aboutsummaryrefslogtreecommitdiffstats
path: root/packet-smb-pipe.c
AgeCommit message (Collapse)AuthorFilesLines
2003-12-21Compiling with -pedantic:Jörg Mayer1-2/+2
warning: comma at end of enumerator list svn path=/trunk/; revision=9383
2003-12-17removed some more MSVC warnings (type casting)Ulf Lamping1-7/+7
svn path=/trunk/; revision=9332
2003-11-16Export "protocol_t" as an opaque type.Guy Harris1-3/+3
Make "proto_is_protocol_enabled()" and "proto_get_protocol_short_name()" take a "protocol_t *" as an argument, so they don't have to look up the "protocol_t" - this will probably speed them up considerably, and they're called on almost every dissector handoff. Get rid of a number of "proto_is_protocol_enabled()" calls that aren't necessary (dissectors called through handles, including those called through dissector tables, or called as heuristic dissectors, aren't even called if their protocol isn't enabled). Change some direct dissector calls to go through handles. svn path=/trunk/; revision=8979
2003-09-03Don't include <epan/conversation.h> if you don't need it.Guy Harris1-2/+1
svn path=/trunk/; revision=8361
2003-06-04There can be more than one DCE RPC call per frame, e.g. there can beGuy Harris1-65/+53
multiple NetBIOS-over-TCP session service messages in a TCP segment, and they can contain the final portions of different DCERPC calls. Don't assume a frame number is sufficient to identify DCE RPC calls. svn path=/trunk/; revision=7777
2003-04-20Add a pointer to an hf_ value for a "reassembled_in" field (which can beGuy Harris1-1/+2
null) to the "fragment_items" structure, and don't pass that value into "process_reassembled_data()", just have it use the value in the "fragment_items" structure passed to it. Make "process_reassembled_data()" capable of handling reassembly done by "fragment_add_seq_check()", and use it in the ATP and 802.11 dissectors; give them "reassembled_in" fields. Make "process_reassembled_data()" handle only the case of a completed reassembly (fd_head != NULL) so that we can use it in those dissectors without gunking the code up too much. svn path=/trunk/; revision=7513
2003-04-15Put in a comment noting that the reassembly code assumes subdissectorsGuy Harris1-2/+8
are idempotent, which isn't necessarily the case. svn path=/trunk/; revision=7462
2003-04-14Keep the two sides of a pipe separate when doing DCERPC-over-a-pipeGuy Harris1-6/+19
reassembly. (Perhaps we *shouldn't* see reassembly in progress in both directions, if the protocol is purely request/response, but that doesn't mean you won't see it in a capture, due to bugs or dropped packets or....) svn path=/trunk/; revision=7457
2003-04-13"dcerpc_fragment_table" is used only in packet-smb-pipe.c, except forGuy Harris1-5/+14
the call to initialize it; move the call to initialize it to the registration routine for the dissector that uses it, move the definition of ""dcerpc_fragment_table" to packet-smb-pipe.c, make it static, and remove the declaration of it from smb.h. Add some casts to squelch compiler complaints. svn path=/trunk/; revision=7449
2003-04-12Missing file from previous commitRonnie Sahlberg1-29/+165
svn path=/trunk/; revision=7446
2003-03-05Use the reported length, not the captured length, as the fragment lengthGuy Harris1-8/+8
when doing reassembly. In some additional places, use "tvb_bytes_exist()" to check whether we have enough data to do reassembly, rather than checking to see if the frame is short (it might be short but we might still have enough data to do reassembly). In DCE RPC, use the fragment length from the header as the number of bytes of fragment data. There's no need to check "pinfo->fragmented" before doing reassembly in the DCERPC-over-SMB-pipes code - either we have all the data or we don't. In SNA and WTP reassembly, add a check to make sure we have all the data to be reassembled. svn path=/trunk/; revision=7282
2003-02-28Don't offer desegmentation to DCERPC if we have a short or fragmentedGuy Harris1-3/+8
packet. svn path=/trunk/; revision=7217
2003-02-20At least in regular SMB Browse and RAP messages, the server type mask isGuy Harris1-5/+3
not guaranteed to be aligned on a 4-byte boundary, so, if we're not dissecting a DCE RPC request or reply, don't use "dissect_ndr_uint32()" to extract the access mask. svn path=/trunk/; revision=7175
2003-02-17Dissect the server type bitfield in NetServerGetInfo for SERVER_INFO_101Tim Potter1-5/+7
and SERVER_INFO_102. Modify all callers to use the new interface. svn path=/trunk/; revision=7158
2002-12-19Update reassemble.c/show_item and all callers to use FT_FRAMENUM for the ↵Ronnie Sahlberg1-3/+3
list of packets corresponding to a reassembled pdu svn path=/trunk/; revision=6807
2002-11-16When processing a response, handle the case where the parameterGuy Harris1-18/+67
descriptor of the matching request is missing, e.g. because the frame was too short but not so sort that the entire request was missing. Clean up the handling of the case where the parameter descriptor isn't missing but the data descriptor was. If we can't dissect the response data due to a missing descriptor, at least create *some* item for the data. svn path=/trunk/; revision=6645
2002-10-24Add a "fragment_add_seq_next()" to reassemble fragments that don't haveGuy Harris1-2/+2
sequence numbers or offsets and are thus assumed to be received in order with no duplicates or dropped fragments (e.g., for NetBIOS Frame, where 802.2 LLC guarantees in-order delivery to NetBIOS with no duplicates or dropped fragments). "show_fragment_tree()' and "show_fragment_seq_tree()" don't modify the "fragment_items" to which the "fit" argument points, so make that argument a "const fragment_items *". Make all the "fragment_items" tables "static" (as they're not used outside the modules defining them) and "const" (as they're not modified). Add support for reassembly of NetBIOS fragmented requests and responses. Get rid of an unnecessary include of "packet-tr.c" in the NetBIOS dissector, and make its table of dissection function pointers static. Fix some typos in the AppleTalk and NetBIOS dissectors. svn path=/trunk/; revision=6491
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-12/+12
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-02Replace the types from sys/types.h and netinet/in.h by their glib.hJörg Mayer1-9/+1
equivalents for the toplevel directory. The removal of winsock2.h will hopefully not cause any problems under MSVC++, as those files using struct timeval still include wtap.h, which still includes winsock2.h. svn path=/trunk/; revision=5932
2002-07-03From Devin Heitmueller: treat the "send buffer length" in SMB RAPGuy Harris1-2/+4
messages as being present in the packet. svn path=/trunk/; revision=5816
2002-06-07Add "show_fragment_seq_tree()", which is like "show_fragment_tree()",Guy Harris1-13/+46
but for stuff reassembled with "fragment_add_seq()" or "fragment_add_seq_check()". Add a "fragment tag" string to the "fragment_items", so that packets with fragmentation errors can be properly flagged as having "Illegal fragments" or "Illegal segments" depending on the term used with the protocol in question. Make all the dissectors that can use "show_fragment_tree()" or "show_fragment_seq_tree()", and don't already use them, do so. svn path=/trunk/; revision=5644
2002-06-04Get rid of the "data_src" member of the "frame_data" structure; put itGuy Harris1-2/+2
in the "packet_info" structure instead, as we don't need a pointer for every single frame in the capture file, just for each frame for which we currently have an open "epan_dissect_t". svn path=/trunk/; revision=5614
2002-05-24Move the value_string table for the share type values toGuy Harris1-9/+2
"packet-smb-common.c", and use it in "packet-dcerpc-srvsvc". svn path=/trunk/; revision=5545
2002-04-30Get rid of some unused arguments, and mark some others as unused.Guy Harris1-60/+53
Remove the declaration of "dissect_nt_sid()" from "packet-dcerpc-samr.c"; get it by including "packet-smb-common.h", instead. svn path=/trunk/; revision=5313
2002-04-29Additional RAP error code for password changes sent to a BDC, from DevinGuy Harris1-1/+2
Heitmueller. svn path=/trunk/; revision=5296
2002-04-29Get rid of an unused variable.Guy Harris1-18/+1
svn path=/trunk/; revision=5293
2002-04-29Removal (or, at least, #ifdeffing out) of unused variables andGuy Harris1-2/+4
functions, from David Frascone. svn path=/trunk/; revision=5288
2002-03-27In the protocol tree entries for lists of fragments/segments, make theGuy Harris1-4/+6
top-level item correspond to the reassembled data, and make the item for each fragment/segment correspond to the part of that reassembled data that came from that fragment/segment. svn path=/trunk/; revision=5025
2002-03-16A new type of DCERPC over SMB transport.Ronnie Sahlberg1-2/+2
I have captures with w2k speaking DCERPC without using the normal Transaction named pipes SMBs. Instead DCERPC is just implemented ontop of ordinary read/write calls. The smb dissector now examines TreeConnectAndX and stores the conversation/tid/type-of-share in a table for later access. All SMB requests examine that hash table to find out if TID in the header refers to a normal share or an IPC$ share. Initial support in read/write SMB calls to detect if the operations are for an IPC share and thus it assumes it must be DCERPC commands in the payload. Desegmentation/Reassembly of these types of calls are not implemented yet. svn path=/trunk/; revision=4952
2002-03-15Moved the value_string for MS country codes from packet-dcerpc-nt.c toRonnie Sahlberg1-2/+2
packet-smb.c so that packet-smb-pipe.c can reference this struct as well. svn path=/trunk/; revision=4947
2002-02-18Don't give tvbuffs names; instead, give data sources names, where aGuy Harris1-5/+4
"data source" has a name and a top-level tvbuff, and frames can have a list of data sources associated with them. Use the tvbuff pointer to determine which data source is the data source for a given field; this means we don't have to worry about multiple data sources with the same name - the only thing the name does is label the notebook tab for the display of the data source, and label the hex dump of the data source in print/Tethereal output. Clean up a bunch of things discovered in the process of doing the above. svn path=/trunk/; revision=4749
2002-01-27Not all pointers in RAP packets point to null-terminated strings; addGuy Harris1-36/+132
support for the "b" descriptor item in data, for pointers that point to arrays of bytes - the descriptor item includes a byte count giving the number of bytes in the array. Handle the "logon hours" bitmask in that fashion. Sometimes it appears that -1 means "unknown", and sometimes it appears that 0 means "unknown", for the last logoff date/time; interpret both of them as "unknown" (or "never"). svn path=/trunk/; revision=4612
2002-01-27Fix "add_byte_param()" not to report multi-byte parameters as having theGuy Harris1-122/+654
wrong type. Don't have routines that create subtrees for the data in a RAP reply - just have a string for the name to give the subtree. Create the subtree iff the reply has an entry count; if there's no name, use "Entries", and if there's no ett_ value for it, use a generic one. If there's no routine to create a subtreee for an entry in a RAP reply, don't create the subtree - some entries have only one member, so there's no point in creating a subtree for them. Provide an ett_ value to use if we don't know what the entry looks like. Properly terminate "lm_null_list[]". Fix the tables for the NetUserGetInfo API. Add tables for the NetUserGetGroups API. Add #defines and names for all the APIs in the SNIA CIFS spec (but fix up some of the names to reflect what the actual API names appear to be). Display the RAP API number in decimal, not hex, for unknown APIs. Use the right hf_ value when displaying the auxiliary data descriptor. svn path=/trunk/; revision=4611
2002-01-21Include files from the "epan" directory and subdirectories thereof withGuy Harris1-3/+3
"epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
2002-01-20Allow a length of -1 to be specified when adding FT_NONE and FT_PROTOCOLGuy Harris1-12/+8
items to the protocol tree; it's interpreted as "the rest of the data in the tvbuff". This can be used if 1) the item covers the entire packet or the remaining payload in the packet or 2) the item's length won't be known until it's dissected, and will be then set with "proto_item_set_len()" - if an exception is thrown in the dissection, it means the item ran *past* the end of the tvbuff, so saying it runs to the end of the tvbuff is reasonable. Convert a number of "proto_tree_add_XXX()" calls using "tvb_length_remaining()", values derived from the result of "tvb_length()", or 0 (in the case of items whose length is unknown) to use -1 instead (using 0 means that if an exception is thrown, selecting the item highlights nothing; using -1 means it highlights all the data for that item that's available). In some places where "tvb_length()" or "tvb_length_remaining()" was used to determine how large a packet is, use "tvb_reported_length()" or "tvb_reported_length_remaining()", instead - the first two calls indicate how much captured data was in the packet, the latter two calls indicate how large the packet actually was (and the fact that using the latter could cause BoundsError exceptions to be thrown is a feature - if such an exception is thrown, the frame really *was* short, and it should be tagged as such). Replace some "proto_tree_add_XXX()" calls with equivalent "proto_tree_add_item()" calls. Fix some indentation. svn path=/trunk/; revision=4578
2002-01-17Use the "fragmented" field of the "packet_info" structure inGuy Harris1-1/+5
"dissect_frame()" to indicate whether a ReportedBoundsError was due to the packet being malformed (i.e., the packet was shorter than it's supposed to be, so the dissector went past the end trying to extract fields that were supposed to be there) or due to it not being reassembled (i.e., the packet was fragmented, and we didn't reassemble it, but just treated the first fragment as the entire packet, so the dissector went past the end trying to extract fields that were partially or completely in fragments after that). Mark the latter as being unreasembled rather than malformed. Properly initialize, save, and restore that field, and properly set it, so that works. svn path=/trunk/; revision=4555
2002-01-15Fix some preferences to eliminate the extra copy of the protocol name atGuy Harris1-2/+2
the beginning, and to use underscores rather than periods where the preference's name really isn't part of a hierarchical namespace. Use "%u" rather than "%d" to print unsigned quantities. svn path=/trunk/; revision=4543
2001-12-16More MSRPC->DCERPC, from Tim Potter.Guy Harris1-5/+5
svn path=/trunk/; revision=4406
2001-12-10Move the pointer to the "column_info" structure in the "frame_data"Guy Harris1-17/+17
structure to the "packet_info" structure; only stuff that's permanently stored with each frame should be in the "frame_data" structure, and the "column_info" structure is not guaranteed to hold the column values for that frame at all times - it was only in the "frame_data" structure so that it could be passed to dissectors, and, as all dissectors are now passed a pointer to a "packet_info" structure, it could just as well be put in the "packet_info" structure. That saves memory, by shrinking the "frame_data" structure (there's one of those per frame), and also lets us clean up the code a bit. svn path=/trunk/; revision=4370
2001-12-09"msrpc" -> "dcerpc", and comment cleanups, from Tim Potter.Guy Harris1-4/+4
svn path=/trunk/; revision=4365
2001-12-05Support for reassembly of DCERPC over SMB, from Ronnie Sahlberg.Guy Harris1-4/+69
svn path=/trunk/; revision=4335
2001-11-28If a request has already been processed, and we fail to find itsGuy Harris1-7/+13
"smb_saved_info_t" in the table of requests whose replies have been found, don't look it up in the table of requests whose replies have not been found - if the request in question has no reply in the capture, that may find some later frame in the same conversation with the same MID, and we don't need that information anyway - the only reason we *need* that structure is to save information in it for use when processing its reply, and we already did that the first time we processed the request. (The information for the later frame may be bad, e.g. having a null "extra_info" pointer, or having one that points to information for another request.) Arrange that we don't use the pointer to the "smb_saved_info_t" when processing a request except to save information if the request hasn't already been processed, as that pointer may not be valid if the request has already been processed, as per the above. svn path=/trunk/; revision=4292
2001-11-28Updates to transaction reassembly, from Ronnie Sahlberg.Guy Harris1-1/+29
Add some checks for null tvbuff arguments. When dissecting transaction setup, parameters, and data when we couldn't dissect it as a pipe or mailslot transaction, use the reported length of the supplied tvbuff, not the actual length, as the amount of data present. svn path=/trunk/; revision=4291
2001-11-27Rename the heuristic dissector table "msrpc" to "smb_transact", toGuy Harris1-5/+5
indicate that it's to be used for SMB transactions; a different table, using different dissectors, would be needed for, say, reads and writes over a named pipe, as those are byte streams and SMB transactions are packets, so the dissectors for the first one need to worry about multiple PDUs per segment and desegmentation, while the dissectors for the second one don't - and, in fact, can't do desegmentation stuff. svn path=/trunk/; revision=4286
2001-11-26Moved from using dissect_data() to using call_dissector()Ed Warnicke1-2/+10
svn path=/trunk/; revision=4269
2001-11-26Clean up the stuff that creates the pipe protocol subtree; it shouldn'tGuy Harris1-14/+17
fetch the length of "sp_tvb" if "sp_tvb" is null. Fix some comments. svn path=/trunk/; revision=4267
2001-11-25From Ronnie Sahlberg: fix a check for a null tvbuff pointer to check theGuy Harris1-2/+2
correct pointer. svn path=/trunk/; revision=4265
2001-11-21Get rid of some unused variables.Guy Harris1-6/+3
svn path=/trunk/; revision=4241
2001-11-20Allow the tvbuff pointer to various "proto_tree_add" routines to be nullGuy Harris1-3/+3
if (and only if) the length of the item being added is 0 (so that it has no data backing it). This means the data stream name pointer for the item in question is null; make sure we handle that. Use that for some "uses the value from the matching request" fields in the SMB Pipe protocol. svn path=/trunk/; revision=4231
2001-11-20Dissect the rest of the named pipe protocol. Export from "packet-smb.c"Guy Harris1-22/+157
routines used for that. Rename some named pipe functions as per the SNIA CIFS spec. Label the "number of files moved" field of the reply to a Move SMB as such, rather than as an unspecified "Count". svn path=/trunk/; revision=4229
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-28 02:58:43 +0000