Wireshark · Ethereal-dev: [Ethereal-dev] packet-smb-mailslot

["Pia Sahlberg" <piabar@xxxxxxxxxxx>]

Hi list,

 

New try.

patch.1   is a one-line fix for packet-smb-pipe

 

patch.2  is the tvbuffified packet-smb-mailslot dissector.

it also contains two small changes for packet-smb-pipe that made it dump core.

(in the nightly snapshot i downloaded yesterday, it might already have been fixed)

 

best regards

    ronnie s

 

 

---

Get your FREE download of MSN Explorer at http://explorer.msn.com
diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-smb-pipe.c 
ethereal/packet-smb-pipe.c
--- ethereal-orig/packet-smb-pipe.c	Sun Aug  5 11:15:26 2001
+++ ethereal/packet-smb-pipe.c	Mon Aug  6 09:38:18 2001
@@ -666,7 +666,7 @@

	/* max storage */
	max_storage = tvb_get_letohl(tvb, offset);
-	if (nlogons == 0xffffffff)
+	if (max_storage == 0xffffffff)
		proto_tree_add_uint_format(tree, hf_max_storage, tvb, offset, 4,
		    max_storage, "Max Storage: No limit");
	else

diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-smb-mailslot.c 
ethereal/packet-smb-mailslot.c
--- ethereal-orig/packet-smb-mailslot.c	Sun Aug  5 10:16:36 2001
+++ ethereal/packet-smb-mailslot.c	Mon Aug  6 11:09:21 2001
@@ -33,127 +33,105 @@
#include "packet-smb-pipe.h"

static int proto_smb_msp = -1;
+static int hf_opcode = -1;
+static int hf_priority = -1;
+static int hf_class = -1;
+static int hf_size = -1;
+static int hf_name = -1;

static int ett_smb_msp = -1;

-gboolean
-dissect_mailslot_smb(const u_char *pd, int offset, frame_data *fd,
-	proto_tree *parent, proto_tree *tree, struct smb_info si, int max_data,
-	int SMB_offset, int errcode, const u_char *command,
-	int DataOffset, int DataCount, int ParameterOffset, int ParameterCount){
-
+static const value_string opcode_vals[] = {
+	{1,	"Write Mail Slot"},
+	{0,	NULL}
+};
+
+static const value_string class_vals[] = {
+	{1,	"Reliable"},
+	{2,	"Unreliable & Broadcast"},
+	{0,	NULL}
+};

/* decode the SMB mail slot protocol */
+gboolean
+dissect_mailslot_smb(tvbuff_t *tvb, packet_info *pinfo, proto_tree 
*parent_tree)
+{
+	struct smb_info *smb_info = pinfo->private;
+   	proto_tree      *tree = 0;
+   	proto_item      *item;
+	tvbuff_t *next_tvb = NULL;
+   	guint16  opcode;
+	int offset = 0;
+	int len;

-   	proto_tree      *smb_msp_tree = 0;
-   	proto_item      *ti;
-
-   	guint16  Temp16;
-   	const char *StrPtr;
-
-	if (!proto_is_protocol_enabled(proto_smb_msp))
+	if (!proto_is_protocol_enabled(proto_smb_msp)) {
		return FALSE;
+	}

-	if (check_col(fd, COL_PROTOCOL))
-		col_set_str(fd, COL_PROTOCOL, "SMB Mailslot");
+	if (check_col(pinfo->fd, COL_PROTOCOL)) {
+		col_set_str(pinfo->fd, COL_PROTOCOL, "SMB Mailslot");
+	}

-	if (DataOffset < 0) {
+	if (smb_info->data_offset < 0) {
		/* Interim reply */
-		col_set_str(fd, COL_INFO, "Interim reply");
+		col_set_str(pinfo->fd, COL_INFO, "Interim reply");
		return TRUE;
	}

- /* do the Op code field */
-
-    	Temp16 = GSHORT(pd, offset);		/* get Op code */
-
-	if (check_col(fd, COL_INFO))
-		  col_set_str(fd, COL_INFO,
-		      ( Temp16 == 1 ? "Write Mail slot" : "Unknown"));
+	 /* do the opcode field */
+	opcode = tvb_get_letohs(tvb, offset);

+	if (check_col(pinfo->fd, COL_INFO)) {
+		  col_set_str(pinfo->fd, COL_INFO,
+		      val_to_str(opcode, opcode_vals, "Unknown opcode:0x%04x"));
+	}

-    	if (tree) {
-		ti = proto_tree_add_item( parent, proto_smb_msp, NullTVB, offset,
-			END_OF_FRAME, FALSE);
-		smb_msp_tree = proto_item_add_subtree(ti, ett_smb_msp);
-
- 		proto_tree_add_text(smb_msp_tree, NullTVB, offset, 2, "Op code: %u 
(%s)",
- 			Temp16, ( Temp16 == 1 ? "Write Mail slot" : "Unknown"));

-	  	offset += 2;
-
-   						/* do the Priority field */
-     		Temp16 = GSHORT(pd, offset);
-     		proto_tree_add_text(smb_msp_tree, NullTVB, offset, 2,
-     			"Priority of transaction: %u", Temp16);
-
-   		offset += 2;
-
-    						/* do the Class field */
-      		Temp16 = GSHORT(pd, offset);
-
-      		proto_tree_add_text(smb_msp_tree, NullTVB, offset, 2, "Class: %u 
(%s)",
-      			Temp16, ( Temp16 == 1) ? "Reliable" : (( Temp16 == 2) ?
-      			"Unreliable & Broadcast" : "Unknown"));
-
-	   	offset += 2;
-
-     			 			/* do the data size field */
-     		Temp16 = GSHORT(pd, offset);
-     		proto_tree_add_text(smb_msp_tree, NullTVB, offset, 2,
-     			"Total size of mail data: %u", Temp16);
-
-	   	offset += 2;
-	}else {					/* no tree value adjust offset*/
-		offset += 8;
-	}
-
-    					/* Build display for: MailSlot Name */
-
-    	StrPtr = &pd[offset];		/* load pointer to name	*/
-
- 	if (smb_msp_tree) {
-		proto_tree_add_text(smb_msp_tree, NullTVB, offset, strlen( StrPtr) + 1,
-			"Mailslot Name: %s", StrPtr);
-    	}
+    	if (parent_tree) {
+		item = proto_tree_add_item(parent_tree, proto_smb_msp, tvb, offset,
+			tvb_length_remaining(tvb, offset), FALSE);
+		tree = proto_item_add_subtree(item, ett_smb_msp);
+	}

-	offset += strlen( StrPtr) + 1;
-
-/*** Decide what dissector to call based upon the command value ***/
+	/* opcode */
+	proto_tree_add_uint(tree, hf_opcode, tvb, offset, 2, opcode);
+	offset += 2;
+
+	/* priority */
+	proto_tree_add_uint(tree, hf_priority, tvb, offset, 2, tvb_get_letohs(tvb, 
offset));
+	offset += 2;

-  	if (command != NULL && strcmp(command, "BROWSE") == 0) {
-  		/* Decode a browse */
-
-		tvbuff_t *tvb;
-		packet_info *pinfo = &pi;
-		tvb = tvb_create_from_top(DataOffset);
-
-		return dissect_mailslot_browse(tvb, pinfo, parent);
-  	}
-
-  	else if (command != NULL && strcmp(command, "LANMAN") == 0) {
+	/* class */
+	proto_tree_add_uint(tree, hf_class, tvb, offset, 2, tvb_get_letohs(tvb, 
offset));
+	offset += 2;
+
+	/* size */
+	proto_tree_add_uint(tree, hf_size, tvb, offset, 2, tvb_get_letohs(tvb, 
offset));
+	offset += 2;
+
+	/* mailslot name */
+	len = tvb_strsize(tvb, offset);
+	proto_tree_add_item(tree, hf_name, tvb, offset, len, TRUE);
+	offset += len;
+
+
+	/* create new tvb for subdissector */
+ 	next_tvb = tvb_new_subset(tvb, offset, -1, -1);
+
+	/*** Decide what dissector to call based upon the command value ***/
+  	if (smb_info->trans_cmd && strcmp(smb_info->trans_cmd, "BROWSE") == 0) {
+		return dissect_mailslot_browse(next_tvb, pinfo, parent_tree);
+  	} else if (smb_info->trans_cmd && strcmp(smb_info->trans_cmd, "LANMAN") 
== 0) {
		/* Decode a LANMAN browse */
-
-		tvbuff_t *tvb;
-		packet_info *pinfo = &pi;
-		tvb = tvb_create_from_top(DataOffset);
-
-		return dissect_mailslot_lanman(tvb, pinfo, parent);
-  	}
-
+		return dissect_mailslot_lanman(next_tvb, pinfo, parent_tree);
+  	} else if (((smb_info->trans_cmd) &&
+		  strncmp(smb_info->trans_cmd, "NET", strlen("NET")) == 0) ||
+		 (strcmp(smb_info->trans_cmd, "TEMP\\NETLOGON") == 0) ||
+		 (strcmp(smb_info->trans_cmd, "MSSP") == 0)){
/* NOTE: use TEMP\\NETLOGON and MSSP because they seems very common,	*/
/* NOTE: may need a look up list to check for the mailslot names passed	*/
/*		by the logon request packet */
-
-  	else if (((command != NULL) &&
-		  strncmp(command, "NET", strlen("NET")) == 0) ||
-		 (strcmp(command, "TEMP\\NETLOGON") == 0) ||
-		 (strcmp(command, "MSSP") == 0)){
-		tvbuff_t *tvb;
-		packet_info *pinfo = &pi;
-		tvb = tvb_create_from_top(DataOffset);
-
-		return dissect_smb_logon(tvb, pinfo, parent);
+		return dissect_smb_logon(next_tvb, pinfo, parent_tree);

	 }
  	return TRUE;
@@ -163,6 +141,28 @@
void
register_proto_smb_mailslot( void){

+	static hf_register_info hf[] = {
+		{ &hf_opcode,
+			{ "Opcode", "mailslot.opcode", FT_UINT16, BASE_DEC,
+			VALS(opcode_vals), 0, "MAILSLOT OpCode", HFILL }},
+
+		{ &hf_priority,
+			{ "Priority", "mailslot.priority", FT_UINT16, BASE_DEC,
+			NULL, 0, "MAILSLOT Priority of transaction", HFILL }},
+
+		{ &hf_class,
+			{ "Class", "mailslot.class", FT_UINT16, BASE_DEC,
+			VALS(class_vals), 0, "MAILSLOT Class of transaction", HFILL }},
+
+		{ &hf_size,
+			{ "Size", "mailslot.size", FT_UINT16, BASE_DEC,
+			NULL, 0, "MAILSLOT Total size of mail data", HFILL }},
+
+		{ &hf_name,
+			{ "Mailslot Name", "mailslot.name", FT_STRING, BASE_NONE,
+			NULL, 0, "MAILSLOT Name of mailslot", HFILL }},
+
+	};

	static gint *ett[] = {
		&ett_smb_msp
@@ -171,5 +171,6 @@
   	proto_smb_msp = proto_register_protocol(
   		"SMB MailSlot Protocol", "SMB Mailslot", "mailslot");

+	proto_register_field_array(proto_smb_msp, hf, array_length(hf));
	proto_register_subtree_array(ett, array_length(ett));
}
diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-smb-mailslot.h 
ethereal/packet-smb-mailslot.h
--- ethereal-orig/packet-smb-mailslot.h	Sun Aug  5 10:16:36 2001
+++ ethereal/packet-smb-mailslot.h	Mon Aug  6 10:57:46 2001
@@ -23,8 +23,11 @@
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, 
USA.
 */

+#ifndef _PACKET_SMB_MAILSLOT_H_
+#define _PACKET_SMB_MAILSLOT_H_
+
gboolean
-dissect_mailslot_smb(const u_char *pd, int offset, frame_data *fd,
-	proto_tree *parent, proto_tree *tree, struct smb_info si, int max_data,
-	int SMB_offset, int errcode, const u_char *command,
-	int DataOffset, int DataCount, int ParameterOffset, int ParameterCount);
+dissect_mailslot_smb(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
+
+#endif
+
diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-smb-pipe.c 
ethereal/packet-smb-pipe.c
--- ethereal-orig/packet-smb-pipe.c	Mon Aug  6 09:51:46 2001
+++ ethereal/packet-smb-pipe.c	Mon Aug  6 11:05:02 2001
@@ -1420,7 +1420,7 @@
		param_descriptor_len = tvb_strsize(tvb, offset);
		proto_tree_add_item(tree, hf_param_desc, tvb, offset,
		    param_descriptor_len, TRUE);
-		if (pinfo->fd->flags.visited) {
+		if (!pinfo->fd->flags.visited) {
			/*
			 * Save the parameter descriptor for future use.
			 */
@@ -1436,7 +1436,7 @@
		return_descriptor_len = tvb_strsize(tvb, offset);
		proto_tree_add_item(tree, hf_return_desc, tvb, offset,
		    return_descriptor_len, TRUE);
-		if (pinfo->fd->flags.visited) {
+		if (!pinfo->fd->flags.visited) {
			/*
			 * Save the return descriptor for future use.
			 */
@@ -1518,14 +1518,15 @@


gboolean
-dissect_pipe_smb(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
-		 char *command)
+dissect_pipe_smb(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
+	struct smb_info *smb_info = pinfo->private;
+
	if (!proto_is_protocol_enabled(proto_smb_lanman))
		return FALSE;
	pinfo->current_proto = "LANMAN";

-	if (command != NULL && strcmp(command, "LANMAN") == 0) {
+	if (smb_info->trans_cmd && strcmp(smb_info->trans_cmd, "LANMAN") == 0) {
		/* Try to decode a LANMAN */

		return dissect_pipe_lanman(tvb, pinfo, tree);
diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-smb-pipe.h 
ethereal/packet-smb-pipe.h
--- ethereal-orig/packet-smb-pipe.h	Sun Aug  5 11:15:26 2001
+++ ethereal/packet-smb-pipe.h	Mon Aug  6 11:07:57 2001
@@ -27,7 +27,6 @@
#define _PACKET_SMB_PIPE_H_

gboolean
-dissect_pipe_smb(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
-		 char *command);
+dissect_pipe_smb(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);

#endif
diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-smb.c 
ethereal/packet-smb.c
--- ethereal-orig/packet-smb.c	Sun Aug  5 11:15:26 2001
+++ ethereal/packet-smb.c	Mon Aug  6 11:21:06 2001
@@ -9611,6 +9611,7 @@
  const gchar      *Data;
  packet_info      *pinfo;
  tvbuff_t         *next_tvb;
+  tvbuff_t         *ms_tvb;

  if (!TransactName)
	  return;
@@ -9668,18 +9669,25 @@
  si.data_count = DataCount;

  /*
+   * Command
+   */
+  si.trans_cmd = trans_cmd;
+
+  /*
   * Pass "si" to the subdissector.
   */
  pinfo->private = &si;

+  /*
+   * tvb for mailslot call
+   */
+  ms_tvb = tvb_create_from_top(SetupAreaOffset);
+
  if ((trans_cmd == NULL) ||
      (((trans_type == NULL || strcmp(trans_type, "MAILSLOT") != 0) ||
-       !dissect_mailslot_smb(pd, SetupAreaOffset, fd, parent, tree, si,
-			     max_data, SMB_offset, errcode, trans_cmd,
-			     SMB_offset + DataOffset, DataCount,
-			     SMB_offset + ParameterOffset, ParameterCount)) &&
+       !dissect_mailslot_smb(ms_tvb, pinfo, parent)) &&
      ((trans_type == NULL || strcmp(trans_type, "PIPE") != 0) ||
-       !dissect_pipe_smb(next_tvb, pinfo, parent, trans_cmd)))) {
+       !dissect_pipe_smb(next_tvb, pinfo, parent)))) {

    if (ParameterCount > 0) {

diff -u -r -x *.[^ch]|nmake|am ethereal-orig/smb.h ethereal/smb.h
--- ethereal-orig/smb.h	Sun Aug  5 11:15:27 2001
+++ ethereal/smb.h	Mon Aug  6 10:49:07 2001
@@ -648,6 +648,7 @@
  int data_offset;		/* Offset from parameter to data in transaction */
  int data_count;		/* Number of bytes of data in transaction */
  guint16 ddisp;		/* Data displacement for transaction commands */
+  char *trans_cmd;		/* Command for mailslot dissection */
};

#endif