2000-02-14 04:02:21 +00:00
|
|
|
/* packet-smb-mailslot.c
|
2001-03-18 03:23:30 +00:00
|
|
|
* Routines for SMB mailslot packet dissection
|
2000-02-14 04:02:21 +00:00
|
|
|
* Copyright 2000, Jeffrey C. Foster <jfoste@woodward.com>
|
|
|
|
*
|
2002-07-13 19:33:20 +00:00
|
|
|
* $Id: packet-smb-mailslot.c,v 1.32 2002/07/13 19:33:20 guy Exp $
|
2000-02-14 04:02:21 +00:00
|
|
|
*
|
|
|
|
* Ethereal - Network traffic analyzer
|
2001-07-08 11:32:02 +00:00
|
|
|
* By Gerald Combs <gerald@ethereal.com>
|
2000-02-14 04:02:21 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
|
|
|
* Copied from packet-pop.c
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
|
|
|
|
2002-07-13 19:33:20 +00:00
|
|
|
#include <string.h>
|
2000-02-14 04:02:21 +00:00
|
|
|
#include "packet-smb-common.h"
|
2001-03-18 03:23:30 +00:00
|
|
|
#include "packet-smb-mailslot.h"
|
2001-03-18 03:34:22 +00:00
|
|
|
#include "packet-smb-browse.h"
|
|
|
|
#include "packet-smb-logon.h"
|
2001-03-18 03:23:30 +00:00
|
|
|
#include "packet-smb-pipe.h"
|
2000-02-14 04:02:21 +00:00
|
|
|
|
|
|
|
static int proto_smb_msp = -1;
|
2001-08-07 08:39:57 +00:00
|
|
|
static int hf_opcode = -1;
|
|
|
|
static int hf_priority = -1;
|
|
|
|
static int hf_class = -1;
|
|
|
|
static int hf_size = -1;
|
|
|
|
static int hf_name = -1;
|
2000-02-14 04:02:21 +00:00
|
|
|
|
|
|
|
static int ett_smb_msp = -1;
|
|
|
|
|
2001-11-26 04:52:51 +00:00
|
|
|
static dissector_handle_t data_handle;
|
|
|
|
|
2001-11-15 10:41:53 +00:00
|
|
|
#define MAILSLOT_UNKNOWN 0
|
|
|
|
#define MAILSLOT_BROWSE 1
|
|
|
|
#define MAILSLOT_LANMAN 2
|
|
|
|
#define MAILSLOT_NET 3
|
|
|
|
#define MAILSLOT_TEMP_NETLOGON 4
|
|
|
|
#define MAILSLOT_MSSP 5
|
|
|
|
|
2001-08-07 08:39:57 +00:00
|
|
|
static const value_string opcode_vals[] = {
|
|
|
|
{1, "Write Mail Slot"},
|
|
|
|
{0, NULL}
|
|
|
|
};
|
2000-02-14 04:02:21 +00:00
|
|
|
|
2001-08-07 08:39:57 +00:00
|
|
|
static const value_string class_vals[] = {
|
|
|
|
{1, "Reliable"},
|
|
|
|
{2, "Unreliable & Broadcast"},
|
|
|
|
{0, NULL}
|
|
|
|
};
|
2000-02-14 04:02:21 +00:00
|
|
|
|
2001-11-15 10:41:53 +00:00
|
|
|
/* decode the SMB mail slot protocol
|
|
|
|
for requests
|
|
|
|
mailslot is the name of the mailslot, e.g. BROWSE
|
|
|
|
si->trans_subcmd is set to the symbolic constant matching the mailslot name.
|
|
|
|
for responses
|
|
|
|
mailslot is NULL
|
|
|
|
si->trans_subcmd gives us which mailslot this response refers to.
|
|
|
|
*/
|
|
|
|
|
2001-08-07 08:39:57 +00:00
|
|
|
gboolean
|
Pass, as the first tvbuff argument to "dissect_mailslot_smb()" and
"dissect_pipe_smb()", a tvbuff containing the setup words and the
pipe/mailslot pathname, as those are arguably the part of the packet
that contains the "mailslot protocol" and the "pipe protocol", as
opposed to the protocol running atop mailslots or pipes.
Pass a setup tvbuff to "dissect_pipe_smb()" for it to pass on to the
MSRPC-over-named-pipe dissector, and have the setup tvbuff passed to it
and "dissect_mailslot_smb()" contain *only* the setup words; don't
extract anything other than the setup words from it.
Declare "register_proto_smb_mailslot()" in "packet-smb-mailslot.h"
rather than "packet-smb.c", and declare "register_proto_smb_pipe()" in
"packet-smb-pipe.h" rather than "packet-smb.c".
Add a protocol for MSRPC-over-named-pipes.
Move the stuff to handle the FID in the setup words of
MSRPC-over-named-pipe transactions out of the SMB Transaction dissector
into the MSRPC dissector. Add a routine to "packet-smb.c", callable
from outside "packet-smb.c", to put an "smb.fid" field into the protocol
tree, and to add ", FID: XXXX" to the Info column, for use by the
MSRPC-over-named-pipe dissector; use it in the SMB dissector as well, in
all the places where we put a FID into the protocol tree.
Move the stuff to check whether the LANMAN protocol is enabled, and to
set "pinfo->current_proto" to "LANMAN" if it is, into the LANMAN
API-over-named-pipe dissector out of the named pipe protocol dissector.
If we didn't dissect a Transaction request or reply as a named pipe or
mailslot message, put any setup words, parameters, and data it has into
the protocol tree as separate items.
Don't put a "Response in" item into the protocol tree for an NT Cancel
request, as there are no responses to NT Cancel requests.
svn path=/trunk/; revision=4221
2001-11-19 10:06:42 +00:00
|
|
|
dissect_mailslot_smb(tvbuff_t *mshdr_tvb, tvbuff_t *setup_tvb,
|
|
|
|
tvbuff_t *tvb, const char *mailslot, packet_info *pinfo,
|
|
|
|
proto_tree *parent_tree)
|
2001-08-07 08:39:57 +00:00
|
|
|
{
|
2001-11-18 02:51:20 +00:00
|
|
|
smb_info_t *smb_info;
|
|
|
|
smb_transact_info_t *tri;
|
|
|
|
int trans_subcmd;
|
2001-11-27 05:14:04 +00:00
|
|
|
proto_tree *tree = NULL;
|
|
|
|
proto_item *item = NULL;
|
2001-08-07 08:39:57 +00:00
|
|
|
guint16 opcode;
|
|
|
|
int offset = 0;
|
|
|
|
int len;
|
2001-11-18 02:51:20 +00:00
|
|
|
gboolean dissected;
|
2001-08-07 08:39:57 +00:00
|
|
|
|
|
|
|
if (!proto_is_protocol_enabled(proto_smb_msp)) {
|
2001-03-18 03:23:30 +00:00
|
|
|
return FALSE;
|
2001-08-07 08:39:57 +00:00
|
|
|
}
|
|
|
|
pinfo->current_proto = "SMB Mailslot";
|
|
|
|
|
2001-12-10 00:26:21 +00:00
|
|
|
if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
|
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "SMB Mailslot");
|
2001-08-07 08:39:57 +00:00
|
|
|
}
|
2001-03-18 03:23:30 +00:00
|
|
|
|
2001-11-18 02:51:20 +00:00
|
|
|
if ((tvb==NULL) || (tvb_reported_length(tvb)==0)) {
|
2001-03-18 03:23:30 +00:00
|
|
|
/* Interim reply */
|
2001-12-10 00:26:21 +00:00
|
|
|
col_set_str(pinfo->cinfo, COL_INFO, "Interim reply");
|
2001-03-18 03:23:30 +00:00
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
2001-12-10 00:26:21 +00:00
|
|
|
if (check_col(pinfo->cinfo, COL_INFO)) {
|
|
|
|
col_clear(pinfo->cinfo, COL_INFO);
|
2001-11-27 05:14:04 +00:00
|
|
|
}
|
|
|
|
|
2001-11-18 02:51:20 +00:00
|
|
|
smb_info = pinfo->private_data;
|
|
|
|
if (smb_info->sip != NULL)
|
|
|
|
tri = smb_info->sip->extra_info;
|
|
|
|
else
|
|
|
|
tri = NULL;
|
|
|
|
|
2001-11-15 10:41:53 +00:00
|
|
|
/* check which mailslot this is about */
|
2001-11-18 02:51:20 +00:00
|
|
|
trans_subcmd=MAILSLOT_UNKNOWN;
|
2001-11-15 10:41:53 +00:00
|
|
|
if(smb_info->request){
|
2001-11-18 01:46:51 +00:00
|
|
|
if(strncmp(mailslot,"BROWSE",6) == 0){
|
2001-11-18 02:51:20 +00:00
|
|
|
trans_subcmd=MAILSLOT_BROWSE;
|
2001-11-18 01:46:51 +00:00
|
|
|
} else if(strncmp(mailslot,"LANMAN",6) == 0){
|
2001-11-18 02:51:20 +00:00
|
|
|
trans_subcmd=MAILSLOT_LANMAN;
|
2001-11-18 01:46:51 +00:00
|
|
|
} else if(strncmp(mailslot,"NET",3) == 0){
|
2001-11-18 02:51:20 +00:00
|
|
|
trans_subcmd=MAILSLOT_NET;
|
2001-11-18 01:46:51 +00:00
|
|
|
} else if(strncmp(mailslot,"TEMP\\NETLOGON",13) == 0){
|
2001-11-18 02:51:20 +00:00
|
|
|
trans_subcmd=MAILSLOT_TEMP_NETLOGON;
|
2001-11-18 01:46:51 +00:00
|
|
|
} else if(strncmp(mailslot,"MSSP",4) == 0){
|
2001-11-18 02:51:20 +00:00
|
|
|
trans_subcmd=MAILSLOT_MSSP;
|
2001-11-15 10:41:53 +00:00
|
|
|
}
|
2001-11-28 11:33:55 +00:00
|
|
|
if (!pinfo->fd->flags.visited) {
|
|
|
|
if (tri != NULL)
|
|
|
|
tri->trans_subcmd = trans_subcmd;
|
|
|
|
}
|
2002-02-10 02:25:14 +00:00
|
|
|
} else {
|
2001-11-28 11:33:55 +00:00
|
|
|
trans_subcmd = tri->trans_subcmd;
|
2001-11-27 05:14:04 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Only do these ones if we have them. For fragmented SMB Transactions
|
|
|
|
we may only have the setup area for the first fragment
|
|
|
|
*/
|
|
|
|
if(mshdr_tvb && setup_tvb){
|
2002-02-10 02:25:14 +00:00
|
|
|
if (parent_tree) {
|
|
|
|
item = proto_tree_add_item(parent_tree, proto_smb_msp,
|
|
|
|
mshdr_tvb, 0, -1, FALSE);
|
|
|
|
tree = proto_item_add_subtree(item, ett_smb_msp);
|
|
|
|
}
|
|
|
|
|
2001-11-27 05:14:04 +00:00
|
|
|
/* do the opcode field */
|
|
|
|
opcode = tvb_get_letohs(setup_tvb, offset);
|
|
|
|
|
2001-12-10 00:26:21 +00:00
|
|
|
if (check_col(pinfo->cinfo, COL_INFO)) {
|
|
|
|
col_add_str(pinfo->cinfo, COL_INFO,
|
2001-11-27 05:14:04 +00:00
|
|
|
val_to_str(opcode, opcode_vals, "Unknown opcode: 0x%04x"));
|
|
|
|
}
|
|
|
|
|
2001-08-07 08:39:57 +00:00
|
|
|
|
Pass, as the first tvbuff argument to "dissect_mailslot_smb()" and
"dissect_pipe_smb()", a tvbuff containing the setup words and the
pipe/mailslot pathname, as those are arguably the part of the packet
that contains the "mailslot protocol" and the "pipe protocol", as
opposed to the protocol running atop mailslots or pipes.
Pass a setup tvbuff to "dissect_pipe_smb()" for it to pass on to the
MSRPC-over-named-pipe dissector, and have the setup tvbuff passed to it
and "dissect_mailslot_smb()" contain *only* the setup words; don't
extract anything other than the setup words from it.
Declare "register_proto_smb_mailslot()" in "packet-smb-mailslot.h"
rather than "packet-smb.c", and declare "register_proto_smb_pipe()" in
"packet-smb-pipe.h" rather than "packet-smb.c".
Add a protocol for MSRPC-over-named-pipes.
Move the stuff to handle the FID in the setup words of
MSRPC-over-named-pipe transactions out of the SMB Transaction dissector
into the MSRPC dissector. Add a routine to "packet-smb.c", callable
from outside "packet-smb.c", to put an "smb.fid" field into the protocol
tree, and to add ", FID: XXXX" to the Info column, for use by the
MSRPC-over-named-pipe dissector; use it in the SMB dissector as well, in
all the places where we put a FID into the protocol tree.
Move the stuff to check whether the LANMAN protocol is enabled, and to
set "pinfo->current_proto" to "LANMAN" if it is, into the LANMAN
API-over-named-pipe dissector out of the named pipe protocol dissector.
If we didn't dissect a Transaction request or reply as a named pipe or
mailslot message, put any setup words, parameters, and data it has into
the protocol tree as separate items.
Don't put a "Response in" item into the protocol tree for an NT Cancel
request, as there are no responses to NT Cancel requests.
svn path=/trunk/; revision=4221
2001-11-19 10:06:42 +00:00
|
|
|
/* These are in the setup words; use "setup_tvb". */
|
|
|
|
|
2001-08-07 08:39:57 +00:00
|
|
|
/* opcode */
|
|
|
|
proto_tree_add_uint(tree, hf_opcode, setup_tvb, offset, 2,
|
|
|
|
opcode);
|
|
|
|
offset += 2;
|
|
|
|
|
|
|
|
/* priority */
|
|
|
|
proto_tree_add_item(tree, hf_priority, setup_tvb, offset, 2,
|
|
|
|
TRUE);
|
|
|
|
offset += 2;
|
|
|
|
|
|
|
|
/* class */
|
|
|
|
proto_tree_add_item(tree, hf_class, setup_tvb, offset, 2, TRUE);
|
|
|
|
offset += 2;
|
|
|
|
|
Pass, as the first tvbuff argument to "dissect_mailslot_smb()" and
"dissect_pipe_smb()", a tvbuff containing the setup words and the
pipe/mailslot pathname, as those are arguably the part of the packet
that contains the "mailslot protocol" and the "pipe protocol", as
opposed to the protocol running atop mailslots or pipes.
Pass a setup tvbuff to "dissect_pipe_smb()" for it to pass on to the
MSRPC-over-named-pipe dissector, and have the setup tvbuff passed to it
and "dissect_mailslot_smb()" contain *only* the setup words; don't
extract anything other than the setup words from it.
Declare "register_proto_smb_mailslot()" in "packet-smb-mailslot.h"
rather than "packet-smb.c", and declare "register_proto_smb_pipe()" in
"packet-smb-pipe.h" rather than "packet-smb.c".
Add a protocol for MSRPC-over-named-pipes.
Move the stuff to handle the FID in the setup words of
MSRPC-over-named-pipe transactions out of the SMB Transaction dissector
into the MSRPC dissector. Add a routine to "packet-smb.c", callable
from outside "packet-smb.c", to put an "smb.fid" field into the protocol
tree, and to add ", FID: XXXX" to the Info column, for use by the
MSRPC-over-named-pipe dissector; use it in the SMB dissector as well, in
all the places where we put a FID into the protocol tree.
Move the stuff to check whether the LANMAN protocol is enabled, and to
set "pinfo->current_proto" to "LANMAN" if it is, into the LANMAN
API-over-named-pipe dissector out of the named pipe protocol dissector.
If we didn't dissect a Transaction request or reply as a named pipe or
mailslot message, put any setup words, parameters, and data it has into
the protocol tree as separate items.
Don't put a "Response in" item into the protocol tree for an NT Cancel
request, as there are no responses to NT Cancel requests.
svn path=/trunk/; revision=4221
2001-11-19 10:06:42 +00:00
|
|
|
/* These are in the rest of the data; use "mshdr_tvb", which
|
|
|
|
starts at the same place "setup_tvb" does. */
|
|
|
|
|
2001-08-07 08:39:57 +00:00
|
|
|
/* size */
|
2001-11-27 05:14:04 +00:00
|
|
|
/* this is actually bytecount in the SMB Transaction command */
|
Pass, as the first tvbuff argument to "dissect_mailslot_smb()" and
"dissect_pipe_smb()", a tvbuff containing the setup words and the
pipe/mailslot pathname, as those are arguably the part of the packet
that contains the "mailslot protocol" and the "pipe protocol", as
opposed to the protocol running atop mailslots or pipes.
Pass a setup tvbuff to "dissect_pipe_smb()" for it to pass on to the
MSRPC-over-named-pipe dissector, and have the setup tvbuff passed to it
and "dissect_mailslot_smb()" contain *only* the setup words; don't
extract anything other than the setup words from it.
Declare "register_proto_smb_mailslot()" in "packet-smb-mailslot.h"
rather than "packet-smb.c", and declare "register_proto_smb_pipe()" in
"packet-smb-pipe.h" rather than "packet-smb.c".
Add a protocol for MSRPC-over-named-pipes.
Move the stuff to handle the FID in the setup words of
MSRPC-over-named-pipe transactions out of the SMB Transaction dissector
into the MSRPC dissector. Add a routine to "packet-smb.c", callable
from outside "packet-smb.c", to put an "smb.fid" field into the protocol
tree, and to add ", FID: XXXX" to the Info column, for use by the
MSRPC-over-named-pipe dissector; use it in the SMB dissector as well, in
all the places where we put a FID into the protocol tree.
Move the stuff to check whether the LANMAN protocol is enabled, and to
set "pinfo->current_proto" to "LANMAN" if it is, into the LANMAN
API-over-named-pipe dissector out of the named pipe protocol dissector.
If we didn't dissect a Transaction request or reply as a named pipe or
mailslot message, put any setup words, parameters, and data it has into
the protocol tree as separate items.
Don't put a "Response in" item into the protocol tree for an NT Cancel
request, as there are no responses to NT Cancel requests.
svn path=/trunk/; revision=4221
2001-11-19 10:06:42 +00:00
|
|
|
proto_tree_add_item(tree, hf_size, mshdr_tvb, offset, 2, TRUE);
|
2001-08-07 08:39:57 +00:00
|
|
|
offset += 2;
|
|
|
|
|
|
|
|
/* mailslot name */
|
Pass, as the first tvbuff argument to "dissect_mailslot_smb()" and
"dissect_pipe_smb()", a tvbuff containing the setup words and the
pipe/mailslot pathname, as those are arguably the part of the packet
that contains the "mailslot protocol" and the "pipe protocol", as
opposed to the protocol running atop mailslots or pipes.
Pass a setup tvbuff to "dissect_pipe_smb()" for it to pass on to the
MSRPC-over-named-pipe dissector, and have the setup tvbuff passed to it
and "dissect_mailslot_smb()" contain *only* the setup words; don't
extract anything other than the setup words from it.
Declare "register_proto_smb_mailslot()" in "packet-smb-mailslot.h"
rather than "packet-smb.c", and declare "register_proto_smb_pipe()" in
"packet-smb-pipe.h" rather than "packet-smb.c".
Add a protocol for MSRPC-over-named-pipes.
Move the stuff to handle the FID in the setup words of
MSRPC-over-named-pipe transactions out of the SMB Transaction dissector
into the MSRPC dissector. Add a routine to "packet-smb.c", callable
from outside "packet-smb.c", to put an "smb.fid" field into the protocol
tree, and to add ", FID: XXXX" to the Info column, for use by the
MSRPC-over-named-pipe dissector; use it in the SMB dissector as well, in
all the places where we put a FID into the protocol tree.
Move the stuff to check whether the LANMAN protocol is enabled, and to
set "pinfo->current_proto" to "LANMAN" if it is, into the LANMAN
API-over-named-pipe dissector out of the named pipe protocol dissector.
If we didn't dissect a Transaction request or reply as a named pipe or
mailslot message, put any setup words, parameters, and data it has into
the protocol tree as separate items.
Don't put a "Response in" item into the protocol tree for an NT Cancel
request, as there are no responses to NT Cancel requests.
svn path=/trunk/; revision=4221
2001-11-19 10:06:42 +00:00
|
|
|
len = tvb_strsize(mshdr_tvb, offset);
|
|
|
|
proto_tree_add_item(tree, hf_name, mshdr_tvb, offset, len, TRUE);
|
2001-11-28 09:44:27 +00:00
|
|
|
offset += len;
|
2002-02-10 02:25:14 +00:00
|
|
|
proto_item_set_len(item, offset);
|
2001-08-07 08:39:57 +00:00
|
|
|
}
|
2000-02-14 04:02:21 +00:00
|
|
|
|
2001-11-18 02:51:20 +00:00
|
|
|
dissected = FALSE;
|
|
|
|
switch(trans_subcmd){
|
2001-11-15 10:41:53 +00:00
|
|
|
case MAILSLOT_BROWSE:
|
2001-11-18 02:51:20 +00:00
|
|
|
dissected = dissect_mailslot_browse(tvb, pinfo, parent_tree);
|
2001-11-15 10:41:53 +00:00
|
|
|
break;
|
|
|
|
case MAILSLOT_LANMAN:
|
2001-11-18 02:51:20 +00:00
|
|
|
dissected = dissect_mailslot_lanman(tvb, pinfo, parent_tree);
|
2001-11-15 10:41:53 +00:00
|
|
|
break;
|
|
|
|
case MAILSLOT_NET:
|
|
|
|
case MAILSLOT_TEMP_NETLOGON:
|
|
|
|
case MAILSLOT_MSSP:
|
2001-11-18 02:51:20 +00:00
|
|
|
dissected = dissect_smb_logon(tvb, pinfo, parent_tree);
|
2001-11-15 10:41:53 +00:00
|
|
|
break;
|
2001-08-07 08:39:57 +00:00
|
|
|
}
|
2001-11-18 02:51:20 +00:00
|
|
|
if (!dissected) {
|
|
|
|
/*
|
|
|
|
* We dissected the mailslot header, but not the
|
|
|
|
* message; dissect the latter as data, but indicate
|
|
|
|
* that we successfully dissected the mailslot stuff.
|
|
|
|
*/
|
2001-11-26 04:52:51 +00:00
|
|
|
call_dissector(data_handle,tvb, pinfo, parent_tree);
|
2001-11-18 02:51:20 +00:00
|
|
|
}
|
|
|
|
return TRUE;
|
2000-02-14 04:02:21 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2001-11-19 10:23:39 +00:00
|
|
|
proto_register_smb_mailslot(void)
|
2001-08-07 08:39:57 +00:00
|
|
|
{
|
|
|
|
static hf_register_info hf[] = {
|
|
|
|
{ &hf_opcode,
|
|
|
|
{ "Opcode", "mailslot.opcode", FT_UINT16, BASE_DEC,
|
|
|
|
VALS(opcode_vals), 0, "MAILSLOT OpCode", HFILL }},
|
2000-02-14 04:02:21 +00:00
|
|
|
|
2001-08-07 08:39:57 +00:00
|
|
|
{ &hf_priority,
|
|
|
|
{ "Priority", "mailslot.priority", FT_UINT16, BASE_DEC,
|
|
|
|
NULL, 0, "MAILSLOT Priority of transaction", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_class,
|
|
|
|
{ "Class", "mailslot.class", FT_UINT16, BASE_DEC,
|
|
|
|
VALS(class_vals), 0, "MAILSLOT Class of transaction", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_size,
|
|
|
|
{ "Size", "mailslot.size", FT_UINT16, BASE_DEC,
|
|
|
|
NULL, 0, "MAILSLOT Total size of mail data", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_name,
|
|
|
|
{ "Mailslot Name", "mailslot.name", FT_STRING, BASE_NONE,
|
|
|
|
NULL, 0, "MAILSLOT Name of mailslot", HFILL }},
|
|
|
|
|
|
|
|
};
|
2000-02-14 04:02:21 +00:00
|
|
|
|
|
|
|
static gint *ett[] = {
|
|
|
|
&ett_smb_msp
|
|
|
|
};
|
|
|
|
|
2001-08-07 08:39:57 +00:00
|
|
|
proto_smb_msp = proto_register_protocol(
|
|
|
|
"SMB MailSlot Protocol", "SMB Mailslot", "mailslot");
|
2000-02-14 04:02:21 +00:00
|
|
|
|
2001-08-07 08:39:57 +00:00
|
|
|
proto_register_field_array(proto_smb_msp, hf, array_length(hf));
|
2000-02-14 04:21:04 +00:00
|
|
|
proto_register_subtree_array(ett, array_length(ett));
|
2000-02-14 04:02:21 +00:00
|
|
|
}
|
2001-11-26 04:52:51 +00:00
|
|
|
|
|
|
|
void
|
|
|
|
proto_reg_handoff_smb_mailslot(void)
|
|
|
|
{
|
2002-02-10 02:25:14 +00:00
|
|
|
data_handle = find_dissector("data");
|
2001-11-26 04:52:51 +00:00
|
|
|
}
|