smbinfo: Add command for displaying alternate data streams

Commit Message

J. Pablo González April 8, 2021, 10:02 a.m. UTC

Hi,

This patch adds a new command to smbinfo which retrieves and displays
the list of alternate data streams for a file.

Signed-off-by: Juan Pablo González <[e-mail]>
---
 smbinfo     | 41 +++++++++++++++++++++++++++++++++++++++++
 smbinfo.rst |  2 ++
 2 files changed, 43 insertions(+)

Comments

Aurélien Aptel April 9, 2021, 2:05 p.m. UTC | #1

J. Pablo González <[e-mail]> writes:
> This patch adds a new command to smbinfo which retrieves and displays
> the list of alternate data streams for a file.

I gave it a quick try and it works. LGTM.

Reviewed-by: Aurelien Aptel <[e-mail]>

Cheers,

Pavel Shilovsky April 14, 2021, 6:55 p.m. UTC | #2

пт, 9 апр. 2021 г. в 07:06, Aurélien Aptel <[e-mail]>:
>
> J. Pablo González <[e-mail]> writes:
> > This patch adds a new command to smbinfo which retrieves and displays
> > the list of alternate data streams for a file.
>
> I gave it a quick try and it works. LGTM.
>
> Reviewed-by: Aurelien Aptel <[e-mail]>

Pablo, Aurelien,

Thanks for the patch and for trying it out!

Merged into the next branch on github.

--
Best regards,
Pavel Shilovsky

J. Pablo González April 14, 2021, 10:05 p.m. UTC | #3

Great, thank you both for your time.

On Wed, Apr 14, 2021 at 8:55 PM Pavel Shilovsky <[e-mail]> wrote:
>
> пт, 9 апр. 2021 г. в 07:06, Aurélien Aptel <[e-mail]>:
> >
> > J. Pablo González <[e-mail]> writes:
> > > This patch adds a new command to smbinfo which retrieves and displays
> > > the list of alternate data streams for a file.
> >
> > I gave it a quick try and it works. LGTM.
> >
> > Reviewed-by: Aurelien Aptel <[e-mail]>
>
> Pablo, Aurelien,
>
> Thanks for the patch and for trying it out!
>
> Merged into the next branch on github.
>
> --
> Best regards,
> Pavel Shilovsky

Patch

diff --git a/smbinfo b/smbinfo
index 9752963..55c44e1 100755
--- a/smbinfo
+++ b/smbinfo
@@ -253,6 +253,10 @@  def main():
     sap.add_argument("file")
     sap.set_defaults(func=cmd_filestandardinfo)

+    sap = subp.add_parser("filestreaminfo", help="Prints
FileStreamInfo for a cifs file")
+    sap.add_argument("file")
+    sap.set_defaults(func=cmd_filestreaminfo)
+
     sap = subp.add_parser("fsctl-getobjid", help="Prints the objectid
of the file and GUID of the underlying volume.")
     sap.add_argument("file")
     sap.set_defaults(func=cmd_fsctl_getobjid)
@@ -753,7 +757,44 @@  def cmd_secdesc(args):
               print(ace)
               off_dacl += ace.size

+def cmd_filestreaminfo(args):
+    qi = QueryInfoStruct(info_type=0x1, file_info_class=22,
input_buffer_length=INPUT_BUFFER_LENGTH)
+    try:
+        fd = os.open(args.file, os.O_RDONLY)
+        info = os.fstat(fd)
+        buf = qi.ioctl(fd)
+    except Exception as e:
+        print("syscall failed: %s"%e)
+        return False

+    print_filestreaminfo(buf)
+
+def print_filestreaminfo(buf):
+    offset = 0
+
+    while offset < len(buf):
+
+        next_offset = struct.unpack_from('<I', buf, offset + 0)[0]
+        name_length = struct.unpack_from('<I', buf, offset + 4)[0]
+        if (name_length > 0):
+            stream_size = struct.unpack_from('<q', buf, offset + 8)[0]
+            stream_alloc_size = struct.unpack_from('<q', buf, offset + 16)[0]
+            stream_utf16le_name = struct.unpack_from('< %ss'%
name_length, buf, offset + 24)[0]
+            stream_name = stream_utf16le_name.decode("utf-16le")
+            if (offset > 0):
+                print()
+            if (stream_name=="::$DATA"):
+                print("Name: %s"% stream_name)
+            else:
+                print("Name: %s"% stream_name[stream_name.find(":") +
1 : stream_name.rfind(':$DATA')])
+            print("Size: %d bytes"% stream_size)
+            print("Allocation size: %d bytes "% stream_alloc_size)
+
+        if (next_offset == 0):
+            break
+
+        offset+=next_offset
+
 class KeyDebugInfoStruct:
     def __init__(self):
         self.suid = bytearray()
diff --git a/smbinfo.rst b/smbinfo.rst
index 7413849..1acf3c4 100644
--- a/smbinfo.rst
+++ b/smbinfo.rst
@@ -65,6 +65,8 @@  COMMAND

 `filestandardinfo`: Prints the FileStandardInformation class

+`filestreaminfo`: Prints the FileStreamInformation class
+
 `fsctl-getobjid`: Prints the ObjectID

 `getcompression`: Prints the compression setting for the file.