The Tcpdump Group git mirrors - tcpdump/blobdiff

* or later

*/

* or later

*/

+#define NETDISSECT_REWORKED

#ifdef HAVE_CONFIG_H

#include "config.h"

#endif

#ifdef HAVE_CONFIG_H

#include "config.h"

#endif

-#ifndef lint

-static const char rcsid[] _U_ =

- "@(#) $Header: /tcpdump/master/tcpdump/print-smb.c,v 1.30 2004-05-31 01:19:10 guy Exp $";

-#endif

-

#include <tcpdump-stdinc.h>

-#include <stdio.h>

#include <string.h>

#include "interface.h"

#include "extract.h"

#include "smb.h"

#include <string.h>

#include "interface.h"

#include "extract.h"

#include "smb.h"

+static const char tstr[] = "[|SMB]";

+

static int request = 0;

+static int unicodestr = 0;

const u_char *startbuf = NULL;

const char *req_f2;

const char *rep_f1;

const char *rep_f2;

const char *req_f2;

const char *rep_f1;

const char *rep_f2;

- void (*fn)(const u_char *, const u_char *, const u_char *, const u_char *);

+ void (*fn)(netdissect_options *, const u_char *, const u_char *, const u_char *, const u_char *);

};

struct smbdescriptint {

};

struct smbdescriptint {

const char *req_f2;

const char *rep_f1;

const char *rep_f2;

const char *req_f2;

const char *rep_f1;

const char *rep_f2;

- void (*fn)(const u_char *, const u_char *, int, int);

+ void (*fn)(netdissect_options *, const u_char *, const u_char *, int, int);

};

struct smbfns

};

struct smbfns

#define FLG_CHAIN (1 << 0)

-static struct smbfns *

-smbfind(int id, struct smbfns *list)

+static const struct smbfns *

+smbfind(int id, const struct smbfns *list)

{

int sindex;

{

int sindex;

return(&list[0]);

}

return(&list[0]);

}

-static struct smbfnsint *

-smbfindint(int id, struct smbfnsint *list)

+static const struct smbfnsint *

+smbfindint(int id, const struct smbfnsint *list)

{

int sindex;

{

int sindex;

}

static void

}

static void

-trans2_findfirst(const u_char *param, const u_char *data, int pcnt, int dcnt)

+trans2_findfirst(netdissect_options *ndo,

+ const u_char *param, const u_char *data, int pcnt, int dcnt)

{

const char *fmt;

if (request)

{

const char *fmt;

if (request)

- fmt = "Attribute=[A]\nSearchCount=[d]\nFlags=[w]\nLevel=[dP5]\nFile=[S]\n";

+ fmt = "Attribute=[A]\nSearchCount=[d]\nFlags=[w]\nLevel=[dP4]\nFile=[S]\n";

else

fmt = "Handle=[w]\nCount=[d]\nEOS=[w]\nEoffset=[d]\nLastNameOfs=[w]\n";

else

fmt = "Handle=[w]\nCount=[d]\nEOS=[w]\nEoffset=[d]\nLastNameOfs=[w]\n";

- smb_fdata(param, fmt, param + pcnt);

+ smb_fdata(ndo, param, fmt, param + pcnt, unicodestr);

if (dcnt) {

- printf("data:\n");

- print_data(data, dcnt);

+ ND_PRINT((ndo, "data:\n"));

+ print_data(ndo, data, dcnt);

}

static void

}

static void

-trans2_qfsinfo(const u_char *param, const u_char *data, int pcnt, int dcnt)

+trans2_qfsinfo(netdissect_options *ndo,

+ const u_char *param, const u_char *data, int pcnt, int dcnt)

{

static int level = 0;

const char *fmt="";

if (request) {

{

static int level = 0;

const char *fmt="";

if (request) {

- TCHECK2(*param, 2);

+ ND_TCHECK2(*param, 2);

level = EXTRACT_LE_16BITS(param);

fmt = "InfoLevel=[d]\n";

level = EXTRACT_LE_16BITS(param);

fmt = "InfoLevel=[d]\n";

- smb_fdata(param, fmt, param + pcnt);

+ smb_fdata(ndo, param, fmt, param + pcnt, unicodestr);

} else {

switch (level) {

case 1:

fmt = "idFileSystem=[W]\nSectorUnit=[D]\nUnit=[D]\nAvail=[D]\nSectorSize=[d]\n";

break;

case 2:

} else {

switch (level) {

case 1:

fmt = "idFileSystem=[W]\nSectorUnit=[D]\nUnit=[D]\nAvail=[D]\nSectorSize=[d]\n";

break;

case 2:

- fmt = "CreationTime=[T2]VolNameLength=[B]\nVolumeLabel=[s12]\n";

+ fmt = "CreationTime=[T2]VolNameLength=[lb]\nVolumeLabel=[c]\n";

break;

case 0x105:

break;

case 0x105:

- fmt = "Capabilities=[W]\nMaxFileLen=[D]\nVolNameLen=[D]\nVolume=[S]\n";

+ fmt = "Capabilities=[W]\nMaxFileLen=[D]\nVolNameLen=[lD]\nVolume=[C]\n";

break;

default:

fmt = "UnknownLevel\n";

break;

}

break;

default:

fmt = "UnknownLevel\n";

break;

}

- smb_fdata(data, fmt, data + dcnt);

+ smb_fdata(ndo, data, fmt, data + dcnt, unicodestr);

}

if (dcnt) {

}

if (dcnt) {

- printf("data:\n");

- print_data(data, dcnt);

+ ND_PRINT((ndo, "data:\n"));

+ print_data(ndo, data, dcnt);

}

return;

trunc:

}

return;

trunc:

- printf("[|SMB]");

- return;

+ ND_PRINT((ndo, "%s", tstr));

}

-struct smbfnsint trans2_fns[] = {

+static const struct smbfnsint trans2_fns[] = {

{ 0, "TRANSACT2_OPEN", 0,

{ "Flags2=[w]\nMode=[w]\nSearchAttrib=[A]\nAttrib=[A]\nTime=[T2]\nOFun=[w]\nSize=[D]\nRes=([w, w, w, w, w])\nPath=[S]",

NULL,

{ 0, "TRANSACT2_OPEN", 0,

{ "Flags2=[w]\nMode=[w]\nSearchAttrib=[A]\nAttrib=[A]\nTime=[T2]\nOFun=[w]\nSize=[D]\nRes=([w, w, w, w, w])\nPath=[S]",

NULL,

static void

-print_trans2(const u_char *words, const u_char *dat _U_, const u_char *buf, const u_char *maxbuf)

+print_trans2(netdissect_options *ndo,

+ const u_char *words, const u_char *dat, const u_char *buf, const u_char *maxbuf)

{

- static struct smbfnsint *fn = &trans2_fns[0];

+ u_int bcc;

+ static const struct smbfnsint *fn = &trans2_fns[0];

const u_char *data, *param;

const u_char *w = words + 1;

const char *f1 = NULL, *f2 = NULL;

int pcnt, dcnt;

const u_char *data, *param;

const u_char *w = words + 1;

const char *f1 = NULL, *f2 = NULL;

int pcnt, dcnt;

- TCHECK(words[0]);

+ ND_TCHECK(words[0]);

if (request) {

- TCHECK2(w[14 * 2], 2);

+ ND_TCHECK2(w[14 * 2], 2);

pcnt = EXTRACT_LE_16BITS(w + 9 * 2);

param = buf + EXTRACT_LE_16BITS(w + 10 * 2);

dcnt = EXTRACT_LE_16BITS(w + 11 * 2);

pcnt = EXTRACT_LE_16BITS(w + 9 * 2);

param = buf + EXTRACT_LE_16BITS(w + 10 * 2);

dcnt = EXTRACT_LE_16BITS(w + 11 * 2);

fn = smbfindint(EXTRACT_LE_16BITS(w + 14 * 2), trans2_fns);

} else {

if (words[0] == 0) {

fn = smbfindint(EXTRACT_LE_16BITS(w + 14 * 2), trans2_fns);

} else {

if (words[0] == 0) {

- printf("%s\n", fn->name);

- printf("Trans2Interim\n");

+ ND_PRINT((ndo, "%s\n", fn->name));

+ ND_PRINT((ndo, "Trans2Interim\n"));

return;

}

return;

}

- TCHECK2(w[7 * 2], 2);

+ ND_TCHECK2(w[7 * 2], 2);

pcnt = EXTRACT_LE_16BITS(w + 3 * 2);

param = buf + EXTRACT_LE_16BITS(w + 4 * 2);

dcnt = EXTRACT_LE_16BITS(w + 6 * 2);

data = buf + EXTRACT_LE_16BITS(w + 7 * 2);

}

pcnt = EXTRACT_LE_16BITS(w + 3 * 2);

param = buf + EXTRACT_LE_16BITS(w + 4 * 2);

dcnt = EXTRACT_LE_16BITS(w + 6 * 2);

data = buf + EXTRACT_LE_16BITS(w + 7 * 2);

}

- printf("%s param_length=%d data_length=%d\n", fn->name, pcnt, dcnt);

+ ND_PRINT((ndo, "%s param_length=%d data_length=%d\n", fn->name, pcnt, dcnt));

if (request) {

if (words[0] == 8) {

if (request) {

if (words[0] == 8) {

- smb_fdata(words + 1,

+ smb_fdata(ndo, words + 1,

"Trans2Secondary\nTotParam=[d]\nTotData=[d]\nParamCnt=[d]\nParamOff=[d]\nParamDisp=[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nHandle=[d]\n",

- maxbuf);

+ maxbuf, unicodestr);

return;

} else {

return;

} else {

- smb_fdata(words + 1,

- "TotParam=[d]\nTotData=[d]\nMaxParam=[d]\nMaxData=[d]\nMaxSetup=[d]\nFlags=[w]\nTimeOut=[D]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nDataCnt=[d]\nDataOff=[d]\nSetupCnt=[d]\n",

- words + 1 + 14 * 2);

- smb_fdata(data + 1, "TransactionName=[S]\n%", maxbuf);

+ smb_fdata(ndo, words + 1,

+ "TotParam=[d]\nTotData=[d]\nMaxParam=[d]\nMaxData=[d]\nMaxSetup=[b][P1]\nFlags=[w]\nTimeOut=[D]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nDataCnt=[d]\nDataOff=[d]\nSetupCnt=[b][P1]\n",

+ words + 1 + 14 * 2, unicodestr);

}

f1 = fn->descript.req_f1;

f2 = fn->descript.req_f2;

} else {

}

f1 = fn->descript.req_f1;

f2 = fn->descript.req_f2;

} else {

- smb_fdata(words + 1,

- "TotParam=[d]\nTotData=[d]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nParamDisp[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nSetupCnt=[d]\n",

- words + 1 + 10 * 2);

+ smb_fdata(ndo, words + 1,

+ "TotParam=[d]\nTotData=[d]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nParamDisp[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nSetupCnt=[b][P1]\n",

+ words + 1 + 10 * 2, unicodestr);

f1 = fn->descript.rep_f1;

f2 = fn->descript.rep_f2;

}

f1 = fn->descript.rep_f1;

f2 = fn->descript.rep_f2;

}

+ ND_TCHECK2(*dat, 2);

+ bcc = EXTRACT_LE_16BITS(dat);

+ ND_PRINT((ndo, "smb_bcc=%u\n", bcc));

if (fn->descript.fn)

- (*fn->descript.fn)(param, data, pcnt, dcnt);

+ (*fn->descript.fn)(ndo, param, data, pcnt, dcnt);

else {

- smb_fdata(param, f1 ? f1 : "Parameters=\n", param + pcnt);

- smb_fdata(data, f2 ? f2 : "Data=\n", data + dcnt);

+ smb_fdata(ndo, param, f1 ? f1 : "Parameters=\n", param + pcnt, unicodestr);

+ smb_fdata(ndo, data, f2 ? f2 : "Data=\n", data + dcnt, unicodestr);

}

return;

trunc:

}

return;

trunc:

- printf("[|SMB]");

- return;

+ ND_PRINT((ndo, "%s", tstr));

}

-

static void

-print_browse(const u_char *param, int paramlen, const u_char *data, int datalen)

+print_browse(netdissect_options *ndo,

+ const u_char *param, int paramlen, const u_char *data, int datalen)

{

const u_char *maxbuf = data + datalen;

int command;

{

const u_char *maxbuf = data + datalen;

int command;

- TCHECK(data[0]);

+ ND_TCHECK(data[0]);

command = data[0];

- smb_fdata(param, "BROWSE PACKET\n|Param ", param+paramlen);

+ smb_fdata(ndo, param, "BROWSE PACKET\n|Param ", param+paramlen, unicodestr);

switch (command) {

case 0xF:

switch (command) {

case 0xF:

- data = smb_fdata(data,

+ data = smb_fdata(ndo, data,

"BROWSE PACKET:\nType=[B] (LocalMasterAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nElectionVersion=[w]\nBrowserConstant=[w]\n",

- maxbuf);

+ maxbuf, unicodestr);

break;

case 0x1:

break;

case 0x1:

- data = smb_fdata(data,

+ data = smb_fdata(ndo, data,

"BROWSE PACKET:\nType=[B] (HostAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nElectionVersion=[w]\nBrowserConstant=[w]\n",

- maxbuf);

+ maxbuf, unicodestr);

break;

case 0x2:

break;

case 0x2:

- data = smb_fdata(data,

+ data = smb_fdata(ndo, data,

"BROWSE PACKET:\nType=[B] (AnnouncementRequest)\nFlags=[B]\nReplySystemName=[S]\n",

- maxbuf);

+ maxbuf, unicodestr);

break;

case 0xc:

break;

case 0xc:

- data = smb_fdata(data,

+ data = smb_fdata(ndo, data,

"BROWSE PACKET:\nType=[B] (WorkgroupAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nCommentPointer=[W]\nServerName=[S]\n",

- maxbuf);

+ maxbuf, unicodestr);

break;

case 0x8:

break;

case 0x8:

- data = smb_fdata(data,

+ data = smb_fdata(ndo, data,

"BROWSE PACKET:\nType=[B] (ElectionFrame)\nElectionVersion=[B]\nOSSummary=[W]\nUptime=[(W, W)]\nServerName=[S]\n",

- maxbuf);

+ maxbuf, unicodestr);

break;

case 0xb:

break;

case 0xb:

- data = smb_fdata(data,

+ data = smb_fdata(ndo, data,

"BROWSE PACKET:\nType=[B] (BecomeBackupBrowser)\nName=[S]\n",

- maxbuf);

+ maxbuf, unicodestr);

break;

case 0x9:

break;

case 0x9:

- data = smb_fdata(data,

- "BROWSE PACKET:\nType=[B] (GetBackupList)\nListCount?=[B]\nToken?=[B]\n",

- maxbuf);

+ data = smb_fdata(ndo, data,

+ "BROWSE PACKET:\nType=[B] (GetBackupList)\nListCount?=[B]\nToken=[W]\n",

+ maxbuf, unicodestr);

break;

case 0xa:

break;

case 0xa:

- data = smb_fdata(data,

- "BROWSE PACKET:\nType=[B] (BackupListResponse)\nServerCount?=[B]\nToken?=[B]*Name=[S]\n",

- maxbuf);

+ data = smb_fdata(ndo, data,

+ "BROWSE PACKET:\nType=[B] (BackupListResponse)\nServerCount?=[B]\nToken=[W]\n*Name=[S]\n",

+ maxbuf, unicodestr);

break;

case 0xd:

break;

case 0xd:

- data = smb_fdata(data,

+ data = smb_fdata(ndo, data,

"BROWSE PACKET:\nType=[B] (MasterAnnouncement)\nMasterName=[S]\n",

- maxbuf);

+ maxbuf, unicodestr);

break;

case 0xe:

break;

case 0xe:

- data = smb_fdata(data,

- "BROWSE PACKET:\nType=[B] (ResetBrowser)\nOptions=[B]\n", maxbuf);

+ data = smb_fdata(ndo, data,

+ "BROWSE PACKET:\nType=[B] (ResetBrowser)\nOptions=[B]\n", maxbuf, unicodestr);

break;

default:

break;

default:

- data = smb_fdata(data, "Unknown Browser Frame ", maxbuf);

+ data = smb_fdata(ndo, data, "Unknown Browser Frame ", maxbuf, unicodestr);

break;

}

return;

trunc:

break;

}

return;

trunc:

- printf("[|SMB]");

- return;

+ ND_PRINT((ndo, "%s", tstr));

}

static void

}

static void

-print_ipc(const u_char *param, int paramlen, const u_char *data, int datalen)

+print_ipc(netdissect_options *ndo,

+ const u_char *param, int paramlen, const u_char *data, int datalen)

{

if (paramlen)

{

if (paramlen)

- smb_fdata(param, "Command=[w]\nStr1=[S]\nStr2=[S]\n", param + paramlen);

+ smb_fdata(ndo, param, "Command=[w]\nStr1=[S]\nStr2=[S]\n", param + paramlen,

+ unicodestr);

if (datalen)

- smb_fdata(data, "IPC ", data + datalen);

+ smb_fdata(ndo, data, "IPC ", data + datalen, unicodestr);

}

static void

}

static void

-print_trans(const u_char *words, const u_char *data1, const u_char *buf, const u_char *maxbuf)

+print_trans(netdissect_options *ndo,

+ const u_char *words, const u_char *data1, const u_char *buf, const u_char *maxbuf)

{

+ u_int bcc;

const char *f1, *f2, *f3, *f4;

const u_char *data, *param;

const u_char *w = words + 1;

int datalen, paramlen;

if (request) {

const char *f1, *f2, *f3, *f4;

const u_char *data, *param;

const u_char *w = words + 1;

int datalen, paramlen;

if (request) {

- TCHECK2(w[12 * 2], 2);

+ ND_TCHECK2(w[12 * 2], 2);

paramlen = EXTRACT_LE_16BITS(w + 9 * 2);

param = buf + EXTRACT_LE_16BITS(w + 10 * 2);

datalen = EXTRACT_LE_16BITS(w + 11 * 2);

paramlen = EXTRACT_LE_16BITS(w + 9 * 2);

param = buf + EXTRACT_LE_16BITS(w + 10 * 2);

datalen = EXTRACT_LE_16BITS(w + 11 * 2);

f3 = "|Param ";

f4 = "|Data ";

} else {

f3 = "|Param ";

f4 = "|Data ";

} else {

- TCHECK2(w[7 * 2], 2);

+ ND_TCHECK2(w[7 * 2], 2);

paramlen = EXTRACT_LE_16BITS(w + 3 * 2);

param = buf + EXTRACT_LE_16BITS(w + 4 * 2);

datalen = EXTRACT_LE_16BITS(w + 6 * 2);

paramlen = EXTRACT_LE_16BITS(w + 3 * 2);

param = buf + EXTRACT_LE_16BITS(w + 4 * 2);

datalen = EXTRACT_LE_16BITS(w + 6 * 2);

f4 = "|Data ";

}

f4 = "|Data ";

}

- smb_fdata(words + 1, f1, SMBMIN(words + 1 + 2 * words[0], maxbuf));

- smb_fdata(data1 + 2, f2, maxbuf - (paramlen + datalen));

+ smb_fdata(ndo, words + 1, f1, min(words + 1 + 2 * words[0], maxbuf),

+ unicodestr);

- if (strcmp((const char *)(data1 + 2), "\\MAILSLOT\\BROWSE") == 0) {

- print_browse(param, paramlen, data, datalen);

- return;

- }

+ ND_TCHECK2(*data1, 2);

+ bcc = EXTRACT_LE_16BITS(data1);

+ ND_PRINT((ndo, "smb_bcc=%u\n", bcc));

+ if (bcc > 0) {

+ smb_fdata(ndo, data1 + 2, f2, maxbuf - (paramlen + datalen), unicodestr);

- if (strcmp((const char *)(data1 + 2), "\\PIPE\\LANMAN") == 0) {

- print_ipc(param, paramlen, data, datalen);

- return;

- }

+ if (strcmp((const char *)(data1 + 2), "\\MAILSLOT\\BROWSE") == 0) {

+ print_browse(ndo, param, paramlen, data, datalen);

+ return;

+ }

- if (paramlen)

- smb_fdata(param, f3, SMBMIN(param + paramlen, maxbuf));

- if (datalen)

- smb_fdata(data, f4, SMBMIN(data + datalen, maxbuf));

+ if (strcmp((const char *)(data1 + 2), "\\PIPE\\LANMAN") == 0) {

+ print_ipc(ndo, param, paramlen, data, datalen);

+ return;

+ }

+

+ if (paramlen)

+ smb_fdata(ndo, param, f3, min(param + paramlen, maxbuf), unicodestr);

+ if (datalen)

+ smb_fdata(ndo, data, f4, min(data + datalen, maxbuf), unicodestr);

+ }

return;

trunc:

return;

trunc:

- printf("[|SMB]");

- return;

+ ND_PRINT((ndo, "%s", tstr));

}

static void

}

static void

-print_negprot(const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf)

+print_negprot(netdissect_options *ndo,

+ const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf)

{

- u_int wcnt;

+ u_int wct, bcc;

const char *f1 = NULL, *f2 = NULL;

- TCHECK(words[0]);

- wcnt = words[0];

+ ND_TCHECK(words[0]);

+ wct = words[0];

if (request)

- f2 = "*|Dialect=[Z]\n";

+ f2 = "*|Dialect=[Y]\n";

else {

- if (wcnt == 1)

+ if (wct == 1)

f1 = "Core Protocol\nDialectIndex=[d]";

- else if (wcnt == 17)

+ else if (wct == 17)

f1 = "NT1 Protocol\nDialectIndex=[d]\nSecMode=[B]\nMaxMux=[d]\nNumVcs=[d]\nMaxBuffer=[D]\nRawSize=[D]\nSessionKey=[W]\nCapabilities=[W]\nServerTime=[T3]TimeZone=[d]\nCryptKey=";

- else if (wcnt == 13)

+ else if (wct == 13)

f1 = "Coreplus/Lanman1/Lanman2 Protocol\nDialectIndex=[d]\nSecMode=[w]\nMaxXMit=[d]\nMaxMux=[d]\nMaxVcs=[d]\nBlkMode=[w]\nSessionKey=[W]\nServerTime=[T1]TimeZone=[d]\nRes=[W]\nCryptKey=";

}

if (f1)

f1 = "Coreplus/Lanman1/Lanman2 Protocol\nDialectIndex=[d]\nSecMode=[w]\nMaxXMit=[d]\nMaxMux=[d]\nMaxVcs=[d]\nBlkMode=[w]\nSessionKey=[W]\nServerTime=[T1]TimeZone=[d]\nRes=[W]\nCryptKey=";

}

if (f1)

- smb_fdata(words + 1, f1, SMBMIN(words + 1 + wcnt * 2, maxbuf));

+ smb_fdata(ndo, words + 1, f1, min(words + 1 + wct * 2, maxbuf),

+ unicodestr);

else

- print_data(words + 1, SMBMIN(wcnt * 2, PTR_DIFF(maxbuf, words + 1)));

-

- TCHECK2(*data, 2);

- if (f2)

- smb_fdata(data + 2, f2, SMBMIN(data + 2 + EXTRACT_LE_16BITS(data), maxbuf));

- else

- print_data(data + 2, SMBMIN(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2)));

+ print_data(ndo, words + 1, min(wct * 2, PTR_DIFF(maxbuf, words + 1)));

+

+ ND_TCHECK2(*data, 2);

+ bcc = EXTRACT_LE_16BITS(data);

+ ND_PRINT((ndo, "smb_bcc=%u\n", bcc));

+ if (bcc > 0) {

+ if (f2)

+ smb_fdata(ndo, data + 2, f2, min(data + 2 + EXTRACT_LE_16BITS(data),

+ maxbuf), unicodestr);

+ else

+ print_data(ndo, data + 2, min(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2)));

+ }

return;

trunc:

return;

trunc:

- printf("[|SMB]");

- return;

+ ND_PRINT((ndo, "%s", tstr));

}

static void

}

static void

-print_sesssetup(const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf)

+print_sesssetup(netdissect_options *ndo,

+ const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf)

{

- u_int wcnt;

+ u_int wct, bcc;

const char *f1 = NULL, *f2 = NULL;

- TCHECK(words[0]);

- wcnt = words[0];

+ ND_TCHECK(words[0]);

+ wct = words[0];

if (request) {

- if (wcnt == 10)

+ if (wct == 10)

f1 = "Com2=[w]\nOff2=[d]\nBufSize=[d]\nMpxMax=[d]\nVcNum=[d]\nSessionKey=[W]\nPassLen=[d]\nCryptLen=[d]\nCryptOff=[d]\nPass&Name=\n";

else

f1 = "Com2=[B]\nRes1=[B]\nOff2=[d]\nMaxBuffer=[d]\nMaxMpx=[d]\nVcNumber=[d]\nSessionKey=[W]\nCaseInsensitivePasswordLength=[d]\nCaseSensitivePasswordLength=[d]\nRes=[W]\nCapabilities=[W]\nPass1&Pass2&Account&Domain&OS&LanMan=\n";

} else {

f1 = "Com2=[w]\nOff2=[d]\nBufSize=[d]\nMpxMax=[d]\nVcNum=[d]\nSessionKey=[W]\nPassLen=[d]\nCryptLen=[d]\nCryptOff=[d]\nPass&Name=\n";

else

f1 = "Com2=[B]\nRes1=[B]\nOff2=[d]\nMaxBuffer=[d]\nMaxMpx=[d]\nVcNumber=[d]\nSessionKey=[W]\nCaseInsensitivePasswordLength=[d]\nCaseSensitivePasswordLength=[d]\nRes=[W]\nCapabilities=[W]\nPass1&Pass2&Account&Domain&OS&LanMan=\n";

} else {

- if (wcnt == 3) {

+ if (wct == 3) {

f1 = "Com2=[w]\nOff2=[d]\nAction=[w]\n";

- } else if (wcnt == 13) {

+ } else if (wct == 13) {

f1 = "Com2=[B]\nRes=[B]\nOff2=[d]\nAction=[w]\n";

f2 = "NativeOS=[S]\nNativeLanMan=[S]\nPrimaryDomain=[S]\n";

}

if (f1)

f1 = "Com2=[B]\nRes=[B]\nOff2=[d]\nAction=[w]\n";

f2 = "NativeOS=[S]\nNativeLanMan=[S]\nPrimaryDomain=[S]\n";

}

if (f1)

- smb_fdata(words + 1, f1, SMBMIN(words + 1 + wcnt * 2, maxbuf));

- else

- print_data(words + 1, SMBMIN(wcnt * 2, PTR_DIFF(maxbuf, words + 1)));

-

- TCHECK2(*data, 2);

- if (f2)

- smb_fdata(data + 2, f2, SMBMIN(data + 2 + EXTRACT_LE_16BITS(data), maxbuf));

+ smb_fdata(ndo, words + 1, f1, min(words + 1 + wct * 2, maxbuf),

+ unicodestr);

else

- print_data(data + 2, SMBMIN(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2)));

+ print_data(ndo, words + 1, min(wct * 2, PTR_DIFF(maxbuf, words + 1)));

+

+ ND_TCHECK2(*data, 2);

+ bcc = EXTRACT_LE_16BITS(data);

+ ND_PRINT((ndo, "smb_bcc=%u\n", bcc));

+ if (bcc > 0) {

+ if (f2)

+ smb_fdata(ndo, data + 2, f2, min(data + 2 + EXTRACT_LE_16BITS(data),

+ maxbuf), unicodestr);

+ else

+ print_data(ndo, data + 2, min(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2)));

+ }

return;

trunc:

return;

trunc:

- printf("[|SMB]");

+ ND_PRINT((ndo, "%s", tstr));

+}

+

+static void

+print_lockingandx(netdissect_options *ndo,

+ const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf)

+{

+ u_int wct, bcc;

+ const u_char *maxwords;

+ const char *f1 = NULL, *f2 = NULL;

+

+ ND_TCHECK(words[0]);

+ wct = words[0];

+ if (request) {

+ f1 = "Com2=[w]\nOff2=[d]\nHandle=[d]\nLockType=[w]\nTimeOut=[D]\nUnlockCount=[d]\nLockCount=[d]\n";

+ ND_TCHECK(words[7]);

+ if (words[7] & 0x10)

+ f2 = "*Process=[d]\n[P2]Offset=[M]\nLength=[M]\n";

+ else

+ f2 = "*Process=[d]\nOffset=[D]\nLength=[D]\n";

+ } else {

+ f1 = "Com2=[w]\nOff2=[d]\n";

+ }

+

+ maxwords = min(words + 1 + wct * 2, maxbuf);

+ if (wct)

+ smb_fdata(ndo, words + 1, f1, maxwords, unicodestr);

+

+ ND_TCHECK2(*data, 2);

+ bcc = EXTRACT_LE_16BITS(data);

+ ND_PRINT((ndo, "smb_bcc=%u\n", bcc));

+ if (bcc > 0) {

+ if (f2)

+ smb_fdata(ndo, data + 2, f2, min(data + 2 + EXTRACT_LE_16BITS(data),

+ maxbuf), unicodestr);

+ else

+ print_data(ndo, data + 2, min(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2)));

+ }

return;

+trunc:

+ ND_PRINT((ndo, "%s", tstr));

}

-static struct smbfns smb_fns[] = {

+static const struct smbfns smb_fns[] = {

{ -1, "SMBunknown", 0, DEFDESCRIPT },

{ SMBtcon, "SMBtcon", 0,

{ -1, "SMBunknown", 0, DEFDESCRIPT },

{ SMBtcon, "SMBtcon", 0,

"Com2=[w]\nOff2=[d]\nCount=[d]\nRemaining=[d]\nRes=[W]\n",

NULL, NULL } },

"Com2=[w]\nOff2=[d]\nCount=[d]\nRemaining=[d]\nRes=[W]\n",

NULL, NULL } },

- { SMBlockingX, "SMBlockingX", FLG_CHAIN,

- { "Com2=[w]\nOff2=[d]\nHandle=[d]\nLockType=[w]\nTimeOut=[D]\nUnlockCount=[d]\nLockCount=[d]\n",

- "*Process=[d]\nOffset=[D]\nLength=[D]\n",

- "Com2=[w]\nOff2=[d]\n", NULL, NULL } },

-

{ SMBffirst, "SMBffirst", 0,

{ "Count=[d]\nAttrib=[A]\n",

"Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n",

{ SMBffirst, "SMBffirst", 0,

{ "Count=[d]\nAttrib=[A]\n",

"Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n",

{ SMBtconX, "SMBtconX", FLG_CHAIN,

{ "Com2=[w]\nOff2=[d]\nFlags=[w]\nPassLen=[d]\nPasswd&Path&Device=\n",

{ SMBtconX, "SMBtconX", FLG_CHAIN,

{ "Com2=[w]\nOff2=[d]\nFlags=[w]\nPassLen=[d]\nPasswd&Path&Device=\n",

- NULL, "Com2=[w]\nOff2=[d]\n", "ServiceType=[S]\n", NULL } },

+ NULL, "Com2=[w]\nOff2=[d]\n", "ServiceType=[R]\n", NULL } },

+

+ { SMBlockingX, "SMBlockingX", FLG_CHAIN,

+ { NULL, NULL, NULL, NULL, print_lockingandx } },

{ SMBtrans2, "SMBtrans2", 0, { NULL, NULL, NULL, NULL, print_trans2 } },

{ SMBnttranss, "SMBnttranss", 0, DEFDESCRIPT },

{ SMBntcreateX, "SMBntcreateX", FLG_CHAIN,

{ SMBnttranss, "SMBnttranss", 0, DEFDESCRIPT },

{ SMBntcreateX, "SMBntcreateX", FLG_CHAIN,

- { "Com2=[w]\nOff2=[d]\nRes=[b]\nNameLen=[d]\nFlags=[W]\nRootDirectoryFid=[D]\nAccessMask=[W]\nAllocationSize=[L]\nExtFileAttributes=[W]\nShareAccess=[W]\nCreateDisposition=[W]\nCreateOptions=[W]\nImpersonationLevel=[W]\nSecurityFlags=[b]\n",

- "Path=[S]\n",

+ { "Com2=[w]\nOff2=[d]\nRes=[b]\nNameLen=[ld]\nFlags=[W]\nRootDirectoryFid=[D]\nAccessMask=[W]\nAllocationSize=[L]\nExtFileAttributes=[W]\nShareAccess=[W]\nCreateDisposition=[W]\nCreateOptions=[W]\nImpersonationLevel=[W]\nSecurityFlags=[b]\n",

+ "Path=[C]\n",

"Com2=[w]\nOff2=[d]\nOplockLevel=[b]\nFid=[d]\nCreateAction=[W]\nCreateTime=[T3]LastAccessTime=[T3]LastWriteTime=[T3]ChangeTime=[T3]ExtFileAttributes=[W]\nAllocationSize=[L]\nEndOfFile=[L]\nFileType=[w]\nDeviceState=[w]\nDirectory=[b]\n",

NULL, NULL } },

"Com2=[w]\nOff2=[d]\nOplockLevel=[b]\nFid=[d]\nCreateAction=[W]\nCreateTime=[T3]LastAccessTime=[T3]LastWriteTime=[T3]ChangeTime=[T3]ExtFileAttributes=[W]\nAllocationSize=[L]\nEndOfFile=[L]\nFileType=[w]\nDeviceState=[w]\nDirectory=[b]\n",

NULL, NULL } },

* print a SMB message

*/

static void

* print a SMB message

*/

static void

-print_smb(const u_char *buf, const u_char *maxbuf)

+print_smb(netdissect_options *ndo,

+ const u_char *buf, const u_char *maxbuf)

{

+ uint16_t flags2;

+ int nterrcodes;

int command;

- const u_char *words, *data;

- struct smbfns *fn;

+ uint32_t nterror;

+ const u_char *words, *maxwords, *data;

+ const struct smbfns *fn;

const char *fmt_smbheader =

"[P4]SMB Command = [B]\nError class = [BP1]\nError code = [d]\nFlags1 = [B]\nFlags2 = [B][P13]\nTree ID = [d]\nProc ID = [d]\nUID = [d]\nMID = [d]\nWord Count = [b]\n";

const char *fmt_smbheader =

"[P4]SMB Command = [B]\nError class = [BP1]\nError code = [d]\nFlags1 = [B]\nFlags2 = [B][P13]\nTree ID = [d]\nProc ID = [d]\nUID = [d]\nMID = [d]\nWord Count = [b]\n";

+ int smboffset;

-

- TCHECK(buf[9]);

+ ND_TCHECK(buf[9]);

request = (buf[9] & 0x80) ? 0 : 1;

+ flags2 = EXTRACT_LE_16BITS(&buf[10]);

+ unicodestr = flags2 & 0x8000;

+ nterrcodes = flags2 & 0x4000;

+ startbuf = buf;

command = buf[4];

fn = smbfind(command, smb_fns);

command = buf[4];

fn = smbfind(command, smb_fns);

- if (vflag > 1)

- printf("\n");

+ if (ndo->ndo_vflag > 1)

+ ND_PRINT((ndo, "\n"));

- printf("SMB PACKET: %s (%s)\n", fn->name, request ? "REQUEST" : "REPLY");

+ ND_PRINT((ndo, "SMB PACKET: %s (%s)\n", fn->name, request ? "REQUEST" : "REPLY"));

- if (vflag < 2)

+ if (ndo->ndo_vflag < 2)

return;

/* print out the header */

return;

/* print out the header */

- smb_fdata(buf, fmt_smbheader, buf + 33);

+ smb_fdata(ndo, buf, fmt_smbheader, buf + 33, unicodestr);

- if (buf[5])

- printf("SMBError = %s\n", smb_errstr(buf[5], EXTRACT_LE_16BITS(&buf[7])));

+ if (nterrcodes) {

+ nterror = EXTRACT_LE_32BITS(&buf[5]);

+ if (nterror)

+ ND_PRINT((ndo, "NTError = %s\n", nt_errstr(nterror)));

+ } else {

+ if (buf[5])

+ ND_PRINT((ndo, "SMBError = %s\n", smb_errstr(buf[5], EXTRACT_LE_16BITS(&buf[7]))));

+ }

- words = buf + 32;

- TCHECK(words[0]);

+ smboffset = 32;

for (;;) {

const char *f1, *f2;

int wct;

u_int bcc;

for (;;) {

const char *f1, *f2;

int wct;

u_int bcc;

+ int newsmboffset;

- TCHECK(words[0]);

+ words = buf + smboffset;

+ ND_TCHECK(words[0]);

wct = words[0];

data = words + 1 + wct * 2;

wct = words[0];

data = words + 1 + wct * 2;

+ maxwords = min(data, maxbuf);

if (request) {

f1 = fn->descript.req_f1;

if (request) {

f1 = fn->descript.req_f1;

}

if (fn->descript.fn)

}

if (fn->descript.fn)

- (*fn->descript.fn)(words, data, buf, maxbuf);

+ (*fn->descript.fn)(ndo, words, data, buf, maxbuf);

else {

if (wct) {

else {

if (wct) {

- printf("smbvwv[]=\n");

if (f1)

- smb_fdata(words + 1, f1, words + 1 + wct * 2);

+ smb_fdata(ndo, words + 1, f1, words + 1 + wct * 2, unicodestr);

else {

int i;

int v;

else {

int i;

int v;

- for (i = 0; i < wct; i++) {

- TCHECK2(words[1 + 2 * i], 2);

+ for (i = 0; &words[1 + 2 * i] < maxwords; i++) {

+ ND_TCHECK2(words[1 + 2 * i], 2);

v = EXTRACT_LE_16BITS(words + 1 + 2 * i);

- printf("smb_vwv[%d]=%d (0x%X)\n", i, v, v);

+ ND_PRINT((ndo, "smb_vwv[%d]=%d (0x%X)\n", i, v, v));

}

- TCHECK2(*data, 2);

+ ND_TCHECK2(*data, 2);

bcc = EXTRACT_LE_16BITS(data);

+ ND_PRINT((ndo, "smb_bcc=%u\n", bcc));

if (f2) {

- if (bcc > 0) {

- printf("smbbuf[]=\n");

- smb_fdata(data + 2, f2, data + 2 + bcc);

- }

+ if (bcc > 0)

+ smb_fdata(ndo, data + 2, f2, data + 2 + bcc, unicodestr);

} else {

- printf("smb_bcc=%u\n", bcc);

if (bcc > 0) {

- printf("smb_buf[]=\n");

- print_data(data + 2, SMBMIN(bcc, PTR_DIFF(maxbuf, data + 2)));

+ ND_PRINT((ndo, "smb_buf[]=\n"));

+ print_data(ndo, data + 2, min(bcc, PTR_DIFF(maxbuf, data + 2)));

}

break;

if (wct == 0)

break;

if (wct == 0)

break;

- TCHECK(words[1]);

- command = EXTRACT_LE_16BITS(words + 1);

+ ND_TCHECK(words[1]);

+ command = words[1];

if (command == 0xFF)

break;

if (command == 0xFF)

break;

- TCHECK2(words[3], 2);

- words = buf + EXTRACT_LE_16BITS(words + 3);

+ ND_TCHECK2(words[3], 2);

+ newsmboffset = EXTRACT_LE_16BITS(words + 3);

fn = smbfind(command, smb_fns);

- printf("\nSMB PACKET: %s (%s) (CHAINED)\n",

- fn->name, request ? "REQUEST" : "REPLY");

+ ND_PRINT((ndo, "\nSMB PACKET: %s (%s) (CHAINED)\n",

+ fn->name, request ? "REQUEST" : "REPLY"));

+ if (newsmboffset <= smboffset) {

+ ND_PRINT((ndo, "Bad andX offset: %u <= %u\n", newsmboffset, smboffset));

+ break;

+ }

+ smboffset = newsmboffset;

}

- printf("\n");

+ ND_PRINT((ndo, "\n"));

return;

trunc:

return;

trunc:

- printf("[|SMB]");

- return;

+ ND_PRINT((ndo, "%s", tstr));

}

* print a NBT packet received across tcp on port 139

*/

void

* print a NBT packet received across tcp on port 139

*/

void

-nbt_tcp_print(const u_char *data, int length)

+nbt_tcp_print(netdissect_options *ndo,

+ const u_char *data, int length)

{

- const u_char *maxbuf = data + length;

- int flags;

+ int caplen;

+ int type;

u_int nbt_len;

+ const u_char *maxbuf;

- TCHECK2(data[2], 2);

- flags = data[0];

+ if (length < 4)

+ goto trunc;

+ if (ndo->ndo_snapend < data)

+ goto trunc;

+ caplen = ndo->ndo_snapend - data;

+ if (caplen < 4)

+ goto trunc;

+ maxbuf = data + caplen;

+ type = data[0];

nbt_len = EXTRACT_16BITS(data + 2);

+ length -= 4;

+ caplen -= 4;

startbuf = data;

- if (maxbuf <= data)

- return;

-

- if (vflag > 1)

- printf ("\n>>>");

-

- printf(" NBT Packet");

- if (vflag < 2)

- return;

-

- printf("\n");

-

- switch (flags) {

- case 1:

- printf("flags=0x%x\n", flags);

- case 0:

- data = smb_fdata(data, "NBT Session Packet\nFlags=[rw]\nLength=[rd]\n",

- data + 4);

- if (data == NULL)

+ if (ndo->ndo_vflag < 2) {

+ ND_PRINT((ndo, " NBT Session Packet: "));

+ switch (type) {

+ case 0x00:

+ ND_PRINT((ndo, "Session Message"));

break;

- if (memcmp(data,"\377SMB",4) == 0) {

- if (nbt_len > PTR_DIFF(maxbuf, data))

- printf("WARNING: Short packet. Try increasing the snap length (%lu)\n",

- (unsigned long)PTR_DIFF(maxbuf, data));

- print_smb(data, maxbuf > data + nbt_len ? data + nbt_len : maxbuf);

- } else

- printf("Session packet:(raw data?)\n");

- break;

case 0x81:

- data = smb_fdata(data,

- "NBT Session Request\nFlags=[rW]\nDestination=[n1]\nSource=[n1]\n",

- maxbuf);

+ ND_PRINT((ndo, "Session Request"));

break;

case 0x82:

break;

case 0x82:

- data = smb_fdata(data, "NBT Session Granted\nFlags=[rW]\n", maxbuf);

+ ND_PRINT((ndo, "Session Granted"));

break;

case 0x83:

{

int ecode;

break;

case 0x83:

{

int ecode;

- TCHECK(data[4]);

+ if (nbt_len < 4)

+ goto trunc;

+ if (length < 4)

+ goto trunc;

+ if (caplen < 4)

+ goto trunc;

ecode = data[4];

- data = smb_fdata(data, "NBT SessionReject\nFlags=[rW]\nReason=[B]\n",

- maxbuf);

+ ND_PRINT((ndo, "Session Reject, "));

switch (ecode) {

case 0x80:

switch (ecode) {

case 0x80:

- printf("Not listening on called name\n");

+ ND_PRINT((ndo, "Not listening on called name"));

break;

case 0x81:

break;

case 0x81:

- printf("Not listening for calling name\n");

+ ND_PRINT((ndo, "Not listening for calling name"));

break;

case 0x82:

break;

case 0x82:

- printf("Called name not present\n");

+ ND_PRINT((ndo, "Called name not present"));

break;

case 0x83:

break;

case 0x83:

- printf("Called name present, but insufficient resources\n");

+ ND_PRINT((ndo, "Called name present, but insufficient resources"));

break;

default:

break;

default:

- printf("Unspecified error 0x%X\n", ecode);

+ ND_PRINT((ndo, "Unspecified error 0x%X", ecode));

+ break;

+ }

+ break;

+

+ case 0x85:

+ ND_PRINT((ndo, "Session Keepalive"));

+ break;

+

+ default:

+ data = smb_fdata(ndo, data, "Unknown packet type [rB]", maxbuf, 0);

+ break;

+ }

+ } else {

+ ND_PRINT((ndo, "\n>>> NBT Session Packet\n"));

+ switch (type) {

+ case 0x00:

+ data = smb_fdata(ndo, data, "[P1]NBT Session Message\nFlags=[B]\nLength=[rd]\n",

+ data + 4, 0);

+ if (data == NULL)

+ break;

+ if (nbt_len >= 4 && caplen >= 4 && memcmp(data,"\377SMB",4) == 0) {

+ if ((int)nbt_len > caplen) {

+ if ((int)nbt_len > length)

+ ND_PRINT((ndo, "WARNING: Packet is continued in later TCP segments\n"));

+ else

+ ND_PRINT((ndo, "WARNING: Short packet. Try increasing the snap length by %d\n",

+ nbt_len - caplen));

+ }

+ print_smb(ndo, data, maxbuf > data + nbt_len ? data + nbt_len : maxbuf);

+ } else

+ ND_PRINT((ndo, "Session packet:(raw data or continuation?)\n"));

+ break;

+

+ case 0x81:

+ data = smb_fdata(ndo, data,

+ "[P1]NBT Session Request\nFlags=[B]\nLength=[rd]\nDestination=[n1]\nSource=[n1]\n",

+ maxbuf, 0);

+ break;

+

+ case 0x82:

+ data = smb_fdata(ndo, data, "[P1]NBT Session Granted\nFlags=[B]\nLength=[rd]\n", maxbuf, 0);

+ break;

+

+ case 0x83:

+ {

+ const u_char *origdata;

+ int ecode;

+

+ origdata = data;

+ data = smb_fdata(ndo, data, "[P1]NBT SessionReject\nFlags=[B]\nLength=[rd]\nReason=[B]\n",

+ maxbuf, 0);

+ if (data == NULL)

break;

+ if (nbt_len >= 1 && caplen >= 1) {

+ ecode = origdata[4];

+ switch (ecode) {

+ case 0x80:

+ ND_PRINT((ndo, "Not listening on called name\n"));

+ break;

+ case 0x81:

+ ND_PRINT((ndo, "Not listening for calling name\n"));

+ break;

+ case 0x82:

+ ND_PRINT((ndo, "Called name not present\n"));

+ break;

+ case 0x83:

+ ND_PRINT((ndo, "Called name present, but insufficient resources\n"));

+ break;

+ default:

+ ND_PRINT((ndo, "Unspecified error 0x%X\n", ecode));

+ break;

+ }

}

break;

case 0x85:

}

break;

case 0x85:

- data = smb_fdata(data, "NBT Session Keepalive\nFlags=[rW]\n", maxbuf);

+ data = smb_fdata(ndo, data, "[P1]NBT Session Keepalive\nFlags=[B]\nLength=[rd]\n", maxbuf, 0);

break;

default:

break;

default:

- printf("flags=0x%x\n", flags);

- data = smb_fdata(data, "NBT - Unknown packet type\nType=[rW]\n", maxbuf);

+ data = smb_fdata(ndo, data, "NBT - Unknown packet type\nType=[B]\n", maxbuf, 0);

+ break;

+ }

+ ND_PRINT((ndo, "\n"));

}

- printf("\n");

- fflush(stdout);

return;

trunc:

return;

trunc:

- printf("[|SMB]");

- return;

+ ND_PRINT((ndo, "%s", tstr));

}

+static const struct tok opcode_str[] = {

+ { 0, "QUERY" },

+ { 5, "REGISTRATION" },

+ { 6, "RELEASE" },

+ { 7, "WACK" },

+ { 8, "REFRESH(8)" },

+ { 9, "REFRESH" },

+ { 15, "MULTIHOMED REGISTRATION" },

+ { 0, NULL }

+};

/*

* print a NBT packet received across udp on port 137

*/

void

/*

* print a NBT packet received across udp on port 137

*/

void

-nbt_udp137_print(const u_char *data, int length)

+nbt_udp137_print(netdissect_options *ndo,

+ const u_char *data, int length)

{

const u_char *maxbuf = data + length;

int name_trn_id, response, opcode, nm_flags, rcode;

int qdcount, ancount, nscount, arcount;

{

const u_char *maxbuf = data + length;

int name_trn_id, response, opcode, nm_flags, rcode;

int qdcount, ancount, nscount, arcount;

- const char *opcodestr;

const u_char *p;

int total, i;

const u_char *p;

int total, i;

- TCHECK2(data[10], 2);

+ ND_TCHECK2(data[10], 2);

name_trn_id = EXTRACT_16BITS(data);

response = (data[2] >> 7);

opcode = (data[2] >> 3) & 0xF;

name_trn_id = EXTRACT_16BITS(data);

response = (data[2] >> 7);

opcode = (data[2] >> 3) & 0xF;

if (maxbuf <= data)

return;

if (maxbuf <= data)

return;

- if (vflag > 1)

- printf("\n>>> ");

-

- printf("NBT UDP PACKET(137): ");

+ if (ndo->ndo_vflag > 1)

+ ND_PRINT((ndo, "\n>>> "));

- switch (opcode) {

- case 0: opcodestr = "QUERY"; break;

- case 5: opcodestr = "REGISTRATION"; break;

- case 6: opcodestr = "RELEASE"; break;

- case 7: opcodestr = "WACK"; break;

- case 8: opcodestr = "REFRESH(8)"; break;

- case 9: opcodestr = "REFRESH"; break;

- case 15: opcodestr = "MULTIHOMED REGISTRATION"; break;

- default: opcodestr = "OPUNKNOWN"; break;

- }

- printf("%s", opcodestr);

+ ND_PRINT((ndo, "NBT UDP PACKET(137): %s", tok2str(opcode_str, "OPUNKNOWN", opcode)));

if (response) {

- if (rcode)

- printf("; NEGATIVE");

- else

- printf("; POSITIVE");

+ ND_PRINT((ndo, "; %s", rcode ? "NEGATIVE" : "POSITIVE"));

}

+ ND_PRINT((ndo, "; %s; %s", response ? "RESPONSE" : "REQUEST",

+ (nm_flags & 1) ? "BROADCAST" : "UNICAST"));

- if (response)

- printf("; RESPONSE");

- else

- printf("; REQUEST");

-

- if (nm_flags & 1)

- printf("; BROADCAST");

- else

- printf("; UNICAST");

-

- if (vflag < 2)

+ if (ndo->ndo_vflag < 2)

return;

- printf("\nTrnID=0x%X\nOpCode=%d\nNmFlags=0x%X\nRcode=%d\nQueryCount=%d\nAnswerCount=%d\nAuthorityCount=%d\nAddressRecCount=%d\n",

+ ND_PRINT((ndo, "\nTrnID=0x%X\nOpCode=%d\nNmFlags=0x%X\nRcode=%d\nQueryCount=%d\nAnswerCount=%d\nAuthorityCount=%d\nAddressRecCount=%d\n",

name_trn_id, opcode, nm_flags, rcode, qdcount, ancount, nscount,

- arcount);

+ arcount));

p = data + 12;

total = ancount + nscount + arcount;

if (qdcount > 100 || total > 100) {

p = data + 12;

total = ancount + nscount + arcount;

if (qdcount > 100 || total > 100) {

- printf("Corrupt packet??\n");

+ ND_PRINT((ndo, "Corrupt packet??\n"));

return;

}

if (qdcount) {

return;

}

if (qdcount) {

- printf("QuestionRecords:\n");

- for (i = 0; i < qdcount; i++)

- p = smb_fdata(p,

+ ND_PRINT((ndo, "QuestionRecords:\n"));

+ for (i = 0; i < qdcount; i++) {

+ p = smb_fdata(ndo, p,

"|Name=[n1]\nQuestionType=[rw]\nQuestionClass=[rw]\n#",

- maxbuf);

- if (p == NULL)

- goto out;

+ maxbuf, 0);

+ if (p == NULL)

+ goto out;

+ }

}

if (total) {

}

if (total) {

- printf("\nResourceRecords:\n");

+ ND_PRINT((ndo, "\nResourceRecords:\n"));

for (i = 0; i < total; i++) {

int rdlen;

int restype;

for (i = 0; i < total; i++) {

int rdlen;

int restype;

- p = smb_fdata(p, "Name=[n1]\n#", maxbuf);

+ p = smb_fdata(ndo, p, "Name=[n1]\n#", maxbuf, 0);

if (p == NULL)

goto out;

restype = EXTRACT_16BITS(p);

if (p == NULL)

goto out;

restype = EXTRACT_16BITS(p);

- p = smb_fdata(p, "ResType=[rw]\nResClass=[rw]\nTTL=[rD]\n", p + 8);

+ p = smb_fdata(ndo, p, "ResType=[rw]\nResClass=[rw]\nTTL=[rD]\n", p + 8, 0);

if (p == NULL)

goto out;

rdlen = EXTRACT_16BITS(p);

if (p == NULL)

goto out;

rdlen = EXTRACT_16BITS(p);

- printf("ResourceLength=%d\nResourceData=\n", rdlen);

+ ND_PRINT((ndo, "ResourceLength=%d\nResourceData=\n", rdlen));

p += 2;

if (rdlen == 6) {

p += 2;

if (rdlen == 6) {

- p = smb_fdata(p, "AddrType=[rw]\nAddress=[b.b.b.b]\n", p + rdlen);

+ p = smb_fdata(ndo, p, "AddrType=[rw]\nAddress=[b.b.b.b]\n", p + rdlen, 0);

if (p == NULL)

goto out;

} else {

if (restype == 0x21) {

int numnames;

if (p == NULL)

goto out;

} else {

if (restype == 0x21) {

int numnames;

- TCHECK(*p);

+ ND_TCHECK(*p);

numnames = p[0];

- p = smb_fdata(p, "NumNames=[B]\n", p + 1);

+ p = smb_fdata(ndo, p, "NumNames=[B]\n", p + 1, 0);

if (p == NULL)

goto out;

while (numnames--) {

if (p == NULL)

goto out;

while (numnames--) {

- p = smb_fdata(p, "Name=[n2]\t#", maxbuf);

- TCHECK(*p);

+ p = smb_fdata(ndo, p, "Name=[n2]\t#", maxbuf, 0);

+ if (p == NULL)

+ goto out;

+ ND_TCHECK(*p);

if (p[0] & 0x80)

- printf("<GROUP> ");

+ ND_PRINT((ndo, "<GROUP> "));

switch (p[0] & 0x60) {

- case 0x00: printf("B "); break;

- case 0x20: printf("P "); break;

- case 0x40: printf("M "); break;

- case 0x60: printf("_ "); break;

+ case 0x00: ND_PRINT((ndo, "B ")); break;

+ case 0x20: ND_PRINT((ndo, "P ")); break;

+ case 0x40: ND_PRINT((ndo, "M ")); break;

+ case 0x60: ND_PRINT((ndo, "_ ")); break;

}

if (p[0] & 0x10)

}

if (p[0] & 0x10)

- printf("<DEREGISTERING> ");

+ ND_PRINT((ndo, "<DEREGISTERING> "));

if (p[0] & 0x08)

- printf("<CONFLICT> ");

+ ND_PRINT((ndo, "<CONFLICT> "));

if (p[0] & 0x04)

- printf("<ACTIVE> ");

+ ND_PRINT((ndo, "<ACTIVE> "));

if (p[0] & 0x02)

- printf("<PERMANENT> ");

- printf("\n");

+ ND_PRINT((ndo, "<PERMANENT> "));

+ ND_PRINT((ndo, "\n"));

p += 2;

}

} else {

p += 2;

}

} else {

- print_data(p, min(rdlen, length - (p - data)));

+ print_data(ndo, p, min(rdlen, length - (p - data)));

p += rdlen;

}

p += rdlen;

}

if (p < maxbuf)

}

if (p < maxbuf)

- smb_fdata(p, "AdditionalData:\n", maxbuf);

+ smb_fdata(ndo, p, "AdditionalData:\n", maxbuf, 0);

out:

- printf("\n");

- fflush(stdout);

+ ND_PRINT((ndo, "\n"));

return;

trunc:

return;

trunc:

- printf("[|SMB]");

- return;

+ ND_PRINT((ndo, "%s", tstr));

}

+/*

+ * Print an SMB-over-TCP packet received across tcp on port 445

+ */

+void

+smb_tcp_print(netdissect_options *ndo,

+ const u_char * data, int length)

+{

+ int caplen;

+ u_int smb_len;

+ const u_char *maxbuf;

+

+ if (length < 4)

+ goto trunc;

+ if (ndo->ndo_snapend < data)

+ goto trunc;

+ caplen = ndo->ndo_snapend - data;

+ if (caplen < 4)

+ goto trunc;

+ maxbuf = data + caplen;

+ smb_len = EXTRACT_24BITS(data + 1);

+ length -= 4;

+ caplen -= 4;

+ startbuf = data;

+ data += 4;

+

+ if (smb_len >= 4 && caplen >= 4 && memcmp(data,"\377SMB",4) == 0) {

+ if ((int)smb_len > caplen) {

+ if ((int)smb_len > length)

+ ND_PRINT((ndo, " WARNING: Packet is continued in later TCP segments\n"));

+ else

+ ND_PRINT((ndo, " WARNING: Short packet. Try increasing the snap length by %d\n",

+ smb_len - caplen));

+ } else

+ ND_PRINT((ndo, " "));

+ print_smb(ndo, data, maxbuf > data + smb_len ? data + smb_len : maxbuf);

+ } else

+ ND_PRINT((ndo, " SMB-over-TCP packet:(raw data or continuation?)\n"));

+ return;

+trunc:

+ ND_PRINT((ndo, "%s", tstr));

+}

/*

* print a NBT packet received across udp on port 138

*/

void

/*

* print a NBT packet received across udp on port 138

*/

void

-nbt_udp138_print(const u_char *data, int length)

+nbt_udp138_print(netdissect_options *ndo,

+ const u_char *data, int length)

{

const u_char *maxbuf = data + length;

{

const u_char *maxbuf = data + length;

- if (maxbuf > snapend)

- maxbuf = snapend;

+ if (maxbuf > ndo->ndo_snapend)

+ maxbuf = ndo->ndo_snapend;

if (maxbuf <= data)

return;

startbuf = data;

if (maxbuf <= data)

return;

startbuf = data;

- if (vflag < 2) {

- printf("NBT UDP PACKET(138)");

+ if (ndo->ndo_vflag < 2) {

+ ND_PRINT((ndo, "NBT UDP PACKET(138)"));

return;

}

return;

}

- data = smb_fdata(data,

+ data = smb_fdata(ndo, data,

"\n>>> NBT UDP PACKET(138) Res=[rw] ID=[rw] IP=[b.b.b.b] Port=[rd] Length=[rd] Res2=[rw]\nSourceName=[n1]\nDestName=[n1]\n#",

- maxbuf);

+ maxbuf, 0);

if (data != NULL) {

/* If there isn't enough data for "\377SMB", don't check for it. */

if (data != NULL) {

/* If there isn't enough data for "\377SMB", don't check for it. */

goto out;

if (memcmp(data, "\377SMB",4) == 0)

goto out;

if (memcmp(data, "\377SMB",4) == 0)

- print_smb(data, maxbuf);

+ print_smb(ndo, data, maxbuf);

}

out:

}

out:

- printf("\n");

- fflush(stdout);

+ ND_PRINT((ndo, "\n"));

}

};

void

};

void

-netbeui_print(u_short control, const u_char *data, int length)

+netbeui_print(netdissect_options *ndo,

+ u_short control, const u_char *data, int length)

{

const u_char *maxbuf = data + length;

int len;

{

const u_char *maxbuf = data + length;

int len;

const u_char *data2;

int is_truncated = 0;

const u_char *data2;

int is_truncated = 0;

- if (maxbuf > snapend)

- maxbuf = snapend;

- TCHECK(data[4]);

+ if (maxbuf > ndo->ndo_snapend)

+ maxbuf = ndo->ndo_snapend;

+ ND_TCHECK(data[4]);

len = EXTRACT_LE_16BITS(data);

command = data[4];

data2 = data + len;

len = EXTRACT_LE_16BITS(data);

command = data[4];

data2 = data + len;

startbuf = data;

- if (vflag < 2) {

- printf("NBF Packet: ");

- data = smb_fdata(data, "[P5]#", maxbuf);

+ if (ndo->ndo_vflag < 2) {

+ ND_PRINT((ndo, "NBF Packet: "));

+ data = smb_fdata(ndo, data, "[P5]#", maxbuf, 0);

} else {

- printf("\n>>> NBF Packet\nType=0x%X ", control);

- data = smb_fdata(data, "Length=[d] Signature=[w] Command=[B]\n#", maxbuf);

+ ND_PRINT((ndo, "\n>>> NBF Packet\nType=0x%X ", control));

+ data = smb_fdata(ndo, data, "Length=[d] Signature=[w] Command=[B]\n#", maxbuf, 0);

}

if (data == NULL)

goto out;

if (command > 0x1f || nbf_strings[command].name == NULL) {

}

if (data == NULL)

goto out;

if (command > 0x1f || nbf_strings[command].name == NULL) {

- if (vflag < 2)

- data = smb_fdata(data, "Unknown NBF Command#", data2);

+ if (ndo->ndo_vflag < 2)

+ data = smb_fdata(ndo, data, "Unknown NBF Command#", data2, 0);

else

- data = smb_fdata(data, "Unknown NBF Command\n", data2);

+ data = smb_fdata(ndo, data, "Unknown NBF Command\n", data2, 0);

} else {

- if (vflag < 2) {

- printf("%s", nbf_strings[command].name);

+ if (ndo->ndo_vflag < 2) {

+ ND_PRINT((ndo, "%s", nbf_strings[command].name));

if (nbf_strings[command].nonverbose != NULL)

- data = smb_fdata(data, nbf_strings[command].nonverbose, data2);

+ data = smb_fdata(ndo, data, nbf_strings[command].nonverbose, data2, 0);

} else {

- printf("%s:\n", nbf_strings[command].name);

+ ND_PRINT((ndo, "%s:\n", nbf_strings[command].name));

if (nbf_strings[command].verbose != NULL)

- data = smb_fdata(data, nbf_strings[command].verbose, data2);

+ data = smb_fdata(ndo, data, nbf_strings[command].verbose, data2, 0);

else

- printf("\n");

+ ND_PRINT((ndo, "\n"));

}

- if (vflag < 2)

+ if (ndo->ndo_vflag < 2)

return;

if (data == NULL)

return;

if (data == NULL)

goto out;

if (memcmp(data2, "\377SMB",4) == 0)

goto out;

if (memcmp(data2, "\377SMB",4) == 0)

- print_smb(data2, maxbuf);

+ print_smb(ndo, data2, maxbuf);

else {

int i;

for (i = 0; i < 128; i++) {

if (&data2[i + 3] >= maxbuf)

break;

if (memcmp(&data2[i], "\377SMB", 4) == 0) {

else {

int i;

for (i = 0; i < 128; i++) {

if (&data2[i + 3] >= maxbuf)

break;

if (memcmp(&data2[i], "\377SMB", 4) == 0) {

- printf("found SMB packet at %d\n", i);

- print_smb(&data2[i], maxbuf);

+ ND_PRINT((ndo, "found SMB packet at %d\n", i));

+ print_smb(ndo, &data2[i], maxbuf);

break;

}

out:

break;

}

out:

- printf("\n");

+ ND_PRINT((ndo, "\n"));

return;

trunc:

return;

trunc:

- printf("[|SMB]");

- return;

+ ND_PRINT((ndo, "%s", tstr));

}

* print IPX-Netbios frames

*/

void

* print IPX-Netbios frames

*/

void

-ipx_netbios_print(const u_char *data, u_int length)

+ipx_netbios_print(netdissect_options *ndo,

+ const u_char *data, u_int length)

{

/*

* this is a hack till I work out how to parse the rest of the

{

/*

* this is a hack till I work out how to parse the rest of the

maxbuf = data + length;

/* Don't go past the end of the captured data in the packet. */

maxbuf = data + length;

/* Don't go past the end of the captured data in the packet. */

- if (maxbuf > snapend)

- maxbuf = snapend;

+ if (maxbuf > ndo->ndo_snapend)

+ maxbuf = ndo->ndo_snapend;

startbuf = data;

for (i = 0; i < 128; i++) {

if (&data[i + 4] > maxbuf)

break;

if (memcmp(&data[i], "\377SMB", 4) == 0) {

startbuf = data;

for (i = 0; i < 128; i++) {

if (&data[i + 4] > maxbuf)

break;

if (memcmp(&data[i], "\377SMB", 4) == 0) {

- smb_fdata(data, "\n>>> IPX transport ", &data[i]);

- if (data != NULL)

- print_smb(&data[i], maxbuf);

- printf("\n");

- fflush(stdout);

+ smb_fdata(ndo, data, "\n>>> IPX transport ", &data[i], 0);

+ print_smb(ndo, &data[i], maxbuf);

+ ND_PRINT((ndo, "\n"));

break;

}

if (i == 128)

break;

}

if (i == 128)

- smb_fdata(data, "\n>>> Unknown IPX ", maxbuf);

+ smb_fdata(ndo, data, "\n>>> Unknown IPX ", maxbuf, 0);

}