1/*
2 * Copyright (C) Andrew Tridgell 1995-1999
3 *
4 * This software may be distributed either under the terms of the
5 * BSD-style license that accompanies tcpdump or the GNU GPL version 2
6 * or later
7 */
8
9#ifdef HAVE_CONFIG_H
10#include "config.h"
11#endif
12
13#include <sys/cdefs.h>
14#ifndef lint
15#if 0
16static const char rcsid[] _U_ =
17     "@(#) Header: /tcpdump/master/tcpdump/print-smb.c,v 1.47 2007-12-09 00:30:47 guy Exp";
18#else
19__RCSID("$NetBSD: print-smb.c,v 1.2 2010/12/05 05:11:30 christos Exp $");
20#endif
21#endif
22
23#include <tcpdump-stdinc.h>
24
25#include <stdio.h>
26#include <string.h>
27
28#include "interface.h"
29#include "extract.h"
30#include "smb.h"
31
32static int request = 0;
33static int unicodestr = 0;
34
35const u_char *startbuf = NULL;
36
37struct smbdescript {
38    const char *req_f1;
39    const char *req_f2;
40    const char *rep_f1;
41    const char *rep_f2;
42    void (*fn)(const u_char *, const u_char *, const u_char *, const u_char *);
43};
44
45struct smbdescriptint {
46    const char *req_f1;
47    const char *req_f2;
48    const char *rep_f1;
49    const char *rep_f2;
50    void (*fn)(const u_char *, const u_char *, int, int);
51};
52
53struct smbfns
54{
55    int id;
56    const char *name;
57    int flags;
58    struct smbdescript descript;
59};
60
61struct smbfnsint
62{
63    int id;
64    const char *name;
65    int flags;
66    struct smbdescriptint descript;
67};
68
69#define DEFDESCRIPT	{ NULL, NULL, NULL, NULL, NULL }
70
71#define FLG_CHAIN	(1 << 0)
72
73static struct smbfns *
74smbfind(int id, struct smbfns *list)
75{
76    int sindex;
77
78    for (sindex = 0; list[sindex].name; sindex++)
79	if (list[sindex].id == id)
80	    return(&list[sindex]);
81
82    return(&list[0]);
83}
84
85static struct smbfnsint *
86smbfindint(int id, struct smbfnsint *list)
87{
88    int sindex;
89
90    for (sindex = 0; list[sindex].name; sindex++)
91	if (list[sindex].id == id)
92	    return(&list[sindex]);
93
94    return(&list[0]);
95}
96
97static void
98trans2_findfirst(const u_char *param, const u_char *data, int pcnt, int dcnt)
99{
100    const char *fmt;
101
102    if (request)
103	fmt = "Attribute=[A]\nSearchCount=[d]\nFlags=[w]\nLevel=[dP4]\nFile=[S]\n";
104    else
105	fmt = "Handle=[w]\nCount=[d]\nEOS=[w]\nEoffset=[d]\nLastNameOfs=[w]\n";
106
107    smb_fdata(param, fmt, param + pcnt, unicodestr);
108    if (dcnt) {
109	printf("data:\n");
110	print_data(data, dcnt);
111    }
112}
113
114static void
115trans2_qfsinfo(const u_char *param, const u_char *data, int pcnt, int dcnt)
116{
117    static int level = 0;
118    const char *fmt="";
119
120    if (request) {
121	TCHECK2(*param, 2);
122	level = EXTRACT_LE_16BITS(param);
123	fmt = "InfoLevel=[d]\n";
124	smb_fdata(param, fmt, param + pcnt, unicodestr);
125    } else {
126	switch (level) {
127	case 1:
128	    fmt = "idFileSystem=[W]\nSectorUnit=[D]\nUnit=[D]\nAvail=[D]\nSectorSize=[d]\n";
129	    break;
130	case 2:
131	    fmt = "CreationTime=[T2]VolNameLength=[lb]\nVolumeLabel=[c]\n";
132	    break;
133	case 0x105:
134	    fmt = "Capabilities=[W]\nMaxFileLen=[D]\nVolNameLen=[lD]\nVolume=[C]\n";
135	    break;
136	default:
137	    fmt = "UnknownLevel\n";
138	    break;
139	}
140	smb_fdata(data, fmt, data + dcnt, unicodestr);
141    }
142    if (dcnt) {
143	printf("data:\n");
144	print_data(data, dcnt);
145    }
146    return;
147trunc:
148    printf("[|SMB]");
149    return;
150}
151
152struct smbfnsint trans2_fns[] = {
153    { 0, "TRANSACT2_OPEN", 0,
154	{ "Flags2=[w]\nMode=[w]\nSearchAttrib=[A]\nAttrib=[A]\nTime=[T2]\nOFun=[w]\nSize=[D]\nRes=([w, w, w, w, w])\nPath=[S]",
155	  NULL,
156	  "Handle=[d]\nAttrib=[A]\nTime=[T2]\nSize=[D]\nAccess=[w]\nType=[w]\nState=[w]\nAction=[w]\nInode=[W]\nOffErr=[d]\n|EALength=[d]\n",
157	  NULL, NULL }},
158    { 1, "TRANSACT2_FINDFIRST", 0,
159	{ NULL, NULL, NULL, NULL, trans2_findfirst }},
160    { 2, "TRANSACT2_FINDNEXT", 0, DEFDESCRIPT },
161    { 3, "TRANSACT2_QFSINFO", 0,
162	{ NULL, NULL, NULL, NULL, trans2_qfsinfo }},
163    { 4, "TRANSACT2_SETFSINFO", 0, DEFDESCRIPT },
164    { 5, "TRANSACT2_QPATHINFO", 0, DEFDESCRIPT },
165    { 6, "TRANSACT2_SETPATHINFO", 0, DEFDESCRIPT },
166    { 7, "TRANSACT2_QFILEINFO", 0, DEFDESCRIPT },
167    { 8, "TRANSACT2_SETFILEINFO", 0, DEFDESCRIPT },
168    { 9, "TRANSACT2_FSCTL", 0, DEFDESCRIPT },
169    { 10, "TRANSACT2_IOCTL", 0, DEFDESCRIPT },
170    { 11, "TRANSACT2_FINDNOTIFYFIRST", 0, DEFDESCRIPT },
171    { 12, "TRANSACT2_FINDNOTIFYNEXT", 0, DEFDESCRIPT },
172    { 13, "TRANSACT2_MKDIR", 0, DEFDESCRIPT },
173    { -1, NULL, 0, DEFDESCRIPT }
174};
175
176
177static void
178print_trans2(const u_char *words, const u_char *dat, const u_char *buf, const u_char *maxbuf)
179{
180    u_int bcc;
181    static struct smbfnsint *fn = &trans2_fns[0];
182    const u_char *data, *param;
183    const u_char *w = words + 1;
184    const char *f1 = NULL, *f2 = NULL;
185    int pcnt, dcnt;
186
187    TCHECK(words[0]);
188    if (request) {
189	TCHECK2(w[14 * 2], 2);
190	pcnt = EXTRACT_LE_16BITS(w + 9 * 2);
191	param = buf + EXTRACT_LE_16BITS(w + 10 * 2);
192	dcnt = EXTRACT_LE_16BITS(w + 11 * 2);
193	data = buf + EXTRACT_LE_16BITS(w + 12 * 2);
194	fn = smbfindint(EXTRACT_LE_16BITS(w + 14 * 2), trans2_fns);
195    } else {
196	if (words[0] == 0) {
197	    printf("%s\n", fn->name);
198	    printf("Trans2Interim\n");
199	    return;
200	}
201	TCHECK2(w[7 * 2], 2);
202	pcnt = EXTRACT_LE_16BITS(w + 3 * 2);
203	param = buf + EXTRACT_LE_16BITS(w + 4 * 2);
204	dcnt = EXTRACT_LE_16BITS(w + 6 * 2);
205	data = buf + EXTRACT_LE_16BITS(w + 7 * 2);
206    }
207
208    printf("%s param_length=%d data_length=%d\n", fn->name, pcnt, dcnt);
209
210    if (request) {
211	if (words[0] == 8) {
212	    smb_fdata(words + 1,
213		"Trans2Secondary\nTotParam=[d]\nTotData=[d]\nParamCnt=[d]\nParamOff=[d]\nParamDisp=[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nHandle=[d]\n",
214		maxbuf, unicodestr);
215	    return;
216	} else {
217	    smb_fdata(words + 1,
218		"TotParam=[d]\nTotData=[d]\nMaxParam=[d]\nMaxData=[d]\nMaxSetup=[b][P1]\nFlags=[w]\nTimeOut=[D]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nDataCnt=[d]\nDataOff=[d]\nSetupCnt=[b][P1]\n",
219		words + 1 + 14 * 2, unicodestr);
220	}
221	f1 = fn->descript.req_f1;
222	f2 = fn->descript.req_f2;
223    } else {
224	smb_fdata(words + 1,
225	    "TotParam=[d]\nTotData=[d]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nParamDisp[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nSetupCnt=[b][P1]\n",
226	    words + 1 + 10 * 2, unicodestr);
227	f1 = fn->descript.rep_f1;
228	f2 = fn->descript.rep_f2;
229    }
230
231    TCHECK2(*dat, 2);
232    bcc = EXTRACT_LE_16BITS(dat);
233    printf("smb_bcc=%u\n", bcc);
234    if (fn->descript.fn)
235	(*fn->descript.fn)(param, data, pcnt, dcnt);
236    else {
237	smb_fdata(param, f1 ? f1 : "Parameters=\n", param + pcnt, unicodestr);
238	smb_fdata(data, f2 ? f2 : "Data=\n", data + dcnt, unicodestr);
239    }
240    return;
241trunc:
242    printf("[|SMB]");
243    return;
244}
245
246
247static void
248print_browse(const u_char *param, int paramlen, const u_char *data, int datalen)
249{
250    const u_char *maxbuf = data + datalen;
251    int command;
252
253    TCHECK(data[0]);
254    command = data[0];
255
256    smb_fdata(param, "BROWSE PACKET\n|Param ", param+paramlen, unicodestr);
257
258    switch (command) {
259    case 0xF:
260	data = smb_fdata(data,
261	    "BROWSE PACKET:\nType=[B] (LocalMasterAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nElectionVersion=[w]\nBrowserConstant=[w]\n",
262	    maxbuf, unicodestr);
263	break;
264
265    case 0x1:
266	data = smb_fdata(data,
267	    "BROWSE PACKET:\nType=[B] (HostAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nElectionVersion=[w]\nBrowserConstant=[w]\n",
268	    maxbuf, unicodestr);
269	break;
270
271    case 0x2:
272	data = smb_fdata(data,
273	    "BROWSE PACKET:\nType=[B] (AnnouncementRequest)\nFlags=[B]\nReplySystemName=[S]\n",
274	    maxbuf, unicodestr);
275	break;
276
277    case 0xc:
278	data = smb_fdata(data,
279	    "BROWSE PACKET:\nType=[B] (WorkgroupAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nCommentPointer=[W]\nServerName=[S]\n",
280	    maxbuf, unicodestr);
281	break;
282
283    case 0x8:
284	data = smb_fdata(data,
285	    "BROWSE PACKET:\nType=[B] (ElectionFrame)\nElectionVersion=[B]\nOSSummary=[W]\nUptime=[(W, W)]\nServerName=[S]\n",
286	    maxbuf, unicodestr);
287	break;
288
289    case 0xb:
290	data = smb_fdata(data,
291	    "BROWSE PACKET:\nType=[B] (BecomeBackupBrowser)\nName=[S]\n",
292	    maxbuf, unicodestr);
293	break;
294
295    case 0x9:
296	data = smb_fdata(data,
297	    "BROWSE PACKET:\nType=[B] (GetBackupList)\nListCount?=[B]\nToken=[W]\n",
298	    maxbuf, unicodestr);
299	break;
300
301    case 0xa:
302	data = smb_fdata(data,
303	    "BROWSE PACKET:\nType=[B] (BackupListResponse)\nServerCount?=[B]\nToken=[W]\n*Name=[S]\n",
304	    maxbuf, unicodestr);
305	break;
306
307    case 0xd:
308	data = smb_fdata(data,
309	    "BROWSE PACKET:\nType=[B] (MasterAnnouncement)\nMasterName=[S]\n",
310	    maxbuf, unicodestr);
311	break;
312
313    case 0xe:
314	data = smb_fdata(data,
315	    "BROWSE PACKET:\nType=[B] (ResetBrowser)\nOptions=[B]\n", maxbuf, unicodestr);
316	break;
317
318    default:
319	data = smb_fdata(data, "Unknown Browser Frame ", maxbuf, unicodestr);
320	break;
321    }
322    return;
323trunc:
324    printf("[|SMB]");
325    return;
326}
327
328
329static void
330print_ipc(const u_char *param, int paramlen, const u_char *data, int datalen)
331{
332    if (paramlen)
333	smb_fdata(param, "Command=[w]\nStr1=[S]\nStr2=[S]\n", param + paramlen,
334	    unicodestr);
335    if (datalen)
336	smb_fdata(data, "IPC ", data + datalen, unicodestr);
337}
338
339
340static void
341print_trans(const u_char *words, const u_char *data1, const u_char *buf, const u_char *maxbuf)
342{
343    u_int bcc;
344    const char *f1, *f2, *f3, *f4;
345    const u_char *data, *param;
346    const u_char *w = words + 1;
347    int datalen, paramlen;
348
349    if (request) {
350	TCHECK2(w[12 * 2], 2);
351	paramlen = EXTRACT_LE_16BITS(w + 9 * 2);
352	param = buf + EXTRACT_LE_16BITS(w + 10 * 2);
353	datalen = EXTRACT_LE_16BITS(w + 11 * 2);
354	data = buf + EXTRACT_LE_16BITS(w + 12 * 2);
355	f1 = "TotParamCnt=[d] \nTotDataCnt=[d] \nMaxParmCnt=[d] \nMaxDataCnt=[d]\nMaxSCnt=[d] \nTransFlags=[w] \nRes1=[w] \nRes2=[w] \nRes3=[w]\nParamCnt=[d] \nParamOff=[d] \nDataCnt=[d] \nDataOff=[d] \nSUCnt=[d]\n";
356	f2 = "|Name=[S]\n";
357	f3 = "|Param ";
358	f4 = "|Data ";
359    } else {
360	TCHECK2(w[7 * 2], 2);
361	paramlen = EXTRACT_LE_16BITS(w + 3 * 2);
362	param = buf + EXTRACT_LE_16BITS(w + 4 * 2);
363	datalen = EXTRACT_LE_16BITS(w + 6 * 2);
364	data = buf + EXTRACT_LE_16BITS(w + 7 * 2);
365	f1 = "TotParamCnt=[d] \nTotDataCnt=[d] \nRes1=[d]\nParamCnt=[d] \nParamOff=[d] \nRes2=[d] \nDataCnt=[d] \nDataOff=[d] \nRes3=[d]\nLsetup=[d]\n";
366	f2 = "|Unknown ";
367	f3 = "|Param ";
368	f4 = "|Data ";
369    }
370
371    smb_fdata(words + 1, f1, SMBMIN(words + 1 + 2 * words[0], maxbuf),
372        unicodestr);
373
374    TCHECK2(*data1, 2);
375    bcc = EXTRACT_LE_16BITS(data1);
376    printf("smb_bcc=%u\n", bcc);
377    if (bcc > 0) {
378	smb_fdata(data1 + 2, f2, maxbuf - (paramlen + datalen), unicodestr);
379
380	if (strcmp((const char *)(data1 + 2), "\\MAILSLOT\\BROWSE") == 0) {
381	    print_browse(param, paramlen, data, datalen);
382	    return;
383	}
384
385	if (strcmp((const char *)(data1 + 2), "\\PIPE\\LANMAN") == 0) {
386	    print_ipc(param, paramlen, data, datalen);
387	    return;
388	}
389
390	if (paramlen)
391	    smb_fdata(param, f3, SMBMIN(param + paramlen, maxbuf), unicodestr);
392	if (datalen)
393	    smb_fdata(data, f4, SMBMIN(data + datalen, maxbuf), unicodestr);
394    }
395    return;
396trunc:
397    printf("[|SMB]");
398    return;
399}
400
401
402static void
403print_negprot(const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf)
404{
405    u_int wct, bcc;
406    const char *f1 = NULL, *f2 = NULL;
407
408    TCHECK(words[0]);
409    wct = words[0];
410    if (request)
411	f2 = "*|Dialect=[Y]\n";
412    else {
413	if (wct == 1)
414	    f1 = "Core Protocol\nDialectIndex=[d]";
415	else if (wct == 17)
416	    f1 = "NT1 Protocol\nDialectIndex=[d]\nSecMode=[B]\nMaxMux=[d]\nNumVcs=[d]\nMaxBuffer=[D]\nRawSize=[D]\nSessionKey=[W]\nCapabilities=[W]\nServerTime=[T3]TimeZone=[d]\nCryptKey=";
417	else if (wct == 13)
418	    f1 = "Coreplus/Lanman1/Lanman2 Protocol\nDialectIndex=[d]\nSecMode=[w]\nMaxXMit=[d]\nMaxMux=[d]\nMaxVcs=[d]\nBlkMode=[w]\nSessionKey=[W]\nServerTime=[T1]TimeZone=[d]\nRes=[W]\nCryptKey=";
419    }
420
421    if (f1)
422	smb_fdata(words + 1, f1, SMBMIN(words + 1 + wct * 2, maxbuf),
423	    unicodestr);
424    else
425	print_data(words + 1, SMBMIN(wct * 2, PTR_DIFF(maxbuf, words + 1)));
426
427    TCHECK2(*data, 2);
428    bcc = EXTRACT_LE_16BITS(data);
429    printf("smb_bcc=%u\n", bcc);
430    if (bcc > 0) {
431	if (f2)
432	    smb_fdata(data + 2, f2, SMBMIN(data + 2 + EXTRACT_LE_16BITS(data),
433		maxbuf), unicodestr);
434	else
435	    print_data(data + 2, SMBMIN(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2)));
436    }
437    return;
438trunc:
439    printf("[|SMB]");
440    return;
441}
442
443static void
444print_sesssetup(const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf)
445{
446    u_int wct, bcc;
447    const char *f1 = NULL, *f2 = NULL;
448
449    TCHECK(words[0]);
450    wct = words[0];
451    if (request) {
452	if (wct == 10)
453	    f1 = "Com2=[w]\nOff2=[d]\nBufSize=[d]\nMpxMax=[d]\nVcNum=[d]\nSessionKey=[W]\nPassLen=[d]\nCryptLen=[d]\nCryptOff=[d]\nPass&Name=\n";
454	else
455	    f1 = "Com2=[B]\nRes1=[B]\nOff2=[d]\nMaxBuffer=[d]\nMaxMpx=[d]\nVcNumber=[d]\nSessionKey=[W]\nCaseInsensitivePasswordLength=[d]\nCaseSensitivePasswordLength=[d]\nRes=[W]\nCapabilities=[W]\nPass1&Pass2&Account&Domain&OS&LanMan=\n";
456    } else {
457	if (wct == 3) {
458	    f1 = "Com2=[w]\nOff2=[d]\nAction=[w]\n";
459	} else if (wct == 13) {
460	    f1 = "Com2=[B]\nRes=[B]\nOff2=[d]\nAction=[w]\n";
461	    f2 = "NativeOS=[S]\nNativeLanMan=[S]\nPrimaryDomain=[S]\n";
462	}
463    }
464
465    if (f1)
466	smb_fdata(words + 1, f1, SMBMIN(words + 1 + wct * 2, maxbuf),
467	    unicodestr);
468    else
469	print_data(words + 1, SMBMIN(wct * 2, PTR_DIFF(maxbuf, words + 1)));
470
471    TCHECK2(*data, 2);
472    bcc = EXTRACT_LE_16BITS(data);
473    printf("smb_bcc=%u\n", bcc);
474    if (bcc > 0) {
475	if (f2)
476	    smb_fdata(data + 2, f2, SMBMIN(data + 2 + EXTRACT_LE_16BITS(data),
477		maxbuf), unicodestr);
478	else
479	    print_data(data + 2, SMBMIN(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2)));
480    }
481    return;
482trunc:
483    printf("[|SMB]");
484    return;
485}
486
487static void
488print_lockingandx(const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf)
489{
490    u_int wct, bcc;
491    const u_char *maxwords;
492    const char *f1 = NULL, *f2 = NULL;
493
494    TCHECK(words[0]);
495    wct = words[0];
496    if (request) {
497	f1 = "Com2=[w]\nOff2=[d]\nHandle=[d]\nLockType=[w]\nTimeOut=[D]\nUnlockCount=[d]\nLockCount=[d]\n";
498	TCHECK(words[7]);
499	if (words[7] & 0x10)
500	    f2 = "*Process=[d]\n[P2]Offset=[M]\nLength=[M]\n";
501	else
502	    f2 = "*Process=[d]\nOffset=[D]\nLength=[D]\n";
503    } else {
504	f1 = "Com2=[w]\nOff2=[d]\n";
505    }
506
507    maxwords = SMBMIN(words + 1 + wct * 2, maxbuf);
508    if (wct)
509	smb_fdata(words + 1, f1, maxwords, unicodestr);
510
511    TCHECK2(*data, 2);
512    bcc = EXTRACT_LE_16BITS(data);
513    printf("smb_bcc=%u\n", bcc);
514    if (bcc > 0) {
515	if (f2)
516	    smb_fdata(data + 2, f2, SMBMIN(data + 2 + EXTRACT_LE_16BITS(data),
517		maxbuf), unicodestr);
518	else
519	    print_data(data + 2, SMBMIN(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2)));
520    }
521    return;
522trunc:
523    printf("[|SMB]");
524    return;
525}
526
527
528static struct smbfns smb_fns[] = {
529    { -1, "SMBunknown", 0, DEFDESCRIPT },
530
531    { SMBtcon, "SMBtcon", 0,
532	{ NULL, "Path=[Z]\nPassword=[Z]\nDevice=[Z]\n",
533	  "MaxXmit=[d]\nTreeId=[d]\n", NULL,
534	  NULL } },
535
536    { SMBtdis, "SMBtdis", 0, DEFDESCRIPT },
537    { SMBexit,  "SMBexit", 0, DEFDESCRIPT },
538    { SMBioctl, "SMBioctl", 0, DEFDESCRIPT },
539
540    { SMBecho, "SMBecho", 0,
541	{ "ReverbCount=[d]\n", NULL,
542	  "SequenceNum=[d]\n", NULL,
543	  NULL } },
544
545    { SMBulogoffX, "SMBulogoffX", FLG_CHAIN, DEFDESCRIPT },
546
547    { SMBgetatr, "SMBgetatr", 0,
548	{ NULL, "Path=[Z]\n",
549	  "Attribute=[A]\nTime=[T2]Size=[D]\nRes=([w,w,w,w,w])\n", NULL,
550	  NULL } },
551
552    { SMBsetatr, "SMBsetatr", 0,
553	{ "Attribute=[A]\nTime=[T2]Res=([w,w,w,w,w])\n", "Path=[Z]\n",
554	  NULL, NULL, NULL } },
555
556    { SMBchkpth, "SMBchkpth", 0,
557       { NULL, "Path=[Z]\n", NULL, NULL, NULL } },
558
559    { SMBsearch, "SMBsearch", 0,
560	{ "Count=[d]\nAttrib=[A]\n",
561	  "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\n",
562	  "Count=[d]\n",
563	  "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",
564	  NULL } },
565
566    { SMBopen, "SMBopen", 0,
567	{ "Mode=[w]\nAttribute=[A]\n", "Path=[Z]\n",
568	  "Handle=[d]\nOAttrib=[A]\nTime=[T2]Size=[D]\nAccess=[w]\n",
569	  NULL, NULL } },
570
571    { SMBcreate, "SMBcreate", 0,
572	{ "Attrib=[A]\nTime=[T2]", "Path=[Z]\n", "Handle=[d]\n", NULL, NULL } },
573
574    { SMBmknew, "SMBmknew", 0,
575	{ "Attrib=[A]\nTime=[T2]", "Path=[Z]\n", "Handle=[d]\n", NULL, NULL } },
576
577    { SMBunlink, "SMBunlink", 0,
578	{ "Attrib=[A]\n", "Path=[Z]\n", NULL, NULL, NULL } },
579
580    { SMBread, "SMBread", 0,
581	{ "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL,
582	  "Count=[d]\nRes=([w,w,w,w])\n", NULL, NULL } },
583
584    { SMBwrite, "SMBwrite", 0,
585	{ "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL,
586	  "Count=[d]\n", NULL, NULL } },
587
588    { SMBclose, "SMBclose", 0,
589	{ "Handle=[d]\nTime=[T2]", NULL, NULL, NULL, NULL } },
590
591    { SMBmkdir, "SMBmkdir", 0,
592	{ NULL, "Path=[Z]\n", NULL, NULL, NULL } },
593
594    { SMBrmdir, "SMBrmdir", 0,
595	{ NULL, "Path=[Z]\n", NULL, NULL, NULL } },
596
597    { SMBdskattr, "SMBdskattr", 0,
598	{ NULL, NULL,
599	  "TotalUnits=[d]\nBlocksPerUnit=[d]\nBlockSize=[d]\nFreeUnits=[d]\nMedia=[w]\n",
600	  NULL, NULL } },
601
602    { SMBmv, "SMBmv", 0,
603	{ "Attrib=[A]\n", "OldPath=[Z]\nNewPath=[Z]\n", NULL, NULL, NULL } },
604
605    /*
606     * this is a Pathworks specific call, allowing the
607     * changing of the root path
608     */
609    { pSETDIR, "SMBsetdir", 0, { NULL, "Path=[Z]\n", NULL, NULL, NULL } },
610
611    { SMBlseek, "SMBlseek", 0,
612	{ "Handle=[d]\nMode=[w]\nOffset=[D]\n", "Offset=[D]\n", NULL, NULL, NULL } },
613
614    { SMBflush, "SMBflush", 0, { "Handle=[d]\n", NULL, NULL, NULL, NULL } },
615
616    { SMBsplopen, "SMBsplopen", 0,
617	{ "SetupLen=[d]\nMode=[w]\n", "Ident=[Z]\n", "Handle=[d]\n",
618	  NULL, NULL } },
619
620    { SMBsplclose, "SMBsplclose", 0,
621	{ "Handle=[d]\n", NULL, NULL, NULL, NULL } },
622
623    { SMBsplretq, "SMBsplretq", 0,
624	{ "MaxCount=[d]\nStartIndex=[d]\n", NULL,
625	  "Count=[d]\nIndex=[d]\n",
626	  "*Time=[T2]Status=[B]\nJobID=[d]\nSize=[D]\nRes=[B]Name=[s16]\n",
627	  NULL } },
628
629    { SMBsplwr, "SMBsplwr", 0,
630	{ "Handle=[d]\n", NULL, NULL, NULL, NULL } },
631
632    { SMBlock, "SMBlock", 0,
633	{ "Handle=[d]\nCount=[D]\nOffset=[D]\n", NULL, NULL, NULL, NULL } },
634
635    { SMBunlock, "SMBunlock", 0,
636	{ "Handle=[d]\nCount=[D]\nOffset=[D]\n", NULL, NULL, NULL, NULL } },
637
638    /* CORE+ PROTOCOL FOLLOWS */
639
640    { SMBreadbraw, "SMBreadbraw", 0,
641	{ "Handle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nRes=[d]\n",
642	  NULL, NULL, NULL, NULL } },
643
644    { SMBwritebraw, "SMBwritebraw", 0,
645	{ "Handle=[d]\nTotalCount=[d]\nRes=[w]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nRes2=[W]\n|DataSize=[d]\nDataOff=[d]\n",
646	  NULL, "WriteRawAck", NULL, NULL } },
647
648    { SMBwritec, "SMBwritec", 0,
649	{ NULL, NULL, "Count=[d]\n", NULL, NULL } },
650
651    { SMBwriteclose, "SMBwriteclose", 0,
652	{ "Handle=[d]\nCount=[d]\nOffset=[D]\nTime=[T2]Res=([w,w,w,w,w,w])",
653	  NULL, "Count=[d]\n", NULL, NULL } },
654
655    { SMBlockread, "SMBlockread", 0,
656	{ "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL,
657	  "Count=[d]\nRes=([w,w,w,w])\n", NULL, NULL } },
658
659    { SMBwriteunlock, "SMBwriteunlock", 0,
660	{ "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL,
661	  "Count=[d]\n", NULL, NULL } },
662
663    { SMBreadBmpx, "SMBreadBmpx", 0,
664	{ "Handle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nRes=[w]\n",
665	  NULL,
666	  "Offset=[D]\nTotCount=[d]\nRemaining=[d]\nRes=([w,w])\nDataSize=[d]\nDataOff=[d]\n",
667	  NULL, NULL } },
668
669    { SMBwriteBmpx, "SMBwriteBmpx", 0,
670	{ "Handle=[d]\nTotCount=[d]\nRes=[w]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nRes2=[W]\nDataSize=[d]\nDataOff=[d]\n", NULL,
671	  "Remaining=[d]\n", NULL, NULL } },
672
673    { SMBwriteBs, "SMBwriteBs", 0,
674	{ "Handle=[d]\nTotCount=[d]\nOffset=[D]\nRes=[W]\nDataSize=[d]\nDataOff=[d]\n",
675	  NULL, "Count=[d]\n", NULL, NULL } },
676
677    { SMBsetattrE, "SMBsetattrE", 0,
678	{ "Handle=[d]\nCreationTime=[T2]AccessTime=[T2]ModifyTime=[T2]", NULL,
679	  NULL, NULL, NULL } },
680
681    { SMBgetattrE, "SMBgetattrE", 0,
682	{ "Handle=[d]\n", NULL,
683	  "CreationTime=[T2]AccessTime=[T2]ModifyTime=[T2]Size=[D]\nAllocSize=[D]\nAttribute=[A]\n",
684	  NULL, NULL } },
685
686    { SMBtranss, "SMBtranss", 0, DEFDESCRIPT },
687    { SMBioctls, "SMBioctls", 0, DEFDESCRIPT },
688
689    { SMBcopy, "SMBcopy", 0,
690	{ "TreeID2=[d]\nOFun=[w]\nFlags=[w]\n", "Path=[S]\nNewPath=[S]\n",
691	  "CopyCount=[d]\n",  "|ErrStr=[S]\n",  NULL } },
692
693    { SMBmove, "SMBmove", 0,
694	{ "TreeID2=[d]\nOFun=[w]\nFlags=[w]\n", "Path=[S]\nNewPath=[S]\n",
695	  "MoveCount=[d]\n",  "|ErrStr=[S]\n",  NULL } },
696
697    { SMBopenX, "SMBopenX", FLG_CHAIN,
698	{ "Com2=[w]\nOff2=[d]\nFlags=[w]\nMode=[w]\nSearchAttrib=[A]\nAttrib=[A]\nTime=[T2]OFun=[w]\nSize=[D]\nTimeOut=[D]\nRes=[W]\n",
699	  "Path=[S]\n",
700	  "Com2=[w]\nOff2=[d]\nHandle=[d]\nAttrib=[A]\nTime=[T2]Size=[D]\nAccess=[w]\nType=[w]\nState=[w]\nAction=[w]\nFileID=[W]\nRes=[w]\n",
701	  NULL, NULL } },
702
703    { SMBreadX, "SMBreadX", FLG_CHAIN,
704	{ "Com2=[w]\nOff2=[d]\nHandle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nCountLeft=[d]\n",
705	  NULL,
706	  "Com2=[w]\nOff2=[d]\nRemaining=[d]\nRes=[W]\nDataSize=[d]\nDataOff=[d]\nRes=([w,w,w,w])\n",
707	  NULL, NULL } },
708
709    { SMBwriteX, "SMBwriteX", FLG_CHAIN,
710	{ "Com2=[w]\nOff2=[d]\nHandle=[d]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nCountLeft=[d]\nRes=[w]\nDataSize=[d]\nDataOff=[d]\n",
711	  NULL,
712	  "Com2=[w]\nOff2=[d]\nCount=[d]\nRemaining=[d]\nRes=[W]\n",
713	  NULL, NULL } },
714
715    { SMBffirst, "SMBffirst", 0,
716	{ "Count=[d]\nAttrib=[A]\n",
717	  "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n",
718	  "Count=[d]\n",
719	  "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",
720	  NULL } },
721
722    { SMBfunique, "SMBfunique", 0,
723	{ "Count=[d]\nAttrib=[A]\n",
724	  "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n",
725	  "Count=[d]\n",
726	  "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",
727	  NULL } },
728
729    { SMBfclose, "SMBfclose", 0,
730	{ "Count=[d]\nAttrib=[A]\n",
731	  "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n",
732	  "Count=[d]\n",
733	  "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",
734	  NULL } },
735
736    { SMBfindnclose, "SMBfindnclose", 0,
737	{ "Handle=[d]\n", NULL, NULL, NULL, NULL } },
738
739    { SMBfindclose, "SMBfindclose", 0,
740	{ "Handle=[d]\n", NULL, NULL, NULL, NULL } },
741
742    { SMBsends, "SMBsends", 0,
743	{ NULL, "Source=[Z]\nDest=[Z]\n", NULL, NULL, NULL } },
744
745    { SMBsendstrt, "SMBsendstrt", 0,
746	{ NULL, "Source=[Z]\nDest=[Z]\n", "GroupID=[d]\n", NULL, NULL } },
747
748    { SMBsendend, "SMBsendend", 0,
749	{ "GroupID=[d]\n", NULL, NULL, NULL, NULL } },
750
751    { SMBsendtxt, "SMBsendtxt", 0,
752	{ "GroupID=[d]\n", NULL, NULL, NULL, NULL } },
753
754    { SMBsendb, "SMBsendb", 0,
755	{ NULL, "Source=[Z]\nDest=[Z]\n", NULL, NULL, NULL } },
756
757    { SMBfwdname, "SMBfwdname", 0, DEFDESCRIPT },
758    { SMBcancelf, "SMBcancelf", 0, DEFDESCRIPT },
759    { SMBgetmac, "SMBgetmac", 0, DEFDESCRIPT },
760
761    { SMBnegprot, "SMBnegprot", 0,
762	{ NULL, NULL, NULL, NULL, print_negprot } },
763
764    { SMBsesssetupX, "SMBsesssetupX", FLG_CHAIN,
765	{ NULL, NULL, NULL, NULL, print_sesssetup } },
766
767    { SMBtconX, "SMBtconX", FLG_CHAIN,
768	{ "Com2=[w]\nOff2=[d]\nFlags=[w]\nPassLen=[d]\nPasswd&Path&Device=\n",
769	  NULL, "Com2=[w]\nOff2=[d]\n", "ServiceType=[R]\n", NULL } },
770
771    { SMBlockingX, "SMBlockingX", FLG_CHAIN,
772	{ NULL, NULL, NULL, NULL, print_lockingandx } },
773
774    { SMBtrans2, "SMBtrans2", 0, { NULL, NULL, NULL, NULL, print_trans2 } },
775
776    { SMBtranss2, "SMBtranss2", 0, DEFDESCRIPT },
777    { SMBctemp, "SMBctemp", 0, DEFDESCRIPT },
778    { SMBreadBs, "SMBreadBs", 0, DEFDESCRIPT },
779    { SMBtrans, "SMBtrans", 0, { NULL, NULL, NULL, NULL, print_trans } },
780
781    { SMBnttrans, "SMBnttrans", 0, DEFDESCRIPT },
782    { SMBnttranss, "SMBnttranss", 0, DEFDESCRIPT },
783
784    { SMBntcreateX, "SMBntcreateX", FLG_CHAIN,
785	{ "Com2=[w]\nOff2=[d]\nRes=[b]\nNameLen=[ld]\nFlags=[W]\nRootDirectoryFid=[D]\nAccessMask=[W]\nAllocationSize=[L]\nExtFileAttributes=[W]\nShareAccess=[W]\nCreateDisposition=[W]\nCreateOptions=[W]\nImpersonationLevel=[W]\nSecurityFlags=[b]\n",
786	  "Path=[C]\n",
787	  "Com2=[w]\nOff2=[d]\nOplockLevel=[b]\nFid=[d]\nCreateAction=[W]\nCreateTime=[T3]LastAccessTime=[T3]LastWriteTime=[T3]ChangeTime=[T3]ExtFileAttributes=[W]\nAllocationSize=[L]\nEndOfFile=[L]\nFileType=[w]\nDeviceState=[w]\nDirectory=[b]\n",
788	  NULL, NULL } },
789
790    { SMBntcancel, "SMBntcancel", 0, DEFDESCRIPT },
791
792    { -1, NULL, 0, DEFDESCRIPT }
793};
794
795
796/*
797 * print a SMB message
798 */
799static void
800print_smb(const u_char *buf, const u_char *maxbuf)
801{
802    u_int16_t flags2;
803    int nterrcodes;
804    int command;
805    u_int32_t nterror;
806    const u_char *words, *maxwords, *data;
807    struct smbfns *fn;
808    const char *fmt_smbheader =
809        "[P4]SMB Command   =  [B]\nError class   =  [BP1]\nError code    =  [d]\nFlags1        =  [B]\nFlags2        =  [B][P13]\nTree ID       =  [d]\nProc ID       =  [d]\nUID           =  [d]\nMID           =  [d]\nWord Count    =  [b]\n";
810    int smboffset;
811
812    TCHECK(buf[9]);
813    request = (buf[9] & 0x80) ? 0 : 1;
814    flags2 = EXTRACT_LE_16BITS(&buf[10]);
815    unicodestr = flags2 & 0x8000;
816    nterrcodes = flags2 & 0x4000;
817    startbuf = buf;
818
819    command = buf[4];
820
821    fn = smbfind(command, smb_fns);
822
823    if (vflag > 1)
824	printf("\n");
825
826    printf("SMB PACKET: %s (%s)\n", fn->name, request ? "REQUEST" : "REPLY");
827
828    if (vflag < 2)
829	return;
830
831    /* print out the header */
832    smb_fdata(buf, fmt_smbheader, buf + 33, unicodestr);
833
834    if (nterrcodes) {
835    	nterror = EXTRACT_LE_32BITS(&buf[5]);
836	if (nterror)
837	    printf("NTError = %s\n", nt_errstr(nterror));
838    } else {
839	if (buf[5])
840	    printf("SMBError = %s\n", smb_errstr(buf[5], EXTRACT_LE_16BITS(&buf[7])));
841    }
842
843    smboffset = 32;
844
845    for (;;) {
846	const char *f1, *f2;
847	int wct;
848	u_int bcc;
849	int newsmboffset;
850
851	words = buf + smboffset;
852	TCHECK(words[0]);
853	wct = words[0];
854	data = words + 1 + wct * 2;
855	maxwords = SMBMIN(data, maxbuf);
856
857	if (request) {
858	    f1 = fn->descript.req_f1;
859	    f2 = fn->descript.req_f2;
860	} else {
861	    f1 = fn->descript.rep_f1;
862	    f2 = fn->descript.rep_f2;
863	}
864
865	if (fn->descript.fn)
866	    (*fn->descript.fn)(words, data, buf, maxbuf);
867	else {
868	    if (wct) {
869		if (f1)
870		    smb_fdata(words + 1, f1, words + 1 + wct * 2, unicodestr);
871		else {
872		    int i;
873		    int v;
874
875		    for (i = 0; &words[1 + 2 * i] < maxwords; i++) {
876			TCHECK2(words[1 + 2 * i], 2);
877			v = EXTRACT_LE_16BITS(words + 1 + 2 * i);
878			printf("smb_vwv[%d]=%d (0x%X)\n", i, v, v);
879		    }
880		}
881	    }
882
883	    TCHECK2(*data, 2);
884	    bcc = EXTRACT_LE_16BITS(data);
885	    printf("smb_bcc=%u\n", bcc);
886	    if (f2) {
887		if (bcc > 0)
888		    smb_fdata(data + 2, f2, data + 2 + bcc, unicodestr);
889	    } else {
890		if (bcc > 0) {
891		    printf("smb_buf[]=\n");
892		    print_data(data + 2, SMBMIN(bcc, PTR_DIFF(maxbuf, data + 2)));
893		}
894	    }
895	}
896
897	if ((fn->flags & FLG_CHAIN) == 0)
898	    break;
899	if (wct == 0)
900	    break;
901	TCHECK(words[1]);
902	command = words[1];
903	if (command == 0xFF)
904	    break;
905	TCHECK2(words[3], 2);
906	newsmboffset = EXTRACT_LE_16BITS(words + 3);
907
908	fn = smbfind(command, smb_fns);
909
910	printf("\nSMB PACKET: %s (%s) (CHAINED)\n",
911	    fn->name, request ? "REQUEST" : "REPLY");
912	if (newsmboffset <= smboffset) {
913	    printf("Bad andX offset: %u <= %u\n", newsmboffset, smboffset);
914	    break;
915	}
916	smboffset = newsmboffset;
917    }
918
919    printf("\n");
920    return;
921trunc:
922    printf("[|SMB]");
923    return;
924}
925
926
927/*
928 * print a NBT packet received across tcp on port 139
929 */
930void
931nbt_tcp_print(const u_char *data, int length)
932{
933    int caplen;
934    int type;
935    u_int nbt_len;
936    const u_char *maxbuf;
937
938    if (length < 4)
939	goto trunc;
940    if (snapend < data)
941	goto trunc;
942    caplen = snapend - data;
943    if (caplen < 4)
944	goto trunc;
945    maxbuf = data + caplen;
946    type = data[0];
947    nbt_len = EXTRACT_16BITS(data + 2);
948    length -= 4;
949    caplen -= 4;
950
951    startbuf = data;
952
953    if (vflag < 2) {
954	printf(" NBT Session Packet: ");
955	switch (type) {
956	case 0x00:
957	    printf("Session Message");
958	    break;
959
960	case 0x81:
961	    printf("Session Request");
962	    break;
963
964	case 0x82:
965	    printf("Session Granted");
966	    break;
967
968	case 0x83:
969	  {
970	    int ecode;
971
972	    if (nbt_len < 4)
973		goto trunc;
974	    if (length < 4)
975		goto trunc;
976	    if (caplen < 4)
977		goto trunc;
978	    ecode = data[4];
979
980	    printf("Session Reject, ");
981	    switch (ecode) {
982	    case 0x80:
983		printf("Not listening on called name");
984		break;
985	    case 0x81:
986		printf("Not listening for calling name");
987		break;
988	    case 0x82:
989		printf("Called name not present");
990		break;
991	    case 0x83:
992		printf("Called name present, but insufficient resources");
993		break;
994	    default:
995		printf("Unspecified error 0x%X", ecode);
996		break;
997	    }
998	  }
999	    break;
1000
1001	case 0x85:
1002	    printf("Session Keepalive");
1003	    break;
1004
1005	default:
1006	    data = smb_fdata(data, "Unknown packet type [rB]", maxbuf, 0);
1007	    break;
1008	}
1009    } else {
1010	printf ("\n>>> NBT Session Packet\n");
1011	switch (type) {
1012	case 0x00:
1013	    data = smb_fdata(data, "[P1]NBT Session Message\nFlags=[B]\nLength=[rd]\n",
1014		data + 4, 0);
1015	    if (data == NULL)
1016		break;
1017	    if (nbt_len >= 4 && caplen >= 4 && memcmp(data,"\377SMB",4) == 0) {
1018		if ((int)nbt_len > caplen) {
1019		    if ((int)nbt_len > length)
1020			printf("WARNING: Packet is continued in later TCP segments\n");
1021		    else
1022			printf("WARNING: Short packet. Try increasing the snap length by %d\n",
1023			    nbt_len - caplen);
1024		}
1025		print_smb(data, maxbuf > data + nbt_len ? data + nbt_len : maxbuf);
1026	    } else
1027		printf("Session packet:(raw data or continuation?)\n");
1028	    break;
1029
1030	case 0x81:
1031	    data = smb_fdata(data,
1032		"[P1]NBT Session Request\nFlags=[B]\nLength=[rd]\nDestination=[n1]\nSource=[n1]\n",
1033		maxbuf, 0);
1034	    break;
1035
1036	case 0x82:
1037	    data = smb_fdata(data, "[P1]NBT Session Granted\nFlags=[B]\nLength=[rd]\n", maxbuf, 0);
1038	    break;
1039
1040	case 0x83:
1041	  {
1042	    const u_char *origdata;
1043	    int ecode;
1044
1045	    origdata = data;
1046	    data = smb_fdata(data, "[P1]NBT SessionReject\nFlags=[B]\nLength=[rd]\nReason=[B]\n",
1047		maxbuf, 0);
1048	    if (data == NULL)
1049		break;
1050	    if (nbt_len >= 1 && caplen >= 1) {
1051		ecode = origdata[4];
1052		switch (ecode) {
1053		case 0x80:
1054		    printf("Not listening on called name\n");
1055		    break;
1056		case 0x81:
1057		    printf("Not listening for calling name\n");
1058		    break;
1059		case 0x82:
1060		    printf("Called name not present\n");
1061		    break;
1062		case 0x83:
1063		    printf("Called name present, but insufficient resources\n");
1064		    break;
1065		default:
1066		    printf("Unspecified error 0x%X\n", ecode);
1067		    break;
1068		}
1069	    }
1070	  }
1071	    break;
1072
1073	case 0x85:
1074	    data = smb_fdata(data, "[P1]NBT Session Keepalive\nFlags=[B]\nLength=[rd]\n", maxbuf, 0);
1075	    break;
1076
1077	default:
1078	    data = smb_fdata(data, "NBT - Unknown packet type\nType=[B]\n", maxbuf, 0);
1079	    break;
1080	}
1081	printf("\n");
1082	fflush(stdout);
1083    }
1084    return;
1085trunc:
1086    printf("[|SMB]");
1087    return;
1088}
1089
1090
1091/*
1092 * print a NBT packet received across udp on port 137
1093 */
1094void
1095nbt_udp137_print(const u_char *data, int length)
1096{
1097    const u_char *maxbuf = data + length;
1098    int name_trn_id, response, opcode, nm_flags, rcode;
1099    int qdcount, ancount, nscount, arcount;
1100    const char *opcodestr;
1101    const u_char *p;
1102    int total, i;
1103
1104    TCHECK2(data[10], 2);
1105    name_trn_id = EXTRACT_16BITS(data);
1106    response = (data[2] >> 7);
1107    opcode = (data[2] >> 3) & 0xF;
1108    nm_flags = ((data[2] & 0x7) << 4) + (data[3] >> 4);
1109    rcode = data[3] & 0xF;
1110    qdcount = EXTRACT_16BITS(data + 4);
1111    ancount = EXTRACT_16BITS(data + 6);
1112    nscount = EXTRACT_16BITS(data + 8);
1113    arcount = EXTRACT_16BITS(data + 10);
1114    startbuf = data;
1115
1116    if (maxbuf <= data)
1117	return;
1118
1119    if (vflag > 1)
1120	printf("\n>>> ");
1121
1122    printf("NBT UDP PACKET(137): ");
1123
1124    switch (opcode) {
1125    case 0: opcodestr = "QUERY"; break;
1126    case 5: opcodestr = "REGISTRATION"; break;
1127    case 6: opcodestr = "RELEASE"; break;
1128    case 7: opcodestr = "WACK"; break;
1129    case 8: opcodestr = "REFRESH(8)"; break;
1130    case 9: opcodestr = "REFRESH"; break;
1131    case 15: opcodestr = "MULTIHOMED REGISTRATION"; break;
1132    default: opcodestr = "OPUNKNOWN"; break;
1133    }
1134    printf("%s", opcodestr);
1135    if (response) {
1136	if (rcode)
1137	    printf("; NEGATIVE");
1138	else
1139	    printf("; POSITIVE");
1140    }
1141
1142    if (response)
1143	printf("; RESPONSE");
1144    else
1145	printf("; REQUEST");
1146
1147    if (nm_flags & 1)
1148	printf("; BROADCAST");
1149    else
1150	printf("; UNICAST");
1151
1152    if (vflag < 2)
1153	return;
1154
1155    printf("\nTrnID=0x%X\nOpCode=%d\nNmFlags=0x%X\nRcode=%d\nQueryCount=%d\nAnswerCount=%d\nAuthorityCount=%d\nAddressRecCount=%d\n",
1156	name_trn_id, opcode, nm_flags, rcode, qdcount, ancount, nscount,
1157	arcount);
1158
1159    p = data + 12;
1160
1161    total = ancount + nscount + arcount;
1162
1163    if (qdcount > 100 || total > 100) {
1164	printf("Corrupt packet??\n");
1165	return;
1166    }
1167
1168    if (qdcount) {
1169	printf("QuestionRecords:\n");
1170	for (i = 0; i < qdcount; i++) {
1171	    p = smb_fdata(p,
1172		"|Name=[n1]\nQuestionType=[rw]\nQuestionClass=[rw]\n#",
1173		maxbuf, 0);
1174	    if (p == NULL)
1175		goto out;
1176	}
1177    }
1178
1179    if (total) {
1180	printf("\nResourceRecords:\n");
1181	for (i = 0; i < total; i++) {
1182	    int rdlen;
1183	    int restype;
1184
1185	    p = smb_fdata(p, "Name=[n1]\n#", maxbuf, 0);
1186	    if (p == NULL)
1187		goto out;
1188	    restype = EXTRACT_16BITS(p);
1189	    p = smb_fdata(p, "ResType=[rw]\nResClass=[rw]\nTTL=[rD]\n", p + 8, 0);
1190	    if (p == NULL)
1191		goto out;
1192	    rdlen = EXTRACT_16BITS(p);
1193	    printf("ResourceLength=%d\nResourceData=\n", rdlen);
1194	    p += 2;
1195	    if (rdlen == 6) {
1196		p = smb_fdata(p, "AddrType=[rw]\nAddress=[b.b.b.b]\n", p + rdlen, 0);
1197		if (p == NULL)
1198		    goto out;
1199	    } else {
1200		if (restype == 0x21) {
1201		    int numnames;
1202
1203		    TCHECK(*p);
1204		    numnames = p[0];
1205		    p = smb_fdata(p, "NumNames=[B]\n", p + 1, 0);
1206		    if (p == NULL)
1207			goto out;
1208		    while (numnames--) {
1209			p = smb_fdata(p, "Name=[n2]\t#", maxbuf, 0);
1210			if (p == NULL)
1211			    goto out;
1212			TCHECK(*p);
1213			if (p[0] & 0x80)
1214			    printf("<GROUP> ");
1215			switch (p[0] & 0x60) {
1216			case 0x00: printf("B "); break;
1217			case 0x20: printf("P "); break;
1218			case 0x40: printf("M "); break;
1219			case 0x60: printf("_ "); break;
1220			}
1221			if (p[0] & 0x10)
1222			    printf("<DEREGISTERING> ");
1223			if (p[0] & 0x08)
1224			    printf("<CONFLICT> ");
1225			if (p[0] & 0x04)
1226			    printf("<ACTIVE> ");
1227			if (p[0] & 0x02)
1228			    printf("<PERMANENT> ");
1229			printf("\n");
1230			p += 2;
1231		    }
1232		} else {
1233		    print_data(p, min(rdlen, length - (p - data)));
1234		    p += rdlen;
1235		}
1236	    }
1237	}
1238    }
1239
1240    if (p < maxbuf)
1241	smb_fdata(p, "AdditionalData:\n", maxbuf, 0);
1242
1243out:
1244    printf("\n");
1245    fflush(stdout);
1246    return;
1247trunc:
1248    printf("[|SMB]");
1249    return;
1250}
1251
1252/*
1253 * Print an SMB-over-TCP packet received across tcp on port 445
1254 */
1255void
1256smb_tcp_print (const u_char * data, int length)
1257{
1258    int caplen;
1259    u_int smb_len;
1260    const u_char *maxbuf;
1261
1262    if (length < 4)
1263	goto trunc;
1264    if (snapend < data)
1265	goto trunc;
1266    caplen = snapend - data;
1267    if (caplen < 4)
1268	goto trunc;
1269    maxbuf = data + caplen;
1270    smb_len = EXTRACT_24BITS(data + 1);
1271    length -= 4;
1272    caplen -= 4;
1273
1274    startbuf = data;
1275    data += 4;
1276
1277    if (smb_len >= 4 && caplen >= 4 && memcmp(data,"\377SMB",4) == 0) {
1278	if ((int)smb_len > caplen) {
1279	    if ((int)smb_len > length)
1280		printf("WARNING: Packet is continued in later TCP segments\n");
1281	    else
1282		printf("WARNING: Short packet. Try increasing the snap length by %d\n",
1283		    smb_len - caplen);
1284	}
1285	print_smb(data, maxbuf > data + smb_len ? data + smb_len : maxbuf);
1286    } else
1287	printf("SMB-over-TCP packet:(raw data or continuation?)\n");
1288    return;
1289trunc:
1290    printf("[|SMB]");
1291    return;
1292}
1293
1294/*
1295 * print a NBT packet received across udp on port 138
1296 */
1297void
1298nbt_udp138_print(const u_char *data, int length)
1299{
1300    const u_char *maxbuf = data + length;
1301
1302    if (maxbuf > snapend)
1303	maxbuf = snapend;
1304    if (maxbuf <= data)
1305	return;
1306    startbuf = data;
1307
1308    if (vflag < 2) {
1309	printf("NBT UDP PACKET(138)");
1310	return;
1311    }
1312
1313    data = smb_fdata(data,
1314	"\n>>> NBT UDP PACKET(138) Res=[rw] ID=[rw] IP=[b.b.b.b] Port=[rd] Length=[rd] Res2=[rw]\nSourceName=[n1]\nDestName=[n1]\n#",
1315	maxbuf, 0);
1316
1317    if (data != NULL) {
1318	/* If there isn't enough data for "\377SMB", don't check for it. */
1319	if (&data[3] >= maxbuf)
1320	    goto out;
1321
1322	if (memcmp(data, "\377SMB",4) == 0)
1323	    print_smb(data, maxbuf);
1324    }
1325out:
1326    printf("\n");
1327    fflush(stdout);
1328}
1329
1330
1331/*
1332   print netbeui frames
1333*/
1334struct nbf_strings {
1335	const char	*name;
1336	const char	*nonverbose;
1337	const char	*verbose;
1338} nbf_strings[0x20] = {
1339	{ "Add Group Name Query", ", [P23]Name to add=[n2]#",
1340	  "[P5]ResponseCorrelator=[w]\n[P16]Name to add=[n2]\n" },
1341	{ "Add Name Query", ", [P23]Name to add=[n2]#",
1342	  "[P5]ResponseCorrelator=[w]\n[P16]Name to add=[n2]\n" },
1343	{ "Name In Conflict", NULL, NULL },
1344	{ "Status Query", NULL, NULL },
1345	{ NULL, NULL, NULL },	/* not used */
1346	{ NULL, NULL, NULL },	/* not used */
1347	{ NULL, NULL, NULL },	/* not used */
1348	{ "Terminate Trace", NULL, NULL },
1349	{ "Datagram", NULL,
1350	  "[P7]Destination=[n2]\nSource=[n2]\n" },
1351	{ "Broadcast Datagram", NULL,
1352	  "[P7]Destination=[n2]\nSource=[n2]\n" },
1353	{ "Name Query", ", [P7]Name=[n2]#",
1354	  "[P1]SessionNumber=[B]\nNameType=[B][P2]\nResponseCorrelator=[w]\nName=[n2]\nName of sender=[n2]\n" },
1355	{ NULL, NULL, NULL },	/* not used */
1356	{ NULL, NULL, NULL },	/* not used */
1357	{ "Add Name Response", ", [P1]GroupName=[w] [P4]Destination=[n2] Source=[n2]#",
1358	  "AddNameInProcess=[B]\nGroupName=[w]\nTransmitCorrelator=[w][P2]\nDestination=[n2]\nSource=[n2]\n" },
1359	{ "Name Recognized", NULL,
1360	  "[P1]Data2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nDestination=[n2]\nSource=[n2]\n" },
1361	{ "Status Response", NULL, NULL },
1362	{ NULL, NULL, NULL },	/* not used */
1363	{ NULL, NULL, NULL },	/* not used */
1364	{ NULL, NULL, NULL },	/* not used */
1365	{ "Terminate Trace", NULL, NULL },
1366	{ "Data Ack", NULL,
1367	  "[P3]TransmitCorrelator=[w][P2]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
1368	{ "Data First/Middle", NULL,
1369	  "Flags=[{RECEIVE_CONTINUE|NO_ACK||PIGGYBACK_ACK_INCLUDED|}]\nResyncIndicator=[w][P2]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
1370	{ "Data Only/Last", NULL,
1371	  "Flags=[{|NO_ACK|PIGGYBACK_ACK_ALLOWED|PIGGYBACK_ACK_INCLUDED|}]\nResyncIndicator=[w][P2]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
1372	{ "Session Confirm", NULL,
1373	  "Data1=[B]\nData2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
1374	{ "Session End", NULL,
1375	  "[P1]Data2=[w][P4]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
1376	{ "Session Initialize", NULL,
1377	  "Data1=[B]\nData2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
1378	{ "No Receive", NULL,
1379	  "Flags=[{|SEND_NO_ACK}]\nDataBytesAccepted=[b][P4]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
1380	{ "Receive Outstanding", NULL,
1381	  "[P1]DataBytesAccepted=[b][P4]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
1382	{ "Receive Continue", NULL,
1383	  "[P2]TransmitCorrelator=[w]\n[P2]RemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
1384	{ NULL, NULL, NULL },	/* not used */
1385	{ NULL, NULL, NULL },	/* not used */
1386	{ "Session Alive", NULL, NULL }
1387};
1388
1389void
1390netbeui_print(u_short control, const u_char *data, int length)
1391{
1392    const u_char *maxbuf = data + length;
1393    int len;
1394    int command;
1395    const u_char *data2;
1396    int is_truncated = 0;
1397
1398    if (maxbuf > snapend)
1399	maxbuf = snapend;
1400    TCHECK(data[4]);
1401    len = EXTRACT_LE_16BITS(data);
1402    command = data[4];
1403    data2 = data + len;
1404    if (data2 >= maxbuf) {
1405	data2 = maxbuf;
1406	is_truncated = 1;
1407    }
1408
1409    startbuf = data;
1410
1411    if (vflag < 2) {
1412	printf("NBF Packet: ");
1413	data = smb_fdata(data, "[P5]#", maxbuf, 0);
1414    } else {
1415	printf("\n>>> NBF Packet\nType=0x%X ", control);
1416	data = smb_fdata(data, "Length=[d] Signature=[w] Command=[B]\n#", maxbuf, 0);
1417    }
1418    if (data == NULL)
1419	goto out;
1420
1421    if (command > 0x1f || nbf_strings[command].name == NULL) {
1422	if (vflag < 2)
1423	    data = smb_fdata(data, "Unknown NBF Command#", data2, 0);
1424	else
1425	    data = smb_fdata(data, "Unknown NBF Command\n", data2, 0);
1426    } else {
1427	if (vflag < 2) {
1428	    printf("%s", nbf_strings[command].name);
1429	    if (nbf_strings[command].nonverbose != NULL)
1430		data = smb_fdata(data, nbf_strings[command].nonverbose, data2, 0);
1431	} else {
1432	    printf("%s:\n", nbf_strings[command].name);
1433	    if (nbf_strings[command].verbose != NULL)
1434		data = smb_fdata(data, nbf_strings[command].verbose, data2, 0);
1435	    else
1436		printf("\n");
1437	}
1438    }
1439
1440    if (vflag < 2)
1441	return;
1442
1443    if (data == NULL)
1444	goto out;
1445
1446    if (is_truncated) {
1447	/* data2 was past the end of the buffer */
1448	goto out;
1449    }
1450
1451    /* If this isn't a command that would contain an SMB message, quit. */
1452    if (command != 0x08 && command != 0x09 && command != 0x15 &&
1453        command != 0x16)
1454	goto out;
1455
1456    /* If there isn't enough data for "\377SMB", don't look for it. */
1457    if (&data2[3] >= maxbuf)
1458	goto out;
1459
1460    if (memcmp(data2, "\377SMB",4) == 0)
1461	print_smb(data2, maxbuf);
1462    else {
1463	int i;
1464	for (i = 0; i < 128; i++) {
1465	    if (&data2[i + 3] >= maxbuf)
1466		break;
1467	    if (memcmp(&data2[i], "\377SMB", 4) == 0) {
1468		printf("found SMB packet at %d\n", i);
1469		print_smb(&data2[i], maxbuf);
1470		break;
1471	    }
1472	}
1473    }
1474
1475out:
1476    printf("\n");
1477    return;
1478trunc:
1479    printf("[|SMB]");
1480    return;
1481}
1482
1483
1484/*
1485 * print IPX-Netbios frames
1486 */
1487void
1488ipx_netbios_print(const u_char *data, u_int length)
1489{
1490    /*
1491     * this is a hack till I work out how to parse the rest of the
1492     * NetBIOS-over-IPX stuff
1493     */
1494    int i;
1495    const u_char *maxbuf;
1496
1497    maxbuf = data + length;
1498    /* Don't go past the end of the captured data in the packet. */
1499    if (maxbuf > snapend)
1500	maxbuf = snapend;
1501    startbuf = data;
1502    for (i = 0; i < 128; i++) {
1503	if (&data[i + 4] > maxbuf)
1504	    break;
1505	if (memcmp(&data[i], "\377SMB", 4) == 0) {
1506	    smb_fdata(data, "\n>>> IPX transport ", &data[i], 0);
1507	    if (data != NULL)
1508		print_smb(&data[i], maxbuf);
1509	    printf("\n");
1510	    fflush(stdout);
1511	    break;
1512	}
1513    }
1514    if (i == 128)
1515	smb_fdata(data, "\n>>> Unknown IPX ", maxbuf, 0);
1516}
1517