2005-09-17 00:31:15 +00:00
|
|
|
/* packet-smb.h
|
|
|
|
* Defines for SMB packet dissection
|
1999-05-09 04:20:59 +00:00
|
|
|
* Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com>
|
|
|
|
*
|
2006-05-21 04:49:01 +00:00
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
1999-05-09 04:20:59 +00:00
|
|
|
* Copyright 1998, 1999 Gerald Combs
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1999-05-09 04:20:59 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1999-05-09 04:20:59 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
2012-06-28 22:56:06 +00:00
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
1999-05-09 04:20:59 +00:00
|
|
|
*/
|
|
|
|
|
2005-09-17 00:31:15 +00:00
|
|
|
#ifndef __PACKET_SMB_H__
|
|
|
|
#define __PACKET_SMB_H__
|
1999-05-09 04:20:59 +00:00
|
|
|
|
2013-03-01 23:53:11 +00:00
|
|
|
#include "ws_symbol_export.h"
|
2007-03-26 21:16:21 +00:00
|
|
|
|
2013-12-03 21:31:04 +00:00
|
|
|
#include <epan/proto.h>
|
2013-09-01 01:00:11 +00:00
|
|
|
#include <epan/wmem/wmem.h>
|
|
|
|
|
2013-03-01 23:53:11 +00:00
|
|
|
WS_DLL_PUBLIC gboolean sid_name_snooping;
|
2004-05-09 10:03:41 +00:00
|
|
|
|
2010-10-29 20:22:02 +00:00
|
|
|
/* SMB command codes, from the SNIA CIFS spec. With MSVC and a
|
2006-05-21 04:49:01 +00:00
|
|
|
* libwireshark.dll, we need a special declaration.
|
2004-05-09 10:03:41 +00:00
|
|
|
*/
|
2013-03-01 23:53:11 +00:00
|
|
|
WS_DLL_PUBLIC value_string_ext smb_cmd_vals_ext;
|
|
|
|
WS_DLL_PUBLIC value_string_ext trans2_cmd_vals_ext;
|
|
|
|
WS_DLL_PUBLIC value_string_ext nt_cmd_vals_ext;
|
2003-03-25 09:41:42 +00:00
|
|
|
|
2001-11-21 06:25:58 +00:00
|
|
|
#define SMB_COM_CREATE_DIRECTORY 0x00
|
|
|
|
#define SMB_COM_DELETE_DIRECTORY 0x01
|
|
|
|
#define SMB_COM_OPEN 0x02
|
|
|
|
#define SMB_COM_CREATE 0x03
|
|
|
|
#define SMB_COM_CLOSE 0x04
|
|
|
|
#define SMB_COM_FLUSH 0x05
|
|
|
|
#define SMB_COM_DELETE 0x06
|
|
|
|
#define SMB_COM_RENAME 0x07
|
|
|
|
#define SMB_COM_QUERY_INFORMATION 0x08
|
|
|
|
#define SMB_COM_SET_INFORMATION 0x09
|
|
|
|
#define SMB_COM_READ 0x0A
|
|
|
|
#define SMB_COM_WRITE 0x0B
|
|
|
|
#define SMB_COM_LOCK_BYTE_RANGE 0x0C
|
|
|
|
#define SMB_COM_UNLOCK_BYTE_RANGE 0x0D
|
|
|
|
#define SMB_COM_CREATE_TEMPORARY 0x0E
|
|
|
|
#define SMB_COM_CREATE_NEW 0x0F
|
|
|
|
#define SMB_COM_CHECK_DIRECTORY 0x10
|
|
|
|
#define SMB_COM_PROCESS_EXIT 0x11
|
|
|
|
#define SMB_COM_SEEK 0x12
|
|
|
|
#define SMB_COM_LOCK_AND_READ 0x13
|
|
|
|
#define SMB_COM_WRITE_AND_UNLOCK 0x14
|
|
|
|
#define SMB_COM_READ_RAW 0x1A
|
|
|
|
#define SMB_COM_READ_MPX 0x1B
|
|
|
|
#define SMB_COM_READ_MPX_SECONDARY 0x1C
|
|
|
|
#define SMB_COM_WRITE_RAW 0x1D
|
|
|
|
#define SMB_COM_WRITE_MPX 0x1E
|
|
|
|
#define SMB_COM_WRITE_MPX_SECONDARY 0x1F
|
|
|
|
#define SMB_COM_WRITE_COMPLETE 0x20
|
|
|
|
#define SMB_COM_QUERY_SERVER 0x21
|
|
|
|
#define SMB_COM_SET_INFORMATION2 0x22
|
|
|
|
#define SMB_COM_QUERY_INFORMATION2 0x23
|
|
|
|
#define SMB_COM_LOCKING_ANDX 0x24
|
|
|
|
#define SMB_COM_TRANSACTION 0x25
|
|
|
|
#define SMB_COM_TRANSACTION_SECONDARY 0x26
|
|
|
|
#define SMB_COM_IOCTL 0x27
|
|
|
|
#define SMB_COM_IOCTL_SECONDARY 0x28
|
|
|
|
#define SMB_COM_COPY 0x29
|
|
|
|
#define SMB_COM_MOVE 0x2A
|
|
|
|
#define SMB_COM_ECHO 0x2B
|
|
|
|
#define SMB_COM_WRITE_AND_CLOSE 0x2C
|
|
|
|
#define SMB_COM_OPEN_ANDX 0x2D
|
|
|
|
#define SMB_COM_READ_ANDX 0x2E
|
|
|
|
#define SMB_COM_WRITE_ANDX 0x2F
|
|
|
|
#define SMB_COM_NEW_FILE_SIZE 0x30
|
|
|
|
#define SMB_COM_CLOSE_AND_TREE_DISC 0x31
|
|
|
|
#define SMB_COM_TRANSACTION2 0x32
|
|
|
|
#define SMB_COM_TRANSACTION2_SECONDARY 0x33
|
|
|
|
#define SMB_COM_FIND_CLOSE2 0x34
|
|
|
|
#define SMB_COM_FIND_NOTIFY_CLOSE 0x35
|
|
|
|
/* Used by Xenix/Unix 0x60-0x6E */
|
|
|
|
#define SMB_COM_TREE_CONNECT 0x70
|
|
|
|
#define SMB_COM_TREE_DISCONNECT 0x71
|
|
|
|
#define SMB_COM_NEGOTIATE 0x72
|
|
|
|
#define SMB_COM_SESSION_SETUP_ANDX 0x73
|
|
|
|
#define SMB_COM_LOGOFF_ANDX 0x74
|
|
|
|
#define SMB_COM_TREE_CONNECT_ANDX 0x75
|
|
|
|
#define SMB_COM_QUERY_INFORMATION_DISK 0x80
|
|
|
|
#define SMB_COM_SEARCH 0x81
|
|
|
|
#define SMB_COM_FIND 0x82
|
|
|
|
#define SMB_COM_FIND_UNIQUE 0x83
|
|
|
|
#define SMB_COM_FIND_CLOSE 0x84
|
|
|
|
#define SMB_COM_NT_TRANSACT 0xA0
|
|
|
|
#define SMB_COM_NT_TRANSACT_SECONDARY 0xA1
|
|
|
|
#define SMB_COM_NT_CREATE_ANDX 0xA2
|
|
|
|
#define SMB_COM_NT_CANCEL 0xA4
|
|
|
|
#define SMB_COM_NT_RENAME 0xA5
|
|
|
|
#define SMB_COM_OPEN_PRINT_FILE 0xC0
|
|
|
|
#define SMB_COM_WRITE_PRINT_FILE 0xC1
|
|
|
|
#define SMB_COM_CLOSE_PRINT_FILE 0xC2
|
|
|
|
#define SMB_COM_GET_PRINT_QUEUE 0xC3
|
|
|
|
#define SMB_COM_READ_BULK 0xD8
|
|
|
|
#define SMB_COM_WRITE_BULK 0xD9
|
|
|
|
#define SMB_COM_WRITE_BULK_DATA 0xDA
|
1999-05-09 04:20:59 +00:00
|
|
|
|
|
|
|
/* Error codes */
|
|
|
|
|
|
|
|
#define SMB_SUCCESS 0x00 /* All OK */
|
|
|
|
#define SMB_ERRDOS 0x01 /* DOS based error */
|
|
|
|
#define SMB_ERRSRV 0x02 /* server error, network file manager */
|
|
|
|
#define SMB_ERRHRD 0x03 /* Hardware style error */
|
|
|
|
#define SMB_ERRCMD 0x04 /* Not an SMB format command */
|
|
|
|
|
2013-03-09 08:44:14 +00:00
|
|
|
/* used for SMB export object functionality */
|
2010-06-15 14:03:49 +00:00
|
|
|
typedef struct _smb_eo_t {
|
2013-11-27 16:30:20 +00:00
|
|
|
guint smbversion;
|
|
|
|
guint16 cmd;
|
|
|
|
int tid,uid;
|
|
|
|
guint fid;
|
|
|
|
guint32 pkt_num;
|
|
|
|
gchar *hostname;
|
|
|
|
gchar *filename;
|
|
|
|
int fid_type;
|
|
|
|
gint64 end_of_file;
|
|
|
|
gchar *content_type;
|
|
|
|
guint32 payload_len;
|
2013-03-09 08:44:14 +00:00
|
|
|
const guint8 *payload_data;
|
2013-11-27 16:30:20 +00:00
|
|
|
guint64 smb_file_offset;
|
|
|
|
guint32 smb_chunk_len;
|
2010-06-15 14:03:49 +00:00
|
|
|
} smb_eo_t;
|
|
|
|
|
2013-11-27 16:30:20 +00:00
|
|
|
/* the information we need to keep around for NT transaction commands */
|
2003-01-22 00:40:36 +00:00
|
|
|
typedef struct {
|
2013-11-27 16:30:20 +00:00
|
|
|
int subcmd;
|
|
|
|
int fid_type;
|
2007-05-07 09:07:29 +00:00
|
|
|
guint32 ioctl_function;
|
2003-01-22 00:40:36 +00:00
|
|
|
} smb_nt_transact_info_t;
|
|
|
|
|
|
|
|
/* the information we need to keep around for transaction2 commands */
|
|
|
|
typedef struct {
|
2013-11-27 16:30:20 +00:00
|
|
|
int subcmd;
|
|
|
|
int info_level;
|
|
|
|
gboolean resume_keys; /* if "return resume" keys set in T2 FIND_FIRST request */
|
2007-05-22 03:33:51 +00:00
|
|
|
const char *name;
|
2003-01-22 00:40:36 +00:00
|
|
|
} smb_transact2_info_t;
|
|
|
|
|
2001-11-18 02:51:20 +00:00
|
|
|
/*
|
|
|
|
* The information we need to save about a request in order to show the
|
|
|
|
* frame number of the request in the dissection of the reply.
|
|
|
|
*/
|
2002-03-16 04:39:29 +00:00
|
|
|
#define SMB_SIF_TID_IS_IPC 0x0001
|
2004-09-30 01:04:33 +00:00
|
|
|
#define SMB_SIF_IS_CONTINUED 0x0002
|
2005-04-16 21:54:32 +00:00
|
|
|
typedef enum {
|
2007-04-26 19:44:18 +00:00
|
|
|
SMB_EI_NONE, /* Unassigned / NULL */
|
|
|
|
SMB_EI_FID, /* FID */
|
|
|
|
SMB_EI_NTI, /* smb_nt_transact_info_t * */
|
|
|
|
SMB_EI_TRI, /* smb_transact_info_t * */
|
|
|
|
SMB_EI_T2I, /* smb_transact2_info_t * */
|
2013-11-27 16:30:20 +00:00
|
|
|
SMB_EI_TIDNAME, /* tid tracking char * */
|
2007-05-10 20:53:35 +00:00
|
|
|
SMB_EI_FILEDATA, /* fid tracking */
|
2007-05-22 23:05:25 +00:00
|
|
|
SMB_EI_FILENAME, /* filename tracking */
|
2007-05-21 07:17:36 +00:00
|
|
|
SMB_EI_UID, /* smb_uid_t */
|
2013-10-13 19:56:52 +00:00
|
|
|
SMB_EI_RWINFO, /* read/write offset/count info */
|
2007-06-17 23:58:01 +00:00
|
|
|
SMB_EI_LOCKDATA, /* locking and x data */
|
2008-09-24 16:16:01 +00:00
|
|
|
SMB_EI_RENAMEDATA, /* rename data */
|
|
|
|
SMB_EI_DIALECTS /* negprot dialects */
|
2005-04-16 21:54:32 +00:00
|
|
|
} smb_extra_info_t;
|
2013-11-27 16:30:20 +00:00
|
|
|
|
2007-05-21 03:44:49 +00:00
|
|
|
typedef struct _smb_fid_into_t smb_fid_info_t;
|
2013-11-27 16:30:20 +00:00
|
|
|
|
2001-11-18 02:51:20 +00:00
|
|
|
typedef struct {
|
2013-11-27 16:30:20 +00:00
|
|
|
guint32 frame_req, frame_res;
|
|
|
|
nstime_t req_time;
|
|
|
|
guint16 flags;
|
|
|
|
guint8 cmd;
|
|
|
|
void *extra_info;
|
|
|
|
smb_extra_info_t extra_info_type;
|
2007-05-21 03:44:49 +00:00
|
|
|
/* we save the fid in each transaction so that we can get fid filters
|
|
|
|
to match both request and response */
|
2013-11-27 16:30:20 +00:00
|
|
|
gboolean fid_seen_in_request;
|
|
|
|
guint16 fid;
|
2001-11-18 02:51:20 +00:00
|
|
|
} smb_saved_info_t;
|
|
|
|
|
2001-08-11 07:26:25 +00:00
|
|
|
/*
|
2001-11-18 01:46:51 +00:00
|
|
|
* The information we need to save about a Transaction request in order
|
|
|
|
* to dissect the reply; this includes information for use by the
|
|
|
|
* Remote API and Mailslot dissectors.
|
|
|
|
* XXX - have an additional data structure hung off of this by the
|
|
|
|
* subdissectors?
|
2001-08-11 07:26:25 +00:00
|
|
|
*/
|
2001-11-18 01:46:51 +00:00
|
|
|
typedef struct {
|
2013-11-27 16:30:20 +00:00
|
|
|
int subcmd;
|
|
|
|
int trans_subcmd;
|
|
|
|
int function;
|
|
|
|
/* Unification of fid variable type (was int) */
|
|
|
|
guint16 fid;
|
|
|
|
guint16 lanman_cmd;
|
|
|
|
guchar *param_descrip; /* Keep these descriptors around */
|
|
|
|
guchar *data_descrip;
|
|
|
|
guchar *aux_data_descrip;
|
|
|
|
int info_level;
|
2001-11-18 01:46:51 +00:00
|
|
|
} smb_transact_info_t;
|
2001-11-15 10:41:53 +00:00
|
|
|
|
2001-11-18 01:46:51 +00:00
|
|
|
/*
|
|
|
|
* Subcommand type.
|
|
|
|
*/
|
|
|
|
#define TRANSACTION_PIPE 0
|
|
|
|
#define TRANSACTION_MAILSLOT 1
|
2001-11-15 10:41:53 +00:00
|
|
|
|
2002-03-16 04:39:29 +00:00
|
|
|
/* these are defines used to represent different types of TIDs.
|
2014-09-16 13:43:06 +00:00
|
|
|
don't use the value 0 for any of these */
|
2002-03-16 04:39:29 +00:00
|
|
|
#define TID_NORMAL 1
|
|
|
|
#define TID_IPC 2
|
|
|
|
|
2001-12-05 08:20:30 +00:00
|
|
|
/* this is the structure which is associated with each conversation */
|
|
|
|
typedef struct conv_tables {
|
|
|
|
/* these two tables are used to match requests with responses */
|
2013-11-27 16:30:20 +00:00
|
|
|
GHashTable *unmatched;
|
|
|
|
GHashTable *matched;
|
2012-06-19 06:24:30 +00:00
|
|
|
/* This table keeps primary transact requests so secondaries can find
|
|
|
|
them */
|
2013-11-27 16:30:20 +00:00
|
|
|
GHashTable *primaries;
|
2003-04-12 08:14:02 +00:00
|
|
|
|
2002-03-16 04:39:29 +00:00
|
|
|
/* This table is used to track TID->services for a conversation */
|
2013-11-27 16:30:20 +00:00
|
|
|
GHashTable *tid_service;
|
|
|
|
gboolean raw_ntlmssp; /* Do extended security exc use raw ntlmssp */
|
2006-06-18 05:45:40 +00:00
|
|
|
|
|
|
|
/* track fid to fidstruct (filename/openframe/closeframe */
|
2013-09-01 01:00:11 +00:00
|
|
|
wmem_tree_t *fid_tree;
|
2010-06-15 14:03:49 +00:00
|
|
|
/* We'll use a GSL list instead */
|
2013-11-27 16:30:20 +00:00
|
|
|
GSList *GSL_fid_info;
|
2006-06-19 09:44:15 +00:00
|
|
|
|
|
|
|
/* track tid to fidstruct (sharename/shareframe/unshareframe */
|
2013-09-01 01:00:11 +00:00
|
|
|
wmem_tree_t *tid_tree;
|
2007-04-24 05:09:53 +00:00
|
|
|
|
|
|
|
/* track uid to username mappings */
|
2013-09-01 01:00:11 +00:00
|
|
|
wmem_tree_t *uid_tree;
|
2001-12-05 08:20:30 +00:00
|
|
|
} conv_tables_t;
|
|
|
|
|
2001-11-03 06:56:56 +00:00
|
|
|
typedef struct smb_info {
|
2013-11-27 16:30:20 +00:00
|
|
|
guint8 cmd;
|
|
|
|
int tid, pid, uid, mid;
|
|
|
|
guint32 nt_status;
|
2001-11-18 01:46:51 +00:00
|
|
|
gboolean unicode; /* Are strings in this SMB Unicode? */
|
|
|
|
gboolean request; /* Is this a request? */
|
2001-11-03 06:56:56 +00:00
|
|
|
gboolean unidir;
|
2013-11-27 16:30:20 +00:00
|
|
|
int info_level;
|
|
|
|
int info_count;
|
2001-11-18 02:51:20 +00:00
|
|
|
smb_saved_info_t *sip; /* smb_saved_info_t, if any, for this */
|
2013-11-27 16:30:20 +00:00
|
|
|
conv_tables_t *ct;
|
2001-11-03 06:56:56 +00:00
|
|
|
} smb_info_t;
|
2000-02-14 04:02:21 +00:00
|
|
|
|
2001-11-20 07:47:42 +00:00
|
|
|
/*
|
|
|
|
* Show file data for a read or write.
|
|
|
|
*/
|
2002-04-30 11:03:08 +00:00
|
|
|
extern int dissect_file_data(tvbuff_t *tvb, proto_tree *tree, int offset,
|
|
|
|
guint16 bc, guint16 datalen);
|
2001-11-20 07:47:42 +00:00
|
|
|
|
2006-08-16 08:00:46 +00:00
|
|
|
|
|
|
|
#define SMB_FID_TYPE_UNKNOWN 0
|
|
|
|
#define SMB_FID_TYPE_FILE 1
|
|
|
|
#define SMB_FID_TYPE_DIR 2
|
|
|
|
#define SMB_FID_TYPE_PIPE 3
|
2007-05-10 20:53:35 +00:00
|
|
|
|
2007-06-17 23:58:01 +00:00
|
|
|
/* used for tracking filenames from rename request to response */
|
|
|
|
typedef struct _smb_rename_saved_info_t {
|
|
|
|
char *old_name;
|
|
|
|
char *new_name;
|
|
|
|
} smb_rename_saved_info_t;
|
|
|
|
|
2007-06-17 20:57:34 +00:00
|
|
|
/* used for tracking lock data between lock request/response */
|
|
|
|
typedef struct _smb_lock_info_t {
|
2013-11-27 16:30:20 +00:00
|
|
|
struct _smb_lock_info_t *next;
|
|
|
|
guint16 pid;
|
|
|
|
guint64 offset;
|
|
|
|
guint64 length;
|
2007-06-17 20:57:34 +00:00
|
|
|
} smb_lock_info_t;
|
2013-11-27 16:30:20 +00:00
|
|
|
|
2007-06-17 20:57:34 +00:00
|
|
|
typedef struct _smb_locking_saved_info_t {
|
2013-11-27 16:30:20 +00:00
|
|
|
guint8 type;
|
|
|
|
guint8 oplock_level;
|
|
|
|
guint16 num_lock;
|
|
|
|
guint16 num_unlock;
|
2007-06-17 20:57:34 +00:00
|
|
|
smb_lock_info_t *locks;
|
|
|
|
smb_lock_info_t *unlocks;
|
|
|
|
} smb_locking_saved_info_t;
|
2013-11-27 16:30:20 +00:00
|
|
|
|
2006-08-16 08:00:46 +00:00
|
|
|
/* used for tracking fid/tid to filename/sharename openedframe closedframe */
|
2007-05-10 20:53:35 +00:00
|
|
|
typedef struct _smb_fid_saved_info_t {
|
2013-11-27 16:30:20 +00:00
|
|
|
char *filename;
|
|
|
|
guint32 create_flags;
|
|
|
|
guint32 access_mask;
|
|
|
|
guint32 file_attributes;
|
|
|
|
guint32 share_access;
|
|
|
|
guint32 create_options;
|
|
|
|
guint32 create_disposition;
|
2007-05-10 20:53:35 +00:00
|
|
|
} smb_fid_saved_info_t;
|
2013-11-27 16:30:20 +00:00
|
|
|
|
2007-05-21 03:44:49 +00:00
|
|
|
struct _smb_fid_into_t {
|
2013-11-27 16:30:20 +00:00
|
|
|
guint16 tid,fid;
|
2010-06-15 14:03:49 +00:00
|
|
|
/* The end_of_file will store the last registered offset or
|
|
|
|
the reported end_of_file from the SMB protocol */
|
2013-11-27 16:30:20 +00:00
|
|
|
gint64 end_of_file;
|
2010-06-15 14:03:49 +00:00
|
|
|
/* These two were int */
|
2013-11-27 16:30:20 +00:00
|
|
|
guint opened_in;
|
|
|
|
guint closed_in;
|
|
|
|
int type;
|
2007-05-10 20:53:35 +00:00
|
|
|
smb_fid_saved_info_t *fsi;
|
2007-05-21 03:44:49 +00:00
|
|
|
};
|
2006-08-16 08:00:46 +00:00
|
|
|
|
2007-05-10 20:53:35 +00:00
|
|
|
/* used for tracking tid to sharename openedframe closedframe */
|
|
|
|
typedef struct _smb_tid_into_t {
|
2013-11-27 16:30:20 +00:00
|
|
|
int opened_in;
|
|
|
|
int closed_in;
|
2007-05-10 20:53:35 +00:00
|
|
|
char *filename;
|
2013-11-27 16:30:20 +00:00
|
|
|
int type;
|
2007-05-10 20:53:35 +00:00
|
|
|
} smb_tid_info_t;
|
|
|
|
|
2006-08-16 08:00:46 +00:00
|
|
|
|
Pass, as the first tvbuff argument to "dissect_mailslot_smb()" and
"dissect_pipe_smb()", a tvbuff containing the setup words and the
pipe/mailslot pathname, as those are arguably the part of the packet
that contains the "mailslot protocol" and the "pipe protocol", as
opposed to the protocol running atop mailslots or pipes.
Pass a setup tvbuff to "dissect_pipe_smb()" for it to pass on to the
MSRPC-over-named-pipe dissector, and have the setup tvbuff passed to it
and "dissect_mailslot_smb()" contain *only* the setup words; don't
extract anything other than the setup words from it.
Declare "register_proto_smb_mailslot()" in "packet-smb-mailslot.h"
rather than "packet-smb.c", and declare "register_proto_smb_pipe()" in
"packet-smb-pipe.h" rather than "packet-smb.c".
Add a protocol for MSRPC-over-named-pipes.
Move the stuff to handle the FID in the setup words of
MSRPC-over-named-pipe transactions out of the SMB Transaction dissector
into the MSRPC dissector. Add a routine to "packet-smb.c", callable
from outside "packet-smb.c", to put an "smb.fid" field into the protocol
tree, and to add ", FID: XXXX" to the Info column, for use by the
MSRPC-over-named-pipe dissector; use it in the SMB dissector as well, in
all the places where we put a FID into the protocol tree.
Move the stuff to check whether the LANMAN protocol is enabled, and to
set "pinfo->current_proto" to "LANMAN" if it is, into the LANMAN
API-over-named-pipe dissector out of the named pipe protocol dissector.
If we didn't dissect a Transaction request or reply as a named pipe or
mailslot message, put any setup words, parameters, and data it has into
the protocol tree as separate items.
Don't put a "Response in" item into the protocol tree for an NT Cancel
request, as there are no responses to NT Cancel requests.
svn path=/trunk/; revision=4221
2001-11-19 10:06:42 +00:00
|
|
|
/*
|
2006-06-18 01:58:34 +00:00
|
|
|
* Dissect an smb FID
|
Pass, as the first tvbuff argument to "dissect_mailslot_smb()" and
"dissect_pipe_smb()", a tvbuff containing the setup words and the
pipe/mailslot pathname, as those are arguably the part of the packet
that contains the "mailslot protocol" and the "pipe protocol", as
opposed to the protocol running atop mailslots or pipes.
Pass a setup tvbuff to "dissect_pipe_smb()" for it to pass on to the
MSRPC-over-named-pipe dissector, and have the setup tvbuff passed to it
and "dissect_mailslot_smb()" contain *only* the setup words; don't
extract anything other than the setup words from it.
Declare "register_proto_smb_mailslot()" in "packet-smb-mailslot.h"
rather than "packet-smb.c", and declare "register_proto_smb_pipe()" in
"packet-smb-pipe.h" rather than "packet-smb.c".
Add a protocol for MSRPC-over-named-pipes.
Move the stuff to handle the FID in the setup words of
MSRPC-over-named-pipe transactions out of the SMB Transaction dissector
into the MSRPC dissector. Add a routine to "packet-smb.c", callable
from outside "packet-smb.c", to put an "smb.fid" field into the protocol
tree, and to add ", FID: XXXX" to the Info column, for use by the
MSRPC-over-named-pipe dissector; use it in the SMB dissector as well, in
all the places where we put a FID into the protocol tree.
Move the stuff to check whether the LANMAN protocol is enabled, and to
set "pinfo->current_proto" to "LANMAN" if it is, into the LANMAN
API-over-named-pipe dissector out of the named pipe protocol dissector.
If we didn't dissect a Transaction request or reply as a named pipe or
mailslot message, put any setup words, parameters, and data it has into
the protocol tree as separate items.
Don't put a "Response in" item into the protocol tree for an NT Cancel
request, as there are no responses to NT Cancel requests.
svn path=/trunk/; revision=4221
2001-11-19 10:06:42 +00:00
|
|
|
*/
|
2006-08-16 08:00:46 +00:00
|
|
|
extern smb_fid_info_t *dissect_smb_fid(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
|
2013-10-25 23:59:30 +00:00
|
|
|
int offset, int len, guint16 fid, gboolean is_created, gboolean is_closed, gboolean is_generated, smb_info_t* si);
|
Pass, as the first tvbuff argument to "dissect_mailslot_smb()" and
"dissect_pipe_smb()", a tvbuff containing the setup words and the
pipe/mailslot pathname, as those are arguably the part of the packet
that contains the "mailslot protocol" and the "pipe protocol", as
opposed to the protocol running atop mailslots or pipes.
Pass a setup tvbuff to "dissect_pipe_smb()" for it to pass on to the
MSRPC-over-named-pipe dissector, and have the setup tvbuff passed to it
and "dissect_mailslot_smb()" contain *only* the setup words; don't
extract anything other than the setup words from it.
Declare "register_proto_smb_mailslot()" in "packet-smb-mailslot.h"
rather than "packet-smb.c", and declare "register_proto_smb_pipe()" in
"packet-smb-pipe.h" rather than "packet-smb.c".
Add a protocol for MSRPC-over-named-pipes.
Move the stuff to handle the FID in the setup words of
MSRPC-over-named-pipe transactions out of the SMB Transaction dissector
into the MSRPC dissector. Add a routine to "packet-smb.c", callable
from outside "packet-smb.c", to put an "smb.fid" field into the protocol
tree, and to add ", FID: XXXX" to the Info column, for use by the
MSRPC-over-named-pipe dissector; use it in the SMB dissector as well, in
all the places where we put a FID into the protocol tree.
Move the stuff to check whether the LANMAN protocol is enabled, and to
set "pinfo->current_proto" to "LANMAN" if it is, into the LANMAN
API-over-named-pipe dissector out of the named pipe protocol dissector.
If we didn't dissect a Transaction request or reply as a named pipe or
mailslot message, put any setup words, parameters, and data it has into
the protocol tree as separate items.
Don't put a "Response in" item into the protocol tree for an NT Cancel
request, as there are no responses to NT Cancel requests.
svn path=/trunk/; revision=4221
2001-11-19 10:06:42 +00:00
|
|
|
|
2001-11-20 07:47:42 +00:00
|
|
|
/*
|
|
|
|
* Dissect named pipe state information.
|
|
|
|
*/
|
2002-04-30 11:03:08 +00:00
|
|
|
extern int dissect_ipc_state(tvbuff_t *tvb, proto_tree *parent_tree,
|
|
|
|
int offset, gboolean setstate);
|
2001-11-20 07:47:42 +00:00
|
|
|
|
2001-12-05 08:20:30 +00:00
|
|
|
extern gboolean smb_dcerpc_reassembly;
|
|
|
|
|
2010-08-10 07:04:20 +00:00
|
|
|
extern int dissect_file_ext_attr(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
|
2005-11-12 10:07:12 +00:00
|
|
|
|
2005-11-12 11:27:34 +00:00
|
|
|
extern const value_string create_disposition_vals[];
|
|
|
|
|
|
|
|
extern int dissect_nt_create_options(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
|
|
|
|
|
|
|
|
extern int dissect_nt_share_access(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
|
|
|
|
|
|
|
|
extern int dissect_smb_access_mask(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
|
|
|
|
|
|
|
|
extern const value_string oa_open_vals[];
|
2005-11-25 06:19:41 +00:00
|
|
|
extern const value_string impersonation_level_vals[];
|
2005-11-12 11:27:34 +00:00
|
|
|
|
2010-10-22 05:15:25 +00:00
|
|
|
extern gboolean sid_display_hex;
|
|
|
|
|
2005-11-17 12:30:36 +00:00
|
|
|
extern int dissect_security_information_mask(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
|
|
|
|
|
2005-11-17 13:43:22 +00:00
|
|
|
extern int dissect_qfsi_FS_VOLUME_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp, int unicode);
|
|
|
|
extern int dissect_qfsi_FS_SIZE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp);
|
|
|
|
extern int dissect_qfsi_FS_DEVICE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp);
|
|
|
|
extern int dissect_qfsi_FS_ATTRIBUTE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp, int unicode);
|
2005-11-17 14:00:07 +00:00
|
|
|
extern int dissect_nt_quota(tvbuff_t *tvb, proto_tree *tree, int offset, guint16 *bcp);
|
2005-11-17 14:22:11 +00:00
|
|
|
extern int dissect_qfsi_FS_OBJECTID_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp);
|
|
|
|
extern int dissect_qfsi_FS_FULL_SIZE_INFO(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, int offset, guint16 *bcp);
|
2005-11-17 22:30:19 +00:00
|
|
|
extern int dissect_qfi_SMB_FILE_EA_INFO(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
|
|
|
|
extern int dissect_qfi_SMB_FILE_STREAM_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, int offset, guint16 *bcp, gboolean *trunc, int unicode);
|
2013-10-25 23:59:30 +00:00
|
|
|
extern int dissect_qfi_SMB_FILE_NAME_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc, gboolean unicode);
|
2005-11-18 07:31:18 +00:00
|
|
|
extern int dissect_qfi_SMB_FILE_STANDARD_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
|
2005-11-25 05:41:00 +00:00
|
|
|
extern int dissect_qfi_SMB_FILE_INTERNAL_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
|
2011-05-19 16:22:21 +00:00
|
|
|
extern int dissect_qsfi_SMB_FILE_POSITION_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
|
|
|
|
extern int dissect_qsfi_SMB_FILE_MODE_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
|
2005-11-25 06:04:11 +00:00
|
|
|
extern int dissect_qfi_SMB_FILE_ALIGNMENT_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
|
2005-11-18 07:31:18 +00:00
|
|
|
extern int dissect_qfi_SMB_FILE_COMPRESSION_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
|
2005-11-25 08:02:40 +00:00
|
|
|
extern int dissect_qfi_SMB_FILE_NETWORK_OPEN_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
|
|
|
|
extern int dissect_qfi_SMB_FILE_ATTRIBUTE_TAG_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
|
2011-05-19 16:22:21 +00:00
|
|
|
extern int dissect_qsfi_SMB_FILE_ALLOCATION_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
|
|
|
|
extern int dissect_qsfi_SMB_FILE_ENDOFFILE_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
|
2005-11-26 00:34:22 +00:00
|
|
|
extern int dissect_nt_notify_completion_filter(tvbuff_t *tvb, proto_tree *parent_tree, int offset);
|
2006-02-07 08:48:51 +00:00
|
|
|
extern int dissect_sfi_SMB_FILE_PIPE_INFO(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc);
|
2013-10-25 23:59:30 +00:00
|
|
|
extern int dissect_get_dfs_request_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean unicode);
|
|
|
|
extern int dissect_get_dfs_referral_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean unicode);
|
2005-11-17 13:43:22 +00:00
|
|
|
|
2013-03-09 08:44:14 +00:00
|
|
|
/* Returns an IP (v4 or v6) of the server in a SMB/SMB2 conversation */
|
|
|
|
extern const gchar *tree_ip_str(packet_info *pinfo, guint16 cmd);
|
|
|
|
|
1999-05-09 04:20:59 +00:00
|
|
|
#endif
|
2013-11-27 16:30:20 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Editor modelines - http://www.wireshark.org/tools/modelines.html
|
|
|
|
*
|
|
|
|
* Local variables:
|
|
|
|
* c-basic-offset: 8
|
|
|
|
* tab-width: 8
|
|
|
|
* indent-tabs-mode: t
|
|
|
|
* End:
|
|
|
|
*
|
|
|
|
* vi: set shiftwidth=8 tabstop=8 noexpandtab:
|
|
|
|
* :indentSize=8:tabSize=8:noTabs=false:
|
|
|
|
*/
|