Milestone 5: deliver embedded RDP sessions and lifecycle hardening
This commit is contained in:
Keith Smith
709
third_party/FreeRDP/tools/wireshark/rdp-udp.lua
vendored
Normal file
709
third_party/FreeRDP/tools/wireshark/rdp-udp.lua
vendored
Normal file
@@ -0,0 +1,709 @@
|
||||
--[[
|
||||
RDP UDP transport dissector for wireshark
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
||||
Copyright 2021 David Fort <contact@hardening-consulting.com>
|
||||
--]]
|
||||
|
||||
local sslDissector = Dissector.get ("tls")
|
||||
local dtlsDissector = Dissector.get ("dtls")
|
||||
|
||||
local dprint = function(...)
|
||||
print(table.concat({"Lua:", ...}," "))
|
||||
end
|
||||
|
||||
local dprint2 = dprint
|
||||
|
||||
dprint2("loading RDP-UDP with wireshark=", get_version())
|
||||
|
||||
local rdpudp = Proto("rdpudp", "UDP transport for RDP")
|
||||
|
||||
-- UDP1 fields
|
||||
local pf_udp_snSourceAck = ProtoField.uint32("rdpudp.snsourceack", "snSourceAck", base.HEX)
|
||||
local pf_udp_ReceiveWindowSize = ProtoField.uint16("rdpudp.receivewindowsize", "ReceiveWindowSize", base.DEC)
|
||||
local pf_udp_flags = ProtoField.uint16("rdpudp.flags", "Flags", base.HEX)
|
||||
|
||||
RDPUDP_SYN = 0x0001
|
||||
RDPUDP_FIN = 0x0002
|
||||
RDPUDP_ACK = 0x0004
|
||||
RDPUDP_DATA = 0x0008
|
||||
RDPUDP_FEC = 0x0010
|
||||
RDPUDP_CN = 0x0020
|
||||
RDPUDP_CWR = 0x0040
|
||||
RDPUDP_AOA = 0x0100
|
||||
RDPUDP_SYNLOSSY = 0x0200
|
||||
RDPUDP_ACKDELAYED = 0x0400
|
||||
RDPUDP_CORRELATIONID = 0x0800
|
||||
RDPUDP_SYNEX = 0x1000
|
||||
|
||||
local pf_udp_flag_syn = ProtoField.bool("rdpudp.flags.syn", "Syn", base.HEX, nil, RDPUDP_SYN)
|
||||
local pf_udp_flag_fin = ProtoField.bool("rdpudp.flags.fin", "Fin", base.HEX, nil, RDPUDP_FIN)
|
||||
local pf_udp_flag_ack = ProtoField.bool("rdpudp.flags.ack", "Ack", base.HEX, nil, RDPUDP_ACK)
|
||||
local pf_udp_flag_data = ProtoField.bool("rdpudp.flags.data", "Data", base.HEX, nil, RDPUDP_DATA)
|
||||
local pf_udp_flag_fec = ProtoField.bool("rdpudp.flags.fec", "FECData", base.HEX, nil, RDPUDP_FEC)
|
||||
local pf_udp_flag_cn = ProtoField.bool("rdpudp.flags.cn", "CN", base.HEX, nil, RDPUDP_CN)
|
||||
local pf_udp_flag_cwr = ProtoField.bool("rdpudp.flags.cwr", "CWR", base.HEX, nil, RDPUDP_CWR)
|
||||
local pf_udp_flag_aoa = ProtoField.bool("rdpudp.flags.aoa", "Ack of Acks", base.HEX, nil, RDPUDP_AOA)
|
||||
local pf_udp_flag_synlossy = ProtoField.bool("rdpudp.flags.synlossy", "Syn lossy", base.HEX, nil, RDPUDP_SYNLOSSY)
|
||||
local pf_udp_flag_ackdelayed = ProtoField.bool("rdpudp.flags.ackdelayed", "Ack delayed", base.HEX, nil, RDPUDP_ACKDELAYED)
|
||||
local pf_udp_flag_correlationId = ProtoField.bool("rdpudp.flags.correlationid", "Correlation id", base.HEX, nil, RDPUDP_CORRELATIONID)
|
||||
local pf_udp_flag_synex = ProtoField.bool("rdpudp.flags.synex", "SynEx", base.HEX, nil, RDPUDP_SYNEX)
|
||||
|
||||
local pf_udp_snInitialSequenceNumber = ProtoField.uint32("rdpudp.initialsequencenumber", "Initial SequenceNumber", base.HEX)
|
||||
local pf_udp_upstreamMtu = ProtoField.uint16("rdpudp.upstreammtu", "Upstream MTU", base.DEC)
|
||||
local pf_udp_downstreamMtu = ProtoField.uint16("rdpudp.downstreammtu", "DownStream MTU", base.DEC)
|
||||
|
||||
local pf_udp_correlationId = ProtoField.new("Correlation Id", "rdpudp.correlationid", ftypes.BYTES)
|
||||
|
||||
local pf_udp_synex_flags = ProtoField.uint16("rdpudp.synex.flags", "Flags", base.HEX)
|
||||
local pf_udp_synex_flag_version = ProtoField.bool("rdpudp.synex.flags.versioninfo", "Version info", base.HEX, nil, 0x0001)
|
||||
local pf_udp_synex_version = ProtoField.uint16("rdpudp.synex.version", "Version", base.HEX, {[1]="Version 1", [2]="Version 2", [0x101]="Version 3"})
|
||||
local pf_udp_synex_cookiehash = ProtoField.new("Cookie Hash", "rdpudp.synex.cookiehash", ftypes.BYTES)
|
||||
|
||||
local pf_udp_ack_vectorsize = ProtoField.uint16("rdpudp.ack.vectorsize", "uAckVectorSize", base.DEC)
|
||||
local pf_udp_ack_item = ProtoField.uint8("rdpudp.ack.item", "Ack item", base.HEX)
|
||||
local pf_udp_ack_item_state = ProtoField.uint8("rdpudp.ack.item.state", "VECTOR_ELEMENT_STATE", base.HEX, {[0]="Received", [1]="Reserved 1", [2]="Reserved 2", [3]="Pending"}, 0xc0)
|
||||
local pf_udp_ack_item_rle = ProtoField.uint8("rdpudp.ack.item.rle", "Run length", base.DEC, nil, 0x3f)
|
||||
|
||||
local pf_udp_fec_coded = ProtoField.uint32("rdpudp.fec.coded", "snCoded", base.HEX)
|
||||
local pf_udp_fec_sourcestart = ProtoField.uint32("rdpudp.fec.sourcestart", "snSourceStart", base.HEX)
|
||||
local pf_udp_fec_range = ProtoField.uint8("rdpudp.fec.range", "Range", base.DEC)
|
||||
local pf_udp_fec_fecindex = ProtoField.uint8("rdpudp.fec.fecindex", "Fec index", base.HEX)
|
||||
|
||||
local pf_udp_resetseqenum = ProtoField.uint32("rdpudp.resetSeqNum", "snResetSeqNum", base.HEX)
|
||||
|
||||
local pf_udp_source_sncoded = ProtoField.uint32("rdpudp.data.sncoded", "snCoded", base.HEX)
|
||||
local pf_udp_source_snSourceStart = ProtoField.uint32("rdpudp.data.sourceStart", "snSourceStart", base.HEX)
|
||||
|
||||
|
||||
-- UDP2 fields
|
||||
local pf_PacketPrefixByte = ProtoField.new("PacketPrefixByte", "rdpudp2.prefixbyte", ftypes.UINT8, nil, base.HEX)
|
||||
|
||||
local pf_packetType = ProtoField.uint8("rdpudp2.packetType", "PacketType", base.HEX, {[0] = "Data", [8] = "Dummy"}, 0x1e, "type of packet")
|
||||
|
||||
RDPUDP2_ACK = 0x0001
|
||||
RDPUDP2_DATA = 0x0004
|
||||
RDPUDP2_ACKVEC = 0x0008
|
||||
RDPUDP2_AOA = 0x0010
|
||||
RDPUDP2_OVERHEAD = 0x0040
|
||||
RDPUDP2_DELAYACK = 0x00100
|
||||
|
||||
local pf_flags = ProtoField.uint16("rdpudp2.flags", "Flags", base.HEX, nil, 0xfff, "flags")
|
||||
local pf_flag_ack = ProtoField.bool("rdpudp2.flags.ack", "Ack", base.HEX, nil, RDPUDP2_ACK, "packet contains Ack payload")
|
||||
local pf_flag_data = ProtoField.bool("rdpudp2.flags.data", "Data", base.HEX, nil, RDPUDP2_DATA, "packet contains Data payload")
|
||||
local pf_flag_ackvec = ProtoField.bool("rdpudp2.flags.ackvec", "AckVec", base.HEX, nil, RDPUDP2_ACKVEC, "packet contains AckVec payload")
|
||||
local pf_flag_aoa = ProtoField.bool("rdpudp2.flags.ackofacks", "AckOfAcks", base.HEX, nil, RDPUDP2_AOA, "packet contains AckOfAcks payload")
|
||||
local pf_flag_overhead = ProtoField.bool("rdpudp2.flags.overheadsize", "OverheadSize", base.HEX, nil, RDPUDP2_OVERHEAD, "packet contains OverheadSize payload")
|
||||
local pf_flag_delayackinfo = ProtoField.bool("rdpudp2.flags.delayackinfo", "DelayedAckInfo", base.HEX, nil, RDPUDP2_DELAYACK, "packet contains DelayedAckInfo payload")
|
||||
|
||||
local pf_logWindow = ProtoField.uint16("rdpudp2.logWindow", "LogWindow", base.DEC, nil, 0xf000, "flags")
|
||||
|
||||
local pf_AckSeq = ProtoField.uint16("rdpudp2.ack.seqnum", "Base Seq", base.HEX)
|
||||
local pf_AckTs = ProtoField.uint24("rdpudp2.ack.ts", "receivedTS", base.DEC)
|
||||
local pf_AckSendTimeGap = ProtoField.uint8("rdpudp2.ack.sendTimeGap", "sendTimeGap", base.DEC)
|
||||
local pf_ndelayedAcks = ProtoField.uint8("rdpudp2.ack.numDelayedAcks", "NumDelayedAcks", base.DEC, nil, 0x0f)
|
||||
local pf_delayedTimeScale = ProtoField.uint8("rdpudp2.ack.delayedTimeScale", "delayedTimeScale", base.DEC, nil, 0xf0)
|
||||
local pf_delayedAcks = ProtoField.new("Delayed acks", "rdpudp2.ack.delayedAcks", ftypes.BYTES)
|
||||
local pf_delayedAck = ProtoField.uint8("rdpudp2.ack.delayedAck", "Delayed ack", base.DEC)
|
||||
|
||||
local pf_OverHeadSize = ProtoField.uint8("rdpudp2.overheadsize", "Overhead size", base.DEC)
|
||||
|
||||
local pf_DelayAckMax = ProtoField.uint8("rdpudp2.delayackinfo.max", "MaxDelayedAcks", base.DEC)
|
||||
local pf_DelayAckTimeout = ProtoField.uint8("rdpudp2.delayackinfo.timeout", "DelayedAckTimeoutInMs", base.DEC)
|
||||
|
||||
local pf_AckOfAcks = ProtoField.uint16("rdpudp2.ackofacks", "Ack of Acks", base.HEX)
|
||||
|
||||
local pf_DataSeqNumber = ProtoField.uint16("rdpudp2.data.seqnum", "sequence number", base.HEX)
|
||||
local pf_DataChannelSeqNumber = ProtoField.uint16("rdpudp2.data.channelseqnumber", "Channel sequence number", base.HEX)
|
||||
local pf_Data = ProtoField.new("Data", "rdpudp2.data", ftypes.BYTES)
|
||||
|
||||
local pf_AckvecBaseSeq = ProtoField.uint16("rdpudp2.ackvec.baseseqnum", "Base sequence number", base.HEX)
|
||||
local pf_AckvecCodecAckVecSize = ProtoField.uint16("rdpudp2.ackvec.codecackvecsize", "Codec ackvec size", base.DEC, nil, 0x7f)
|
||||
local pf_AckvecHaveTs = ProtoField.bool("rdpudp2.ackvec.havets", "have timestamp", base.DEC, nil, 0x80)
|
||||
local pf_AckvecTimeStamp = ProtoField.uint24("rdpudp2.ackvec.timestamp", "Timestamp", base.HEX)
|
||||
local pf_AckvecCodedAck = ProtoField.uint8("rdpudp2.ackvec.codecAck", "Coded Ack", base.HEX)
|
||||
local pf_AckvecCodedAckMode = ProtoField.uint8("rdpudp2.ackvec.codecAckMode", "Mode", base.HEX, {[0]="Bitmap", [1]="Run length"}, 0x80)
|
||||
local pf_AckvecCodedAckRleState = ProtoField.uint8("rdpudp2.ackvec.codecAckRleState", "State", base.HEX, {[0]="lost",[1]="received"}, 0x40)
|
||||
local pf_AckvecCodedAckRleLen = ProtoField.uint8("rdpudp2.ackvec.codecAckRleLen", "Length", base.DEC, nil, 0x3f)
|
||||
|
||||
rdpudp.fields = {
|
||||
-- UDP1
|
||||
pf_udp_snSourceAck, pf_udp_ReceiveWindowSize, pf_udp_flags, pf_udp_flag_syn,
|
||||
pf_udp_flag_fin, pf_udp_flag_ack, pf_udp_flag_data, pf_udp_flag_fec, pf_udp_flag_cn,
|
||||
pf_udp_flag_cwr, pf_udp_flag_aoa, pf_udp_flag_synlossy, pf_udp_flag_ackdelayed,
|
||||
pf_udp_flag_correlationId, pf_udp_flag_synex,
|
||||
pf_udp_snInitialSequenceNumber, pf_udp_upstreamMtu, pf_udp_downstreamMtu,
|
||||
pf_udp_correlationId,
|
||||
pf_udp_synex_flags, pf_udp_synex_flag_version, pf_udp_synex_version, pf_udp_synex_cookiehash,
|
||||
pf_udp_ack_vectorsize, pf_udp_ack_item, pf_udp_ack_item_state, pf_udp_ack_item_rle,
|
||||
pf_udp_fec_coded, pf_udp_fec_sourcestart, pf_udp_fec_range, pf_udp_fec_fecindex,
|
||||
pf_udp_resetseqenum,
|
||||
pf_udp_source_sncoded, pf_udp_source_snSourceStart,
|
||||
|
||||
-- UDP2
|
||||
pf_PacketPrefixByte, pf_packetType,
|
||||
pf_flags, pf_flag_ack, pf_flag_data, pf_flag_ackvec, pf_flag_aoa, pf_flag_overhead, pf_flag_delayackinfo,
|
||||
pf_logWindow,
|
||||
pf_Ack, pf_AckSeq, pf_AckTs, pf_AckSendTimeGap, pf_ndelayedAcks, pf_delayedTimeScale, pf_delayedAcks,
|
||||
pf_OverHeadSize,
|
||||
pf_DelayAckMax, pf_DelayAckTimeout,
|
||||
pf_AckOfAcks,
|
||||
pf_DataSeqNumber, pf_Data, pf_DataChannelSeqNumber,
|
||||
pf_Ackvec, pf_AckvecBaseSeq, pf_AckvecCodecAckVecSize, pf_AckvecHaveTs, pf_AckvecTimeStamp, pf_AckvecCodedAck, pf_AckvecCodedAckMode,
|
||||
pf_AckvecCodedAckRleState, pf_AckvecCodedAckRleLen
|
||||
}
|
||||
|
||||
rdpudp.prefs.track_udp2_peer_states = Pref.bool("Track state of UDP2 peers", true, "Keep track of state of UDP2 peers (receiver and sender windows")
|
||||
rdpudp.prefs.debug_ssl = Pref.bool("SSL debug message", false, "print verbose message of the SSL fragments reassembly")
|
||||
|
||||
|
||||
|
||||
local field_rdpudp_flags = Field.new("rdpudp.flags")
|
||||
local field_rdpudp2_packetType = Field.new("rdpudp2.packetType")
|
||||
local field_rdpudp2_channelSeqNumber = Field.new("rdpudp2.data.channelseqnumber")
|
||||
local field_rdpudp2_ackvec_base = Field.new("rdpudp2.ackvec.baseseqnum")
|
||||
|
||||
function unwrapPacket(tvbuf)
|
||||
local len = tvbuf:reported_length_remaining()
|
||||
local ret = tvbuf:bytes(7, 1) .. tvbuf:bytes(1, 6) .. tvbuf:bytes(0, 1) .. tvbuf:bytes(8, len-8)
|
||||
--dprint2("input first bytes=", tvbuf:bytes(0, 9):tohex(true, " "))
|
||||
--dprint2("output first bytes=", ret:subset(0, 9):tohex(true, " "))
|
||||
return ret:tvb("RDP-UDP unwrapped")
|
||||
end
|
||||
|
||||
function rdpudp.init()
|
||||
udpComms = {}
|
||||
end
|
||||
|
||||
function computePacketKey(pktinfo)
|
||||
local addr_lo = pktinfo.net_src
|
||||
local addr_hi = pktinfo.net_dst
|
||||
local port_lo = pktinfo.src_port
|
||||
local port_hi = pktinfo.dst_port
|
||||
|
||||
if addr_lo > addr_hi then
|
||||
addr_hi, addr_lo = addr_lo, addr_hi
|
||||
port_hi, port_lo = port_lo, port_hi
|
||||
end
|
||||
|
||||
return tostring(addr_lo) .. ":" .. tostring(port_lo) .. " -> " .. tostring(addr_hi) .. ":" .. tostring(port_hi)
|
||||
end
|
||||
|
||||
function tableItem(pktinfo)
|
||||
local key = computePacketKey(pktinfo)
|
||||
local ret = udpComms[key]
|
||||
if ret == nil then
|
||||
dprint2(pktinfo.number .. " creating entry for " .. key)
|
||||
udpComms[key] = { isLossy = false, switchToUdp2 = nil, sslFragments = {},
|
||||
serverAddr = nil, clientAddr = nil,
|
||||
serverState = { receiveLow = nil, receiveHigh = nil, senderLow = nil, senderHigh = nil },
|
||||
clientState = { receiveLow = nil, receiveHigh = nil, senderLow = nil, senderHigh = nil }
|
||||
}
|
||||
ret = udpComms[key]
|
||||
end
|
||||
return ret
|
||||
end
|
||||
|
||||
function doAlign(v, alignment)
|
||||
local rest = v % alignment
|
||||
if rest ~= 0 then
|
||||
return v + alignment - rest
|
||||
end
|
||||
return v
|
||||
end
|
||||
|
||||
function dissectV1(tvbuf, pktinfo, tree)
|
||||
--dprint2("dissecting in UDP1 mode")
|
||||
local pktlen = tvbuf:reported_length_remaining()
|
||||
|
||||
tree:add(pf_udp_snSourceAck, tvbuf:range(0, 4))
|
||||
tree:add(pf_udp_ReceiveWindowSize, tvbuf:range(4, 2))
|
||||
local flagsRange = tvbuf:range(6, 2)
|
||||
local flagsItem = tree:add(pf_udp_flags, flagsRange)
|
||||
--
|
||||
flagsItem:add(pf_udp_flag_syn, flagsRange)
|
||||
flagsItem:add(pf_udp_flag_fin, flagsRange)
|
||||
flagsItem:add(pf_udp_flag_ack, flagsRange)
|
||||
flagsItem:add(pf_udp_flag_data, flagsRange)
|
||||
flagsItem:add(pf_udp_flag_fec, flagsRange)
|
||||
flagsItem:add(pf_udp_flag_cn, flagsRange)
|
||||
flagsItem:add(pf_udp_flag_cwr, flagsRange)
|
||||
flagsItem:add(pf_udp_flag_aoa, flagsRange)
|
||||
flagsItem:add(pf_udp_flag_synlossy, flagsRange)
|
||||
flagsItem:add(pf_udp_flag_ackdelayed, flagsRange)
|
||||
flagsItem:add(pf_udp_flag_correlationId, flagsRange)
|
||||
flagsItem:add(pf_udp_flag_synex, flagsRange)
|
||||
|
||||
startAt = 8
|
||||
local flags = flagsRange:uint()
|
||||
local haveSyn = bit32.band(flags, RDPUDP_SYN) ~= 0
|
||||
local haveAck = bit32.band(flags, RDPUDP_ACK) ~= 0
|
||||
local isLossySyn = bit32.band(flags, RDPUDP_SYNLOSSY) ~= 0
|
||||
local tableRecord = tableItem(pktinfo)
|
||||
|
||||
|
||||
if isLossySyn then
|
||||
tableRecord.isLossy = true
|
||||
end
|
||||
|
||||
if haveSyn then
|
||||
-- dprint2("rdpudp - SYN")
|
||||
local synItem = tree:add("Syn", tvbuf:range(startAt, 8))
|
||||
|
||||
synItem:add(pf_udp_snInitialSequenceNumber, tvbuf:range(startAt, 4))
|
||||
synItem:add(pf_udp_upstreamMtu, tvbuf:range(startAt+4, 2))
|
||||
synItem:add(pf_udp_downstreamMtu, tvbuf:range(startAt+6, 2))
|
||||
|
||||
startAt = startAt + 8
|
||||
end
|
||||
|
||||
if bit32.band(flags, RDPUDP_CORRELATIONID) ~= 0 then
|
||||
-- dprint2("rdpudp - CorrelationId")
|
||||
tree:add(pf_udp_correlationId, tvbuf:range(startAt, 16))
|
||||
startAt = startAt + 32
|
||||
end
|
||||
|
||||
if bit32.band(flags, RDPUDP_SYNEX) ~= 0 then
|
||||
-- dprint2("rdpudp - SynEx")
|
||||
local synexItem = tree:add("SynEx")
|
||||
|
||||
local synexFlagsRange = tvbuf:range(startAt, 2)
|
||||
local synexFlags = synexItem:add(pf_udp_synex_flags, synexFlagsRange);
|
||||
--
|
||||
synexFlags:add(pf_udp_synex_flag_version, synexFlagsRange)
|
||||
local exflags = synexFlagsRange:uint()
|
||||
startAt = startAt + 2
|
||||
if bit32.band(exflags, 1) ~= 0 then
|
||||
synexItem:add(pf_udp_synex_version, tvbuf:range(startAt, 2))
|
||||
local versionVal = tvbuf:range(startAt, 2):uint()
|
||||
startAt = startAt + 2
|
||||
|
||||
if versionVal == 0x101 then
|
||||
if not haveAck then
|
||||
synexItem:add(pf_udp_synex_cookiehash, tvbuf:range(startAt, 32))
|
||||
startAt = startAt + 32
|
||||
else
|
||||
-- switch to UDP2
|
||||
tableRecord.switchToUdp2 = pktinfo.number
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
local mask = RDPUDP_SYN + RDPUDP_ACK
|
||||
if bit32.band(flags, mask) == mask then
|
||||
tableRecord.serverAddr = tostring(pktinfo.net_src)
|
||||
tableRecord.clientAddr = tostring(pktinfo.net_dst)
|
||||
-- dprint2(pktinfo.number .. ": key='" .. computePacketKey(pktinfo) ..
|
||||
-- "' setting server=" .. tableRecord.serverAddr .. " client=" .. tableRecord.clientAddr)
|
||||
end
|
||||
end
|
||||
|
||||
if haveAck and not haveSyn then
|
||||
-- dprint2("rdpudp - Ack")
|
||||
local ackItem = tree:add("Ack")
|
||||
ackItem:add(pf_udp_ack_vectorsize, tvbuf:range(startAt, 2))
|
||||
|
||||
local i = 0
|
||||
uAckVectorSize = tvbuf:range(startAt, 2):uint()
|
||||
while i < uAckVectorSize do
|
||||
local ackRange = tvbuf:range(startAt + 2 + i, 1)
|
||||
local ack = ackItem:add(pf_udp_ack_item, ackRange)
|
||||
ack:add(pf_udp_ack_item_state, ackRange)
|
||||
ack:add(pf_udp_ack_item_rle, ackRange)
|
||||
i = i + 1
|
||||
end -- while
|
||||
|
||||
-- aligned on a dword (4 bytes) boundary
|
||||
-- dprint2("pktinfo=",pktinfo.number," blockSz=",doAlign(2 + uAckVectorSize, 4))
|
||||
startAt = startAt + doAlign(2 + uAckVectorSize, 4)
|
||||
end
|
||||
|
||||
if bit32.band(flags, RDPUDP_FEC) ~= 0 then
|
||||
-- dprint2("rdpudp - FEC header")
|
||||
local fecItem = tree:add("FEC", tvbuf:range(startAt, 12))
|
||||
fecItem:add(pf_udp_fec_coded, tvbuf:range(startAt, 4))
|
||||
fecItem:add(pf_udp_fec_sourcestart, tvbuf:range(startAt+4, 4))
|
||||
fecItem:add(pf_udp_fec_range, tvbuf:range(startAt+8, 1))
|
||||
fecItem:add(pf_udp_fec_fecindex, tvbuf:range(startAt+9, 1))
|
||||
|
||||
startAt = startAt + (4 * 3)
|
||||
end
|
||||
|
||||
if bit32.band(flags, RDPUDP_AOA) ~= 0 then
|
||||
-- dprint2("rdpudp - AOA")
|
||||
tree:add(pf_udp_resetseqenum, tvbuf:range(startAt, 4))
|
||||
startAt = startAt + 4
|
||||
end
|
||||
|
||||
if bit32.band(flags, RDPUDP_DATA) ~= 0 then
|
||||
-- dprint2("rdpudp - Data")
|
||||
local dataItem = tree:add("Data")
|
||||
dataItem:add(pf_udp_source_sncoded, tvbuf:range(startAt, 4))
|
||||
dataItem:add(pf_udp_source_snSourceStart, tvbuf:range(startAt+4, 4))
|
||||
startAt = startAt + 8
|
||||
|
||||
local payload = tvbuf:range(startAt)
|
||||
local subTvb = payload:tvb("payload")
|
||||
if tableRecord.isLossy then
|
||||
dtlsDissector:call(subTvb, pktinfo, dataItem)
|
||||
else
|
||||
sslDissector:call(subTvb, pktinfo, dataItem)
|
||||
end
|
||||
end
|
||||
|
||||
return pktlen
|
||||
end
|
||||
|
||||
-- given a tvb containing SSL records returns the part of the buffer that has complete
|
||||
-- SSL records
|
||||
function getCompleteSslRecordsLen(tvb)
|
||||
local startAt = 0
|
||||
local remLen = tvb:reported_length_remaining()
|
||||
|
||||
while remLen > 5 do
|
||||
local recordLen = 5 + tvb:range(startAt+3, 2):uint()
|
||||
if remLen < recordLen then
|
||||
break
|
||||
end
|
||||
startAt = startAt + recordLen
|
||||
remLen = remLen - recordLen
|
||||
end -- while
|
||||
|
||||
return startAt;
|
||||
end
|
||||
|
||||
TLS_OK = 0
|
||||
TLS_SHORT = 1
|
||||
TLS_NOT_TLS = 2
|
||||
TLS_NOT_COMPLETE = 3
|
||||
sslResNames = {[0]="TLS_OK", [1]="TLS_SHORT", [2]="TLS_NOT_TLS", [3]="TLS_NOT_COMPLETE"}
|
||||
|
||||
function checkSslRecord(tvb)
|
||||
local remLen = tvb:reported_length_remaining()
|
||||
|
||||
if remLen <= 5 then
|
||||
return TLS_SHORT, 0
|
||||
end
|
||||
|
||||
local b0 = tvb:range(0, 1):uint()
|
||||
if b0 < 0x14 or b0 > 0x17 then
|
||||
-- dprint2("doesn't look like a SSL record, b0=",b0)
|
||||
return TLS_NOT_TLS, 0
|
||||
end
|
||||
|
||||
local recordLen = 5 + tvb:range(3, 2):uint()
|
||||
if remLen < recordLen then
|
||||
return TLS_NOT_COMPLETE, recordLen
|
||||
end
|
||||
return TLS_OK, recordLen
|
||||
end
|
||||
|
||||
|
||||
function getSslFragments(pktinfo)
|
||||
local addr0 = pktinfo.net_src
|
||||
local addr1 = pktinfo.net_dst
|
||||
local port0 = pktinfo.src_port
|
||||
local port1 = pktinfo.dst_port
|
||||
local key = tostring(addr0) .. ":" .. tostring(port0) .. "->" .. tostring(addr1) .. ":" .. tostring(port1)
|
||||
|
||||
local tableRecord = tableItem(pktinfo)
|
||||
if tableRecord.sslFragments[key] == nil then
|
||||
tableRecord.sslFragments[key] = {}
|
||||
end
|
||||
|
||||
return tableRecord.sslFragments[key]
|
||||
end
|
||||
|
||||
function dissectV2(in_tvbuf, pktinfo, tree)
|
||||
-- dprint2("dissecting in UDP2 mode")
|
||||
local pktlen = in_tvbuf:reported_length_remaining()
|
||||
if pktlen < 7 then
|
||||
dprint2("packet ", pktinfo.number, " too short, len=", pktlen)
|
||||
return
|
||||
end
|
||||
|
||||
local conversation = tableItem(pktinfo)
|
||||
local sourceState = nil
|
||||
local targetState = nil
|
||||
if rdpudp.prefs.track_udp2_peer_states then
|
||||
if tostring(pktinfo.net_dst) == conversation.serverAddr then
|
||||
sourceState = conversation.clientState
|
||||
targetState = conversation.serverState
|
||||
else
|
||||
sourceState = conversation.serverState
|
||||
targetState = conversation.clientState
|
||||
end
|
||||
end
|
||||
|
||||
pktinfo.cols.info = ""
|
||||
local info = "("
|
||||
local tvbuf = unwrapPacket(in_tvbuf)
|
||||
local prefixRange = tvbuf:range(0, 1)
|
||||
local prefix_tree = tree:add(pf_PacketPrefixByte, prefixRange)
|
||||
--
|
||||
local packetType = prefix_tree:add(pf_packetType, prefixRange)
|
||||
|
||||
local flagsRange = tvbuf:range(1,2)
|
||||
local flagsTree = tree:add_le(pf_flags, flagsRange)
|
||||
--
|
||||
flagsTree:add_packet_field(pf_flag_ack, flagsRange, ENC_LITTLE_ENDIAN)
|
||||
flagsTree:add_le(pf_flag_data, flagsRange)
|
||||
flagsTree:add_le(pf_flag_ackvec, flagsRange)
|
||||
flagsTree:add_le(pf_flag_aoa, flagsRange)
|
||||
flagsTree:add_le(pf_flag_overhead, flagsRange)
|
||||
flagsTree:add_le(pf_flag_delayackinfo, flagsRange)
|
||||
|
||||
tree:add_le(pf_logWindow, flagsRange)
|
||||
|
||||
local flags = tvbuf:range(1,2):le_uint()
|
||||
|
||||
local startAt = 3
|
||||
if bit32.band(flags, RDPUDP2_ACK) ~= 0 then
|
||||
-- dprint2("got ACK payload")
|
||||
info = info .. "ACK,"
|
||||
local ackTree = tree:add("Ack")
|
||||
|
||||
ackTree:add_le(pf_AckSeq, tvbuf:range(startAt, 2))
|
||||
ackTree:add_le(pf_AckTs, tvbuf:range(startAt+2, 3))
|
||||
ackTree:add(pf_AckSendTimeGap, tvbuf:range(startAt+5, 1))
|
||||
ackTree:add(pf_ndelayedAcks, tvbuf:range(startAt+6, 1))
|
||||
ackTree:add(pf_delayedTimeScale, tvbuf:range(startAt+6, 1))
|
||||
|
||||
local ackSeq = tvbuf:range(startAt, 2):le_uint()
|
||||
local ackTs = tvbuf:range(startAt+2, 3):le_uint()
|
||||
local nacks = bit32.band(tvbuf:range(startAt+6, 1):le_uint(), 0xf)
|
||||
local delayAckTimeScale = bit32.rshift(bit32.band(tvbuf:range(startAt+6, 1):le_uint(), 0xf0), 4)
|
||||
-- dprint2(pktinfo.number,": nACKs=", nacks, "delayAckTS=", bit32.rshift(delayAckTimeScale, 4))
|
||||
|
||||
if rdpudp.prefs.track_udp2_peer_states then
|
||||
targetState.senderLow = ackSeq
|
||||
end
|
||||
|
||||
startAt = startAt + 7
|
||||
if nacks ~= 0 then
|
||||
local acksItem = ackTree:add(pf_delayedAcks, tvbuf:range(startAt, nacks))
|
||||
local i
|
||||
for i = nacks-1, 0, -1 do
|
||||
local ackDelay = tvbuf:range(startAt+i, 1):le_uint() * bit32.lshift(1, delayAckTimeScale)
|
||||
acksItem:add(pf_delayedAck, tvbuf:range(startAt+i, 1), "seq=0x" .. string.format("%0.4x", ackSeq-i-1) .. " ts=" .. ackTs-ackDelay)
|
||||
end
|
||||
acksItem:add(pf_delayedAck, tvbuf:range(startAt, nacks), "seq=0x" .. string.format("%0.4x", ackSeq) .. " ts=" .. ackTs):set_generated()
|
||||
end
|
||||
startAt = startAt + nacks
|
||||
end
|
||||
|
||||
if bit32.band(flags, RDPUDP2_OVERHEAD) ~= 0 then
|
||||
info = info .. "OVERHEAD,"
|
||||
|
||||
tree:add_le(pf_OverHeadSize, tvbuf:range(startAt, 1))
|
||||
startAt = startAt + 1
|
||||
end
|
||||
|
||||
if bit32.band(flags, RDPUDP2_DELAYACK) ~= 0 then
|
||||
info = info .. "DELAYEDACK,"
|
||||
|
||||
local delayAckItem = tree:add("DelayAckInfo", tvbuf:range(startAt, 3))
|
||||
delayAckItem:add_le(pf_DelayAckMax, tvbuf:range(startAt, 1))
|
||||
delayAckItem:add_le(pf_DelayAckTimeout, tvbuf:range(startAt+1, 2))
|
||||
startAt = startAt + 3
|
||||
end
|
||||
|
||||
if bit32.band(flags, RDPUDP2_AOA) ~= 0 then
|
||||
info = info .. "AOA,"
|
||||
tree:add_le(pf_AckOfAcks, tvbuf:range(startAt, 2))
|
||||
startAt = startAt + 2
|
||||
end
|
||||
|
||||
local dataTree
|
||||
local isDummy = (field_rdpudp2_packetType()() == 0x8)
|
||||
if bit32.band(flags, RDPUDP2_DATA) ~= 0 then
|
||||
if isDummy then
|
||||
info = info .. "DUMMY,"
|
||||
else
|
||||
info = info .. "DATA,"
|
||||
end
|
||||
dataTree = tree:add(isDummy and "Dummy Data" or "Data")
|
||||
dataTree:add_le(pf_DataSeqNumber, tvbuf:range(startAt, 2))
|
||||
startAt = startAt + 2
|
||||
end
|
||||
|
||||
if bit32.band(flags, RDPUDP2_ACKVEC) ~= 0 then
|
||||
-- dprint2("got ACKVEC payload")
|
||||
info = info .. "ACKVEC,"
|
||||
|
||||
local codedAckVecSizeA = tvbuf:range(startAt+2, 1):le_uint()
|
||||
local codedAckVecSize = bit32.band(codedAckVecSizeA, 0x7f)
|
||||
local haveTs = bit32.band(codedAckVecSizeA, 0x80) ~= 0
|
||||
|
||||
local ackVecTree = tree:add("AckVec")
|
||||
ackVecTree:add_le(pf_AckvecBaseSeq, tvbuf:range(startAt, 2))
|
||||
ackVecTree:add(pf_AckvecCodecAckVecSize, tvbuf:range(startAt+2, 1))
|
||||
ackVecTree:add(pf_AckvecHaveTs, tvbuf:range(startAt+2, 1))
|
||||
startAt = startAt + 3
|
||||
if haveTs then
|
||||
ackVecTree:add_le(pf_AckvecTimeStamp, tvbuf:range(startAt, 4))
|
||||
startAt = startAt + 4
|
||||
end
|
||||
local codedAckVector = ackVecTree:add("Vector", tvbuf:range(startAt, codedAckVecSize))
|
||||
local seqNumber = field_rdpudp2_ackvec_base()()
|
||||
for i = 0, codedAckVecSize-1, 1 do
|
||||
local bRange = tvbuf:range(startAt + i, 1)
|
||||
local b = bRange:uint()
|
||||
|
||||
local codedAck = codedAckVector:add(pf_AckvecCodedAck, bRange, b)
|
||||
codedAck:add(pf_AckvecCodedAckMode, bRange)
|
||||
|
||||
local itemString = "";
|
||||
if bit32.band(b, 0x80) == 0 then
|
||||
-- bitmap length mode
|
||||
itemString = string.format("bitmap(0x%0.2x): ", b)
|
||||
local mask = 0x1
|
||||
for j = 0, 7-1 do
|
||||
flag = "!"
|
||||
if bit32.band(b, mask) ~= 0 then
|
||||
flag = ""
|
||||
end
|
||||
|
||||
itemString = itemString .. " " .. flag .. string.format("%0.4x", seqNumber)
|
||||
mask = mask * 2
|
||||
seqNumber = seqNumber + 1
|
||||
end
|
||||
else
|
||||
-- run length mode
|
||||
codedAck:add(pf_AckvecCodedAckRleState, bRange)
|
||||
codedAck:add(pf_AckvecCodedAckRleLen, bRange)
|
||||
|
||||
local rleLen = bit32.band(b, 0x3f)
|
||||
itemString = "rle(len=" .. rleLen .. "): ".. (bit32.band(b, 0x40) and "received" or "lost") ..
|
||||
string.format(" %0.4x -> %0.4x", seqNumber, seqNumber + rleLen)
|
||||
seqNumber = seqNumber + rleLen
|
||||
end
|
||||
|
||||
codedAck:set_text(itemString)
|
||||
|
||||
end
|
||||
|
||||
startAt = startAt + codedAckVecSize
|
||||
end
|
||||
|
||||
if not isDummy and bit32.band(flags, RDPUDP2_DATA) ~= 0 then
|
||||
dataTree:add_le(pf_DataChannelSeqNumber, tvbuf:range(startAt, 2))
|
||||
local payload = tvbuf:range(startAt + 2)
|
||||
local subTvb = payload:tvb("payload")
|
||||
|
||||
local channelSeqId = field_rdpudp2_channelSeqNumber()()
|
||||
local sslFragments = getSslFragments(pktinfo)
|
||||
local workTvb = nil
|
||||
|
||||
local sslRes, recordLen = checkSslRecord(subTvb)
|
||||
if rdpudp.prefs.debug_ssl then
|
||||
dprint2("packet=", pktinfo.number, " channelSeq=", channelSeqId,
|
||||
" dataLen=", subTvb:reported_length_remaining(),
|
||||
" sslRes=", sslResNames[sslRes],
|
||||
" recordLen=", recordLen)
|
||||
end
|
||||
if sslRes == TLS_OK then
|
||||
workTvb = subTvb
|
||||
elseif sslRes == TLS_SHORT or sslRes == TLS_NOT_COMPLETE then
|
||||
if rdpudp.prefs.debug_ssl then
|
||||
dprint2("packet=", pktinfo.number, " recording fragment len=", subTvb:len())
|
||||
end
|
||||
|
||||
local frag = ByteArray.new()
|
||||
frag:append(subTvb:bytes())
|
||||
sslFragments[channelSeqId] = frag
|
||||
|
||||
elseif sslRes == TLS_NOT_TLS then
|
||||
local prevFragment = sslFragments[channelSeqId-1]
|
||||
if rdpudp.prefs.debug_ssl then
|
||||
dprint2("packet=",pktinfo.number," picking channelSeq=", channelSeqId-1, " havePrevFragment=", prevFragment ~= nil and "ok" or "no")
|
||||
end
|
||||
if prevFragment ~= nil then
|
||||
-- dprint2("prevLen=",prevFragment:len(), " subTvbLen=",subTvb:len())
|
||||
local testBytes = prevFragment .. subTvb:bytes()
|
||||
local testTvb = ByteArray.tvb(testBytes, "reassembled fragment")
|
||||
|
||||
sslRes, recordLen = checkSslRecord(testTvb)
|
||||
if rdpudp.prefs.debug_ssl then
|
||||
dprint2("packet=", pktinfo.number,
|
||||
" reassembled len=", testTvb:reported_length_remaining(),
|
||||
" sslRes=", sslResNames[sslRes],
|
||||
" recordLen=", recordLen)
|
||||
end
|
||||
if sslRes == TLS_OK then
|
||||
workTvb = testTvb
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if workTvb ~= nil then
|
||||
repeat
|
||||
if rdpudp.prefs.debug_ssl then
|
||||
dprint2("treating workTvbLen=", workTvb:reported_length_remaining(), " recordLen=",recordLen)
|
||||
end
|
||||
local sslFragment = workTvb:range(0, recordLen):tvb("SSL fragment")
|
||||
sslDissector:call(sslFragment, pktinfo, dataTree)
|
||||
|
||||
workTvb = workTvb:range(recordLen):tvb()
|
||||
sslRes, recordLen = checkSslRecord(workTvb)
|
||||
|
||||
if sslRes == TLS_SHORT or sslRes == TLS_NOT_COMPLETE then
|
||||
if rdpudp.prefs.debug_ssl then
|
||||
dprint2("packet=", pktinfo.number, " recording fragment len=", subTvb:len())
|
||||
end
|
||||
|
||||
local frag = ByteArray.new()
|
||||
frag:append(workTvb:bytes())
|
||||
sslFragments[channelSeqId] = frag
|
||||
end
|
||||
|
||||
until sslRes ~= TLS_OK or workTvb:reported_length_remaining() == 0
|
||||
else
|
||||
dataTree:add_le(pf_Data, payload)
|
||||
end
|
||||
end
|
||||
|
||||
info = string.sub(info, 0, -2) .. ")"
|
||||
pktinfo.cols.info = info -- .. tostring(pktinfo.cols.info)
|
||||
if rdpudp.prefs.track_udp2_peer_states then
|
||||
local stateTrackItem = tree:add("UDP2 state tracking")
|
||||
stateTrackItem:set_generated()
|
||||
stateTrackItem:add(tostring(pktinfo.net_dst) == conversation.serverAddr and "Client -> Server" or "Server -> Client")
|
||||
end
|
||||
|
||||
|
||||
return pktlen
|
||||
end
|
||||
|
||||
function rdpudp.dissector(in_tvbuf, pktinfo, root)
|
||||
-- dprint2("rdpudp.dissector called")
|
||||
pktinfo.cols.protocol:set("RDP-UDP")
|
||||
|
||||
local pktlen = in_tvbuf:reported_length_remaining()
|
||||
local tree = root:add(rdpudp, in_tvbuf:range(0,pktlen))
|
||||
|
||||
local tableRecord = tableItem(pktinfo)
|
||||
local doDissectV1 = true
|
||||
if tableRecord.switchToUdp2 ~= nil and tableRecord.switchToUdp2 < pktinfo.number then
|
||||
doDissectV1 = false
|
||||
end
|
||||
|
||||
if doDissectV1 then
|
||||
return dissectV1(in_tvbuf, pktinfo, tree)
|
||||
end
|
||||
|
||||
return dissectV2(in_tvbuf, pktinfo, tree)
|
||||
end
|
||||
|
||||
DissectorTable.get("udp.port"):add(3389, rdpudp)
|
||||
Reference in New Issue
Block a user