Hi,
Thanks.
Ill go through the draft draft and check it against the checked in
dissector.
Thanks again.
Right now I thought of fixing up packet-smb-pipe.c
Do you know of any draft-drafts for that one as well? or is it reading samba
source code which is the way to go to
verify the dissector?
After pipe, packet-smb-mailslot.c will be very easy and quick to fix. It is
very small.
As for the remaining packet-smb.c
The dissect_smb dissector calls the appropriate sub-dissector from the array
of function pointers dissector[] (or something similar)
I think the best way to fix packet-smb.c would be to change it so there were
(during the transition) an alternative array
dissector_tvb[] and then change dissect_smb() so it would call the
tvbuffified subdissector from dissector_tvb[] (if it exists/has been
tvbuffified)
In that way the subdissectors could easily be tvbuffified independently, one
at a time instead of all of them at once.
----- Original Message -----
From: "Guy Harris" <guy@xxxxxxxxxx>
To: "Ronnie Sahlberg" <rsahlber@xxxxxxxxxxxxxx>
Cc: "Richard Sharpe" <sharpe@xxxxxxxxxx>; <ethereal-dev@xxxxxxxxxxxx>
Sent: Friday, July 13, 2001 8:11 AM
Subject: Re: [Ethereal-dev] smb-browse
> > I tried to keep the functionality as close as possible to the original
> > dissector, but there is one exception:
> > I assume that every instance of a string for a ServerName is always
exactly
> > 16 characters (which might not
> > be 0 terminated).
>
> Nope.
>
> In a Get Backup List response, there are multiple host names, *not*
> padded to 16 characters, and NUL-terminated. One capture on the network
> here showed that.
>
> I've attached an old "PRELIMINARY DRAFT OF AN INTERNET-DRAFT" (yes, the
> document says it's a draft of an Internet-Draft, using the word "draft"
> twice; the document may or may not 100% accurately reflect what Windows
> actually does), from the old CIFS mailing list, for the browser
> protocol; for Get Backup List responses, it says
>
> 6.3 GetBackupListResponse Browser Frame
>
> The GetBackupListResponse frame is sent by a Master Browser in response
> to a GetBackupListRequest frame. If the GetBackupListRequest was sent
> from the computer whose name is "ComputerName", the
> GetBackupListResponse frame is sent to the ComputerName(00) NETBIOS
> unique name and mailslot "\MAILSLOT\LANMAN". Note: this name is not part
> of the request and the Master Browser needs to *deduce* this name with
> some cooperation from the transport protocol involved. The definition
> of the GetBackupListResponse frame is:
>
> struct {
> unsigned short OpCode;
> unsigned short BackupServerCount;
> unsigned short Token;
> unsigned char BackupServerList[][]
> }
> where:
> Opcode -- Identifies this structure as a backup list.
>
> BackupServerCount -- Specifies the number of backup servers
> that follow this list.
>
> Token -- Is returned unmodified to the client. This is used by
> the client to associate an incoming BackupListResponse
> with its BackupListRequest.
>
> BackupServerList -- ASCII backup servers. Each server name is
> null terminated and up to 16 bytes in length.
>
> "Up to 16 bytes" means "could be less than 16 bytes".
>
