diff options
| author | Ronnie Sahlberg <ronnie_sahlberg@ozemail.com.au> | 2005-12-21 08:48:59 +0000 |
|---|---|---|
| committer | Ronnie Sahlberg <ronnie_sahlberg@ozemail.com.au> | 2005-12-21 08:48:59 +0000 |
| commit | 8aca1c1c529878989aebfe6c1d3f9c5e0c8dc531 (patch) | |
| tree | 49905cac22e6a246a2101a7125b9782e5f7a7b84 | |
| parent | 5a0d95fa7665bbb6045ae028aed8bf852e78b636 (diff) | |
add dissection of two more NTCreateAndX bits :
open by file id
and
backup intent
svn path=/trunk/; revision=16869
| -rw-r--r-- | epan/dissectors/packet-smb.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/epan/dissectors/packet-smb.c b/epan/dissectors/packet-smb.c index 28deab0887..451b940cb4 100644 --- a/epan/dissectors/packet-smb.c +++ b/epan/dissectors/packet-smb.c @@ -425,6 +425,8 @@ static int hf_smb_nt_create_options_no_ea_knowledge = -1; static int hf_smb_nt_create_options_eight_dot_three_only = -1; static int hf_smb_nt_create_options_random_access = -1; static int hf_smb_nt_create_options_delete_on_close = -1; +static int hf_smb_nt_create_options_open_by_fileid = -1; +static int hf_smb_nt_create_options_backup_intent = -1; static int hf_smb_nt_share_access_read = -1; static int hf_smb_nt_share_access_write = -1; static int hf_smb_nt_share_access_delete = -1; @@ -7128,6 +7130,14 @@ static const true_false_string tfs_nt_create_options_delete_on_close = { "The file should be deleted when it is closed", "The file should not be deleted when it is closed" }; +static const true_false_string tfs_nt_create_options_open_by_fileid = { + "OpenByFileID bit is SET", + "OpenByFileID is NOT set" +}; +static const true_false_string tfs_nt_create_options_backup_intent = { + "This is a create with BACKUP INTENT", + "This is a normal create" +}; int dissect_nt_create_options(tvbuff_t *tvb, proto_tree *parent_tree, int offset) @@ -7169,6 +7179,10 @@ dissect_nt_create_options(tvbuff_t *tvb, proto_tree *parent_tree, int offset) tvb, offset, 4, mask); proto_tree_add_boolean(tree, hf_smb_nt_create_options_delete_on_close, tvb, offset, 4, mask); + proto_tree_add_boolean(tree, hf_smb_nt_create_options_open_by_fileid, + tvb, offset, 4, mask); + proto_tree_add_boolean(tree, hf_smb_nt_create_options_backup_intent, + tvb, offset, 4, mask); offset += 4; @@ -16897,12 +16911,18 @@ proto_register_smb(void) { &hf_smb_nt_create_options_delete_on_close, { "Delete On Close", "smb.nt.create_options.delete_on_close", FT_BOOLEAN, 32, TFS(&tfs_nt_create_options_delete_on_close), 0x00001000, "Should the file be deleted when closed?", HFILL }}, + { &hf_smb_nt_create_options_open_by_fileid, + { "Open By FileID", "smb.nt.create_options.open_by_fileid", FT_BOOLEAN, 32, + TFS(&tfs_nt_create_options_open_by_fileid), 0x00002000, "Open file by inode", HFILL }}, /* 0x00002000 is "open by FID", or something such as that (which I suspect is like "open by inumber" on UNIX), at least in "NtCreateFile()" and "NtOpenFile()"; is that sent over the wire? NetMon thinks so, but see previous comment. */ + { &hf_smb_nt_create_options_backup_intent, + { "Backup Intent", "smb.nt.create_options.backup_intent", FT_BOOLEAN, 32, + TFS(&tfs_nt_create_options_backup_intent), 0x00004000, "Is this opened by BACKUP ADMIN for backup intent?", HFILL }}, /* 0x00004000 is "open for backup", at least in "NtCreateFile()" and "NtOpenFile()"; is that sent over the wire? NetMon thinks so, but see previous comment. */ |