epan/dissectors/packet-smb-browse.c

   1 /* packet-smb-browse.c
   2  * Routines for SMB Browser packet dissection
   3  * Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com>
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * Copied from packet-pop.c
  12  *
  13  * This program is free software; you can redistribute it and/or
  14  * modify it under the terms of the GNU General Public License
  15  * as published by the Free Software Foundation; either version 2
  16  * of the License, or (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  26  */
  27
  28 #ifdef HAVE_CONFIG_H
  29 # include "config.h"
  30 #endif
  31
  32 #include <time.h>
  33 #include <glib.h>
  34 #include <ctype.h>
  35 #include <epan/packet.h>
  36 #include <epan/dissectors/packet-smb.h>
  37 #include <string.h>
  38
  39 #include "packet-smb-browse.h"
  40 #include "packet-dcerpc.h"
  41
  42 static int proto_smb_browse = -1;
  43 static int hf_command = -1;
  44 static int hf_update_count = -1;
  45 static int hf_periodicity = -1;
  46 static int hf_server_name = -1;
  47 static int hf_mb_server_name = -1;
  48 static int hf_mb_reset_command = -1;
  49 static int hf_mb_reset_demote = -1;
  50 static int hf_mb_reset_flush = -1;
  51 static int hf_mb_reset_stop = -1;
  52 static int hf_os_major = -1;
  53 static int hf_os_minor = -1;
  54 static int hf_server_type = -1;
  55 static int hf_server_type_workstation = -1;
  56 static int hf_server_type_server = -1;
  57 static int hf_server_type_sql = -1;
  58 static int hf_server_type_domain = -1;
  59 static int hf_server_type_backup = -1;
  60 static int hf_server_type_time = -1;
  61 static int hf_server_type_apple = -1;
  62 static int hf_server_type_novell = -1;
  63 static int hf_server_type_member = -1;
  64 static int hf_server_type_print = -1;
  65 static int hf_server_type_dialin = -1;
  66 static int hf_server_type_xenix = -1;
  67 static int hf_server_type_ntw = -1;
  68 static int hf_server_type_wfw = -1;
  69 static int hf_server_type_nts = -1;
  70 static int hf_server_type_potentialb = -1;
  71 static int hf_server_type_backupb = -1;
  72 static int hf_server_type_masterb = -1;
  73 static int hf_server_type_domainmasterb = -1;
  74 static int hf_server_type_osf = -1;
  75 static int hf_server_type_vms = -1;
  76 static int hf_server_type_w95 = -1;
  77 static int hf_server_type_dfs = -1;
  78 static int hf_server_type_local = -1;
  79 static int hf_server_type_domainenum = -1;
  80 static int hf_election_version = -1;
  81 static int hf_proto_major = -1;
  82 static int hf_proto_minor = -1;
  83 static int hf_sig_const = -1;
  84 static int hf_server_comment = -1;
  85 static int hf_unused_flags = -1;
  86 static int hf_response_computer_name = -1;
  87 static int hf_election_criteria = -1;
  88 static int hf_election_desire = -1;
  89 static int hf_election_desire_flags_backup = -1;
  90 static int hf_election_desire_flags_standby = -1;
  91 static int hf_election_desire_flags_master = -1;
  92 static int hf_election_desire_flags_domain_master = -1;
  93 static int hf_election_desire_flags_wins = -1;
  94 static int hf_election_desire_flags_nt = -1;
  95 static int hf_election_revision = -1;
  96 static int hf_election_os = -1;
  97 static int hf_election_os_wfw = -1;
  98 static int hf_election_os_ntw = -1;
  99 static int hf_election_os_nts = -1;
 100 static int hf_server_uptime = -1;
 101 static int hf_backup_count = -1;
 102 static int hf_backup_token = -1;
 103 static int hf_backup_server = -1;
 104 static int hf_browser_to_promote = -1;
 105
 106 static gint ett_browse = -1;
 107 static gint ett_browse_flags = -1;
 108 static gint ett_browse_election_criteria = -1;
 109 static gint ett_browse_election_os = -1;
 110 static gint ett_browse_election_desire = -1;
 111 static gint ett_browse_reset_cmd_flags = -1;
 112
 113 #define SERVER_WORKSTATION              0
 114 #define SERVER_SERVER                   1
 115 #define SERVER_SQL_SERVER               2
 116 #define SERVER_DOMAIN_CONTROLLER        3
 117 #define SERVER_BACKUP_CONTROLLER        4
 118 #define SERVER_TIME_SOURCE              5
 119 #define SERVER_APPLE_SERVER             6
 120 #define SERVER_NOVELL_SERVER            7
 121 #define SERVER_DOMAIN_MEMBER_SERVER     8
 122 #define SERVER_PRINT_QUEUE_SERVER       9
 123 #define SERVER_DIALIN_SERVER            10
 124 #define SERVER_XENIX_SERVER             11
 125 #define SERVER_NT_WORKSTATION           12
 126 #define SERVER_WINDOWS_FOR_WORKGROUPS   13
 127 #define SERVER_NT_SERVER                15
 128 #define SERVER_POTENTIAL_BROWSER        16
 129 #define SERVER_BACKUP_BROWSER           17
 130 #define SERVER_MASTER_BROWSER           18
 131 #define SERVER_DOMAIN_MASTER_BROWSER    19
 132 #define SERVER_OSF                      20
 133 #define SERVER_VMS                      21
 134 #define SERVER_WINDOWS_95               22
 135 #define SERVER_DFS_SERVER               23
 136 #define SERVER_LOCAL_LIST_ONLY          30
 137 #define SERVER_DOMAIN_ENUM              31
 138
 139 static const value_string server_types[] = {
 140         {SERVER_WORKSTATION,            "Workstation"},
 141         {SERVER_SERVER,                 "Server"},
 142         {SERVER_SQL_SERVER,             "SQL Server"},
 143         {SERVER_DOMAIN_CONTROLLER,      "Domain Controller"},
 144         {SERVER_BACKUP_CONTROLLER,      "Backup Controller"},
 145         {SERVER_TIME_SOURCE,            "Time Source"},
 146         {SERVER_APPLE_SERVER,           "Apple Server"},
 147         {SERVER_NOVELL_SERVER,          "Novell Server"},
 148         {SERVER_DOMAIN_MEMBER_SERVER,   "Domain Member Server"},
 149         {SERVER_PRINT_QUEUE_SERVER,     "Print Queue Server"},
 150         {SERVER_DIALIN_SERVER,          "Dialin Server"},
 151         {SERVER_XENIX_SERVER,           "Xenix Server"},
 152         {SERVER_NT_WORKSTATION,         "NT Workstation"},
 153         {SERVER_WINDOWS_FOR_WORKGROUPS, "Windows for Workgroups"},
 154         {SERVER_NT_SERVER,              "NT Server"},
 155         {SERVER_POTENTIAL_BROWSER,      "Potential Browser"},
 156         {SERVER_BACKUP_BROWSER,         "Backup Browser"},
 157         {SERVER_MASTER_BROWSER,         "Master Browser"},
 158         {SERVER_DOMAIN_MASTER_BROWSER,  "Domain Master Browser"},
 159         {SERVER_OSF,                    "OSF"},
 160         {SERVER_VMS,                    "VMS"},
 161         {SERVER_WINDOWS_95,             "Windows 95 or above"},
 162         {SERVER_DFS_SERVER,             "DFS server"},
 163         {SERVER_LOCAL_LIST_ONLY,        "Local List Only"},
 164         {SERVER_DOMAIN_ENUM,            "Domain Enum"},
 165         {0,     NULL}
 166 };
 167
 168 #define SET_WINDOWS_VERSION_STRING(os_major_ver, os_minor_ver, windows_version) \
 169   if(os_major_ver == 6 && os_minor_ver == 1)                            \
 170     windows_version = "Windows 7 or Windows Server 2008 R2";            \
 171                                                                         \
 172   else if(os_major_ver == 6 && os_minor_ver == 0)                       \
 173     windows_version = "Windows Vista or Windows Server 2008";           \
 174                                                                         \
 175   else if(os_major_ver == 5 && os_minor_ver == 2)                       \
 176     windows_version = "Windows Server 2003 R2 or Windows Server 2003";  \
 177                                                                         \
 178   else if(os_major_ver == 5 && os_minor_ver == 1)                       \
 179     windows_version = "Windows XP";                                     \
 180                                                                         \
 181   else if(os_major_ver == 5 && os_minor_ver == 0)                       \
 182     windows_version = "Windows 2000";                                   \
 183                                                                         \
 184   else                                                                  \
 185     windows_version = NULL;
 186
 187 static const value_string resetbrowserstate_command_names[] = {
 188   { 0x01, "Stop being a master browser and become a backup browser"},
 189   { 0x02, "Discard browse lists, stop being a master browser, and try again"},
 190   { 0x04, "Stop being a master browser for ever"},
 191   { 0, NULL}
 192 };
 193
 194 static true_false_string tfs_demote_to_backup = {
 195         "Demote an LMB to a Backup Browser",
 196         "Do not demote an LMB to a Backup Browser"
 197 };
 198
 199 static true_false_string tfs_flush_browse_list = {
 200         "Flush the Browse List",
 201         "Do not Flush the Browse List"
 202 };
 203
 204 static true_false_string tfs_stop_being_lmb = {
 205         "Stop Being a Local Master Browser",
 206         "Do not Stop Being a Local Master Browser"
 207 };
 208
 209 static const true_false_string tfs_workstation = {
 210         "This is a Workstation",
 211         "This is NOT a Workstation"
 212 };
 213 static const true_false_string tfs_server = {
 214         "This is a Server",
 215         "This is NOT a Server"
 216 };
 217 static const true_false_string tfs_sql = {
 218         "This is an SQL server",
 219         "This is NOT an SQL server"
 220 };
 221 static const true_false_string tfs_domain = {
 222         "This is a Domain Controller",
 223         "This is NOT a Domain Controller"
 224 };
 225 static const true_false_string tfs_backup = {
 226         "This is a Backup Controller",
 227         "This is NOT a Backup Controller"
 228 };
 229 static const true_false_string tfs_time = {
 230         "This is a Time Source",
 231         "This is NOT a Time Source"
 232 };
 233 static const true_false_string tfs_apple = {
 234         "This is an Apple host",
 235         "This is NOT an Apple host"
 236 };
 237 static const true_false_string tfs_novell = {
 238         "This is a Novell server",
 239         "This is NOT a Novell server"
 240 };
 241 static const true_false_string tfs_member = {
 242         "This is a Domain Member server",
 243         "This is NOT a Domain Member server"
 244 };
 245 static const true_false_string tfs_print = {
 246         "This is a Print Queue server",
 247         "This is NOT a Print Queue server"
 248 };
 249 static const true_false_string tfs_dialin = {
 250         "This is a Dialin server",
 251         "This is NOT a Dialin server"
 252 };
 253 static const true_false_string tfs_xenix = {
 254         "This is a Xenix server",
 255         "This is NOT a Xenix server"
 256 };
 257 static const true_false_string tfs_ntw = {
 258         "This is an NT Workstation",
 259         "This is NOT an NT Workstation"
 260 };
 261 static const true_false_string tfs_wfw = {
 262         "This is a WfW host",
 263         "This is NOT a WfW host"
 264 };
 265 static const true_false_string tfs_nts = {
 266         "This is an NT Server",
 267         "This is NOT an NT Server"
 268 };
 269 static const true_false_string tfs_potentialb = {
 270         "This is a Potential Browser",
 271         "This is NOT a Potential Browser"
 272 };
 273 static const true_false_string tfs_backupb = {
 274         "This is a Backup Browser",
 275         "This is NOT a Backup Browser"
 276 };
 277 static const true_false_string tfs_masterb = {
 278         "This is a Master Browser",
 279         "This is NOT a Master Browser"
 280 };
 281 static const true_false_string tfs_domainmasterb = {
 282         "This is a Domain Master Browser",
 283         "This is NOT a Domain Master Browser"
 284 };
 285 static const true_false_string tfs_osf = {
 286         "This is an OSF host",
 287         "This is NOT an OSF host"
 288 };
 289 static const true_false_string tfs_vms = {
 290         "This is a VMS host",
 291         "This is NOT a VMS host"
 292 };
 293 static const true_false_string tfs_w95 = {
 294         "This is a Windows 95 or above host",
 295         "This is NOT a Windows 95 or above host"
 296 };
 297 static const true_false_string tfs_dfs = {
 298         "This is a DFS server",
 299         "THis is NOT a DFS server"
 300 };
 301 static const true_false_string tfs_local = {
 302         "This is a local list only request",
 303         "This is NOT a local list only request"
 304 };
 305 static const true_false_string tfs_domainenum = {
 306         "This is a Domain Enum request",
 307         "This is NOT a Domain Enum request"
 308 };
 309
 310 #define DESIRE_BACKUP                   0
 311 #define DESIRE_STANDBY                  1
 312 #define DESIRE_MASTER                   2
 313 #define DESIRE_DOMAIN_MASTER            3
 314 #define DESIRE_WINS                     5
 315 #define DESIRE_NT                       7
 316
 317 static const true_false_string tfs_desire_backup = {
 318         "Backup Browse Server",
 319         "NOT Backup Browse Server"
 320 };
 321 static const true_false_string tfs_desire_standby = {
 322         "Standby Browse Server",
 323         "NOT Standby Browse Server"
 324 };
 325 static const true_false_string tfs_desire_master = {
 326         "Master Browser",
 327         "NOT Master Browser"
 328 };
 329 static const true_false_string tfs_desire_domain_master = {
 330         "Domain Master Browse Server",
 331         "NOT Domain Master Browse Server"
 332 };
 333 static const true_false_string tfs_desire_wins = {
 334         "WINS Client",
 335         "NOT WINS Client"
 336 };
 337 static const true_false_string tfs_desire_nt = {
 338         "Windows NT Advanced Server",
 339         "NOT Windows NT Advanced Server"
 340 };
 341
 342 #define BROWSE_HOST_ANNOUNCE                    1
 343 #define BROWSE_REQUEST_ANNOUNCE                 2
 344 #define BROWSE_ELECTION_REQUEST                 8
 345 #define BROWSE_BACKUP_LIST_REQUEST              9
 346 #define BROWSE_BACKUP_LIST_RESPONSE             10
 347 #define BROWSE_BECOME_BACKUP                    11
 348 #define BROWSE_DOMAIN_ANNOUNCEMENT              12
 349 #define BROWSE_MASTER_ANNOUNCEMENT              13
 350 #define BROWSE_RESETBROWSERSTATE_ANNOUNCEMENT   14
 351 #define BROWSE_LOCAL_MASTER_ANNOUNCEMENT        15
 352
 353 static const value_string commands[] = {
 354         {BROWSE_HOST_ANNOUNCE,          "Host Announcement"},
 355         {BROWSE_REQUEST_ANNOUNCE,       "Request Announcement"},
 356         {BROWSE_ELECTION_REQUEST,       "Browser Election Request"},
 357         {BROWSE_BACKUP_LIST_REQUEST,    "Get Backup List Request"},
 358         {BROWSE_BACKUP_LIST_RESPONSE,   "Get Backup List Response"},
 359         {BROWSE_BECOME_BACKUP,          "Become Backup Browser"},
 360         {BROWSE_DOMAIN_ANNOUNCEMENT,    "Domain/Workgroup Announcement"},
 361         {BROWSE_MASTER_ANNOUNCEMENT,    "Master Announcement"},
 362         {BROWSE_RESETBROWSERSTATE_ANNOUNCEMENT, "Reset Browser State Announcement"},
 363         {BROWSE_LOCAL_MASTER_ANNOUNCEMENT,"Local Master Announcement"},
 364         {0,                             NULL}
 365 };
 366
 367 #define OS_WFW                          0
 368 #define OS_NTW                          4
 369 #define OS_NTS                          5
 370
 371 static const true_false_string tfs_os_wfw = {
 372         "Windows for Workgroups",
 373         "Not Windows for Workgroups"
 374 };
 375 static const true_false_string tfs_os_ntw = {
 376         "Windows NT Workstation",
 377         "Not Windows NT Workstation"
 378 };
 379 static const true_false_string tfs_os_nts = {
 380         "Windows NT Server",
 381         "Not Windows NT Server"
 382 };
 383
 384 static void
 385 dissect_election_criterion_os(tvbuff_t *tvb, proto_tree *parent_tree, int offset)
 386 {
 387         proto_tree *tree = NULL;
 388         proto_item *item = NULL;
 389         guint8 os;
 390
 391         os = tvb_get_guint8(tvb, offset);
 392
 393         if (parent_tree) {
 394                 item = proto_tree_add_uint(parent_tree, hf_election_os, tvb, offset, 1, os);
 395                 tree = proto_item_add_subtree(item, ett_browse_election_os);
 396         }
 397
 398         proto_tree_add_boolean(tree, hf_election_os_wfw,
 399                 tvb, offset, 1, os);
 400         proto_tree_add_boolean(tree, hf_election_os_ntw,
 401                 tvb, offset, 1, os);
 402         proto_tree_add_boolean(tree, hf_election_os_nts,
 403                 tvb, offset, 1, os);
 404
 405 }
 406
 407 static void
 408 dissect_election_criterion_desire(tvbuff_t *tvb, proto_tree *parent_tree, int offset)
 409 {
 410         proto_tree *tree = NULL;
 411         proto_item *item = NULL;
 412         guint8 desire;
 413
 414         desire = tvb_get_guint8(tvb, offset);
 415
 416         if (parent_tree) {
 417                 item = proto_tree_add_uint(parent_tree, hf_election_desire, tvb, offset, 1, desire);
 418                 tree = proto_item_add_subtree(item, ett_browse_election_desire);
 419         }
 420
 421         proto_tree_add_boolean(tree, hf_election_desire_flags_backup,
 422                 tvb, offset, 1, desire);
 423         proto_tree_add_boolean(tree, hf_election_desire_flags_standby,
 424                 tvb, offset, 1, desire);
 425         proto_tree_add_boolean(tree, hf_election_desire_flags_master,
 426                 tvb, offset, 1, desire);
 427         proto_tree_add_boolean(tree, hf_election_desire_flags_domain_master,
 428                 tvb, offset, 1, desire);
 429         proto_tree_add_boolean(tree, hf_election_desire_flags_wins,
 430                 tvb, offset, 1, desire);
 431         proto_tree_add_boolean(tree, hf_election_desire_flags_nt,
 432                 tvb, offset, 1, desire);
 433
 434 }
 435
 436 static void
 437 dissect_election_criterion(tvbuff_t *tvb, proto_tree *parent_tree, int offset)
 438 {
 439         proto_tree *tree = NULL;
 440         proto_item *item = NULL;
 441         guint32 criterion;
 442
 443         criterion = tvb_get_letohl(tvb, offset);
 444
 445         if (parent_tree) {
 446                 item = proto_tree_add_uint(parent_tree, hf_election_criteria, tvb, offset, 4, criterion);
 447                 tree = proto_item_add_subtree(item, ett_browse_election_criteria);
 448         }
 449
 450         /* election desire */
 451         dissect_election_criterion_desire(tvb, tree, offset);
 452         offset += 1;
 453
 454         /* browser protocol major version */
 455         proto_tree_add_item(tree, hf_proto_major, tvb, offset, 1, TRUE);
 456         offset += 1;
 457
 458         /* browser protocol minor version */
 459         proto_tree_add_item(tree, hf_proto_minor, tvb, offset, 1, TRUE);
 460         offset += 1;
 461
 462         /* election os */
 463         dissect_election_criterion_os(tvb, tree, offset);
 464         offset += 1;
 465
 466 }
 467
 468 /*
 469  * XXX - this causes non-browser packets to have browser fields.
 470  */
 471 int
 472 dissect_smb_server_type_flags(tvbuff_t *tvb, int offset, packet_info *pinfo,
 473                               proto_tree *parent_tree, guint8 *drep,
 474                               gboolean infoflag)
 475 {
 476         proto_tree *tree = NULL;
 477         proto_item *item = NULL;
 478         guint32 flags;
 479         int i;
 480
 481         if (drep != NULL) {
 482                 /*
 483                  * Called from a DCE RPC protocol dissector, for a
 484                  * protocol where a 32-bit NDR integer contains
 485                  * an server type mask; extract the server type mask
 486                  * with an NDR call (but don't put it into the
 487                  * protocol tree, as we can't get a pointer to the
 488                  * item it puts in, and thus can't put a tree below
 489                  * it with the values of the individual bits).
 490                  */
 491                 offset = dissect_ndr_uint32(
 492                         tvb, offset, pinfo, NULL, drep, hf_server_type, &flags);
 493         } else {
 494                 /*
 495                  * Called from SMB browser or RAP, where the server type
 496                  * mask is just a 4-byte little-endian quantity with no
 497                  * special NDR alignment requirement; extract it with
 498                  * "tvb_get_letohl()".
 499                  */
 500                 flags = tvb_get_letohl(tvb, offset);
 501                 offset += 4;
 502         }
 503
 504         if (parent_tree) {
 505                 item = proto_tree_add_uint(parent_tree, hf_server_type, tvb, offset-4, 4, flags);
 506                 tree = proto_item_add_subtree(item, ett_browse_flags);
 507         }
 508
 509         if (infoflag) {
 510                 /* Append the type(s) of the system to the COL_INFO line ... */
 511                 if (check_col(pinfo->cinfo, COL_INFO)) {
 512                         for (i = 0; i < 32; i++) {
 513                                 if (flags & (1<<i)) {
 514                                         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
 515                                                 val_to_str(i, server_types,
 516                                                 "Unknown server type:%d"));
 517                                 }
 518                         }
 519                 }
 520         }
 521
 522         proto_tree_add_boolean(tree, hf_server_type_workstation,
 523                 tvb, offset-4, 4, flags);
 524         proto_tree_add_boolean(tree, hf_server_type_server,
 525                 tvb, offset-4, 4, flags);
 526         proto_tree_add_boolean(tree, hf_server_type_sql,
 527                 tvb, offset-4, 4, flags);
 528         proto_tree_add_boolean(tree, hf_server_type_domain,
 529                 tvb, offset-4, 4, flags);
 530         proto_tree_add_boolean(tree, hf_server_type_backup,
 531                 tvb, offset-4, 4, flags);
 532         proto_tree_add_boolean(tree, hf_server_type_time,
 533                 tvb, offset-4, 4, flags);
 534         proto_tree_add_boolean(tree, hf_server_type_apple,
 535                 tvb, offset-4, 4, flags);
 536         proto_tree_add_boolean(tree, hf_server_type_novell,
 537                 tvb, offset-4, 4, flags);
 538         proto_tree_add_boolean(tree, hf_server_type_member,
 539                 tvb, offset-4, 4, flags);
 540         proto_tree_add_boolean(tree, hf_server_type_print,
 541                 tvb, offset-4, 4, flags);
 542         proto_tree_add_boolean(tree, hf_server_type_dialin,
 543                 tvb, offset-4, 4, flags);
 544         proto_tree_add_boolean(tree, hf_server_type_xenix,
 545                 tvb, offset-4, 4, flags);
 546         proto_tree_add_boolean(tree, hf_server_type_ntw,
 547                 tvb, offset-4, 4, flags);
 548         proto_tree_add_boolean(tree, hf_server_type_wfw,
 549                 tvb, offset-4, 4, flags);
 550         proto_tree_add_boolean(tree, hf_server_type_nts,
 551                 tvb, offset-4, 4, flags);
 552         proto_tree_add_boolean(tree, hf_server_type_potentialb,
 553                 tvb, offset-4, 4, flags);
 554         proto_tree_add_boolean(tree, hf_server_type_backupb,
 555                 tvb, offset-4, 4, flags);
 556         proto_tree_add_boolean(tree, hf_server_type_masterb,
 557                 tvb, offset-4, 4, flags);
 558         proto_tree_add_boolean(tree, hf_server_type_domainmasterb,
 559                 tvb, offset-4, 4, flags);
 560         proto_tree_add_boolean(tree, hf_server_type_osf,
 561                 tvb, offset-4, 4, flags);
 562         proto_tree_add_boolean(tree, hf_server_type_vms,
 563                 tvb, offset-4, 4, flags);
 564         proto_tree_add_boolean(tree, hf_server_type_w95,
 565                 tvb, offset-4, 4, flags);
 566         proto_tree_add_boolean(tree, hf_server_type_dfs,
 567                 tvb, offset-4, 4, flags);
 568         proto_tree_add_boolean(tree, hf_server_type_local,
 569                 tvb, offset-4, 4, flags);
 570         proto_tree_add_boolean(tree, hf_server_type_domainenum,
 571                 tvb, offset-4, 4, flags);
 572
 573         return offset;
 574 }
 575
 576
 577 static void
 578 dissect_mailslot_browse(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
 579 {
 580         int offset = 0;
 581         guint8 cmd;
 582         proto_tree *tree = NULL;
 583         proto_item *item = NULL;
 584         guint32 periodicity;
 585         gchar host_name[17];
 586         gchar *utf8_host_name;
 587         gint namelen;
 588         guint8 server_count, reset_cmd;
 589         guint8 os_major_ver, os_minor_ver;
 590         gchar *windows_version = NULL;
 591         int i;
 592         guint32 uptime;
 593
 594         col_set_str(pinfo->cinfo, COL_PROTOCOL, "BROWSER");
 595         col_clear(pinfo->cinfo, COL_INFO);
 596
 597         cmd = tvb_get_guint8(tvb, offset);
 598
 599         if (check_col(pinfo->cinfo, COL_INFO)) {
 600                 /* Put in something, and replace it later */
 601                 col_add_str(pinfo->cinfo, COL_INFO, val_to_str(cmd, commands, "Unknown command:0x%02x"));
 602         }
 603
 604
 605         if (parent_tree) {
 606                 item = proto_tree_add_item(parent_tree, proto_smb_browse, tvb, offset, -1, TRUE);
 607
 608                 tree = proto_item_add_subtree(item, ett_browse);
 609         }
 610
 611         /* command */
 612         proto_tree_add_uint(tree, hf_command, tvb, offset, 1, cmd);
 613         offset += 1;
 614
 615         switch (cmd) {
 616         case BROWSE_DOMAIN_ANNOUNCEMENT:
 617         case BROWSE_LOCAL_MASTER_ANNOUNCEMENT:
 618         case BROWSE_HOST_ANNOUNCE: {
 619                 /* update count */
 620                 proto_tree_add_item(tree, hf_update_count, tvb, offset, 1, TRUE);
 621                 offset += 1;
 622
 623                 /* periodicity (in milliseconds) */
 624                 periodicity = tvb_get_letohl(tvb, offset);
 625                 proto_tree_add_uint_format(tree, hf_periodicity, tvb, offset, 4,
 626                     periodicity,
 627                     "Update Periodicity: %s",
 628                     time_msecs_to_str(periodicity));
 629                 offset += 4;
 630
 631                 /* server name */
 632                 tvb_get_nstringz0(tvb, offset, sizeof(host_name), host_name);
 633                 utf8_host_name = g_convert(host_name, strlen(host_name),
 634                         "UTF-8", "CP437", NULL, NULL, NULL);
 635                 if (utf8_host_name == NULL)
 636                         utf8_host_name = host_name;
 637                 if (check_col(pinfo->cinfo, COL_INFO)) {
 638                         col_append_fstr(pinfo->cinfo, COL_INFO, " %s", utf8_host_name);
 639                 }
 640                 proto_tree_add_string_format(tree, hf_server_name,
 641                         tvb, offset, 16,
 642                         utf8_host_name,
 643                         (cmd==BROWSE_DOMAIN_ANNOUNCEMENT)?
 644                                 "Domain/Workgroup: %s":
 645                                 "Host Name: %s",
 646                         utf8_host_name);
 647                 if (utf8_host_name != host_name)
 648                         g_free(utf8_host_name);
 649                 offset += 16;
 650
 651                 /* Windows version (See "OSVERSIONINFO Structure" on MSDN) */
 652                 os_major_ver = tvb_get_guint8(tvb, offset);
 653                 os_minor_ver = tvb_get_guint8(tvb, offset+1);
 654
 655                 SET_WINDOWS_VERSION_STRING(os_major_ver, os_minor_ver, windows_version);
 656
 657                 if(windows_version)
 658                   proto_tree_add_text(tree, tvb, offset, 2, "Windows version: %s", windows_version);
 659
 660                 /* OS major version */
 661                 proto_tree_add_item(tree, hf_os_major, tvb, offset, 1, TRUE);
 662                 offset += 1;
 663
 664                 /* OS minor version */
 665                 proto_tree_add_item(tree, hf_os_minor, tvb, offset, 1, TRUE);
 666                 offset += 1;
 667
 668                 /* server type flags */
 669                 offset = dissect_smb_server_type_flags(
 670                         tvb, offset, pinfo, tree, NULL, TRUE);
 671
 672                 if (cmd == BROWSE_DOMAIN_ANNOUNCEMENT && tvb_get_letohs (tvb, offset + 2) != 0xAA55) {
 673                         /*
 674                          * Network Monitor claims this is a "Comment
 675                          * Pointer".  I don't believe it.
 676                          *
 677                          * It's not a browser protocol major/minor
 678                          * version number, and signature constant,
 679                          * however.
 680                          */
 681                         proto_tree_add_text(tree, tvb, offset, 4,
 682                             "Mysterious Field: 0x%08x",
 683                             tvb_get_letohl(tvb, offset));
 684                         offset += 4;
 685                 } else {
 686                         /* browser protocol major version */
 687                         proto_tree_add_item(tree, hf_proto_major, tvb, offset, 1, TRUE);
 688                         offset += 1;
 689
 690                         /* browser protocol minor version */
 691                         proto_tree_add_item(tree, hf_proto_minor, tvb, offset, 1, TRUE);
 692                         offset += 1;
 693
 694                         /* signature constant */
 695                         proto_tree_add_item(tree, hf_sig_const, tvb, offset, 2, TRUE);
 696                         offset += 2;
 697                 }
 698
 699                 /* master browser server name or server comment */
 700                 namelen = tvb_strsize(tvb, offset);
 701                 proto_tree_add_item(tree,
 702                         (cmd==BROWSE_DOMAIN_ANNOUNCEMENT)?
 703                             hf_mb_server_name : hf_server_comment,
 704                         tvb, offset, namelen, TRUE);
 705                 offset += namelen;
 706                 break;
 707         }
 708         case BROWSE_REQUEST_ANNOUNCE: {
 709                 guint8 *computer_name;
 710
 711                 /* unused/unknown flags */
 712                 proto_tree_add_item(tree, hf_unused_flags,
 713                         tvb, offset, 1, TRUE);
 714                 offset += 1;
 715
 716                 /* name of computer to which to send reply */
 717                 computer_name = tvb_get_ephemeral_stringz(tvb, offset, &namelen);
 718                 proto_tree_add_string(tree, hf_response_computer_name,
 719                         tvb, offset, namelen, computer_name);
 720                 if (check_col(pinfo->cinfo, COL_INFO))
 721                         col_append_fstr(
 722                                 pinfo->cinfo, COL_INFO, " %s", computer_name);
 723                 offset += namelen;
 724                 break;
 725         }
 726
 727         case BROWSE_ELECTION_REQUEST:
 728                 /* election version */
 729                 proto_tree_add_item(tree, hf_election_version, tvb, offset, 1, TRUE);
 730                 offset += 1;
 731
 732                 /* criterion */
 733                 dissect_election_criterion(tvb, tree, offset);
 734                 offset += 4;
 735
 736                 /* server uptime */
 737                 uptime = tvb_get_letohl(tvb, offset);
 738                 proto_tree_add_uint_format(tree, hf_server_uptime,
 739                     tvb, offset, 4, uptime,
 740                     "Uptime: %s",
 741                     time_msecs_to_str(uptime));
 742                 offset += 4;
 743
 744                 /* next 4 bytes must be zero */
 745                 offset += 4;
 746
 747                 /* server name */
 748                 namelen = tvb_strsize(tvb, offset);
 749                 proto_tree_add_item(tree, hf_server_name,
 750                         tvb, offset, namelen, TRUE);
 751                 offset += namelen;
 752                 break;
 753
 754         case BROWSE_BACKUP_LIST_REQUEST:
 755                 /* backup list requested count */
 756                 proto_tree_add_item(tree, hf_backup_count, tvb, offset, 1, TRUE);
 757                 offset += 1;
 758
 759                 /* backup requested token */
 760                 proto_tree_add_item(tree, hf_backup_token, tvb, offset, 4, TRUE);
 761                 offset += 4;
 762                 break;
 763
 764         case BROWSE_BACKUP_LIST_RESPONSE:
 765                 /* backup list requested count */
 766                 server_count = tvb_get_guint8(tvb, offset);
 767                 proto_tree_add_uint(tree, hf_backup_count, tvb, offset, 1,
 768                     server_count);
 769                 offset += 1;
 770
 771                 /* backup requested token */
 772                 proto_tree_add_item(tree, hf_backup_token, tvb, offset, 4, TRUE);
 773                 offset += 4;
 774
 775                 /* backup server names */
 776                 for (i = 0; i < server_count; i++) {
 777                         namelen = tvb_strsize(tvb, offset);
 778                         proto_tree_add_item(tree, hf_backup_server,
 779                                 tvb, offset, namelen, TRUE);
 780                         offset += namelen;
 781                 }
 782                 break;
 783
 784         case BROWSE_MASTER_ANNOUNCEMENT:
 785                 /* master browser server name */
 786                 namelen = tvb_strsize(tvb, offset);
 787                 proto_tree_add_item(tree, hf_mb_server_name,
 788                         tvb, offset, namelen, TRUE);
 789                 offset += namelen;
 790                 break;
 791
 792         case BROWSE_RESETBROWSERSTATE_ANNOUNCEMENT: {
 793                 proto_tree *sub_tree;
 794                 proto_item *reset_item;
 795
 796                 /* the subcommand follows ... one of three values */
 797
 798                 reset_cmd = tvb_get_guint8(tvb, offset);
 799                 reset_item = proto_tree_add_uint(tree, hf_mb_reset_command, tvb,
 800                                                  offset, 1, reset_cmd);
 801                 sub_tree = proto_item_add_subtree(item, ett_browse_reset_cmd_flags);
 802                 proto_tree_add_boolean(sub_tree, hf_mb_reset_demote, tvb,
 803                                        offset, 1, reset_cmd);
 804                 proto_tree_add_boolean(sub_tree, hf_mb_reset_flush, tvb,
 805                                        offset, 1, reset_cmd);
 806                 proto_tree_add_boolean(sub_tree, hf_mb_reset_stop, tvb,
 807                                        offset, 1, reset_cmd);
 808                 offset += 1;
 809                 break;
 810         }
 811
 812         case BROWSE_BECOME_BACKUP:
 813                 /* name of browser to promote */
 814                 namelen = tvb_strsize(tvb, offset);
 815                 proto_tree_add_item(tree, hf_browser_to_promote,
 816                         tvb, offset, namelen, TRUE);
 817                 offset += namelen;
 818                 break;
 819         }
 820 }
 821
 822 /*
 823  * It appears that browser announcements sent to \MAILSLOT\LANMAN aren't
 824  * the same as browser announcements sent to \MAILSLOT\BROWSE.
 825  * Was that an older version of the protocol?
 826  *
 827  * The document at
 828  *
 829  *      http://www.samba.org/samba/ftp/specs/brow_rev.txt
 830  *
 831  * gives both formats of host announcement packets, saying that
 832  * "[The first] format seems wrong", that one being what appears to
 833  * show up in \MAILSLOT\LANMAN packets, and that "[The second one]
 834  * may be better", that one being what appears to show up in
 835  * \MAILSLOT\BROWSE packets.
 836  *
 837  * XXX - what other browser packets go out to that mailslot?
 838  */
 839 static void
 840 dissect_mailslot_lanman(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
 841 {
 842         int offset = 0;
 843         guint8 cmd;
 844         proto_tree *tree = NULL;
 845         proto_item *item = NULL;
 846         guint32 periodicity;
 847         const guint8 *host_name;
 848         guint8 os_major_ver, os_minor_ver;
 849         gchar *windows_version = NULL;
 850         guint namelen;
 851
 852         col_set_str(pinfo->cinfo, COL_PROTOCOL, "BROWSER");
 853         col_clear(pinfo->cinfo, COL_INFO);
 854
 855         cmd = tvb_get_guint8(tvb, offset);
 856
 857         if (check_col(pinfo->cinfo, COL_INFO)) {
 858                 /* Put in something, and replace it later */
 859                 col_add_str(pinfo->cinfo, COL_INFO, val_to_str(cmd, commands, "Unknown command:0x%02x"));
 860         }
 861
 862
 863         if (parent_tree) {
 864                 item = proto_tree_add_item(parent_tree, proto_smb_browse, tvb, offset, -1, TRUE);
 865
 866                 tree = proto_item_add_subtree(item, ett_browse);
 867         }
 868
 869         /* command */
 870         proto_tree_add_uint(tree, hf_command, tvb, offset, 1, cmd);
 871         offset += 1;
 872
 873         switch (cmd) {
 874         case BROWSE_DOMAIN_ANNOUNCEMENT:
 875         case BROWSE_LOCAL_MASTER_ANNOUNCEMENT:
 876         case BROWSE_HOST_ANNOUNCE:
 877
 878                 /* update count */
 879                 proto_tree_add_item(tree, hf_update_count, tvb, offset, 1, TRUE);
 880                 offset += 1;
 881
 882                 /* server type flags */
 883                 offset = dissect_smb_server_type_flags(
 884                         tvb, offset, pinfo, tree, NULL, TRUE);
 885
 886                 /* OS version string (See "OSVERSIONINFO Structure" on MSDN) */
 887                 os_major_ver = tvb_get_guint8(tvb, offset);
 888                 os_minor_ver = tvb_get_guint8(tvb, offset+1);
 889
 890                 SET_WINDOWS_VERSION_STRING(os_major_ver, os_minor_ver, windows_version);
 891
 892                 if(windows_version)
 893                   proto_tree_add_text(tree, tvb, offset, 2, "Windows version: %s", windows_version);
 894
 895                 /* OS major version */
 896                 proto_tree_add_item(tree, hf_os_major, tvb, offset, 1, TRUE);
 897                 offset += 1;
 898
 899                 /* OS minor version */
 900                 proto_tree_add_item(tree, hf_os_minor, tvb, offset, 1, TRUE);
 901                 offset += 1;
 902
 903                 /* periodicity (in seconds; convert to milliseconds) */
 904                 periodicity = tvb_get_letohs(tvb, offset)*1000;
 905                 proto_tree_add_uint_format(tree, hf_periodicity, tvb, offset, 2,
 906                     periodicity,
 907                     "Update Periodicity: %s",
 908                     time_msecs_to_str(periodicity));
 909                 offset += 2;
 910
 911                 /* server name */
 912                 namelen = tvb_strsize(tvb, offset);
 913                 host_name = tvb_get_ptr(tvb, offset, namelen);
 914                 if (check_col(pinfo->cinfo, COL_INFO)) {
 915                         col_append_fstr(pinfo->cinfo, COL_INFO, " %s", host_name);
 916                 }
 917                 proto_tree_add_item(tree, hf_server_name,
 918                         tvb, offset, namelen, TRUE);
 919                 offset += namelen;
 920
 921                 /* master browser server name or server comment */
 922                 namelen = tvb_strsize(tvb, offset);
 923                 proto_tree_add_item(tree,
 924                         (cmd==BROWSE_DOMAIN_ANNOUNCEMENT)?
 925                             hf_mb_server_name : hf_server_comment,
 926                         tvb, offset, namelen, TRUE);
 927                 offset += namelen;
 928                 break;
 929         }
 930 }
 931
 932 void
 933 proto_register_smb_browse(void)
 934 {
 935         static hf_register_info hf[] = {
 936                 { &hf_command,
 937                         { "Command", "browser.command", FT_UINT8, BASE_HEX,
 938                         VALS(commands), 0, "Browse command opcode", HFILL }},
 939
 940                 { &hf_update_count,
 941                         { "Update Count", "browser.update_count", FT_UINT8, BASE_DEC,
 942                         NULL, 0, "Browse Update Count", HFILL }},
 943
 944                 { &hf_periodicity,
 945                         { "Update Periodicity", "browser.period", FT_UINT32, BASE_DEC,
 946                         NULL, 0, "Update Periodicity in ms", HFILL }},
 947
 948                 { &hf_server_name,
 949                         { "Server Name", "browser.server", FT_STRING, BASE_NONE,
 950                         NULL, 0, "BROWSE Server Name", HFILL }},
 951
 952                 { &hf_mb_server_name,
 953                         { "Master Browser Server Name", "browser.mb_server", FT_STRING, BASE_NONE,
 954                         NULL, 0, "BROWSE Master Browser Server Name", HFILL }},
 955
 956                 { &hf_mb_reset_command,
 957                   { "ResetBrowserState Command", "browser.reset_cmd", FT_UINT8,
 958                     BASE_HEX, VALS(resetbrowserstate_command_names), 0,
 959                     NULL, HFILL }},
 960                 { &hf_mb_reset_demote,
 961                   { "Demote LMB", "browser.reset_cmd.demote", FT_BOOLEAN,
 962                     8, TFS(&tfs_demote_to_backup), 0x01, NULL, HFILL}},
 963                 { &hf_mb_reset_flush,
 964                   { "Flush Browse List", "browser.reset_cmd.flush", FT_BOOLEAN,
 965                     8, TFS(&tfs_flush_browse_list), 0x02, NULL, HFILL}},
 966                 { &hf_mb_reset_stop,
 967                   { "Stop Being LMB", "browser.reset_cmd.stop_lmb", FT_BOOLEAN,
 968                     8, TFS(&tfs_stop_being_lmb), 0x04, NULL, HFILL}},
 969                 { &hf_os_major,
 970                         { "OS Major Version", "browser.os_major", FT_UINT8, BASE_DEC,
 971                         NULL, 0, "Operating System Major Version", HFILL }},
 972
 973                 { &hf_os_minor,
 974                         { "OS Minor Version", "browser.os_minor", FT_UINT8, BASE_DEC,
 975                         NULL, 0, "Operating System Minor Version", HFILL }},
 976
 977                 { &hf_server_type,
 978                         { "Server Type", "browser.server_type", FT_UINT32, BASE_HEX,
 979                         NULL, 0, "Server Type Flags", HFILL }},
 980
 981                 { &hf_server_type_workstation,
 982                         { "Workstation", "browser.server_type.workstation", FT_BOOLEAN, 32,
 983                         TFS(&tfs_workstation), 1<<SERVER_WORKSTATION, "Is This A Workstation?", HFILL }},
 984
 985                 { &hf_server_type_server,
 986                         { "Server", "browser.server_type.server", FT_BOOLEAN, 32,
 987                         TFS(&tfs_server), 1<<SERVER_SERVER, "Is This A Server?", HFILL }},
 988
 989                 { &hf_server_type_sql,
 990                         { "SQL", "browser.server_type.sql", FT_BOOLEAN, 32,
 991                         TFS(&tfs_sql), 1<<SERVER_SQL_SERVER, "Is This A SQL Server?", HFILL }},
 992
 993                 { &hf_server_type_domain,
 994                         { "Domain Controller", "browser.server_type.domain_controller", FT_BOOLEAN, 32,
 995                         TFS(&tfs_domain), 1<<SERVER_DOMAIN_CONTROLLER, "Is This A Domain Controller?", HFILL }},
 996
 997                 { &hf_server_type_backup,
 998                         { "Backup Controller", "browser.server_type.backup_controller", FT_BOOLEAN, 32,
 999                         TFS(&tfs_backup), 1<<SERVER_BACKUP_CONTROLLER, "Is This A Backup Domain Controller?", HFILL }},
1000
1001                 { &hf_server_type_time,
1002                         { "Time Source", "browser.server_type.time", FT_BOOLEAN, 32,
1003                         TFS(&tfs_time), 1<<SERVER_TIME_SOURCE, "Is This A Time Source?", HFILL }},
1004
1005                 { &hf_server_type_apple,
1006                         { "Apple", "browser.server_type.apple", FT_BOOLEAN, 32,
1007                         TFS(&tfs_apple), 1<<SERVER_APPLE_SERVER, "Is This An Apple Server ?", HFILL }},
1008
1009                 { &hf_server_type_novell,
1010                         { "Novell", "browser.server_type.novell", FT_BOOLEAN, 32,
1011                         TFS(&tfs_novell), 1<<SERVER_NOVELL_SERVER, "Is This A Novell Server?", HFILL }},
1012
1013                 { &hf_server_type_member,
1014                         { "Member", "browser.server_type.member", FT_BOOLEAN, 32,
1015                         TFS(&tfs_member), 1<<SERVER_DOMAIN_MEMBER_SERVER, "Is This A Domain Member Server?", HFILL }},
1016
1017                 { &hf_server_type_print,
1018                         { "Print", "browser.server_type.print", FT_BOOLEAN, 32,
1019                         TFS(&tfs_print), 1<<SERVER_PRINT_QUEUE_SERVER, "Is This A Print Server?", HFILL }},
1020
1021                 { &hf_server_type_dialin,
1022                         { "Dialin", "browser.server_type.dialin", FT_BOOLEAN, 32,
1023                         TFS(&tfs_dialin), 1<<SERVER_DIALIN_SERVER, "Is This A Dialin Server?", HFILL }},
1024
1025                 { &hf_server_type_xenix,
1026                         { "Xenix", "browser.server_type.xenix", FT_BOOLEAN, 32,
1027                         TFS(&tfs_xenix), 1<<SERVER_XENIX_SERVER, "Is This A Xenix Server?", HFILL }},
1028
1029                 { &hf_server_type_ntw,
1030                         { "NT Workstation", "browser.server_type.ntw", FT_BOOLEAN, 32,
1031                         TFS(&tfs_ntw), 1<<SERVER_NT_WORKSTATION, "Is This A NT Workstation?", HFILL }},
1032
1033                 { &hf_server_type_wfw,
1034                         { "WfW", "browser.server_type.wfw", FT_BOOLEAN, 32,
1035                         TFS(&tfs_wfw), 1<<SERVER_WINDOWS_FOR_WORKGROUPS, "Is This A Windows For Workgroups Server?", HFILL }},
1036
1037                 { &hf_server_type_nts,
1038                         { "NT Server", "browser.server_type.nts", FT_BOOLEAN, 32,
1039                         TFS(&tfs_nts), 1<<SERVER_NT_SERVER, "Is This A NT Server?", HFILL }},
1040
1041                 { &hf_server_type_potentialb,
1042                         { "Potential Browser", "browser.server_type.browser.potential", FT_BOOLEAN, 32,
1043                         TFS(&tfs_potentialb), 1<<SERVER_POTENTIAL_BROWSER, "Is This A Potential Browser?", HFILL }},
1044
1045                 { &hf_server_type_backupb,
1046                         { "Backup Browser", "browser.server_type.browser.backup", FT_BOOLEAN, 32,
1047                         TFS(&tfs_backupb), 1<<SERVER_BACKUP_BROWSER, "Is This A Backup Browser?", HFILL }},
1048
1049                 { &hf_server_type_masterb,
1050                         { "Master Browser", "browser.server_type.browser.master", FT_BOOLEAN, 32,
1051                         TFS(&tfs_masterb), 1<<SERVER_MASTER_BROWSER, "Is This A Master Browser?", HFILL }},
1052
1053                 { &hf_server_type_domainmasterb,
1054                         { "Domain Master Browser", "browser.server_type.browser.domain_master", FT_BOOLEAN, 32,
1055                         TFS(&tfs_domainmasterb), 1<<SERVER_DOMAIN_MASTER_BROWSER, "Is This A Domain Master Browser?", HFILL }},
1056
1057                 { &hf_server_type_osf,
1058                         { "OSF", "browser.server_type.osf", FT_BOOLEAN, 32,
1059                         TFS(&tfs_osf), 1<<SERVER_OSF, "Is This An OSF server ?", HFILL }},
1060
1061                 { &hf_server_type_vms,
1062                         { "VMS", "browser.server_type.vms", FT_BOOLEAN, 32,
1063                         TFS(&tfs_vms), 1<<SERVER_VMS, "Is This A VMS Server?", HFILL }},
1064
1065                 { &hf_server_type_w95,
1066                         { "Windows 95+", "browser.server_type.w95", FT_BOOLEAN, 32,
1067                         TFS(&tfs_w95), 1<<SERVER_WINDOWS_95, "Is This A Windows 95 or above server?", HFILL }},
1068
1069                 { &hf_server_type_dfs,
1070                         { "DFS", "browser.server_type.dfs", FT_BOOLEAN, 32,
1071                         TFS(&tfs_dfs), 1<<SERVER_DFS_SERVER, "Is This A DFS server?", HFILL }},
1072
1073                 { &hf_server_type_local,
1074                         { "Local", "browser.server_type.local", FT_BOOLEAN, 32,
1075                         TFS(&tfs_local), 1<<SERVER_LOCAL_LIST_ONLY, "Is This A Local List Only request?", HFILL }},
1076
1077                 { &hf_server_type_domainenum,
1078                         { "Domain Enum", "browser.server_type.domainenum", FT_BOOLEAN, 32,
1079                         TFS(&tfs_domainenum), 1<<SERVER_DOMAIN_ENUM, "Is This A Domain Enum request?", HFILL }},
1080
1081                 { &hf_election_version,
1082                         { "Election Version", "browser.election.version", FT_UINT8, BASE_DEC,
1083                         NULL, 0, NULL, HFILL }},
1084
1085                 { &hf_proto_major,
1086                         { "Browser Protocol Major Version", "browser.proto_major", FT_UINT8, BASE_DEC,
1087                         NULL, 0, NULL, HFILL }},
1088
1089                 { &hf_proto_minor,
1090                         { "Browser Protocol Minor Version", "browser.proto_minor", FT_UINT8, BASE_DEC,
1091                         NULL, 0, NULL, HFILL }},
1092
1093                 { &hf_sig_const,
1094                         { "Signature", "browser.sig", FT_UINT16, BASE_HEX,
1095                         NULL, 0, "Signature Constant", HFILL }},
1096
1097                 { &hf_server_comment,
1098                         { "Host Comment", "browser.comment", FT_STRINGZ, BASE_NONE,
1099                         NULL, 0, "Server Comment", HFILL }},
1100
1101                 { &hf_unused_flags,
1102                         { "Unused flags", "browser.unused", FT_UINT8, BASE_HEX,
1103                         NULL, 0, "Unused/unknown flags", HFILL }},
1104
1105                 { &hf_response_computer_name,
1106                         { "Response Computer Name", "browser.response_computer_name", FT_STRINGZ, BASE_NONE,
1107                         NULL, 0, NULL, HFILL }},
1108
1109                 { &hf_election_criteria,
1110                         { "Election Criteria", "browser.election.criteria", FT_UINT32, BASE_HEX,
1111                         NULL, 0, NULL, HFILL }},
1112
1113                 { &hf_election_desire,
1114                         { "Election Desire", "browser.election.desire", FT_UINT8, BASE_HEX,
1115                         NULL, 0, NULL, HFILL }},
1116
1117                 { &hf_election_desire_flags_backup,
1118                         { "Backup", "browser.election.desire.backup", FT_BOOLEAN, 8,
1119                         TFS(&tfs_desire_backup), 1<<DESIRE_BACKUP, "Is this a backup server", HFILL }},
1120
1121                 { &hf_election_desire_flags_standby,
1122                         { "Standby", "browser.election.desire.standby", FT_BOOLEAN, 8,
1123                         TFS(&tfs_desire_standby), 1<<DESIRE_STANDBY, "Is this a standby server?", HFILL }},
1124
1125                 { &hf_election_desire_flags_master,
1126                         { "Master", "browser.election.desire.master", FT_BOOLEAN, 8,
1127                         TFS(&tfs_desire_master), 1<<DESIRE_MASTER, "Is this a master server", HFILL }},
1128
1129                 { &hf_election_desire_flags_domain_master,
1130                         { "Domain Master", "browser.election.desire.domain_master", FT_BOOLEAN, 8,
1131                         TFS(&tfs_desire_domain_master), 1<<DESIRE_DOMAIN_MASTER, "Is this a domain master", HFILL }},
1132
1133                 { &hf_election_desire_flags_wins,
1134                         { "WINS", "browser.election.desire.wins", FT_BOOLEAN, 8,
1135                         TFS(&tfs_desire_wins), 1<<DESIRE_WINS, "Is this a WINS server", HFILL }},
1136
1137                 { &hf_election_desire_flags_nt,
1138                         { "NT", "browser.election.desire.nt", FT_BOOLEAN, 8,
1139                         TFS(&tfs_desire_nt), 1<<DESIRE_NT, "Is this a NT server", HFILL }},
1140
1141                 { &hf_election_revision,
1142                         { "Election Revision", "browser.election.revision", FT_UINT16, BASE_DEC,
1143                         NULL, 0, NULL, HFILL }},
1144
1145                 { &hf_election_os,
1146                         { "Election OS", "browser.election.os", FT_UINT8, BASE_HEX,
1147                         NULL, 0, NULL, HFILL }},
1148
1149                 { &hf_election_os_wfw,
1150                         { "WfW", "browser.election.os.wfw", FT_BOOLEAN, 8,
1151                         TFS(&tfs_os_wfw), 1<<OS_WFW, "Is this a WfW host?", HFILL }},
1152
1153                 { &hf_election_os_ntw,
1154                         { "NT Workstation", "browser.election.os.ntw", FT_BOOLEAN, 8,
1155                         TFS(&tfs_os_ntw), 1<<OS_NTW, "Is this a NT Workstation?", HFILL }},
1156
1157                 { &hf_election_os_nts,
1158                         { "NT Server", "browser.election.os.nts", FT_BOOLEAN, 8,
1159                         TFS(&tfs_os_nts), 1<<OS_NTS, "Is this a NT Server?", HFILL }},
1160
1161                 { &hf_server_uptime,
1162                         { "Uptime", "browser.uptime", FT_UINT32, BASE_DEC,
1163                         NULL, 0, "Server uptime in ms", HFILL }},
1164
1165                 { &hf_backup_count,
1166                         { "Backup List Requested Count", "browser.backup.count", FT_UINT8, BASE_DEC,
1167                         NULL, 0, NULL, HFILL }},
1168
1169                 { &hf_backup_token,
1170                         { "Backup Request Token", "browser.backup.token", FT_UINT32, BASE_DEC,
1171                         NULL, 0, "Backup requested/response token", HFILL }},
1172
1173                 { &hf_backup_server,
1174                         { "Backup Server", "browser.backup.server", FT_STRING, BASE_NONE,
1175                         NULL, 0, "Backup Server Name", HFILL }},
1176
1177                 { &hf_browser_to_promote,
1178                         { "Browser to Promote", "browser.browser_to_promote", FT_STRINGZ, BASE_NONE,
1179                         NULL, 0, NULL, HFILL }},
1180
1181         };
1182
1183         static gint *ett[] = {
1184                 &ett_browse,
1185                 &ett_browse_flags,
1186                 &ett_browse_election_criteria,
1187                 &ett_browse_election_os,
1188                 &ett_browse_election_desire,
1189                 &ett_browse_reset_cmd_flags,
1190         };
1191
1192         proto_smb_browse = proto_register_protocol("Microsoft Windows Browser Protocol",
1193             "BROWSER", "browser");
1194
1195         proto_register_field_array(proto_smb_browse, hf, array_length(hf));
1196         proto_register_subtree_array(ett, array_length(ett));
1197
1198         register_dissector("mailslot_browse", dissect_mailslot_browse,
1199             proto_smb_browse);
1200         register_dissector("mailslot_lanman", dissect_mailslot_lanman,
1201             proto_smb_browse);
1202 }