packet-smb-browse.c

   1 /* packet-smb-browse.c
   2  * Routines for SMB Browser packet dissection
   3  * Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com>
   4  *
   5  * $Id: packet-smb-browse.c,v 1.30 2003/04/30 02:35:19 gerald Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * Copied from packet-pop.c
  12  *
  13  * This program is free software; you can redistribute it and/or
  14  * modify it under the terms of the GNU General Public License
  15  * as published by the Free Software Foundation; either version 2
  16  * of the License, or (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  26  */
  27
  28 #ifdef HAVE_CONFIG_H
  29 # include "config.h"
  30 #endif
  31
  32 #include <stdio.h>
  33
  34 #include <time.h>
  35 #include <string.h>
  36 #include <glib.h>
  37 #include <ctype.h>
  38 #include <epan/packet.h>
  39 #include <epan/conversation.h>
  40 #include "smb.h"
  41 #include "alignment.h"
  42
  43 #include "packet-smb-browse.h"
  44 #include "packet-dcerpc.h"
  45
  46 static int proto_smb_browse = -1;
  47 static int hf_command = -1;
  48 static int hf_update_count = -1;
  49 static int hf_periodicity = -1;
  50 static int hf_server_name = -1;
  51 static int hf_mb_server_name = -1;
  52 static int hf_mb_reset_command = -1;
  53 static int hf_mb_reset_demote = -1;
  54 static int hf_mb_reset_flush = -1;
  55 static int hf_mb_reset_stop = -1;
  56 static int hf_os_major = -1;
  57 static int hf_os_minor = -1;
  58 static int hf_server_type = -1;
  59 static int hf_server_type_workstation = -1;
  60 static int hf_server_type_server = -1;
  61 static int hf_server_type_sql = -1;
  62 static int hf_server_type_domain = -1;
  63 static int hf_server_type_backup = -1;
  64 static int hf_server_type_time = -1;
  65 static int hf_server_type_apple = -1;
  66 static int hf_server_type_novell = -1;
  67 static int hf_server_type_member = -1;
  68 static int hf_server_type_print = -1;
  69 static int hf_server_type_dialin = -1;
  70 static int hf_server_type_xenix = -1;
  71 static int hf_server_type_ntw = -1;
  72 static int hf_server_type_wfw = -1;
  73 static int hf_server_type_nts = -1;
  74 static int hf_server_type_potentialb = -1;
  75 static int hf_server_type_backupb = -1;
  76 static int hf_server_type_masterb = -1;
  77 static int hf_server_type_domainmasterb = -1;
  78 static int hf_server_type_osf = -1;
  79 static int hf_server_type_vms = -1;
  80 static int hf_server_type_w95 = -1;
  81 static int hf_server_type_local = -1;
  82 static int hf_server_type_domainenum = -1;
  83 static int hf_election_version = -1;
  84 static int hf_proto_major = -1;
  85 static int hf_proto_minor = -1;
  86 static int hf_sig_const = -1;
  87 static int hf_server_comment = -1;
  88 static int hf_unused_flags = -1;
  89 static int hf_response_computer_name = -1;
  90 static int hf_election_criteria = -1;
  91 static int hf_election_desire = -1;
  92 static int hf_election_desire_flags_backup = -1;
  93 static int hf_election_desire_flags_standby = -1;
  94 static int hf_election_desire_flags_master = -1;
  95 static int hf_election_desire_flags_domain_master = -1;
  96 static int hf_election_desire_flags_wins = -1;
  97 static int hf_election_desire_flags_nt = -1;
  98 static int hf_election_revision = -1;
  99 static int hf_election_os = -1;
 100 static int hf_election_os_wfw = -1;
 101 static int hf_election_os_ntw = -1;
 102 static int hf_election_os_nts = -1;
 103 static int hf_server_uptime = -1;
 104 static int hf_backup_count = -1;
 105 static int hf_backup_token = -1;
 106 static int hf_backup_server = -1;
 107 static int hf_browser_to_promote = -1;
 108
 109 static gint ett_browse = -1;
 110 static gint ett_browse_flags = -1;
 111 static gint ett_browse_election_criteria = -1;
 112 static gint ett_browse_election_os = -1;
 113 static gint ett_browse_election_desire = -1;
 114 static gint ett_browse_reset_cmd_flags = -1;
 115
 116 #define SERVER_WORKSTATION              0
 117 #define SERVER_SERVER                   1
 118 #define SERVER_SQL_SERVER               2
 119 #define SERVER_DOMAIN_CONTROLLER        3
 120 #define SERVER_BACKUP_CONTROLLER        4
 121 #define SERVER_TIME_SOURCE              5
 122 #define SERVER_APPLE_SERVER             6
 123 #define SERVER_NOVELL_SERVER            7
 124 #define SERVER_DOMAIN_MEMBER_SERVER     8
 125 #define SERVER_PRINT_QUEUE_SERVER       9
 126 #define SERVER_DIALIN_SERVER            10
 127 #define SERVER_XENIX_SERVER             11
 128 #define SERVER_NT_WORKSTATION           12
 129 #define SERVER_WINDOWS_FOR_WORKGROUPS   13
 130 #define SERVER_NT_SERVER                15
 131 #define SERVER_POTENTIAL_BROWSER        16
 132 #define SERVER_BACKUP_BROWSER           17
 133 #define SERVER_MASTER_BROWSER           18
 134 #define SERVER_DOMAIN_MASTER_BROWSER    19
 135 #define SERVER_OSF                      20
 136 #define SERVER_VMS                      21
 137 #define SERVER_WINDOWS_95               22
 138 #define SERVER_LOCAL_LIST_ONLY          30
 139 #define SERVER_DOMAIN_ENUM              31
 140
 141 static const value_string server_types[] = {
 142         {SERVER_WORKSTATION,            "Workstation"},
 143         {SERVER_SERVER,                 "Server"},
 144         {SERVER_SQL_SERVER,             "SQL Server"},
 145         {SERVER_DOMAIN_CONTROLLER,      "Domain Controller"},
 146         {SERVER_BACKUP_CONTROLLER,      "Backup Controller"},
 147         {SERVER_TIME_SOURCE,            "Time Source"},
 148         {SERVER_APPLE_SERVER,           "Apple Server"},
 149         {SERVER_NOVELL_SERVER,          "Novell Server"},
 150         {SERVER_DOMAIN_MEMBER_SERVER,   "Domain Member Server"},
 151         {SERVER_PRINT_QUEUE_SERVER,     "Print Queue Server"},
 152         {SERVER_DIALIN_SERVER,          "Dialin Server"},
 153         {SERVER_XENIX_SERVER,           "Xenix Server"},
 154         {SERVER_NT_WORKSTATION,         "NT Workstation"},
 155         {SERVER_WINDOWS_FOR_WORKGROUPS, "Windows for Workgroups"},
 156         {SERVER_NT_SERVER,              "NT Server"},
 157         {SERVER_POTENTIAL_BROWSER,      "Potential Browser"},
 158         {SERVER_BACKUP_BROWSER,         "Backup Browser"},
 159         {SERVER_MASTER_BROWSER,         "Master Browser"},
 160         {SERVER_DOMAIN_MASTER_BROWSER,  "Domain Master Browser"},
 161         {SERVER_OSF,                    "OSF"},
 162         {SERVER_VMS,                    "VMS"},
 163         {SERVER_WINDOWS_95,             "Windows 95 or above"},
 164         {SERVER_LOCAL_LIST_ONLY,        "Local List Only"},
 165         {SERVER_DOMAIN_ENUM,            "Domain Enum"},
 166         {0,     NULL}
 167 };
 168
 169 static const value_string resetbrowserstate_command_names[] = {
 170   { 0x01, "Stop being a master browser and become a backup browser"},
 171   { 0x02, "Discard browse lists, stop being a master browser, and try again"},
 172   { 0x04, "Stop being a master browser for ever"},
 173   { 0, NULL}
 174 };
 175
 176 static true_false_string tfs_demote_to_backup = {
 177         "Demote an LMB to a Backup Browser",
 178         "Do not demote an LMB to a Backup Browser"
 179 };
 180
 181 static true_false_string tfs_flush_browse_list = {
 182         "Flush the Browse List",
 183         "Do not Flush the Browse List"
 184 };
 185
 186 static true_false_string tfs_stop_being_lmb = {
 187         "Stop Being a Local Master Browser",
 188         "Do not Stop Being a Local Master Browser"
 189 };
 190
 191 static const true_false_string tfs_workstation = {
 192         "This is a Workstation",
 193         "This is NOT a Workstation"
 194 };
 195 static const true_false_string tfs_server = {
 196         "This is a Server",
 197         "This is NOT a Server"
 198 };
 199 static const true_false_string tfs_sql = {
 200         "This is an SQL server",
 201         "This is NOT an SQL server"
 202 };
 203 static const true_false_string tfs_domain = {
 204         "This is a Domain Controller",
 205         "This is NOT a Domain Controller"
 206 };
 207 static const true_false_string tfs_backup = {
 208         "This is a Backup Controller",
 209         "This is NOT a Backup Controller"
 210 };
 211 static const true_false_string tfs_time = {
 212         "This is a Time Source",
 213         "This is NOT a Time Source"
 214 };
 215 static const true_false_string tfs_apple = {
 216         "This is an Apple host",
 217         "This is NOT an Apple host"
 218 };
 219 static const true_false_string tfs_novell = {
 220         "This is a Novell server",
 221         "This is NOT a Novell server"
 222 };
 223 static const true_false_string tfs_member = {
 224         "This is a Domain Member server",
 225         "This is NOT a Domain Member server"
 226 };
 227 static const true_false_string tfs_print = {
 228         "This is a Print Queue server",
 229         "This is NOT a Print Queue server"
 230 };
 231 static const true_false_string tfs_dialin = {
 232         "This is a Dialin server",
 233         "This is NOT a Dialin server"
 234 };
 235 static const true_false_string tfs_xenix = {
 236         "This is a Xenix server",
 237         "This is NOT a Xenix server"
 238 };
 239 static const true_false_string tfs_ntw = {
 240         "This is an NT Workstation",
 241         "This is NOT an NT Workstation"
 242 };
 243 static const true_false_string tfs_wfw = {
 244         "This is a WfW host",
 245         "This is NOT a WfW host"
 246 };
 247 static const true_false_string tfs_nts = {
 248         "This is an NT Server",
 249         "This is NOT an NT Server"
 250 };
 251 static const true_false_string tfs_potentialb = {
 252         "This is a Potential Browser",
 253         "This is NOT a Potential Browser"
 254 };
 255 static const true_false_string tfs_backupb = {
 256         "This is a Backup Browser",
 257         "This is NOT a Backup Browser"
 258 };
 259 static const true_false_string tfs_masterb = {
 260         "This is a Master Browser",
 261         "This is NOT a Master Browser"
 262 };
 263 static const true_false_string tfs_domainmasterb = {
 264         "This is a Domain Master Browser",
 265         "This is NOT a Domain Master Browser"
 266 };
 267 static const true_false_string tfs_osf = {
 268         "This is an OSF host",
 269         "This is NOT an OSF host"
 270 };
 271 static const true_false_string tfs_vms = {
 272         "This is a VMS host",
 273         "This is NOT a VMS host"
 274 };
 275 static const true_false_string tfs_w95 = {
 276         "This is a Windows 95 or above host",
 277         "This is NOT a Windows 95 or above host"
 278 };
 279 static const true_false_string tfs_local = {
 280         "This is a local list only request",
 281         "This is NOT a local list only request"
 282 };
 283 static const true_false_string tfs_domainenum = {
 284         "This is a Domain Enum request",
 285         "This is NOT a Domain Enum request"
 286 };
 287
 288 #define DESIRE_BACKUP                   0
 289 #define DESIRE_STANDBY                  1
 290 #define DESIRE_MASTER                   2
 291 #define DESIRE_DOMAIN_MASTER            3
 292 #define DESIRE_WINS                     5
 293 #define DESIRE_NT                       7
 294
 295 static const value_string desire_flags[] = {
 296         {DESIRE_BACKUP,         "Backup Browse Server"},
 297         {DESIRE_STANDBY,        "Standby Browse Server"},
 298         {DESIRE_MASTER,         "Master Browser"},
 299         {DESIRE_DOMAIN_MASTER,  "Domain Master Browse Server"},
 300         {DESIRE_WINS,           "WINS Client"},
 301         {DESIRE_NT,             "Windows NT Advanced Server"},
 302         {0,                     NULL}
 303 };
 304
 305 static const true_false_string tfs_desire_backup = {
 306         "Backup Browse Server",
 307         "NOT Backup Browse Server"
 308  };
 309 static const true_false_string tfs_desire_standby = {
 310         "Standby Browse Server",
 311         "NOT Standby Browse Server"
 312 };
 313 static const true_false_string tfs_desire_master = {
 314         "Master Browser",
 315         "NOT Master Browser"
 316 };
 317 static const true_false_string tfs_desire_domain_master = {
 318         "Domain Master Browse Server",
 319         "NOT Domain Master Browse Server"
 320 };
 321 static const true_false_string tfs_desire_wins = {
 322         "WINS Client",
 323         "NOT WINS Client"
 324 };
 325 static const true_false_string tfs_desire_nt = {
 326         "Windows NT Advanced Server",
 327         "NOT Windows NT Advanced Server"
 328 };
 329
 330 #define BROWSE_HOST_ANNOUNCE                    1
 331 #define BROWSE_REQUEST_ANNOUNCE                 2
 332 #define BROWSE_ELECTION_REQUEST                 8
 333 #define BROWSE_BACKUP_LIST_REQUEST              9
 334 #define BROWSE_BACKUP_LIST_RESPONSE             10
 335 #define BROWSE_BECOME_BACKUP                    11
 336 #define BROWSE_DOMAIN_ANNOUNCEMENT              12
 337 #define BROWSE_MASTER_ANNOUNCEMENT              13
 338 #define BROWSE_RESETBROWSERSTATE_ANNOUNCEMENT   14
 339 #define BROWSE_LOCAL_MASTER_ANNOUNCEMENT        15
 340
 341 static const value_string commands[] = {
 342         {BROWSE_HOST_ANNOUNCE,          "Host Announcement"},
 343         {BROWSE_REQUEST_ANNOUNCE,       "Request Announcement"},
 344         {BROWSE_ELECTION_REQUEST,       "Browser Election Request"},
 345         {BROWSE_BACKUP_LIST_REQUEST,    "Get Backup List Request"},
 346         {BROWSE_BACKUP_LIST_RESPONSE,   "Get Backup List Response"},
 347         {BROWSE_BECOME_BACKUP,          "Become Backup Browser"},
 348         {BROWSE_DOMAIN_ANNOUNCEMENT,    "Domain/Workgroup Announcement"},
 349         {BROWSE_MASTER_ANNOUNCEMENT,    "Master Announcement"},
 350         {BROWSE_RESETBROWSERSTATE_ANNOUNCEMENT, "Reset Browser State Announcement"},
 351         {BROWSE_LOCAL_MASTER_ANNOUNCEMENT,"Local Master Announcement"},
 352         {0,                             NULL}
 353 };
 354
 355 #define OS_WFW                          0
 356 #define OS_NTW                          4
 357 #define OS_NTS                          5
 358
 359 static const value_string os_flags[] = {
 360         {OS_WFW,                "Windows for Workgroups"},
 361         {OS_NTW,                "Windows NT Workstation"},
 362         {OS_NTS,                "Windows NT Server"},
 363         {0,                     NULL}
 364 };
 365
 366 static const true_false_string tfs_os_wfw = {
 367         "Windows for Workgroups",
 368         "Not Windows for Workgroups"
 369 };
 370 static const true_false_string tfs_os_ntw = {
 371         "Windows NT Workstation",
 372         "Not Windows NT Workstation"
 373 };
 374 static const true_false_string tfs_os_nts = {
 375         "Windows NT Server",
 376         "Not Windows NT Server"
 377 };
 378
 379 static void
 380 dissect_election_criterion_os(tvbuff_t *tvb, proto_tree *parent_tree, int offset)
 381 {
 382         proto_tree *tree = NULL;
 383         proto_item *item = NULL;
 384         guint8 os;
 385
 386         os = tvb_get_guint8(tvb, offset);
 387
 388         if (parent_tree) {
 389                 item = proto_tree_add_uint(parent_tree, hf_election_os, tvb, offset, 1, os);
 390                 tree = proto_item_add_subtree(item, ett_browse_election_os);
 391         }
 392
 393         proto_tree_add_boolean(tree, hf_election_os_wfw,
 394                 tvb, offset, 1, os);
 395         proto_tree_add_boolean(tree, hf_election_os_ntw,
 396                 tvb, offset, 1, os);
 397         proto_tree_add_boolean(tree, hf_election_os_nts,
 398                 tvb, offset, 1, os);
 399
 400 }
 401
 402 static void
 403 dissect_election_criterion_desire(tvbuff_t *tvb, proto_tree *parent_tree, int offset)
 404 {
 405         proto_tree *tree = NULL;
 406         proto_item *item = NULL;
 407         guint8 desire;
 408
 409         desire = tvb_get_guint8(tvb, offset);
 410
 411         if (parent_tree) {
 412                 item = proto_tree_add_uint(parent_tree, hf_election_desire, tvb, offset, 1, desire);
 413                 tree = proto_item_add_subtree(item, ett_browse_election_desire);
 414         }
 415
 416         proto_tree_add_boolean(tree, hf_election_desire_flags_backup,
 417                 tvb, offset, 1, desire);
 418         proto_tree_add_boolean(tree, hf_election_desire_flags_standby,
 419                 tvb, offset, 1, desire);
 420         proto_tree_add_boolean(tree, hf_election_desire_flags_master,
 421                 tvb, offset, 1, desire);
 422         proto_tree_add_boolean(tree, hf_election_desire_flags_domain_master,
 423                 tvb, offset, 1, desire);
 424         proto_tree_add_boolean(tree, hf_election_desire_flags_wins,
 425                 tvb, offset, 1, desire);
 426         proto_tree_add_boolean(tree, hf_election_desire_flags_nt,
 427                 tvb, offset, 1, desire);
 428
 429 }
 430
 431 static void
 432 dissect_election_criterion(tvbuff_t *tvb, proto_tree *parent_tree, int offset)
 433 {
 434         proto_tree *tree = NULL;
 435         proto_item *item = NULL;
 436         guint32 criterion;
 437
 438         criterion = tvb_get_letohl(tvb, offset);
 439
 440         if (parent_tree) {
 441                 item = proto_tree_add_uint(parent_tree, hf_election_criteria, tvb, offset, 4, criterion);
 442                 tree = proto_item_add_subtree(item, ett_browse_election_criteria);
 443         }
 444
 445         /* election desire */
 446         dissect_election_criterion_desire(tvb, tree, offset);
 447         offset += 1;
 448
 449         /* browser protocol major version */
 450         proto_tree_add_item(tree, hf_proto_major, tvb, offset, 1, TRUE);
 451         offset += 1;
 452
 453         /* browser protocol minor version */
 454         proto_tree_add_item(tree, hf_proto_minor, tvb, offset, 1, TRUE);
 455         offset += 1;
 456
 457         /* election os */
 458         dissect_election_criterion_os(tvb, tree, offset);
 459         offset += 1;
 460
 461 }
 462
 463 /*
 464  * XXX - this causes non-browser packets to have browser fields.
 465  */
 466 int
 467 dissect_smb_server_type_flags(tvbuff_t *tvb, int offset, packet_info *pinfo,
 468                               proto_tree *parent_tree, char *drep,
 469                               gboolean infoflag)
 470 {
 471         proto_tree *tree = NULL;
 472         proto_item *item = NULL;
 473         guint32 flags;
 474         int i;
 475
 476         if (drep != NULL) {
 477                 /*
 478                  * Called from a DCE RPC protocol dissector, for a
 479                  * protocol where a 32-bit NDR integer contains
 480                  * an server type mask; extract the server type mask
 481                  * with an NDR call.
 482                  */
 483                 offset = dissect_ndr_uint32(
 484                         tvb, offset, pinfo, tree, drep, hf_server_type, &flags);
 485         } else {
 486                 /*
 487                  * Called from SMB browser or RAS, where the server type
 488                  * mask is just a 4-byte little-endian quantity with no
 489                  * special NDR alignment requirement; extract it with
 490                  * "tvb_get_letohl()".
 491                  */
 492                 flags = tvb_get_letohl(tvb, offset);
 493                 offset += 4;
 494         }
 495
 496         if (parent_tree) {
 497                 item = proto_tree_add_uint(parent_tree, hf_server_type, tvb, offset, 4, flags);
 498                 tree = proto_item_add_subtree(item, ett_browse_flags);
 499         }
 500
 501         if (infoflag) {
 502                 /* Append the type(s) of the system to the COL_INFO line ... */
 503                 if (check_col(pinfo->cinfo, COL_INFO)) {
 504                         for (i = 0; i < 32; i++) {
 505                                 if (flags & (1<<i)) {
 506                                         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
 507                                                 val_to_str(i, server_types,
 508                                                 "Unknown server type:%d"));
 509                                 }
 510                         }
 511                 }
 512         }
 513
 514         proto_tree_add_boolean(tree, hf_server_type_workstation,
 515                 tvb, offset, 4, flags);
 516         proto_tree_add_boolean(tree, hf_server_type_server,
 517                 tvb, offset, 4, flags);
 518         proto_tree_add_boolean(tree, hf_server_type_sql,
 519                 tvb, offset, 4, flags);
 520         proto_tree_add_boolean(tree, hf_server_type_domain,
 521                 tvb, offset, 4, flags);
 522         proto_tree_add_boolean(tree, hf_server_type_backup,
 523                 tvb, offset, 4, flags);
 524         proto_tree_add_boolean(tree, hf_server_type_time,
 525                 tvb, offset, 4, flags);
 526         proto_tree_add_boolean(tree, hf_server_type_apple,
 527                 tvb, offset, 4, flags);
 528         proto_tree_add_boolean(tree, hf_server_type_novell,
 529                 tvb, offset, 4, flags);
 530         proto_tree_add_boolean(tree, hf_server_type_member,
 531                 tvb, offset, 4, flags);
 532         proto_tree_add_boolean(tree, hf_server_type_print,
 533                 tvb, offset, 4, flags);
 534         proto_tree_add_boolean(tree, hf_server_type_dialin,
 535                 tvb, offset, 4, flags);
 536         proto_tree_add_boolean(tree, hf_server_type_xenix,
 537                 tvb, offset, 4, flags);
 538         proto_tree_add_boolean(tree, hf_server_type_ntw,
 539                 tvb, offset, 4, flags);
 540         proto_tree_add_boolean(tree, hf_server_type_wfw,
 541                 tvb, offset, 4, flags);
 542         proto_tree_add_boolean(tree, hf_server_type_nts,
 543                 tvb, offset, 4, flags);
 544         proto_tree_add_boolean(tree, hf_server_type_potentialb,
 545                 tvb, offset, 4, flags);
 546         proto_tree_add_boolean(tree, hf_server_type_backupb,
 547                 tvb, offset, 4, flags);
 548         proto_tree_add_boolean(tree, hf_server_type_masterb,
 549                 tvb, offset, 4, flags);
 550         proto_tree_add_boolean(tree, hf_server_type_domainmasterb,
 551                 tvb, offset, 4, flags);
 552         proto_tree_add_boolean(tree, hf_server_type_osf,
 553                 tvb, offset, 4, flags);
 554         proto_tree_add_boolean(tree, hf_server_type_vms,
 555                 tvb, offset, 4, flags);
 556         proto_tree_add_boolean(tree, hf_server_type_w95,
 557                 tvb, offset, 4, flags);
 558         proto_tree_add_boolean(tree, hf_server_type_local,
 559                 tvb, offset, 4, flags);
 560         proto_tree_add_boolean(tree, hf_server_type_domainenum,
 561                 tvb, offset, 4, flags);
 562
 563         return offset;
 564 }
 565
 566
 567 gboolean
 568 dissect_mailslot_browse(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
 569 {
 570         int offset = 0;
 571         guint8 cmd;
 572         proto_tree *tree = NULL;
 573         proto_item *item = NULL;
 574         guint32 periodicity;
 575         char host_name[17];
 576         guint namelen;
 577         guint8 server_count, reset_cmd;
 578         int i;
 579         guint32 uptime;
 580
 581         if (!proto_is_protocol_enabled(proto_smb_browse)) {
 582                 return FALSE;
 583         }
 584
 585         pinfo->current_proto = "BROWSER";
 586
 587         if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
 588                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "BROWSER");
 589         }
 590         if (check_col(pinfo->cinfo, COL_INFO)) {
 591                 col_clear(pinfo->cinfo, COL_INFO);
 592         }
 593
 594         cmd = tvb_get_guint8(tvb, offset);
 595
 596         if (check_col(pinfo->cinfo, COL_INFO)) {
 597                 /* Put in something, and replace it later */
 598                 col_set_str(pinfo->cinfo, COL_INFO, val_to_str(cmd, commands, "Unknown command:0x%02x"));
 599         }
 600
 601
 602         if (parent_tree) {
 603                 item = proto_tree_add_item(parent_tree, proto_smb_browse, tvb, offset, -1, TRUE);
 604
 605                 tree = proto_item_add_subtree(item, ett_browse);
 606         }
 607
 608         /* command */
 609         proto_tree_add_uint(tree, hf_command, tvb, offset, 1, cmd);
 610         offset += 1;
 611
 612         switch (cmd) {
 613         case BROWSE_DOMAIN_ANNOUNCEMENT:
 614         case BROWSE_LOCAL_MASTER_ANNOUNCEMENT:
 615         case BROWSE_HOST_ANNOUNCE: {
 616                 /* update count */
 617                 proto_tree_add_item(tree, hf_update_count, tvb, offset, 1, TRUE);
 618                 offset += 1;
 619
 620                 /* periodicity (in milliseconds) */
 621                 periodicity = tvb_get_letohl(tvb, offset);
 622                 proto_tree_add_uint_format(tree, hf_periodicity, tvb, offset, 4,
 623                     periodicity,
 624                     "Update Periodicity: %s",
 625                     time_msecs_to_str(periodicity));
 626                 offset += 4;
 627
 628                 /* server name */
 629                 tvb_get_nstringz0(tvb, offset, sizeof(host_name), host_name);
 630                 if (check_col(pinfo->cinfo, COL_INFO)) {
 631                         col_append_fstr(pinfo->cinfo, COL_INFO, " %s", host_name);
 632                 }
 633                 proto_tree_add_string_format(tree, hf_server_name,
 634                         tvb, offset, 16,
 635                         host_name,
 636                         (cmd==BROWSE_DOMAIN_ANNOUNCEMENT)?
 637                                 "Domain/Workgroup: %s":
 638                                 "Host Name: %s",
 639                         host_name);
 640                 offset += 16;
 641
 642                 /* OS major version */
 643                 proto_tree_add_item(tree, hf_os_major, tvb, offset, 1, TRUE);
 644                 offset += 1;
 645
 646                 /* OS minor version */
 647                 proto_tree_add_item(tree, hf_os_minor, tvb, offset, 1, TRUE);
 648                 offset += 1;
 649
 650                 /* server type flags */
 651                 offset = dissect_smb_server_type_flags(
 652                         tvb, offset, pinfo, tree, NULL, TRUE);
 653
 654                 if (cmd == BROWSE_DOMAIN_ANNOUNCEMENT) {
 655                         /*
 656                          * Network Monitor claims this is a "Comment
 657                          * Pointer".  I don't believe it.
 658                          *
 659                          * It's not a browser protocol major/minor
 660                          * version number, and signature constant,
 661                          * however.
 662                          */
 663                         proto_tree_add_text(tree, tvb, offset, 4,
 664                             "Mysterious Field: 0x%08x",
 665                             tvb_get_letohl(tvb, offset));
 666                         offset += 4;
 667                 } else {
 668                         /* browser protocol major version */
 669                         proto_tree_add_item(tree, hf_proto_major, tvb, offset, 1, TRUE);
 670                         offset += 1;
 671
 672                         /* browser protocol minor version */
 673                         proto_tree_add_item(tree, hf_proto_minor, tvb, offset, 1, TRUE);
 674                         offset += 1;
 675
 676                         /* signature constant */
 677                         proto_tree_add_item(tree, hf_sig_const, tvb, offset, 2, TRUE);
 678                         offset += 2;
 679                 }
 680
 681                 /* master browser server name or server comment */
 682                 namelen = tvb_strsize(tvb, offset);
 683                 proto_tree_add_item(tree,
 684                         (cmd==BROWSE_DOMAIN_ANNOUNCEMENT)?
 685                             hf_mb_server_name : hf_server_comment,
 686                         tvb, offset, namelen, TRUE);
 687                 offset += namelen;
 688                 break;
 689         }
 690         case BROWSE_REQUEST_ANNOUNCE: {
 691                 char *computer_name;
 692
 693                 /* unused/unknown flags */
 694                 proto_tree_add_item(tree, hf_unused_flags,
 695                         tvb, offset, 1, TRUE);
 696                 offset += 1;
 697
 698                 /* name of computer to which to send reply */
 699                 namelen = tvb_strsize(tvb, offset);
 700                 proto_tree_add_item(tree, hf_response_computer_name,
 701                         tvb, offset, namelen, TRUE);
 702
 703                 computer_name = g_malloc(namelen);
 704                 tvb_get_nstringz0(tvb, offset, namelen, computer_name);
 705
 706                 if (check_col(pinfo->cinfo, COL_INFO))
 707                         col_append_fstr(
 708                                 pinfo->cinfo, COL_INFO, " %s", computer_name);
 709
 710                 g_free(computer_name);
 711
 712                 offset += namelen;
 713                 break;
 714         }
 715
 716         case BROWSE_ELECTION_REQUEST:
 717                 /* election version */
 718                 proto_tree_add_item(tree, hf_election_version, tvb, offset, 1, TRUE);
 719                 offset += 1;
 720
 721                 /* criterion */
 722                 dissect_election_criterion(tvb, tree, offset);
 723                 offset += 4;
 724
 725                 /* server uptime */
 726                 uptime = tvb_get_letohl(tvb, offset);
 727                 proto_tree_add_uint_format(tree, hf_server_uptime,
 728                     tvb, offset, 4, uptime,
 729                     "Uptime: %s",
 730                     time_msecs_to_str(uptime));
 731                 offset += 4;
 732
 733                 /* next 4 bytes must be zero */
 734                 offset += 4;
 735
 736                 /* server name */
 737                 namelen = tvb_strsize(tvb, offset);
 738                 proto_tree_add_item(tree, hf_server_name,
 739                         tvb, offset, namelen, TRUE);
 740                 offset += namelen;
 741                 break;
 742
 743         case BROWSE_BACKUP_LIST_REQUEST:
 744                 /* backup list requested count */
 745                 proto_tree_add_item(tree, hf_backup_count, tvb, offset, 1, TRUE);
 746                 offset += 1;
 747
 748                 /* backup requested token */
 749                 proto_tree_add_item(tree, hf_backup_token, tvb, offset, 4, TRUE);
 750                 offset += 4;
 751                 break;
 752
 753         case BROWSE_BACKUP_LIST_RESPONSE:
 754                 /* backup list requested count */
 755                 server_count = tvb_get_guint8(tvb, offset);
 756                 proto_tree_add_uint(tree, hf_backup_count, tvb, offset, 1,
 757                     server_count);
 758                 offset += 1;
 759
 760                 /* backup requested token */
 761                 proto_tree_add_item(tree, hf_backup_token, tvb, offset, 4, TRUE);
 762                 offset += 4;
 763
 764                 /* backup server names */
 765                 for (i = 0; i < server_count; i++) {
 766                         namelen = tvb_strsize(tvb, offset);
 767                         proto_tree_add_item(tree, hf_backup_server,
 768                                 tvb, offset, namelen, TRUE);
 769                         offset += namelen;
 770                 }
 771                 break;
 772
 773         case BROWSE_MASTER_ANNOUNCEMENT:
 774                 /* master browser server name */
 775                 namelen = tvb_strsize(tvb, offset);
 776                 proto_tree_add_item(tree, hf_mb_server_name,
 777                         tvb, offset, namelen, TRUE);
 778                 offset += namelen;
 779                 break;
 780
 781         case BROWSE_RESETBROWSERSTATE_ANNOUNCEMENT: {
 782                 proto_tree *sub_tree;
 783                 proto_item *reset_item;
 784
 785                 /* the subcommand follows ... one of three values */
 786
 787                 reset_cmd = tvb_get_guint8(tvb, offset);
 788                 reset_item = proto_tree_add_uint(tree, hf_mb_reset_command, tvb,
 789                                                  offset, 1, reset_cmd);
 790                 sub_tree = proto_item_add_subtree(item, ett_browse_reset_cmd_flags);
 791                 proto_tree_add_boolean(sub_tree, hf_mb_reset_demote, tvb,
 792                                        offset, 1, reset_cmd);
 793                 proto_tree_add_boolean(sub_tree, hf_mb_reset_flush, tvb,
 794                                        offset, 1, reset_cmd);
 795                 proto_tree_add_boolean(sub_tree, hf_mb_reset_stop, tvb,
 796                                        offset, 1, reset_cmd);
 797                 offset += 1;
 798                 break;
 799         }
 800
 801         case BROWSE_BECOME_BACKUP:
 802                 /* name of browser to promote */
 803                 namelen = tvb_strsize(tvb, offset);
 804                 proto_tree_add_item(tree, hf_browser_to_promote,
 805                         tvb, offset, namelen, TRUE);
 806                 offset += namelen;
 807                 break;
 808         }
 809
 810         return TRUE;
 811 }
 812
 813 /*
 814  * It appears that browser announcements sent to \MAILSLOT\LANMAN aren't
 815  * the same as browser announcements sent to \MAILSLOT\BROWSE.
 816  * Was that an older version of the protocol?
 817  *
 818  * The document at
 819  *
 820  *      http://www.samba.org/samba/ftp/specs/brow_rev.txt
 821  *
 822  * gives both formats of host announcement packets, saying that
 823  * "[The first] format seems wrong", that one being what appears to
 824  * show up in \MAILSLOT\LANMAN packets, and that "[The second one]
 825  * may be better", that one being what appears to show up in
 826  * \MAILSLOT\BROWSE packets.
 827  *
 828  * XXX - what other browser packets go out to that mailslot?
 829  */
 830 gboolean
 831 dissect_mailslot_lanman(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
 832 {
 833         int offset = 0;
 834         guint8 cmd;
 835         proto_tree *tree = NULL;
 836         proto_item *item = NULL;
 837         guint32 periodicity;
 838         const char *host_name;
 839         guint namelen;
 840
 841         if (!proto_is_protocol_enabled(proto_smb_browse)) {
 842                 return FALSE;
 843         }
 844
 845         pinfo->current_proto = "BROWSER";
 846
 847         if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
 848                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "BROWSER");
 849         }
 850         if (check_col(pinfo->cinfo, COL_INFO)) {
 851                 col_clear(pinfo->cinfo, COL_INFO);
 852         }
 853
 854         cmd = tvb_get_guint8(tvb, offset);
 855
 856         if (check_col(pinfo->cinfo, COL_INFO)) {
 857                 /* Put in something, and replace it later */
 858                 col_set_str(pinfo->cinfo, COL_INFO, val_to_str(cmd, commands, "Unknown command:0x%02x"));
 859         }
 860
 861
 862         if (parent_tree) {
 863                 item = proto_tree_add_item(parent_tree, proto_smb_browse, tvb, offset, -1, TRUE);
 864
 865                 tree = proto_item_add_subtree(item, ett_browse);
 866         }
 867
 868         /* command */
 869         proto_tree_add_uint(tree, hf_command, tvb, offset, 1, cmd);
 870         offset += 1;
 871
 872         switch (cmd) {
 873         case BROWSE_DOMAIN_ANNOUNCEMENT:
 874         case BROWSE_LOCAL_MASTER_ANNOUNCEMENT:
 875         case BROWSE_HOST_ANNOUNCE:
 876
 877                 /* update count */
 878                 proto_tree_add_item(tree, hf_update_count, tvb, offset, 1, TRUE);
 879                 offset += 1;
 880
 881                 /* server type flags */
 882                 offset = dissect_smb_server_type_flags(
 883                         tvb, offset, pinfo, tree, NULL, TRUE);
 884
 885                 /* OS major version */
 886                 proto_tree_add_item(tree, hf_os_major, tvb, offset, 1, TRUE);
 887                 offset += 1;
 888
 889                 /* OS minor version */
 890                 proto_tree_add_item(tree, hf_os_minor, tvb, offset, 1, TRUE);
 891                 offset += 1;
 892
 893                 /* periodicity (in seconds; convert to milliseconds) */
 894                 periodicity = tvb_get_letohs(tvb, offset)*1000;
 895                 proto_tree_add_uint_format(tree, hf_periodicity, tvb, offset, 2,
 896                     periodicity,
 897                     "Update Periodicity: %s",
 898                     time_msecs_to_str(periodicity));
 899                 offset += 2;
 900
 901                 /* server name */
 902                 namelen = tvb_strsize(tvb, offset);
 903                 host_name = tvb_get_ptr(tvb, offset, namelen);
 904                 if (check_col(pinfo->cinfo, COL_INFO)) {
 905                         col_append_fstr(pinfo->cinfo, COL_INFO, " %s", host_name);
 906                 }
 907                 proto_tree_add_item(tree, hf_server_name,
 908                         tvb, offset, namelen, TRUE);
 909                 offset += namelen;
 910
 911                 /* master browser server name or server comment */
 912                 namelen = tvb_strsize(tvb, offset);
 913                 proto_tree_add_item(tree,
 914                         (cmd==BROWSE_DOMAIN_ANNOUNCEMENT)?
 915                             hf_mb_server_name : hf_server_comment,
 916                         tvb, offset, namelen, TRUE);
 917                 offset += namelen;
 918                 break;
 919         }
 920
 921         return TRUE;
 922 }
 923
 924 void
 925 proto_register_smb_browse(void)
 926 {
 927         static hf_register_info hf[] = {
 928                 { &hf_command,
 929                         { "Command", "browser.command", FT_UINT8, BASE_HEX,
 930                         VALS(commands), 0, "Browse command opcode", HFILL }},
 931
 932                 { &hf_update_count,
 933                         { "Update Count", "browser.update_count", FT_UINT8, BASE_DEC,
 934                         NULL, 0, "Browse Update Count", HFILL }},
 935
 936                 { &hf_periodicity,
 937                         { "Update Periodicity", "browser.period", FT_UINT32, BASE_DEC,
 938                         NULL, 0, "Update Periodicity in ms", HFILL }},
 939
 940                 { &hf_server_name,
 941                         { "Server Name", "browser.server", FT_STRING, BASE_NONE,
 942                         NULL, 0, "BROWSE Server Name", HFILL }},
 943
 944                 { &hf_mb_server_name,
 945                         { "Master Browser Server Name", "browser.mb_server", FT_STRING, BASE_NONE,
 946                         NULL, 0, "BROWSE Master Browser Server Name", HFILL }},
 947
 948                 { &hf_mb_reset_command,
 949                   { "ResetBrowserState Command", "browser.reset_cmd", FT_UINT8,
 950                     BASE_HEX, VALS(&resetbrowserstate_command_names), 0,
 951                     "ResetBrowserState Command", HFILL }},
 952                 { &hf_mb_reset_demote,
 953                   { "Demote LMB", "browser.reset_cmd.demote", FT_BOOLEAN,
 954                     8, TFS(&tfs_demote_to_backup), 0x01, "Demote LMB", HFILL}},
 955                 { &hf_mb_reset_flush,
 956                   { "Flush Browse List", "browser.reset_cmd.flush", FT_BOOLEAN,
 957                     8, TFS(&tfs_flush_browse_list), 0x02, "Flush Browse List", HFILL}},
 958                 { &hf_mb_reset_stop,
 959                   { "Stop Being LMB", "browser.reset_cmd.stop_lmb", FT_BOOLEAN,
 960                     8, TFS(&tfs_stop_being_lmb), 0x04, "Stop Being LMB", HFILL}},
 961                 { &hf_os_major,
 962                         { "OS Major Version", "browser.os_major", FT_UINT8, BASE_DEC,
 963                         NULL, 0, "Operating System Major Version", HFILL }},
 964
 965                 { &hf_os_minor,
 966                         { "OS Minor Version", "browser.os_minor", FT_UINT8, BASE_DEC,
 967                         NULL, 0, "Operating System Minor Version", HFILL }},
 968
 969                 { &hf_server_type,
 970                         { "Server Type", "browser.server_type", FT_UINT32, BASE_HEX,
 971                         NULL, 0, "Server Type Flags", HFILL }},
 972
 973                 { &hf_server_type_workstation,
 974                         { "Workstation", "browser.server_type.workstation", FT_BOOLEAN, 32,
 975                         TFS(&tfs_workstation), 1<<SERVER_WORKSTATION, "Is This A Workstation?", HFILL }},
 976
 977                 { &hf_server_type_server,
 978                         { "Server", "browser.server_type.server", FT_BOOLEAN, 32,
 979                         TFS(&tfs_server), 1<<SERVER_SERVER, "Is This A Server?", HFILL }},
 980
 981                 { &hf_server_type_sql,
 982                         { "SQL", "browser.server_type.sql", FT_BOOLEAN, 32,
 983                         TFS(&tfs_sql), 1<<SERVER_SQL_SERVER, "Is This A SQL Server?", HFILL }},
 984
 985                 { &hf_server_type_domain,
 986                         { "Domain Controller", "browser.server_type.domain_controller", FT_BOOLEAN, 32,
 987                         TFS(&tfs_domain), 1<<SERVER_DOMAIN_CONTROLLER, "Is This A Domain Controller?", HFILL }},
 988
 989                 { &hf_server_type_backup,
 990                         { "Backup Controller", "browser.server_type.backup_controller", FT_BOOLEAN, 32,
 991                         TFS(&tfs_backup), 1<<SERVER_BACKUP_CONTROLLER, "Is This A Backup Domain Controller?", HFILL }},
 992
 993                 { &hf_server_type_time,
 994                         { "Time Source", "browser.server_type.time", FT_BOOLEAN, 32,
 995                         TFS(&tfs_time), 1<<SERVER_TIME_SOURCE, "Is This A Time Source?", HFILL }},
 996
 997                 { &hf_server_type_apple,
 998                         { "Apple", "browser.server_type.apple", FT_BOOLEAN, 32,
 999                         TFS(&tfs_apple), 1<<SERVER_APPLE_SERVER, "Is This An Apple Server ?", HFILL }},
1000
1001                 { &hf_server_type_novell,
1002                         { "Novell", "browser.server_type.novell", FT_BOOLEAN, 32,
1003                         TFS(&tfs_novell), 1<<SERVER_NOVELL_SERVER, "Is This A Novell Server?", HFILL }},
1004
1005                 { &hf_server_type_member,
1006                         { "Member", "browser.server_type.member", FT_BOOLEAN, 32,
1007                         TFS(&tfs_member), 1<<SERVER_DOMAIN_MEMBER_SERVER, "Is This A Domain Member Server?", HFILL }},
1008
1009                 { &hf_server_type_print,
1010                         { "Print", "browser.server_type.print", FT_BOOLEAN, 32,
1011                         TFS(&tfs_print), 1<<SERVER_PRINT_QUEUE_SERVER, "Is This A Print Server?", HFILL }},
1012
1013                 { &hf_server_type_dialin,
1014                         { "Dialin", "browser.server_type.dialin", FT_BOOLEAN, 32,
1015                         TFS(&tfs_dialin), 1<<SERVER_DIALIN_SERVER, "Is This A Dialin Server?", HFILL }},
1016
1017                 { &hf_server_type_xenix,
1018                         { "Xenix", "browser.server_type.xenix", FT_BOOLEAN, 32,
1019                         TFS(&tfs_xenix), 1<<SERVER_XENIX_SERVER, "Is This A Xenix Server?", HFILL }},
1020
1021                 { &hf_server_type_ntw,
1022                         { "NT Workstation", "browser.server_type.ntw", FT_BOOLEAN, 32,
1023                         TFS(&tfs_ntw), 1<<SERVER_NT_WORKSTATION, "Is This A NT Workstation?", HFILL }},
1024
1025                 { &hf_server_type_wfw,
1026                         { "WfW", "browser.server_type.wfw", FT_BOOLEAN, 32,
1027                         TFS(&tfs_wfw), 1<<SERVER_WINDOWS_FOR_WORKGROUPS, "Is This A Windows For Workgroups Server?", HFILL }},
1028
1029                 { &hf_server_type_nts,
1030                         { "NT Server", "browser.server_type.nts", FT_BOOLEAN, 32,
1031                         TFS(&tfs_nts), 1<<SERVER_NT_SERVER, "Is This A NT Server?", HFILL }},
1032
1033                 { &hf_server_type_potentialb,
1034                         { "Potential Browser", "browser.server_type.browser.potential", FT_BOOLEAN, 32,
1035                         TFS(&tfs_potentialb), 1<<SERVER_POTENTIAL_BROWSER, "Is This A Potential Browser?", HFILL }},
1036
1037                 { &hf_server_type_backupb,
1038                         { "Backup Browser", "browser.server_type.browser.backup", FT_BOOLEAN, 32,
1039                         TFS(&tfs_backupb), 1<<SERVER_BACKUP_BROWSER, "Is This A Backup Browser?", HFILL }},
1040
1041                 { &hf_server_type_masterb,
1042                         { "Master Browser", "browser.server_type.browser.master", FT_BOOLEAN, 32,
1043                         TFS(&tfs_masterb), 1<<SERVER_MASTER_BROWSER, "Is This A Master Browser?", HFILL }},
1044
1045                 { &hf_server_type_domainmasterb,
1046                         { "Domain Master Browser", "browser.server_type.browser.domain_master", FT_BOOLEAN, 32,
1047                         TFS(&tfs_domainmasterb), 1<<SERVER_DOMAIN_MASTER_BROWSER, "Is This A Domain Master Browser?", HFILL }},
1048
1049                 { &hf_server_type_osf,
1050                         { "OSF", "browser.server_type.osf", FT_BOOLEAN, 32,
1051                         TFS(&tfs_osf), 1<<SERVER_OSF, "Is This An OSF server ?", HFILL }},
1052
1053                 { &hf_server_type_vms,
1054                         { "VMS", "browser.server_type.vms", FT_BOOLEAN, 32,
1055                         TFS(&tfs_vms), 1<<SERVER_VMS, "Is This A VMS Server?", HFILL }},
1056
1057                 { &hf_server_type_w95,
1058                         { "Windows 95+", "browser.server_type.w95", FT_BOOLEAN, 32,
1059                         TFS(&tfs_w95), 1<<SERVER_WINDOWS_95, "Is This A Windows 95 or above server?", HFILL }},
1060
1061                 { &hf_server_type_local,
1062                         { "Local", "browser.server_type.local", FT_BOOLEAN, 32,
1063                         TFS(&tfs_local), 1<<SERVER_LOCAL_LIST_ONLY, "Is This A Local List Only request?", HFILL }},
1064
1065                 { &hf_server_type_domainenum,
1066                         { "Domain Enum", "browser.server_type.domainenum", FT_BOOLEAN, 32,
1067                         TFS(&tfs_domainenum), 1<<SERVER_DOMAIN_ENUM, "Is This A Domain Enum request?", HFILL }},
1068
1069                 { &hf_election_version,
1070                         { "Election Version", "browser.election.version", FT_UINT8, BASE_DEC,
1071                         NULL, 0, "Election Version", HFILL }},
1072
1073                 { &hf_proto_major,
1074                         { "Browser Protocol Major Version", "browser.proto_major", FT_UINT8, BASE_DEC,
1075                         NULL, 0, "Browser Protocol Major Version", HFILL }},
1076
1077                 { &hf_proto_minor,
1078                         { "Browser Protocol Minor Version", "browser.proto_minor", FT_UINT8, BASE_DEC,
1079                         NULL, 0, "Browser Protocol Minor Version", HFILL }},
1080
1081                 { &hf_sig_const,
1082                         { "Signature", "browser.sig", FT_UINT16, BASE_HEX,
1083                         NULL, 0, "Signature Constant", HFILL }},
1084
1085                 { &hf_server_comment,
1086                         { "Host Comment", "browser.comment", FT_STRINGZ, BASE_NONE,
1087                         NULL, 0, "Server Comment", HFILL }},
1088
1089                 { &hf_unused_flags,
1090                         { "Unused flags", "browser.unused", FT_UINT8, BASE_HEX,
1091                         NULL, 0, "Unused/unknown flags", HFILL }},
1092
1093                 { &hf_response_computer_name,
1094                         { "Response Computer Name", "browser.response_computer_name", FT_STRINGZ, BASE_NONE,
1095                         NULL, 0, "Response Computer Name", HFILL }},
1096
1097                 { &hf_election_criteria,
1098                         { "Election Criteria", "browser.election.criteria", FT_UINT32, BASE_HEX,
1099                         NULL, 0, "Election Criteria", HFILL }},
1100
1101                 { &hf_election_desire,
1102                         { "Election Desire", "browser.election.desire", FT_UINT8, BASE_HEX,
1103                         NULL, 0, "Election Desire", HFILL }},
1104
1105                 { &hf_election_desire_flags_backup,
1106                         { "Backup", "browser.election.desire.backup", FT_BOOLEAN, 8,
1107                         TFS(&tfs_desire_backup), 1<<DESIRE_BACKUP, "Is this a backup server", HFILL }},
1108
1109                 { &hf_election_desire_flags_standby,
1110                         { "Standby", "browser.election.desire.standby", FT_BOOLEAN, 8,
1111                         TFS(&tfs_desire_standby), 1<<DESIRE_STANDBY, "Is this a standby server?", HFILL }},
1112
1113                 { &hf_election_desire_flags_master,
1114                         { "Master", "browser.election.desire.master", FT_BOOLEAN, 8,
1115                         TFS(&tfs_desire_master), 1<<DESIRE_MASTER, "Is this a master server", HFILL }},
1116
1117                 { &hf_election_desire_flags_domain_master,
1118                         { "Domain Master", "browser.election.desire.domain_master", FT_BOOLEAN, 8,
1119                         TFS(&tfs_desire_domain_master), 1<<DESIRE_DOMAIN_MASTER, "Is this a domain master", HFILL }},
1120
1121                 { &hf_election_desire_flags_wins,
1122                         { "WINS", "browser.election.desire.wins", FT_BOOLEAN, 8,
1123                         TFS(&tfs_desire_wins), 1<<DESIRE_WINS, "Is this a WINS server", HFILL }},
1124
1125                 { &hf_election_desire_flags_nt,
1126                         { "NT", "browser.election.desire.nt", FT_BOOLEAN, 8,
1127                         TFS(&tfs_desire_nt), 1<<DESIRE_NT, "Is this a NT server", HFILL }},
1128
1129                 { &hf_election_revision,
1130                         { "Election Revision", "browser.election.revision", FT_UINT16, BASE_DEC,
1131                         NULL, 0, "Election Revision", HFILL }},
1132
1133                 { &hf_election_os,
1134                         { "Election OS", "browser.election.os", FT_UINT8, BASE_HEX,
1135                         NULL, 0, "Election OS", HFILL }},
1136
1137                 { &hf_election_os_wfw,
1138                         { "WfW", "browser.election.os.wfw", FT_BOOLEAN, 8,
1139                         TFS(&tfs_os_wfw), 1<<OS_WFW, "Is this a WfW host?", HFILL }},
1140
1141                 { &hf_election_os_ntw,
1142                         { "NT Workstation", "browser.election.os.ntw", FT_BOOLEAN, 8,
1143                         TFS(&tfs_os_ntw), 1<<OS_NTW, "Is this a NT Workstation?", HFILL }},
1144
1145                 { &hf_election_os_nts,
1146                         { "NT Server", "browser.election.os.nts", FT_BOOLEAN, 8,
1147                         TFS(&tfs_os_nts), 1<<OS_NTS, "Is this a NT Server?", HFILL }},
1148
1149                 { &hf_server_uptime,
1150                         { "Uptime", "browser.uptime", FT_UINT32, BASE_DEC,
1151                         NULL, 0, "Server uptime in ms", HFILL }},
1152
1153                 { &hf_backup_count,
1154                         { "Backup List Requested Count", "browser.backup.count", FT_UINT8, BASE_DEC,
1155                         NULL, 0, "Backup list requested count", HFILL }},
1156
1157                 { &hf_backup_token,
1158                         { "Backup Request Token", "browser.backup.token", FT_UINT32, BASE_DEC,
1159                         NULL, 0, "Backup requested/response token", HFILL }},
1160
1161                 { &hf_backup_server,
1162                         { "Backup Server", "browser.backup.server", FT_STRING, BASE_NONE,
1163                         NULL, 0, "Backup Server Name", HFILL }},
1164
1165                 { &hf_browser_to_promote,
1166                         { "Browser to Promote", "browser.browser_to_promote", FT_STRINGZ, BASE_NONE,
1167                         NULL, 0, "Browser to Promote", HFILL }},
1168
1169         };
1170
1171         static gint *ett[] = {
1172                 &ett_browse,
1173                 &ett_browse_flags,
1174                 &ett_browse_election_criteria,
1175                 &ett_browse_election_os,
1176                 &ett_browse_election_desire,
1177                 &ett_browse_reset_cmd_flags,
1178         };
1179
1180         proto_smb_browse = proto_register_protocol("Microsoft Windows Browser Protocol",
1181             "BROWSER", "browser");
1182
1183         proto_register_field_array(proto_smb_browse, hf, array_length(hf));
1184         proto_register_subtree_array(ett, array_length(ett));
1185 }