diff options
Diffstat (limited to '')
| -rw-r--r-- | tools/wireshark/rdp-udp.lua | 709 |
1 files changed, 709 insertions, 0 deletions
diff --git a/tools/wireshark/rdp-udp.lua b/tools/wireshark/rdp-udp.lua new file mode 100644 index 0000000..ce80ece --- /dev/null +++ b/tools/wireshark/rdp-udp.lua @@ -0,0 +1,709 @@ +--[[ + RDP UDP transport dissector for wireshark + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + Copyright 2021 David Fort <contact@hardening-consulting.com> +--]] + +local sslDissector = Dissector.get ("tls") +local dtlsDissector = Dissector.get ("dtls") + +local dprint = function(...) + print(table.concat({"Lua:", ...}," ")) +end + +local dprint2 = dprint + +dprint2("loading RDP-UDP with wireshark=", get_version()) + +local rdpudp = Proto("rdpudp", "UDP transport for RDP") + +-- UDP1 fields +local pf_udp_snSourceAck = ProtoField.uint32("rdpudp.snsourceack", "snSourceAck", base.HEX) +local pf_udp_ReceiveWindowSize = ProtoField.uint16("rdpudp.receivewindowsize", "ReceiveWindowSize", base.DEC) +local pf_udp_flags = ProtoField.uint16("rdpudp.flags", "Flags", base.HEX) + +RDPUDP_SYN = 0x0001 +RDPUDP_FIN = 0x0002 +RDPUDP_ACK = 0x0004 +RDPUDP_DATA = 0x0008 +RDPUDP_FEC = 0x0010 +RDPUDP_CN = 0x0020 +RDPUDP_CWR = 0x0040 +RDPUDP_AOA = 0x0100 +RDPUDP_SYNLOSSY = 0x0200 +RDPUDP_ACKDELAYED = 0x0400 +RDPUDP_CORRELATIONID = 0x0800 +RDPUDP_SYNEX = 0x1000 + +local pf_udp_flag_syn = ProtoField.bool("rdpudp.flags.syn", "Syn", base.HEX, nil, RDPUDP_SYN) +local pf_udp_flag_fin = ProtoField.bool("rdpudp.flags.fin", "Fin", base.HEX, nil, RDPUDP_FIN) +local pf_udp_flag_ack = ProtoField.bool("rdpudp.flags.ack", "Ack", base.HEX, nil, RDPUDP_ACK) +local pf_udp_flag_data = ProtoField.bool("rdpudp.flags.data", "Data", base.HEX, nil, RDPUDP_DATA) +local pf_udp_flag_fec = ProtoField.bool("rdpudp.flags.fec", "FECData", base.HEX, nil, RDPUDP_FEC) +local pf_udp_flag_cn = ProtoField.bool("rdpudp.flags.cn", "CN", base.HEX, nil, RDPUDP_CN) +local pf_udp_flag_cwr = ProtoField.bool("rdpudp.flags.cwr", "CWR", base.HEX, nil, RDPUDP_CWR) +local pf_udp_flag_aoa = ProtoField.bool("rdpudp.flags.aoa", "Ack of Acks", base.HEX, nil, RDPUDP_AOA) +local pf_udp_flag_synlossy = ProtoField.bool("rdpudp.flags.synlossy", "Syn lossy", base.HEX, nil, RDPUDP_SYNLOSSY) +local pf_udp_flag_ackdelayed = ProtoField.bool("rdpudp.flags.ackdelayed", "Ack delayed", base.HEX, nil, RDPUDP_ACKDELAYED) +local pf_udp_flag_correlationId = ProtoField.bool("rdpudp.flags.correlationid", "Correlation id", base.HEX, nil, RDPUDP_CORRELATIONID) +local pf_udp_flag_synex = ProtoField.bool("rdpudp.flags.synex", "SynEx", base.HEX, nil, RDPUDP_SYNEX) + +local pf_udp_snInitialSequenceNumber = ProtoField.uint32("rdpudp.initialsequencenumber", "Initial SequenceNumber", base.HEX) +local pf_udp_upstreamMtu = ProtoField.uint16("rdpudp.upstreammtu", "Upstream MTU", base.DEC) +local pf_udp_downstreamMtu = ProtoField.uint16("rdpudp.downstreammtu", "DownStream MTU", base.DEC) + +local pf_udp_correlationId = ProtoField.new("Correlation Id", "rdpudp.correlationid", ftypes.BYTES) + +local pf_udp_synex_flags = ProtoField.uint16("rdpudp.synex.flags", "Flags", base.HEX) +local pf_udp_synex_flag_version = ProtoField.bool("rdpudp.synex.flags.versioninfo", "Version info", base.HEX, nil, 0x0001) +local pf_udp_synex_version = ProtoField.uint16("rdpudp.synex.version", "Version", base.HEX, {[1]="Version 1", [2]="Version 2", [0x101]="Version 3"}) +local pf_udp_synex_cookiehash = ProtoField.new("Cookie Hash", "rdpudp.synex.cookiehash", ftypes.BYTES) + +local pf_udp_ack_vectorsize = ProtoField.uint16("rdpudp.ack.vectorsize", "uAckVectorSize", base.DEC) +local pf_udp_ack_item = ProtoField.uint8("rdpudp.ack.item", "Ack item", base.HEX) +local pf_udp_ack_item_state = ProtoField.uint8("rdpudp.ack.item.state", "VECTOR_ELEMENT_STATE", base.HEX, {[0]="Received", [1]="Reserved 1", [2]="Reserved 2", [3]="Pending"}, 0xc0) +local pf_udp_ack_item_rle = ProtoField.uint8("rdpudp.ack.item.rle", "Run length", base.DEC, nil, 0x3f) + +local pf_udp_fec_coded = ProtoField.uint32("rdpudp.fec.coded", "snCoded", base.HEX) +local pf_udp_fec_sourcestart = ProtoField.uint32("rdpudp.fec.sourcestart", "snSourceStart", base.HEX) +local pf_udp_fec_range = ProtoField.uint8("rdpudp.fec.range", "Range", base.DEC) +local pf_udp_fec_fecindex = ProtoField.uint8("rdpudp.fec.fecindex", "Fec index", base.HEX) + +local pf_udp_resetseqenum = ProtoField.uint32("rdpudp.resetSeqNum", "snResetSeqNum", base.HEX) + +local pf_udp_source_sncoded = ProtoField.uint32("rdpudp.data.sncoded", "snCoded", base.HEX) +local pf_udp_source_snSourceStart = ProtoField.uint32("rdpudp.data.sourceStart", "snSourceStart", base.HEX) + + +-- UDP2 fields +local pf_PacketPrefixByte = ProtoField.new("PacketPrefixByte", "rdpudp2.prefixbyte", ftypes.UINT8, nil, base.HEX) + +local pf_packetType = ProtoField.uint8("rdpudp2.packetType", "PacketType", base.HEX, {[0] = "Data", [8] = "Dummy"}, 0x1e, "type of packet") + +RDPUDP2_ACK = 0x0001 +RDPUDP2_DATA = 0x0004 +RDPUDP2_ACKVEC = 0x0008 +RDPUDP2_AOA = 0x0010 +RDPUDP2_OVERHEAD = 0x0040 +RDPUDP2_DELAYACK = 0x00100 + +local pf_flags = ProtoField.uint16("rdpudp2.flags", "Flags", base.HEX, nil, 0xfff, "flags") +local pf_flag_ack = ProtoField.bool("rdpudp2.flags.ack", "Ack", base.HEX, nil, RDPUDP2_ACK, "packet contains Ack payload") +local pf_flag_data = ProtoField.bool("rdpudp2.flags.data", "Data", base.HEX, nil, RDPUDP2_DATA, "packet contains Data payload") +local pf_flag_ackvec = ProtoField.bool("rdpudp2.flags.ackvec", "AckVec", base.HEX, nil, RDPUDP2_ACKVEC, "packet contains AckVec payload") +local pf_flag_aoa = ProtoField.bool("rdpudp2.flags.ackofacks", "AckOfAcks", base.HEX, nil, RDPUDP2_AOA, "packet contains AckOfAcks payload") +local pf_flag_overhead = ProtoField.bool("rdpudp2.flags.overheadsize", "OverheadSize", base.HEX, nil, RDPUDP2_OVERHEAD, "packet contains OverheadSize payload") +local pf_flag_delayackinfo = ProtoField.bool("rdpudp2.flags.delayackinfo", "DelayedAckInfo", base.HEX, nil, RDPUDP2_DELAYACK, "packet contains DelayedAckInfo payload") + +local pf_logWindow = ProtoField.uint16("rdpudp2.logWindow", "LogWindow", base.DEC, nil, 0xf000, "flags") + +local pf_AckSeq = ProtoField.uint16("rdpudp2.ack.seqnum", "Base Seq", base.HEX) +local pf_AckTs = ProtoField.uint24("rdpudp2.ack.ts", "receivedTS", base.DEC) +local pf_AckSendTimeGap = ProtoField.uint8("rdpudp2.ack.sendTimeGap", "sendTimeGap", base.DEC) +local pf_ndelayedAcks = ProtoField.uint8("rdpudp2.ack.numDelayedAcks", "NumDelayedAcks", base.DEC, nil, 0x0f) +local pf_delayedTimeScale = ProtoField.uint8("rdpudp2.ack.delayedTimeScale", "delayedTimeScale", base.DEC, nil, 0xf0) +local pf_delayedAcks = ProtoField.new("Delayed acks", "rdpudp2.ack.delayedAcks", ftypes.BYTES) +local pf_delayedAck = ProtoField.uint8("rdpudp2.ack.delayedAck", "Delayed ack", base.DEC) + +local pf_OverHeadSize = ProtoField.uint8("rdpudp2.overheadsize", "Overhead size", base.DEC) + +local pf_DelayAckMax = ProtoField.uint8("rdpudp2.delayackinfo.max", "MaxDelayedAcks", base.DEC) +local pf_DelayAckTimeout = ProtoField.uint8("rdpudp2.delayackinfo.timeout", "DelayedAckTimeoutInMs", base.DEC) + +local pf_AckOfAcks = ProtoField.uint16("rdpudp2.ackofacks", "Ack of Acks", base.HEX) + +local pf_DataSeqNumber = ProtoField.uint16("rdpudp2.data.seqnum", "sequence number", base.HEX) +local pf_DataChannelSeqNumber = ProtoField.uint16("rdpudp2.data.channelseqnumber", "Channel sequence number", base.HEX) +local pf_Data = ProtoField.new("Data", "rdpudp2.data", ftypes.BYTES) + +local pf_AckvecBaseSeq = ProtoField.uint16("rdpudp2.ackvec.baseseqnum", "Base sequence number", base.HEX) +local pf_AckvecCodecAckVecSize = ProtoField.uint16("rdpudp2.ackvec.codecackvecsize", "Codec ackvec size", base.DEC, nil, 0x7f) +local pf_AckvecHaveTs = ProtoField.bool("rdpudp2.ackvec.havets", "have timestamp", base.DEC, nil, 0x80) +local pf_AckvecTimeStamp = ProtoField.uint24("rdpudp2.ackvec.timestamp", "Timestamp", base.HEX) +local pf_AckvecCodedAck = ProtoField.uint8("rdpudp2.ackvec.codecAck", "Coded Ack", base.HEX) +local pf_AckvecCodedAckMode = ProtoField.uint8("rdpudp2.ackvec.codecAckMode", "Mode", base.HEX, {[0]="Bitmap", [1]="Run length"}, 0x80) +local pf_AckvecCodedAckRleState = ProtoField.uint8("rdpudp2.ackvec.codecAckRleState", "State", base.HEX, {[0]="lost",[1]="received"}, 0x40) +local pf_AckvecCodedAckRleLen = ProtoField.uint8("rdpudp2.ackvec.codecAckRleLen", "Length", base.DEC, nil, 0x3f) + +rdpudp.fields = { + -- UDP1 + pf_udp_snSourceAck, pf_udp_ReceiveWindowSize, pf_udp_flags, pf_udp_flag_syn, + pf_udp_flag_fin, pf_udp_flag_ack, pf_udp_flag_data, pf_udp_flag_fec, pf_udp_flag_cn, + pf_udp_flag_cwr, pf_udp_flag_aoa, pf_udp_flag_synlossy, pf_udp_flag_ackdelayed, + pf_udp_flag_correlationId, pf_udp_flag_synex, + pf_udp_snInitialSequenceNumber, pf_udp_upstreamMtu, pf_udp_downstreamMtu, + pf_udp_correlationId, + pf_udp_synex_flags, pf_udp_synex_flag_version, pf_udp_synex_version, pf_udp_synex_cookiehash, + pf_udp_ack_vectorsize, pf_udp_ack_item, pf_udp_ack_item_state, pf_udp_ack_item_rle, + pf_udp_fec_coded, pf_udp_fec_sourcestart, pf_udp_fec_range, pf_udp_fec_fecindex, + pf_udp_resetseqenum, + pf_udp_source_sncoded, pf_udp_source_snSourceStart, + + -- UDP2 + pf_PacketPrefixByte, pf_packetType, + pf_flags, pf_flag_ack, pf_flag_data, pf_flag_ackvec, pf_flag_aoa, pf_flag_overhead, pf_flag_delayackinfo, + pf_logWindow, + pf_Ack, pf_AckSeq, pf_AckTs, pf_AckSendTimeGap, pf_ndelayedAcks, pf_delayedTimeScale, pf_delayedAcks, + pf_OverHeadSize, + pf_DelayAckMax, pf_DelayAckTimeout, + pf_AckOfAcks, + pf_DataSeqNumber, pf_Data, pf_DataChannelSeqNumber, + pf_Ackvec, pf_AckvecBaseSeq, pf_AckvecCodecAckVecSize, pf_AckvecHaveTs, pf_AckvecTimeStamp, pf_AckvecCodedAck, pf_AckvecCodedAckMode, + pf_AckvecCodedAckRleState, pf_AckvecCodedAckRleLen +} + +rdpudp.prefs.track_udp2_peer_states = Pref.bool("Track state of UDP2 peers", true, "Keep track of state of UDP2 peers (receiver and sender windows") +rdpudp.prefs.debug_ssl = Pref.bool("SSL debug message", false, "print verbose message of the SSL fragments reassembly") + + + +local field_rdpudp_flags = Field.new("rdpudp.flags") +local field_rdpudp2_packetType = Field.new("rdpudp2.packetType") +local field_rdpudp2_channelSeqNumber = Field.new("rdpudp2.data.channelseqnumber") +local field_rdpudp2_ackvec_base = Field.new("rdpudp2.ackvec.baseseqnum") + +function unwrapPacket(tvbuf) + local len = tvbuf:reported_length_remaining() + local ret = tvbuf:bytes(7, 1) .. tvbuf:bytes(1, 6) .. tvbuf:bytes(0, 1) .. tvbuf:bytes(8, len-8) + --dprint2("iput first bytes=", tvbuf:bytes(0, 9):tohex(true, " ")) + --dprint2("oput first bytes=", ret:subset(0, 9):tohex(true, " ")) + return ret:tvb("RDP-UDP unwrapped") +end + +function rdpudp.init() + udpComms = {} +end + +function computePacketKey(pktinfo) + local addr_lo = pktinfo.net_src + local addr_hi = pktinfo.net_dst + local port_lo = pktinfo.src_port + local port_hi = pktinfo.dst_port + + if addr_lo > addr_hi then + addr_hi, addr_lo = addr_lo, addr_hi + port_hi, port_lo = port_lo, port_hi + end + + return tostring(addr_lo) .. ":" .. tostring(port_lo) .. " -> " .. tostring(addr_hi) .. ":" .. tostring(port_hi) +end + +function tableItem(pktinfo) + local key = computePacketKey(pktinfo) + local ret = udpComms[key] + if ret == nil then + dprint2(pktinfo.number .. " creating entry for " .. key) + udpComms[key] = { isLossy = false, switchToUdp2 = nil, sslFragments = {}, + serverAddr = nil, clientAddr = nil, + serverState = { receiveLow = nil, receiveHigh = nil, senderLow = nil, senderHigh = nil }, + clientState = { receiveLow = nil, receiveHigh = nil, senderLow = nil, senderHigh = nil } + } + ret = udpComms[key] + end + return ret +end + +function doAlign(v, alignment) + local rest = v % alignment + if rest ~= 0 then + return v + alignment - rest + end + return v +end + +function dissectV1(tvbuf, pktinfo, tree) + --dprint2("dissecting in UDP1 mode") + local pktlen = tvbuf:reported_length_remaining() + + tree:add(pf_udp_snSourceAck, tvbuf:range(0, 4)) + tree:add(pf_udp_ReceiveWindowSize, tvbuf:range(4, 2)) + local flagsRange = tvbuf:range(6, 2) + local flagsItem = tree:add(pf_udp_flags, flagsRange) + -- + flagsItem:add(pf_udp_flag_syn, flagsRange) + flagsItem:add(pf_udp_flag_fin, flagsRange) + flagsItem:add(pf_udp_flag_ack, flagsRange) + flagsItem:add(pf_udp_flag_data, flagsRange) + flagsItem:add(pf_udp_flag_fec, flagsRange) + flagsItem:add(pf_udp_flag_cn, flagsRange) + flagsItem:add(pf_udp_flag_cwr, flagsRange) + flagsItem:add(pf_udp_flag_aoa, flagsRange) + flagsItem:add(pf_udp_flag_synlossy, flagsRange) + flagsItem:add(pf_udp_flag_ackdelayed, flagsRange) + flagsItem:add(pf_udp_flag_correlationId, flagsRange) + flagsItem:add(pf_udp_flag_synex, flagsRange) + + startAt = 8 + local flags = flagsRange:uint() + local haveSyn = bit32.band(flags, RDPUDP_SYN) ~= 0 + local haveAck = bit32.band(flags, RDPUDP_ACK) ~= 0 + local isLossySyn = bit32.band(flags, RDPUDP_SYNLOSSY) ~= 0 + local tableRecord = tableItem(pktinfo) + + + if isLossySyn then + tableRecord.isLossy = true + end + + if haveSyn then + -- dprint2("rdpudp - SYN") + local synItem = tree:add("Syn", tvbuf:range(startAt, 8)) + + synItem:add(pf_udp_snInitialSequenceNumber, tvbuf:range(startAt, 4)) + synItem:add(pf_udp_upstreamMtu, tvbuf:range(startAt+4, 2)) + synItem:add(pf_udp_downstreamMtu, tvbuf:range(startAt+6, 2)) + + startAt = startAt + 8 + end + + if bit32.band(flags, RDPUDP_CORRELATIONID) ~= 0 then + -- dprint2("rdpudp - CorrelationId") + tree:add(pf_udp_correlationId, tvbuf:range(startAt, 16)) + startAt = startAt + 32 + end + + if bit32.band(flags, RDPUDP_SYNEX) ~= 0 then + -- dprint2("rdpudp - SynEx") + local synexItem = tree:add("SynEx") + + local synexFlagsRange = tvbuf:range(startAt, 2) + local synexFlags = synexItem:add(pf_udp_synex_flags, synexFlagsRange); + -- + synexFlags:add(pf_udp_synex_flag_version, synexFlagsRange) + local exflags = synexFlagsRange:uint() + startAt = startAt + 2 + if bit32.band(exflags, 1) ~= 0 then + synexItem:add(pf_udp_synex_version, tvbuf:range(startAt, 2)) + local versionVal = tvbuf:range(startAt, 2):uint() + startAt = startAt + 2 + + if versionVal == 0x101 then + if not haveAck then + synexItem:add(pf_udp_synex_cookiehash, tvbuf:range(startAt, 32)) + startAt = startAt + 32 + else + -- switch to UDP2 + tableRecord.switchToUdp2 = pktinfo.number + end + end + end + + local mask = RDPUDP_SYN + RDPUDP_ACK + if bit32.band(flags, mask) == mask then + tableRecord.serverAddr = tostring(pktinfo.net_src) + tableRecord.clientAddr = tostring(pktinfo.net_dst) + -- dprint2(pktinfo.number .. ": key='" .. computePacketKey(pktinfo) .. + -- "' setting server=" .. tableRecord.serverAddr .. " client=" .. tableRecord.clientAddr) + end + end + + if haveAck and not haveSyn then + -- dprint2("rdpudp - Ack") + local ackItem = tree:add("Ack") + ackItem:add(pf_udp_ack_vectorsize, tvbuf:range(startAt, 2)) + + local i = 0 + uAckVectorSize = tvbuf:range(startAt, 2):uint() + while i < uAckVectorSize do + local ackRange = tvbuf:range(startAt + 2 + i, 1) + local ack = ackItem:add(pf_udp_ack_item, ackRange) + ack:add(pf_udp_ack_item_state, ackRange) + ack:add(pf_udp_ack_item_rle, ackRange) + i = i + 1 + end -- while + + -- aligned on a dword (4 bytes) boundary + -- dprint2("pktinfo=",pktinfo.number," blockSz=",doAlign(2 + uAckVectorSize, 4)) + startAt = startAt + doAlign(2 + uAckVectorSize, 4) + end + + if bit32.band(flags, RDPUDP_FEC) ~= 0 then + -- dprint2("rdpudp - FEC header") + local fecItem = tree:add("FEC", tvbuf:range(startAt, 12)) + fecItem:add(pf_udp_fec_coded, tvbuf:range(startAt, 4)) + fecItem:add(pf_udp_fec_sourcestart, tvbuf:range(startAt+4, 4)) + fecItem:add(pf_udp_fec_range, tvbuf:range(startAt+8, 1)) + fecItem:add(pf_udp_fec_fecindex, tvbuf:range(startAt+9, 1)) + + startAt = startAt + (4 * 3) + end + + if bit32.band(flags, RDPUDP_AOA) ~= 0 then + -- dprint2("rdpudp - AOA") + tree:add(pf_udp_resetseqenum, tvbuf:range(startAt, 4)) + startAt = startAt + 4 + end + + if bit32.band(flags, RDPUDP_DATA) ~= 0 then + -- dprint2("rdpudp - Data") + local dataItem = tree:add("Data") + dataItem:add(pf_udp_source_sncoded, tvbuf:range(startAt, 4)) + dataItem:add(pf_udp_source_snSourceStart, tvbuf:range(startAt+4, 4)) + startAt = startAt + 8 + + local payload = tvbuf:range(startAt) + local subTvb = payload:tvb("payload") + if tableRecord.isLossy then + dtlsDissector:call(subTvb, pktinfo, dataItem) + else + sslDissector:call(subTvb, pktinfo, dataItem) + end + end + + return pktlen +end + +-- given a tvb containing SSL records returns the part of the buffer that has complete +-- SSL records +function getCompleteSslRecordsLen(tvb) + local startAt = 0 + local remLen = tvb:reported_length_remaining() + + while remLen > 5 do + local recordLen = 5 + tvb:range(startAt+3, 2):uint() + if remLen < recordLen then + break + end + startAt = startAt + recordLen + remLen = remLen - recordLen + end -- while + + return startAt; +end + +TLS_OK = 0 +TLS_SHORT = 1 +TLS_NOT_TLS = 2 +TLS_NOT_COMPLETE = 3 +sslResNames = {[0]="TLS_OK", [1]="TLS_SHORT", [2]="TLS_NOT_TLS", [3]="TLS_NOT_COMPLETE"} + +function checkSslRecord(tvb) + local remLen = tvb:reported_length_remaining() + + if remLen <= 5 then + return TLS_SHORT, 0 + end + + local b0 = tvb:range(0, 1):uint() + if b0 < 0x14 or b0 > 0x17 then + -- dprint2("doesn't look like a SSL record, b0=",b0) + return TLS_NOT_TLS, 0 + end + + local recordLen = 5 + tvb:range(3, 2):uint() + if remLen < recordLen then + return TLS_NOT_COMPLETE, recordLen + end + return TLS_OK, recordLen +end + + +function getSslFragments(pktinfo) + local addr0 = pktinfo.net_src + local addr1 = pktinfo.net_dst + local port0 = pktinfo.src_port + local port1 = pktinfo.dst_port + local key = tostring(addr0) .. ":" .. tostring(port0) .. "->" .. tostring(addr1) .. ":" .. tostring(port1) + + local tableRecord = tableItem(pktinfo) + if tableRecord.sslFragments[key] == nil then + tableRecord.sslFragments[key] = {} + end + + return tableRecord.sslFragments[key] +end + +function dissectV2(in_tvbuf, pktinfo, tree) + -- dprint2("dissecting in UDP2 mode") + local pktlen = in_tvbuf:reported_length_remaining() + if pktlen < 7 then + dprint2("packet ", pktinfo.number, " too short, len=", pktlen) + return + end + + local conversation = tableItem(pktinfo) + local sourceState = nil + local targetState = nil + if rdpudp.prefs.track_udp2_peer_states then + if tostring(pktinfo.net_dst) == conversation.serverAddr then + sourceState = conversation.clientState + targetState = conversation.serverState + else + sourceState = conversation.serverState + targetState = conversation.clientState + end + end + + pktinfo.cols.info = "" + local info = "(" + local tvbuf = unwrapPacket(in_tvbuf) + local prefixRange = tvbuf:range(0, 1) + local prefix_tree = tree:add(pf_PacketPrefixByte, prefixRange) + -- + local packetType = prefix_tree:add(pf_packetType, prefixRange) + + local flagsRange = tvbuf:range(1,2) + local flagsTree = tree:add_le(pf_flags, flagsRange) + -- + flagsTree:add_packet_field(pf_flag_ack, flagsRange, ENC_LITTLE_ENDIAN) + flagsTree:add_le(pf_flag_data, flagsRange) + flagsTree:add_le(pf_flag_ackvec, flagsRange) + flagsTree:add_le(pf_flag_aoa, flagsRange) + flagsTree:add_le(pf_flag_overhead, flagsRange) + flagsTree:add_le(pf_flag_delayackinfo, flagsRange) + + tree:add_le(pf_logWindow, flagsRange) + + local flags = tvbuf:range(1,2):le_uint() + + local startAt = 3 + if bit32.band(flags, RDPUDP2_ACK) ~= 0 then + -- dprint2("got ACK payload") + info = info .. "ACK," + local ackTree = tree:add("Ack") + + ackTree:add_le(pf_AckSeq, tvbuf:range(startAt, 2)) + ackTree:add_le(pf_AckTs, tvbuf:range(startAt+2, 3)) + ackTree:add(pf_AckSendTimeGap, tvbuf:range(startAt+5, 1)) + ackTree:add(pf_ndelayedAcks, tvbuf:range(startAt+6, 1)) + ackTree:add(pf_delayedTimeScale, tvbuf:range(startAt+6, 1)) + + local ackSeq = tvbuf:range(startAt, 2):le_uint() + local ackTs = tvbuf:range(startAt+2, 3):le_uint() + local nacks = bit32.band(tvbuf:range(startAt+6, 1):le_uint(), 0xf) + local delayAckTimeScale = bit32.rshift(bit32.band(tvbuf:range(startAt+6, 1):le_uint(), 0xf0), 4) + -- dprint2(pktinfo.number,": nACKs=", nacks, "delayAckTS=", bit32.rshift(delayAckTimeScale, 4)) + + if rdpudp.prefs.track_udp2_peer_states then + targetState.senderLow = ackSeq + end + + startAt = startAt + 7 + if nacks ~= 0 then + local acksItem = ackTree:add(pf_delayedAcks, tvbuf:range(startAt, nacks)) + local i + for i = nacks-1, 0, -1 do + local ackDelay = tvbuf:range(startAt+i, 1):le_uint() * bit32.lshift(1, delayAckTimeScale) + acksItem:add(pf_delayedAck, tvbuf:range(startAt+i, 1), "seq=0x" .. string.format("%0.4x", ackSeq-i-1) .. " ts=" .. ackTs-ackDelay) + end + acksItem:add(pf_delayedAck, tvbuf:range(startAt, nacks), "seq=0x" .. string.format("%0.4x", ackSeq) .. " ts=" .. ackTs):set_generated() + end + startAt = startAt + nacks + end + + if bit32.band(flags, RDPUDP2_OVERHEAD) ~= 0 then + info = info .. "OVERHEAD," + + tree:add_le(pf_OverHeadSize, tvbuf:range(startAt, 1)) + startAt = startAt + 1 + end + + if bit32.band(flags, RDPUDP2_DELAYACK) ~= 0 then + info = info .. "DELAYEDACK," + + local delayAckItem = tree:add("DelayAckInfo", tvbuf:range(startAt, 3)) + delayAckItem:add_le(pf_DelayAckMax, tvbuf:range(startAt, 1)) + delayAckItem:add_le(pf_DelayAckTimeout, tvbuf:range(startAt+1, 2)) + startAt = startAt + 3 + end + + if bit32.band(flags, RDPUDP2_AOA) ~= 0 then + info = info .. "AOA," + tree:add_le(pf_AckOfAcks, tvbuf:range(startAt, 2)) + startAt = startAt + 2 + end + + local dataTree + local isDummy = (field_rdpudp2_packetType()() == 0x8) + if bit32.band(flags, RDPUDP2_DATA) ~= 0 then + if isDummy then + info = info .. "DUMMY," + else + info = info .. "DATA," + end + dataTree = tree:add(isDummy and "Dummy Data" or "Data") + dataTree:add_le(pf_DataSeqNumber, tvbuf:range(startAt, 2)) + startAt = startAt + 2 + end + + if bit32.band(flags, RDPUDP2_ACKVEC) ~= 0 then + -- dprint2("got ACKVEC payload") + info = info .. "ACKVEC," + + local codedAckVecSizeA = tvbuf:range(startAt+2, 1):le_uint() + local codedAckVecSize = bit32.band(codedAckVecSizeA, 0x7f) + local haveTs = bit32.band(codedAckVecSizeA, 0x80) ~= 0 + + local ackVecTree = tree:add("AckVec") + ackVecTree:add_le(pf_AckvecBaseSeq, tvbuf:range(startAt, 2)) + ackVecTree:add(pf_AckvecCodecAckVecSize, tvbuf:range(startAt+2, 1)) + ackVecTree:add(pf_AckvecHaveTs, tvbuf:range(startAt+2, 1)) + startAt = startAt + 3 + if haveTs then + ackVecTree:add_le(pf_AckvecTimeStamp, tvbuf:range(startAt, 4)) + startAt = startAt + 4 + end + local codedAckVector = ackVecTree:add("Vector", tvbuf:range(startAt, codedAckVecSize)) + local seqNumber = field_rdpudp2_ackvec_base()() + for i = 0, codedAckVecSize-1, 1 do + local bRange = tvbuf:range(startAt + i, 1) + local b = bRange:uint() + + local codedAck = codedAckVector:add(pf_AckvecCodedAck, bRange, b) + codedAck:add(pf_AckvecCodedAckMode, bRange) + + local itemString = ""; + if bit32.band(b, 0x80) == 0 then + -- bitmap length mode + itemString = string.format("bitmap(0x%0.2x): ", b) + local mask = 0x1 + for j = 0, 7-1 do + flag = "!" + if bit32.band(b, mask) ~= 0 then + flag = "" + end + + itemString = itemString .. " " .. flag .. string.format("%0.4x", seqNumber) + mask = mask * 2 + seqNumber = seqNumber + 1 + end + else + -- run length mode + codedAck:add(pf_AckvecCodedAckRleState, bRange) + codedAck:add(pf_AckvecCodedAckRleLen, bRange) + + local rleLen = bit32.band(b, 0x3f) + itemString = "rle(len=" .. rleLen .. "): ".. (bit32.band(b, 0x40) and "received" or "lost") .. + string.format(" %0.4x -> %0.4x", seqNumber, seqNumber + rleLen) + seqNumber = seqNumber + rleLen + end + + codedAck:set_text(itemString) + + end + + startAt = startAt + codedAckVecSize + end + + if not isDummy and bit32.band(flags, RDPUDP2_DATA) ~= 0 then + dataTree:add_le(pf_DataChannelSeqNumber, tvbuf:range(startAt, 2)) + local payload = tvbuf:range(startAt + 2) + local subTvb = payload:tvb("payload") + + local channelSeqId = field_rdpudp2_channelSeqNumber()() + local sslFragments = getSslFragments(pktinfo) + local workTvb = nil + + local sslRes, recordLen = checkSslRecord(subTvb) + if rdpudp.prefs.debug_ssl then + dprint2("packet=", pktinfo.number, " channelSeq=", channelSeqId, + " dataLen=", subTvb:reported_length_remaining(), + " sslRes=", sslResNames[sslRes], + " recordLen=", recordLen) + end + if sslRes == TLS_OK then + workTvb = subTvb + elseif sslRes == TLS_SHORT or sslRes == TLS_NOT_COMPLETE then + if rdpudp.prefs.debug_ssl then + dprint2("packet=", pktinfo.number, " recording fragment len=", subTvb:len()) + end + + local frag = ByteArray.new() + frag:append(subTvb:bytes()) + sslFragments[channelSeqId] = frag + + elseif sslRes == TLS_NOT_TLS then + local prevFragment = sslFragments[channelSeqId-1] + if rdpudp.prefs.debug_ssl then + dprint2("packet=",pktinfo.number," picking channelSeq=", channelSeqId-1, " havePrevFragment=", prevFragment ~= nil and "ok" or "no") + end + if prevFragment ~= nil then + -- dprint2("prevLen=",prevFragment:len(), " subTvbLen=",subTvb:len()) + local testBytes = prevFragment .. subTvb:bytes() + local testTvb = ByteArray.tvb(testBytes, "reassembled fragment") + + sslRes, recordLen = checkSslRecord(testTvb) + if rdpudp.prefs.debug_ssl then + dprint2("packet=", pktinfo.number, + " reassembled len=", testTvb:reported_length_remaining(), + " sslRes=", sslResNames[sslRes], + " recordLen=", recordLen) + end + if sslRes == TLS_OK then + workTvb = testTvb + end + end + end + + if workTvb ~= nil then + repeat + if rdpudp.prefs.debug_ssl then + dprint2("treating workTvbLen=", workTvb:reported_length_remaining(), " recordLen=",recordLen) + end + local sslFragment = workTvb:range(0, recordLen):tvb("SSL fragment") + sslDissector:call(sslFragment, pktinfo, dataTree) + + workTvb = workTvb:range(recordLen):tvb() + sslRes, recordLen = checkSslRecord(workTvb) + + if sslRes == TLS_SHORT or sslRes == TLS_NOT_COMPLETE then + if rdpudp.prefs.debug_ssl then + dprint2("packet=", pktinfo.number, " recording fragment len=", subTvb:len()) + end + + local frag = ByteArray.new() + frag:append(workTvb:bytes()) + sslFragments[channelSeqId] = frag + end + + until sslRes ~= TLS_OK or workTvb:reported_length_remaining() == 0 + else + dataTree:add_le(pf_Data, payload) + end + end + + info = string.sub(info, 0, -2) .. ")" + pktinfo.cols.info = info -- .. tostring(pktinfo.cols.info) + if rdpudp.prefs.track_udp2_peer_states then + local stateTrackItem = tree:add("UDP2 state tracking") + stateTrackItem:set_generated() + stateTrackItem:add(tostring(pktinfo.net_dst) == conversation.serverAddr and "Client -> Server" or "Server -> Client") + end + + + return pktlen +end + +function rdpudp.dissector(in_tvbuf, pktinfo, root) + -- dprint2("rdpudp.dissector called") + pktinfo.cols.protocol:set("RDP-UDP") + + local pktlen = in_tvbuf:reported_length_remaining() + local tree = root:add(rdpudp, in_tvbuf:range(0,pktlen)) + + local tableRecord = tableItem(pktinfo) + local doDissectV1 = true + if tableRecord.switchToUdp2 ~= nil and tableRecord.switchToUdp2 < pktinfo.number then + doDissectV1 = false + end + + if doDissectV1 then + return dissectV1(in_tvbuf, pktinfo, tree) + end + + return dissectV2(in_tvbuf, pktinfo, tree) +end + +DissectorTable.get("udp.port"):add(3389, rdpudp) |