aboutsummaryrefslogtreecommitdiffstats
path: root/packet-smb.c
AgeCommit message (Collapse)AuthorFilesLines
2004-07-18Move dissectors to epan/dissectors directory.Gilbert Ramirez1-19418/+0
Also move ncp222.py, x11-fields, process-x11-fields.pl, make-reg-dotc, and make-reg-dotc.py. Adjust #include lines in files that include packet-*.h files. svn path=/trunk/; revision=11410
2004-07-18Set the svn:eol-style property on all text files to "native", so thatGuy Harris1-1/+1
they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-05-29When we create a tvbuff for a security blob, set its reported length toGuy Harris1-17/+34
the reported length of the blob, not the amount of data available from the blob. Use "tvb_strneql()" when checking for strings, so that we don't throw an exception if there's less data in the tvbuff than there are bytes in the string, we just say "not equal". svn path=/trunk/; revision=11031
2004-04-02dont bail out just because we dont have the entire security blob present inRonnie Sahlberg1-5/+27
a pdu. even for short frames, try to pass on as mush as possible to gssapi. svn path=/trunk/; revision=10545
2004-03-30Add the mask for an NT ACL ACE to the summary list for each ACE. ThisRichard Sharpe1-5/+12
means we don't have to expand the ACE to see what the permission mask is. There are a couple of other places where this could be used, but I have not done anything about them. svn path=/trunk/; revision=10515
2004-03-20From Ronnie Sahlberg: Windows XP SP1 appears to send the OS and LANMANGuy Harris1-4/+27
fields over the wire in ASCII in SessionSetupandX messages even though the "Unicode strings" flag is set. svn path=/trunk/; revision=10413
2004-03-01Make the SMB dissector better at catching what is probably a DCERPC payloadRonnie Sahlberg1-10/+24
inside Write commands and make sure the proper things are stored in the hash so we remember what is and what is not a IPC$ share ontop of which all file i/o is to dcerpc interfaces. svn path=/trunk/; revision=10268
2004-02-25Dissect FILE_RENAME_INFO.Guy Harris1-4/+70
Combine the dissection for 0x0101 and 1004 in Set File Info. svn path=/trunk/; revision=10234
2004-01-19char *drep -> guint8 *drepJörg Mayer1-8/+8
svn path=/trunk/; revision=9735
2004-01-10Eliminate "alignment.h" header - the stuff in it is no longer used.Guy Harris1-2/+1
svn path=/trunk/; revision=9625
2004-01-02Fix a comment.Guy Harris1-2/+2
svn path=/trunk/; revision=9528
2004-01-02Revert a small change I made a day or so ago because Guy has captures thatRichard Sharpe1-2/+2
show that the short name can be in ASCII if flags 2 says ASCII. svn path=/trunk/; revision=9519
2003-12-30A small fix from Andrew Bartlett. The Short File Name is always in UNICODE.Richard Sharpe1-3/+3
svn path=/trunk/; revision=9494
2003-12-28removed some MSVC warnings (warning level 2)Ulf Lamping1-3/+3
svn path=/trunk/; revision=9459
2003-12-18The "cmd" members of "smb_saved_info_t" and "smb_info_t" structuresGuy Harris1-6/+6
always contain an SMB command code (SMB requests and responses both have command codes, so there's no "unknown" out-of-band value); make it a "guint8". Make the argument to "decode_smb_name()" a "guint8" as an SMB command code is passed to it ("guint8" and "unsigned char" are the same types on all platforms we're likely to deal with, so it's a cosmetic change, not a semantic one). Put in an extra "GPOINTER_TO_UINT()" call before casting "si->sip->extra_info" to "guint16", to squelch compiler warnings. svn path=/trunk/; revision=9335
2003-12-17removed some more MSVC warnings (type casting)Ulf Lamping1-14/+14
svn path=/trunk/; revision=9332
2003-12-03Update to SMB ReadAndX replies.Ronnie Sahlberg1-9/+13
There might be a 4 (not 2) byte datalen high field. If there is no such field (due to an early dialect being used) these bytes are often 0xff. If these four bytes are all 0xff dont display them in the tree. svn path=/trunk/; revision=9149
2003-11-12If what remains of the SMB byte count exceeds the data left in theGuy Harris1-4/+2
tvbuff, show what's left as extra byte parameters - don't act as if there aren't any extra byte parameters. svn path=/trunk/; revision=8946
2003-11-10Bugfix for ethereal crashesRonnie Sahlberg1-3/+12
If the ByteCount field in the SMB PDU spanned beyond the end of the packet because the packet was short or because the BC field was corrupted and contained garbade data then the tree item for the command (the subtree just after the SMBHeader subtree) would describe data continuing beyond the end of the packet. If we selected one such tree in the dissect pane and used Prepare/Match Selected this would cause the filter build thing to try to access data beyod the end of the packet and ethereal would dump core. Change the END_OF_SMB macro so that it shrinks bc so that bc never describes data beyond the end of the packet. svn path=/trunk/; revision=8926
2003-10-24From Jim McDonough: add one more nt status code toGuy Harris1-1/+2
packet-dcerpc-smb.c that is often returned from the winreg abortshutdown operation. svn path=/trunk/; revision=8767
2003-10-23The ACL revision field is one byte, not 2 bytes.Ronnie Sahlberg1-5/+5
svn path=/trunk/; revision=8764
2003-10-01The max count high field is 32 bits, and, in order to compare itGuy Harris1-4/+5
against 0xffffffff, it has to be extracted into a 32-bit variable. svn path=/trunk/; revision=8575
2003-09-29Added comment: XXX Argh maxcnt_high is guint16 and thus 16 bit -> always falseJörg Mayer1-1/+2
svn path=/trunk/; revision=8567
2003-09-28in ReadAndXRonnie Sahlberg1-2/+10
when reading what could potentially be the maxcount high field assume that IF it is 0xFFFFFFFF that it is not maxcount high at all but instead just some padding/reserved bytes. If this field is 0xFFFFFFFF just ignore it. svn path=/trunk/; revision=8559
2003-08-28Clean up white space.Guy Harris1-10/+10
svn path=/trunk/; revision=8302
2003-08-21Label the Count field in a Write AndX response as such, rather than asGuy Harris1-15/+25
"Data Length". Fix some low-16-bits-of fields to have "_low", rather than "_high", at the ends of their names. svn path=/trunk/; revision=8204
2003-08-21The MaxCountHigh field in a READ_ANDX is given as a ULONG, i.e. 32 bits,Guy Harris1-15/+43
in the SNIA CIFS spec, although it's probably a 16-bit MaxCountHigh and a 16-bit reserved field (it's a 32-bit timeout field in an earlier SMB spec). Call the MaxCount and MaxCountHigh fields in a READ_ANDX "Max Count Low" and "Max Count High", rather than "Data Length Low" and "Data Length High". svn path=/trunk/; revision=8198
2003-08-20The length and offset for large file support for LockingAndX was broken.Ronnie Sahlberg1-7/+54
We treated this as just a normal 64bit integer in LittleEndian format. However, this is actually 2 32 bit integers, each in LittleEndian format but the two 32 bit fields are stored in BigEndian format relative to each other. Since we dont do 64 bit aritmetic I had to convert the field to FT_STRING as well so sorry, no creative len>xxx filters anymore. but at least we present the data in the correct way in the tree pane. We didnt see this one earlier since most locking_andx requests are probably for offset : 0 and length: - Funnily enough it seems that certain popular commercial products have the same bug as ethereal had up until 5 minutes ago. svn path=/trunk/; revision=8196
2003-08-19Update to the SMB dissector so that the HighLen 16 bit integer is decodedRonnie Sahlberg1-42/+84
instead of as being represented as RESERVED. This updates the ReadAndX and WriteAndX calls and replies. This should really try to keep track of the negotiation of the conversation to make sure we only do it for those sessions where LARGE file io has been negotiated. Currently it does it for all Read/Write AndX calls. It is probably safe to do so since for those clients where this is not supported these bytes are RESERVED and MBZ anyway. svn path=/trunk/; revision=8191
2003-08-17Update to SMBRonnie Sahlberg1-16/+16
Change the AndX command fields to only place a filterable field in the tree when smb.cmd is NOT 0xff If smb.cmd is 0xFF just place a text entry in the field instead. This makes it more intuitive for users that try to use filters such as smb.cmd!=0xXY since the filter will no longer behave "unexpectedly" and fail to filter out any of the AndX commands. Yes, they should really use !smb.cmd==0xXY instead but one cant explain this to every single user. I dont think anyone would ever want to filter for smb.cmd==0xFF anyway svn path=/trunk/; revision=8178
2003-08-16Get rid of an unused variable.Guy Harris1-2/+1
svn path=/trunk/; revision=8170
2003-08-15In "dissect_transaction2_request_parameters()", "bc" gets decremented asGuy Harris1-5/+4
we go through the data, so we can't compare it with the current offset minus the starting offset - we should just test, and use, its value directly, as, at the end, it reflects the amount of data left. svn path=/trunk/; revision=8167
2003-08-15Some fixes for UNIX CIFS extensions. There's still a problem in the trans2Tim Potter1-5/+14
find response and we end up displaying malformed frame even though all data has been dissected. svn path=/trunk/; revision=8166
2003-08-14Removed references to CIFS TR section numbers from various value_strings.Tim Potter1-67/+67
The strings are now in COL_INFO and the section numbers were cluttering it up. svn path=/trunk/; revision=8164
2003-08-13Make some abbreviations to some value_strings to save COL_INFO real estate:Tim Potter1-12/+26
transaction -> trans, information -> info. Put value_string data in COL_INFO for trans2 query{path,file}info. svn path=/trunk/; revision=8163
2003-08-13Fixes for testing all variations of query fsinfo. There were a fewTim Potter1-5/+33
transpositions of subcommand numbers, and the query object id case was not implemented. I'm not sure about the query fs label info as it doesn't seem to exist as a server procedure except in Samba. svn path=/trunk/; revision=8162
2003-08-04Dissect some more set attr calls ...Richard Sharpe1-1/+4
svn path=/trunk/; revision=8128
2003-07-10Support for CIFS UNIX extensions as documented in the CIFS TR 1.0,Tim Potter1-21/+366
Appendix D. svn path=/trunk/; revision=8012
2003-07-10Add more entries to the query/set path/file info value_strings forTim Potter1-3/+40
some extra info levels discovered by tridge. Put subcommand information in COL_INFO for trans2 query fs/path/file info. svn path=/trunk/; revision=8011
2003-06-15The MID field in the SMB header is in reality only ~10 bits in sizeRonnie Sahlberg1-7/+7
so it is pretty common for MID values to be reused even in moderately sized captures. The test to compare that the command type between the request and reply is not sufficient for when most of the commands between the client and the server are the same (e.g. streaming Read/Write) Change the matching so that ONLY the first "response" we see for a certain open MID will be matched to the original request. I.e. Prevent Read Request Read Reply [missing from capture] Read Request Read Reply From incorrectly matching the second reply (if it has a reused MID) with the first request. This makes the response time statistics a bit more reliable as well. svn path=/trunk/; revision=7888
2003-06-12Add new routines:Guy Harris1-3/+2
tvb_get_string() - takes a tvbuff, an offset, and a length as arguments, allocates a buffer big enough to hold a string with the specified number of bytes plus an added null terminator (i.e., length+1), copies the specified number of bytes from the tvbuff, at the specified offset, to that buffer and puts in a null terminator, and returns a pointer to that buffer (or throws an exception before allocating the buffer if that many bytes aren't available in the tvbuff); tvb_get_stringz() - takes a tvbuff, an offset, and a pointer to a "gint" as arguments, gets the size of the null-terminated string starting at the specified offset in the tvbuff (throwing an exception if the null terminator isn't found), allocates a buffer big enough to hold that string, copies the string to that buffer, and returns a pointer to that buffer and stores the length of the string (including the terminating null) in the variable pointed to by the "gint" pointer. Replace many pieces of code allocating a buffer and copying a string with calls to "tvb_get_string()" (for one thing, "tvb_get_string()" doesn't require you to remember that the argument to "tvb_get_nstringz0()" is the size of the buffer into which you're copying the string, which might be the length of the string to be copied *plus 1*). Don't use fixed-length buffers for null-terminated strings (even if the code that generates those packets has a #define to limit the length of the string). Use "tvb_get_stringz()", instead. In some cases where a value is fetched but is only used to pass an argument to a "proto_tree_add_XXX" routine, use "proto_tree_add_item()" instead. svn path=/trunk/; revision=7859
2003-06-10Show the upper 2 bytes of the formerly-reserved area as a "High Part ofGuy Harris1-15/+13
PID" even for SMB-over-IPX. svn path=/trunk/; revision=7823
2003-06-09Put the right data into the protocol tree for the high 16 bits of the PID.Guy Harris1-10/+10
svn path=/trunk/; revision=7819
2003-06-09Dissect the 12-byte reserved field as a 2-byte PID high, 8-byte sig, andRichard Sharpe1-4/+23
2-byte reserved field. svn path=/trunk/; revision=7812
2003-06-09Update the section numbers in various information level strings toGuy Harris1-89/+88
reflect the 1.0 version of the CIFS spec. Similarly update function names containing section numbers. Change the strings for query file levels 0x0200 and 0x0201 to say "Query" rather than "Set" (we now have separate tables for "query" and "set" information levels, as some of them differ), and get rid of the string for 0x0202, as that's documented in the CIFS spec only as a "set" level. svn path=/trunk/; revision=7810
2003-06-08The information levels for TRANS2_SET_{PATH,FILE}_INFORMATION are,Guy Harris1-10/+158
according to the SNIA CIFS 1.0 spec and some captures I've seen, are not the same as for the corresponding TRANS2_GET_{PATH,FILE}_INFORMATION. Handle the SET information levels as per the CIFS spec. svn path=/trunk/; revision=7806
2003-06-06Rename EA length field to EA list length. Field was originally justTim Potter1-13/+13
list length before my previous commit. svn path=/trunk/; revision=7797
2003-06-06Dissect extended attribute lists in trans2 QUERY_FILE_INFORMATION,Tim Potter1-24/+103
info level 4. svn path=/trunk/; revision=7796
2003-06-04There can be more than one DCE RPC call per frame, e.g. there can beGuy Harris1-11/+1
multiple NetBIOS-over-TCP session service messages in a TCP segment, and they can contain the final portions of different DCERPC calls. Don't assume a frame number is sufficient to identify DCE RPC calls. svn path=/trunk/; revision=7777
2003-05-28From Laurent Rabret: use "g_free()", not "free()", to free stuffGuy Harris1-2/+2
allocated with "g_malloc()" and related GLib routines. svn path=/trunk/; revision=7758
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-26 09:44:38 +0000