/* Do not modify this file. Changes will be overwritten.                      */

/* Generated automatically by the ASN.1 to Wireshark dissector compiler       */

/* packet-ldap.c                                                              */

/* asn2wrs.py -b -q -L -p ldap -c ./ldap.cnf -s ./packet-ldap-template -D . -O ../.. Lightweight-Directory-Access-Protocol-V3.asn */

/* packet-ldap.c

 * Routines for ldap packet dissection

 *

* See RFC 3494 (LDAP v2), RFC 4511 (LDAP v3), and RFC 2222 (SASL).

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

/*

 * This is not a complete implementation. It doesn't handle the full version 3, more specifically,

 * it handles only the commands of version 2, but any additional characteristics of the ver3 command are supported.

 * It's also missing extensible search filters.

 *

 * There should probably be a lot more error checking, I simply assume that if we have a full packet, it will be a complete

 * and correct packet.

 *

 * AFAIK, it will handle all messages used by the OpenLDAP 1.2.9 server and libraries which was my goal. I do plan to add

 * the remaining commands as time permits but this is not a priority to me. Send me an email if you need it and I'll see what

 * I can do.

 *

 * Doug Nazar

 * nazard@dragoninc.on.ca

 */

/*

 * 11/11/2002 - Fixed problem when decoding LDAP with desegmentation enabled and the

 *              ASN.1 BER Universal Class Tag: "Sequence Of" header is encapsulated across 2

 *              TCP segments.

 *

 * Ronald W. Henderson

 * ronald.henderson@cognicaseusa.com

 */

/*

 * 20-JAN-2004 - added decoding of MS-CLDAP netlogon RPC

 *               using information from the SNIA 2003 conference paper :

 *               Active Directory Domain Controller Location Service

 *                    by Anthony Liguori

 * ronnie sahlberg

 */

/*

 * 17-DEC-2004 - added basic decoding for LDAP Controls

 * 20-DEC-2004 - added handling for GSS-API encrypted blobs

 *

 * Stefan Metzmacher <metze@samba.org>

 *

 * 15-NOV-2005 - Changed to use the asn2wrs compiler

 * Anders Broman <anders.broman@ericsson.com>

 */

/*

 * 3-AUG-2008 - Extended the cldap support to include all netlogon data types.

 *              Updated cldap_netlogon_flags to include Windows 2008 flags

 *              Expanded the ntver ldap option with bit field

 *

 * Gary Reynolds <gazzadownunder@yahoo.co.uk>

 */

/*

 * 09-DEC-2009 - Added support for RFC4533

 *               Content Synchronization Operation (aka syncrepl)

 * 11-DEC-2009 - Added support for IntermediateResponse (LDAP v3 from RFC 4511)

 * Mathieu Parent <math.parent@gmail.com>

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/exceptions.h>

#include <epan/conversation.h>

#include <epan/prefs.h>

#include <epan/tap.h>

#include <epan/srt_table.h>

#include <epan/oids.h>

#include <epan/strutil.h>

#include <epan/show_exception.h>

#include <epan/asn1.h>

#include <epan/proto_data.h>

#include <epan/expert.h>

#include <epan/uat.h>

#include <epan/charsets.h>

#include <epan/tfs.h>

#include <wsutil/str_util.h>

#include <wsutil/array.h>

#include "packet-frame.h"

#include "packet-tcp.h"

#include "packet-windows-common.h"

#include "packet-dcerpc.h"

#include "packet-ldap.h"

#include "packet-ntlmssp.h"

#include "packet-tls.h"

#include "packet-tls-utils.h"

#include "packet-gssapi.h"

#include "packet-acdr.h"

#include "packet-ber.h"

#include "packet-per.h"

#include "packet-dns.h"

void proto_register_ldap(void);

void proto_reg_handoff_ldap(void);

/* Initialize the protocol and registered fields */

static int ldap_tap;

static int proto_ldap;

static int proto_cldap;

static int hf_ldap_sasl_buffer_length;

static int hf_ldap_response_in;

static int hf_ldap_response_to;

static int hf_ldap_time;

static int hf_ldap_guid;

static int hf_mscldap_ntver_flags;

static int hf_mscldap_ntver_flags_v1;

static int hf_mscldap_ntver_flags_v5;

static int hf_mscldap_ntver_flags_v5ex;

static int hf_mscldap_ntver_flags_v5ep;

static int hf_mscldap_ntver_flags_vcs;

static int hf_mscldap_ntver_flags_vnt4;

static int hf_mscldap_ntver_flags_vpdc;

static int hf_mscldap_ntver_flags_vip;

static int hf_mscldap_ntver_flags_vl;

static int hf_mscldap_ntver_flags_vgc;

static int hf_mscldap_netlogon_ipaddress_family;

static int hf_mscldap_netlogon_ipaddress_port;

static int hf_mscldap_netlogon_ipaddress;

static int hf_mscldap_netlogon_ipaddress_ipv4;

static int hf_mscldap_netlogon_ipaddress_zero;

static int hf_mscldap_netlogon_opcode;

static int hf_mscldap_netlogon_flags;

static int hf_mscldap_netlogon_flags_pdc;

static int hf_mscldap_netlogon_flags_gc;

static int hf_mscldap_netlogon_flags_ldap;

static int hf_mscldap_netlogon_flags_ds;

static int hf_mscldap_netlogon_flags_kdc;

static int hf_mscldap_netlogon_flags_timeserv;

static int hf_mscldap_netlogon_flags_closest;

static int hf_mscldap_netlogon_flags_writable;

static int hf_mscldap_netlogon_flags_good_timeserv;

static int hf_mscldap_netlogon_flags_ndnc;

static int hf_mscldap_netlogon_flags_fnc;

static int hf_mscldap_netlogon_flags_dnc;

static int hf_mscldap_netlogon_flags_dns;

static int hf_mscldap_netlogon_flags_wdc;

static int hf_mscldap_netlogon_flags_rodc;

static int hf_mscldap_domain_guid;

static int hf_mscldap_forest;

static int hf_mscldap_domain;

static int hf_mscldap_hostname;

static int hf_mscldap_nb_domain_z;

static int hf_mscldap_nb_domain;

static int hf_mscldap_nb_hostname_z;

static int hf_mscldap_nb_hostname;

static int hf_mscldap_username_z;

static int hf_mscldap_username;

static int hf_mscldap_sitename;

static int hf_mscldap_clientsitename;

static int hf_mscldap_nextclosestsitename;

static int hf_mscldap_netlogon_lm_token;

static int hf_mscldap_netlogon_nt_token;

static int hf_ldap_sid;

static int hf_ldap_AccessMask_ADS_CREATE_CHILD;

static int hf_ldap_AccessMask_ADS_DELETE_CHILD;

static int hf_ldap_AccessMask_ADS_LIST;

static int hf_ldap_AccessMask_ADS_SELF_WRITE;

static int hf_ldap_AccessMask_ADS_READ_PROP;

static int hf_ldap_AccessMask_ADS_WRITE_PROP;

static int hf_ldap_AccessMask_ADS_DELETE_TREE;

static int hf_ldap_AccessMask_ADS_LIST_OBJECT;

static int hf_ldap_AccessMask_ADS_CONTROL_ACCESS;

static int hf_ldap_LDAPMessage_PDU;

static int hf_ldap_object_security_flag;

static int hf_ldap_ancestor_first_flag;

static int hf_ldap_public_data_only_flag;

static int hf_ldap_incremental_value_flag;

static int hf_ldap_oid;

static int hf_ldap_gssapi_encrypted_payload;

static int hf_ldap_SearchControlValue_PDU;        /* SearchControlValue */

static int hf_ldap_SortKeyList_PDU;               /* SortKeyList */

static int hf_ldap_SortResult_PDU;                /* SortResult */

static int hf_ldap_DirSyncControlValue_PDU;       /* DirSyncControlValue */

static int hf_ldap_PasswdModifyRequestValue_PDU;  /* PasswdModifyRequestValue */

static int hf_ldap_CancelRequestValue_PDU;        /* CancelRequestValue */

static int hf_ldap_SyncRequestValue_PDU;          /* SyncRequestValue */

static int hf_ldap_SyncStateValue_PDU;            /* SyncStateValue */

static int hf_ldap_SyncDoneValue_PDU;             /* SyncDoneValue */

static int hf_ldap_SyncInfoValue_PDU;             /* SyncInfoValue */

static int hf_ldap_PasswordPolicyResponseValue_PDU;  /* PasswordPolicyResponseValue */

static int hf_ldap_messageID;                     /* MessageID */

static int hf_ldap_protocolOp;                    /* ProtocolOp */

static int hf_ldap_controls;                      /* Controls */

static int hf_ldap_bindRequest;                   /* BindRequest */

static int hf_ldap_bindResponse;                  /* BindResponse */

static int hf_ldap_unbindRequest;                 /* UnbindRequest */

static int hf_ldap_searchRequest;                 /* SearchRequest */

static int hf_ldap_searchResEntry;                /* SearchResultEntry */

static int hf_ldap_searchResDone;                 /* SearchResultDone */

static int hf_ldap_searchResRef;                  /* SearchResultReference */

static int hf_ldap_modifyRequest;                 /* ModifyRequest */

static int hf_ldap_modifyResponse;                /* ModifyResponse */

static int hf_ldap_addRequest;                    /* AddRequest */

static int hf_ldap_addResponse;                   /* AddResponse */

static int hf_ldap_delRequest;                    /* DelRequest */

static int hf_ldap_delResponse;                   /* DelResponse */

static int hf_ldap_modDNRequest;                  /* ModifyDNRequest */

static int hf_ldap_modDNResponse;                 /* ModifyDNResponse */

static int hf_ldap_compareRequest;                /* CompareRequest */

static int hf_ldap_compareResponse;               /* CompareResponse */

static int hf_ldap_abandonRequest;                /* AbandonRequest */

static int hf_ldap_extendedReq;                   /* ExtendedRequest */

static int hf_ldap_extendedResp;                  /* ExtendedResponse */

static int hf_ldap_intermediateResponse;          /* IntermediateResponse */

static int hf_ldap_AttributeDescriptionList_item;  /* AttributeDescription */

static int hf_ldap_attributeDesc;                 /* AttributeDescription */

static int hf_ldap_assertionValue;                /* AssertionValue */

static int hf_ldap_type;                          /* AttributeDescription */

static int hf_ldap_vals;                          /* SET_OF_AttributeValue */

static int hf_ldap_vals_item;                     /* AttributeValue */

static int hf_ldap_resultCode;                    /* T_resultCode */

static int hf_ldap_matchedDN;                     /* LDAPDN */

static int hf_ldap_errorMessage;                  /* ErrorMessage */

static int hf_ldap_referral;                      /* Referral */

static int hf_ldap_Referral_item;                 /* LDAPURL */

static int hf_ldap_Controls_item;                 /* Control */

static int hf_ldap_controlType;                   /* ControlType */

static int hf_ldap_criticality;                   /* BOOLEAN */

static int hf_ldap_controlValue;                  /* T_controlValue */

static int hf_ldap_version;                       /* INTEGER_1_127 */

static int hf_ldap_name;                          /* LDAPDN */

static int hf_ldap_authentication;                /* AuthenticationChoice */

static int hf_ldap_simple;                        /* Simple */

static int hf_ldap_sasl;                          /* SaslCredentials */

static int hf_ldap_ntlmsspNegotiate;              /* T_ntlmsspNegotiate */

static int hf_ldap_ntlmsspAuth;                   /* T_ntlmsspAuth */

static int hf_ldap_mechanism;                     /* Mechanism */

static int hf_ldap_credentials;                   /* Credentials */

static int hf_ldap_bindResponse_resultCode;       /* BindResponse_resultCode */

static int hf_ldap_bindResponse_matchedDN;        /* T_bindResponse_matchedDN */

static int hf_ldap_serverSaslCreds;               /* ServerSaslCreds */

static int hf_ldap_baseObject;                    /* LDAPDN */

static int hf_ldap_scope;                         /* T_scope */

static int hf_ldap_derefAliases;                  /* T_derefAliases */

static int hf_ldap_sizeLimit;                     /* INTEGER_0_maxInt */

static int hf_ldap_timeLimit;                     /* INTEGER_0_maxInt */

static int hf_ldap_typesOnly;                     /* BOOLEAN */

static int hf_ldap_filter;                        /* T_filter */

static int hf_ldap_searchRequest_attributes;      /* AttributeDescriptionList */

static int hf_ldap_and;                           /* T_and */

static int hf_ldap_and_item;                      /* T_and_item */

static int hf_ldap_or;                            /* T_or */

static int hf_ldap_or_item;                       /* T_or_item */

static int hf_ldap_not;                           /* T_not */

static int hf_ldap_equalityMatch;                 /* T_equalityMatch */

static int hf_ldap_substrings;                    /* SubstringFilter */

static int hf_ldap_greaterOrEqual;                /* T_greaterOrEqual */

static int hf_ldap_lessOrEqual;                   /* T_lessOrEqual */

static int hf_ldap_present;                       /* T_present */

static int hf_ldap_approxMatch;                   /* T_approxMatch */

static int hf_ldap_extensibleMatch;               /* T_extensibleMatch */

static int hf_ldap_substringFilter_substrings;    /* T_substringFilter_substrings */

static int hf_ldap_substringFilter_substrings_item;  /* T_substringFilter_substrings_item */

static int hf_ldap_initial;                       /* LDAPString */

static int hf_ldap_any;                           /* LDAPString */

static int hf_ldap_final;                         /* LDAPString */

static int hf_ldap_matchingRule;                  /* MatchingRuleId */

static int hf_ldap_matchValue;                    /* AssertionValue */

static int hf_ldap_dnAttributes;                  /* T_dnAttributes */

static int hf_ldap_objectName;                    /* LDAPDN */

static int hf_ldap_searchResultEntry_attributes;  /* PartialAttributeList */

static int hf_ldap_PartialAttributeList_item;     /* PartialAttributeList_item */

static int hf_ldap__untag_item;                   /* LDAPURL */

static int hf_ldap_object;                        /* LDAPDN */

static int hf_ldap_modifyRequest_modification;    /* ModifyRequest_modification */

static int hf_ldap_modifyRequest_modification_item;  /* T_modifyRequest_modification_item */

static int hf_ldap_operation;                     /* T_operation */

static int hf_ldap_modification;                  /* AttributeTypeAndValues */

static int hf_ldap_entry;                         /* LDAPDN */

static int hf_ldap_attributes;                    /* AttributeList */

static int hf_ldap_AttributeList_item;            /* AttributeList_item */

static int hf_ldap_newrdn;                        /* RelativeLDAPDN */

static int hf_ldap_deleteoldrdn;                  /* BOOLEAN */

static int hf_ldap_newSuperior;                   /* LDAPDN */

static int hf_ldap_ava;                           /* AttributeValueAssertion */

static int hf_ldap_requestName;                   /* LDAPOID */

static int hf_ldap_requestValue;                  /* T_requestValue */

static int hf_ldap_extendedResponse_resultCode;   /* ExtendedResponse_resultCode */

static int hf_ldap_responseName;                  /* ResponseName */

static int hf_ldap_response;                      /* OCTET_STRING */

static int hf_ldap_intermediateResponse_responseValue;  /* T_intermediateResponse_responseValue */

static int hf_ldap_size;                          /* INTEGER */

static int hf_ldap_cookie;                        /* OCTET_STRING */

static int hf_ldap_SortKeyList_item;              /* SortKeyList_item */

static int hf_ldap_attributeType;                 /* AttributeDescription */

static int hf_ldap_orderingRule;                  /* MatchingRuleId */

static int hf_ldap_reverseOrder;                  /* BOOLEAN */

static int hf_ldap_sortResult;                    /* T_sortResult */

static int hf_ldap_flags;                         /* DirSyncFlags */

static int hf_ldap_maxBytes;                      /* INTEGER */

static int hf_ldap_userIdentity;                  /* OCTET_STRING */

static int hf_ldap_oldPasswd;                     /* OCTET_STRING */

static int hf_ldap_newPasswd;                     /* OCTET_STRING */

static int hf_ldap_cancelID;                      /* MessageID */

static int hf_ldap_mode;                          /* T_mode */

static int hf_ldap_reloadHint;                    /* BOOLEAN */

static int hf_ldap_state;                         /* T_state */

static int hf_ldap_entryUUID;                     /* SyncUUID */

static int hf_ldap_refreshDeletes;                /* BOOLEAN */

static int hf_ldap_newcookie;                     /* OCTET_STRING */

static int hf_ldap_refreshDelete;                 /* T_refreshDelete */

static int hf_ldap_refreshDone;                   /* BOOLEAN */

static int hf_ldap_refreshPresent;                /* T_refreshPresent */

static int hf_ldap_syncIdSet;                     /* T_syncIdSet */

static int hf_ldap_syncUUIDs;                     /* SET_OF_SyncUUID */

static int hf_ldap_syncUUIDs_item;                /* SyncUUID */

static int hf_ldap_warning;                       /* T_warning */

static int hf_ldap_timeBeforeExpiration;          /* INTEGER_0_maxInt */

static int hf_ldap_graceAuthNsRemaining;          /* INTEGER_0_maxInt */

static int hf_ldap_error;                         /* T_error */

/* Initialize the subtree pointers */

static int ett_ldap;

static int ett_ldap_msg;

static int ett_ldap_sasl_blob;

static int ett_ldap_payload;

static int ett_mscldap_netlogon_flags;

static int ett_mscldap_ntver_flags;

static int ett_mscldap_ipdetails;

static int ett_ldap_DirSyncFlagsSubEntry;

static int ett_ldap_LDAPMessage;

static int ett_ldap_ProtocolOp;

static int ett_ldap_AttributeDescriptionList;

static int ett_ldap_AttributeValueAssertion;

static int ett_ldap_Attribute;

static int ett_ldap_SET_OF_AttributeValue;

static int ett_ldap_LDAPResult;

static int ett_ldap_Referral;

static int ett_ldap_Controls;

static int ett_ldap_Control;

static int ett_ldap_BindRequest_U;

static int ett_ldap_AuthenticationChoice;

static int ett_ldap_SaslCredentials;

static int ett_ldap_BindResponse_U;

static int ett_ldap_SearchRequest_U;

static int ett_ldap_Filter;

static int ett_ldap_T_and;

static int ett_ldap_T_or;

static int ett_ldap_SubstringFilter;

static int ett_ldap_T_substringFilter_substrings;

static int ett_ldap_T_substringFilter_substrings_item;

static int ett_ldap_MatchingRuleAssertion;

static int ett_ldap_SearchResultEntry_U;

static int ett_ldap_PartialAttributeList;

static int ett_ldap_PartialAttributeList_item;

static int ett_ldap_SEQUENCE_OF_LDAPURL;

static int ett_ldap_ModifyRequest_U;

static int ett_ldap_ModifyRequest_modification;

static int ett_ldap_T_modifyRequest_modification_item;

static int ett_ldap_AttributeTypeAndValues;

static int ett_ldap_AddRequest_U;

static int ett_ldap_AttributeList;

static int ett_ldap_AttributeList_item;

static int ett_ldap_ModifyDNRequest_U;

static int ett_ldap_CompareRequest_U;

static int ett_ldap_ExtendedRequest_U;

static int ett_ldap_ExtendedResponse_U;

static int ett_ldap_IntermediateResponse_U;

static int ett_ldap_SearchControlValue;

static int ett_ldap_SortKeyList;

static int ett_ldap_SortKeyList_item;

static int ett_ldap_SortResult;

static int ett_ldap_DirSyncControlValue;

static int ett_ldap_PasswdModifyRequestValue;

static int ett_ldap_CancelRequestValue;

static int ett_ldap_SyncRequestValue;

static int ett_ldap_SyncStateValue;

static int ett_ldap_SyncDoneValue;

static int ett_ldap_SyncInfoValue;

static int ett_ldap_T_refreshDelete;

static int ett_ldap_T_refreshPresent;

static int ett_ldap_T_syncIdSet;

static int ett_ldap_SET_OF_SyncUUID;

static int ett_ldap_PasswordPolicyResponseValue;

static int ett_ldap_T_warning;

static expert_field ei_ldap_exceeded_filter_length;

static expert_field ei_ldap_too_many_filter_elements;

static dissector_table_t ldap_name_dissector_table;

static const char *object_identifier_id; /* LDAP OID */

static bool do_protocolop;

static char     *attr_type;

static bool is_binary_attr_type;

static bool ldap_found_in_frame;

#define TCP_PORT_RANGE_LDAP             "389,3268" /* 3268 is Windows 2000 Global Catalog */

#define TCP_PORT_LDAPS                  636

#define UDP_PORT_CLDAP                  389

/* desegmentation of LDAP */

static bool ldap_desegment = true;

static unsigned global_ldaps_tcp_port = TCP_PORT_LDAPS;

static unsigned ssl_port;

static dissector_handle_t gssapi_handle;

static dissector_handle_t gssapi_wrap_handle;

static dissector_handle_t ntlmssp_handle;

static dissector_handle_t spnego_handle;

static dissector_handle_t tls_handle;

static dissector_handle_t ldap_handle;

static dissector_handle_t cldap_handle;

static void prefs_register_ldap(void); /* forward declaration for use in preferences registration */

/* different types of rpc calls on top of ms cldap */

#define MSCLDAP_RPC_NETLOGON  1

/* Message type Choice values */

static const value_string ldap_ProtocolOp_choice_vals[] = {

  {   0, "bindRequest" },

  {   1, "bindResponse" },

  {   2, "unbindRequest" },

  {   3, "searchRequest" },

  {   4, "searchResEntry" },

  {   5, "searchResDone" },

  {   6, "searchResRef" },

  {   7, "modifyRequest" },

  {   8, "modifyResponse" },

  {   9, "addRequest" },

  {  10, "addResponse" },

  {  11, "delRequest" },

  {  12, "delResponse" },

  {  13, "modDNRequest" },

  {  14, "modDNResponse" },

  {  15, "compareRequest" },

  {  16, "compareResponse" },

  {  17, "abandonRequest" },

  {  18, "extendedReq" },

  {  19, "extendedResp" },

  {  20, "intermediateResponse" },

  { 0, NULL }

};

/* Procedure names (used in Service Response Time */

const value_string ldap_procedure_names[] = {

  {   0, "Bind" },

  {   3, "Search" },

  {   6, "Modify" },

  {   8, "Add" },

  {  10, "Delete" },

  {  12, "Modrdn" },

  {  14, "Compare" },

  {  23, "Extended" },

  { 0, NULL }

};

#define LOGON_PRIMARY_QUERY             7

#define LOGON_PRIMARY_RESPONSE         12

#define LOGON_SAM_LOGON_REQUEST        18

#define LOGON_SAM_LOGON_RESPONSE       19

#define LOGON_SAM_PAUSE_RESPONSE       20

#define LOGON_SAM_USER_UNKNOWN         21

#define LOGON_SAM_LOGON_RESPONSE_EX    23

#define LOGON_SAM_PAUSE_RESPONSE_EX    24

#define LOGON_SAM_USER_UNKNOWN_EX      25

static const value_string netlogon_opcode_vals[] = {

  { LOGON_PRIMARY_QUERY,         "LOGON_PRIMARY_QUERY" },

  { LOGON_PRIMARY_RESPONSE,      "LOGON_PRIMARY_RESPONSE" },

  { LOGON_SAM_LOGON_REQUEST,     "LOGON_SAM_LOGON_REQUEST" },

  { LOGON_SAM_LOGON_RESPONSE,    "LOGON_SAM_LOGON_RESPONSE" },

  { LOGON_SAM_PAUSE_RESPONSE,    "LOGON_SAM_PAUSE_RESPONSE" },

  { LOGON_SAM_LOGON_RESPONSE_EX, "LOGON_SAM_LOGON_RESPONSE_EX" },

  { LOGON_SAM_PAUSE_RESPONSE_EX, "LOGON_SAM_PAUSE_RESPONSE_EX" },

  { LOGON_SAM_USER_UNKNOWN_EX,   "LOGON_SAM_USER_UNKNOWN_EX" },

  { 0, NULL }

};

#define LDAP_NUM_PROCEDURES     24

static void

ldapstat_init(struct register_srt* srt _U_, GArray* srt_array)

{

  srt_stat_table *ldap_srt_table;

  uint32_t i;

  ldap_srt_table = init_srt_table("LDAP Commands", NULL, srt_array, LDAP_NUM_PROCEDURES, NULL, "ldap.protocolOp", NULL);

  for (i = 0; i < LDAP_NUM_PROCEDURES; i++)

  {

    init_srt_table_row(ldap_srt_table, i, val_to_str_const(i, ldap_procedure_names, "<unknown>"));

  }

}

static tap_packet_status

ldapstat_packet(void *pldap, packet_info *pinfo, epan_dissect_t *edt _U_, const void *psi, tap_flags_t flags _U_)

{

  unsigned i = 0;

  srt_stat_table *ldap_srt_table;

  const ldap_call_response_t *ldap=(const ldap_call_response_t *)psi;

  srt_data_t *data = (srt_data_t *)pldap;

  /* we are only interested in reply packets */

  if(ldap->is_request){

    return TAP_PACKET_DONT_REDRAW;

  }

  /* if we haven't seen the request, just ignore it */

  if(!ldap->req_frame){

    return TAP_PACKET_DONT_REDRAW;

  }

  /* only use the commands we know how to handle */

  switch(ldap->protocolOpTag){

  case LDAP_REQ_BIND:

  case LDAP_REQ_SEARCH:

  case LDAP_REQ_MODIFY:

  case LDAP_REQ_ADD:

  case LDAP_REQ_DELETE:

  case LDAP_REQ_MODRDN:

  case LDAP_REQ_COMPARE:

  case LDAP_REQ_EXTENDED:

    break;

  default:

    return TAP_PACKET_DONT_REDRAW;

  }

  ldap_srt_table = g_array_index(data->srt_array, srt_stat_table*, i);

  add_srt_table_data(ldap_srt_table, ldap->protocolOpTag, &ldap->req_time, pinfo);

  return TAP_PACKET_REDRAW;

}

/*

 * Data structure attached to a conversation, giving authentication

 * information from a bind request.

 */

typedef struct ldap_conv_info_t {

  unsigned auth_type;    /* authentication type */

  char *auth_mech;    /* authentication mechanism */

  uint32_t first_auth_frame;  /* first frame that would use a security layer */

  wmem_map_t *unmatched;

  wmem_map_t *matched;

  bool is_mscldap;

  uint32_t num_results;

  bool start_tls_pending;

  uint32_t start_tls_frame;

} ldap_conv_info_t;

static unsigned

ldap_info_hash_matched(const void *k)

{

  const ldap_call_response_t *key = (const ldap_call_response_t *)k;

  return key->messageId;

}

static int

ldap_info_equal_matched(const void *k1, const void *k2)

{

  const ldap_call_response_t *key1 = (const ldap_call_response_t*)k1;

  const ldap_call_response_t *key2 = (const ldap_call_response_t*)k2;

  if( key1->req_frame && key2->req_frame && (key1->req_frame!=key2->req_frame) ){

    return 0;

  }

  /* a response may span multiple frames

  if( key1->rep_frame && key2->rep_frame && (key1->rep_frame!=key2->rep_frame) ){

    return 0;

  }

  */

  return key1->messageId==key2->messageId;

}

static unsigned

ldap_info_hash_unmatched(const void *k)

{

  const ldap_call_response_t *key = (const ldap_call_response_t*)k;

  return key->messageId;

}

static int

ldap_info_equal_unmatched(const void *k1, const void *k2)

{

  const ldap_call_response_t *key1 = (const ldap_call_response_t*)k1;

  const ldap_call_response_t *key2 = (const ldap_call_response_t*)k2;

  return key1->messageId==key2->messageId;

}

/* These are the NtVer flags from MS-ADTS section 6.3.1.1

 * https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts

 */

static const true_false_string tfs_ntver_v1 = {

  "Client requested version 1 netlogon response",

  "Version 1 netlogon response not requested"

};

static const true_false_string tfs_ntver_v5 = {

  "Client requested version 5 netlogon response",

  "Version 5 netlogon response not requested"

};

static const true_false_string tfs_ntver_v5ex = {

  "Client requested version 5 extended netlogon response",

  "Version 5 extended response not requested"

};

static const true_false_string tfs_ntver_v5ep = {

  "Client has requested IP address of the server",

  "IP address of server not requested"

};

static const true_false_string tfs_ntver_vcs = {

  "Client has asked for the closest site information",

  "Closest site information not requested"

};

static const true_false_string tfs_ntver_vnt4 = {

  "Client is requesting server to avoid NT4 emulation",

  "Only full AD DS requested"

};

static const true_false_string tfs_ntver_vpdc = {

  "Client has requested the Primary Domain Controller",

  "Primary Domain Controller not requested"

};

static const true_false_string tfs_ntver_vip = {

  "Client has requested IP details (obsolete)",

  "IP details not requested (obsolete)"

};

static const true_false_string tfs_ntver_vl = {

  "Client indicated that it is the local machine",

  "Client is not the local machine"

};static const true_false_string tfs_ntver_vgc = {

  "Client has requested a Global Catalog server",

  "Global Catalog not requested"

};

/* Stuff for generation/handling of fields for custom AttributeValues */

typedef struct _attribute_type_t {

  char* attribute_type;

  char* attribute_desc;

} attribute_type_t;

static attribute_type_t* attribute_types;

static unsigned num_attribute_types;

static GHashTable* attribute_types_hash;

static hf_register_info* dynamic_hf;

static unsigned dynamic_hf_size;

static bool

attribute_types_update_cb(void *r, char **err)

{

  attribute_type_t *rec = (attribute_type_t *)r;

  char c;

  if (rec->attribute_type == NULL) {

    *err = g_strdup("Attribute type can't be empty");

    return false;

  }

  g_strstrip(rec->attribute_type);

  if (rec->attribute_type[0] == 0) {

    *err = g_strdup("Attribute type can't be empty");

    return false;

  }

  /* Check for invalid characters (to avoid asserting out when

   * registering the field).

   */

  c = proto_check_field_name(rec->attribute_type);

  if (c) {

    *err = ws_strdup_printf("Attribute type can't contain '%c'", c);

    return false;

  }

  *err = NULL;

  return true;

}

static void *

attribute_types_copy_cb(void* n, const void* o, size_t siz _U_)

{

  attribute_type_t* new_rec = (attribute_type_t*)n;

  const attribute_type_t* old_rec = (const attribute_type_t*)o;

  new_rec->attribute_type = g_strdup(old_rec->attribute_type);

  new_rec->attribute_desc = g_strdup(old_rec->attribute_desc);

  return new_rec;

}

static void

attribute_types_free_cb(void*r)

{

  attribute_type_t* rec = (attribute_type_t*)r;

  g_free(rec->attribute_type);

  g_free(rec->attribute_desc);

}

UAT_CSTRING_CB_DEF(attribute_types, attribute_type, attribute_type_t)

UAT_CSTRING_CB_DEF(attribute_types, attribute_desc, attribute_type_t)

/*

 *

 */

static int*

get_hf_for_header(char* attribute_type)

{

  int* hf_id = NULL;

  if (attribute_types_hash && attribute_type) {

    hf_id = (int*) g_hash_table_lookup(attribute_types_hash, attribute_type);

  } else {

    hf_id = NULL;

  }

  return hf_id;

}

/*

 *

 */

static void

deregister_attribute_types(void)

{

  if (dynamic_hf) {

    /* Deregister all fields */

    for (unsigned i = 0; i < dynamic_hf_size; i++) {

      proto_deregister_field (proto_ldap, *(dynamic_hf[i].p_id));

      g_free (dynamic_hf[i].p_id);

    }

    proto_add_deregistered_data (dynamic_hf);

    dynamic_hf = NULL;

    dynamic_hf_size = 0;

  }

  if (attribute_types_hash) {

    g_hash_table_destroy (attribute_types_hash);

    attribute_types_hash = NULL;

  }

}

static void

attribute_types_post_update_cb(void)

{

  int* hf_id;

  char* attribute_type;

  deregister_attribute_types();

  if (num_attribute_types) {

    attribute_types_hash = g_hash_table_new(g_str_hash, g_str_equal);

    dynamic_hf = g_new0(hf_register_info,num_attribute_types);

    dynamic_hf_size = num_attribute_types;

    for (unsigned i = 0; i < dynamic_hf_size; i++) {

      hf_id = g_new(int,1);

      *hf_id = -1;

      attribute_type = g_strdup(attribute_types[i].attribute_type);

      dynamic_hf[i].p_id = hf_id;

      dynamic_hf[i].hfinfo.name = attribute_type;

      dynamic_hf[i].hfinfo.abbrev = ws_strdup_printf("ldap.AttributeValue.%s", attribute_type);

      dynamic_hf[i].hfinfo.type = FT_STRING;

      dynamic_hf[i].hfinfo.display = BASE_NONE;

      dynamic_hf[i].hfinfo.strings = NULL;

      dynamic_hf[i].hfinfo.bitmask = 0;

      dynamic_hf[i].hfinfo.blurb = g_strdup(attribute_types[i].attribute_desc);

      HFILL_INIT(dynamic_hf[i]);

      g_hash_table_insert(attribute_types_hash, attribute_type, hf_id);

    }

    proto_register_field_array(proto_ldap, dynamic_hf, dynamic_hf_size);

  }

}

static void

attribute_types_reset_cb(void)

{

  deregister_attribute_types();

}

/* MS-ADTS specification, section 6.3.1.1, NETLOGON_NT_VERSION Options Bits */

static int dissect_mscldap_ntver_flags(proto_tree *parent_tree, tvbuff_t *tvb, int offset)

{

  static int * const flags[] = {

    &hf_mscldap_ntver_flags_v1,

    &hf_mscldap_ntver_flags_v5,

    &hf_mscldap_ntver_flags_v5ex,

    &hf_mscldap_ntver_flags_v5ep,

    &hf_mscldap_ntver_flags_vcs,

    &hf_mscldap_ntver_flags_vnt4,

    &hf_mscldap_ntver_flags_vpdc,

    &hf_mscldap_ntver_flags_vip,

    &hf_mscldap_ntver_flags_vl,

    &hf_mscldap_ntver_flags_vgc,

    NULL

  };

  proto_tree_add_bitmask_with_flags(parent_tree, tvb, offset, hf_mscldap_ntver_flags,

                           ett_mscldap_ntver_flags, flags, ENC_LITTLE_ENDIAN, BMT_NO_FALSE);

  offset += 4;

  return offset;

}

/* This string contains the last LDAPString that was decoded */

static const char *attributedesc_string;

/* This string contains the last AssertionValue that was decoded */

static char *ldapvalue_string;

/* if the octet string contain all printable ASCII characters, then

 * display it as a string, othervise just display it in hex.

 */

static unsigned

dissect_ldap_AssertionValue(bool implicit_tag, tvbuff_t *tvb, unsigned offset, asn1_ctx_t *actx, proto_tree *tree, int hf_index)

{

  int8_t ber_class;

  bool pc, ind, is_ascii;

  int32_t tag;

  uint32_t len;

  if(!implicit_tag){

    offset=get_ber_identifier(tvb, offset, &ber_class, &pc, &tag);

    offset=get_ber_length(tvb, offset, &len, &ind);

  } else {

    len=tvb_reported_length_remaining(tvb,offset);

  }

  if(len==0){

    return offset;

  }

  /*

   * Some special/wellknown attributes in common LDAP (read AD)

   * are neither ascii strings nor blobs of hex data.

   * Special case these attributes and decode them more nicely.

   *

   * Add more special cases as required to prettify further

   * (there can't be that many ones that are truly interesting)

   */

  if(attributedesc_string && !strncmp("DomainSid", attributedesc_string, 9)){

    tvbuff_t *sid_tvb;

    char *tmpstr;

    /* this octet string contains an NT SID */

    sid_tvb=tvb_new_subset_length(tvb, offset, len);

    dissect_nt_sid(sid_tvb, actx->pinfo, 0, tree, "SID", &tmpstr, hf_index);

    ldapvalue_string=tmpstr;

    goto finished;

  } else if ( (len==16) /* GUIDs are always 16 bytes */

  && (attributedesc_string && !strncmp("DomainGuid", attributedesc_string, 10))) {

    uint8_t drep[4] = { 0x10, 0x00, 0x00, 0x00}; /* fake DREP struct */

    e_guid_t uuid;

    /* This octet string contained a GUID */

    dissect_dcerpc_uuid_t(tvb, offset, actx->pinfo, tree, drep, hf_ldap_guid, &uuid);

    ldapvalue_string=(char*)wmem_alloc(actx->pinfo->pool, 1024);

    snprintf(ldapvalue_string, 1023, "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",

               uuid.data1, uuid.data2, uuid.data3, uuid.data4[0], uuid.data4[1],

               uuid.data4[2], uuid.data4[3], uuid.data4[4], uuid.data4[5],

               uuid.data4[6], uuid.data4[7]);

    goto finished;

  } else if (attributedesc_string && !strncmp("NtVer", attributedesc_string, 5)){

    uint32_t flags;

    len = 0;

    /* get flag value to populate ldapvalue_string */

    flags=tvb_get_letohl(tvb, offset);

    ldapvalue_string=(char*)wmem_alloc(actx->pinfo->pool, 1024);

    snprintf(ldapvalue_string, 1023, "0x%08x",flags);

    /* populate bitmask subtree */

    offset = dissect_mscldap_ntver_flags(tree, tvb, offset);

    goto finished;

  }

  /*

   * It was not one of our "wellknown" attributes so make the best

   * we can and just try to see if it is an ascii string or if it

   * is a binary blob.

   *

   * XXX - should we support reading RFC 2252-style schemas

   * for LDAP, and using that to determine how to display

   * attribute values and assertion values?

   *

   * -- I don't think there are full schemas available that describe the

   *  interesting cases i.e. AD -- ronnie

   */

  is_ascii=tvb_ascii_isprint(tvb, offset, len);

  /* convert the string into a printable string */

  if(is_ascii){

    ldapvalue_string= (char*)tvb_get_string_enc(actx->pinfo->pool, tvb, offset, len, ENC_UTF_8|ENC_NA);

  } else {

    ldapvalue_string= tvb_bytes_to_str_punct(actx->pinfo->pool, tvb, offset, len, ':');

  }

  proto_tree_add_string(tree, hf_index, tvb, offset, len, ldapvalue_string);

finished:

  offset+=len;

  return offset;

}

/* This string contains the last Filter item that was decoded */

static const char *Filter_string;

static const char *and_filter_string;

static const char *or_filter_string;

static const char *substring_value;

static const char *substring_item_init;

static const char *substring_item_any;

static const char *substring_item_final;

static const char *matching_rule_string;

static bool matching_rule_dnattr=false;

#define MAX_FILTER_LEN 4096

static int Filter_length;

#define MAX_FILTER_ELEMENTS 200

static int Filter_elements;

/* Global variables */

static unsigned MessageID;

static int ProtocolOp = -1;

static proto_item *ldm_tree; /* item to add text to */

static void ldap_do_protocolop(packet_info *pinfo)

{

  const char* valstr;

  if (do_protocolop) {

    valstr = val_to_str(pinfo->pool, ProtocolOp, ldap_ProtocolOp_choice_vals, "Unknown (%u)");

    col_append_fstr(pinfo->cinfo, COL_INFO, "%s(%u) ", valstr, MessageID);

    if(ldm_tree)

      proto_item_append_text(ldm_tree, " %s(%d)", valstr, MessageID);

    do_protocolop = false;

  }

}

static ldap_call_response_t *

ldap_match_call_response(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, unsigned messageId, unsigned protocolOpTag, ldap_conv_info_t *ldap_info)

{

  ldap_call_response_t lcr, *lcrp=NULL;

  /* first see if we have already matched this */

      lcr.messageId=messageId;

      switch(protocolOpTag){

        case LDAP_REQ_BIND:

        case LDAP_REQ_SEARCH:

        case LDAP_REQ_MODIFY:

        case LDAP_REQ_ADD:

        case LDAP_REQ_DELETE:

        case LDAP_REQ_MODRDN:

        case LDAP_REQ_COMPARE:

        case LDAP_REQ_EXTENDED:

          lcr.is_request=true;

          lcr.req_frame=pinfo->num;

          lcr.rep_frame=0;

          break;

        case LDAP_RES_BIND:

        case LDAP_RES_SEARCH_ENTRY:

        case LDAP_RES_SEARCH_REF:

        case LDAP_RES_SEARCH_RESULT:

        case LDAP_RES_MODIFY:

        case LDAP_RES_ADD:

        case LDAP_RES_DELETE:

        case LDAP_RES_MODRDN:

        case LDAP_RES_COMPARE:

        case LDAP_RES_EXTENDED:

        case LDAP_RES_INTERMEDIATE:

          lcr.is_request=false;

          lcr.req_frame=0;

          lcr.rep_frame=pinfo->num;

          break;

        default:

          return NULL;

      }

      lcrp=(ldap_call_response_t *)wmem_map_lookup(ldap_info->matched, &lcr);

      if(lcrp){

        lcrp->is_request=lcr.is_request;

      } else {

        /* we haven't found a match - try and match it up */

  switch(protocolOpTag){

      case LDAP_REQ_BIND:

      case LDAP_REQ_SEARCH:

      case LDAP_REQ_MODIFY:

      case LDAP_REQ_ADD:

      case LDAP_REQ_DELETE:

      case LDAP_REQ_MODRDN:

      case LDAP_REQ_COMPARE:

      case LDAP_REQ_EXTENDED:

        /* this is a request - add it to the unmatched list */

        /* check that we don't already have one of those in the

           unmatched list and if so remove it */

        lcr.messageId=messageId;

        lcrp=(ldap_call_response_t *)wmem_map_lookup(ldap_info->unmatched, &lcr);

        if(lcrp){

          wmem_map_remove(ldap_info->unmatched, lcrp);

        }

        /* if we can't reuse the old one, grab a new chunk */

        if(!lcrp){