smbinfo

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#
# smbinfo is a cmdline tool to query SMB-specific file and fs
# information on a Linux SMB mount (cifs.ko).
#
# Copyright (C) 2019 Aurelien Aptel <aaptel@suse.com>
# Copyright (C) 2019 Ronnie Sahlberg <lsahlberg@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA

import os
import re
import argparse
import fcntl
import struct
import stat
import datetime
import calendar

VERBOSE = False

# ioctl ctl codes
CIFS_QUERY_INFO          = 0xc018cf07
CIFS_ENUMERATE_SNAPSHOTS = 0x800ccf06
CIFS_DUMP_KEY            = 0xc03acf08
CIFS_DUMP_FULL_KEY       = 0xc011cf0a

# large enough input buffer length
INPUT_BUFFER_LENGTH = 16384

# length of a @GMT- token in bytes
GMT_TOKEN_LEN_IN_BYTES = 24 * 2

# GMT format string
GMT_FORMAT = "@GMT-%Y.%m.%d-%H.%M.%S"

# cifs query flags
PASSTHRU_QUERY_INFO = 0x00000000
PASSTHRU_FSCTL      = 0x00000001

DIR_ACCESS_FLAGS = [
    (0x00000001, "LIST_DIRECTORY"),
    (0x00000002, "ADD_FILE"),
    (0x00000004, "ADD_SUBDIRECTORY"),
    (0x00000008, "READ_EA"),
    (0x00000010, "WRITE_EA"),
    (0x00000020, "TRAVERSE"),
    (0x00000040, "DELETE_CHILD"),
    (0x00000080, "READ_ATTRIBUTES"),
    (0x00000100, "WRITE_ATTRIBUTES"),
    (0x00010000, "DELETE"),
    (0x00020000, "READ_CONTROL"),
    (0x00040000, "WRITE_DAC"),
    (0x00080000, "WRITE_OWNER"),
    (0x00100000, "SYNCHRONIZER"),
    (0x01000000, "ACCESS_SYSTEM_SECURITY"),
    (0x02000000, "MAXIMUM_ALLOWED"),
    (0x10000000, "GENERIC_ALL"),
    (0x20000000, "GENERIC_EXECUTE"),
    (0x40000000, "GENERIC_WRITE"),
    (0x80000000, "GENERIC_READ"),
]

FILE_ACCESS_FLAGS = [
    (0x00000001, "READ_DATA"),
    (0x00000002, "WRITE_DATA"),
    (0x00000004, "APPEND_DATA"),
    (0x00000008, "READ_EA"),
    (0x00000010, "WRITE_EA"),
    (0x00000020, "EXECUTE"),
    (0x00000040, "DELETE_CHILD"),
    (0x00000080, "READ_ATTRIBUTES"),
    (0x00000100, "WRITE_ATTRIBUTES"),
    (0x00010000, "DELETE"),
    (0x00020000, "READ_CONTROL"),
    (0x00040000, "WRITE_DAC"),
    (0x00080000, "WRITE_OWNER"),
    (0x00100000, "SYNCHRONIZER"),
    (0x01000000, "ACCESS_SYSTEM_SECURITY"),
    (0x02000000, "MAXIMUM_ALLOWED"),
    (0x10000000, "GENERIC_ALL"),
    (0x20000000, "GENERIC_EXECUTE"),
    (0x40000000, "GENERIC_WRITE"),
    (0x80000000, "GENERIC_READ"),
]

FILE_ATTR_FLAGS = [
    (0x00000001, "READ_ONLY"),
    (0x00000002, "HIDDEN"),
    (0x00000004, "SYSTEM"),
    (0x00000010, "DIRECTORY"),
    (0x00000020, "ARCHIVE"),
    (0x00000080, "NORMAL"),
    (0x00000100, "TEMPORARY"),
    (0x00000200, "SPARSE_FILE"),
    (0x00000400, "REPARSE_POINT"),
    (0x00000800, "COMPRESSED"),
    (0x00001000, "OFFLINE"),
    (0x00002000, "NOT_CONTENT_INDEXED"),
    (0x00004000, "ENCRYPTED"),
    (0x00008000, "INTEGRITY_STREAM"),
    (0x00020000, "NO_SCRUB_DATA"),
]

FILE_MODE_FLAGS = [
    (0x00000002, "WRITE_THROUGH"),
    (0x00000004, "SEQUENTIAL_ONLY"),
    (0x00000008, "NO_INTERMEDIATE_BUFFERING"),
    (0x00000010, "SYNCHRONOUS_IO_ALERT"),
    (0x00000020, "SYNCHRONOUS_IO_NONALERT"),
    (0x00001000, "DELETE_ON_CLOSE"),
]

ALIGN_TYPES = [
    (0, "BYTE_ALIGNMENT"),
    (1, "WORD_ALIGNMENT"),
    (3, "LONG_ALIGNMENT"),
    (7, "QUAD_ALIGNMENT"),
    (15, "OCTA_ALIGNMENT"),
    (31, "32_bit_ALIGNMENT"),
    (63, "64_bit_ALIGNMENT"),
    (127, "128_bit_ALIGNMENT"),
    (255, "254_bit_ALIGNMENT"),
    (511, "512_bit_ALIGNMENT"),
]

COMPRESSION_TYPES = [
    (0x0000, "NONE"),
    (0x0002, "LZNT1"),
]

CONTROL_FLAGS = [
    (0x8000, "SR"),
    (0x4000, "RM"),
    (0x2000, "PS"),
    (0x1000, "PD"),
    (0x0800, "SI"),
    (0x0400, "DI"),
    (0x0200, "SC"),
    (0x0100, "DC"),
    (0x0080, "DT"),
    (0x0040, "SS"),
    (0x0020, "SD"),
    (0x0010, "SP"),
    (0x0008, "DD"),
    (0x0004, "DP"),
    (0x0002, "GD"),
    (0x0001, "OD"),
]

ACE_TYPES = [
    (0x00, "ALLOWED"),
    (0x01, "DENIED"),
    (0x02, "AUDIT"),
    (0x03, "ALARM"),
    (0x04, "ALLOWED_COMPOUND"),
    (0x05, "ALLOWED_OBJECT"),
    (0x06, "DENIED_OBJECT"),
    (0x07, "AUDIT_OBJECT"),
    (0x08, "ALARM_OBJECT"),
    (0x09, "ALLOWED_CALLBACK"),
    (0x0a, "DENIED_CALLBACK"),
    (0x0b, "ALLOWED_CALLBACK_OBJECT"),
    (0x0c, "DENIED_CALLBACK_OBJECT"),
    (0x0d, "AUDIT_CALLBACK"),
    (0x0e, "ALARM_CALLBACK"),
    (0x0f, "AUDIT_CALLBACK_OBJECT"),
    (0x10, "ALARM_CALLBACK_OBJECT"),
    (0x11, "MANDATORY_LABEL"),
    (0x12, "RESOURCE_ATTRIBUTE"),
    (0x13, "SCOPED_POLICY_ID"),
]

ACE_FLAGS = [
    (0x80, "FAILED_ACCESS"),
    (0x40, "SUCCESSFUL_ACCESS"),
    (0x10, "INHERITED"),
    (0x08, "INHERIT_ONLY"),
    (0x04, "NO_PROPAGATE_INHERIT"),
    (0x02, "CONTAINER_INHERIT"),
    (0x01, "OBJECT_INHERIT"),
]

CIPHER_TYPES = [
    (0x00, "AES-128-CCM"),
    (0x01, "AES-128-CCM"),
    (0x02, "AES-128-GCM"),
    (0x03, "AES-256-CCM"),
    (0x04, "AES-256-GCM"),
]

def main():
    #
    # Global options and arguments
    #

    ap = argparse.ArgumentParser(description="Display SMB-specific file information using cifs IOCTL")
    ap.add_argument("-V", "--verbose", action="store_true", help="verbose output")
    subp = ap.add_subparsers(help="sub-commands help")
    subp.required = True
    subp.dest = 'subcommand'

    #
    # To add a new sub-command xxx, add a subparser xxx complete with
    # help, options and/or arguments and implement cmd_xxx()
    #

    sap = subp.add_parser("fileaccessinfo", help="Prints FileAccessInfo for a cifs file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_fileaccessinfo)

    sap = subp.add_parser("filealigninfo", help="Prints FileAlignInfo for a cifs file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_filealigninfo)

    sap = subp.add_parser("fileallinfo", help="Prints FileAllInfo for a cifs file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_fileallinfo)

    sap = subp.add_parser("filebasicinfo", help="Prints FileBasicInfo for a cifs file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_filebasicinfo)

    sap = subp.add_parser("fileeainfo", help="Prints FileEAInfo for a cifs file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_fileeainfo)

    sap = subp.add_parser("filefsfullsizeinfo", help="Prints FileFsFullSizeInfo for a cifs file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_filefsfullsizeinfo)

    sap = subp.add_parser("fileinternalinfo", help="Prints FileInternalInfo for a cifs file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_fileinternalinfo)

    sap = subp.add_parser("filemodeinfo", help="Prints FileModeInfo for a cifs file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_filemodeinfo)

    sap = subp.add_parser("filepositioninfo", help="Prints FilePositionInfo for a cifs file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_filepositioninfo)

    sap = subp.add_parser("filestandardinfo", help="Prints FileStandardInfo for a cifs file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_filestandardinfo)

    sap = subp.add_parser("filestreaminfo", help="Prints FileStreamInfo for a cifs file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_filestreaminfo)

    sap = subp.add_parser("fsctl-getobjid", help="Prints the objectid of the file and GUID of the underlying volume.")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_fsctl_getobjid)

    sap = subp.add_parser("getcompression", help="Prints the compression setting for the file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_getcompression)

    sap = subp.add_parser("setcompression", help="Sets the compression level for the file")
    sap.add_argument("type", choices=['no','default','lznt1'])
    sap.add_argument("file")
    sap.set_defaults(func=cmd_setcompression)

    sap = subp.add_parser("list-snapshots", help="List the previous versions of the volume that backs this file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_list_snapshots)

    sap = subp.add_parser("quota", help="Prints the quota for a cifs file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_quota)

    sap = subp.add_parser("secdesc", help="Prints the security descriptor for a cifs file")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_secdesc)

    sap = subp.add_parser("keys", help="Prints the decryption information needed to view encrypted network traces")
    sap.add_argument("file")
    sap.set_defaults(func=cmd_keys)

    # parse arguments
    args = ap.parse_args()

    # act on any global options
    if args.verbose:
        global VERBOSE
        VERBOSE = True

    # call subcommand function
    args.func(args)

class QueryInfoStruct:
    def __init__(self,
                 info_type=0, file_info_class=0, additional_information=0,
                 flags=0, input_buffer_length=0, output_buffer_length=0):
        self.info_type = info_type
        self.file_info_class = file_info_class
        self.additional_information = additional_information
        self.flags = flags
        self.input_buffer_length = input_buffer_length
        self.output_buffer_length = output_buffer_length
        buf_size = max(self.input_buffer_length, self.output_buffer_length)
        self.input_buffer = bytearray(buf_size)

    def pack_input(self, fmt, offset, *vals):
        struct.pack_into(fmt, self.input_buffer, offset, *vals)

    def ioctl(self, fd, out_fmt=None):
        buf = bytearray()
        buf.extend(struct.pack("IIIIII",
                               self.info_type,
                               self.file_info_class,
                               self.additional_information,
                               self.flags,
                               self.input_buffer_length,
                               self.output_buffer_length))
        in_len = len(buf)
        buf.extend(self.input_buffer)
        fcntl.ioctl(fd, CIFS_QUERY_INFO, buf, True)
        if out_fmt:
            return struct.unpack_from(out_fmt, buf, in_len)
        else:
            return buf[in_len:]

def flags_to_str(flags, bitlist, verbose=None):
    if verbose is None:
        verbose = VERBOSE

    if not verbose:
        return "0x%08x"%flags

    out = []
    for bit, name in bitlist:
        if flags & bit:
            out.append(name)

    return "0x%08x (%s)"%(flags, ",".join(out))

def type_to_str(typ, typelist, verbose=None):
    if verbose is None:
        verbose = VERBOSE

    if not verbose:
        return "0x%08x"%typ

    s = "Unknown"
    for val, name in typelist:
        if typ == val:
            s = name

    return "0x%08x (%s)"%(typ, s)

def cmd_fileaccessinfo(args):
    qi = QueryInfoStruct(info_type=0x1, file_info_class=8, input_buffer_length=4)
    try:
        fd = os.open(args.file, os.O_RDONLY)
        info = os.fstat(fd)
        buf = qi.ioctl(fd)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    print_fileaccessinfo(buf, info)

def print_fileaccessinfo(buf, info):
    flags = struct.unpack_from('<I', buf, 0)[0]
    if stat.S_ISDIR(info.st_mode):
        print("Directory access flags:", flags_to_str(flags, DIR_ACCESS_FLAGS))
    else:
        print("File/Printer access flags:", flags_to_str(flags, FILE_ACCESS_FLAGS))

def cmd_filealigninfo(args):
    qi = QueryInfoStruct(info_type=0x1, file_info_class=17, input_buffer_length=4)
    try:
        fd = os.open(args.file, os.O_RDONLY)
        buf = qi.ioctl(fd)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    print_filealigninfo(buf)

def print_filealigninfo(buf):
    mask = struct.unpack_from('<I', buf, 0)[0]
    print("File alignment: %s"%type_to_str(mask, ALIGN_TYPES))

def cmd_fileallinfo(args):
    qi = QueryInfoStruct(info_type=0x1, file_info_class=18, input_buffer_length=INPUT_BUFFER_LENGTH)
    try:
        fd = os.open(args.file, os.O_RDONLY)
        info = os.fstat(fd)
        buf = qi.ioctl(fd)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    print_filebasicinfo(buf)
    print_filestandardinfo(buf[40:])
    print_fileinternalinfo(buf[64:])
    print_fileeainfo(buf[72:])
    print_fileaccessinfo(buf[76:], info)
    print_filepositioninfo(buf[80:])
    print_filemodeinfo(buf[88:])
    print_filealigninfo(buf[92:])

def win_to_datetime(smb2_time):
    usec = (smb2_time / 10) % 1000000
    sec  = (smb2_time - 116444736000000000) // 10000000
    return datetime.datetime.fromtimestamp(sec + usec/10000000)

def cmd_filebasicinfo(args):
    qi = QueryInfoStruct(info_type=0x1, file_info_class=4, input_buffer_length=40)
    try:
        fd = os.open(args.file, os.O_RDONLY)
        buf = qi.ioctl(fd)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    print_filebasicinfo(buf)

def print_filebasicinfo(buf):
    ctime, atime, wtime, mtime, attrs = struct.unpack_from('<QQQQI', buf, 0)
    print("Creation Time: %s"%win_to_datetime(ctime))
    print("Last Access Time: %s"%win_to_datetime(atime))
    print("Last Write Time: %s"%win_to_datetime(wtime))
    print("Last Change Time: %s"%win_to_datetime(mtime))
    print("File Attributes: %s"%flags_to_str(attrs, FILE_ATTR_FLAGS))

def cmd_fileeainfo(args):
    qi = QueryInfoStruct(info_type=0x1, file_info_class=7, input_buffer_length=4)
    try:
        fd = os.open(args.file, os.O_RDONLY)
        buf = qi.ioctl(fd)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    print_fileeainfo(buf)

def print_fileeainfo(buf):
    size = struct.unpack_from('<I', buf, 0)[0]
    print("EA Size: %d"%size)

def cmd_filefsfullsizeinfo(args):
    qi = QueryInfoStruct(info_type=0x2, file_info_class=7, input_buffer_length=32)
    try:
        fd = os.open(args.file, os.O_RDONLY)
        total, caller_avail, actual_avail, sec_per_unit, byte_per_sec = qi.ioctl(fd, '<QQQII')
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    print("Total Allocation Units: %d"%total)
    print("Caller Available Allocation Units: %d"%caller_avail)
    print("Actual Available Allocation Units: %d"%actual_avail)
    print("Sectors Per Allocation Unit: %d"%sec_per_unit)
    print("Bytes Per Sector: %d"%byte_per_sec)

def cmd_fileinternalinfo(args):
    qi = QueryInfoStruct(info_type=0x1, file_info_class=6, input_buffer_length=8)
    try:
        fd = os.open(args.file, os.O_RDONLY)
        buf = qi.ioctl(fd)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    print_fileinternalinfo(buf)

def print_fileinternalinfo(buf):
    index = struct.unpack_from('<Q', buf, 0)[0]
    print("Index Number: %d"%index)


def cmd_filemodeinfo(args):
    qi = QueryInfoStruct(info_type=0x1, file_info_class=16, input_buffer_length=4)
    try:
        fd = os.open(args.file, os.O_RDONLY)
        buf = qi.ioctl(fd)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    print_filemodeinfo(buf)

def print_filemodeinfo(buf):
        mode = struct.unpack_from('<I', buf, 0)[0]
        print("Mode: %s"%flags_to_str(mode, FILE_MODE_FLAGS))

def cmd_filepositioninfo(args):
    qi = QueryInfoStruct(info_type=0x1, file_info_class=14, input_buffer_length=8)
    try:
        fd = os.open(args.file, os.O_RDONLY)
        buf = qi.ioctl(fd)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    print_filepositioninfo(buf)

def print_filepositioninfo(buf):
    offset = struct.unpack_from('<Q', buf, 0)[0]
    print("Current Byte Offset: %d"%offset)

def cmd_filestandardinfo(args):
    qi = QueryInfoStruct(info_type=0x1, file_info_class=5, input_buffer_length=24)
    try:
        fd = os.open(args.file, os.O_RDONLY)
        buf = qi.ioctl(fd)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    print_filestandardinfo(buf)

def print_filestandardinfo(buf):
    nalloc, eof, nlink, del_pending, del_dir = struct.unpack_from('<QQIBB', buf, 0)
    print("Allocation Size: %d"%nalloc)
    print("End Of File: %d"%eof)
    print("Number of Links: %d"%nlink)
    print("Delete Pending: %d"%del_pending)
    print("Delete Directory: %d"%del_dir)

def guid_to_str(buf):
    return "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x"%struct.unpack_from('<IHHBBBBBBBB', buf, 0)

def cmd_fsctl_getobjid(args):
    qi = QueryInfoStruct(info_type=0x9009c, file_info_class=5, flags=PASSTHRU_FSCTL, input_buffer_length=64)
    try:
        fd = os.open(args.file, os.O_RDONLY)
        buf = qi.ioctl(fd)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    print("Object-ID: %s"%guid_to_str(buf))
    print("Birth-Volume-ID: %s"%guid_to_str(buf[16:]))
    print("Birth-Object-ID: %s"%guid_to_str(buf[32:]))
    print("Domain-ID: %s"%guid_to_str(buf[48:]))

def cmd_getcompression(args):
    qi = QueryInfoStruct(info_type=0x9003c, flags=PASSTHRU_FSCTL, input_buffer_length=2)
    try:
        fd = os.open(args.file, os.O_RDONLY)
        ctype = qi.ioctl(fd, '<H')[0]
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    ctype_name = "UNKNOWN"
    for val, name in COMPRESSION_TYPES:
        if ctype == val:
            ctype_name = name
            break
    print("Compression: %d (%s)"%(ctype, ctype_name))

def cmd_setcompression(args):
    qi = QueryInfoStruct(info_type=0x9c040, flags=PASSTHRU_FSCTL, output_buffer_length=2)
    type_map = {'no': 0, 'default': 1, 'lznt1': 2}
    qi.pack_input('<H', 0, type_map[args.type])
    try:
        fd = os.open(args.file, os.O_RDONLY)
        qi.ioctl(fd)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

class SnapshotArrayStruct:
    def __init__(self,
                 nb_snapshots=0,
                 nb_snapshots_returned=0,
                 snapshot_array_size=12):
        self.nb_snapshots = nb_snapshots
        self.nb_snapshots_returned = nb_snapshots_returned
        self.snapshot_array_size = snapshot_array_size
        self.snapshot_array = []

    def ioctl(self, fd, op):
        buf = bytearray()
        buf.extend(struct.pack("III",
                               self.nb_snapshots,
                               self.nb_snapshots_returned,
                               self.snapshot_array_size))

        buf.extend(bytearray(16 + self.snapshot_array_size))
        fcntl.ioctl(fd, op, buf, True)

        out = SnapshotArrayStruct()
        out.nb_snapshots, out.nb_snapshots_returned, out.snapshot_array_size = struct.unpack_from('III', buf, 0)
        data = buf[12:]

        # '@\x00G\x00M\x00T\x00-\x002\x000\x001\x009\x00.\x000\x004\x00.\x000\x005\x00-\x002\x003\x00.\x001\x000\x00.\x005\x000\x00\x00\x00'
        index_start = 0
        while index_start < len(data):
            gmt_start = data.find(b'@', index_start)
            if gmt_start == -1 or len(data) - gmt_start < GMT_TOKEN_LEN_IN_BYTES:
                break
            gmt = data[gmt_start:gmt_start + GMT_TOKEN_LEN_IN_BYTES]
            index_start = gmt_start + GMT_TOKEN_LEN_IN_BYTES
            out.snapshot_array.append(datetime.datetime.strptime(gmt.decode('utf-16'), GMT_FORMAT))

        return out

def datetime_to_smb(dt):
    ntfs_time_offset = (369*365 + 89) * 24 * 3600 * 10000000
    return calendar.timegm(dt.timetuple()) * 10000000 + ntfs_time_offset

def cmd_list_snapshots(args):
    sa1req = SnapshotArrayStruct()
    sa1res = None
    sa2req = None
    sa2res = None

    try:
        fd = os.open(args.file, os.O_RDONLY)
        sa1res = sa1req.ioctl(fd, CIFS_ENUMERATE_SNAPSHOTS)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    if sa1res.nb_snapshots == 0:
        return

    sa2req = SnapshotArrayStruct(nb_snapshots=sa1res.nb_snapshots, snapshot_array_size=sa1res.snapshot_array_size)
    try:
        fd = os.open(args.file, os.O_RDONLY)
        sa2res = sa2req.ioctl(fd, CIFS_ENUMERATE_SNAPSHOTS)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False


    print("Number of snapshots: %d Number of snapshots returned: %d"%(sa2res.nb_snapshots, sa2res.nb_snapshots_returned))
    print("Snapshot list in GMT (Coordinated UTC Time) and SMB format (100 nanosecond units needed for snapshot mounts):")
    for i, d in enumerate(sa2res.snapshot_array):
        print("%d) GMT:%s\n   SMB3:%d"%(i + 1, d.strftime(GMT_FORMAT), datetime_to_smb(d)))

class SID:
    def __init__(self, buf, off=0):
        rev, sublen = struct.unpack_from('BB', buf, off+0)
        off += 2
        auth = 0
        subauth = []
        for i in range(6):
            auth = (auth << 8)|buf[off]
            off += 1
        for i in range(sublen):
            subauth.append(struct.unpack_from('<I', buf, off))
            off += 4

        self.rev = rev
        self.auth = auth
        self.subauth = subauth

    def __str__(self):
        auth = ("0x%x" if self.auth >= 2**32 else "%d")%self.auth
        return  "S-%d-%s-%s"%(self.rev, auth, '-'.join(["%d"%x for x in self.subauth]))

class ACE:
    def __init__(self, buf, off=0, is_dir=False):
        self.typ, self.flags, self.size = struct.unpack_from('<BBH', buf, off)
        self.is_dir = is_dir
        if self.typ not in [0,1,2]:
            self.buf = buf[4:]
        else:
            self.mask = struct.unpack_from('<I', buf, off+4)[0]
            self.sid = SID(buf, off+8)

    def __str__(self):
        s = []
        s.append("Type: %s" % type_to_str(self.typ, ACE_TYPES))
        s.append("Flags: %s" % flags_to_str(self.flags, ACE_FLAGS))
        if self.typ not in [0,1,2]:
            s.append("<%s>"%(" ".join(["%02x"%x for x in self.buf])))
        else:
            s.append("Mask: %s"%flags_to_str(self.mask, (DIR_ACCESS_FLAGS if self.is_dir else FILE_ACCESS_FLAGS)))
            s.append("SID: %s"%self.sid)
        return ", ".join(s)

def cmd_quota(args):
    qi = QueryInfoStruct(info_type=0x04, input_buffer_length=INPUT_BUFFER_LENGTH)
    qi.pack_input('BBI', 0,
                  0, # return single
                  1, # restart scan
                  0, # sid list length
                  )
    qi.output_buffer_length = 16
    buf = None

    try:
        fd = os.open(args.file, os.O_RDONLY)
        buf = qi.ioctl(fd)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    off = 0
    while off < len(buf):
        next_off = struct.unpack_from('<I', buf, off+ 0)[0]
        sid_len  = struct.unpack_from('<I', buf, off+ 4)[0]
        atime    = struct.unpack_from('<Q', buf, off+ 8)[0]
        qused    = struct.unpack_from('<Q', buf, off+16)[0]
        qthresh  = struct.unpack_from('<Q', buf, off+24)[0]
        qlimit   = struct.unpack_from('<Q', buf, off+32)[0]
        sid = SID(buf, off+40)

        print("SID Length: %d"%sid_len)
        print("Change Time: %s"%win_to_datetime(atime))
        print("Quota Used: %d"%qused)
        print("Quota Threshold:", ("NO THRESHOLD" if qthresh == 0xffffffffffffffff else "%d"%qthresh))
        print("Quota Limit:", ("NO LIMIT" if qlimit == 0xffffffffffffffff else "%d"%qlimit))
        print("SID: %s"%sid)

        if next_off == 0:
            break
        off += next_off

def cmd_secdesc(args):
    qi = QueryInfoStruct(info_type=0x03,
                         additional_information=0x7, # owner, group, dacl
                         input_buffer_length=INPUT_BUFFER_LENGTH)
    buf = None
    info = None

    try:
        fd = os.open(args.file, os.O_RDONLY)
        info = os.fstat(fd)
        buf = qi.ioctl(fd)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    is_dir = stat.S_ISDIR(info.st_mode)
    rev, ctrl, off_owner, off_group, off_dacl = struct.unpack_from('<BxHIIxxxxI', buf, 0)

    print("Revision: %d"%rev)
    print("Control: %s"%flags_to_str(ctrl, CONTROL_FLAGS))
    if off_owner:
        print("Owner: %s"%SID(buf, off_owner))
    if off_group:
        print("Group: %s"%SID(buf, off_group))
    if off_dacl:
        print("DACL:")
        rev, count = struct.unpack_from('<BxxxH', buf, off_dacl)
        off_dacl += 8
        for i in range(count):
              ace = ACE(buf, off_dacl, is_dir=is_dir)
              print(ace)
              off_dacl += ace.size

def cmd_filestreaminfo(args):
    qi = QueryInfoStruct(info_type=0x1, file_info_class=22, input_buffer_length=INPUT_BUFFER_LENGTH)
    try:
        fd = os.open(args.file, os.O_RDONLY)
        info = os.fstat(fd)
        buf = qi.ioctl(fd)
    except Exception as e:
        print("syscall failed: %s"%e)
        return False

    print_filestreaminfo(buf)

def print_filestreaminfo(buf):
    offset = 0

    while offset < len(buf):

        next_offset = struct.unpack_from('<I', buf, offset + 0)[0]
        name_length = struct.unpack_from('<I', buf, offset + 4)[0]
        if (name_length > 0):
            stream_size = struct.unpack_from('<q', buf, offset + 8)[0]
            stream_alloc_size = struct.unpack_from('<q', buf, offset + 16)[0]
            stream_utf16le_name = struct.unpack_from('< %ss'% name_length, buf, offset + 24)[0]
            stream_name = stream_utf16le_name.decode("utf-16le")
            if (offset > 0):
                print()
            if (stream_name=="::$DATA"):
                print("Name: %s"% stream_name)
            else:
                print("Name: %s"% stream_name[stream_name.find(":") + 1 : stream_name.rfind(':$DATA')])
            print("Size: %d bytes"% stream_size)
            print("Allocation size: %d bytes "% stream_alloc_size)

        if (next_offset == 0):
            break

        offset+=next_offset

class KeyDebugInfoStruct:
    def __init__(self):
        self.suid = bytearray()
        self.cipher = 0
        self.session_key = bytearray()
        self.enc_key = bytearray()
        self.dec_key = bytearray()

    def ioctl(self, fd):
        buf = bytearray()
        buf.extend(struct.pack("= 8s H 16s 16s 16s", self.suid, self.cipher,
                               self.session_key, self.enc_key, self.dec_key))
        fcntl.ioctl(fd, CIFS_DUMP_KEY, buf, True)
        (self.suid, self.cipher, self.session_key,
         self.enc_key, self.dec_key) = struct.unpack_from('= 8s H 16s 16s 16s', buf, 0)

class FullKeyDebugInfoStruct:
    def __init__(self):
        # lets pick something large to be future proof
        # 17 + 3*32 would be strict minimum as of linux 5.13
        self.in_size = 1024
        self.suid = bytearray()
        self.cipher = 0
        self.session_key_len = 0
        self.server_in_key_len = 0
        self.server_out_key_len = 0

    def ioctl(self, fd):
        fmt = "= I 8s H B B B"
        size = struct.calcsize(fmt)
        buf = bytearray()
        buf.extend(struct.pack(fmt, self.in_size, self.suid, self.cipher,
                               self.session_key_len, self.server_in_key_len, self.server_out_key_len))
        buf.extend(bytearray(self.in_size-size))
        fcntl.ioctl(fd, CIFS_DUMP_FULL_KEY, buf, True)
        (self.in_size, self.suid, self.cipher,
         self.session_key_len, self.server_in_key_len,
         self.server_out_key_len) = struct.unpack_from(fmt, buf, 0)

        end = size
        self.session_key = buf[end:end+self.session_key_len]
        end += self.session_key_len
        self.server_in_key = buf[end:end+self.server_in_key_len]
        end += self.server_in_key_len
        self.server_out_key = buf[end:end+self.server_out_key_len]

def bytes_to_hex(buf):
    return " ".join(["%02x"%x for x in buf])

def cmd_keys(args):
    fd = os.open(args.file, os.O_RDONLY)
    kd = FullKeyDebugInfoStruct()

    try:
        # try new call first
        kd.ioctl(fd)
    except Exception as e:
        # new failed, try old call
        kd = KeyDebugInfoStruct()
        try:
            kd.ioctl(fd)
        except Exception as e:
            # both new and old call failed
            print("syscall failed: %s"%e)
            return False
        print("Session Id: %s"%bytes_to_hex(kd.suid))
        print("Cipher: %s"%type_to_str(kd.cipher, CIPHER_TYPES, verbose=True))
        print("Session Key: %s"%bytes_to_hex(kd.session_key))
        print("Encryption key: %s"%bytes_to_hex(kd.enc_key))
        print("Decryption key: %s"%bytes_to_hex(kd.dec_key))
    else:
        # no exception, new call succeeded
        print("Session Id: %s"%bytes_to_hex(kd.suid))
        print("Cipher: %s"%type_to_str(kd.cipher, CIPHER_TYPES, verbose=True))
        print("Session Key: %s"%bytes_to_hex(kd.session_key))
        print("ServerIn  Key: %s"%bytes_to_hex(kd.server_in_key))
        print("ServerOut key: %s"%bytes_to_hex(kd.server_out_key))

if __name__ == '__main__':
    main()