packet-smb-browse.c

   1 /* packet-smb-browse.c
   2  * Routines for SMB Browser packet dissection
   3  * Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com>
   4  *
   5  * $Id: packet-smb-browse.c,v 1.31 2003/06/12 08:33:29 guy Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * Copied from packet-pop.c
  12  *
  13  * This program is free software; you can redistribute it and/or
  14  * modify it under the terms of the GNU General Public License
  15  * as published by the Free Software Foundation; either version 2
  16  * of the License, or (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  26  */
  27
  28 #ifdef HAVE_CONFIG_H
  29 # include "config.h"
  30 #endif
  31
  32 #include <stdio.h>
  33
  34 #include <time.h>
  35 #include <string.h>
  36 #include <glib.h>
  37 #include <ctype.h>
  38 #include <epan/packet.h>
  39 #include <epan/conversation.h>
  40 #include "smb.h"
  41 #include "alignment.h"
  42
  43 #include "packet-smb-browse.h"
  44 #include "packet-dcerpc.h"
  45
  46 static int proto_smb_browse = -1;
  47 static int hf_command = -1;
  48 static int hf_update_count = -1;
  49 static int hf_periodicity = -1;
  50 static int hf_server_name = -1;
  51 static int hf_mb_server_name = -1;
  52 static int hf_mb_reset_command = -1;
  53 static int hf_mb_reset_demote = -1;
  54 static int hf_mb_reset_flush = -1;
  55 static int hf_mb_reset_stop = -1;
  56 static int hf_os_major = -1;
  57 static int hf_os_minor = -1;
  58 static int hf_server_type = -1;
  59 static int hf_server_type_workstation = -1;
  60 static int hf_server_type_server = -1;
  61 static int hf_server_type_sql = -1;
  62 static int hf_server_type_domain = -1;
  63 static int hf_server_type_backup = -1;
  64 static int hf_server_type_time = -1;
  65 static int hf_server_type_apple = -1;
  66 static int hf_server_type_novell = -1;
  67 static int hf_server_type_member = -1;
  68 static int hf_server_type_print = -1;
  69 static int hf_server_type_dialin = -1;
  70 static int hf_server_type_xenix = -1;
  71 static int hf_server_type_ntw = -1;
  72 static int hf_server_type_wfw = -1;
  73 static int hf_server_type_nts = -1;
  74 static int hf_server_type_potentialb = -1;
  75 static int hf_server_type_backupb = -1;
  76 static int hf_server_type_masterb = -1;
  77 static int hf_server_type_domainmasterb = -1;
  78 static int hf_server_type_osf = -1;
  79 static int hf_server_type_vms = -1;
  80 static int hf_server_type_w95 = -1;
  81 static int hf_server_type_local = -1;
  82 static int hf_server_type_domainenum = -1;
  83 static int hf_election_version = -1;
  84 static int hf_proto_major = -1;
  85 static int hf_proto_minor = -1;
  86 static int hf_sig_const = -1;
  87 static int hf_server_comment = -1;
  88 static int hf_unused_flags = -1;
  89 static int hf_response_computer_name = -1;
  90 static int hf_election_criteria = -1;
  91 static int hf_election_desire = -1;
  92 static int hf_election_desire_flags_backup = -1;
  93 static int hf_election_desire_flags_standby = -1;
  94 static int hf_election_desire_flags_master = -1;
  95 static int hf_election_desire_flags_domain_master = -1;
  96 static int hf_election_desire_flags_wins = -1;
  97 static int hf_election_desire_flags_nt = -1;
  98 static int hf_election_revision = -1;
  99 static int hf_election_os = -1;
 100 static int hf_election_os_wfw = -1;
 101 static int hf_election_os_ntw = -1;
 102 static int hf_election_os_nts = -1;
 103 static int hf_server_uptime = -1;
 104 static int hf_backup_count = -1;
 105 static int hf_backup_token = -1;
 106 static int hf_backup_server = -1;
 107 static int hf_browser_to_promote = -1;
 108
 109 static gint ett_browse = -1;
 110 static gint ett_browse_flags = -1;
 111 static gint ett_browse_election_criteria = -1;
 112 static gint ett_browse_election_os = -1;
 113 static gint ett_browse_election_desire = -1;
 114 static gint ett_browse_reset_cmd_flags = -1;
 115
 116 #define SERVER_WORKSTATION              0
 117 #define SERVER_SERVER                   1
 118 #define SERVER_SQL_SERVER               2
 119 #define SERVER_DOMAIN_CONTROLLER        3
 120 #define SERVER_BACKUP_CONTROLLER        4
 121 #define SERVER_TIME_SOURCE              5
 122 #define SERVER_APPLE_SERVER             6
 123 #define SERVER_NOVELL_SERVER            7
 124 #define SERVER_DOMAIN_MEMBER_SERVER     8
 125 #define SERVER_PRINT_QUEUE_SERVER       9
 126 #define SERVER_DIALIN_SERVER            10
 127 #define SERVER_XENIX_SERVER             11
 128 #define SERVER_NT_WORKSTATION           12
 129 #define SERVER_WINDOWS_FOR_WORKGROUPS   13
 130 #define SERVER_NT_SERVER                15
 131 #define SERVER_POTENTIAL_BROWSER        16
 132 #define SERVER_BACKUP_BROWSER           17
 133 #define SERVER_MASTER_BROWSER           18
 134 #define SERVER_DOMAIN_MASTER_BROWSER    19
 135 #define SERVER_OSF                      20
 136 #define SERVER_VMS                      21
 137 #define SERVER_WINDOWS_95               22
 138 #define SERVER_LOCAL_LIST_ONLY          30
 139 #define SERVER_DOMAIN_ENUM              31
 140
 141 static const value_string server_types[] = {
 142         {SERVER_WORKSTATION,            "Workstation"},
 143         {SERVER_SERVER,                 "Server"},
 144         {SERVER_SQL_SERVER,             "SQL Server"},
 145         {SERVER_DOMAIN_CONTROLLER,      "Domain Controller"},
 146         {SERVER_BACKUP_CONTROLLER,      "Backup Controller"},
 147         {SERVER_TIME_SOURCE,            "Time Source"},
 148         {SERVER_APPLE_SERVER,           "Apple Server"},
 149         {SERVER_NOVELL_SERVER,          "Novell Server"},
 150         {SERVER_DOMAIN_MEMBER_SERVER,   "Domain Member Server"},
 151         {SERVER_PRINT_QUEUE_SERVER,     "Print Queue Server"},
 152         {SERVER_DIALIN_SERVER,          "Dialin Server"},
 153         {SERVER_XENIX_SERVER,           "Xenix Server"},
 154         {SERVER_NT_WORKSTATION,         "NT Workstation"},
 155         {SERVER_WINDOWS_FOR_WORKGROUPS, "Windows for Workgroups"},
 156         {SERVER_NT_SERVER,              "NT Server"},
 157         {SERVER_POTENTIAL_BROWSER,      "Potential Browser"},
 158         {SERVER_BACKUP_BROWSER,         "Backup Browser"},
 159         {SERVER_MASTER_BROWSER,         "Master Browser"},
 160         {SERVER_DOMAIN_MASTER_BROWSER,  "Domain Master Browser"},
 161         {SERVER_OSF,                    "OSF"},
 162         {SERVER_VMS,                    "VMS"},
 163         {SERVER_WINDOWS_95,             "Windows 95 or above"},
 164         {SERVER_LOCAL_LIST_ONLY,        "Local List Only"},
 165         {SERVER_DOMAIN_ENUM,            "Domain Enum"},
 166         {0,     NULL}
 167 };
 168
 169 static const value_string resetbrowserstate_command_names[] = {
 170   { 0x01, "Stop being a master browser and become a backup browser"},
 171   { 0x02, "Discard browse lists, stop being a master browser, and try again"},
 172   { 0x04, "Stop being a master browser for ever"},
 173   { 0, NULL}
 174 };
 175
 176 static true_false_string tfs_demote_to_backup = {
 177         "Demote an LMB to a Backup Browser",
 178         "Do not demote an LMB to a Backup Browser"
 179 };
 180
 181 static true_false_string tfs_flush_browse_list = {
 182         "Flush the Browse List",
 183         "Do not Flush the Browse List"
 184 };
 185
 186 static true_false_string tfs_stop_being_lmb = {
 187         "Stop Being a Local Master Browser",
 188         "Do not Stop Being a Local Master Browser"
 189 };
 190
 191 static const true_false_string tfs_workstation = {
 192         "This is a Workstation",
 193         "This is NOT a Workstation"
 194 };
 195 static const true_false_string tfs_server = {
 196         "This is a Server",
 197         "This is NOT a Server"
 198 };
 199 static const true_false_string tfs_sql = {
 200         "This is an SQL server",
 201         "This is NOT an SQL server"
 202 };
 203 static const true_false_string tfs_domain = {
 204         "This is a Domain Controller",
 205         "This is NOT a Domain Controller"
 206 };
 207 static const true_false_string tfs_backup = {
 208         "This is a Backup Controller",
 209         "This is NOT a Backup Controller"
 210 };
 211 static const true_false_string tfs_time = {
 212         "This is a Time Source",
 213         "This is NOT a Time Source"
 214 };
 215 static const true_false_string tfs_apple = {
 216         "This is an Apple host",
 217         "This is NOT an Apple host"
 218 };
 219 static const true_false_string tfs_novell = {
 220         "This is a Novell server",
 221         "This is NOT a Novell server"
 222 };
 223 static const true_false_string tfs_member = {
 224         "This is a Domain Member server",
 225         "This is NOT a Domain Member server"
 226 };
 227 static const true_false_string tfs_print = {
 228         "This is a Print Queue server",
 229         "This is NOT a Print Queue server"
 230 };
 231 static const true_false_string tfs_dialin = {
 232         "This is a Dialin server",
 233         "This is NOT a Dialin server"
 234 };
 235 static const true_false_string tfs_xenix = {
 236         "This is a Xenix server",
 237         "This is NOT a Xenix server"
 238 };
 239 static const true_false_string tfs_ntw = {
 240         "This is an NT Workstation",
 241         "This is NOT an NT Workstation"
 242 };
 243 static const true_false_string tfs_wfw = {
 244         "This is a WfW host",
 245         "This is NOT a WfW host"
 246 };
 247 static const true_false_string tfs_nts = {
 248         "This is an NT Server",
 249         "This is NOT an NT Server"
 250 };
 251 static const true_false_string tfs_potentialb = {
 252         "This is a Potential Browser",
 253         "This is NOT a Potential Browser"
 254 };
 255 static const true_false_string tfs_backupb = {
 256         "This is a Backup Browser",
 257         "This is NOT a Backup Browser"
 258 };
 259 static const true_false_string tfs_masterb = {
 260         "This is a Master Browser",
 261         "This is NOT a Master Browser"
 262 };
 263 static const true_false_string tfs_domainmasterb = {
 264         "This is a Domain Master Browser",
 265         "This is NOT a Domain Master Browser"
 266 };
 267 static const true_false_string tfs_osf = {
 268         "This is an OSF host",
 269         "This is NOT an OSF host"
 270 };
 271 static const true_false_string tfs_vms = {
 272         "This is a VMS host",
 273         "This is NOT a VMS host"
 274 };
 275 static const true_false_string tfs_w95 = {
 276         "This is a Windows 95 or above host",
 277         "This is NOT a Windows 95 or above host"
 278 };
 279 static const true_false_string tfs_local = {
 280         "This is a local list only request",
 281         "This is NOT a local list only request"
 282 };
 283 static const true_false_string tfs_domainenum = {
 284         "This is a Domain Enum request",
 285         "This is NOT a Domain Enum request"
 286 };
 287
 288 #define DESIRE_BACKUP                   0
 289 #define DESIRE_STANDBY                  1
 290 #define DESIRE_MASTER                   2
 291 #define DESIRE_DOMAIN_MASTER            3
 292 #define DESIRE_WINS                     5
 293 #define DESIRE_NT                       7
 294
 295 static const value_string desire_flags[] = {
 296         {DESIRE_BACKUP,         "Backup Browse Server"},
 297         {DESIRE_STANDBY,        "Standby Browse Server"},
 298         {DESIRE_MASTER,         "Master Browser"},
 299         {DESIRE_DOMAIN_MASTER,  "Domain Master Browse Server"},
 300         {DESIRE_WINS,           "WINS Client"},
 301         {DESIRE_NT,             "Windows NT Advanced Server"},
 302         {0,                     NULL}
 303 };
 304
 305 static const true_false_string tfs_desire_backup = {
 306         "Backup Browse Server",
 307         "NOT Backup Browse Server"
 308  };
 309 static const true_false_string tfs_desire_standby = {
 310         "Standby Browse Server",
 311         "NOT Standby Browse Server"
 312 };
 313 static const true_false_string tfs_desire_master = {
 314         "Master Browser",
 315         "NOT Master Browser"
 316 };
 317 static const true_false_string tfs_desire_domain_master = {
 318         "Domain Master Browse Server",
 319         "NOT Domain Master Browse Server"
 320 };
 321 static const true_false_string tfs_desire_wins = {
 322         "WINS Client",
 323         "NOT WINS Client"
 324 };
 325 static const true_false_string tfs_desire_nt = {
 326         "Windows NT Advanced Server",
 327         "NOT Windows NT Advanced Server"
 328 };
 329
 330 #define BROWSE_HOST_ANNOUNCE                    1
 331 #define BROWSE_REQUEST_ANNOUNCE                 2
 332 #define BROWSE_ELECTION_REQUEST                 8
 333 #define BROWSE_BACKUP_LIST_REQUEST              9
 334 #define BROWSE_BACKUP_LIST_RESPONSE             10
 335 #define BROWSE_BECOME_BACKUP                    11
 336 #define BROWSE_DOMAIN_ANNOUNCEMENT              12
 337 #define BROWSE_MASTER_ANNOUNCEMENT              13
 338 #define BROWSE_RESETBROWSERSTATE_ANNOUNCEMENT   14
 339 #define BROWSE_LOCAL_MASTER_ANNOUNCEMENT        15
 340
 341 static const value_string commands[] = {
 342         {BROWSE_HOST_ANNOUNCE,          "Host Announcement"},
 343         {BROWSE_REQUEST_ANNOUNCE,       "Request Announcement"},
 344         {BROWSE_ELECTION_REQUEST,       "Browser Election Request"},
 345         {BROWSE_BACKUP_LIST_REQUEST,    "Get Backup List Request"},
 346         {BROWSE_BACKUP_LIST_RESPONSE,   "Get Backup List Response"},
 347         {BROWSE_BECOME_BACKUP,          "Become Backup Browser"},
 348         {BROWSE_DOMAIN_ANNOUNCEMENT,    "Domain/Workgroup Announcement"},
 349         {BROWSE_MASTER_ANNOUNCEMENT,    "Master Announcement"},
 350         {BROWSE_RESETBROWSERSTATE_ANNOUNCEMENT, "Reset Browser State Announcement"},
 351         {BROWSE_LOCAL_MASTER_ANNOUNCEMENT,"Local Master Announcement"},
 352         {0,                             NULL}
 353 };
 354
 355 #define OS_WFW                          0
 356 #define OS_NTW                          4
 357 #define OS_NTS                          5
 358
 359 static const value_string os_flags[] = {
 360         {OS_WFW,                "Windows for Workgroups"},
 361         {OS_NTW,                "Windows NT Workstation"},
 362         {OS_NTS,                "Windows NT Server"},
 363         {0,                     NULL}
 364 };
 365
 366 static const true_false_string tfs_os_wfw = {
 367         "Windows for Workgroups",
 368         "Not Windows for Workgroups"
 369 };
 370 static const true_false_string tfs_os_ntw = {
 371         "Windows NT Workstation",
 372         "Not Windows NT Workstation"
 373 };
 374 static const true_false_string tfs_os_nts = {
 375         "Windows NT Server",
 376         "Not Windows NT Server"
 377 };
 378
 379 static void
 380 dissect_election_criterion_os(tvbuff_t *tvb, proto_tree *parent_tree, int offset)
 381 {
 382         proto_tree *tree = NULL;
 383         proto_item *item = NULL;
 384         guint8 os;
 385
 386         os = tvb_get_guint8(tvb, offset);
 387
 388         if (parent_tree) {
 389                 item = proto_tree_add_uint(parent_tree, hf_election_os, tvb, offset, 1, os);
 390                 tree = proto_item_add_subtree(item, ett_browse_election_os);
 391         }
 392
 393         proto_tree_add_boolean(tree, hf_election_os_wfw,
 394                 tvb, offset, 1, os);
 395         proto_tree_add_boolean(tree, hf_election_os_ntw,
 396                 tvb, offset, 1, os);
 397         proto_tree_add_boolean(tree, hf_election_os_nts,
 398                 tvb, offset, 1, os);
 399
 400 }
 401
 402 static void
 403 dissect_election_criterion_desire(tvbuff_t *tvb, proto_tree *parent_tree, int offset)
 404 {
 405         proto_tree *tree = NULL;
 406         proto_item *item = NULL;
 407         guint8 desire;
 408
 409         desire = tvb_get_guint8(tvb, offset);
 410
 411         if (parent_tree) {
 412                 item = proto_tree_add_uint(parent_tree, hf_election_desire, tvb, offset, 1, desire);
 413                 tree = proto_item_add_subtree(item, ett_browse_election_desire);
 414         }
 415
 416         proto_tree_add_boolean(tree, hf_election_desire_flags_backup,
 417                 tvb, offset, 1, desire);
 418         proto_tree_add_boolean(tree, hf_election_desire_flags_standby,
 419                 tvb, offset, 1, desire);
 420         proto_tree_add_boolean(tree, hf_election_desire_flags_master,
 421                 tvb, offset, 1, desire);
 422         proto_tree_add_boolean(tree, hf_election_desire_flags_domain_master,
 423                 tvb, offset, 1, desire);
 424         proto_tree_add_boolean(tree, hf_election_desire_flags_wins,
 425                 tvb, offset, 1, desire);
 426         proto_tree_add_boolean(tree, hf_election_desire_flags_nt,
 427                 tvb, offset, 1, desire);
 428
 429 }
 430
 431 static void
 432 dissect_election_criterion(tvbuff_t *tvb, proto_tree *parent_tree, int offset)
 433 {
 434         proto_tree *tree = NULL;
 435         proto_item *item = NULL;
 436         guint32 criterion;
 437
 438         criterion = tvb_get_letohl(tvb, offset);
 439
 440         if (parent_tree) {
 441                 item = proto_tree_add_uint(parent_tree, hf_election_criteria, tvb, offset, 4, criterion);
 442                 tree = proto_item_add_subtree(item, ett_browse_election_criteria);
 443         }
 444
 445         /* election desire */
 446         dissect_election_criterion_desire(tvb, tree, offset);
 447         offset += 1;
 448
 449         /* browser protocol major version */
 450         proto_tree_add_item(tree, hf_proto_major, tvb, offset, 1, TRUE);
 451         offset += 1;
 452
 453         /* browser protocol minor version */
 454         proto_tree_add_item(tree, hf_proto_minor, tvb, offset, 1, TRUE);
 455         offset += 1;
 456
 457         /* election os */
 458         dissect_election_criterion_os(tvb, tree, offset);
 459         offset += 1;
 460
 461 }
 462
 463 /*
 464  * XXX - this causes non-browser packets to have browser fields.
 465  */
 466 int
 467 dissect_smb_server_type_flags(tvbuff_t *tvb, int offset, packet_info *pinfo,
 468                               proto_tree *parent_tree, char *drep,
 469                               gboolean infoflag)
 470 {
 471         proto_tree *tree = NULL;
 472         proto_item *item = NULL;
 473         guint32 flags;
 474         int i;
 475
 476         if (drep != NULL) {
 477                 /*
 478                  * Called from a DCE RPC protocol dissector, for a
 479                  * protocol where a 32-bit NDR integer contains
 480                  * an server type mask; extract the server type mask
 481                  * with an NDR call.
 482                  */
 483                 offset = dissect_ndr_uint32(
 484                         tvb, offset, pinfo, tree, drep, hf_server_type, &flags);
 485         } else {
 486                 /*
 487                  * Called from SMB browser or RAS, where the server type
 488                  * mask is just a 4-byte little-endian quantity with no
 489                  * special NDR alignment requirement; extract it with
 490                  * "tvb_get_letohl()".
 491                  */
 492                 flags = tvb_get_letohl(tvb, offset);
 493                 offset += 4;
 494         }
 495
 496         if (parent_tree) {
 497                 item = proto_tree_add_uint(parent_tree, hf_server_type, tvb, offset, 4, flags);
 498                 tree = proto_item_add_subtree(item, ett_browse_flags);
 499         }
 500
 501         if (infoflag) {
 502                 /* Append the type(s) of the system to the COL_INFO line ... */
 503                 if (check_col(pinfo->cinfo, COL_INFO)) {
 504                         for (i = 0; i < 32; i++) {
 505                                 if (flags & (1<<i)) {
 506                                         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
 507                                                 val_to_str(i, server_types,
 508                                                 "Unknown server type:%d"));
 509                                 }
 510                         }
 511                 }
 512         }
 513
 514         proto_tree_add_boolean(tree, hf_server_type_workstation,
 515                 tvb, offset, 4, flags);
 516         proto_tree_add_boolean(tree, hf_server_type_server,
 517                 tvb, offset, 4, flags);
 518         proto_tree_add_boolean(tree, hf_server_type_sql,
 519                 tvb, offset, 4, flags);
 520         proto_tree_add_boolean(tree, hf_server_type_domain,
 521                 tvb, offset, 4, flags);
 522         proto_tree_add_boolean(tree, hf_server_type_backup,
 523                 tvb, offset, 4, flags);
 524         proto_tree_add_boolean(tree, hf_server_type_time,
 525                 tvb, offset, 4, flags);
 526         proto_tree_add_boolean(tree, hf_server_type_apple,
 527                 tvb, offset, 4, flags);
 528         proto_tree_add_boolean(tree, hf_server_type_novell,
 529                 tvb, offset, 4, flags);
 530         proto_tree_add_boolean(tree, hf_server_type_member,
 531                 tvb, offset, 4, flags);
 532         proto_tree_add_boolean(tree, hf_server_type_print,
 533                 tvb, offset, 4, flags);
 534         proto_tree_add_boolean(tree, hf_server_type_dialin,
 535                 tvb, offset, 4, flags);
 536         proto_tree_add_boolean(tree, hf_server_type_xenix,
 537                 tvb, offset, 4, flags);
 538         proto_tree_add_boolean(tree, hf_server_type_ntw,
 539                 tvb, offset, 4, flags);
 540         proto_tree_add_boolean(tree, hf_server_type_wfw,
 541                 tvb, offset, 4, flags);
 542         proto_tree_add_boolean(tree, hf_server_type_nts,
 543                 tvb, offset, 4, flags);
 544         proto_tree_add_boolean(tree, hf_server_type_potentialb,
 545                 tvb, offset, 4, flags);
 546         proto_tree_add_boolean(tree, hf_server_type_backupb,
 547                 tvb, offset, 4, flags);
 548         proto_tree_add_boolean(tree, hf_server_type_masterb,
 549                 tvb, offset, 4, flags);
 550         proto_tree_add_boolean(tree, hf_server_type_domainmasterb,
 551                 tvb, offset, 4, flags);
 552         proto_tree_add_boolean(tree, hf_server_type_osf,
 553                 tvb, offset, 4, flags);
 554         proto_tree_add_boolean(tree, hf_server_type_vms,
 555                 tvb, offset, 4, flags);
 556         proto_tree_add_boolean(tree, hf_server_type_w95,
 557                 tvb, offset, 4, flags);
 558         proto_tree_add_boolean(tree, hf_server_type_local,
 559                 tvb, offset, 4, flags);
 560         proto_tree_add_boolean(tree, hf_server_type_domainenum,
 561                 tvb, offset, 4, flags);
 562
 563         return offset;
 564 }
 565
 566
 567 gboolean
 568 dissect_mailslot_browse(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
 569 {
 570         int offset = 0;
 571         guint8 cmd;
 572         proto_tree *tree = NULL;
 573         proto_item *item = NULL;
 574         guint32 periodicity;
 575         char host_name[17];
 576         guint namelen;
 577         guint8 server_count, reset_cmd;
 578         int i;
 579         guint32 uptime;
 580
 581         if (!proto_is_protocol_enabled(proto_smb_browse)) {
 582                 return FALSE;
 583         }
 584
 585         pinfo->current_proto = "BROWSER";
 586
 587         if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
 588                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "BROWSER");
 589         }
 590         if (check_col(pinfo->cinfo, COL_INFO)) {
 591                 col_clear(pinfo->cinfo, COL_INFO);
 592         }
 593
 594         cmd = tvb_get_guint8(tvb, offset);
 595
 596         if (check_col(pinfo->cinfo, COL_INFO)) {
 597                 /* Put in something, and replace it later */
 598                 col_set_str(pinfo->cinfo, COL_INFO, val_to_str(cmd, commands, "Unknown command:0x%02x"));
 599         }
 600
 601
 602         if (parent_tree) {
 603                 item = proto_tree_add_item(parent_tree, proto_smb_browse, tvb, offset, -1, TRUE);
 604
 605                 tree = proto_item_add_subtree(item, ett_browse);
 606         }
 607
 608         /* command */
 609         proto_tree_add_uint(tree, hf_command, tvb, offset, 1, cmd);
 610         offset += 1;
 611
 612         switch (cmd) {
 613         case BROWSE_DOMAIN_ANNOUNCEMENT:
 614         case BROWSE_LOCAL_MASTER_ANNOUNCEMENT:
 615         case BROWSE_HOST_ANNOUNCE: {
 616                 /* update count */
 617                 proto_tree_add_item(tree, hf_update_count, tvb, offset, 1, TRUE);
 618                 offset += 1;
 619
 620                 /* periodicity (in milliseconds) */
 621                 periodicity = tvb_get_letohl(tvb, offset);
 622                 proto_tree_add_uint_format(tree, hf_periodicity, tvb, offset, 4,
 623                     periodicity,
 624                     "Update Periodicity: %s",
 625                     time_msecs_to_str(periodicity));
 626                 offset += 4;
 627
 628                 /* server name */
 629                 tvb_get_nstringz0(tvb, offset, sizeof(host_name), host_name);
 630                 if (check_col(pinfo->cinfo, COL_INFO)) {
 631                         col_append_fstr(pinfo->cinfo, COL_INFO, " %s", host_name);
 632                 }
 633                 proto_tree_add_string_format(tree, hf_server_name,
 634                         tvb, offset, 16,
 635                         host_name,
 636                         (cmd==BROWSE_DOMAIN_ANNOUNCEMENT)?
 637                                 "Domain/Workgroup: %s":
 638                                 "Host Name: %s",
 639                         host_name);
 640                 offset += 16;
 641
 642                 /* OS major version */
 643                 proto_tree_add_item(tree, hf_os_major, tvb, offset, 1, TRUE);
 644                 offset += 1;
 645
 646                 /* OS minor version */
 647                 proto_tree_add_item(tree, hf_os_minor, tvb, offset, 1, TRUE);
 648                 offset += 1;
 649
 650                 /* server type flags */
 651                 offset = dissect_smb_server_type_flags(
 652                         tvb, offset, pinfo, tree, NULL, TRUE);
 653
 654                 if (cmd == BROWSE_DOMAIN_ANNOUNCEMENT) {
 655                         /*
 656                          * Network Monitor claims this is a "Comment
 657                          * Pointer".  I don't believe it.
 658                          *
 659                          * It's not a browser protocol major/minor
 660                          * version number, and signature constant,
 661                          * however.
 662                          */
 663                         proto_tree_add_text(tree, tvb, offset, 4,
 664                             "Mysterious Field: 0x%08x",
 665                             tvb_get_letohl(tvb, offset));
 666                         offset += 4;
 667                 } else {
 668                         /* browser protocol major version */
 669                         proto_tree_add_item(tree, hf_proto_major, tvb, offset, 1, TRUE);
 670                         offset += 1;
 671
 672                         /* browser protocol minor version */
 673                         proto_tree_add_item(tree, hf_proto_minor, tvb, offset, 1, TRUE);
 674                         offset += 1;
 675
 676                         /* signature constant */
 677                         proto_tree_add_item(tree, hf_sig_const, tvb, offset, 2, TRUE);
 678                         offset += 2;
 679                 }
 680
 681                 /* master browser server name or server comment */
 682                 namelen = tvb_strsize(tvb, offset);
 683                 proto_tree_add_item(tree,
 684                         (cmd==BROWSE_DOMAIN_ANNOUNCEMENT)?
 685                             hf_mb_server_name : hf_server_comment,
 686                         tvb, offset, namelen, TRUE);
 687                 offset += namelen;
 688                 break;
 689         }
 690         case BROWSE_REQUEST_ANNOUNCE: {
 691                 char *computer_name;
 692
 693                 /* unused/unknown flags */
 694                 proto_tree_add_item(tree, hf_unused_flags,
 695                         tvb, offset, 1, TRUE);
 696                 offset += 1;
 697
 698                 /* name of computer to which to send reply */
 699                 computer_name = tvb_get_stringz(tvb, offset, &namelen);
 700                 proto_tree_add_string(tree, hf_response_computer_name,
 701                         tvb, offset, namelen, computer_name);
 702                 if (check_col(pinfo->cinfo, COL_INFO))
 703                         col_append_fstr(
 704                                 pinfo->cinfo, COL_INFO, " %s", computer_name);
 705                 g_free(computer_name);
 706                 offset += namelen;
 707                 break;
 708         }
 709
 710         case BROWSE_ELECTION_REQUEST:
 711                 /* election version */
 712                 proto_tree_add_item(tree, hf_election_version, tvb, offset, 1, TRUE);
 713                 offset += 1;
 714
 715                 /* criterion */
 716                 dissect_election_criterion(tvb, tree, offset);
 717                 offset += 4;
 718
 719                 /* server uptime */
 720                 uptime = tvb_get_letohl(tvb, offset);
 721                 proto_tree_add_uint_format(tree, hf_server_uptime,
 722                     tvb, offset, 4, uptime,
 723                     "Uptime: %s",
 724                     time_msecs_to_str(uptime));
 725                 offset += 4;
 726
 727                 /* next 4 bytes must be zero */
 728                 offset += 4;
 729
 730                 /* server name */
 731                 namelen = tvb_strsize(tvb, offset);
 732                 proto_tree_add_item(tree, hf_server_name,
 733                         tvb, offset, namelen, TRUE);
 734                 offset += namelen;
 735                 break;
 736
 737         case BROWSE_BACKUP_LIST_REQUEST:
 738                 /* backup list requested count */
 739                 proto_tree_add_item(tree, hf_backup_count, tvb, offset, 1, TRUE);
 740                 offset += 1;
 741
 742                 /* backup requested token */
 743                 proto_tree_add_item(tree, hf_backup_token, tvb, offset, 4, TRUE);
 744                 offset += 4;
 745                 break;
 746
 747         case BROWSE_BACKUP_LIST_RESPONSE:
 748                 /* backup list requested count */
 749                 server_count = tvb_get_guint8(tvb, offset);
 750                 proto_tree_add_uint(tree, hf_backup_count, tvb, offset, 1,
 751                     server_count);
 752                 offset += 1;
 753
 754                 /* backup requested token */
 755                 proto_tree_add_item(tree, hf_backup_token, tvb, offset, 4, TRUE);
 756                 offset += 4;
 757
 758                 /* backup server names */
 759                 for (i = 0; i < server_count; i++) {
 760                         namelen = tvb_strsize(tvb, offset);
 761                         proto_tree_add_item(tree, hf_backup_server,
 762                                 tvb, offset, namelen, TRUE);
 763                         offset += namelen;
 764                 }
 765                 break;
 766
 767         case BROWSE_MASTER_ANNOUNCEMENT:
 768                 /* master browser server name */
 769                 namelen = tvb_strsize(tvb, offset);
 770                 proto_tree_add_item(tree, hf_mb_server_name,
 771                         tvb, offset, namelen, TRUE);
 772                 offset += namelen;
 773                 break;
 774
 775         case BROWSE_RESETBROWSERSTATE_ANNOUNCEMENT: {
 776                 proto_tree *sub_tree;
 777                 proto_item *reset_item;
 778
 779                 /* the subcommand follows ... one of three values */
 780
 781                 reset_cmd = tvb_get_guint8(tvb, offset);
 782                 reset_item = proto_tree_add_uint(tree, hf_mb_reset_command, tvb,
 783                                                  offset, 1, reset_cmd);
 784                 sub_tree = proto_item_add_subtree(item, ett_browse_reset_cmd_flags);
 785                 proto_tree_add_boolean(sub_tree, hf_mb_reset_demote, tvb,
 786                                        offset, 1, reset_cmd);
 787                 proto_tree_add_boolean(sub_tree, hf_mb_reset_flush, tvb,
 788                                        offset, 1, reset_cmd);
 789                 proto_tree_add_boolean(sub_tree, hf_mb_reset_stop, tvb,
 790                                        offset, 1, reset_cmd);
 791                 offset += 1;
 792                 break;
 793         }
 794
 795         case BROWSE_BECOME_BACKUP:
 796                 /* name of browser to promote */
 797                 namelen = tvb_strsize(tvb, offset);
 798                 proto_tree_add_item(tree, hf_browser_to_promote,
 799                         tvb, offset, namelen, TRUE);
 800                 offset += namelen;
 801                 break;
 802         }
 803
 804         return TRUE;
 805 }
 806
 807 /*
 808  * It appears that browser announcements sent to \MAILSLOT\LANMAN aren't
 809  * the same as browser announcements sent to \MAILSLOT\BROWSE.
 810  * Was that an older version of the protocol?
 811  *
 812  * The document at
 813  *
 814  *      http://www.samba.org/samba/ftp/specs/brow_rev.txt
 815  *
 816  * gives both formats of host announcement packets, saying that
 817  * "[The first] format seems wrong", that one being what appears to
 818  * show up in \MAILSLOT\LANMAN packets, and that "[The second one]
 819  * may be better", that one being what appears to show up in
 820  * \MAILSLOT\BROWSE packets.
 821  *
 822  * XXX - what other browser packets go out to that mailslot?
 823  */
 824 gboolean
 825 dissect_mailslot_lanman(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
 826 {
 827         int offset = 0;
 828         guint8 cmd;
 829         proto_tree *tree = NULL;
 830         proto_item *item = NULL;
 831         guint32 periodicity;
 832         const char *host_name;
 833         guint namelen;
 834
 835         if (!proto_is_protocol_enabled(proto_smb_browse)) {
 836                 return FALSE;
 837         }
 838
 839         pinfo->current_proto = "BROWSER";
 840
 841         if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
 842                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "BROWSER");
 843         }
 844         if (check_col(pinfo->cinfo, COL_INFO)) {
 845                 col_clear(pinfo->cinfo, COL_INFO);
 846         }
 847
 848         cmd = tvb_get_guint8(tvb, offset);
 849
 850         if (check_col(pinfo->cinfo, COL_INFO)) {
 851                 /* Put in something, and replace it later */
 852                 col_set_str(pinfo->cinfo, COL_INFO, val_to_str(cmd, commands, "Unknown command:0x%02x"));
 853         }
 854
 855
 856         if (parent_tree) {
 857                 item = proto_tree_add_item(parent_tree, proto_smb_browse, tvb, offset, -1, TRUE);
 858
 859                 tree = proto_item_add_subtree(item, ett_browse);
 860         }
 861
 862         /* command */
 863         proto_tree_add_uint(tree, hf_command, tvb, offset, 1, cmd);
 864         offset += 1;
 865
 866         switch (cmd) {
 867         case BROWSE_DOMAIN_ANNOUNCEMENT:
 868         case BROWSE_LOCAL_MASTER_ANNOUNCEMENT:
 869         case BROWSE_HOST_ANNOUNCE:
 870
 871                 /* update count */
 872                 proto_tree_add_item(tree, hf_update_count, tvb, offset, 1, TRUE);
 873                 offset += 1;
 874
 875                 /* server type flags */
 876                 offset = dissect_smb_server_type_flags(
 877                         tvb, offset, pinfo, tree, NULL, TRUE);
 878
 879                 /* OS major version */
 880                 proto_tree_add_item(tree, hf_os_major, tvb, offset, 1, TRUE);
 881                 offset += 1;
 882
 883                 /* OS minor version */
 884                 proto_tree_add_item(tree, hf_os_minor, tvb, offset, 1, TRUE);
 885                 offset += 1;
 886
 887                 /* periodicity (in seconds; convert to milliseconds) */
 888                 periodicity = tvb_get_letohs(tvb, offset)*1000;
 889                 proto_tree_add_uint_format(tree, hf_periodicity, tvb, offset, 2,
 890                     periodicity,
 891                     "Update Periodicity: %s",
 892                     time_msecs_to_str(periodicity));
 893                 offset += 2;
 894
 895                 /* server name */
 896                 namelen = tvb_strsize(tvb, offset);
 897                 host_name = tvb_get_ptr(tvb, offset, namelen);
 898                 if (check_col(pinfo->cinfo, COL_INFO)) {
 899                         col_append_fstr(pinfo->cinfo, COL_INFO, " %s", host_name);
 900                 }
 901                 proto_tree_add_item(tree, hf_server_name,
 902                         tvb, offset, namelen, TRUE);
 903                 offset += namelen;
 904
 905                 /* master browser server name or server comment */
 906                 namelen = tvb_strsize(tvb, offset);
 907                 proto_tree_add_item(tree,
 908                         (cmd==BROWSE_DOMAIN_ANNOUNCEMENT)?
 909                             hf_mb_server_name : hf_server_comment,
 910                         tvb, offset, namelen, TRUE);
 911                 offset += namelen;
 912                 break;
 913         }
 914
 915         return TRUE;
 916 }
 917
 918 void
 919 proto_register_smb_browse(void)
 920 {
 921         static hf_register_info hf[] = {
 922                 { &hf_command,
 923                         { "Command", "browser.command", FT_UINT8, BASE_HEX,
 924                         VALS(commands), 0, "Browse command opcode", HFILL }},
 925
 926                 { &hf_update_count,
 927                         { "Update Count", "browser.update_count", FT_UINT8, BASE_DEC,
 928                         NULL, 0, "Browse Update Count", HFILL }},
 929
 930                 { &hf_periodicity,
 931                         { "Update Periodicity", "browser.period", FT_UINT32, BASE_DEC,
 932                         NULL, 0, "Update Periodicity in ms", HFILL }},
 933
 934                 { &hf_server_name,
 935                         { "Server Name", "browser.server", FT_STRING, BASE_NONE,
 936                         NULL, 0, "BROWSE Server Name", HFILL }},
 937
 938                 { &hf_mb_server_name,
 939                         { "Master Browser Server Name", "browser.mb_server", FT_STRING, BASE_NONE,
 940                         NULL, 0, "BROWSE Master Browser Server Name", HFILL }},
 941
 942                 { &hf_mb_reset_command,
 943                   { "ResetBrowserState Command", "browser.reset_cmd", FT_UINT8,
 944                     BASE_HEX, VALS(&resetbrowserstate_command_names), 0,
 945                     "ResetBrowserState Command", HFILL }},
 946                 { &hf_mb_reset_demote,
 947                   { "Demote LMB", "browser.reset_cmd.demote", FT_BOOLEAN,
 948                     8, TFS(&tfs_demote_to_backup), 0x01, "Demote LMB", HFILL}},
 949                 { &hf_mb_reset_flush,
 950                   { "Flush Browse List", "browser.reset_cmd.flush", FT_BOOLEAN,
 951                     8, TFS(&tfs_flush_browse_list), 0x02, "Flush Browse List", HFILL}},
 952                 { &hf_mb_reset_stop,
 953                   { "Stop Being LMB", "browser.reset_cmd.stop_lmb", FT_BOOLEAN,
 954                     8, TFS(&tfs_stop_being_lmb), 0x04, "Stop Being LMB", HFILL}},
 955                 { &hf_os_major,
 956                         { "OS Major Version", "browser.os_major", FT_UINT8, BASE_DEC,
 957                         NULL, 0, "Operating System Major Version", HFILL }},
 958
 959                 { &hf_os_minor,
 960                         { "OS Minor Version", "browser.os_minor", FT_UINT8, BASE_DEC,
 961                         NULL, 0, "Operating System Minor Version", HFILL }},
 962
 963                 { &hf_server_type,
 964                         { "Server Type", "browser.server_type", FT_UINT32, BASE_HEX,
 965                         NULL, 0, "Server Type Flags", HFILL }},
 966
 967                 { &hf_server_type_workstation,
 968                         { "Workstation", "browser.server_type.workstation", FT_BOOLEAN, 32,
 969                         TFS(&tfs_workstation), 1<<SERVER_WORKSTATION, "Is This A Workstation?", HFILL }},
 970
 971                 { &hf_server_type_server,
 972                         { "Server", "browser.server_type.server", FT_BOOLEAN, 32,
 973                         TFS(&tfs_server), 1<<SERVER_SERVER, "Is This A Server?", HFILL }},
 974
 975                 { &hf_server_type_sql,
 976                         { "SQL", "browser.server_type.sql", FT_BOOLEAN, 32,
 977                         TFS(&tfs_sql), 1<<SERVER_SQL_SERVER, "Is This A SQL Server?", HFILL }},
 978
 979                 { &hf_server_type_domain,
 980                         { "Domain Controller", "browser.server_type.domain_controller", FT_BOOLEAN, 32,
 981                         TFS(&tfs_domain), 1<<SERVER_DOMAIN_CONTROLLER, "Is This A Domain Controller?", HFILL }},
 982
 983                 { &hf_server_type_backup,
 984                         { "Backup Controller", "browser.server_type.backup_controller", FT_BOOLEAN, 32,
 985                         TFS(&tfs_backup), 1<<SERVER_BACKUP_CONTROLLER, "Is This A Backup Domain Controller?", HFILL }},
 986
 987                 { &hf_server_type_time,
 988                         { "Time Source", "browser.server_type.time", FT_BOOLEAN, 32,
 989                         TFS(&tfs_time), 1<<SERVER_TIME_SOURCE, "Is This A Time Source?", HFILL }},
 990
 991                 { &hf_server_type_apple,
 992                         { "Apple", "browser.server_type.apple", FT_BOOLEAN, 32,
 993                         TFS(&tfs_apple), 1<<SERVER_APPLE_SERVER, "Is This An Apple Server ?", HFILL }},
 994
 995                 { &hf_server_type_novell,
 996                         { "Novell", "browser.server_type.novell", FT_BOOLEAN, 32,
 997                         TFS(&tfs_novell), 1<<SERVER_NOVELL_SERVER, "Is This A Novell Server?", HFILL }},
 998
 999                 { &hf_server_type_member,
1000                         { "Member", "browser.server_type.member", FT_BOOLEAN, 32,
1001                         TFS(&tfs_member), 1<<SERVER_DOMAIN_MEMBER_SERVER, "Is This A Domain Member Server?", HFILL }},
1002
1003                 { &hf_server_type_print,
1004                         { "Print", "browser.server_type.print", FT_BOOLEAN, 32,
1005                         TFS(&tfs_print), 1<<SERVER_PRINT_QUEUE_SERVER, "Is This A Print Server?", HFILL }},
1006
1007                 { &hf_server_type_dialin,
1008                         { "Dialin", "browser.server_type.dialin", FT_BOOLEAN, 32,
1009                         TFS(&tfs_dialin), 1<<SERVER_DIALIN_SERVER, "Is This A Dialin Server?", HFILL }},
1010
1011                 { &hf_server_type_xenix,
1012                         { "Xenix", "browser.server_type.xenix", FT_BOOLEAN, 32,
1013                         TFS(&tfs_xenix), 1<<SERVER_XENIX_SERVER, "Is This A Xenix Server?", HFILL }},
1014
1015                 { &hf_server_type_ntw,
1016                         { "NT Workstation", "browser.server_type.ntw", FT_BOOLEAN, 32,
1017                         TFS(&tfs_ntw), 1<<SERVER_NT_WORKSTATION, "Is This A NT Workstation?", HFILL }},
1018
1019                 { &hf_server_type_wfw,
1020                         { "WfW", "browser.server_type.wfw", FT_BOOLEAN, 32,
1021                         TFS(&tfs_wfw), 1<<SERVER_WINDOWS_FOR_WORKGROUPS, "Is This A Windows For Workgroups Server?", HFILL }},
1022
1023                 { &hf_server_type_nts,
1024                         { "NT Server", "browser.server_type.nts", FT_BOOLEAN, 32,
1025                         TFS(&tfs_nts), 1<<SERVER_NT_SERVER, "Is This A NT Server?", HFILL }},
1026
1027                 { &hf_server_type_potentialb,
1028                         { "Potential Browser", "browser.server_type.browser.potential", FT_BOOLEAN, 32,
1029                         TFS(&tfs_potentialb), 1<<SERVER_POTENTIAL_BROWSER, "Is This A Potential Browser?", HFILL }},
1030
1031                 { &hf_server_type_backupb,
1032                         { "Backup Browser", "browser.server_type.browser.backup", FT_BOOLEAN, 32,
1033                         TFS(&tfs_backupb), 1<<SERVER_BACKUP_BROWSER, "Is This A Backup Browser?", HFILL }},
1034
1035                 { &hf_server_type_masterb,
1036                         { "Master Browser", "browser.server_type.browser.master", FT_BOOLEAN, 32,
1037                         TFS(&tfs_masterb), 1<<SERVER_MASTER_BROWSER, "Is This A Master Browser?", HFILL }},
1038
1039                 { &hf_server_type_domainmasterb,
1040                         { "Domain Master Browser", "browser.server_type.browser.domain_master", FT_BOOLEAN, 32,
1041                         TFS(&tfs_domainmasterb), 1<<SERVER_DOMAIN_MASTER_BROWSER, "Is This A Domain Master Browser?", HFILL }},
1042
1043                 { &hf_server_type_osf,
1044                         { "OSF", "browser.server_type.osf", FT_BOOLEAN, 32,
1045                         TFS(&tfs_osf), 1<<SERVER_OSF, "Is This An OSF server ?", HFILL }},
1046
1047                 { &hf_server_type_vms,
1048                         { "VMS", "browser.server_type.vms", FT_BOOLEAN, 32,
1049                         TFS(&tfs_vms), 1<<SERVER_VMS, "Is This A VMS Server?", HFILL }},
1050
1051                 { &hf_server_type_w95,
1052                         { "Windows 95+", "browser.server_type.w95", FT_BOOLEAN, 32,
1053                         TFS(&tfs_w95), 1<<SERVER_WINDOWS_95, "Is This A Windows 95 or above server?", HFILL }},
1054
1055                 { &hf_server_type_local,
1056                         { "Local", "browser.server_type.local", FT_BOOLEAN, 32,
1057                         TFS(&tfs_local), 1<<SERVER_LOCAL_LIST_ONLY, "Is This A Local List Only request?", HFILL }},
1058
1059                 { &hf_server_type_domainenum,
1060                         { "Domain Enum", "browser.server_type.domainenum", FT_BOOLEAN, 32,
1061                         TFS(&tfs_domainenum), 1<<SERVER_DOMAIN_ENUM, "Is This A Domain Enum request?", HFILL }},
1062
1063                 { &hf_election_version,
1064                         { "Election Version", "browser.election.version", FT_UINT8, BASE_DEC,
1065                         NULL, 0, "Election Version", HFILL }},
1066
1067                 { &hf_proto_major,
1068                         { "Browser Protocol Major Version", "browser.proto_major", FT_UINT8, BASE_DEC,
1069                         NULL, 0, "Browser Protocol Major Version", HFILL }},
1070
1071                 { &hf_proto_minor,
1072                         { "Browser Protocol Minor Version", "browser.proto_minor", FT_UINT8, BASE_DEC,
1073                         NULL, 0, "Browser Protocol Minor Version", HFILL }},
1074
1075                 { &hf_sig_const,
1076                         { "Signature", "browser.sig", FT_UINT16, BASE_HEX,
1077                         NULL, 0, "Signature Constant", HFILL }},
1078
1079                 { &hf_server_comment,
1080                         { "Host Comment", "browser.comment", FT_STRINGZ, BASE_NONE,
1081                         NULL, 0, "Server Comment", HFILL }},
1082
1083                 { &hf_unused_flags,
1084                         { "Unused flags", "browser.unused", FT_UINT8, BASE_HEX,
1085                         NULL, 0, "Unused/unknown flags", HFILL }},
1086
1087                 { &hf_response_computer_name,
1088                         { "Response Computer Name", "browser.response_computer_name", FT_STRINGZ, BASE_NONE,
1089                         NULL, 0, "Response Computer Name", HFILL }},
1090
1091                 { &hf_election_criteria,
1092                         { "Election Criteria", "browser.election.criteria", FT_UINT32, BASE_HEX,
1093                         NULL, 0, "Election Criteria", HFILL }},
1094
1095                 { &hf_election_desire,
1096                         { "Election Desire", "browser.election.desire", FT_UINT8, BASE_HEX,
1097                         NULL, 0, "Election Desire", HFILL }},
1098
1099                 { &hf_election_desire_flags_backup,
1100                         { "Backup", "browser.election.desire.backup", FT_BOOLEAN, 8,
1101                         TFS(&tfs_desire_backup), 1<<DESIRE_BACKUP, "Is this a backup server", HFILL }},
1102
1103                 { &hf_election_desire_flags_standby,
1104                         { "Standby", "browser.election.desire.standby", FT_BOOLEAN, 8,
1105                         TFS(&tfs_desire_standby), 1<<DESIRE_STANDBY, "Is this a standby server?", HFILL }},
1106
1107                 { &hf_election_desire_flags_master,
1108                         { "Master", "browser.election.desire.master", FT_BOOLEAN, 8,
1109                         TFS(&tfs_desire_master), 1<<DESIRE_MASTER, "Is this a master server", HFILL }},
1110
1111                 { &hf_election_desire_flags_domain_master,
1112                         { "Domain Master", "browser.election.desire.domain_master", FT_BOOLEAN, 8,
1113                         TFS(&tfs_desire_domain_master), 1<<DESIRE_DOMAIN_MASTER, "Is this a domain master", HFILL }},
1114
1115                 { &hf_election_desire_flags_wins,
1116                         { "WINS", "browser.election.desire.wins", FT_BOOLEAN, 8,
1117                         TFS(&tfs_desire_wins), 1<<DESIRE_WINS, "Is this a WINS server", HFILL }},
1118
1119                 { &hf_election_desire_flags_nt,
1120                         { "NT", "browser.election.desire.nt", FT_BOOLEAN, 8,
1121                         TFS(&tfs_desire_nt), 1<<DESIRE_NT, "Is this a NT server", HFILL }},
1122
1123                 { &hf_election_revision,
1124                         { "Election Revision", "browser.election.revision", FT_UINT16, BASE_DEC,
1125                         NULL, 0, "Election Revision", HFILL }},
1126
1127                 { &hf_election_os,
1128                         { "Election OS", "browser.election.os", FT_UINT8, BASE_HEX,
1129                         NULL, 0, "Election OS", HFILL }},
1130
1131                 { &hf_election_os_wfw,
1132                         { "WfW", "browser.election.os.wfw", FT_BOOLEAN, 8,
1133                         TFS(&tfs_os_wfw), 1<<OS_WFW, "Is this a WfW host?", HFILL }},
1134
1135                 { &hf_election_os_ntw,
1136                         { "NT Workstation", "browser.election.os.ntw", FT_BOOLEAN, 8,
1137                         TFS(&tfs_os_ntw), 1<<OS_NTW, "Is this a NT Workstation?", HFILL }},
1138
1139                 { &hf_election_os_nts,
1140                         { "NT Server", "browser.election.os.nts", FT_BOOLEAN, 8,
1141                         TFS(&tfs_os_nts), 1<<OS_NTS, "Is this a NT Server?", HFILL }},
1142
1143                 { &hf_server_uptime,
1144                         { "Uptime", "browser.uptime", FT_UINT32, BASE_DEC,
1145                         NULL, 0, "Server uptime in ms", HFILL }},
1146
1147                 { &hf_backup_count,
1148                         { "Backup List Requested Count", "browser.backup.count", FT_UINT8, BASE_DEC,
1149                         NULL, 0, "Backup list requested count", HFILL }},
1150
1151                 { &hf_backup_token,
1152                         { "Backup Request Token", "browser.backup.token", FT_UINT32, BASE_DEC,
1153                         NULL, 0, "Backup requested/response token", HFILL }},
1154
1155                 { &hf_backup_server,
1156                         { "Backup Server", "browser.backup.server", FT_STRING, BASE_NONE,
1157                         NULL, 0, "Backup Server Name", HFILL }},
1158
1159                 { &hf_browser_to_promote,
1160                         { "Browser to Promote", "browser.browser_to_promote", FT_STRINGZ, BASE_NONE,
1161                         NULL, 0, "Browser to Promote", HFILL }},
1162
1163         };
1164
1165         static gint *ett[] = {
1166                 &ett_browse,
1167                 &ett_browse_flags,
1168                 &ett_browse_election_criteria,
1169                 &ett_browse_election_os,
1170                 &ett_browse_election_desire,
1171                 &ett_browse_reset_cmd_flags,
1172         };
1173
1174         proto_smb_browse = proto_register_protocol("Microsoft Windows Browser Protocol",
1175             "BROWSER", "browser");
1176
1177         proto_register_field_array(proto_smb_browse, hf, array_length(hf));
1178         proto_register_subtree_array(ett, array_length(ett));
1179 }