---
-- This library was written by Patrik Karlsson <patrik@cqure.net> to facilitate
-- communication with the Apple AFP Service. It is not feature complete and
-- still missing several functions.
--
-- The library currently supports
-- * Authentication using the DHX UAM (CAST128)
-- * File reading and writing
-- * Listing sharepoints
-- * Listing directory contents
-- * Querying ACLs and mapping user identities (UIDs)
--
-- The library was built based on the following reference:
-- http://developer.apple.com/mac/library/documentation/Networking/Reference/AFP_Reference/Reference/reference.html
-- http://developer.apple.com/mac/library/documentation/Networking/Conceptual/AFP/AFPSecurity/AFPSecurity.html#//apple_ref/doc/uid/TP40000854-CH232-CHBBAGCB
--
-- Most functions have been tested against both Mac OS X 10.6.2 and Netatalk 2.0.3
--
-- The library contains the following four classes
-- * <code>Response</code>
-- ** A class used as return value by functions in the <code>Proto</code> class.
-- ** The response class acts as a wrapper and holds the response data and any error information.
-- * <code>Proto</code>
-- ** This class contains all the AFP specific functions and calls.
-- ** The functions can be accessed directly but the preferred method is through the <code>Helper</code> class.
-- ** The function names closely resemble those described in the Apple documentation.
-- ** Some functions may lack some of the options outlined in Apple's documentation.
-- * <code>Helper</code>
-- ** The helper class wraps the <code>Proto</code> class using functions with a more descriptive name.
-- ** Functions are task-oriented. For example, <code>ReadFile</code> and usually call several functions in the <code>Proto</code> class.
-- ** The purpose of this class is to give developers easy access to some of the common AFP tasks.
-- * <code>Util</code>
-- ** The <code>Util</code> class contains a number of static functions mainly used to convert data.
--
-- The following information will describe how to use the AFP Helper class to communicate with an AFP server.
--
-- The short version:
-- <code>
-- helper = afp.Helper:new()
-- status, response = helper:OpenSession( host, port )
-- status, response = helper:Login()
-- .. do some fancy AFP stuff ..
-- status, response = helper:Logout()
-- status, response = helper:CloseSession()
-- </code>
--
-- Here's the longer version, with some explanatory text. To start using the Helper class,
-- the script has to create it's own instance. We do this by issuing the following:
-- <code>
-- helper = afp.Helper:new()
-- </code>
--
-- Next a session to the AFP server must be established, this is done using the OpenSession method of the
-- Helper class, like this:
-- <code>
-- status, response = helper:OpenSession( host, port )
-- </code>
--
-- The next step needed to be performed is to authenticate to the server. We need to do this even for
-- functions that are available publically. In order to authenticate as the public user simply
-- authenticate using nil for both username and password. This can be achieved by calling the Login method
-- without any parameters, like this:
-- <code>
-- status, response = helper:Login()
-- </code>
--
-- To authenticate to the server using the username 'admin' and password 'nimda' we do this instead:
-- <code>
-- status, response = helper:Login('admin', 'nimda')
-- </code>
--
-- At this stage we're authenticated and can call any of the AFP functions we're authorized to.
-- For the purpose of this documentation, we will attempt to list the servers share points.
-- We do this by issuing the following:
-- <code>
-- status, shares = helper:ListShares()
-- </code>
--
-- Once we're finnished, we need to logout and close the AFP session this is done by calling the
-- following two methods of the Helper class:
-- <code>
-- status, response = helper:Logout()
-- status, response = helper:CloseSession()
-- </code>
--
-- Consult the documentation of each function to learn more about their respective return values.
--
--@author Patrik Karlsson <patrik@cqure.net>
--@copyright Same as Nmap--See http://nmap.org/book/man-legal.html
--
-- @args afp.username The username to use for authentication.
-- @args afp.password The password to use for authentication.
--
-- Version 0.5
--
-- Created 01/03/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
-- Revised 01/20/2010 - v0.2 - updated all bitmaps to hex for better readability
-- Revised 02/15/2010 - v0.3 - added a bunch of new functions and re-designed the code to be OO
--
-- New functionality added as of v0.3
-- o File reading, writing
-- o Authentication
-- o Helper functions for most AFP functions
-- o More robust error handling
--
-- Revised 03/05/2010 - v0.4 - changed output table of Helper:Dir to include type and ID
-- - added support for --without-openssl
--
-- Revised 03/09/2010 - v0.5 - documentation, documenation and more documentation
-- Revised 04/03/2011 - v0.6 - add support for getting file- sizes, dates and Unix ACLs
-- - moved afp.username & afp.password arguments to library
local bin = require "bin"
local bit = require "bit"
local nmap = require "nmap"
local os = require "os"
local stdnse = require "stdnse"
local string = require "string"
local table = require "table"
_ENV = stdnse.module("afp", stdnse.seeall);
local HAVE_SSL, openssl = pcall(require,'openssl')
-- Table of valid REQUESTs
local REQUEST = {
CloseSession = 0x01,
OpenSession = 0x04,
Command = 0x02,
GetStatus = 0x03,
Write = 0x06,
}
-- Table of headers flags to be set accordingly in requests and responses
local FLAGS = {
Request = 0,
Response = 1
}
-- Table of possible AFP_COMMANDs
COMMAND = {
FPCloseVol = 0x02,
FPCloseFork = 0x04,
FPCopyFile = 0x05,
FPCreateDir = 0x06,
FPCreateFile = 0x07,
FPGetSrvrInfo = 0x0f,
FPGetSrvParms = 0x10,
FPLogin = 0x12,
FPLoginCont = 0x13,
FPLogout = 0x14,
FPMapId = 0x15,
FPMapName = 0x16,
FPGetUserInfo = 0x25,
FPOpenVol = 0x18,
FPOpenFork = 0x1a,
FPGetFileDirParams = 0x22,
FPChangePassword = 0x24,
FPReadExt = 0x3c,
FPWriteExt = 0x3d,
FPGetAuthMethods = 0x3e,
FPLoginExt = 0x3f,
FPEnumerateExt2 = 0x44,
}
USER_BITMAP = {
UserId = 0x01,
PrimaryGroupId = 0x2,
UUID = 0x4
}
VOL_BITMAP = {
Attributes = 0x1,
Signature = 0x2,
CreationDate = 0x4,
ModificationDate = 0x8,
BackupDate = 0x10,
ID = 0x20,
BytesFree = 0x40,
BytesTotal = 0x80,
Name = 0x100,
ExtendedBytesFree = 0x200,
ExtendedBytesTotal = 0x400,
BlockSize = 0x800
}
FILE_BITMAP = {
Attributes = 0x1,
ParentDirId = 0x2,
CreationDate = 0x4,
ModificationDate = 0x8,
BackupDate = 0x10,
FinderInfo = 0x20,
LongName = 0x40,
ShortName = 0x80,
NodeId = 0x100,
DataForkSize = 0x200,
ResourceForkSize = 0x400,
ExtendedDataForkSize = 0x800,
LaunchLimit = 0x1000,
UTF8Name = 0x2000,
ExtendedResourceForkSize = 0x4000,
UnixPrivileges = 0x8000,
ALL = 0xFFFF
}
DIR_BITMAP = {
Attributes = 0x1,
ParentDirId = 0x2,
CreationDate = 0x4,
ModificationDate = 0x8,
BackupDate = 0x10,
FinderInfo = 0x20,
LongName = 0x40,
ShortName = 0x80,
NodeId = 0x100,
OffspringCount = 0x200,
OwnerId = 0x400,
GroupId = 0x800,
AccessRights = 0x1000,
UTF8Name = 0x2000,
UnixPrivileges = 0x8000,
ALL = 0xBFFF,
}
PATH_TYPE = {
ShortName = 1,
LongName = 2,
UTF8Name = 3,
}
ACCESS_MODE = {
Read = 0x1,
Write = 0x2,
DenyRead = 0x10,
DenyWrite = 0x20
}
-- Access controls
ACLS = {
OwnerSearch = 0x1,
OwnerRead = 0x2,
OwnerWrite = 0x4,
GroupSearch = 0x100,
GroupRead = 0x200,
GroupWrite = 0x400,
EveryoneSearch = 0x10000,
EveryoneRead = 0x20000,
EveryoneWrite = 0x40000,
UserSearch = 0x100000,
UserRead = 0x200000,
UserWrite = 0x400000,
BlankAccess = 0x10000000,
UserIsOwner = 0x80000000
}
-- User authentication modules
UAM =
{
NoUserAuth = "No User Authent",
ClearText = "Cleartxt Passwrd",
RandNum = "Randnum Exchange",
TwoWayRandNum = "2-Way Randnum",
DHCAST128 = "DHCAST128",
DHX2 = "DHX2",
Kerberos = "Client Krb v2",
Reconnect = "Recon1",
}
ERROR =
{
SocketError = 1000,
CustomError = 0xdeadbeef,
FPNoErr = 0,
FPAccessDenied = -5000,
FPAuthContinue = -5001,
FPBadUAM = -5002,
FPBadVersNum = -5003,
FPBitmapErr = - 5004,
FPCantMove = - 5005,
FPEOFErr = -5009,
FPItemNotFound = -5012,
FPLockErr = -5013,
FPMiscErr = -5014,
FPObjectExists = -5017,
FPObjectNotFound = -5018,
FPParamErr = -5019,
FPUserNotAuth = -5023,
FPCallNotSupported = -5024,
}
MAP_ID =
{
UserIDToName = 1,
GroupIDToName = 2,
UserIDToUTF8Name = 3,
GroupIDToUTF8Name = 4,
UserUUIDToUTF8Name = 5,
GroupUUIDToUTF8Name = 6
}
MAP_NAME =
{
NameToUserID = 1,
NameToGroupID = 2,
UTF8NameToUserID = 3,
UTF8NameToGroupID = 4,
UTF8NameToUserUUID = 5,
UTF8NameToGroupUUID = 6
}
SERVERFLAGS =
{
CopyFile = 0x01,
ChangeablePasswords = 0x02,
NoPasswordSaving = 0x04,
ServerMessages = 0x08,
ServerSignature = 0x10,
TCPoverIP = 0x20,
ServerNotifications = 0x40,
Reconnect = 0x80,
OpenDirectory = 0x100,
UTF8ServerName = 0x200,
UUIDs = 0x400,
SuperClient = 0x8000
}
local ERROR_MSG = {
[ERROR.FPAccessDenied]="Access Denied",
[ERROR.FPAuthContinue]="Authentication is not yet complete",
[ERROR.FPBadUAM]="Specified UAM is unknown",
[ERROR.FPBadVersNum]="Server does not support the specified AFP version",
[ERROR.FPBitmapErr]="Attempt was made to get or set a parameter that cannot be obtained or set with this command, or a required bitmap is null",
[ERROR.FPCantMove]="Attempt was made to move a directory into one of its descendent directories.",
[ERROR.FPEOFErr]="No more matches or end of fork reached.",
[ERROR.FPLockErr]="Some or all of the requested range is locked by another user; a lock range conflict exists.",
[ERROR.FPMiscErr]="Non-AFP error occurred.",
[ERROR.FPObjectNotFound]="Input parameters do not point to an existing directory, file, or volume.",
[ERROR.FPParamErr]="Parameter error.",
[ERROR.FPObjectExists] = "File or directory already exists.",
[ERROR.FPUserNotAuth] = "UAM failed (the specified old password doesn't match); no user is logged in yet for the specified session; authentication failed; password is incorrect.",
[ERROR.FPItemNotFound] = "Specified APPL mapping, comment, or icon was not found in the Desktop database; specified ID is unknown.",
[ERROR.FPCallNotSupported] = "Server does not support this command.",
}
-- Check if all the bits in flag are set in bitmap.
local function flag_is_set(bitmap, flag)
return bit.band(bitmap, flag) == flag
end
-- Response class returned by all functions in Proto
Response = {
new = function(self,o)
o = o or {}
setmetatable(o, self)
self.__index = self
return o
end,
--- Sets the error code
--
-- @param code number containing the error code
setErrorCode = function( self, code )
self.error_code = code
end,
--- Gets the error code
--
-- @return code number containing the error code
getErrorCode = function( self )
return self.error_code
end,
--- Gets the error message
--
-- @return msg string containing the error
getErrorMessage = function(self)
if self.error_msg then
return self.error_msg
else
return ERROR_MSG[self.error_code] or ("Unknown error (%d) occured"):format(self.error_code)
end
end,
--- Sets the error message
--
-- @param msg string containing the error message
setErrorMessage = function(self, msg)
self.error_code = ERROR.CustomError
self.error_msg = msg
end,
--- Sets the result
--
-- @param result result to set
setResult = function(self, result)
self.result = result
end,
--- Get the result
--
-- @return result
getResult = function(self)
return self.result
end,
--- Sets the packet
setPacket = function( self, packet )
self.packet = packet
end,
getPacket = function( self )
return self.packet
end,
--- Gets the packet data
getPacketData = function(self)
return self.packet.data
end,
--- Gets the packet header
getPacketHeader = function(self)
return self.packet.header
end,
}
--- Proto class containing all AFP specific code
--
-- For more details consult:
-- http://developer.apple.com/mac/library/documentation/Networking/Reference/AFP_Reference/Reference/reference.html
Proto = {
RequestId = 1,
new = function(self,o)
o = o or {}
setmetatable(o, self)
self.__index = self
return o
end,
setSocket = function(self, socket)
self.socket = socket
end,
--- Creates an AFP packet
--
-- @param command number should be one of the commands in the COMMAND table
-- @param data_offset number holding the offset to the data
-- @param data the actual data of the request
create_fp_packet = function( self, command, data_offset, data )
local reserved = 0
local data = data or ""
local data_len = data:len()
local header = bin.pack("CC>SIII", FLAGS.Request, command, self.RequestId, data_offset, data_len, reserved)
self.RequestId = self.RequestId + 1
return header .. data
end,
--- Parses the FP header (first 16-bytes of packet)
--
-- @param packet string containing the raw packet
-- @return table with header data containing <code>flags</code>, <code>command</code>,
-- <code>request_id</code>, <code>error_code</code>, <code>length</code> and <code>reserved</code> fields
parse_fp_header = function( self, packet )
local header = {}
local pos
pos, header.flags, header.command, header.request_id = bin.unpack( "CC>S", packet )
pos, header.error_code, header.length, header.reserved = bin.unpack( ">i>II", packet:sub(5) )
if header.error_code ~= 0 then
header.error_msg = ERROR_MSG[header.error_code] or ("Unknown error: %d"):format(header.error_code)
header.error_msg = "ERROR: " .. header.error_msg
end
header.raw = packet:sub(1,16)
return header
end,
--- Reads a AFP packet of the socket
--
-- @return Response object
read_fp_packet = function( self )
local packet = {}
local buf = ""
local status, response
status, buf = self.socket:receive_bytes(16)
if ( not status ) then
response = Response:new()
response:setErrorCode(ERROR.SocketError)
response:setErrorMessage(buf)
return response
end
packet.header = self:parse_fp_header( buf )
while buf:len() < packet.header.length + packet.header.raw:len() do
local tmp
status, tmp = self.socket:receive_bytes( packet.header.length + 16 - buf:len() )
if not status then
response = Response:new()
response:setErrorCode(ERROR.SocketError)
response:setErrorMessage(buf)
return response
end
buf = buf .. tmp
end
packet.data = buf:len() > 16 and buf:sub( 17 ) or ""
response = Response:new()
response:setErrorCode(packet.header.error_code)
response:setPacket(packet)
return response
end,
--- Sends the raw packet over the socket
--
-- @param packet containing the raw data
-- @return Response object
send_fp_packet = function( self, packet )
return self.socket:send(packet)
end,
--- Sends an DSIOpenSession request to the server and handles the response
--
-- @return Response object
dsi_open_session = function( self, host, port )
local data_offset = 0
local option = 0x01 -- Attention Quantum
local option_len = 4
local quantum = 1024
local data, packet, status
data = bin.pack( "CCI", option, option_len, quantum )
packet = self:create_fp_packet( REQUEST.OpenSession, data_offset, data )
self:send_fp_packet( packet )
return self:read_fp_packet()
end,
--- Sends an DSICloseSession request to the server and handles the response
dsi_close_session = function( self )
local data_offset = 0
local option = 0x01 -- Attention Quantum
local option_len = 4
local quantum = 1024
local data, packet, status
data = ""
packet = self:create_fp_packet( REQUEST.CloseSession, data_offset, data )
self:send_fp_packet( packet )
end,
-- Sends an FPCopyFile request to the server
--
-- @param src_vol number containing the ID of the src file volume
-- @param srd_did number containing the directory id of the src file
-- @param src_path string containingt the file path/name of the src file
-- @param dst_vol number containing the ID of the dst file volume
-- @param dst_did number containing the id of the dest. directory
-- @param dst_path string containing the dest path (can be nil or "")
-- @param new_name string containign the new name of the destination
-- @return Response object
fp_copy_file = function(self, src_vol, src_did, src_path, dst_vol, dst_did, dst_path, new_name )
local pad, data_offset = 0, 0
local unicode_names, unicode_hint = 0x03, 0x08000103
local data, packet, response
-- make sure we have empty names rather than nil values
local dst_path = dst_path or ""
local src_path = src_path or ""
local new_name = new_name or ""
data = bin.pack(">CCSISI", COMMAND.FPCopyFile, pad, src_vol, src_did, dst_vol, dst_did )
data = data .. bin.pack(">CIP", unicode_names, unicode_hint, src_path )
data = data .. bin.pack(">CIP", unicode_names, unicode_hint, dst_path )
data = data .. bin.pack(">CIP", unicode_names, unicode_hint, new_name )
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
return self:read_fp_packet()
end,
--- Sends an GetStatus DSI request (which is basically a FPGetSrvrInfo
-- AFP request) to the server and handles the response
--
-- @return status (true or false)
-- @return table with server information (if status is true) or error string
-- (if status is false)
fp_get_server_info = function(self)
local packet
local data_offset = 0
local pad = 0
local response, result = {}, {}
local offsets = {}
local pos
local _
local status
local data = bin.pack("CC", COMMAND.FPGetSrvrInfo, 0)
packet = self:create_fp_packet(REQUEST.GetStatus, data_offset, data)
self:send_fp_packet(packet)
response = self:read_fp_packet()
if response:getErrorCode() ~= ERROR.FPNoErr then
return response
end
packet = response.packet
-- parse and store the offsets in the 'header'
pos, offsets.machine_type, offsets.afp_version_count,
offsets.uam_count, offsets.volume_icon_and_mask
= bin.unpack(">SSSS", packet.data, pos)
-- the flags are directly in the 'header'
result.flags = {}
pos, result.flags.raw = bin.unpack(">S", packet.data, pos)
-- the short server name is stored directly in the 'header' as
-- well
pos, result.server_name = bin.unpack("p", packet.data, pos)
-- Server offset should begin at an even boundary see link below
-- http://developer.apple.com/mac/library/documentation/Networking/Reference/AFP_Reference/Reference/reference.html#//apple_ref/doc/uid/TP40003548-CH3-CHDIEGED
if (pos + 1) % 2 ~= 0 then
pos = pos + 1
end
-- and some more offsets
pos, offsets.server_signature, offsets.network_addresses_count,
offsets.directory_names_count, offsets.utf8_server_name
= bin.unpack(">SSSS", packet.data, pos)
-- this sets up all the server flaqs in the response table as booleans
result.flags.SuperClient = flag_is_set(result.flags.raw, SERVERFLAGS.SuperClient)
result.flags.UUIDs = flag_is_set(result.flags.raw, SERVERFLAGS.UUIDs)
result.flags.UTF8ServerName = flag_is_set(result.flags.raw, SERVERFLAGS.UTF8ServerName)
result.flags.OpenDirectory = flag_is_set(result.flags.raw, SERVERFLAGS.OpenDirectory)
result.flags.Reconnect = flag_is_set(result.flags.raw, SERVERFLAGS.Reconnect)
result.flags.ServerNotifications = flag_is_set(result.flags.raw, SERVERFLAGS.ServerNotifications)
result.flags.TCPoverIP = flag_is_set(result.flags.raw, SERVERFLAGS.TCPoverIP)
result.flags.ServerSignature = flag_is_set(result.flags.raw, SERVERFLAGS.ServerSignature)
result.flags.ServerMessages = flag_is_set(result.flags.raw, SERVERFLAGS.ServerMessages)
result.flags.NoPasswordSaving = flag_is_set(result.flags.raw, SERVERFLAGS.NoPasswordSaving)
result.flags.ChangeablePasswords = flag_is_set(result.flags.raw, SERVERFLAGS.ChangeablePasswords)
result.flags.CopyFile = flag_is_set(result.flags.raw, SERVERFLAGS.CopyFile)
-- store the machine type
_, result.machine_type = bin.unpack("p", packet.data, offsets.machine_type + 1)
-- this tells us the number of afp versions supported
pos, result.afp_version_count = bin.unpack("C", packet.data, offsets.afp_version_count + 1)
-- now we loop through them all, storing for the response
result.afp_versions = {}
for i = 1,result.afp_version_count do
pos, _ = bin.unpack("p", packet.data, pos)
table.insert(result.afp_versions, _)
end
-- same idea as the afp versions here
pos, result.uam_count = bin.unpack("C", packet.data, offsets.uam_count + 1)
result.uams = {}
for i = 1,result.uam_count do
pos, _ = bin.unpack("p", packet.data, pos)
table.insert(result.uams, _)
end
-- volume_icon_and_mask would normally be parsed out here,
-- however the apple docs say it is deprecated in Mac OS X, so
-- we don't bother with it
-- server signature is 16 bytes
result.server_signature = string.sub(packet.data, offsets.server_signature + 1, offsets.server_signature + 16)
-- this is the same idea as afp_version and uam above
pos, result.network_addresses_count = bin.unpack("C", packet.data, offsets.network_addresses_count + 1)
result.network_addresses = {}
-- gets a little complicated in here, basically each entry has
-- a length byte, a tag byte, and then the data. We parse
-- differently based on the tag
for i = 1, result.network_addresses_count do
local length
local tag
pos, length = bin.unpack("C", packet.data, pos)
pos, tag = bin.unpack("C", packet.data, pos)
if tag == 0x00 then
-- reserved, shouldn't ever come up, maybe this should
-- return an error? maybe not, lets just ignore this
elseif tag == 0x01 then
-- four byte ip
local octet = {}
pos, octet[1], octet[2], octet[3], octet[4] = bin.unpack("CCCC", packet.data, pos)
table.insert(result.network_addresses, string.format("%d.%d.%d.%d", octet[1], octet[2], octet[3], octet[4]))
elseif tag == 0x02 then
-- four byte ip and two byte port
local octet = {}
local port
pos, octet[1], octet[2], octet[3], octet[4], port = bin.unpack(">CCCCS", packet.data, pos)
table.insert(result.network_addresses, string.format("%d.%d.%d.%d:%d", octet[1], octet[2], octet[3], octet[4], port))
elseif tag == 0x03 then
-- ddp address (two byte network, one byte
-- node, one byte socket) not tested, anyone
-- use ddp anymore?
local network
local node
local socket
pos, network = bin.unpack(">S", packet.data, pos)
pos, node = bin.unpack("C", packet.data, pos)
pos, socket = bin.unpack("C", packet.data, pos)
table.insert(result.network_addresses, string.format("ddp %d.%d:%d", network, node, socket))
elseif tag == 0x04 then
-- dns name (string)
local temp
pos, temp = bin.unpack("z", packet.data:sub(1,pos+length-3), pos)
table.insert(result.network_addresses, temp)
elseif tag == 0x05 then
-- four byte ip and two byte port, client
-- should use ssh. not tested, should work as it
-- is the same as tag 0x02
local octet = {}
local port
pos, octet[1], octet[2], octet[3], octet[4], port = bin.unpack(">CCCCS", packet.data, pos)
table.insert(result.network_addresses, string.format("ssh://%d.%d.%d.%d:%d", octet[1], octet[2], octet[3], octet[4], port))
elseif tag == 0x06 then
-- 16 byte ipv6
-- not tested, but should work (next tag is
-- tested)
local octet = {}
local j
local addr
for j = 1, 8 do
pos, octet[j] = bin.unpack(">S", packet.data, pos)
end
for j = 1, 7 do
addr = addr .. string.format("%04x:", octet[j])
end
addr = addr .. string.format("%04x", octet[8])
table.insert(result.network_addresses, addr)
elseif tag == 0x07 then
-- 16 byte ipv6 and two byte port
local octet = {}
local port
local j
local addr
for j = 1, 8 do
pos, octet[j] = bin.unpack(">S", packet.data, pos)
end
pos, port = bin.unpack(">S", packet.data, pos)
addr = "["
for j = 1, 7 do
addr = addr .. string.format("%04x:", octet[j])
end
addr = addr .. string.format("%04x]:%d", octet[8], port)
table.insert(result.network_addresses, addr)
end
end
-- same idea as the others here
pos, result.directory_names_count = bin.unpack("C", packet.data, offsets.directory_names_count + 1)
result.directory_names = {}
for i = 1, result.directory_names_count do
local dirname
pos, dirname = bin.unpack("p", packet.data, pos)
table.insert(result.directory_names, dirname)
end
-- only one utf8 server name. note this string has a two-byte length.
_, result.utf8_server_name = bin.unpack(">P", packet.data, offsets.utf8_server_name + 1)
response.result = result
return response
end,
--- Sends an FPGetUserInfo AFP request to the server and handles the response
--
-- @return response object with the following result <code>user_bitmap</code> and
-- <code>uid</code> fields
fp_get_user_info = function( self )
local packet, pos, status, response
local data_offset = 0
local flags = 1 -- Default User
local uid = 0
local bitmap = USER_BITMAP.UserId
local result = {}
local data = bin.pack( "CCI>S", COMMAND.FPGetUserInfo, flags, uid, bitmap )
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
response = self:read_fp_packet()
if response:getErrorCode() ~= ERROR.FPNoErr then
return response
end
pos, response.result.user_bitmap, response.result.uid = bin.unpack(">S>I", packet.data)
return response
end,
--- Sends an FPGetSrvrParms AFP request to the server and handles the response
--
-- @return response object with the following result <code>server_time</code>,
-- <code>vol_count</code>, <code>volumes</code> fields
fp_get_srvr_parms = function(self)
local packet, status, data
local data_offset = 0
local response = {}
local pos = 0
local parms = {}
data = bin.pack("CC", COMMAND.FPGetSrvParms, 0)
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
response = self:read_fp_packet()
if response:getErrorCode() ~= ERROR.FPNoErr then
return response
end
data = response:getPacketData()
pos, parms.server_time, parms.vol_count = bin.unpack("IC", data)
-- we should now be at the leading zero preceeding the first volume name
-- next is the length of the volume name, move pos there
pos = pos + 1
parms.volumes = {}
for i=1, parms.vol_count do
local _, vol_len = bin.unpack("C", data:sub(pos))
local volume_name = data:sub(pos + 1, pos + 1 + vol_len)
pos = pos + vol_len + 2
table.insert(parms.volumes, string.format("%s", volume_name) )
end
response:setResult(parms)
return response
end,
--- Sends an FPLogin request to the server and handles the response
--
-- This function currently only supports the 3.1 through 3.3 protocol versions
-- It currently supports the following authentication methods:
-- o No User Authent
-- o DHCAST128
--
-- The DHCAST128 UAM should work against most servers even though it's
-- superceeded by the DHX2 UAM.
--
-- @param afp_version string (AFP3.3|AFP3.2|AFP3.1)
-- @param uam string containing authentication information
-- @return Response object
fp_login = function( self, afp_version, uam, username, password, options )
local packet, status, data
local data_offset = 0
local status, response
if not HAVE_SSL then
response = Response:new()
response:setErrorMessage("OpenSSL not available, aborting ...")
return response
end
-- currently we only support AFP3.3
if afp_version == nil or ( afp_version ~= "AFP3.3" and afp_version ~= "AFP3.2" and afp_version ~= "AFP3.1" ) then
response = Response:new()
response:setErrorMessage("Incorrect AFP version")
return response
end
if ( uam == "No User Authent" ) then
data = bin.pack( "CCACA", COMMAND.FPLogin, afp_version:len(), afp_version, uam:len(), uam )
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
return self:read_fp_packet( )
elseif( uam == "DHCAST128" ) then
local dhx_s2civ, dhx_c2civ = 'CJalbert', 'LWallace'
local p, g, Ra, Ma, Mb, K, nonce
local EncData, PlainText, K_bin, auth_response
local _, Id
local username = username or ""
local password = password or ""
if ( bit.mod(username:len(), 2) == 0 ) then
username = username .. string.char(0)
end
p = openssl.bignum_hex2bn("BA2873DFB06057D43F2024744CEEE75B")
g = openssl.bignum_dec2bn("7")
Ra = openssl.bignum_hex2bn("86F6D3C0B0D63E4B11F113A2F9F19E3BBBF803F28D30087A1450536BE979FD42")
Ma = openssl.bignum_mod_exp(g, Ra, p)
data = bin.pack( "CpppA", COMMAND.FPLogin, afp_version, uam, username, openssl.bignum_bn2bin(Ma) )
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
response = self:read_fp_packet( )
if ( response:getErrorCode() ~= ERROR.FPAuthContinue ) then
return response
end
if ( response.packet.header.length ~= 50 ) then
response:setErrorMessage("LoginContinue packet contained invalid data")
return response
end
_, Id, Mb, EncData = bin.unpack(">SH16A32", response.packet.data )
Mb = openssl.bignum_hex2bn( Mb )
K = openssl.bignum_mod_exp (Mb, Ra, p)
K_bin = openssl.bignum_bn2bin(K)
nonce = openssl.decrypt("cast5-cbc", K_bin, dhx_s2civ, EncData, false ):sub(1,16)
nonce = openssl.bignum_add( openssl.bignum_bin2bn(nonce), openssl.bignum_dec2bn("1") )
PlainText = openssl.bignum_bn2bin(nonce) .. Util.ZeroPad(password, 64)
auth_response = openssl.encrypt( "cast5-cbc", K_bin, dhx_c2civ, PlainText, true)
data = bin.pack( "CC>SA", COMMAND.FPLoginCont, 0, Id, auth_response )
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
response = self:read_fp_packet( )
if ( response:getErrorCode() ~= ERROR.FPNoErr ) then
return response
end
return response
end
response:setErrorMessage("Unsupported uam: " .. uam or "nil")
return response
end,
-- Terminates sessions and frees server resources established by FPLoginand FPLoginExt.
--
-- @return response object
fp_logout = function( self )
local packet, data, response
local data_offset, pad = 0, 0
data = bin.pack("CC", COMMAND.FPLogout, pad)
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
return self:read_fp_packet( )
end,
--- Sends an FPOpenVol request to the server and handles the response
--
-- @param bitmap number bitmask of volume information to request
-- @param volume_name string containing the volume name to query
-- @return response object with the following result <code>bitmap</code> and
-- <code>volume_id</code> fields
fp_open_vol = function( self, bitmap, volume_name )
local packet, status, pos, data
local data_offset, pad = 0, 0
local response, volume = {}, {}
data = bin.pack("CC>SCA", COMMAND.FPOpenVol, pad, bitmap, volume_name:len(), volume_name )
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
response = self:read_fp_packet()
if response:getErrorCode() ~= ERROR.FPNoErr then
return response
end
pos, volume.bitmap, volume.volume_id = bin.unpack(">S>S", response.packet.data)
response:setResult(volume)
return response
end,
--- Sends an FPGetFileDirParms request to the server and handles the response
--
-- @param volume_id number containing the id of the volume to query
-- @param did number containing the id of the directory to query
-- @param file_bitmap number bitmask of file information to query
-- @param dir_bitmap number bitmask of directory information to query
-- @param path string containing the name of the directory to query
-- @return response object with the following result <code>file_bitmap</code>, <code>dir_bitmap</code>,
-- <code>file_type</code> and (<code>dir<code> or <code>file</code> tables) depending on whether
-- <code>did</code> is a file or directory
fp_get_file_dir_parms = function( self, volume_id, did, file_bitmap, dir_bitmap, path )
local packet, status, data
local data_offset = 0
local pad = 0
local response, parms = {}, {}
local pos
if ( did == nil ) then
response = Response:new()
response:setErrorMessage("No Directory Id supplied")
return response
end
if ( volume_id == nil ) then
response = Response:new()
response:setErrorMessage("No Volume Id supplied")
return response
end
data = bin.pack("CC>S>I>S>SCCAC", COMMAND.FPGetFileDirParams, pad, volume_id, did, file_bitmap, dir_bitmap, path.type, path.len, path.name, 0)
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
response = self:read_fp_packet()
if response:getErrorCode() ~= ERROR.FPNoErr then
return response
end
pos, parms.file_bitmap, parms.dir_bitmap, parms.file_type, pad = bin.unpack( ">S>SCC", response.packet.data )
-- file or dir?
if ( parms.file_type == 0x80 ) then
pos, parms.dir = Util.decode_dir_bitmap( parms.dir_bitmap, response.packet.data, pos )
else
-- file
pos, parms.file = Util.decode_file_bitmap( parms.file_bitmap, response.packet.data, pos )
end
response:setResult(parms)
return response
end,
--- Sends an FPEnumerateExt2 request to the server and handles the response
--
-- @param volume_id number containing the id of the volume to query
-- @param did number containing the id of the directory to query
-- @param file_bitmap number bitmask of file information to query
-- @param dir_bitmap number bitmask of directory information to query
-- @param req_count number
-- @param start_index number
-- @param reply_size number
-- @param path string containing the name of the directory to query
-- @return response object with the following result set to a table of tables containing
-- <code>file_bitmap</code>, <code>dir_bitmap</code>, <code>req_count</code> fields
fp_enumerate_ext2 = function( self, volume_id, did, file_bitmap, dir_bitmap, req_count, start_index, reply_size, path )
local packet, pos, _, status
local data_offset = 0
local pad = 0
local response,records = {}, {}
local data = bin.pack( "CC>S>I>S>S", COMMAND.FPEnumerateExt2, pad, volume_id, did, file_bitmap, dir_bitmap )
data = data .. bin.pack( ">S>I>ICCA", req_count, start_index, reply_size, path.type, path.len, path.name )
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
response = self:read_fp_packet( )
if response:getErrorCode() ~= ERROR.FPNoErr then
return response
end
pos, file_bitmap, dir_bitmap, req_count = bin.unpack(">S>S>S", response.packet.data)
records = {}
for i=1, req_count do
local record = {}
local len, _, ftype
pos, len, ftype, _ = bin.unpack(">SCC", response.packet.data, pos)
if ( ftype == 0x80 ) then
_, record = Util.decode_dir_bitmap( dir_bitmap, response.packet.data, pos )
else
-- file
_, record = Util.decode_file_bitmap( file_bitmap, response.packet.data, pos )
end
if bit.mod( len, 2 ) ~= 0 then
len = len + 1
end
pos = pos + ( len - 4 )
record.type = ftype
table.insert(records, record)
end
response:setResult(records)
return response
end,
--- Sends an FPOpenFork request to the server and handles the response
--
-- @param flag number
-- @param volume_id number containing the id of the volume to query
-- @param did number containing the id of the directory to query
-- @param file_bitmap number bitmask of file information to query
-- @param access_mode number containing bitmask of options from <code>ACCESS_MODE</code>
-- @param path string containing the name of the directory to query
-- @return response object with the following result contents <code>file_bitmap</code> and <code>fork_id</code>
fp_open_fork = function( self, flag, volume_id, did, file_bitmap, access_mode, path )
local packet, _
local data_offset = 0
local pad = 0
local response, fork = {}, {}
local data = bin.pack( "CC>S>I>S>S", COMMAND.FPOpenFork, flag, volume_id, did, file_bitmap, access_mode )
if path.type == PATH_TYPE.LongName then
data = data .. bin.pack( "CCA", path.type, path.len, path.name )
end
if path.type == PATH_TYPE.UTF8Name then
local unicode_hint = 0x08000103
data = data .. bin.pack( "C>I>SA", path.type, unicode_hint, path.len, path.name )
end
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
response = self:read_fp_packet()
if response:getErrorCode() ~= ERROR.FPNoErr then
return response
end
_, fork.file_bitmap, fork.fork_id = bin.unpack(">S>S", response.packet.data)
response:setResult(fork)
return response
end,
--- FPCloseFork
--
-- @param fork number containing the fork to close
-- @return response object
fp_close_fork = function( self, fork )
local packet
local data_offset = 0
local pad = 0
local response = {}
local data = bin.pack( "CC>S", COMMAND.FPCloseFork, pad, fork )
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
return self:read_fp_packet( )
end,
--- FPCreateDir
--
-- @param vol_id number containing the volume id
-- @param dir_id number containing the directory id
-- @param path string containing the name of the directory
-- @return response object
fp_create_dir = function( self, vol_id, dir_id, path )
local packet
local data_offset, pad = 0, 0
local response = {}
local data = bin.pack( "CC>S>ICp", COMMAND.FPCreateDir, pad, vol_id, dir_id, path.type, path.name )
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
return self:read_fp_packet( )
end,
--- Sends an FPCloseVol request to the server and handles the response
--
-- @param volume_id number containing the id of the volume to close
-- @return response object
fp_close_vol = function( self, volume_id )
local packet
local data_offset, pad = 0, 0
local response = {}
local data = bin.pack( "CC>S", COMMAND.FPCloseVol, pad, volume_id )
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
return self:read_fp_packet( )
end,
--- FPReadExt
--
-- @param fork number containing the open fork
-- @param offset number containing the offset from where writing should start. Negative value indicates offset from the end of the fork
-- @param count number containing the number of bytes to be written
-- @return response object
fp_read_ext = function( self, fork, offset, count )
local pad = 0
local packet, response
local data_offset = 0
local block_size = 1024
local data = bin.pack( "CC>S>L>L", COMMAND.FPReadExt, pad, fork, offset, count )
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
response = self:read_fp_packet( )
if ( response:getErrorCode() == ERROR.FPEOFErr and response.packet.header.length > 0 ) then
response:setErrorCode( ERROR.FPNoErr )
end
response:setResult( response.packet.data )
return response
end,
--- FPWriteExt
--
-- @param flag number indicates whether Offset is relative to the beginning or end of the fork.
-- @param fork number containing the open fork
-- @param offset number containing the offset from where writing should start. Negative value indicates offset from the end of the fork
-- @param count number containing the number of bytes to be written
-- @param fdata string containing the data to be written
-- @return response object
fp_write_ext = function( self, flag, fork, offset, count, fdata )
local packet
local data_offset = 20
local data
if count > fdata:len() then
local err = Response:new()
err:setErrorMessage("fp_write_ext: Count is greater than the amount of data")
return err
end
if count < 0 then
local err = Response:new()
err:setErrorMessage("fp_write_ext: Count must exceed zero")
return err
end
data = bin.pack( "CC>S>L>LA", COMMAND.FPWriteExt, flag, fork, offset, count, fdata )
packet = self:create_fp_packet( REQUEST.Write, data_offset, data )
self:send_fp_packet( packet )
return self:read_fp_packet( )
end,
--- FPCreateFile
--
-- @param flag number where 0 indicates a soft create and 1 indicates a hard create.
-- @param vol_id number containing the volume id
-- @param did number containing the ancestor directory id
-- @param path string containing the path, including the volume, path and file name
-- @return response object
fp_create_file = function(self, flag, vol_id, did, path )
local packet
local data_offset = 0
local data = bin.pack( "CC>S>ICCA" , COMMAND.FPCreateFile, flag, vol_id, did, path.type, path.len, path.name )
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
return self:read_fp_packet()
end,
--- FPMapId
--
-- @param subfunc number containing the subfunction to call
-- @param id number containing th id to translate
-- @return response object with the id in the <code>result</code> field
fp_map_id = function( self, subfunc, id )
local packet, response
local data_offset = 0
local data = bin.pack( "CC", COMMAND.FPMapId, subfunc )
local _, len
if ( subfunc == MAP_ID.UserUUIDToUTF8Name or subfunc == MAP_ID.GroupUUIDToUTF8Name ) then
data = data .. bin.pack(">L", id)
else
data = data .. bin.pack(">I", id)
end
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
response = self:read_fp_packet( )
if response:getErrorCode() ~= ERROR.FPNoErr then
return response
end
-- Netatalk returns the name with 1-byte length prefix,
-- Mac OS has a 2-byte (UTF-8) length prefix
local _, len = bin.unpack("C", response.packet.data)
-- if length is zero assume 2-byte length (UTF-8 name)
if len == 0 then
response:setResult( select(2, bin.unpack(">P", response.packet.data )) )
else
response:setResult( select(2, bin.unpack("p", response.packet.data )) )
end
return response
end,
--- FPMapName
--
-- @param subfunc number containing the subfunction to call
-- @param name string containing name to map
-- @return response object with the mapped name in the <code>result</code> field
fp_map_name = function( self, subfunc, name )
local packet
local data_offset = 0
local data = bin.pack( "CC>SA", COMMAND.FPMapName, subfunc, name:len(), name )
local response
packet = self:create_fp_packet( REQUEST.Command, data_offset, data )
self:send_fp_packet( packet )
response = self:read_fp_packet( )
if response:getErrorCode() ~= ERROR.FPNoErr then
return response
end
response:setResult( select(2, bin.unpack(">I", response.packet.data)))
return response
end,
}
--- The helper class wraps the protocol class and their functions. It contains
-- high-level functions with descriptive names, facilitating the use and
-- minimizing the need to fully understand the AFP low-level protocol details.
Helper = {
--- Creates a new helper object
new = function(self,o)
local o = {}
setmetatable(o, self)
self.__index = self
o.username = stdnse.get_script_args("afp.username")
o.password = stdnse.get_script_args("afp.password")
return o
end,
--- Connects to the remote server and establishes a new AFP session
--
-- @param host table as recieved by the action function of the script
-- @param port table as recieved by the action function of the script
-- @return status boolean
-- @return string containing error message (if status is false)
OpenSession = function( self, host, port )
local status, response
self.socket = nmap.new_socket()
self.socket:set_timeout( 5000 )
status = self.socket:connect(host, port)
if not status then
return false, "Socket connection failed"
end
self.proto = Proto:new( { socket=self.socket} )
response = self.proto:dsi_open_session(self.socket)
if response:getErrorCode() ~= ERROR.FPNoErr then
self.socket:close()
return false, response:getErrorMessage()
end
return true
end,
--- Closes the AFP session and then the socket
--
-- @return status boolean
-- @return string containing error message (if status is false)
CloseSession = function( self )
local status, packet = self.proto:dsi_close_session( )
self.socket:close()
return status, packet
end,
--- Terminates the connection, withou closing the AFP session
--
-- @return status (always true)
-- @return string (always "")
Terminate = function( self )
self.socket:close()
return true,""
end,
--- Logs in to an AFP service
--
-- @param username (optional) string containing the username
-- @param password (optional) string containing the user password
-- @param options table containing additional options <code>uam</code>
Login = function( self, username, password, options )
local uam = ( options and options.UAM ) and options.UAM or "DHCAST128"
local response
-- username and password arguments override the ones supplied using the
-- script arguments afp.username and afp.password
local username = username or self.username
local password = password or self.password
if ( username and uam == "DHCAST128" ) then
response = self.proto:fp_login( "AFP3.1", "DHCAST128", username, password )
elseif( username ) then
return false, ("Unsupported UAM: %s"):format(uam)
else
response = self.proto:fp_login( "AFP3.1", "No User Authent" )
end
if response:getErrorCode() ~= ERROR.FPNoErr then
return false, response:getErrorMessage()
end
return true, "Success"
end,
--- Logs out from the AFP service
Logout = function(self)
return self.proto:fp_logout()
end,
--- Walks the directory tree specified by <code>str_path</code> and returns the node information
--
-- @param str_path string containing the directory
-- @return status boolean true on success, otherwise false
-- @return item table containing node information <code>DirectoryId</code> and <code>DirectoryName</code>
WalkDirTree = function( self, str_path )
local status, response, path
local elements = stdnse.strsplit( "/", str_path )
local f_bm = FILE_BITMAP.NodeId + FILE_BITMAP.ParentDirId + FILE_BITMAP.LongName
local d_bm = DIR_BITMAP.NodeId + DIR_BITMAP.ParentDirId + DIR_BITMAP.LongName
local item = { DirectoryId = 2 }
response = self.proto:fp_open_vol( VOL_BITMAP.ID, elements[1] )
if response:getErrorCode() ~= ERROR.FPNoErr then
return false, response:getErrorMessage()
end
item.VolumeId = response.result.volume_id
item.DirectoryName = str_path
for i=2, #elements do
path = { ['type']=PATH_TYPE.LongName, name=elements[i], len=elements[i]:len() }
response = self.proto:fp_get_file_dir_parms( item.VolumeId, item.DirectoryId, f_bm, d_bm, path )
if response:getErrorCode() ~= ERROR.FPNoErr then
return false, response:getErrorMessage()
end
item.DirectoryId = response.result.dir.NodeId
item.DirectoryName = response.result.dir.LongName
end
return true, item
end,
--- Reads a file on the AFP server
--
-- @param str_path string containing the AFP sharepoint, path and filename eg. HR/Documents/File.doc
-- @return status boolean true on success, false on failure
-- @return content string containing the file contents
ReadFile = function( self, str_path )
local status, response, fork, content, vol_name
local offset, count, did = 0, 1024, 2
local status, path, vol_id
local p = Util.SplitPath( str_path )
status, response = self:WalkDirTree( p.dir )
if ( not status ) then
return false, response
end
vol_id = response.VolumeId
did = response.DirectoryId
path = { ['type']=PATH_TYPE.LongName, name=p.file, len=p.file:len() }
response = self.proto:fp_open_fork(0, vol_id, did, 0, ACCESS_MODE.Read, path )
if response:getErrorCode() ~= ERROR.FPNoErr then
return false, response:getErrorMessage()
end
fork = response.result.fork_id
content = ""
while true do
response = self.proto:fp_read_ext( fork, offset, count )
if response:getErrorCode() ~= ERROR.FPNoErr then
break
end
content = content .. response.result
offset = offset + count
end
response = self.proto:fp_close_fork( fork )
if response:getErrorCode() ~= ERROR.FPNoErr then
return false, response:getErrorMessage()
end
return true, content
end,
--- Writes a file to the AFP server
--
-- @param str_path string containing the AFP sharepoint, path and filename eg. HR/Documents/File.doc
-- @param fdata string containing the data to write to the file
-- @return status boolean true on success, false on failure
-- @return error string containing error message if status is false
WriteFile = function( self, str_path, fdata )
local status, response, fork, content
local offset, count = 1, 1024
local status, vol_id, did, path
local p = Util.SplitPath( str_path )
status, response = self:WalkDirTree( p.dir )
vol_id = response.VolumeId
did = response.DirectoryId
if ( not status ) then
return false, response
end
path = { ['type']=PATH_TYPE.LongName, name=p.file, len=p.file:len() }
status, response = self.proto:fp_create_file( 0, vol_id, did, path )
if not status then
if ( response.header.error_code ~= ERROR.FPObjectExists ) then
return false, response.header.error_msg
end
end
response = self.proto:fp_open_fork( 0, vol_id, did, 0, ACCESS_MODE.Write, path )
if response:getErrorCode() ~= ERROR.FPNoErr then
return false, response:getErrorMessage()
end
fork = response.result.fork_id
response = self.proto:fp_write_ext( 0, fork, 0, fdata:len(), fdata )
return true, nil
end,
--- Maps a user id (uid) to a user name
--
-- @param uid number containing the uid to resolve
-- @return status boolean true on success, false on failure
-- @return username string on success
-- error string on failure
UIDToName = function( self, uid )
local response = self.proto:fp_map_id( MAP_ID.UserIDToName, uid )
if response:getErrorCode() ~= ERROR.FPNoErr then
return false, response:getErrorMessage()
end
return true, response.result
end,
--- Maps a group id (gid) to group name
--
-- @param gid number containing the gid to lookup
-- @return status boolean true on success, false on failure
-- @return groupname string on success
-- error string on failure
GIDToName = function( self, gid )
local response = self.proto:fp_map_id( MAP_ID.GroupIDToName, gid )
if response:getErrorCode() ~= ERROR.FPNoErr then
return false, response:getErrorMessage()
end
return true, response.result
end,
--- Maps a username to a UID
--
-- @param name string containing the username to map to an UID
-- @return status boolean true on success, false on failure
-- @return UID number on success
-- error string on failure
NameToUID = function( self, name )
local response = self.proto:fp_map_name( MAP_NAME.NameToUserID, name )
if response:getErrorCode() ~= ERROR.FPNoErr then
return false, response:getErrorMessage()
end
return true, response.result
end,
--- List the contents of a directory
--
-- @param str_path string containing the sharepoint and directory names
-- @param options table options containing zero or more of the options
-- <code>max_depth</code> and <code>dironly</code>
-- @param depth number containing the current depth (used when called recursively)
-- @param parent table containing information about the parent object (used when called recursively)
-- @return status boolean true on success, false on failure
-- @return dir table containing a table for each directory item with the following <code>type</code>,
-- <code>name</code> and <code>id</code>
Dir = function( self, str_path, options, depth, parent )
local status, result
local depth = depth or 1
local options = options or { max_depth = 1 }
local response, records
local f_bm = FILE_BITMAP.NodeId + FILE_BITMAP.ParentDirId + FILE_BITMAP.LongName
local d_bm = DIR_BITMAP.NodeId + DIR_BITMAP.ParentDirId + DIR_BITMAP.LongName
local path = { ['type']=PATH_TYPE.LongName, name="", len=0 }
local TYPE_DIR = 0x80
if ( parent == nil ) then
status, response = self:WalkDirTree( str_path )
if ( not status ) then
return false, response
end
parent = {}
parent.vol_id = response.VolumeId
parent.did = response.DirectoryId
parent.dir_name = response.DirectoryName or ""
parent.out_tbl = {}
end
if ( options and options.max_depth and options.max_depth > 0 and options.max_depth < depth ) then
return false, "Max Depth Reached"
end
response = self.proto:fp_enumerate_ext2( parent.vol_id, parent.did, f_bm, d_bm, 1000, 1, 52800, path)
if response:getErrorCode() ~= ERROR.FPNoErr then
return false, response:getErrorMessage()
end
records = response.result or {}
local dir_item = {}
for _, record in ipairs( records ) do
if ( options and options.dironly ) then
if ( record.type == TYPE_DIR ) then
table.insert( dir_item, { ['type'] = record.type, ['name'] = record.LongName, ['id'] = record.NodeId } )
end
else
table.insert( dir_item, { ['type'] = record.type, ['name'] = record.LongName, ['id'] = record.NodeId } )
end
if ( record.type == TYPE_DIR ) then
self:Dir("", options, depth + 1, { vol_id = parent.vol_id, did=record.NodeId, dir_name=record.LongName, out_tbl=dir_item} )
end
end
table.insert( parent.out_tbl, dir_item )
return true, parent.out_tbl
end,
--- Displays a directory tree
--
-- @param str_path string containing the sharepoint and the directory
-- @param options table options containing zero or more of the options
-- <code>max_depth</code> and <code>dironly</code>
-- @return dirtree table containing the directories
DirTree = function( self, str_path, options )
local options = options or {}
options.dironly = true
return self:Dir( str_path, options )
end,
--- List the AFP sharepoints
--
-- @return volumes table containing the sharepoints
ListShares = function( self )
local response
response = self.proto:fp_get_srvr_parms( )
if response:getErrorCode() ~= ERROR.FPNoErr then
return false, response:getErrorMessage()
end
return true, response.result.volumes
end,
--- Determine the sharepoint permissions
--
-- @param vol_name string containing the name of the volume
-- @return status boolean true on success, false on failure
-- @return acls table containing the volume acls as returned by <code>acls_to_long_string</code>
GetSharePermissions = function( self, vol_name )
local status, response, vol_id, acls
response = self.proto:fp_open_vol( VOL_BITMAP.ID, vol_name )
if response:getErrorCode() == ERROR.FPNoErr then
local vol_id
local path = {}
vol_id = response.result.volume_id
path.type = PATH_TYPE.LongName
path.name = ""
path.len = path.name:len()
response = self.proto:fp_get_file_dir_parms( vol_id, 2, FILE_BITMAP.ALL, DIR_BITMAP.ALL, path )
if response:getErrorCode() == ERROR.FPNoErr then
if ( response.result.dir and response.result.dir.AccessRights ) then
acls = Util.acls_to_long_string(response.result.dir.AccessRights)
acls.name = nil
end
end
self.proto:fp_close_vol( vol_id )
end
return true, acls
end,
--- Gets the Unix permissions of a file
-- @param vol_name string containing the name of the volume
-- @param str_path string containing the name of the file
-- @return status true on success, false on failure
-- @return acls table (on success) containing the following fields
-- <code>uid</code> - a numeric user identifier
-- <code>gid</code> - a numeric group identifier
-- <code>privs</code> - a string value representing the permissions
-- eg: drwx------
-- @return err string (on failure) containing the error message
GetFileUnixPermissions = function(self, vol_name, str_path)
local response = self.proto:fp_open_vol( VOL_BITMAP.ID, vol_name )
if ( response:getErrorCode() ~= ERROR.FPNoErr ) then
return false, response:getErrorMessage()
end
local vol_id = response.result.volume_id
local path = { type = PATH_TYPE.LongName, name = str_path, len = #str_path }
response = self.proto:fp_get_file_dir_parms( vol_id, 2, FILE_BITMAP.UnixPrivileges, DIR_BITMAP.UnixPrivileges, path )
if ( response:getErrorCode() ~= ERROR.FPNoErr ) then
return false, response:getErrorMessage()
end
local item = ( response.result.file ) and response.result.file or response.result.dir
local item_type = ( response.result.file ) and "-" or "d"
local privs = ( item.UnixPrivileges and item.UnixPrivileges.ua_permissions ) and
item.UnixPrivileges.ua_permissions
if ( privs ) then
local uid = item.UnixPrivileges.uid
local gid = item.UnixPrivileges.gid
local str_privs = item_type .. Util.decode_unix_privs(privs)
return true, { uid = uid, gid = gid, privs = str_privs }
end
end,
--- Gets the Unix permissions of a file
-- @param vol_name string containing the name of the volume
-- @param str_path string containing the name of the file
-- @return status true on success, false on failure
-- @return size containing the size of the file in bytes
-- @return err string (on failure) containing the error message
GetFileSize = function( self, vol_name, str_path )
local response = self.proto:fp_open_vol( VOL_BITMAP.ID, vol_name )
if ( response:getErrorCode() ~= ERROR.FPNoErr ) then
return false, response:getErrorMessage()
end
local vol_id = response.result.volume_id
local path = { type = PATH_TYPE.LongName, name = str_path, len = #str_path }
response = self.proto:fp_get_file_dir_parms( vol_id, 2, FILE_BITMAP.ExtendedDataForkSize, 0, path )
if ( response:getErrorCode() ~= ERROR.FPNoErr ) then
return false, response:getErrorMessage()
end
return true, ( response.result.file and
response.result.file.ExtendedDataForkSize) and
response.result.file.ExtendedDataForkSize or 0
end,
--- Returns the creation, modification and backup dates of a file
-- @param vol_name string containing the name of the volume
-- @param str_path string containing the name of the file
-- @return status true on success, false on failure
-- @return dates table containing the following fields:
-- <code>create</code> - Creation date of the file
-- <code>modify</code> - Modification date of the file
-- <code>backup</code> - Date of last backup
-- @return err string (on failure) containing the error message
GetFileDates = function( self, vol_name, str_path )
local response = self.proto:fp_open_vol( VOL_BITMAP.ID, vol_name )
if ( response:getErrorCode() ~= ERROR.FPNoErr ) then
return false, response:getErrorMessage()
end
local vol_id = response.result.volume_id
local path = { type = PATH_TYPE.LongName, name = str_path, len = #str_path }
local f_bm = FILE_BITMAP.CreationDate + FILE_BITMAP.ModificationDate + FILE_BITMAP.BackupDate
local d_bm = DIR_BITMAP.CreationDate + DIR_BITMAP.ModificationDate + DIR_BITMAP.BackupDate
response = self.proto:fp_get_file_dir_parms( vol_id, 2, f_bm, d_bm, path )
if ( response:getErrorCode() ~= ERROR.FPNoErr ) then
return false, response:getErrorMessage()
end
local item = ( response.result.file ) and response.result.file or response.result.dir
local diff = os.time{year=2000, month=1, day=1, hour=0} - os.time{year=1970, month=1, day=1, hour=0}
local create = os.date("%Y-%m-%d %H:%M", item.CreationDate + diff)
local backup = os.date("%Y-%m-%d %H:%M", item.BackupDate )
local modify = os.date("%Y-%m-%d %H:%M", item.ModificationDate + diff )
return true, { create = create, backup = backup, modify = modify }
end,
--- Creates a new directory on the AFP sharepoint
--
-- @param str_path containing the sharepoint and the directory
-- @return status boolean true on success, false on failure
-- @return dirId number containing the new directory id
CreateDir = function( self, str_path )
local status, response, vol_id, did
local p = Util.SplitPath( str_path )
local path = { ['type']=PATH_TYPE.LongName, name=p.file, len=p.file:len() }
status, response = self:WalkDirTree( p.dir )
if not status then
return false, response
end
response = self.proto:fp_create_dir( response.VolumeId, response.DirectoryId, path )
if response:getErrorCode() ~= ERROR.FPNoErr then
return false, response:getErrorMessage()
end
return true, response
end,
}
--- Util class, containing some static functions used by Helper and Proto
Util =
{
--- Pads a string with zeroes
--
-- @param str string containing the string to be padded
-- @param len number containing the length of the new string
-- @return str string containing the new string
ZeroPad = function( str, len )
if len < str:len() then
return
end
for i=1, len - str:len() do
str = str .. string.char(0)
end
return str
end,
--- Splits a path into two pieces, directory and file
--
-- @param str_path string containing the path to split
-- @return dir table containing <code>dir</code> and <code>file</code>
SplitPath = function( str_path )
local elements = stdnse.strsplit("/", str_path)
local dir, file = "", ""
if #elements < 2 then
return nil
end
file = elements[#elements]
table.remove( elements, #elements )
dir = stdnse.strjoin( "/", elements )
return { ['dir']=dir, ['file']=file }
end,
--- Converts a group bitmask of Search, Read and Write to table
--
-- @param acls number containing bitmasked acls
-- @return table of ACLs
acl_group_to_long_string = function(acls)
local acl_table = {}
if bit.band( acls, ACLS.OwnerSearch ) == ACLS.OwnerSearch then
table.insert( acl_table, "Search")
end
if bit.band( acls, ACLS.OwnerRead ) == ACLS.OwnerRead then
table.insert( acl_table, "Read")
end
if bit.band( acls, ACLS.OwnerWrite ) == ACLS.OwnerWrite then
table.insert( acl_table, "Write")
end
return acl_table
end,
--- Converts a numeric acl to string
--
-- @param acls number containig acls as recieved from <code>fp_get_file_dir_parms</code>
-- @return table of long ACLs
acls_to_long_string = function( acls )
local owner = Util.acl_group_to_long_string( bit.band( acls, 255 ) )
local group = Util.acl_group_to_long_string( bit.band( bit.rshift(acls, 8), 255 ) )
local everyone = Util.acl_group_to_long_string( bit.band( bit.rshift(acls, 16), 255 ) )
local user = Util.acl_group_to_long_string( bit.band( bit.rshift(acls, 24), 255 ) )
local blank = bit.band( acls, ACLS.BlankAccess ) == ACLS.BlankAccess and "Blank" or nil
local isowner = bit.band( acls, ACLS.UserIsOwner ) == ACLS.UserIsOwner and "IsOwner" or nil
local options = {}
if blank then
table.insert(options, "Blank")
end
if isowner then
table.insert(options, "IsOwner")
end
local acls_tbl = {}
table.insert( acls_tbl, string.format( "Owner: %s", stdnse.strjoin(",", owner) ) )
table.insert( acls_tbl, string.format( "Group: %s", stdnse.strjoin(",", group) ) )
table.insert( acls_tbl, string.format( "Everyone: %s", stdnse.strjoin(",", everyone) ) )
table.insert( acls_tbl, string.format( "User: %s", stdnse.strjoin(",", user) ) )
if #options > 0 then
table.insert( acls_tbl, string.format( "Options: %s", stdnse.strjoin(",", options ) ) )
end
return acls_tbl
end,
--- Decodes the UnixPrivileges.ua_permissions value
--
-- @param privs number containing the UnixPrivileges.ua_permissions value
-- @return string containing the ACL characters
decode_unix_privs = function( privs )
local owner = ( bit.band( privs, ACLS.OwnerRead ) == ACLS.OwnerRead ) and "r" or "-"
owner = owner .. (( bit.band( privs, ACLS.OwnerWrite ) == ACLS.OwnerWrite ) and "w" or "-")
owner = owner .. (( bit.band( privs, ACLS.OwnerSearch ) == ACLS.OwnerSearch ) and "x" or "-")
local group = ( bit.band( privs, ACLS.GroupRead ) == ACLS.GroupRead ) and "r" or "-"
group = group .. (( bit.band( privs, ACLS.GroupWrite ) == ACLS.GroupWrite ) and "w" or "-")
group = group .. (( bit.band( privs, ACLS.GroupSearch ) == ACLS.GroupSearch ) and "x" or "-")
local other = ( bit.band( privs, ACLS.EveryoneRead ) == ACLS.EveryoneRead ) and "r" or "-"
other = other .. (( bit.band( privs, ACLS.EveryoneWrite ) == ACLS.EveryoneWrite ) and "w" or "-")
other = other .. (( bit.band( privs, ACLS.EveryoneSearch ) == ACLS.EveryoneSearch ) and "x" or "-")
return owner .. group .. other
end,
--- Decodes a file bitmap
--
-- @param bitmap number containing the bitmap
-- @param data string containing the data to be decoded
-- @param pos number containing the offset into data
-- @return pos number containing the new offset after decoding
-- @return file table containing the decoded values
decode_file_bitmap = function( bitmap, data, pos )
local file = {}
if ( bit.band( bitmap, FILE_BITMAP.Attributes ) == FILE_BITMAP.Attributes ) then
pos, file.Attributes = bin.unpack(">S", data, pos )
end
if ( bit.band( bitmap, FILE_BITMAP.ParentDirId ) == FILE_BITMAP.ParentDirId ) then
pos, file.ParentDirId = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, FILE_BITMAP.CreationDate ) == FILE_BITMAP.CreationDate ) then
pos, file.CreationDate = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, FILE_BITMAP.ModificationDate ) == FILE_BITMAP.ModificationDate ) then
pos, file.ModificationDate = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, FILE_BITMAP.BackupDate ) == FILE_BITMAP.BackupDate ) then
pos, file.BackupDate = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, FILE_BITMAP.FinderInfo ) == FILE_BITMAP.FinderInfo ) then
pos, file.FinderInfo = bin.unpack("A32", data, pos )
end
if ( bit.band( bitmap, FILE_BITMAP.LongName ) == FILE_BITMAP.LongName ) then
local offset, p, name
pos, offset = bin.unpack(">S", data, pos)
p, file.LongName = bin.unpack("p", data, offset + pos - 1)
end
if ( bit.band( bitmap, FILE_BITMAP.ShortName ) == FILE_BITMAP.ShortName ) then
local offset, p, name
pos, offset = bin.unpack(">S", data, pos)
p, file.ShortName = bin.unpack("p", data, offset + pos - 1)
end
if ( bit.band( bitmap, FILE_BITMAP.NodeId ) == FILE_BITMAP.NodeId ) then
pos, file.NodeId = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, FILE_BITMAP.DataForkSize ) == FILE_BITMAP.DataForkSize ) then
pos, file.DataForkSize = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, FILE_BITMAP.ResourceForkSize ) == FILE_BITMAP.ResourceForkSize ) then
pos, file.ResourceForkSize = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, FILE_BITMAP.ExtendedDataForkSize ) == FILE_BITMAP.ExtendedDataForkSize ) then
pos, file.ExtendedDataForkSize = bin.unpack(">L", data, pos )
end
if ( bit.band( bitmap, FILE_BITMAP.LaunchLimit ) == FILE_BITMAP.LaunchLimit ) then
-- should not be set as it's deprecated according to:
-- http://developer.apple.com/mac/library/documentation/Networking/Reference/AFP_Reference/Reference/reference.html#//apple_ref/doc/c_ref/kFPLaunchLimitBit
end
if ( bit.band( bitmap, FILE_BITMAP.UTF8Name ) == FILE_BITMAP.UTF8Name ) then
local offset, p, name
pos, offset = bin.unpack(">S", data, pos)
p, file.UTF8Name = bin.unpack("p", data, offset + pos - 1)
end
if ( bit.band( bitmap, FILE_BITMAP.ExtendedResourceForkSize ) == FILE_BITMAP.ExtendedResourceForkSize ) then
pos, file.ExtendedResourceForkSize = bin.unpack(">L", data, pos )
end
if ( bit.band( bitmap, FILE_BITMAP.UnixPrivileges ) == FILE_BITMAP.UnixPrivileges ) then
local unixprivs = {}
pos, unixprivs.uid, unixprivs.gid,
unixprivs.permissions, unixprivs.ua_permissions = bin.unpack(">IIII", data, pos )
file.UnixPrivileges = unixprivs
end
return pos, file
end,
--- Decodes a directory bitmap
--
-- @param bitmap number containing the bitmap
-- @param data string containing the data to be decoded
-- @param pos number containing the offset into data
-- @return pos number containing the new offset after decoding
-- @return dir table containing the decoded values
decode_dir_bitmap = function( bitmap, data, pos )
local dir = {}
if ( bit.band( bitmap, DIR_BITMAP.Attributes ) == DIR_BITMAP.Attributes ) then
pos, dir.Attributes = bin.unpack(">S", data, pos )
end
if ( bit.band( bitmap, DIR_BITMAP.ParentDirId ) == DIR_BITMAP.ParentDirId ) then
pos, dir.ParentDirId = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, DIR_BITMAP.CreationDate ) == DIR_BITMAP.CreationDate ) then
pos, dir.CreationDate = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, DIR_BITMAP.ModificationDate ) == DIR_BITMAP.ModificationDate ) then
pos, dir.ModificationDate = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, DIR_BITMAP.BackupDate ) == DIR_BITMAP.BackupDate ) then
pos, dir.BackupDate = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, DIR_BITMAP.FinderInfo ) == DIR_BITMAP.FinderInfo ) then
pos, dir.FinderInfo = bin.unpack("A32", data, pos )
end
if ( bit.band( bitmap, DIR_BITMAP.LongName ) == DIR_BITMAP.LongName ) then
local offset, p, name
pos, offset = bin.unpack(">S", data, pos)
-- TODO: This really needs to be adressed someway
-- Barely, never, ever happens, which makes it difficult to pin down
-- http://developer.apple.com/mac/library/documentation/Networking/Reference/
-- AFP_Reference/Reference/reference.html#//apple_ref/doc/uid/TP40003548-CH3-CHDBEHBG [URL is wrapped]
local justkidding = select(2, bin.unpack(">I", data, pos + 4))
if ( justkidding ~= 0 ) then
offset = 5
end
p, dir.LongName = bin.unpack("p", data, offset + pos - 1)
end
if ( bit.band( bitmap, DIR_BITMAP.ShortName ) == DIR_BITMAP.ShortName ) then
local offset, p, name
pos, offset = bin.unpack(">S", data, pos)
p, dir.ShortName = bin.unpack("p", data, offset + pos - 1)
end
if ( bit.band( bitmap, DIR_BITMAP.NodeId ) == DIR_BITMAP.NodeId ) then
pos, dir.NodeId = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, DIR_BITMAP.OffspringCount ) == DIR_BITMAP.OffspringCount ) then
pos, dir.OffspringCount = bin.unpack(">S", data, pos )
end
if ( bit.band( bitmap, DIR_BITMAP.OwnerId ) == DIR_BITMAP.OwnerId ) then
pos, dir.OwnerId = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, DIR_BITMAP.GroupId ) == DIR_BITMAP.GroupId ) then
pos, dir.GroupId = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, DIR_BITMAP.AccessRights ) == DIR_BITMAP.AccessRights ) then
pos, dir.AccessRights = bin.unpack(">I", data, pos )
end
if ( bit.band( bitmap, DIR_BITMAP.UTF8Name ) == DIR_BITMAP.UTF8Name ) then
local offset, p, name
pos, offset = bin.unpack(">S", data, pos)
p, dir.UTF8Name = bin.unpack("p", data, offset + pos - 1)
end
if ( bit.band( bitmap, DIR_BITMAP.UnixPrivileges ) == DIR_BITMAP.UnixPrivileges ) then
local unixprivs = {}
pos, unixprivs.uid, unixprivs.gid,
unixprivs.permissions, unixprivs.ua_permissions = bin.unpack(">I>I>I>I", data, pos )
dir.UnixPrivileges = unixprivs
end
return pos, dir
end,
}
return _ENV;
@KyuuKazami