/* packet-netbios.c

 * Routines for NetBIOS protocol packet disassembly

 * Jeff Foster <jfoste@woodward.com>

 * Copyright 1999 Jeffrey C. Foster

 *

 * derived from the packet-nbns.c

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/capture_dissectors.h>

#include <epan/llcsaps.h>

#include <epan/reassemble.h>

#include <epan/prefs.h>

#include <epan/expert.h>

#include <epan/tfs.h>

#include <wsutil/array.h>

#include "packet-netbios.h"

void proto_register_netbios(void);

void proto_reg_handoff_netbios(void);

static dissector_handle_t netbios_handle;

static capture_dissector_handle_t netbios_cap_handle;

/* Netbios command numbers */

#define NB_ADD_GROUP    0x00

#define NB_ADD_NAME   0x01

#define NB_NAME_IN_CONFLICT 0x02

#define NB_STATUS_QUERY   0x03

#define NB_TERMINATE_TRACE_R  0x07

#define NB_DATAGRAM   0x08

#define NB_DATAGRAM_BCAST 0x09

#define NB_NAME_QUERY   0x0a

#define NB_ADD_NAME_RESP  0x0d

#define NB_NAME_RESP    0x0e

#define NB_STATUS_RESP    0x0f

#define NB_TERMINATE_TRACE_LR 0x13

#define NB_DATA_ACK   0x14

#define NB_DATA_FIRST_MIDDLE  0x15

#define NB_DATA_ONLY_LAST 0x16

#define NB_SESSION_CONFIRM  0x17

#define NB_SESSION_END    0x18

#define NB_SESSION_INIT   0x19

#define NB_NO_RECEIVE   0x1a

#define NB_RECEIVE_OUTSTANDING  0x1b

#define NB_RECEIVE_CONTINUE 0x1c

#define NB_KEEP_ALIVE   0x1f

/* Offsets of fields in the NetBIOS header. */

#define NB_LENGTH    0

#define NB_DELIMITER     2

#define NB_COMMAND     4

#define NB_FLAGS     5

#define NB_DATA1     5

#define NB_RESYNC    6

#define NB_DATA2     6

#define NB_CALL_NAME_TYPE  7

#define NB_XMIT_CORL     8

#define NB_RESP_CORL    10

#define NB_RMT_SES    12

#define NB_LOCAL_SES    13

#define NB_RECVER_NAME    12

#define NB_SENDER_NAME    28

static int proto_netbios;

static int hf_netb_cmd;

static int hf_netb_hdr_len;

static int hf_netb_delimiter;

static int hf_netb_xmit_corrl;

static int hf_netb_resp_corrl;

static int hf_netb_call_name_type;

static int hf_netb_version;

static int hf_netbios_no_receive_flags;

static int hf_netbios_no_receive_flags_send_no_ack;

static int hf_netb_largest_frame;

static int hf_netb_nb_name;

static int hf_netb_nb_name_type;

static int hf_netb_status_buffer_len;

static int hf_netb_status;

static int hf_netb_name_type;

static int hf_netb_max_data_recv_size;

static int hf_netb_termination_indicator;

static int hf_netb_num_data_bytes_accepted;

static int hf_netb_local_ses_no;

static int hf_netb_remote_ses_no;

static int hf_netb_flags;

static int hf_netb_flags_send_no_ack;

static int hf_netb_flags_ack;

static int hf_netb_flags_ack_with_data;

static int hf_netb_flags_ack_expected;

static int hf_netb_flags_recv_cont_req;

static int hf_netb_data2;

static int hf_netb_data2_frame;

static int hf_netb_data2_user;

static int hf_netb_data2_status;

static int hf_netb_datagram_mac;

static int hf_netb_datagram_bcast_mac;

static int hf_netb_resync_indicator;

static int hf_netb_status_request;

static int hf_netb_local_session_no;

static int hf_netb_state_of_name;

static int hf_netb_status_response;

static int hf_netb_fragments;

static int hf_netb_fragment;

static int hf_netb_fragment_overlap;

static int hf_netb_fragment_overlap_conflict;

static int hf_netb_fragment_multiple_tails;

static int hf_netb_fragment_too_long_fragment;

static int hf_netb_fragment_error;

static int hf_netb_fragment_count;

static int hf_netb_reassembled_length;

static int ett_netb;

static int ett_netb_name;

static int ett_netb_flags;

static int ett_netb_status;

static int ett_netb_fragments;

static int ett_netb_fragment;

static expert_field ei_netb_unknown_command_data;

static const fragment_items netbios_frag_items = {

  &ett_netb_fragment,

  &ett_netb_fragments,

  &hf_netb_fragments,

  &hf_netb_fragment,

  &hf_netb_fragment_overlap,

  &hf_netb_fragment_overlap_conflict,

  &hf_netb_fragment_multiple_tails,

  &hf_netb_fragment_too_long_fragment,

  &hf_netb_fragment_error,

  &hf_netb_fragment_count,

  NULL,

  &hf_netb_reassembled_length,

  /* Reassembled data field */

  NULL,

  "fragments"

};

/* The strings for the station type, used by get_netbios_name function;

   many of them came from the file "NetBIOS.txt" in the Zip archive at

  http://www.net3group.com/ftp/browser.zip

 */

static const value_string nb_name_type_vals[] = {

  {0x00,  "Workstation/Redirector"},

  {0x01,  "Browser"},

  {0x02,  "Workstation/Redirector"},

    /* not sure what 0x02 is, I'm seeing a lot of them however */

    /* I'm seeing them with workstation/redirection host

      announcements */

  {0x03,  "Messenger service/Main name"},

  {0x05,  "Forwarded name"},

  {0x06,  "RAS Server service"},

  {0x1b,  "Domain Master Browser"},

  {0x1c,  "Domain Controllers"},

  {0x1d,  "Local Master Browser"},

  {0x1e,  "Browser Election Service"},

  {0x1f,  "Net DDE Service"},

  {0x20,  "Server service"},

  {0x21,  "RAS client service"},

  {0x22,  "Exchange Interchange (MSMail Connector)"},

  {0x23,  "Exchange Store"},

  {0x24,  "Exchange Directory"},

  {0x2b,  "Lotus Notes Server service"},

  {0x30,  "Modem sharing server service"},

  {0x31,  "Modem sharing client service"},

  {0x43,  "SMS Clients Remote Control"},

  {0x44,  "SMS Administrators Remote Control Tool"},

  {0x45,  "SMS Clients Remote Chat"},

  {0x46,  "SMS Clients Remote Transfer"},

  {0x4c,  "DEC Pathworks TCP/IP Service on Windows NT"},

  {0x52,  "DEC Pathworks TCP/IP Service on Windows NT"},

  {0x6a,  "Microsoft Exchange IMC"},

  {0x87,  "Microsoft Exchange MTA"},

  {0xbe,  "Network Monitor Agent"},

  {0xbf,  "Network Monitor Analyzer"},

  {0x00,  NULL}

};

static value_string_ext nb_name_type_vals_ext = VALUE_STRING_EXT_INIT(nb_name_type_vals);

/* Table for reassembly of fragments. */

static reassembly_table netbios_reassembly_table;

/* defragmentation of NetBIOS Frame */

static bool netbios_defragment = true;

/* See

  http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/BK8P7001/CCONTENTS

   and

  http://ourworld.compuserve.com/homepages/TimothyDEvans/contents.htm

   for information about the NetBIOS Frame Protocol (which is what this

   module dissects). */

/* the strings for the command types  */

static const value_string cmd_vals[] = {

  { NB_ADD_GROUP,     "Add Group Name Query" },

  { NB_ADD_NAME,      "Add Name Query" },

  { NB_NAME_IN_CONFLICT,    "Name In Conflict" },

  { NB_STATUS_QUERY,    "Status Query" },

  { NB_TERMINATE_TRACE_R,   "Terminate Trace" },

  { NB_DATAGRAM,      "Datagram" },

  { NB_DATAGRAM_BCAST,    "Broadcast Datagram" },

  { NB_NAME_QUERY,    "Name Query" },

  { NB_ADD_NAME_RESP,   "Add Name Response" },

  { NB_NAME_RESP,     "Name Recognized" },

  { NB_STATUS_RESP,   "Status Response" },

  { NB_TERMINATE_TRACE_LR,  "Terminate Trace" },

  { NB_DATA_ACK,      "Data Ack" },

  { NB_DATA_FIRST_MIDDLE,   "Data First Middle" },

  { NB_DATA_ONLY_LAST,    "Data Only Last" },

  { NB_SESSION_CONFIRM,   "Session Confirm" },

  { NB_SESSION_END,   "Session End" },

  { NB_SESSION_INIT,    "Session Initialize" },

  { NB_NO_RECEIVE,    "No Receive" },

  { NB_RECEIVE_OUTSTANDING, "Receive Outstanding" },

  { NB_RECEIVE_CONTINUE,    "Receive Continue" },

  { NB_KEEP_ALIVE,    "Session Alive" },

  { 0,        NULL }

};

static value_string_ext cmd_vals_ext = VALUE_STRING_EXT_INIT(cmd_vals);

static const value_string name_types[] = {

  { 0, "Unique name" },

  { 1, "Group name" },

  { 0, NULL }

};

static const true_false_string netb_version_str = {

  "2.00 or higher",

  "1.xx"

};

static const value_string termination_indicator_vals[] = {

  { 0x0000, "Normal session end" },

  { 0x0001, "Abnormal session end" },

  { 0,      NULL }

};

static const value_string status_vals[] = {

  { 0, "Add name not in process" },

  { 1, "Add name in process" },

  { 0, NULL }

};

static const value_string max_frame_size_vals[] = {

  { 0,  "516" },

  { 1,  "1500" },

  { 2,  "2052" },

  { 3,  "4472" },

  { 4,  "8144" },

  { 5,  "11407" },

  { 6,  "17800" },  /* 17800 in TR spec, 17749 in NBF spec */

  { 7,  "65535" },

  { 0,  NULL }

};

static bool

capture_netbios(const unsigned char *pd _U_, int offset _U_, int len _U_, capture_packet_info_t *cpinfo, const union wtap_pseudo_header *pseudo_header _U_)

{

  capture_dissector_increment_count(cpinfo, proto_netbios);

  return true;

}

int

process_netbios_name(const unsigned char *name_ptr, char *name_ret, int name_ret_len)

{

  int    i;

  int    name_type = *(name_ptr + NETBIOS_NAME_LEN - 1);

  unsigned char name_char;

  char  *name_ret_orig = name_ret;

  static const char hex_digits[16] = {'0','1','2','3','4','5','6','7','8','9','a','b','c','d','e','f'};

  for (i = 0; i < NETBIOS_NAME_LEN - 1; i++) {

    name_char = *name_ptr++;

    if (name_char >= ' ' && name_char <= '~') {

      if (--name_ret_len > 0)

        *name_ret++ = name_char;

    } else {

      /* It's not printable; show it as <XX>, where

         XX is the value in hex. */

      if (--name_ret_len > 0)

        *name_ret++ = '<';

      if (--name_ret_len > 0)

        *name_ret++ = hex_digits[(name_char >> 4)];

      if (--name_ret_len > 0)

        *name_ret++ = hex_digits[(name_char & 0x0F)];

      if (--name_ret_len > 0)

        *name_ret++ = '>';

    }

  }

  *name_ret = '\0';

  /* Remove trailing space characters from name. */

  name_ret--;

  while (name_ret >= name_ret_orig) {

    if (*name_ret != ' ') {

      *(name_ret + 1) = 0;

      break;

    }

    name_ret--;

  }

  return name_type;

}

int

get_netbios_name( tvbuff_t *tvb, int offset, char *name_ret, int name_ret_len)

{/*  Extract the name string and name type.  Return the name string in  */

 /* name_ret and return the name_type. */

  return process_netbios_name( tvb_get_ptr( tvb, offset, NETBIOS_NAME_LEN ), name_ret, name_ret_len);

}

/*

 * Get a string describing the type of a NetBIOS name.

 */

const char *

netbios_name_type_descr(int name_type)

{

  return val_to_str_ext_const(name_type, &nb_name_type_vals_ext, "Unknown");

}

void

netbios_add_name(const char* label, tvbuff_t *tvb, int offset, proto_tree *tree)

{/* add a name field display tree. Display the name and station type in sub-tree */

  proto_tree *field_tree;

  char        name_str[(NETBIOS_NAME_LEN - 1)*4 + 1];

  int         name_type;

  const char *name_type_str;

          /* decode the name field */

  name_type = get_netbios_name( tvb, offset, name_str, (NETBIOS_NAME_LEN - 1)*4 + 1);

  name_type_str = netbios_name_type_descr(name_type);

  field_tree = proto_tree_add_subtree_format( tree, tvb, offset, NETBIOS_NAME_LEN,

      ett_netb_name, NULL, "%s: %s<%02x> (%s)", label, name_str, name_type, name_type_str);

  proto_tree_add_string_format( field_tree, hf_netb_nb_name, tvb, offset,

    15, name_str, "%s", name_str);

  proto_tree_add_uint_format( field_tree, hf_netb_nb_name_type, tvb, offset + 15, 1, name_type,

    "0x%02x (%s)", name_type, name_type_str);

}

static void

netbios_data_first_middle_flags( tvbuff_t *tvb, proto_tree *tree, int offset)

{

  proto_tree *field_tree;

  proto_item *tf;

    /* decode the flag field for Data First Middle packet*/

  tf = proto_tree_add_item(tree, hf_netb_flags, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  field_tree = proto_item_add_subtree(tf, ett_netb_flags);

  proto_tree_add_item( field_tree, hf_netb_flags_ack, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  proto_tree_add_item( field_tree, hf_netb_flags_ack_expected, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  proto_tree_add_item( field_tree, hf_netb_flags_recv_cont_req, tvb, offset, 1, ENC_LITTLE_ENDIAN);

}

static void

netbios_data_only_flags( tvbuff_t *tvb, proto_tree *tree, int offset)

{

  proto_tree *field_tree;

  proto_item *tf;

  /* decode the flag field for Data Only Last packet*/

  tf = proto_tree_add_item(tree, hf_netb_flags, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  field_tree = proto_item_add_subtree(tf, ett_netb_flags);

  proto_tree_add_item( field_tree, hf_netb_flags_ack, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  proto_tree_add_item( field_tree, hf_netb_flags_ack_with_data, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  proto_tree_add_item( field_tree, hf_netb_flags_ack_expected, tvb, offset, 1, ENC_LITTLE_ENDIAN);

}

static void

netbios_add_ses_confirm_flags( tvbuff_t *tvb, proto_tree *tree, int offset)

{

  proto_tree *field_tree;

  proto_item *tf;

  /* decode the flag field for Session Confirm packet */

  tf = proto_tree_add_item(tree, hf_netb_flags, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  field_tree = proto_item_add_subtree( tf, ett_netb_flags);

  proto_tree_add_item( field_tree, hf_netb_flags_send_no_ack, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  proto_tree_add_item( field_tree, hf_netb_version, tvb, offset, 1, ENC_LITTLE_ENDIAN);

}

static void

netbios_add_session_init_flags( tvbuff_t *tvb, proto_tree *tree, int offset)

{

  proto_tree *field_tree;

  proto_item *tf;

  /* decode the flag field for Session Init packet */

  tf = proto_tree_add_item(tree, hf_netb_flags, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  field_tree = proto_item_add_subtree(tf, ett_netb_flags);

  proto_tree_add_item( field_tree, hf_netb_flags_send_no_ack, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  proto_tree_add_item( field_tree, hf_netb_largest_frame, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  proto_tree_add_item( field_tree, hf_netb_version, tvb, offset, 1, ENC_LITTLE_ENDIAN);

}

static void

netbios_no_receive_flags( tvbuff_t *tvb, proto_tree *tree, int offset)

{

  proto_tree *field_tree;

  proto_item *tf;

  /* decode the flag field for No Receive packet*/

  tf = proto_tree_add_item(tree, hf_netbios_no_receive_flags, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  field_tree = proto_item_add_subtree(tf, ett_netb_flags);

  proto_tree_add_item(field_tree, hf_netbios_no_receive_flags_send_no_ack, tvb, offset, 1, ENC_LITTLE_ENDIAN);

}

/************************************************************************/

/*                  */

/*  The routines to display the netbios field values in the tree  */

/*                  */

/************************************************************************/

static void

nb_xmit_corrl( tvbuff_t *tvb, int offset, proto_tree *tree)

{/* display the transmit correlator */

  proto_tree_add_item( tree, hf_netb_xmit_corrl, tvb, offset + NB_XMIT_CORL,

    2, ENC_LITTLE_ENDIAN);

}

static void

nb_resp_corrl( tvbuff_t *tvb, int offset, proto_tree *tree)

{/* display the response correlator */

  proto_tree_add_item( tree, hf_netb_resp_corrl, tvb, offset + NB_RESP_CORL,

    2, ENC_LITTLE_ENDIAN);

}

static void

nb_call_name_type( tvbuff_t *tvb, int offset, proto_tree *tree)

{/* display the call name type */

  proto_tree_add_item( tree, hf_netb_call_name_type, tvb, offset + NB_CALL_NAME_TYPE,

    1, ENC_LITTLE_ENDIAN);

}

static uint8_t

nb_local_session( tvbuff_t *tvb, int offset, proto_tree *tree)

{/* add the local session to tree, and return its value */

  uint8_t local_session = tvb_get_uint8( tvb, offset + NB_LOCAL_SES);

  proto_tree_add_uint( tree, hf_netb_local_ses_no, tvb, offset + NB_LOCAL_SES, 1,

    local_session);

  return local_session;

}

static uint8_t

nb_remote_session( tvbuff_t *tvb, int offset, proto_tree *tree)

{/* add the remote session to tree, and return its value */

  uint8_t remote_session = tvb_get_uint8( tvb, offset + NB_RMT_SES);

  proto_tree_add_uint( tree, hf_netb_remote_ses_no, tvb, offset + NB_RMT_SES, 1,

    remote_session);

  return remote_session;

}

static void

nb_data1(int hf, tvbuff_t *tvb, int offset, proto_tree *tree)

{/* add the DATA1 to tree with specified hf_ value */

  proto_tree_add_item( tree, hf, tvb, offset + NB_DATA1, 1, ENC_LITTLE_ENDIAN);

}

static void

nb_data2(int hf, tvbuff_t *tvb, int offset, proto_tree *tree)

{/* add the DATA2 to tree with specified hf_ value */

  proto_tree_add_item( tree, hf, tvb, offset + NB_DATA2, 2, ENC_LITTLE_ENDIAN);

}

static void

nb_resync_indicator( tvbuff_t *tvb, int offset, proto_tree *tree, const char *cmd_str)

{

  uint16_t resync_indicator = tvb_get_letohs( tvb, offset + NB_DATA2);

  switch (resync_indicator) {

  case 0x0000:

    proto_tree_add_uint_format_value(tree, hf_netb_resync_indicator, tvb, offset + NB_DATA2, 2,

        resync_indicator, "No re-sync");

    break;

  case 0x0001:

    proto_tree_add_uint_format_value(tree, hf_netb_resync_indicator, tvb, offset + NB_DATA2, 2,

        resync_indicator, "First '%s' following 'Receive Outstanding'", cmd_str);

    break;

  default:

    proto_tree_add_item(tree, hf_netb_resync_indicator, tvb, offset + NB_DATA2, 2, ENC_LITTLE_ENDIAN);

    break;

  }

}

/************************************************************************/

/*                  */

/*  The routines called by the top level to handle individual commands  */

/*                  */

/************************************************************************/

static uint32_t

dissect_netb_unknown( tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *tree)

{/* Handle any unknown commands, do nothing */

  proto_tree_add_expert(tree, pinfo, &ei_netb_unknown_command_data, tvb, offset + NB_COMMAND + 1, -1);

  return 0;

}

static uint32_t

dissect_netb_add_group_name( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the ADD GROUP NAME QUERY command */

  nb_resp_corrl( tvb, offset, tree);

  netbios_add_name("Group name to add", tvb, offset + NB_SENDER_NAME,

      tree);

  return 0;

}

static uint32_t

dissect_netb_add_name( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the ADD NAME QUERY command */

  nb_resp_corrl( tvb, offset, tree);

  netbios_add_name("Name to add", tvb, offset + NB_SENDER_NAME, tree);

  return 0;

}

static uint32_t

dissect_netb_name_in_conflict( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the NAME IN CONFLICT command */

  netbios_add_name("Name In Conflict", tvb, offset + NB_RECVER_NAME,

      tree);

  netbios_add_name("Sender's Name", tvb, offset + NB_SENDER_NAME, tree);

  return 0;

}

static uint32_t

dissect_netb_status_query( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the STATUS QUERY command */

  uint8_t status_request = tvb_get_uint8( tvb, offset + NB_DATA1);

  switch (status_request) {

  case 0:

    proto_tree_add_uint_format_value(tree, hf_netb_status_request, tvb, offset + NB_DATA1, 1,

        status_request, "NetBIOS 1.x or 2.0");

    break;

  case 1:

    proto_tree_add_uint_format_value(tree, hf_netb_status_request, tvb, offset + NB_DATA1, 1,

        status_request, "NetBIOS 2.1, initial status request");

    break;

  default:

    proto_tree_add_uint_format_value(tree, hf_netb_status_request, tvb, offset + NB_DATA1, 1,

        status_request, "NetBIOS 2.1, %u names received so far",

        status_request);

    break;

  }

  nb_data2( hf_netb_status_buffer_len, tvb, offset, tree);

  nb_resp_corrl( tvb, offset, tree);

  netbios_add_name("Receiver's Name", tvb, offset + NB_RECVER_NAME, tree);

  netbios_add_name("Sender's Name", tvb, offset + NB_SENDER_NAME, tree);

  return 0;

}

static uint32_t

dissect_netb_terminate_trace( tvbuff_t *tvb _U_, packet_info *pinfo _U_, int offset _U_, proto_tree *tree _U_)

{/* Handle the TERMINATE TRACE command */

  /*

   * XXX - are any of the fields in this message significant?

   * The IBM NetBIOS document shows them as "Reserved".

   */

  return 0;

}

static const unsigned char zeroes[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};

static uint32_t

dissect_netb_datagram( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the DATAGRAM command */

  netbios_add_name("Receiver's Name", tvb, offset + NB_RECVER_NAME, tree);

  /* Weird.  In some datagrams, this is 10 octets of 0, followed

     by a MAC address.... */

  if (tvb_memeql(tvb, offset + NB_SENDER_NAME, zeroes, 10) == 0) {

    proto_tree_add_item(tree, hf_netb_datagram_mac,

              tvb, offset + NB_SENDER_NAME + 10, 6, ENC_NA );

  } else {

    netbios_add_name("Sender's Name", tvb, offset + NB_SENDER_NAME,

        tree);

  }

  return 0;

}

static uint32_t

dissect_netb_datagram_bcast( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the DATAGRAM BROADCAST command */

  /* We assume the same weirdness can happen here.... */

  if (tvb_memeql(tvb, offset + NB_SENDER_NAME, zeroes, 10) == 0) {

    proto_tree_add_item(tree, hf_netb_datagram_bcast_mac,

              tvb, offset + NB_SENDER_NAME + 10, 6, ENC_NA );

  } else {

    netbios_add_name("Sender's Name", tvb, offset + NB_SENDER_NAME,

        tree);

  }

  return 0;

}

static uint32_t

dissect_netb_name_query( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the NAME QUERY command */

  uint8_t local_session_number = tvb_get_uint8( tvb, offset + NB_DATA2);

  if (local_session_number == 0) {

    proto_tree_add_uint_format_value( tree, hf_netb_local_session_no, tvb, offset + NB_DATA2, 1,

        local_session_number, "0 (FIND.NAME request)");

  } else {

    proto_tree_add_item( tree, hf_netb_local_session_no, tvb, offset + NB_DATA2, 1, ENC_LITTLE_ENDIAN);

  }

  nb_call_name_type( tvb, offset, tree);

  nb_resp_corrl( tvb, offset, tree);

  netbios_add_name("Query Name", tvb, offset + NB_RECVER_NAME, tree);

  if (local_session_number != 0) {

    netbios_add_name("Sender's Name", tvb, offset + NB_SENDER_NAME,

        tree);

  }

  return 0;

}

static uint32_t

dissect_netb_add_name_resp( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the ADD NAME RESPONSE command */

  nb_data1( hf_netb_status, tvb, offset, tree);

  nb_data2( hf_netb_name_type, tvb, offset, tree);

  nb_xmit_corrl( tvb, offset, tree);

  netbios_add_name("Name to be added", tvb, offset + NB_RECVER_NAME,

      tree);

  netbios_add_name("Name to be added", tvb, offset + NB_SENDER_NAME,

      tree);

  return 0;

}

static uint32_t

dissect_netb_name_resp( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the NAME RECOGNIZED command */

  uint8_t local_session_number = tvb_get_uint8( tvb, offset + NB_DATA2);

  switch (local_session_number) {

  case 0x00:

    proto_tree_add_uint_format_value( tree, hf_netb_state_of_name, tvb, offset + NB_DATA2, 1,

        local_session_number, "No LISTEN pending, or FIND.NAME response");

    break;

  case 0xFF:

    proto_tree_add_uint_format_value( tree, hf_netb_state_of_name, tvb, offset + NB_DATA2, 1,

        local_session_number, "LISTEN pending, but insufficient resources to establish session");

    break;

  default:

    proto_tree_add_item( tree, hf_netb_local_session_no, tvb, offset + NB_DATA2, 1, ENC_LITTLE_ENDIAN);

    break;

  }

  nb_call_name_type( tvb, offset, tree);

  nb_xmit_corrl( tvb, offset, tree);

  if (local_session_number != 0x00 && local_session_number != 0xFF)

    nb_resp_corrl(tvb, offset, tree);

  netbios_add_name("Receiver's Name", tvb, offset + NB_RECVER_NAME, tree);

  if (local_session_number != 0x00 && local_session_number != 0xFF) {

    netbios_add_name("Sender's Name", tvb, offset + NB_SENDER_NAME,

        tree);

  }

  return 0;

}

static uint32_t

dissect_netb_status_resp( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the STATUS RESPONSE command */

  uint8_t     status_response = tvb_get_uint8( tvb, offset + NB_DATA1);

  proto_item *td2;

  proto_tree *data2_tree;

  nb_call_name_type( tvb, offset, tree);

  if (status_response == 0) {

    proto_tree_add_uint_format_value(tree, hf_netb_status_response, tvb, offset + NB_DATA1, 1,

        status_response, "NetBIOS 1.x or 2.0");

  } else {

    proto_tree_add_uint_format_value(tree, hf_netb_status_response, tvb, offset + NB_DATA1, 1,

        status_response, "NetBIOS 2.1, %u names sent so far",

        status_response);

  }

  td2 = proto_tree_add_item(tree, hf_netb_data2, tvb, offset + NB_DATA2, 2, ENC_LITTLE_ENDIAN);

  data2_tree = proto_item_add_subtree(td2, ett_netb_status);

  proto_tree_add_item(data2_tree, hf_netb_data2_frame, tvb, offset + NB_DATA2, 2, ENC_LITTLE_ENDIAN);

  proto_tree_add_item(data2_tree, hf_netb_data2_user, tvb, offset + NB_DATA2, 2, ENC_LITTLE_ENDIAN);

  proto_tree_add_item(data2_tree, hf_netb_data2_status, tvb, offset + NB_DATA2, 2, ENC_LITTLE_ENDIAN);

  nb_xmit_corrl( tvb, offset, tree);

  netbios_add_name("Receiver's Name", tvb, offset + NB_RECVER_NAME, tree);

  netbios_add_name("Sender's Name", tvb, offset + NB_SENDER_NAME,

      tree);

  return 0;

}

static uint32_t

dissect_netb_data_ack( tvbuff_t* tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the DATA ACK command */

  nb_xmit_corrl( tvb, offset, tree);

  nb_remote_session( tvb, offset, tree);

  nb_local_session( tvb, offset, tree);

  return 0;

}

static uint32_t

dissect_netb_data_first_middle( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the DATA FIRST MIDDLE command */

  uint8_t remote_session, local_session;

  /*

   * This is the first frame, or the middle frame, of a fragmented

   * packet.

   *

   * XXX - there are no sequence numbers, so we have to assume

   * that fragments arrive in order with no duplicates.

   * In fact, 802.2 LLC is supposed to handle that, so we

   * might have to have the LLC dissector do so (but the TCP

   * dissector doesn't currently handle out-of-order or duplicate

   * data, either).

   */

  netbios_data_first_middle_flags( tvb, tree, offset + NB_FLAGS);

  nb_resync_indicator( tvb, offset, tree, "DATA FIRST MIDDLE");

  nb_xmit_corrl( tvb, offset, tree);

  nb_resp_corrl( tvb, offset, tree);

  remote_session = nb_remote_session( tvb, offset, tree);

  local_session = nb_local_session( tvb, offset, tree);

  /*

   * Return a combination of the remote and local session numbers,

   * for use when reassembling.

   */

  return (remote_session << 8) + local_session;

}

static uint32_t

dissect_netb_data_only_last( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the DATA ONLY LAST command */

  uint8_t remote_session, local_session;

  /*

   * This is a complete packet, or the last frame of a fragmented

   * packet.

   */

  netbios_data_only_flags( tvb, tree, offset + NB_FLAGS);

  nb_resync_indicator( tvb, offset, tree, "DATA ONLY LAST");

  nb_xmit_corrl( tvb, offset, tree);

  nb_resp_corrl( tvb, offset, tree);

  remote_session = nb_remote_session( tvb, offset, tree);

  local_session = nb_local_session( tvb, offset, tree);

  /*

   * Return a combination of the remote and local session numbers,

   * for use when reassembling.

   */

  return (remote_session << 8) + local_session;

}

static uint32_t

dissect_netb_session_confirm( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the SESSION CONFIRM command */

  netbios_add_ses_confirm_flags( tvb, tree, offset + NB_FLAGS);

  nb_data2( hf_netb_max_data_recv_size, tvb, offset, tree);

  nb_xmit_corrl( tvb, offset, tree);

  nb_resp_corrl( tvb, offset, tree);

  nb_remote_session( tvb, offset, tree);

  nb_local_session( tvb, offset, tree);

  return 0;

}

static uint32_t

dissect_netb_session_end( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the SESSION END command */

  nb_data2( hf_netb_termination_indicator, tvb, offset, tree);

  nb_remote_session( tvb, offset, tree);

  nb_local_session( tvb, offset, tree);

  return 0;

}

static uint32_t

dissect_netb_session_init( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the SESSION INITIALIZE command */

  netbios_add_session_init_flags( tvb, tree, offset + NB_FLAGS);

  nb_data2( hf_netb_max_data_recv_size, tvb, offset, tree);

  nb_resp_corrl( tvb, offset, tree);

  nb_xmit_corrl( tvb, offset, tree);

  nb_remote_session( tvb, offset, tree);

  nb_local_session( tvb, offset, tree);

  return 0;

}

static uint32_t

dissect_netb_no_receive( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the NO RECEIVE command */

  netbios_no_receive_flags( tvb, tree, offset + NB_FLAGS);

  nb_data2( hf_netb_num_data_bytes_accepted, tvb, offset, tree);

  nb_remote_session( tvb, offset, tree);

  nb_local_session( tvb, offset, tree);

  return 0;

}

static uint32_t

dissect_netb_receive_outstanding( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the RECEIVE OUTSTANDING command */

  nb_data2( hf_netb_num_data_bytes_accepted, tvb, offset, tree);

  nb_remote_session( tvb, offset, tree);

  nb_local_session( tvb, offset, tree);

  return 0;

}

static uint32_t

dissect_netb_receive_continue( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the RECEIVE CONTINUE command */

  nb_xmit_corrl( tvb, offset, tree);

  nb_remote_session( tvb, offset, tree);

  nb_local_session( tvb, offset, tree);

  return 0;

}

static uint32_t

dissect_netb_session_alive( tvbuff_t *tvb, packet_info *pinfo _U_, int offset, proto_tree *tree)

{/* Handle the SESSION ALIVE command */

  /*

   * XXX - all the fields are claimed to be "Reserved", but

   * the session numbers appear to be non-zero in at least

   * one capture, and they do appear to match session numbers