/* packet-smb-mailslot.c

 * Routines for SMB mailslot packet dissection

 * Copyright 2000, Jeffrey C. Foster <jfoste@woodward.com>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * Copied from packet-pop.c

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <epan/packet.h>

#include "packet-smb.h"

#include "packet-smb-mailslot.h"

void proto_register_smb_mailslot(void);

void proto_reg_handoff_smb_mailslot(void);

static int proto_smb_msp;

static int hf_opcode;

static int hf_priority;

static int hf_class;

static int hf_size;

static int hf_name;

static int ett_smb_msp;

static dissector_handle_t mailslot_browse_handle;

static dissector_handle_t mailslot_lanman_handle;

static dissector_handle_t netlogon_handle;

#define MAILSLOT_UNKNOWN              0

#define MAILSLOT_BROWSE               1

#define MAILSLOT_LANMAN               2

#define MAILSLOT_NET                  3

#define MAILSLOT_TEMP_NETLOGON        4

#define MAILSLOT_MSSP                 5

static const value_string opcode_vals[] = {

  {1, "Write Mail Slot"},

  {0, NULL}

};

static const value_string class_vals[] = {

  {1, "Reliable"},

  {2, "Unreliable & Broadcast"},

  {0, NULL}

};

/* decode the SMB mail slot protocol

   for requests

     mailslot is the name of the mailslot, e.g. BROWSE

     si->trans_subcmd is set to the symbolic constant matching the mailslot name.

   for responses

     mailslot is NULL

     si->trans_subcmd gives us which mailslot this response refers to.

*/

bool

dissect_mailslot_smb(tvbuff_t *mshdr_tvb, tvbuff_t *setup_tvb,

         tvbuff_t *tvb, const char *mailslot, packet_info *pinfo,

         proto_tree *parent_tree, smb_info_t* smb_info)

{

  smb_transact_info_t *tri;

  int             trans_subcmd;

  proto_tree      *tree = NULL;

  proto_item      *item = NULL;

  uint16_t        opcode;

  int             offset = 0;

  int             len;

  if (!proto_is_protocol_enabled(find_protocol_by_id(proto_smb_msp))) {

    return false;

  }

  pinfo->current_proto = "SMB Mailslot";

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "SMB Mailslot");

  if ((tvb==NULL) || (tvb_reported_length(tvb)==0)) {

    /* Interim reply */

    col_set_str(pinfo->cinfo, COL_INFO, "Interim reply");

    return true;

  }

  col_clear(pinfo->cinfo, COL_INFO);

  if (smb_info->sip != NULL && smb_info->sip->extra_info_type == SMB_EI_TRI)

    tri = (smb_transact_info_t *)smb_info->sip->extra_info;

  else

    tri = NULL;

  /* check which mailslot this is about */

  trans_subcmd=MAILSLOT_UNKNOWN;

  if(smb_info->request){

    if(strncmp(mailslot,"BROWSE",6) == 0){

        trans_subcmd=MAILSLOT_BROWSE;

    } else if(strncmp(mailslot,"LANMAN",6) == 0){

        trans_subcmd=MAILSLOT_LANMAN;

    } else if(strncmp(mailslot,"NET",3) == 0){

        trans_subcmd=MAILSLOT_NET;

    } else if(strncmp(mailslot,"TEMP\\NETLOGON",13) == 0){

        trans_subcmd=MAILSLOT_TEMP_NETLOGON;

    } else if(strncmp(mailslot,"MSSP",4) == 0){

      trans_subcmd=MAILSLOT_MSSP;

    }

    if (!pinfo->fd->visited) {

      if (tri != NULL)

        tri->trans_subcmd = trans_subcmd;

    }

  } else {

    if(!tri){

      return false;

    } else {

      trans_subcmd = tri->trans_subcmd;

    }

  }

  /* Only do these ones if we have them. For fragmented SMB Transactions

     we may only have the setup area for the first fragment

  */

  if(mshdr_tvb && setup_tvb){

    if (parent_tree) {

      item = proto_tree_add_item(parent_tree, proto_smb_msp,

               mshdr_tvb, 0, -1, ENC_NA);

      tree = proto_item_add_subtree(item, ett_smb_msp);

    }

    /* do the opcode field */

    opcode = tvb_get_letohs(setup_tvb, offset);

    col_add_str(pinfo->cinfo, COL_INFO,

            val_to_str(pinfo->pool, opcode, opcode_vals, "Unknown opcode: 0x%04x"));

    /* These are in the setup words; use "setup_tvb". */

    /* opcode */

    proto_tree_add_uint(tree, hf_opcode, setup_tvb, offset, 2,

        opcode);

    offset += 2;

    /* priority */

    proto_tree_add_item(tree, hf_priority, setup_tvb, offset, 2,

        ENC_LITTLE_ENDIAN);

    offset += 2;

    /* class */

    proto_tree_add_item(tree, hf_class, setup_tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    /* These are in the rest of the data; use "mshdr_tvb", which

       starts at the same place "setup_tvb" does. */

    /* size */

    /* this is actually bytecount in the SMB Transaction command */

    proto_tree_add_item(tree, hf_size, mshdr_tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    /* mailslot name */

    len = tvb_strsize(mshdr_tvb, offset);

    proto_tree_add_item(tree, hf_name, mshdr_tvb, offset, len, ENC_ASCII);

    offset += len;

    proto_item_set_len(item, offset);

  }

  switch(trans_subcmd){

  case MAILSLOT_BROWSE:

    call_dissector(mailslot_browse_handle, tvb, pinfo,

        parent_tree);

    break;

  case MAILSLOT_LANMAN:

    call_dissector(mailslot_lanman_handle, tvb, pinfo,

        parent_tree);

    break;

  case MAILSLOT_NET:

  case MAILSLOT_TEMP_NETLOGON:

  case MAILSLOT_MSSP:

    call_dissector(netlogon_handle, tvb, pinfo,

        parent_tree);

    break;

  default:

    /*

     * We dissected the mailslot header, but we don't know

     * how to dissect the message; dissect the latter as data,

     * but indicate that we successfully dissected the mailslot

     * stuff.

     */

    call_data_dissector(tvb, pinfo, parent_tree);

    break;

  }

  return true;

}

void

proto_register_smb_mailslot(void)

{

  static hf_register_info hf[] = {

    { &hf_opcode,

      { "Opcode", "mailslot.opcode", FT_UINT16, BASE_DEC,

        VALS(opcode_vals), 0, "MAILSLOT OpCode", HFILL }},

    { &hf_priority,

      { "Priority", "mailslot.priority", FT_UINT16, BASE_DEC,

        NULL, 0, "MAILSLOT Priority of transaction", HFILL }},

    { &hf_class,

      { "Class", "mailslot.class", FT_UINT16, BASE_DEC,

        VALS(class_vals), 0, "MAILSLOT Class of transaction", HFILL }},

    { &hf_size,

      { "Size", "mailslot.size", FT_UINT16, BASE_DEC,

        NULL, 0, "MAILSLOT Total size of mail data", HFILL }},

    { &hf_name,

      { "Mailslot Name", "mailslot.name", FT_STRING, BASE_NONE,

        NULL, 0, "MAILSLOT Name of mailslot", HFILL }},

  };

  static int *ett[] = {

    &ett_smb_msp

  };

  proto_smb_msp = proto_register_protocol("SMB MailSlot Protocol", "SMB Mailslot", "mailslot");

  proto_register_field_array(proto_smb_msp, hf, array_length(hf));

  proto_register_subtree_array(ett, array_length(ett));

}

void

proto_reg_handoff_smb_mailslot(void)

{

  mailslot_browse_handle = find_dissector_add_dependency("mailslot_browse", proto_smb_msp);

  mailslot_lanman_handle = find_dissector_add_dependency("mailslot_lanman", proto_smb_msp);

  netlogon_handle = find_dissector_add_dependency("smb_netlogon", proto_smb_msp);

}

/*

 * Editor modelines  -  https://www.wireshark.org/tools/modelines.html

 *

 * Local variables:

 * c-basic-offset: 8

 * tab-width: 8

 * indent-tabs-mode: t

 * End:

 *

 * vi: set shiftwidth=8 tabstop=8 noexpandtab:

 * :indentSize=8:tabSize=8:noTabs=false:

 */