aboutsummaryrefslogtreecommitdiffstats
path: root/packet-smb.c
AgeCommit message (Collapse)AuthorFilesLines
2002-01-17Use the "fragmented" field of the "packet_info" structure inGuy Harris1-15/+25
"dissect_frame()" to indicate whether a ReportedBoundsError was due to the packet being malformed (i.e., the packet was shorter than it's supposed to be, so the dissector went past the end trying to extract fields that were supposed to be there) or due to it not being reassembled (i.e., the packet was fragmented, and we didn't reassemble it, but just treated the first fragment as the entire packet, so the dissector went past the end trying to extract fields that were partially or completely in fragments after that). Mark the latter as being unreasembled rather than malformed. Properly initialize, save, and restore that field, and properly set it, so that works. svn path=/trunk/; revision=4555
2002-01-15Fix some preferences to eliminate the extra copy of the protocol name atGuy Harris1-5/+5
the beginning, and to use underscores rather than periods where the preference's name really isn't part of a hierarchical namespace. Use "%u" rather than "%d" to print unsigned quantities. svn path=/trunk/; revision=4543
2002-01-15When checking whether to do DCERPC-over-SMB reassembly on a Read and XGuy Harris1-6/+6
response, don't assume that we saw the request and therefore that "si->sip" is non-null - we might well not have seen the request and thus might not have set "si->sip". svn path=/trunk/; revision=4542
2002-01-08Use "proto_tree_add_item()", not "proto_tree_add_bytes()", to add anGuy Harris1-2/+3
item for extra data at the end of the Transaction2 request parameters. svn path=/trunk/; revision=4499
2002-01-08Match requests and responses using both the MID and the PID; the SNIAGuy Harris1-40/+49
CIFS draft spec speaks of both being used: The multiplex ID (Mid) is used along with the Pid to allow multiplexing the single client and server connection among the client's multiple processes, threads, and requests per thread. Clients may have many outstanding requests (up to the negotiated number, MaxMpxCount) at one time. Servers MAY respond to requests in any order, but a response message MUST always contain the same Mid and Pid values as the corresponding request message. The client MUST NOT have multiple outstanding requests to a server with the same Mid and Pid. and I have seen a capture where more than one PID is used on a given connection and where the same MID is used with two different PIDs. Get rid of the "mid" field in the "smb_info_t" structure - the MID is not used outside "dissect_smb()". svn path=/trunk/; revision=4495
2002-01-03SPOOLSS RPC dissector, from Tim Potter. This includes adding additionalGuy Harris1-2/+11
DOS error codes to the table of them, and exporting that table to other dissectors for protocols using DOS error codes. svn path=/trunk/; revision=4470
2001-12-18Reassembly of fragmented NT Transaction responses, from Ronnie Sahlberg.Guy Harris1-32/+92
svn path=/trunk/; revision=4421
2001-12-18From Ronnie Sahlberg: dissect security descriptor flags.Guy Harris1-192/+206
Clean up the display of the access control list entry flags. Treat the access control list entry mask bits as NT permission bits (as that's what they are). svn path=/trunk/; revision=4420
2001-12-15NT ACL structure dissection, from Ronnie Sahlberg.Guy Harris1-3/+391
svn path=/trunk/; revision=4405
2001-12-15NT security descriptor dissection, from Ronnie Sahlberg.Guy Harris1-16/+161
svn path=/trunk/; revision=4396
2001-12-10Move the pointer to the "column_info" structure in the "frame_data"Guy Harris1-98/+98
structure to the "packet_info" structure; only stuff that's permanently stored with each frame should be in the "frame_data" structure, and the "column_info" structure is not guaranteed to hold the column values for that frame at all times - it was only in the "frame_data" structure so that it could be passed to dissectors, and, as all dissectors are now passed a pointer to a "packet_info" structure, it could just as well be put in the "packet_info" structure. That saves memory, by shrinking the "frame_data" structure (there's one of those per frame), and also lets us clean up the code a bit. svn path=/trunk/; revision=4370
2001-12-07More NT error codes, from Todd Sabin.Guy Harris1-1/+126
svn path=/trunk/; revision=4352
2001-12-06From Todd Sabin:Guy Harris1-2/+2
add "dissect_ndr_ctx_hnd()" for dissecting context handles, and use it in various DCERPC dissectors; beef up the MS Security Account Manager dissector. Also, export "NT_errors[]" for use by that dissector. svn path=/trunk/; revision=4350
2001-12-06From Ronnie Sahlberg: reassemble DCERPC-over-SMB requests as well asGuy Harris1-5/+42
responses. svn path=/trunk/; revision=4348
2001-12-06In the SMB dissector, keep a list of all the conversation structuresGuy Harris1-4/+33
and, when we're re-initializing the dissector, free up all the hash tables attached to those structures. svn path=/trunk/; revision=4345
2001-12-06There can be more than one SMB request or response in a frame whenGuy Harris1-16/+64
you're doing NetBIOS-over-TCP (yes, I've seen that, with one response being a Transaction and the other being a Read and X), so the frame number is insufficient as a key in the hash table of matched request/response pairs; use the frame number and the MID. svn path=/trunk/; revision=4344
2001-12-05Support for reassembly of DCERPC over SMB, from Ronnie Sahlberg.Guy Harris1-81/+114
svn path=/trunk/; revision=4335
2001-12-05From Tim Potter: add the DOS error for "file already exists" on aGuy Harris1-1/+2
rename. svn path=/trunk/; revision=4333
2001-12-05Don't fetch "t2i->info_level" if "t2i" is null.Guy Harris1-20/+22
svn path=/trunk/; revision=4332
2001-11-29Update from Ronnie Sahlberg:Guy Harris1-4/+14
1. Changes how can_desegment works so that can_desegment is only != 0 for whichever dissector is running immediately on top of whoever offers the can_desegment service. Thus DCERPC needs no special handling to see if it can trust can_desegment (which is currently only available ontop of TCP and not ontop of tcp->nbss->smb). 2. Changes fragment reassembly of transaction smb to only show the defragmented packet for the transaction smb holding the first fragment. To see why, test it with a transaction SMB containing a ~60kb PDU or larger. The old behaviour had approximately quadratic behaviour regarding runtime for dissecting such PDUs. (example: NetShareEnum is a command which can grow really really large if the number of shares and comments are large) svn path=/trunk/; revision=4296
2001-11-29When processing a response, check whether "si->sip" is null before usingGuy Harris1-3/+3
it; it'll be null if the matching request hasn't been seen. svn path=/trunk/; revision=4295
2001-11-28From Ronnie Sahlberg: track FID values between requesta and responsesGuy Harris1-6/+35
for ReadAndX and WriteAndX. svn path=/trunk/; revision=4293
2001-11-28If a request has already been processed, and we fail to find itsGuy Harris1-132/+101
"smb_saved_info_t" in the table of requests whose replies have been found, don't look it up in the table of requests whose replies have not been found - if the request in question has no reply in the capture, that may find some later frame in the same conversation with the same MID, and we don't need that information anyway - the only reason we *need* that structure is to save information in it for use when processing its reply, and we already did that the first time we processed the request. (The information for the later frame may be bad, e.g. having a null "extra_info" pointer, or having one that points to information for another request.) Arrange that we don't use the pointer to the "smb_saved_info_t" when processing a request except to save information if the request hasn't already been processed, as that pointer may not be valid if the request has already been processed, as per the above. svn path=/trunk/; revision=4292
2001-11-28Updates to transaction reassembly, from Ronnie Sahlberg.Guy Harris1-235/+207
Add some checks for null tvbuff arguments. When dissecting transaction setup, parameters, and data when we couldn't dissect it as a pipe or mailslot transaction, use the reported length of the supplied tvbuff, not the actual length, as the amount of data present. svn path=/trunk/; revision=4291
2001-11-27Remove an extra blank from a data source name.Guy Harris1-2/+10
Added comments, from Ronnie Sahlberg. svn path=/trunk/; revision=4280
2001-11-26In "smb_trans_defragment()", quit if "si->sip" is null, as it means weGuy Harris1-1/+12
don't have the frame number of the request, which we use as the ID of the transaction being reassembled. (If we're reassembling a reply, should we not use the frame number of the reply instead? We used to have a hash table to keep track of that, so we might just be able to bring it back....) svn path=/trunk/; revision=4274
2001-11-26Add some comments.Guy Harris1-1/+12
svn path=/trunk/; revision=4273
2001-11-26From Ronnie Sahlberg: reassemble transaction data if transactionGuy Harris1-29/+151
continuations are seen. svn path=/trunk/; revision=4272
2001-11-24Assorted changes from Ronnie Sahlberg:Guy Harris1-22/+36
Add a few small functions to reassemble.c to cope with protocols where the total length of defragmented PDUs are specified in the first fragment (all previous uses of reassembly has been for PDUs where the last fragment is signalled by a flag in the header for the last fragment). Add a few small functions to reassemble.c to abort-and-delete defragmentation of PDUs and also detect IF a PDU is currently being defragmented. (Useful for PDUs where the "unique" identifier is rather ununique, or may be reused often enough so it can be a problem for Ethereal.) Change where NT Cancel presents its Cancelation-to output, and makes the three trans secondary requests also output similar information. svn path=/trunk/; revision=4255
2001-11-21Discard stuff in "smb.h" not used by the dissectors, and replace theGuy Harris1-21/+21
#defines for SMB commands with ones that use the names from the SNIA CIFS spec. Use those #define values rather than hardcoded values in various places that check for specific commands. svn path=/trunk/; revision=4244
2001-11-21Support for Transaction Secondary and Transaction2 Secondary, fromGuy Harris1-3/+12
Ronnie Sahlberg. svn path=/trunk/; revision=4243
2001-11-21Get rid of some unused variables.Guy Harris1-27/+6
svn path=/trunk/; revision=4241
2001-11-20From Ronnie Sahlberg: handle transaction continuations the way we handleGuy Harris1-27/+69
NT Cancel, as transaction continuations don't get a response, either. svn path=/trunk/; revision=4230
2001-11-20Dissect the rest of the named pipe protocol. Export from "packet-smb.c"Guy Harris1-19/+27
routines used for that. Rename some named pipe functions as per the SNIA CIFS spec. Label the "number of files moved" field of the reply to a Move SMB as such, rather than as an unspecified "Count". svn path=/trunk/; revision=4229
2001-11-20Save the function code and FID for pipe requests, and use it for theGuy Harris1-10/+13
matching responses. svn path=/trunk/; revision=4228
2001-11-19Dissect the setup words in pipe transactions that have them; thatGuy Harris1-20/+59
obviates the need to have a protocol tree item for "MSRPC-over-SMB", as the setup words for it are just standard TransactNmPipe setup words (0x26 is the TransactNmPipe function code, and the next setup word is the FID for the pipe in question.) Pass to the pipe dissector tvbuffs for setup-words-plus-pipe (which is the data for the pipe protocol) and parameters-plus-data (which is the data for the protocol running atop the pipe protocol); use the former for the top-level protocol tree item for the pipe protocol, and the latter for the top-level protocol tree item for the LANMAN protocol. svn path=/trunk/; revision=4223
2001-11-19Make the register routines for the mailslot, pipe, browser, andGuy Harris1-16/+1
mailslot-based logon protocols just be regular register routines, detected by the script that generates the "register.c" file, rather than special stuff known to the SMB dissector. svn path=/trunk/; revision=4222
2001-11-19Pass, as the first tvbuff argument to "dissect_mailslot_smb()" andGuy Harris1-133/+151
"dissect_pipe_smb()", a tvbuff containing the setup words and the pipe/mailslot pathname, as those are arguably the part of the packet that contains the "mailslot protocol" and the "pipe protocol", as opposed to the protocol running atop mailslots or pipes. Pass a setup tvbuff to "dissect_pipe_smb()" for it to pass on to the MSRPC-over-named-pipe dissector, and have the setup tvbuff passed to it and "dissect_mailslot_smb()" contain *only* the setup words; don't extract anything other than the setup words from it. Declare "register_proto_smb_mailslot()" in "packet-smb-mailslot.h" rather than "packet-smb.c", and declare "register_proto_smb_pipe()" in "packet-smb-pipe.h" rather than "packet-smb.c". Add a protocol for MSRPC-over-named-pipes. Move the stuff to handle the FID in the setup words of MSRPC-over-named-pipe transactions out of the SMB Transaction dissector into the MSRPC dissector. Add a routine to "packet-smb.c", callable from outside "packet-smb.c", to put an "smb.fid" field into the protocol tree, and to add ", FID: XXXX" to the Info column, for use by the MSRPC-over-named-pipe dissector; use it in the SMB dissector as well, in all the places where we put a FID into the protocol tree. Move the stuff to check whether the LANMAN protocol is enabled, and to set "pinfo->current_proto" to "LANMAN" if it is, into the LANMAN API-over-named-pipe dissector out of the named pipe protocol dissector. If we didn't dissect a Transaction request or reply as a named pipe or mailslot message, put any setup words, parameters, and data it has into the protocol tree as separate items. Don't put a "Response in" item into the protocol tree for an NT Cancel request, as there are no responses to NT Cancel requests. svn path=/trunk/; revision=4221
2001-11-18From Tim Potter:Guy Harris1-8/+68
display the returned FID in the Info column for NT Create And X replies; display the setup words, and treat the second word as a FID in Transaction requests presumed to contain DCE RPC-over-SMB. Add the FID to the Info column for other open/create replies while we're at it. svn path=/trunk/; revision=4219
2001-11-18Pass in the "smb_info" structure a pointer to the "smb_saved_info_t"Guy Harris1-97/+139
structure, so that it can be updated by subdissectors; this way the updates affect the structure immediately, and don't get lost if the subdissector later throws an exception. Use "tvb_reported_length()" to check for an interim mailslot reply; "tvb_length()" could give the wrong answer if a short snapshot length was given in the capture. svn path=/trunk/; revision=4218
2001-11-18Have only the request and response frame numbers, and a "void *", in anGuy Harris1-126/+313
"smb_saved_info_t". Put all the information needed to dissect NT Transaction replies, Transaction2 replies, or Transaction replies into separate data structures, allocated separately, and put a pointer to that data structure in the "void *" in question. Use the return value of "dissect_pipe_smb()" and "dissect_mailslot_smb()" to control whether to display as data the stuff those routines were asked to dissect. If we've seen a request before, but its "smb_saved_info_t" isn't in the "matched" hash table, look in the "unmatched" hash table - perhaps we haven't seen the reply yet. svn path=/trunk/; revision=4216
2001-11-16Add some bits in the Write AndX write mode as per "Microsoft NetworksGuy Harris1-3/+29
SMB FILE SHARING PROTOCOL EXTENSIONS, SMB File Sharing Protocol Extensions Version 2.0, Document Version 3.3". Fix the test for the "connectionless mode" to test the correct bit. svn path=/trunk/; revision=4215
2001-11-16Never put an entry into the hash table for an NT Cancel request, even ifGuy Harris1-7/+10
we didn't find the request it's cancelling. svn path=/trunk/; revision=4214
2001-11-16Don't save a full "smb_info" structure in the hash tables for requestsGuy Harris1-94/+133
and replies, just save a structure holding that information that can't be derived from the contents of one of the SMBs. Don't save anything at all for NT Cancel requests - they have the same TID/PID/MID/UID as the SMB being cancelled, and you want the information for that request used when dissecting the NT Cancel (so it gets the number of the frame containing the request being cancelled) and when dissecting the reply to the request being cancelled. Get rid of an unused routine. svn path=/trunk/; revision=4213
2001-11-16Cleanup of request/response matching, from Ronnie Sahlberg.Guy Harris1-872/+425
Get rid of "Response to" stuff in the LANMAN dissector, as that's now done in the SMB dissector. Add a routine for dissecting unknown SMBs (gets the word and byte counts, and just adds text entries for the word and byte parameters, if any), and replace null pointers in the dissector table with pointers to that routine. Get rid of the check for a null dissector pointer. svn path=/trunk/; revision=4212
2001-11-16Responses to queries for stream information can return more than oneGuy Harris1-24/+69
piece of information in the reply, as a file can have more than one stream; show all of them. Don't use the "File Name" field for stream names. svn path=/trunk/; revision=4211
2001-11-16Use "hf_smb_t2_stream_size", not "hf_smb_t2_stream_name_length", whenGuy Harris1-2/+2
adding the stream size. svn path=/trunk/; revision=4210
2001-11-15Tvbuffification of Transaction requests, from Ronnie Sahlberg.Guy Harris1-1348/+281
"Send buffer pointer" and "send buffer length" items appear not to be sent over the wire. Add support for Write And X. svn path=/trunk/; revision=4204
2001-11-13Squelch an MSVC++ complaint.Guy Harris1-1/+2
svn path=/trunk/; revision=4198
2001-11-12Include the sync I/O alert and nonalert bits.Guy Harris1-1/+23
Put in comments about some of the other bits. svn path=/trunk/; revision=4196
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-24 02:11:24 +0000