path: root/packet-smb.c
AgeCommit message (Collapse)AuthorFilesLines
2001-12-07More NT error codes, from Todd Sabin.Guy Harris1-1/+126
svn path=/trunk/; revision=4352
2001-12-06From Todd Sabin:Guy Harris1-2/+2
add "dissect_ndr_ctx_hnd()" for dissecting context handles, and use it in various DCERPC dissectors; beef up the MS Security Account Manager dissector. Also, export "NT_errors[]" for use by that dissector. svn path=/trunk/; revision=4350
2001-12-06From Ronnie Sahlberg: reassemble DCERPC-over-SMB requests as well asGuy Harris1-5/+42
responses. svn path=/trunk/; revision=4348
2001-12-06In the SMB dissector, keep a list of all the conversation structuresGuy Harris1-4/+33
and, when we're re-initializing the dissector, free up all the hash tables attached to those structures. svn path=/trunk/; revision=4345
2001-12-06There can be more than one SMB request or response in a frame whenGuy Harris1-16/+64
you're doing NetBIOS-over-TCP (yes, I've seen that, with one response being a Transaction and the other being a Read and X), so the frame number is insufficient as a key in the hash table of matched request/response pairs; use the frame number and the MID. svn path=/trunk/; revision=4344
2001-12-05Support for reassembly of DCERPC over SMB, from Ronnie Sahlberg.Guy Harris1-81/+114
svn path=/trunk/; revision=4335
2001-12-05From Tim Potter: add the DOS error for "file already exists" on aGuy Harris1-1/+2
rename. svn path=/trunk/; revision=4333
2001-12-05Don't fetch "t2i->info_level" if "t2i" is null.Guy Harris1-20/+22
svn path=/trunk/; revision=4332
2001-11-29Update from Ronnie Sahlberg:Guy Harris1-4/+14
1. Changes how can_desegment works so that can_desegment is only != 0 for whichever dissector is running immediately on top of whoever offers the can_desegment service. Thus DCERPC needs no special handling to see if it can trust can_desegment (which is currently only available ontop of TCP and not ontop of tcp->nbss->smb). 2. Changes fragment reassembly of transaction smb to only show the defragmented packet for the transaction smb holding the first fragment. To see why, test it with a transaction SMB containing a ~60kb PDU or larger. The old behaviour had approximately quadratic behaviour regarding runtime for dissecting such PDUs. (example: NetShareEnum is a command which can grow really really large if the number of shares and comments are large) svn path=/trunk/; revision=4296
2001-11-29When processing a response, check whether "si->sip" is null before usingGuy Harris1-3/+3
it; it'll be null if the matching request hasn't been seen. svn path=/trunk/; revision=4295
2001-11-28From Ronnie Sahlberg: track FID values between requesta and responsesGuy Harris1-6/+35
for ReadAndX and WriteAndX. svn path=/trunk/; revision=4293
2001-11-28If a request has already been processed, and we fail to find itsGuy Harris1-132/+101
"smb_saved_info_t" in the table of requests whose replies have been found, don't look it up in the table of requests whose replies have not been found - if the request in question has no reply in the capture, that may find some later frame in the same conversation with the same MID, and we don't need that information anyway - the only reason we *need* that structure is to save information in it for use when processing its reply, and we already did that the first time we processed the request. (The information for the later frame may be bad, e.g. having a null "extra_info" pointer, or having one that points to information for another request.) Arrange that we don't use the pointer to the "smb_saved_info_t" when processing a request except to save information if the request hasn't already been processed, as that pointer may not be valid if the request has already been processed, as per the above. svn path=/trunk/; revision=4292
2001-11-28Updates to transaction reassembly, from Ronnie Sahlberg.Guy Harris1-235/+207
Add some checks for null tvbuff arguments. When dissecting transaction setup, parameters, and data when we couldn't dissect it as a pipe or mailslot transaction, use the reported length of the supplied tvbuff, not the actual length, as the amount of data present. svn path=/trunk/; revision=4291
2001-11-27Remove an extra blank from a data source name.Guy Harris1-2/+10
Added comments, from Ronnie Sahlberg. svn path=/trunk/; revision=4280
2001-11-26In "smb_trans_defragment()", quit if "si->sip" is null, as it means weGuy Harris1-1/+12
don't have the frame number of the request, which we use as the ID of the transaction being reassembled. (If we're reassembling a reply, should we not use the frame number of the reply instead? We used to have a hash table to keep track of that, so we might just be able to bring it back....) svn path=/trunk/; revision=4274
2001-11-26Add some comments.Guy Harris1-1/+12
svn path=/trunk/; revision=4273
2001-11-26From Ronnie Sahlberg: reassemble transaction data if transactionGuy Harris1-29/+151
continuations are seen. svn path=/trunk/; revision=4272
2001-11-24Assorted changes from Ronnie Sahlberg:Guy Harris1-22/+36
Add a few small functions to reassemble.c to cope with protocols where the total length of defragmented PDUs are specified in the first fragment (all previous uses of reassembly has been for PDUs where the last fragment is signalled by a flag in the header for the last fragment). Add a few small functions to reassemble.c to abort-and-delete defragmentation of PDUs and also detect IF a PDU is currently being defragmented. (Useful for PDUs where the "unique" identifier is rather ununique, or may be reused often enough so it can be a problem for Ethereal.) Change where NT Cancel presents its Cancelation-to output, and makes the three trans secondary requests also output similar information. svn path=/trunk/; revision=4255
2001-11-21Discard stuff in "smb.h" not used by the dissectors, and replace theGuy Harris1-21/+21
#defines for SMB commands with ones that use the names from the SNIA CIFS spec. Use those #define values rather than hardcoded values in various places that check for specific commands. svn path=/trunk/; revision=4244
2001-11-21Support for Transaction Secondary and Transaction2 Secondary, fromGuy Harris1-3/+12
Ronnie Sahlberg. svn path=/trunk/; revision=4243
2001-11-21Get rid of some unused variables.Guy Harris1-27/+6
svn path=/trunk/; revision=4241
2001-11-20From Ronnie Sahlberg: handle transaction continuations the way we handleGuy Harris1-27/+69
NT Cancel, as transaction continuations don't get a response, either. svn path=/trunk/; revision=4230
2001-11-20Dissect the rest of the named pipe protocol. Export from "packet-smb.c"Guy Harris1-19/+27
routines used for that. Rename some named pipe functions as per the SNIA CIFS spec. Label the "number of files moved" field of the reply to a Move SMB as such, rather than as an unspecified "Count". svn path=/trunk/; revision=4229
2001-11-20Save the function code and FID for pipe requests, and use it for theGuy Harris1-10/+13
matching responses. svn path=/trunk/; revision=4228
2001-11-19Dissect the setup words in pipe transactions that have them; thatGuy Harris1-20/+59
obviates the need to have a protocol tree item for "MSRPC-over-SMB", as the setup words for it are just standard TransactNmPipe setup words (0x26 is the TransactNmPipe function code, and the next setup word is the FID for the pipe in question.) Pass to the pipe dissector tvbuffs for setup-words-plus-pipe (which is the data for the pipe protocol) and parameters-plus-data (which is the data for the protocol running atop the pipe protocol); use the former for the top-level protocol tree item for the pipe protocol, and the latter for the top-level protocol tree item for the LANMAN protocol. svn path=/trunk/; revision=4223
2001-11-19Make the register routines for the mailslot, pipe, browser, andGuy Harris1-16/+1
mailslot-based logon protocols just be regular register routines, detected by the script that generates the "register.c" file, rather than special stuff known to the SMB dissector. svn path=/trunk/; revision=4222
2001-11-19Pass, as the first tvbuff argument to "dissect_mailslot_smb()" andGuy Harris1-133/+151
"dissect_pipe_smb()", a tvbuff containing the setup words and the pipe/mailslot pathname, as those are arguably the part of the packet that contains the "mailslot protocol" and the "pipe protocol", as opposed to the protocol running atop mailslots or pipes. Pass a setup tvbuff to "dissect_pipe_smb()" for it to pass on to the MSRPC-over-named-pipe dissector, and have the setup tvbuff passed to it and "dissect_mailslot_smb()" contain *only* the setup words; don't extract anything other than the setup words from it. Declare "register_proto_smb_mailslot()" in "packet-smb-mailslot.h" rather than "packet-smb.c", and declare "register_proto_smb_pipe()" in "packet-smb-pipe.h" rather than "packet-smb.c". Add a protocol for MSRPC-over-named-pipes. Move the stuff to handle the FID in the setup words of MSRPC-over-named-pipe transactions out of the SMB Transaction dissector into the MSRPC dissector. Add a routine to "packet-smb.c", callable from outside "packet-smb.c", to put an "smb.fid" field into the protocol tree, and to add ", FID: XXXX" to the Info column, for use by the MSRPC-over-named-pipe dissector; use it in the SMB dissector as well, in all the places where we put a FID into the protocol tree. Move the stuff to check whether the LANMAN protocol is enabled, and to set "pinfo->current_proto" to "LANMAN" if it is, into the LANMAN API-over-named-pipe dissector out of the named pipe protocol dissector. If we didn't dissect a Transaction request or reply as a named pipe or mailslot message, put any setup words, parameters, and data it has into the protocol tree as separate items. Don't put a "Response in" item into the protocol tree for an NT Cancel request, as there are no responses to NT Cancel requests. svn path=/trunk/; revision=4221
2001-11-18From Tim Potter:Guy Harris1-8/+68
display the returned FID in the Info column for NT Create And X replies; display the setup words, and treat the second word as a FID in Transaction requests presumed to contain DCE RPC-over-SMB. Add the FID to the Info column for other open/create replies while we're at it. svn path=/trunk/; revision=4219
2001-11-18Pass in the "smb_info" structure a pointer to the "smb_saved_info_t"Guy Harris1-97/+139
structure, so that it can be updated by subdissectors; this way the updates affect the structure immediately, and don't get lost if the subdissector later throws an exception. Use "tvb_reported_length()" to check for an interim mailslot reply; "tvb_length()" could give the wrong answer if a short snapshot length was given in the capture. svn path=/trunk/; revision=4218
2001-11-18Have only the request and response frame numbers, and a "void *", in anGuy Harris1-126/+313
"smb_saved_info_t". Put all the information needed to dissect NT Transaction replies, Transaction2 replies, or Transaction replies into separate data structures, allocated separately, and put a pointer to that data structure in the "void *" in question. Use the return value of "dissect_pipe_smb()" and "dissect_mailslot_smb()" to control whether to display as data the stuff those routines were asked to dissect. If we've seen a request before, but its "smb_saved_info_t" isn't in the "matched" hash table, look in the "unmatched" hash table - perhaps we haven't seen the reply yet. svn path=/trunk/; revision=4216
2001-11-16Add some bits in the Write AndX write mode as per "Microsoft NetworksGuy Harris1-3/+29
SMB FILE SHARING PROTOCOL EXTENSIONS, SMB File Sharing Protocol Extensions Version 2.0, Document Version 3.3". Fix the test for the "connectionless mode" to test the correct bit. svn path=/trunk/; revision=4215
2001-11-16Never put an entry into the hash table for an NT Cancel request, even ifGuy Harris1-7/+10
we didn't find the request it's cancelling. svn path=/trunk/; revision=4214
2001-11-16Don't save a full "smb_info" structure in the hash tables for requestsGuy Harris1-94/+133
and replies, just save a structure holding that information that can't be derived from the contents of one of the SMBs. Don't save anything at all for NT Cancel requests - they have the same TID/PID/MID/UID as the SMB being cancelled, and you want the information for that request used when dissecting the NT Cancel (so it gets the number of the frame containing the request being cancelled) and when dissecting the reply to the request being cancelled. Get rid of an unused routine. svn path=/trunk/; revision=4213
2001-11-16Cleanup of request/response matching, from Ronnie Sahlberg.Guy Harris1-872/+425
Get rid of "Response to" stuff in the LANMAN dissector, as that's now done in the SMB dissector. Add a routine for dissecting unknown SMBs (gets the word and byte counts, and just adds text entries for the word and byte parameters, if any), and replace null pointers in the dissector table with pointers to that routine. Get rid of the check for a null dissector pointer. svn path=/trunk/; revision=4212
2001-11-16Responses to queries for stream information can return more than oneGuy Harris1-24/+69
piece of information in the reply, as a file can have more than one stream; show all of them. Don't use the "File Name" field for stream names. svn path=/trunk/; revision=4211
2001-11-16Use "hf_smb_t2_stream_size", not "hf_smb_t2_stream_name_length", whenGuy Harris1-2/+2
adding the stream size. svn path=/trunk/; revision=4210
2001-11-15Tvbuffification of Transaction requests, from Ronnie Sahlberg.Guy Harris1-1348/+281
"Send buffer pointer" and "send buffer length" items appear not to be sent over the wire. Add support for Write And X. svn path=/trunk/; revision=4204
2001-11-13Squelch an MSVC++ complaint.Guy Harris1-1/+2
svn path=/trunk/; revision=4198
2001-11-12Include the sync I/O alert and nonalert bits.Guy Harris1-1/+23
Put in comments about some of the other bits. svn path=/trunk/; revision=4196
2001-11-12Transaction2 tvbuffified, and support added for many Transaction2 SMBs,Guy Harris1-1301/+4276
from Ronnie Sahlberg. Various other bug fixes, cleanups, and other improvements. svn path=/trunk/; revision=4193
2001-11-11Dissect the NT create option bits. (Well, some of them, anyway.)Guy Harris1-35/+149
svn path=/trunk/; revision=4192
2001-11-10Change from Tim Potter to show the error status in the Info column forGuy Harris1-21/+171
SMBs that got errors. Add some additional access mask bits, and the URL of another spec. svn path=/trunk/; revision=4191
2001-11-09Microsoft calls it "Dfs", not "DFS", perhaps to avoid confusion with theGuy Harris1-6/+6
OSF's DCE DFS (which is completely unrelated to Dfs). svn path=/trunk/; revision=4190
2001-11-09NT Create and X support, from Ronnie Sahlberg.Guy Harris1-7/+280
"#if 0" out an unused routine, pending determination of whether there's any place that would use it. Fix some typos. Display the NT create options in hex, as they appear to be a bitmask. svn path=/trunk/; revision=4189
2001-11-09Tvbuffification of SMB print commands, from Ronnie Sahlberg.Guy Harris1-430/+350
Fix up some SMBs I missed when adding the byte-count checks. svn path=/trunk/; revision=4183
2001-11-08Print the create flags with 8 hex digits.Guy Harris1-17/+26
Add some checks of the return value of "get_unicode_or_ascii_string_tvb()" - if a null terminator is missing, it might well run past the end of the byte parameters - and add some code to keep the byte count updated so that the right byte count is passed to "get_unicode_or_ascii_string_tvb()". svn path=/trunk/; revision=4180
2001-11-08Put the stuff to handle file data in read and write requests into aGuy Harris1-137/+148
common subroutine. Label the "total data length" field in Write Raw and Write Multiplexed requests as such. Dissect the IPC State/Device State field of Open and X requests and NT Create and X requests ass per the stuff on page 67 of ftp://ftp.microsoft.com/developr/drg/CIFS/dosextp.txt Make a variable that doesn't need to be static not static. svn path=/trunk/; revision=4179
2001-11-08NT Transact dissection, from Ronnie Sahlberg.Guy Harris1-7/+1876
svn path=/trunk/; revision=4178
2001-11-07"dissect_open_print_file_smb()" was defined but not used; put it intoGuy Harris1-2/+2
the appropriate entry in the "dissect[]" table. svn path=/trunk/; revision=4176
2001-11-07Further tvbuffication from Ronnie Sahlberg.Guy Harris1-2990/+1928
Get rid of a bunch of stuff for which said tvbuffication removes the need. When dissecting byte parameters, make sure you don't consume more bytes than the byte count, and handle captures where the last string in the byte parameters area isn't properly null-terminated (I think I've seen that in packets from various versions of Windows NT). Make various bitfields given as decimal in SMB specs decimal. svn path=/trunk/; revision=4172