRING", HFILL }},
680 { &hf_credssp_cspData,
681 { "cspData", "credssp.cspData_element",
682 FT_NONE, BASE_NONE, NULL, 0,
683 "TSCspDataDetail", HFILL }},
684 { &hf_credssp_userHint,
685 { "userHint", "credssp.userHint",
686 FT_BYTES, BASE_NONE, NULL, 0,
687 "OCTET_STRING", HFILL }},
688 { &hf_credssp_domainHint,
689 { "domainHint", "credssp.domainHint",
690 FT_BYTES, BASE_NONE, NULL, 0,
691 "OCTET_STRING", HFILL }},
692 { &hf_credssp_packageName,
693 { "packageName", "credssp.packageName",
694 FT_STRING, STR_UNICODE, NULL, 0,
695 NULL, HFILL }},
696 { &hf_credssp_credBuffer,
697 { "credBuffer", "credssp.credBuffer",
698 FT_BYTES, BASE_NONE, NULL, 0,
699 NULL, HFILL }},
700 { &hf_credssp_logonCred,
701 { "logonCred", "credssp.logonCred_element",
702 FT_NONE, BASE_NONE, NULL, 0,
703 "TSRemoteGuardPackageCred", HFILL }},
704 { &hf_credssp_supplementalCreds,
705 { "supplementalCreds", "credssp.supplementalCreds",
706 FT_UINT32, BASE_DEC, NULL, 0,
707 "SEQUENCE_OF_TSRemoteGuardPackageCred", HFILL }},
708 { &hf_credssp_supplementalCreds_item,
709 { "TSRemoteGuardPackageCred", "credssp.TSRemoteGuardPackageCred_element",
710 FT_NONE, BASE_NONE, NULL, 0,
711 NULL, HFILL }},
712 { &hf_credssp_credType,
713 { "credType", "credssp.credType",
714 FT_INT32, BASE_DEC, NULL, 0,
715 NULL, HFILL }},
716 { &hf_credssp_credentials,
717 { "credentials", "credssp.credentials",
718 FT_BYTES, BASE_NONE, NULL, 0,
719 NULL, HFILL }},
720 { &hf_credssp_version,
721 { "version", "credssp.version",
722 FT_INT32, BASE_DEC, NULL, 0,
723 NULL, HFILL }},
724 { &hf_credssp_negoTokens,
725 { "negoTokens", "credssp.negoTokens",
726 FT_UINT32, BASE_DEC, NULL, 0,
727 "NegoData", HFILL }},
728 { &hf_credssp_authInfo,
729 { "authInfo", "credssp.authInfo",
730 FT_BYTES, BASE_NONE, NULL, 0,
731 NULL, HFILL }},
732 { &hf_credssp_pubKeyAuth,
733 { "pubKeyAuth", "credssp.pubKeyAuth",
734 FT_BYTES, BASE_NONE, NULL, 0,
735 NULL, HFILL }},
736 { &hf_credssp_errorCode,
737 { "errorCode", "credssp.errorCode",
738 FT_INT32, BASE_DEC, NULL, 0,
739 NULL, HFILL }},
740 { &hf_credssp_clientNonce,
741 { "clientNonce", "credssp.clientNonce",
742 FT_BYTES, BASE_NONE, NULL, 0,
743 NULL, HFILL }},
744
745 /*--- End of included file: packet-credssp-hfarr.c ---*/
746 #line 167 "./asn1/credssp/packet-credssp-template.c"
747 };
748
749 /* List of subtrees */
750 static gint *ett[] = {
751 &ett_credssp,
752 &ett_credssp_RGC_CredBuffer,
753
754 /*--- Included file: packet-credssp-ettarr.c ---*/
755 #line 1 "./asn1/credssp/packet-credssp-ettarr.c"
756 &ett_credssp_NegoData,
757 &ett_credssp_NegoData_item,
758 &ett_credssp_TSPasswordCreds,
759 &ett_credssp_TSCspDataDetail,
760 &ett_credssp_TSSmartCardCreds,
761 &ett_credssp_TSRemoteGuardPackageCred,
762 &ett_credssp_TSRemoteGuardCreds,
763 &ett_credssp_SEQUENCE_OF_TSRemoteGuardPackageCred,
764 &ett_credssp_TSCredentials,
765 &ett_credssp_TSRequest,
766
767 /*--- End of included file: packet-credssp-ettarr.c ---*/
768 #line 174 "./asn1/credssp/packet-credssp-template.c"
769 };
770
771
772 /* Register protocol */
773 proto_credssp = proto_register_protocol(PNAME, PSNAME, PFNAME);
774 register_dissector("credssp", dissect_credssp, proto_credssp);
775
776 /* Register fields and subtrees */
777 proto_register_field_array(proto_credssp, hf, array_length(hf));
778 proto_register_subtree_array(ett, array_length(ett));
779
780 /* heuristic dissectors for any premable e.g. CredSSP before RDP */
781 credssp_heur_subdissector_list = register_heur_dissector_list("credssp", proto_credssp);
782
783 }
784
785
786 /*--- proto_reg_handoff_credssp --- */
proto_reg_handoff_credssp(void)787 void proto_reg_handoff_credssp(void) {
788
789 gssapi_handle = find_dissector_add_dependency("gssapi", proto_credssp);
790 gssapi_wrap_handle = find_dissector_add_dependency("gssapi_verf", proto_credssp);
791
792 heur_dissector_add("tls", dissect_credssp_heur, "CredSSP over TLS", "credssp_tls", proto_credssp, HEURISTIC_ENABLE);
793 heur_dissector_add("rdp", dissect_credssp_heur, "CredSSP in TPKT", "credssp_tpkt", proto_credssp, HEURISTIC_ENABLE);
794 exported_pdu_tap = find_tap_id(EXPORT_PDU_TAP_NAME_LAYER_7);
795 }
796
797