aboutsummaryrefslogtreecommitdiffstats
path: root/packet-smb.c
AgeCommit message (Collapse)AuthorFilesLines
2003-08-28Clean up white space.Guy Harris1-10/+10
svn path=/trunk/; revision=8302
2003-08-21Label the Count field in a Write AndX response as such, rather than asGuy Harris1-15/+25
"Data Length". Fix some low-16-bits-of fields to have "_low", rather than "_high", at the ends of their names. svn path=/trunk/; revision=8204
2003-08-21The MaxCountHigh field in a READ_ANDX is given as a ULONG, i.e. 32 bits,Guy Harris1-15/+43
in the SNIA CIFS spec, although it's probably a 16-bit MaxCountHigh and a 16-bit reserved field (it's a 32-bit timeout field in an earlier SMB spec). Call the MaxCount and MaxCountHigh fields in a READ_ANDX "Max Count Low" and "Max Count High", rather than "Data Length Low" and "Data Length High". svn path=/trunk/; revision=8198
2003-08-20The length and offset for large file support for LockingAndX was broken.Ronnie Sahlberg1-7/+54
We treated this as just a normal 64bit integer in LittleEndian format. However, this is actually 2 32 bit integers, each in LittleEndian format but the two 32 bit fields are stored in BigEndian format relative to each other. Since we dont do 64 bit aritmetic I had to convert the field to FT_STRING as well so sorry, no creative len>xxx filters anymore. but at least we present the data in the correct way in the tree pane. We didnt see this one earlier since most locking_andx requests are probably for offset : 0 and length: - Funnily enough it seems that certain popular commercial products have the same bug as ethereal had up until 5 minutes ago. svn path=/trunk/; revision=8196
2003-08-19Update to the SMB dissector so that the HighLen 16 bit integer is decodedRonnie Sahlberg1-42/+84
instead of as being represented as RESERVED. This updates the ReadAndX and WriteAndX calls and replies. This should really try to keep track of the negotiation of the conversation to make sure we only do it for those sessions where LARGE file io has been negotiated. Currently it does it for all Read/Write AndX calls. It is probably safe to do so since for those clients where this is not supported these bytes are RESERVED and MBZ anyway. svn path=/trunk/; revision=8191
2003-08-17Update to SMBRonnie Sahlberg1-16/+16
Change the AndX command fields to only place a filterable field in the tree when smb.cmd is NOT 0xff If smb.cmd is 0xFF just place a text entry in the field instead. This makes it more intuitive for users that try to use filters such as smb.cmd!=0xXY since the filter will no longer behave "unexpectedly" and fail to filter out any of the AndX commands. Yes, they should really use !smb.cmd==0xXY instead but one cant explain this to every single user. I dont think anyone would ever want to filter for smb.cmd==0xFF anyway svn path=/trunk/; revision=8178
2003-08-16Get rid of an unused variable.Guy Harris1-2/+1
svn path=/trunk/; revision=8170
2003-08-15In "dissect_transaction2_request_parameters()", "bc" gets decremented asGuy Harris1-5/+4
we go through the data, so we can't compare it with the current offset minus the starting offset - we should just test, and use, its value directly, as, at the end, it reflects the amount of data left. svn path=/trunk/; revision=8167
2003-08-15Some fixes for UNIX CIFS extensions. There's still a problem in the trans2Tim Potter1-5/+14
find response and we end up displaying malformed frame even though all data has been dissected. svn path=/trunk/; revision=8166
2003-08-14Removed references to CIFS TR section numbers from various value_strings.Tim Potter1-67/+67
The strings are now in COL_INFO and the section numbers were cluttering it up. svn path=/trunk/; revision=8164
2003-08-13Make some abbreviations to some value_strings to save COL_INFO real estate:Tim Potter1-12/+26
transaction -> trans, information -> info. Put value_string data in COL_INFO for trans2 query{path,file}info. svn path=/trunk/; revision=8163
2003-08-13Fixes for testing all variations of query fsinfo. There were a fewTim Potter1-5/+33
transpositions of subcommand numbers, and the query object id case was not implemented. I'm not sure about the query fs label info as it doesn't seem to exist as a server procedure except in Samba. svn path=/trunk/; revision=8162
2003-08-04Dissect some more set attr calls ...Richard Sharpe1-1/+4
svn path=/trunk/; revision=8128
2003-07-10Support for CIFS UNIX extensions as documented in the CIFS TR 1.0,Tim Potter1-21/+366
Appendix D. svn path=/trunk/; revision=8012
2003-07-10Add more entries to the query/set path/file info value_strings forTim Potter1-3/+40
some extra info levels discovered by tridge. Put subcommand information in COL_INFO for trans2 query fs/path/file info. svn path=/trunk/; revision=8011
2003-06-15The MID field in the SMB header is in reality only ~10 bits in sizeRonnie Sahlberg1-7/+7
so it is pretty common for MID values to be reused even in moderately sized captures. The test to compare that the command type between the request and reply is not sufficient for when most of the commands between the client and the server are the same (e.g. streaming Read/Write) Change the matching so that ONLY the first "response" we see for a certain open MID will be matched to the original request. I.e. Prevent Read Request Read Reply [missing from capture] Read Request Read Reply From incorrectly matching the second reply (if it has a reused MID) with the first request. This makes the response time statistics a bit more reliable as well. svn path=/trunk/; revision=7888
2003-06-12Add new routines:Guy Harris1-3/+2
tvb_get_string() - takes a tvbuff, an offset, and a length as arguments, allocates a buffer big enough to hold a string with the specified number of bytes plus an added null terminator (i.e., length+1), copies the specified number of bytes from the tvbuff, at the specified offset, to that buffer and puts in a null terminator, and returns a pointer to that buffer (or throws an exception before allocating the buffer if that many bytes aren't available in the tvbuff); tvb_get_stringz() - takes a tvbuff, an offset, and a pointer to a "gint" as arguments, gets the size of the null-terminated string starting at the specified offset in the tvbuff (throwing an exception if the null terminator isn't found), allocates a buffer big enough to hold that string, copies the string to that buffer, and returns a pointer to that buffer and stores the length of the string (including the terminating null) in the variable pointed to by the "gint" pointer. Replace many pieces of code allocating a buffer and copying a string with calls to "tvb_get_string()" (for one thing, "tvb_get_string()" doesn't require you to remember that the argument to "tvb_get_nstringz0()" is the size of the buffer into which you're copying the string, which might be the length of the string to be copied *plus 1*). Don't use fixed-length buffers for null-terminated strings (even if the code that generates those packets has a #define to limit the length of the string). Use "tvb_get_stringz()", instead. In some cases where a value is fetched but is only used to pass an argument to a "proto_tree_add_XXX" routine, use "proto_tree_add_item()" instead. svn path=/trunk/; revision=7859
2003-06-10Show the upper 2 bytes of the formerly-reserved area as a "High Part ofGuy Harris1-15/+13
PID" even for SMB-over-IPX. svn path=/trunk/; revision=7823
2003-06-09Put the right data into the protocol tree for the high 16 bits of the PID.Guy Harris1-10/+10
svn path=/trunk/; revision=7819
2003-06-09Dissect the 12-byte reserved field as a 2-byte PID high, 8-byte sig, andRichard Sharpe1-4/+23
2-byte reserved field. svn path=/trunk/; revision=7812
2003-06-09Update the section numbers in various information level strings toGuy Harris1-89/+88
reflect the 1.0 version of the CIFS spec. Similarly update function names containing section numbers. Change the strings for query file levels 0x0200 and 0x0201 to say "Query" rather than "Set" (we now have separate tables for "query" and "set" information levels, as some of them differ), and get rid of the string for 0x0202, as that's documented in the CIFS spec only as a "set" level. svn path=/trunk/; revision=7810
2003-06-08The information levels for TRANS2_SET_{PATH,FILE}_INFORMATION are,Guy Harris1-10/+158
according to the SNIA CIFS 1.0 spec and some captures I've seen, are not the same as for the corresponding TRANS2_GET_{PATH,FILE}_INFORMATION. Handle the SET information levels as per the CIFS spec. svn path=/trunk/; revision=7806
2003-06-06Rename EA length field to EA list length. Field was originally justTim Potter1-13/+13
list length before my previous commit. svn path=/trunk/; revision=7797
2003-06-06Dissect extended attribute lists in trans2 QUERY_FILE_INFORMATION,Tim Potter1-24/+103
info level 4. svn path=/trunk/; revision=7796
2003-06-04There can be more than one DCE RPC call per frame, e.g. there can beGuy Harris1-11/+1
multiple NetBIOS-over-TCP session service messages in a TCP segment, and they can contain the final portions of different DCERPC calls. Don't assume a frame number is sufficient to identify DCE RPC calls. svn path=/trunk/; revision=7777
2003-05-28From Laurent Rabret: use "g_free()", not "free()", to free stuffGuy Harris1-2/+2
allocated with "g_malloc()" and related GLib routines. svn path=/trunk/; revision=7758
2003-05-23Initialise sid_str in case dissect_nt_sid() can't return a stringTim Potter1-2/+2
representation for the sid. svn path=/trunk/; revision=7719
2003-05-22make dissect_nt_sid() return a sid string that also contains the proper name ↵Ronnie Sahlberg1-2/+6
for the sid. this prettifies some dcerpc interfaces svn path=/trunk/; revision=7712
2003-05-21Change the interface to dissect_nt_sid so that we can provide a hf field to useRonnie Sahlberg1-11/+19
to describe the sid instead of the default smb.sid one svn path=/trunk/; revision=7708
2003-05-16Tap SMB packets before we call the dissecotrs so that even if thereRonnie Sahlberg1-3/+6
is an exception (i.e. short packet) the tap listener will still be alled. svn path=/trunk/; revision=7684
2003-05-15More work on dissecting generic and standard mappings for NT access masks.Tim Potter1-35/+103
svn path=/trunk/; revision=7668
2003-05-09Move the ntlmv2 response dissection out of packet-ntlmssp.c and in toTim Potter1-4/+21
packet-smb-common.c so it can be used elsewhere. Dissect a ntlmv2 response in a session setup SMB if detected. svn path=/trunk/; revision=7655
2003-04-29Add a "proto_item_set_end()" routine that sets the length of an itemGuy Harris1-3/+2
given a tvbuff/offset pair referring to the byte past the end of the item. Use it in one place in the SMB dissector (there are plenty of other places where it could be used as well). svn path=/trunk/; revision=7603
2003-04-28dissect_nt_access_mask() sometimes ami is NULL.Ronnie Sahlberg1-3/+3
check that it is non-NULL before we dereference it. svn path=/trunk/; revision=7592
2003-04-28Move the specific rights dissection function and name into a structureTim Potter1-24/+16
instead of passing them around as separate parameters. This is a prelude to adding generic and standard mapping to the access mask dissection. svn path=/trunk/; revision=7591
2003-04-27Note some weirdness seen in some captures, where the direction flag inGuy Harris1-1/+8
the SMB isn't set on replies. svn path=/trunk/; revision=7588
2003-04-24From Jim McDonough: fix smb transact2 findfirst decoding of info levelGuy Harris1-5/+5
2's (including EA sizes, requested by os2 clients). svn path=/trunk/; revision=7547
2003-04-20Add a pointer to an hf_ value for a "reassembled_in" field (which can beGuy Harris1-1/+2
null) to the "fragment_items" structure, and don't pass that value into "process_reassembled_data()", just have it use the value in the "fragment_items" structure passed to it. Make "process_reassembled_data()" capable of handling reassembly done by "fragment_add_seq_check()", and use it in the ATP and 802.11 dissectors; give them "reassembled_in" fields. Make "process_reassembled_data()" handle only the case of a completed reassembly (fd_head != NULL) so that we can use it in those dissectors without gunking the code up too much. svn path=/trunk/; revision=7513
2003-04-18Add some comments about the 0x10 bit in the Flags field of an NTcreate&X.Richard Sharpe1-2/+24
svn path=/trunk/; revision=7493
2003-04-17Add a heuristic dissector table to Vines SPP, use it for dissecting SPPGuy Harris1-1/+2
data packets, and register the SMB dissector with it. Dissect the Control field of SPP packets. svn path=/trunk/; revision=7480
2003-04-17Update a URL, and note that the Open Group publications are nowGuy Harris1-4/+4
available for free download. svn path=/trunk/; revision=7476
2003-04-17Support SMB as one of the protocols that can run over OSI COTP.Guy Harris1-1/+2
svn path=/trunk/; revision=7474
2003-04-14Add a new routine "dissect_file_data_maybe_dcerpc()" to handle fileGuy Harris1-71/+38
read/write data that might, or might not, be DCE RPC information on a pipe, and use that routine rather than duplicating similar code in multiple places. svn path=/trunk/; revision=7455
2003-04-14Fix up some comments.Guy Harris1-6/+16
svn path=/trunk/; revision=7454
2003-04-14The two extra bytes in the write_andx request is only present if bothRonnie Sahlberg1-6/+16
the MEssageStart and the Raw bits are set. svn path=/trunk/; revision=7452
2003-04-14Use symbolic names for the various write mode bits.Guy Harris1-14/+28
To test whether a single bit is set, just do "if (mode&bit)", not "if ((mode&bit)==bit)". In the places where read and write data is processed, have both a comment indicating that it's file data and that you can transport DCERPC over SMB just with reads and writes, to indicate why we may call the DCERPC-over-a-pipe dissector. svn path=/trunk/; revision=7450
2003-04-13"dcerpc_fragment_table" is used only in packet-smb-pipe.c, except forGuy Harris1-9/+1
the call to initialize it; move the call to initialize it to the registration routine for the dissector that uses it, move the definition of ""dcerpc_fragment_table" to packet-smb-pipe.c, make it static, and remove the declaration of it from smb.h. Add some casts to squelch compiler complaints. svn path=/trunk/; revision=7449
2003-04-12Rewrite the DCERPC over SMB reassembly completely.Ronnie Sahlberg1-86/+17
Move the actual reassembly to packet-smb-pipe.c instead of having it inside the packet-smb.b/Write_andX and ReadAndX dissectors. Change the dissector to only call dcerpc dissector from the packet where reassembly was completed instead of always from the first fragment. Add display fiulter field for the other fragments that display which frame the dcerpc pdu was reassembled in. This is needed in order to be able to reassemble the type of dcerpc fragments that are sent between nt4 dc's. The DCERPC fragment reassembly in the dcerpc layer is still broken though, and i think it has been broken for quite some time. That will be addressed shortly. svn path=/trunk/; revision=7445
2003-04-10The NT Security Descriptor revision field is only one byte, not two.Ronnie Sahlberg1-6/+10
Make the dissector decode the first two bytes of the security descriptor as one byte for the revision and the second byte as nothing/should be zero. svn path=/trunk/; revision=7436
2003-04-09Squelch a compiler warning - the problem "should not happen", as aGuy Harris1-2/+2
WriteAndX request should have a full complement of word parameters, but, just in cast it doesn't.... (Should we somehow arrange to throw an exception if there aren't enough word or byte parameters in SMBs, i.e. impose a minimum in some cases?) svn path=/trunk/; revision=7430
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-21 22:08:38 +0000