diff options
| -rw-r--r-- | usr.sbin/tcpdump/print-smb.c | 512 | ||||
| -rw-r--r-- | usr.sbin/tcpdump/smbutil.c | 81 |
2 files changed, 211 insertions, 382 deletions
diff --git a/usr.sbin/tcpdump/print-smb.c b/usr.sbin/tcpdump/print-smb.c index be4e611ca16..8afa04b1f12 100644 --- a/usr.sbin/tcpdump/print-smb.c +++ b/usr.sbin/tcpdump/print-smb.c @@ -1,4 +1,4 @@ -/* $OpenBSD: print-smb.c,v 1.1 2000/12/07 22:36:46 mickey Exp $ */ +/* $OpenBSD: print-smb.c,v 1.2 2001/01/03 18:41:00 mickey Exp $ */ /* Copyright (C) Andrew Tridgell 1995-1999 @@ -13,7 +13,7 @@ #ifndef lint static const char rcsid[] = - "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-smb.c,v 1.1 2000/12/07 22:36:46 mickey Exp $"; + "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-smb.c,v 1.2 2001/01/03 18:41:00 mickey Exp $"; #endif #include <stdio.h> @@ -64,16 +64,12 @@ static void trans2_findfirst(uchar *param,uchar *data,int pcnt,int dcnt) char *fmt; if (request) { - fmt = "Attribute=[A]\nSearchCount=[d]\nFlags=[w]\nLevel=[dP5]\nFile=[S]\n"; + fmt = "attr [A] searchcnt [d] flags [w] level [dP5] file [S] "; } else { - fmt = "Handle=[w]\nCount=[d]\nEOS=[w]\nEoffset=[d]\nLastNameOfs=[w]\n"; + fmt = "handle [w] cnt [d] eos [w] eoffset [d] lastnameofs [w] "; } fdata(param,fmt,param+pcnt); - if (dcnt) { - printf("data:\n"); - print_data(data,dcnt); - } } static void trans2_qfsinfo(uchar *param,uchar *data,int pcnt,int dcnt) @@ -83,34 +79,30 @@ static void trans2_qfsinfo(uchar *param,uchar *data,int pcnt,int dcnt) if (request) { level = SVAL(param,0); - fmt = "InfoLevel=[d]\n"; + fmt = "info level [d] "; fdata(param,fmt,param+pcnt); } else { switch (level) { case 1: - fmt = "idFileSystem=[W]\nSectorUnit=[D]\nUnit=[D]\nAvail=[D]\nSectorSize=[d]\n"; + fmt = "fsid [W] sectorunit [D] unit [D] avail [D] sectorsize [d] "; break; case 2: - fmt = "CreationTime=[T2]VolNameLength=[B]\nVolumeLabel=[s12]\n"; + fmt = "creat [T2] volnamelen [B] volume [s12] "; break; case 0x105: - fmt = "Capabilities=[W]\nMaxFileLen=[D]\nVolNameLen=[D]\nVolume=[S]\n"; + fmt = "capabilities [W] maxfilelen [D] volnamelen [D] volume [S] "; break; default: - fmt = "UnknownLevel\n"; + fmt = "unknown level "; } fdata(data,fmt,data+dcnt); } - if (dcnt) { - printf("data:\n"); - print_data(data,dcnt); - } } struct smbfns trans2_fns[] = { {0,"TRANSACT2_OPEN",0, - {"Flags2=[w]\nMode=[w]\nSearchAttrib=[A]\nAttrib=[A]\nTime=[T2]\nOFun=[w]\nSize=[D]\nRes=([w,w,w,w,w])\nPath=[S]",NULL, - "Handle=[d]\nAttrib=[A]\nTime=[T2]\nSize=[D]\nAccess=[w]\nType=[w]\nState=[w]\nAction=[w]\nInode=[W]\nOffErr=[d]\n|EALength=[d]\n",NULL,NULL}}, + {"flags2 [w] mode [w] searchattr [A] attr [A] time [T2] ofun [w] size [D] res [w,w,w,w,w] path [S]",NULL, + "handle [d] attr [A] time [T2] size [D] access [w] type [w] state [w] action [w] inode [W] offerr [d] |ealen [d] ",NULL,NULL}}, {1,"TRANSACT2_FINDFIRST",0, {NULL,NULL,NULL,NULL,trans2_findfirst}}, @@ -153,25 +145,25 @@ static void print_trans2(uchar *words,uchar *dat,uchar *buf,uchar *maxbuf) dcnt = SVAL(words+1,6*2); } - printf("%s param_length=%d data_length=%d\n", + printf("%s paramlen %d datalen %d ", fn->name,pcnt,dcnt); if (request) { if (CVAL(words,0) == 8) { - fdata(words+1,"Trans2Secondary\nTotParam=[d]\nTotData=[d]\nParamCnt=[d]\nParamOff=[d]\nParamDisp=[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nHandle=[d]\n",maxbuf); + fdata(words+1,"trans2secondary totparam [d] totdata [d] paramcnt [d] paramoff [d] paramdisp [d] datacnt [d] dataoff [d] datadisp [d] handle [d] ",maxbuf); return; } else { - fdata(words+1,"TotParam=[d]\nTotData=[d]\nMaxParam=[d]\nMaxData=[d]\nMaxSetup=[d]\nFlags=[w]\nTimeOut=[D]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nDataCnt=[d]\nDataOff=[d]\nSetupCnt=[d]\n",words+1+14*2); - fdata(data+1,"TransactionName=[S]\n%",maxbuf); + fdata(words+1,"totparam [d] totdata [d] maxparam [d] maxdata [d] maxsetup [d] flags [w] timeout [D] res1 [w] paramcnt [d] paramoff [d] datacnt=[d] dataoff [d] setupcnt [d] ",words+1+14*2); + fdata(data+1,"transname [S] %",maxbuf); } f1 = fn->descript.req_f1; f2 = fn->descript.req_f2; } else { if (CVAL(words,0) == 0) { - printf("Trans2Interim\n"); + printf("trans2interim "); return; } else { - fdata(words+1,"TotParam=[d]\nTotData=[d]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nParamDisp[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nSetupCnt=[d]\n",words+1+10*2); + fdata(words+1,"totparam [d] totdata [d] res1 [w] paramcnt [d] paramoff [d] paramdisp [d] datacnt [d] dataoff [d] datadisp [d] setupcnt [d] ",words+1+10*2); } f1 = fn->descript.rep_f1; f2 = fn->descript.rep_f2; @@ -180,8 +172,8 @@ static void print_trans2(uchar *words,uchar *dat,uchar *buf,uchar *maxbuf) if (fn->descript.fn) { fn->descript.fn(param,data,pcnt,dcnt); } else { - fdata(param,f1?f1:(uchar*)"Paramaters=\n",param+pcnt); - fdata(data,f2?f2:(uchar*)"Data=\n",data+dcnt); + fdata(param,f1?f1:(uchar*)"params ",param+pcnt); + fdata(data,f2?f2:(uchar*)"data ",data+dcnt); } } @@ -191,51 +183,51 @@ static void print_browse(uchar *param,int paramlen,const uchar *data,int datalen const uchar *maxbuf = data + datalen; int command = CVAL(data,0); - fdata(param,"BROWSE PACKET\n|Param ",param+paramlen); + fdata(param,"browse |param ",param+paramlen); switch (command) { case 0xF: - data = fdata(data,"BROWSE PACKET:\nType=[B] (LocalMasterAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nElectionVersion=[w]\nBrowserConstant=[w]\n",maxbuf); + data = fdata(data,"browse [B] (LocalMasterAnnouncement) updatecnt [w] res1 [B] announceintv [d] name [n2] version [B].[B] servertype [W] electionversion [w] browserconst [w] ",maxbuf); break; case 0x1: - data = fdata(data,"BROWSE PACKET:\nType=[B] (HostAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nElectionVersion=[w]\nBrowserConstant=[w]\n",maxbuf); + data = fdata(data,"browse [B] (HostAnnouncement) updatecnt [w] res1 [B] announceintv [d] name [n2] version [B].[B] servertype [W] electionversion [w] browserconst [w] ",maxbuf); break; case 0x2: - data = fdata(data,"BROWSE PACKET:\nType=[B] (AnnouncementRequest)\nFlags=[B]\nReplySystemName=[S]\n",maxbuf); + data = fdata(data,"browse [B] (AnnouncementRequest) flags [B] replysysname [S] ",maxbuf); break; case 0xc: - data = fdata(data,"BROWSE PACKET:\nType=[B] (WorkgroupAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nCommentPointer=[W]\nServerName=[S]\n",maxbuf); + data = fdata(data,"browse [B] (WorkgroupAnnouncement) updatecnt [w] res1 [B] announceintv [d] name [n2] version [B].[B] servertype [W] commentptr [W] servername [S] ",maxbuf); break; case 0x8: - data = fdata(data,"BROWSE PACKET:\nType=[B] (ElectionFrame)\nElectionVersion=[B]\nOSSummary=[W]\nUptime=[(W,W)]\nServerName=[S]\n",maxbuf); + data = fdata(data,"browse [B] (ElectionFrame) electionversion [B] ossummary [W] uptime [(W,W)] servername [S] ",maxbuf); break; case 0xb: - data = fdata(data,"BROWSE PACKET:\nType=[B] (BecomeBackupBrowser)\nName=[S]\n",maxbuf); + data = fdata(data,"browse [B] (BecomeBackupBrowser) name [S] ",maxbuf); break; case 0x9: - data = fdata(data,"BROWSE PACKET:\nType=[B] (GetBackupList)\nListCount?=[B]\nToken?=[B]\n",maxbuf); + data = fdata(data,"browse [B] (GetBackupList) listcnt? [B] token? [B] ",maxbuf); break; case 0xa: - data = fdata(data,"BROWSE PACKET:\nType=[B] (BackupListResponse)\nServerCount?=[B]\nToken?=[B]*Name=[S]\n",maxbuf); + data = fdata(data,"browse [B] (BackupListResponse) servercnt? [B] token? [B] *name [S] ",maxbuf); break; case 0xd: - data = fdata(data,"BROWSE PACKET:\nType=[B] (MasterAnnouncement)\nMasterName=[S]\n",maxbuf); + data = fdata(data,"browse [B] (MasterAnnouncement) master-name [S] ",maxbuf); break; case 0xe: - data = fdata(data,"BROWSE PACKET:\nType=[B] (ResetBrowser)\nOptions=[B]\n",maxbuf); + data = fdata(data,"browse [B] (ResetBrowser) options [B] ",maxbuf); break; default: - data = fdata(data,"Unknown Browser Frame ",maxbuf); + data = fdata(data,"browse unknown-frame",maxbuf); break; } } @@ -244,7 +236,7 @@ static void print_browse(uchar *param,int paramlen,const uchar *data,int datalen static void print_ipc(uchar *param,int paramlen,uchar *data,int datalen) { if (paramlen) - fdata(param,"Command=[w]\nStr1=[S]\nStr2=[S]\n",param+paramlen); + fdata(param,"cmd [w] str1 [S] str2 [S] ",param+paramlen); if (datalen) fdata(data,"IPC ",data+datalen); } @@ -261,19 +253,19 @@ static void print_trans(uchar *words,uchar *data1,uchar *buf,uchar *maxbuf) param = buf + SVAL(words+1,10*2); datalen = SVAL(words+1,11*2); data = buf + SVAL(words+1,12*2); - f1 = "TotParamCnt=[d] \nTotDataCnt=[d] \nMaxParmCnt=[d] \nMaxDataCnt=[d]\nMaxSCnt=[d] \nTransFlags=[w] \nRes1=[w] \nRes2=[w] \nRes3=[w]\nParamCnt=[d] \nParamOff=[d] \nDataCnt=[d] \nDataOff=[d] \nSUCnt=[d]\n"; - f2 = "|Name=[S]\n"; - f3 = "|Param "; - f4 = "|Data "; + f1 = " totparamcnt [d] totdatacnt [d] maxparmcnt [d] maxdatacnt [d] maxscnt [d] transflags [w] res [w] [w] [w] paramcnt [d] paramoff [d] datacnt [d] dataoff [d] sucnt [d] "; + f2 = "|[S] "; + f3 = "|param "; + f4 = "|data "; } else { paramlen = SVAL(words+1,3*2); param = buf + SVAL(words+1,4*2); datalen = SVAL(words+1,6*2); data = buf + SVAL(words+1,7*2); - f1 = "TotParamCnt=[d] \nTotDataCnt=[d] \nRes1=[d]\nParamCnt=[d] \nParamOff=[d] \nRes2=[d] \nDataCnt=[d] \nDataOff=[d] \nRes3=[d]\nLsetup=[d]\n"; - f2 = "|Unknown "; - f3 = "|Param "; - f4 = "|Data "; + f1 = "totparamcnt [d] totdatacnt [d] res1 [d] paramcnt [d] paramoff [d] res2 [d] datacnt [d] dataoff [d] res3 [d] Lsetup [d] "; + f2 = "|unk "; + f3 = "|param "; + f4 = "|data "; } fdata(words+1,f1,MIN(words+1+2*CVAL(words,0),maxbuf)); @@ -300,27 +292,22 @@ static void print_negprot(uchar *words,uchar *data,uchar *buf,uchar *maxbuf) uchar *f1=NULL,*f2=NULL; if (request) { - f2 = "*|Dialect=[Z]\n"; + f2 = "*|dialect [Z] "; } else { if (CVAL(words,0) == 1) { - f1 = "Core Protocol\nDialectIndex=[d]"; + f1 = "core-proto dialect index [d]"; } else if (CVAL(words,0) == 17) { - f1 = "NT1 Protocol\nDialectIndex=[d]\nSecMode=[B]\nMaxMux=[d]\nNumVcs=[d]\nMaxBuffer=[D]\nRawSize=[D]\nSessionKey=[W]\nCapabilities=[W]\nServerTime=[T3]TimeZone=[d]\nCryptKey="; + f1 = "NT1-proto dialect index [d] secmode [B] maxmux [d] numvcs [d] maxbuf [D] rawsize [D] sesskey [W] capabilities [W] servertime [T3] tz [d] cryptkey "; } else if (CVAL(words,0) == 13) { - f1 = "Coreplus/Lanman1/Lanman2 Protocol\nDialectIndex=[d]\nSecMode=[w]\nMaxXMit=[d]\nMaxMux=[d]\nMaxVcs=[d]\nBlkMode=[w]\nSessionKey=[W]\nServerTime=[T1]TimeZone=[d]\nRes=[W]\nCryptKey="; + f1 = "coreplus/lanman1/lanman2-proto dialect index [d] secmode [w] maxxmit [d] maxmux [d] maxvcs [d] blkmode [w] sesskey [W] servertime [T1] tz [d] res [W] cryptkey "; } } if (f1) fdata(words+1,f1,MIN(words + 1 + CVAL(words,0)*2,maxbuf)); - else - print_data(words+1,MIN(CVAL(words,0)*2,PTR_DIFF(maxbuf,words+1))); if (f2) fdata(data+2,f2,MIN(data + 2 + SVAL(data,0),maxbuf)); - else - print_data(data+2,MIN(SVAL(data,0),PTR_DIFF(maxbuf,data+2))); - } static void print_sesssetup(uchar *words,uchar *data,uchar *buf,uchar *maxbuf) @@ -330,28 +317,24 @@ static void print_sesssetup(uchar *words,uchar *data,uchar *buf,uchar *maxbuf) if (request) { if (wcnt==10) { - f1 = "Com2=[w]\nOff2=[d]\nBufSize=[d]\nMpxMax=[d]\nVcNum=[d]\nSessionKey=[W]\nPassLen=[d]\nCryptLen=[d]\nCryptOff=[d]\nPass&Name=\n"; + f1 = "com2 [w] off2 [d] bufsize [d] maxmpx [d] vcnum [d] sesskey [W] passlen [d] cryptlen [d] cryptoff [d] pass&name "; } else { - f1 = "Com2=[B]\nRes1=[B]\nOff2=[d]\nMaxBuffer=[d]\nMaxMpx=[d]\nVcNumber=[d]\nSessionKey=[W]\nCaseInsensitivePasswordLength=[d]\nCaseSensitivePasswordLength=[d]\nRes=[W]\nCapabilities=[W]\nPass1&Pass2&Account&Domain&OS&LanMan=\n"; + f1 = "com2 [B] res1 [B] off2 [d] maxbuf [d] maxmpx [d] vcnum [d] sesskey [W] case-insensitive-passlen [d] case-sensitive-passlen [d] res [W] capabilities [W] pass1&pass2&account&domain&os&lanman "; } } else { if (CVAL(words,0) == 3) { - f1 = "Com2=[w]\nOff2=[d]\nAction=[w]\n"; + f1 = "com2 [w] off2 [d] action [w] "; } else if (CVAL(words,0) == 13) { - f1 = "Com2=[B]\nRes=[B]\nOff2=[d]\nAction=[w]\n"; - f2 = "NativeOS=[S]\nNativeLanMan=[S]\nPrimaryDomain=[S]\n"; + f1 = "com2 [B] res [B] off2 [d] action [w] "; + f2 = "native-os [S] nativelanman [S] primarydomain [S] "; } } if (f1) fdata(words+1,f1,MIN(words + 1 + CVAL(words,0)*2,maxbuf)); - else - print_data(words+1,MIN(CVAL(words,0)*2,PTR_DIFF(maxbuf,words+1))); if (f2) fdata(data+2,f2,MIN(data + 2 + SVAL(data,0),maxbuf)); - else - print_data(data+2,MIN(SVAL(data,0),PTR_DIFF(maxbuf,data+2))); } @@ -360,9 +343,7 @@ static struct smbfns smb_fns[] = {-1,"SMBunknown",0,DEFDESCRIPT}, {SMBtcon,"SMBtcon",0, - {NULL,"Path=[Z]\nPassword=[Z]\nDevice=[Z]\n", - "MaxXmit=[d]\nTreeId=[d]\n",NULL, - NULL}}, + {NULL,"path [Z] pass [Z] dev [Z] ", "xmitmax [d] treeid [d] ",NULL, NULL}}, {SMBtdis,"SMBtdis",0,DEFDESCRIPT}, @@ -370,225 +351,132 @@ static struct smbfns smb_fns[] = {SMBioctl,"SMBioctl",0,DEFDESCRIPT}, {SMBecho,"SMBecho",0, - {"ReverbCount=[d]\n",NULL, - "SequenceNum=[d]\n",NULL, - NULL}}, + {"reverbcount [d] ",NULL, "seqnum [d] ",NULL, NULL}}, {SMBulogoffX, "SMBulogoffX",FLG_CHAIN,DEFDESCRIPT}, -{SMBgetatr,"SMBgetatr",0, - {NULL,"Path=[Z]\n", - "Attribute=[A]\nTime=[T2]Size=[D]\nRes=([w,w,w,w,w])\n",NULL, - NULL}}, +{SMBgetatr,"SMBgetatr",0, {NULL,"path [Z] ", + "attr [A] time [T2] size [D] res ([w,w,w,w,w]) ",NULL, NULL}}, {SMBsetatr,"SMBsetatr",0, - {"Attribute=[A]\nTime=[T2]Res=([w,w,w,w,w])\n","Path=[Z]\n", - NULL,NULL,NULL}}, + {"attr [A] time [T2] res ([w,w,w,w,w]) ","path [Z] ", NULL,NULL,NULL}}, -{SMBchkpth,"SMBchkpth",0, - {NULL,"Path=[Z]\n",NULL,NULL,NULL}}, +{SMBchkpth,"SMBchkpth",0, {NULL,"path [Z] ",NULL,NULL,NULL}}, {SMBsearch,"SMBsearch",0, -{"Count=[d]\nAttrib=[A]\n","Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\n", -"Count=[d]\n","BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",NULL}}, - +{"cnt [d] attr [A] ","path [Z] blktype [B] blklen [d] |res1 [B] mask [s11] srv1 [B] dirindex [d] srv2 [w] res2 [W] ", +"cnt [d] ","blktype [B] blklen [d] * res1 [B] mask [s11] srv1 [B] dirindex [d] srv2 [w] res2 [W] attr [a] time [T1] size [D] name [s13] ",NULL}}, -{SMBopen,"SMBopen",0, - {"Mode=[w]\nAttribute=[A]\n","Path=[Z]\n", - "Handle=[d]\nOAttrib=[A]\nTime=[T2]Size=[D]\nAccess=[w]\n",NULL, - NULL}}, +{SMBopen,"SMBopen",0, {"mode [w] attr [A] ","path [Z] ", "handle [d] oattr [A] time [T2] size [D] access [w] ",NULL, NULL}}, -{SMBcreate,"SMBcreate",0, - {"Attrib=[A]\nTime=[T2]","Path=[Z]\n", - "Handle=[d]\n",NULL, - NULL}}, +{SMBcreate,"SMBcreate",0, {"attr [A] time [T2]","path [Z] ", "handle [d]",NULL, NULL}}, -{SMBmknew,"SMBmknew",0, - {"Attrib=[A]\nTime=[T2]","Path=[Z]\n", - "Handle=[d]\n",NULL, - NULL}}, +{SMBmknew,"SMBmknew",0, {"attr [A] time [T2]","path [Z] ", "handle [d] ",NULL, NULL}}, -{SMBunlink,"SMBunlink",0, - {"Attrib=[A]\n","Path=[Z]\n",NULL,NULL,NULL}}, +{SMBunlink,"SMBunlink",0, {"attr [A] ","path [Z] ",NULL,NULL,NULL}}, -{SMBread,"SMBread",0, - {"Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n",NULL, - "Count=[d]\nRes=([w,w,w,w])\n",NULL,NULL}}, +{SMBread,"SMBread",0, {"handle [d] bytecnt [d] offset [D] cntleft [d] ",NULL, "cnt [d] res ([w,w,w,w]) ",NULL,NULL}}, -{SMBwrite,"SMBwrite",0, - {"Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n",NULL, - "Count=[d]\n",NULL,NULL}}, +{SMBwrite,"SMBwrite",0, {"handle [d] bytecnt [d] offset [D] cntleft [d] ",NULL, "cnt [d] ",NULL,NULL}}, -{SMBclose,"SMBclose",0, - {"Handle=[d]\nTime=[T2]",NULL,NULL,NULL,NULL}}, +{SMBclose,"SMBclose",0, {"handle [d] time [T2]",NULL,NULL,NULL,NULL}}, -{SMBmkdir,"SMBmkdir",0, - {NULL,"Path=[Z]\n",NULL,NULL,NULL}}, +{SMBmkdir,"SMBmkdir",0, {NULL,"path [Z] ",NULL,NULL,NULL}}, -{SMBrmdir,"SMBrmdir",0, - {NULL,"Path=[Z]\n",NULL,NULL,NULL}}, +{SMBrmdir,"SMBrmdir",0, {NULL,"path [Z] ",NULL,NULL,NULL}}, -{SMBdskattr,"SMBdskattr",0, -{NULL,NULL, -"TotalUnits=[d]\nBlocksPerUnit=[d]\nBlockSize=[d]\nFreeUnits=[d]\nMedia=[w]\n", -NULL,NULL}}, +{SMBdskattr,"SMBdskattr",0, {NULL,NULL, "totalunits [d] blks/unit [d] blksize [d] freeunits [d] media [w] ", NULL,NULL}}, -{SMBmv,"SMBmv",0, - {"Attrib=[A]\n","OldPath=[Z]\nNewPath=[Z]\n",NULL,NULL,NULL}}, +{SMBmv,"SMBmv",0, {"attr [A] ","oldpath [Z] newpath [Z] ",NULL,NULL,NULL}}, /* this is a Pathworks specific call, allowing the changing of the root path */ -{pSETDIR,"SMBsetdir",0, - {NULL,"Path=[Z]\n",NULL,NULL,NULL}}, +{pSETDIR,"SMBsetdir",0, {NULL,"path [Z] ",NULL,NULL,NULL}}, -{SMBlseek,"SMBlseek",0, - {"Handle=[d]\nMode=[w]\nOffset=[D]\n","Offset=[D]\n",NULL,NULL}}, +{SMBlseek,"SMBlseek",0, {"handle [d] mode [w] offset [D] ","offset [D] ",NULL,NULL}}, -{SMBflush,"SMBflush",0, - {"Handle=[d]\n",NULL,NULL,NULL,NULL}}, +{SMBflush,"SMBflush",0, {"handle [d] ",NULL,NULL,NULL,NULL}}, -{SMBsplopen,"SMBsplopen",0, - {"SetupLen=[d]\nMode=[w]\n","Ident=[Z]\n","Handle=[d]\n",NULL,NULL}}, +{SMBsplopen,"SMBsplopen",0, {"setuplen [d] mode [w] ","ident [Z] ","handle [d] ",NULL,NULL}}, -{SMBsplclose,"SMBsplclose",0, - {"Handle=[d]\n",NULL,NULL,NULL,NULL}}, +{SMBsplclose,"SMBsplclose",0, {"handle [d] ",NULL,NULL,NULL,NULL}}, -{SMBsplretq,"SMBsplretq",0, - {"MaxCount=[d]\nStartIndex=[d]\n",NULL, - "Count=[d]\nIndex=[d]\n", - "*Time=[T2]Status=[B]\nJobID=[d]\nSize=[D]\nRes=[B]Name=[s16]\n", - NULL}}, +{SMBsplretq,"SMBsplretq",0, {"maxcnt [d] startindex [d] ",NULL, "cnt [d] index [d] ", "*time [T2] status [B] jobid [d] size [D] res [B] name [s16] ", NULL}}, -{SMBsplwr,"SMBsplwr",0, - {"Handle=[d]\n",NULL,NULL,NULL,NULL}}, +{SMBsplwr,"SMBsplwr",0, {"handle [d] ",NULL,NULL,NULL,NULL}}, -{SMBlock,"SMBlock",0, - {"Handle=[d]\nCount=[D]\nOffset=[D]\n",NULL,NULL,NULL,NULL}}, +{SMBlock,"SMBlock",0, {"handle [d] count [D] offset [D] ",NULL,NULL,NULL,NULL}}, -{SMBunlock,"SMBunlock",0, - {"Handle=[d]\nCount=[D]\nOffset=[D]\n",NULL,NULL,NULL,NULL}}, +{SMBunlock,"SMBunlock",0, {"handle [d] count [D] offset [D] ",NULL,NULL,NULL,NULL}}, /* CORE+ PROTOCOL FOLLOWS */ -{SMBreadbraw,"SMBreadbraw",0, -{"Handle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nRes=[d]\n", - NULL,NULL,NULL,NULL}}, +{SMBreadbraw,"SMBreadbraw",0, {"handle [d] offset [D] maxcnt [d] mincnt [d] timeout [D] res [d] ", NULL,NULL,NULL,NULL}}, -{SMBwritebraw,"SMBwritebraw",0, -{"Handle=[d]\nTotalCount=[d]\nRes=[w]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nRes2=[W]\n|DataSize=[d]\nDataOff=[d]\n", -NULL,"WriteRawAck",NULL,NULL}}, +{SMBwritebraw,"SMBwritebraw",0, {"handle [d] totalcnt [d] res [w] offset [D] timeout [D] wmode [w] res2 [W] |datasize [d] dataoff [d] ", NULL,"write-raw-ack",NULL,NULL}}, -{SMBwritec,"SMBwritec",0, - {NULL,NULL,"Count=[d]\n",NULL,NULL}}, +{SMBwritec,"SMBwritec",0, {NULL,NULL,"count [d] ",NULL,NULL}}, -{SMBwriteclose,"SMBwriteclose",0, - {"Handle=[d]\nCount=[d]\nOffset=[D]\nTime=[T2]Res=([w,w,w,w,w,w])",NULL, - "Count=[d]\n",NULL,NULL}}, +{SMBwriteclose,"SMBwriteclose",0, {"handle [d] count [d] offset [D] time [T2] res ([w,w,w,w,w,w])",NULL, "count [d] ",NULL,NULL}}, -{SMBlockread,"SMBlockread",0, - {"Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n",NULL, - "Count=[d]\nRes=([w,w,w,w])\n",NULL,NULL}}, +{SMBlockread,"SMBlockread",0, {"handle [d] bytecnt [d] offset [D] cntleft [d] ",NULL, "count [d] res ([w,w,w,w]) ",NULL,NULL}}, -{SMBwriteunlock,"SMBwriteunlock",0, - {"Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n",NULL, - "Count=[d]\n",NULL,NULL}}, +{SMBwriteunlock,"SMBwriteunlock",0, {"handle [d] bytecnt [d] offset [D] cntleft [d] ",NULL, "count [d] ",NULL,NULL}}, -{SMBreadBmpx,"SMBreadBmpx",0, -{"Handle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nRes=[w]\n", -NULL, -"Offset=[D]\nTotCount=[d]\nRemaining=[d]\nRes=([w,w])\nDataSize=[d]\nDataOff=[d]\n", -NULL,NULL}}, +{SMBreadBmpx,"SMBreadBmpx",0, {"handle [d] offset [D] maxcnt [d] mincnt [d] timeout [D] res [w] ", NULL, "offset [D] totcnt [d] remain [d] res ([w,w]) datasize [d] dataoff [d] ", NULL,NULL}}, -{SMBwriteBmpx,"SMBwriteBmpx",0, -{"Handle=[d]\nTotCount=[d]\nRes=[w]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nRes2=[W]\nDataSize=[d]\nDataOff=[d]\n",NULL, -"Remaining=[d]\n",NULL,NULL}}, +{SMBwriteBmpx,"SMBwriteBmpx",0, {"handle [d] totcnt [d] res [w] offset [D] timeout [D] wmode [w] res2 [W] datasize [d] dataoff [d] ",NULL, "remain [d] ",NULL,NULL}}, -{SMBwriteBs,"SMBwriteBs",0, - {"Handle=[d]\nTotCount=[d]\nOffset=[D]\nRes=[W]\nDataSize=[d]\nDataOff=[d]\n",NULL, - "Count=[d]\n",NULL,NULL}}, +{SMBwriteBs,"SMBwriteBs",0, {"handle [d] totcnt [d] offset [D] res [W] datasize [d] dataoff [d] ",NULL, "count [d] ",NULL,NULL}}, -{SMBsetattrE,"SMBsetattrE",0, - {"Handle=[d]\nCreationTime=[T2]AccessTime=[T2]ModifyTime=[T2]",NULL, - NULL,NULL,NULL}}, +{SMBsetattrE,"SMBsetattrE",0, {"handle [d] ctime [T2] atime [T2] mtime [T2]",NULL, NULL,NULL,NULL}}, -{SMBgetattrE,"SMBgetattrE",0, -{"Handle=[d]\n",NULL, - "CreationTime=[T2]AccessTime=[T2]ModifyTime=[T2]Size=[D]\nAllocSize=[D]\nAttribute=[A]\n",NULL,NULL}}, +{SMBgetattrE,"SMBgetattrE",0, {"handle [d] ",NULL, "ctime [T2] atime [T2] mtime [T2] size [D] allocsize [D] attr [A] ",NULL,NULL}}, {SMBtranss,"SMBtranss",0,DEFDESCRIPT}, {SMBioctls,"SMBioctls",0,DEFDESCRIPT}, -{SMBcopy,"SMBcopy",0, - {"TreeID2=[d]\nOFun=[w]\nFlags=[w]\n","Path=[S]\nNewPath=[S]\n", - "CopyCount=[d]\n","|ErrStr=[S]\n",NULL}}, +{SMBcopy,"SMBcopy",0, {"treeid2 [d] ofun [w] flags [w] ","path [S] newpath [S] ", "copycnt [d] ","|errstr [S] ",NULL}}, -{SMBmove,"SMBmove",0, - {"TreeID2=[d]\nOFun=[w]\nFlags=[w]\n","Path=[S]\nNewPath=[S]\n", - "MoveCount=[d]\n","|ErrStr=[S]\n",NULL}}, +{SMBmove,"SMBmove",0, {"treeid2 [d] ofun [w] flags [w] ","path [S] newpath [S] ", "movecnt [d] ","|errstr [S] ",NULL}}, -{SMBopenX,"SMBopenX",FLG_CHAIN, -{"Com2=[w]\nOff2=[d]\nFlags=[w]\nMode=[w]\nSearchAttrib=[A]\nAttrib=[A]\nTime=[T2]OFun=[w]\nSize=[D]\nTimeOut=[D]\nRes=[W]\n","Path=[S]\n", -"Com2=[w]\nOff2=[d]\nHandle=[d]\nAttrib=[A]\nTime=[T2]Size=[D]\nAccess=[w]\nType=[w]\nState=[w]\nAction=[w]\nFileID=[W]\nRes=[w]\n",NULL,NULL}}, +{SMBopenX,"SMBopenX",FLG_CHAIN, {"com2 [w] off2 [d] flags [w] mode [w] searchattr [A] attr [A] time [T2] ofun [w] size [D] timeout [D] res [W] ","path [S] ", "com2 [w] off2 [d] handle [d] attr [A] time [T2] size [D] access [w] type [w] state [w] action [w] fileid [W] res [w] ",NULL,NULL}}, -{SMBreadX,"SMBreadX",FLG_CHAIN, -{"Com2=[w]\nOff2=[d]\nHandle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nCountLeft=[d]\n",NULL, -"Com2=[w]\nOff2=[d]\nRemaining=[d]\nRes=[W]\nDataSize=[d]\nDataOff=[d]\nRes=([w,w,w,w])\n",NULL,NULL}}, +{SMBreadX,"SMBreadX",FLG_CHAIN, {"com2 [w] off2 [d] handle [d] offset [D] maxcnt [d] mincnt [d] timeout [D] cntleft [d] ",NULL, "com2 [w] off2 [d] remain [d] res [W] datasize [d] dataoff [d] res ([w,w,w,w]) ",NULL,NULL}}, -{SMBwriteX,"SMBwriteX",FLG_CHAIN, -{"Com2=[w]\nOff2=[d]\nHandle=[d]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nCountLeft=[d]\nRes=[w]\nDataSize=[d]\nDataOff=[d]\n",NULL, -"Com2=[w]\nOff2=[d]\nCount=[d]\nRemaining=[d]\nRes=[W]\n",NULL,NULL}}, +{SMBwriteX,"SMBwriteX",FLG_CHAIN, {"com2 [w] off2 [d] handle [d] offset [D] timeout [D] wmode [w] cntleft [d] res [w] datasize [d] dataoff [d] ",NULL, "com2 [w] off2 [d] count [d] remain [d] res [W] ",NULL,NULL}}, -{SMBlockingX,"SMBlockingX",FLG_CHAIN, -{"Com2=[w]\nOff2=[d]\nHandle=[d]\nLockType=[w]\nTimeOut=[D]\nUnlockCount=[d]\nLockCount=[d]\n", -"*Process=[d]\nOffset=[D]\nLength=[D]\n", -"Com2=[w]\nOff2=[d]\n"}}, +{SMBlockingX,"SMBlockingX",FLG_CHAIN, {"com2 [w] off2 [d] handle [d] locktype [w] timeout [D] unlockcnt [d] lockcnt [d] ", "*process [d] offset [D] len [D] ", "com2 [w] off2 [d] "}}, -{SMBffirst,"SMBffirst",0, -{"Count=[d]\nAttrib=[A]\n","Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n", -"Count=[d]\n","BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",NULL}}, +{SMBffirst,"SMBffirst",0, {"count [d] attr [A] ","path [Z] blktype [B] blklen [d] |res1 [B] mask [s11] srv2 [B] dirindex [d] srv2 [w] ", "count [d] ","blktype [B] blklen [d] * res1 [B] mask [s11] srv1 [B] dirindex [d] srv2 [w] res2 [W] attr [a] time [T1] size [D] name [s13] ",NULL}}, -{SMBfunique,"SMBfunique",0, -{"Count=[d]\nAttrib=[A]\n","Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n", -"Count=[d]\n","BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",NULL}}, +{SMBfunique,"SMBfunique",0, {"count [d] attr [A] ","path [Z] blktype [B] blklen [d] |res1 [B] mask [s11] srv1 [B] dirindex [d] srv2 [w] ", "count [d] ","blktype [B] blklen [d] * res1 [B] mask [s11] srv1 [B] dirindex [d] srv2 [w] res2 [W] attr [a] time [T1] size [D] name [s13] ",NULL}}, -{SMBfclose,"SMBfclose",0, -{"Count=[d]\nAttrib=[A]\n","Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n", -"Count=[d]\n","BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",NULL}}, +{SMBfclose,"SMBfclose",0, {"count [d] attr [A] ","path [Z] blktype [B] blklen [d] |res1 [B] mask [s11] srv1 [B] dirindex [d] srv2 [w] ", "count [d] ","blktype [B] blklen [d] * res1 [B] mask [s11] srv1 [B] dirindex [d] srv2 [w] res2 [W] attr [a] time [T1] size [D] name [s13] ",NULL}}, -{SMBfindnclose, "SMBfindnclose", 0, - {"Handle=[d]\n",NULL,NULL,NULL,NULL}}, +{SMBfindnclose, "SMBfindnclose", 0, {"handle [d] ",NULL,NULL,NULL,NULL}}, -{SMBfindclose, "SMBfindclose", 0, - {"Handle=[d]\n",NULL,NULL,NULL,NULL}}, +{SMBfindclose, "SMBfindclose", 0, {"handle [d] ",NULL,NULL,NULL,NULL}}, -{SMBsends,"SMBsends",0, - {NULL,"Source=[Z]\nDest=[Z]\n",NULL,NULL,NULL}}, +{SMBsends,"SMBsends",0, {NULL,"src [Z] dst [Z] ",NULL,NULL,NULL}}, -{SMBsendstrt,"SMBsendstrt",0, - {NULL,"Source=[Z]\nDest=[Z]\n","GroupID=[d]\n",NULL,NULL}}, +{SMBsendstrt,"SMBsendstrt",0, {NULL,"src [Z] dst [Z] ","groupid [d] ",NULL,NULL}}, -{SMBsendend,"SMBsendend",0, - {"GroupID=[d]\n",NULL,NULL,NULL,NULL}}, +{SMBsendend,"SMBsendend",0, {"groupid [d] ",NULL,NULL,NULL,NULL}}, -{SMBsendtxt,"SMBsendtxt",0, - {"GroupID=[d]\n",NULL,NULL,NULL,NULL}}, +{SMBsendtxt,"SMBsendtxt",0, {"groupid [d] ",NULL,NULL,NULL,NULL}}, -{SMBsendb,"SMBsendb",0, - {NULL,"Source=[Z]\nDest=[Z]\n",NULL,NULL,NULL}}, +{SMBsendb,"SMBsendb",0, {NULL,"src [Z] dst [Z] ",NULL,NULL,NULL}}, {SMBfwdname,"SMBfwdname",0,DEFDESCRIPT}, {SMBcancelf,"SMBcancelf",0,DEFDESCRIPT}, {SMBgetmac,"SMBgetmac",0,DEFDESCRIPT}, -{SMBnegprot,"SMBnegprot",0, - {NULL,NULL,NULL,NULL,print_negprot}}, +{SMBnegprot,"SMBnegprot",0, {NULL,NULL,NULL,NULL,print_negprot}}, -{SMBsesssetupX,"SMBsesssetupX",FLG_CHAIN, - {NULL,NULL,NULL,NULL,print_sesssetup}}, +{SMBsesssetupX,"SMBsesssetupX",FLG_CHAIN,{NULL,NULL,NULL,NULL,print_sesssetup}}, -{SMBtconX,"SMBtconX",FLG_CHAIN, -{"Com2=[w]\nOff2=[d]\nFlags=[w]\nPassLen=[d]\nPasswd&Path&Device=\n",NULL, - "Com2=[w]\nOff2=[d]\n","ServiceType=[S]\n",NULL}}, +{SMBtconX,"SMBtconX",FLG_CHAIN, {"com2 [w] off2 [d] flags [w] passlen [d] passwd&path&dev ",NULL, "com2 [w] off2 [d] ","servicetype [S] ",NULL}}, {SMBtrans2, "SMBtrans2",0,{NULL,NULL,NULL,NULL,print_trans2}}, @@ -600,9 +488,7 @@ NULL,NULL}}, {SMBnttrans,"SMBnttrans", 0, DEFDESCRIPT}, {SMBnttranss,"SMBnttranss", 0, DEFDESCRIPT}, -{SMBntcreateX,"SMBntcreateX", FLG_CHAIN, -{"Com2=[w]\nOff2=[d]\nRes=[b]\nNameLen=[d]\nFlags=[W]\nRootDirectoryFid=[D]\nAccessMask=[W]\nAllocationSize=[L]\nExtFileAttributes=[W]\nShareAccess=[W]\nCreateDisposition=[W]\nCreateOptions=[W]\nImpersonationLevel=[W]\nSecurityFlags=[b]\n","Path=[S]\n", - "Com2=[w]\nOff2=[d]\nOplockLevel=[b]\nFid=[d]\nCreateAction=[W]\nCreateTime=[T3]LastAccessTime=[T3]LastWriteTime=[T3]ChangeTime=[T3]ExtFileAttributes=[W]\nAllocationSize=[L]\nEndOfFile=[L]\nFileType=[w]\nDeviceState=[w]\nDirectory=[b]\n", NULL}}, +{SMBntcreateX,"SMBntcreateX", FLG_CHAIN, {"com2 [w] off2 [d] res [b] namelen [d] flags [W] rootdirfid [D] accessmask [W] allocsize [L] extfileattr [W] shareaccess [W] createdisposition [W] createopts [W] impersonallevel [W] securityflags [b] ","path [S] ", "com2 [w] off2 [d] oplocklvl [b] fid [d] createaction [W] createtime [T3] lastaccesstime [T3] lastwritetime [T3] ctime [T3]extfileattr [W] allocsize [L] eof [L] filetype [w] devstate [w] dir [b] ", NULL}}, {SMBntcancel,"SMBntcancel", 0, DEFDESCRIPT}, @@ -618,7 +504,7 @@ static void print_smb(const uchar *buf, const uchar *maxbuf) const uchar *words, *data; struct smbfns *fn; char *fmt_smbheader = -"[P4]SMB Command = [B]\nError class = [BP1]\nError code = [d]\nFlags1 = [B]\nFlags2 = [B][P13]\nTree ID = [d]\nProc ID = [d]\nUID = [d]\nMID = [d]\nWord Count = [b]\n"; +"[P4] cmd [B] error [BP1]/[d] flags [B] [B][P13] treeid [d] procid [d] uid [d] mid [d] wordcnt [b] "; request = (CVAL(buf,9)&0x80)?0:1; @@ -626,7 +512,7 @@ static void print_smb(const uchar *buf, const uchar *maxbuf) fn = smbfind(command,smb_fns); - printf("\nSMB PACKET: %s (%s)\n",fn->name,request?"REQUEST":"REPLY"); + printf("%s-%s",fn->name,request?"request":"reply"); if (vflag == 0) return; @@ -636,7 +522,7 @@ static void print_smb(const uchar *buf, const uchar *maxbuf) if (CVAL(buf,5)) { int class = CVAL(buf,5); int num = SVAL(buf,7); - printf("SMBError = %s\n",smb_errstr(class,num)); + printf("SMBError %s ",smb_errstr(class,num)); } words = buf+32; @@ -660,28 +546,24 @@ static void print_smb(const uchar *buf, const uchar *maxbuf) fn->descript.fn(words,data,buf,maxbuf); } else { if (f1) { - printf("smbvwv[]=\n"); + printf("smbvwv[]="); fdata(words+1,f1,words + 1 + wct*2); } else if (wct) { int i; int v; - printf("smbvwv[]=\n"); + printf("smbvwv[]="); for (i=0;i<wct;i++) { v = SVAL(words+1,2*i); - printf("smb_vwv[%d]=%d (0x%X)\n",i,v,v); + printf("smb_vwv[%d]=%d (0x%X) ",i,v,v); } } if (f2) { - printf("smbbuf[]=\n"); + printf("smbbuf[]="); fdata(data+2,f2,maxbuf); } else { int bcc = SVAL(data,0); - printf("smb_bcc=%d\n",bcc); - if (bcc>0) { - printf("smb_buf[]=\n"); - print_data(data + 2, MIN(bcc,PTR_DIFF(maxbuf,data+2))); - } + printf("smb_bcc=%d",bcc); } } @@ -692,13 +574,11 @@ static void print_smb(const uchar *buf, const uchar *maxbuf) fn = smbfind(command,smb_fns); - printf("\nSMB PACKET: %s (%s) (CHAINED)\n",fn->name,request?"REQUEST":"REPLY"); + printf("chained-%s-%s ",fn->name,request?"request":"reply"); } else { words = data = NULL; } } - - printf("\n"); } @@ -714,66 +594,64 @@ void nbt_tcp_print(const uchar *data,int length) startbuf = data; if (maxbuf <= data) return; - printf("\n>>> NBT Packet\n"); + printf(": nbt "); switch (flags) { case 1: - printf("flags=0x%x\n", flags); + printf("flags 0x%x ", flags); case 0: - data = fdata(data,"NBT Session Packet\nFlags=[rw]\nLength=[rd]\n",data+4); + data = fdata(data,"session flags [rw] len [rd] ",data+4); if (data == NULL) break; if (memcmp(data,"\377SMB",4)==0) { if (nbt_len>PTR_DIFF(maxbuf,data)) - printf("WARNING: Short packet. Try increasing the snap length (%ld)\n", - PTR_DIFF(maxbuf,data)); + printf("[|nbt]"); print_smb(data,maxbuf>data+nbt_len?data+nbt_len:maxbuf); } else { - printf("Session packet:(raw data?)\n"); + printf("session packet :(raw data?) "); } break; case 0x81: - data = fdata(data,"NBT Session Request\nFlags=[rW]\nDestination=[n1]\nSource=[n1]\n",maxbuf); + data = fdata(data,"session-request flags [rW] dst [n1] src [n1] ",maxbuf); break; case 0x82: - data = fdata(data,"NBT Session Granted\nFlags=[rW]\n",maxbuf); + data = fdata(data,"sessionr-granted flags [rW] ",maxbuf); break; case 0x83: { int ecode = CVAL(data,4); - data = fdata(data,"NBT SessionReject\nFlags=[rW]\nReason=[B]\n",maxbuf); + data = fdata(data,"session-reject flags [rW] reason [B] ",maxbuf); switch (ecode) { case 0x80: - printf("Not listening on called name\n"); + printf("(Not listening on called name) "); break; case 0x81: - printf("Not listening for calling name\n"); + printf("(Not listening for calling name) "); break; case 0x82: - printf("Called name not present\n"); + printf("(Called name not present) "); break; case 0x83: - printf("Called name present, but insufficient resources\n"); + printf("(Insufficient resources) "); break; default: - printf("Unspecified error 0x%X\n",ecode); + printf("(Unspecified error 0x%X) ",ecode); break; } } break; case 0x85: - data = fdata(data,"NBT Session Keepalive\nFlags=[rW]\n",maxbuf); + data = fdata(data,"keepalive flags [rW] ",maxbuf); break; default: - printf("flags=0x%x\n", flags); - data = fdata(data,"NBT - Unknown packet type\nType=[rW]\n",maxbuf); + printf("flags=0x%x ", flags); + data = fdata(data,"unknown packet type [rW] ",maxbuf); } - printf("\n"); fflush(stdout); } @@ -800,39 +678,31 @@ void nbt_udp137_print(const uchar *data, int length) if (maxbuf <= data) return; - printf("\n>>> NBT UDP PACKET(137): "); - switch (opcode) { - case 0: opcodestr = "QUERY"; break; - case 5: opcodestr = "REGISTRATION"; break; - case 6: opcodestr = "RELEASE"; break; - case 7: opcodestr = "WACK"; break; - case 8: opcodestr = "REFRESH(8)"; break; - case 9: opcodestr = "REFRESH"; break; - default: opcodestr = "OPUNKNOWN"; break; + case 0: opcodestr = "query"; break; + case 5: opcodestr = "registration"; break; + case 6: opcodestr = "release"; break; + case 7: opcodestr = "wack"; break; + case 8: opcodestr = "refresh(8)"; break; + case 9: opcodestr = "refresh"; break; + default: opcodestr = "unknown"; break; } - printf("%s", opcodestr); + printf("nbt-%s", opcodestr); if (response) { if (rcode) - printf("; NEGATIVE"); + printf("-negative"); else - printf("; POSITIVE"); - } - - if (response) - printf("; RESPONSE"); - else - printf("; REQUEST"); + printf("-positive"); + printf("-resp"); + } else + printf("-req"); if (nm_flags&1) - printf("; BROADCAST"); - else - printf("; UNICAST"); + printf("-bcast"); if (vflag == 0) return; - printf("\nTrnID=0x%X\nOpCode=%d\nNmFlags=0x%X\nRcode=%d\nQueryCount=%d\nAnswerCount=%d\nAuthorityCount=%d\nAddressRecCount=%d\n", - name_trn_id,opcode,nm_flags,rcode,qdcount,ancount,nscount,arcount); + printf(" transid 0x%X opcode %d nmflags 0x%X rcode %d querycnt %d answercnt %d authoritycnt %d addrreccnt %d ", name_trn_id,opcode,nm_flags,rcode,qdcount,ancount,nscount,arcount); p = data + 12; @@ -841,45 +711,45 @@ void nbt_udp137_print(const uchar *data, int length) int i; if (qdcount>100 || total>100) { - printf("Corrupt packet??\n"); + printf("(corrupt packet?) "); return; } if (qdcount) { - printf("QuestionRecords:\n"); + printf("question: "); for (i=0;i<qdcount;i++) - p = fdata(p,"|Name=[n1]\nQuestionType=[rw]\nQuestionClass=[rw]\n#",maxbuf); + p = fdata(p,"|name [n1] type [rw] class [rw] #",maxbuf); if (p == NULL) - goto out; + return; } if (total) { - printf("\nResourceRecords:\n"); + printf("rr: "); for (i=0;i<total;i++) { int rdlen; int restype; - p = fdata(p,"Name=[n1]\n#",maxbuf); + p = fdata(p,"name [n1] #",maxbuf); if (p == NULL) - goto out; + return; restype = RSVAL(p,0); - p = fdata(p,"ResType=[rw]\nResClass=[rw]\nTTL=[rD]\n",p+8); + p = fdata(p,"type [rw] class [rw] ttl [rD] ",p+8); if (p == NULL) - goto out; + return; rdlen = RSVAL(p,0); - printf("ResourceLength=%d\nResourceData=\n",rdlen); + printf("len %d data ",rdlen); p += 2; if (rdlen == 6) { - p = fdata(p,"AddrType=[rw]\nAddress=[b.b.b.b]\n",p+rdlen); + p = fdata(p,"addrtype [rw] addr [b.b.b.b] ",p+rdlen); if (p == NULL) - goto out; + return; } else { if (restype == 0x21) { int numnames = CVAL(p,0); - p = fdata(p,"NumNames=[B]\n",p+1); + p = fdata(p,"numnames [B] ",p+1); if (p == NULL) - goto out; + return; while (numnames--) { - p = fdata(p,"Name=[n2]\t#",maxbuf); + p = fdata(p,"name [n2] #",maxbuf); if (p[0] & 0x80) printf("<GROUP> "); switch (p[0] & 0x60) { case 0x00: printf("B "); break; @@ -891,24 +761,19 @@ void nbt_udp137_print(const uchar *data, int length) if (p[0] & 0x08) printf("<CONFLICT> "); if (p[0] & 0x04) printf("<ACTIVE> "); if (p[0] & 0x02) printf("<PERMANENT> "); - printf("\n"); p += 2; } - } else { - print_data(p,rdlen); + } else p += rdlen; - } } } } } if ((uchar*)p < maxbuf) { - fdata(p,"AdditionalData:\n",maxbuf); + fdata(p,"extra: ",maxbuf); } -out: - printf("\n"); fflush(stdout); } @@ -923,12 +788,12 @@ void nbt_udp138_print(const uchar *data, int length) startbuf = data; if (maxbuf <= data) return; - data = fdata(data,"\n>>> NBT UDP PACKET(138) Res=[rw] ID=[rw] IP=[b.b.b.b] Port=[rd] Length=[rd] Res2=[rw]\nSourceName=[n1]\nDestName=[n1]\n#",maxbuf); + /* EMF - figure out how to skip fields inside maxbuf easily, IP and PORT here are bloody redundant */ + data = fdata(data,"nbt res [rw] id [rw] ip [b.b.b.b] port [rd] len [rd] res2 [rw] srcname [n1] dstname [n1] #",maxbuf); if (data != NULL) print_smb(data,maxbuf); - printf("\n"); fflush(stdout); } @@ -951,58 +816,58 @@ void netbeui_print(u_short control, const uchar *data, const uchar *maxbuf) startbuf = data; - printf("\n>>> NetBeui Packet\nType=0x%X ", control); - data = fdata(data,"Length=[d] Signature=[w] Command=[B]\n#",maxbuf); + printf("NetBeui type 0x%X ", control); + data = fdata(data,"len [d] signature [w] cmd [B] #",maxbuf); if (data == NULL) - goto out; + return; switch (command) { case 0xA: - data = fdata(data,"NameQuery:[P1]\nSessionNumber=[B]\nNameType=[B][P2]\nResponseCorrelator=[w]\nDestination=[n2]\nSource=[n2]\n",data2); + data = fdata(data,"namequery [P1] sessnum [B] nametype [B][P2] respcorrelator [w] dst [n2] src [n2] ",data2); break; case 0x8: - data = fdata(data,"NetbiosDataGram:[P7]\nDestination=[n2]\nSource=[n2]\n",data2); + data = fdata(data,"netbios dgram [P7] dst [n2] src [n2] ",data2); break; case 0xE: - data = fdata(data,"NameRecognise:\n[P1]\nData2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nDestination=[n2]\nSource=[n2]\n",data2); + data = fdata(data,"namerecognize [P1] data2 [w] xmitcorrelator [w] respcorrelator [w] dst [n2] src [n2] ",data2); break; case 0x19: - data = fdata(data,"SessionInitialise:\nData1=[B]\nData2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n",data2); + data = fdata(data,"sessinit data1 [B] data2 [w] xmitcorrelator [w] respcorrelator [w] remsessnum [B] lclsessnum [B] ",data2); break; case 0x17: - data = fdata(data,"SessionConfirm:\nData1=[B]\nData2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n",data2); + data = fdata(data,"sessconf data1 [B] data2 [w] xmitcorrelator [w] respcorrelator [w] remsessnum [B] lclsessnum [B] ",data2); break; case 0x16: - data = fdata(data,"NetbiosDataOnlyLast:\nFlags=[{|NO_ACK|PIGGYBACK_ACK_ALLOWED|PIGGYBACK_ACK_INCLUDED|}]\nResyncIndicator=[w][P2]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n",data2); + data = fdata(data,"netbios data only last flags [{|NO_ACK|PIGGYBACK_ACK_ALLOWED|PIGGYBACK_ACK_INCLUDED|}] resyncindicator [w][P2] respcorrelator [w] remsessnum [B] lclsessnum [B] ",data2); break; case 0x14: - data = fdata(data,"NetbiosDataAck:\n[P3]TransmitCorrelator=[w][P2]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n",data2); + data = fdata(data,"netbios data ack [P3] xmitcorrelator [w][P2] remsessnum [B] lclsessnum [B] ",data2); break; case 0x18: - data = fdata(data,"SessionEnd:\n[P1]Data2=[w][P4]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n",data2); + data = fdata(data,"end session [P1] data2 [w][P4] remsessnum [B] lclsessnum [B] ",data2); break; case 0x1f: - data = fdata(data,"SessionAlive\n",data2); + data = fdata(data,"session alive ",data2); break; default: - data = fdata(data,"Unknown Netbios Command ",data2); + data = fdata(data,"unknown netbios command ",data2); break; } if (data == NULL) - goto out; + return; if (is_truncated) { /* data2 was past the end of the buffer */ - goto out; + return; } if (memcmp(data2,"\377SMB",4)==0) { @@ -1013,15 +878,12 @@ void netbeui_print(u_short control, const uchar *data, const uchar *maxbuf) if (&data2[i] >= maxbuf) break; if (memcmp(&data2[i],"\377SMB",4)==0) { - printf("found SMB packet at %d\n", i); + printf("smb @ %d", i); print_smb(&data2[i],maxbuf); break; } } } - -out: - printf("\n"); } @@ -1035,13 +897,11 @@ void ipx_netbios_print(const uchar *data, const uchar *maxbuf) startbuf = data; for (i=0;i<128;i++) if (memcmp(&data[i],"\377SMB",4)==0) { - fdata(data,"\n>>> IPX transport ",&data[i]); - if (data != NULL) - print_smb(&data[i],maxbuf); - printf("\n"); + fdata(data,"IPX ",&data[i]); + print_smb(&data[i],maxbuf); fflush(stdout); break; } if (i==128) - fdata(data,"\n>>> Unknown IPX ",maxbuf); + fdata(data,"unknown IPX ",maxbuf); } diff --git a/usr.sbin/tcpdump/smbutil.c b/usr.sbin/tcpdump/smbutil.c index 725ac6982a0..613bf1fbe21 100644 --- a/usr.sbin/tcpdump/smbutil.c +++ b/usr.sbin/tcpdump/smbutil.c @@ -1,4 +1,4 @@ -/* $OpenBSD: smbutil.c,v 1.1 2000/12/07 22:36:46 mickey Exp $ */ +/* $OpenBSD: smbutil.c,v 1.2 2001/01/03 18:41:00 mickey Exp $ */ /* Copyright (C) Andrew Tridgell 1995-1999 @@ -13,7 +13,7 @@ #ifndef lint static const char rcsid[] = - "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/smbutil.c,v 1.1 2000/12/07 22:36:46 mickey Exp $"; + "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/smbutil.c,v 1.2 2001/01/03 18:41:00 mickey Exp $"; #endif #include <sys/param.h> @@ -121,6 +121,7 @@ we run past the end of the buffer ****************************************************************************/ static int name_interpret(const uchar *in,const uchar *maxbuf,char *out) { + char *ob = out; int ret; int len; @@ -139,15 +140,21 @@ static int name_interpret(const uchar *in,const uchar *maxbuf,char *out) return(-1); /* name goes past the end of the buffer */ TCHECK2(*in, 2); if (in[0] < 'A' || in[0] > 'P' || in[1] < 'A' || in[1] > 'P') { - *out = 0; - return(0); + *out++ = 0; + break; } *out = ((in[0]-'A')<<4) + (in[1]-'A'); in += 2; out++; } - *out = 0; ret = out[-1]; + out--; + while (out[-1] == ' ') + out--; + *out = '\0'; + for (; *ob; ob++) + if (!isprint(*ob)) + *ob = 'X'; return(ret); @@ -200,7 +207,7 @@ static int name_extract(const uchar *buf,int ofs,const uchar *maxbuf,char *name) const uchar *p = name_ptr(buf,ofs,maxbuf); if (p == NULL) return(-1); /* error (probably name going past end of buffer) */ - strcpy(name,""); + *name = '\0'; return(name_interpret(p,maxbuf,name)); } @@ -232,13 +239,6 @@ trunc: return(-1); /* name goes past the end of the buffer */ } -static void print_asc(const unsigned char *buf,int len) -{ - int i; - for (i=0;i<len;i++) - printf("%c",isprint(buf[i])?buf[i]:'.'); -} - static char *name_type_str(int name_type) { static char *f = NULL; @@ -254,38 +254,6 @@ static char *name_type_str(int name_type) return(f); } -void print_data(const unsigned char *buf, int len) -{ - int i=0; - if (len<=0) return; - printf("[%03X] ",i); - for (i=0;i<len;) { - printf("%02X ",(int)buf[i]); - i++; - if (i%8 == 0) printf(" "); - if (i%16 == 0) { - print_asc(&buf[i-16],8); printf(" "); - print_asc(&buf[i-8],8); printf("\n"); - if (i<len) printf("[%03X] ",i); - } - } - if (i%16) { - int n; - - n = 16 - (i%16); - printf(" "); - if (n>8) printf(" "); - while (n--) printf(" "); - - n = MIN(8,i%16); - print_asc(&buf[i-(i%16)],n); printf(" "); - n = (i%16) - n; - if (n>0) print_asc(&buf[i-n],n); - printf("\n"); - } -} - - static void write_bits(unsigned int val,char *fmt) { char *p = fmt; @@ -405,7 +373,7 @@ static const uchar *fdata1(const uchar *buf, const char *fmt, const uchar *maxbu case 'd': { unsigned int x = reverse?RSVAL(buf,0):SVAL(buf,0); - printf("%d (0x%x)",x, x); + printf("%d",x); buf += 2; fmt++; break; @@ -437,7 +405,7 @@ static const uchar *fdata1(const uchar *buf, const char *fmt, const uchar *maxbu case 'b': { unsigned int x = CVAL(buf,0); - printf("%d (0x%x)",x, x); + printf("%d",x); /* EMF - jesus, use B if you want hex */ buf += 1; fmt++; break; @@ -452,7 +420,7 @@ static const uchar *fdata1(const uchar *buf, const char *fmt, const uchar *maxbu case 'Z': { if (*buf != 4 && *buf != 2) - printf("Error! ASCIIZ buffer of type %d (safety=%d)\n", + printf("Error! ASCIIZ buffer of type %d (safety=%d) ", *buf,(int)PTR_DIFF(maxbuf,buf)); printf("%.*s",(int)PTR_DIFF(maxbuf,buf+1),unistr(buf+1, &len)); buf += len+1; @@ -490,12 +458,12 @@ static const uchar *fdata1(const uchar *buf, const char *fmt, const uchar *maxbu if (len < 0) goto trunc; buf += len; - printf("%-15.15s NameType=0x%02X (%s)", + printf("%.15s type 0x%02X (%s)", nbuf,name_type,name_type_str(name_type)); break; case 2: name_type = buf[15]; - printf("%-15.15s NameType=0x%02X (%s)", + printf("%.15s type 0x%02X (%s)", buf,name_type,name_type_str(name_type)); buf += 16; break; @@ -527,7 +495,7 @@ static const uchar *fdata1(const uchar *buf, const char *fmt, const uchar *maxbu buf+=8; break; } - printf("%s",t?asctime(localtime(&t)):"NULL\n"); + printf("%s",t?asctime(localtime(&t)):"NULL "); fmt++; while (isdigit(*fmt)) fmt++; break; } @@ -539,13 +507,12 @@ static const uchar *fdata1(const uchar *buf, const char *fmt, const uchar *maxbu } if (buf>=maxbuf && *fmt) - printf("END OF BUFFER\n"); + printf("END OF BUFFER "); return(buf); trunc: - printf("\n"); - printf("WARNING: Short packet. Try increasing the snap length\n"); + printf("WARNING: Short packet. Try increasing the snap length "); return(NULL); } @@ -604,8 +571,10 @@ const uchar *fdata(const uchar *buf, const char *fmt, const uchar *maxbuf) } if (!depth && buf<maxbuf) { int len = PTR_DIFF(maxbuf,buf); - printf("Data: (%d bytes)\n",len); - print_data(buf,len); + printf("(%d data bytes)",len); + /* EMF - use -X flag if you want this verbosity + * print_data(buf,len); + */ return(buf+len); } return(buf); |