aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGuy Harris <guy@alum.mit.edu>2002-01-28 00:58:46 +0000
committerGuy Harris <guy@alum.mit.edu>2002-01-28 00:58:46 +0000
commitb3bc97d7f55b895f58bc0d8ab4174042bdde3655 (patch)
treefc2eca37a6b5db25d0b63b8f2905595dbcde0b96
parenteb0f5ed538fe26284c8a5b0d8ccb2aae0d114fbc (diff)
Add support for dissecting NT FILETIME time stamp values.
Get rid of a level of hierarchy in some SMB field names. svn path=/trunk/; revision=4613
-rw-r--r--packet-smb-common.h4
-rw-r--r--packet-smb-logon.c4
-rw-r--r--packet-smb.c307
3 files changed, 188 insertions, 127 deletions
diff --git a/packet-smb-common.h b/packet-smb-common.h
index 5102b97b7b..f8979f62c1 100644
--- a/packet-smb-common.h
+++ b/packet-smb-common.h
@@ -2,7 +2,7 @@
* Routines for SMB packet dissection
* Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com>
*
- * $Id: packet-smb-common.h,v 1.7 2002/01/25 09:42:21 guy Exp $
+ * $Id: packet-smb-common.h,v 1.8 2002/01/28 00:58:46 guy Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
@@ -58,7 +58,7 @@ int display_unicode_string(tvbuff_t *tvb, packet_info *pinfo,
int display_ms_string(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, int hf_index);
-int dissect_smb_64bit_time(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, int offset, char *str, int hf_date);
+int dissect_smb_64bit_time(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, int hf_date);
int dissect_nt_sid(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *parent_tree, char *name);
diff --git a/packet-smb-logon.c b/packet-smb-logon.c
index 0a24135716..135b6f7e6a 100644
--- a/packet-smb-logon.c
+++ b/packet-smb-logon.c
@@ -2,7 +2,7 @@
* Routines for SMB net logon packet dissection
* Copyright 2000, Jeffrey C. Foster <jfoste@woodward.com>
*
- * $Id: packet-smb-logon.c,v 1.24 2002/01/25 09:42:21 guy Exp $
+ * $Id: packet-smb-logon.c,v 1.25 2002/01/28 00:58:46 guy Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
@@ -469,7 +469,7 @@ dissect_announce_change(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int
offset += 8;
offset = dissect_smb_64bit_time(tvb, pinfo, info_tree, offset,
- "NT Date/Time", hf_nt_date_time);
+ hf_nt_date_time);
info_count--;
}
diff --git a/packet-smb.c b/packet-smb.c
index 00c71ac25c..16c3dfa858 100644
--- a/packet-smb.c
+++ b/packet-smb.c
@@ -3,7 +3,7 @@
* Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com>
* 2001 Rewrite by Ronnie Sahlberg and Guy Harris
*
- * $Id: packet-smb.c,v 1.199 2002/01/25 09:42:21 guy Exp $
+ * $Id: packet-smb.c,v 1.200 2002/01/28 00:58:46 guy Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
@@ -562,7 +562,6 @@ static gint ett_smb_lock_type = -1;
static gint ett_smb_ssetupandxaction = -1;
static gint ett_smb_optionsup = -1;
static gint ett_smb_time_date = -1;
-static gint ett_smb_64bit_time = -1;
static gint ett_smb_move_flags = -1;
static gint ett_smb_file_attributes = -1;
static gint ett_smb_search_resume_key = -1;
@@ -1097,23 +1096,86 @@ dissect_smb_UTIME(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offse
return offset;
}
-int
-dissect_smb_64bit_time(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, int offset, char *str, int hf_date)
+#define TIME_FIXUP_CONSTANT (369.0*365.25*24*60*60-(3.0*24*60*60+6.0*60*60))
+
+/*
+ * Translate an 8-byte FILETIME value, given as the upper and lower 32 bits,
+ * to an "nstime_t".
+ * A FILETIME is a 64-bit integer, giving the time since Jan 1, 1601,
+ * midnight "UTC", in 100ns units.
+ * Return TRUE if the conversion succeeds, FALSE otherwise.
+ *
+ * According to the Samba code, it appears to be kludge-GMT (at least for
+ * file listings). This means it's the GMT you get by taking a local time
+ * and adding the server time zone offset. This is NOT the same as GMT in
+ * some cases. However, we don't know the server time zone, so we don't
+ * do that adjustment.
+ *
+ * This code is based on the Samba code:
+ *
+ * Unix SMB/Netbios implementation.
+ * Version 1.9.
+ * time handling functions
+ * Copyright (C) Andrew Tridgell 1992-1998
+ */
+static gboolean
+nt_time_to_nstime(guint32 filetime_high, guint32 filetime_low, nstime_t *tv)
{
- proto_item *item = NULL;
- proto_tree *tree = NULL;
- nstime_t tv;
+ double d;
+ /* The next two lines are a fix needed for the
+ broken SCO compiler. JRA. */
+ time_t l_time_min = TIME_T_MIN;
+ time_t l_time_max = TIME_T_MAX;
- /* XXXX we need some way to represent this as a time
- properly. For now we display everything as 8 bytes*/
+ if (filetime_high == 0)
+ return FALSE;
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 8,
- str);
- tree = proto_item_add_subtree(item, ett_smb_64bit_time);
- }
+ /*
+ * Get the time as a double, in seconds and fractional seconds.
+ */
+ d = ((double)filetime_high)*4.0*(double)(1<<30);
+ d += filetime_low;
+ d *= 1.0e-7;
+
+ /* Now adjust by 369 years, to make the seconds since 1970. */
+ d -= TIME_FIXUP_CONSTANT;
- proto_tree_add_bytes_format(tree, hf_smb_unknown, tvb, offset, 8, tvb_get_ptr(tvb, offset, 8), "%s: can't decode this yet", str);
+ if (!(l_time_min <= d && d <= l_time_max))
+ return FALSE;
+
+ /*
+ * Get the time as seconds and nanoseconds.
+ */
+ tv->secs = d;
+ tv->nsecs = (d - tv->secs)*1000000000;
+
+ return TRUE;
+}
+
+int
+dissect_smb_64bit_time(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, int hf_date)
+{
+ guint32 filetime_high, filetime_low;
+ nstime_t ts;
+
+ if (tree) {
+ filetime_low = tvb_get_letohl(tvb, offset);
+ filetime_high = tvb_get_letohl(tvb, offset + 4);
+ if (filetime_low == 0 && filetime_high == 0) {
+ proto_tree_add_text(tree, tvb, offset, 8,
+ "%s: No time specified (0)",
+ proto_registrar_get_name(hf_date));
+ } else {
+ if (nt_time_to_nstime(filetime_high, filetime_low, &ts)) {
+ proto_tree_add_time(tree, hf_date, tvb,
+ offset, 8, &ts);
+ } else {
+ proto_tree_add_text(tree, tvb, offset, 8,
+ "%s: Time can't be converted",
+ proto_registrar_get_name(hf_date));
+ }
+ }
+ }
offset += 8;
return offset;
@@ -2073,7 +2135,7 @@ dissect_negprot_response(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, in
/* system time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "System Time", hf_smb_system_time);
+ hf_smb_system_time);
/* time zone */
tz = tvb_get_letohs(tvb, offset);
@@ -7280,19 +7342,19 @@ dissect_nt_trans_param_response(tvbuff_t *tvb, packet_info *pinfo, int offset, p
/* create time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Create Time", hf_smb_create_time);
+ hf_smb_create_time);
/* access time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Access Time", hf_smb_access_time);
+ hf_smb_access_time);
/* last write time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Write Time", hf_smb_last_write_time);
+ hf_smb_last_write_time);
/* last change time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Change Time", hf_smb_change_time);
+ hf_smb_change_time);
/* Extended File Attributes */
offset = dissect_file_ext_attr(tvb, pinfo, tree, offset);
@@ -7977,19 +8039,19 @@ dissect_nt_create_andx_response(tvbuff_t *tvb, packet_info *pinfo, proto_tree *t
/* create time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Create Time", hf_smb_create_time);
+ hf_smb_create_time);
/* access time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Access Time", hf_smb_access_time);
+ hf_smb_access_time);
/* last write time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Write Time", hf_smb_last_write_time);
-
+ hf_smb_last_write_time);
+
/* last change time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Change Time", hf_smb_change_time);
+ hf_smb_change_time);
/* Extended File Attributes */
offset = dissect_file_ext_attr(tvb, pinfo, tree, offset);
@@ -9075,25 +9137,25 @@ dissect_4_2_14_4(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
/* create time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Create", hf_smb_create_time);
+ hf_smb_create_time);
*bcp -= 8;
/* access time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Access Time", hf_smb_access_time);
+ hf_smb_access_time);
*bcp -= 8;
/* last write time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Write Time", hf_smb_last_write_time);
+ hf_smb_last_write_time);
*bcp -= 8;
/* last change time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Change Time", hf_smb_change_time);
+ hf_smb_change_time);
*bcp -= 8;
/* File Attributes */
@@ -10169,25 +10231,25 @@ dissect_4_3_4_4(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree,
/* create time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Create Time", hf_smb_create_time);
+ hf_smb_create_time);
*bcp -= 8;
/* access time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Access Time", hf_smb_access_time);
+ hf_smb_access_time);
*bcp -= 8;
/* last write time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Write Time", hf_smb_last_write_time);
+ hf_smb_last_write_time);
*bcp -= 8;
/* last change time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Change Time", hf_smb_change_time);
+ hf_smb_change_time);
*bcp -= 8;
/* end of file */
@@ -10280,25 +10342,25 @@ dissect_4_3_4_5(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree,
/* create time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Create Time", hf_smb_create_time);
+ hf_smb_create_time);
*bcp -= 8;
/* access time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Access Time", hf_smb_access_time);
+ hf_smb_access_time);
*bcp -= 8;
/* last write time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Write Time", hf_smb_last_write_time);
+ hf_smb_last_write_time);
*bcp -= 8;
/* last change time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Change Time", hf_smb_change_time);
+ hf_smb_change_time);
*bcp -= 8;
/* end of file */
@@ -10396,25 +10458,25 @@ dissect_4_3_4_6(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree,
/* create time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Create Time", hf_smb_create_time);
+ hf_smb_create_time);
*bcp -= 8;
/* access time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Access Time", hf_smb_access_time);
+ hf_smb_access_time);
*bcp -= 8;
/* last write time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Write Time", hf_smb_last_write_time);
+ hf_smb_last_write_time);
*bcp -= 8;
/* last change time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Change Time", hf_smb_change_time);
+ hf_smb_change_time);
*bcp -= 8;
/* end of file */
@@ -10767,7 +10829,7 @@ dissect_qfsi_vals(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree,
/* create time */
CHECK_BYTE_COUNT_TRANS_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Create Time", hf_smb_create_time);
+ hf_smb_create_time);
*bcp -= 8;
/* volume serial number */
@@ -14085,7 +14147,7 @@ proto_register_smb(void)
NULL, 0, "Unique token identifying this session", HFILL }},
{ &hf_smb_server_timezone,
- { "Time Zone", "smb.server.timezone", FT_INT16, BASE_DEC,
+ { "Time Zone", "smb.server_timezone", FT_INT16, BASE_DEC,
NULL, 0, "Current timezone at server.", HFILL }},
{ &hf_smb_encryption_key_length,
@@ -14105,7 +14167,7 @@ proto_register_smb(void)
NULL, 0, "Maximum raw buffer size", HFILL }},
{ &hf_smb_server_guid,
- { "Server GUID", "smb.server.guid", FT_BYTES, BASE_HEX,
+ { "Server GUID", "smb.server_guid", FT_BYTES, BASE_HEX,
NULL, 0, "Globally unique identifier for this server", HFILL }},
{ &hf_smb_security_blob_len,
@@ -14161,79 +14223,79 @@ proto_register_smb(void)
NULL, 0, "Current time at server, SMB_TIME format", HFILL }},
{ &hf_smb_server_cap_raw_mode,
- { "Raw Mode", "smb.server.cap.raw_mode", FT_BOOLEAN, 32,
+ { "Raw Mode", "smb.server_cap.raw_mode", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_raw_mode), SERVER_CAP_RAW_MODE, "Are Raw Read and Raw Write supported?", HFILL }},
{ &hf_smb_server_cap_mpx_mode,
- { "MPX Mode", "smb.server.cap.mpx_mode", FT_BOOLEAN, 32,
+ { "MPX Mode", "smb.server_cap.mpx_mode", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_mpx_mode), SERVER_CAP_MPX_MODE, "Are Read Mpx and Write Mpx supported?", HFILL }},
{ &hf_smb_server_cap_unicode,
- { "Unicode", "smb.server.cap.unicode", FT_BOOLEAN, 32,
+ { "Unicode", "smb.server_cap.unicode", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_unicode), SERVER_CAP_UNICODE, "Are Unicode strings supported?", HFILL }},
{ &hf_smb_server_cap_large_files,
- { "Large Files", "smb.server.cap.large_files", FT_BOOLEAN, 32,
+ { "Large Files", "smb.server_cap.large_files", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_large_files), SERVER_CAP_LARGE_FILES, "Are large files (>4GB) supported?", HFILL }},
{ &hf_smb_server_cap_nt_smbs,
- { "NT SMBs", "smb.server.cap.nt_smbs", FT_BOOLEAN, 32,
+ { "NT SMBs", "smb.server_cap.nt_smbs", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_nt_smbs), SERVER_CAP_NT_SMBS, "Are NT SMBs supported?", HFILL }},
{ &hf_smb_server_cap_rpc_remote_apis,
- { "RPC Remote APIs", "smb.server.cap.rpc_remote_apis", FT_BOOLEAN, 32,
+ { "RPC Remote APIs", "smb.server_cap.rpc_remote_apis", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_rpc_remote_apis), SERVER_CAP_RPC_REMOTE_APIS, "Are RPC Remote APIs supported?", HFILL }},
{ &hf_smb_server_cap_nt_status,
- { "NT Status Codes", "smb.server.cap.nt_status", FT_BOOLEAN, 32,
+ { "NT Status Codes", "smb.server_cap.nt_status", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_nt_status), SERVER_CAP_STATUS32, "Are NT Status Codes supported?", HFILL }},
{ &hf_smb_server_cap_level_ii_oplocks,
- { "Level 2 Oplocks", "smb.server.cap.level_2_oplocks", FT_BOOLEAN, 32,
+ { "Level 2 Oplocks", "smb.server_cap.level_2_oplocks", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_level_ii_oplocks), SERVER_CAP_LEVEL_II_OPLOCKS, "Are Level 2 oplocks supported?", HFILL }},
{ &hf_smb_server_cap_lock_and_read,
- { "Lock and Read", "smb.server.cap.lock_and_read", FT_BOOLEAN, 32,
+ { "Lock and Read", "smb.server_cap.lock_and_read", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_lock_and_read), SERVER_CAP_LOCK_AND_READ, "Is Lock and Read supported?", HFILL }},
{ &hf_smb_server_cap_nt_find,
- { "NT Find", "smb.server.cap.nt_find", FT_BOOLEAN, 32,
+ { "NT Find", "smb.server_cap.nt_find", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_nt_find), SERVER_CAP_NT_FIND, "Is NT Find supported?", HFILL }},
{ &hf_smb_server_cap_dfs,
- { "Dfs", "smb.server.cap.dfs", FT_BOOLEAN, 32,
+ { "Dfs", "smb.server_cap.dfs", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_dfs), SERVER_CAP_DFS, "Is Dfs supported?", HFILL }},
{ &hf_smb_server_cap_infolevel_passthru,
- { "Infolevel Passthru", "smb.server.cap.infolevel_passthru", FT_BOOLEAN, 32,
+ { "Infolevel Passthru", "smb.server_cap.infolevel_passthru", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_infolevel_passthru), SERVER_CAP_INFOLEVEL_PASSTHRU, "Is NT information level request passthrough supported?", HFILL }},
{ &hf_smb_server_cap_large_readx,
- { "Large ReadX", "smb.server.cap.large_readx", FT_BOOLEAN, 32,
+ { "Large ReadX", "smb.server_cap.large_readx", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_large_readx), SERVER_CAP_LARGE_READX, "Is Large Read andX supported?", HFILL }},
{ &hf_smb_server_cap_large_writex,
- { "Large WriteX", "smb.server.cap.large_writex", FT_BOOLEAN, 32,
+ { "Large WriteX", "smb.server_cap.large_writex", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_large_writex), SERVER_CAP_LARGE_WRITEX, "Is Large Write andX supported?", HFILL }},
{ &hf_smb_server_cap_unix,
- { "UNIX", "smb.server.cap.unix", FT_BOOLEAN, 32,
+ { "UNIX", "smb.server_cap.unix", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_unix), SERVER_CAP_UNIX , "Are UNIX extensions supported?", HFILL }},
{ &hf_smb_server_cap_reserved,
- { "Reserved", "smb.server.cap.reserved", FT_BOOLEAN, 32,
+ { "Reserved", "smb.server_cap.reserved", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_reserved), SERVER_CAP_RESERVED, "RESERVED", HFILL }},
{ &hf_smb_server_cap_bulk_transfer,
- { "Bulk Transfer", "smb.server.cap.bulk_transfer", FT_BOOLEAN, 32,
+ { "Bulk Transfer", "smb.server_cap.bulk_transfer", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_bulk_transfer), SERVER_CAP_BULK_TRANSFER, "Are Bulk Read and Bulk Write supported?", HFILL }},
{ &hf_smb_server_cap_compressed_data,
- { "Compressed Data", "smb.server.cap.compressed_data", FT_BOOLEAN, 32,
+ { "Compressed Data", "smb.server_cap.compressed_data", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_compressed_data), SERVER_CAP_COMPRESSED_DATA, "Is compressed data transfer supported?", HFILL }},
{ &hf_smb_server_cap_extended_security,
- { "Extended Security", "smb.server.cap.extended_security", FT_BOOLEAN, 32,
+ { "Extended Security", "smb.server_cap.extended_security", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_extended_security), SERVER_CAP_EXTENDED_SECURITY, "Are Extended security exchanges supported?", HFILL }},
{ &hf_smb_system_time,
@@ -14321,91 +14383,91 @@ proto_register_smb(void)
NULL, 0, "FID: File ID", HFILL }},
{ &hf_smb_file_attr_read_only_16bit,
- { "Read Only", "smb.file.attribute.read_only", FT_BOOLEAN, 16,
+ { "Read Only", "smb.file_attribute.read_only", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_read_only), FILE_ATTRIBUTE_READ_ONLY, "READ ONLY file attribute", HFILL }},
{ &hf_smb_file_attr_read_only_8bit,
- { "Read Only", "smb.file.attribute.read_only", FT_BOOLEAN, 8,
+ { "Read Only", "smb.file_attribute.read_only", FT_BOOLEAN, 8,
TFS(&tfs_file_attribute_read_only), FILE_ATTRIBUTE_READ_ONLY, "READ ONLY file attribute", HFILL }},
{ &hf_smb_file_attr_hidden_16bit,
- { "Hidden", "smb.file.attribute.hidden", FT_BOOLEAN, 16,
+ { "Hidden", "smb.file_attribute.hidden", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_hidden), FILE_ATTRIBUTE_HIDDEN, "HIDDEN file attribute", HFILL }},
{ &hf_smb_file_attr_hidden_8bit,
- { "Hidden", "smb.file.attribute.hidden", FT_BOOLEAN, 8,
+ { "Hidden", "smb.file_attribute.hidden", FT_BOOLEAN, 8,
TFS(&tfs_file_attribute_hidden), FILE_ATTRIBUTE_HIDDEN, "HIDDEN file attribute", HFILL }},
{ &hf_smb_file_attr_system_16bit,
- { "System", "smb.file.attribute.system", FT_BOOLEAN, 16,
+ { "System", "smb.file_attribute.system", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_system), FILE_ATTRIBUTE_SYSTEM, "SYSTEM file attribute", HFILL }},
{ &hf_smb_file_attr_system_8bit,
- { "System", "smb.file.attribute.system", FT_BOOLEAN, 8,
+ { "System", "smb.file_attribute.system", FT_BOOLEAN, 8,
TFS(&tfs_file_attribute_system), FILE_ATTRIBUTE_SYSTEM, "SYSTEM file attribute", HFILL }},
{ &hf_smb_file_attr_volume_16bit,
- { "Volume ID", "smb.file.attribute.volume", FT_BOOLEAN, 16,
+ { "Volume ID", "smb.file_attribute.volume", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_volume), FILE_ATTRIBUTE_VOLUME, "VOLUME file attribute", HFILL }},
{ &hf_smb_file_attr_volume_8bit,
- { "Volume ID", "smb.file.attribute.volume", FT_BOOLEAN, 8,
+ { "Volume ID", "smb.file_attribute.volume", FT_BOOLEAN, 8,
TFS(&tfs_file_attribute_volume), FILE_ATTRIBUTE_VOLUME, "VOLUME ID file attribute", HFILL }},
{ &hf_smb_file_attr_directory_16bit,
- { "Directory", "smb.file.attribute.directory", FT_BOOLEAN, 16,
+ { "Directory", "smb.file_attribute.directory", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_directory), FILE_ATTRIBUTE_DIRECTORY, "DIRECTORY file attribute", HFILL }},
{ &hf_smb_file_attr_directory_8bit,
- { "Directory", "smb.file.attribute.directory", FT_BOOLEAN, 8,
+ { "Directory", "smb.file_attribute.directory", FT_BOOLEAN, 8,
TFS(&tfs_file_attribute_directory), FILE_ATTRIBUTE_DIRECTORY, "DIRECTORY file attribute", HFILL }},
{ &hf_smb_file_attr_archive_16bit,
- { "Archive", "smb.file.attribute.archive", FT_BOOLEAN, 16,
+ { "Archive", "smb.file_attribute.archive", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_archive), FILE_ATTRIBUTE_ARCHIVE, "ARCHIVE file attribute", HFILL }},
{ &hf_smb_file_attr_archive_8bit,
- { "Archive", "smb.file.attribute.archive", FT_BOOLEAN, 8,
+ { "Archive", "smb.file_attribute.archive", FT_BOOLEAN, 8,
TFS(&tfs_file_attribute_archive), FILE_ATTRIBUTE_ARCHIVE, "ARCHIVE file attribute", HFILL }},
{ &hf_smb_file_attr_device,
- { "Device", "smb.file.attribute.device", FT_BOOLEAN, 16,
+ { "Device", "smb.file_attribute.device", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_device), FILE_ATTRIBUTE_DEVICE, "Is this file a device?", HFILL }},
{ &hf_smb_file_attr_normal,
- { "Normal", "smb.file.attribute.normal", FT_BOOLEAN, 16,
+ { "Normal", "smb.file_attribute.normal", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_normal), FILE_ATTRIBUTE_NORMAL, "Is this a normal file?", HFILL }},
{ &hf_smb_file_attr_temporary,
- { "Temporary", "smb.file.attribute.temporary", FT_BOOLEAN, 16,
+ { "Temporary", "smb.file_attribute.temporary", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_temporary), FILE_ATTRIBUTE_TEMPORARY, "Is this a temporary file?", HFILL }},
{ &hf_smb_file_attr_sparse,
- { "Sparse", "smb.file.attribute.sparse", FT_BOOLEAN, 16,
+ { "Sparse", "smb.file_attribute.sparse", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_sparse), FILE_ATTRIBUTE_SPARSE, "Is this a sparse file?", HFILL }},
{ &hf_smb_file_attr_reparse,
- { "Reparse Point", "smb.file.attribute.reparse", FT_BOOLEAN, 16,
+ { "Reparse Point", "smb.file_attribute.reparse", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_reparse), FILE_ATTRIBUTE_REPARSE, "Does this file have an associated reparse point?", HFILL }},
{ &hf_smb_file_attr_compressed,
- { "Compressed", "smb.file.attribute.compressed", FT_BOOLEAN, 16,
+ { "Compressed", "smb.file_attribute.compressed", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_compressed), FILE_ATTRIBUTE_COMPRESSED, "Is this file compressed?", HFILL }},
{ &hf_smb_file_attr_offline,
- { "Offline", "smb.file.attribute.offline", FT_BOOLEAN, 16,
+ { "Offline", "smb.file_attribute.offline", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_offline), FILE_ATTRIBUTE_OFFLINE, "Is this file offline?", HFILL }},
{ &hf_smb_file_attr_not_content_indexed,
- { "Content Indexed", "smb.file.attribute.not_content_indexed", FT_BOOLEAN, 16,
+ { "Content Indexed", "smb.file_attribute.not_content_indexed", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_not_content_indexed), FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, "May this file be indexed by the content indexing service", HFILL }},
{ &hf_smb_file_attr_encrypted,
- { "Encrypted", "smb.file.attribute.encrypted", FT_BOOLEAN, 16,
+ { "Encrypted", "smb.file_attribute.encrypted", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_encrypted), FILE_ATTRIBUTE_ENCRYPTED, "Is this file encrypted?", HFILL }},
{ &hf_smb_file_size,
- { "File Size", "smb.file.size", FT_UINT32, BASE_DEC,
+ { "File Size", "smb.file_size", FT_UINT32, BASE_DEC,
NULL, 0, "File Size", HFILL }},
{ &hf_smb_search_attribute_read_only,
@@ -14493,7 +14555,7 @@ proto_register_smb(void)
NULL, 0, "Padding or unknown data", HFILL }},
{ &hf_smb_file_data,
- { "File Data", "smb.file.data", FT_BYTES, BASE_HEX,
+ { "File Data", "smb.file_data", FT_BYTES, BASE_HEX,
NULL, 0, "Data read/written to the file", HFILL }},
{ &hf_smb_total_data_len,
@@ -15116,91 +15178,91 @@ proto_register_smb(void)
TFS(&tfs_nt_share_access_delete), 0x00000004, "", HFILL }},
{ &hf_smb_file_eattr_read_only,
- { "Read Only", "smb.file.attribute.read_only", FT_BOOLEAN, 32,
+ { "Read Only", "smb.file_attribute.read_only", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_read_only), FILE_ATTRIBUTE_READ_ONLY, "READ ONLY file attribute", HFILL }},
{ &hf_smb_file_eattr_hidden,
- { "Hidden", "smb.file.attribute.hidden", FT_BOOLEAN, 32,
+ { "Hidden", "smb.file_attribute.hidden", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_hidden), FILE_ATTRIBUTE_HIDDEN, "HIDDEN file attribute", HFILL }},
{ &hf_smb_file_eattr_system,
- { "System", "smb.file.attribute.system", FT_BOOLEAN, 32,
+ { "System", "smb.file_attribute.system", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_system), FILE_ATTRIBUTE_SYSTEM, "SYSTEM file attribute", HFILL }},
{ &hf_smb_file_eattr_volume,
- { "Volume ID", "smb.file.attribute.volume", FT_BOOLEAN, 32,
+ { "Volume ID", "smb.file_attribute.volume", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_volume), FILE_ATTRIBUTE_VOLUME, "VOLUME file attribute", HFILL }},
{ &hf_smb_file_eattr_directory,
- { "Directory", "smb.file.attribute.directory", FT_BOOLEAN, 32,
+ { "Directory", "smb.file_attribute.directory", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_directory), FILE_ATTRIBUTE_DIRECTORY, "DIRECTORY file attribute", HFILL }},
{ &hf_smb_file_eattr_archive,
- { "Archive", "smb.file.attribute.archive", FT_BOOLEAN, 32,
+ { "Archive", "smb.file_attribute.archive", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_archive), FILE_ATTRIBUTE_ARCHIVE, "ARCHIVE file attribute", HFILL }},
{ &hf_smb_file_eattr_device,
- { "Device", "smb.file.attribute.device", FT_BOOLEAN, 32,
+ { "Device", "smb.file_attribute.device", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_device), FILE_ATTRIBUTE_DEVICE, "Is this file a device?", HFILL }},
{ &hf_smb_file_eattr_normal,
- { "Normal", "smb.file.attribute.normal", FT_BOOLEAN, 32,
+ { "Normal", "smb.file_attribute.normal", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_normal), FILE_ATTRIBUTE_NORMAL, "Is this a normal file?", HFILL }},
{ &hf_smb_file_eattr_temporary,
- { "Temporary", "smb.file.attribute.temporary", FT_BOOLEAN, 32,
+ { "Temporary", "smb.file_attribute.temporary", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_temporary), FILE_ATTRIBUTE_TEMPORARY, "Is this a temporary file?", HFILL }},
{ &hf_smb_file_eattr_sparse,
- { "Sparse", "smb.file.attribute.sparse", FT_BOOLEAN, 32,
+ { "Sparse", "smb.file_attribute.sparse", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_sparse), FILE_ATTRIBUTE_SPARSE, "Is this a sparse file?", HFILL }},
{ &hf_smb_file_eattr_reparse,
- { "Reparse Point", "smb.file.attribute.reparse", FT_BOOLEAN, 32,
+ { "Reparse Point", "smb.file_attribute.reparse", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_reparse), FILE_ATTRIBUTE_REPARSE, "Does this file have an associated reparse point?", HFILL }},
{ &hf_smb_file_eattr_compressed,
- { "Compressed", "smb.file.attribute.compressed", FT_BOOLEAN, 32,
+ { "Compressed", "smb.file_attribute.compressed", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_compressed), FILE_ATTRIBUTE_COMPRESSED, "Is this file compressed?", HFILL }},
{ &hf_smb_file_eattr_offline,
- { "Offline", "smb.file.attribute.offline", FT_BOOLEAN, 32,
+ { "Offline", "smb.file_attribute.offline", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_offline), FILE_ATTRIBUTE_OFFLINE, "Is this file offline?", HFILL }},
{ &hf_smb_file_eattr_not_content_indexed,
- { "Content Indexed", "smb.file.attribute.not_content_indexed", FT_BOOLEAN, 32,
+ { "Content Indexed", "smb.file_attribute.not_content_indexed", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_not_content_indexed), FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, "May this file be indexed by the content indexing service", HFILL }},
{ &hf_smb_file_eattr_encrypted,
- { "Encrypted", "smb.file.attribute.encrypted", FT_BOOLEAN, 32,
+ { "Encrypted", "smb.file_attribute.encrypted", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_encrypted), FILE_ATTRIBUTE_ENCRYPTED, "Is this file encrypted?", HFILL }},
{ &hf_smb_file_eattr_write_through,
- { "Write Through", "smb.file.attribute.write_through", FT_BOOLEAN, 32,
+ { "Write Through", "smb.file_attribute.write_through", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_write_through), FILE_ATTRIBUTE_WRITE_THROUGH, "Does this object need write through?", HFILL }},
{ &hf_smb_file_eattr_no_buffering,
- { "No Buffering", "smb.file.attribute.no_buffering", FT_BOOLEAN, 32,
+ { "No Buffering", "smb.file_attribute.no_buffering", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_no_buffering), FILE_ATTRIBUTE_NO_BUFFERING, "May the server buffer this object?", HFILL }},
{ &hf_smb_file_eattr_random_access,
- { "Random Access", "smb.file.attribute.random_access", FT_BOOLEAN, 32,
+ { "Random Access", "smb.file_attribute.random_access", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_random_access), FILE_ATTRIBUTE_RANDOM_ACCESS, "Optimize for random access", HFILL }},
{ &hf_smb_file_eattr_sequential_scan,
- { "Sequential Scan", "smb.file.attribute.sequential_scan", FT_BOOLEAN, 32,
+ { "Sequential Scan", "smb.file_attribute.sequential_scan", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_sequential_scan), FILE_ATTRIBUTE_SEQUENTIAL_SCAN, "Optimize for sequential scan", HFILL }},
{ &hf_smb_file_eattr_delete_on_close,
- { "Delete on Close", "smb.file.attribute.delete_on_close", FT_BOOLEAN, 32,
+ { "Delete on Close", "smb.file_attribute.delete_on_close", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_delete_on_close), FILE_ATTRIBUTE_DELETE_ON_CLOSE, "Should this object be deleted on close?", HFILL }},
{ &hf_smb_file_eattr_backup_semantics,
- { "Backup", "smb.file.attribute.backup_semantics", FT_BOOLEAN, 32,
+ { "Backup", "smb.file_attribute.backup_semantics", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_backup_semantics), FILE_ATTRIBUTE_BACKUP_SEMANTICS, "Does this object need/support backup semantics", HFILL }},
{ &hf_smb_file_eattr_posix_semantics,
- { "Posix", "smb.file.attribute.posix_semantics", FT_BOOLEAN, 32,
+ { "Posix", "smb.file_attribute.posix_semantics", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_posix_semantics), FILE_ATTRIBUTE_POSIX_SEMANTICS, "Does this object need/support POSIX semantics?", HFILL }},
{ &hf_smb_sec_desc_len,
@@ -15524,19 +15586,19 @@ proto_register_smb(void)
NULL, 0, "Length of Short (8.3) File Name", HFILL }},
{ &hf_smb_fs_id,
- { "FS Id", "smb.fs.id", FT_UINT32, BASE_DEC,
+ { "FS Id", "smb.fs_id", FT_UINT32, BASE_DEC,
NULL, 0, "File System ID (NT Server always returns 0)", HFILL }},
{ &hf_smb_sector_unit,
- { "Sectors/Unit", "smb.fs.sector_per_unit", FT_UINT32, BASE_DEC,
+ { "Sectors/Unit", "smb.fs_sector_per_unit", FT_UINT32, BASE_DEC,
NULL, 0, "Sectors per allocation unit", HFILL }},
{ &hf_smb_fs_units,
- { "Total Units", "smb.fs.units", FT_UINT32, BASE_DEC,
+ { "Total Units", "smb.fs_units", FT_UINT32, BASE_DEC,
NULL, 0, "Total number of units on this filesystem", HFILL }},
{ &hf_smb_fs_sector,
- { "Bytes per Sector", "smb.fs.bytes_per_sector", FT_UINT32, BASE_DEC,
+ { "Bytes per Sector", "smb.fs_bytes_per_sector", FT_UINT32, BASE_DEC,
NULL, 0, "Bytes per sector", HFILL }},
{ &hf_smb_avail_units,
@@ -15560,15 +15622,15 @@ proto_register_smb(void)
NULL, 0, "Number of free allocation units", HFILL }},
{ &hf_smb_max_name_len,
- { "Max name length", "smb.fs.max_name_len", FT_UINT32, BASE_DEC,
+ { "Max name length", "smb.fs_max_name_len", FT_UINT32, BASE_DEC,
NULL, 0, "Maximum length of each file name component in number of bytes", HFILL }},
{ &hf_smb_fs_name_len,
- { "Label Length", "smb.fs.name.len", FT_UINT32, BASE_DEC,
+ { "Label Length", "smb.fs_name.len", FT_UINT32, BASE_DEC,
NULL, 0, "Length of filesystem name in bytes", HFILL }},
{ &hf_smb_fs_name,
- { "FS Name", "smb.fs.name", FT_STRING, BASE_DEC,
+ { "FS Name", "smb.fs_name", FT_STRING, BASE_DEC,
NULL, 0, "Name of filesystem", HFILL }},
{ &hf_smb_device_char_removable,
@@ -15600,31 +15662,31 @@ proto_register_smb(void)
TFS(&tfs_device_char_virtual), 0x00000040, "Is this a virtual device", HFILL }},
{ &hf_smb_fs_attr_css,
- { "Case Sensitive Search", "smb.fs.attr.css", FT_BOOLEAN, 32,
+ { "Case Sensitive Search", "smb.fs_attr.css", FT_BOOLEAN, 32,
TFS(&tfs_fs_attr_css), 0x00000001, "Does this FS support Case Sensitive Search?", HFILL }},
{ &hf_smb_fs_attr_cpn,
- { "Case Preserving", "smb.fs.attr.cpn", FT_BOOLEAN, 32,
+ { "Case Preserving", "smb.fs_attr.cpn", FT_BOOLEAN, 32,
TFS(&tfs_fs_attr_cpn), 0x00000002, "Will this FS Preserve Name Case?", HFILL }},
{ &hf_smb_fs_attr_pacls,
- { "Persistent ACLs", "smb.fs.attr.pacls", FT_BOOLEAN, 32,
+ { "Persistent ACLs", "smb.fs_attr.pacls", FT_BOOLEAN, 32,
TFS(&tfs_fs_attr_pacls), 0x00000004, "Does this FS support Persistent ACLs?", HFILL }},
{ &hf_smb_fs_attr_fc,
- { "Compression", "smb.fs.attr.fc", FT_BOOLEAN, 32,
+ { "Compression", "smb.fs_attr.fc", FT_BOOLEAN, 32,
TFS(&tfs_fs_attr_fc), 0x00000008, "Does this FS support File Compression?", HFILL }},
{ &hf_smb_fs_attr_vq,
- { "Volume Quotas", "smb.fs.attr.vq", FT_BOOLEAN, 32,
+ { "Volume Quotas", "smb.fs_attr.vq", FT_BOOLEAN, 32,
TFS(&tfs_fs_attr_vq), 0x00000010, "Does this FS support Volume Quotas?", HFILL }},
{ &hf_smb_fs_attr_dim,
- { "Mounted", "smb.fs.attr.dim", FT_BOOLEAN, 32,
+ { "Mounted", "smb.fs_attr.dim", FT_BOOLEAN, 32,
TFS(&tfs_fs_attr_dim), 0x00000020, "Is this FS a Mounted Device?", HFILL }},
{ &hf_smb_fs_attr_vic,
- { "Compressed", "smb.fs.attr.vic", FT_BOOLEAN, 32,
+ { "Compressed", "smb.fs_attr.vic", FT_BOOLEAN, 32,
TFS(&tfs_fs_attr_vic), 0x00008000, "Is this FS Compressed?", HFILL }},
{ &hf_smb_sec_desc_revision,
@@ -15764,7 +15826,6 @@ proto_register_smb(void)
&ett_smb_ssetupandxaction,
&ett_smb_optionsup,
&ett_smb_time_date,
- &ett_smb_64bit_time,
&ett_smb_move_flags,
&ett_smb_file_attributes,
&ett_smb_search_resume_key,