Wireshark · Ethereal-dev: [Ethereal-dev] packet-smb.c

["Pia Sahlberg" <piabar@xxxxxxxxxxx>]

Hi list,

Third patch for packet-smb.c
This patch require the previous two.
This patch tvbuffifies the SMB QUERY INFORMATION (0x08) call.

best regards
  ronnie sahlberg


_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-smb.c 
ethereal/packet-smb.c
--- ethereal-orig/packet-smb.c	Sat Aug 11 09:27:18 2001
+++ ethereal/packet-smb.c	Sat Aug 11 09:59:33 2001
@@ -53,11 +53,13 @@
#include "packet-smb-pipe.h"
#include "packet-smb-common.h"

+static int not_converted_yet = -1;
+
static int proto_smb = -1;
static int hf_smb_cmd = -1;
static int hf_word_count = -1;
static int hf_byte_count = -1;
-static int hf_dialect_buffer_format = -1;
+static int hf_buffer_format = -1;
static int hf_dialect_name = -1;
static int hf_dialect_index = -1;
static int hf_sm_mode = -1;
@@ -103,11 +105,22 @@
static int hf_system_time_high = -1;
static int hf_server_guid = -1;
static int hf_security_blob = -1;
+static int hf_file_name = -1;
+static int hf_file_attribute_read_only = -1;
+static int hf_file_attribute_hidden = -1;
+static int hf_file_attribute_system = -1;
+static int hf_file_attribute_volume = -1;
+static int hf_file_attribute_directory = -1;
+static int hf_file_attribute_archive = -1;
+static int hf_last_write_date = -1;
+static int hf_last_write_dos_date = -1;
+static int hf_last_write_dos_time = -1;
+static int hf_file_size = -1;

/*xxxxx*/

static gint ett_smb = -1;
-static gint ett_smb_fileattributes = -1;
+static gint ett_smb_file_attributes = -1;
static gint ett_smb_capabilities = -1;
static gint ett_smb_aflags = -1;
static gint ett_smb_dialects = -1;
@@ -129,6 +142,47 @@
static gint ett_smb_time_date = -1;


+static const value_string buffer_format_vals[] = {
+	{1,	"Data Block"},
+	{2,	"Dialect"},
+	{3,	"Pathname"},
+	{4,	"ASCII"},
+	{5,	"Variable Block"},
+	{0,	NULL}
+};
+
+
+#define FILE_ATTRIBUTE_READ_ONLY	0x0001
+#define FILE_ATTRIBUTE_HIDDEN		0x0002
+#define FILE_ATTRIBUTE_SYSTEM		0x0004
+#define FILE_ATTRIBUTE_VOLUME		0x0008
+#define FILE_ATTRIBUTE_DIRECTORY	0x0010
+#define FILE_ATTRIBUTE_ARCHIVE		0x0020
+static const true_false_string tfs_file_attribute_read_only = {
+	"This file is READ ONLY",
+	"This file is NOT read only",
+};
+static const true_false_string tfs_file_attribute_hidden = {
+	"This is a HIDDEN file",
+	"This is NOT a hidden file"
+};
+static const true_false_string tfs_file_attribute_system = {
+	"This is a SYSTEM file",
+	"This is NOT a system file"
+};
+static const true_false_string tfs_file_attribute_volume = {
+	"This is a VOLUME",
+	"This is NOT a volume"
+};
+static const true_false_string tfs_file_attribute_directory = {
+	"This is a DIRECTORY",
+	"This is NOT a directory"
+};
+static const true_false_string tfs_file_attribute_archive = {
+	"This is an ARCHIVE file",
+	"This is NOT an archive file"
+};
+
#define SERVER_CAP_RAW_MODE		0x00000001
#define SERVER_CAP_MPX_MODE		0x00000002
#define SERVER_CAP_UNICODE		0x00000004
@@ -260,6 +314,38 @@

/*xxxxx*/
static int
+dissect_file_attributes(tvbuff_t *tvb, packet_info *pinfo, proto_tree 
*parent_tree, int offset)
+{
+	guint16 mask;
+	proto_item *item = NULL;
+	proto_tree *tree = NULL;
+
+	mask = tvb_get_letohs(tvb, offset);
+
+	if(parent_tree){
+		item = proto_tree_add_text(parent_tree, tvb, offset, 4, "File Attributes: 
0x%04x ", mask);
+		tree = proto_item_add_subtree(item, ett_smb_file_attributes);
+	}
+
+	proto_tree_add_boolean(tree, hf_file_attribute_read_only,
+			tvb, offset, 2, mask);
+	proto_tree_add_boolean(tree, hf_file_attribute_hidden,
+			tvb, offset, 2, mask);
+	proto_tree_add_boolean(tree, hf_file_attribute_system,
+			tvb, offset, 2, mask);
+	proto_tree_add_boolean(tree, hf_file_attribute_volume,
+			tvb, offset, 2, mask);
+	proto_tree_add_boolean(tree, hf_file_attribute_directory,
+			tvb, offset, 2, mask);
+	proto_tree_add_boolean(tree, hf_file_attribute_archive,
+			tvb, offset, 2, mask);
+
+	offset += 2;
+
+	return offset;
+}
+
+static int
dissect_negprot_capabilities(tvbuff_t *tvb, packet_info *pinfo, proto_tree 
*parent_tree, int offset)
{
	guint32 mask;
@@ -269,7 +355,7 @@
	mask = tvb_get_letohl(tvb, offset);

	if(parent_tree){
-		item = proto_tree_add_text(parent_tree, tvb, offset, 4, "Capabilities: 
0x%04x ", mask);
+		item = proto_tree_add_text(parent_tree, tvb, offset, 4, "Capabilities: 
0x%08x ", mask);
		tree = proto_item_add_subtree(item, ett_smb_capabilities);
	}

@@ -316,7 +402,56 @@
}

static int
-dissect_time_date(tvbuff_t *tvb, packet_info *pinfo, proto_tree 
*parent_tree, int offset, char *str, int hf_date, int hf_dos_date, int 
hf_dos_time)
+dissect_smbu_time_date(tvbuff_t *tvb, packet_info *pinfo, proto_tree 
*parent_tree, int offset, char *str, int hf_date, int hf_dos_date, int 
hf_dos_time)
+{
+	guint16 dos_time, dos_date;
+	proto_item *item = NULL;
+	proto_tree *tree = NULL;
+	time_t t;
+	static char td[4+2+2+2+1+10];
+	static char tt[2+2+2+2+1+10];
+	struct timeval tv;
+	struct tm *tm;
+
+	dos_time = tvb_get_letohs(tvb, offset);
+	dos_date = tvb_get_letohs(tvb, offset+2);
+
+	t = (dos_date<<16) + dos_time;
+	tv.tv_sec = t;
+	tv.tv_usec = 0;
+	tm = gmtime(&t);
+
+	if(tm){
+		sprintf(td, "%04d-%02d-%02d",
+			1900+(tm->tm_year), 1+(tm->tm_mon), tm->tm_mday);
+		sprintf(tt, "%02d:%02d:%02d",
+			tm->tm_hour, tm->tm_min, tm->tm_sec);
+	} else {
+		sprintf(td, "Bad date format");
+		tt[0]=0;
+	}
+
+
+	if(parent_tree){
+		item = proto_tree_add_text(parent_tree, tvb, offset, 4, "%s : %s %s", 
str, td, tt);
+		tree = proto_item_add_subtree(item, ett_smb_time_date);
+	}
+
+	if(tm){
+		proto_tree_add_time(tree, hf_date, tvb, offset, 4, &tv);
+
+		proto_tree_add_uint_format(tree, hf_dos_time, tvb, offset, 2, dos_time, 
"SMBU Time: %s (0x%04x)", tt, dos_time);
+
+		proto_tree_add_uint_format(tree, hf_dos_date, tvb, offset+2, 2, dos_date, 
"SMBU Date: %s (0x%04x)", td, dos_date);
+	}
+
+	offset += 4;
+
+	return offset;
+}
+
+static int
+dissect_dos_time_date(tvbuff_t *tvb, packet_info *pinfo, proto_tree 
*parent_tree, int offset, char *str, int hf_date, int hf_dos_date, int 
hf_dos_time)
{
	guint16 dos_time, dos_date;
	proto_item *item = NULL;
@@ -337,7 +472,6 @@
	tm.tm_year = ((dos_date>>9)&0x7f)+1980;

	t = mktime(&tm);
-
	tv.tv_sec = t;
	tv.tv_usec = 0;

@@ -459,7 +593,7 @@
		}

		/* buffer format */
-		proto_tree_add_uint(dtr, hf_dialect_buffer_format, tvb, offset, 1, 
tvb_get_guint8(tvb, offset));
+		proto_tree_add_uint(dtr, hf_buffer_format, tvb, offset, 1, 
tvb_get_guint8(tvb, offset));
		offset += 1;
		bc -= 1;

@@ -545,7 +679,7 @@
		offset += 4;

		/* current time and date at server */
-		offset = dissect_time_date(tvb, pinfo, tree, offset, "Current Time and 
Date at server", hf_current_server_date, hf_current_server_dos_date, 
hf_current_server_dos_time);
+		offset = dissect_dos_time_date(tvb, pinfo, tree, offset, "Current Time 
and Date at server", hf_current_server_date, hf_current_server_dos_date, 
hf_current_server_dos_time);

		/* time zone */
		tz = tvb_get_letohs(tvb, offset);
@@ -683,8 +817,58 @@
}


-/*xxxxx*/
+static int
+dissect_smb_query_information_request(tvbuff_t *tvb, packet_info *pinfo, 
proto_tree *tree)
+{
+	int offset = 0;
+
+	/* word count */
+	proto_tree_add_uint(tree, hf_word_count, tvb, offset, 1, 
tvb_get_guint8(tvb, offset));
+	offset += 1;
+
+	/* byte count */
+	proto_tree_add_uint(tree, hf_byte_count, tvb, offset, 2, 
tvb_get_letohs(tvb, offset));
+	offset += 2;

+	/* buffer format */
+	proto_tree_add_uint(tree, hf_buffer_format, tvb, offset, 1, 
tvb_get_guint8(tvb, offset));
+	offset += 1;
+
+	/* file name */
+	offset = dissect_ascii_or_unicode_string(tvb, pinfo, tree, offset, 
hf_file_name);
+
+	return offset;
+}
+
+static int
+dissect_smb_query_information_response(tvbuff_t *tvb, packet_info *pinfo, 
proto_tree *tree)
+{
+	int offset = 0;
+
+	/* word count */
+	proto_tree_add_uint(tree, hf_word_count, tvb, offset, 1, 
tvb_get_guint8(tvb, offset));
+	offset += 1;
+
+	/* file attributes */
+	offset = dissect_file_attributes(tvb, pinfo, tree, offset);
+
+	/* last write time */
+	offset = dissect_smbu_time_date(tvb, pinfo, tree, offset, "Last Write 
Time", hf_last_write_date, hf_last_write_dos_date, hf_last_write_dos_time);
+
+	/* file size */
+	proto_tree_add_uint(tree, hf_file_size, tvb, offset, 4, 
tvb_get_letohl(tvb, offset));
+	offset += 4;
+
+	/* 10 reserved bytes */
+	proto_tree_add_bytes(tree, hf_reserved, tvb, offset, 10, tvb_get_ptr(tvb, 
offset, 10));
+	offset += 10;
+
+	/* byte count */
+	proto_tree_add_uint(tree, hf_byte_count, tvb, offset, 2, 
tvb_get_letohs(tvb, offset));
+	offset += 2;
+
+	return offset;
+}

typedef struct _smb_function {
	int (*request)(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
@@ -700,7 +884,7 @@
/* 0x05 */  {NULL, NULL},
/* 0x06 */  {NULL, NULL},
/* 0x07 */  {NULL, NULL},
-/* 0x08 */  {NULL, NULL},
+/* 0x08 */  
{dissect_smb_query_information_request,	dissect_smb_query_information_response},
/* 0x09 */  {NULL, NULL},
/* 0x0a */  {NULL, NULL},
/* 0x0b */  {NULL, NULL},
@@ -1358,6 +1542,7 @@
struct tm *_gtime; /* Add leading underscore ("_") to prevent symbol
                      conflict with /usr/include/time.h on some NetBSD
                      systems */
+
static char *
dissect_smbu_date(guint16 date, guint16 time)

@@ -1377,7 +1562,6 @@

}

-
/*
 * Relies on time
 */
@@ -1727,7 +1911,7 @@
      if (tree) {

	ti = proto_tree_add_text(tree, NullTVB, offset, 2, "Attributes: 0x%02x", 
Attributes);
-	Attributes_tree = proto_item_add_subtree(ti, ett_smb_fileattributes);
+	Attributes_tree = proto_item_add_subtree(ti, ett_smb_file_attributes);
	proto_tree_add_text(Attributes_tree, NullTVB, offset, 2, "%s",
			    decode_boolean_bitfield(Attributes, 0x01, 16, "Read-only file", "Not 
a read-only file"));
	proto_tree_add_text(Attributes_tree, NullTVB, offset, 2, "%s",
@@ -2592,7 +2776,7 @@
      if (tree) {

	ti = proto_tree_add_text(tree, NullTVB, offset, 2, "Attributes: 0x%02x", 
Attributes);
-	Attributes_tree = proto_item_add_subtree(ti, ett_smb_fileattributes);
+	Attributes_tree = proto_item_add_subtree(ti, ett_smb_file_attributes);
	proto_tree_add_text(Attributes_tree, NullTVB, offset, 2, "%s",
			    decode_boolean_bitfield(Attributes, 0x01, 16, "Read-only file", "Not 
a read-only file"));
	proto_tree_add_text(Attributes_tree, NullTVB, offset, 2, "%s",
@@ -4387,7 +4571,7 @@
      if (tree) {

	ti = proto_tree_add_text(tree, NullTVB, offset, 2, "FileAttributes: 
0x%02x", FileAttributes);
-	FileAttributes_tree = proto_item_add_subtree(ti, ett_smb_fileattributes);
+	FileAttributes_tree = proto_item_add_subtree(ti, ett_smb_file_attributes);
	proto_tree_add_text(FileAttributes_tree, NullTVB, offset, 2, "%s",
			    decode_boolean_bitfield(FileAttributes, 0x01, 16, "Read only file", 
"Not a read only file"));
	proto_tree_add_text(FileAttributes_tree, NullTVB, offset, 2, "%s",
@@ -7290,7 +7474,7 @@
    if (tree) {

      ti = proto_tree_add_text(tree, NullTVB, offset, 2, "Attributes: 
0x%02x", Attributes);
-      Attributes_tree = proto_item_add_subtree(ti, ett_smb_fileattributes);
+      Attributes_tree = proto_item_add_subtree(ti, 
ett_smb_file_attributes);
      proto_tree_add_text(Attributes_tree, NullTVB, offset, 2, "%s",
                          decode_boolean_bitfield(Attributes, 0x01, 16, 
"Read-only file", "Not a read-only file"));
      proto_tree_add_text(Attributes_tree, NullTVB, offset, 2, "%s",
@@ -8246,233 +8430,6 @@
}

void
-dissect_get_file_attr_smb(const u_char *pd, int offset, frame_data *fd, 
proto_tree *parent, proto_tree *tree, struct smb_info si, int max_data, int 
SMB_offset, int errcode)
-
-{
-  proto_tree    *Attributes_tree;
-  proto_item    *ti;
-  guint8        WordCount;
-  guint8        BufferFormat;
-  guint32       FileSize;
-  guint16       Reserved5;
-  guint16       Reserved4;
-  guint16       Reserved3;
-  guint16       Reserved2;
-  guint16       Reserved1;
-  guint16       LastWriteTime;
-  guint16       LastWriteDate;
-  guint16       ByteCount;
-  guint16       Attributes;
-  const char    *FileName;
-
-  if (si.request) {
-    /* Request(s) dissect code */
-
-    /* Build display for: Word Count (WCT) */
-
-    WordCount = GBYTE(pd, offset);
-
-    if (tree) {
-
-      proto_tree_add_text(tree, NullTVB, offset, 1, "Word Count (WCT): %u", 
WordCount);
-
-    }
-
-    offset += 1; /* Skip Word Count (WCT) */
-
-    /* Build display for: Byte Count (BCC) */
-
-    ByteCount = GSHORT(pd, offset);
-
-    if (tree) {
-
-      proto_tree_add_text(tree, NullTVB, offset, 2, "Byte Count (BCC): %u", 
ByteCount);
-
-    }
-
-    offset += 2; /* Skip Byte Count (BCC) */
-
-    /* Build display for: Buffer Format */
-
-    BufferFormat = GBYTE(pd, offset);
-
-    if (tree) {
-
-      proto_tree_add_text(tree, NullTVB, offset, 1, "Buffer Format: %u", 
BufferFormat);
-
-    }
-
-    offset += 1; /* Skip Buffer Format */
-
-    /* Build display for: File Name */
-
-    FileName = pd + offset;
-
-    if (tree) {
-
-      proto_tree_add_text(tree, NullTVB, offset, strlen(FileName) + 1, 
"File Name: %s", FileName);
-
-    }
-
-    offset += strlen(FileName) + 1; /* Skip File Name */
-
-  } else {
-    /* Response(s) dissect code */
-
-    /* Build display for: Word Count (WCT) */
-
-    WordCount = GBYTE(pd, offset);
-
-    if (tree) {
-
-      proto_tree_add_text(tree, NullTVB, offset, 1, "Word Count (WCT): %u", 
WordCount);
-
-    }
-
-    offset += 1; /* Skip Word Count (WCT) */
-
-    if (WordCount > 0) {
-
-      /* Build display for: Attributes */
-
-      Attributes = GSHORT(pd, offset);
-
-      if (tree) {
-
-	ti = proto_tree_add_text(tree, NullTVB, offset, 2, "Attributes: 0x%02x", 
Attributes);
-	Attributes_tree = proto_item_add_subtree(ti, ett_smb_fileattributes);
-	proto_tree_add_text(Attributes_tree, NullTVB, offset, 2, "%s",
-			    decode_boolean_bitfield(Attributes, 0x01, 16, "Read-only file", "Not 
a read-only file"));
-	proto_tree_add_text(Attributes_tree, NullTVB, offset, 2, "%s",
-			    decode_boolean_bitfield(Attributes, 0x02, 16, "Hidden file", "Not a 
hidden file"));
-	proto_tree_add_text(Attributes_tree, NullTVB, offset, 2, "%s",
-			    decode_boolean_bitfield(Attributes, 0x04, 16, "System file", "Not a 
system file"));
-	proto_tree_add_text(Attributes_tree, NullTVB, offset, 2, "%s",
-			    decode_boolean_bitfield(Attributes, 0x08, 16, " Volume", "Not a 
volume"));
-	proto_tree_add_text(Attributes_tree, NullTVB, offset, 2, "%s",
-			    decode_boolean_bitfield(Attributes, 0x10, 16, " Directory", "Not a 
directory"));
-	proto_tree_add_text(Attributes_tree, NullTVB, offset, 2, "%s",
-			    decode_boolean_bitfield(Attributes, 0x20, 16, " Archived", "Not 
archived"));
-
-      }
-
-      offset += 2; /* Skip Attributes */
-
-      /* Build display for: Last Write Time */
-
-      LastWriteTime = GSHORT(pd, offset);
-
-      if (tree) {
-
-      }
-
-      offset += 2; /* Skip Last Write Time */
-
-      /* Build display for: Last Write Date */
-
-      LastWriteDate = GSHORT(pd, offset);
-
-      if (tree) {
-
-	proto_tree_add_text(tree, NullTVB, offset, 2, "Last Write Date: %s", 
dissect_smbu_date(LastWriteDate, LastWriteTime));
-
-	proto_tree_add_text(tree, NullTVB, offset - 2, 2, "Last Write Time: %s", 
dissect_smbu_time(LastWriteDate, LastWriteTime));
-
-      }
-
-      offset += 2; /* Skip Last Write Date */
-
-      /* Build display for: File Size */
-
-      FileSize = GWORD(pd, offset);
-
-      if (tree) {
-
-	proto_tree_add_text(tree, NullTVB, offset, 4, "File Size: %u", FileSize);
-
-      }
-
-      offset += 4; /* Skip File Size */
-
-      /* Build display for: Reserved 1 */
-
-      Reserved1 = GSHORT(pd, offset);
-
-      if (tree) {
-
-	proto_tree_add_text(tree, NullTVB, offset, 2, "Reserved 1: %u", 
Reserved1);
-
-      }
-
-      offset += 2; /* Skip Reserved 1 */
-
-      /* Build display for: Reserved 2 */
-
-      Reserved2 = GSHORT(pd, offset);
-
-      if (tree) {
-
-	proto_tree_add_text(tree, NullTVB, offset, 2, "Reserved 2: %u", 
Reserved2);
-
-      }
-
-      offset += 2; /* Skip Reserved 2 */
-
-      /* Build display for: Reserved 3 */
-
-      Reserved3 = GSHORT(pd, offset);
-
-      if (tree) {
-
-	proto_tree_add_text(tree, NullTVB, offset, 2, "Reserved 3: %u", 
Reserved3);
-
-      }
-
-      offset += 2; /* Skip Reserved 3 */
-
-      /* Build display for: Reserved 4 */
-
-      Reserved4 = GSHORT(pd, offset);
-
-      if (tree) {
-
-	proto_tree_add_text(tree, NullTVB, offset, 2, "Reserved 4: %u", 
Reserved4);
-
-      }
-
-      offset += 2; /* Skip Reserved 4 */
-
-      /* Build display for: Reserved 5 */
-
-      Reserved5 = GSHORT(pd, offset);
-
-      if (tree) {
-
-	proto_tree_add_text(tree, NullTVB, offset, 2, "Reserved 5: %u", 
Reserved5);
-
-      }
-
-      offset += 2; /* Skip Reserved 5 */
-
-    }
-
-    /* Build display for: Byte Count (BCC) */
-
-    ByteCount = GSHORT(pd, offset);
-
-    if (tree) {
-
-      proto_tree_add_text(tree, NullTVB, offset, 2, "Byte Count (BCC): %u", 
ByteCount);
-
-    }
-
-    offset += 2; /* Skip Byte Count (BCC) */
-
-  }
-
-}
-
-void
dissect_read_file_smb(const u_char *pd, int offset, frame_data *fd, 
proto_tree *parent, proto_tree *tree, struct smb_info si, int max_data, int 
SMB_offset, int errcode)

{
@@ -10529,7 +10486,7 @@
  dissect_flush_file_smb,   /* SMBflush flush a file */
  dissect_delete_file_smb,  /* SMBunlink delete a file */
  dissect_rename_file_smb,  /* SMBmv rename a file */
-  dissect_get_file_attr_smb,/* SMBgetatr get file attributes */
+  dissect_unknown_smb,
  dissect_set_file_attr_smb,/* SMBsetatr set file attributes */
  dissect_read_file_smb,    /* SMBread read from a file */
  dissect_write_file_smb,   /* SMBwrite write to a file */
@@ -11270,6 +11227,9 @@
		}
		(*new_dissector)(next_tvb, &pi, cmd_tree);
	} else {
+		/* just so its easy to find unconverted packets in a capture*/
+		proto_tree_add_item_hidden(tree, not_converted_yet, NullTVB, 0, 0, TRUE);
+
		/* call old dissector */
		(dissect[cmd])(pd, offset, fd, tree, tree, si, max_data,
			       SMB_offset, errcode);
@@ -11289,6 +11249,10 @@
proto_register_smb(void)
{
	static hf_register_info hf[] = {
+	  { &not_converted_yet,
+		{ "", "smb.not_converted_yet", FT_NONE, BASE_NONE,
+		NULL, 0, "dummy to indicate which packets are not tvbuffified yet", HFILL 
}},
+
	  { &hf_smb_cmd,
	    { "SMB Command", "smb.cmd", FT_UINT8, BASE_HEX,
	    NULL, 0x0, "SMB Command", HFILL }},
@@ -11301,9 +11265,9 @@
		{ "Byte Count", "smb.byte_count", FT_UINT16, BASE_DEC,
		NULL, 0, "SMB Byte Count", HFILL }},

-	  { &hf_dialect_buffer_format,
-		{ "Buffer Format", "smb.dialect.buffer_format", FT_UINT8, BASE_HEX,
-		NULL, 0, "Buffer Format for this dialect", HFILL }},
+	  { &hf_buffer_format,
+		{ "Buffer Format", "smb.buffer_format", FT_UINT8, BASE_HEX,
+		VALS(buffer_format_vals), 0, "Buffer Format", HFILL }},

	  { &hf_dialect_name,
		{ "Name", "smb.dialect.name", FT_STRING, BASE_NONE,
@@ -11485,11 +11449,56 @@
		{ "Security Blob", "smb.security.blob", FT_BYTES, BASE_HEX,
		NULL, 0, "Security blob", HFILL }},

+	  { &hf_file_name,
+		{ "File Name", "smb.file_name", FT_STRING, BASE_NONE,
+		NULL, 0, "SMB File Name", HFILL }},
+
+	  { &hf_file_attribute_read_only,
+		{ "Read Only", "smb.file.attribute.read_only", FT_BOOLEAN, 16,
+		TFS(&tfs_file_attribute_read_only), FILE_ATTRIBUTE_READ_ONLY, "READ ONLY 
file attribute", HFILL }},
+
+	  { &hf_file_attribute_hidden,
+		{ "Hidden", "smb.file.attribute.hidden", FT_BOOLEAN, 16,
+		TFS(&tfs_file_attribute_hidden), FILE_ATTRIBUTE_HIDDEN, "HIDDEN file 
attribute", HFILL }},
+
+	  { &hf_file_attribute_system,
+		{ "System", "smb.file.attribute.system", FT_BOOLEAN, 16,
+		TFS(&tfs_file_attribute_system), FILE_ATTRIBUTE_SYSTEM, "SYSTEM file 
attribute", HFILL }},
+
+	  { &hf_file_attribute_volume,
+		{ "Volume", "smb.file.attribute.volume", FT_BOOLEAN, 16,
+		TFS(&tfs_file_attribute_volume), FILE_ATTRIBUTE_VOLUME, "VOLUME file 
attribute", HFILL }},
+
+	  { &hf_file_attribute_directory,
+		{ "Directory", "smb.file.attribute.directory", FT_BOOLEAN, 16,
+		TFS(&tfs_file_attribute_directory), FILE_ATTRIBUTE_DIRECTORY, "DIRECTORY 
file attribute", HFILL }},
+
+	  { &hf_file_attribute_archive,
+		{ "Archive", "smb.file.attribute.archive", FT_BOOLEAN, 16,
+		TFS(&tfs_file_attribute_archive), FILE_ATTRIBUTE_ARCHIVE, "ARCHIVE file 
attribute", HFILL }},
+
+	  { &hf_last_write_date,
+		{ "Last Write", "smb.last_write.date", FT_ABSOLUTE_TIME, BASE_NONE,
+		NULL, 0, "Last Write time", HFILL }},
+
+	  { &hf_last_write_dos_date,
+		{ "Last Write Date", "smb.last_write.dos.date", FT_UINT16, BASE_HEX,
+		NULL, 0, "Last Write date, SMBU format", HFILL }},
+
+	  { &hf_last_write_dos_time,
+		{ "Last Write Time", "smb.last_write.dos.time", FT_UINT16, BASE_HEX,
+		NULL, 0, "Last Write time, SMBU format", HFILL }},
+
+	  { &hf_file_size,
+		{ "File Size", "smb.file.size", FT_UINT32, BASE_DEC,
+		NULL, 0, "File Size", HFILL }},
+
+
/*xxxxx*/
	};
	static gint *ett[] = {
		&ett_smb,
-		&ett_smb_fileattributes,
+		&ett_smb_file_attributes,
		&ett_smb_capabilities,
		&ett_smb_aflags,
		&ett_smb_dialects,
@@ -11523,3 +11532,4 @@
	register_proto_smb_mailslot();
	register_proto_smb_pipe();
}
+