aboutsummaryrefslogtreecommitdiffstats
path: root/packet-smb.c
AgeCommit message (Collapse)AuthorFilesLines
2003-04-24From Jim McDonough: fix smb transact2 findfirst decoding of info levelGuy Harris1-5/+5
2's (including EA sizes, requested by os2 clients). svn path=/trunk/; revision=7547
2003-04-20Add a pointer to an hf_ value for a "reassembled_in" field (which can beGuy Harris1-1/+2
null) to the "fragment_items" structure, and don't pass that value into "process_reassembled_data()", just have it use the value in the "fragment_items" structure passed to it. Make "process_reassembled_data()" capable of handling reassembly done by "fragment_add_seq_check()", and use it in the ATP and 802.11 dissectors; give them "reassembled_in" fields. Make "process_reassembled_data()" handle only the case of a completed reassembly (fd_head != NULL) so that we can use it in those dissectors without gunking the code up too much. svn path=/trunk/; revision=7513
2003-04-18Add some comments about the 0x10 bit in the Flags field of an NTcreate&X.Richard Sharpe1-2/+24
svn path=/trunk/; revision=7493
2003-04-17Add a heuristic dissector table to Vines SPP, use it for dissecting SPPGuy Harris1-1/+2
data packets, and register the SMB dissector with it. Dissect the Control field of SPP packets. svn path=/trunk/; revision=7480
2003-04-17Update a URL, and note that the Open Group publications are nowGuy Harris1-4/+4
available for free download. svn path=/trunk/; revision=7476
2003-04-17Support SMB as one of the protocols that can run over OSI COTP.Guy Harris1-1/+2
svn path=/trunk/; revision=7474
2003-04-14Add a new routine "dissect_file_data_maybe_dcerpc()" to handle fileGuy Harris1-71/+38
read/write data that might, or might not, be DCE RPC information on a pipe, and use that routine rather than duplicating similar code in multiple places. svn path=/trunk/; revision=7455
2003-04-14Fix up some comments.Guy Harris1-6/+16
svn path=/trunk/; revision=7454
2003-04-14The two extra bytes in the write_andx request is only present if bothRonnie Sahlberg1-6/+16
the MEssageStart and the Raw bits are set. svn path=/trunk/; revision=7452
2003-04-14Use symbolic names for the various write mode bits.Guy Harris1-14/+28
To test whether a single bit is set, just do "if (mode&bit)", not "if ((mode&bit)==bit)". In the places where read and write data is processed, have both a comment indicating that it's file data and that you can transport DCERPC over SMB just with reads and writes, to indicate why we may call the DCERPC-over-a-pipe dissector. svn path=/trunk/; revision=7450
2003-04-13"dcerpc_fragment_table" is used only in packet-smb-pipe.c, except forGuy Harris1-9/+1
the call to initialize it; move the call to initialize it to the registration routine for the dissector that uses it, move the definition of ""dcerpc_fragment_table" to packet-smb-pipe.c, make it static, and remove the declaration of it from smb.h. Add some casts to squelch compiler complaints. svn path=/trunk/; revision=7449
2003-04-12Rewrite the DCERPC over SMB reassembly completely.Ronnie Sahlberg1-86/+17
Move the actual reassembly to packet-smb-pipe.c instead of having it inside the packet-smb.b/Write_andX and ReadAndX dissectors. Change the dissector to only call dcerpc dissector from the packet where reassembly was completed instead of always from the first fragment. Add display fiulter field for the other fragments that display which frame the dcerpc pdu was reassembled in. This is needed in order to be able to reassemble the type of dcerpc fragments that are sent between nt4 dc's. The DCERPC fragment reassembly in the dcerpc layer is still broken though, and i think it has been broken for quite some time. That will be addressed shortly. svn path=/trunk/; revision=7445
2003-04-10The NT Security Descriptor revision field is only one byte, not two.Ronnie Sahlberg1-6/+10
Make the dissector decode the first two bytes of the security descriptor as one byte for the revision and the second byte as nothing/should be zero. svn path=/trunk/; revision=7436
2003-04-09Squelch a compiler warning - the problem "should not happen", as aGuy Harris1-2/+2
WriteAndX request should have a full complement of word parameters, but, just in cast it doesn't.... (Should we somehow arrange to throw an exception if there aren't enough word or byte parameters in SMBs, i.e. impose a minimum in some cases?) svn path=/trunk/; revision=7430
2003-04-09Update to WriteAndX request decoding so it can handle the pipe bits properly.Ronnie Sahlberg1-2/+21
If both mode bits MessageStart and WriteRaw are set, then the first two bytes of the byte-field is the total length of the data written to the pipe. svn path=/trunk/; revision=7428
2003-04-03Add some additional fields to SMB-over-IPX dissection, as per whatGuy Harris1-6/+26
NetMon 2.x does. svn path=/trunk/; revision=7403
2003-04-03Add support for SMB-over-IPX.Guy Harris1-28/+78
svn path=/trunk/; revision=7402
2003-04-03When dissecting specific rights, pass a name string down so theTim Potter1-15/+28
proto item says "foo specific rights" instead of just "specific rights". svn path=/trunk/; revision=7401
2003-03-25Added SMB option : sid_name_snooping.Ronnie Sahlberg1-3/+20
This feature, when enabled through Edit/preferences/protocols/smb, will look at certain SMB and CIFS related protocols to discover the mapping between SIDs and their Names. For those SIDs whose name has been snooped/discovered ethereal will also add "(<name>)" to the end of the SID when printed in the tree pane through the function dissect_nt_sid(). Currently the feature is not too exciting since the only thing that packet-smb-sidsnooping.c will look at to build this mapping table is replies to the LSA/QueryInfoPolicy infolevel 3 packets and thus discover mappings between a Domain SID and a Domain Name. In the near future this future will be enhanced to also look at more interesting calls such as LSA/LookupSIDs2 and similar. svn path=/trunk/; revision=7362
2003-03-17Turn SIDs into FT_STRING fields so that we can filter for them usingRonnie Sahlberg1-24/+40
display filters. svn path=/trunk/; revision=7355
2003-03-17Rename hf_smb_sid to the more appropriate hf_smb_search_idRonnie Sahlberg1-8/+8
since we will need hf_smb_sid for the SID string later svn path=/trunk/; revision=7354
2003-03-14Make sure that we display all the file attributes ...Richard Sharpe1-3/+21
svn path=/trunk/; revision=7352
2003-03-04Make sure we don't obliterate the UNICODE flag ...Richard Sharpe1-2/+5
svn path=/trunk/; revision=7278
2003-02-25Added 'server unavailable' dos error message.Tim Potter1-1/+2
svn path=/trunk/; revision=7192
2003-02-14Properly set the ACE type in the summary line for an ACE - and, whileGuy Harris1-4/+5
we're at it, avoid going past the end of a packet. Put the ACE type's hex value into that line if it's an unknown type. svn path=/trunk/; revision=7144
2003-02-11Decorate ACE items in an ACL with the SID and flag values.Tim Potter1-7/+20
svn path=/trunk/; revision=7122
2003-02-10Update some comments.Guy Harris1-4/+11
svn path=/trunk/; revision=7112
2003-02-08At least in regular SMB requests, the access mask in an ACE is notGuy Harris1-15/+22
guaranteed to be aligned on a 4-byte boundary, so, if we're not dissecting an ACE from a DCE RPC request or reply, don't use "dissect_ndr_uint32()" to extract the access mask. (Is it guaranteed to be so aligned even if the ACE is part of a DCE RPC message? Or are ACLs just opaque blobs from the point of view of DCE RPC?) Use "%u", not "%d", to print unsigned quantities. svn path=/trunk/; revision=7106
2003-02-07Move dissect_nt_access_mask() from packet-dcerpc-nt.c to packet-smb.cTim Potter1-18/+388
Give dissect_nt_sec_desc() and dissect_nt_access_mask() a specific rights function parameter for dissecting specific access rights. Fix callers in packet-smb.c to use the new interface. svn path=/trunk/; revision=7086
2003-01-31Modify dissect_nt_sid() function to return a string version of the SID.Tim Potter1-9/+19
Fix all callers to use the new function form. svn path=/trunk/; revision=7054
2003-01-22SMB RTT statistics for tethereal and ethereal.Ronnie Sahlberg1-86/+82
SMB RTT statistics are similar to the RTT statistics already supported by ONC-RPC and DCE-RPC. It will present a table with all seen SMB commands and present the Min/Max and Avg response time in ms. Transaction2 and NT-Transaction commands are broken out and presented in its own subtables. tethereal feature is activated with -z smb,rtt switch and in ethereal it is activated either through -0z smb,rtt switch or through the Menu. svn path=/trunk/; revision=6966
2002-12-31Small fix from Andrew Bartlett to make Is Directory come out right.Richard Sharpe1-4/+4
svn path=/trunk/; revision=6823
2002-12-19Update reassemble.c/show_item and all callers to use FT_FRAMENUM for the ↵Ronnie Sahlberg1-3/+3
list of packets corresponding to a reassembled pdu svn path=/trunk/; revision=6807
2002-12-19Update packet-smb.c to use the new FT_FRAMENUM typeRonnie Sahlberg1-5/+5
svn path=/trunk/; revision=6806
2002-12-05Fix for DCERPC detection when carried ontop of SMB.Ronnie Sahlberg1-1/+11
If we do not see the TreeConnect call when a TID is connected, we did not know it was a IPC share. If we do not know what kind of share it is we assume it being a normal one and thus read/write data to that share is normal file i/o. Update the dissector so that IF it sees a Transaction SMB carrying PIPE (dcerpc) then we assume that all other read/write to that TID is also DCERPC. I.e. we assume the entire TID is IPC. svn path=/trunk/; revision=6747
2002-11-14Only display errors in SMB headers in the COL_INFO field. This getsTim Potter1-2/+2
rid of the annoying STATUS_BUFFER_OVERFLOW messages when dissecting large DCERPC responses as a buffer overflow is only a informational message not an error. svn path=/trunk/; revision=6632
2002-11-08Use the same ett_ value for all security blobs, regardless of whetherGuy Harris1-28/+14
they're raw NTLMSSP or GSS-API. svn path=/trunk/; revision=6584
2002-11-05A small fix to NtCreat&X from Jim McDonough ...Richard Sharpe1-89/+1
svn path=/trunk/; revision=6562
2002-10-24Add a "fragment_add_seq_next()" to reassemble fragments that don't haveGuy Harris1-2/+2
sequence numbers or offsets and are thus assumed to be received in order with no duplicates or dropped fragments (e.g., for NetBIOS Frame, where 802.2 LLC guarantees in-order delivery to NetBIOS with no duplicates or dropped fragments). "show_fragment_tree()' and "show_fragment_seq_tree()" don't modify the "fragment_items" to which the "fit" argument points, so make that argument a "const fragment_items *". Make all the "fragment_items" tables "static" (as they're not used outside the modules defining them) and "const" (as they're not modified). Add support for reassembly of NetBIOS fragmented requests and responses. Get rid of an unnecessary include of "packet-tr.c" in the NetBIOS dissector, and make its table of dissection function pointers static. Fix some typos in the AppleTalk and NetBIOS dissectors. svn path=/trunk/; revision=6491
2002-09-20More pretty-boy stuff for Write&X responses ...Richard Sharpe1-2/+8
svn path=/trunk/; revision=6307
2002-09-20Add more info in the info col for write&X.Richard Sharpe1-3/+15
svn path=/trunk/; revision=6306
2002-09-04Fix the handling of the NTLMSSP blobs in the case when the server asksRichard Sharpe1-3/+15
for RAW NTLMSSP, but the client actually sends SPNEGO encapsulated NTLMSSP. svn path=/trunk/; revision=6173
2002-08-31Further fixes. Properly account for the length of headers. Still some headersRichard Sharpe1-1/+4
that we do not account for properly, like Octet Strings. svn path=/trunk/; revision=6152
2002-08-31Properly handle raw ntlmssp ...Richard Sharpe1-20/+48
svn path=/trunk/; revision=6151
2002-08-31Handle the lack of a security blob in negprot response when raw NTLMSSP isRichard Sharpe1-2/+6
being used properly. svn path=/trunk/; revision=6149
2002-08-30Add support for raw NTLMSSP blobs when talking to XP etc ...Richard Sharpe1-2/+16
More to do yet though ... svn path=/trunk/; revision=6148
2002-08-29From Ulf Lamping: change some #define names to avoid name collisions onGuy Harris1-72/+72
Windows that cause compiler warnings. svn path=/trunk/; revision=6129
2002-08-29Guided by Guy and an examination of RFC2078 and RFC2478, I have added someRichard Sharpe1-2/+2
comments about what we need to do to get SPNEGO properly implemented. More work to do. svn path=/trunk/; revision=6121
2002-08-29Fix up dissect_file_attributesRichard Sharpe1-30/+51
svn path=/trunk/; revision=6119
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-251/+251
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-28 22:42:51 +0000