Commit graph

2609 commits

Author SHA1 Message Date
Ronnie Sahlberg
d71982fbbb add the rest of Graeme Lunts patch
svn path=/trunk/; revision=16520
2005-11-16 23:17:21 +00:00
Anders Broman
7c8d0dad93 Decose APN messages correctly.
svn path=/trunk/; revision=16514
2005-11-16 20:03:09 +00:00
Ronnie Sahlberg
04f785f836 add dissection of buffercode
according to
wiki.etehreal.com/SMB2/BufferCode



svn path=/trunk/; revision=16512
2005-11-16 10:59:41 +00:00
Ronnie Sahlberg
898dc49980 add a simple g_strlcat define in strutil for gtk==1 where this symbol does not exist
svn path=/trunk/; revision=16511
2005-11-16 09:27:43 +00:00
Anders Broman
6c466a1437 Display AVP:s of Dimater type Unsigned32 as such even when they have "value translation".
svn path=/trunk/; revision=16510
2005-11-16 07:21:48 +00:00
Anders Broman
00131b0f1e From Greg Morris;
The following diff (based on current SVN) fixes the following...
1. Adds additional return value 0xa901 
"Invalid Data Type Flag (outdated return value - replaced in NSS as 0x89aa error)" 
for 87/xx NCP's.
2. Fixes decode for NCP 87/20 reply packets
3. Fixes decode for NCP 89/53 request packets

svn path=/trunk/; revision=16509
2005-11-16 07:16:34 +00:00
Anders Broman
c33182b898 From Graeme Lunt:
Here are a number of small patches for asn1 based dissectors:

acse:
  release request/response column information (many X.400/X.500 unbinds are
empty)
  "standardised" PNAME to "ISO 8650-1 OSI Association Control Service"
  fix for crash when using EXTERNAL dissector

rtse:
  column information when attempting a resume

x509if:
  generation of LDAP-style DNs from RDNSequences 
  new function x509if_get_last_dn() to get the last DN generated.

x509af:
  DSS parameters
  certificate extension naming
  subject naming of certificate

x509sat:
  Guide syntax (as SET now supported)
  PDU exports.
  
cms:
  verification of message digest attribute (SHA-1 and MD5)
  
ess:
  enumerated/restrictive/permissive/informative security categories

x411:
  generation of string encoding of X.400 addresses, trace information and message identifiers.

s4406:
  separate types for primary and copy precedence to allow better filtering (e.g. primary precedence = flash)
  priority-level-qualifier


svn path=/trunk/; revision=16508
2005-11-16 07:13:12 +00:00
Guy Harris
893ad69c74 Handle OSPF V3 prefixes similarly to the way other IPv6 prefixes are
handled (but not the same, as the prefix length in OSPF is rounded up to
a multiple of 4 bytes, not just a byte).  This simplifies the code, and
keeps us from overflowing the buffer we allocate if the prefix length is
> 128 (we now just report that as an error).

svn path=/trunk/; revision=16507
2005-11-15 10:56:18 +00:00
Ronnie Sahlberg
5bc41c76b0 add decoding of extended attributes
svn path=/trunk/; revision=16506
2005-11-15 08:49:34 +00:00
Tomas Kukosa
97584210fb improvements in value constraint support
- NO_BOUND is defined instead of usage -1
- negative bound is handled properly for INTEGER

svn path=/trunk/; revision=16505
2005-11-14 13:05:17 +00:00
Ronnie Sahlberg
f4e55c1155 move the include of emem.h a bit further down
so it does know what size_t is when emem is included.

i needed this change to get it to compile on my box


svn path=/trunk/; revision=16504
2005-11-14 13:02:23 +00:00
Ronnie Sahlberg
ae6cc5a6f2 some more infol;evels decoded
svn path=/trunk/; revision=16503
2005-11-14 12:06:39 +00:00
Guy Harris
04b5d191ac Fix the declaration of gssapi_lookup_oid_str() to match its definition.
svn path=/trunk/; revision=16502
2005-11-14 10:49:13 +00:00
Tomas Kukosa
3b770d5c7c - dissect_ber_object_identifier() returns value as tvb
- new dissect_ber_object_identifier_str() function
 - BER dissectors adapted and regenerated

svn path=/trunk/; revision=16501
2005-11-14 10:02:31 +00:00
Anders Broman
0496eb5dca Fix Bug 566 H.263: in display filters, ftype bit masked by sbit
svn path=/trunk/; revision=16500
2005-11-13 20:53:24 +00:00
Anders Broman
42ed3aede8 Fix the lenght calculation.
svn path=/trunk/; revision=16499
2005-11-13 18:09:44 +00:00
Ronnie Sahlberg
5244ca9cdd prettify read/write
svn path=/trunk/; revision=16497
2005-11-12 23:17:06 +00:00
Ronnie Sahlberg
6124eac224 prettify smb2
always put the filename in col_info if it is known

for getinfo/setinfo  put the class/level in colinfo as well.


this makes it very easy to see in the packet summary which file a icommand applies to and what kind of info is requested



svn path=/trunk/; revision=16496
2005-11-12 23:05:29 +00:00
Ronnie Sahlberg
fafd0aeb49 from martin marthieson
updates to rlogin

Hi, this patch:
- uses value_string for control message field
- doesn't use a single global time value to mark start of all conversations!
- corrects client-user-name, server-user-name order in initial user-info
message
- adds data (text input/output) into the protocol tree
- makes lots more things filterable
- improves info column text (always calls rlogin_display() now)
- cleans up some whitespace



svn path=/trunk/; revision=16495
2005-11-12 22:05:53 +00:00
Ronnie Sahlberg
7d0ed23854 from Laurent Constantin
updates to smb
A patch for packet-smb.c is attached:
 - it improves timeout decoding
 - it defines common NT transaction IOCTL functions
 - it corrects decoding of resume key in search queries
 - it defines a new function dissect_4_2_16_8_unsure() to replace
   dissect_4_2_16_8(). I'm unsure if it is correct. As said in
   comments, it works for me, but I find strange that nobody noticed
   dissect_4_2_16_8() was wrong. So, it is between "#if 0".
   Someone else should confirm dissect_4_2_16_8_unsure() works
   before activating it.



svn path=/trunk/; revision=16494
2005-11-12 21:56:02 +00:00
Ronnie Sahlberg
5940b03d12 if we get the error BUTTER_TOO_SMALL coming back in a getinfo reply the data will just be 4 bytes and will contain the required buffer size
svn path=/trunk/; revision=16493
2005-11-12 21:14:17 +00:00
Ronnie Sahlberg
0097584f2e the timestamps of negprot are known
svn path=/trunk/; revision=16491
2005-11-12 11:42:06 +00:00
Ronnie Sahlberg
15f13b23a0 improve the dissection of Create and fill in most of the fields
svn path=/trunk/; revision=16490
2005-11-12 11:27:34 +00:00
Ulf Lamping
a78d2fbc63 (on behalf of the PROFIBUS Nutzerorganisation e.V. Deutschland):
add some PROFINET specific LLDP extensions

svn path=/trunk/; revision=16488
2005-11-12 10:09:02 +00:00
Ronnie Sahlberg
8b68d91039 dissect more of Close request/response
svn path=/trunk/; revision=16487
2005-11-12 10:07:12 +00:00
Ronnie Sahlberg
728323e533 add initial decode of dcerpc over smb2
it does not yet multiplex between different files   but it is better than nothing


svn path=/trunk/; revision=16484
2005-11-12 08:48:02 +00:00
Ronnie Sahlberg
bc6cb5d6ad in order to handle dcerpc over smb2 later and to make the heuristics stronger for determining what might and what might not be a pipe
add   TID tracking.   for all TreeConnect requests/resposnes seen,   store the name->tid mapping and other metadata.


as a freebee    the disswection of the tid in the ehader is aware of this table so when a tid value is dissected in the header and we known the name for this tid   then put it in an expansion below the tid.




svn path=/trunk/; revision=16483
2005-11-12 07:45:01 +00:00
Ronnie Sahlberg
9ca683a249 start separating things out into structures
we can regenerate from the header
we need to remember between request/response
we need on a per conersation bases

to reduce the amount of data we store in the per req/resp  pair  since there will be many of them and we want that struct as small as possible.




svn path=/trunk/; revision=16482
2005-11-12 04:23:52 +00:00
Ronnie Sahlberg
9f6c2b3ed5 a guid is only 16 bytes so dont highlight 20 bytes in the hexpane
svn path=/trunk/; revision=16481
2005-11-12 01:21:43 +00:00
Jörg Mayer
1baf01d966 Update to samba 11681
svn path=/trunk/; revision=16480
2005-11-12 00:42:45 +00:00
Jörg Mayer
66df615702 Propset svn:...
svn path=/trunk/; revision=16478
2005-11-12 00:25:27 +00:00
Ronnie Sahlberg
ebcdb60414 in smb2 the file handles are not normal context handles they are just a guid
make them a guid in smb2 dissector and make tim pottesr excellent conmtext handle tracking also able to do the same thing for GUIDs


( a context handle is just a 32 biut attribute field followed by a uuid anyway)




svn path=/trunk/; revision=16477
2005-11-11 22:12:10 +00:00
Anders Broman
260853d5b4 fix:
Malformed packet IAM, Calling party number 
Application transport -  some code clean up. 
bug 551 Nor Med PC ethereal-bugs@ethereal.com NEW SS7, ISUP, IAM-signal, malformed packet (not) 
Bug 554 Min Low PC ethereal-bugs@ethereal.com NEW ETSI codec dissection error in BICC 

svn path=/trunk/; revision=16476
2005-11-11 22:05:21 +00:00
Ronnie Sahlberg
574717c28d start decoding notify requests
svn path=/trunk/; revision=16475
2005-11-11 12:49:42 +00:00
Ronnie Sahlberg
756520be42 dissect READ packets
svn path=/trunk/; revision=16474
2005-11-11 11:35:10 +00:00
Ronnie Sahlberg
6250873db4 write offset is 32 bits so is write length
svn path=/trunk/; revision=16473
2005-11-11 11:14:14 +00:00
Ronnie Sahlberg
eae75ff28b add allocation size
svn path=/trunk/; revision=16472
2005-11-11 11:03:00 +00:00
Ronnie Sahlberg
ec327c0a14 add decode of endoffile for file infolevel 0x12
svn path=/trunk/; revision=16471
2005-11-11 10:26:36 +00:00
Ronnie Sahlberg
b358df838c class:3 level:0 is just a normal nt security descvriptor
svn path=/trunk/; revision=16470
2005-11-11 09:09:31 +00:00
Ronnie Sahlberg
e85060f171 opcode 0x0c is Cancel
svn path=/trunk/; revision=16469
2005-11-11 08:23:11 +00:00
Ronnie Sahlberg
1a6338e9d5 opcode 0x0f is Notify
svn path=/trunk/; revision=16468
2005-11-11 08:14:59 +00:00
Ronnie Sahlberg
deadd3c93f SMB2_FILE_INFO_0a structure which is used with SetInfo to rename a file
svn path=/trunk/; revision=16467
2005-11-11 08:04:32 +00:00
Ronnie Sahlberg
8e2ab17da8 dont dereference null pointers
svn path=/trunk/; revision=16466
2005-11-11 07:49:13 +00:00
Ronnie Sahlberg
886e149907 the uid is 64 bits
svn path=/trunk/; revision=16465
2005-11-11 07:41:09 +00:00
Ronnie Sahlberg
078ef72ee4 break out some structures into packet-smb2.h so we can start tapping in later
we will do service-response-time   statistics before other inferior products have even noticed a new protocol is in town.




svn path=/trunk/; revision=16463
2005-11-11 03:50:53 +00:00
Gerald Combs
66296cdf17 Don't use null values for blurbs in header fields.
svn path=/trunk/; revision=16462
2005-11-11 00:04:37 +00:00
Ronnie Sahlberg
46f0739541 start decoding SMB2_FILE_INFO_22
svn path=/trunk/; revision=16461
2005-11-10 22:46:10 +00:00
Ronnie Sahlberg
8d54b19302 from albert chin
dont use c++ style comments


svn path=/trunk/; revision=16459
2005-11-10 21:50:30 +00:00
Ronnie Sahlberg
b78b018dbc use the policy_handle framework for dcerpc to trach which frame a policy handle is opened in and which one it is closed in.
also attempt to store a name for it   like File:foo


but this does not work yet.




svn path=/trunk/; revision=16458
2005-11-10 10:08:32 +00:00
Guy Harris
07d0b328c7 Include <ctype.h> to declare "isprint()".
svn path=/trunk/; revision=16456
2005-11-10 07:26:30 +00:00
Guy Harris
13a24cc310 There's no guarantee that BYTE_ORDER is defined as anything useful, and
the BYTE_ORDER == BIG_ENDIAN values for FMIP_HI_FLAG_ASSIGNED and
FMIP_HI_FLAG_BUFFER are bogus for the way they're used anyway (they're
used to check bits in a one-byte value), so throw away those values, and
get rid of the leading 00 in the BYTE_ORDER == LITTLE_ENDIAN values.

svn path=/trunk/; revision=16455
2005-11-10 03:16:25 +00:00
Anders Broman
f86d2d458c From Andrei Emeltchenko
I have added new RTCP POC fields as OMA standard says. With some additions. 

svn path=/trunk/; revision=16452
2005-11-09 21:50:39 +00:00
Ronnie Sahlberg
4acbd6bcc9 add initial decode for SMB2_FS_INFO_01
svn path=/trunk/; revision=16451
2005-11-09 21:06:06 +00:00
Ronnie Sahlberg
d0a574078d add decode of SMB2_FS_INFO_05
svn path=/trunk/; revision=16450
2005-11-09 20:57:56 +00:00
Ronnie Sahlberg
005fbb5304 add decoding of the create request
svn path=/trunk/; revision=16449
2005-11-09 20:37:49 +00:00
Gerald Combs
f9d4caf148 From Stig Bjørlykke:
I just learned how easy it is to reassemble multiple UDP packets, so  I
had to implement this for the P_Mul protocol :)

This patch fixes:
* Reassemble multiple data packets
* Add packet length check
* Fix for PDU type in tree entry

svn path=/trunk/; revision=16448
2005-11-09 16:01:35 +00:00
Ronnie Sahlberg
8ba0aaf3a9 some more of the never ending stream of smb2 updates
svn path=/trunk/; revision=16447
2005-11-09 13:19:57 +00:00
Ronnie Sahlberg
2c0b087fde add decode of Write commands
svn path=/trunk/; revision=16446
2005-11-09 10:18:31 +00:00
Ronnie Sahlberg
d94d156a7a add support for Close and the new guess that the FID is present in the Find request.
Ohoy sailor,    we have spotted the concept of current working directory.

does this mean we also get rid of the silly 200-256 byte path length limitation?




svn path=/trunk/; revision=16445
2005-11-09 09:29:41 +00:00
Ronnie Sahlberg
a204fdaea7 dissect more of the SMB2/Close function
svn path=/trunk/; revision=16444
2005-11-09 09:14:11 +00:00
Anders Broman
2044d02bcb Move def of subid_t to format-oid.h don't include asn1.h in cops any more.
svn path=/trunk/; revision=16440
2005-11-08 22:18:06 +00:00
Ronnie Sahlberg
53ab6ed970 start dissecting SMB2_FILE_INFO_12
svn path=/trunk/; revision=16439
2005-11-08 21:16:36 +00:00
Gerald Combs
781f8051e5 From Peter Kovar: Fix the typo referenced in bug 577.
svn path=/trunk/; revision=16438
2005-11-08 15:28:15 +00:00
Gerald Combs
f2d2a624d8 You don't tug on Superman's cape. You don't spit into the wind.
You don't pull the mask off the old Lone Ranger, and you don't
overflow a guint8.  Fixes the infinite loop in bug 576.

Fix up whitespace.  Add an entry to the release notes.  Apologies
to Jim Croce.

svn path=/trunk/; revision=16436
2005-11-08 15:22:38 +00:00
Ronnie Sahlberg
6f2482bc9f dissect some of GetInfo requests and Replies
svn path=/trunk/; revision=16435
2005-11-08 09:20:04 +00:00
Ronnie Sahlberg
f8b4f34276 add a comment to keep the dissector in sync with the wiki
rename functions 0x10 and 0x11 to follow the names in the wiki



svn path=/trunk/; revision=16434
2005-11-08 08:53:55 +00:00
Ronnie Sahlberg
b46a5611ed add a pointer to the wiki for documentation of this protocol
svn path=/trunk/; revision=16433
2005-11-08 08:41:42 +00:00
Ronnie Sahlberg
40b13e337f add dissection of the known parts of negotiate protocol
svn path=/trunk/; revision=16432
2005-11-08 08:40:32 +00:00
Guy Harris
af00219b1b Use "proto_tree_add_item()", not "proto_tree_add_bytes()", if you're
just supplying the result of "tvb_get_ptr()" with the same tvbuff,
offset, and length as the byte array.

Get rid of an unused variable.

Set svn:keywords and svn:eol-style appropriately.

svn path=/trunk/; revision=16430
2005-11-07 22:50:34 +00:00
Gerald Combs
b1b1c50f1e Fix an ftsanity.py error.
svn path=/trunk/; revision=16429
2005-11-07 21:58:27 +00:00
Gerald Combs
062621786f Fix bug 575, from Menno Andriesse:
In two functions that call proto_tree_add_bytes I forgot the
  'tvb_get_ptr' function, the argument was 'FALSE' instead.  This gave
  a predictable 'NULL' pointer bug...

Fix an ftsanity.py error.  Fixup whitespace.


svn path=/trunk/; revision=16428
2005-11-07 21:54:08 +00:00
Ronnie Sahlberg
66d99c3eed begin dissecting the Find response packet
svn path=/trunk/; revision=16427
2005-11-07 21:19:59 +00:00
Guy Harris
6c521f90f5 The return value of tvb_get_ptr() is a const ptr; assign it to a const
ptr.

The answer to the question
"??????????????????????????????????????????????????????????????????" is
"No - the return value of tvb_get_ptr() is a reference, not an allocated
copy, and it cannot be freed and doesn't need to be freed."

svn path=/trunk/; revision=16426
2005-11-07 21:10:52 +00:00
Ronnie Sahlberg
39ecd87667 dissect the treeconnect request packet
svn path=/trunk/; revision=16425
2005-11-07 21:00:09 +00:00
Ronnie Sahlberg
8012fd3cd9 add request response matching so we can start passing info levels around from request to response and start dissecting some of the commands
svn path=/trunk/; revision=16424
2005-11-07 20:32:27 +00:00
Anders Broman
708d793e63 Display MSW and LSW as NTP timestamp as well.
svn path=/trunk/; revision=16421
2005-11-07 19:40:55 +00:00
Anders Broman
a9a63056df Dissect NSAP
svn path=/trunk/; revision=16420
2005-11-07 19:39:38 +00:00
Anders Broman
b2ec8c9ca4 Bug fix to dissection of NSAP E164 Country codes
svn path=/trunk/; revision=16419
2005-11-07 19:39:02 +00:00
Anders Broman
199214844b Martin Hill has examined packet-dec-dnart.c and found some errors and made some improvements.
svn path=/trunk/; revision=16418
2005-11-07 19:37:10 +00:00
Anders Broman
8586ce47d2 From Stig Bjørlykke
A new dissector for P_Mul (ACP142) http://www.jcs.mil/j6/cceb/acps/Acp142.pdf

svn path=/trunk/; revision=16417
2005-11-07 19:35:48 +00:00
Ronnie Sahlberg
575907f024 put the error code in col info
svn path=/trunk/; revision=16414
2005-11-07 08:57:04 +00:00
Ronnie Sahlberg
0b01ed88cb smb2 updates, most of the header is now decoded properly
svn path=/trunk/; revision=16413
2005-11-07 08:39:23 +00:00
Ulf Lamping
c3187174bf replace *a lot* of file related calls by their GLib counterparts. This is necessary for the switch to GTK 2.6 (at least on WIN32).
to do this, I've added file_util.h to wiretap (would file_compat.h be a better name?), and provide compat_macros like eth_open() instead of open(). While at it, move other file related things there, like #include <io.h>, definition of O_BINARY and alike, so it's all in one place.

deleted related things from config.h.win32

As of these massive changes, I'm almost certain that this will break the Unix build. I'll keep an eye on the buildbot so hopefully everything is working again soon.

svn path=/trunk/; revision=16403
2005-11-06 22:43:25 +00:00
Ronnie Sahlberg
4e954caec3 dissect some of the session setup and the security blob for smb2
svn path=/trunk/; revision=16402
2005-11-06 13:04:57 +00:00
Ronnie Sahlberg
3924f02631 dissect the smb2 request/response flag
svn path=/trunk/; revision=16401
2005-11-06 11:55:17 +00:00
Ronnie Sahlberg
f449406fee dissect the smb2 tree id
svn path=/trunk/; revision=16400
2005-11-06 11:46:10 +00:00
Ronnie Sahlberg
c44a9aab72 some smb2 updates
svn path=/trunk/; revision=16399
2005-11-06 05:32:01 +00:00
Ronnie Sahlberg
dcfb3758cc add an empty dissector for SMB2
svn path=/trunk/; revision=16398
2005-11-06 04:18:13 +00:00
Anders Broman
2916d12d76 Packet-amr Register as "AMR" not "amr".
Add Dynamic PT:s mimestring  to rtp_info if avalable.
Use Dynamic PT:s mime string to find clock rate.

svn path=/trunk/; revision=16397
2005-11-05 21:38:22 +00:00
Ronnie Sahlberg
4a92dc0bc9 get rid of some strcat
svn path=/trunk/; revision=16396
2005-11-05 20:32:33 +00:00
Ronnie Sahlberg
c7aee8324f get rid of an array and dissect a bitmask properly
get rid of some strcat()s


svn path=/trunk/; revision=16395
2005-11-05 02:03:21 +00:00
Ronnie Sahlberg
b6ae69cfcf remove an array and some strcat from ncp
svn path=/trunk/; revision=16394
2005-11-05 01:23:06 +00:00
Ronnie Sahlberg
b1b51ed1b0 remove an array and the remaining strcat from ospf
svn path=/trunk/; revision=16393
2005-11-04 23:03:26 +00:00
Ronnie Sahlberg
909764f6b2 get rid of some strcat and a stackbased array
svn path=/trunk/; revision=16392
2005-11-04 21:55:23 +00:00
Ronnie Sahlberg
e07f132280 from Metze
some winsrepl updates


svn path=/trunk/; revision=16391
2005-11-04 21:22:21 +00:00
Ronnie Sahlberg
0cafcb3e50 From Menno Andriesse
New protocol : STANAG 5066

I changed it from being a plugin to a builtin dissector
and also changed a couple of small bugs


svn path=/trunk/; revision=16390
2005-11-04 21:14:33 +00:00
Anders Broman
857077708b Fix a typo and change TLLI representation to HEX.
svn path=/trunk/; revision=16389
2005-11-03 19:14:52 +00:00
Guy Harris
2447b390d2 "dissect_cmp_http()" doesn't check for a valid packet (it doesn't need
to, it's selected by the media-type string, not something unreliable
such as a port number), and doesn't return anything, so give it the
right type and don't declare it as a "new-style" dissector.

svn path=/trunk/; revision=16387
2005-11-03 04:35:39 +00:00
Guy Harris
81b9490d4c Get rid of (valid) warning about uninitialized variable, and clean up
indentation.

svn path=/trunk/; revision=16386
2005-11-03 04:33:51 +00:00
Luis Ontanon
ff20ed3e10 Some cleanup,
- Improve expert info
- Remove the debug tree (one warning unused function, will go)
- Make Sure Pending messages have a cmdmsg (and so a colinfo label)


svn path=/trunk/; revision=16383
2005-11-02 23:01:15 +00:00