aboutsummaryrefslogtreecommitdiffstats
path: root/packet-smb.c
AgeCommit message (Collapse)AuthorFilesLines
2002-04-30From Joerg Mayer: get rid of unused "pinfo" argument toGuy Harris1-35/+9
"dissect_nt_sec_desc()". Also, get rid of code to handle lengths of -1 in "dissect_nt_sec_desc()" - we never pass it a length of -1, as security descriptors aren't sent over the wire with NDR syntax. svn path=/trunk/; revision=5317
2002-04-30Get rid of some unused arguments, and mark some others as unused.Guy Harris1-324/+304
Remove the declaration of "dissect_nt_sid()" from "packet-dcerpc-samr.c"; get it by including "packet-smb-common.h", instead. svn path=/trunk/; revision=5313
2002-04-29There's no need to allocate and fill in an array of sub-authorities andGuy Harris1-27/+19
then later construct the sub-authority string from that array; we can just construct the string as we fetch the sub-authorities. Given that we're doing that, use the cleanup handler to free the string, so that we don't leak memory if we throw an exception when fetching the RID, for example. svn path=/trunk/; revision=5294
2002-04-29Removal (or, at least, #ifdeffing out) of unused variables andGuy Harris1-6/+6
functions, from David Frascone. svn path=/trunk/; revision=5288
2002-04-28Put in a note about the "primary domain" in the Negotiate ProtocolGuy Harris1-1/+7
response if the negotiated dialect is Windows for Workgroups 3.1a. svn path=/trunk/; revision=5264
2002-04-27Fix the test in "dissect_smb_datetime()" for "no date/time specified"Guy Harris1-7/+84
values. Note that in a Negotiate Protocol response, the primary domain won't be present if the negotiated dialect isn't "DOS LANMAN 2.1" or "LANMAN2.1". At least for Info Standard replies for Transaction2 Find First2 requests, if the request had the "return resume keys" flag set, the reply will have a resume key at the beginning of each entry. We assume that to be the case for Info Query EA Size and Info QUery EAs From List; it does *not* appear to be the case for Find File Directory Info, Find File Full Directory Info, or Find File Both Directory Info (they don't have it even if the flag is set, at least in the captures I've seen). The length of the name string in Find First2 entries doesn't include the terminating '\0'; count that as well. svn path=/trunk/; revision=5259
2002-04-24Sometimes there is some junk at the end of an ACE so use the size fieldTim Potter1-3/+9
within the ACE to work out where the end is. svn path=/trunk/; revision=5235
2002-04-24Added 'invalid security descriptor' error to list of dos errors.Tim Potter1-1/+2
svn path=/trunk/; revision=5234
2002-04-23Clean up the descriptions of reassembly preferences.Guy Harris1-3/+3
svn path=/trunk/; revision=5230
2002-04-22Support for NT Rename SMB, from Steven French.Guy Harris1-3/+82
svn path=/trunk/; revision=5217
2002-04-22Fix the return value of "dissect_nt_sec_desc()".Guy Harris1-3/+5
svn path=/trunk/; revision=5213
2002-04-22Correctly dissect LSA security descriptors, at least as they appearGuy Harris1-13/+33
inside a Netlogon security descriptor. Correctly dissect NT security descriptors as they appear inside an LSA security descriptor (at least as those appear inside a Netlogon security descriptor) - they get sent over the wire, apparently, as an opaque blob from the point of view of DCE RPC, at least from one capture I've seen, they do *not* get sent over the wire in DCE RPC NDR syntax. svn path=/trunk/; revision=5212
2002-04-17Bugfixes for LSA dissector and a small change to the security_descriptor ↵Ronnie Sahlberg1-8/+14
dissector in packet-smb.c so we can call it from DCERPC NDR encoded services. svn path=/trunk/; revision=5194
2002-04-16Do the standard "next entry offset" stuff in NT NOTIFY replies, so as toGuy Harris1-2/+25
1) handle inter-entry padding; 2) quit when the "next entry offset" is 0 (that being the signal for the last entry). svn path=/trunk/; revision=5171
2002-04-09Fixed two instances where si->sip was being not checked for NULL beforeTim Potter1-3/+3
being dereferenced. svn path=/trunk/; revision=5137
2002-04-08More static-ization.Gilbert Ramirez1-2/+2
svn path=/trunk/; revision=5131
2002-03-29copylen should be unsigned when we check the range since tvb_memcpy will be ↵Ronnie Sahlberg1-2/+2
upset if a negative value is passed as len svn path=/trunk/; revision=5044
2002-03-27The Unicode Consortium's country code table has been updated toGuy Harris1-8/+7
incorporate the fixes I sent them, so it now matches what we have. svn path=/trunk/; revision=5032
2002-03-27In the protocol tree entries for lists of fragments/segments, make theGuy Harris1-16/+20
top-level item correspond to the reassembled data, and make the item for each fragment/segment correspond to the part of that reassembled data that came from that fragment/segment. svn path=/trunk/; revision=5025
2002-03-26The Unicode Consortium's table has some errors in it; fix those errorsGuy Harris1-4/+14
in our table. svn path=/trunk/; revision=5023
2002-03-25The Cygwin "winnls.h" header, and the Microsoft "winnls.h" headers, saysGuy Harris1-4/+9
that a country code of 0 is for the "default", presumably meaning "don't override the setting on the desktop machine" or something such as that. svn path=/trunk/; revision=5015
2002-03-20When dissecting an SID with more than 4 authorities, increment theGuy Harris1-1/+2
offset to go past the last authority (the RID). svn path=/trunk/; revision=4991
2002-03-20Handle Read operations on IPC trees as DCE RPC.Guy Harris1-5/+31
svn path=/trunk/; revision=4989
2002-03-19Express the RID separately of more than 4 sub-authorities. It is always theRichard Sharpe1-5/+15
last sub-authority. svn path=/trunk/; revision=4988
2002-03-19Treat WriteAndX operations on IPC trees as containing DCERPC callGuy Harris1-5/+17
information, just as is done for Write. Squelch a compiler warning. svn path=/trunk/; revision=4987
2002-03-19Tiny quota updatesRonnie Sahlberg1-9/+21
svn path=/trunk/; revision=4980
2002-03-18Quota updates. GetUserQuota implemented and support for list of userquota ↵Ronnie Sahlberg1-20/+47
structures svn path=/trunk/; revision=4970
2002-03-18Add dissection of one more bit in Quota FS Flags bitmaskRonnie Sahlberg1-2/+21
svn path=/trunk/; revision=4969
2002-03-17quota update partial NTGetUserQuota supportRonnie Sahlberg1-2/+11
svn path=/trunk/; revision=4964
2002-03-17Partial dissection of NT Set User Quota data blockRonnie Sahlberg1-11/+54
svn path=/trunk/; revision=4963
2002-03-17SMB Quota updatesRonnie Sahlberg1-8/+48
svn path=/trunk/; revision=4962
2002-03-17Updates for NT QUOTA in packet-smb.cRonnie Sahlberg1-102/+84
svn path=/trunk/; revision=4961
2002-03-16The service is just called "IPC"; the pipe is what's called "IPC$".Guy Harris1-2/+2
svn path=/trunk/; revision=4957
2002-03-16Whether the data returned from a read or sent in a write is DCERPCGuy Harris1-11/+33
traffic or not, that data doesn't include the padding; handle padding if you're dissecting it as DCERPC traffic. Don't treat the traffic as DCERPC traffic unless it's to the IPC$ share. svn path=/trunk/; revision=4956
2002-03-16There is no guarantee that, when processing an SMB response, "si->sip"Guy Harris1-3/+5
is non-null, as there's no guarantee that the corresponding SMB request is in the capture. Check whether it's null before using it. svn path=/trunk/; revision=4954
2002-03-16A new type of DCERPC over SMB transport.Ronnie Sahlberg1-22/+69
I have captures with w2k speaking DCERPC without using the normal Transaction named pipes SMBs. Instead DCERPC is just implemented ontop of ordinary read/write calls. The smb dissector now examines TreeConnectAndX and stores the conversation/tid/type-of-share in a table for later access. All SMB requests examine that hash table to find out if TID in the header refers to a normal share or an IPC$ share. Initial support in read/write SMB calls to detect if the operations are for an IPC share and thus it assumes it must be DCERPC commands in the payload. Desegmentation/Reassembly of these types of calls are not implemented yet. svn path=/trunk/; revision=4952
2002-03-15Pretty up the SID dissector ...Richard Sharpe1-16/+28
svn path=/trunk/; revision=4948
2002-03-15Moved the value_string for MS country codes from packet-dcerpc-nt.c toRonnie Sahlberg1-1/+112
packet-smb.c so that packet-smb-pipe.c can reference this struct as well. svn path=/trunk/; revision=4947
2002-03-15Added error messages for invalid name and invalid form size.Tim Potter1-1/+3
svn path=/trunk/; revision=4946
2002-03-14Clean up the display of the top-level item for the NT ACE Flags, so thatGuy Harris1-13/+16
there's a space after the colon, and so that there's no extra comma at the end and only one space between the items. Fix a typo. svn path=/trunk/; revision=4940
2002-03-10Absolute and Relative times were swapped. Also add comment that there seemsRonnie Sahlberg1-3/+7
to be an unknown special time constant : 0x40000000 00000000 that we dont know yet what it means. svn path=/trunk/; revision=4915
2002-03-09No need to put ", N byte{s} at offset O" into the Info column twice;Guy Harris1-6/+1
once is enough. svn path=/trunk/; revision=4901
2002-02-27Display a different message in the COL_INFO field for anonymous sessionTim Potter1-3/+9
setup packets. svn path=/trunk/; revision=4818
2002-02-22Fixed up value_string for SMBE_unknownlevel error.Tim Potter1-2/+2
svn path=/trunk/; revision=4785
2002-02-22Initial quota support, from Ronnie Sahlberg.Guy Harris1-1/+120
svn path=/trunk/; revision=4771
2002-02-21Use the right format (one with a numerical format item rather than aGuy Harris1-2/+3
string format item) as the third argument to "val_to_str()". svn path=/trunk/; revision=4770
2002-02-21Export dissect_nt_sec_desc() so it can be used by other dissectors.Tim Potter1-3/+4
A NT security descriptor can be either revision 1 or 2 and seem to be the same format on the wire. svn path=/trunk/; revision=4768
2002-02-20From Ronnie Sahlberg: add the actual SMB command to the structure thatGuy Harris1-14/+43
remembers SMBs for request/response matching, and make sure the request and the response have the same type (or that the response has a different type but is a valid response to the request). svn path=/trunk/; revision=4763
2002-02-18Don't give tvbuffs names; instead, give data sources names, where aGuy Harris1-5/+5
"data source" has a name and a top-level tvbuff, and frames can have a list of data sources associated with them. Use the tvbuff pointer to determine which data source is the data source for a given field; this means we don't have to worry about multiple data sources with the same name - the only thing the name does is label the notebook tab for the display of the data source, and label the hex dump of the data source in print/Tethereal output. Clean up a bunch of things discovered in the process of doing the above. svn path=/trunk/; revision=4749
2002-02-14From Tim Potter:Guy Harris1-11/+55
- For selected read and write SMBs, display the byte count and offset in the info column. This makes browsing file read/writes easier to understand. - In dissect_nt_sids() sometimes the version number is 3 but the rest of the sid format remains the same. This is purely by observation - I have no documentation to confirm this. - Use a GString instead of a fixed buffer in dissect_nt_sids(). svn path=/trunk/; revision=4733
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-24 16:23:53 +0000