X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/bcf0fb3b48edc9e642c4101e2ccf964a30cdb6f1..c177cb3800a9a68d79b2812f0ffcb9479abd6eb8:/print-smb.c diff --git a/print-smb.c b/print-smb.c index e4bacbbc..723b9a03 100644 --- a/print-smb.c +++ b/print-smb.c @@ -6,16 +6,17 @@ * or later */ -#define NETDISSECT_REWORKED +/* \summary: SMB/CIFS printer */ + #ifdef HAVE_CONFIG_H #include "config.h" #endif -#include +#include #include -#include "interface.h" +#include "netdissect.h" #include "extract.h" #include "smb.h" @@ -100,7 +101,7 @@ trans2_findfirst(netdissect_options *ndo, smb_fdata(ndo, param, fmt, param + pcnt, unicodestr); if (dcnt) { ND_PRINT((ndo, "data:\n")); - print_data(ndo, data, dcnt); + smb_print_data(ndo, data, dcnt); } } @@ -135,7 +136,7 @@ trans2_qfsinfo(netdissect_options *ndo, } if (dcnt) { ND_PRINT((ndo, "data:\n")); - print_data(ndo, data, dcnt); + smb_print_data(ndo, data, dcnt); } return; trunc: @@ -416,7 +417,7 @@ print_negprot(netdissect_options *ndo, smb_fdata(ndo, words + 1, f1, min(words + 1 + wct * 2, maxbuf), unicodestr); else - print_data(ndo, words + 1, min(wct * 2, PTR_DIFF(maxbuf, words + 1))); + smb_print_data(ndo, words + 1, min(wct * 2, PTR_DIFF(maxbuf, words + 1))); ND_TCHECK2(*data, 2); bcc = EXTRACT_LE_16BITS(data); @@ -426,7 +427,7 @@ print_negprot(netdissect_options *ndo, smb_fdata(ndo, data + 2, f2, min(data + 2 + EXTRACT_LE_16BITS(data), maxbuf), unicodestr); else - print_data(ndo, data + 2, min(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2))); + smb_print_data(ndo, data + 2, min(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2))); } return; trunc: @@ -460,7 +461,7 @@ print_sesssetup(netdissect_options *ndo, smb_fdata(ndo, words + 1, f1, min(words + 1 + wct * 2, maxbuf), unicodestr); else - print_data(ndo, words + 1, min(wct * 2, PTR_DIFF(maxbuf, words + 1))); + smb_print_data(ndo, words + 1, min(wct * 2, PTR_DIFF(maxbuf, words + 1))); ND_TCHECK2(*data, 2); bcc = EXTRACT_LE_16BITS(data); @@ -470,7 +471,7 @@ print_sesssetup(netdissect_options *ndo, smb_fdata(ndo, data + 2, f2, min(data + 2 + EXTRACT_LE_16BITS(data), maxbuf), unicodestr); else - print_data(ndo, data + 2, min(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2))); + smb_print_data(ndo, data + 2, min(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2))); } return; trunc: @@ -510,7 +511,7 @@ print_lockingandx(netdissect_options *ndo, smb_fdata(ndo, data + 2, f2, min(data + 2 + EXTRACT_LE_16BITS(data), maxbuf), unicodestr); else - print_data(ndo, data + 2, min(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2))); + smb_print_data(ndo, data + 2, min(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2))); } return; trunc: @@ -793,10 +794,10 @@ static void print_smb(netdissect_options *ndo, const u_char *buf, const u_char *maxbuf) { - u_int16_t flags2; + uint16_t flags2; int nterrcodes; int command; - u_int32_t nterror; + uint32_t nterror; const u_char *words, *maxwords, *data; const struct smbfns *fn; const char *fmt_smbheader = @@ -805,9 +806,6 @@ print_smb(netdissect_options *ndo, ND_TCHECK(buf[9]); request = (buf[9] & 0x80) ? 0 : 1; - flags2 = EXTRACT_LE_16BITS(&buf[10]); - unicodestr = flags2 & 0x8000; - nterrcodes = flags2 & 0x4000; startbuf = buf; command = buf[4]; @@ -822,6 +820,11 @@ print_smb(netdissect_options *ndo, if (ndo->ndo_vflag < 2) return; + ND_TCHECK_16BITS(&buf[10]); + flags2 = EXTRACT_LE_16BITS(&buf[10]); + unicodestr = flags2 & 0x8000; + nterrcodes = flags2 & 0x4000; + /* print out the header */ smb_fdata(ndo, buf, fmt_smbheader, buf + 33, unicodestr); @@ -883,7 +886,7 @@ print_smb(netdissect_options *ndo, } else { if (bcc > 0) { ND_PRINT((ndo, "smb_buf[]=\n")); - print_data(ndo, data + 2, min(bcc, PTR_DIFF(maxbuf, data + 2))); + smb_print_data(ndo, data + 2, min(bcc, PTR_DIFF(maxbuf, data + 2))); } } } @@ -1079,6 +1082,16 @@ trunc: ND_PRINT((ndo, "%s", tstr)); } +static const struct tok opcode_str[] = { + { 0, "QUERY" }, + { 5, "REGISTRATION" }, + { 6, "RELEASE" }, + { 7, "WACK" }, + { 8, "REFRESH(8)" }, + { 9, "REFRESH" }, + { 15, "MULTIHOMED REGISTRATION" }, + { 0, NULL } +}; /* * print a NBT packet received across udp on port 137 @@ -1090,7 +1103,6 @@ nbt_udp137_print(netdissect_options *ndo, const u_char *maxbuf = data + length; int name_trn_id, response, opcode, nm_flags, rcode; int qdcount, ancount, nscount, arcount; - const char *opcodestr; const u_char *p; int total, i; @@ -1112,35 +1124,12 @@ nbt_udp137_print(netdissect_options *ndo, if (ndo->ndo_vflag > 1) ND_PRINT((ndo, "\n>>> ")); - ND_PRINT((ndo, "NBT UDP PACKET(137): ")); - - switch (opcode) { - case 0: opcodestr = "QUERY"; break; - case 5: opcodestr = "REGISTRATION"; break; - case 6: opcodestr = "RELEASE"; break; - case 7: opcodestr = "WACK"; break; - case 8: opcodestr = "REFRESH(8)"; break; - case 9: opcodestr = "REFRESH"; break; - case 15: opcodestr = "MULTIHOMED REGISTRATION"; break; - default: opcodestr = "OPUNKNOWN"; break; - } - ND_PRINT((ndo, "%s", opcodestr)); + ND_PRINT((ndo, "NBT UDP PACKET(137): %s", tok2str(opcode_str, "OPUNKNOWN", opcode))); if (response) { - if (rcode) - ND_PRINT((ndo, "; NEGATIVE")); - else - ND_PRINT((ndo, "; POSITIVE")); + ND_PRINT((ndo, "; %s", rcode ? "NEGATIVE" : "POSITIVE")); } - - if (response) - ND_PRINT((ndo, "; RESPONSE")); - else - ND_PRINT((ndo, "; REQUEST")); - - if (nm_flags & 1) - ND_PRINT((ndo, "; BROADCAST")); - else - ND_PRINT((ndo, "; UNICAST")); + ND_PRINT((ndo, "; %s; %s", response ? "RESPONSE" : "REQUEST", + (nm_flags & 1) ? "BROADCAST" : "UNICAST")); if (ndo->ndo_vflag < 2) return; @@ -1178,10 +1167,12 @@ nbt_udp137_print(netdissect_options *ndo, p = smb_fdata(ndo, p, "Name=[n1]\n#", maxbuf, 0); if (p == NULL) goto out; + ND_TCHECK_16BITS(p); restype = EXTRACT_16BITS(p); p = smb_fdata(ndo, p, "ResType=[rw]\nResClass=[rw]\nTTL=[rD]\n", p + 8, 0); if (p == NULL) goto out; + ND_TCHECK_16BITS(p); rdlen = EXTRACT_16BITS(p); ND_PRINT((ndo, "ResourceLength=%d\nResourceData=\n", rdlen)); p += 2; @@ -1223,7 +1214,7 @@ nbt_udp137_print(netdissect_options *ndo, p += 2; } } else { - print_data(ndo, p, min(rdlen, length - (p - data))); + smb_print_data(ndo, p, min(rdlen, length - (p - data))); p += rdlen; } } @@ -1269,14 +1260,15 @@ smb_tcp_print(netdissect_options *ndo, if (smb_len >= 4 && caplen >= 4 && memcmp(data,"\377SMB",4) == 0) { if ((int)smb_len > caplen) { if ((int)smb_len > length) - ND_PRINT((ndo, "WARNING: Packet is continued in later TCP segments\n")); + ND_PRINT((ndo, " WARNING: Packet is continued in later TCP segments\n")); else - ND_PRINT((ndo, "WARNING: Short packet. Try increasing the snap length by %d\n", + ND_PRINT((ndo, " WARNING: Short packet. Try increasing the snap length by %d\n", smb_len - caplen)); - } + } else + ND_PRINT((ndo, " ")); print_smb(ndo, data, maxbuf > data + smb_len ? data + smb_len : maxbuf); } else - ND_PRINT((ndo, "SMB-over-TCP packet:(raw data or continuation?)\n")); + ND_PRINT((ndo, " SMB-over-TCP packet:(raw data or continuation?)\n")); return; trunc: ND_PRINT((ndo, "%s", tstr)); @@ -1322,7 +1314,7 @@ out: /* print netbeui frames */ -struct nbf_strings { +static struct nbf_strings { const char *name; const char *nonverbose; const char *verbose;