Note that for THE3GPP_IPV6_DNS_SERVERS we probably *do* need to handle

[obnox/wireshark/wip.git] / packet-smb-logon.c

diff --git a/packet-smb-logon.c b/packet-smb-logon.c
index 22bd679f56f65ddcbab504b8e56d983d5704b83e..5d1f2376b24143b22a89c34ad61defd87ef13dab 100644 (file)
--- a/packet-smb-logon.c
+++ b/packet-smb-logon.c
@@ -2,7 +2,7 @@
  * Routines for SMB net logon packet dissection
  * Copyright 2000, Jeffrey C. Foster <jfoste@woodward.com>
  *
- * $Id: packet-smb-logon.c,v 1.30 2003/04/03 02:22:30 tpot Exp $
+ * $Id: packet-smb-logon.c,v 1.36 2003/11/19 03:53:32 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -26,7 +26,6 @@
  */
 
 #include "packet-smb-common.h"
-#include "packet-smb-logon.h"
 
 static int proto_smb_logon = -1;
 static int hf_command = -1;
@@ -310,10 +309,17 @@ dissect_smb_logon_LM20_resp(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *t
 static int
 dissect_smb_pdc_query(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 {
+       char *name;
+
        /*** 0x07 Query for Primary PDC  ***/
 
        /* computer name */
-       offset = display_ms_string(tvb, tree, offset, hf_computer_name, NULL);
+       offset = display_ms_string(tvb, tree, offset, hf_computer_name, &name);
+
+       if (check_col(pinfo->cinfo, COL_INFO))
+               col_append_fstr(pinfo->cinfo, COL_INFO, " from %s", name);
+
+       g_free(name);
 
        /* mailslot name */
        offset = display_ms_string(tvb, tree, offset, hf_mailslot_name, NULL);
@@ -331,7 +337,7 @@ dissect_smb_pdc_query(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, i
                if (offset % 2) offset++;      /* word align ... */
 
                /* Unicode computer name */
-               offset = display_unicode_string(tvb, tree, offset, hf_unicode_computer_name);
+               offset = display_unicode_string(tvb, tree, offset, hf_unicode_computer_name, NULL);
 
                /* NT version */
                proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
@@ -360,16 +366,29 @@ dissect_smb_pdc_startup(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree,
        /* A short Announce will not have the rest */
 
        if (tvb_reported_length_remaining(tvb, offset) != 0) {
+         char *name = NULL;
 
          if (offset % 2) offset++;      /* word align ... */
 
          /* pdc name */
-         offset = display_unicode_string(tvb, tree, offset, hf_unicode_pdc_name);
+         offset = display_unicode_string(tvb, tree, offset, hf_unicode_pdc_name, &name);
+
+         if (name && check_col(pinfo->cinfo, COL_INFO)) {
+                 col_append_fstr(pinfo->cinfo, COL_INFO, ": host %s", name);
+                 g_free(name);
+                 name = NULL;
+         }
 
          if (offset % 2) offset++;
 
          /* domain name */
-         offset = display_unicode_string(tvb, tree, offset, hf_domain_name);
+         offset = display_unicode_string(tvb, tree, offset, hf_domain_name, &name);
+
+         if (name && check_col(pinfo->cinfo, COL_INFO)) {
+                 col_append_fstr(pinfo->cinfo, COL_INFO, ", domain %s", name);
+                 g_free(name);
+                 name = NULL;
+         }
 
          /* NT version */
          proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
@@ -446,10 +465,10 @@ dissect_announce_change(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree,
                 * XXX - older protocol versions don't have this stuff?
                 */
                /* pdc name */
-               offset = display_unicode_string(tvb, tree, offset, hf_unicode_pdc_name);
+               offset = display_unicode_string(tvb, tree, offset, hf_unicode_pdc_name, NULL);
 
                /* domain name */
-               offset = display_unicode_string(tvb, tree, offset, hf_domain_name);
+               offset = display_unicode_string(tvb, tree, offset, hf_domain_name, NULL);
 
                /* DB count */
                info_count = tvb_get_letohl(tvb, offset);
@@ -490,7 +509,7 @@ dissect_announce_change(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree,
 
                        /* Domain SID */
                        offset = dissect_nt_sid(
-                               tvb, offset, tree, "Domain", NULL);
+                               tvb, offset, tree, "Domain", NULL, -1);
                }
 
                /* NT version */
@@ -521,10 +540,10 @@ dissect_smb_sam_logon_req(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tre
        offset += 2;
 
        /* computer name */
-       offset = display_unicode_string(tvb, tree, offset, hf_unicode_computer_name);
+       offset = display_unicode_string(tvb, tree, offset, hf_unicode_computer_name, NULL);
 
        /* user name */
-       offset = display_unicode_string(tvb, tree, offset, hf_user_name);
+       offset = display_unicode_string(tvb, tree, offset, hf_user_name, NULL);
 
        /* mailslot name */
        offset = display_ms_string(tvb, tree, offset, hf_mailslot_name, NULL);
@@ -543,7 +562,7 @@ dissect_smb_sam_logon_req(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tre
                offset = ((offset + 3)/4)*4;
 
                /* Domain SID */
-               offset = dissect_nt_sid(tvb, offset, tree, "Domain", NULL);
+               offset = dissect_nt_sid(tvb, offset, tree, "Domain", NULL, -1);
        }
 
        /* NT version */
@@ -684,13 +703,13 @@ dissect_smb_sam_logon_resp(tvbuff_t *tvb, packet_info *pinfo _U_,
        /* Netlogon command 0x13 - decode the SAM logon response from server */
 
        /* server name */
-       offset = display_unicode_string(tvb, tree, offset, hf_server_name);
+       offset = display_unicode_string(tvb, tree, offset, hf_server_name, NULL);
 
        /* user name */
-       offset = display_unicode_string(tvb, tree, offset, hf_user_name);
+       offset = display_unicode_string(tvb, tree, offset, hf_user_name, NULL);
 
        /* domain name */
-       offset = display_unicode_string(tvb, tree, offset, hf_domain_name);
+       offset = display_unicode_string(tvb, tree, offset, hf_domain_name, NULL);
 
        /* NT version */
        proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, TRUE);
@@ -729,7 +748,10 @@ dissect_smb_sam_logon_resp(tvbuff_t *tvb, packet_info *pinfo _U_,
 #define LOGON_SAM_RESPONSE_DURING_LOGON                0x14
 #define LOGON_SAM_USER_UNKNOWN                 0x15
 #define LOGON_SAM_INTERROGATE_RESPONSE         0x16
-#define LOGON_LAST_CMD                         0x17
+#define LOGON_SAM_AD_USER_UNKNOWN              0x17
+#define LOGON_SAM_UNKNOWN_18                   0x18
+#define LOGON_SAM_AD_LOGON_RESPONSE            0x19
+#define LOGON_LAST_CMD                         0x20
 
 static const value_string commands[] = {
        {LOGON_LM10_LOGON_REQUEST,      "LM1.0/LM2.0 LOGON Request"},
@@ -755,6 +777,9 @@ static const value_string commands[] = {
        {LOGON_SAM_RESPONSE_DURING_LOGON,"SAM Response during LOGON pause"},
        {LOGON_SAM_USER_UNKNOWN,        "SAM Response - user unknown"},
        {LOGON_SAM_INTERROGATE_RESPONSE,"SAM Response to Interrogate Request"},
+       {LOGON_SAM_AD_USER_UNKNOWN,     "SAM Active Directory Response - user unknown"},
+       {LOGON_SAM_UNKNOWN_18,          "SAM unknown command 0x18"},
+       {LOGON_SAM_AD_LOGON_RESPONSE,   "Active Directory Response to SAM LOGON request"},
        {0,     NULL}
 };
 
@@ -781,12 +806,15 @@ static int (*dissect_smb_logon_cmds[])(tvbuff_t *tvb, packet_info *pinfo, proto_
        dissect_smb_sam_logon_req,  /* 0x12 (SAM LOGON request )        */
        dissect_smb_sam_logon_resp, /* 0x13 (SAM LOGON response)        */
        dissect_smb_unknown,        /* 0x14 (SAM Response during LOGON Pause) */
-       dissect_smb_unknown,        /* 0x15 (SAM Response User Unknown)      */
-       dissect_smb_unknown,        /* 0x16 (SAM Response to Interrogate)   */
+       dissect_smb_unknown,        /* 0x15 (SAM Response User Unknown) */
+       dissect_smb_unknown,        /* 0x16 (SAM Response to Interrogate)*/
+       dissect_smb_unknown,        /* 0x17 (SAM AD response User Unknown*/
+       dissect_smb_unknown,        /* 0x18 (Unknown command)           */
+       dissect_smb_unknown         /* 0x19 (SAM LOGON AD response)     */
 };
 
 
-gboolean
+static void
 dissect_smb_logon(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 {
        int        offset = 0;
@@ -794,11 +822,6 @@ dissect_smb_logon(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
        proto_tree *smb_logon_tree = NULL;
        proto_item *item = NULL;
 
-       if (!proto_is_protocol_enabled(proto_smb_logon))
-               return FALSE;
-
-       pinfo->current_proto = "NETLOGON";
-
        if (check_col(pinfo->cinfo, COL_PROTOCOL))
                col_set_str(pinfo->cinfo, COL_PROTOCOL, "NETLOGON");
        if (check_col(pinfo->cinfo, COL_INFO))
@@ -832,8 +855,6 @@ dissect_smb_logon(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
                offset = dissect_smb_unknown(tvb, pinfo, smb_logon_tree,
                    offset);
        }
-
-       return TRUE;
 }
 
 void
@@ -1006,4 +1027,6 @@ proto_register_smb_logon( void)
 
        proto_register_field_array(proto_smb_logon, hf, array_length(hf));
        proto_register_subtree_array(ett, array_length(ett));
+
+       register_dissector("netlogon", dissect_smb_logon, proto_smb_logon);
 }