Home | History | Annotate | Download | only in tcpdump 
      1 /*
      2  * Copyright (C) Andrew Tridgell 1995-1999
      3  *
      4  * This software may be distributed either under the terms of the
      5  * BSD-style license that accompanies tcpdump or the GNU GPL version 2
      6  * or later
      7  */
      8 
      9 #ifdef HAVE_CONFIG_H
     10 #include "config.h"
     11 #endif
     12 
     13 #ifndef lint
     14 static const char rcsid[] _U_ =
     15      "@(#) $Header: /tcpdump/master/tcpdump/print-smb.c,v 1.41.2.4 2007/07/14 22:29:05 guy Exp $";
     16 #endif
     17 
     18 #include <tcpdump-stdinc.h>
     19 
     20 #include <stdio.h>
     21 #include <string.h>
     22 
     23 #include "interface.h"
     24 #include "extract.h"
     25 #include "smb.h"
     26 
     27 static int request = 0;
     28 static int unicodestr = 0;
     29 
     30 const u_char *startbuf = NULL;
     31 
     32 struct smbdescript {
     33     const char *req_f1;
     34     const char *req_f2;
     35     const char *rep_f1;
     36     const char *rep_f2;
     37     void (*fn)(const u_char *, const u_char *, const u_char *, const u_char *);
     38 };
     39 
     40 struct smbdescriptint {
     41     const char *req_f1;
     42     const char *req_f2;
     43     const char *rep_f1;
     44     const char *rep_f2;
     45     void (*fn)(const u_char *, const u_char *, int, int);
     46 };
     47 
     48 struct smbfns
     49 {
     50     int id;
     51     const char *name;
     52     int flags;
     53     struct smbdescript descript;
     54 };
     55 
     56 struct smbfnsint
     57 {
     58     int id;
     59     const char *name;
     60     int flags;
     61     struct smbdescriptint descript;
     62 };
     63 
     64 #define DEFDESCRIPT	{ NULL, NULL, NULL, NULL, NULL }
     65 
     66 #define FLG_CHAIN	(1 << 0)
     67 
     68 static struct smbfns *
     69 smbfind(int id, struct smbfns *list)
     70 {
     71     int sindex;
     72 
     73     for (sindex = 0; list[sindex].name; sindex++)
     74 	if (list[sindex].id == id)
     75 	    return(&list[sindex]);
     76 
     77     return(&list[0]);
     78 }
     79 
     80 static struct smbfnsint *
     81 smbfindint(int id, struct smbfnsint *list)
     82 {
     83     int sindex;
     84 
     85     for (sindex = 0; list[sindex].name; sindex++)
     86 	if (list[sindex].id == id)
     87 	    return(&list[sindex]);
     88 
     89     return(&list[0]);
     90 }
     91 
     92 static void
     93 trans2_findfirst(const u_char *param, const u_char *data, int pcnt, int dcnt)
     94 {
     95     const char *fmt;
     96 
     97     if (request)
     98 	fmt = "Attribute=[A]\nSearchCount=[d]\nFlags=[w]\nLevel=[dP4]\nFile=[S]\n";
     99     else
    100 	fmt = "Handle=[w]\nCount=[d]\nEOS=[w]\nEoffset=[d]\nLastNameOfs=[w]\n";
    101 
    102     smb_fdata(param, fmt, param + pcnt, unicodestr);
    103     if (dcnt) {
    104 	printf("data:\n");
    105 	print_data(data, dcnt);
    106     }
    107 }
    108 
    109 static void
    110 trans2_qfsinfo(const u_char *param, const u_char *data, int pcnt, int dcnt)
    111 {
    112     static int level = 0;
    113     const char *fmt="";
    114 
    115     if (request) {
    116 	TCHECK2(*param, 2);
    117 	level = EXTRACT_LE_16BITS(param);
    118 	fmt = "InfoLevel=[d]\n";
    119 	smb_fdata(param, fmt, param + pcnt, unicodestr);
    120     } else {
    121 	switch (level) {
    122 	case 1:
    123 	    fmt = "idFileSystem=[W]\nSectorUnit=[D]\nUnit=[D]\nAvail=[D]\nSectorSize=[d]\n";
    124 	    break;
    125 	case 2:
    126 	    fmt = "CreationTime=[T2]VolNameLength=[lb]\nVolumeLabel=[c]\n";
    127 	    break;
    128 	case 0x105:
    129 	    fmt = "Capabilities=[W]\nMaxFileLen=[D]\nVolNameLen=[lD]\nVolume=[C]\n";
    130 	    break;
    131 	default:
    132 	    fmt = "UnknownLevel\n";
    133 	    break;
    134 	}
    135 	smb_fdata(data, fmt, data + dcnt, unicodestr);
    136     }
    137     if (dcnt) {
    138 	printf("data:\n");
    139 	print_data(data, dcnt);
    140     }
    141     return;
    142 trunc:
    143     printf("[|SMB]");
    144     return;
    145 }
    146 
    147 struct smbfnsint trans2_fns[] = {
    148     { 0, "TRANSACT2_OPEN", 0,
    149 	{ "Flags2=[w]\nMode=[w]\nSearchAttrib=[A]\nAttrib=[A]\nTime=[T2]\nOFun=[w]\nSize=[D]\nRes=([w, w, w, w, w])\nPath=[S]",
    150 	  NULL,
    151 	  "Handle=[d]\nAttrib=[A]\nTime=[T2]\nSize=[D]\nAccess=[w]\nType=[w]\nState=[w]\nAction=[w]\nInode=[W]\nOffErr=[d]\n|EALength=[d]\n",
    152 	  NULL, NULL }},
    153     { 1, "TRANSACT2_FINDFIRST", 0,
    154 	{ NULL, NULL, NULL, NULL, trans2_findfirst }},
    155     { 2, "TRANSACT2_FINDNEXT", 0, DEFDESCRIPT },
    156     { 3, "TRANSACT2_QFSINFO", 0,
    157 	{ NULL, NULL, NULL, NULL, trans2_qfsinfo }},
    158     { 4, "TRANSACT2_SETFSINFO", 0, DEFDESCRIPT },
    159     { 5, "TRANSACT2_QPATHINFO", 0, DEFDESCRIPT },
    160     { 6, "TRANSACT2_SETPATHINFO", 0, DEFDESCRIPT },
    161     { 7, "TRANSACT2_QFILEINFO", 0, DEFDESCRIPT },
    162     { 8, "TRANSACT2_SETFILEINFO", 0, DEFDESCRIPT },
    163     { 9, "TRANSACT2_FSCTL", 0, DEFDESCRIPT },
    164     { 10, "TRANSACT2_IOCTL", 0, DEFDESCRIPT },
    165     { 11, "TRANSACT2_FINDNOTIFYFIRST", 0, DEFDESCRIPT },
    166     { 12, "TRANSACT2_FINDNOTIFYNEXT", 0, DEFDESCRIPT },
    167     { 13, "TRANSACT2_MKDIR", 0, DEFDESCRIPT },
    168     { -1, NULL, 0, DEFDESCRIPT }
    169 };
    170 
    171 
    172 static void
    173 print_trans2(const u_char *words, const u_char *dat, const u_char *buf, const u_char *maxbuf)
    174 {
    175     u_int bcc;
    176     static struct smbfnsint *fn = &trans2_fns[0];
    177     const u_char *data, *param;
    178     const u_char *w = words + 1;
    179     const char *f1 = NULL, *f2 = NULL;
    180     int pcnt, dcnt;
    181 
    182     TCHECK(words[0]);
    183     if (request) {
    184 	TCHECK2(w[14 * 2], 2);
    185 	pcnt = EXTRACT_LE_16BITS(w + 9 * 2);
    186 	param = buf + EXTRACT_LE_16BITS(w + 10 * 2);
    187 	dcnt = EXTRACT_LE_16BITS(w + 11 * 2);
    188 	data = buf + EXTRACT_LE_16BITS(w + 12 * 2);
    189 	fn = smbfindint(EXTRACT_LE_16BITS(w + 14 * 2), trans2_fns);
    190     } else {
    191 	if (words[0] == 0) {
    192 	    printf("%s\n", fn->name);
    193 	    printf("Trans2Interim\n");
    194 	    return;
    195 	}
    196 	TCHECK2(w[7 * 2], 2);
    197 	pcnt = EXTRACT_LE_16BITS(w + 3 * 2);
    198 	param = buf + EXTRACT_LE_16BITS(w + 4 * 2);
    199 	dcnt = EXTRACT_LE_16BITS(w + 6 * 2);
    200 	data = buf + EXTRACT_LE_16BITS(w + 7 * 2);
    201     }
    202 
    203     printf("%s param_length=%d data_length=%d\n", fn->name, pcnt, dcnt);
    204 
    205     if (request) {
    206 	if (words[0] == 8) {
    207 	    smb_fdata(words + 1,
    208 		"Trans2Secondary\nTotParam=[d]\nTotData=[d]\nParamCnt=[d]\nParamOff=[d]\nParamDisp=[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nHandle=[d]\n",
    209 		maxbuf, unicodestr);
    210 	    return;
    211 	} else {
    212 	    smb_fdata(words + 1,
    213 		"TotParam=[d]\nTotData=[d]\nMaxParam=[d]\nMaxData=[d]\nMaxSetup=[b][P1]\nFlags=[w]\nTimeOut=[D]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nDataCnt=[d]\nDataOff=[d]\nSetupCnt=[b][P1]\n",
    214 		words + 1 + 14 * 2, unicodestr);
    215 	}
    216 	f1 = fn->descript.req_f1;
    217 	f2 = fn->descript.req_f2;
    218     } else {
    219 	smb_fdata(words + 1,
    220 	    "TotParam=[d]\nTotData=[d]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nParamDisp[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nSetupCnt=[b][P1]\n",
    221 	    words + 1 + 10 * 2, unicodestr);
    222 	f1 = fn->descript.rep_f1;
    223 	f2 = fn->descript.rep_f2;
    224     }
    225 
    226     TCHECK2(*dat, 2);
    227     bcc = EXTRACT_LE_16BITS(dat);
    228     printf("smb_bcc=%u\n", bcc);
    229     if (fn->descript.fn)
    230 	(*fn->descript.fn)(param, data, pcnt, dcnt);
    231     else {
    232 	smb_fdata(param, f1 ? f1 : "Parameters=\n", param + pcnt, unicodestr);
    233 	smb_fdata(data, f2 ? f2 : "Data=\n", data + dcnt, unicodestr);
    234     }
    235     return;
    236 trunc:
    237     printf("[|SMB]");
    238     return;
    239 }
    240 
    241 
    242 static void
    243 print_browse(const u_char *param, int paramlen, const u_char *data, int datalen)
    244 {
    245     const u_char *maxbuf = data + datalen;
    246     int command;
    247 
    248     TCHECK(data[0]);
    249     command = data[0];
    250 
    251     smb_fdata(param, "BROWSE PACKET\n|Param ", param+paramlen, unicodestr);
    252 
    253     switch (command) {
    254     case 0xF:
    255 	data = smb_fdata(data,
    256 	    "BROWSE PACKET:\nType=[B] (LocalMasterAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nElectionVersion=[w]\nBrowserConstant=[w]\n",
    257 	    maxbuf, unicodestr);
    258 	break;
    259 
    260     case 0x1:
    261 	data = smb_fdata(data,
    262 	    "BROWSE PACKET:\nType=[B] (HostAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nElectionVersion=[w]\nBrowserConstant=[w]\n",
    263 	    maxbuf, unicodestr);
    264 	break;
    265 
    266     case 0x2:
    267 	data = smb_fdata(data,
    268 	    "BROWSE PACKET:\nType=[B] (AnnouncementRequest)\nFlags=[B]\nReplySystemName=[S]\n",
    269 	    maxbuf, unicodestr);
    270 	break;
    271 
    272     case 0xc:
    273 	data = smb_fdata(data,
    274 	    "BROWSE PACKET:\nType=[B] (WorkgroupAnnouncement)\nUpdateCount=[w]\nRes1=[B]\nAnnounceInterval=[d]\nName=[n2]\nMajorVersion=[B]\nMinorVersion=[B]\nServerType=[W]\nCommentPointer=[W]\nServerName=[S]\n",
    275 	    maxbuf, unicodestr);
    276 	break;
    277 
    278     case 0x8:
    279 	data = smb_fdata(data,
    280 	    "BROWSE PACKET:\nType=[B] (ElectionFrame)\nElectionVersion=[B]\nOSSummary=[W]\nUptime=[(W, W)]\nServerName=[S]\n",
    281 	    maxbuf, unicodestr);
    282 	break;
    283 
    284     case 0xb:
    285 	data = smb_fdata(data,
    286 	    "BROWSE PACKET:\nType=[B] (BecomeBackupBrowser)\nName=[S]\n",
    287 	    maxbuf, unicodestr);
    288 	break;
    289 
    290     case 0x9:
    291 	data = smb_fdata(data,
    292 	    "BROWSE PACKET:\nType=[B] (GetBackupList)\nListCount?=[B]\nToken=[W]\n",
    293 	    maxbuf, unicodestr);
    294 	break;
    295 
    296     case 0xa:
    297 	data = smb_fdata(data,
    298 	    "BROWSE PACKET:\nType=[B] (BackupListResponse)\nServerCount?=[B]\nToken=[W]\n*Name=[S]\n",
    299 	    maxbuf, unicodestr);
    300 	break;
    301 
    302     case 0xd:
    303 	data = smb_fdata(data,
    304 	    "BROWSE PACKET:\nType=[B] (MasterAnnouncement)\nMasterName=[S]\n",
    305 	    maxbuf, unicodestr);
    306 	break;
    307 
    308     case 0xe:
    309 	data = smb_fdata(data,
    310 	    "BROWSE PACKET:\nType=[B] (ResetBrowser)\nOptions=[B]\n", maxbuf, unicodestr);
    311 	break;
    312 
    313     default:
    314 	data = smb_fdata(data, "Unknown Browser Frame ", maxbuf, unicodestr);
    315 	break;
    316     }
    317     return;
    318 trunc:
    319     printf("[|SMB]");
    320     return;
    321 }
    322 
    323 
    324 static void
    325 print_ipc(const u_char *param, int paramlen, const u_char *data, int datalen)
    326 {
    327     if (paramlen)
    328 	smb_fdata(param, "Command=[w]\nStr1=[S]\nStr2=[S]\n", param + paramlen,
    329 	    unicodestr);
    330     if (datalen)
    331 	smb_fdata(data, "IPC ", data + datalen, unicodestr);
    332 }
    333 
    334 
    335 static void
    336 print_trans(const u_char *words, const u_char *data1, const u_char *buf, const u_char *maxbuf)
    337 {
    338     u_int bcc;
    339     const char *f1, *f2, *f3, *f4;
    340     const u_char *data, *param;
    341     const u_char *w = words + 1;
    342     int datalen, paramlen;
    343 
    344     if (request) {
    345 	TCHECK2(w[12 * 2], 2);
    346 	paramlen = EXTRACT_LE_16BITS(w + 9 * 2);
    347 	param = buf + EXTRACT_LE_16BITS(w + 10 * 2);
    348 	datalen = EXTRACT_LE_16BITS(w + 11 * 2);
    349 	data = buf + EXTRACT_LE_16BITS(w + 12 * 2);
    350 	f1 = "TotParamCnt=[d] \nTotDataCnt=[d] \nMaxParmCnt=[d] \nMaxDataCnt=[d]\nMaxSCnt=[d] \nTransFlags=[w] \nRes1=[w] \nRes2=[w] \nRes3=[w]\nParamCnt=[d] \nParamOff=[d] \nDataCnt=[d] \nDataOff=[d] \nSUCnt=[d]\n";
    351 	f2 = "|Name=[S]\n";
    352 	f3 = "|Param ";
    353 	f4 = "|Data ";
    354     } else {
    355 	TCHECK2(w[7 * 2], 2);
    356 	paramlen = EXTRACT_LE_16BITS(w + 3 * 2);
    357 	param = buf + EXTRACT_LE_16BITS(w + 4 * 2);
    358 	datalen = EXTRACT_LE_16BITS(w + 6 * 2);
    359 	data = buf + EXTRACT_LE_16BITS(w + 7 * 2);
    360 	f1 = "TotParamCnt=[d] \nTotDataCnt=[d] \nRes1=[d]\nParamCnt=[d] \nParamOff=[d] \nRes2=[d] \nDataCnt=[d] \nDataOff=[d] \nRes3=[d]\nLsetup=[d]\n";
    361 	f2 = "|Unknown ";
    362 	f3 = "|Param ";
    363 	f4 = "|Data ";
    364     }
    365 
    366     smb_fdata(words + 1, f1, SMBMIN(words + 1 + 2 * words[0], maxbuf),
    367         unicodestr);
    368 
    369     TCHECK2(*data1, 2);
    370     bcc = EXTRACT_LE_16BITS(data1);
    371     printf("smb_bcc=%u\n", bcc);
    372     if (bcc > 0) {
    373 	smb_fdata(data1 + 2, f2, maxbuf - (paramlen + datalen), unicodestr);
    374 
    375 	if (strcmp((const char *)(data1 + 2), "\\MAILSLOT\\BROWSE") == 0) {
    376 	    print_browse(param, paramlen, data, datalen);
    377 	    return;
    378 	}
    379 
    380 	if (strcmp((const char *)(data1 + 2), "\\PIPE\\LANMAN") == 0) {
    381 	    print_ipc(param, paramlen, data, datalen);
    382 	    return;
    383 	}
    384 
    385 	if (paramlen)
    386 	    smb_fdata(param, f3, SMBMIN(param + paramlen, maxbuf), unicodestr);
    387 	if (datalen)
    388 	    smb_fdata(data, f4, SMBMIN(data + datalen, maxbuf), unicodestr);
    389     }
    390     return;
    391 trunc:
    392     printf("[|SMB]");
    393     return;
    394 }
    395 
    396 
    397 static void
    398 print_negprot(const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf)
    399 {
    400     u_int wct, bcc;
    401     const char *f1 = NULL, *f2 = NULL;
    402 
    403     TCHECK(words[0]);
    404     wct = words[0];
    405     if (request)
    406 	f2 = "*|Dialect=[Y]\n";
    407     else {
    408 	if (wct == 1)
    409 	    f1 = "Core Protocol\nDialectIndex=[d]";
    410 	else if (wct == 17)
    411 	    f1 = "NT1 Protocol\nDialectIndex=[d]\nSecMode=[B]\nMaxMux=[d]\nNumVcs=[d]\nMaxBuffer=[D]\nRawSize=[D]\nSessionKey=[W]\nCapabilities=[W]\nServerTime=[T3]TimeZone=[d]\nCryptKey=";
    412 	else if (wct == 13)
    413 	    f1 = "Coreplus/Lanman1/Lanman2 Protocol\nDialectIndex=[d]\nSecMode=[w]\nMaxXMit=[d]\nMaxMux=[d]\nMaxVcs=[d]\nBlkMode=[w]\nSessionKey=[W]\nServerTime=[T1]TimeZone=[d]\nRes=[W]\nCryptKey=";
    414     }
    415 
    416     if (f1)
    417 	smb_fdata(words + 1, f1, SMBMIN(words + 1 + wct * 2, maxbuf),
    418 	    unicodestr);
    419     else
    420 	print_data(words + 1, SMBMIN(wct * 2, PTR_DIFF(maxbuf, words + 1)));
    421 
    422     TCHECK2(*data, 2);
    423     bcc = EXTRACT_LE_16BITS(data);
    424     printf("smb_bcc=%u\n", bcc);
    425     if (bcc > 0) {
    426 	if (f2)
    427 	    smb_fdata(data + 2, f2, SMBMIN(data + 2 + EXTRACT_LE_16BITS(data),
    428 		maxbuf), unicodestr);
    429 	else
    430 	    print_data(data + 2, SMBMIN(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2)));
    431     }
    432     return;
    433 trunc:
    434     printf("[|SMB]");
    435     return;
    436 }
    437 
    438 static void
    439 print_sesssetup(const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf)
    440 {
    441     u_int wct, bcc;
    442     const char *f1 = NULL, *f2 = NULL;
    443 
    444     TCHECK(words[0]);
    445     wct = words[0];
    446     if (request) {
    447 	if (wct == 10)
    448 	    f1 = "Com2=[w]\nOff2=[d]\nBufSize=[d]\nMpxMax=[d]\nVcNum=[d]\nSessionKey=[W]\nPassLen=[d]\nCryptLen=[d]\nCryptOff=[d]\nPass&Name=\n";
    449 	else
    450 	    f1 = "Com2=[B]\nRes1=[B]\nOff2=[d]\nMaxBuffer=[d]\nMaxMpx=[d]\nVcNumber=[d]\nSessionKey=[W]\nCaseInsensitivePasswordLength=[d]\nCaseSensitivePasswordLength=[d]\nRes=[W]\nCapabilities=[W]\nPass1&Pass2&Account&Domain&OS&LanMan=\n";
    451     } else {
    452 	if (wct == 3) {
    453 	    f1 = "Com2=[w]\nOff2=[d]\nAction=[w]\n";
    454 	} else if (wct == 13) {
    455 	    f1 = "Com2=[B]\nRes=[B]\nOff2=[d]\nAction=[w]\n";
    456 	    f2 = "NativeOS=[S]\nNativeLanMan=[S]\nPrimaryDomain=[S]\n";
    457 	}
    458     }
    459 
    460     if (f1)
    461 	smb_fdata(words + 1, f1, SMBMIN(words + 1 + wct * 2, maxbuf),
    462 	    unicodestr);
    463     else
    464 	print_data(words + 1, SMBMIN(wct * 2, PTR_DIFF(maxbuf, words + 1)));
    465 
    466     TCHECK2(*data, 2);
    467     bcc = EXTRACT_LE_16BITS(data);
    468     printf("smb_bcc=%u\n", bcc);
    469     if (bcc > 0) {
    470 	if (f2)
    471 	    smb_fdata(data + 2, f2, SMBMIN(data + 2 + EXTRACT_LE_16BITS(data),
    472 		maxbuf), unicodestr);
    473 	else
    474 	    print_data(data + 2, SMBMIN(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2)));
    475     }
    476     return;
    477 trunc:
    478     printf("[|SMB]");
    479     return;
    480 }
    481 
    482 static void
    483 print_lockingandx(const u_char *words, const u_char *data, const u_char *buf _U_, const u_char *maxbuf)
    484 {
    485     u_int wct, bcc;
    486     const u_char *maxwords;
    487     const char *f1 = NULL, *f2 = NULL;
    488 
    489     TCHECK(words[0]);
    490     wct = words[0];
    491     if (request) {
    492 	f1 = "Com2=[w]\nOff2=[d]\nHandle=[d]\nLockType=[w]\nTimeOut=[D]\nUnlockCount=[d]\nLockCount=[d]\n";
    493 	TCHECK(words[7]);
    494 	if (words[7] & 0x10)
    495 	    f2 = "*Process=[d]\n[P2]Offset=[M]\nLength=[M]\n";
    496 	else
    497 	    f2 = "*Process=[d]\nOffset=[D]\nLength=[D]\n";
    498     } else {
    499 	f1 = "Com2=[w]\nOff2=[d]\n";
    500     }
    501 
    502     maxwords = SMBMIN(words + 1 + wct * 2, maxbuf);
    503     if (wct)
    504 	smb_fdata(words + 1, f1, maxwords, unicodestr);
    505 
    506     TCHECK2(*data, 2);
    507     bcc = EXTRACT_LE_16BITS(data);
    508     printf("smb_bcc=%u\n", bcc);
    509     if (bcc > 0) {
    510 	if (f2)
    511 	    smb_fdata(data + 2, f2, SMBMIN(data + 2 + EXTRACT_LE_16BITS(data),
    512 		maxbuf), unicodestr);
    513 	else
    514 	    print_data(data + 2, SMBMIN(EXTRACT_LE_16BITS(data), PTR_DIFF(maxbuf, data + 2)));
    515     }
    516     return;
    517 trunc:
    518     printf("[|SMB]");
    519     return;
    520 }
    521 
    522 
    523 static struct smbfns smb_fns[] = {
    524     { -1, "SMBunknown", 0, DEFDESCRIPT },
    525 
    526     { SMBtcon, "SMBtcon", 0,
    527 	{ NULL, "Path=[Z]\nPassword=[Z]\nDevice=[Z]\n",
    528 	  "MaxXmit=[d]\nTreeId=[d]\n", NULL,
    529 	  NULL } },
    530 
    531     { SMBtdis, "SMBtdis", 0, DEFDESCRIPT },
    532     { SMBexit,  "SMBexit", 0, DEFDESCRIPT },
    533     { SMBioctl, "SMBioctl", 0, DEFDESCRIPT },
    534 
    535     { SMBecho, "SMBecho", 0,
    536 	{ "ReverbCount=[d]\n", NULL,
    537 	  "SequenceNum=[d]\n", NULL,
    538 	  NULL } },
    539 
    540     { SMBulogoffX, "SMBulogoffX", FLG_CHAIN, DEFDESCRIPT },
    541 
    542     { SMBgetatr, "SMBgetatr", 0,
    543 	{ NULL, "Path=[Z]\n",
    544 	  "Attribute=[A]\nTime=[T2]Size=[D]\nRes=([w,w,w,w,w])\n", NULL,
    545 	  NULL } },
    546 
    547     { SMBsetatr, "SMBsetatr", 0,
    548 	{ "Attribute=[A]\nTime=[T2]Res=([w,w,w,w,w])\n", "Path=[Z]\n",
    549 	  NULL, NULL, NULL } },
    550 
    551     { SMBchkpth, "SMBchkpth", 0,
    552        { NULL, "Path=[Z]\n", NULL, NULL, NULL } },
    553 
    554     { SMBsearch, "SMBsearch", 0,
    555 	{ "Count=[d]\nAttrib=[A]\n",
    556 	  "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\n",
    557 	  "Count=[d]\n",
    558 	  "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",
    559 	  NULL } },
    560 
    561     { SMBopen, "SMBopen", 0,
    562 	{ "Mode=[w]\nAttribute=[A]\n", "Path=[Z]\n",
    563 	  "Handle=[d]\nOAttrib=[A]\nTime=[T2]Size=[D]\nAccess=[w]\n",
    564 	  NULL, NULL } },
    565 
    566     { SMBcreate, "SMBcreate", 0,
    567 	{ "Attrib=[A]\nTime=[T2]", "Path=[Z]\n", "Handle=[d]\n", NULL, NULL } },
    568 
    569     { SMBmknew, "SMBmknew", 0,
    570 	{ "Attrib=[A]\nTime=[T2]", "Path=[Z]\n", "Handle=[d]\n", NULL, NULL } },
    571 
    572     { SMBunlink, "SMBunlink", 0,
    573 	{ "Attrib=[A]\n", "Path=[Z]\n", NULL, NULL, NULL } },
    574 
    575     { SMBread, "SMBread", 0,
    576 	{ "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL,
    577 	  "Count=[d]\nRes=([w,w,w,w])\n", NULL, NULL } },
    578 
    579     { SMBwrite, "SMBwrite", 0,
    580 	{ "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL,
    581 	  "Count=[d]\n", NULL, NULL } },
    582 
    583     { SMBclose, "SMBclose", 0,
    584 	{ "Handle=[d]\nTime=[T2]", NULL, NULL, NULL, NULL } },
    585 
    586     { SMBmkdir, "SMBmkdir", 0,
    587 	{ NULL, "Path=[Z]\n", NULL, NULL, NULL } },
    588 
    589     { SMBrmdir, "SMBrmdir", 0,
    590 	{ NULL, "Path=[Z]\n", NULL, NULL, NULL } },
    591 
    592     { SMBdskattr, "SMBdskattr", 0,
    593 	{ NULL, NULL,
    594 	  "TotalUnits=[d]\nBlocksPerUnit=[d]\nBlockSize=[d]\nFreeUnits=[d]\nMedia=[w]\n",
    595 	  NULL, NULL } },
    596 
    597     { SMBmv, "SMBmv", 0,
    598 	{ "Attrib=[A]\n", "OldPath=[Z]\nNewPath=[Z]\n", NULL, NULL, NULL } },
    599 
    600     /*
    601      * this is a Pathworks specific call, allowing the
    602      * changing of the root path
    603      */
    604     { pSETDIR, "SMBsetdir", 0, { NULL, "Path=[Z]\n", NULL, NULL, NULL } },
    605 
    606     { SMBlseek, "SMBlseek", 0,
    607 	{ "Handle=[d]\nMode=[w]\nOffset=[D]\n", "Offset=[D]\n", NULL, NULL, NULL } },
    608 
    609     { SMBflush, "SMBflush", 0, { "Handle=[d]\n", NULL, NULL, NULL, NULL } },
    610 
    611     { SMBsplopen, "SMBsplopen", 0,
    612 	{ "SetupLen=[d]\nMode=[w]\n", "Ident=[Z]\n", "Handle=[d]\n",
    613 	  NULL, NULL } },
    614 
    615     { SMBsplclose, "SMBsplclose", 0,
    616 	{ "Handle=[d]\n", NULL, NULL, NULL, NULL } },
    617 
    618     { SMBsplretq, "SMBsplretq", 0,
    619 	{ "MaxCount=[d]\nStartIndex=[d]\n", NULL,
    620 	  "Count=[d]\nIndex=[d]\n",
    621 	  "*Time=[T2]Status=[B]\nJobID=[d]\nSize=[D]\nRes=[B]Name=[s16]\n",
    622 	  NULL } },
    623 
    624     { SMBsplwr, "SMBsplwr", 0,
    625 	{ "Handle=[d]\n", NULL, NULL, NULL, NULL } },
    626 
    627     { SMBlock, "SMBlock", 0,
    628 	{ "Handle=[d]\nCount=[D]\nOffset=[D]\n", NULL, NULL, NULL, NULL } },
    629 
    630     { SMBunlock, "SMBunlock", 0,
    631 	{ "Handle=[d]\nCount=[D]\nOffset=[D]\n", NULL, NULL, NULL, NULL } },
    632 
    633     /* CORE+ PROTOCOL FOLLOWS */
    634 
    635     { SMBreadbraw, "SMBreadbraw", 0,
    636 	{ "Handle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nRes=[d]\n",
    637 	  NULL, NULL, NULL, NULL } },
    638 
    639     { SMBwritebraw, "SMBwritebraw", 0,
    640 	{ "Handle=[d]\nTotalCount=[d]\nRes=[w]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nRes2=[W]\n|DataSize=[d]\nDataOff=[d]\n",
    641 	  NULL, "WriteRawAck", NULL, NULL } },
    642 
    643     { SMBwritec, "SMBwritec", 0,
    644 	{ NULL, NULL, "Count=[d]\n", NULL, NULL } },
    645 
    646     { SMBwriteclose, "SMBwriteclose", 0,
    647 	{ "Handle=[d]\nCount=[d]\nOffset=[D]\nTime=[T2]Res=([w,w,w,w,w,w])",
    648 	  NULL, "Count=[d]\n", NULL, NULL } },
    649 
    650     { SMBlockread, "SMBlockread", 0,
    651 	{ "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL,
    652 	  "Count=[d]\nRes=([w,w,w,w])\n", NULL, NULL } },
    653 
    654     { SMBwriteunlock, "SMBwriteunlock", 0,
    655 	{ "Handle=[d]\nByteCount=[d]\nOffset=[D]\nCountLeft=[d]\n", NULL,
    656 	  "Count=[d]\n", NULL, NULL } },
    657 
    658     { SMBreadBmpx, "SMBreadBmpx", 0,
    659 	{ "Handle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nRes=[w]\n",
    660 	  NULL,
    661 	  "Offset=[D]\nTotCount=[d]\nRemaining=[d]\nRes=([w,w])\nDataSize=[d]\nDataOff=[d]\n",
    662 	  NULL, NULL } },
    663 
    664     { SMBwriteBmpx, "SMBwriteBmpx", 0,
    665 	{ "Handle=[d]\nTotCount=[d]\nRes=[w]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nRes2=[W]\nDataSize=[d]\nDataOff=[d]\n", NULL,
    666 	  "Remaining=[d]\n", NULL, NULL } },
    667 
    668     { SMBwriteBs, "SMBwriteBs", 0,
    669 	{ "Handle=[d]\nTotCount=[d]\nOffset=[D]\nRes=[W]\nDataSize=[d]\nDataOff=[d]\n",
    670 	  NULL, "Count=[d]\n", NULL, NULL } },
    671 
    672     { SMBsetattrE, "SMBsetattrE", 0,
    673 	{ "Handle=[d]\nCreationTime=[T2]AccessTime=[T2]ModifyTime=[T2]", NULL,
    674 	  NULL, NULL, NULL } },
    675 
    676     { SMBgetattrE, "SMBgetattrE", 0,
    677 	{ "Handle=[d]\n", NULL,
    678 	  "CreationTime=[T2]AccessTime=[T2]ModifyTime=[T2]Size=[D]\nAllocSize=[D]\nAttribute=[A]\n",
    679 	  NULL, NULL } },
    680 
    681     { SMBtranss, "SMBtranss", 0, DEFDESCRIPT },
    682     { SMBioctls, "SMBioctls", 0, DEFDESCRIPT },
    683 
    684     { SMBcopy, "SMBcopy", 0,
    685 	{ "TreeID2=[d]\nOFun=[w]\nFlags=[w]\n", "Path=[S]\nNewPath=[S]\n",
    686 	  "CopyCount=[d]\n",  "|ErrStr=[S]\n",  NULL } },
    687 
    688     { SMBmove, "SMBmove", 0,
    689 	{ "TreeID2=[d]\nOFun=[w]\nFlags=[w]\n", "Path=[S]\nNewPath=[S]\n",
    690 	  "MoveCount=[d]\n",  "|ErrStr=[S]\n",  NULL } },
    691 
    692     { SMBopenX, "SMBopenX", FLG_CHAIN,
    693 	{ "Com2=[w]\nOff2=[d]\nFlags=[w]\nMode=[w]\nSearchAttrib=[A]\nAttrib=[A]\nTime=[T2]OFun=[w]\nSize=[D]\nTimeOut=[D]\nRes=[W]\n",
    694 	  "Path=[S]\n",
    695 	  "Com2=[w]\nOff2=[d]\nHandle=[d]\nAttrib=[A]\nTime=[T2]Size=[D]\nAccess=[w]\nType=[w]\nState=[w]\nAction=[w]\nFileID=[W]\nRes=[w]\n",
    696 	  NULL, NULL } },
    697 
    698     { SMBreadX, "SMBreadX", FLG_CHAIN,
    699 	{ "Com2=[w]\nOff2=[d]\nHandle=[d]\nOffset=[D]\nMaxCount=[d]\nMinCount=[d]\nTimeOut=[D]\nCountLeft=[d]\n",
    700 	  NULL,
    701 	  "Com2=[w]\nOff2=[d]\nRemaining=[d]\nRes=[W]\nDataSize=[d]\nDataOff=[d]\nRes=([w,w,w,w])\n",
    702 	  NULL, NULL } },
    703 
    704     { SMBwriteX, "SMBwriteX", FLG_CHAIN,
    705 	{ "Com2=[w]\nOff2=[d]\nHandle=[d]\nOffset=[D]\nTimeOut=[D]\nWMode=[w]\nCountLeft=[d]\nRes=[w]\nDataSize=[d]\nDataOff=[d]\n",
    706 	  NULL,
    707 	  "Com2=[w]\nOff2=[d]\nCount=[d]\nRemaining=[d]\nRes=[W]\n",
    708 	  NULL, NULL } },
    709 
    710     { SMBffirst, "SMBffirst", 0,
    711 	{ "Count=[d]\nAttrib=[A]\n",
    712 	  "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n",
    713 	  "Count=[d]\n",
    714 	  "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",
    715 	  NULL } },
    716 
    717     { SMBfunique, "SMBfunique", 0,
    718 	{ "Count=[d]\nAttrib=[A]\n",
    719 	  "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n",
    720 	  "Count=[d]\n",
    721 	  "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",
    722 	  NULL } },
    723 
    724     { SMBfclose, "SMBfclose", 0,
    725 	{ "Count=[d]\nAttrib=[A]\n",
    726 	  "Path=[Z]\nBlkType=[B]\nBlkLen=[d]\n|Res1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\n",
    727 	  "Count=[d]\n",
    728 	  "BlkType=[B]\nBlkLen=[d]\n*\nRes1=[B]\nMask=[s11]\nSrv1=[B]\nDirIndex=[d]\nSrv2=[w]\nRes2=[W]\nAttrib=[a]\nTime=[T1]Size=[D]\nName=[s13]\n",
    729 	  NULL } },
    730 
    731     { SMBfindnclose, "SMBfindnclose", 0,
    732 	{ "Handle=[d]\n", NULL, NULL, NULL, NULL } },
    733 
    734     { SMBfindclose, "SMBfindclose", 0,
    735 	{ "Handle=[d]\n", NULL, NULL, NULL, NULL } },
    736 
    737     { SMBsends, "SMBsends", 0,
    738 	{ NULL, "Source=[Z]\nDest=[Z]\n", NULL, NULL, NULL } },
    739 
    740     { SMBsendstrt, "SMBsendstrt", 0,
    741 	{ NULL, "Source=[Z]\nDest=[Z]\n", "GroupID=[d]\n", NULL, NULL } },
    742 
    743     { SMBsendend, "SMBsendend", 0,
    744 	{ "GroupID=[d]\n", NULL, NULL, NULL, NULL } },
    745 
    746     { SMBsendtxt, "SMBsendtxt", 0,
    747 	{ "GroupID=[d]\n", NULL, NULL, NULL, NULL } },
    748 
    749     { SMBsendb, "SMBsendb", 0,
    750 	{ NULL, "Source=[Z]\nDest=[Z]\n", NULL, NULL, NULL } },
    751 
    752     { SMBfwdname, "SMBfwdname", 0, DEFDESCRIPT },
    753     { SMBcancelf, "SMBcancelf", 0, DEFDESCRIPT },
    754     { SMBgetmac, "SMBgetmac", 0, DEFDESCRIPT },
    755 
    756     { SMBnegprot, "SMBnegprot", 0,
    757 	{ NULL, NULL, NULL, NULL, print_negprot } },
    758 
    759     { SMBsesssetupX, "SMBsesssetupX", FLG_CHAIN,
    760 	{ NULL, NULL, NULL, NULL, print_sesssetup } },
    761 
    762     { SMBtconX, "SMBtconX", FLG_CHAIN,
    763 	{ "Com2=[w]\nOff2=[d]\nFlags=[w]\nPassLen=[d]\nPasswd&Path&Device=\n",
    764 	  NULL, "Com2=[w]\nOff2=[d]\n", "ServiceType=[R]\n", NULL } },
    765 
    766     { SMBlockingX, "SMBlockingX", FLG_CHAIN,
    767 	{ NULL, NULL, NULL, NULL, print_lockingandx } },
    768 
    769     { SMBtrans2, "SMBtrans2", 0, { NULL, NULL, NULL, NULL, print_trans2 } },
    770 
    771     { SMBtranss2, "SMBtranss2", 0, DEFDESCRIPT },
    772     { SMBctemp, "SMBctemp", 0, DEFDESCRIPT },
    773     { SMBreadBs, "SMBreadBs", 0, DEFDESCRIPT },
    774     { SMBtrans, "SMBtrans", 0, { NULL, NULL, NULL, NULL, print_trans } },
    775 
    776     { SMBnttrans, "SMBnttrans", 0, DEFDESCRIPT },
    777     { SMBnttranss, "SMBnttranss", 0, DEFDESCRIPT },
    778 
    779     { SMBntcreateX, "SMBntcreateX", FLG_CHAIN,
    780 	{ "Com2=[w]\nOff2=[d]\nRes=[b]\nNameLen=[ld]\nFlags=[W]\nRootDirectoryFid=[D]\nAccessMask=[W]\nAllocationSize=[L]\nExtFileAttributes=[W]\nShareAccess=[W]\nCreateDisposition=[W]\nCreateOptions=[W]\nImpersonationLevel=[W]\nSecurityFlags=[b]\n",
    781 	  "Path=[C]\n",
    782 	  "Com2=[w]\nOff2=[d]\nOplockLevel=[b]\nFid=[d]\nCreateAction=[W]\nCreateTime=[T3]LastAccessTime=[T3]LastWriteTime=[T3]ChangeTime=[T3]ExtFileAttributes=[W]\nAllocationSize=[L]\nEndOfFile=[L]\nFileType=[w]\nDeviceState=[w]\nDirectory=[b]\n",
    783 	  NULL, NULL } },
    784 
    785     { SMBntcancel, "SMBntcancel", 0, DEFDESCRIPT },
    786 
    787     { -1, NULL, 0, DEFDESCRIPT }
    788 };
    789 
    790 
    791 /*
    792  * print a SMB message
    793  */
    794 static void
    795 print_smb(const u_char *buf, const u_char *maxbuf)
    796 {
    797     u_int16_t flags2;
    798     int nterrcodes;
    799     int command;
    800     u_int32_t nterror;
    801     const u_char *words, *maxwords, *data;
    802     struct smbfns *fn;
    803     const char *fmt_smbheader =
    804         "[P4]SMB Command   =  [B]\nError class   =  [BP1]\nError code    =  [d]\nFlags1        =  [B]\nFlags2        =  [B][P13]\nTree ID       =  [d]\nProc ID       =  [d]\nUID           =  [d]\nMID           =  [d]\nWord Count    =  [b]\n";
    805     int smboffset;
    806 
    807     TCHECK(buf[9]);
    808     request = (buf[9] & 0x80) ? 0 : 1;
    809     flags2 = EXTRACT_LE_16BITS(&buf[10]);
    810     unicodestr = flags2 & 0x8000;
    811     nterrcodes = flags2 & 0x4000;
    812     startbuf = buf;
    813 
    814     command = buf[4];
    815 
    816     fn = smbfind(command, smb_fns);
    817 
    818     if (vflag > 1)
    819 	printf("\n");
    820 
    821     printf("SMB PACKET: %s (%s)\n", fn->name, request ? "REQUEST" : "REPLY");
    822 
    823     if (vflag < 2)
    824 	return;
    825 
    826     /* print out the header */
    827     smb_fdata(buf, fmt_smbheader, buf + 33, unicodestr);
    828 
    829     if (nterrcodes) {
    830     	nterror = EXTRACT_LE_32BITS(&buf[5]);
    831 	if (nterror)
    832 	    printf("NTError = %s\n", nt_errstr(nterror));
    833     } else {
    834 	if (buf[5])
    835 	    printf("SMBError = %s\n", smb_errstr(buf[5], EXTRACT_LE_16BITS(&buf[7])));
    836     }
    837 
    838     smboffset = 32;
    839 
    840     for (;;) {
    841 	const char *f1, *f2;
    842 	int wct;
    843 	u_int bcc;
    844 	int newsmboffset;
    845 
    846 	words = buf + smboffset;
    847 	TCHECK(words[0]);
    848 	wct = words[0];
    849 	data = words + 1 + wct * 2;
    850 	maxwords = SMBMIN(data, maxbuf);
    851 
    852 	if (request) {
    853 	    f1 = fn->descript.req_f1;
    854 	    f2 = fn->descript.req_f2;
    855 	} else {
    856 	    f1 = fn->descript.rep_f1;
    857 	    f2 = fn->descript.rep_f2;
    858 	}
    859 
    860 	if (fn->descript.fn)
    861 	    (*fn->descript.fn)(words, data, buf, maxbuf);
    862 	else {
    863 	    if (wct) {
    864 		if (f1)
    865 		    smb_fdata(words + 1, f1, words + 1 + wct * 2, unicodestr);
    866 		else {
    867 		    int i;
    868 		    int v;
    869 
    870 		    for (i = 0; &words[1 + 2 * i] < maxwords; i++) {
    871 			TCHECK2(words[1 + 2 * i], 2);
    872 			v = EXTRACT_LE_16BITS(words + 1 + 2 * i);
    873 			printf("smb_vwv[%d]=%d (0x%X)\n", i, v, v);
    874 		    }
    875 		}
    876 	    }
    877 
    878 	    TCHECK2(*data, 2);
    879 	    bcc = EXTRACT_LE_16BITS(data);
    880 	    printf("smb_bcc=%u\n", bcc);
    881 	    if (f2) {
    882 		if (bcc > 0)
    883 		    smb_fdata(data + 2, f2, data + 2 + bcc, unicodestr);
    884 	    } else {
    885 		if (bcc > 0) {
    886 		    printf("smb_buf[]=\n");
    887 		    print_data(data + 2, SMBMIN(bcc, PTR_DIFF(maxbuf, data + 2)));
    888 		}
    889 	    }
    890 	}
    891 
    892 	if ((fn->flags & FLG_CHAIN) == 0)
    893 	    break;
    894 	if (wct == 0)
    895 	    break;
    896 	TCHECK(words[1]);
    897 	command = words[1];
    898 	if (command == 0xFF)
    899 	    break;
    900 	TCHECK2(words[3], 2);
    901 	newsmboffset = EXTRACT_LE_16BITS(words + 3);
    902 
    903 	fn = smbfind(command, smb_fns);
    904 
    905 	printf("\nSMB PACKET: %s (%s) (CHAINED)\n",
    906 	    fn->name, request ? "REQUEST" : "REPLY");
    907 	if (newsmboffset <= smboffset) {
    908 	    printf("Bad andX offset: %u <= %u\n", newsmboffset, smboffset);
    909 	    break;
    910 	}
    911 	smboffset = newsmboffset;
    912     }
    913 
    914     printf("\n");
    915     return;
    916 trunc:
    917     printf("[|SMB]");
    918     return;
    919 }
    920 
    921 
    922 /*
    923  * print a NBT packet received across tcp on port 139
    924  */
    925 void
    926 nbt_tcp_print(const u_char *data, int length)
    927 {
    928     int caplen;
    929     int type;
    930     u_int nbt_len;
    931     const u_char *maxbuf;
    932 
    933     if (length < 4)
    934 	goto trunc;
    935     if (snapend < data)
    936 	goto trunc;
    937     caplen = snapend - data;
    938     if (caplen < 4)
    939 	goto trunc;
    940     maxbuf = data + caplen;
    941     type = data[0];
    942     nbt_len = EXTRACT_16BITS(data + 2);
    943     length -= 4;
    944     caplen -= 4;
    945 
    946     startbuf = data;
    947 
    948     if (vflag < 2) {
    949 	printf(" NBT Session Packet: ");
    950 	switch (type) {
    951 	case 0x00:
    952 	    printf("Session Message");
    953 	    break;
    954 
    955 	case 0x81:
    956 	    printf("Session Request");
    957 	    break;
    958 
    959 	case 0x82:
    960 	    printf("Session Granted");
    961 	    break;
    962 
    963 	case 0x83:
    964 	  {
    965 	    int ecode;
    966 
    967 	    if (nbt_len < 4)
    968 		goto trunc;
    969 	    if (length < 4)
    970 		goto trunc;
    971 	    if (caplen < 4)
    972 		goto trunc;
    973 	    ecode = data[4];
    974 
    975 	    printf("Session Reject, ");
    976 	    switch (ecode) {
    977 	    case 0x80:
    978 		printf("Not listening on called name");
    979 		break;
    980 	    case 0x81:
    981 		printf("Not listening for calling name");
    982 		break;
    983 	    case 0x82:
    984 		printf("Called name not present");
    985 		break;
    986 	    case 0x83:
    987 		printf("Called name present, but insufficient resources");
    988 		break;
    989 	    default:
    990 		printf("Unspecified error 0x%X", ecode);
    991 		break;
    992 	    }
    993 	  }
    994 	    break;
    995 
    996 	case 0x85:
    997 	    printf("Session Keepalive");
    998 	    break;
    999 
   1000 	default:
   1001 	    data = smb_fdata(data, "Unknown packet type [rB]", maxbuf, 0);
   1002 	    break;
   1003 	}
   1004     } else {
   1005 	printf ("\n>>> NBT Session Packet\n");
   1006 	switch (type) {
   1007 	case 0x00:
   1008 	    data = smb_fdata(data, "[P1]NBT Session Message\nFlags=[B]\nLength=[rd]\n",
   1009 		data + 4, 0);
   1010 	    if (data == NULL)
   1011 		break;
   1012 	    if (nbt_len >= 4 && caplen >= 4 && memcmp(data,"\377SMB",4) == 0) {
   1013 		if ((int)nbt_len > caplen) {
   1014 		    if ((int)nbt_len > length)
   1015 			printf("WARNING: Packet is continued in later TCP segments\n");
   1016 		    else
   1017 			printf("WARNING: Short packet. Try increasing the snap length by %d\n",
   1018 			    nbt_len - caplen);
   1019 		}
   1020 		print_smb(data, maxbuf > data + nbt_len ? data + nbt_len : maxbuf);
   1021 	    } else
   1022 		printf("Session packet:(raw data or continuation?)\n");
   1023 	    break;
   1024 
   1025 	case 0x81:
   1026 	    data = smb_fdata(data,
   1027 		"[P1]NBT Session Request\nFlags=[B]\nLength=[rd]\nDestination=[n1]\nSource=[n1]\n",
   1028 		maxbuf, 0);
   1029 	    break;
   1030 
   1031 	case 0x82:
   1032 	    data = smb_fdata(data, "[P1]NBT Session Granted\nFlags=[B]\nLength=[rd]\n", maxbuf, 0);
   1033 	    break;
   1034 
   1035 	case 0x83:
   1036 	  {
   1037 	    const u_char *origdata;
   1038 	    int ecode;
   1039 
   1040 	    origdata = data;
   1041 	    data = smb_fdata(data, "[P1]NBT SessionReject\nFlags=[B]\nLength=[rd]\nReason=[B]\n",
   1042 		maxbuf, 0);
   1043 	    if (data == NULL)
   1044 		break;
   1045 	    if (nbt_len >= 1 && caplen >= 1) {
   1046 		ecode = origdata[4];
   1047 		switch (ecode) {
   1048 		case 0x80:
   1049 		    printf("Not listening on called name\n");
   1050 		    break;
   1051 		case 0x81:
   1052 		    printf("Not listening for calling name\n");
   1053 		    break;
   1054 		case 0x82:
   1055 		    printf("Called name not present\n");
   1056 		    break;
   1057 		case 0x83:
   1058 		    printf("Called name present, but insufficient resources\n");
   1059 		    break;
   1060 		default:
   1061 		    printf("Unspecified error 0x%X\n", ecode);
   1062 		    break;
   1063 		}
   1064 	    }
   1065 	  }
   1066 	    break;
   1067 
   1068 	case 0x85:
   1069 	    data = smb_fdata(data, "[P1]NBT Session Keepalive\nFlags=[B]\nLength=[rd]\n", maxbuf, 0);
   1070 	    break;
   1071 
   1072 	default:
   1073 	    data = smb_fdata(data, "NBT - Unknown packet type\nType=[B]\n", maxbuf, 0);
   1074 	    break;
   1075 	}
   1076 	printf("\n");
   1077 	fflush(stdout);
   1078     }
   1079     return;
   1080 trunc:
   1081     printf("[|SMB]");
   1082     return;
   1083 }
   1084 
   1085 
   1086 /*
   1087  * print a NBT packet received across udp on port 137
   1088  */
   1089 void
   1090 nbt_udp137_print(const u_char *data, int length)
   1091 {
   1092     const u_char *maxbuf = data + length;
   1093     int name_trn_id, response, opcode, nm_flags, rcode;
   1094     int qdcount, ancount, nscount, arcount;
   1095     const char *opcodestr;
   1096     const u_char *p;
   1097     int total, i;
   1098 
   1099     TCHECK2(data[10], 2);
   1100     name_trn_id = EXTRACT_16BITS(data);
   1101     response = (data[2] >> 7);
   1102     opcode = (data[2] >> 3) & 0xF;
   1103     nm_flags = ((data[2] & 0x7) << 4) + (data[3] >> 4);
   1104     rcode = data[3] & 0xF;
   1105     qdcount = EXTRACT_16BITS(data + 4);
   1106     ancount = EXTRACT_16BITS(data + 6);
   1107     nscount = EXTRACT_16BITS(data + 8);
   1108     arcount = EXTRACT_16BITS(data + 10);
   1109     startbuf = data;
   1110 
   1111     if (maxbuf <= data)
   1112 	return;
   1113 
   1114     if (vflag > 1)
   1115 	printf("\n>>> ");
   1116 
   1117     printf("NBT UDP PACKET(137): ");
   1118 
   1119     switch (opcode) {
   1120     case 0: opcodestr = "QUERY"; break;
   1121     case 5: opcodestr = "REGISTRATION"; break;
   1122     case 6: opcodestr = "RELEASE"; break;
   1123     case 7: opcodestr = "WACK"; break;
   1124     case 8: opcodestr = "REFRESH(8)"; break;
   1125     case 9: opcodestr = "REFRESH"; break;
   1126     case 15: opcodestr = "MULTIHOMED REGISTRATION"; break;
   1127     default: opcodestr = "OPUNKNOWN"; break;
   1128     }
   1129     printf("%s", opcodestr);
   1130     if (response) {
   1131 	if (rcode)
   1132 	    printf("; NEGATIVE");
   1133 	else
   1134 	    printf("; POSITIVE");
   1135     }
   1136 
   1137     if (response)
   1138 	printf("; RESPONSE");
   1139     else
   1140 	printf("; REQUEST");
   1141 
   1142     if (nm_flags & 1)
   1143 	printf("; BROADCAST");
   1144     else
   1145 	printf("; UNICAST");
   1146 
   1147     if (vflag < 2)
   1148 	return;
   1149 
   1150     printf("\nTrnID=0x%X\nOpCode=%d\nNmFlags=0x%X\nRcode=%d\nQueryCount=%d\nAnswerCount=%d\nAuthorityCount=%d\nAddressRecCount=%d\n",
   1151 	name_trn_id, opcode, nm_flags, rcode, qdcount, ancount, nscount,
   1152 	arcount);
   1153 
   1154     p = data + 12;
   1155 
   1156     total = ancount + nscount + arcount;
   1157 
   1158     if (qdcount > 100 || total > 100) {
   1159 	printf("Corrupt packet??\n");
   1160 	return;
   1161     }
   1162 
   1163     if (qdcount) {
   1164 	printf("QuestionRecords:\n");
   1165 	for (i = 0; i < qdcount; i++) {
   1166 	    p = smb_fdata(p,
   1167 		"|Name=[n1]\nQuestionType=[rw]\nQuestionClass=[rw]\n#",
   1168 		maxbuf, 0);
   1169 	    if (p == NULL)
   1170 		goto out;
   1171 	}
   1172     }
   1173 
   1174     if (total) {
   1175 	printf("\nResourceRecords:\n");
   1176 	for (i = 0; i < total; i++) {
   1177 	    int rdlen;
   1178 	    int restype;
   1179 
   1180 	    p = smb_fdata(p, "Name=[n1]\n#", maxbuf, 0);
   1181 	    if (p == NULL)
   1182 		goto out;
   1183 	    restype = EXTRACT_16BITS(p);
   1184 	    p = smb_fdata(p, "ResType=[rw]\nResClass=[rw]\nTTL=[rD]\n", p + 8, 0);
   1185 	    if (p == NULL)
   1186 		goto out;
   1187 	    rdlen = EXTRACT_16BITS(p);
   1188 	    printf("ResourceLength=%d\nResourceData=\n", rdlen);
   1189 	    p += 2;
   1190 	    if (rdlen == 6) {
   1191 		p = smb_fdata(p, "AddrType=[rw]\nAddress=[b.b.b.b]\n", p + rdlen, 0);
   1192 		if (p == NULL)
   1193 		    goto out;
   1194 	    } else {
   1195 		if (restype == 0x21) {
   1196 		    int numnames;
   1197 
   1198 		    TCHECK(*p);
   1199 		    numnames = p[0];
   1200 		    p = smb_fdata(p, "NumNames=[B]\n", p + 1, 0);
   1201 		    if (p == NULL)
   1202 			goto out;
   1203 		    while (numnames--) {
   1204 			p = smb_fdata(p, "Name=[n2]\t#", maxbuf, 0);
   1205 			if (p == NULL)
   1206 			    goto out;
   1207 			TCHECK(*p);
   1208 			if (p[0] & 0x80)
   1209 			    printf("<GROUP> ");
   1210 			switch (p[0] & 0x60) {
   1211 			case 0x00: printf("B "); break;
   1212 			case 0x20: printf("P "); break;
   1213 			case 0x40: printf("M "); break;
   1214 			case 0x60: printf("_ "); break;
   1215 			}
   1216 			if (p[0] & 0x10)
   1217 			    printf("<DEREGISTERING> ");
   1218 			if (p[0] & 0x08)
   1219 			    printf("<CONFLICT> ");
   1220 			if (p[0] & 0x04)
   1221 			    printf("<ACTIVE> ");
   1222 			if (p[0] & 0x02)
   1223 			    printf("<PERMANENT> ");
   1224 			printf("\n");
   1225 			p += 2;
   1226 		    }
   1227 		} else {
   1228 		    print_data(p, min(rdlen, length - (p - data)));
   1229 		    p += rdlen;
   1230 		}
   1231 	    }
   1232 	}
   1233     }
   1234 
   1235     if (p < maxbuf)
   1236 	smb_fdata(p, "AdditionalData:\n", maxbuf, 0);
   1237 
   1238 out:
   1239     printf("\n");
   1240     fflush(stdout);
   1241     return;
   1242 trunc:
   1243     printf("[|SMB]");
   1244     return;
   1245 }
   1246 
   1247 
   1248 
   1249 /*
   1250  * print a NBT packet received across udp on port 138
   1251  */
   1252 void
   1253 nbt_udp138_print(const u_char *data, int length)
   1254 {
   1255     const u_char *maxbuf = data + length;
   1256 
   1257     if (maxbuf > snapend)
   1258 	maxbuf = snapend;
   1259     if (maxbuf <= data)
   1260 	return;
   1261     startbuf = data;
   1262 
   1263     if (vflag < 2) {
   1264 	printf("NBT UDP PACKET(138)");
   1265 	return;
   1266     }
   1267 
   1268     data = smb_fdata(data,
   1269 	"\n>>> NBT UDP PACKET(138) Res=[rw] ID=[rw] IP=[b.b.b.b] Port=[rd] Length=[rd] Res2=[rw]\nSourceName=[n1]\nDestName=[n1]\n#",
   1270 	maxbuf, 0);
   1271 
   1272     if (data != NULL) {
   1273 	/* If there isn't enough data for "\377SMB", don't check for it. */
   1274 	if (&data[3] >= maxbuf)
   1275 	    goto out;
   1276 
   1277 	if (memcmp(data, "\377SMB",4) == 0)
   1278 	    print_smb(data, maxbuf);
   1279     }
   1280 out:
   1281     printf("\n");
   1282     fflush(stdout);
   1283 }
   1284 
   1285 
   1286 /*
   1287    print netbeui frames
   1288 */
   1289 struct nbf_strings {
   1290 	const char	*name;
   1291 	const char	*nonverbose;
   1292 	const char	*verbose;
   1293 } nbf_strings[0x20] = {
   1294 	{ "Add Group Name Query", ", [P23]Name to add=[n2]#",
   1295 	  "[P5]ResponseCorrelator=[w]\n[P16]Name to add=[n2]\n" },
   1296 	{ "Add Name Query", ", [P23]Name to add=[n2]#",
   1297 	  "[P5]ResponseCorrelator=[w]\n[P16]Name to add=[n2]\n" },
   1298 	{ "Name In Conflict", NULL, NULL },
   1299 	{ "Status Query", NULL, NULL },
   1300 	{ NULL, NULL, NULL },	/* not used */
   1301 	{ NULL, NULL, NULL },	/* not used */
   1302 	{ NULL, NULL, NULL },	/* not used */
   1303 	{ "Terminate Trace", NULL, NULL },
   1304 	{ "Datagram", NULL,
   1305 	  "[P7]Destination=[n2]\nSource=[n2]\n" },
   1306 	{ "Broadcast Datagram", NULL,
   1307 	  "[P7]Destination=[n2]\nSource=[n2]\n" },
   1308 	{ "Name Query", ", [P7]Name=[n2]#",
   1309 	  "[P1]SessionNumber=[B]\nNameType=[B][P2]\nResponseCorrelator=[w]\nName=[n2]\nName of sender=[n2]\n" },
   1310 	{ NULL, NULL, NULL },	/* not used */
   1311 	{ NULL, NULL, NULL },	/* not used */
   1312 	{ "Add Name Response", ", [P1]GroupName=[w] [P4]Destination=[n2] Source=[n2]#",
   1313 	  "AddNameInProcess=[B]\nGroupName=[w]\nTransmitCorrelator=[w][P2]\nDestination=[n2]\nSource=[n2]\n" },
   1314 	{ "Name Recognized", NULL,
   1315 	  "[P1]Data2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nDestination=[n2]\nSource=[n2]\n" },
   1316 	{ "Status Response", NULL, NULL },
   1317 	{ NULL, NULL, NULL },	/* not used */
   1318 	{ NULL, NULL, NULL },	/* not used */
   1319 	{ NULL, NULL, NULL },	/* not used */
   1320 	{ "Terminate Trace", NULL, NULL },
   1321 	{ "Data Ack", NULL,
   1322 	  "[P3]TransmitCorrelator=[w][P2]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
   1323 	{ "Data First/Middle", NULL,
   1324 	  "Flags=[{RECEIVE_CONTINUE|NO_ACK||PIGGYBACK_ACK_INCLUDED|}]\nResyncIndicator=[w][P2]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
   1325 	{ "Data Only/Last", NULL,
   1326 	  "Flags=[{|NO_ACK|PIGGYBACK_ACK_ALLOWED|PIGGYBACK_ACK_INCLUDED|}]\nResyncIndicator=[w][P2]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
   1327 	{ "Session Confirm", NULL,
   1328 	  "Data1=[B]\nData2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
   1329 	{ "Session End", NULL,
   1330 	  "[P1]Data2=[w][P4]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
   1331 	{ "Session Initialize", NULL,
   1332 	  "Data1=[B]\nData2=[w]\nTransmitCorrelator=[w]\nResponseCorelator=[w]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
   1333 	{ "No Receive", NULL,
   1334 	  "Flags=[{|SEND_NO_ACK}]\nDataBytesAccepted=[b][P4]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
   1335 	{ "Receive Outstanding", NULL,
   1336 	  "[P1]DataBytesAccepted=[b][P4]\nRemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
   1337 	{ "Receive Continue", NULL,
   1338 	  "[P2]TransmitCorrelator=[w]\n[P2]RemoteSessionNumber=[B]\nLocalSessionNumber=[B]\n" },
   1339 	{ NULL, NULL, NULL },	/* not used */
   1340 	{ NULL, NULL, NULL },	/* not used */
   1341 	{ "Session Alive", NULL, NULL }
   1342 };
   1343 
   1344 void
   1345 netbeui_print(u_short control, const u_char *data, int length)
   1346 {
   1347     const u_char *maxbuf = data + length;
   1348     int len;
   1349     int command;
   1350     const u_char *data2;
   1351     int is_truncated = 0;
   1352 
   1353     if (maxbuf > snapend)
   1354 	maxbuf = snapend;
   1355     TCHECK(data[4]);
   1356     len = EXTRACT_LE_16BITS(data);
   1357     command = data[4];
   1358     data2 = data + len;
   1359     if (data2 >= maxbuf) {
   1360 	data2 = maxbuf;
   1361 	is_truncated = 1;
   1362     }
   1363 
   1364     startbuf = data;
   1365 
   1366     if (vflag < 2) {
   1367 	printf("NBF Packet: ");
   1368 	data = smb_fdata(data, "[P5]#", maxbuf, 0);
   1369     } else {
   1370 	printf("\n>>> NBF Packet\nType=0x%X ", control);
   1371 	data = smb_fdata(data, "Length=[d] Signature=[w] Command=[B]\n#", maxbuf, 0);
   1372     }
   1373     if (data == NULL)
   1374 	goto out;
   1375 
   1376     if (command > 0x1f || nbf_strings[command].name == NULL) {
   1377 	if (vflag < 2)
   1378 	    data = smb_fdata(data, "Unknown NBF Command#", data2, 0);
   1379 	else
   1380 	    data = smb_fdata(data, "Unknown NBF Command\n", data2, 0);
   1381     } else {
   1382 	if (vflag < 2) {
   1383 	    printf("%s", nbf_strings[command].name);
   1384 	    if (nbf_strings[command].nonverbose != NULL)
   1385 		data = smb_fdata(data, nbf_strings[command].nonverbose, data2, 0);
   1386 	} else {
   1387 	    printf("%s:\n", nbf_strings[command].name);
   1388 	    if (nbf_strings[command].verbose != NULL)
   1389 		data = smb_fdata(data, nbf_strings[command].verbose, data2, 0);
   1390 	    else
   1391 		printf("\n");
   1392 	}
   1393     }
   1394 
   1395     if (vflag < 2)
   1396 	return;
   1397 
   1398     if (data == NULL)
   1399 	goto out;
   1400 
   1401     if (is_truncated) {
   1402 	/* data2 was past the end of the buffer */
   1403 	goto out;
   1404     }
   1405 
   1406     /* If this isn't a command that would contain an SMB message, quit. */
   1407     if (command != 0x08 && command != 0x09 && command != 0x15 &&
   1408         command != 0x16)
   1409 	goto out;
   1410 
   1411     /* If there isn't enough data for "\377SMB", don't look for it. */
   1412     if (&data2[3] >= maxbuf)
   1413 	goto out;
   1414 
   1415     if (memcmp(data2, "\377SMB",4) == 0)
   1416 	print_smb(data2, maxbuf);
   1417     else {
   1418 	int i;
   1419 	for (i = 0; i < 128; i++) {
   1420 	    if (&data2[i + 3] >= maxbuf)
   1421 		break;
   1422 	    if (memcmp(&data2[i], "\377SMB", 4) == 0) {
   1423 		printf("found SMB packet at %d\n", i);
   1424 		print_smb(&data2[i], maxbuf);
   1425 		break;
   1426 	    }
   1427 	}
   1428     }
   1429 
   1430 out:
   1431     printf("\n");
   1432     return;
   1433 trunc:
   1434     printf("[|SMB]");
   1435     return;
   1436 }
   1437 
   1438 
   1439 /*
   1440  * print IPX-Netbios frames
   1441  */
   1442 void
   1443 ipx_netbios_print(const u_char *data, u_int length)
   1444 {
   1445     /*
   1446      * this is a hack till I work out how to parse the rest of the
   1447      * NetBIOS-over-IPX stuff
   1448      */
   1449     int i;
   1450     const u_char *maxbuf;
   1451 
   1452     maxbuf = data + length;
   1453     /* Don't go past the end of the captured data in the packet. */
   1454     if (maxbuf > snapend)
   1455 	maxbuf = snapend;
   1456     startbuf = data;
   1457     for (i = 0; i < 128; i++) {
   1458 	if (&data[i + 4] > maxbuf)
   1459 	    break;
   1460 	if (memcmp(&data[i], "\377SMB", 4) == 0) {
   1461 	    smb_fdata(data, "\n>>> IPX transport ", &data[i], 0);
   1462 	    if (data != NULL)
   1463 		print_smb(&data[i], maxbuf);
   1464 	    printf("\n");
   1465 	    fflush(stdout);
   1466 	    break;
   1467 	}
   1468     }
   1469     if (i == 128)
   1470 	smb_fdata(data, "\n>>> Unknown IPX ", maxbuf, 0);
   1471 }
   1472