Commit Graph

30 Commits

Author SHA1 Message Date
Laurent Deniel 039bb4fbd8 Remove #define DEBUG_SMB_HASH
Is this file generated code ?

If not, please :

- get rid of compilation warnings
- put the # of preprocessor macros at the first column

svn path=/trunk/; revision=863
1999-10-16 20:26:37 +00:00
Richard Sharpe f646f88a5e Completed first pass of state keeping code in packet-smb.c.
Added decoder for transact SMBs.

Changed things a lot for state keeping.

Next thing is to decode transacts and transact2s more.

svn path=/trunk/; revision=860
1999-10-16 16:02:46 +00:00
Richard Sharpe 42b64a7584 Big bunch of fixes to packet-smb.c for things I need.
Also added first pass of state keeping. I am using glib's hash
functions.

Modelled after packet-ncp.c.

We will need to standardize the <proto>_init_protocol functions called in
file.c at some stage ...

I will have a couple of more goes at the state keeping before I am finished.
At the moment, the infrastructure is there but I do nothing with it.

svn path=/trunk/; revision=798
1999-10-10 11:50:45 +00:00
Guy Harris 06494664b0 "gmtime()" takes a pointer to a "time_t", not a pointer to a "guint32",
as an argument.  ("time_t" could be 64 bits - I think it is 64 bits on
some platforms, e.g.  Alpha Linux - and it's typically signed rather
than unsigned.)

svn path=/trunk/; revision=760
1999-10-03 05:01:56 +00:00
Richard Sharpe 776a369f1a A bunch of fixes for SMB decode.
1. Fix some silly errors.
  2. Dont decode beyond Word Count if errcode > 0
  3. Decode a bunch mode SMBs

Next is to keep state so we can do a better job ...

svn path=/trunk/; revision=758
1999-10-03 01:14:33 +00:00
Guy Harris 96e79ab6f8 Add a "BYTES_ARE_IN_FRAME()" macro, to test whether there are a
specified number of bytes of captured data in the frame at the specified
offset, and a "IS_DATA_IN_FRAME()" macro, to test whether there are any
bytes of captured data in the frame at the specified offset, and convert
some bounds checks to use them.

Add a dissector for the Internet Printing Protocol.

svn path=/trunk/; revision=685
1999-09-17 05:56:58 +00:00
Guy Harris f93c76fd10 Convert a bunch of uses of "fd->cap_len" to use "pi.captured_len" (or to
use END_OF_FRAME), so that they don't look at stuff in an IP datagram
past the end of the IP datagram (i.e., frame padding).

svn path=/trunk/; revision=584
1999-08-26 07:34:43 +00:00
Gilbert Ramirez cb1e32da97 Removed unnecessary #include "etypes.h" lines.
svn path=/trunk/; revision=565
1999-08-24 17:26:16 +00:00
Guy Harris ac4f87218d Declare the "packet_info" structure "pi" in "packet.h", rather than in a
bunch of source files.

Replace the "payload" field of a "packet_info" structure with "len" and
"captured_len" fields, which contain the total packet length and total
captured packet length (including all headers) at the current protocol
layer (i.e., if a given layer has a length field, and that length field
says its shorter than the length we got from the capture, reduce the
"pi.len" and "pi.captured_len" values appropriately).  Those fields can
be used in the future if we add checks to make sure a field we're
extracting from a packet doesn't go past the end of the packet, or past
the captured part of the packet.

Get rid of the additional payload argument to some dissection functions;
use "pi.captured_len - offset" instead.

Have the END_OF_FRAME macro use "pi.captured_len" rather than
"fd->cap_len", so that "dissect the rest of the frame" becomes "dissect
the rest of the packet", and doesn't dissect end-of-frame padding such
as padding added to make an Ethernet frame 60 or more octets long.  (We
might want to rename it END_OF_PACKET; if we ever want to label the
end-of-frame padding for the benefit of people curious what that extra
gunk is, we could have a separate END_OF_FRAME macro that uses
"fd->cap_len".)

svn path=/trunk/; revision=506
1999-08-18 00:57:54 +00:00
Gilbert Ramirez 7bd6c15378 Made the protocol (but not the fields) use the new proto_tree routine,
allowing users to filter on the existence of these protocols. I also
added packet-clip.c to the Nmake makefile.

svn path=/trunk/; revision=402
1999-07-29 05:47:07 +00:00
Gilbert Ramirez 02fe5e7d57 Got rid of ipv6 compiler warnings when compiling on RedHat 6.0.
Initialized AndXCommand to 0 in packet-smb.c just to get rid of compiler
warning about 'possibly used uninitialized'.

svn path=/trunk/; revision=382
1999-07-23 15:08:25 +00:00
Gilbert Ramirez 601c52f0fb Added support for compiling on win32 with Visual C and 'nmake'. It compiles,
but does not link. Perhaps someone who understands the MS tools can help
out. I made it link a few months ago, but with different version of glib/gtk+.
I can't remember how I made it link.

Most of the compatibility issues were resolved with adding
#ifdef HAVE_UNISTD_H the the source code. Please be sure to add this to all
future code.

svn path=/trunk/; revision=359
1999-07-13 02:53:26 +00:00
Richard Sharpe 87be6de734 Some more updates. Now have open_andx decoded mostly ... Still some funnies
and some difficult things.

I should not have blown away any of Gilbert's stuff this time around ...

Hope not anyway ...

svn path=/trunk/; revision=357
1999-07-12 14:26:16 +00:00
Guy Harris d35862ac07 The previous checkins were based on versions of the file prior to
Gilbert's new protocol-tree code (and to a bunch of other changes); put
all the missing changes back in.

svn path=/trunk/; revision=354
1999-07-11 07:24:57 +00:00
Richard Sharpe 9b8cd07087 More decoding of fields. Now handle enumerated fields, but still have
problems with single bit fields when declared as an enumerated field.

It shows an unknown ... Damn ... Can't see what the problem is.

svn path=/trunk/; revision=353
1999-07-10 14:01:53 +00:00
Gilbert Ramirez 07f42b5b31 Created a new protocol tree implementation and a new display filter
mechanism that is built into ethereal. Wiretap is now used to read all
file formats. Libpcap is used only for capturing.

svn path=/trunk/; revision=342
1999-07-07 22:52:57 +00:00
Richard Sharpe 4cef485bd4 Fixed a small problem that would have prevented Ethereal from compiling.
svn path=/trunk/; revision=335
1999-07-01 04:04:38 +00:00
Richard Sharpe e10ddc676c Added some more, auto-generated decoding to packet-smb.c.
Hope it is all OK.

This is getting interesting.

svn path=/trunk/; revision=334
1999-06-28 10:57:57 +00:00
Guy Harris 9bee1b3f20 Unfortunately, as the "cap_len" field in a "frame_data" is unsigned,
"fd->cap_len - offset", i.e. END_OF_FRAME, is unsigned, so

	while (END_OF_FRAME > 0) {

doesn't keep you out of the loop if "offset" is already beyond
"fd->cap_len", so you can try processing stuff past the end of the
captured data in the packet.

svn path=/trunk/; revision=298
1999-06-01 20:39:20 +00:00
Richard Sharpe 38802ac432 Removing some includes of tftp.h from places it should not be
in.

Would like to remove it from packet-tftp.c as well to remove our
dependence on that file as well.

svn path=/trunk/; revision=285
1999-05-13 01:05:11 +00:00
Guy Harris e638eb378f Turn "arpaddr_to_str()" into "bytes_to_str()", and make it public, so it
can be used by dissectors other than ARP to display byte arrays as
strings of hex digits.

Add a routine to extract a null-terminated Unicode string and turn it
into an ISO 8859-1 string for display.  (Ultimately, we should determine
what character sets the X server or printer or whatever can handle, and
turn it into the appropriate character set.)

Display the challenge in "core-to-LANMAN-2.1" Negotiate Protocol
responses as a string of hex digits - but only if the length is
non-zero.  (It's a counted array, not a null-terminated string.)

Display some additional security mode bits in an NT LM 0.12 Negotiate
Protocol response.

Display some additional bits in the "capabilities" field of the
Negotiate Protocol response.

Display the challenge in an NT LM 0.12 Negotiate Protocol response as a
string of hex digits (it's a counted array, not a null-terminated
string).

Display the domain name as Unicode in an NT LM 0.12 Negotiate Protocol
response if the capabilities field has the "supports Unicode" bit set
(no, not the "Unicode" bit in the "flags2" field - NT doesn't set that
in the response, even though it sends the domain name over in Unicode!).

Display some additional bits in the "flags2" field of an SMB.

svn path=/trunk/; revision=275
1999-05-11 08:21:39 +00:00
Guy Harris 45394e744e Add some SMB codes and error codes from the
"draft-leach-cifs-v1-spec-01.txt" CIFS Internet draft.

svn path=/trunk/; revision=274
1999-05-11 07:22:31 +00:00
Guy Harris c3a9aef919 Add decoding of DOS-format dates and times (one of the N different
date/time formats used in SMB...).

svn path=/trunk/; revision=273
1999-05-11 01:18:30 +00:00
Guy Harris 3cc7edbb32 Some of my fixes did get lost - put 'em back.
Fix the "proto_tree_add_item()" used when the server didn't support any
of the dialects the client offered not to print the dialect index.

In the "Core to LANMAN 2.1" "negotiate protocol" decode, show the time
zone as minutes from UTC, just as is done for the "post-LANMAN 2.1"
decode.

svn path=/trunk/; revision=272
1999-05-11 00:28:18 +00:00
Richard Sharpe 1fe8627014 Some clean-ups. I hope I have not disturbed any of Guy's
fixes, as I had to manually apply his fixes. It is a long story,
but my development environment is, umm, interesting.

Thanks to Guy for spotting the problems in my Core Proto to LanMan 2.0
decode probs.

I did not spot them and I do not have any such traces to check
against.

svn path=/trunk/; revision=271
1999-05-11 00:00:40 +00:00
Guy Harris 7dc4edc13b Fix up the decode of "greater than core and up to and including LANMAN
2.1" "negotiate protocol" responses.

Display unsigned fields in "negotiate protocol" as unsigned, rather than
signed, values.

svn path=/trunk/; revision=268
1999-05-10 21:36:40 +00:00
Guy Harris a4c1b66753 Decode the "flags2" field in the SMB header.
Squelch another "variable may be used without being initialized"
complaint (also due to insufficiently sophisticated dataflow analysis by
EGCS 1.1), and a number of "unused variable" complaints, as well as
"assigning a 'const XXX *' to an 'XXX *'" complaints.

svn path=/trunk/; revision=266
1999-05-10 20:30:27 +00:00
Richard Sharpe ba2afbfeb8 Mode decoded SMBs ... Now decode part of a TCONX request,
but not the responses, and do not handle the ANDX part yet,
but I have a Linux course to develop, so that is enough for
now.

svn path=/trunk/; revision=261
1999-05-10 00:27:32 +00:00
Richard Sharpe 57bdcc3387 Minor changes to check if log info is working
svn path=/trunk/; revision=260
1999-05-09 12:56:12 +00:00
Richard Sharpe 54e5da8bac Added new files for SMB decode: packet-smb.c, alignment.h, smb.h
svn path=/trunk/; revision=259
1999-05-09 04:20:59 +00:00