mirrors
/
FreeRDP
mirror of https://github.com/FreeRDP/FreeRDP
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
FreeRDP/tools/wireshark/rdp-udp.lua

710 lines
27 KiB
Lua
Raw Blame History

--[[
RDP UDP transport dissector for wireshark
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Copyright 2021 David Fort <contact@hardening-consulting.com>
--]]
local sslDissector = Dissector.get ("tls")
local dtlsDissector = Dissector.get ("dtls")
local dprint = function(...)
print(table.concat({"Lua:", ...}," "))
end
local dprint2 = dprint
dprint2("loading RDP-UDP with wireshark=", get_version())
local rdpudp = Proto("rdpudp", "UDP transport for RDP")
-- UDP1 fields
local pf_udp_snSourceAck = ProtoField.uint32("rdpudp.snsourceack", "snSourceAck", base.HEX)
local pf_udp_ReceiveWindowSize = ProtoField.uint16("rdpudp.receivewindowsize", "ReceiveWindowSize", base.DEC)
local pf_udp_flags = ProtoField.uint16("rdpudp.flags", "Flags", base.HEX)
RDPUDP_SYN = 0x0001
RDPUDP_FIN = 0x0002
RDPUDP_ACK = 0x0004
RDPUDP_DATA = 0x0008
RDPUDP_FEC = 0x0010
RDPUDP_CN = 0x0020
RDPUDP_CWR = 0x0040
RDPUDP_AOA = 0x0100
RDPUDP_SYNLOSSY = 0x0200
RDPUDP_ACKDELAYED = 0x0400
RDPUDP_CORRELATIONID = 0x0800
RDPUDP_SYNEX = 0x1000
local pf_udp_flag_syn = ProtoField.bool("rdpudp.flags.syn", "Syn", base.HEX, nil, RDPUDP_SYN)
local pf_udp_flag_fin = ProtoField.bool("rdpudp.flags.fin", "Fin", base.HEX, nil, RDPUDP_FIN)
local pf_udp_flag_ack = ProtoField.bool("rdpudp.flags.ack", "Ack", base.HEX, nil, RDPUDP_ACK)
local pf_udp_flag_data = ProtoField.bool("rdpudp.flags.data", "Data", base.HEX, nil, RDPUDP_DATA)
local pf_udp_flag_fec = ProtoField.bool("rdpudp.flags.fec", "FECData", base.HEX, nil, RDPUDP_FEC)
local pf_udp_flag_cn = ProtoField.bool("rdpudp.flags.cn", "CN", base.HEX, nil, RDPUDP_CN)
local pf_udp_flag_cwr = ProtoField.bool("rdpudp.flags.cwr", "CWR", base.HEX, nil, RDPUDP_CWR)
local pf_udp_flag_aoa = ProtoField.bool("rdpudp.flags.aoa", "Ack of Acks", base.HEX, nil, RDPUDP_AOA)
local pf_udp_flag_synlossy = ProtoField.bool("rdpudp.flags.synlossy", "Syn lossy", base.HEX, nil, RDPUDP_SYNLOSSY)
local pf_udp_flag_ackdelayed = ProtoField.bool("rdpudp.flags.ackdelayed", "Ack delayed", base.HEX, nil, RDPUDP_ACKDELAYED)
local pf_udp_flag_correlationId = ProtoField.bool("rdpudp.flags.correlationid", "Correlation id", base.HEX, nil, RDPUDP_CORRELATIONID)
local pf_udp_flag_synex = ProtoField.bool("rdpudp.flags.synex", "SynEx", base.HEX, nil, RDPUDP_SYNEX)
local pf_udp_snInitialSequenceNumber = ProtoField.uint32("rdpudp.initialsequencenumber", "Initial SequenceNumber", base.HEX)
local pf_udp_upstreamMtu = ProtoField.uint16("rdpudp.upstreammtu", "Upstream MTU", base.DEC)
local pf_udp_downstreamMtu = ProtoField.uint16("rdpudp.downstreammtu", "DownStream MTU", base.DEC)
local pf_udp_correlationId = ProtoField.new("Correlation Id", "rdpudp.correlationid", ftypes.BYTES)
local pf_udp_synex_flags = ProtoField.uint16("rdpudp.synex.flags", "Flags", base.HEX)
local pf_udp_synex_flag_version = ProtoField.bool("rdpudp.synex.flags.versioninfo", "Version info", base.HEX, nil, 0x0001)
local pf_udp_synex_version = ProtoField.uint16("rdpudp.synex.version", "Version", base.HEX, {[1]="Version 1", [2]="Version 2", [0x101]="Version 3"})
local pf_udp_synex_cookiehash = ProtoField.new("Cookie Hash", "rdpudp.synex.cookiehash", ftypes.BYTES)
local pf_udp_ack_vectorsize = ProtoField.uint16("rdpudp.ack.vectorsize", "uAckVectorSize", base.DEC)
local pf_udp_ack_item = ProtoField.uint8("rdpudp.ack.item", "Ack item", base.HEX)
local pf_udp_ack_item_state = ProtoField.uint8("rdpudp.ack.item.state", "VECTOR_ELEMENT_STATE", base.HEX, {[0]="Received", [1]="Reserved 1", [2]="Reserved 2", [3]="Pending"}, 0xc0)
local pf_udp_ack_item_rle = ProtoField.uint8("rdpudp.ack.item.rle", "Run length", base.DEC, nil, 0x3f)
local pf_udp_fec_coded = ProtoField.uint32("rdpudp.fec.coded", "snCoded", base.HEX)
local pf_udp_fec_sourcestart = ProtoField.uint32("rdpudp.fec.sourcestart", "snSourceStart", base.HEX)
local pf_udp_fec_range = ProtoField.uint8("rdpudp.fec.range", "Range", base.DEC)
local pf_udp_fec_fecindex = ProtoField.uint8("rdpudp.fec.fecindex", "Fec index", base.HEX)
local pf_udp_resetseqenum = ProtoField.uint32("rdpudp.resetSeqNum", "snResetSeqNum", base.HEX)
local pf_udp_source_sncoded = ProtoField.uint32("rdpudp.data.sncoded", "snCoded", base.HEX)
local pf_udp_source_snSourceStart = ProtoField.uint32("rdpudp.data.sourceStart", "snSourceStart", base.HEX)
-- UDP2 fields
local pf_PacketPrefixByte = ProtoField.new("PacketPrefixByte", "rdpudp2.prefixbyte", ftypes.UINT8, nil, base.HEX)
local pf_packetType = ProtoField.uint8("rdpudp2.packetType", "PacketType", base.HEX, {[0] = "Data", [8] = "Dummy"}, 0x1e, "type of packet")
RDPUDP2_ACK = 0x0001
RDPUDP2_DATA = 0x0004
RDPUDP2_ACKVEC = 0x0008
RDPUDP2_AOA = 0x0010
RDPUDP2_OVERHEAD = 0x0040
RDPUDP2_DELAYACK = 0x00100
local pf_flags = ProtoField.uint16("rdpudp2.flags", "Flags", base.HEX, nil, 0xfff, "flags")
local pf_flag_ack = ProtoField.bool("rdpudp2.flags.ack", "Ack", base.HEX, nil, RDPUDP2_ACK, "packet contains Ack payload")
local pf_flag_data = ProtoField.bool("rdpudp2.flags.data", "Data", base.HEX, nil, RDPUDP2_DATA, "packet contains Data payload")
local pf_flag_ackvec = ProtoField.bool("rdpudp2.flags.ackvec", "AckVec", base.HEX, nil, RDPUDP2_ACKVEC, "packet contains AckVec payload")
local pf_flag_aoa = ProtoField.bool("rdpudp2.flags.ackofacks", "AckOfAcks", base.HEX, nil, RDPUDP2_AOA, "packet contains AckOfAcks payload")
local pf_flag_overhead = ProtoField.bool("rdpudp2.flags.overheadsize", "OverheadSize", base.HEX, nil, RDPUDP2_OVERHEAD, "packet contains OverheadSize payload")
local pf_flag_delayackinfo = ProtoField.bool("rdpudp2.flags.delayackinfo", "DelayedAckInfo", base.HEX, nil, RDPUDP2_DELAYACK, "packet contains DelayedAckInfo payload")
local pf_logWindow = ProtoField.uint16("rdpudp2.logWindow", "LogWindow", base.DEC, nil, 0xf000, "flags")
local pf_AckSeq = ProtoField.uint16("rdpudp2.ack.seqnum", "Base Seq", base.HEX)
local pf_AckTs = ProtoField.uint24("rdpudp2.ack.ts", "receivedTS", base.DEC)
local pf_AckSendTimeGap = ProtoField.uint8("rdpudp2.ack.sendTimeGap", "sendTimeGap", base.DEC)
local pf_ndelayedAcks = ProtoField.uint8("rdpudp2.ack.numDelayedAcks", "NumDelayedAcks", base.DEC, nil, 0x0f)
local pf_delayedTimeScale = ProtoField.uint8("rdpudp2.ack.delayedTimeScale", "delayedTimeScale", base.DEC, nil, 0xf0)
local pf_delayedAcks = ProtoField.new("Delayed acks", "rdpudp2.ack.delayedAcks", ftypes.BYTES)
local pf_delayedAck = ProtoField.uint8("rdpudp2.ack.delayedAck", "Delayed ack", base.DEC)
local pf_OverHeadSize = ProtoField.uint8("rdpudp2.overheadsize", "Overhead size", base.DEC)
local pf_DelayAckMax = ProtoField.uint8("rdpudp2.delayackinfo.max", "MaxDelayedAcks", base.DEC)
local pf_DelayAckTimeout = ProtoField.uint8("rdpudp2.delayackinfo.timeout", "DelayedAckTimeoutInMs", base.DEC)
local pf_AckOfAcks = ProtoField.uint16("rdpudp2.ackofacks", "Ack of Acks", base.HEX)
local pf_DataSeqNumber = ProtoField.uint16("rdpudp2.data.seqnum", "sequence number", base.HEX)
local pf_DataChannelSeqNumber = ProtoField.uint16("rdpudp2.data.channelseqnumber", "Channel sequence number", base.HEX)
local pf_Data = ProtoField.new("Data", "rdpudp2.data", ftypes.BYTES)
local pf_AckvecBaseSeq = ProtoField.uint16("rdpudp2.ackvec.baseseqnum", "Base sequence number", base.HEX)
local pf_AckvecCodecAckVecSize = ProtoField.uint16("rdpudp2.ackvec.codecackvecsize", "Codec ackvec size", base.DEC, nil, 0x7f)
local pf_AckvecHaveTs = ProtoField.bool("rdpudp2.ackvec.havets", "have timestamp", base.DEC, nil, 0x80)
local pf_AckvecTimeStamp = ProtoField.uint24("rdpudp2.ackvec.timestamp", "Timestamp", base.HEX)
local pf_AckvecCodedAck = ProtoField.uint8("rdpudp2.ackvec.codecAck", "Coded Ack", base.HEX)
local pf_AckvecCodedAckMode = ProtoField.uint8("rdpudp2.ackvec.codecAckMode", "Mode", base.HEX, {[0]="Bitmap", [1]="Run length"}, 0x80)
local pf_AckvecCodedAckRleState = ProtoField.uint8("rdpudp2.ackvec.codecAckRleState", "State", base.HEX, {[0]="lost",[1]="received"}, 0x40)
local pf_AckvecCodedAckRleLen = ProtoField.uint8("rdpudp2.ackvec.codecAckRleLen", "Length", base.DEC, nil, 0x3f)
rdpudp.fields = {
-- UDP1
pf_udp_snSourceAck, pf_udp_ReceiveWindowSize, pf_udp_flags, pf_udp_flag_syn,
pf_udp_flag_fin, pf_udp_flag_ack, pf_udp_flag_data, pf_udp_flag_fec, pf_udp_flag_cn,
pf_udp_flag_cwr, pf_udp_flag_aoa, pf_udp_flag_synlossy, pf_udp_flag_ackdelayed,
pf_udp_flag_correlationId, pf_udp_flag_synex,
pf_udp_snInitialSequenceNumber, pf_udp_upstreamMtu, pf_udp_downstreamMtu,
pf_udp_correlationId,
pf_udp_synex_flags, pf_udp_synex_flag_version, pf_udp_synex_version, pf_udp_synex_cookiehash,
pf_udp_ack_vectorsize, pf_udp_ack_item, pf_udp_ack_item_state, pf_udp_ack_item_rle,
pf_udp_fec_coded, pf_udp_fec_sourcestart, pf_udp_fec_range, pf_udp_fec_fecindex,
pf_udp_resetseqenum,
pf_udp_source_sncoded, pf_udp_source_snSourceStart,
-- UDP2
pf_PacketPrefixByte, pf_packetType,
pf_flags, pf_flag_ack, pf_flag_data, pf_flag_ackvec, pf_flag_aoa, pf_flag_overhead, pf_flag_delayackinfo,
pf_logWindow,
pf_Ack, pf_AckSeq, pf_AckTs, pf_AckSendTimeGap, pf_ndelayedAcks, pf_delayedTimeScale, pf_delayedAcks,
pf_OverHeadSize,
pf_DelayAckMax, pf_DelayAckTimeout,
pf_AckOfAcks,
pf_DataSeqNumber, pf_Data, pf_DataChannelSeqNumber,
pf_Ackvec, pf_AckvecBaseSeq, pf_AckvecCodecAckVecSize, pf_AckvecHaveTs, pf_AckvecTimeStamp, pf_AckvecCodedAck, pf_AckvecCodedAckMode,
pf_AckvecCodedAckRleState, pf_AckvecCodedAckRleLen
}
rdpudp.prefs.track_udp2_peer_states = Pref.bool("Track state of UDP2 peers", true, "Keep track of state of UDP2 peers (receiver and sender windows")
rdpudp.prefs.debug_ssl = Pref.bool("SSL debug message", false, "print verbose message of the SSL fragments reassembly")
local field_rdpudp_flags = Field.new("rdpudp.flags")
local field_rdpudp2_packetType = Field.new("rdpudp2.packetType")
local field_rdpudp2_channelSeqNumber = Field.new("rdpudp2.data.channelseqnumber")
local field_rdpudp2_ackvec_base = Field.new("rdpudp2.ackvec.baseseqnum")
function unwrapPacket(tvbuf)
local len = tvbuf:reported_length_remaining()
local ret = tvbuf:bytes(7, 1) .. tvbuf:bytes(1, 6) .. tvbuf:bytes(0, 1) .. tvbuf:bytes(8, len-8)
--dprint2("iput first bytes=", tvbuf:bytes(0, 9):tohex(true, " "))
--dprint2("oput first bytes=", ret:subset(0, 9):tohex(true, " "))
return ret:tvb("RDP-UDP unwrapped")
end
function rdpudp.init()
udpComms = {}
end
function computePacketKey(pktinfo)
local addr_lo = pktinfo.net_src
local addr_hi = pktinfo.net_dst
local port_lo = pktinfo.src_port
local port_hi = pktinfo.dst_port
if addr_lo > addr_hi then
addr_hi, addr_lo = addr_lo, addr_hi
port_hi, port_lo = port_lo, port_hi
end
return tostring(addr_lo) .. ":" .. tostring(port_lo) .. " -> " .. tostring(addr_hi) .. ":" .. tostring(port_hi)
end
function tableItem(pktinfo)
local key = computePacketKey(pktinfo)
local ret = udpComms[key]
if ret == nil then
dprint2(pktinfo.number .. " creating entry for " .. key)
udpComms[key] = { isLossy = false, switchToUdp2 = nil, sslFragments = {},
serverAddr = nil, clientAddr = nil,
serverState = { receiveLow = nil, receiveHigh = nil, senderLow = nil, senderHigh = nil },
clientState = { receiveLow = nil, receiveHigh = nil, senderLow = nil, senderHigh = nil }
}
ret = udpComms[key]
end
return ret
end
function doAlign(v, alignment)
local rest = v % alignment
if rest ~= 0 then
return v + alignment - rest
end
return v
end
function dissectV1(tvbuf, pktinfo, tree)
--dprint2("dissecting in UDP1 mode")
local pktlen = tvbuf:reported_length_remaining()
tree:add(pf_udp_snSourceAck, tvbuf:range(0, 4))
tree:add(pf_udp_ReceiveWindowSize, tvbuf:range(4, 2))
local flagsRange = tvbuf:range(6, 2)
local flagsItem = tree:add(pf_udp_flags, flagsRange)
--
flagsItem:add(pf_udp_flag_syn, flagsRange)
flagsItem:add(pf_udp_flag_fin, flagsRange)
flagsItem:add(pf_udp_flag_ack, flagsRange)
flagsItem:add(pf_udp_flag_data, flagsRange)
flagsItem:add(pf_udp_flag_fec, flagsRange)
flagsItem:add(pf_udp_flag_cn, flagsRange)
flagsItem:add(pf_udp_flag_cwr, flagsRange)
flagsItem:add(pf_udp_flag_aoa, flagsRange)
flagsItem:add(pf_udp_flag_synlossy, flagsRange)
flagsItem:add(pf_udp_flag_ackdelayed, flagsRange)
flagsItem:add(pf_udp_flag_correlationId, flagsRange)
flagsItem:add(pf_udp_flag_synex, flagsRange)
startAt = 8
local flags = flagsRange:uint()
local haveSyn = bit32.band(flags, RDPUDP_SYN) ~= 0
local haveAck = bit32.band(flags, RDPUDP_ACK) ~= 0
local isLossySyn = bit32.band(flags, RDPUDP_SYNLOSSY) ~= 0
local tableRecord = tableItem(pktinfo)
if isLossySyn then
tableRecord.isLossy = true
end
if haveSyn then
-- dprint2("rdpudp - SYN")
local synItem = tree:add("Syn", tvbuf:range(startAt, 8))
synItem:add(pf_udp_snInitialSequenceNumber, tvbuf:range(startAt, 4))
synItem:add(pf_udp_upstreamMtu, tvbuf:range(startAt+4, 2))
synItem:add(pf_udp_downstreamMtu, tvbuf:range(startAt+6, 2))
startAt = startAt + 8
end
if bit32.band(flags, RDPUDP_CORRELATIONID) ~= 0 then
-- dprint2("rdpudp - CorrelationId")
tree:add(pf_udp_correlationId, tvbuf:range(startAt, 16))
startAt = startAt + 32
end
if bit32.band(flags, RDPUDP_SYNEX) ~= 0 then
-- dprint2("rdpudp - SynEx")
local synexItem = tree:add("SynEx")
local synexFlagsRange = tvbuf:range(startAt, 2)
local synexFlags = synexItem:add(pf_udp_synex_flags, synexFlagsRange);
--
synexFlags:add(pf_udp_synex_flag_version, synexFlagsRange)
local exflags = synexFlagsRange:uint()
startAt = startAt + 2
if bit32.band(exflags, 1) ~= 0 then
synexItem:add(pf_udp_synex_version, tvbuf:range(startAt, 2))
local versionVal = tvbuf:range(startAt, 2):uint()
startAt = startAt + 2
if versionVal == 0x101 then
if not haveAck then
synexItem:add(pf_udp_synex_cookiehash, tvbuf:range(startAt, 32))
startAt = startAt + 32
else
-- switch to UDP2
tableRecord.switchToUdp2 = pktinfo.number
end
end
end
local mask = RDPUDP_SYN + RDPUDP_ACK
if bit32.band(flags, mask) == mask then
tableRecord.serverAddr = tostring(pktinfo.net_src)
tableRecord.clientAddr = tostring(pktinfo.net_dst)
-- dprint2(pktinfo.number .. ": key='" .. computePacketKey(pktinfo) ..
-- "' setting server=" .. tableRecord.serverAddr .. " client=" .. tableRecord.clientAddr)
end
end
if haveAck and not haveSyn then
-- dprint2("rdpudp - Ack")
local ackItem = tree:add("Ack")
ackItem:add(pf_udp_ack_vectorsize, tvbuf:range(startAt, 2))
local i = 0
uAckVectorSize = tvbuf:range(startAt, 2):uint()
while i < uAckVectorSize do
local ackRange = tvbuf:range(startAt + 2 + i, 1)
local ack = ackItem:add(pf_udp_ack_item, ackRange)
ack:add(pf_udp_ack_item_state, ackRange)
ack:add(pf_udp_ack_item_rle, ackRange)
i = i + 1
end -- while
-- aligned on a dword (4 bytes) boundary
-- dprint2("pktinfo=",pktinfo.number," blockSz=",doAlign(2 + uAckVectorSize, 4))
startAt = startAt + doAlign(2 + uAckVectorSize, 4)
end
if bit32.band(flags, RDPUDP_FEC) ~= 0 then
-- dprint2("rdpudp - FEC header")
local fecItem = tree:add("FEC", tvbuf:range(startAt, 12))
fecItem:add(pf_udp_fec_coded, tvbuf:range(startAt, 4))
fecItem:add(pf_udp_fec_sourcestart, tvbuf:range(startAt+4, 4))
fecItem:add(pf_udp_fec_range, tvbuf:range(startAt+8, 1))
fecItem:add(pf_udp_fec_fecindex, tvbuf:range(startAt+9, 1))
startAt = startAt + (4 * 3)
end
if bit32.band(flags, RDPUDP_AOA) ~= 0 then
-- dprint2("rdpudp - AOA")
tree:add(pf_udp_resetseqenum, tvbuf:range(startAt, 4))
startAt = startAt + 4
end
if bit32.band(flags, RDPUDP_DATA) ~= 0 then
-- dprint2("rdpudp - Data")
local dataItem = tree:add("Data")
dataItem:add(pf_udp_source_sncoded, tvbuf:range(startAt, 4))
dataItem:add(pf_udp_source_snSourceStart, tvbuf:range(startAt+4, 4))
startAt = startAt + 8
local payload = tvbuf:range(startAt)
local subTvb = payload:tvb("payload")
if tableRecord.isLossy then
dtlsDissector:call(subTvb, pktinfo, dataItem)
else
sslDissector:call(subTvb, pktinfo, dataItem)
end
end
return pktlen
end
-- given a tvb containing SSL records returns the part of the buffer that has complete
-- SSL records
function getCompleteSslRecordsLen(tvb)
local startAt = 0
local remLen = tvb:reported_length_remaining()
while remLen > 5 do
local recordLen = 5 + tvb:range(startAt+3, 2):uint()
if remLen < recordLen then
break
end
startAt = startAt + recordLen
remLen = remLen - recordLen
end -- while
return startAt;
end
TLS_OK = 0
TLS_SHORT = 1
TLS_NOT_TLS = 2
TLS_NOT_COMPLETE = 3
sslResNames = {[0]="TLS_OK", [1]="TLS_SHORT", [2]="TLS_NOT_TLS", [3]="TLS_NOT_COMPLETE"}
function checkSslRecord(tvb)
local remLen = tvb:reported_length_remaining()
if remLen <= 5 then
return TLS_SHORT, 0
end
local b0 = tvb:range(0, 1):uint()
if b0 < 0x14 or b0 > 0x17 then
-- dprint2("doesn't look like a SSL record, b0=",b0)
return TLS_NOT_TLS, 0
end
local recordLen = 5 + tvb:range(3, 2):uint()
if remLen < recordLen then
return TLS_NOT_COMPLETE, recordLen
end
return TLS_OK, recordLen
end
function getSslFragments(pktinfo)
local addr0 = pktinfo.net_src
local addr1 = pktinfo.net_dst
local port0 = pktinfo.src_port
local port1 = pktinfo.dst_port
local key = tostring(addr0) .. ":" .. tostring(port0) .. "->" .. tostring(addr1) .. ":" .. tostring(port1)
local tableRecord = tableItem(pktinfo)
if tableRecord.sslFragments[key] == nil then
tableRecord.sslFragments[key] = {}
end
return tableRecord.sslFragments[key]
end
function dissectV2(in_tvbuf, pktinfo, tree)
-- dprint2("dissecting in UDP2 mode")
local pktlen = in_tvbuf:reported_length_remaining()
if pktlen < 7 then
dprint2("packet ", pktinfo.number, " too short, len=", pktlen)
return
end
local conversation = tableItem(pktinfo)
local sourceState = nil
local targetState = nil
if rdpudp.prefs.track_udp2_peer_states then
if tostring(pktinfo.net_dst) == conversation.serverAddr then
sourceState = conversation.clientState
targetState = conversation.serverState
else
sourceState = conversation.serverState
targetState = conversation.clientState
end
end
pktinfo.cols.info = ""
local info = "("
local tvbuf = unwrapPacket(in_tvbuf)
local prefixRange = tvbuf:range(0, 1)
local prefix_tree = tree:add(pf_PacketPrefixByte, prefixRange)
--
local packetType = prefix_tree:add(pf_packetType, prefixRange)
local flagsRange = tvbuf:range(1,2)
local flagsTree = tree:add_le(pf_flags, flagsRange)
--
flagsTree:add_packet_field(pf_flag_ack, flagsRange, ENC_LITTLE_ENDIAN)
flagsTree:add_le(pf_flag_data, flagsRange)
flagsTree:add_le(pf_flag_ackvec, flagsRange)
flagsTree:add_le(pf_flag_aoa, flagsRange)
flagsTree:add_le(pf_flag_overhead, flagsRange)
flagsTree:add_le(pf_flag_delayackinfo, flagsRange)
tree:add_le(pf_logWindow, flagsRange)
local flags = tvbuf:range(1,2):le_uint()
local startAt = 3
if bit32.band(flags, RDPUDP2_ACK) ~= 0 then
-- dprint2("got ACK payload")
info = info .. "ACK,"
local ackTree = tree:add("Ack")
ackTree:add_le(pf_AckSeq, tvbuf:range(startAt, 2))
ackTree:add_le(pf_AckTs, tvbuf:range(startAt+2, 3))
ackTree:add(pf_AckSendTimeGap, tvbuf:range(startAt+5, 1))
ackTree:add(pf_ndelayedAcks, tvbuf:range(startAt+6, 1))
ackTree:add(pf_delayedTimeScale, tvbuf:range(startAt+6, 1))
local ackSeq = tvbuf:range(startAt, 2):le_uint()
local ackTs = tvbuf:range(startAt+2, 3):le_uint()
local nacks = bit32.band(tvbuf:range(startAt+6, 1):le_uint(), 0xf)
local delayAckTimeScale = bit32.rshift(bit32.band(tvbuf:range(startAt+6, 1):le_uint(), 0xf0), 4)
-- dprint2(pktinfo.number,": nACKs=", nacks, "delayAckTS=", bit32.rshift(delayAckTimeScale, 4))
if rdpudp.prefs.track_udp2_peer_states then
targetState.senderLow = ackSeq
end
startAt = startAt + 7
if nacks ~= 0 then
local acksItem = ackTree:add(pf_delayedAcks, tvbuf:range(startAt, nacks))
local i
for i = nacks-1, 0, -1 do
local ackDelay = tvbuf:range(startAt+i, 1):le_uint() * bit32.lshift(1, delayAckTimeScale)
acksItem:add(pf_delayedAck, tvbuf:range(startAt+i, 1), "seq=0x" .. string.format("%0.4x", ackSeq-i-1) .. " ts=" .. ackTs-ackDelay)
end
acksItem:add(pf_delayedAck, tvbuf:range(startAt, nacks), "seq=0x" .. string.format("%0.4x", ackSeq) .. " ts=" .. ackTs):set_generated()
end
startAt = startAt + nacks
end
if bit32.band(flags, RDPUDP2_OVERHEAD) ~= 0 then
info = info .. "OVERHEAD,"
tree:add_le(pf_OverHeadSize, tvbuf:range(startAt, 1))
startAt = startAt + 1
end
if bit32.band(flags, RDPUDP2_DELAYACK) ~= 0 then
info = info .. "DELAYEDACK,"
local delayAckItem = tree:add("DelayAckInfo", tvbuf:range(startAt, 3))
delayAckItem:add_le(pf_DelayAckMax, tvbuf:range(startAt, 1))
delayAckItem:add_le(pf_DelayAckTimeout, tvbuf:range(startAt+1, 2))
startAt = startAt + 3
end
if bit32.band(flags, RDPUDP2_AOA) ~= 0 then
info = info .. "AOA,"
tree:add_le(pf_AckOfAcks, tvbuf:range(startAt, 2))
startAt = startAt + 2
end
local dataTree
local isDummy = (field_rdpudp2_packetType()() == 0x8)
if bit32.band(flags, RDPUDP2_DATA) ~= 0 then
if isDummy then
info = info .. "DUMMY,"
else
info = info .. "DATA,"
end
dataTree = tree:add(isDummy and "Dummy Data" or "Data")
dataTree:add_le(pf_DataSeqNumber, tvbuf:range(startAt, 2))
startAt = startAt + 2
end
if bit32.band(flags, RDPUDP2_ACKVEC) ~= 0 then
-- dprint2("got ACKVEC payload")
info = info .. "ACKVEC,"
local codedAckVecSizeA = tvbuf:range(startAt+2, 1):le_uint()
local codedAckVecSize = bit32.band(codedAckVecSizeA, 0x7f)
local haveTs = bit32.band(codedAckVecSizeA, 0x80) ~= 0
local ackVecTree = tree:add("AckVec")
ackVecTree:add_le(pf_AckvecBaseSeq, tvbuf:range(startAt, 2))
ackVecTree:add(pf_AckvecCodecAckVecSize, tvbuf:range(startAt+2, 1))
ackVecTree:add(pf_AckvecHaveTs, tvbuf:range(startAt+2, 1))
startAt = startAt + 3
if haveTs then
ackVecTree:add_le(pf_AckvecTimeStamp, tvbuf:range(startAt, 4))
startAt = startAt + 4
end
local codedAckVector = ackVecTree:add("Vector", tvbuf:range(startAt, codedAckVecSize))
local seqNumber = field_rdpudp2_ackvec_base()()
for i = 0, codedAckVecSize-1, 1 do
local bRange = tvbuf:range(startAt + i, 1)
local b = bRange:uint()
local codedAck = codedAckVector:add(pf_AckvecCodedAck, bRange, b)
codedAck:add(pf_AckvecCodedAckMode, bRange)
local itemString = "";
if bit32.band(b, 0x80) == 0 then
-- bitmap length mode
itemString = string.format("bitmap(0x%0.2x): ", b)
local mask = 0x1
for j = 0, 7-1 do
flag = "!"
if bit32.band(b, mask) ~= 0 then
flag = ""
end
itemString = itemString .. " " .. flag .. string.format("%0.4x", seqNumber)
mask = mask * 2
seqNumber = seqNumber + 1
end
else
-- run length mode
codedAck:add(pf_AckvecCodedAckRleState, bRange)
codedAck:add(pf_AckvecCodedAckRleLen, bRange)
local rleLen = bit32.band(b, 0x3f)
itemString = "rle(len=" .. rleLen .. "): ".. (bit32.band(b, 0x40) and "received" or "lost") ..
string.format(" %0.4x -> %0.4x", seqNumber, seqNumber + rleLen)
seqNumber = seqNumber + rleLen
end
codedAck:set_text(itemString)
end
startAt = startAt + codedAckVecSize
end
if not isDummy and bit32.band(flags, RDPUDP2_DATA) ~= 0 then
dataTree:add_le(pf_DataChannelSeqNumber, tvbuf:range(startAt, 2))
local payload = tvbuf:range(startAt + 2)
local subTvb = payload:tvb("payload")
local channelSeqId = field_rdpudp2_channelSeqNumber()()
local sslFragments = getSslFragments(pktinfo)
local workTvb = nil
local sslRes, recordLen = checkSslRecord(subTvb)
if rdpudp.prefs.debug_ssl then
dprint2("packet=", pktinfo.number, " channelSeq=", channelSeqId,
" dataLen=", subTvb:reported_length_remaining(),
" sslRes=", sslResNames[sslRes],
" recordLen=", recordLen)
end
if sslRes == TLS_OK then
workTvb = subTvb
elseif sslRes == TLS_SHORT or sslRes == TLS_NOT_COMPLETE then
if rdpudp.prefs.debug_ssl then
dprint2("packet=", pktinfo.number, " recording fragment len=", subTvb:len())
end
local frag = ByteArray.new()
frag:append(subTvb:bytes())
sslFragments[channelSeqId] = frag
elseif sslRes == TLS_NOT_TLS then
local prevFragment = sslFragments[channelSeqId-1]
if rdpudp.prefs.debug_ssl then
dprint2("packet=",pktinfo.number," picking channelSeq=", channelSeqId-1, " havePrevFragment=", prevFragment ~= nil and "ok" or "no")
end
if prevFragment ~= nil then
-- dprint2("prevLen=",prevFragment:len(), " subTvbLen=",subTvb:len())
local testBytes = prevFragment .. subTvb:bytes()
local testTvb = ByteArray.tvb(testBytes, "reassembled fragment")
sslRes, recordLen = checkSslRecord(testTvb)
if rdpudp.prefs.debug_ssl then
dprint2("packet=", pktinfo.number,
" reassembled len=", testTvb:reported_length_remaining(),
" sslRes=", sslResNames[sslRes],
" recordLen=", recordLen)
end
if sslRes == TLS_OK then
workTvb = testTvb
end
end
end
if workTvb ~= nil then
repeat
if rdpudp.prefs.debug_ssl then
dprint2("treating workTvbLen=", workTvb:reported_length_remaining(), " recordLen=",recordLen)
end
local sslFragment = workTvb:range(0, recordLen):tvb("SSL fragment")
sslDissector:call(sslFragment, pktinfo, dataTree)
workTvb = workTvb:range(recordLen):tvb()
sslRes, recordLen = checkSslRecord(workTvb)
if sslRes == TLS_SHORT or sslRes == TLS_NOT_COMPLETE then
if rdpudp.prefs.debug_ssl then
dprint2("packet=", pktinfo.number, " recording fragment len=", subTvb:len())
end
local frag = ByteArray.new()
frag:append(workTvb:bytes())
sslFragments[channelSeqId] = frag
end
until sslRes ~= TLS_OK or workTvb:reported_length_remaining() == 0
else
dataTree:add_le(pf_Data, payload)
end
end
info = string.sub(info, 0, -2) .. ")"
pktinfo.cols.info = info -- .. tostring(pktinfo.cols.info)
if rdpudp.prefs.track_udp2_peer_states then
local stateTrackItem = tree:add("UDP2 state tracking")
stateTrackItem:set_generated()
stateTrackItem:add(tostring(pktinfo.net_dst) == conversation.serverAddr and "Client -> Server" or "Server -> Client")
end
return pktlen
end
function rdpudp.dissector(in_tvbuf, pktinfo, root)
-- dprint2("rdpudp.dissector called")
pktinfo.cols.protocol:set("RDP-UDP")
local pktlen = in_tvbuf:reported_length_remaining()
local tree = root:add(rdpudp, in_tvbuf:range(0,pktlen))
local tableRecord = tableItem(pktinfo)
local doDissectV1 = true
if tableRecord.switchToUdp2 ~= nil and tableRecord.switchToUdp2 < pktinfo.number then
doDissectV1 = false
end
if doDissectV1 then
return dissectV1(in_tvbuf, pktinfo, tree)
end
return dissectV2(in_tvbuf, pktinfo, tree)
end
DissectorTable.get("udp.port"):add(3389, rdpudp)
Reference in New Issue View Git Blame Copy Permalink