aboutsummaryrefslogtreecommitdiffstats
path: root/packet-smb-pipe.c
Commit message (Collapse)AuthorAgeFilesLines
* Set the svn:eol-style property on all text files to "native", so thatGuy Harris2004-07-181-1/+1
| | | | | | | | | they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
* DCERPC problem reported by JBM and identified by Todd SabinRonnie Sahlberg2004-06-091-3/+2
| | | | | | | | | | | Other protocol, not only SMB will populate pinfo->private_data thus checking for existence of non-NULL pinfo->private_data is not sufficient to determine we have SMB data and this is what it is. Refactor the adding of salt/FID from lower layer protocols and generalize it. Create a new dissector_handle specific for SMB so that we know that IFF we came in through that handle, then whatever pinfo->private_data is what we expect it to be. svn path=/trunk/; revision=11129
* add dissection of the ms rap netserverenum3 functionRonnie Sahlberg2004-06-031-1/+30
| | | | svn path=/trunk/; revision=11097
* Compiling with -pedantic:Jörg Mayer2003-12-211-2/+2
| | | | | | warning: comma at end of enumerator list svn path=/trunk/; revision=9383
* removed some more MSVC warnings (type casting)Ulf Lamping2003-12-171-7/+7
| | | | svn path=/trunk/; revision=9332
* Export "protocol_t" as an opaque type.Guy Harris2003-11-161-3/+3
| | | | | | | | | | | | | | | | Make "proto_is_protocol_enabled()" and "proto_get_protocol_short_name()" take a "protocol_t *" as an argument, so they don't have to look up the "protocol_t" - this will probably speed them up considerably, and they're called on almost every dissector handoff. Get rid of a number of "proto_is_protocol_enabled()" calls that aren't necessary (dissectors called through handles, including those called through dissector tables, or called as heuristic dissectors, aren't even called if their protocol isn't enabled). Change some direct dissector calls to go through handles. svn path=/trunk/; revision=8979
* Don't include <epan/conversation.h> if you don't need it.Guy Harris2003-09-031-2/+1
| | | | svn path=/trunk/; revision=8361
* There can be more than one DCE RPC call per frame, e.g. there can beGuy Harris2003-06-041-65/+53
| | | | | | | | multiple NetBIOS-over-TCP session service messages in a TCP segment, and they can contain the final portions of different DCERPC calls. Don't assume a frame number is sufficient to identify DCE RPC calls. svn path=/trunk/; revision=7777
* Add a pointer to an hf_ value for a "reassembled_in" field (which can beGuy Harris2003-04-201-1/+2
| | | | | | | | | | | | | | null) to the "fragment_items" structure, and don't pass that value into "process_reassembled_data()", just have it use the value in the "fragment_items" structure passed to it. Make "process_reassembled_data()" capable of handling reassembly done by "fragment_add_seq_check()", and use it in the ATP and 802.11 dissectors; give them "reassembled_in" fields. Make "process_reassembled_data()" handle only the case of a completed reassembly (fd_head != NULL) so that we can use it in those dissectors without gunking the code up too much. svn path=/trunk/; revision=7513
* Put in a comment noting that the reassembly code assumes subdissectorsGuy Harris2003-04-151-2/+8
| | | | | | are idempotent, which isn't necessarily the case. svn path=/trunk/; revision=7462
* Keep the two sides of a pipe separate when doing DCERPC-over-a-pipeGuy Harris2003-04-141-6/+19
| | | | | | | | | reassembly. (Perhaps we *shouldn't* see reassembly in progress in both directions, if the protocol is purely request/response, but that doesn't mean you won't see it in a capture, due to bugs or dropped packets or....) svn path=/trunk/; revision=7457
* "dcerpc_fragment_table" is used only in packet-smb-pipe.c, except forGuy Harris2003-04-131-5/+14
| | | | | | | | | | | the call to initialize it; move the call to initialize it to the registration routine for the dissector that uses it, move the definition of ""dcerpc_fragment_table" to packet-smb-pipe.c, make it static, and remove the declaration of it from smb.h. Add some casts to squelch compiler complaints. svn path=/trunk/; revision=7449
* Missing file from previous commitRonnie Sahlberg2003-04-121-29/+165
| | | | svn path=/trunk/; revision=7446
* Use the reported length, not the captured length, as the fragment lengthGuy Harris2003-03-051-8/+8
| | | | | | | | | | | | | | | | | | | | | when doing reassembly. In some additional places, use "tvb_bytes_exist()" to check whether we have enough data to do reassembly, rather than checking to see if the frame is short (it might be short but we might still have enough data to do reassembly). In DCE RPC, use the fragment length from the header as the number of bytes of fragment data. There's no need to check "pinfo->fragmented" before doing reassembly in the DCERPC-over-SMB-pipes code - either we have all the data or we don't. In SNA and WTP reassembly, add a check to make sure we have all the data to be reassembled. svn path=/trunk/; revision=7282
* Don't offer desegmentation to DCERPC if we have a short or fragmentedGuy Harris2003-02-281-3/+8
| | | | | | packet. svn path=/trunk/; revision=7217
* At least in regular SMB Browse and RAP messages, the server type mask isGuy Harris2003-02-201-5/+3
| | | | | | | | not guaranteed to be aligned on a 4-byte boundary, so, if we're not dissecting a DCE RPC request or reply, don't use "dissect_ndr_uint32()" to extract the access mask. svn path=/trunk/; revision=7175
* Dissect the server type bitfield in NetServerGetInfo for SERVER_INFO_101Tim Potter2003-02-171-5/+7
| | | | | | | | and SERVER_INFO_102. Modify all callers to use the new interface. svn path=/trunk/; revision=7158
* Update reassemble.c/show_item and all callers to use FT_FRAMENUM for the ↵Ronnie Sahlberg2002-12-191-3/+3
| | | | | | list of packets corresponding to a reassembled pdu svn path=/trunk/; revision=6807
* When processing a response, handle the case where the parameterGuy Harris2002-11-161-18/+67
| | | | | | | | | | | | | descriptor of the matching request is missing, e.g. because the frame was too short but not so sort that the entire request was missing. Clean up the handling of the case where the parameter descriptor isn't missing but the data descriptor was. If we can't dissect the response data due to a missing descriptor, at least create *some* item for the data. svn path=/trunk/; revision=6645
* Add a "fragment_add_seq_next()" to reassemble fragments that don't haveGuy Harris2002-10-241-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | sequence numbers or offsets and are thus assumed to be received in order with no duplicates or dropped fragments (e.g., for NetBIOS Frame, where 802.2 LLC guarantees in-order delivery to NetBIOS with no duplicates or dropped fragments). "show_fragment_tree()' and "show_fragment_seq_tree()" don't modify the "fragment_items" to which the "fit" argument points, so make that argument a "const fragment_items *". Make all the "fragment_items" tables "static" (as they're not used outside the modules defining them) and "const" (as they're not modified). Add support for reassembly of NetBIOS fragmented requests and responses. Get rid of an unnecessary include of "packet-tr.c" in the NetBIOS dissector, and make its table of dissection function pointers static. Fix some typos in the AppleTalk and NetBIOS dissectors. svn path=/trunk/; revision=6491
* Removed trailing whitespaces from .h and .c files using theJörg Mayer2002-08-281-12/+12
| | | | | | | winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
* Replace the types from sys/types.h and netinet/in.h by their glib.hJörg Mayer2002-08-021-9/+1
| | | | | | | | equivalents for the toplevel directory. The removal of winsock2.h will hopefully not cause any problems under MSVC++, as those files using struct timeval still include wtap.h, which still includes winsock2.h. svn path=/trunk/; revision=5932
* From Devin Heitmueller: treat the "send buffer length" in SMB RAPGuy Harris2002-07-031-2/+4
| | | | | | messages as being present in the packet. svn path=/trunk/; revision=5816
* Add "show_fragment_seq_tree()", which is like "show_fragment_tree()",Guy Harris2002-06-071-13/+46
| | | | | | | | | | | | | | | but for stuff reassembled with "fragment_add_seq()" or "fragment_add_seq_check()". Add a "fragment tag" string to the "fragment_items", so that packets with fragmentation errors can be properly flagged as having "Illegal fragments" or "Illegal segments" depending on the term used with the protocol in question. Make all the dissectors that can use "show_fragment_tree()" or "show_fragment_seq_tree()", and don't already use them, do so. svn path=/trunk/; revision=5644
* Get rid of the "data_src" member of the "frame_data" structure; put itGuy Harris2002-06-041-2/+2
| | | | | | | | in the "packet_info" structure instead, as we don't need a pointer for every single frame in the capture file, just for each frame for which we currently have an open "epan_dissect_t". svn path=/trunk/; revision=5614
* Move the value_string table for the share type values toGuy Harris2002-05-241-9/+2
| | | | | | "packet-smb-common.c", and use it in "packet-dcerpc-srvsvc". svn path=/trunk/; revision=5545
* Get rid of some unused arguments, and mark some others as unused.Guy Harris2002-04-301-60/+53
| | | | | | | | Remove the declaration of "dissect_nt_sid()" from "packet-dcerpc-samr.c"; get it by including "packet-smb-common.h", instead. svn path=/trunk/; revision=5313
* Additional RAP error code for password changes sent to a BDC, from DevinGuy Harris2002-04-291-1/+2
| | | | | | Heitmueller. svn path=/trunk/; revision=5296
* Get rid of an unused variable.Guy Harris2002-04-291-18/+1
| | | | svn path=/trunk/; revision=5293
* Removal (or, at least, #ifdeffing out) of unused variables andGuy Harris2002-04-291-2/+4
| | | | | | functions, from David Frascone. svn path=/trunk/; revision=5288
* In the protocol tree entries for lists of fragments/segments, make theGuy Harris2002-03-271-4/+6
| | | | | | | | top-level item correspond to the reassembled data, and make the item for each fragment/segment correspond to the part of that reassembled data that came from that fragment/segment. svn path=/trunk/; revision=5025
* A new type of DCERPC over SMB transport.Ronnie Sahlberg2002-03-161-2/+2
| | | | | | | | | | | | | | | | I have captures with w2k speaking DCERPC without using the normal Transaction named pipes SMBs. Instead DCERPC is just implemented ontop of ordinary read/write calls. The smb dissector now examines TreeConnectAndX and stores the conversation/tid/type-of-share in a table for later access. All SMB requests examine that hash table to find out if TID in the header refers to a normal share or an IPC$ share. Initial support in read/write SMB calls to detect if the operations are for an IPC share and thus it assumes it must be DCERPC commands in the payload. Desegmentation/Reassembly of these types of calls are not implemented yet. svn path=/trunk/; revision=4952
* Moved the value_string for MS country codes from packet-dcerpc-nt.c toRonnie Sahlberg2002-03-151-2/+2
| | | | | | packet-smb.c so that packet-smb-pipe.c can reference this struct as well. svn path=/trunk/; revision=4947
* Don't give tvbuffs names; instead, give data sources names, where aGuy Harris2002-02-181-5/+4
| | | | | | | | | | | | | | | "data source" has a name and a top-level tvbuff, and frames can have a list of data sources associated with them. Use the tvbuff pointer to determine which data source is the data source for a given field; this means we don't have to worry about multiple data sources with the same name - the only thing the name does is label the notebook tab for the display of the data source, and label the hex dump of the data source in print/Tethereal output. Clean up a bunch of things discovered in the process of doing the above. svn path=/trunk/; revision=4749
* Not all pointers in RAP packets point to null-terminated strings; addGuy Harris2002-01-271-36/+132
| | | | | | | | | | | | | | support for the "b" descriptor item in data, for pointers that point to arrays of bytes - the descriptor item includes a byte count giving the number of bytes in the array. Handle the "logon hours" bitmask in that fashion. Sometimes it appears that -1 means "unknown", and sometimes it appears that 0 means "unknown", for the last logoff date/time; interpret both of them as "unknown" (or "never"). svn path=/trunk/; revision=4612
* Fix "add_byte_param()" not to report multi-byte parameters as having theGuy Harris2002-01-271-122/+654
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | wrong type. Don't have routines that create subtrees for the data in a RAP reply - just have a string for the name to give the subtree. Create the subtree iff the reply has an entry count; if there's no name, use "Entries", and if there's no ett_ value for it, use a generic one. If there's no routine to create a subtreee for an entry in a RAP reply, don't create the subtree - some entries have only one member, so there's no point in creating a subtree for them. Provide an ett_ value to use if we don't know what the entry looks like. Properly terminate "lm_null_list[]". Fix the tables for the NetUserGetInfo API. Add tables for the NetUserGetGroups API. Add #defines and names for all the APIs in the SNIA CIFS spec (but fix up some of the names to reflect what the actual API names appear to be). Display the RAP API number in decimal, not hex, for unknown APIs. Use the right hf_ value when displaying the auxiliary data descriptor. svn path=/trunk/; revision=4611
* Include files from the "epan" directory and subdirectories thereof withGuy Harris2002-01-211-3/+3
| | | | | | | | | | | | | "epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
* Allow a length of -1 to be specified when adding FT_NONE and FT_PROTOCOLGuy Harris2002-01-201-12/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | items to the protocol tree; it's interpreted as "the rest of the data in the tvbuff". This can be used if 1) the item covers the entire packet or the remaining payload in the packet or 2) the item's length won't be known until it's dissected, and will be then set with "proto_item_set_len()" - if an exception is thrown in the dissection, it means the item ran *past* the end of the tvbuff, so saying it runs to the end of the tvbuff is reasonable. Convert a number of "proto_tree_add_XXX()" calls using "tvb_length_remaining()", values derived from the result of "tvb_length()", or 0 (in the case of items whose length is unknown) to use -1 instead (using 0 means that if an exception is thrown, selecting the item highlights nothing; using -1 means it highlights all the data for that item that's available). In some places where "tvb_length()" or "tvb_length_remaining()" was used to determine how large a packet is, use "tvb_reported_length()" or "tvb_reported_length_remaining()", instead - the first two calls indicate how much captured data was in the packet, the latter two calls indicate how large the packet actually was (and the fact that using the latter could cause BoundsError exceptions to be thrown is a feature - if such an exception is thrown, the frame really *was* short, and it should be tagged as such). Replace some "proto_tree_add_XXX()" calls with equivalent "proto_tree_add_item()" calls. Fix some indentation. svn path=/trunk/; revision=4578
* Use the "fragmented" field of the "packet_info" structure inGuy Harris2002-01-171-1/+5
| | | | | | | | | | | | | | | | | "dissect_frame()" to indicate whether a ReportedBoundsError was due to the packet being malformed (i.e., the packet was shorter than it's supposed to be, so the dissector went past the end trying to extract fields that were supposed to be there) or due to it not being reassembled (i.e., the packet was fragmented, and we didn't reassemble it, but just treated the first fragment as the entire packet, so the dissector went past the end trying to extract fields that were partially or completely in fragments after that). Mark the latter as being unreasembled rather than malformed. Properly initialize, save, and restore that field, and properly set it, so that works. svn path=/trunk/; revision=4555
* Fix some preferences to eliminate the extra copy of the protocol name atGuy Harris2002-01-151-2/+2
| | | | | | | | | the beginning, and to use underscores rather than periods where the preference's name really isn't part of a hierarchical namespace. Use "%u" rather than "%d" to print unsigned quantities. svn path=/trunk/; revision=4543
* More MSRPC->DCERPC, from Tim Potter.Guy Harris2001-12-161-5/+5
| | | | svn path=/trunk/; revision=4406
* Move the pointer to the "column_info" structure in the "frame_data"Guy Harris2001-12-101-17/+17
| | | | | | | | | | | | | | | structure to the "packet_info" structure; only stuff that's permanently stored with each frame should be in the "frame_data" structure, and the "column_info" structure is not guaranteed to hold the column values for that frame at all times - it was only in the "frame_data" structure so that it could be passed to dissectors, and, as all dissectors are now passed a pointer to a "packet_info" structure, it could just as well be put in the "packet_info" structure. That saves memory, by shrinking the "frame_data" structure (there's one of those per frame), and also lets us clean up the code a bit. svn path=/trunk/; revision=4370
* "msrpc" -> "dcerpc", and comment cleanups, from Tim Potter.Guy Harris2001-12-091-4/+4
| | | | svn path=/trunk/; revision=4365
* Support for reassembly of DCERPC over SMB, from Ronnie Sahlberg.Guy Harris2001-12-051-4/+69
| | | | svn path=/trunk/; revision=4335
* If a request has already been processed, and we fail to find itsGuy Harris2001-11-281-7/+13
| | | | | | | | | | | | | | | | | | | | "smb_saved_info_t" in the table of requests whose replies have been found, don't look it up in the table of requests whose replies have not been found - if the request in question has no reply in the capture, that may find some later frame in the same conversation with the same MID, and we don't need that information anyway - the only reason we *need* that structure is to save information in it for use when processing its reply, and we already did that the first time we processed the request. (The information for the later frame may be bad, e.g. having a null "extra_info" pointer, or having one that points to information for another request.) Arrange that we don't use the pointer to the "smb_saved_info_t" when processing a request except to save information if the request hasn't already been processed, as that pointer may not be valid if the request has already been processed, as per the above. svn path=/trunk/; revision=4292
* Updates to transaction reassembly, from Ronnie Sahlberg.Guy Harris2001-11-281-1/+29
| | | | | | | | | | | Add some checks for null tvbuff arguments. When dissecting transaction setup, parameters, and data when we couldn't dissect it as a pipe or mailslot transaction, use the reported length of the supplied tvbuff, not the actual length, as the amount of data present. svn path=/trunk/; revision=4291
* Rename the heuristic dissector table "msrpc" to "smb_transact", toGuy Harris2001-11-271-5/+5
| | | | | | | | | | | indicate that it's to be used for SMB transactions; a different table, using different dissectors, would be needed for, say, reads and writes over a named pipe, as those are byte streams and SMB transactions are packets, so the dissectors for the first one need to worry about multiple PDUs per segment and desegmentation, while the dissectors for the second one don't - and, in fact, can't do desegmentation stuff. svn path=/trunk/; revision=4286
* Moved from using dissect_data() to using call_dissector()Ed Warnicke2001-11-261-2/+10
| | | | svn path=/trunk/; revision=4269
* Clean up the stuff that creates the pipe protocol subtree; it shouldn'tGuy Harris2001-11-261-14/+17
| | | | | | | | fetch the length of "sp_tvb" if "sp_tvb" is null. Fix some comments. svn path=/trunk/; revision=4267
* From Ronnie Sahlberg: fix a check for a null tvbuff pointer to check theGuy Harris2001-11-251-2/+2
| | | | | | correct pointer. svn path=/trunk/; revision=4265
generated by cgit v1.2.3 (git 2.25.1) at 2025-02-24 16:00:33 +0000