Fix NETLOGON_LOGON_QUERY parsing: Add mailslot name alignment

scapy/layers/smb.py

@@ -943,6 +943,10 @@ class NETLOGON_LOGON_QUERY(NETLOGON):
         LEShortEnumField("OpCode", 0x7, _NETLOGON_opcodes),
         StrNullField("ComputerName", ""),
         StrNullField("MailslotName", ""),
+        ConditionalField(
+            ByteField("MailslotPad", default=0x00),
+            lambda pkt: len(pkt.ComputerName) % 2 != 0
+        ),
         StrNullFieldUtf16("UnicodeComputerName", ""),
         FlagsField("NtVersion", 0xB, -32, _NV_VERSION),
         XLEShortField("LmNtToken", 0xFFFF),

test/scapy/layers/ldap.uts

@@ -215,3 +215,23 @@ pkt = NETLOGON(b'\x13\x00\\\x00\\\x00D\x00C\x001\x00\x00\x00\x00\x00D\x00O\x00M\
 assert pkt.NtVersion == 1
 assert pkt.UnicodeLogonServer == r"\\DC1"
 assert pkt.UnicodeDomainName == "DOMAIN"
+
+= Dissect NETLOGON_LOGON_QUERY - V1+V5+V5EX_WITH_IP
+
+pkt = NETLOGON(b'\x07\x00PC\x00\\MAILSLOT\\NET\\GETDC598\x00P\x00C\x00\x00\x00\x0b\x00\x00 \xff\xff\xff\xff')
+
+print(pkt.show())
+assert pkt.ComputerName == b"PC"
+assert pkt.MailslotName == b"\\MAILSLOT\\NET\\GETDC598"
+assert pkt.NtVersion == 0x2000000b
+assert pkt.UnicodeComputerName == "PC"
+
+= Dissect NETLOGON_LOGON_QUERY - V1+V5+V5EX_WITH_IP - with Padding
+
+pkt = NETLOGON(b'\x07\x00USER-PC\x00\\MAILSLOT\\NET\\GETDC725\x00\x00U\x00S\x00E\x00R\x00-\x00P\x00C\x00\x00\x00\x0b\x00\x00 \xff\xff\xff\xff')
+
+print(pkt.show())
+assert pkt.ComputerName == b"USER-PC"
+assert pkt.MailslotName == b"\\MAILSLOT\\NET\\GETDC725"
+assert pkt.NtVersion == 0x2000000b
+assert pkt.UnicodeComputerName == "USER-PC"