aboutsummaryrefslogtreecommitdiffstats
path: root/packet-smb.c
AgeCommit message (Collapse)AuthorFilesLines
2001-11-12Transaction2 tvbuffified, and support added for many Transaction2 SMBs,Guy Harris1-1301/+4276
from Ronnie Sahlberg. Various other bug fixes, cleanups, and other improvements. svn path=/trunk/; revision=4193
2001-11-11Dissect the NT create option bits. (Well, some of them, anyway.)Guy Harris1-35/+149
svn path=/trunk/; revision=4192
2001-11-10Change from Tim Potter to show the error status in the Info column forGuy Harris1-21/+171
SMBs that got errors. Add some additional access mask bits, and the URL of another spec. svn path=/trunk/; revision=4191
2001-11-09Microsoft calls it "Dfs", not "DFS", perhaps to avoid confusion with theGuy Harris1-6/+6
OSF's DCE DFS (which is completely unrelated to Dfs). svn path=/trunk/; revision=4190
2001-11-09NT Create and X support, from Ronnie Sahlberg.Guy Harris1-7/+280
"#if 0" out an unused routine, pending determination of whether there's any place that would use it. Fix some typos. Display the NT create options in hex, as they appear to be a bitmask. svn path=/trunk/; revision=4189
2001-11-09Tvbuffification of SMB print commands, from Ronnie Sahlberg.Guy Harris1-430/+350
Fix up some SMBs I missed when adding the byte-count checks. svn path=/trunk/; revision=4183
2001-11-08Print the create flags with 8 hex digits.Guy Harris1-17/+26
Add some checks of the return value of "get_unicode_or_ascii_string_tvb()" - if a null terminator is missing, it might well run past the end of the byte parameters - and add some code to keep the byte count updated so that the right byte count is passed to "get_unicode_or_ascii_string_tvb()". svn path=/trunk/; revision=4180
2001-11-08Put the stuff to handle file data in read and write requests into aGuy Harris1-137/+148
common subroutine. Label the "total data length" field in Write Raw and Write Multiplexed requests as such. Dissect the IPC State/Device State field of Open and X requests and NT Create and X requests ass per the stuff on page 67 of ftp://ftp.microsoft.com/developr/drg/CIFS/dosextp.txt Make a variable that doesn't need to be static not static. svn path=/trunk/; revision=4179
2001-11-08NT Transact dissection, from Ronnie Sahlberg.Guy Harris1-7/+1876
svn path=/trunk/; revision=4178
2001-11-07"dissect_open_print_file_smb()" was defined but not used; put it intoGuy Harris1-2/+2
the appropriate entry in the "dissect[]" table. svn path=/trunk/; revision=4176
2001-11-07Further tvbuffication from Ronnie Sahlberg.Guy Harris1-2990/+1928
Get rid of a bunch of stuff for which said tvbuffication removes the need. When dissecting byte parameters, make sure you don't consume more bytes than the byte count, and handle captures where the last string in the byte parameters area isn't properly null-terminated (I think I've seen that in packets from various versions of Windows NT). Make various bitfields given as decimal in SMB specs decimal. svn path=/trunk/; revision=4172
2001-11-05Fix the previous change to handle SMBs with tvbuffified dissectors.Guy Harris1-2/+2
svn path=/trunk/; revision=4161
2001-11-05Put andX commands at the same level as the first command.Guy Harris1-2/+4
svn path=/trunk/; revision=4160
2001-11-05Put in some references.Guy Harris1-1/+26
svn path=/trunk/; revision=4159
2001-11-05Further tvbuffication, from Ronnie Sahlberg.Guy Harris1-1333/+770
Convert a bunch of "proto_tree_add_XXX" calls to "proto_tree_add_item" calls. svn path=/trunk/; revision=4158
2001-11-05Futher tvbuffification from Ronnie Sahlberg.Guy Harris1-888/+506
Do more sanity checking on DOS dates and times. Convert a bunch of "proto_tree_add_XXX" calls to "proto_tree_add_item" calls. Put the word and byte data for untvbuffified SMBs under a subtree just as is done for tvbuffified SMBs. Get rid of some no-longer-used routines. Fix some displays in untvbuffified SMBs to resemble the way those fields are displayed for tvbuffified SMBs. Display timesouts as seconds and milliseconds when they're in units of milliseconds. svn path=/trunk/; revision=4157
2001-11-04Further tvbuffication, from Ronnie Sahlberg.Guy Harris1-2288/+1466
Make it possible for a non-tvbuffied dissector for an andX SMB to call a tvbuffified dissector for the andX command, and fix the non-tvbuffified dissectors in question to do so. svn path=/trunk/; revision=4154
2001-11-04More tvbuffication, from Ronnie Sahlberg.Guy Harris1-760/+437
When converting DOS-date years to "struct tm" years, add 1980 and subtract 1900, to make it clearer what the conversion involves (DOS-date years are (year - 1980); "struct tm" years are (year - 1900)). svn path=/trunk/; revision=4146
2001-11-03Check for a zero word count in LogoffandX requests and replies.Guy Harris1-37/+45
svn path=/trunk/; revision=4145
2001-11-03Clean up the display of the Flags and Flags2 fields, and add a missingGuy Harris1-52/+63
bit to Flags2. svn path=/trunk/; revision=4140
2001-11-03Tvbuffification of Negotiate Protocol, from Ronnie Sahlberg.Guy Harris1-580/+972
Fix up Info column to put "Request" or "Response" *after* the name of the request. Give the Negotiate Protocol request its full name. svn path=/trunk/; revision=4139
2001-11-03First tvbuffication change, from Ronnie Sahlberg. Also changes SMBGuy Harris1-653/+1126
command names to match later SMB specs. svn path=/trunk/; revision=4138
2001-11-03Rename the "private" member of the "packet_info" structure toGuy Harris1-2/+2
"private_data", to keep C++ compilers from getting heartburn. svn path=/trunk/; revision=4130
2001-10-20Properly handle the andX command in a LockingAndX message.Guy Harris1-13/+14
Fix up some closing braces. svn path=/trunk/; revision=4049
2001-09-30Make several of the fields in the SMB header filterable.Guy Harris1-192/+49
Get rid of the "unknown-0xXX" entries in the "value_string" table for SMB command codes - they make it much more painful to select one of them in the filter-editing dialog box. svn path=/trunk/; revision=3985
2001-09-29Use tvbuff routines to extract data from the SMB header.Guy Harris1-65/+57
svn path=/trunk/; revision=3974
2001-09-29Start the process of tvbuffifying the SMB dissector - give it aGuy Harris1-18/+26
tvbuffified heuristic-dissector interface, but have it immediately turn its arguments into an old-style buffer pointer and offset. Register the SMB dissector as a heuristic NetBIOS dissector, and have "dissect_netbios_payload()" just try the heuristics, as it no longer has to call the SMB dissector explicitly. svn path=/trunk/; revision=3973
2001-09-28From Todd Sabin: dissect the auth info in connection oriented dcerpcGuy Harris1-6/+22
packets. Make a "dissect_netbios_payload()" routine, called from the NetBIOS-over-802.2 (NBF), NetBIOS-over-IPX, and NetBIOS-over-TCP dissectors. Take Todd Sabin's changes to add a heuristic dissector list to the NBSS dissector, and apply them to "dissect_netbios_payload()" instead. Make the SMB dissector heuristic, returning FALSE if it doesn't see 0xFF S M B at the beginning of the packet, and have "dissect_netbios_payload()" first try the heuristic dissector list, then try the SMB dissector if no other heuristic dissector claims the packet, then just dissect the payload as data. From Todd Sabin: have the DCE/RPC dissector register as a heuristic dissector for NetBIOS. svn path=/trunk/; revision=3969
2001-09-28WordCount is unsigned, so test for "WordCount != 0" rather thanGuy Harris1-54/+40
"WordCount > 0". Always put the byte count field into the protocol tree, regardless of whether WordCount is 0 - it's not one of the word parameters counted by WordCount, so it's present even if WordCount is 0. Fix a "val_to_str()" call. svn path=/trunk/; revision=3966
2001-09-28Base decisions on whether to dump the word parameters on the word countGuy Harris1-113/+152
value being non-zero, not on whether the error code is zero. Don't bother passing the error code to dissectors for particular SMBs, as they don't need to use it. In "get_unicode_or_ascii_string()", when aligning to an even boundary, align to an even boundary in the SMB message, not in the packet as a whole - there's no guarantee that there are an even number of bytes in the frame before the SMB message. In the Info column, mark the packet as a request or response based on the request/response bit in the Flags field, not on the matched port - for NBIPX, the source and destination ports (IPX sockets) may be the same, so you may not be able to determine whether it's a request or a response based on that. svn path=/trunk/; revision=3965
2001-09-27Add support for NT error codes.Guy Harris1-2/+741
svn path=/trunk/; revision=3962
2001-09-27Handle interim Transact2 responses correctly.Guy Harris1-3/+46
Mark interim responses as such in the Info column. svn path=/trunk/; revision=3961
2001-09-11The byte count field in an SMB Write request counts not only the dataGuy Harris1-4/+4
being written, but the 2 bytes of data length and one byte of buffer type preceding that data; use the data length (which doesn't count itself or the buffer type byte), rather than the byte count, to determine how much data is being written. svn path=/trunk/; revision=3917
2001-09-03Instead of having a single datum attached to a conversation, have a listGuy Harris1-3/+3
of protocol-id-plus-datum pairs, so that multiple protocols can attach information to the same conversation. Dissectors that attach information to a conversation should not assume that if they find a conversation it has one of its data attached to it; the conversation might've been created by another dissector. svn path=/trunk/; revision=3901
2001-08-27Put in a comment noting that the "Service" string in a Tree Connect andGuy Harris1-2/+6
X reply is always in ASCII. svn path=/trunk/; revision=3877
2001-08-27Handle the "Native File System" string in a TconX response as ASCII orGuy Harris1-4/+4
Unicode based on whether strings in the SMB are ASCII or Unicode. svn path=/trunk/; revision=3876
2001-08-27Use the descriptor strings when dissecting remote APIs; this lets usGuy Harris1-1/+12
handle null pointer entries, and lets us make the dissection of those APIs more table-driven. svn path=/trunk/; revision=3873
2001-08-27Show the Capabilities field in a Session Setup and X request as a 32-bitGuy Harris1-3/+9
value. Put in a comment noting what may be *another* bug in some versions of Windows when constructing Session Setup and X requests. svn path=/trunk/; revision=3871
2001-08-27Show buffer formats symbolically as well as numerically.Guy Harris1-26/+85
svn path=/trunk/; revision=3870
2001-08-27Fix a number of SMB dissectors to correctly handle ASCII and UnicodeGuy Harris1-51/+65
strings, based on whether the "strings are Unicode" bit is set in the SMB header or not. svn path=/trunk/; revision=3869
2001-08-27Make a routine to handle fetching strings that are Unicode or ASCIIGuy Harris1-91/+512
depending on the setting of the "Strings are Unicode" bit in the SMB. Correctly handle Unicode strings in Session Setup and X and Tree Connect and X messages. Always display the Word Count and Byte Count fields of a Session Setup and X message, regardless of whether we recognize the word count value as one we can handle or not. Correctly handle Session Setup and X messages if extended security exchanges are being used. Decode the (known) bits of the Action field in an Session Setup and X message, and the (known) bits of the optional flags field of a Tree Connect and X message. Show the optional flags field as a 16-bit hex quantity. svn path=/trunk/; revision=3868
2001-08-11Fix a typo in a comment.Guy Harris1-2/+2
svn path=/trunk/; revision=3842
2001-08-11In the Info column for transaction responses for which we don't have theGuy Harris1-5/+5
matching request, or for responses where we don't have the pathname/transaction code of the matching request, indicate the SMB opcode of the transaction, rather than just saying it's a response to a generic message. svn path=/trunk/; revision=3841
2001-08-11If the matching request for a transaction reply wasn't found, so that weGuy Harris1-16/+16
don't know the path name, don't give up, just show the parameters and data, as is done with transactions that aren't mailslot browser transactions or LANMAN RAP pipe transactions. svn path=/trunk/; revision=3840
2001-08-11Display padding and data fields in transaction requests/replies as hex,Guy Harris1-7/+14
not as text; it's rarely, if ever, pure text. svn path=/trunk/; revision=3839
2001-08-11Squelch a compiler warning.Guy Harris1-2/+2
svn path=/trunk/; revision=3838
2001-08-11Change the SMB header to being a separate break-out tree ...Richard Sharpe1-18/+24
Next, on to tvbuffify etc the others... svn path=/trunk/; revision=3836
2001-08-11Keep track of transaction replies that have continuations, and associateGuy Harris1-29/+200
continuations with the message to which they're a continuation. svn path=/trunk/; revision=3834
2001-08-07Tvbuffified SMB mailslot protocol dissector, from Ronnie Sahlberg.Guy Harris1-7/+28
svn path=/trunk/; revision=3832
2001-08-06The MID in an SMB message is not a transaction ID in, say, the ONC RPCGuy Harris1-91/+196
sense; instead, it's a "multiplex ID" used when there's more than one request *currently* in flight, to distinguish replies. This means that the MID and PID don't uniquely identify a request in a conversation. Therefore, we have to use some other value to distinguish between requests with the same MID and PID. Add a mechanism to do so. svn path=/trunk/; revision=3829
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-22 21:53:39 +0000