mailslot-based logon protocols just be regular register routines,
detected by the script that generates the "register.c" file, rather than
special stuff known to the SMB dissector.
svn path=/trunk/; revision=4222
"dissect_pipe_smb()", a tvbuff containing the setup words and the
pipe/mailslot pathname, as those are arguably the part of the packet
that contains the "mailslot protocol" and the "pipe protocol", as
opposed to the protocol running atop mailslots or pipes.
Pass a setup tvbuff to "dissect_pipe_smb()" for it to pass on to the
MSRPC-over-named-pipe dissector, and have the setup tvbuff passed to it
and "dissect_mailslot_smb()" contain *only* the setup words; don't
extract anything other than the setup words from it.
Declare "register_proto_smb_mailslot()" in "packet-smb-mailslot.h"
rather than "packet-smb.c", and declare "register_proto_smb_pipe()" in
"packet-smb-pipe.h" rather than "packet-smb.c".
Add a protocol for MSRPC-over-named-pipes.
Move the stuff to handle the FID in the setup words of
MSRPC-over-named-pipe transactions out of the SMB Transaction dissector
into the MSRPC dissector. Add a routine to "packet-smb.c", callable
from outside "packet-smb.c", to put an "smb.fid" field into the protocol
tree, and to add ", FID: XXXX" to the Info column, for use by the
MSRPC-over-named-pipe dissector; use it in the SMB dissector as well, in
all the places where we put a FID into the protocol tree.
Move the stuff to check whether the LANMAN protocol is enabled, and to
set "pinfo->current_proto" to "LANMAN" if it is, into the LANMAN
API-over-named-pipe dissector out of the named pipe protocol dissector.
If we didn't dissect a Transaction request or reply as a named pipe or
mailslot message, put any setup words, parameters, and data it has into
the protocol tree as separate items.
Don't put a "Response in" item into the protocol tree for an NT Cancel
request, as there are no responses to NT Cancel requests.
svn path=/trunk/; revision=4221
display the returned FID in the Info column for NT Create And X
replies;
display the setup words, and treat the second word as a FID in
Transaction requests presumed to contain DCE RPC-over-SMB.
Add the FID to the Info column for other open/create replies while we're
at it.
svn path=/trunk/; revision=4219
structure, so that it can be updated by subdissectors; this way the
updates affect the structure immediately, and don't get lost if the
subdissector later throws an exception.
Use "tvb_reported_length()" to check for an interim mailslot reply;
"tvb_length()" could give the wrong answer if a short snapshot length
was given in the capture.
svn path=/trunk/; revision=4218
"smb_saved_info_t". Put all the information needed to dissect NT
Transaction replies, Transaction2 replies, or Transaction replies into
separate data structures, allocated separately, and put a pointer to
that data structure in the "void *" in question.
Use the return value of "dissect_pipe_smb()" and
"dissect_mailslot_smb()" to control whether to display as data the stuff
those routines were asked to dissect.
If we've seen a request before, but its "smb_saved_info_t" isn't in the
"matched" hash table, look in the "unmatched" hash table - perhaps we
haven't seen the reply yet.
svn path=/trunk/; revision=4216
SMB FILE SHARING PROTOCOL EXTENSIONS, SMB File Sharing Protocol
Extensions Version 2.0, Document Version 3.3".
Fix the test for the "connectionless mode" to test the correct bit.
svn path=/trunk/; revision=4215
and replies, just save a structure holding that information that can't
be derived from the contents of one of the SMBs.
Don't save anything at all for NT Cancel requests - they have the same
TID/PID/MID/UID as the SMB being cancelled, and you want the information
for that request used when dissecting the NT Cancel (so it gets the
number of the frame containing the request being cancelled) and when
dissecting the reply to the request being cancelled.
Get rid of an unused routine.
svn path=/trunk/; revision=4213
Get rid of "Response to" stuff in the LANMAN dissector, as that's now
done in the SMB dissector.
Add a routine for dissecting unknown SMBs (gets the word and byte
counts, and just adds text entries for the word and byte parameters, if
any), and replace null pointers in the dissector table with pointers to
that routine. Get rid of the check for a null dissector pointer.
svn path=/trunk/; revision=4212
piece of information in the reply, as a file can have more than one
stream; show all of them.
Don't use the "File Name" field for stream names.
svn path=/trunk/; revision=4211
"#if 0" out an unused routine, pending determination of whether there's
any place that would use it.
Fix some typos.
Display the NT create options in hex, as they appear to be a bitmask.
svn path=/trunk/; revision=4189
Add some checks of the return value of
"get_unicode_or_ascii_string_tvb()" - if a null terminator is missing,
it might well run past the end of the byte parameters - and add some
code to keep the byte count updated so that the right byte count is
passed to "get_unicode_or_ascii_string_tvb()".
svn path=/trunk/; revision=4180
common subroutine.
Label the "total data length" field in Write Raw and Write Multiplexed
requests as such.
Dissect the IPC State/Device State field of Open and X requests and NT
Create and X requests ass per the stuff on page 67 of
ftp://ftp.microsoft.com/developr/drg/CIFS/dosextp.txt
Make a variable that doesn't need to be static not static.
svn path=/trunk/; revision=4179
Get rid of a bunch of stuff for which said tvbuffication removes the
need.
When dissecting byte parameters, make sure you don't consume more bytes
than the byte count, and handle captures where the last string in the
byte parameters area isn't properly null-terminated (I think I've seen
that in packets from various versions of Windows NT).
Make various bitfields given as decimal in SMB specs decimal.
svn path=/trunk/; revision=4172
Do more sanity checking on DOS dates and times.
Convert a bunch of "proto_tree_add_XXX" calls to "proto_tree_add_item"
calls.
Put the word and byte data for untvbuffified SMBs under a subtree just
as is done for tvbuffified SMBs.
Get rid of some no-longer-used routines.
Fix some displays in untvbuffified SMBs to resemble the way those fields
are displayed for tvbuffified SMBs.
Display timesouts as seconds and milliseconds when they're in units of
milliseconds.
svn path=/trunk/; revision=4157
Make it possible for a non-tvbuffied dissector for an andX SMB to call a
tvbuffified dissector for the andX command, and fix the non-tvbuffified
dissectors in question to do so.
svn path=/trunk/; revision=4154
When converting DOS-date years to "struct tm" years, add 1980 and
subtract 1900, to make it clearer what the conversion involves (DOS-date
years are (year - 1980); "struct tm" years are (year - 1900)).
svn path=/trunk/; revision=4146
Fix up Info column to put "Request" or "Response" *after* the name of
the request.
Give the Negotiate Protocol request its full name.
svn path=/trunk/; revision=4139
Get rid of the "unknown-0xXX" entries in the "value_string" table for
SMB command codes - they make it much more painful to select one of them
in the filter-editing dialog box.
svn path=/trunk/; revision=3985
tvbuffified heuristic-dissector interface, but have it immediately turn
its arguments into an old-style buffer pointer and offset.
Register the SMB dissector as a heuristic NetBIOS dissector, and have
"dissect_netbios_payload()" just try the heuristics, as it no longer has
to call the SMB dissector explicitly.
svn path=/trunk/; revision=3973
packets.
Make a "dissect_netbios_payload()" routine, called from the
NetBIOS-over-802.2 (NBF), NetBIOS-over-IPX, and NetBIOS-over-TCP
dissectors. Take Todd Sabin's changes to add a heuristic dissector list
to the NBSS dissector, and apply them to "dissect_netbios_payload()"
instead. Make the SMB dissector heuristic, returning FALSE if it
doesn't see 0xFF S M B at the beginning of the packet, and have
"dissect_netbios_payload()" first try the heuristic dissector list, then
try the SMB dissector if no other heuristic dissector claims the packet,
then just dissect the payload as data.
From Todd Sabin: have the DCE/RPC dissector register as a heuristic
dissector for NetBIOS.
svn path=/trunk/; revision=3969
"WordCount > 0".
Always put the byte count field into the protocol tree, regardless of
whether WordCount is 0 - it's not one of the word parameters counted by
WordCount, so it's present even if WordCount is 0.
Fix a "val_to_str()" call.
svn path=/trunk/; revision=3966
value being non-zero, not on whether the error code is zero. Don't
bother passing the error code to dissectors for particular SMBs, as they
don't need to use it.
In "get_unicode_or_ascii_string()", when aligning to an even boundary,
align to an even boundary in the SMB message, not in the packet as a
whole - there's no guarantee that there are an even number of bytes in
the frame before the SMB message.
In the Info column, mark the packet as a request or response based on
the request/response bit in the Flags field, not on the matched port -
for NBIPX, the source and destination ports (IPX sockets) may be the
same, so you may not be able to determine whether it's a request or a
response based on that.
svn path=/trunk/; revision=3965
being written, but the 2 bytes of data length and one byte of buffer
type preceding that data; use the data length (which doesn't count
itself or the buffer type byte), rather than the byte count, to
determine how much data is being written.
svn path=/trunk/; revision=3917
of protocol-id-plus-datum pairs, so that multiple protocols can attach
information to the same conversation.
Dissectors that attach information to a conversation should not assume
that if they find a conversation it has one of its data attached to it;
the conversation might've been created by another dissector.
svn path=/trunk/; revision=3901
Guy Harris