Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 3310] New: SMB2 create context response not correctly dissected

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3310

           Summary: SMB2 create context response not correctly dissected
           Product: Wireshark
           Version: SVN
          Platform: PC
        OS/Version: All
            Status: NEW
          Severity: Major
          Priority: Medium
         Component: Wireshark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: yamisoe@xxxxxxxxx


Build Information:
Version 1.1.3 (SVN Rev 27619)

Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.14.4, with GLib 2.18.2, with libpcap 0.9.8, with libz
1.2.3.3, without POSIX capabilities, without libpcre, without SMI, without
c-ares, without ADNS, without Lua, without GnuTLS, without Gcrypt, without
Kerberos, without GeoIP, without PortAudio, without AirPcap.
NOTE: this build doesn't support the "matches" operator for Wireshark filter
syntax.

Running on Linux 2.6.27-7-generic, with libpcap version 0.9.8.

Built using gcc 4.3.2.
--
1. in sample capture 'durable_open.pcap' packet 610 is malformed.

2. packet 610 is a response to SMB2 CREATE, whose extra info contains
SMB2_CREATE_DURABLE_HANDLE_RESPONSE context. It is this context (DHnQ) not
dissected correctly.

3. I checked the code (packet-smb2.c) and found that
dissect_smb2_create_request/response both use SAME dissector function for
request and response create context data, such as dissect_smb2_DHnQ_buffer().

However, from SMB2 SPEC[1], the create context data in request and response
have different format[2].

To solve this issue, we need to use separated create context data dissectors
for request and response.


[1]
http://download.microsoft.com/download/a/e/6/ae6e4142-aa58-45c6-8dcf-a657e5900cd3/%5BMS-SMB2%5D.pdf

[2] For DHnQ, please see [1]'s page 51(request), 58(response), and note that
the buffer length are 16 and 8.


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.