when reading what could potentially be the maxcount high field
assume that IF it is 0xFFFFFFFF that it is not maxcount high at all but
instead just some padding/reserved bytes.
If this field is 0xFFFFFFFF just ignore it.
svn path=/trunk/; revision=8559
in the SNIA CIFS spec, although it's probably a 16-bit MaxCountHigh and
a 16-bit reserved field (it's a 32-bit timeout field in an earlier SMB
spec).
Call the MaxCount and MaxCountHigh fields in a READ_ANDX "Max Count Low"
and "Max Count High", rather than "Data Length Low" and "Data Length
High".
svn path=/trunk/; revision=8198
We treated this as just a normal 64bit integer in LittleEndian format.
However, this is actually 2 32 bit integers, each in LittleEndian format
but the two 32 bit fields are stored in BigEndian format relative to each other.
Since we dont do 64 bit aritmetic I had to convert the field to FT_STRING as well
so sorry, no creative len>xxx filters anymore. but at least we present
the data in the correct way in the tree pane.
We didnt see this one earlier since most locking_andx requests are probably for offset : 0 and length: -
Funnily enough it seems that certain popular commercial products have the same bug as ethereal had up until 5 minutes ago.
svn path=/trunk/; revision=8196
instead of as being represented as RESERVED.
This updates the ReadAndX and WriteAndX calls and replies.
This should really try to keep track of the negotiation of the conversation to make sure we only do it for those sessions where LARGE file io has been negotiated. Currently it does it for all Read/Write AndX calls.
It is probably safe to do so since for those clients where this is not supported these bytes are RESERVED and MBZ anyway.
svn path=/trunk/; revision=8191
Change the AndX command fields to only place a filterable field in the tree when smb.cmd is NOT 0xff
If smb.cmd is 0xFF just place a text entry in the field instead.
This makes it more intuitive for users that try to use filters such as
smb.cmd!=0xXY since the filter will no longer behave "unexpectedly" and fail to filter out any of the AndX commands.
Yes, they should really use !smb.cmd==0xXY instead but one cant explain this to every single user.
I dont think anyone would ever want to filter for smb.cmd==0xFF anyway
svn path=/trunk/; revision=8178
we go through the data, so we can't compare it with the current offset
minus the starting offset - we should just test, and use, its value
directly, as, at the end, it reflects the amount of data left.
svn path=/trunk/; revision=8167
transpositions of subcommand numbers, and the query object id case was not
implemented. I'm not sure about the query fs label info as it doesn't seem
to exist as a server procedure except in Samba.
svn path=/trunk/; revision=8162
some extra info levels discovered by tridge.
Put subcommand information in COL_INFO for trans2 query fs/path/file
info.
svn path=/trunk/; revision=8011
so it is pretty common for MID values to be reused even in
moderately sized captures.
The test to compare that the command type between the request
and reply is not sufficient for when most of the commands between the client
and the server are the same (e.g. streaming Read/Write)
Change the matching so that ONLY the first "response" we see for a certain
open MID will be matched to the original request.
I.e. Prevent
Read Request
Read Reply
[missing from capture] Read Request
Read Reply
From incorrectly matching the second reply (if it has a reused MID) with the
first request.
This makes the response time statistics a bit more reliable as well.
svn path=/trunk/; revision=7888
tvb_get_string() - takes a tvbuff, an offset, and a length as
arguments, allocates a buffer big enough to hold a string with
the specified number of bytes plus an added null terminator
(i.e., length+1), copies the specified number of bytes from the
tvbuff, at the specified offset, to that buffer and puts in a
null terminator, and returns a pointer to that buffer (or throws
an exception before allocating the buffer if that many bytes
aren't available in the tvbuff);
tvb_get_stringz() - takes a tvbuff, an offset, and a pointer to
a "gint" as arguments, gets the size of the null-terminated
string starting at the specified offset in the tvbuff (throwing
an exception if the null terminator isn't found), allocates a
buffer big enough to hold that string, copies the string to that
buffer, and returns a pointer to that buffer and stores the
length of the string (including the terminating null) in the
variable pointed to by the "gint" pointer.
Replace many pieces of code allocating a buffer and copying a string
with calls to "tvb_get_string()" (for one thing, "tvb_get_string()"
doesn't require you to remember that the argument to
"tvb_get_nstringz0()" is the size of the buffer into which you're
copying the string, which might be the length of the string to be copied
*plus 1*).
Don't use fixed-length buffers for null-terminated strings (even if the
code that generates those packets has a #define to limit the length of
the string). Use "tvb_get_stringz()", instead.
In some cases where a value is fetched but is only used to pass an
argument to a "proto_tree_add_XXX" routine, use "proto_tree_add_item()"
instead.
svn path=/trunk/; revision=7859
reflect the 1.0 version of the CIFS spec. Similarly update function
names containing section numbers.
Change the strings for query file levels 0x0200 and 0x0201 to say
"Query" rather than "Set" (we now have separate tables for "query" and
"set" information levels, as some of them differ), and get rid of the
string for 0x0202, as that's documented in the CIFS spec only as a "set"
level.
svn path=/trunk/; revision=7810
according to the SNIA CIFS 1.0 spec and some captures I've seen, are not
the same as for the corresponding TRANS2_GET_{PATH,FILE}_INFORMATION.
Handle the SET information levels as per the CIFS spec.
svn path=/trunk/; revision=7806
multiple NetBIOS-over-TCP session service messages in a TCP segment, and
they can contain the final portions of different DCERPC calls. Don't
assume a frame number is sufficient to identify DCE RPC calls.
svn path=/trunk/; revision=7777
given a tvbuff/offset pair referring to the byte past the end of the
item. Use it in one place in the SMB dissector (there are plenty of
other places where it could be used as well).
svn path=/trunk/; revision=7603
instead of passing them around as separate parameters. This is a
prelude to adding generic and standard mapping to the access mask
dissection.
svn path=/trunk/; revision=7591
null) to the "fragment_items" structure, and don't pass that value into
"process_reassembled_data()", just have it use the value in the
"fragment_items" structure passed to it.
Make "process_reassembled_data()" capable of handling reassembly done by
"fragment_add_seq_check()", and use it in the ATP and 802.11 dissectors;
give them "reassembled_in" fields. Make "process_reassembled_data()"
handle only the case of a completed reassembly (fd_head != NULL) so that
we can use it in those dissectors without gunking the code up too much.
svn path=/trunk/; revision=7513
read/write data that might, or might not, be DCE RPC information on a
pipe, and use that routine rather than duplicating similar code in
multiple places.
svn path=/trunk/; revision=7455
Guy Harris