diff options
author | Ronnie Sahlberg <ronnie_sahlberg@ozemail.com.au> | 2005-11-12 21:56:02 +0000 |
---|---|---|
committer | Ronnie Sahlberg <ronnie_sahlberg@ozemail.com.au> | 2005-11-12 21:56:02 +0000 |
commit | 7d0ed23854d97da3bc4d9c85a20fc44a17ec8e55 (patch) | |
tree | e9a803a9d5f91b0dd671e1de7ca771e76f3b1c19 | |
parent | 5940b03d12a3445907dba3b0b86160b16b9bc7d0 (diff) |
from Laurent Constantin
updates to smb
A patch for packet-smb.c is attached:
- it improves timeout decoding
- it defines common NT transaction IOCTL functions
- it corrects decoding of resume key in search queries
- it defines a new function dissect_4_2_16_8_unsure() to replace
dissect_4_2_16_8(). I'm unsure if it is correct. As said in
comments, it works for me, but I find strange that nobody noticed
dissect_4_2_16_8() was wrong. So, it is between "#if 0".
Someone else should confirm dissect_4_2_16_8_unsure() works
before activating it.
svn path=/trunk/; revision=16494
-rw-r--r-- | epan/dissectors/packet-smb.c | 174 |
1 files changed, 154 insertions, 20 deletions
diff --git a/epan/dissectors/packet-smb.c b/epan/dissectors/packet-smb.c index 3c806d8c42..ce65eab099 100644 --- a/epan/dissectors/packet-smb.c +++ b/epan/dissectors/packet-smb.c @@ -3871,6 +3871,32 @@ dissect_write_and_close_response(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tr return offset; } +/* Timeout is defined on page 117 of SMB Protocol Extensions version 2.0 + available at http://us1.samba.org/samba/ftp/SMB-info/DOSEXTP.TXT +*/ +static gchar * +smbext20_timeout_msecs_to_str(gint32 time) +{ + gchar *buf; +#define SMBEXT20_TIMEOUT_MSECS_TO_STR_MAXLEN 60 + + if (time <= 0) { + buf=ep_alloc(SMBEXT20_TIMEOUT_MSECS_TO_STR_MAXLEN+1); + if (time == 0) { + g_snprintf(buf, SMBEXT20_TIMEOUT_MSECS_TO_STR_MAXLEN+1, "Return immediately (0)"); + } else if (time == -1) { + g_snprintf(buf, SMBEXT20_TIMEOUT_MSECS_TO_STR_MAXLEN+1, "Wait indefinitely (-1)"); + } else if (time == -2) { + g_snprintf(buf, SMBEXT20_TIMEOUT_MSECS_TO_STR_MAXLEN+1, "Use default timeout (-2)"); + } else { + g_snprintf(buf, SMBEXT20_TIMEOUT_MSECS_TO_STR_MAXLEN+1, "Unknown reserved value (%d)", time); + } + return buf; + } + + return time_msecs_to_str(time); +} + static int dissect_read_raw_request(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, proto_tree *smb_tree _U_) { @@ -3899,7 +3925,7 @@ dissect_read_raw_request(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree /* timeout */ to = tvb_get_letohl(tvb, offset); - proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: %s", time_msecs_to_str(to)); + proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: %s", smbext20_timeout_msecs_to_str(to)); offset += 4; /* 2 reserved bytes */ @@ -4134,7 +4160,7 @@ dissect_write_raw_request(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tre /* timeout */ to = tvb_get_letohl(tvb, offset); - proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: %s", time_msecs_to_str(to)); + proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: %s", smbext20_timeout_msecs_to_str(to)); offset += 4; /* mode */ @@ -4212,7 +4238,7 @@ dissect_write_mpx_request(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tre /* timeout */ to = tvb_get_letohl(tvb, offset); - proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: %s", time_msecs_to_str(to)); + proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: %s", smbext20_timeout_msecs_to_str(to)); offset += 4; /* mode */ @@ -4308,7 +4334,7 @@ dissect_search_resume_key(tvbuff_t *tvb, packet_info *pinfo, /* file name */ fn_len = 11; - fn = get_unicode_or_ascii_string(tvb, &offset, si->unicode, &fn_len, + fn = get_unicode_or_ascii_string(tvb, &offset, FALSE/*never Unicode*/, &fn_len, TRUE, TRUE, bcp); CHECK_STRING_SUBR(fn); /* ensure that it's null-terminated */ @@ -4679,12 +4705,7 @@ dissect_locking_andx_request(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree * /* timeout */ to = tvb_get_letohl(tvb, offset); - if (to == 0) - proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: Return immediately (0)"); - else if (to == 0xffffffff) - proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: Wait indefinitely (-1)"); - else - proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: %s", time_msecs_to_str(to)); + proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: %s", smbext20_timeout_msecs_to_str(to)); offset += 4; /* number of unlocks */ @@ -4998,6 +5019,7 @@ dissect_open_andx_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, i { guint8 wc, cmd=0xff; guint16 andxoffset=0, bc; + guint32 to; smb_info_t *si = pinfo->private_data; int fn_len; const char *fn; @@ -5046,9 +5068,14 @@ dissect_open_andx_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, i proto_tree_add_item(tree, hf_smb_alloc_size, tvb, offset, 4, TRUE); offset += 4; - /* 8 reserved bytes */ - proto_tree_add_item(tree, hf_smb_reserved, tvb, offset, 8, TRUE); - offset += 8; + /* timeout, described at http://us1.samba.org/samba/ftp/SMB-info/DOSEXTP.TXT */ + to = tvb_get_letohl(tvb, offset); + proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: %s", smbext20_timeout_msecs_to_str(to)); + offset += 4; + + /* 4 reserved bytes */ + proto_tree_add_item(tree, hf_smb_reserved, tvb, offset, 4, TRUE); + offset += 4; BYTE_COUNT; @@ -6503,6 +6530,72 @@ const value_string nt_cmd_vals[] = { {0, NULL} }; +/* These IOCTL function values come from Visual 6.0 winioctl.h, and + are described in MSDN. + They are only FSCTLs (they all start with 0x0009). If we were + pedantic, we could check if ioctl_isfsctl boolean is set, but + this is redundant. +*/ +static const value_string nt_ioctl_function_vals[] = { + {0x00090000, "FSCTL_REQUEST_OPLOCK_LEVEL_1"}, + {0x00090004, "FSCTL_REQUEST_OPLOCK_LEVEL_2"}, + {0x00090008, "FSCTL_REQUEST_BATCH_OPLOCK"}, + {0x0009000C, "FSCTL_OPLOCK_BREAK_ACKNOWLEDGE"}, + {0x00090010, "FSCTL_OPBATCH_ACK_CLOSE_PENDING"}, + {0x00090014, "FSCTL_OPLOCK_BREAK_NOTIFY"}, + {0x00090018, "FSCTL_LOCK_VOLUME"}, + {0x0009001C, "FSCTL_UNLOCK_VOLUME"}, + {0x00090020, "FSCTL_DISMOUNT_VOLUME"}, + {0x00090028, "FSCTL_IS_VOLUME_MOUNTED"}, + {0x0009002C, "FSCTL_IS_PATHNAME_VALID"}, + {0x00090030, "FSCTL_MARK_VOLUME_DIRTY"}, + {0x0009003B, "FSCTL_QUERY_RETRIEVAL_POINTERS"}, + {0x0009003C, "FSCTL_GET_COMPRESSION"}, + {0x0009C040, "FSCTL_SET_COMPRESSION"}, + {0x0009004F, "FSCTL_MARK_AS_SYSTEM_HIVE"}, + {0x00090050, "FSCTL_OPLOCK_BREAK_ACK_NO_2"}, + {0x00090054, "FSCTL_INVALIDATE_VOLUMES"}, + {0x00090058, "FSCTL_QUERY_FAT_BPB"}, + {0x0009005C, "FSCTL_REQUEST_FILTER_OPLOCK"}, + {0x00090060, "FSCTL_FILESYSTEM_GET_STATISTICS"}, + {0x00090064, "FSCTL_GET_NTFS_VOLUME_DATA"}, + {0x00090068, "FSCTL_GET_NTFS_FILE_RECORD"}, + {0x0009006F, "FSCTL_GET_VOLUME_BITMAP"}, + {0x00090073, "FSCTL_GET_RETRIEVAL_POINTERS"}, + {0x00090074, "FSCTL_MOVE_FILE"}, + {0x00090078, "FSCTL_IS_VOLUME_DIRTY"}, + {0x0009007C, "FSCTL_GET_HFS_INFORMATION"}, + {0x00090083, "FSCTL_ALLOW_EXTENDED_DASD_IO"}, + {0x00090087, "FSCTL_READ_PROPERTY_DATA"}, + {0x0009008B, "FSCTL_WRITE_PROPERTY_DATA"}, + {0x0009008F, "FSCTL_FIND_FILES_BY_SID"}, + {0x00090097, "FSCTL_DUMP_PROPERTY_DATA"}, + {0x00098098, "FSCTL_SET_OBJECT_ID"}, + {0x0009009C, "FSCTL_GET_OBJECT_ID"}, + {0x000980A0, "FSCTL_DELETE_OBJECT_ID"}, + {0x000980A4, "FSCTL_SET_REPARSE_POINT"}, + {0x000900A8, "FSCTL_GET_REPARSE_POINT"}, + {0x000980AC, "FSCTL_DELETE_REPARSE_POINT"}, + {0x000940B3, "FSCTL_ENUM_USN_DATA"}, + {0x000940B7, "FSCTL_SECURITY_ID_CHECK"}, + {0x000940BB, "FSCTL_READ_USN_JOURNAL"}, + {0x000980BC, "FSCTL_SET_OBJECT_ID_EXTENDED"}, + {0x000900C0, "FSCTL_CREATE_OR_GET_OBJECT_ID"}, + {0x000980C4, "FSCTL_SET_SPARSE"}, + {0x000980C8, "FSCTL_SET_ZERO_DATA"}, + {0x000940CF, "FSCTL_QUERY_ALLOCATED_RANGES"}, + {0x000980D0, "FSCTL_ENABLE_UPGRADE"}, + {0x000900D4, "FSCTL_SET_ENCRYPTION"}, + {0x000900DB, "FSCTL_ENCRYPTION_FSCTL_IO"}, + {0x000900DF, "FSCTL_WRITE_RAW_ENCRYPTED"}, + {0x000900E3, "FSCTL_READ_RAW_ENCRYPTED"}, + {0x000940E7, "FSCTL_CREATE_USN_JOURNAL"}, + {0x000940EB, "FSCTL_READ_FILE_USN_DATA"}, + {0x000940EF, "FSCTL_WRITE_USN_CLOSE_RECORD"}, + {0x000900F0, "FSCTL_EXTEND_VOLUME"}, + {0, NULL} +}; + static const value_string nt_ioctl_isfsctl_vals[] = { {0, "Device IOCTL"}, {1, "FS control : FSCTL"}, @@ -10486,6 +10579,46 @@ dissect_4_2_16_8(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, return offset; } +/* This dissects the SMB_QUERY_FILE_ALL_INFO + BUT NOT as described in 4.2.16.8. + All SMB_QUERY_FILE_ALL_INFO packets I captured were only correctly + decoded using this function. As you can see, this is very different + from function dissect_4_2_16_8() which implements the documented + format. + XXX I don't know which one we should use. Does someone have + a valid decoding with dissect_4_2_16_8() ? +*/ +static int +dissect_4_2_16_8_unsure(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, + int offset, guint16 *bcp, gboolean *trunc) +{ + + offset = dissect_4_2_16_4(tvb, pinfo, tree, offset, bcp, trunc); + if (*trunc) { + return offset; + } + + /* 4 pad bytes */ + offset+=4; + + offset = dissect_4_2_16_5(tvb, pinfo, tree, offset, bcp, trunc); + if (*trunc) { + return offset; + } + + /* 2 pad bytes */ + offset+=2; + + offset = dissect_4_2_16_6(tvb, pinfo, tree, offset, bcp, trunc); + if (*trunc) { + return offset; + } + + offset = dissect_4_2_16_7(tvb, pinfo, tree, offset, bcp, trunc); + + return offset; +} + /* this dissects the SMB_QUERY_FILE_STREAM_INFO as described in 4.2.16.10 */ @@ -10936,8 +11069,14 @@ dissect_qpi_loi_vals(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, break; case 0x0107: /*Query File All Info*/ case 1018: /* SMB_FILE_ALL_INFORMATION */ +#if 1 offset = dissect_4_2_16_8(tvb, pinfo, tree, offset, bcp, &trunc); +#else + /* see comments before function definition */ + offset = dissect_4_2_16_8_unsure(tvb, pinfo, tree, offset, bcp, + &trunc); +#endif break; case 0x0108: /*Query File Alt File Info*/ case 1021: /* SMB_FILE_ALTERNATE_NAME_INFORMATION */ @@ -11441,12 +11580,7 @@ dissect_transaction_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, /* timeout */ to = tvb_get_letohl(tvb, offset); - if (to == 0) - proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: Return immediately (0)"); - else if (to == 0xffffffff) - proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: Wait indefinitely (-1)"); - else - proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: %s", time_msecs_to_str(to)); + proto_tree_add_uint_format(tree, hf_smb_timeout, tvb, offset, 4, to, "Timeout: %s", smbext20_timeout_msecs_to_str(to)); offset += 4; /* 2 reserved bytes */ @@ -16330,7 +16464,7 @@ proto_register_smb(void) { &hf_smb_nt_ioctl_function_code, { "Function", "smb.nt.ioctl.function", FT_UINT32, BASE_HEX, - NULL, 0, "NT IOCTL function code", HFILL }}, + VALS(nt_ioctl_function_vals), 0, "NT IOCTL function code", HFILL }}, { &hf_smb_nt_ioctl_isfsctl, { "IsFSctl", "smb.nt.ioctl.isfsctl", FT_UINT8, BASE_DEC, |