diff options
| -rw-r--r-- | packet-smb.c | 1115 | ||||
| -rw-r--r-- | packet.h | 116 |
2 files changed, 933 insertions, 298 deletions
diff --git a/packet-smb.c b/packet-smb.c index 9ae2b4d39c..c30540cb86 100644 --- a/packet-smb.c +++ b/packet-smb.c @@ -2,7 +2,7 @@ * Routines for smb packet dissection * Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com> * - * $Id: packet-smb.c,v 1.15 1999/07/07 22:51:53 gram Exp $ + * $Id: packet-smb.c,v 1.16 1999/07/10 14:01:52 sharpe Exp $ * * Ethereal - Network traffic analyzer * By Gerald Combs <gerald@unicom.net> @@ -316,7 +316,7 @@ dissect_unknown_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, END_OF_FRAME, "Data (%u bytes)", + proto_tree_add_item(tree, offset, END_OF_FRAME, "Data (%u bytes)", END_OF_FRAME); } @@ -421,7 +421,7 @@ dissect_treecon_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 1, "Word Count (WCT): %u", WordCount); + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", WordCount); } @@ -433,7 +433,7 @@ dissect_treecon_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); } @@ -445,7 +445,7 @@ dissect_treecon_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 1, "BufferFormat1: %u", BufferFormat1); + proto_tree_add_item(tree, offset, 1, "BufferFormat1: %u", BufferFormat1); } @@ -457,7 +457,7 @@ dissect_treecon_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, strlen(SharePath) + 1, "Share Path: %s", SharePath); + proto_tree_add_item(tree, offset, strlen(SharePath) + 1, "Share Path: %s", SharePath); } @@ -469,7 +469,7 @@ dissect_treecon_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 1, "BufferFormat2: %u", BufferFormat2); + proto_tree_add_item(tree, offset, 1, "BufferFormat2: %u", BufferFormat2); } @@ -481,7 +481,7 @@ dissect_treecon_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, strlen(Password) + 1, "Password: %s", Password); + proto_tree_add_item(tree, offset, strlen(Password) + 1, "Password: %s", Password); } @@ -493,7 +493,7 @@ dissect_treecon_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 1, "BufferFormat3: %u", BufferFormat3); + proto_tree_add_item(tree, offset, 1, "BufferFormat3: %u", BufferFormat3); } @@ -505,7 +505,7 @@ dissect_treecon_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, strlen(Service) + 1, "Service: %s", Service); + proto_tree_add_item(tree, offset, strlen(Service) + 1, "Service: %s", Service); } @@ -521,7 +521,7 @@ dissect_treecon_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 1, "Word Count (WCT): %u", WordCount); + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", WordCount); } @@ -533,7 +533,7 @@ dissect_treecon_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Max Buffer Size: %u", MaxBufferSize); + proto_tree_add_item(tree, offset, 2, "Max Buffer Size: %u", MaxBufferSize); } @@ -545,7 +545,7 @@ dissect_treecon_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "TID: %u", TID); + proto_tree_add_item(tree, offset, 2, "TID: %u", TID); } @@ -557,7 +557,7 @@ dissect_treecon_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); } @@ -577,6 +577,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree guint8 WordCount; guint8 AndXReserved; guint8 AndXCommand; + int AndXCmdOffset; guint32 SessionKey; guint32 Reserved; guint32 Capabilities; @@ -611,7 +612,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 1, "Word Count (WCT): %u", WordCount); + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", WordCount); } @@ -620,12 +621,13 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree /* Build display for: AndXCommand */ AndXCommand = GBYTE(pd, offset); + AndXCmdOffset = offset; - if (tree) { + /* if (tree) { - proto_tree_add_text(tree, offset, 1, "AndXCommand: %u", AndXCommand); + proto_tree_add_item(tree, offset, 1, "AndXCommand: %u", AndXCommand); - } + } */ offset += 1; /* Skip AndXCommand */ @@ -635,7 +637,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 1, "AndXReserved: %u", AndXReserved); + proto_tree_add_item(tree, offset, 1, "AndXReserved: %u", AndXReserved); } @@ -647,7 +649,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "AndXOffset: %u", AndXOffset); + proto_tree_add_item(tree, offset, 2, "AndXOffset: %u", AndXOffset); } @@ -659,7 +661,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "MaxBufferSize: %u", MaxBufferSize); + proto_tree_add_item(tree, offset, 2, "MaxBufferSize: %u", MaxBufferSize); } @@ -671,7 +673,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "MaxMpxCount: %u", MaxMpxCount); + proto_tree_add_item(tree, offset, 2, "MaxMpxCount: %u", MaxMpxCount); } @@ -683,7 +685,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "VcNumber: %u", VcNumber); + proto_tree_add_item(tree, offset, 2, "VcNumber: %u", VcNumber); } @@ -695,7 +697,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 4, "SessionKey: %u", SessionKey); + proto_tree_add_item(tree, offset, 4, "SessionKey: %u", SessionKey); } @@ -707,7 +709,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "PasswordLen: %u", PasswordLen); + proto_tree_add_item(tree, offset, 2, "PasswordLen: %u", PasswordLen); } @@ -719,7 +721,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 4, "Reserved: %u", Reserved); + proto_tree_add_item(tree, offset, 4, "Reserved: %u", Reserved); } @@ -731,7 +733,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); } @@ -743,7 +745,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, strlen(AccountName) + 1, "AccountName: %s", AccountName); + proto_tree_add_item(tree, offset, strlen(AccountName) + 1, "AccountName: %s", AccountName); } @@ -755,7 +757,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, strlen(PrimaryDomain) + 1, "PrimaryDomain: %s", PrimaryDomain); + proto_tree_add_item(tree, offset, strlen(PrimaryDomain) + 1, "PrimaryDomain: %s", PrimaryDomain); } @@ -767,7 +769,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, strlen(NativeOS) + 1, "NativeOS: %s", NativeOS); + proto_tree_add_item(tree, offset, strlen(NativeOS) + 1, "NativeOS: %s", NativeOS); } @@ -783,7 +785,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 1, "Word Count (WCT): %u", WordCount); + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", WordCount); } @@ -792,12 +794,13 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree /* Build display for: AndXCommand */ AndXCommand = GBYTE(pd, offset); + AndXCmdOffset = offset; - if (tree) { + /* if (tree) { - proto_tree_add_text(tree, offset, 1, "AndXCommand: %u", AndXCommand); + proto_tree_add_item(tree, offset, 1, "AndXCommand: %u", AndXCommand); - } + } */ offset += 1; /* Skip AndXCommand */ @@ -807,7 +810,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 1, "AndXReserved: %u", AndXReserved); + proto_tree_add_item(tree, offset, 1, "AndXReserved: %u", AndXReserved); } @@ -819,7 +822,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "AndXOffset: %u", AndXOffset); + proto_tree_add_item(tree, offset, 2, "AndXOffset: %u", AndXOffset); } @@ -831,7 +834,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "MaxBufferSize: %u", MaxBufferSize); + proto_tree_add_item(tree, offset, 2, "MaxBufferSize: %u", MaxBufferSize); } @@ -843,7 +846,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "MaxMpxCount: %u", MaxMpxCount); + proto_tree_add_item(tree, offset, 2, "MaxMpxCount: %u", MaxMpxCount); } @@ -855,7 +858,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "VcNumber: %u", VcNumber); + proto_tree_add_item(tree, offset, 2, "VcNumber: %u", VcNumber); } @@ -867,7 +870,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 4, "SessionKey: %u", SessionKey); + proto_tree_add_item(tree, offset, 4, "SessionKey: %u", SessionKey); } @@ -879,7 +882,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "ANSI Account Password Length: %u", ANSIAccountPasswordLength); + proto_tree_add_item(tree, offset, 2, "ANSI Account Password Length: %u", ANSIAccountPasswordLength); } @@ -891,7 +894,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "UNICODE Account Password Length: %u", UNICODEAccountPasswordLength); + proto_tree_add_item(tree, offset, 2, "UNICODE Account Password Length: %u", UNICODEAccountPasswordLength); } @@ -903,7 +906,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 4, "Reserved: %u", Reserved); + proto_tree_add_item(tree, offset, 4, "Reserved: %u", Reserved); } @@ -915,35 +918,36 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - ti = proto_tree_add_text(tree, offset, 4, "Capabilities: 0x%04x", Capabilities); - Capabilities_tree = proto_item_add_subtree(ti, ETT_SMB_CAPABILITIES); - proto_tree_add_text(Capabilities_tree, offset, 4, "%s", + ti = proto_tree_add_item(tree, offset, 4, "Capabilities: 0x%04x", Capabilities); + Capabilities_tree = proto_tree_new(); + proto_item_add_subtree(ti, Capabilities_tree, ETT_SMB_CAPABILITIES); + proto_tree_add_item(Capabilities_tree, offset, 4, "%s", decode_boolean_bitfield(Capabilities, 0x0001, 32, " Raw Mode supported", " Raw Mode not supported")); - proto_tree_add_text(Capabilities_tree, offset, 4, "%s", + proto_tree_add_item(Capabilities_tree, offset, 4, "%s", decode_boolean_bitfield(Capabilities, 0x0002, 32, " Raw Mode supported", " MPX Mode not supported")); - proto_tree_add_text(Capabilities_tree, offset, 4, "%s", + proto_tree_add_item(Capabilities_tree, offset, 4, "%s", decode_boolean_bitfield(Capabilities, 0x0004, 32," Unicode supported", " Unicode not supported")); - proto_tree_add_text(Capabilities_tree, offset, 4, "%s", + proto_tree_add_item(Capabilities_tree, offset, 4, "%s", decode_boolean_bitfield(Capabilities, 0x0008, 32, " Large Files supported", " Large Files not supported")); - proto_tree_add_text(Capabilities_tree, offset, 4, "%s", + proto_tree_add_item(Capabilities_tree, offset, 4, "%s", decode_boolean_bitfield(Capabilities, 0x0010, 32, " NT LM 0.12 SMBs supported", " NT LM 0.12 SMBs not supported")); - proto_tree_add_text(Capabilities_tree, offset, 4, "%s", + proto_tree_add_item(Capabilities_tree, offset, 4, "%s", decode_boolean_bitfield(Capabilities, 0x0020, 32, " RPC Remote APIs supported", " RPC Remote APIs not supported")); - proto_tree_add_text(Capabilities_tree, offset, 4, "%s", + proto_tree_add_item(Capabilities_tree, offset, 4, "%s", decode_boolean_bitfield(Capabilities, 0x0040, 32, " NT Status Codes supported", " NT Status Codes not supported")); - proto_tree_add_text(Capabilities_tree, offset, 4, "%s", + proto_tree_add_item(Capabilities_tree, offset, 4, "%s", decode_boolean_bitfield(Capabilities, 0x0080, 32, " Level 2 OpLocks supported", " Level 2 OpLocks not supported")); - proto_tree_add_text(Capabilities_tree, offset, 4, "%s", + proto_tree_add_item(Capabilities_tree, offset, 4, "%s", decode_boolean_bitfield(Capabilities, 0x0100, 32, " Lock&Read supported", " Lock&Read not supported")); - proto_tree_add_text(Capabilities_tree, offset, 4, "%s", + proto_tree_add_item(Capabilities_tree, offset, 4, "%s", decode_boolean_bitfield(Capabilities, 0x0200, 32, " NT Find supported", " NT Find not supported")); - proto_tree_add_text(Capabilities_tree, offset, 4, "%s", + proto_tree_add_item(Capabilities_tree, offset, 4, "%s", decode_boolean_bitfield(Capabilities, 0x1000, 32, " DFS supported", " DFS not supported")); - proto_tree_add_text(Capabilities_tree, offset, 4, "%s", + proto_tree_add_item(Capabilities_tree, offset, 4, "%s", decode_boolean_bitfield(Capabilities, 0x4000, 32, " Large READX supported", " Large READX not supported")); - proto_tree_add_text(Capabilities_tree, offset, 4, "%s", + proto_tree_add_item(Capabilities_tree, offset, 4, "%s", decode_boolean_bitfield(Capabilities, 0x8000, 32, " Large WRITEX supported", " Large WRITEX not supported")); - proto_tree_add_text(Capabilities_tree, offset, 4, "%s", + proto_tree_add_item(Capabilities_tree, offset, 4, "%s", decode_boolean_bitfield(Capabilities, 0x80000000, 32, " Extended Security Exchanges supported", " Extended Security Exchanges not supported")); } @@ -956,7 +960,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count: %u", ByteCount); + proto_tree_add_item(tree, offset, 2, "Byte Count: %u", ByteCount); } @@ -968,7 +972,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, strlen(ANSIPassword) + 1, "ANSI Password: %s", ANSIPassword); + proto_tree_add_item(tree, offset, strlen(ANSIPassword) + 1, "ANSI Password: %s", ANSIPassword); } @@ -982,7 +986,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, strlen(UNICODEPassword) + 1, "UNICODE Password: %s", UNICODEPassword); + proto_tree_add_item(tree, offset, strlen(UNICODEPassword) + 1, "UNICODE Password: %s", UNICODEPassword); } @@ -996,7 +1000,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, strlen(AccountName) + 1, "Account Name: %s", AccountName); + proto_tree_add_item(tree, offset, strlen(AccountName) + 1, "Account Name: %s", AccountName); } @@ -1008,7 +1012,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, strlen(PrimaryDomain) + 1, "Primary Domain: %s", PrimaryDomain); + proto_tree_add_item(tree, offset, strlen(PrimaryDomain) + 1, "Primary Domain: %s", PrimaryDomain); } @@ -1020,7 +1024,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, strlen(NativeOS) + 1, "Native OS: %s", NativeOS); + proto_tree_add_item(tree, offset, strlen(NativeOS) + 1, "Native OS: %s", NativeOS); } @@ -1032,7 +1036,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, strlen(NativeLanManType) + 1, "Native LanMan Type: %s", NativeLanManType); + proto_tree_add_item(tree, offset, strlen(NativeLanManType) + 1, "Native LanMan Type: %s", NativeLanManType); } @@ -1045,6 +1049,12 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (AndXCommand != 0xFF) { + if (tree) { + + proto_tree_add_item(tree, AndXCmdOffset, 1, "Command: %s", decode_smb_name(AndXCommand)); + + } + (dissect[AndXCommand])(pd, offset, fd, tree, max_data, dirn); } @@ -1059,7 +1069,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 1, "Word Count (WCT): %u", WordCount); + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", WordCount); } @@ -1071,7 +1081,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 1, "AndXCommand: %u", AndXCommand); + proto_tree_add_item(tree, offset, 1, "AndXCommand: %u", AndXCommand); } @@ -1083,7 +1093,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 1, "AndXReserved: %u", AndXReserved); + proto_tree_add_item(tree, offset, 1, "AndXReserved: %u", AndXReserved); } @@ -1095,7 +1105,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "AndXOffset: %u", AndXOffset); + proto_tree_add_item(tree, offset, 2, "AndXOffset: %u", AndXOffset); } @@ -1107,7 +1117,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "Action: %u", Action); + proto_tree_add_item(tree, offset, 2, "Action: %u", Action); } @@ -1119,7 +1129,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); } @@ -1131,7 +1141,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, strlen(NativeOS) + 1, "NativeOS: %s", NativeOS); + proto_tree_add_item(tree, offset, strlen(NativeOS) + 1, "NativeOS: %s", NativeOS); } @@ -1143,7 +1153,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, strlen(NativeLanMan) + 1, "NativeLanMan: %s", NativeLanMan); + proto_tree_add_item(tree, offset, strlen(NativeLanMan) + 1, "NativeLanMan: %s", NativeLanMan); } @@ -1155,7 +1165,7 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree if (tree) { - proto_tree_add_text(tree, offset, strlen(PrimaryDomain) + 1, "PrimaryDomain: %s", PrimaryDomain); + proto_tree_add_item(tree, offset, strlen(PrimaryDomain) + 1, "PrimaryDomain: %s", PrimaryDomain); } @@ -1173,6 +1183,672 @@ dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree } void +dissect_open_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int max_data, int dirn) + +{ + guint8 WordCount; + guint8 BufferFormat; + guint32 DataSize; + guint16 SearchAttributes; + guint16 LastWriteTime; + guint16 LastWriteDate; + guint16 FileAttributes; + guint16 FID; + guint16 DesiredAccess; + guint16 ByteCount; + guint16 AccessGranted; + const char *FileName; + + if (dirn == 1) { /* Request(s) dissect code */ + + /* Build display for: Desired Access (Mode) */ + + DesiredAccess = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Desired Access (Mode): %u", DesiredAccess); + + } + + offset += 2; /* Skip Desired Access (Mode) */ + + /* Build display for: Search Attributes */ + + SearchAttributes = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Search Attributes: %u", SearchAttributes); + + } + + offset += 2; /* Skip Search Attributes */ + + /* Build display for: Byte Count (BCC) */ + + ByteCount = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); + + } + + offset += 2; /* Skip Byte Count (BCC) */ + + /* Build display for: Buffer Format */ + + BufferFormat = GBYTE(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 1, "Buffer Format: %u", BufferFormat); + + } + + offset += 1; /* Skip Buffer Format */ + + /* Build display for: File Name */ + + FileName = pd + offset; + + if (tree) { + + proto_tree_add_item(tree, offset, strlen(FileName) + 1, "File Name: %s", FileName); + + } + + offset += strlen(FileName) + 1; /* Skip File Name */ + + } + + if (dirn == 0) { /* Response(s) dissect code */ + + /* Build display for: Word Count (WCT) */ + + WordCount = GBYTE(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", WordCount); + + } + + offset += 1; /* Skip Word Count (WCT) */ + + /* Build display for: FID (File Handle) */ + + FID = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "FID (File Handle): %u", FID); + + } + + offset += 2; /* Skip FID (File Handle) */ + + /* Build display for: File Attributes */ + + FileAttributes = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "File Attributes: %u", FileAttributes); + + } + + offset += 2; /* Skip File Attributes */ + + /* Build display for: Last Write Date */ + + LastWriteDate = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Last Write Date: %s", dissect_dos_date(LastWriteDate)); + + } + + offset += 2; /* Skip Last Write Date */ + + /* Build display for: Last Write Time */ + + LastWriteTime = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Last Write Time: %s", dissect_dos_time(LastWriteTime)); + + } + + offset += 2; /* Skip Last Write Time */ + + /* Build display for: Data Size */ + + DataSize = GWORD(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 4, "Data Size: %u", DataSize); + + } + + offset += 4; /* Skip Data Size */ + + /* Build display for: Access Granted */ + + AccessGranted = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Access Granted: %u", AccessGranted); + + } + + offset += 2; /* Skip Access Granted */ + + /* Build display for: Byte Count (BCC) */ + + ByteCount = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); + + } + + offset += 2; /* Skip Byte Count (BCC) */ + + } + +} + +void +dissect_open_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int max_data, int dirn) + +{ + + proto_tree *Flags_tree; + proto_tree *OpenFunction_tree; + proto_item *ti; + guint8 WordCount; + guint8 BufferFormat; + guint8 AndXReserved; + guint8 AndXCommand; + guint32 ServerFID; + guint32 Reserved2; + guint32 Reserved1; + static const value_string OpenFunction_0x10[] = { + { 0, " Fail if file does not exist"}, + { 1, " Create file if it does not exist"}, + { 2, ""}, + { 0, NULL} + }; + static const value_string OpenFunction_0x03[] = { + { 0, " Fail if file exists"}, + { 1, " Open file if it exists"}, + { 2, " Truncate File if it exists"}, + { 0, NULL} + }; + guint32 DataSize; + guint32 AllocatedSize; + guint16 SearchAttributes; + guint16 Reserved; + guint16 OpenFunction; + guint16 LastWriteTime; + guint16 LastWriteDate; + guint16 GrantedAccess; + guint16 Flags; + guint16 FileType; + guint16 FileAttributes; + guint16 FID; + guint16 DeviceState; + guint16 DesiredAccess; + guint16 CreationTime; + guint16 CreationDate; + guint16 ByteCount; + guint16 Attributed; + guint16 AndXOffset; + guint16 Action; + const char *FileName; + + if (dirn == 1) { /* Request(s) dissect code */ + + /* Build display for: Word Count (WCT) */ + + WordCount = GBYTE(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", WordCount); + + } + + offset += 1; /* Skip Word Count (WCT) */ + + /* Build display for: AndXCommand */ + + AndXCommand = GBYTE(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 1, "AndXCommand: %u", AndXCommand); + + } + + offset += 1; /* Skip AndXCommand */ + + /* Build display for: AndXReserved */ + + AndXReserved = GBYTE(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 1, "AndXReserved: %u", AndXReserved); + + } + + offset += 1; /* Skip AndXReserved */ + + /* Build display for: AndXOffset */ + + AndXOffset = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "AndXOffset: %u", AndXOffset); + + } + + offset += 2; /* Skip AndXOffset */ + + /* Build display for: Flags */ + + Flags = GSHORT(pd, offset); + + if (tree) { + + ti = proto_tree_add_item(tree, offset, 2, "Flags: 0x%02x", Flags); + Flags_tree = proto_tree_new(); + proto_item_add_subtree(ti, Flags_tree, ETT_SMB_FLAGS); + proto_tree_add_item(Flags_tree, offset, 2, "%s", + decode_boolean_bitfield(Flags, 0x01, 16, " Dont Return Additional Info", " Return Additional Info")); + proto_tree_add_item(Flags_tree, offset, 2, "%s", + decode_boolean_bitfield(Flags, 0x02, 16, " Exclusive OpLock not Requested", " Exclusive OpLock Requested")); + proto_tree_add_item(Flags_tree, offset, 2, "%s", + decode_boolean_bitfield(Flags, 0x04, 16, " Batch OpLock not Requested", " Batch OpLock Requested")); + +} + + offset += 2; /* Skip Flags */ + + /* Build display for: Desired Access */ + + DesiredAccess = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Desired Access: %u", DesiredAccess); + + } + + offset += 2; /* Skip Desired Access */ + + /* Build display for: Search Attributes */ + + SearchAttributes = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Search Attributes: %u", SearchAttributes); + + } + + offset += 2; /* Skip Search Attributes */ + + /* Build display for: File Attributes */ + + FileAttributes = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "File Attributes: %u", FileAttributes); + + } + + offset += 2; /* Skip File Attributes */ + + /* Build display for: Creation Time */ + + CreationTime = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Creation Time: %s", dissect_dos_date(CreationTime)); + + } + + offset += 2; /* Skip Creation Time */ + + /* Build display for: Creation Date */ + + CreationDate = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Creation Date: %s", dissect_dos_time(CreationDate)); + + } + + offset += 2; /* Skip Creation Date */ + + /* Build display for: Open Function */ + + OpenFunction = GSHORT(pd, offset); + + if (tree) { + + ti = proto_tree_add_item(tree, offset, 2, "Open Function: 0x%02x", OpenFunction); + OpenFunction_tree = proto_tree_new(); + proto_item_add_subtree(ti, OpenFunction_tree, ETT_SMB_OPENFUNCTION); + proto_tree_add_item(OpenFunction_tree, offset, 2, "%s", + decode_enumerated_bitfield(OpenFunction, 0x10, 16, OpenFunction_0x10, "%s")); + proto_tree_add_item(OpenFunction_tree, offset, 2, "%s", + decode_enumerated_bitfield(OpenFunction, 0x03, 16, OpenFunction_0x03, "%s")); + + } + + offset += 2; /* Skip Open Function */ + + /* Build display for: Allocated Size */ + + AllocatedSize = GWORD(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 4, "Allocated Size: %u", AllocatedSize); + + } + + offset += 4; /* Skip Allocated Size */ + + /* Build display for: Reserved1 */ + + Reserved1 = GWORD(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 4, "Reserved1: %u", Reserved1); + + } + + offset += 4; /* Skip Reserved1 */ + + /* Build display for: Reserved2 */ + + Reserved2 = GWORD(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 4, "Reserved2: %u", Reserved2); + + } + + offset += 4; /* Skip Reserved2 */ + + /* Build display for: Byte Count */ + + ByteCount = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Byte Count: %u", ByteCount); + + } + + offset += 2; /* Skip Byte Count */ + + /* Build display for: Buffer Format */ + + /* BufferFormat = GBYTE(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 1, "Buffer Format: %u", BufferFormat); + + } + + offset += 1;*/ /* Skip Buffer Format */ + + /* Build display for: File Name */ + + FileName = pd + offset; + + if (tree) { + + proto_tree_add_item(tree, offset, strlen(FileName) + 1, "File Name: %s", FileName); + + } + + offset += strlen(FileName) + 1; /* Skip File Name */ + + + if (AndXCommand != 0xFF) { + + (dissect[AndXCommand])(pd, offset, fd, tree, max_data, dirn); + + } + + } + + if (dirn == 0) { /* Response(s) dissect code */ + + /* Build display for: Word Count (WCT) */ + + WordCount = GBYTE(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", WordCount); + + } + + offset += 1; /* Skip Word Count (WCT) */ + + /* Build display for: AndXCommand */ + + AndXCommand = GBYTE(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 1, "AndXCommand: %u", AndXCommand); + + } + + offset += 1; /* Skip AndXCommand */ + + /* Build display for: AndXReserved */ + + AndXReserved = GBYTE(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 1, "AndXReserved: %u", AndXReserved); + + } + + offset += 1; /* Skip AndXReserved */ + + /* Build display for: AndXOffset */ + + AndXOffset = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "AndXOffset: %u", AndXOffset); + + } + + offset += 2; /* Skip AndXOffset */ + + /* Build display for: FID */ + + FID = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "FID: %u", FID); + + } + + offset += 2; /* Skip FID */ + + /* Build display for: Attributed */ + + Attributed = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Attributed: %u", Attributed); + + } + + offset += 2; /* Skip Attributed */ + + /* Build display for: Last Write Time */ + + LastWriteTime = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Last Write Time: %s", dissect_dos_time(LastWriteTime)); + + } + + offset += 2; /* Skip Last Write Time */ + + /* Build display for: Last Write Date */ + + LastWriteDate = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Last Write Date: %s", dissect_dos_date(LastWriteDate)); + + } + + offset += 2; /* Skip Last Write Date */ + + /* Build display for: Data Size */ + + DataSize = GWORD(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 4, "Data Size: %u", DataSize); + + } + + offset += 4; /* Skip Data Size */ + + /* Build display for: Granted Access */ + + GrantedAccess = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Granted Access: %u", GrantedAccess); + + } + + offset += 2; /* Skip Granted Access */ + + /* Build display for: File Type */ + + FileType = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "File Type: %u", FileType); + + } + + offset += 2; /* Skip File Type */ + + /* Build display for: Device State */ + + DeviceState = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Device State: %u", DeviceState); + + } + + offset += 2; /* Skip Device State */ + + /* Build display for: Action */ + + Action = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Action: %u", Action); + + } + + offset += 2; /* Skip Action */ + + /* Build display for: Server FID */ + + ServerFID = GWORD(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 4, "Server FID: %u", ServerFID); + + } + + offset += 4; /* Skip Server FID */ + + /* Build display for: Reserved */ + + Reserved = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Reserved: %u", Reserved); + + } + + offset += 2; /* Skip Reserved */ + + /* Build display for: Byte Count */ + + ByteCount = GSHORT(pd, offset); + + if (tree) { + + proto_tree_add_item(tree, offset, 2, "Byte Count: %u", ByteCount); + + } + + offset += 2; /* Skip Byte Count */ + + + if (AndXCommand != 0xFF) { + + (dissect[AndXCommand])(pd, offset, fd, tree, max_data, dirn); + + } + + } + +} + +void dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int max_data, int dirn) { @@ -1193,9 +1869,9 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 1, "Invalid TCON_ANDX format. WCT should be 2, 3, or 4 ..., not %u", wct); + proto_tree_add_item(tree, offset, 1, "Invalid TCON_ANDX format. WCT should be 2, 3, or 4 ..., not %u", wct); - proto_tree_add_text(tree, offset, END_OF_FRAME, "Data"); + proto_tree_add_item(tree, offset, END_OF_FRAME, "Data"); return; @@ -1205,7 +1881,7 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 1, "Word Count (WCT): %u", wct); + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", wct); } @@ -1215,11 +1891,11 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 1, "Next Command: %s", + proto_tree_add_item(tree, offset, 1, "Next Command: %s", (andxcmd == 0xFF) ? "No further commands": decode_smb_name(andxcmd)); - proto_tree_add_text(tree, offset + 1, 1, "Reserved (MBZ): %u", pd[offset+1]); + proto_tree_add_item(tree, offset + 1, 1, "Reserved (MBZ): %u", pd[offset+1]); } @@ -1229,7 +1905,7 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 2, "Offset to next command: %u", andxoffs); + proto_tree_add_item(tree, offset, 2, "Offset to next command: %u", andxoffs); } @@ -1243,9 +1919,10 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - ti = proto_tree_add_text(tree, offset, 2, "Additional Flags: 0x%02x", flags); - flags_tree = proto_item_add_subtree(ti, ETT_SMB_AFLAGS); - proto_tree_add_text(flags_tree, offset, 2, "%s", + ti = proto_tree_add_item(tree, offset, 2, "Additional Flags: 0x%02x", flags); + flags_tree = proto_tree_new(); + proto_item_add_subtree(ti, flags_tree, ETT_SMB_AFLAGS); + proto_tree_add_item(flags_tree, offset, 2, "%s", decode_boolean_bitfield(flags, 0x01, 16, "Disconnect TID", "Don't disconnect TID")); @@ -1258,7 +1935,7 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 2, "Password Length: %u", passwdlen); + proto_tree_add_item(tree, offset, 2, "Password Length: %u", passwdlen); } @@ -1268,7 +1945,7 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", bcc); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", bcc); } @@ -1278,7 +1955,7 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, strlen(str) + 1, "Password: %s", str); + proto_tree_add_item(tree, offset, strlen(str) + 1, "Password: %s", str); } @@ -1288,7 +1965,7 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, strlen(str) + 1, "Path: %s", str); + proto_tree_add_item(tree, offset, strlen(str) + 1, "Path: %s", str); } @@ -1298,7 +1975,7 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, strlen(str) + 1, "Service: %s", str); + proto_tree_add_item(tree, offset, strlen(str) + 1, "Service: %s", str); } @@ -1312,7 +1989,7 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", bcc); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", bcc); } @@ -1322,7 +1999,7 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, strlen(str) + 1, "Service Type: %s", + proto_tree_add_item(tree, offset, strlen(str) + 1, "Service Type: %s", str); } @@ -1337,7 +2014,7 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { /* Should break out the bits */ - proto_tree_add_text(tree, offset, 2, "Optional Support: 0x%04x", + proto_tree_add_item(tree, offset, 2, "Optional Support: 0x%04x", optionsup); } @@ -1348,7 +2025,7 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", bcc); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", bcc); } @@ -1358,7 +2035,7 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, strlen(str) + 1, "Service: %s", str); + proto_tree_add_item(tree, offset, strlen(str) + 1, "Service: %s", str); } @@ -1368,7 +2045,7 @@ dissect_tcon_andx_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, strlen(str) + 1, "Native File System: %s", str); + proto_tree_add_item(tree, offset, strlen(str) + 1, "Native File System: %s", str); } @@ -1405,9 +2082,9 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr !((wct == 13) && (dirn == 0)) && !((wct == 17) && (dirn == 0))) { if (tree) { - proto_tree_add_text(tree, offset, 1, "Invalid Negotiate Protocol format. WCT should be zero or 1 or 13 or 17 ..., not %u", wct); + proto_tree_add_item(tree, offset, 1, "Invalid Negotiate Protocol format. WCT should be zero or 1 or 13 or 17 ..., not %u", wct); - proto_tree_add_text(tree, offset, END_OF_FRAME, "Data"); + proto_tree_add_item(tree, offset, END_OF_FRAME, "Data"); return; } @@ -1415,7 +2092,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 1, "Word Count (WCT): %d", wct); + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %d", wct); } @@ -1431,7 +2108,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", bcc); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", bcc); } @@ -1439,8 +2116,9 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - ti = proto_tree_add_text(tree, offset, END_OF_FRAME, "Dialects"); - dialects = proto_item_add_subtree(ti, ETT_SMB_DIALECTS); + ti = proto_tree_add_item(tree, offset, END_OF_FRAME, "Dialects"); + dialects = proto_tree_new(); + proto_item_add_subtree(ti, dialects, ETT_SMB_DIALECTS); } @@ -1449,7 +2127,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(dialects, offset, 1, "Dialect Marker: %d", pd[offset]); + proto_tree_add_item(dialects, offset, 1, "Dialect Marker: %d", pd[offset]); } @@ -1459,7 +2137,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(dialects, offset, strlen(str)+1, "Dialect: %s", str); + proto_tree_add_item(dialects, offset, strlen(str)+1, "Dialect: %s", str); } @@ -1476,12 +2154,12 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (dialect == 0xFFFF) { /* Server didn't like them dialects */ - proto_tree_add_text(tree, offset, 2, "Supplied dialects not recognized"); + proto_tree_add_item(tree, offset, 2, "Supplied dialects not recognized"); } else { - proto_tree_add_text(tree, offset, 2, "Dialect Index: %u, PC NETWORK PROTGRAM 1.0", dialect); + proto_tree_add_item(tree, offset, 2, "Dialect Index: %u, PC NETWORK PROTGRAM 1.0", dialect); } @@ -1493,7 +2171,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", bcc); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", bcc); } @@ -1503,7 +2181,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Dialect Index: %u, Greater than CORE PROTOCOL and up to LANMAN2.1", GSHORT(pd, offset)); + proto_tree_add_item(tree, offset, 2, "Dialect Index: %u, Greater than CORE PROTOCOL and up to LANMAN2.1", GSHORT(pd, offset)); } @@ -1515,13 +2193,14 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - ti = proto_tree_add_text(tree, offset, 2, "Security Mode: 0x%04x", mode); - mode_tree = proto_item_add_subtree(ti, ETT_SMB_MODE); - proto_tree_add_text(mode_tree, offset, 2, "%s", + ti = proto_tree_add_item(tree, offset, 2, "Security Mode: 0x%04x", mode); + mode_tree = proto_tree_new(); + proto_item_add_subtree(ti, mode_tree, ETT_SMB_MODE); + proto_tree_add_item(mode_tree, offset, 2, "%s", decode_boolean_bitfield(mode, 0x0001, 16, "Security = User", "Security = Share")); - proto_tree_add_text(mode_tree, offset, 2, "%s", + proto_tree_add_item(mode_tree, offset, 2, "%s", decode_boolean_bitfield(mode, 0x0002, 16, "Passwords = Encrypted", "Passwords = Plaintext")); @@ -1532,7 +2211,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Max buffer size: %u", GSHORT(pd, offset)); + proto_tree_add_item(tree, offset, 2, "Max buffer size: %u", GSHORT(pd, offset)); } @@ -1540,7 +2219,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Max multiplex count: %u", GSHORT(pd, offset)); + proto_tree_add_item(tree, offset, 2, "Max multiplex count: %u", GSHORT(pd, offset)); } @@ -1548,7 +2227,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Max vcs: %u", GSHORT(pd, offset)); + proto_tree_add_item(tree, offset, 2, "Max vcs: %u", GSHORT(pd, offset)); } @@ -1558,13 +2237,14 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - ti = proto_tree_add_text(tree, offset, 2, "Raw Mode: 0x%04x", rawmode); - rawmode_tree = proto_item_add_subtree(ti, ETT_SMB_RAWMODE); - proto_tree_add_text(rawmode_tree, offset, 2, "%s", + ti = proto_tree_add_item(tree, offset, 2, "Raw Mode: 0x%04x", rawmode); + rawmode_tree = proto_tree_new(); + proto_item_add_subtree(ti, rawmode_tree, ETT_SMB_RAWMODE); + proto_tree_add_item(rawmode_tree, offset, 2, "%s", decode_boolean_bitfield(rawmode, 0x01, 16, "Read Raw supported", "Read Raw not supported")); - proto_tree_add_text(rawmode_tree, offset, 2, "%s", + proto_tree_add_item(rawmode_tree, offset, 2, "%s", decode_boolean_bitfield(rawmode, 0x02, 16, "Write Raw supported", "Write Raw not supported")); @@ -1575,7 +2255,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 4, "Session key: %08x", GWORD(pd, offset)); + proto_tree_add_item(tree, offset, 4, "Session key: %08x", GWORD(pd, offset)); } @@ -1585,9 +2265,9 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Server Time: %s", + proto_tree_add_item(tree, offset, 2, "Server Time: %s", dissect_dos_time(GSHORT(pd, offset))); - proto_tree_add_text(tree, offset + 2, 2, "Server Date: %s", + proto_tree_add_item(tree, offset + 2, 2, "Server Date: %s", dissect_dos_date(GSHORT(pd, offset + 2))); } @@ -1598,7 +2278,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Server time zone: %i min from UTC", + proto_tree_add_item(tree, offset, 2, "Server time zone: %i min from UTC", (signed)GSSHORT(pd, offset)); } @@ -1611,7 +2291,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Challenge Length: %u", enckeylen); + proto_tree_add_item(tree, offset, 2, "Challenge Length: %u", enckeylen); } @@ -1619,7 +2299,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Reserved: %u (MBZ)", GSHORT(pd, offset)); + proto_tree_add_item(tree, offset, 2, "Reserved: %u (MBZ)", GSHORT(pd, offset)); } @@ -1629,7 +2309,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", bcc); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", bcc); } @@ -1641,7 +2321,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, enckeylen, "Challenge: %s", + proto_tree_add_item(tree, offset, enckeylen, "Challenge: %s", bytes_to_str(str, enckeylen)); } @@ -1655,7 +2335,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, strlen(str)+1, "Primary Domain: %s", str); + proto_tree_add_item(tree, offset, strlen(str)+1, "Primary Domain: %s", str); } @@ -1665,7 +2345,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Dialect Index: %u, Greater than LANMAN2.1", GSHORT(pd, offset)); + proto_tree_add_item(tree, offset, 2, "Dialect Index: %u, Greater than LANMAN2.1", GSHORT(pd, offset)); } @@ -1675,21 +2355,22 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - ti = proto_tree_add_text(tree, offset, 1, "Security Mode: 0x%02x", mode); - mode_tree = proto_item_add_subtree(ti, ETT_SMB_MODE); - proto_tree_add_text(mode_tree, offset, 1, "%s", + ti = proto_tree_add_item(tree, offset, 1, "Security Mode: 0x%02x", mode); + mode_tree = proto_tree_new(); + proto_item_add_subtree(ti, mode_tree, ETT_SMB_MODE); + proto_tree_add_item(mode_tree, offset, 1, "%s", decode_boolean_bitfield(mode, 0x01, 8, "Security = User", "Security = Share")); - proto_tree_add_text(mode_tree, offset, 1, "%s", + proto_tree_add_item(mode_tree, offset, 1, "%s", decode_boolean_bitfield(mode, 0x02, 8, "Passwords = Encrypted", "Passwords = Plaintext")); - proto_tree_add_text(mode_tree, offset, 1, "%s", + proto_tree_add_item(mode_tree, offset, 1, "%s", decode_boolean_bitfield(mode, 0x04, 8, "Security signatures enabled", "Security signatures not enabled")); - proto_tree_add_text(mode_tree, offset, 1, "%s", + proto_tree_add_item(mode_tree, offset, 1, "%s", decode_boolean_bitfield(mode, 0x08, 8, "Security signatures required", "Security signatures not required")); @@ -1700,7 +2381,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Max multiplex count: %u", GSHORT(pd, offset)); + proto_tree_add_item(tree, offset, 2, "Max multiplex count: %u", GSHORT(pd, offset)); } @@ -1708,7 +2389,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Max vcs: %u", GSHORT(pd, offset)); + proto_tree_add_item(tree, offset, 2, "Max vcs: %u", GSHORT(pd, offset)); } @@ -1716,7 +2397,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Max buffer size: %u", GWORD(pd, offset)); + proto_tree_add_item(tree, offset, 2, "Max buffer size: %u", GWORD(pd, offset)); } @@ -1724,7 +2405,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 4, "Max raw size: %u", GWORD(pd, offset)); + proto_tree_add_item(tree, offset, 4, "Max raw size: %u", GWORD(pd, offset)); } @@ -1732,7 +2413,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 4, "Session key: %08x", GWORD(pd, offset)); + proto_tree_add_item(tree, offset, 4, "Session key: %08x", GWORD(pd, offset)); } @@ -1742,61 +2423,62 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - ti = proto_tree_add_text(tree, offset, 4, "Capabilities: 0x%04x", caps); - caps_tree = proto_item_add_subtree(ti, ETT_SMB_CAPABILITIES); - proto_tree_add_text(caps_tree, offset, 4, "%s", + ti = proto_tree_add_item(tree, offset, 4, "Capabilities: 0x%04x", caps); + caps_tree = proto_tree_new(); + proto_item_add_subtree(ti, caps_tree, ETT_SMB_CAPS); + proto_tree_add_item(caps_tree, offset, 4, "%s", decode_boolean_bitfield(caps, 0x0001, 32, "Raw Mode supported", "Raw Mode not supported")); - proto_tree_add_text(caps_tree, offset, 4, "%s", + proto_tree_add_item(caps_tree, offset, 4, "%s", decode_boolean_bitfield(caps, 0x0002, 32, "MPX Mode supported", "MPX Mode not supported")); - proto_tree_add_text(caps_tree, offset, 4, "%s", + proto_tree_add_item(caps_tree, offset, 4, "%s", decode_boolean_bitfield(caps, 0x0004, 32, "Unicode supported", "Unicode not supported")); - proto_tree_add_text(caps_tree, offset, 4, "%s", + proto_tree_add_item(caps_tree, offset, 4, "%s", decode_boolean_bitfield(caps, 0x0008, 32, "Large files supported", "Large files not supported")); - proto_tree_add_text(caps_tree, offset, 4, "%s", + proto_tree_add_item(caps_tree, offset, 4, "%s", decode_boolean_bitfield(caps, 0x0010, 32, "NT LM 0.12 SMBs supported", "NT LM 0.12 SMBs not supported")); - proto_tree_add_text(caps_tree, offset, 4, "%s", + proto_tree_add_item(caps_tree, offset, 4, "%s", decode_boolean_bitfield(caps, 0x0020, 32, "RPC remote APIs supported", "RPC remote APIs not supported")); - proto_tree_add_text(caps_tree, offset, 4, "%s", + proto_tree_add_item(caps_tree, offset, 4, "%s", decode_boolean_bitfield(caps, 0x0040, 32, "NT status codes supported", "NT status codes not supported")); - proto_tree_add_text(caps_tree, offset, 4, "%s", + proto_tree_add_item(caps_tree, offset, 4, "%s", decode_boolean_bitfield(caps, 0x0080, 32, "Level 2 OpLocks supported", "Level 2 OpLocks not supported")); - proto_tree_add_text(caps_tree, offset, 4, "%s", + proto_tree_add_item(caps_tree, offset, 4, "%s", decode_boolean_bitfield(caps, 0x0100, 32, "Lock&Read supported", "Lock&Read not supported")); - proto_tree_add_text(caps_tree, offset, 4, "%s", + proto_tree_add_item(caps_tree, offset, 4, "%s", decode_boolean_bitfield(caps, 0x0200, 32, "NT Find supported", "NT Find not supported")); - proto_tree_add_text(caps_tree, offset, 4, "%s", + proto_tree_add_item(caps_tree, offset, 4, "%s", decode_boolean_bitfield(caps, 0x1000, 32, "DFS supported", "DFS not supported")); - proto_tree_add_text(caps_tree, offset, 4, "%s", + proto_tree_add_item(caps_tree, offset, 4, "%s", decode_boolean_bitfield(caps, 0x4000, 32, "Large READX supported", "Large READX not supported")); - proto_tree_add_text(caps_tree, offset, 4, "%s", + proto_tree_add_item(caps_tree, offset, 4, "%s", decode_boolean_bitfield(caps, 0x8000, 32, "Large WRITEX supported", "Large WRITEX not supported")); - proto_tree_add_text(caps_tree, offset, 4, "%s", + proto_tree_add_item(caps_tree, offset, 4, "%s", decode_boolean_bitfield(caps, 0x80000000, 32, "Extended security exchanges supported", "Extended security exchanges not supported")); @@ -1808,8 +2490,8 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 4, "System Time Low: 0x%08x", GWORD(pd, offset)); - proto_tree_add_text(tree, offset + 4, 4, "System Time High: 0x%08x", GWORD(pd, offset + 4)); + proto_tree_add_item(tree, offset, 4, "System Time Low: 0x%08x", GWORD(pd, offset)); + proto_tree_add_item(tree, offset + 4, 4, "System Time High: 0x%08x", GWORD(pd, offset + 4)); } @@ -1819,7 +2501,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Server time zone: %i min from UTC", + proto_tree_add_item(tree, offset, 2, "Server time zone: %i min from UTC", (signed)GSSHORT(pd, offset)); } @@ -1832,7 +2514,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 1, "Encryption key len: %u", enckeylen); + proto_tree_add_item(tree, offset, 1, "Encryption key len: %u", enckeylen); } @@ -1842,7 +2524,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte count (BCC): %u", bcc); + proto_tree_add_item(tree, offset, 2, "Byte count (BCC): %u", bcc); } @@ -1856,7 +2538,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (tree) { - proto_tree_add_text(tree, offset, enckeylen, "Challenge encryption key: %s", + proto_tree_add_item(tree, offset, enckeylen, "Challenge encryption key: %s", bytes_to_str(str, enckeylen)); } @@ -1875,9 +2557,9 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr if (caps & 0x0004) { ustr = unicode_to_str(str, &ustr_len); - proto_tree_add_text(tree, offset, ustr_len+2, "OEM domain name: %s", ustr); + proto_tree_add_item(tree, offset, ustr_len+2, "OEM domain name: %s", ustr); } else { - proto_tree_add_text(tree, offset, strlen(str)+1, "OEM domain name: %s", str); + proto_tree_add_item(tree, offset, strlen(str)+1, "OEM domain name: %s", str); } } @@ -1887,7 +2569,7 @@ dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tr default: /* Baddd */ if (tree) - proto_tree_add_text(tree, offset, 1, "Bad format, should never get here"); + proto_tree_add_item(tree, offset, 1, "Bad format, should never get here"); return; } @@ -1911,7 +2593,7 @@ dissect_deletedir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 1, "Word Count (WCT): %u", WordCount); + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", WordCount); } @@ -1923,7 +2605,7 @@ dissect_deletedir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); } @@ -1935,7 +2617,7 @@ dissect_deletedir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 1, "Buffer Format: %u", BufferFormat); + proto_tree_add_item(tree, offset, 1, "Buffer Format: %u", BufferFormat); } @@ -1947,7 +2629,7 @@ dissect_deletedir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, strlen(DirectoryName) + 1, "Directory Name: %s", DirectoryName); + proto_tree_add_item(tree, offset, strlen(DirectoryName) + 1, "Directory Name: %s", DirectoryName); } @@ -1963,7 +2645,7 @@ dissect_deletedir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 1, "Word Count (WCT): %u", WordCount); + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", WordCount); } @@ -1975,7 +2657,7 @@ dissect_deletedir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); } @@ -2002,7 +2684,7 @@ dissect_createdir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 1, "Word Count (WCT): %u", WordCount); + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", WordCount); } @@ -2014,7 +2696,7 @@ dissect_createdir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); } @@ -2026,7 +2708,7 @@ dissect_createdir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 1, "Buffer Format: %u", BufferFormat); + proto_tree_add_item(tree, offset, 1, "Buffer Format: %u", BufferFormat); } @@ -2038,7 +2720,7 @@ dissect_createdir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, strlen(DirectoryName) + 1, "Directory Name: %s", DirectoryName); + proto_tree_add_item(tree, offset, strlen(DirectoryName) + 1, "Directory Name: %s", DirectoryName); } @@ -2054,7 +2736,7 @@ dissect_createdir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 1, "Word Count (WCT): %u", WordCount); + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", WordCount); } @@ -2066,7 +2748,7 @@ dissect_createdir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree * if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); } @@ -2093,7 +2775,7 @@ dissect_checkdir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *t if (tree) { - proto_tree_add_text(tree, offset, 1, "Word Count (WCT): %u", WordCount); + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", WordCount); } @@ -2105,7 +2787,7 @@ dissect_checkdir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *t if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); } @@ -2117,7 +2799,7 @@ dissect_checkdir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *t if (tree) { - proto_tree_add_text(tree, offset, 1, "Buffer Format: %u", BufferFormat); + proto_tree_add_item(tree, offset, 1, "Buffer Format: %u", BufferFormat); } @@ -2129,7 +2811,7 @@ dissect_checkdir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *t if (tree) { - proto_tree_add_text(tree, offset, strlen(DirectoryName) + 1, "Directory Name: %s", DirectoryName); + proto_tree_add_item(tree, offset, strlen(DirectoryName) + 1, "Directory Name: %s", DirectoryName); } @@ -2145,7 +2827,7 @@ dissect_checkdir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *t if (tree) { - proto_tree_add_text(tree, offset, 1, "Word Count (WCT): %u", WordCount); + proto_tree_add_item(tree, offset, 1, "Word Count (WCT): %u", WordCount); } @@ -2157,7 +2839,7 @@ dissect_checkdir_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *t if (tree) { - proto_tree_add_text(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); + proto_tree_add_item(tree, offset, 2, "Byte Count (BCC): %u", ByteCount); } @@ -2214,7 +2896,7 @@ void (*dissect[256])(const u_char *, int, frame_data *, proto_tree *, int, int) dissect_unknown_smb, /* SMBmove move */ dissect_unknown_smb, /* SMBecho echo */ dissect_unknown_smb, /* SMBwriteclose write a file and then close it */ - dissect_unknown_smb, /* SMBopenX open and X */ + dissect_open_andx_smb, /* SMBopenX open and X */ dissect_unknown_smb, /* SMBreadX read and X */ dissect_unknown_smb, /* SMBwriteX write and X */ dissect_unknown_smb, /* unknown SMB 0x30 */ @@ -2602,16 +3284,17 @@ dissect_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int if (tree) { - ti = proto_tree_add_text(tree, offset, END_OF_FRAME, + ti = proto_tree_add_item(tree, offset, END_OF_FRAME, "Server Message Block Protocol"); - smb_tree = proto_item_add_subtree(ti, ETT_SMB); + smb_tree = proto_tree_new(); + proto_item_add_subtree(ti, smb_tree, ETT_SMB); /* 0xFFSMB is actually a 1 byte msg type and 3 byte server * component ... SMB is only one used */ - proto_tree_add_text(smb_tree, offset, 1, "Message Type: 0xFF"); - proto_tree_add_text(smb_tree, offset+1, 3, "Server Component: SMB"); + proto_tree_add_item(smb_tree, offset, 1, "Message Type: 0xFF"); + proto_tree_add_item(smb_tree, offset+1, 3, "Server Component: SMB"); } @@ -2619,7 +3302,7 @@ dissect_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int if (tree) { - proto_tree_add_text(smb_tree, offset, 1, "Command: %s", decode_smb_name(cmd)); + proto_tree_add_item(smb_tree, offset, 1, "Command: %s", decode_smb_name(cmd)); } @@ -2631,7 +3314,7 @@ dissect_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int if (tree) { - proto_tree_add_text(smb_tree, offset, 1, "Error Class: %s", + proto_tree_add_item(smb_tree, offset, 1, "Error Class: %s", val_to_str((guint8)pd[offset], errcls_types, "Unknown Error Class (%x)")); } @@ -2643,7 +3326,7 @@ dissect_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int if (tree) { - proto_tree_add_text(smb_tree, offset, 1, "Reserved: %i", errcode1); + proto_tree_add_item(smb_tree, offset, 1, "Reserved: %i", errcode1); } @@ -2653,7 +3336,7 @@ dissect_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int if (tree) { - proto_tree_add_text(smb_tree, offset, 2, "Error Code: %s", + proto_tree_add_item(smb_tree, offset, 2, "Error Code: %s", decode_smb_error(errcls, errcode)); } @@ -2666,35 +3349,36 @@ dissect_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int if (tree) { - tf = proto_tree_add_text(smb_tree, offset, 1, "Flags: 0x%02x", flags); + tf = proto_tree_add_item(smb_tree, offset, 1, "Flags: 0x%02x", flags); - flags_tree = proto_item_add_subtree(tf, ETT_SMB_FLAGS); - proto_tree_add_text(flags_tree, offset, 1, "%s", + flags_tree = proto_tree_new(); + proto_item_add_subtree(tf, flags_tree, ETT_SMB_FLAGS); + proto_tree_add_item(flags_tree, offset, 1, "%s", decode_boolean_bitfield(flags, 0x01, 8, "Lock&Read, Write&Unlock supported", "Lock&Read, Write&Unlock not supported")); - proto_tree_add_text(flags_tree, offset, 1, "%s", + proto_tree_add_item(flags_tree, offset, 1, "%s", decode_boolean_bitfield(flags, 0x02, 8, "Receive buffer posted", "Receive buffer not posted")); - proto_tree_add_text(flags_tree, offset, 1, "%s", + proto_tree_add_item(flags_tree, offset, 1, "%s", decode_boolean_bitfield(flags, 0x08, 8, "Path names caseless", "Path names case sensitive")); - proto_tree_add_text(flags_tree, offset, 1, "%s", + proto_tree_add_item(flags_tree, offset, 1, "%s", decode_boolean_bitfield(flags, 0x10, 8, "Pathnames canonicalized", "Pathnames not canonicalized")); - proto_tree_add_text(flags_tree, offset, 1, "%s", + proto_tree_add_item(flags_tree, offset, 1, "%s", decode_boolean_bitfield(flags, 0x20, 8, "OpLocks requested/granted", "OpLocks not requested/granted")); - proto_tree_add_text(flags_tree, offset, 1, "%s", + proto_tree_add_item(flags_tree, offset, 1, "%s", decode_boolean_bitfield(flags, 0x40, 8, "Notify all", "Notify open only")); - proto_tree_add_text(flags_tree, offset, 1, "%s", + proto_tree_add_item(flags_tree, offset, 1, "%s", decode_boolean_bitfield(flags, SMB_FLAGS_DIRN, 8, "Response to client/redirector", "Request to server")); @@ -2706,38 +3390,39 @@ dissect_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int if (tree) { - tf = proto_tree_add_text(smb_tree, offset, 1, "Flags2: 0x%04x", flags2); + tf = proto_tree_add_item(smb_tree, offset, 1, "Flags2: 0x%04x", flags2); - flags2_tree = proto_item_add_subtree(tf, ETT_SMB_FLAGS2); - proto_tree_add_text(flags2_tree, offset, 1, "%s", + flags2_tree = proto_tree_new(); + proto_item_add_subtree(tf, flags2_tree, ETT_SMB_FLAGS2); + proto_tree_add_item(flags2_tree, offset, 1, "%s", decode_boolean_bitfield(flags2, 0x0001, 16, "Long file names supported", "Long file names not supported")); - proto_tree_add_text(flags2_tree, offset, 1, "%s", + proto_tree_add_item(flags2_tree, offset, 1, "%s", decode_boolean_bitfield(flags2, 0x0002, 16, "Extended attributes supported", "Extended attributes not supported")); - proto_tree_add_text(flags2_tree, offset, 1, "%s", + proto_tree_add_item(flags2_tree, offset, 1, "%s", decode_boolean_bitfield(flags2, 0x0004, 16, "Security signatures supported", "Security signatures not supported")); - proto_tree_add_text(flags2_tree, offset, 1, "%s", + proto_tree_add_item(flags2_tree, offset, 1, "%s", decode_boolean_bitfield(flags2, 0x0800, 16, "Extended security negotiation supported", "Extended security negotiation not supported")); - proto_tree_add_text(flags2_tree, offset, 1, "%s", + proto_tree_add_item(flags2_tree, offset, 1, "%s", decode_boolean_bitfield(flags2, 0x1000, 16, "Resolve pathnames with DFS", "Don't resolve pathnames with DFS")); - proto_tree_add_text(flags2_tree, offset, 1, "%s", + proto_tree_add_item(flags2_tree, offset, 1, "%s", decode_boolean_bitfield(flags2, 0x2000, 16, "Permit reads if execute-only", "Don't permit reads if execute-only")); - proto_tree_add_text(flags2_tree, offset, 1, "%s", + proto_tree_add_item(flags2_tree, offset, 1, "%s", decode_boolean_bitfield(flags2, 0x4000, 16, "Error codes are NT error codes", "Error codes are DOS error codes")); - proto_tree_add_text(flags2_tree, offset, 1, "%s", + proto_tree_add_item(flags2_tree, offset, 1, "%s", decode_boolean_bitfield(flags2, 0x8000, 16, "Strings are Unicode", "Strings are ASCII")); @@ -2748,7 +3433,7 @@ dissect_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int if (tree) { - proto_tree_add_text(smb_tree, offset, 12, "Reserved: 6 WORDS"); + proto_tree_add_item(smb_tree, offset, 12, "Reserved: 6 WORDS"); } @@ -2760,7 +3445,7 @@ dissect_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int if (tree) { - proto_tree_add_text(smb_tree, offset, 2, "Network Path/Tree ID (TID): %i (%04x)", tid, tid); + proto_tree_add_item(smb_tree, offset, 2, "Network Path/Tree ID (TID): %i (%04x)", tid, tid); } @@ -2772,7 +3457,7 @@ dissect_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int if (tree) { - proto_tree_add_text(smb_tree, offset, 2, "Process ID (PID): %i (%04x)", pid, pid); + proto_tree_add_item(smb_tree, offset, 2, "Process ID (PID): %i (%04x)", pid, pid); } @@ -2784,7 +3469,7 @@ dissect_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int if (tree) { - proto_tree_add_text(smb_tree, offset, 2, "User ID (UID): %i (%04x)", uid, uid); + proto_tree_add_item(smb_tree, offset, 2, "User ID (UID): %i (%04x)", uid, uid); } @@ -2796,7 +3481,7 @@ dissect_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int if (tree) { - proto_tree_add_text(smb_tree, offset, 2, "Multiplex ID (MID): %i (%04x)", mid, mid); + proto_tree_add_item(smb_tree, offset, 2, "Multiplex ID (MID): %i (%04x)", mid, mid); } @@ -1,7 +1,7 @@ /* packet.h * Definitions for packet disassembly structures and routines * - * $Id: packet.h,v 1.67 1999/07/08 20:31:42 guy Exp $ + * $Id: packet.h,v 1.68 1999/07/10 14:01:53 sharpe Exp $ * * Ethereal - Network traffic analyzer * By Gerald Combs <gerald@zing.org> @@ -27,10 +27,6 @@ #ifndef __PACKET_H__ #define __PACKET_H__ -#ifndef __PROTO_H__ -#include "proto.h" -#endif - /* Pointer versions of ntohs and ntohl. Given a pointer to a member of a * byte array, returns the value of the two or four bytes at the pointer. * The pletoh[sl] versions return the little-endian representation. @@ -69,25 +65,17 @@ #endif #endif -/* Useful when you have an array whose size you can tell at compile-time */ -#define array_length(x) (sizeof x / sizeof x[0]) - - /* Useful when highlighting regions inside a dissect_*() function. With this * macro, you can highlight from an arbitrary offset to the end of the * frame. See dissect_data() for an example. */ #define END_OF_FRAME (fd->cap_len - offset) - -/* To pass one of two strings, singular or plural */ -#define plurality(d,s,p) ((d) == 1 ? (s) : (p)) + typedef struct _column_info { gint num_cols; /* Number of columns */ - gchar **col_title;/* Column title */ gboolean **fmt_matx; /* Specifies which formats apply to a column */ gchar **col_data; /* Column data */ - gint *col_width; /* Column width */ } column_info; #define COL_MAX_LEN 256 @@ -96,7 +84,6 @@ typedef struct _packet_counts { gint tcp; gint udp; gint ospf; - gint gre; gint other; gint total; } packet_counts; @@ -112,8 +99,9 @@ typedef struct _frame_data { guint32 del_usecs; /* Delta microseconds */ long file_off; /* File offset */ column_info *cinfo; /* Column formatting information */ - int lnk_t; /* Per-packet encapsulation/data-link type */ - gboolean passed_dfilter; /* TRUE = display, FALSE = no display */ +#ifdef WITH_WIRETAP + int lnk_t; /* Per-packet encapsulation/data-link type */ +#endif } frame_data; typedef struct _packet_info { @@ -149,14 +137,11 @@ typedef struct tcp_extra_data { add_subtree() call. */ enum { - ETT_NONE, ETT_FRAME, ETT_IEEE8023, ETT_ETHER2, ETT_LLC, ETT_TOKEN_RING, - ETT_TOKEN_RING_AC, - ETT_TOKEN_RING_FC, ETT_TR_IERR_CNT, ETT_TR_NERR_CNT, ETT_TR_MAC, @@ -181,17 +166,12 @@ enum { ETT_IPX, ETT_SPX, ETT_NCP, - ETT_NCP_REQUEST_FIELDS, - ETT_NCP_REPLY_FIELDS, ETT_DNS, ETT_DNS_FLAGS, ETT_DNS_QRY, ETT_DNS_QD, ETT_DNS_ANS, ETT_DNS_RR, - ETT_ISAKMP, - ETT_ISAKMP_FLAGS, - ETT_ISAKMP_PAYLOAD, ETT_RIP, ETT_RIP_VEC, ETT_OSPF, @@ -243,50 +223,15 @@ enum { ETT_TELNET, ETT_TELNET_SUBOPT, ETT_NNTP, - ETT_SNMP, ETT_NBSS, ETT_NBSS_FLAGS, ETT_SMB, ETT_SMB_FLAGS, - ETT_SMB_FLAGS2, ETT_SMB_DIALECTS, ETT_SMB_MODE, - ETT_SMB_CAPABILITIES, + ETT_SMB_CAPS, ETT_SMB_RAWMODE, ETT_SMB_AFLAGS, - ETT_PPTP, - ETT_GRE, - ETT_GRE_FLAGS, - ETT_PPPOED, - ETT_PPPOED_TAGS, - ETT_PPPOES, - ETT_LCP, - ETT_IPCP, - ETT_RSVP, - ETT_RSVP_UNKNOWN_CLASS, - ETT_RSVP_HDR, - ETT_RSVP_SESSION, - ETT_RSVP_SGROUP, - ETT_RSVP_HOP, - ETT_RSVP_INTEGRITY, - ETT_RSVP_TIME_VALUES, - ETT_RSVP_ERROR, - ETT_RSVP_SCOPE, - ETT_RSVP_STYLE, - ETT_RSVP_FLOWSPEC, - ETT_RSVP_FILTER_SPEC, - ETT_RSVP_SENDER_TEMPLATE, - ETT_RSVP_SENDER_TSPEC, - ETT_RSVP_ADSPEC, - ETT_RSVP_POLICY, - ETT_RSVP_CONFIRM, - ETT_RSVP_ADSPEC_SUBTREE1, - ETT_RSVP_ADSPEC_SUBTREE2, - ETT_RSVP_ADSPEC_SUBTREE3, - ETT_RTSP, - ETT_SDP, - ETT_RADIUS, - ETT_RADIUS_AVP, NUM_TREE_TYPES /* last item number plus one */ }; @@ -310,9 +255,7 @@ enum { /* Utility routines used by packet*.c */ gchar* ether_to_str(const guint8 *); gchar* ip_to_str(const guint8 *); -gchar* abs_time_to_str(struct timeval*); gchar* time_secs_to_str(guint32); -gchar* bytes_to_str(const guint8 *, int); const u_char *find_line_end(const u_char *data, const u_char *dataend, const u_char **eol); int get_token_len(const u_char *linep, const u_char *lineend, @@ -327,7 +270,6 @@ const char *decode_enumerated_bitfield(guint32 val, guint32 mask, int width, const char *decode_numeric_bitfield(guint32 val, guint32 mask, int width, const char *fmt); gint check_col(frame_data *, gint); -void col_add_cls_time(frame_data *); #if __GNUC__ == 2 void col_add_fstr(frame_data *, gint, gchar *, ...) __attribute__((format (printf, 3, 4))); @@ -337,9 +279,28 @@ void col_append_fstr(frame_data *, gint, gchar *, ...) void col_add_fstr(frame_data *, gint, gchar *, ...); void col_append_fstr(frame_data *, gint, gchar *, ...); #endif -void col_add_str(frame_data *, gint, const gchar *); +void col_add_str(frame_data *, gint, gchar *); void col_append_str(frame_data *, gint, gchar *); +/* Routines in packet.c */ + +typedef struct GtkWidget proto_tree; +typedef struct GtkWidget proto_item; + +struct GtkWidget; + +void proto_item_set_len(proto_item *ti, gint len); +proto_tree* proto_tree_new(void); +void proto_item_add_subtree(proto_item *ti, proto_tree *subtree, gint idx); + +#if __GNUC__ == 2 +proto_item* proto_tree_add_item(proto_tree *tree, gint start, gint len, + gchar *format, ...) + __attribute__((format (printf, 4, 5))); +#else +proto_item* proto_tree_add_item(proto_tree *tree, gint start, gint len, + gchar *format, ...); +#endif void dissect_packet(const u_char *, frame_data *, proto_tree *); /* @@ -400,25 +361,17 @@ void dissect_ipv6(const u_char *, int, frame_data *, proto_tree *); void dissect_ipx(const u_char *, int, frame_data *, proto_tree *); void dissect_llc(const u_char *, int, frame_data *, proto_tree *); void dissect_lpd(const u_char *, int, frame_data *, proto_tree *); -void dissect_nbdgm(const u_char *, int, frame_data *, proto_tree *, int); -void dissect_nbipx_ns(const u_char *, int, frame_data *, proto_tree *, int); +void dissect_nbdgm(const u_char *, int, frame_data *, proto_tree *); +void dissect_nbipx_ns(const u_char *, int, frame_data *, proto_tree *); void dissect_nbns(const u_char *, int, frame_data *, proto_tree *); -void dissect_ncp(const u_char *, int, frame_data *, proto_tree *, int); -void dissect_nwlink_dg(const u_char *, int, frame_data *, proto_tree *, int); +void dissect_ncp(const u_char *, int, frame_data *, proto_tree *); +void dissect_nwlink_dg(const u_char *, int, frame_data *, proto_tree *); void dissect_osi(const u_char *, int, frame_data *, proto_tree *); void dissect_ospf(const u_char *, int, frame_data *, proto_tree *); void dissect_ospf_hello(const u_char *, int, frame_data *, proto_tree *); -void dissect_pppoed(const u_char *, int, frame_data *, proto_tree *); -void dissect_pppoes(const u_char *, int, frame_data *, proto_tree *); -void dissect_isakmp(const u_char *, int, frame_data *, proto_tree *); -void dissect_radius(const u_char *, int, frame_data *, proto_tree *); void dissect_rip(const u_char *, int, frame_data *, proto_tree *); -void dissect_rsvp(const u_char *, int, frame_data *, proto_tree *); -void dissect_rtsp(const u_char *, int, frame_data *, proto_tree *); -void dissect_sdp(const u_char *, int, frame_data *, proto_tree *); -void dissect_snmp(const u_char *, int, frame_data *, proto_tree *); void dissect_tcp(const u_char *, int, frame_data *, proto_tree *); -void dissect_tftp(const u_char *, int, frame_data *, proto_tree *); +void dissect_tftp(const u_char *, int, frame_data *, proto_tree *, int); void dissect_trmac(const u_char *, int, frame_data *, proto_tree *); void dissect_udp(const u_char *, int, frame_data *, proto_tree *); void dissect_vines(const u_char *, int, frame_data *, proto_tree *); @@ -428,7 +381,6 @@ void dissect_vines_icp(const u_char *, int, frame_data *, proto_tree *); void dissect_vines_ipc(const u_char *, int, frame_data *, proto_tree *); void dissect_vines_rtp(const u_char *, int, frame_data *, proto_tree *); void dissect_vines_spp(const u_char *, int, frame_data *, proto_tree *); -void dissect_payload_ppp(const u_char *, int, frame_data *, proto_tree *); void dissect_ftp(const u_char *, int, frame_data *, proto_tree *, int); void dissect_ftpdata(const u_char *, int, frame_data *, proto_tree *, int); @@ -437,18 +389,16 @@ void dissect_nntp(const u_char *, int, frame_data *, proto_tree *, int); void dissect_pop(const u_char *, int, frame_data *, proto_tree *, int); void dissect_smb(const u_char *, int, frame_data *, proto_tree *, int); void dissect_telnet(const u_char *, int, frame_data *, proto_tree *, int); -void dissect_pptp(const u_char *, int, frame_data *, proto_tree *); -void dissect_gre(const u_char *, int, frame_data *, proto_tree *); void init_dissect_udp(void); /* These functions are in ethertype.c */ +gchar *ethertype_to_str(guint16 etype, const char *fmt); void capture_ethertype(guint16 etype, int offset, const u_char *pd, guint32 cap_len, packet_counts *ld); void ethertype(guint16 etype, int offset, const u_char *pd, frame_data *fd, proto_tree *tree, - proto_tree *fh_tree, int item_id); -extern const value_string etype_vals[]; + proto_tree *fh_tree); /* These functions are in packet-arp.c */ gchar *arphrdaddr_to_str(guint8 *ad, int ad_len, guint16 type); |