* Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com>
* 2001 Rewrite by Ronnie Sahlberg and Guy Harris
*
- * $Id: packet-smb.c,v 1.197 2002/01/21 07:36:42 guy Exp $
+ * $Id: packet-smb.c,v 1.242 2002/04/16 02:42:24 guy Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
static int hf_smb_fs_attr_vq = -1;
static int hf_smb_fs_attr_dim = -1;
static int hf_smb_fs_attr_vic = -1;
+static int hf_smb_quota_flags_enabled = -1;
+static int hf_smb_quota_flags_deny_disk = -1;
+static int hf_smb_quota_flags_log_limit = -1;
+static int hf_smb_quota_flags_log_warning = -1;
+static int hf_smb_soft_quota_limit = -1;
+static int hf_smb_hard_quota_limit = -1;
+static int hf_smb_user_quota_used = -1;
+static int hf_smb_user_quota_offset = -1;
static gint ett_smb = -1;
static gint ett_smb_hdr = -1;
static gint ett_smb_ssetupandxaction = -1;
static gint ett_smb_optionsup = -1;
static gint ett_smb_time_date = -1;
-static gint ett_smb_64bit_time = -1;
static gint ett_smb_move_flags = -1;
static gint ett_smb_file_attributes = -1;
static gint ett_smb_search_resume_key = -1;
static gint ett_smb_nt_share_access = -1;
static gint ett_smb_nt_security_flags = -1;
static gint ett_smb_nt_trans_setup = -1;
+static gint ett_smb_nt_trans_data = -1;
+static gint ett_smb_nt_trans_param = -1;
static gint ett_smb_nt_notify_completion_filter = -1;
static gint ett_smb_nt_ioctl_flags = -1;
static gint ett_smb_security_information_mask = -1;
static gint ett_smb_ace = -1;
static gint ett_smb_ace_flags = -1;
static gint ett_smb_sec_desc_type = -1;
+static gint ett_smb_quotaflags = -1;
proto_tree *top_tree=NULL; /* ugly */
return offset;
}
-static int
-dissect_smb_64bit_time(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, int offset, char *str, int hf_date)
+#define TIME_FIXUP_CONSTANT (369.0*365.25*24*60*60-(3.0*24*60*60+6.0*60*60))
+
+/*
+ * Translate an 8-byte FILETIME value, given as the upper and lower 32 bits,
+ * to an "nstime_t".
+ * A FILETIME is a 64-bit integer, giving the time since Jan 1, 1601,
+ * midnight "UTC", in 100ns units.
+ * Return TRUE if the conversion succeeds, FALSE otherwise.
+ *
+ * According to the Samba code, it appears to be kludge-GMT (at least for
+ * file listings). This means it's the GMT you get by taking a local time
+ * and adding the server time zone offset. This is NOT the same as GMT in
+ * some cases. However, we don't know the server time zone, so we don't
+ * do that adjustment.
+ *
+ * This code is based on the Samba code:
+ *
+ * Unix SMB/Netbios implementation.
+ * Version 1.9.
+ * time handling functions
+ * Copyright (C) Andrew Tridgell 1992-1998
+ */
+static gboolean
+nt_time_to_nstime(guint32 filetime_high, guint32 filetime_low, nstime_t *tv)
{
- proto_item *item = NULL;
- proto_tree *tree = NULL;
- nstime_t tv;
+ double d;
+ /* The next two lines are a fix needed for the
+ broken SCO compiler. JRA. */
+ time_t l_time_min = TIME_T_MIN;
+ time_t l_time_max = TIME_T_MAX;
- /* XXXX we need some way to represent this as a time
- properly. For now we display everything as 8 bytes*/
+ if (filetime_high == 0)
+ return FALSE;
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 8,
- str);
- tree = proto_item_add_subtree(item, ett_smb_64bit_time);
- }
+ /*
+ * Get the time as a double, in seconds and fractional seconds.
+ */
+ d = ((double)filetime_high)*4.0*(double)(1<<30);
+ d += filetime_low;
+ d *= 1.0e-7;
+
+ /* Now adjust by 369 years, to make the seconds since 1970. */
+ d -= TIME_FIXUP_CONSTANT;
- proto_tree_add_bytes_format(tree, hf_smb_unknown, tvb, offset, 8, tvb_get_ptr(tvb, offset, 8), "%s: can't decode this yet", str);
+ if (!(l_time_min <= d && d <= l_time_max))
+ return FALSE;
+
+ /*
+ * Get the time as seconds and nanoseconds.
+ */
+ tv->secs = d;
+ tv->nsecs = (d - tv->secs)*1000000000;
+
+ return TRUE;
+}
+
+int
+dissect_smb_64bit_time(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, int hf_date)
+{
+ guint32 filetime_high, filetime_low;
+ nstime_t ts;
+
+ /* XXX there seems also to be another special time value which is fairly common :
+ 0x40000000 00000000
+ the meaning of this one is yet unknown
+ */
+ if (tree) {
+ filetime_low = tvb_get_letohl(tvb, offset);
+ filetime_high = tvb_get_letohl(tvb, offset + 4);
+ if (filetime_low == 0 && filetime_high == 0) {
+ proto_tree_add_text(tree, tvb, offset, 8,
+ "%s: No time specified (0)",
+ proto_registrar_get_name(hf_date));
+ } else if(filetime_low==0 && filetime_high==0x80000000){
+ proto_tree_add_text(tree, tvb, offset, 8,
+ "%s: Infinity (relative time)",
+ proto_registrar_get_name(hf_date));
+ } else if(filetime_low==0xffffffff && filetime_high==0x7fffffff){
+ proto_tree_add_text(tree, tvb, offset, 8,
+ "%s: Infinity (absolute time)",
+ proto_registrar_get_name(hf_date));
+ } else {
+ if (nt_time_to_nstime(filetime_high, filetime_low, &ts)) {
+ proto_tree_add_time(tree, hf_date, tvb,
+ offset, 8, &ts);
+ } else {
+ proto_tree_add_text(tree, tvb, offset, 8,
+ "%s: Time can't be converted",
+ proto_registrar_get_name(hf_date));
+ }
+ }
+ }
offset += 8;
return offset;
/* system time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "System Time", hf_smb_system_time);
+ hf_smb_system_time);
/* time zone */
tz = tvb_get_letohs(tvb, offset);
dissect_close_file_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree)
{
guint8 wc;
- guint16 bc;
+ guint16 bc, fid;
WORD_COUNT;
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* last write time */
{
guint8 wc;
guint16 bc;
+ smb_info_t *si;
+ unsigned int fid;
WORD_COUNT;
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
+ if (!pinfo->fd->flags.visited) {
+ /* remember the FID for the processing of the response */
+ si = (smb_info_t *)pinfo->private_data;
+ si->sip->extra_info=(void *)fid;
+ }
/* read count */
proto_tree_add_item(tree, hf_smb_count, tvb, offset, 2, TRUE);
return offset;
}
+static int
+dissect_file_data_dcerpc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
+ proto_tree *top_tree, int offset, guint16 bc, guint16 datalen, guint16 fid)
+{
+ int tvblen;
+ tvbuff_t *dcerpc_tvb;
+
+ if(bc>datalen){
+ /* We have some initial padding bytes. */
+ /* XXX - use the data offset here instead? */
+ proto_tree_add_item(tree, hf_smb_padding, tvb, offset, bc-datalen,
+ TRUE);
+ offset += bc-datalen;
+ bc = datalen;
+ }
+ tvblen = tvb_length_remaining(tvb, offset);
+ dcerpc_tvb = tvb_new_subset(tvb, offset, tvblen, bc);
+ dissect_pipe_dcerpc(dcerpc_tvb, pinfo, top_tree, tree, fid);
+ if(bc>tvblen)
+ offset += tvblen;
+ else
+ offset += bc;
+ return offset;
+}
+
static int
dissect_read_file_response(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree)
{
guint16 cnt=0, bc;
guint8 wc;
+ smb_info_t *si = (smb_info_t *)pinfo->private_data;
+ int fid=0;
WORD_COUNT;
proto_tree_add_item(tree, hf_smb_reserved, tvb, offset, 8, TRUE);
offset += 8;
+ /* If we have seen the request, then print which FID this refers to */
+ /* first check if we have seen the request */
+ if(si->sip != NULL && si->sip->frame_req>0){
+ fid=(int)si->sip->extra_info;
+ add_fid(tvb, pinfo, tree, 0, 0, fid);
+ }
+
BYTE_COUNT;
/* buffer format */
proto_tree_add_item(tree, hf_smb_data_len, tvb, offset, 2, TRUE);
COUNT_BYTES(2);
- if (bc != 0) {
- /* file data */
- offset = dissect_file_data(tvb, pinfo, tree, offset, bc, bc);
+ /* another way to transport DCERPC over SMB is to skip Transaction completely and just
+ read write */
+ if(bc){
+ if(si->sip != NULL && si->sip->flags&SMB_SIF_TID_IS_IPC){
+ /* dcerpc call */
+ offset = dissect_file_data_dcerpc(tvb, pinfo, tree,
+ top_tree, offset, bc, bc, fid);
+ } else {
+ /* ordinary file data, or we didn't see the request,
+ so we don't know whether this is a DCERPC call
+ or not */
+ offset = dissect_file_data(tvb, pinfo, tree, offset, bc, bc);
+ }
bc = 0;
}
static int
dissect_write_file_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree)
{
- guint16 cnt=0, bc;
+ guint32 ofs=0;
+ guint16 cnt=0, bc, fid=0;
guint8 wc;
+ smb_info_t *si = (smb_info_t *)pinfo->private_data;
WORD_COUNT;
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* write count */
offset += 2;
/* offset */
+ ofs = tvb_get_letohl(tvb, offset);
proto_tree_add_item(tree, hf_smb_offset, tvb, offset, 4, TRUE);
offset += 4;
+ if (check_col(pinfo->cinfo, COL_INFO))
+ col_append_fstr(pinfo->cinfo, COL_INFO,
+ ", %d byte%s at offset %d", cnt,
+ (cnt == 1) ? "" : "s", ofs);
+
/* remaining */
proto_tree_add_item(tree, hf_smb_remaining, tvb, offset, 2, TRUE);
offset += 2;
COUNT_BYTES(2);
if (bc != 0) {
- /* file data */
- offset = dissect_file_data(tvb, pinfo, tree, offset, bc, bc);
+ if( (si->sip && si->sip->flags&SMB_SIF_TID_IS_IPC) && (ofs==0) ){
+ /* dcerpc call */
+ offset = dissect_file_data_dcerpc(tvb, pinfo, tree,
+ top_tree, offset, bc, bc, fid);
+ } else {
+ /* ordinary file data */
+ offset = dissect_file_data(tvb, pinfo, tree, offset, bc, bc);
+ }
bc = 0;
}
dissect_write_file_response(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree)
{
guint8 wc;
- guint16 bc;
+ guint16 bc, cnt;
WORD_COUNT;
/* write count */
+ cnt = tvb_get_letohs(tvb, offset);
proto_tree_add_item(tree, hf_smb_count, tvb, offset, 2, TRUE);
offset += 2;
+ if (check_col(pinfo->cinfo, COL_INFO))
+ col_append_fstr(pinfo->cinfo, COL_INFO,
+ ", %d byte%s", cnt, (cnt == 1) ? "" : "s");
+
BYTE_COUNT;
END_OF_SMB
dissect_lock_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree)
{
guint8 wc;
- guint16 bc;
+ guint16 bc, fid;
WORD_COUNT;
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* lock count */
int fn_len;
const char *fn;
guint8 wc;
- guint16 bc;
- guint16 fid;
+ guint16 bc, fid;
WORD_COUNT;
dissect_seek_file_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree)
{
guint8 wc;
- guint16 bc;
+ guint16 bc, fid;
WORD_COUNT;
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* Seek Mode */
dissect_set_information2_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree)
{
guint8 wc;
- guint16 bc;
+ guint16 bc, fid;
WORD_COUNT;
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* create time */
{
guint8 wc;
guint16 cnt=0;
- guint16 bc;
+ guint16 bc, fid;
WORD_COUNT;
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* write count */
dissect_read_raw_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree)
{
guint8 wc;
- guint16 bc;
+ guint16 bc, fid;
guint32 to;
WORD_COUNT;
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* offset */
dissect_read_mpx_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree)
{
guint8 wc;
- guint16 bc;
+ guint16 bc, fid;
WORD_COUNT;
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* offset */
dissect_write_raw_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree)
{
guint32 to;
- guint16 datalen=0, bc;
+ guint16 datalen=0, bc, fid;
guint8 wc;
WORD_COUNT;
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* total data length */
dissect_write_mpx_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree)
{
guint32 to;
- guint16 datalen=0, bc;
+ guint16 datalen=0, bc, fid;
guint8 wc;
WORD_COUNT;
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* total data length */
dissect_locking_andx_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree)
{
guint8 wc, cmd=0xff, lt=0;
- guint16 andxoffset=0, un=0, ln=0, bc;
+ guint16 andxoffset=0, un=0, ln=0, bc, fid;
guint32 to;
proto_item *litem = NULL;
proto_tree *ltree = NULL;
offset += 2;
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* lock type */
dissect_read_andx_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree)
{
guint8 wc, cmd=0xff;
- guint16 andxoffset=0, bc;
+ guint16 andxoffset=0, bc, maxcnt = 0;
+ guint32 ofs = 0;
smb_info_t *si;
unsigned int fid;
}
/* offset */
+ ofs = tvb_get_letohl(tvb, offset);
proto_tree_add_item(tree, hf_smb_offset, tvb, offset, 4, TRUE);
offset += 4;
/* max count */
+ maxcnt = tvb_get_letohs(tvb, offset);
proto_tree_add_item(tree, hf_smb_max_count, tvb, offset, 2, TRUE);
offset += 2;
+ if (check_col(pinfo->cinfo, COL_INFO))
+ col_append_fstr(pinfo->cinfo, COL_INFO,
+ ", %d byte%s at offset %d", maxcnt,
+ (maxcnt == 1) ? "" : "s", ofs);
+
/* min count */
proto_tree_add_item(tree, hf_smb_min_count, tvb, offset, 2, TRUE);
offset += 2;
guint8 wc, cmd=0xff;
guint16 andxoffset=0, bc, datalen=0, dataoffset=0;
smb_info_t *si = (smb_info_t *)pinfo->private_data;
+ int fid=0;
WORD_COUNT;
/* If we have seen the request, then print which FID this refers to */
/* first check if we have seen the request */
if(si->sip != NULL && si->sip->frame_req>0){
- add_fid(tvb, pinfo, tree, 0, 0, (int)si->sip->extra_info);
+ fid=(int)si->sip->extra_info;
+ add_fid(tvb, pinfo, tree, 0, 0, fid);
}
/* remaining */
proto_tree_add_uint(tree, hf_smb_data_len, tvb, offset, 2, datalen);
offset += 2;
+ if (check_col(pinfo->cinfo, COL_INFO))
+ col_append_fstr(pinfo->cinfo, COL_INFO,
+ ", %d byte%s", datalen,
+ (datalen == 1) ? "" : "s");
+
/* data offset */
dataoffset=tvb_get_letohs(tvb, offset);
proto_tree_add_uint(tree, hf_smb_data_offset, tvb, offset, 2, dataoffset);
/* is this part of DCERPC over SMB reassembly?*/
if(smb_dcerpc_reassembly && !pinfo->fd->flags.visited
&& (bc<=tvb_length_remaining(tvb, offset)) ){
- guint32 frame;
- if (si->sip != NULL && (frame=(guint32)g_hash_table_lookup(
+ gpointer hash_value;
+ if (si->sip != NULL && (hash_value = g_hash_table_lookup(
si->ct->dcerpc_fid_to_frame,
si->sip->extra_info)) != NULL) {
fragment_data *fd_head;
+ guint32 frame = GPOINTER_TO_UINT(hash_value);
+
/* first fragment is always from a SMB Trans command and
offset 0 of the following read/write SMB commands start
BEYOND the first Trans SMB payload. Look for offset
}
}
- /* file data */
- offset = dissect_file_data(tvb, pinfo, tree, offset, bc, datalen);
- bc = 0;
+ /* another way to transport DCERPC over SMB is to skip Transaction completely and just
+ read write */
+ if(bc){
+ if(si->sip != NULL && si->sip->flags&SMB_SIF_TID_IS_IPC){
+ /* dcerpc call */
+ offset = dissect_file_data_dcerpc(tvb, pinfo, tree,
+ top_tree, offset, bc, datalen, fid);
+ } else {
+ /* ordinary file data, or we didn't see the request,
+ so we don't know whether this is a DCERPC call
+ or not */
+ offset = dissect_file_data(tvb, pinfo, tree, offset, bc, datalen);
+ }
+ bc = 0;
+ }
END_OF_SMB
static int
dissect_write_andx_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree)
{
+ guint32 ofs=0;
guint8 wc, cmd=0xff;
guint16 andxoffset=0, bc, datalen=0, dataoffset=0;
smb_info_t *si = (smb_info_t *)pinfo->private_data;
- unsigned int fid;
+ unsigned int fid=0;
WORD_COUNT;
}
/* offset */
+ ofs = tvb_get_letohl(tvb, offset);
proto_tree_add_item(tree, hf_smb_offset, tvb, offset, 4, TRUE);
offset += 4;
proto_tree_add_uint(tree, hf_smb_data_offset, tvb, offset, 2, dataoffset);
offset += 2;
+ /* FIXME: add byte/offset to COL_INFO */
+
if(wc==14){
/* high offset */
proto_tree_add_item(tree, hf_smb_high_offset, tvb, offset, 4, TRUE);
/* is this part of DCERPC over SMB reassembly?*/
if(smb_dcerpc_reassembly && !pinfo->fd->flags.visited && (bc<=tvb_length_remaining(tvb, offset)) ){
- guint32 frame;
- frame=(guint32)g_hash_table_lookup(si->ct->dcerpc_fid_to_frame,
+ gpointer hash_value;
+ hash_value = g_hash_table_lookup(si->ct->dcerpc_fid_to_frame,
si->sip->extra_info);
- if(frame){
+ if(hash_value){
fragment_data *fd_head;
+ guint32 frame = GPOINTER_TO_UINT(hash_value);
+
/* first fragment is always from a SMB Trans command and
offset 0 of the following read/write SMB commands start
BEYOND the first Trans SMB payload. Look for offset
}
/* file data */
- offset = dissect_file_data(tvb, pinfo, tree, offset, bc, datalen);
- bc = 0;
+ if (bc != 0) {
+ if( (si->sip && si->sip->flags&SMB_SIF_TID_IS_IPC) && (ofs==0) ){
+ /* dcerpc call */
+ offset = dissect_file_data_dcerpc(tvb, pinfo, tree,
+ top_tree, offset, bc, datalen, fid);
+ } else {
+ /* ordinary file data */
+ offset = dissect_file_data(tvb, pinfo, tree, offset,
+ bc, datalen);
+ }
+ bc = 0;
+ }
END_OF_SMB
COUNT_BYTES(dn_len);
if (check_col(pinfo->cinfo, COL_INFO)) {
- col_append_fstr(pinfo->cinfo, COL_INFO, ", User: %s@%s",
- an,dn);
+ col_append_fstr(pinfo->cinfo, COL_INFO, ", User: ");
+
+ if (!dn[0] && !an[0])
+ col_append_fstr(pinfo->cinfo, COL_INFO,
+ "anonymous");
+ else
+ col_append_fstr(pinfo->cinfo, COL_INFO,
+ "%s\\%s", dn,an);
}
/* OS */
offset, an_len, an);
COUNT_BYTES(an_len);
+ /* Now when we know the service type, store it so that we know it for later commands down
+ this tree */
+ if(!pinfo->fd->flags.visited){
+ smb_info_t *si = (smb_info_t *)pinfo->private_data;
+ /* Remove any previous entry for this TID */
+ if(g_hash_table_lookup(si->ct->tid_service, (void *)si->tid)){
+ g_hash_table_remove(si->ct->tid_service, (void *)si->tid);
+ }
+ if(strcmp(an,"IPC") == 0){
+ g_hash_table_insert(si->ct->tid_service, (void *)si->tid, (void *)TID_IPC);
+ } else {
+ g_hash_table_insert(si->ct->tid_service, (void *)si->tid, (void *)TID_NORMAL);
+ }
+ }
+
+
if(wc==3){
if (bc != 0) {
/*
#define NT_TRANS_NOTIFY 4
#define NT_TRANS_RENAME 5
#define NT_TRANS_QSD 6
+#define NT_TRANS_GET_USER_QUOTA 7
+#define NT_TRANS_SET_USER_QUOTA 8
static const value_string nt_cmd_vals[] = {
- {NT_TRANS_CREATE, "NT CREATE"},
- {NT_TRANS_IOCTL, "NT IOCTL"},
- {NT_TRANS_SSD, "NT SET SECURITY DESC"},
- {NT_TRANS_NOTIFY, "NT NOTIFY"},
- {NT_TRANS_RENAME, "NT RENAME"},
- {NT_TRANS_QSD, "NT QUERY SECURITY DESC"},
+ {NT_TRANS_CREATE, "NT CREATE"},
+ {NT_TRANS_IOCTL, "NT IOCTL"},
+ {NT_TRANS_SSD, "NT SET SECURITY DESC"},
+ {NT_TRANS_NOTIFY, "NT NOTIFY"},
+ {NT_TRANS_RENAME, "NT RENAME"},
+ {NT_TRANS_QSD, "NT QUERY SECURITY DESC"},
+ {NT_TRANS_GET_USER_QUOTA, "NT GET USER QUOTA"},
+ {NT_TRANS_SET_USER_QUOTA, "NT SET USER QUOTA"},
{0, NULL}
};
return offset;
}
-static int
+static void
+free_g_string(void *arg)
+{
+ GString *gstring = arg;
+
+ g_string_free(arg, TRUE);
+}
+
+int
dissect_nt_sid(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *parent_tree, char *name)
{
proto_item *item = NULL;
proto_tree *tree = NULL;
- int old_offset = offset;
+ int old_offset = offset, sa_offset = offset;
+ guint *s_auths = NULL;
+ guint rid;
guint8 revision;
guint8 num_auth;
+ guint auth = 0; /* FIXME: What if it is larger than 32-bits */
int i;
- char str[256], *strp;
+ GString *gstr;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, -1,
offset += 1;
switch(revision){
- case 1: /*only revision of SOD we will se ?*/
+ case 1:
+ case 2: /* Not sure what the different revision numbers mean */
/* number of authorities*/
num_auth = tvb_get_guint8(tvb, offset);
proto_tree_add_item(tree, hf_smb_sid_num_auth, tvb, offset, 1, TRUE);
/* XXX perhaps we should have these thing searchable?
a new FT_xxx thingie? SMB is quite common!*/
/* identifier authorities */
- strp=str;
- *strp=0;
+
+ /* FIXME: We should dynamically allocate the authorities array,
+ which is only one thing. Then we don't have to allocate two
+ strings below etc ...
+ */
+
for(i=0;i<6;i++){
- sprintf(strp,"%s%d-",strp,tvb_get_guint8(tvb, offset));
+ auth = (auth << 8) + tvb_get_guint8(tvb, offset);
+
offset++;
}
- /* sub authorities */
- for(i=0;i<num_auth;i++){
+
+ proto_tree_add_text(tree, tvb, offset - 6, 6, "Authority: %u", auth);
+
+ sa_offset = offset;
+
+ CLEANUP_PUSH(free, s_auths);
+
+ s_auths = g_malloc(sizeof(guint) * num_auth);
+
+ /* sub authorities, leave RID to last */
+ /* FIXME: If we take an exception now, we lose the whole
+ sub-authorities string thang */
+ for(i=0; i < (num_auth > 4?(num_auth - 1):num_auth); i++){
/* XXX should not be letohl but native byteorder according to
samba header files. considering that all non-x86 NT ports
are dead we can (?) assume that non le byte encodings
will be "uncommon"?*/
- sprintf(strp,"%s%d-",strp,tvb_get_letohl(tvb, offset));
+ s_auths[i] = tvb_get_letohl(tvb, offset);
+ offset+=4;
+ }
+
+ CLEANUP_CALL_AND_POP;
+
+ gstr = g_string_new("");
+
+ for (i = 0; i < (num_auth>4?(num_auth - 1):num_auth); i++)
+ g_string_sprintfa(gstr, (i>0 ? "-%u" : "%u"), s_auths[i]);
+
+ proto_tree_add_text(tree, tvb, sa_offset, num_auth * 4, "Sub-authorities: %s", gstr->str);
+
+ if (num_auth > 4) {
+ rid = tvb_get_letohl(tvb, offset);
+ proto_tree_add_text(tree, tvb, offset, 4, "RID: %u", rid);
+ proto_item_append_text(item, ": S-1-%u-%s-%u", auth, gstr->str, rid);
offset+=4;
}
- /* strip trailing '-'*/
- str[strlen(str)-1]=0;
+ else {
+ proto_item_append_text(item, ": S-1-%u-%s", auth, gstr->str);
+ }
- proto_tree_add_text(tree, tvb, offset-6-num_auth*4, 6+num_auth*4, "SID: %s", str);
- proto_item_append_text(item, ": %s", str);
-
}
proto_item_set_len(item, offset-old_offset);
};
#define APPEND_ACE_TEXT(flag, item, string) \
- if(item && flag){ \
- proto_item_append_text(item, string); \
- }
+ if(flag){ \
+ if(item) \
+ proto_item_append_text(item, string, sep); \
+ sep = ", "; \
+ }
static int
dissect_nt_v2_ace_flags(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *parent_tree)
proto_item *item = NULL;
proto_tree *tree = NULL;
guint8 mask;
+ char *sep = " ";
mask = tvb_get_guint8(tvb, offset);
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 1,
- "NT ACE Flags:0x%02x", mask);
+ "NT ACE Flags: 0x%02x", mask);
tree = proto_item_add_subtree(item, ett_smb_ace_flags);
}
proto_tree_add_boolean(tree, hf_smb_ace_flags_failed_access,
tvb, offset, 1, mask);
- APPEND_ACE_TEXT(mask&0x80, item, " Failed Access,");
+ APPEND_ACE_TEXT(mask&0x80, item, "%sFailed Access");
proto_tree_add_boolean(tree, hf_smb_ace_flags_successful_access,
tvb, offset, 1, mask);
- APPEND_ACE_TEXT(mask&0x40, item, " Successful Access,");
+ APPEND_ACE_TEXT(mask&0x40, item, "%sSuccessful Access");
proto_tree_add_boolean(tree, hf_smb_ace_flags_inherited_ace,
tvb, offset, 1, mask);
- APPEND_ACE_TEXT(mask&0x10, item, " Inherited ACE,");
+ APPEND_ACE_TEXT(mask&0x10, item, "%sInherited ACE");
proto_tree_add_boolean(tree, hf_smb_ace_flags_inherit_only,
tvb, offset, 1, mask);
- APPEND_ACE_TEXT(mask&0x08, item, " Inherit Only,");
+ APPEND_ACE_TEXT(mask&0x08, item, "%sInherit Only");
proto_tree_add_boolean(tree, hf_smb_ace_flags_non_propagate_inherit,
tvb, offset, 1, mask);
- APPEND_ACE_TEXT(mask&0x04, item, " No Propagate Inherit,");
+ APPEND_ACE_TEXT(mask&0x04, item, "%sNo Propagate Inherit");
proto_tree_add_boolean(tree, hf_smb_ace_flags_container_inherit,
tvb, offset, 1, mask);
- APPEND_ACE_TEXT(mask&0x02, item, " Container Inherit,");
+ APPEND_ACE_TEXT(mask&0x02, item, "%sContainer Inherit");
proto_tree_add_boolean(tree, hf_smb_ace_flags_object_inherit,
tvb, offset, 1, mask);
- APPEND_ACE_TEXT(mask&0x01, item, " Object Inherit,");
+ APPEND_ACE_TEXT(mask&0x01, item, "%sObject Inherit");
offset += 1;
offset = dissect_nt_access_mask(tvb, pinfo, tree, offset);
/* SID */
- offset = dissect_nt_sid(tvb, pinfo, offset, tree, "SID");
+ offset = dissect_nt_sid(tvb, pinfo, offset, tree, "ACE");
proto_item_set_len(item, offset-old_offset);
return offset;
switch(revision){
case 2: /* only version we will ever see of this structure?*/
+ case 3:
/* size */
proto_tree_add_item(tree, hf_smb_acl_size, tvb, offset, 2, TRUE);
offset += 2;
}
-static int
+int
dissect_nt_sec_desc(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *parent_tree, int len)
{
proto_item *item = NULL;
/* offset to owner sid */
owner_sid_offset = tvb_get_letohl(tvb, offset);
- proto_tree_add_text(tree, tvb, offset, 4, "Offset to owner SID : %d", owner_sid_offset);
+ proto_tree_add_text(tree, tvb, offset, 4, "Offset to owner SID: %d", owner_sid_offset);
offset += 4;
/* offset to group sid */
group_sid_offset = tvb_get_letohl(tvb, offset);
- proto_tree_add_text(tree, tvb, offset, 4, "Offset to group SID : %d", group_sid_offset);
+ proto_tree_add_text(tree, tvb, offset, 4, "Offset to group SID: %d", group_sid_offset);
offset += 4;
/* offset to sacl */
sacl_offset = tvb_get_letohl(tvb, offset);
- proto_tree_add_text(tree, tvb, offset, 4, "Offset to SACL : %d", sacl_offset);
+ proto_tree_add_text(tree, tvb, offset, 4, "Offset to SACL: %d", sacl_offset);
offset += 4;
/* offset to dacl */
dacl_offset = tvb_get_letohl(tvb, offset);
- proto_tree_add_text(tree, tvb, offset, 4, "Offset to DACL : %d", dacl_offset);
+ proto_tree_add_text(tree, tvb, offset, 4, "Offset to DACL: %d", dacl_offset);
offset += 4;
/*owner SID*/
}
static int
-dissect_nt_trans_data_request(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *parent_tree, int len, nt_trans_data *ntd)
+dissect_nt_user_quota(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp)
+{
+ int old_offset, old_sid_offset;
+ guint32 qsize;
+
+ do {
+ old_offset=offset;
+
+ CHECK_BYTE_COUNT_TRANS_SUBR(4);
+ qsize=tvb_get_letohl(tvb, offset);
+ proto_tree_add_uint(tree, hf_smb_user_quota_offset, tvb, offset, 4, qsize);
+ COUNT_BYTES_TRANS_SUBR(4);
+
+ CHECK_BYTE_COUNT_TRANS_SUBR(4);
+ /* length of SID */
+ proto_tree_add_text(tree, tvb, offset, 4, "Length of SID: %d", tvb_get_letohl(tvb, offset));
+ COUNT_BYTES_TRANS_SUBR(4);
+
+ /* 16 unknown bytes */
+ CHECK_BYTE_COUNT_TRANS_SUBR(8);
+ proto_tree_add_item(tree, hf_smb_unknown, tvb,
+ offset, 8, TRUE);
+ COUNT_BYTES_TRANS_SUBR(8);
+
+ /* number of bytes for used quota */
+ CHECK_BYTE_COUNT_TRANS_SUBR(8);
+ proto_tree_add_item(tree, hf_smb_user_quota_used, tvb, offset, 8, TRUE);
+ COUNT_BYTES_TRANS_SUBR(8);
+
+ /* number of bytes for quota warning */
+ CHECK_BYTE_COUNT_TRANS_SUBR(8);
+ proto_tree_add_item(tree, hf_smb_soft_quota_limit, tvb, offset, 8, TRUE);
+ COUNT_BYTES_TRANS_SUBR(8);
+
+ /* number of bytes for quota limit */
+ CHECK_BYTE_COUNT_TRANS_SUBR(8);
+ proto_tree_add_item(tree, hf_smb_hard_quota_limit, tvb, offset, 8, TRUE);
+ COUNT_BYTES_TRANS_SUBR(8);
+
+ /* SID of the user */
+ old_sid_offset=offset;
+ offset = dissect_nt_sid(tvb, pinfo, offset, tree, "Quota");
+ *bcp -= (offset-old_sid_offset);
+
+ if(qsize){
+ offset = old_offset+qsize;
+ }
+ }while(qsize);
+
+
+ return offset;
+}
+
+
+static int
+dissect_nt_trans_data_request(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *parent_tree, int bc, nt_trans_data *ntd)
{
proto_item *item = NULL;
proto_tree *tree = NULL;
smb_info_t *si;
+ int old_offset = offset;
+ guint16 bcp=bc; /* XXX fixme */
si = (smb_info_t *)pinfo->private_data;
if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, len,
+ item = proto_tree_add_text(parent_tree, tvb, offset, bc,
"%s Data",
val_to_str(ntd->subcmd, nt_cmd_vals, "Unknown NT transaction (%u)"));
- tree = proto_item_add_subtree(item, ett_smb_nt_trans_setup);
+ tree = proto_item_add_subtree(item, ett_smb_nt_trans_data);
}
switch(ntd->subcmd){
break;
case NT_TRANS_IOCTL:
/* ioctl data */
- proto_tree_add_item(tree, hf_smb_nt_ioctl_data, tvb, offset, len, TRUE);
- offset += len;
+ proto_tree_add_item(tree, hf_smb_nt_ioctl_data, tvb, offset, bc, TRUE);
+ offset += bc;
break;
case NT_TRANS_SSD:
- offset = dissect_nt_sec_desc(tvb, pinfo, offset, tree, len);
+ offset = dissect_nt_sec_desc(tvb, pinfo, offset, tree, bc);
break;
case NT_TRANS_NOTIFY:
break;
break;
case NT_TRANS_QSD:
break;
+ case NT_TRANS_GET_USER_QUOTA:
+ /* unknown 4 bytes */
+ proto_tree_add_item(tree, hf_smb_unknown, tvb,
+ offset, 4, TRUE);
+ offset += 4;
+
+ /* length of SID */
+ proto_tree_add_text(tree, tvb, offset, 4, "Length of SID: %d", tvb_get_letohl(tvb, offset));
+ offset +=4;
+
+ offset = dissect_nt_sid(tvb, pinfo, offset, tree, "Quota");
+ break;
+ case NT_TRANS_SET_USER_QUOTA:
+ offset = dissect_nt_user_quota(tvb, pinfo, tree, offset, &bcp);
+ break;
+ }
+
+ /* ooops there were data we didnt know how to process */
+ if((offset-old_offset) < bc){
+ proto_tree_add_item(tree, hf_smb_unknown, tvb, offset,
+ bc - (offset-old_offset), TRUE);
+ offset += bc - (offset-old_offset);
}
return offset;
item = proto_tree_add_text(parent_tree, tvb, offset, len,
"%s Parameters",
val_to_str(ntd->subcmd, nt_cmd_vals, "Unknown NT transaction (%u)"));
- tree = proto_item_add_subtree(item, ett_smb_nt_trans_setup);
+ tree = proto_item_add_subtree(item, ett_smb_nt_trans_param);
}
switch(ntd->subcmd){
break;
case NT_TRANS_IOCTL:
break;
- case NT_TRANS_SSD:
+ case NT_TRANS_SSD: {
+ guint16 fid;
+
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* 2 reserved bytes */
/* security information */
offset = dissect_security_information_mask(tvb, pinfo, tree, offset);
break;
+ }
case NT_TRANS_NOTIFY:
break;
case NT_TRANS_RENAME:
/* XXX not documented */
break;
- case NT_TRANS_QSD:
+ case NT_TRANS_QSD: {
+ guint16 fid;
+
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* 2 reserved bytes */
offset = dissect_security_information_mask(tvb, pinfo, tree, offset);
break;
}
+ case NT_TRANS_GET_USER_QUOTA:
+ /* not decoded yet */
+ break;
+ case NT_TRANS_SET_USER_QUOTA:
+ /* not decoded yet */
+ break;
+ }
return offset;
}
switch(ntd->subcmd){
case NT_TRANS_CREATE:
break;
- case NT_TRANS_IOCTL:
+ case NT_TRANS_IOCTL: {
+ guint16 fid;
+
/* function code */
proto_tree_add_item(tree, hf_smb_nt_ioctl_function_code, tvb, offset, 4, TRUE);
offset += 4;
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* isfsctl */
offset = dissect_nt_ioctl_flags(tvb, pinfo, tree, offset);
break;
+ }
case NT_TRANS_SSD:
break;
- case NT_TRANS_NOTIFY:
+ case NT_TRANS_NOTIFY: {
+ guint16 fid;
+
/* completion filter */
offset = dissect_nt_notify_completion_filter(tvb, pinfo, tree, offset);
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
/* watch tree */
offset += 1;
break;
+ }
case NT_TRANS_RENAME:
/* XXX not documented */
break;
case NT_TRANS_QSD:
break;
+ case NT_TRANS_GET_USER_QUOTA:
+ /* not decoded yet */
+ break;
+ case NT_TRANS_SET_USER_QUOTA:
+ /* not decoded yet */
+ break;
}
return old_offset+len;
proto_tree *tree = NULL;
smb_info_t *si;
smb_nt_transact_info_t *nti;
+ guint16 bcp;
si = (smb_info_t *)pinfo->private_data;
if (si->sip != NULL)
item = proto_tree_add_text(parent_tree, tvb, offset, len,
"Unknown NT Transaction Data (matching request not seen)");
}
- tree = proto_item_add_subtree(item, ett_smb_nt_trans_setup);
+ tree = proto_item_add_subtree(item, ett_smb_nt_trans_data);
}
if (nti == NULL) {
*/
offset = dissect_nt_sec_desc(tvb, pinfo, offset, tree, len);
break;
+ case NT_TRANS_GET_USER_QUOTA:
+ bcp=len;
+ offset = dissect_nt_user_quota(tvb, pinfo, tree, offset, &bcp);
+ break;
+ case NT_TRANS_SET_USER_QUOTA:
+ /* not decoded yet */
+ break;
}
return offset;
smb_info_t *si;
smb_nt_transact_info_t *nti;
guint16 fid;
+ int old_offset;
+ guint32 neo;
+ int padcnt;
si = (smb_info_t *)pinfo->private_data;
if (si->sip != NULL)
item = proto_tree_add_text(parent_tree, tvb, offset, len,
"Unknown NT Transaction Parameters (matching request not seen)");
}
- tree = proto_item_add_subtree(item, ett_smb_nt_trans_setup);
+ tree = proto_item_add_subtree(item, ett_smb_nt_trans_param);
}
if (nti == NULL) {
/* create time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Create Time", hf_smb_create_time);
+ hf_smb_create_time);
/* access time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Access Time", hf_smb_access_time);
+ hf_smb_access_time);
/* last write time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Write Time", hf_smb_last_write_time);
+ hf_smb_last_write_time);
/* last change time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Change Time", hf_smb_change_time);
+ hf_smb_change_time);
/* Extended File Attributes */
offset = dissect_file_ext_attr(tvb, pinfo, tree, offset);
break;
case NT_TRANS_NOTIFY:
while(len){
+ old_offset = offset;
+
/* next entry offset */
- proto_tree_add_item(tree, hf_smb_next_entry_offset, tvb, offset, 4, TRUE);
+ neo = tvb_get_letohl(tvb, offset);
+ proto_tree_add_uint(tree, hf_smb_next_entry_offset, tvb, offset, 4, neo);
COUNT_BYTES(4);
len -= 4;
/* broken implementations */
/* broken implementations */
if(len<0)break;
+ if (neo == 0)
+ break; /* no more structures */
+
+ /* skip to next structure */
+ padcnt = (old_offset + neo) - offset;
+ if (padcnt < 0) {
+ /*
+ * XXX - this is bogus; flag it?
+ */
+ padcnt = 0;
+ }
+ if (padcnt != 0) {
+ COUNT_BYTES(padcnt);
+ len -= padcnt;
+ /* broken implementations */
+ if(len<0)break;
+ }
}
break;
case NT_TRANS_RENAME:
proto_tree_add_item(tree, hf_smb_sec_desc_len, tvb, offset, 4, TRUE);
offset += 4;
break;
+ case NT_TRANS_GET_USER_QUOTA:
+ proto_tree_add_text(tree, tvb, offset, 4, "Size of returned Quota data: %d",
+ tvb_get_letohl(tvb, offset));
+ offset += 4;
+ break;
+ case NT_TRANS_SET_USER_QUOTA:
+ /* not decoded yet */
+ break;
}
return offset;
break;
case NT_TRANS_QSD:
break;
+ case NT_TRANS_GET_USER_QUOTA:
+ /* not decoded yet */
+ break;
+ case NT_TRANS_SET_USER_QUOTA:
+ /* not decoded yet */
+ break;
}
return offset;
proto_item *it;
fragment_data *fd;
- it = proto_tree_add_text(tree, tvb, 0, 0, "Fragments");
- tr = proto_item_add_subtree(it, ett_smb_segments);
- for(fd=r_fd->next;fd;fd=fd->next){
- proto_tree_add_text(tr, tvb, 0, 0, "Frame:%u Data:%u-%u",
- fd->frame, fd->offset, fd->offset+fd->len-1);
- }
-
pd_tvb = tvb_new_real_data(r_fd->data, r_fd->datalen,
- r_fd->datalen, "Reassembled SMB");
+ r_fd->datalen);
tvb_set_child_real_data_tvbuff(tvb, pd_tvb);
- pinfo->fd->data_src = g_slist_append(pinfo->fd->data_src, pd_tvb);
+ add_new_data_source(pinfo->fd, pd_tvb, "Reassembled SMB");
pinfo->fragmented = FALSE;
+
+ it = proto_tree_add_text(tree, pd_tvb, 0, -1, "Fragments");
+ tr = proto_item_add_subtree(it, ett_smb_segments);
+ for(fd=r_fd->next;fd;fd=fd->next){
+ proto_tree_add_text(tr, pd_tvb, fd->offset, fd->len,
+ "Frame:%u Data:%u-%u",
+ fd->frame, fd->offset,
+ fd->offset+fd->len-1);
+ }
}
{
int cnt;
guint8 wc;
- guint16 bc;
+ guint16 bc, fid;
WORD_COUNT;
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
offset += 2;
BYTE_COUNT;
/* create time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Create Time", hf_smb_create_time);
+ hf_smb_create_time);
/* access time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Access Time", hf_smb_access_time);
+ hf_smb_access_time);
/* last write time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Write Time", hf_smb_last_write_time);
-
+ hf_smb_last_write_time);
+
/* last change time */
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Change Time", hf_smb_change_time);
+ hf_smb_change_time);
/* Extended File Attributes */
offset = dissect_file_ext_attr(tvb, pinfo, tree, offset);
{ 0x01, "FIND_FIRST2" },
{ 0x02, "FIND_NEXT2" },
{ 0x03, "QUERY_FS_INFORMATION" },
+ { 0x04, "SET_FS_QUOTA" },
{ 0x05, "QUERY_PATH_INFORMATION" },
{ 0x06, "SET_PATH_INFORMATION" },
{ 0x07, "QUERY_FILE_INFORMATION" },
{ 0x0103, "Query FS Size Info"},
{ 0x0104, "Query FS Device Info"},
{ 0x0105, "Query FS Attribute Info"},
+ { 1006, "Query FS Quota Info"},
{0, NULL}
};
}
break;
- case 0x07: /*TRANS2_QUERY_FILE_INFORMATION*/
+ case 0x07: { /*TRANS2_QUERY_FILE_INFORMATION*/
+ guint16 fid;
+
/* fid */
CHECK_BYTE_COUNT_TRANS(2);
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
COUNT_BYTES_TRANS(2);
/* level of interest */
COUNT_BYTES_TRANS(2);
break;
- case 0x08: /*TRANS2_SET_FILE_INFORMATION*/
+ }
+ case 0x08: { /*TRANS2_SET_FILE_INFORMATION*/
+ guint16 fid;
+
/* fid */
CHECK_BYTE_COUNT_TRANS(2);
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
COUNT_BYTES_TRANS(2);
/* level of interest */
COUNT_BYTES_TRANS(2);
break;
+ }
case 0x09: /*TRANS2_FSCTL*/
case 0x0a: /*TRANS2_IOCTL2*/
/* these calls have no parameter block in the request */
/* create time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Create", hf_smb_create_time);
+ hf_smb_create_time);
*bcp -= 8;
/* access time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Access Time", hf_smb_access_time);
+ hf_smb_access_time);
*bcp -= 8;
/* last write time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Write Time", hf_smb_last_write_time);
+ hf_smb_last_write_time);
*bcp -= 8;
/* last change time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Change Time", hf_smb_change_time);
+ hf_smb_change_time);
*bcp -= 8;
/* File Attributes */
}
+static const true_false_string tfs_quota_flags_deny_disk = {
+ "DENY DISK SPACE for users exceeding quota limit",
+ "Do NOT deny disk space for users exceeding quota limit"
+};
+static const true_false_string tfs_quota_flags_log_limit = {
+ "LOG EVENT when a user exceeds their QUOTA LIMIT",
+ "Do NOT log event when a user exceeds their quota limit"
+};
+static const true_false_string tfs_quota_flags_log_warning = {
+ "LOG EVENT when a user exceeds their WARNING LEVEL",
+ "Do NOT log event when a user exceeds their warning level"
+};
+static const true_false_string tfs_quota_flags_enabled = {
+ "Quotas are ENABLED of this fs",
+ "Quotas are NOT enabled on this fs"
+};
+static void
+dissect_quota_flags(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, int offset)
+{
+ guint8 mask;
+ proto_item *item = NULL;
+ proto_tree *tree = NULL;
+
+ mask = tvb_get_guint8(tvb, offset);
+
+ if(parent_tree){
+ item = proto_tree_add_text(parent_tree, tvb, offset, 1,
+ "Quota Flags: 0x%02x %s", mask,
+ mask?"Enabled":"Disabled");
+ tree = proto_item_add_subtree(item, ett_smb_quotaflags);
+ }
+
+ proto_tree_add_boolean(tree, hf_smb_quota_flags_log_limit,
+ tvb, offset, 1, mask);
+ proto_tree_add_boolean(tree, hf_smb_quota_flags_log_warning,
+ tvb, offset, 1, mask);
+ proto_tree_add_boolean(tree, hf_smb_quota_flags_deny_disk,
+ tvb, offset, 1, mask);
+
+ if(mask && (!(mask&0x01))){
+ proto_tree_add_boolean_hidden(tree, hf_smb_quota_flags_enabled,
+ tvb, offset, 1, 0x01);
+ } else {
+ proto_tree_add_boolean(tree, hf_smb_quota_flags_enabled,
+ tvb, offset, 1, mask);
+ }
+
+}
+
+static int
+dissect_nt_quota(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp)
+{
+ /* first 24 bytes are unknown */
+ CHECK_BYTE_COUNT_TRANS_SUBR(24);
+ proto_tree_add_item(tree, hf_smb_unknown, tvb,
+ offset, 24, TRUE);
+ COUNT_BYTES_TRANS_SUBR(24);
+
+ /* number of bytes for quota warning */
+ CHECK_BYTE_COUNT_TRANS_SUBR(8);
+ proto_tree_add_item(tree, hf_smb_soft_quota_limit, tvb, offset, 8, TRUE);
+ COUNT_BYTES_TRANS_SUBR(8);
+
+ /* number of bytes for quota limit */
+ CHECK_BYTE_COUNT_TRANS_SUBR(8);
+ proto_tree_add_item(tree, hf_smb_hard_quota_limit, tvb, offset, 8, TRUE);
+ COUNT_BYTES_TRANS_SUBR(8);
+
+ /* one byte of quota flags */
+ CHECK_BYTE_COUNT_TRANS_SUBR(1);
+ dissect_quota_flags(tvb, pinfo, tree, offset);
+ COUNT_BYTES_TRANS_SUBR(1);
+
+ /* these 7 bytes are unknown */
+ CHECK_BYTE_COUNT_TRANS_SUBR(7);
+ proto_tree_add_item(tree, hf_smb_unknown, tvb,
+ offset, 7, TRUE);
+ COUNT_BYTES_TRANS_SUBR(7);
+
+ return offset;
+}
+
static int
dissect_transaction2_request_data(tvbuff_t *tvb, packet_info *pinfo,
proto_tree *parent_tree, int offset, int subcmd, guint16 dc)
case 0x03: /*TRANS2_QUERY_FS_INFORMATION*/
/* no data field in this request */
break;
+ case 0x04: /* TRANS2_SET_QUOTA */
+ offset = dissect_nt_quota(tvb, pinfo, tree, offset, &dc);
+ break;
case 0x05: /*TRANS2_QUERY_PATH_INFORMATION*/
/* no data field in this request */
break;
offset += 2;
if(si->cmd==SMB_COM_TRANSACTION2){
+ guint16 fid;
+
/* fid */
- proto_tree_add_item(tree, hf_smb_fid, tvb, offset, 2, TRUE);
+ fid = tvb_get_letohs(tvb, offset);
+ add_fid(tvb, pinfo, tree, offset, 2, fid);
+
offset += 2;
}
/* create time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Create Time", hf_smb_create_time);
+ hf_smb_create_time);
*bcp -= 8;
/* access time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Access Time", hf_smb_access_time);
+ hf_smb_access_time);
*bcp -= 8;
/* last write time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Write Time", hf_smb_last_write_time);
+ hf_smb_last_write_time);
*bcp -= 8;
/* last change time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Change Time", hf_smb_change_time);
+ hf_smb_change_time);
*bcp -= 8;
/* end of file */
/* create time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Create Time", hf_smb_create_time);
+ hf_smb_create_time);
*bcp -= 8;
/* access time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Access Time", hf_smb_access_time);
+ hf_smb_access_time);
*bcp -= 8;
/* last write time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Write Time", hf_smb_last_write_time);
+ hf_smb_last_write_time);
*bcp -= 8;
/* last change time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Change Time", hf_smb_change_time);
+ hf_smb_change_time);
*bcp -= 8;
/* end of file */
/* create time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Create Time", hf_smb_create_time);
+ hf_smb_create_time);
*bcp -= 8;
/* access time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Access Time", hf_smb_access_time);
+ hf_smb_access_time);
*bcp -= 8;
/* last write time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Write Time", hf_smb_last_write_time);
+ hf_smb_last_write_time);
*bcp -= 8;
/* last change time */
CHECK_BYTE_COUNT_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Change Time", hf_smb_change_time);
+ hf_smb_change_time);
*bcp -= 8;
/* end of file */
return offset;
}
-
/*dissect the data block for TRANS2_QUERY_FS_INFORMATION*/
static int
dissect_qfsi_vals(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree,
/* create time */
CHECK_BYTE_COUNT_TRANS_SUBR(8);
offset = dissect_smb_64bit_time(tvb, pinfo, tree, offset,
- "Create Time", hf_smb_create_time);
+ hf_smb_create_time);
*bcp -= 8;
/* volume serial number */
COUNT_BYTES_TRANS_SUBR(fn_len);
break;
+ case 1006: /* QUERY_FS_QUOTA_INFO */
+ offset = dissect_nt_quota(tvb, pinfo, tree, offset, bcp);
}
return offset;
proto_tree *tr;
proto_item *it;
fragment_data *fd;
-
- it = proto_tree_add_text(tree, tvb, 0, 0, "Fragments");
- tr = proto_item_add_subtree(it, ett_smb_segments);
- for(fd=r_fd->next;fd;fd=fd->next){
- proto_tree_add_text(tr, tvb, 0, 0, "Frame:%u Data:%u-%u",
- fd->frame, fd->offset, fd->offset+fd->len-1);
- }
-
+
pd_tvb = tvb_new_real_data(r_fd->data, r_fd->datalen,
- r_fd->datalen, "Reassembled SMB");
+ r_fd->datalen);
tvb_set_child_real_data_tvbuff(tvb, pd_tvb);
- pinfo->fd->data_src = g_slist_append(pinfo->fd->data_src, pd_tvb);
+ add_new_data_source(pinfo->fd, pd_tvb, "Reassembled SMB");
pinfo->fragmented = FALSE;
+
+ it = proto_tree_add_text(tree, pd_tvb, 0, -1, "Fragments");
+ tr = proto_item_add_subtree(it, ett_smb_segments);
+ for(fd=r_fd->next;fd;fd=fd->next){
+ proto_tree_add_text(tr, pd_tvb, fd->offset, fd->len,
+ "Frame:%u Data:%u-%u",
+ fd->frame, fd->offset,
+ fd->offset+fd->len-1);
+ }
}
int (*response)(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, proto_tree *smb_tree);
} smb_function;
-smb_function smb_dissector[256] = {
+static smb_function smb_dissector[256] = {
/* 0x00 Create Dir*/ {dissect_old_dir_request, dissect_empty},
/* 0x01 Delete Dir*/ {dissect_old_dir_request, dissect_empty},
/* 0x02 Open File*/ {dissect_open_file_request, dissect_open_file_response},
g_hash_table_destroy(ct->matched);
if (ct->dcerpc_fid_to_frame)
g_hash_table_destroy(ct->dcerpc_fid_to_frame);
+ if (ct->tid_service)
+ g_hash_table_destroy(ct->tid_service);
}
static void
const gchar *string;
int string_len;
smb_info_t *si;
- int copylen;
+ unsigned int copylen;
if (*bcp == 0) {
/* Not enough data in buffer */
{SMBE_nosuchshare, "Requested share does not exist"},
{SMBE_filexists, "File in operation already exists"},
{SMBE_cannotopen, "Cannot open the file specified"},
- {SMBE_unknownlevel, "Unknown level??"},
+ {SMBE_unknownlevel, "Unknown info level"},
+ {SMBE_invalidname, "Invalid name"},
{SMBE_badpipe, "Named pipe invalid"},
{SMBE_pipebusy, "All instances of pipe are busy"},
{SMBE_pipeclosing, "Named pipe close in progress"},
{SMBE_invalidenvironment, "Invalid environment"},
{SMBE_printerdriverinuse, "Printer driver in use"},
{SMBE_invalidparam, "Invalid parameter"},
+ {SMBE_invalidformsize, "Invalid form size"},
{0, NULL}
};
}
+
+/* These are the MS country codes from
+
+ http://www.unicode.org/unicode/onlinedat/countries.html
+
+ For countries that share the same number, I choose to use only the
+ name of the largest country. Apologies for this. If this offends you,
+ here is the table to change that.
+
+ This also includes the code of 0 for "Default", which isn't in
+ that list, but is in Microsoft's SDKs and the Cygnus "winnls.h"
+ header file. Presumably it means "don't override the setting
+ on the user's machine".
+
+ Future versions of Microsoft's "winnls.h" header file might include
+ additional codes; the current version matches the Unicode Consortium's
+ table.
+*/
+const value_string ms_country_codes[] = {
+ { 0, "Default"},
+ { 1, "USA"},
+ { 2, "Canada"},
+ { 7, "Russia"},
+ { 20, "Egypt"},
+ { 27, "South Africa"},
+ { 30, "Greece"},
+ { 31, "Netherlands"},
+ { 32, "Belgium"},
+ { 33, "France"},
+ { 34, "Spain"},
+ { 36, "Hungary"},
+ { 39, "Italy"},
+ { 40, "Romania"},
+ { 41, "Switzerland"},
+ { 43, "Austria"},
+ { 44, "United Kingdom"},
+ { 45, "Denmark"},
+ { 46, "Sweden"},
+ { 47, "Norway"},
+ { 48, "Poland"},
+ { 49, "Germany"},
+ { 51, "Peru"},
+ { 52, "Mexico"},
+ { 54, "Argentina"},
+ { 55, "Brazil"},
+ { 56, "Chile"},
+ { 57, "Colombia"},
+ { 58, "Venezuela"},
+ { 60, "Malaysia"},
+ { 61, "Australia"},
+ { 62, "Indonesia"},
+ { 63, "Philippines"},
+ { 64, "New Zealand"},
+ { 65, "Singapore"},
+ { 66, "Thailand"},
+ { 81, "Japan"},
+ { 82, "South Korea"},
+ { 84, "Viet Nam"},
+ { 86, "China"},
+ { 90, "Turkey"},
+ { 91, "India"},
+ { 92, "Pakistan"},
+ {212, "Morocco"},
+ {213, "Algeria"},
+ {216, "Tunisia"},
+ {218, "Libya"},
+ {254, "Kenya"},
+ {263, "Zimbabwe"},
+ {298, "Faroe Islands"},
+ {351, "Portugal"},
+ {352, "Luxembourg"},
+ {353, "Ireland"},
+ {354, "Iceland"},
+ {355, "Albania"},
+ {358, "Finland"},
+ {359, "Bulgaria"},
+ {370, "Lithuania"},
+ {371, "Latvia"},
+ {372, "Estonia"},
+ {374, "Armenia"},
+ {375, "Belarus"},
+ {380, "Ukraine"},
+ {381, "Serbia"},
+ {385, "Croatia"},
+ {386, "Slovenia"},
+ {389, "Macedonia"},
+ {420, "Czech Republic"},
+ {421, "Slovak Republic"},
+ {501, "Belize"},
+ {502, "Guatemala"},
+ {503, "El Salvador"},
+ {504, "Honduras"},
+ {505, "Nicaragua"},
+ {506, "Costa Rica"},
+ {507, "Panama"},
+ {591, "Bolivia"},
+ {593, "Ecuador"},
+ {595, "Paraguay"},
+ {598, "Uruguay"},
+ {673, "Brunei Darussalam"},
+ {852, "Hong Kong"},
+ {853, "Macau"},
+ {886, "Taiwan"},
+ {960, "Maldives"},
+ {961, "Lebanon"},
+ {962, "Jordan"},
+ {963, "Syria"},
+ {964, "Iraq"},
+ {965, "Kuwait"},
+ {966, "Saudi Arabia"},
+ {967, "Yemen"},
+ {968, "Oman"},
+ {971, "United Arab Emirates"},
+ {972, "Israel"},
+ {973, "Bahrain"},
+ {974, "Qatar"},
+ {976, "Mongolia"},
+ {981, "Iran"},
+ {994, "Azerbaijan"},
+ {995, "Georgia"},
+ {996, "Kyrgyzstan"},
+
+ {0, NULL}
+};
+
/*
* NT error codes.
*
guint32 nt_status = 0;
guint8 errclass = 0;
guint16 errcode = 0;
- guint16 uid, pid, tid, mid;
guint32 pid_mid;
conversation_t *conversation;
} else {
si.unicode = FALSE;
}
- tid = tvb_get_letohs(tvb, offset+24);
- pid = tvb_get_letohs(tvb, offset+26);
- uid = tvb_get_letohs(tvb, offset+28);
- mid = tvb_get_letohs(tvb, offset+30);
- pid_mid = (pid << 16) | mid;
+ si.tid = tvb_get_letohs(tvb, offset+24);
+ si.pid = tvb_get_letohs(tvb, offset+26);
+ si.uid = tvb_get_letohs(tvb, offset+28);
+ si.mid = tvb_get_letohs(tvb, offset+30);
+ pid_mid = (si.pid << 16) | si.mid;
si.info_level = -1;
si.info_count = -1;
si.ct->dcerpc_fid_to_frame=g_hash_table_new(
smb_saved_info_hash_unmatched,
smb_saved_info_equal_unmatched);
+ si.ct->tid_service=g_hash_table_new(
+ smb_saved_info_hash_unmatched,
+ smb_saved_info_equal_unmatched);
conversation_add_proto_data(conversation, proto_smb, si.ct);
}
if( (si.request)
- && (mid==0)
- && (uid==0)
- && (pid==0)
- && (tid==0) ){
+ && (si.mid==0)
+ && (si.uid==0)
+ && (si.pid==0)
+ && (si.tid==0) ){
/* this is a broadcast SMB packet, there will not be a reply.
We dont need to do anything
*/
*/
sip=g_hash_table_lookup(si.ct->unmatched, (void *)pid_mid);
if(sip!=NULL){
- if(si.request){
- /* ok, we are processing an SMB
- request but there was already
- another "identical" smb resuest
- we had not matched yet.
- This must mean that either we have
- a retransmission or that the
- response to the previous one was
- lost and the client has reused
- the MID for this conversation.
- In either case it's not much more
- we can do than forget the old
- request and concentrate on the
+ gboolean cmd_match=FALSE;
+
+ /*
+ * Make sure the SMB we found was the
+ * same command, or a different command
+ * that's another valid type of reply
+ * to that command.
+ */
+ if(si.cmd==sip->cmd){
+ cmd_match=TRUE;
+ }
+ else if(si.cmd==SMB_COM_NT_CANCEL){
+ cmd_match=TRUE;
+ }
+ else if((si.cmd==SMB_COM_TRANSACTION_SECONDARY)
+ && (sip->cmd==SMB_COM_TRANSACTION)){
+ cmd_match=TRUE;
+ }
+ else if((si.cmd==SMB_COM_TRANSACTION2_SECONDARY)
+ && (sip->cmd==SMB_COM_TRANSACTION2)){
+ cmd_match=TRUE;
+ }
+ else if((si.cmd==SMB_COM_NT_TRANSACT_SECONDARY)
+ && (sip->cmd==SMB_COM_NT_TRANSACT)){
+ cmd_match=TRUE;
+ }
+
+ if( (si.request) || (!cmd_match) ) {
+ /* If we are processing an SMB request but there was already
+ another "identical" smb resuest we had not matched yet.
+ This must mean that either we have a retransmission or that the
+ response to the previous one was lost and the client has reused
+ the MID for this conversation. In either case it's not much more
+ we can do than forget the old request and concentrate on the
present one instead.
+
+ We also do this cleanup if we see that the cmd in the original
+ request in sip->cmd is not compatible with the current cmd.
+ This is to prevent matching errors such as if there were two
+ SMBs of different cmds but with identical MID and PID values and
+ if ethereal lost the first reply and the second request.
*/
g_hash_table_remove(si.ct->unmatched, (void *)pid_mid);
+ sip=NULL; /* XXX should free it as well */
} else {
/* we have found a response to some request we have seen earlier.
What we do now depends on whether this is the first response
sip = g_mem_chunk_alloc(smb_saved_info_chunk);
sip->frame_req = pinfo->fd->num;
sip->frame_res = 0;
+ sip->flags = 0;
+ if(g_hash_table_lookup(si.ct->tid_service, (void *)si.tid)
+ == (void *)TID_IPC) {
+ sip->flags |= SMB_SIF_TID_IS_IPC;
+ }
+ sip->cmd = si.cmd;
sip->extra_info = NULL;
g_hash_table_insert(si.ct->unmatched, (void *)pid_mid, sip);
}
offset += 12;
/* TID */
- proto_tree_add_uint(htree, hf_smb_tid, tvb, offset, 2, tid);
+ proto_tree_add_uint(htree, hf_smb_tid, tvb, offset, 2, si.tid);
offset += 2;
/* PID */
- proto_tree_add_uint(htree, hf_smb_pid, tvb, offset, 2, pid);
+ proto_tree_add_uint(htree, hf_smb_pid, tvb, offset, 2, si.pid);
offset += 2;
/* UID */
- proto_tree_add_uint(htree, hf_smb_uid, tvb, offset, 2, uid);
+ proto_tree_add_uint(htree, hf_smb_uid, tvb, offset, 2, si.uid);
offset += 2;
/* MID */
- proto_tree_add_uint(htree, hf_smb_mid, tvb, offset, 2, mid);
+ proto_tree_add_uint(htree, hf_smb_mid, tvb, offset, 2, si.mid);
offset += 2;
pinfo->private_data = &si;
*/
col_append_fstr(
pinfo->cinfo, COL_INFO, ", Error: %s",
- val_to_str(nt_status, NT_errors, "%s"));
+ val_to_str(nt_status, NT_errors,
+ "Unknown (0x%08X)"));
}
} else {
/*
NULL, 0, "Unique token identifying this session", HFILL }},
{ &hf_smb_server_timezone,
- { "Time Zone", "smb.server.timezone", FT_INT16, BASE_DEC,
+ { "Time Zone", "smb.server_timezone", FT_INT16, BASE_DEC,
NULL, 0, "Current timezone at server.", HFILL }},
{ &hf_smb_encryption_key_length,
NULL, 0, "Maximum raw buffer size", HFILL }},
{ &hf_smb_server_guid,
- { "Server GUID", "smb.server.guid", FT_BYTES, BASE_HEX,
+ { "Server GUID", "smb.server_guid", FT_BYTES, BASE_HEX,
NULL, 0, "Globally unique identifier for this server", HFILL }},
{ &hf_smb_security_blob_len,
NULL, 0, "Current time at server, SMB_TIME format", HFILL }},
{ &hf_smb_server_cap_raw_mode,
- { "Raw Mode", "smb.server.cap.raw_mode", FT_BOOLEAN, 32,
+ { "Raw Mode", "smb.server_cap.raw_mode", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_raw_mode), SERVER_CAP_RAW_MODE, "Are Raw Read and Raw Write supported?", HFILL }},
{ &hf_smb_server_cap_mpx_mode,
- { "MPX Mode", "smb.server.cap.mpx_mode", FT_BOOLEAN, 32,
+ { "MPX Mode", "smb.server_cap.mpx_mode", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_mpx_mode), SERVER_CAP_MPX_MODE, "Are Read Mpx and Write Mpx supported?", HFILL }},
{ &hf_smb_server_cap_unicode,
- { "Unicode", "smb.server.cap.unicode", FT_BOOLEAN, 32,
+ { "Unicode", "smb.server_cap.unicode", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_unicode), SERVER_CAP_UNICODE, "Are Unicode strings supported?", HFILL }},
{ &hf_smb_server_cap_large_files,
- { "Large Files", "smb.server.cap.large_files", FT_BOOLEAN, 32,
+ { "Large Files", "smb.server_cap.large_files", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_large_files), SERVER_CAP_LARGE_FILES, "Are large files (>4GB) supported?", HFILL }},
{ &hf_smb_server_cap_nt_smbs,
- { "NT SMBs", "smb.server.cap.nt_smbs", FT_BOOLEAN, 32,
+ { "NT SMBs", "smb.server_cap.nt_smbs", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_nt_smbs), SERVER_CAP_NT_SMBS, "Are NT SMBs supported?", HFILL }},
{ &hf_smb_server_cap_rpc_remote_apis,
- { "RPC Remote APIs", "smb.server.cap.rpc_remote_apis", FT_BOOLEAN, 32,
+ { "RPC Remote APIs", "smb.server_cap.rpc_remote_apis", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_rpc_remote_apis), SERVER_CAP_RPC_REMOTE_APIS, "Are RPC Remote APIs supported?", HFILL }},
{ &hf_smb_server_cap_nt_status,
- { "NT Status Codes", "smb.server.cap.nt_status", FT_BOOLEAN, 32,
+ { "NT Status Codes", "smb.server_cap.nt_status", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_nt_status), SERVER_CAP_STATUS32, "Are NT Status Codes supported?", HFILL }},
{ &hf_smb_server_cap_level_ii_oplocks,
- { "Level 2 Oplocks", "smb.server.cap.level_2_oplocks", FT_BOOLEAN, 32,
+ { "Level 2 Oplocks", "smb.server_cap.level_2_oplocks", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_level_ii_oplocks), SERVER_CAP_LEVEL_II_OPLOCKS, "Are Level 2 oplocks supported?", HFILL }},
{ &hf_smb_server_cap_lock_and_read,
- { "Lock and Read", "smb.server.cap.lock_and_read", FT_BOOLEAN, 32,
+ { "Lock and Read", "smb.server_cap.lock_and_read", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_lock_and_read), SERVER_CAP_LOCK_AND_READ, "Is Lock and Read supported?", HFILL }},
{ &hf_smb_server_cap_nt_find,
- { "NT Find", "smb.server.cap.nt_find", FT_BOOLEAN, 32,
+ { "NT Find", "smb.server_cap.nt_find", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_nt_find), SERVER_CAP_NT_FIND, "Is NT Find supported?", HFILL }},
{ &hf_smb_server_cap_dfs,
- { "Dfs", "smb.server.cap.dfs", FT_BOOLEAN, 32,
+ { "Dfs", "smb.server_cap.dfs", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_dfs), SERVER_CAP_DFS, "Is Dfs supported?", HFILL }},
{ &hf_smb_server_cap_infolevel_passthru,
- { "Infolevel Passthru", "smb.server.cap.infolevel_passthru", FT_BOOLEAN, 32,
+ { "Infolevel Passthru", "smb.server_cap.infolevel_passthru", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_infolevel_passthru), SERVER_CAP_INFOLEVEL_PASSTHRU, "Is NT information level request passthrough supported?", HFILL }},
{ &hf_smb_server_cap_large_readx,
- { "Large ReadX", "smb.server.cap.large_readx", FT_BOOLEAN, 32,
+ { "Large ReadX", "smb.server_cap.large_readx", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_large_readx), SERVER_CAP_LARGE_READX, "Is Large Read andX supported?", HFILL }},
{ &hf_smb_server_cap_large_writex,
- { "Large WriteX", "smb.server.cap.large_writex", FT_BOOLEAN, 32,
+ { "Large WriteX", "smb.server_cap.large_writex", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_large_writex), SERVER_CAP_LARGE_WRITEX, "Is Large Write andX supported?", HFILL }},
{ &hf_smb_server_cap_unix,
- { "UNIX", "smb.server.cap.unix", FT_BOOLEAN, 32,
+ { "UNIX", "smb.server_cap.unix", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_unix), SERVER_CAP_UNIX , "Are UNIX extensions supported?", HFILL }},
{ &hf_smb_server_cap_reserved,
- { "Reserved", "smb.server.cap.reserved", FT_BOOLEAN, 32,
+ { "Reserved", "smb.server_cap.reserved", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_reserved), SERVER_CAP_RESERVED, "RESERVED", HFILL }},
{ &hf_smb_server_cap_bulk_transfer,
- { "Bulk Transfer", "smb.server.cap.bulk_transfer", FT_BOOLEAN, 32,
+ { "Bulk Transfer", "smb.server_cap.bulk_transfer", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_bulk_transfer), SERVER_CAP_BULK_TRANSFER, "Are Bulk Read and Bulk Write supported?", HFILL }},
{ &hf_smb_server_cap_compressed_data,
- { "Compressed Data", "smb.server.cap.compressed_data", FT_BOOLEAN, 32,
+ { "Compressed Data", "smb.server_cap.compressed_data", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_compressed_data), SERVER_CAP_COMPRESSED_DATA, "Is compressed data transfer supported?", HFILL }},
{ &hf_smb_server_cap_extended_security,
- { "Extended Security", "smb.server.cap.extended_security", FT_BOOLEAN, 32,
+ { "Extended Security", "smb.server_cap.extended_security", FT_BOOLEAN, 32,
TFS(&tfs_server_cap_extended_security), SERVER_CAP_EXTENDED_SECURITY, "Are Extended security exchanges supported?", HFILL }},
{ &hf_smb_system_time,
NULL, 0, "FID: File ID", HFILL }},
{ &hf_smb_file_attr_read_only_16bit,
- { "Read Only", "smb.file.attribute.read_only", FT_BOOLEAN, 16,
+ { "Read Only", "smb.file_attribute.read_only", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_read_only), FILE_ATTRIBUTE_READ_ONLY, "READ ONLY file attribute", HFILL }},
{ &hf_smb_file_attr_read_only_8bit,
- { "Read Only", "smb.file.attribute.read_only", FT_BOOLEAN, 8,
+ { "Read Only", "smb.file_attribute.read_only", FT_BOOLEAN, 8,
TFS(&tfs_file_attribute_read_only), FILE_ATTRIBUTE_READ_ONLY, "READ ONLY file attribute", HFILL }},
{ &hf_smb_file_attr_hidden_16bit,
- { "Hidden", "smb.file.attribute.hidden", FT_BOOLEAN, 16,
+ { "Hidden", "smb.file_attribute.hidden", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_hidden), FILE_ATTRIBUTE_HIDDEN, "HIDDEN file attribute", HFILL }},
{ &hf_smb_file_attr_hidden_8bit,
- { "Hidden", "smb.file.attribute.hidden", FT_BOOLEAN, 8,
+ { "Hidden", "smb.file_attribute.hidden", FT_BOOLEAN, 8,
TFS(&tfs_file_attribute_hidden), FILE_ATTRIBUTE_HIDDEN, "HIDDEN file attribute", HFILL }},
{ &hf_smb_file_attr_system_16bit,
- { "System", "smb.file.attribute.system", FT_BOOLEAN, 16,
+ { "System", "smb.file_attribute.system", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_system), FILE_ATTRIBUTE_SYSTEM, "SYSTEM file attribute", HFILL }},
{ &hf_smb_file_attr_system_8bit,
- { "System", "smb.file.attribute.system", FT_BOOLEAN, 8,
+ { "System", "smb.file_attribute.system", FT_BOOLEAN, 8,
TFS(&tfs_file_attribute_system), FILE_ATTRIBUTE_SYSTEM, "SYSTEM file attribute", HFILL }},
{ &hf_smb_file_attr_volume_16bit,
- { "Volume ID", "smb.file.attribute.volume", FT_BOOLEAN, 16,
+ { "Volume ID", "smb.file_attribute.volume", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_volume), FILE_ATTRIBUTE_VOLUME, "VOLUME file attribute", HFILL }},
{ &hf_smb_file_attr_volume_8bit,
- { "Volume ID", "smb.file.attribute.volume", FT_BOOLEAN, 8,
+ { "Volume ID", "smb.file_attribute.volume", FT_BOOLEAN, 8,
TFS(&tfs_file_attribute_volume), FILE_ATTRIBUTE_VOLUME, "VOLUME ID file attribute", HFILL }},
{ &hf_smb_file_attr_directory_16bit,
- { "Directory", "smb.file.attribute.directory", FT_BOOLEAN, 16,
+ { "Directory", "smb.file_attribute.directory", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_directory), FILE_ATTRIBUTE_DIRECTORY, "DIRECTORY file attribute", HFILL }},
{ &hf_smb_file_attr_directory_8bit,
- { "Directory", "smb.file.attribute.directory", FT_BOOLEAN, 8,
+ { "Directory", "smb.file_attribute.directory", FT_BOOLEAN, 8,
TFS(&tfs_file_attribute_directory), FILE_ATTRIBUTE_DIRECTORY, "DIRECTORY file attribute", HFILL }},
{ &hf_smb_file_attr_archive_16bit,
- { "Archive", "smb.file.attribute.archive", FT_BOOLEAN, 16,
+ { "Archive", "smb.file_attribute.archive", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_archive), FILE_ATTRIBUTE_ARCHIVE, "ARCHIVE file attribute", HFILL }},
{ &hf_smb_file_attr_archive_8bit,
- { "Archive", "smb.file.attribute.archive", FT_BOOLEAN, 8,
+ { "Archive", "smb.file_attribute.archive", FT_BOOLEAN, 8,
TFS(&tfs_file_attribute_archive), FILE_ATTRIBUTE_ARCHIVE, "ARCHIVE file attribute", HFILL }},
{ &hf_smb_file_attr_device,
- { "Device", "smb.file.attribute.device", FT_BOOLEAN, 16,
+ { "Device", "smb.file_attribute.device", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_device), FILE_ATTRIBUTE_DEVICE, "Is this file a device?", HFILL }},
{ &hf_smb_file_attr_normal,
- { "Normal", "smb.file.attribute.normal", FT_BOOLEAN, 16,
+ { "Normal", "smb.file_attribute.normal", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_normal), FILE_ATTRIBUTE_NORMAL, "Is this a normal file?", HFILL }},
{ &hf_smb_file_attr_temporary,
- { "Temporary", "smb.file.attribute.temporary", FT_BOOLEAN, 16,
+ { "Temporary", "smb.file_attribute.temporary", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_temporary), FILE_ATTRIBUTE_TEMPORARY, "Is this a temporary file?", HFILL }},
{ &hf_smb_file_attr_sparse,
- { "Sparse", "smb.file.attribute.sparse", FT_BOOLEAN, 16,
+ { "Sparse", "smb.file_attribute.sparse", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_sparse), FILE_ATTRIBUTE_SPARSE, "Is this a sparse file?", HFILL }},
{ &hf_smb_file_attr_reparse,
- { "Reparse Point", "smb.file.attribute.reparse", FT_BOOLEAN, 16,
+ { "Reparse Point", "smb.file_attribute.reparse", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_reparse), FILE_ATTRIBUTE_REPARSE, "Does this file have an associated reparse point?", HFILL }},
{ &hf_smb_file_attr_compressed,
- { "Compressed", "smb.file.attribute.compressed", FT_BOOLEAN, 16,
+ { "Compressed", "smb.file_attribute.compressed", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_compressed), FILE_ATTRIBUTE_COMPRESSED, "Is this file compressed?", HFILL }},
{ &hf_smb_file_attr_offline,
- { "Offline", "smb.file.attribute.offline", FT_BOOLEAN, 16,
+ { "Offline", "smb.file_attribute.offline", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_offline), FILE_ATTRIBUTE_OFFLINE, "Is this file offline?", HFILL }},
{ &hf_smb_file_attr_not_content_indexed,
- { "Content Indexed", "smb.file.attribute.not_content_indexed", FT_BOOLEAN, 16,
+ { "Content Indexed", "smb.file_attribute.not_content_indexed", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_not_content_indexed), FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, "May this file be indexed by the content indexing service", HFILL }},
{ &hf_smb_file_attr_encrypted,
- { "Encrypted", "smb.file.attribute.encrypted", FT_BOOLEAN, 16,
+ { "Encrypted", "smb.file_attribute.encrypted", FT_BOOLEAN, 16,
TFS(&tfs_file_attribute_encrypted), FILE_ATTRIBUTE_ENCRYPTED, "Is this file encrypted?", HFILL }},
{ &hf_smb_file_size,
- { "File Size", "smb.file.size", FT_UINT32, BASE_DEC,
+ { "File Size", "smb.file_size", FT_UINT32, BASE_DEC,
NULL, 0, "File Size", HFILL }},
{ &hf_smb_search_attribute_read_only,
NULL, 0, "Padding or unknown data", HFILL }},
{ &hf_smb_file_data,
- { "File Data", "smb.file.data", FT_BYTES, BASE_HEX,
+ { "File Data", "smb.file_data", FT_BYTES, BASE_HEX,
NULL, 0, "Data read/written to the file", HFILL }},
{ &hf_smb_total_data_len,
TFS(&tfs_nt_share_access_delete), 0x00000004, "", HFILL }},
{ &hf_smb_file_eattr_read_only,
- { "Read Only", "smb.file.attribute.read_only", FT_BOOLEAN, 32,
+ { "Read Only", "smb.file_attribute.read_only", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_read_only), FILE_ATTRIBUTE_READ_ONLY, "READ ONLY file attribute", HFILL }},
{ &hf_smb_file_eattr_hidden,
- { "Hidden", "smb.file.attribute.hidden", FT_BOOLEAN, 32,
+ { "Hidden", "smb.file_attribute.hidden", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_hidden), FILE_ATTRIBUTE_HIDDEN, "HIDDEN file attribute", HFILL }},
{ &hf_smb_file_eattr_system,
- { "System", "smb.file.attribute.system", FT_BOOLEAN, 32,
+ { "System", "smb.file_attribute.system", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_system), FILE_ATTRIBUTE_SYSTEM, "SYSTEM file attribute", HFILL }},
{ &hf_smb_file_eattr_volume,
- { "Volume ID", "smb.file.attribute.volume", FT_BOOLEAN, 32,
+ { "Volume ID", "smb.file_attribute.volume", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_volume), FILE_ATTRIBUTE_VOLUME, "VOLUME file attribute", HFILL }},
{ &hf_smb_file_eattr_directory,
- { "Directory", "smb.file.attribute.directory", FT_BOOLEAN, 32,
+ { "Directory", "smb.file_attribute.directory", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_directory), FILE_ATTRIBUTE_DIRECTORY, "DIRECTORY file attribute", HFILL }},
{ &hf_smb_file_eattr_archive,
- { "Archive", "smb.file.attribute.archive", FT_BOOLEAN, 32,
+ { "Archive", "smb.file_attribute.archive", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_archive), FILE_ATTRIBUTE_ARCHIVE, "ARCHIVE file attribute", HFILL }},
{ &hf_smb_file_eattr_device,
- { "Device", "smb.file.attribute.device", FT_BOOLEAN, 32,
+ { "Device", "smb.file_attribute.device", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_device), FILE_ATTRIBUTE_DEVICE, "Is this file a device?", HFILL }},
{ &hf_smb_file_eattr_normal,
- { "Normal", "smb.file.attribute.normal", FT_BOOLEAN, 32,
+ { "Normal", "smb.file_attribute.normal", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_normal), FILE_ATTRIBUTE_NORMAL, "Is this a normal file?", HFILL }},
{ &hf_smb_file_eattr_temporary,
- { "Temporary", "smb.file.attribute.temporary", FT_BOOLEAN, 32,
+ { "Temporary", "smb.file_attribute.temporary", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_temporary), FILE_ATTRIBUTE_TEMPORARY, "Is this a temporary file?", HFILL }},
{ &hf_smb_file_eattr_sparse,
- { "Sparse", "smb.file.attribute.sparse", FT_BOOLEAN, 32,
+ { "Sparse", "smb.file_attribute.sparse", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_sparse), FILE_ATTRIBUTE_SPARSE, "Is this a sparse file?", HFILL }},
{ &hf_smb_file_eattr_reparse,
- { "Reparse Point", "smb.file.attribute.reparse", FT_BOOLEAN, 32,
+ { "Reparse Point", "smb.file_attribute.reparse", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_reparse), FILE_ATTRIBUTE_REPARSE, "Does this file have an associated reparse point?", HFILL }},
{ &hf_smb_file_eattr_compressed,
- { "Compressed", "smb.file.attribute.compressed", FT_BOOLEAN, 32,
+ { "Compressed", "smb.file_attribute.compressed", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_compressed), FILE_ATTRIBUTE_COMPRESSED, "Is this file compressed?", HFILL }},
{ &hf_smb_file_eattr_offline,
- { "Offline", "smb.file.attribute.offline", FT_BOOLEAN, 32,
+ { "Offline", "smb.file_attribute.offline", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_offline), FILE_ATTRIBUTE_OFFLINE, "Is this file offline?", HFILL }},
{ &hf_smb_file_eattr_not_content_indexed,
- { "Content Indexed", "smb.file.attribute.not_content_indexed", FT_BOOLEAN, 32,
+ { "Content Indexed", "smb.file_attribute.not_content_indexed", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_not_content_indexed), FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, "May this file be indexed by the content indexing service", HFILL }},
{ &hf_smb_file_eattr_encrypted,
- { "Encrypted", "smb.file.attribute.encrypted", FT_BOOLEAN, 32,
+ { "Encrypted", "smb.file_attribute.encrypted", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_encrypted), FILE_ATTRIBUTE_ENCRYPTED, "Is this file encrypted?", HFILL }},
{ &hf_smb_file_eattr_write_through,
- { "Write Through", "smb.file.attribute.write_through", FT_BOOLEAN, 32,
+ { "Write Through", "smb.file_attribute.write_through", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_write_through), FILE_ATTRIBUTE_WRITE_THROUGH, "Does this object need write through?", HFILL }},
{ &hf_smb_file_eattr_no_buffering,
- { "No Buffering", "smb.file.attribute.no_buffering", FT_BOOLEAN, 32,
+ { "No Buffering", "smb.file_attribute.no_buffering", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_no_buffering), FILE_ATTRIBUTE_NO_BUFFERING, "May the server buffer this object?", HFILL }},
{ &hf_smb_file_eattr_random_access,
- { "Random Access", "smb.file.attribute.random_access", FT_BOOLEAN, 32,
+ { "Random Access", "smb.file_attribute.random_access", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_random_access), FILE_ATTRIBUTE_RANDOM_ACCESS, "Optimize for random access", HFILL }},
{ &hf_smb_file_eattr_sequential_scan,
- { "Sequential Scan", "smb.file.attribute.sequential_scan", FT_BOOLEAN, 32,
+ { "Sequential Scan", "smb.file_attribute.sequential_scan", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_sequential_scan), FILE_ATTRIBUTE_SEQUENTIAL_SCAN, "Optimize for sequential scan", HFILL }},
{ &hf_smb_file_eattr_delete_on_close,
- { "Delete on Close", "smb.file.attribute.delete_on_close", FT_BOOLEAN, 32,
+ { "Delete on Close", "smb.file_attribute.delete_on_close", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_delete_on_close), FILE_ATTRIBUTE_DELETE_ON_CLOSE, "Should this object be deleted on close?", HFILL }},
{ &hf_smb_file_eattr_backup_semantics,
- { "Backup", "smb.file.attribute.backup_semantics", FT_BOOLEAN, 32,
+ { "Backup", "smb.file_attribute.backup_semantics", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_backup_semantics), FILE_ATTRIBUTE_BACKUP_SEMANTICS, "Does this object need/support backup semantics", HFILL }},
{ &hf_smb_file_eattr_posix_semantics,
- { "Posix", "smb.file.attribute.posix_semantics", FT_BOOLEAN, 32,
+ { "Posix", "smb.file_attribute.posix_semantics", FT_BOOLEAN, 32,
TFS(&tfs_file_attribute_posix_semantics), FILE_ATTRIBUTE_POSIX_SEMANTICS, "Does this object need/support POSIX semantics?", HFILL }},
{ &hf_smb_sec_desc_len,
NULL, 0, "Length of Short (8.3) File Name", HFILL }},
{ &hf_smb_fs_id,
- { "FS Id", "smb.fs.id", FT_UINT32, BASE_DEC,
+ { "FS Id", "smb.fs_id", FT_UINT32, BASE_DEC,
NULL, 0, "File System ID (NT Server always returns 0)", HFILL }},
{ &hf_smb_sector_unit,
- { "Sectors/Unit", "smb.fs.sector_per_unit", FT_UINT32, BASE_DEC,
+ { "Sectors/Unit", "smb.fs_sector_per_unit", FT_UINT32, BASE_DEC,
NULL, 0, "Sectors per allocation unit", HFILL }},
{ &hf_smb_fs_units,
- { "Total Units", "smb.fs.units", FT_UINT32, BASE_DEC,
+ { "Total Units", "smb.fs_units", FT_UINT32, BASE_DEC,
NULL, 0, "Total number of units on this filesystem", HFILL }},
{ &hf_smb_fs_sector,
- { "Bytes per Sector", "smb.fs.bytes_per_sector", FT_UINT32, BASE_DEC,
+ { "Bytes per Sector", "smb.fs_bytes_per_sector", FT_UINT32, BASE_DEC,
NULL, 0, "Bytes per sector", HFILL }},
{ &hf_smb_avail_units,
{ "Free Units", "smb.free_alloc_units", FT_UINT64, BASE_DEC,
NULL, 0, "Number of free allocation units", HFILL }},
+ { &hf_smb_soft_quota_limit,
+ { "(Soft) Quota Treshold", "smb.quota.soft.default", FT_UINT64, BASE_DEC,
+ NULL, 0, "Soft Quota treshold", HFILL }},
+
+ { &hf_smb_hard_quota_limit,
+ { "(Hard) Quota Limit", "smb.quota.hard.default", FT_UINT64, BASE_DEC,
+ NULL, 0, "Hard Quota limit", HFILL }},
+
+ { &hf_smb_user_quota_used,
+ { "Quota Used", "smb.quota.used", FT_UINT64, BASE_DEC,
+ NULL, 0, "How much Quota is used by this user", HFILL }},
+
{ &hf_smb_max_name_len,
- { "Max name length", "smb.fs.max_name_len", FT_UINT32, BASE_DEC,
+ { "Max name length", "smb.fs_max_name_len", FT_UINT32, BASE_DEC,
NULL, 0, "Maximum length of each file name component in number of bytes", HFILL }},
{ &hf_smb_fs_name_len,
- { "Label Length", "smb.fs.name.len", FT_UINT32, BASE_DEC,
+ { "Label Length", "smb.fs_name.len", FT_UINT32, BASE_DEC,
NULL, 0, "Length of filesystem name in bytes", HFILL }},
{ &hf_smb_fs_name,
- { "FS Name", "smb.fs.name", FT_STRING, BASE_DEC,
+ { "FS Name", "smb.fs_name", FT_STRING, BASE_DEC,
NULL, 0, "Name of filesystem", HFILL }},
{ &hf_smb_device_char_removable,
TFS(&tfs_device_char_virtual), 0x00000040, "Is this a virtual device", HFILL }},
{ &hf_smb_fs_attr_css,
- { "Case Sensitive Search", "smb.fs.attr.css", FT_BOOLEAN, 32,
+ { "Case Sensitive Search", "smb.fs_attr.css", FT_BOOLEAN, 32,
TFS(&tfs_fs_attr_css), 0x00000001, "Does this FS support Case Sensitive Search?", HFILL }},
{ &hf_smb_fs_attr_cpn,
- { "Case Preserving", "smb.fs.attr.cpn", FT_BOOLEAN, 32,
+ { "Case Preserving", "smb.fs_attr.cpn", FT_BOOLEAN, 32,
TFS(&tfs_fs_attr_cpn), 0x00000002, "Will this FS Preserve Name Case?", HFILL }},
{ &hf_smb_fs_attr_pacls,
- { "Persistent ACLs", "smb.fs.attr.pacls", FT_BOOLEAN, 32,
+ { "Persistent ACLs", "smb.fs_attr.pacls", FT_BOOLEAN, 32,
TFS(&tfs_fs_attr_pacls), 0x00000004, "Does this FS support Persistent ACLs?", HFILL }},
{ &hf_smb_fs_attr_fc,
- { "Compression", "smb.fs.attr.fc", FT_BOOLEAN, 32,
+ { "Compression", "smb.fs_attr.fc", FT_BOOLEAN, 32,
TFS(&tfs_fs_attr_fc), 0x00000008, "Does this FS support File Compression?", HFILL }},
{ &hf_smb_fs_attr_vq,
- { "Volume Quotas", "smb.fs.attr.vq", FT_BOOLEAN, 32,
+ { "Volume Quotas", "smb.fs_attr.vq", FT_BOOLEAN, 32,
TFS(&tfs_fs_attr_vq), 0x00000010, "Does this FS support Volume Quotas?", HFILL }},
{ &hf_smb_fs_attr_dim,
- { "Mounted", "smb.fs.attr.dim", FT_BOOLEAN, 32,
+ { "Mounted", "smb.fs_attr.dim", FT_BOOLEAN, 32,
TFS(&tfs_fs_attr_dim), 0x00000020, "Is this FS a Mounted Device?", HFILL }},
{ &hf_smb_fs_attr_vic,
- { "Compressed", "smb.fs.attr.vic", FT_BOOLEAN, 32,
+ { "Compressed", "smb.fs_attr.vic", FT_BOOLEAN, 32,
TFS(&tfs_fs_attr_vic), 0x00008000, "Is this FS Compressed?", HFILL }},
{ &hf_smb_sec_desc_revision,
{ "Num ACEs", "smb.acl.num_aces", FT_UINT32, BASE_DEC,
NULL, 0, "Number of ACE structures for this ACL", HFILL }},
+ { &hf_smb_user_quota_offset,
+ { "Next Offset", "smb.quota.user.offset", FT_UINT32, BASE_DEC,
+ NULL, 0, "Relative offset to next user quota structure", HFILL }},
+
{ &hf_smb_ace_type,
{ "Type", "smb.ace.type", FT_UINT8, BASE_DEC,
VALS(ace_type_vals), 0, "Type of ACE", HFILL }},
TFS(&tfs_ace_flags_failed_access), 0x80, "Should failed accesses be audited?", HFILL }},
{ &hf_smb_sec_desc_type_owner_defaulted,
- { "Onwer Defaulted", "smb.sec_desc.type.owner_defaulted", FT_BOOLEAN, 16,
+ { "Owner Defaulted", "smb.sec_desc.type.owner_defaulted", FT_BOOLEAN, 16,
TFS(&tfs_sec_desc_type_owner_defaulted), 0x0001, "Is Owner Defaulted set?", HFILL }},
{ &hf_smb_sec_desc_type_group_defaulted,
{ "Self Relative", "smb.sec_desc.type.self_relative", FT_BOOLEAN, 16,
TFS(&tfs_sec_desc_type_self_relative), 0x8000, "Is this SecDesc self relative?", HFILL }},
+ { &hf_smb_quota_flags_deny_disk,
+ { "Deny Disk", "smb.quota.flags.deny_disk", FT_BOOLEAN, 8,
+ TFS(&tfs_quota_flags_deny_disk), 0x02, "Is the default quota limit enforced?", HFILL }},
+
+ { &hf_smb_quota_flags_log_limit,
+ { "Log Limit", "smb.quota.flags.log_limit", FT_BOOLEAN, 8,
+ TFS(&tfs_quota_flags_log_limit), 0x20, "Should the server log an event when the limit is exceeded?", HFILL }},
+
+ { &hf_smb_quota_flags_log_warning,
+ { "Log Warning", "smb.quota.flags.log_warning", FT_BOOLEAN, 8,
+ TFS(&tfs_quota_flags_log_warning), 0x10, "Should the server log an event when the warning level is exceeded?", HFILL }},
+
+ { &hf_smb_quota_flags_enabled,
+ { "Enabled", "smb.quota.flags.enabled", FT_BOOLEAN, 8,
+ TFS(&tfs_quota_flags_enabled), 0x01, "Is quotas enabled of this FS?", HFILL }},
+
};
static gint *ett[] = {
&ett_smb,
&ett_smb_ssetupandxaction,
&ett_smb_optionsup,
&ett_smb_time_date,
- &ett_smb_64bit_time,
&ett_smb_move_flags,
&ett_smb_file_attributes,
&ett_smb_search_resume_key,
&ett_smb_nt_share_access,
&ett_smb_nt_security_flags,
&ett_smb_nt_trans_setup,
+ &ett_smb_nt_trans_data,
+ &ett_smb_nt_trans_param,
&ett_smb_nt_notify_completion_filter,
&ett_smb_nt_ioctl_flags,
&ett_smb_security_information_mask,
&ett_smb_ace,
&ett_smb_ace_flags,
&ett_smb_sec_desc_type,
+ &ett_smb_quotaflags,
};
module_t *smb_module;
git.samba.org / obnox / wireshark / wip.git / blobdiff