reminder to check whether "samr_dissect_get_alias_membership_reply()"
should dissect the uint32 at the end as an NT status.
Un-#if out "samr_dissect_context_handle_SID()", to serve as a reminder
to figure out whether it should be deleted or used.
Get rid of "samr_dissect_get_user_groups_rqst()" - it's identical to
"samr_dissect_get_groups_for_user_rqst()", but isn't being used.
svn path=/trunk/; revision=5295
then later construct the sub-authority string from that array; we can
just construct the string as we fetch the sub-authorities.
Given that we're doing that, use the cleanup handler to free the string,
so that we don't leak memory if we throw an exception when fetching the
RID, for example.
svn path=/trunk/; revision=5294
than the fixed-length stuff, even if that runs past the end of the
captured data, so if it *does* run past the end of the captured data, we
report a short frame.
svn path=/trunk/; revision=5292
Unicode file name offsets.
Display the "UNIX privileges" field as a 4-longword structure, as part
of the AFP 3.0 spec claims; unfortunately, another part claims it's only
4 bytes, but, unless a "long" is 8 bits, one or the other claim must be
false.
Completely get rid of the static "afp_handle" variable - it's not
necessary.
Put the Unicode name offset into the tree, if present, in
"parse_file_bitmap()" and "parse_dir_bitmap()".
Get rid of some unused variables.
Put the newline mask and character into the tree for FPRead.
svn path=/trunk/; revision=5289
move the code from "dfilter_lookup_token()" into
"proto_registrar_get_byname()", and get rid of "dfilter_lookup_token()"
and have its callers call "proto_registrar_get_byname()" instead.
svn path=/trunk/; revision=5287
rather than extracting a string and adding that explicitly (which runs
the risk of leaking memory if the "tvb_get_ptr()" throws an exception).
Use "tvb_format_text()" when adding the string to the Info column, so
that non-printable characters are displayed as escapes.
svn path=/trunk/; revision=5283
dissector, so it can show them as replies.
Put the command code into the protocol tree for replies.
Fix some additional AFP function names to match the names in the AFP
spec.
svn path=/trunk/; revision=5279
dissector, so it can show them as replies.
Put the command code into the protocol tree for replies.
Fix some additional AFP function names to match the names in the AFP
spec.
svn path=/trunk/; revision=5275
packet it doesn't like and let some other dissector look at it, rather
than setting the Protocol and Info columns but not putting anything into
the protocol tree.
svn path=/trunk/; revision=5272
More calls, more fields, and other updates, for AFP.
Decode the error code for DSI.
Also, have separate fields for the code field in DSI when it's a data
offset and when it's an error code.
svn path=/trunk/; revision=5270
if the version number isn't 1; the LDP port number appears to be
popular for ONC RPC protocols, and this lets them be dissected as such,
at least if they don't begin with a 2-byte big-endian 1.
Do a standard TCP loop, which:
handles LDP headers split across TCP segments;
gives each LDP PDU in a TCP stream a tvbuff of its own, so we
don't run past the end of the PDU;
gives each LDP PDU its own tree.
svn path=/trunk/; revision=5261
that return an "int", giving either an indication of how much data was
dissected, an indication of how much more data is needed from TCP to
dissect, or 0, meaning "this isn't one of my packets").
svn path=/trunk/; revision=5260
values.
Note that in a Negotiate Protocol response, the primary domain won't be
present if the negotiated dialect isn't "DOS LANMAN 2.1" or "LANMAN2.1".
At least for Info Standard replies for Transaction2 Find First2
requests, if the request had the "return resume keys" flag set, the
reply will have a resume key at the beginning of each entry. We assume
that to be the case for Info Query EA Size and Info QUery EAs From List;
it does *not* appear to be the case for Find File Directory Info, Find
File Full Directory Info, or Find File Both Directory Info (they don't
have it even if the flag is set, at least in the captures I've seen).
The length of the name string in Find First2 entries doesn't include the
terminating '\0'; count that as well.
svn path=/trunk/; revision=5259
simplifies the code (and makes the name in the protocol tree match the
name in the dialog box for constructing filter expressions), and also
fixes a bug where the item for the request command contained the entire
request, not just the request command.
svn path=/trunk/; revision=5257
Show the flag bits in the ATP "Control information" byte as individual
Booleans, and show the TRel timeout indicator if the packet is a TReq
with XO set.
Clean up whitespace.
svn path=/trunk/; revision=5256
comparing with the "size_t" value "ngsniffer->rand.nbytes", rather than
just casting "ngsniffer->rand.nextout" to "unsigned" - if "unsigned" is
shorter than "long", the latter doesn't do what you want.
svn path=/trunk/; revision=5252
Tim Potter