xref: /freebsd/contrib/tcpdump/print-smb.c (revision 6b3455a7665208c366849f0b2b3bc916fb97516e) 
1 /*
2  * Copyright (C) Andrew Tridgell 1995-1999
3  *
4  * This software may be distributed either under the terms of the
5  * BSD-style license that accompanies tcpdump or the GNU GPL version 2
6  * or later
7  */
8 
9 #ifdef HAVE_CONFIG_H
10 #include "config.h"
11 #endif
12 
13 #ifndef lint
14 static const char rcsid[] _U_ =
15      "@(#) $Header: /tcpdump/master/tcpdump/print-smb.c,v 1.27.2.2 2003/11/16 08:51:45 guy Exp $";
16 #endif
17 
18 #include <tcpdump-stdinc.h>
19 
20 #include <stdio.h>
21 #include <string.h>
22 
23 #include "interface.h"
24 #include "extract.h"
25 #include "smb.h"
26 
27 static int request = 0;
28 
29 const u_char *startbuf = NULL;
30 
31 struct smbdescript {
32     const char *req_f1;
33     const char *req_f2;
34     const char *rep_f1;
35     const char *rep_f2;
36     void (*fn)(const u_char *, const u_char *, const u_char *, const u_char *);
37 };
38 
39 struct smbdescriptint {
40     const char *req_f1;
41     const char *req_f2;
42     const char *rep_f1;
43     const char *rep_f2;
44     void (*fn)(const u_char *, const u_char *, int, int);
45 };
46 
47 struct smbfns
48 {
49     int id;
50     const char *name;
51     int flags;
52     struct smbdescript descript;
53 };
54 
55 struct smbfnsint
56 {
57     int id;
58     const char *name;
59     int flags;
60     struct smbdescriptint descript;
61 };
62 
63 #define DEFDESCRIPT	{ NULL, NULL, NULL, NULL, NULL }
64 
65 #define FLG_CHAIN	(1 << 0)
66 
67 static struct smbfns *
68 smbfind(int id, struct smbfns *list)
69 {
70     int sindex;
71 
72     for (sindex = 0; list[sindex].name; sindex++)
73 	if (list[sindex].id == id)
74 	    return(&list[sindex]);
75 
76     return(&list[0]);
77 }
78 
79 static struct smbfnsint *
80 smbfindint(int id, struct smbfnsint *list)
81 {
82     int sindex;
83 
84     for (sindex = 0; list[sindex].name; sindex++)
85 	if (list[sindex].id == id)
86 	    return(&list[sindex]);
87 
88     return(&list[0]);
89 }
90 
91 static void
92 trans2_findfirst(const u_char *param, const u_char *data, int pcnt, int dcnt)
93 {
94     const char *fmt;
95 
96     if (request)
97 	fmt = "Attribute=[A]\nSearchCount=[d]\nFlags=[w]\nLevel=[dP5]\nFile=[S]\n";
98     else
99 	fmt = "Handle=[w]\nCount=[d]\nEOS=[w]\nEoffset=[d]\nLastNameOfs=[w]\n";
100 
101     smb_fdata(param, fmt, param + pcnt);
102     if (dcnt) {
103 	printf("data:\n");
104 	print_data(data, dcnt);
105     }
106 }
107 
108 static void
109 trans2_qfsinfo(const u_char *param, const u_char *data, int pcnt, int dcnt)
110 {
111     static int level = 0;
112     const char *fmt="";
113 
114     if (request) {
115 	TCHECK2(*param, 2);
116 	level = EXTRACT_LE_16BITS(param);
117 	fmt = "InfoLevel=[d]\n";
118 	smb_fdata(param, fmt, param + pcnt);
119     } else {
120 	switch (level) {
121 	case 1:
122 	    fmt = "idFileSystem=[W]\nSectorUnit=[D]\nUnit=[D]\nAvail=[D]\nSectorSize=[d]\n";
123 	    break;
124 	case 2:
125 	    fmt = "CreationTime=[T2]VolNameLength=[B]\nVolumeLabel=[s12]\n";
126 	    break;
127 	case 0x105:
128 	    fmt = "Capabilities=[W]\nMaxFileLen=[D]\nVolNameLen=[D]\nVolume=[S]\n";
129 	    break;
130 	default:
131 	    fmt = "UnknownLevel\n";
132 	    break;
133 	}
134 	smb_fdata(data, fmt, data + dcnt);
135     }
136     if (dcnt) {
137 	printf("data:\n");
138 	print_data(data, dcnt);
139     }
140     return;
141 trunc:
142     printf("[|SMB]");
143     return;
144 }
145 
146 struct smbfnsint trans2_fns[] = {
147     { 0, "TRANSACT2_OPEN", 0,
148 	{ "Flags2=[w]\nMode=[w]\nSearchAttrib=[A]\nAttrib=[A]\nTime=[T2]\nOFun=[w]\nSize=[D]\nRes=([w, w, w, w, w])\nPath=[S]",
149 	  NULL,
150 	  "Handle=[d]\nAttrib=[A]\nTime=[T2]\nSize=[D]\nAccess=[w]\nType=[w]\nState=[w]\nAction=[w]\nInode=[W]\nOffErr=[d]\n|EALength=[d]\n",
151 	  NULL, NULL }},
152     { 1, "TRANSACT2_FINDFIRST", 0,
153 	{ NULL, NULL, NULL, NULL, trans2_findfirst }},
154     { 2, "TRANSACT2_FINDNEXT", 0, DEFDESCRIPT },
155     { 3, "TRANSACT2_QFSINFO", 0,
156 	{ NULL, NULL, NULL, NULL, trans2_qfsinfo }},
157     { 4, "TRANSACT2_SETFSINFO", 0, DEFDESCRIPT },
158     { 5, "TRANSACT2_QPATHINFO", 0, DEFDESCRIPT },
159     { 6, "TRANSACT2_SETPATHINFO", 0, DEFDESCRIPT },
160     { 7, "TRANSACT2_QFILEINFO", 0, DEFDESCRIPT },
161     { 8, "TRANSACT2_SETFILEINFO", 0, DEFDESCRIPT },
162     { 9, "TRANSACT2_FSCTL", 0, DEFDESCRIPT },
163     { 10, "TRANSACT2_IOCTL", 0, DEFDESCRIPT },
164     { 11, "TRANSACT2_FINDNOTIFYFIRST", 0, DEFDESCRIPT },
165     { 12, "TRANSACT2_FINDNOTIFYNEXT", 0, DEFDESCRIPT },
166     { 13, "TRANSACT2_MKDIR", 0, DEFDESCRIPT },
167     { -1, NULL, 0, DEFDESCRIPT }
168 };
169 
170 
171 static void
172 print_trans2(const u_char *words, const u_char *dat _U_, const u_char *buf, const u_char *maxbuf)
173 {
174     static struct smbfnsint *fn = &trans2_fns[0];
175     const u_char *data, *param;
176     const u_char *w = words + 1;
177     const char *f1 = NULL, *f2 = NULL;
178     int pcnt, dcnt;
179 
180     TCHECK(words[0]);
181     if (request) {
182 	TCHECK2(w[14 * 2], 2);
183 	pcnt = EXTRACT_LE_16BITS(w + 9 * 2);
184 	param = buf + EXTRACT_LE_16BITS(w + 10 * 2);
185 	dcnt = EXTRACT_LE_16BITS(w + 11 * 2);
186 	data = buf + EXTRACT_LE_16BITS(w + 12 * 2);
187 	fn = smbfindint(EXTRACT_LE_16BITS(w + 14 * 2), trans2_fns);
188     } else {
189 	if (words[0] == 0) {
190 	    printf("%s\n", fn->name);
191 	    printf("Trans2Interim\n");
192 	    return;
193 	}
194 	TCHECK2(w[7 * 2], 2);
195 	pcnt = EXTRACT_LE_16BITS(w + 3 * 2);
196 	param = buf + EXTRACT_LE_16BITS(w + 4 * 2);
197 	dcnt = EXTRACT_LE_16BITS(w + 6 * 2);
198 	data = buf + EXTRACT_LE_16BITS(w + 7 * 2);
199     }
200 
201     printf("%s param_length=%d data_length=%d\n", fn->name, pcnt, dcnt);
202 
203     if (request) {
204 	if (words[0] == 8) {
205 	    smb_fdata(words + 1,
206 		"Trans2Secondary\nTotParam=[d]\nTotData=[d]\nParamCnt=[d]\nParamOff=[d]\nParamDisp=[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nHandle=[d]\n",
207 		maxbuf);
208 	    return;
209 	} else {
210 	    smb_fdata(words + 1,
211 		"TotParam=[d]\nTotData=[d]\nMaxParam=[d]\nMaxData=[d]\nMaxSetup=[d]\nFlags=[w]\nTimeOut=[D]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nDataCnt=[d]\nDataOff=[d]\nSetupCnt=[d]\n",
212 		words + 1 + 14 * 2);
213 	    smb_fdata(data + 1, "TransactionName=[S]\n%", maxbuf);
214 	}
215 	f1 = fn->descript.req_f1;
216 	f2 = fn->descript.req_f2;
217     } else {
218 	smb_fdata(words + 1,
219 	    "TotParam=[d]\nTotData=[d]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nParamDisp[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nSetupCnt=[d]\n",
220 	    words + 1 + 10 * 2);
221 	f1 = fn->descript.rep_f1;
222 	f2 = fn->descript.rep_f2;
223     }
224 
225     if (fn->descript.fn)
226 	(*fn->descript.fn)(param, data, pcnt, dcnt);
227     else {
228 	smb_fdata(param, f1 ? f1 : "Parameters=\n", param + pcnt);
229 	smb_fdata(data, f2 ? f2 : "Data=\n", data + dcnt);
230     }
231     return;
232 trunc:
233     printf("[|SMB]");
234     return;
235 }
236 
237 
238 static void
239 print_browse(const u_char *param, int paramlen, const u_char *data, int datalen)
240 {
241     const u_char *maxbuf = data + datalen;
242     int command;
243 
244     TCHECK(data[0]);
245     command = data[0];
246 
247     smb_fdata(param, "BROWSE PACKET\n|Param ", param+paramlen);
248 
249     switch (command) {
250     case 0xF:
251 	data = smb_fdata(data,
252 	    "BROWSE PACKET:\nType=[B] (LocalMasterAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nElectionVersion=[w]\nBrowserConstant=[w]\n",
253 	    maxbuf);
254 	break;
255 
256     case 0x1:
257 	data = smb_fdata(data,
258 	    "BROWSE PACKET:\nType=[B] (HostAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nElectionVersion=[w]\nBrowserConstant=[w]\n",
259 	    maxbuf);
260 	break;
261 
262     case 0x2:
263 	data = smb_fdata(data,
264 	    "BROWSE PACKET:\nType=[B] (AnnouncementRequest)\nFlags=[B]\nReplySystemName=[S]\n",
265 	    maxbuf);
266 	break;
267 
268     case 0xc:
269 	data = smb_fdata(data,
270 	    "BROWSE PACKET:\nType=[B] (WorkgroupAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nCommentPointer=[W]\nServerName=[S]\n",
271 	    maxbuf);
272 	break;
273 
274     case 0x8:
275 	data = smb_fdata(data,
276 	    "BROWSE PACKET:\nType=[B] (ElectionFrame)\nElectionVersion=[B]\nOSSummary=[W]\nUptime=[(W, W)]\nServerName=[S]\n",
277 	    maxbuf);
278 	break;
279 
280     case 0xb:
281 	data = smb_fdata(data,
282 	    "BROWSE PACKET:\nType=[B] (BecomeBackupBrowser)\nName=[S]\n",
283 	    maxbuf);
284 	break;
285 
286     case 0x9:
287 	data = smb_fdata(data,
288 	    "BROWSE PACKET:\nType=[B] (GetBackupList)\nListCount?=[B]\nToken?=[B]\n",
289 	    maxbuf);
290 	break;
291 
292     case 0xa:
293 	data = smb_fdata(data,
294 	    "BROWSE PACKET:\nType=[B] (BackupListResponse)\nServerCount?=[B]\nToken?=[B]*Name=[S]\n",
295 	    maxbuf);
296 	break;
297 
298     case 0xd:
299 	data = smb_fdata(data,
300 	    "BROWSE PACKET:\nType=[B] (MasterAnnouncement)\nMasterName=[S]\n",
301 	    maxbuf);
302 	break;
303 
304     case 0xe:
305 	data = smb_fdata(data,
306 	    "BROWSE PACKET:\nType=[B] (ResetBrowser)\nOptions=[B]\n", maxbuf);
307 	break;
308 
309     default:
310 	data = smb_fdata(data, "Unknown Browser Frame ", maxbuf);
311 	break;
312     }
313     return;
314 trunc:
315     printf("[|SMB]");
316     return;
317 }
318 
319 
320 static void
321 print_ipc(const u_char *param, int paramlen, const u_char *data, int datalen)
322 {
323     if (paramlen)
324 	smb_fdata(param, "Command=[w]\nStr1=[S]\nStr2=[S]\n", param + paramlen);
325     if (datalen)
326 	smb_fdata(data, "IPC ", data + datalen);
327 }
328 
329 
330 static void
331 print_trans(const u_char *words, const u_char *data1, const u_char *buf, const u_char *maxbuf)
332 {
333     const char *f1, *f2, *f3, *f4;
334     const u_char *data, *param;
335     const u_char *w = words + 1;
336     int datalen, paramlen;
337 
338     if (request) {
339 	TCHECK2(w[12 * 2], 2);
340 	paramlen = EXTRACT_LE_16BITS(w + 9 * 2);
341 	param = buf + EXTRACT_LE_16BITS(w + 10 * 2);
342 	datalen = EXTRACT_LE_16BITS(w + 11 * 2);
343 	data = buf + EXTRACT_LE_16BITS(w + 12 * 2);
344 	f1 = "TotParamCnt=[d] \nTotDataCnt=[d] \nMaxParmCnt=[d] \nMaxDataCnt=[d]\nMaxSCnt=[d] \nTransFlags=[w] \nRes1=[w] \nRes2=[w] \nRes3=[w]\nParamCnt=[d] \nParamOff=[d] \nDataCnt=[d] \nDataOff=[d] \nSUCnt=[d]\n";
345 	f2 = "|Name=[S]\n";
346 	f3 = "|Param ";
347 	f4 = "|Data ";
348     } else {
349 	TCHECK2(w[7 * 2], 2);
350 	paramlen = EXTRACT_LE_16BITS(w + 3 * 2);
351 	param = buf + EXTRACT_LE_16BITS(w + 4 * 2);
352 	datalen = EXTRACT_LE_16BITS(w + 6 * 2);
353 	data = buf + EXTRACT_LE_16BITS(w + 7 * 2);
354 	f1 = "TotParamCnt=[d] \nTotDataCnt=[d] \nRes1=[d]\nParamCnt=[d] \nParamOff=[d] \nRes2=[d] \nDataCnt=[d] \nDataOff=[d] \nRes3=[d]\nLsetup=[d]\n";
355 	f2 = "|Unknown ";
356 	f3 = "|Param ";
357 	f4 = "|Data ";
358     }
359 
360     smb_fdata(words + 1, f1, SMBMIN(words + 1 + 2 * words[0], maxbuf));
361     smb_fdata(data1 + 2, f2, maxbuf - (paramlen + datalen));
362 
363     if (strcmp((const char *)(data1 + 2), "\\MAILSLOT\\BROWSE") == 0) {
364 	print_browse(param, paramlen, data, datalen);
365 	return;
366     }
367 
368     if (strcmp((const char *)(data1 + 2), "\\PIPE\\LANMAN") == 0) {
369 	print_ipc(param, paramlen, data, datalen);
370 	return;
371     }
372 
373     if (paramlen)
374 	smb_fdata(param, f3, SMBMIN(param + paramlen, maxbuf));
375     if (datalen)
376 	smb_fdata(data, f4, SMBMIN(data + datalen, maxbuf));
377     return;
378 trunc:
379     printf("[|SMB]");
380     return;
381 }
382 
383 
384 static void
385 print_negprot(const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf)
386 {
387     u_int wcnt;
388     const char *f1 = NULL, *f2 = NULL;
389 
390     TCHECK(words[0]);
391     wcnt = words[0];
392     if (request)
393 	f2 = "*|Dialect=[Z]\n";
394     else {
395 	if (wcnt == 1)
396 	    f1 = "Core Protocol\nDialectIndex=[d]";
397 	else if (wcnt == 17)
398 	    f1 = "NT1 Protocol\nDialectIndex=[d]\nSecMode=[B]\nMaxMux=[d]\nNumVcs=[d]\nMaxBuffer=[D]\nRawSize=[D]\nSessionKey=[W]\nCapabilities=[W]\nServerTime=[T3]TimeZone=[d]\nCryptKey=";
399 	else if (wcnt == 13)
400 	    f1 = "Coreplus/Lanman1/Lanman2 Protocol\nDialectIndex=[d]\nSecMode=[w]\nMaxXMit=[d]\nMaxMux=[d]\nMaxVcs=[d]\nBlkMode=[w]\nSessionKey=[W]\nServerTime=[T1]TimeZone=[d]\nRes=[W]\nCryptKey=";
401     }
402 
403     if (f1)
404 	smb_fdata(words + 1, f1, SMBMIN(words + 1 + wcnt * 2, maxbuf));
405     else
406 	print_data(words + 1, SMBMIN(wcnt * 2, PTR_DIFF(maxbuf, words + 1)));
407 
408     TCHECK2(*data, 2);
409     if (f2)
410 	smb_fdata(data + 2, f2, SMBMIN(data + 2 + EXTRACT_LE_16BITS(data), maxbuf));
411     else
412 	print_data(data + 2, SMBMIN(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2)));
413     return;
414 trunc:
415     printf("[|SMB]");
416     return;
417 }
418 
419 static void
420 print_sesssetup(const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf)
421 {
422     u_int wcnt;
423     const char *f1 = NULL, *f2 = NULL;
424 
425     TCHECK(words[0]);
426     wcnt = words[0];
427     if (request) {
428 	if (wcnt == 10)
429 	    f1 = "Com2=[w]\nOff2=[d]\nBufSize=[d]\nMpxMax=[d]\nVcNum=[d]\nSessionKey=[W]\nPassLen=[d]\nCryptLen=[d]\nCryptOff=[d]\nPass&Name=\n";
430 	else
431 	    f1 = "Com2=[B]\nRes1=[B]\nOff2=[d]\nMaxBuffer=[d]\nMaxMpx=[d]\nVcNumber=[d]\nSessionKey=[W]\nCaseInsensitivePasswordLength=[d]\nCaseSensitivePasswordLength=[d]\nRes=[W]\nCapabilities=[W]\nPass1&Pass2&Account&Domain&OS&LanMan=\n";
432     } else {
433 	if (wcnt == 3) {
434 	    f1 = "Com2=[w]\nOff2=[d]\nAction=[w]\n";
435 	} else if (wcnt == 13) {
436 	    f1 = "Com2=[B]\nRes=[B]\nOff2=[d]\nAction=[w]\n";
437 	    f2 = "NativeOS=[S]\nNativeLanMan=[S]\nPrimaryDomain=[S]\n";
438 	}
439     }
440 
441     if (f1)
442 	smb_fdata(words + 1, f1, SMBMIN(words + 1 + wcnt * 2, maxbuf));
443     else
444 	print_data(words + 1, SMBMIN(wcnt * 2, PTR_DIFF(maxbuf, words + 1)));
445 
446     TCHECK2(*data, 2);
447     if (f2)
448 	smb_fdata(data + 2, f2, SMBMIN(data + 2 + EXTRACT_LE_16BITS(data), maxbuf));
449     else
450 	print_data(data + 2, SMBMIN(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2)));
451     return;
452 trunc:
453     printf("[|SMB]");
454     return;
455 }
456 
457 
458 static struct smbfns smb_fns[] = {
459     { -1, "SMBunknown", 0, DEFDESCRIPT },
460 
461     { SMBtcon, "SMBtcon", 0,
462 	{ NULL, "Path=[Z]\nPassword=[Z]\nDevice=[Z]\n",
463 	  "MaxXmit=[d]\nTreeId=[d]\n", NULL,
464 	  NULL } },
465 
466     { SMBtdis, "SMBtdis", 0, DEFDESCRIPT },
467     { SMBexit,  "SMBexit", 0, DEFDESCRIPT },
468     { SMBioctl, "SMBioctl", 0, DEFDESCRIPT },
469 
470     { SMBecho, "SMBecho", 0,
471 	{ "ReverbCount=[d]\n", NULL,
472 	  "SequenceNum=[d]\n", NULL,
473 	  NULL } },
474 
475     { SMBulogoffX, "SMBulogoffX", FLG_CHAIN, DEFDESCRIPT },
476 
477     { SMBgetatr, "SMBgetatr", 0,
478 	{ NULL, "Path=[Z]\n",
479 	  "Attribute=[A]\nTime=[T2]Size=[D]\nRes=([w,w,w,w,w])\n", NULL,
480 	  NULL } },
481 
482     { SMBsetatr, "SMBsetatr", 0,
483 	{ "Attribute=[A]\nTime=[T2]Res=([w,w,w,w,w])\n", "Path=[Z]\n",
484 	  NULL, NULL, NULL } },
485 
486     { SMBchkpth, "SMBchkpth", 0,
487        { NULL, "Path=[Z]\n", NULL, NULL, NULL } },
488 
489     { SMBsearch, "SMBsearch", 0,
490 	{ "Count=[d]\nAttrib=[A]\n",
491 	  "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\n",
492 	  "Count=[d]\n",
493 	  "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",
494 	  NULL } },
495 
496     { SMBopen, "SMBopen", 0,
497 	{ "Mode=[w]\nAttribute=[A]\n", "Path=[Z]\n",
498 	  "Handle=[d]\nOAttrib=[A]\nTime=[T2]Size=[D]\nAccess=[w]\n",
499 	  NULL, NULL } },
500 
501     { SMBcreate, "SMBcreate", 0,
502 	{ "Attrib=[A]\nTime=[T2]", "Path=[Z]\n", "Handle=[d]\n", NULL, NULL } },
503 
504     { SMBmknew, "SMBmknew", 0,
505 	{ "Attrib=[A]\nTime=[T2]", "Path=[Z]\n", "Handle=[d]\n", NULL, NULL } },
506 
507     { SMBunlink, "SMBunlink", 0,
508 	{ "Attrib=[A]\n", "Path=[Z]\n", NULL, NULL, NULL } },
509 
510     { SMBread, "SMBread", 0,
511 	{ "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL,
512 	  "Count=[d]\nRes=([w,w,w,w])\n", NULL, NULL } },
513 
514     { SMBwrite, "SMBwrite", 0,
515 	{ "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL,
516 	  "Count=[d]\n", NULL, NULL } },
517 
518     { SMBclose, "SMBclose", 0,
519 	{ "Handle=[d]\nTime=[T2]", NULL, NULL, NULL, NULL } },
520 
521     { SMBmkdir, "SMBmkdir", 0,
522 	{ NULL, "Path=[Z]\n", NULL, NULL, NULL } },
523 
524     { SMBrmdir, "SMBrmdir", 0,
525 	{ NULL, "Path=[Z]\n", NULL, NULL, NULL } },
526 
527     { SMBdskattr, "SMBdskattr", 0,
528 	{ NULL, NULL,
529 	  "TotalUnits=[d]\nBlocksPerUnit=[d]\nBlockSize=[d]\nFreeUnits=[d]\nMedia=[w]\n",
530 	  NULL, NULL } },
531 
532     { SMBmv, "SMBmv", 0,
533 	{ "Attrib=[A]\n", "OldPath=[Z]\nNewPath=[Z]\n", NULL, NULL, NULL } },
534 
535     /*
536      * this is a Pathworks specific call, allowing the
537      * changing of the root path
538      */
539     { pSETDIR, "SMBsetdir", 0, { NULL, "Path=[Z]\n", NULL, NULL, NULL } },
540 
541     { SMBlseek, "SMBlseek", 0,
542 	{ "Handle=[d]\nMode=[w]\nOffset=[D]\n", "Offset=[D]\n", NULL, NULL, NULL } },
543 
544     { SMBflush, "SMBflush", 0, { "Handle=[d]\n", NULL, NULL, NULL, NULL } },
545 
546     { SMBsplopen, "SMBsplopen", 0,
547 	{ "SetupLen=[d]\nMode=[w]\n", "Ident=[Z]\n", "Handle=[d]\n",
548 	  NULL, NULL } },
549 
550     { SMBsplclose, "SMBsplclose", 0,
551 	{ "Handle=[d]\n", NULL, NULL, NULL, NULL } },
552 
553     { SMBsplretq, "SMBsplretq", 0,
554 	{ "MaxCount=[d]\nStartIndex=[d]\n", NULL,
555 	  "Count=[d]\nIndex=[d]\n",
556 	  "*Time=[T2]Status=[B]\nJobID=[d]\nSize=[D]\nRes=[B]Name=[s16]\n",
557 	  NULL } },
558 
559     { SMBsplwr, "SMBsplwr", 0,
560 	{ "Handle=[d]\n", NULL, NULL, NULL, NULL } },
561 
562     { SMBlock, "SMBlock", 0,
563 	{ "Handle=[d]\nCount=[D]\nOffset=[D]\n", NULL, NULL, NULL, NULL } },
564 
565     { SMBunlock, "SMBunlock", 0,
566 	{ "Handle=[d]\nCount=[D]\nOffset=[D]\n", NULL, NULL, NULL, NULL } },
567 
568     /* CORE+ PROTOCOL FOLLOWS */
569 
570     { SMBreadbraw, "SMBreadbraw", 0,
571 	{ "Handle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nRes=[d]\n",
572 	  NULL, NULL, NULL, NULL } },
573 
574     { SMBwritebraw, "SMBwritebraw", 0,
575 	{ "Handle=[d]\nTotalCount=[d]\nRes=[w]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nRes2=[W]\n|DataSize=[d]\nDataOff=[d]\n",
576 	  NULL, "WriteRawAck", NULL, NULL } },
577 
578     { SMBwritec, "SMBwritec", 0,
579 	{ NULL, NULL, "Count=[d]\n", NULL, NULL } },
580 
581     { SMBwriteclose, "SMBwriteclose", 0,
582 	{ "Handle=[d]\nCount=[d]\nOffset=[D]\nTime=[T2]Res=([w,w,w,w,w,w])",
583 	  NULL, "Count=[d]\n", NULL, NULL } },
584 
585     { SMBlockread, "SMBlockread", 0,
586 	{ "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL,
587 	  "Count=[d]\nRes=([w,w,w,w])\n", NULL, NULL } },
588 
589     { SMBwriteunlock, "SMBwriteunlock", 0,
590 	{ "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL,
591 	  "Count=[d]\n", NULL, NULL } },
592 
593     { SMBreadBmpx, "SMBreadBmpx", 0,
594 	{ "Handle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nRes=[w]\n",
595 	  NULL,
596 	  "Offset=[D]\nTotCount=[d]\nRemaining=[d]\nRes=([w,w])\nDataSize=[d]\nDataOff=[d]\n",
597 	  NULL, NULL } },
598 
599     { SMBwriteBmpx, "SMBwriteBmpx", 0,
600 	{ "Handle=[d]\nTotCount=[d]\nRes=[w]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nRes2=[W]\nDataSize=[d]\nDataOff=[d]\n", NULL,
601 	  "Remaining=[d]\n", NULL, NULL } },
602 
603     { SMBwriteBs, "SMBwriteBs", 0,
604 	{ "Handle=[d]\nTotCount=[d]\nOffset=[D]\nRes=[W]\nDataSize=[d]\nDataOff=[d]\n",
605 	  NULL, "Count=[d]\n", NULL, NULL } },
606 
607     { SMBsetattrE, "SMBsetattrE", 0,
608 	{ "Handle=[d]\nCreationTime=[T2]AccessTime=[T2]ModifyTime=[T2]", NULL,
609 	  NULL, NULL, NULL } },
610 
611     { SMBgetattrE, "SMBgetattrE", 0,
612 	{ "Handle=[d]\n", NULL,
613 	  "CreationTime=[T2]AccessTime=[T2]ModifyTime=[T2]Size=[D]\nAllocSize=[D]\nAttribute=[A]\n",
614 	  NULL, NULL } },
615 
616     { SMBtranss, "SMBtranss", 0, DEFDESCRIPT },
617     { SMBioctls, "SMBioctls", 0, DEFDESCRIPT },
618 
619     { SMBcopy, "SMBcopy", 0,
620 	{ "TreeID2=[d]\nOFun=[w]\nFlags=[w]\n", "Path=[S]\nNewPath=[S]\n",
621 	  "CopyCount=[d]\n",  "|ErrStr=[S]\n",  NULL } },
622 
623     { SMBmove, "SMBmove", 0,
624 	{ "TreeID2=[d]\nOFun=[w]\nFlags=[w]\n", "Path=[S]\nNewPath=[S]\n",
625 	  "MoveCount=[d]\n",  "|ErrStr=[S]\n",  NULL } },
626 
627     { SMBopenX, "SMBopenX", FLG_CHAIN,
628 	{ "Com2=[w]\nOff2=[d]\nFlags=[w]\nMode=[w]\nSearchAttrib=[A]\nAttrib=[A]\nTime=[T2]OFun=[w]\nSize=[D]\nTimeOut=[D]\nRes=[W]\n",
629 	  "Path=[S]\n",
630 	  "Com2=[w]\nOff2=[d]\nHandle=[d]\nAttrib=[A]\nTime=[T2]Size=[D]\nAccess=[w]\nType=[w]\nState=[w]\nAction=[w]\nFileID=[W]\nRes=[w]\n",
631 	  NULL, NULL } },
632 
633     { SMBreadX, "SMBreadX", FLG_CHAIN,
634 	{ "Com2=[w]\nOff2=[d]\nHandle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nCountLeft=[d]\n",
635 	  NULL,
636 	  "Com2=[w]\nOff2=[d]\nRemaining=[d]\nRes=[W]\nDataSize=[d]\nDataOff=[d]\nRes=([w,w,w,w])\n",
637 	  NULL, NULL } },
638 
639     { SMBwriteX, "SMBwriteX", FLG_CHAIN,
640 	{ "Com2=[w]\nOff2=[d]\nHandle=[d]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nCountLeft=[d]\nRes=[w]\nDataSize=[d]\nDataOff=[d]\n",
641 	  NULL,
642 	  "Com2=[w]\nOff2=[d]\nCount=[d]\nRemaining=[d]\nRes=[W]\n",
643 	  NULL, NULL } },
644 
645     { SMBlockingX, "SMBlockingX", FLG_CHAIN,
646 	{ "Com2=[w]\nOff2=[d]\nHandle=[d]\nLockType=[w]\nTimeOut=[D]\nUnlockCount=[d]\nLockCount=[d]\n",
647 	  "*Process=[d]\nOffset=[D]\nLength=[D]\n",
648 	  "Com2=[w]\nOff2=[d]\n", NULL, NULL } },
649 
650     { SMBffirst, "SMBffirst", 0,
651 	{ "Count=[d]\nAttrib=[A]\n",
652 	  "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n",
653 	  "Count=[d]\n",
654 	  "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",
655 	  NULL } },
656 
657     { SMBfunique, "SMBfunique", 0,
658 	{ "Count=[d]\nAttrib=[A]\n",
659 	  "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n",
660 	  "Count=[d]\n",
661 	  "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",
662 	  NULL } },
663 
664     { SMBfclose, "SMBfclose", 0,
665 	{ "Count=[d]\nAttrib=[A]\n",
666 	  "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n",
667 	  "Count=[d]\n",
668 	  "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",
669 	  NULL } },
670 
671     { SMBfindnclose, "SMBfindnclose", 0,
672 	{ "Handle=[d]\n", NULL, NULL, NULL, NULL } },
673 
674     { SMBfindclose, "SMBfindclose", 0,
675 	{ "Handle=[d]\n", NULL, NULL, NULL, NULL } },
676 
677     { SMBsends, "SMBsends", 0,
678 	{ NULL, "Source=[Z]\nDest=[Z]\n", NULL, NULL, NULL } },
679 
680     { SMBsendstrt, "SMBsendstrt", 0,
681 	{ NULL, "Source=[Z]\nDest=[Z]\n", "GroupID=[d]\n", NULL, NULL } },
682 
683     { SMBsendend, "SMBsendend", 0,
684 	{ "GroupID=[d]\n", NULL, NULL, NULL, NULL } },
685 
686     { SMBsendtxt, "SMBsendtxt", 0,
687 	{ "GroupID=[d]\n", NULL, NULL, NULL, NULL } },
688 
689     { SMBsendb, "SMBsendb", 0,
690 	{ NULL, "Source=[Z]\nDest=[Z]\n", NULL, NULL, NULL } },
691 
692     { SMBfwdname, "SMBfwdname", 0, DEFDESCRIPT },
693     { SMBcancelf, "SMBcancelf", 0, DEFDESCRIPT },
694     { SMBgetmac, "SMBgetmac", 0, DEFDESCRIPT },
695 
696     { SMBnegprot, "SMBnegprot", 0,
697 	{ NULL, NULL, NULL, NULL, print_negprot } },
698 
699     { SMBsesssetupX, "SMBsesssetupX", FLG_CHAIN,
700 	{ NULL, NULL, NULL, NULL, print_sesssetup } },
701 
702     { SMBtconX, "SMBtconX", FLG_CHAIN,
703 	{ "Com2=[w]\nOff2=[d]\nFlags=[w]\nPassLen=[d]\nPasswd&Path&Device=\n",
704 	  NULL, "Com2=[w]\nOff2=[d]\n", "ServiceType=[S]\n", NULL } },
705 
706     { SMBtrans2, "SMBtrans2", 0, { NULL, NULL, NULL, NULL, print_trans2 } },
707 
708     { SMBtranss2, "SMBtranss2", 0, DEFDESCRIPT },
709     { SMBctemp, "SMBctemp", 0, DEFDESCRIPT },
710     { SMBreadBs, "SMBreadBs", 0, DEFDESCRIPT },
711     { SMBtrans, "SMBtrans", 0, { NULL, NULL, NULL, NULL, print_trans } },
712 
713     { SMBnttrans, "SMBnttrans", 0, DEFDESCRIPT },
714     { SMBnttranss, "SMBnttranss", 0, DEFDESCRIPT },
715 
716     { SMBntcreateX, "SMBntcreateX", FLG_CHAIN,
717 	{ "Com2=[w]\nOff2=[d]\nRes=[b]\nNameLen=[d]\nFlags=[W]\nRootDirectoryFid=[D]\nAccessMask=[W]\nAllocationSize=[L]\nExtFileAttributes=[W]\nShareAccess=[W]\nCreateDisposition=[W]\nCreateOptions=[W]\nImpersonationLevel=[W]\nSecurityFlags=[b]\n",
718 	  "Path=[S]\n",
719 	  "Com2=[w]\nOff2=[d]\nOplockLevel=[b]\nFid=[d]\nCreateAction=[W]\nCreateTime=[T3]LastAccessTime=[T3]LastWriteTime=[T3]ChangeTime=[T3]ExtFileAttributes=[W]\nAllocationSize=[L]\nEndOfFile=[L]\nFileType=[w]\nDeviceState=[w]\nDirectory=[b]\n",
720 	  NULL, NULL } },
721 
722     { SMBntcancel, "SMBntcancel", 0, DEFDESCRIPT },
723 
724     { -1, NULL, 0, DEFDESCRIPT }
725 };
726 
727 
728 /*
729  * print a SMB message
730  */
731 static void
732 print_smb(const u_char *buf, const u_char *maxbuf)
733 {
734     int command;
735     const u_char *words, *data;
736     struct smbfns *fn;
737     const char *fmt_smbheader =
738         "[P4]SMB Command   =  [B]\nError class   =  [BP1]\nError code    =  [d]\nFlags1        =  [B]\nFlags2        =  [B][P13]\nTree ID       =  [d]\nProc ID       =  [d]\nUID           =  [d]\nMID           =  [d]\nWord Count    =  [b]\n";
739 
740 
741     TCHECK(buf[9]);
742     request = (buf[9] & 0x80) ? 0 : 1;
743 
744     command = buf[4];
745 
746     fn = smbfind(command, smb_fns);
747 
748     if (vflag > 1)
749 	printf("\n");
750 
751     printf("SMB PACKET: %s (%s)\n", fn->name, request ? "REQUEST" : "REPLY");
752 
753     if (vflag < 2)
754 	return;
755 
756     /* print out the header */
757     smb_fdata(buf, fmt_smbheader, buf + 33);
758 
759     if (buf[5])
760 	printf("SMBError = %s\n", smb_errstr(buf[5], EXTRACT_LE_16BITS(&buf[7])));
761 
762     words = buf + 32;
763     TCHECK(words[0]);
764 
765     for (;;) {
766 	const char *f1, *f2;
767 	int wct;
768 	u_int bcc;
769 
770 	TCHECK(words[0]);
771 	wct = words[0];
772 	data = words + 1 + wct * 2;
773 
774 	if (request) {
775 	    f1 = fn->descript.req_f1;
776 	    f2 = fn->descript.req_f2;
777 	} else {
778 	    f1 = fn->descript.rep_f1;
779 	    f2 = fn->descript.rep_f2;
780 	}
781 
782 	if (fn->descript.fn)
783 	    (*fn->descript.fn)(words, data, buf, maxbuf);
784 	else {
785 	    if (wct) {
786 		printf("smbvwv[]=\n");
787 		if (f1)
788 		    smb_fdata(words + 1, f1, words + 1 + wct * 2);
789 		else {
790 		    int i;
791 		    int v;
792 
793 		    for (i = 0; i < wct; i++) {
794 			TCHECK2(words[1 + 2 * i], 2);
795 			v = EXTRACT_LE_16BITS(words + 1 + 2 * i);
796 			printf("smb_vwv[%d]=%d (0x%X)\n", i, v, v);
797 		    }
798 		}
799 	    }
800 
801 	    TCHECK2(*data, 2);
802 	    bcc = EXTRACT_LE_16BITS(data);
803 	    if (f2) {
804 		if (bcc > 0) {
805 		    printf("smbbuf[]=\n");
806 		    smb_fdata(data + 2, f2, data + 2 + bcc);
807 		}
808 	    } else {
809 		printf("smb_bcc=%u\n", bcc);
810 		if (bcc > 0) {
811 		    printf("smb_buf[]=\n");
812 		    print_data(data + 2, SMBMIN(bcc, PTR_DIFF(maxbuf, data + 2)));
813 		}
814 	    }
815 	}
816 
817 	if ((fn->flags & FLG_CHAIN) == 0)
818 	    break;
819 	if (wct == 0)
820 	    break;
821 	TCHECK(words[1]);
822 	command = EXTRACT_LE_16BITS(words + 1);
823 	if (command == 0xFF)
824 	    break;
825 	TCHECK2(words[3], 2);
826 	words = buf + EXTRACT_LE_16BITS(words + 3);
827 
828 	fn = smbfind(command, smb_fns);
829 
830 	printf("\nSMB PACKET: %s (%s) (CHAINED)\n",
831 	    fn->name, request ? "REQUEST" : "REPLY");
832     }
833 
834     printf("\n");
835     return;
836 trunc:
837     printf("[|SMB]");
838     return;
839 }
840 
841 
842 /*
843  * print a NBT packet received across tcp on port 139
844  */
845 void
846 nbt_tcp_print(const u_char *data, int length)
847 {
848     const u_char *maxbuf = data + length;
849     int flags;
850     u_int nbt_len;
851 
852     TCHECK2(data[2], 2);
853     flags = data[0];
854     nbt_len = EXTRACT_16BITS(data + 2);
855 
856     startbuf = data;
857     if (maxbuf <= data)
858 	return;
859 
860     if (vflag > 1)
861 	printf ("\n>>>");
862 
863     printf(" NBT Packet");
864 
865     if (vflag < 2)
866 	return;
867 
868     printf("\n");
869 
870     switch (flags) {
871     case 1:
872 	printf("flags=0x%x\n", flags);
873     case 0:
874 	data = smb_fdata(data, "NBT Session Packet\nFlags=[rw]\nLength=[rd]\n",
875 	    data + 4);
876 	if (data == NULL)
877 	    break;
878 	if (memcmp(data,"\377SMB",4) == 0) {
879 	    if (nbt_len > PTR_DIFF(maxbuf, data))
880 	    printf("WARNING: Short packet. Try increasing the snap length (%lu)\n",
881 	       (unsigned long)PTR_DIFF(maxbuf, data));
882 	    print_smb(data, maxbuf > data + nbt_len ? data + nbt_len : maxbuf);
883 	} else
884 	    printf("Session packet:(raw data?)\n");
885 	break;
886 
887 	case 0x81:
888 	    data = smb_fdata(data,
889 		"NBT Session Request\nFlags=[rW]\nDestination=[n1]\nSource=[n1]\n",
890 		maxbuf);
891 	    break;
892 
893 	case 0x82:
894 	    data = smb_fdata(data, "NBT Session Granted\nFlags=[rW]\n", maxbuf);
895 	    break;
896 
897 	case 0x83:
898 	  {
899 	    int ecode;
900 
901 	    TCHECK(data[4]);
902 	    ecode = data[4];
903 
904 	    data = smb_fdata(data, "NBT SessionReject\nFlags=[rW]\nReason=[B]\n",
905 		maxbuf);
906 	    switch (ecode) {
907 	    case 0x80:
908 		printf("Not listening on called name\n");
909 		break;
910 	    case 0x81:
911 		printf("Not listening for calling name\n");
912 		break;
913 	    case 0x82:
914 		printf("Called name not present\n");
915 		break;
916 	    case 0x83:
917 		printf("Called name present, but insufficient resources\n");
918 		break;
919 	    default:
920 		printf("Unspecified error 0x%X\n", ecode);
921 		break;
922 	    }
923 	  }
924 	    break;
925 
926 	case 0x85:
927 	    data = smb_fdata(data, "NBT Session Keepalive\nFlags=[rW]\n", maxbuf);
928 	    break;
929 
930 	default:
931 	    printf("flags=0x%x\n", flags);
932 	    data = smb_fdata(data, "NBT - Unknown packet type\nType=[rW]\n", maxbuf);
933     }
934     printf("\n");
935     fflush(stdout);
936     return;
937 trunc:
938     printf("[|SMB]");
939     return;
940 }
941 
942 
943 /*
944  * print a NBT packet received across udp on port 137
945  */
946 void
947 nbt_udp137_print(const u_char *data, int length)
948 {
949     const u_char *maxbuf = data + length;
950     int name_trn_id, response, opcode, nm_flags, rcode;
951     int qdcount, ancount, nscount, arcount;
952     const char *opcodestr;
953     const u_char *p;
954     int total, i;
955 
956     TCHECK2(data[10], 2);
957     name_trn_id = EXTRACT_16BITS(data);
958     response = (data[2] >> 7);
959     opcode = (data[2] >> 3) & 0xF;
960     nm_flags = ((data[2] & 0x7) << 4) + (data[3] >> 4);
961     rcode = data[3] & 0xF;
962     qdcount = EXTRACT_16BITS(data + 4);
963     ancount = EXTRACT_16BITS(data + 6);
964     nscount = EXTRACT_16BITS(data + 8);
965     arcount = EXTRACT_16BITS(data + 10);
966     startbuf = data;
967 
968     if (maxbuf <= data)
969 	return;
970 
971     if (vflag > 1)
972 	printf("\n>>> ");
973 
974     printf("NBT UDP PACKET(137): ");
975 
976     switch (opcode) {
977     case 0: opcodestr = "QUERY"; break;
978     case 5: opcodestr = "REGISTRATION"; break;
979     case 6: opcodestr = "RELEASE"; break;
980     case 7: opcodestr = "WACK"; break;
981     case 8: opcodestr = "REFRESH(8)"; break;
982     case 9: opcodestr = "REFRESH"; break;
983     case 15: opcodestr = "MULTIHOMED REGISTRATION"; break;
984     default: opcodestr = "OPUNKNOWN"; break;
985     }
986     printf("%s", opcodestr);
987     if (response) {
988 	if (rcode)
989 	    printf("; NEGATIVE");
990 	else
991 	    printf("; POSITIVE");
992     }
993 
994     if (response)
995 	printf("; RESPONSE");
996     else
997 	printf("; REQUEST");
998 
999     if (nm_flags & 1)
1000 	printf("; BROADCAST");
1001     else
1002 	printf("; UNICAST");
1003 
1004     if (vflag < 2)
1005 	return;
1006 
1007     printf("\nTrnID=0x%X\nOpCode=%d\nNmFlags=0x%X\nRcode=%d\nQueryCount=%d\nAnswerCount=%d\nAuthorityCount=%d\nAddressRecCount=%d\n",
1008 	name_trn_id, opcode, nm_flags, rcode, qdcount, ancount, nscount,
1009 	arcount);
1010 
1011     p = data + 12;
1012 
1013     total = ancount + nscount + arcount;
1014 
1015     if (qdcount > 100 || total > 100) {
1016 	printf("Corrupt packet??\n");
1017 	return;
1018     }
1019 
1020     if (qdcount) {
1021 	printf("QuestionRecords:\n");
1022 	for (i = 0; i < qdcount; i++)
1023 	    p = smb_fdata(p,
1024 		"|Name=[n1]\nQuestionType=[rw]\nQuestionClass=[rw]\n#",
1025 		maxbuf);
1026 	if (p == NULL)
1027 	    goto out;
1028     }
1029 
1030     if (total) {
1031 	printf("\nResourceRecords:\n");
1032 	for (i = 0; i < total; i++) {
1033 	    int rdlen;
1034 	    int restype;
1035 
1036 	    p = smb_fdata(p, "Name=[n1]\n#", maxbuf);
1037 	    if (p == NULL)
1038 		goto out;
1039 	    restype = EXTRACT_16BITS(p);
1040 	    p = smb_fdata(p, "ResType=[rw]\nResClass=[rw]\nTTL=[rD]\n", p + 8);
1041 	    if (p == NULL)
1042 		goto out;
1043 	    rdlen = EXTRACT_16BITS(p);
1044 	    printf("ResourceLength=%d\nResourceData=\n", rdlen);
1045 	    p += 2;
1046 	    if (rdlen == 6) {
1047 		p = smb_fdata(p, "AddrType=[rw]\nAddress=[b.b.b.b]\n", p + rdlen);
1048 		if (p == NULL)
1049 		    goto out;
1050 	    } else {
1051 		if (restype == 0x21) {
1052 		    int numnames;
1053 
1054 		    TCHECK(*p);
1055 		    numnames = p[0];
1056 		    p = smb_fdata(p, "NumNames=[B]\n", p + 1);
1057 		    if (p == NULL)
1058 			goto out;
1059 		    while (numnames--) {
1060 			p = smb_fdata(p, "Name=[n2]\t#", maxbuf);
1061 			TCHECK(*p);
1062 			if (p[0] & 0x80)
1063 			    printf("<GROUP> ");
1064 			switch (p[0] & 0x60) {
1065 			case 0x00: printf("B "); break;
1066 			case 0x20: printf("P "); break;
1067 			case 0x40: printf("M "); break;
1068 			case 0x60: printf("_ "); break;
1069 			}
1070 			if (p[0] & 0x10)
1071 			    printf("<DEREGISTERING> ");
1072 			if (p[0] & 0x08)
1073 			    printf("<CONFLICT> ");
1074 			if (p[0] & 0x04)
1075 			    printf("<ACTIVE> ");
1076 			if (p[0] & 0x02)
1077 			    printf("<PERMANENT> ");
1078 			printf("\n");
1079 			p += 2;
1080 		    }
1081 		} else {
1082 		    print_data(p, min(rdlen, length - (p - data)));
1083 		    p += rdlen;
1084 		}
1085 	    }
1086 	}
1087     }
1088 
1089     if (p < maxbuf)
1090 	smb_fdata(p, "AdditionalData:\n", maxbuf);
1091 
1092 out:
1093     printf("\n");
1094     fflush(stdout);
1095     return;
1096 trunc:
1097     printf("[|SMB]");
1098     return;
1099 }
1100 
1101 
1102 
1103 /*
1104  * print a NBT packet received across udp on port 138
1105  */
1106 void
1107 nbt_udp138_print(const u_char *data, int length)
1108 {
1109     const u_char *maxbuf = data + length;
1110 
1111     if (maxbuf > snapend)
1112 	maxbuf = snapend;
1113     if (maxbuf <= data)
1114 	return;
1115     startbuf = data;
1116 
1117     if (vflag < 2) {
1118 	printf("NBT UDP PACKET(138)");
1119 	return;
1120     }
1121 
1122     data = smb_fdata(data,
1123 	"\n>>> NBT UDP PACKET(138) Res=[rw] ID=[rw] IP=[b.b.b.b] Port=[rd] Length=[rd] Res2=[rw]\nSourceName=[n1]\nDestName=[n1]\n#",
1124 	maxbuf);
1125 
1126     if (data != NULL) {
1127 	/* If there isn't enough data for "\377SMB", don't check for it. */
1128 	if (&data[3] >= maxbuf)
1129 	    goto out;
1130 
1131 	if (memcmp(data, "\377SMB",4) == 0)
1132 	    print_smb(data, maxbuf);
1133     }
1134 out:
1135     printf("\n");
1136     fflush(stdout);
1137 }
1138 
1139 
1140 /*
1141    print netbeui frames
1142 */
1143 void
1144 netbeui_print(u_short control, const u_char *data, int length)
1145 {
1146     const u_char *maxbuf = data + length;
1147     int len;
1148     int command;
1149     const u_char *data2;
1150     int is_truncated = 0;
1151 
1152     if (maxbuf > snapend)
1153 	maxbuf = snapend;
1154     TCHECK(data[4]);
1155     len = EXTRACT_LE_16BITS(data);
1156     command = data[4];
1157     data2 = data + len;
1158     if (data2 >= maxbuf) {
1159 	data2 = maxbuf;
1160 	is_truncated = 1;
1161     }
1162 
1163     startbuf = data;
1164 
1165     if (vflag < 2) {
1166 	printf("NetBeui Packet");
1167 	return;
1168     }
1169 
1170     printf("\n>>> NetBeui Packet\nType=0x%X ", control);
1171     data = smb_fdata(data, "Length=[d] Signature=[w] Command=[B]\n#", maxbuf);
1172     if (data == NULL)
1173 	goto out;
1174 
1175     switch (command) {
1176     case 0xA:
1177 	data = smb_fdata(data, "NameQuery:[P1]\nSessionNumber=[B]\nNameType=[B][P2]\nResponseCorrelator=[w]\nDestination=[n2]\nSource=[n2]\n", data2);
1178 	break;
1179 
1180     case 0x8:
1181 	data = smb_fdata(data,
1182 	    "NetbiosDataGram:[P7]\nDestination=[n2]\nSource=[n2]\n", data2);
1183 	break;
1184 
1185     case 0xE:
1186 	data = smb_fdata(data,
1187 	    "NameRecognise:\n[P1]\nData2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nDestination=[n2]\nSource=[n2]\n",
1188 	    data2);
1189 	break;
1190 
1191     case 0x19:
1192 	data = smb_fdata(data,
1193 	    "SessionInitialise:\nData1=[B]\nData2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n",
1194 	    data2);
1195 	break;
1196 
1197     case 0x17:
1198 	data = smb_fdata(data,
1199 	    "SessionConfirm:\nData1=[B]\nData2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n",
1200 	    data2);
1201 	break;
1202 
1203     case 0x16:
1204 	data = smb_fdata(data,
1205 	    "NetbiosDataOnlyLast:\nFlags=[{|NO_ACK|PIGGYBACK_ACK_ALLOWED|PIGGYBACK_ACK_INCLUDED|}]\nResyncIndicator=[w][P2]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n",
1206 	    data2);
1207 	break;
1208 
1209     case 0x14:
1210 	data = smb_fdata(data,
1211 	    "NetbiosDataAck:\n[P3]TransmitCorrelator=[w][P2]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n",
1212 	    data2);
1213 	break;
1214 
1215     case 0x18:
1216 	data = smb_fdata(data,
1217 	    "SessionEnd:\n[P1]Data2=[w][P4]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n",
1218 	    data2);
1219 	break;
1220 
1221     case 0x1f:
1222 	data = smb_fdata(data, "SessionAlive\n", data2);
1223 	break;
1224 
1225     default:
1226 	data = smb_fdata(data, "Unknown Netbios Command ", data2);
1227 	break;
1228     }
1229     if (data == NULL)
1230 	goto out;
1231 
1232     if (is_truncated) {
1233 	/* data2 was past the end of the buffer */
1234 	goto out;
1235     }
1236 
1237     /* If there isn't enough data for "\377SMB", don't look for it. */
1238     if (&data2[3] >= maxbuf)
1239 	goto out;
1240 
1241     if (memcmp(data2, "\377SMB",4) == 0)
1242 	print_smb(data2, maxbuf);
1243     else {
1244 	int i;
1245 	for (i = 0; i < 128; i++) {
1246 	    if (&data2[i + 3] >= maxbuf)
1247 		break;
1248 	    if (memcmp(&data2[i], "\377SMB", 4) == 0) {
1249 		printf("found SMB packet at %d\n", i);
1250 		print_smb(&data2[i], maxbuf);
1251 		break;
1252 	    }
1253 	}
1254     }
1255 
1256 out:
1257     printf("\n");
1258     return;
1259 trunc:
1260     printf("[|SMB]");
1261     return;
1262 }
1263 
1264 
1265 /*
1266  * print IPX-Netbios frames
1267  */
1268 void
1269 ipx_netbios_print(const u_char *data, u_int length)
1270 {
1271     /*
1272      * this is a hack till I work out how to parse the rest of the
1273      * NetBIOS-over-IPX stuff
1274      */
1275     int i;
1276     const u_char *maxbuf;
1277 
1278     maxbuf = data + length;
1279     /* Don't go past the end of the captured data in the packet. */
1280     if (maxbuf > snapend)
1281 	maxbuf = snapend;
1282     startbuf = data;
1283     for (i = 0; i < 128; i++) {
1284 	if (&data[i + 4] > maxbuf)
1285 	    break;
1286 	if (memcmp(&data[i], "\377SMB", 4) == 0) {
1287 	    smb_fdata(data, "\n>>> IPX transport ", &data[i]);
1288 	    if (data != NULL)
1289 		print_smb(&data[i], maxbuf);
1290 	    printf("\n");
1291 	    fflush(stdout);
1292 	    break;
1293 	}
1294     }
1295     if (i == 128)
1296 	smb_fdata(data, "\n>>> Unknown IPX ", maxbuf);
1297 }
1298