aboutsummaryrefslogtreecommitdiffstats
path: root/smb.h
Commit message (Collapse)AuthorAgeFilesLines
* Handle continuation replies to transactions better - try to match themGuy Harris2004-09-301-0/+1
| | | | | | | up with the original request, without matching unrelated replies with that request. svn path=/trunk/; revision=12145
* Move a bunch of stuff that's more Windows-related than SMB-related toGuy Harris2004-08-031-96/+0
| | | | | | "packet-windows-common.[ch]". svn path=/trunk/; revision=11592
* Set the svn:eol-style property on all text files to "native", so thatGuy Harris2004-07-181-1/+1
| | | | | | | | | they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
* From Lars Roland: add support for building a libethereal.dll with MSVC:Guy Harris2004-05-091-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | add a config.nmake option to control whether to build libethereal.dll or not; remove "./wiretap" from PATH to prevent problems due to wrongly-loaded files; build dissector.lib with MSVC; move "print.c" and "ps.c" to the dissector helpers, as "print.c" imports variables from packet-frame.c and packet-data.c, which are in libethereal; move "g711.c" out of the dissector helpers, as they're used only by Ethereal in a tap, not in Tethereal or in any dissector; add a .def file for libethereal; arrange to declare global variables exported from libethereal with "__declspec(dllimport)" when building programs that import those variables; update the NSIS installer. Make the "configure" script define ETH_VAR_IMPORT as "extern". svn path=/trunk/; revision=10834
* The "cmd" members of "smb_saved_info_t" and "smb_info_t" structuresGuy Harris2003-12-181-3/+3
| | | | | | | | | | | | | | | | always contain an SMB command code (SMB requests and responses both have command codes, so there's no "unknown" out-of-band value); make it a "guint8". Make the argument to "decode_smb_name()" a "guint8" as an SMB command code is passed to it ("guint8" and "unsigned char" are the same types on all platforms we're likely to deal with, so it's a cosmetic change, not a semantic one). Put in an extra "GPOINTER_TO_UINT()" call before casting "si->sip->extra_info" to "guint16", to squelch compiler warnings. svn path=/trunk/; revision=9335
* There can be more than one DCE RPC call per frame, e.g. there can beGuy Harris2003-06-041-6/+1
| | | | | | | | multiple NetBIOS-over-TCP session service messages in a TCP segment, and they can contain the final portions of different DCERPC calls. Don't assume a frame number is sufficient to identify DCE RPC calls. svn path=/trunk/; revision=7777
* "dcerpc_fragment_table" is used only in packet-smb-pipe.c, except forGuy Harris2003-04-131-2/+1
| | | | | | | | | | | the call to initialize it; move the call to initialize it to the registration routine for the dissector that uses it, move the definition of ""dcerpc_fragment_table" to packet-smb-pipe.c, make it static, and remove the declaration of it from smb.h. Add some casts to squelch compiler complaints. svn path=/trunk/; revision=7449
* Rewrite the DCERPC over SMB reassembly completely.Ronnie Sahlberg2003-04-121-1/+5
| | | | | | | | | | | | | | | | Move the actual reassembly to packet-smb-pipe.c instead of having it inside the packet-smb.b/Write_andX and ReadAndX dissectors. Change the dissector to only call dcerpc dissector from the packet where reassembly was completed instead of always from the first fragment. Add display fiulter field for the other fragments that display which frame the dcerpc pdu was reassembled in. This is needed in order to be able to reassemble the type of dcerpc fragments that are sent between nt4 dc's. The DCERPC fragment reassembly in the dcerpc layer is still broken though, and i think it has been broken for quite some time. That will be addressed shortly. svn path=/trunk/; revision=7445
* Added SMB option : sid_name_snooping.Ronnie Sahlberg2003-03-251-1/+3
| | | | | | | | | | | | | | | | | This feature, when enabled through Edit/preferences/protocols/smb, will look at certain SMB and CIFS related protocols to discover the mapping between SIDs and their Names. For those SIDs whose name has been snooped/discovered ethereal will also add "(<name>)" to the end of the SID when printed in the tree pane through the function dissect_nt_sid(). Currently the feature is not too exciting since the only thing that packet-smb-sidsnooping.c will look at to build this mapping table is replies to the LSA/QueryInfoPolicy infolevel 3 packets and thus discover mappings between a Domain SID and a Domain Name. In the near future this future will be enhanced to also look at more interesting calls such as LSA/LookupSIDs2 and similar. svn path=/trunk/; revision=7362
* Added 'server unavailable' dos error message.Tim Potter2003-02-251-1/+2
| | | | svn path=/trunk/; revision=7192
* SMB RTT statistics for tethereal and ethereal.Ronnie Sahlberg2003-01-221-1/+16
| | | | | | | | | | | | SMB RTT statistics are similar to the RTT statistics already supported by ONC-RPC and DCE-RPC. It will present a table with all seen SMB commands and present the Min/Max and Avg response time in ms. Transaction2 and NT-Transaction commands are broken out and presented in its own subtables. tethereal feature is activated with -z smb,rtt switch and in ethereal it is activated either through -0z smb,rtt switch or through the Menu. svn path=/trunk/; revision=6966
* Properly handle raw ntlmssp ...Richard Sharpe2002-08-311-2/+2
| | | | svn path=/trunk/; revision=6151
* Handle the lack of a security blob in negprot response when raw NTLMSSP isRichard Sharpe2002-08-311-2/+2
| | | | | | being used properly. svn path=/trunk/; revision=6149
* Add support for raw NTLMSSP blobs when talking to XP etc ...Richard Sharpe2002-08-301-1/+2
| | | | | | More to do yet though ... svn path=/trunk/; revision=6148
* Removed trailing whitespaces from .h and .c files using theJörg Mayer2002-08-281-8/+8
| | | | | | | winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
* Added some NT access mask constants.Tim Potter2002-08-211-5/+34
| | | | svn path=/trunk/; revision=6055
* Added DOS error 259 - no more items.Tim Potter2002-08-071-1/+2
| | | | svn path=/trunk/; revision=5962
* From Prabhakar Krishnan: add item to SMB protocol tree for time betweenGuy Harris2002-07-201-1/+2
| | | | | | request and response. svn path=/trunk/; revision=5895
* Put in some additional information from:Guy Harris2002-05-261-19/+22
| | | | | | | | | | Microsoft Networks SMB File Sharing Protocol Extensions Version 2.0, Document Version 3.3, November 7, 1988; Microsoft Networks SMB File Sharing Protocol Extensions Version 3.0, Document Version 1.11, July 19, 1990. svn path=/trunk/; revision=5566
* Added constant and value_string for invalid security descriptor ownerTim Potter2002-05-081-1/+2
| | | | | | error. svn path=/trunk/; revision=5415
* Get rid of some unused arguments, and mark some others as unused.Guy Harris2002-04-301-5/+5
| | | | | | | | Remove the declaration of "dissect_nt_sid()" from "packet-dcerpc-samr.c"; get it by including "packet-smb-common.h", instead. svn path=/trunk/; revision=5313
* Added 'invalid security descriptor' error to list of dos errors.Tim Potter2002-04-241-1/+2
| | | | svn path=/trunk/; revision=5234
* A new type of DCERPC over SMB transport.Ronnie Sahlberg2002-03-161-1/+11
| | | | | | | | | | | | | | | | I have captures with w2k speaking DCERPC without using the normal Transaction named pipes SMBs. Instead DCERPC is just implemented ontop of ordinary read/write calls. The smb dissector now examines TreeConnectAndX and stores the conversation/tid/type-of-share in a table for later access. All SMB requests examine that hash table to find out if TID in the header refers to a normal share or an IPC$ share. Initial support in read/write SMB calls to detect if the operations are for an IPC share and thus it assumes it must be DCERPC commands in the payload. Desegmentation/Reassembly of these types of calls are not implemented yet. svn path=/trunk/; revision=4952
* Moved the value_string for MS country codes from packet-dcerpc-nt.c toRonnie Sahlberg2002-03-151-1/+3
| | | | | | packet-smb.c so that packet-smb-pipe.c can reference this struct as well. svn path=/trunk/; revision=4947
* Added error messages for invalid name and invalid form size.Tim Potter2002-03-151-2/+4
| | | | svn path=/trunk/; revision=4946
* From Ronnie Sahlberg: add the actual SMB command to the structure thatGuy Harris2002-02-201-1/+2
| | | | | | | | remembers SMBs for request/response matching, and make sure the request and the response have the same type (or that the response has a different type but is a valid response to the request). svn path=/trunk/; revision=4763
* Match requests and responses using both the MID and the PID; the SNIAGuy Harris2002-01-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | CIFS draft spec speaks of both being used: The multiplex ID (Mid) is used along with the Pid to allow multiplexing the single client and server connection among the client's multiple processes, threads, and requests per thread. Clients may have many outstanding requests (up to the negotiated number, MaxMpxCount) at one time. Servers MAY respond to requests in any order, but a response message MUST always contain the same Mid and Pid values as the corresponding request message. The client MUST NOT have multiple outstanding requests to a server with the same Mid and Pid. and I have seen a capture where more than one PID is used on a given connection and where the same MID is used with two different PIDs. Get rid of the "mid" field in the "smb_info_t" structure - the MID is not used outside "dissect_smb()". svn path=/trunk/; revision=4495
* SPOOLSS RPC dissector, from Tim Potter. This includes adding additionalGuy Harris2002-01-031-2/+14
| | | | | | | DOS error codes to the table of them, and exporting that table to other dissectors for protocols using DOS error codes. svn path=/trunk/; revision=4470
* From Todd Sabin:Guy Harris2001-12-061-1/+5
| | | | | | | | | | | add "dissect_ndr_ctx_hnd()" for dissecting context handles, and use it in various DCERPC dissectors; beef up the MS Security Account Manager dissector. Also, export "NT_errors[]" for use by that dissector. svn path=/trunk/; revision=4350
* Support for reassembly of DCERPC over SMB, from Ronnie Sahlberg.Guy Harris2001-12-051-1/+14
| | | | svn path=/trunk/; revision=4335
* From Tim Potter: add the DOS error for "file already exists" on aGuy Harris2001-12-051-1/+2
| | | | | | rename. svn path=/trunk/; revision=4333
* If a request has already been processed, and we fail to find itsGuy Harris2001-11-281-1/+2
| | | | | | | | | | | | | | | | | | | | "smb_saved_info_t" in the table of requests whose replies have been found, don't look it up in the table of requests whose replies have not been found - if the request in question has no reply in the capture, that may find some later frame in the same conversation with the same MID, and we don't need that information anyway - the only reason we *need* that structure is to save information in it for use when processing its reply, and we already did that the first time we processed the request. (The information for the later frame may be bad, e.g. having a null "extra_info" pointer, or having one that points to information for another request.) Arrange that we don't use the pointer to the "smb_saved_info_t" when processing a request except to save information if the request hasn't already been processed, as that pointer may not be valid if the request has already been processed, as per the above. svn path=/trunk/; revision=4292
* Discard stuff in "smb.h" not used by the dissectors, and replace theGuy Harris2001-11-211-496/+76
| | | | | | | | | | #defines for SMB commands with ones that use the names from the SNIA CIFS spec. Use those #define values rather than hardcoded values in various places that check for specific commands. svn path=/trunk/; revision=4244
* Dissect the rest of the named pipe protocol. Export from "packet-smb.c"Guy Harris2001-11-201-1/+13
| | | | | | | | | | | routines used for that. Rename some named pipe functions as per the SNIA CIFS spec. Label the "number of files moved" field of the reply to a Move SMB as such, rather than as an unspecified "Count". svn path=/trunk/; revision=4229
* Save the function code and FID for pipe requests, and use it for theGuy Harris2001-11-201-2/+4
| | | | | | matching responses. svn path=/trunk/; revision=4228
* Pass, as the first tvbuff argument to "dissect_mailslot_smb()" andGuy Harris2001-11-191-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "dissect_pipe_smb()", a tvbuff containing the setup words and the pipe/mailslot pathname, as those are arguably the part of the packet that contains the "mailslot protocol" and the "pipe protocol", as opposed to the protocol running atop mailslots or pipes. Pass a setup tvbuff to "dissect_pipe_smb()" for it to pass on to the MSRPC-over-named-pipe dissector, and have the setup tvbuff passed to it and "dissect_mailslot_smb()" contain *only* the setup words; don't extract anything other than the setup words from it. Declare "register_proto_smb_mailslot()" in "packet-smb-mailslot.h" rather than "packet-smb.c", and declare "register_proto_smb_pipe()" in "packet-smb-pipe.h" rather than "packet-smb.c". Add a protocol for MSRPC-over-named-pipes. Move the stuff to handle the FID in the setup words of MSRPC-over-named-pipe transactions out of the SMB Transaction dissector into the MSRPC dissector. Add a routine to "packet-smb.c", callable from outside "packet-smb.c", to put an "smb.fid" field into the protocol tree, and to add ", FID: XXXX" to the Info column, for use by the MSRPC-over-named-pipe dissector; use it in the SMB dissector as well, in all the places where we put a FID into the protocol tree. Move the stuff to check whether the LANMAN protocol is enabled, and to set "pinfo->current_proto" to "LANMAN" if it is, into the LANMAN API-over-named-pipe dissector out of the named pipe protocol dissector. If we didn't dissect a Transaction request or reply as a named pipe or mailslot message, put any setup words, parameters, and data it has into the protocol tree as separate items. Don't put a "Response in" item into the protocol tree for an NT Cancel request, as there are no responses to NT Cancel requests. svn path=/trunk/; revision=4221
* From Tim Potter: use the FID, for DCE RPC-over-SMB, as part of theGuy Harris2001-11-181-1/+2
| | | | | | conversation matching. svn path=/trunk/; revision=4220
* Pass in the "smb_info" structure a pointer to the "smb_saved_info_t"Guy Harris2001-11-181-3/+11
| | | | | | | | | | | | structure, so that it can be updated by subdissectors; this way the updates affect the structure immediately, and don't get lost if the subdissector later throws an exception. Use "tvb_reported_length()" to check for an interim mailslot reply; "tvb_length()" could give the wrong answer if a short snapshot length was given in the capture. svn path=/trunk/; revision=4218
* Have only the request and response frame numbers, and a "void *", in anGuy Harris2001-11-181-23/+23
| | | | | | | | | | | | | | | | | "smb_saved_info_t". Put all the information needed to dissect NT Transaction replies, Transaction2 replies, or Transaction replies into separate data structures, allocated separately, and put a pointer to that data structure in the "void *" in question. Use the return value of "dissect_pipe_smb()" and "dissect_mailslot_smb()" to control whether to display as data the stuff those routines were asked to dissect. If we've seen a request before, but its "smb_saved_info_t" isn't in the "matched" hash table, look in the "unmatched" hash table - perhaps we haven't seen the reply yet. svn path=/trunk/; revision=4216
* Cleanup of request/response matching, from Ronnie Sahlberg.Guy Harris2001-11-161-25/+4
| | | | | | | | | | | | Get rid of "Response to" stuff in the LANMAN dissector, as that's now done in the SMB dissector. Add a routine for dissecting unknown SMBs (gets the word and byte counts, and just adds text entries for the word and byte parameters, if any), and replace null pointers in the dissector table with pointers to that routine. Get rid of the check for a null dissector pointer. svn path=/trunk/; revision=4212
* Tvbuffification of Transaction requests, from Ronnie Sahlberg.Guy Harris2001-11-151-6/+6
| | | | | | | | | "Send buffer pointer" and "send buffer length" items appear not to be sent over the wire. Add support for Write And X. svn path=/trunk/; revision=4204
* Transaction2 tvbuffified, and support added for many Transaction2 SMBs,Guy Harris2001-11-121-1/+3
| | | | | | | | from Ronnie Sahlberg. Various other bug fixes, cleanups, and other improvements. svn path=/trunk/; revision=4193
* NT Transact dissection, from Ronnie Sahlberg.Guy Harris2001-11-081-1/+2
| | | | svn path=/trunk/; revision=4178
* First tvbuffication change, from Ronnie Sahlberg. Also changes SMBGuy Harris2001-11-031-4/+10
| | | | | | command names to match later SMB specs. svn path=/trunk/; revision=4138
* Squelch some compiler warnings.Guy Harris2001-08-271-4/+4
| | | | svn path=/trunk/; revision=3874
* Use the descriptor strings when dissecting remote APIs; this lets usGuy Harris2001-08-271-2/+4
| | | | | | | handle null pointer entries, and lets us make the dissection of those APIs more table-driven. svn path=/trunk/; revision=3873
* Keep track of transaction replies that have continuations, and associateGuy Harris2001-08-111-1/+20
| | | | | | continuations with the message to which they're a continuation. svn path=/trunk/; revision=3834
* Tvbuffified SMB mailslot protocol dissector, from Ronnie Sahlberg.Guy Harris2001-08-071-1/+2
| | | | svn path=/trunk/; revision=3832
* Remote API protocol (that seems to be what it's called in a number ofGuy Harris2001-08-051-1/+6
| | | | | | | | | places) dissector tvbuffified, from Ronnie Sahlberg and me. Additional "are we past the end of the buffer" checks added, so that we don't hand random junk to the transaction and transact2 dissectors. svn path=/trunk/; revision=3824
* Add a request/response flag to the "struct smb_info" structure, and useGuy Harris2001-08-051-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | that rather than passing another copy of that flag to dissectors of particular messages. Pass that structure to the pipe subdissector by making "pi.private" point to it, rather than by passing it as an explicit argument. Change more of the if (dirn == 1) { ... } if (dirn == 0) { ... } stuff to if (dirn == 1) { ... } else { ... } and then, as per the first paragraph, check the "request" flag in the "smb_info" structure rather than checking a "dirn" flag. Set "last_transact2_command" to -1 in the "smb_request_val" structures for TRANSACTION requests, as it doesn't apply to those requests. As "dissect_transact_params()" doesn't do any work if the "TransactName" argument is null, don't bother calling it for a reply if we don't have an "smb_request_val" for the corresponding request, as that means we can't find out the value to pass as the "TransactName" argument. svn path=/trunk/; revision=3822
generated by cgit v1.2.3 (git 2.25.1) at 2025-02-26 17:49:19 +0000