?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
MSWSP: add two more Property Sets
[wireshark-wip.git] / epan / dissectors / packet-afp.c
blob959dc953ffbf04ff2e0976118b4c70e4680ffce1
1 /* packet-afp.c
2 * Routines for afp packet dissection
3 * Copyright 2002, Didier Gautheron <dgautheron@magic.fr>
4 *
5 * $Id$
6 *
7 * Wireshark - Network traffic analyzer
8 * By Gerald Combs <gerald@wireshark.org>
9 * Copyright 1998 Gerald Combs
10 *
11 * Copied from README.developer
12 * Copied from packet-dsi.c
13 *
14 * This program is free software; you can redistribute it and/or
15 * modify it under the terms of the GNU General Public License
16 * as published by the Free Software Foundation; either version 2
17 * of the License, or (at your option) any later version.
18 *
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
23 *
24 * You should have received a copy of the GNU General Public License
25 * along with this program; if not, write to the Free Software
26 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
27 */
28
29 #include "config.h"
30
31 #include <string.h>
32
33 #include <glib.h>
34 #include <epan/packet.h>
35 #include <epan/exceptions.h>
36 /* #include <epan/strutil.h> */
37 #include <epan/conversation.h>
38 #include <epan/wmem/wmem.h>
39 #include <epan/tap.h>
40 #include <epan/expert.h>
41
42 #include "packet-afp.h"
43
44 /* The information in this module (AFP) comes from:
45
46 AFP 2.1 & 2.2 documentation, in PDF form, at
47
48 http://developer.apple.com/DOCUMENTATION/macos8/pdf/ASAppleTalkFiling2.1_2.2.pdf
49
50 AFP3.0.pdf from http://www.apple.com (still available?)
51
52 AFP 3.1 programming guide, in PDF form, at
53
54 http://developer.apple.com/documentation/Networking/Conceptual/AFP/AFP3_1.pdf
55
56 and, in HTML form, at
57
58 http://developer.apple.com/documentation/Networking/Conceptual/AFP/index.html
59
60 Current AFP 3.x specfication, in HTML form, at
61 http://developer.apple.com/mac/library/documentation/Networking/Reference/AFP_Reference/Reference/reference.html
62
63 Current AFP 3.x programming guide, in HTML form, at
64 http://developer.apple.com/mac/library/documentation/Networking/Conceptual/AFP/Introduction/Introduction.html
65
66 The netatalk source code by Wesley Craig & Adrian Sun
67 http://netatalk.sf.net
68
69 XXX - distinguish between UTF-8 and Mac proprietary encodings for strings?
70 Does that need a preference in case we didn't see the client and server
71 negotiate that?
72 */
73 /* Forward declarations */
74 void proto_register_afp(void);
75 void proto_reg_handoff_afp(void);
76
77 /* from netatalk/include/afp.h */
78 #define AFPTRANS_NONE 0
79 #define AFPTRANS_DDP (1 << 0)
80 #define AFPTRANS_TCP (1 << 1)
81 #define AFPTRANS_ALL (AFPTRANS_DDP | AFPTRANS_TCP)
82
83 /* AFP Attention Codes -- 4 bits */
84 #define AFPATTN_SHUTDOWN (1 << 15) /* shutdown/disconnect */
85 #define AFPATTN_CRASH (1 << 14) /* server crashed */
86 #define AFPATTN_MESG (1 << 13) /* server has message */
87 #define AFPATTN_NORECONNECT (1 << 12) /* don't reconnect */
88 /* server notification */
89 #define AFPATTN_NOTIFY (AFPATTN_MESG | AFPATTN_NORECONNECT)
90
91 /* extended bitmap -- 12 bits. volchanged is only useful w/ a server
92 * notification, and time is only useful for shutdown. */
93 #define AFPATTN_VOLCHANGED (1 << 0) /* volume has changed */
94 #define AFPATTN_TIME(x) ((x) & 0xfff) /* time in minutes */
95
96 /* AFP functions */
97 #define AFP_BYTELOCK 1
98 #define AFP_CLOSEVOL 2
99 #define AFP_CLOSEDIR 3
100 #define AFP_CLOSEFORK 4
101 #define AFP_COPYFILE 5
102 #define AFP_CREATEDIR 6
103 #define AFP_CREATEFILE 7
104 #define AFP_DELETE 8
105 #define AFP_ENUMERATE 9
106 #define AFP_FLUSH 10
107 #define AFP_FLUSHFORK 11
108 #define AFP_GETFORKPARAM 14
109 #define AFP_GETSRVINFO 15
110 #define AFP_GETSRVPARAM 16
111 #define AFP_GETVOLPARAM 17
112 #define AFP_LOGIN 18
113 #define AFP_LOGINCONT 19
114 #define AFP_LOGOUT 20
115 #define AFP_MAPID 21
116 #define AFP_MAPNAME 22
117 #define AFP_MOVE 23
118 #define AFP_OPENVOL 24
119 #define AFP_OPENDIR 25
120 #define AFP_OPENFORK 26
121 #define AFP_READ 27
122 #define AFP_RENAME 28
123 #define AFP_SETDIRPARAM 29
124 #define AFP_SETFILEPARAM 30
125 #define AFP_SETFORKPARAM 31
126 #define AFP_SETVOLPARAM 32
127 #define AFP_WRITE 33
128 #define AFP_GETFLDRPARAM 34
129 #define AFP_SETFLDRPARAM 35
130 #define AFP_CHANGEPW 36
131 #define AFP_GETUSERINFO 37
132 #define AFP_GETSRVRMSG 38
133 #define AFP_CREATEID 39
134 #define AFP_DELETEID 40
135 #define AFP_RESOLVEID 41
136 #define AFP_EXCHANGEFILE 42
137 #define AFP_CATSEARCH 43
138 #define AFP_OPENDT 48
139 #define AFP_CLOSEDT 49
140 #define AFP_GETICON 51
141 #define AFP_GTICNINFO 52
142 #define AFP_ADDAPPL 53
143 #define AFP_RMVAPPL 54
144 #define AFP_GETAPPL 55
145 #define AFP_ADDCMT 56
146 #define AFP_RMVCMT 57
147 #define AFP_GETCMT 58
148
149 #define AFP_ZZZ 122
150 #define AFP_ADDICON 192
151
152 /* AFP 3.0 new calls */
153 #define AFP_BYTELOCK_EXT 59
154 #define AFP_READ_EXT 60
155 #define AFP_WRITE_EXT 61
156 #define AFP_LOGIN_EXT 63
157 #define AFP_GETSESSTOKEN 64
158 #define AFP_DISCTOLDSESS 65
159 #define AFP_ENUMERATE_EXT 66
160 #define AFP_CATSEARCH_EXT 67
161
162 /* AFP 3.1 new calls */
163 #define AFP_ENUMERATE_EXT2 68
164
165 /* AFP 3.2 new calls */
166 #define AFP_GETEXTATTR 69
167 #define AFP_SETEXTATTR 70
168 #define AFP_REMOVEATTR 71
169 #define AFP_LISTEXTATTR 72
170 #define AFP_GETACL 73
171 #define AFP_SETACL 74
172 #define AFP_ACCESS 75
173
174 /* AFP 3.2 calls added in 10.5 */
175 #define AFP_SPOTLIGHTRPC 76
176 #define AFP_SYNCDIR 78
177 #define AFP_SYNCFORK 79
178
179 /* FPSpotlightRPC subcommand codes */
180 #define SPOTLIGHT_CMD_GET_VOLPATH 4
181 #define SPOTLIGHT_CMD_GET_VOLID 2
182 #define SPOTLIGHT_CMD_GET_THREE 3
183
184 /* Spotlight epoch is UNIX epoch minus SPOTLIGHT_TIME_DELTA */
185 #define SPOTLIGHT_TIME_DELTA G_GINT64_CONSTANT(280878921600U)
186
187 /* ----------------------------- */
188 static int proto_afp = -1;
189 static int hf_afp_reserved = -1;
190 static int hf_afp_unknown = -1;
191
192 static int hf_afp_command = -1; /* CommandCode */
193 static int hf_afp_Version = -1;
194 static int hf_afp_UAM = -1;
195 static int hf_afp_user = -1;
196 static int hf_afp_passwd = -1;
197 static int hf_afp_random = -1;
198
199 static int hf_afp_response_to = -1;
200 static int hf_afp_time = -1;
201 static int hf_afp_response_in = -1;
202
203 static int hf_afp_login_flags = -1;
204 static int hf_afp_pad = -1;
205
206 static int hf_afp_user_type = -1;
207 static int hf_afp_user_len = -1;
208 static int hf_afp_user_name = -1;
209
210 static int hf_afp_vol_flag_passwd = -1;
211 static int hf_afp_vol_flag_has_config = -1;
212 static int hf_afp_server_time = -1;
213
214 static int hf_afp_vol_bitmap = -1;
215 static int hf_afp_vol_name_offset = -1;
216 static int hf_afp_vol_id = -1;
217 static int hf_afp_vol_attribute = -1;
218 static int hf_afp_vol_name = -1;
219 static int hf_afp_vol_signature = -1;
220 static int hf_afp_vol_creation_date = -1;
221 static int hf_afp_vol_modification_date = -1;
222 static int hf_afp_vol_backup_date = -1;
223 static int hf_afp_vol_bytes_free = -1;
224 static int hf_afp_vol_bytes_total = -1;
225 static int hf_afp_vol_ex_bytes_free = -1;
226 static int hf_afp_vol_ex_bytes_total = -1;
227 static int hf_afp_vol_block_size = -1;
228
229 /* desktop stuff */
230 static int hf_afp_comment = -1;
231 static int hf_afp_file_creator = -1;
232 static int hf_afp_file_type = -1;
233 static int hf_afp_icon_type = -1;
234 static int hf_afp_icon_length = -1;
235 static int hf_afp_icon_tag = -1;
236 static int hf_afp_icon_index = -1;
237 static int hf_afp_appl_index = -1;
238 static int hf_afp_appl_tag = -1;
239
240 static int hf_afp_did = -1;
241 static int hf_afp_file_id = -1;
242 static int hf_afp_file_DataForkLen = -1;
243 static int hf_afp_file_RsrcForkLen = -1;
244 static int hf_afp_file_ExtDataForkLen = -1;
245 static int hf_afp_file_ExtRsrcForkLen = -1;
246
247 static int hf_afp_dir_bitmap = -1;
248 static int hf_afp_dir_offspring = -1;
249 static int hf_afp_dir_OwnerID = -1;
250 static int hf_afp_dir_GroupID = -1;
251
252 static int hf_afp_file_bitmap = -1;
253 static int hf_afp_req_count = -1;
254 static int hf_afp_start_index = -1;
255 static int hf_afp_start_index32 = -1;
256 static int hf_afp_max_reply_size = -1;
257 static int hf_afp_max_reply_size32 = -1;
258 static int hf_afp_file_flag = -1;
259 static int hf_afp_create_flag = -1;
260 static int hf_afp_struct_size = -1;
261 static int hf_afp_struct_size16 = -1;
262
263 static int hf_afp_cat_count = -1;
264 static int hf_afp_cat_req_matches = -1;
265 static int hf_afp_cat_position = -1;
266
267 static int hf_afp_creation_date = -1;
268 static int hf_afp_modification_date = -1;
269 static int hf_afp_backup_date = -1;
270 static int hf_afp_finder_info = -1;
271 static int hf_afp_long_name_offset = -1;
272 static int hf_afp_short_name_offset = -1;
273 static int hf_afp_unicode_name_offset = -1;
274 static int hf_afp_unix_privs_uid = -1;
275 static int hf_afp_unix_privs_gid = -1;
276 static int hf_afp_unix_privs_permissions = -1;
277 static int hf_afp_unix_privs_ua_permissions = -1;
278
279 static int hf_afp_path_type = -1;
280 static int hf_afp_path_len = -1;
281 static int hf_afp_path_name = -1;
282 static int hf_afp_path_unicode_hint = -1;
283 static int hf_afp_path_unicode_len = -1;
284
285 static int hf_afp_flag = -1;
286 static int hf_afp_dt_ref = -1;
287 static int hf_afp_ofork = -1;
288 static int hf_afp_ofork_len = -1;
289 static int hf_afp_offset = -1;
290 static int hf_afp_rw_count = -1;
291 static int hf_afp_newline_mask = -1;
292 static int hf_afp_newline_char = -1;
293 static int hf_afp_last_written = -1;
294
295 static int hf_afp_fork_type = -1;
296 static int hf_afp_access_mode = -1;
297 static int hf_afp_access_read = -1;
298 static int hf_afp_access_write = -1;
299 static int hf_afp_access_deny_read = -1;
300 static int hf_afp_access_deny_write = -1;
301
302 static gint hf_afp_lock_op = -1;
303 static gint hf_afp_lock_from = -1;
304 static gint hf_afp_lock_offset = -1;
305 static gint hf_afp_lock_len = -1;
306 static gint hf_afp_lock_range_start = -1;
307
308 static gint ett_afp = -1;
309
310 static gint ett_afp_vol_attribute = -1;
311 static gint ett_afp_enumerate = -1;
312 static gint ett_afp_enumerate_line = -1;
313 static gint ett_afp_access_mode = -1;
314
315 static gint ett_afp_vol_bitmap = -1;
316 static gint ett_afp_dir_bitmap = -1;
317 static gint ett_afp_dir_attribute = -1;
318 static gint ett_afp_file_attribute = -1;
319 static gint ett_afp_file_bitmap = -1;
320 static gint ett_afp_unix_privs = -1;
321 static gint ett_afp_path_name = -1;
322 static gint ett_afp_lock_flags = -1;
323 static gint ett_afp_dir_ar = -1;
324
325 static gint ett_afp_server_vol = -1;
326 static gint ett_afp_vol_list = -1;
327 static gint ett_afp_vol_flag = -1;
328 static gint ett_afp_cat_search = -1;
329 static gint ett_afp_cat_r_bitmap = -1;
330 static gint ett_afp_cat_spec = -1;
331 static gint ett_afp_vol_did = -1;
332
333 /* AFP 3.0 parameters */
334 static gint hf_afp_lock_offset64 = -1;
335 static gint hf_afp_lock_len64 = -1;
336 static gint hf_afp_lock_range_start64 = -1;
337
338 static int hf_afp_offset64 = -1;
339 static int hf_afp_rw_count64 = -1;
340 static int hf_afp_reqcount64 = -1;
341
342 static int hf_afp_last_written64 = -1;
343
344 static int hf_afp_ofork_len64 = -1;
345 static int hf_afp_session_token_type = -1;
346 static int hf_afp_session_token_len = -1;
347 static int hf_afp_session_token = -1;
348 static int hf_afp_session_token_timestamp = -1;
349
350 /* AFP 3.2 */
351
352 static int hf_afp_extattr_bitmap = -1;
353 static int hf_afp_extattr_bitmap_NoFollow = -1;
354 static int hf_afp_extattr_bitmap_Create = -1;
355 static int hf_afp_extattr_bitmap_Replace = -1;
356 static int ett_afp_extattr_bitmap = -1;
357 static int hf_afp_extattr_namelen = -1;
358 static int hf_afp_extattr_name = -1;
359 static int hf_afp_extattr_len = -1;
360 static int hf_afp_extattr_data = -1;
361 static int hf_afp_extattr_req_count = -1;
362 static int hf_afp_extattr_start_index = -1;
363 static int hf_afp_extattr_reply_size = -1;
364 static int ett_afp_extattr_names = -1;
365
366 static expert_field ei_afp_subquery_count_over_safety_limit = EI_INIT;
367 static expert_field ei_afp_subquery_count_over_query_count = EI_INIT;
368 static expert_field ei_afp_abnormal_num_subqueries = EI_INIT;
369 static expert_field ei_afp_too_many_acl_entries = EI_INIT;
370 static expert_field ei_afp_ip_port_reused = EI_INIT;
371
372 static int afp_tap = -1;
373
374 static dissector_handle_t data_handle;
375
376 static const value_string vol_signature_vals[] = {
377 {1, "Flat"},
378 {2, "Fixed Directory ID"},
379 {3, "Variable Directory ID (deprecated)"},
380 {0, NULL }
381 };
382
383 static const value_string CommandCode_vals[] = {
384 {AFP_BYTELOCK, "FPByteRangeLock" },
385 {AFP_CLOSEVOL, "FPCloseVol" },
386 {AFP_CLOSEDIR, "FPCloseDir" },
387 {AFP_CLOSEFORK, "FPCloseFork" },
388 {AFP_COPYFILE, "FPCopyFile" },
389 {AFP_CREATEDIR, "FPCreateDir" },
390 {AFP_CREATEFILE, "FPCreateFile" },
391 {AFP_DELETE, "FPDelete" },
392 {AFP_ENUMERATE, "FPEnumerate" },
393 {AFP_FLUSH, "FPFlush" },
394 {AFP_FLUSHFORK, "FPFlushFork" },
395 {AFP_GETFORKPARAM, "FPGetForkParms" },
396 {AFP_GETSRVINFO, "FPGetSrvrInfo" },
397 {AFP_GETSRVPARAM, "FPGetSrvrParms" },
398 {AFP_GETVOLPARAM, "FPGetVolParms" },
399 {AFP_LOGIN, "FPLogin" },
400 {AFP_LOGINCONT, "FPLoginCont" },
401 {AFP_LOGOUT, "FPLogout" },
402 {AFP_MAPID, "FPMapID" },
403 {AFP_MAPNAME, "FPMapName" },
404 {AFP_MOVE, "FPMoveAndRename" },
405 {AFP_OPENVOL, "FPOpenVol" },
406 {AFP_OPENDIR, "FPOpenDir" },
407 {AFP_OPENFORK, "FPOpenFork" },
408 {AFP_READ, "FPRead" },
409 {AFP_RENAME, "FPRename" },
410 {AFP_SETDIRPARAM, "FPSetDirParms" },
411 {AFP_SETFILEPARAM, "FPSetFileParms" },
412 {AFP_SETFORKPARAM, "FPSetForkParms" },
413 {AFP_SETVOLPARAM, "FPSetVolParms" },
414 {AFP_WRITE, "FPWrite" },
415 {AFP_GETFLDRPARAM, "FPGetFileDirParms" },
416 {AFP_SETFLDRPARAM, "FPSetFileDirParms" },
417 {AFP_CHANGEPW, "FPChangePassword" },
418 {AFP_GETUSERINFO, "FPGetUserInfo" },
419 {AFP_GETSRVRMSG, "FPGetSrvrMsg" },
420 {AFP_CREATEID, "FPCreateID" },
421 {AFP_DELETEID, "FPDeleteID" },
422 {AFP_RESOLVEID, "FPResolveID" },
423 {AFP_EXCHANGEFILE, "FPExchangeFiles" },
424 {AFP_CATSEARCH, "FPCatSearch" },
425 {AFP_OPENDT, "FPOpenDT" },
426 {AFP_CLOSEDT, "FPCloseDT" },
427 {AFP_GETICON, "FPGetIcon" },
428 {AFP_GTICNINFO, "FPGetIconInfo" },
429 {AFP_ADDAPPL, "FPAddAPPL" },
430 {AFP_RMVAPPL, "FPRemoveAPPL" },
431 {AFP_GETAPPL, "FPGetAPPL" },
432 {AFP_ADDCMT, "FPAddComment" },
433 {AFP_RMVCMT, "FPRemoveComment" },
434 {AFP_GETCMT, "FPGetComment" },
435 {AFP_BYTELOCK_EXT, "FPByteRangeLockExt" },
436 {AFP_READ_EXT, "FPReadExt" },
437 {AFP_WRITE_EXT, "FPWriteExt" },
438 {AFP_LOGIN_EXT, "FPLoginExt" },
439 {AFP_GETSESSTOKEN, "FPGetSessionToken" },
440 {AFP_DISCTOLDSESS, "FPDisconnectOldSession" },
441 {AFP_ENUMERATE_EXT, "FPEnumerateExt" },
442 {AFP_CATSEARCH_EXT, "FPCatSearchExt" },
443 {AFP_ENUMERATE_EXT2, "FPEnumerateExt2" },
444 {AFP_GETEXTATTR, "FPGetExtAttr" },
445 {AFP_SETEXTATTR, "FPSetExtAttr" },
446 {AFP_REMOVEATTR, "FPRemoveExtAttr" },
447 {AFP_LISTEXTATTR, "FPListExtAttrs" },
448 {AFP_GETACL, "FPGetACL" },
449 {AFP_SETACL, "FPSetACL" },
450 {AFP_ACCESS, "FPAccess" },
451 {AFP_SPOTLIGHTRPC, "FPSpotlightRPC" },
452 {AFP_SYNCDIR, "FPSyncDir" },
453 {AFP_SYNCFORK, "FPSyncFork" },
454 {AFP_ZZZ, "FPZzzzz" },
455 {AFP_ADDICON, "FPAddIcon" },
456 {0, NULL }
457 };
458 value_string_ext CommandCode_vals_ext = VALUE_STRING_EXT_INIT(CommandCode_vals);
459
460 static const value_string unicode_hint_vals[] = {
461 { 0, "MacRoman" },
462 { 1, "MacJapanese" },
463 { 2, "MacChineseTrad" },
464 { 3, "MacKorean" },
465 { 4, "MacArabic" },
466 { 5, "MacHebrew" },
467 { 6, "MacGreek" },
468 { 7, "MacCyrillic" },
469 { 9, "MacDevanagari" },
470 { 10, "MacGurmukhi" },
471 { 11, "MacGujarati" },
472 { 12, "MacOriya" },
473 { 13, "MacBengali" },
474 { 14, "MacTamil" },
475 { 15, "MacTelugu" },
476 { 16, "MacKannada" },
477 { 17, "MacMalayalam" },
478 { 18, "MacSinhalese" },
479 { 19, "MacBurmese" },
480 { 20, "MacKhmer" },
481 { 21, "MacThai" },
482 { 22, "MacLaotian" },
483 { 23, "MacGeorgian" },
484 { 24, "MacArmenian" },
485 { 25, "MacChineseSimp" },
486 { 26, "MacTibetan" },
487 { 27, "MacMongolian" },
488 { 28, "MacEthiopic" },
489 { 29, "MacCentralEurRoman" },
490 { 30, "MacVietnamese" },
491 { 31, "MacExtArabic" },
492 { 33, "MacSymbol" },
493 { 34, "MacDingbats" },
494 { 35, "MacTurkish" },
495 { 36, "MacCroatian" },
496 { 37, "MacIcelandic" },
497 { 38, "MacRomanian" },
498 { 39, "MacCeltic" },
499 { 40, "MacGaelic" },
500 { 41, "MacKeyboardGlyphs" },
501 { 126, "MacUnicode" },
502 { 140, "MacFarsi" },
503 { 152, "MacUkrainian" },
504 { 236, "MacInuit" },
505 { 252, "MacVT100" },
506 { 255, "MacHFS" },
507 { 256, "UnicodeDefault" },
508 /* ?? { 257, "UnicodeV1_1" }, */
509 { 257, "ISO10646_1993" },
510 { 259, "UnicodeV2_0" },
511 /* ?? { 259, "UnicodeV2_1" }, */
512 { 260, "UnicodeV3_0" },
513 { 513, "ISOLatin1" },
514 { 514, "ISOLatin2" },
515 { 515, "ISOLatin3" },
516 { 516, "ISOLatin4" },
517 { 517, "ISOLatinCyrillic" },
518 { 518, "ISOLatinArabic" },
519 { 519, "ISOLatinGreek" },
520 { 520, "ISOLatinHebrew" },
521 { 521, "ISOLatin5" },
522 { 522, "ISOLatin6" },
523 { 525, "ISOLatin7" },
524 { 526, "ISOLatin8" },
525 { 527, "ISOLatin9" },
526 { 1024, "DOSLatinUS" },
527 { 1029, "DOSGreek" },
528 { 1030, "DOSBalticRim" },
529 { 1040, "DOSLatin1" },
530 { 1041, "DOSGreek1" },
531 { 1042, "DOSLatin2" },
532 { 1043, "DOSCyrillic" },
533 { 1044, "DOSTurkish" },
534 { 1045, "DOSPortuguese" },
535 { 1046, "DOSIcelandic" },
536 { 1047, "DOSHebrew" },
537 { 1048, "DOSCanadianFrench" },
538 { 1049, "DOSArabic" },
539 { 1050, "DOSNordic" },
540 { 1051, "DOSRussian" },
541 { 1052, "DOSGreek2" },
542 { 1053, "DOSThai" },
543 { 1056, "DOSJapanese" },
544 { 1057, "DOSChineseSimplif" },
545 { 1058, "DOSKorean" },
546 { 1059, "DOSChineseTrad" },
547 { 1280, "WindowsLatin1" },
548 /* { 1280, "WindowsANSI" }, */
549 { 1281, "WindowsLatin2" },
550 { 1282, "WindowsCyrillic" },
551 { 1283, "WindowsGreek" },
552 { 1284, "WindowsLatin5" },
553 { 1285, "WindowsHebrew" },
554 { 1286, "WindowsArabic" },
555 { 1287, "WindowsBalticRim" },
556 { 1288, "WindowsVietnamese" },
557 { 1296, "WindowsKoreanJohab" },
558 { 1536, "US_ASCII" },
559 { 1568, "JIS_X0201_76" },
560 { 1569, "JIS_X0208_83" },
561 { 1570, "JIS_X0208_90" },
562 { 0, NULL }
563 };
564 static value_string_ext unicode_hint_vals_ext = VALUE_STRING_EXT_INIT(unicode_hint_vals);
565
566 /* volume bitmap
567 from Apple AFP3.0.pdf
568 Table 1-2 p. 20
569 */
570 #define kFPVolAttributeBit (1 << 0)
571 #define kFPVolSignatureBit (1 << 1)
572 #define kFPVolCreateDateBit (1 << 2)
573 #define kFPVolModDateBit (1 << 3)
574 #define kFPVolBackupDateBit (1 << 4)
575 #define kFPVolIDBit (1 << 5)
576 #define kFPVolBytesFreeBit (1 << 6)
577 #define kFPVolBytesTotalBit (1 << 7)
578 #define kFPVolNameBit (1 << 8)
579 #define kFPVolExtBytesFreeBit (1 << 9)
580 #define kFPVolExtBytesTotalBit (1 << 10)
581 #define kFPVolBlockSizeBit (1 << 11)
582
583 static int hf_afp_vol_bitmap_Attributes = -1;
584 static int hf_afp_vol_bitmap_Signature = -1;
585 static int hf_afp_vol_bitmap_CreateDate = -1;
586 static int hf_afp_vol_bitmap_ModDate = -1;
587 static int hf_afp_vol_bitmap_BackupDate = -1;
588 static int hf_afp_vol_bitmap_ID = -1;
589 static int hf_afp_vol_bitmap_BytesFree = -1;
590 static int hf_afp_vol_bitmap_BytesTotal = -1;
591 static int hf_afp_vol_bitmap_Name = -1;
592 static int hf_afp_vol_bitmap_ExtBytesFree = -1;
593 static int hf_afp_vol_bitmap_ExtBytesTotal = -1;
594 static int hf_afp_vol_bitmap_BlockSize = -1;
595
596 static int hf_afp_vol_attribute_ReadOnly = -1;
597 static int hf_afp_vol_attribute_HasVolumePassword = -1;
598 static int hf_afp_vol_attribute_SupportsFileIDs = -1;
599 static int hf_afp_vol_attribute_SupportsCatSearch = -1;
600 static int hf_afp_vol_attribute_SupportsBlankAccessPrivs = -1;
601 static int hf_afp_vol_attribute_SupportsUnixPrivs = -1;
602 static int hf_afp_vol_attribute_SupportsUTF8Names = -1;
603 static int hf_afp_vol_attribute_NoNetworkUserID = -1;
604 static int hf_afp_vol_attribute_DefaultPrivsFromParent = -1;
605 static int hf_afp_vol_attribute_NoExchangeFiles = -1;
606 static int hf_afp_vol_attribute_SupportsExtAttrs = -1;
607 static int hf_afp_vol_attribute_SupportsACLs = -1;
608 static int hf_afp_vol_attribute_CaseSensitive = -1;
609 static int hf_afp_vol_attribute_SupportsTMLockSteal = -1;
610
611 static int hf_afp_dir_bitmap_Attributes = -1;
612 static int hf_afp_dir_bitmap_ParentDirID = -1;
613 static int hf_afp_dir_bitmap_CreateDate = -1;
614 static int hf_afp_dir_bitmap_ModDate = -1;
615 static int hf_afp_dir_bitmap_BackupDate = -1;
616 static int hf_afp_dir_bitmap_FinderInfo = -1;
617 static int hf_afp_dir_bitmap_LongName = -1;
618 static int hf_afp_dir_bitmap_ShortName = -1;
619 static int hf_afp_dir_bitmap_NodeID = -1;
620 static int hf_afp_dir_bitmap_OffspringCount = -1;
621 static int hf_afp_dir_bitmap_OwnerID = -1;
622 static int hf_afp_dir_bitmap_GroupID = -1;
623 static int hf_afp_dir_bitmap_AccessRights = -1;
624 static int hf_afp_dir_bitmap_UTF8Name = -1;
625 static int hf_afp_dir_bitmap_UnixPrivs = -1;
626
627 static int hf_afp_dir_attribute_Invisible = -1;
628 static int hf_afp_dir_attribute_IsExpFolder = -1;
629
630 static int hf_afp_dir_attribute_System = -1;
631 static int hf_afp_dir_attribute_Mounted = -1;
632 static int hf_afp_dir_attribute_InExpFolder = -1;
633
634 static int hf_afp_dir_attribute_BackUpNeeded = -1;
635 static int hf_afp_dir_attribute_RenameInhibit = -1;
636 static int hf_afp_dir_attribute_DeleteInhibit = -1;
637
638 static int hf_afp_file_bitmap_Attributes = -1;
639 static int hf_afp_file_bitmap_ParentDirID = -1;
640 static int hf_afp_file_bitmap_CreateDate = -1;
641 static int hf_afp_file_bitmap_ModDate = -1;
642 static int hf_afp_file_bitmap_BackupDate = -1;
643 static int hf_afp_file_bitmap_FinderInfo = -1;
644 static int hf_afp_file_bitmap_LongName = -1;
645 static int hf_afp_file_bitmap_ShortName = -1;
646 static int hf_afp_file_bitmap_NodeID = -1;
647 static int hf_afp_file_bitmap_DataForkLen = -1;
648 static int hf_afp_file_bitmap_RsrcForkLen = -1;
649 static int hf_afp_file_bitmap_ExtDataForkLen = -1;
650 static int hf_afp_file_bitmap_LaunchLimit = -1;
651
652 static int hf_afp_file_bitmap_UTF8Name = -1;
653 static int hf_afp_file_bitmap_ExtRsrcForkLen = -1;
654 static int hf_afp_file_bitmap_UnixPrivs = -1;
655
656 static int hf_afp_file_attribute_Invisible = -1;
657 static int hf_afp_file_attribute_MultiUser = -1;
658 static int hf_afp_file_attribute_System = -1;
659 static int hf_afp_file_attribute_DAlreadyOpen = -1;
660 static int hf_afp_file_attribute_RAlreadyOpen = -1;
661 static int hf_afp_file_attribute_WriteInhibit = -1;
662 static int hf_afp_file_attribute_BackUpNeeded = -1;
663 static int hf_afp_file_attribute_RenameInhibit = -1;
664 static int hf_afp_file_attribute_DeleteInhibit = -1;
665 static int hf_afp_file_attribute_CopyProtect = -1;
666 static int hf_afp_file_attribute_SetClear = -1;
667
668 static int hf_afp_map_name_type = -1;
669 static int hf_afp_map_name = -1;
670 static int hf_afp_map_id = -1;
671 static int hf_afp_map_id_type = -1;
672 static int hf_afp_map_id_reply_type = -1;
673
674 static int hf_afp_request_bitmap_Attributes = -1;
675 static int hf_afp_request_bitmap_ParentDirID = -1;
676 static int hf_afp_request_bitmap_CreateDate = -1;
677 static int hf_afp_request_bitmap_ModDate = -1;
678 static int hf_afp_request_bitmap_BackupDate = -1;
679 static int hf_afp_request_bitmap_FinderInfo = -1;
680 static int hf_afp_request_bitmap_LongName = -1;
681 static int hf_afp_request_bitmap_DataForkLen = -1;
682 static int hf_afp_request_bitmap_OffspringCount = -1;
683 static int hf_afp_request_bitmap_RsrcForkLen = -1;
684 static int hf_afp_request_bitmap_ExtDataForkLen = -1;
685 static int hf_afp_request_bitmap_UTF8Name = -1;
686 static int hf_afp_request_bitmap_ExtRsrcForkLen = -1;
687 static int hf_afp_request_bitmap_PartialNames = -1;
688
689 static int ett_afp_spotlight_queries = -1;
690 static int ett_afp_spotlight_query_line = -1;
691 static int ett_afp_spotlight_query = -1;
692 static int ett_afp_spotlight_data = -1;
693 static int ett_afp_spotlight_toc = -1;
694
695 static int hf_afp_spotlight_request_flags = -1;
696 static int hf_afp_spotlight_request_command = -1;
697 static int hf_afp_spotlight_request_reserved = -1;
698 static int hf_afp_spotlight_reply_reserved = -1;
699 static int hf_afp_spotlight_volpath_server = -1;
700 static int hf_afp_spotlight_volpath_client = -1;
701 static int hf_afp_spotlight_returncode = -1;
702 static int hf_afp_spotlight_volflags = -1;
703 static int hf_afp_spotlight_reqlen = -1;
704 static int hf_afp_spotlight_uuid = -1;
705 static int hf_afp_spotlight_date = -1;
706
707 static const value_string flag_vals[] = {
708 {0, "Start" },
709 {1, "End" },
710 {0, NULL } };
711
712 static const value_string path_type_vals[] = {
713 {1, "Short names" },
714 {2, "Long names" },
715 {3, "Unicode names" },
716 {0, NULL } };
717
718 static const value_string map_name_type_vals[] = {
719 {1, "Unicode user name to a user ID" },
720 {2, "Unicode group name to a group ID" },
721 {3, "Macintosh roman user name to a user ID" },
722 {4, "Macintosh roman group name to a group ID" },
723 {5, "Unicode user name to a user UUID" },
724 {6, "Unicode group name to a group UUID" },
725 {0, NULL } };
726 static value_string_ext map_name_type_vals_ext = VALUE_STRING_EXT_INIT(map_name_type_vals);
727
728 static const value_string map_id_type_vals[] = {
729 {1, "User ID to a Macintosh roman user name" },
730 {2, "Group ID to a Macintosh roman group name" },
731 {3, "User ID to a unicode user name" },
732 {4, "Group ID to a unicode group name" },
733 {5, "User UUID to a unicode user name" },
734 {6, "Group UUID to a unicode group name" },
735 {0, NULL } };
736 static value_string_ext map_id_type_vals_ext = VALUE_STRING_EXT_INIT(map_id_type_vals);
737
738 /* map_id subfunctions 5,6: reply type */
739 static const value_string map_id_reply_type_vals[] = {
740 {1, "user name" },
741 {2, "group name" },
742 {0, NULL } };
743
744 /*
745 volume attribute from Apple AFP3.0.pdf
746 Table 1-3 p. 22
747 */
748 #define kReadOnly (1 << 0)
749 #define kHasVolumePassword (1 << 1)
750 #define kSupportsFileIDs (1 << 2)
751 #define kSupportsCatSearch (1 << 3)
752 #define kSupportsBlankAccessPrivs (1 << 4)
753 #define kSupportsUnixPrivs (1 << 5)
754 #define kSupportsUTF8Names (1 << 6)
755 /* AFP3.1 */
756 #define kNoNetworkUserIDs (1 << 7)
757 /* AFP3.2 */
758 #define kDefaultPrivsFromParent (1 << 8)
759 #define kNoExchangeFiles (1 << 9)
760 #define kSupportsExtAttrs (1 << 10)
761 #define kSupportsACLs (1 << 11)
762 /* AFP3.2+ */
763 #define kCaseSensitive (1 << 12)
764 #define kSupportsTMLockSteal (1 << 13)
765
766 /*
767 directory bitmap from Apple AFP3.1.pdf
768 Table 1-5 pp. 25-26
769 */
770 #define kFPAttributeBit (1 << 0)
771 #define kFPParentDirIDBit (1 << 1)
772 #define kFPCreateDateBit (1 << 2)
773 #define kFPModDateBit (1 << 3)
774 #define kFPBackupDateBit (1 << 4)
775 #define kFPFinderInfoBit (1 << 5)
776 #define kFPLongNameBit (1 << 6)
777 #define kFPShortNameBit (1 << 7)
778 #define kFPNodeIDBit (1 << 8)
779 #define kFPOffspringCountBit (1 << 9)
780 #define kFPOwnerIDBit (1 << 10)
781 #define kFPGroupIDBit (1 << 11)
782 #define kFPAccessRightsBit (1 << 12)
783 #define kFPUTF8NameBit (1 << 13)
784
785 /* FIXME AFP3.0 bit 14, AFP3.1 bit 15 */
786
787 #define kFPUnixPrivsBit (1 << 15)
788
789 /*
790 directory Access Rights parameter AFP3.1.pdf
791 table 1-7 p. 28
792 */
793
794 #define AR_O_SEARCH (1 << 0) /* owner has search access */
795 #define AR_O_READ (1 << 1) /* owner has read access */
796 #define AR_O_WRITE (1 << 2) /* owner has write access */
797
798 #define AR_G_SEARCH (1 << 8) /* group has search access */
799 #define AR_G_READ (1 << 9) /* group has read access */
800 #define AR_G_WRITE (1 << 10) /* group has write access */
801
802 #define AR_E_SEARCH (1 << 16) /* everyone has search access */
803 #define AR_E_READ (1 << 17) /* everyone has read access */
804 #define AR_E_WRITE (1 << 18) /* everyone has write access */
805
806 #define AR_U_SEARCH (1 << 24) /* user has search access */
807 #define AR_U_READ (1 << 25) /* user has read access */
808 #define AR_U_WRITE (1 << 26) /* user has write access */
809
810 #define AR_BLANK (1 << 28) /* Blank Access Privileges (use parent dir privileges) */
811 #define AR_U_OWN (1UL << 31) /* user is the owner */
812
813 static int hf_afp_dir_ar = -1;
814 static int hf_afp_dir_ar_o_search = -1;
815 static int hf_afp_dir_ar_o_read = -1;
816 static int hf_afp_dir_ar_o_write = -1;
817 static int hf_afp_dir_ar_g_search = -1;
818 static int hf_afp_dir_ar_g_read = -1;
819 static int hf_afp_dir_ar_g_write = -1;
820 static int hf_afp_dir_ar_e_search = -1;
821 static int hf_afp_dir_ar_e_read = -1;
822 static int hf_afp_dir_ar_e_write = -1;
823 static int hf_afp_dir_ar_u_search = -1;
824 static int hf_afp_dir_ar_u_read = -1;
825 static int hf_afp_dir_ar_u_write = -1;
826 static int hf_afp_dir_ar_blank = -1;
827 static int hf_afp_dir_ar_u_own = -1;
828
829 static int hf_afp_user_flag = -1;
830 static int hf_afp_user_ID = -1;
831 static int hf_afp_group_ID = -1;
832 static int hf_afp_UUID = -1;
833 static int hf_afp_GRPUUID = -1;
834 static int hf_afp_user_bitmap = -1;
835 static int hf_afp_user_bitmap_UID = -1;
836 static int hf_afp_user_bitmap_GID = -1;
837 static int hf_afp_user_bitmap_UUID = -1;
838
839 static gint ett_afp_user_bitmap = -1;
840
841 static const value_string user_flag_vals[] = {
842 {0, "Use user ID" },
843 {1, "Default user" },
844 {0, NULL } };
845
846 static int hf_afp_message = -1;
847 static int hf_afp_message_type = -1;
848 static int hf_afp_message_bitmap = -1;
849 static int hf_afp_message_bitmap_REQ = -1;
850 static int hf_afp_message_bitmap_UTF = -1;
851 static int hf_afp_message_len = -1;
852
853 static gint ett_afp_message_bitmap = -1;
854
855 static const value_string server_message_type[] = {
856 {0, "Login message" },
857 {1, "Server message" },
858 {0, NULL } };
859
860 /*
861 file bitmap AFP3.1.pdf
862 Table 1-8 p. 29
863 same as dir
864 kFPAttributeBit (bit 0)
865 kFPParentDirIDBit (bit 1)
866 kFPCreateDateBit (bit 2)
867 kFPModDateBit (bit 3)
868 kFPBackupDateBit (bit 4)
869 kFPFinderInfoBit (bit 5)
870 kFPLongNameBit (bit 6)
871 kFPShortNameBit (bit 7)
872 kFPNodeIDBit (bit 8)
873
874 kFPUTF8NameBit (bit 13)
875 */
876
877 #define kFPDataForkLenBit (1 << 9)
878 #define kFPRsrcForkLenBit (1 << 10)
879 #define kFPExtDataForkLenBit (1 << 11)
880 #define kFPLaunchLimitBit (1 << 12)
881
882 #define kFPExtRsrcForkLenBit (1 << 14)
883
884 /*
885 file attribute AFP3.1.pdf
886 Table 1-9 pp. 29-31
887 */
888 #define kFPInvisibleBit (1 << 0)
889 #define kFPMultiUserBit (1 << 1)
890 #define kFPSystemBit (1 << 2)
891 #define kFPDAlreadyOpenBit (1 << 3)
892 #define kFPRAlreadyOpenBit (1 << 4)
893 #define kFPWriteInhibitBit (1 << 5)
894 #define kFPBackUpNeededBit (1 << 6)
895 #define kFPRenameInhibitBit (1 << 7)
896 #define kFPDeleteInhibitBit (1 << 8)
897 #define kFPCopyProtectBit (1 << 10)
898 #define kFPSetClearBit (1 << 15)
899
900 /* dir attribute */
901 #define kIsExpFolder (1 << 1)
902 #define kMounted (1 << 3)
903 #define kInExpFolder (1 << 4)
904
905 /* AFP 3.1 getsession token type */
906 #define kLoginWithoutID 0
907 #define kLoginWithID 1
908 #define kReconnWithID 2
909 #define kLoginWithTimeAndID 3
910 #define kReconnWithTimeAndID 4
911
912 /* modified AFP 3.1 token type cf. page 327 */
913 #define kRecon1Login 5
914 #define kRecon1ReconnectLogin 6
915 #define kRecon1Refresh 7
916 #define kGetKerberosSessionKey 8
917
918 static const value_string token_type_vals[] = {
919 {kLoginWithoutID, "LoginWithoutID"},
920 {kLoginWithID, "LoginWithID"},
921 {kReconnWithID, "ReconnWithID"},
922 {kLoginWithTimeAndID, "LoginWithTimeAndID"},
923 {kReconnWithTimeAndID, "ReconnWithTimeAndID"},
924 {kRecon1Login, "Recon1Login"},
925 {kRecon1ReconnectLogin, "Recon1ReconnectLogin"},
926 {kRecon1Refresh, "Recon1Refresh"},
927 {kGetKerberosSessionKey, "GetKerberosSessionKey"},
928
929 {0, NULL } };
930 static value_string_ext token_type_vals_ext = VALUE_STRING_EXT_INIT(token_type_vals);
931
932 /* AFP 3.2 ACL bitmap */
933 #define kFileSec_UUID (1 << 0)
934 #define kFileSec_GRPUUID (1 << 1)
935 #define kFileSec_ACL (1 << 2)
936 #define kFileSec_REMOVEACL (1 << 3)
937 #define kFileSec_Inherit (1 << 4)
938
939 static int hf_afp_acl_list_bitmap = -1;
940 static int hf_afp_acl_list_bitmap_UUID = -1;
941 static int hf_afp_acl_list_bitmap_GRPUUID = -1;
942 static int hf_afp_acl_list_bitmap_ACL = -1;
943 static int hf_afp_acl_list_bitmap_REMOVEACL = -1;
944 static int hf_afp_acl_list_bitmap_Inherit = -1;
945 static int ett_afp_acl_list_bitmap = -1;
946
947 static int hf_afp_access_bitmap = -1;
948
949 static int hf_afp_acl_entrycount = -1;
950 static int hf_afp_acl_flags = -1;
951
952 static int hf_afp_ace_flags = -1;
953
954 static int ett_afp_ace_flags = -1;
955 static int hf_afp_ace_flags_allow = -1;
956 static int hf_afp_ace_flags_deny = -1;
957 static int hf_afp_ace_flags_inherited = -1;
958 static int hf_afp_ace_flags_fileinherit = -1;
959 static int hf_afp_ace_flags_dirinherit = -1;
960 static int hf_afp_ace_flags_limitinherit = -1;
961 static int hf_afp_ace_flags_onlyinherit = -1;
962
963 /* AFP 3.2 ACE flags */
964 #define ACE_ALLOW (1 << 0)
965 #define ACE_DENY (1 << 1)
966 #define ACE_INHERITED (1 << 4)
967 #define ACE_FILE_INHERIT (1 << 5)
968 #define ACE_DIR_INHERIT (1 << 6)
969 #define ACE_LIMIT_INHERIT (1 << 7)
970 #define ACE_ONLY_INHERIT (1 << 8)
971
972 static int ett_afp_ace_entries = -1;
973 static int ett_afp_ace_entry = -1;
974
975 /* AFP 3.2 ACL access right cf page 248*/
976 #define KAUTH_VNODE_READ_DATA (1 << 1)
977 #define KAUTH_VNODE_LIST_DIRECTORY KAUTH_VNODE_READ_DATA
978 #define KAUTH_VNODE_WRITE_DATA (1 << 2)
979 #define KAUTH_VNODE_ADD_FILE KAUTH_VNODE_WRITE_DATA
980 #define KAUTH_VNODE_EXECUTE (1 << 3)
981 #define KAUTH_VNODE_SEARCH KAUTH_VNODE_EXECUTE
982 #define KAUTH_VNODE_DELETE (1 << 4)
983 #define KAUTH_VNODE_APPEND_DATA (1 << 5)
984 #define KAUTH_VNODE_ADD_SUBDIRECTORY KAUTH_VNODE_APPEND_DATA
985 #define KAUTH_VNODE_DELETE_CHILD (1 << 6)
986 #define KAUTH_VNODE_READ_ATTRIBUTES (1 << 7)
987 #define KAUTH_VNODE_WRITE_ATTRIBUTES (1 << 8)
988 #define KAUTH_VNODE_READ_EXTATTRIBUTES (1 << 9)
989 #define KAUTH_VNODE_WRITE_EXTATTRIBUTES (1 << 10)
990 #define KAUTH_VNODE_READ_SECURITY (1 << 11)
991 #define KAUTH_VNODE_WRITE_SECURITY (1 << 12)
992 #define KAUTH_VNODE_CHANGE_OWNER (1 << 13)
993 #define KAUTH_VNODE_SYNCHRONIZE (1 << 20)
994 #define KAUTH_VNODE_GENERIC_ALL (1 << 21)
995 #define KAUTH_VNODE_GENERIC_EXECUTE (1 << 22)
996 #define KAUTH_VNODE_GENERIC_WRITE (1 << 23)
997 #define KAUTH_VNODE_GENERIC_READ (1 << 24)
998
999
1000 static int hf_afp_acl_access_bitmap = -1;
1001 static int ett_afp_acl_access_bitmap = -1;
1002 static int hf_afp_acl_access_bitmap_read_data = -1;
1003 static int hf_afp_acl_access_bitmap_write_data = -1;
1004 static int hf_afp_acl_access_bitmap_execute = -1;
1005 static int hf_afp_acl_access_bitmap_delete = -1;
1006 static int hf_afp_acl_access_bitmap_append_data = -1;
1007 static int hf_afp_acl_access_bitmap_delete_child = -1;
1008 static int hf_afp_acl_access_bitmap_read_attrs = -1;
1009 static int hf_afp_acl_access_bitmap_write_attrs = -1;
1010 static int hf_afp_acl_access_bitmap_read_extattrs = -1;
1011 static int hf_afp_acl_access_bitmap_write_extattrs = -1;
1012 static int hf_afp_acl_access_bitmap_read_security = -1;
1013 static int hf_afp_acl_access_bitmap_write_security = -1;
1014 static int hf_afp_acl_access_bitmap_change_owner = -1;
1015 static int hf_afp_acl_access_bitmap_synchronize = -1;
1016 static int hf_afp_acl_access_bitmap_generic_all = -1;
1017 static int hf_afp_acl_access_bitmap_generic_execute = -1;
1018 static int hf_afp_acl_access_bitmap_generic_write = -1;
1019 static int hf_afp_acl_access_bitmap_generic_read = -1;
1020
1021
1022 #define hash_init_count 20
1023
1024 /* Forward declarations */
1025
1026 /* Hash functions */
1027 static gint afp_equal (gconstpointer v, gconstpointer v2);
1028 static guint afp_hash (gconstpointer v);
1029
1030 static gint dissect_spotlight(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset);
1031
1032 typedef struct {
1033 guint32 conversation;
1034 guint16 seq;
1035 } afp_request_key;
1036
1037 static GHashTable *afp_request_hash = NULL;
1038
1039 static guint Vol; /* volume */
1040 static guint Did; /* parent directory ID */
1041
1042 static guint64
1043 spotlight_ntoh64(tvbuff_t *tvb, gint offset, guint encoding)
1044 {
1045 if (encoding == ENC_LITTLE_ENDIAN)
1046 return tvb_get_letoh64(tvb, offset);
1047 else
1048 return tvb_get_ntoh64(tvb, offset);
1049 }
1050
1051 static gdouble
1052 spotlight_ntohieee_double(tvbuff_t *tvb, gint offset, guint encoding)
1053 {
1054 if (encoding == ENC_LITTLE_ENDIAN)
1055 return tvb_get_letohieee_double(tvb, offset);
1056 else
1057 return tvb_get_ntohieee_double(tvb, offset);
1058 }
1059
1060 /*
1061 * Returns the UTF-16 string encoding, by checking the 2-byte byte order mark.
1062 * If there is no byte order mark, -1 is returned.
1063 */
1064 static guint
1065 spotlight_get_utf16_string_encoding(tvbuff_t *tvb, gint offset, gint query_length, guint encoding) {
1066 guint utf16_encoding;
1067
1068 /* check for byte order mark */
1069 utf16_encoding = ENC_BIG_ENDIAN;
1070 if (query_length >= 2) {
1071 guint16 byte_order_mark;
1072 if (encoding == ENC_LITTLE_ENDIAN)
1073 byte_order_mark = tvb_get_letohs(tvb, offset);
1074 else
1075 byte_order_mark = tvb_get_ntohs(tvb, offset);
1076
1077 if (byte_order_mark == 0xFFFE) {
1078 utf16_encoding = ENC_BIG_ENDIAN | ENC_UTF_16;
1079 }
1080 else if (byte_order_mark == 0xFEFF) {
1081 utf16_encoding = ENC_LITTLE_ENDIAN | ENC_UTF_16;
1082 }
1083 }
1084
1085 return utf16_encoding;
1086 }
1087
1088 /* Hash Functions */
1089 static gint afp_equal (gconstpointer v, gconstpointer v2)
1090 {
1091 const afp_request_key *val1 = (const afp_request_key*)v;
1092 const afp_request_key *val2 = (const afp_request_key*)v2;
1093
1094 if (val1->conversation == val2->conversation &&
1095 val1->seq == val2->seq) {
1096 return 1;
1097 }
1098 return 0;
1099 }
1100
1101 static guint afp_hash (gconstpointer v)
1102 {
1103 const afp_request_key *afp_key = (const afp_request_key*)v;
1104 return afp_key->seq;
1105 }
1106
1107 /* --------------------------
1108 */
1109 #define PAD(x) { proto_tree_add_item(tree, hf_afp_pad, tvb, offset, x, ENC_NA); offset += x; }
1110
1111 static guint16
1112 decode_vol_bitmap (proto_tree *tree, tvbuff_t *tvb, gint offset)
1113 {
1114 proto_tree *sub_tree = NULL;
1115 proto_item *item;
1116 guint16 bitmap;
1117
1118 bitmap = tvb_get_ntohs(tvb, offset);
1119 if (tree) {
1120 item = proto_tree_add_item(tree, hf_afp_vol_bitmap, tvb, offset, 2, ENC_BIG_ENDIAN);
1121 sub_tree = proto_item_add_subtree(item, ett_afp_vol_bitmap);
1122
1123 proto_tree_add_item(sub_tree, hf_afp_vol_bitmap_Attributes, tvb, offset, 2, ENC_BIG_ENDIAN);
1124 proto_tree_add_item(sub_tree, hf_afp_vol_bitmap_Signature, tvb, offset, 2, ENC_BIG_ENDIAN);
1125 proto_tree_add_item(sub_tree, hf_afp_vol_bitmap_CreateDate, tvb, offset, 2, ENC_BIG_ENDIAN);
1126 proto_tree_add_item(sub_tree, hf_afp_vol_bitmap_ModDate, tvb, offset, 2, ENC_BIG_ENDIAN);
1127 proto_tree_add_item(sub_tree, hf_afp_vol_bitmap_BackupDate, tvb, offset, 2, ENC_BIG_ENDIAN);
1128 proto_tree_add_item(sub_tree, hf_afp_vol_bitmap_ID, tvb, offset, 2, ENC_BIG_ENDIAN);
1129 proto_tree_add_item(sub_tree, hf_afp_vol_bitmap_BytesFree, tvb, offset, 2, ENC_BIG_ENDIAN);
1130 proto_tree_add_item(sub_tree, hf_afp_vol_bitmap_BytesTotal, tvb, offset, 2, ENC_BIG_ENDIAN);
1131 proto_tree_add_item(sub_tree, hf_afp_vol_bitmap_Name, tvb, offset, 2, ENC_BIG_ENDIAN);
1132 proto_tree_add_item(sub_tree, hf_afp_vol_bitmap_ExtBytesFree, tvb, offset, 2, ENC_BIG_ENDIAN);
1133 proto_tree_add_item(sub_tree, hf_afp_vol_bitmap_ExtBytesTotal, tvb, offset, 2, ENC_BIG_ENDIAN);
1134 proto_tree_add_item(sub_tree, hf_afp_vol_bitmap_BlockSize , tvb, offset, 2, ENC_BIG_ENDIAN);
1135 }
1136
1137 return bitmap;
1138 }
1139
1140 /* -------------------------- */
1141 static guint16
1142 decode_vol_attribute (proto_tree *tree, tvbuff_t *tvb, gint offset)
1143 {
1144 proto_tree *sub_tree = NULL;
1145 proto_item *item;
1146 guint16 bitmap;
1147
1148 bitmap = tvb_get_ntohs(tvb, offset);
1149 if (tree) {
1150 item = proto_tree_add_item(tree, hf_afp_vol_attribute, tvb, offset, 2, ENC_BIG_ENDIAN);
1151 sub_tree = proto_item_add_subtree(item, ett_afp_vol_attribute);
1152
1153 proto_tree_add_item(sub_tree, hf_afp_vol_attribute_ReadOnly ,tvb, offset, 2, ENC_BIG_ENDIAN);
1154 proto_tree_add_item(sub_tree, hf_afp_vol_attribute_HasVolumePassword ,tvb, offset, 2, ENC_BIG_ENDIAN);
1155 proto_tree_add_item(sub_tree, hf_afp_vol_attribute_SupportsFileIDs ,tvb, offset, 2, ENC_BIG_ENDIAN);
1156 proto_tree_add_item(sub_tree, hf_afp_vol_attribute_SupportsCatSearch ,tvb, offset, 2, ENC_BIG_ENDIAN);
1157 proto_tree_add_item(sub_tree, hf_afp_vol_attribute_SupportsBlankAccessPrivs,tvb, offset, 2, ENC_BIG_ENDIAN);
1158 proto_tree_add_item(sub_tree, hf_afp_vol_attribute_SupportsUnixPrivs ,tvb, offset, 2, ENC_BIG_ENDIAN);
1159 proto_tree_add_item(sub_tree, hf_afp_vol_attribute_SupportsUTF8Names ,tvb, offset, 2, ENC_BIG_ENDIAN);
1160 proto_tree_add_item(sub_tree, hf_afp_vol_attribute_NoNetworkUserID ,tvb, offset, 2, ENC_BIG_ENDIAN);
1161 proto_tree_add_item(sub_tree, hf_afp_vol_attribute_DefaultPrivsFromParent ,tvb, offset, 2, ENC_BIG_ENDIAN);
1162 proto_tree_add_item(sub_tree, hf_afp_vol_attribute_NoExchangeFiles ,tvb, offset, 2, ENC_BIG_ENDIAN);
1163 proto_tree_add_item(sub_tree, hf_afp_vol_attribute_SupportsExtAttrs ,tvb, offset, 2, ENC_BIG_ENDIAN);
1164 proto_tree_add_item(sub_tree, hf_afp_vol_attribute_SupportsACLs ,tvb, offset, 2, ENC_BIG_ENDIAN);
1165 proto_tree_add_item(sub_tree, hf_afp_vol_attribute_CaseSensitive ,tvb, offset, 2, ENC_BIG_ENDIAN);
1166 proto_tree_add_item(sub_tree, hf_afp_vol_attribute_SupportsTMLockSteal ,tvb, offset, 2, ENC_BIG_ENDIAN);
1167 }
1168
1169 return bitmap;
1170 }
1171
1172 /* --------------------------
1173 cf AFP3.0.pdf page 38
1174 date are number of seconds from 12:00am on 01.01.2000 GMT
1175 backup : 0x8000000 not set
1176 from netatalk adouble.h
1177 */
1178 #define DATE_NOT_SET 0x80000000
1179 #define AD_DATE_DELTA 946684800
1180 #define AD_DATE_TO_UNIX(x) (x + AD_DATE_DELTA)
1181 static void
1182 print_date(proto_tree *tree,int id, tvbuff_t *tvb, gint offset)
1183 {
1184 time_t date = tvb_get_ntohl(tvb, offset);
1185 nstime_t tv;
1186
1187 tv.secs = AD_DATE_TO_UNIX(date);
1188 tv.nsecs = 0;
1189 proto_tree_add_time(tree, id, tvb, offset, 4, &tv);
1190 }
1191
1192 /* -------------------------- */
1193 static gint
1194 parse_vol_bitmap (proto_tree *tree, tvbuff_t *tvb, gint offset, guint16 bitmap)
1195 {
1196 guint16 nameoff = 0;
1197
1198 if ((bitmap & kFPVolAttributeBit)) {
1199 decode_vol_attribute(tree,tvb,offset);
1200 offset += 2;
1201 }
1202 if ((bitmap & kFPVolSignatureBit)) {
1203 proto_tree_add_item(tree, hf_afp_vol_signature,tvb, offset, 2, ENC_BIG_ENDIAN);
1204 offset += 2;
1205 }
1206 if ((bitmap & kFPVolCreateDateBit)) {
1207 print_date(tree, hf_afp_vol_creation_date,tvb, offset);
1208 offset += 4;
1209 }
1210 if ((bitmap & kFPVolModDateBit)) {
1211 print_date(tree, hf_afp_vol_modification_date,tvb, offset);
1212 offset += 4;
1213 }
1214 if ((bitmap & kFPVolBackupDateBit)) {
1215 print_date(tree, hf_afp_vol_backup_date,tvb, offset);
1216 offset += 4;
1217 }
1218 if ((bitmap & kFPVolIDBit)) {
1219 proto_tree_add_item(tree, hf_afp_vol_id, tvb, offset, 2, ENC_BIG_ENDIAN);
1220 offset += 2;
1221 }
1222 if ((bitmap & kFPVolBytesFreeBit)) {
1223 proto_tree_add_item(tree, hf_afp_vol_bytes_free,tvb, offset, 4, ENC_BIG_ENDIAN);
1224 offset += 4;
1225 }
1226 if ((bitmap & kFPVolBytesTotalBit)) {
1227 proto_tree_add_item(tree, hf_afp_vol_bytes_total,tvb, offset, 4, ENC_BIG_ENDIAN);
1228 offset += 4;
1229 }
1230 if ((bitmap & kFPVolNameBit)) {
1231 nameoff = tvb_get_ntohs(tvb, offset);
1232 proto_tree_add_item(tree, hf_afp_vol_name_offset,tvb, offset, 2, ENC_BIG_ENDIAN);
1233 offset += 2;
1234 }
1235 if ((bitmap & kFPVolExtBytesFreeBit)) {
1236 proto_tree_add_item(tree, hf_afp_vol_ex_bytes_free,tvb, offset, 8, ENC_BIG_ENDIAN);
1237 offset += 8;
1238 }
1239 if ((bitmap & kFPVolExtBytesTotalBit)) {
1240 proto_tree_add_item(tree, hf_afp_vol_ex_bytes_total,tvb, offset, 8, ENC_BIG_ENDIAN);
1241 offset += 8;
1242 }
1243 if ((bitmap & kFPVolBlockSizeBit)) {
1244 proto_tree_add_item(tree, hf_afp_vol_block_size,tvb, offset, 4, ENC_BIG_ENDIAN);
1245 offset += 4;
1246 }
1247 if (nameoff) {
1248 guint8 len;
1249
1250 len = tvb_get_guint8(tvb, offset);
1251 proto_tree_add_item(tree, hf_afp_vol_name, tvb, offset, 1, ENC_UTF_8|ENC_BIG_ENDIAN);
1252 offset += len +1;
1253
1254 }
1255 return offset;
1256 }
1257
1258 /* -------------------------- */
1259 static guint16
1260 decode_file_bitmap (proto_tree *tree, tvbuff_t *tvb, gint offset)
1261 {
1262 proto_tree *sub_tree = NULL;
1263 proto_item *item;
1264 guint16 bitmap;
1265
1266 bitmap = tvb_get_ntohs(tvb, offset);
1267 if (tree) {
1268 item = proto_tree_add_item(tree, hf_afp_file_bitmap, tvb, offset, 2, ENC_BIG_ENDIAN);
1269 sub_tree = proto_item_add_subtree(item, ett_afp_file_bitmap);
1270
1271 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_Attributes , tvb, offset, 2, ENC_BIG_ENDIAN);
1272 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_ParentDirID , tvb, offset, 2, ENC_BIG_ENDIAN);
1273 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_CreateDate , tvb, offset, 2, ENC_BIG_ENDIAN);
1274 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_ModDate , tvb, offset, 2, ENC_BIG_ENDIAN);
1275 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_BackupDate , tvb, offset, 2, ENC_BIG_ENDIAN);
1276 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_FinderInfo , tvb, offset, 2, ENC_BIG_ENDIAN);
1277 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_LongName , tvb, offset, 2, ENC_BIG_ENDIAN);
1278 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_ShortName , tvb, offset, 2, ENC_BIG_ENDIAN);
1279 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_NodeID , tvb, offset, 2, ENC_BIG_ENDIAN);
1280
1281 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_DataForkLen , tvb, offset, 2, ENC_BIG_ENDIAN);
1282 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_RsrcForkLen , tvb, offset, 2, ENC_BIG_ENDIAN);
1283 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_ExtDataForkLen , tvb, offset, 2, ENC_BIG_ENDIAN);
1284 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_LaunchLimit , tvb, offset, 2, ENC_BIG_ENDIAN);
1285 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_UTF8Name , tvb, offset, 2, ENC_BIG_ENDIAN);
1286
1287 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_ExtRsrcForkLen , tvb, offset, 2, ENC_BIG_ENDIAN);
1288 proto_tree_add_item(sub_tree, hf_afp_file_bitmap_UnixPrivs , tvb, offset, 2, ENC_BIG_ENDIAN);
1289 }
1290
1291 return bitmap;
1292 }
1293
1294 /* -------------------------- */
1295 static guint16
1296 decode_file_attribute(proto_tree *tree, tvbuff_t *tvb, gint offset, int shared)
1297 {
1298 proto_tree *sub_tree = NULL;
1299 proto_item *item;
1300 guint16 attribute;
1301
1302 attribute = tvb_get_ntohs(tvb, offset);
1303 if (!tree) {
1304 return attribute;
1305 }
1306 item = proto_tree_add_text(tree, tvb, offset, 2,
1307 "File Attributes: 0x%04x", attribute);
1308 sub_tree = proto_item_add_subtree(item, ett_afp_file_attribute);
1309 proto_tree_add_item(sub_tree, hf_afp_file_attribute_Invisible , tvb, offset, 2, ENC_BIG_ENDIAN);
1310 if (!shared)
1311 proto_tree_add_item(sub_tree, hf_afp_file_attribute_MultiUser , tvb, offset, 2, ENC_BIG_ENDIAN);
1312
1313 proto_tree_add_item(sub_tree, hf_afp_file_attribute_System , tvb, offset, 2, ENC_BIG_ENDIAN);
1314
1315 if (!shared) {
1316 proto_tree_add_item(sub_tree, hf_afp_file_attribute_DAlreadyOpen , tvb, offset, 2, ENC_BIG_ENDIAN);
1317 proto_tree_add_item(sub_tree, hf_afp_file_attribute_RAlreadyOpen , tvb, offset, 2, ENC_BIG_ENDIAN);
1318 }
1319 /* writeinhibit is file only but Macs are setting it with FPSetFileDirParms too */
1320 proto_tree_add_item(sub_tree, hf_afp_file_attribute_WriteInhibit , tvb, offset, 2, ENC_BIG_ENDIAN);
1321 proto_tree_add_item(sub_tree, hf_afp_file_attribute_BackUpNeeded , tvb, offset, 2, ENC_BIG_ENDIAN);
1322 proto_tree_add_item(sub_tree, hf_afp_file_attribute_RenameInhibit, tvb, offset, 2, ENC_BIG_ENDIAN);
1323 proto_tree_add_item(sub_tree, hf_afp_file_attribute_DeleteInhibit, tvb, offset, 2, ENC_BIG_ENDIAN);
1324
1325 if (!shared)
1326 proto_tree_add_item(sub_tree, hf_afp_file_attribute_CopyProtect , tvb, offset, 2, ENC_BIG_ENDIAN);
1327
1328 proto_tree_add_item(sub_tree, hf_afp_file_attribute_SetClear , tvb, offset, 2, ENC_BIG_ENDIAN);
1329
1330 return(attribute);
1331 }
1332
1333 static void
1334 decode_access_rights (proto_tree *tree, tvbuff_t *tvb, int hf, gint offset)
1335 {
1336 proto_tree *sub_tree;
1337 proto_item *item;
1338
1339 if (tree) {
1340 item = proto_tree_add_item(tree, hf, tvb, offset, 4, ENC_BIG_ENDIAN);
1341 sub_tree = proto_item_add_subtree(item, ett_afp_dir_ar);
1342
1343 proto_tree_add_item(sub_tree, hf_afp_dir_ar_o_search, tvb, offset, 4, ENC_BIG_ENDIAN);
1344 proto_tree_add_item(sub_tree, hf_afp_dir_ar_o_read , tvb, offset, 4, ENC_BIG_ENDIAN);
1345 proto_tree_add_item(sub_tree, hf_afp_dir_ar_o_write , tvb, offset, 4, ENC_BIG_ENDIAN);
1346
1347 proto_tree_add_item(sub_tree, hf_afp_dir_ar_g_search, tvb, offset, 4, ENC_BIG_ENDIAN);
1348 proto_tree_add_item(sub_tree, hf_afp_dir_ar_g_read , tvb, offset, 4, ENC_BIG_ENDIAN);
1349 proto_tree_add_item(sub_tree, hf_afp_dir_ar_g_write , tvb, offset, 4, ENC_BIG_ENDIAN);
1350
1351 proto_tree_add_item(sub_tree, hf_afp_dir_ar_e_search, tvb, offset, 4, ENC_BIG_ENDIAN);
1352 proto_tree_add_item(sub_tree, hf_afp_dir_ar_e_read , tvb, offset, 4, ENC_BIG_ENDIAN);
1353 proto_tree_add_item(sub_tree, hf_afp_dir_ar_e_write , tvb, offset, 4, ENC_BIG_ENDIAN);
1354
1355 proto_tree_add_item(sub_tree, hf_afp_dir_ar_u_search, tvb, offset, 4, ENC_BIG_ENDIAN);
1356 proto_tree_add_item(sub_tree, hf_afp_dir_ar_u_read , tvb, offset, 4, ENC_BIG_ENDIAN);
1357 proto_tree_add_item(sub_tree, hf_afp_dir_ar_u_write , tvb, offset, 4, ENC_BIG_ENDIAN);
1358
1359 proto_tree_add_item(sub_tree, hf_afp_dir_ar_blank , tvb, offset, 4, ENC_BIG_ENDIAN);
1360 proto_tree_add_item(sub_tree, hf_afp_dir_ar_u_own , tvb, offset, 4, ENC_BIG_ENDIAN);
1361 }
1362 }
1363
1364 static void
1365 decode_unix_privs (proto_tree *tree, tvbuff_t *tvb, gint offset)
1366 {
1367 proto_tree *sub_tree;
1368 proto_item *item;
1369
1370 if (tree) {
1371 item = proto_tree_add_text(tree, tvb, offset, 16,
1372 "UNIX privileges");
1373 sub_tree = proto_item_add_subtree(item, ett_afp_unix_privs);
1374
1375 proto_tree_add_item(sub_tree, hf_afp_unix_privs_uid, tvb, offset, 4, ENC_BIG_ENDIAN);
1376 proto_tree_add_item(sub_tree, hf_afp_unix_privs_gid, tvb, offset+4, 4, ENC_BIG_ENDIAN);
1377 proto_tree_add_item(sub_tree, hf_afp_unix_privs_permissions, tvb, offset+8, 4, ENC_BIG_ENDIAN);
1378 decode_access_rights(sub_tree, tvb, hf_afp_unix_privs_ua_permissions, offset+12);
1379 }
1380 }
1381
1382 /* -------------------------- */
1383 static gint
1384 parse_long_filename(proto_tree *tree, tvbuff_t *tvb, gint offset, gint org_offset)
1385 {
1386 guint16 lnameoff;
1387 gint tp_ofs = 0;
1388 guint8 len;
1389
1390 lnameoff = tvb_get_ntohs(tvb, offset);
1391 proto_tree_add_item(tree, hf_afp_long_name_offset,tvb, offset, 2, ENC_BIG_ENDIAN);
1392 if (lnameoff) {
1393 tp_ofs = lnameoff +org_offset;
1394 len = tvb_get_guint8(tvb, tp_ofs);
1395 proto_tree_add_item(tree, hf_afp_path_len, tvb, tp_ofs, 1, ENC_BIG_ENDIAN);
1396 tp_ofs++;
1397 proto_tree_add_item(tree, hf_afp_path_name, tvb, tp_ofs, len, ENC_UTF_8|ENC_NA);
1398 tp_ofs += len;
1399 }
1400 return tp_ofs;
1401 }
1402
1403 /* -------------------------- */
1404 static gint
1405 parse_UTF8_filename(proto_tree *tree, tvbuff_t *tvb, gint offset, gint org_offset)
1406 {
1407 guint16 unameoff;
1408 gint tp_ofs = 0;
1409 guint16 len;
1410
1411 unameoff = tvb_get_ntohs(tvb, offset);
1412 proto_tree_add_item(tree, hf_afp_unicode_name_offset,tvb, offset, 2, ENC_BIG_ENDIAN);
1413 offset += 2;
1414 if (unameoff) {
1415 /* FIXME AFP3.x reuses PDINFO bit for UTF8.
1416 * In enumerate_ext it's pad with 4 bytes, PDINFO was 6 bytes,
1417 * but not in catsearch_ext.
1418 * Last but not least there's a bug in OSX catsearch_ext for spec2
1419 * offset is off by 2 bytes.
1420 */
1421
1422 tp_ofs = unameoff +org_offset;
1423 if (tp_ofs > offset) {
1424 PAD(4);
1425 }
1426 else if (tp_ofs < offset) {
1427 tp_ofs = offset;
1428 }
1429 proto_tree_add_item( tree, hf_afp_path_unicode_hint, tvb, tp_ofs, 4, ENC_BIG_ENDIAN);
1430 tp_ofs += 4;
1431
1432 len = tvb_get_ntohs(tvb, tp_ofs);
1433 proto_tree_add_item( tree, hf_afp_path_unicode_len, tvb, tp_ofs, 2, ENC_BIG_ENDIAN);
1434 tp_ofs += 2;
1435
1436 proto_tree_add_item(tree, hf_afp_path_name, tvb, tp_ofs, len, ENC_UTF_8|ENC_NA);
1437 tp_ofs += len;
1438 }
1439 return tp_ofs;
1440 }
1441
1442 /* -------------------------- */
1443 static gint
1444 parse_file_bitmap (proto_tree *tree, tvbuff_t *tvb, gint offset, guint16 bitmap, int shared)
1445 {
1446 /* guint16 snameoff = 0; */
1447 gint max_offset = 0;
1448
1449 gint org_offset = offset;
1450
1451 if ((bitmap & kFPAttributeBit)) {
1452 decode_file_attribute(tree, tvb, offset, shared);
1453 offset += 2;
1454 }
1455 if ((bitmap & kFPParentDirIDBit)) {
1456 proto_tree_add_item(tree, hf_afp_did, tvb, offset, 4, ENC_BIG_ENDIAN);
1457 offset += 4;
1458 }
1459 if ((bitmap & kFPCreateDateBit)) {
1460 print_date(tree, hf_afp_creation_date,tvb, offset);
1461 offset += 4;
1462 }
1463 if ((bitmap & kFPModDateBit)) {
1464 print_date(tree, hf_afp_modification_date,tvb, offset);
1465 offset += 4;
1466 }
1467 if ((bitmap & kFPBackupDateBit)) {
1468 print_date(tree, hf_afp_backup_date,tvb, offset);
1469 offset += 4;
1470 }
1471 if ((bitmap & kFPFinderInfoBit)) {
1472 proto_tree_add_item(tree, hf_afp_finder_info,tvb, offset, 32, ENC_NA);
1473 offset += 32;
1474 }
1475 if ((bitmap & kFPLongNameBit)) {
1476 gint tp_ofs;
1477
1478 tp_ofs = parse_long_filename(tree, tvb, offset, org_offset);
1479 max_offset = (tp_ofs >max_offset)?tp_ofs:max_offset;
1480
1481 offset += 2;
1482
1483 }
1484 if ((bitmap & kFPShortNameBit)) {
1485 /* snameoff = tvb_get_ntohs(tvb, offset); */
1486 proto_tree_add_item(tree, hf_afp_short_name_offset,tvb, offset, 2, ENC_BIG_ENDIAN);
1487 offset += 2;
1488 }
1489 if ((bitmap & kFPNodeIDBit)) {
1490 proto_tree_add_item(tree, hf_afp_file_id, tvb, offset, 4, ENC_BIG_ENDIAN);
1491 offset += 4;
1492 }
1493
1494 if ((bitmap & kFPDataForkLenBit)) {
1495 proto_tree_add_item(tree, hf_afp_file_DataForkLen, tvb, offset, 4, ENC_BIG_ENDIAN);
1496 offset += 4;
1497 }
1498
1499 if ((bitmap & kFPRsrcForkLenBit)) {
1500 proto_tree_add_item(tree, hf_afp_file_RsrcForkLen, tvb, offset, 4, ENC_BIG_ENDIAN);
1501 offset += 4;
1502 }
1503
1504 if ((bitmap & kFPExtDataForkLenBit)) {
1505 proto_tree_add_item(tree, hf_afp_file_ExtDataForkLen, tvb, offset, 8, ENC_BIG_ENDIAN);
1506 offset += 8;
1507 }
1508
1509 if ((bitmap & kFPLaunchLimitBit)) {
1510 offset += 2; /* ? */
1511 }
1512
1513 if ((bitmap & kFPUTF8NameBit)) {
1514 gint tp_ofs;
1515
1516 tp_ofs = parse_UTF8_filename(tree, tvb, offset, org_offset);
1517 max_offset = (tp_ofs >max_offset)?tp_ofs:max_offset;
1518 offset += 6;
1519 }
1520
1521 if ((bitmap & kFPExtRsrcForkLenBit)) {
1522 proto_tree_add_item(tree, hf_afp_file_ExtRsrcForkLen, tvb, offset, 8, ENC_BIG_ENDIAN);
1523 offset += 8;
1524 }
1525
1526 if ((bitmap & kFPUnixPrivsBit)) {
1527 /*
1528 * XXX - the AFP 3.0 spec says this is "Four bytes", but
1529 * also says the privileges are "stored in an FPUnixPrivs
1530 * structure", which is 16 bytes long.
1531 *
1532 * We assume, for now, that the latter is true.
1533 */
1534 decode_unix_privs(tree, tvb, offset);
1535 offset += 16;
1536 }
1537
1538 return (max_offset)?max_offset:offset;
1539 }
1540
1541 /* -------------------------- */
1542 static guint16
1543 decode_dir_bitmap (proto_tree *tree, tvbuff_t *tvb, gint offset)
1544 {
1545 proto_tree *sub_tree = NULL;
1546 proto_item *item;
1547 guint16 bitmap;
1548
1549 bitmap = tvb_get_ntohs(tvb, offset);
1550 if (tree) {
1551 item = proto_tree_add_item(tree, hf_afp_dir_bitmap, tvb, offset, 2, ENC_BIG_ENDIAN);
1552 sub_tree = proto_item_add_subtree(item, ett_afp_dir_bitmap);
1553
1554 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_Attributes , tvb, offset, 2, ENC_BIG_ENDIAN);
1555 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_ParentDirID , tvb, offset, 2, ENC_BIG_ENDIAN);
1556 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_CreateDate , tvb, offset, 2, ENC_BIG_ENDIAN);
1557 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_ModDate , tvb, offset, 2, ENC_BIG_ENDIAN);
1558 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_BackupDate , tvb, offset, 2, ENC_BIG_ENDIAN);
1559 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_FinderInfo , tvb, offset, 2, ENC_BIG_ENDIAN);
1560 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_LongName , tvb, offset, 2, ENC_BIG_ENDIAN);
1561 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_ShortName , tvb, offset, 2, ENC_BIG_ENDIAN);
1562 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_NodeID , tvb, offset, 2, ENC_BIG_ENDIAN);
1563 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_OffspringCount , tvb, offset, 2, ENC_BIG_ENDIAN);
1564 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_OwnerID , tvb, offset, 2, ENC_BIG_ENDIAN);
1565 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_GroupID , tvb, offset, 2, ENC_BIG_ENDIAN);
1566 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_AccessRights , tvb, offset, 2, ENC_BIG_ENDIAN);
1567 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_UTF8Name , tvb, offset, 2, ENC_BIG_ENDIAN);
1568 proto_tree_add_item(sub_tree, hf_afp_dir_bitmap_UnixPrivs , tvb, offset, 2, ENC_BIG_ENDIAN);
1569 }
1570
1571 return bitmap;
1572 }
1573
1574 /* -------------------------- */
1575 static guint16
1576 decode_dir_attribute(proto_tree *tree, tvbuff_t *tvb, gint offset)
1577 {
1578 proto_tree *sub_tree = NULL;
1579 proto_item *item;
1580 guint16 attribute;
1581
1582 attribute = tvb_get_ntohs(tvb, offset);
1583 if (tree) {
1584 item = proto_tree_add_text(tree, tvb, offset, 2,
1585 "Directory Attributes: 0x%04x", attribute);
1586 sub_tree = proto_item_add_subtree(item, ett_afp_dir_attribute);
1587
1588 proto_tree_add_item(sub_tree, hf_afp_dir_attribute_Invisible , tvb, offset, 2, ENC_BIG_ENDIAN);
1589 proto_tree_add_item(sub_tree, hf_afp_dir_attribute_IsExpFolder , tvb, offset, 2, ENC_BIG_ENDIAN);
1590 proto_tree_add_item(sub_tree, hf_afp_dir_attribute_System , tvb, offset, 2, ENC_BIG_ENDIAN);
1591 proto_tree_add_item(sub_tree, hf_afp_dir_attribute_Mounted , tvb, offset, 2, ENC_BIG_ENDIAN);
1592 proto_tree_add_item(sub_tree, hf_afp_dir_attribute_InExpFolder , tvb, offset, 2, ENC_BIG_ENDIAN);
1593 proto_tree_add_item(sub_tree, hf_afp_dir_attribute_BackUpNeeded , tvb, offset, 2, ENC_BIG_ENDIAN);
1594 proto_tree_add_item(sub_tree, hf_afp_dir_attribute_RenameInhibit, tvb, offset, 2, ENC_BIG_ENDIAN);
1595 proto_tree_add_item(sub_tree, hf_afp_dir_attribute_DeleteInhibit, tvb, offset, 2, ENC_BIG_ENDIAN);
1596 }
1597
1598 return(attribute);
1599 }
1600
1601 /* -------------------------- */
1602 static gint
1603 parse_dir_bitmap (proto_tree *tree, tvbuff_t *tvb, gint offset, guint16 bitmap)
1604 {
1605 /* guint16 snameoff = 0; */
1606 gint max_offset = 0;
1607
1608 gint org_offset = offset;
1609
1610 if ((bitmap & kFPAttributeBit)) {
1611 decode_dir_attribute(tree, tvb, offset);
1612 offset += 2;
1613 }
1614 if ((bitmap & kFPParentDirIDBit)) {
1615 proto_tree_add_item(tree, hf_afp_did, tvb, offset, 4, ENC_BIG_ENDIAN);
1616 offset += 4;
1617 }
1618 if ((bitmap & kFPCreateDateBit)) {
1619 print_date(tree, hf_afp_creation_date,tvb, offset);
1620 offset += 4;
1621 }
1622 if ((bitmap & kFPModDateBit)) {
1623 print_date(tree, hf_afp_modification_date,tvb, offset);
1624 offset += 4;
1625 }
1626 if ((bitmap & kFPBackupDateBit)) {
1627 print_date(tree, hf_afp_backup_date,tvb, offset);
1628 offset += 4;
1629 }
1630 if ((bitmap & kFPFinderInfoBit)) {
1631 proto_tree_add_item(tree, hf_afp_finder_info,tvb, offset, 32, ENC_NA);
1632 offset += 32;
1633 }
1634 if ((bitmap & kFPLongNameBit)) {
1635 gint tp_ofs;
1636
1637 tp_ofs = parse_long_filename(tree, tvb, offset, org_offset);
1638 max_offset = (tp_ofs >max_offset)?tp_ofs:max_offset;
1639
1640 offset += 2;
1641 }
1642 if ((bitmap & kFPShortNameBit)) {
1643 /* snameoff = tvb_get_ntohs(tvb, offset); */
1644 proto_tree_add_item(tree, hf_afp_short_name_offset,tvb, offset, 2, ENC_BIG_ENDIAN);
1645 offset += 2;
1646 }
1647 if ((bitmap & kFPNodeIDBit)) {
1648 proto_tree_add_item(tree, hf_afp_file_id, tvb, offset, 4, ENC_BIG_ENDIAN);
1649 offset += 4;
1650 }
1651 if ((bitmap & kFPOffspringCountBit)) {
1652 proto_tree_add_item(tree, hf_afp_dir_offspring, tvb, offset, 2, ENC_BIG_ENDIAN);
1653 offset += 2; /* error in AFP3.0.pdf */
1654 }
1655 if ((bitmap & kFPOwnerIDBit)) {
1656 proto_tree_add_item(tree, hf_afp_dir_OwnerID, tvb, offset, 4, ENC_BIG_ENDIAN);
1657 offset += 4;
1658 }
1659 if ((bitmap & kFPGroupIDBit)) {
1660 proto_tree_add_item(tree, hf_afp_dir_GroupID, tvb, offset, 4, ENC_BIG_ENDIAN);
1661 offset += 4;
1662 }
1663 if ((bitmap & kFPAccessRightsBit)) {
1664 decode_access_rights(tree, tvb, hf_afp_dir_ar, offset);
1665 offset += 4;
1666 }
1667 if ((bitmap & kFPUTF8NameBit)) {
1668 gint tp_ofs;
1669
1670 tp_ofs = parse_UTF8_filename(tree, tvb, offset, org_offset);
1671 max_offset = (tp_ofs >max_offset)?tp_ofs:max_offset;
1672 offset += 6;
1673 }
1674 if ((bitmap & kFPUnixPrivsBit)) {
1675 /*
1676 * XXX - the AFP 3.0 spec says this is "Four bytes", but
1677 * also says the privileges are "stored in an FPUnixPrivs
1678 * structure", which is 16 bytes long.
1679 *
1680 * We assume, for now, that the latter is true.
1681 */
1682 decode_unix_privs(tree, tvb, offset);
1683 offset += 16;
1684 }
1685 return (max_offset)?max_offset:offset;
1686 }
1687
1688 /* -------------------------- */
1689 static guint8 *
1690 name_in_bitmap(tvbuff_t *tvb, gint offset, guint16 bitmap, int isdir)
1691 {
1692 guint8 *name;
1693 gint org_offset = offset;
1694 guint16 nameoff;
1695 guint8 len;
1696 guint16 len16;
1697 gint tp_ofs;
1698
1699 if ((bitmap & kFPAttributeBit)) /* 0 */
1700 offset += 2;
1701 if ((bitmap & kFPParentDirIDBit)) /* 1 */
1702 offset += 4;
1703 if ((bitmap & kFPCreateDateBit)) /* 2 */
1704 offset += 4;
1705 if ((bitmap & kFPModDateBit)) /* 3 */
1706 offset += 4;
1707 if ((bitmap & kFPBackupDateBit)) /* 4 */
1708 offset += 4;
1709 if ((bitmap & kFPFinderInfoBit)) /* 5 */
1710 offset += 32;
1711
1712 if ((bitmap & kFPLongNameBit)) { /* 6 */
1713 nameoff = tvb_get_ntohs(tvb, offset);
1714 if (nameoff) {
1715 tp_ofs = nameoff +org_offset;
1716 len = tvb_get_guint8(tvb, tp_ofs);
1717 tp_ofs++;
1718 name = tvb_get_string(wmem_packet_scope(), tvb, tp_ofs, len);
1719 return name;
1720 }
1721 offset += 2;
1722 }
1723
1724 if ((bitmap & kFPShortNameBit)) /* 7 */
1725 offset += 2;
1726 if ((bitmap & kFPNodeIDBit)) /* 8 */
1727 offset += 4;
1728
1729 if (isdir) {
1730 if ((bitmap & kFPOffspringCountBit)) /* 9 */
1731 offset += 2;
1732 if ((bitmap & kFPOwnerIDBit)) /* 10*/
1733 offset += 4;
1734 if ((bitmap & kFPGroupIDBit)) /* 11*/
1735 offset += 4;
1736 if ((bitmap & kFPAccessRightsBit)) /* 12*/
1737 offset += 4;
1738 }
1739 else {
1740 if ((bitmap & kFPDataForkLenBit)) /* 9 */
1741 offset += 4;
1742 if ((bitmap & kFPRsrcForkLenBit)) /* 10*/
1743 offset += 4;
1744 if ((bitmap & kFPExtDataForkLenBit)) /* 11*/
1745 offset += 8;
1746 if ((bitmap & kFPLaunchLimitBit)) /* 12*/
1747 offset += 2; /* FIXME ? */
1748 }
1749
1750 if ((bitmap & kFPUTF8NameBit)) { /* 13 */
1751 nameoff = tvb_get_ntohs(tvb, offset);
1752 if (nameoff) {
1753 tp_ofs = nameoff +org_offset +4;
1754 len16 = tvb_get_ntohs(tvb, tp_ofs);
1755 tp_ofs += 2;
1756 name = tvb_get_string(wmem_packet_scope(), tvb, tp_ofs, len16);
1757 return name;
1758 }
1759 }
1760 return NULL;
1761 }
1762
1763 /* -------------------------- */
1764 static guint8 *
1765 name_in_dbitmap(tvbuff_t *tvb, gint offset, guint16 bitmap)
1766 {
1767 guint8 *name;
1768
1769 name = name_in_bitmap(tvb, offset, bitmap, 1);
1770 if (name != NULL)
1771 return name;
1772 /*
1773 check UTF8 name
1774 */
1775
1776 return name;
1777 }
1778
1779 /* -------------------------- */
1780 static guint8 *
1781 name_in_fbitmap(tvbuff_t *tvb, gint offset, guint16 bitmap)
1782 {
1783 guint8 *name;
1784
1785 name = name_in_bitmap(tvb, offset, bitmap, 0);
1786 if (name != NULL)
1787 return name;
1788 /*
1789 check UTF8 name
1790 */
1791
1792 return name;
1793 }
1794
1795 /* -------------------------- */
1796 static gint
1797 decode_vol(proto_tree *tree, tvbuff_t *tvb, gint offset)
1798 {
1799 Vol = tvb_get_ntohs(tvb, offset);
1800 proto_tree_add_item(tree, hf_afp_vol_id, tvb, offset, 2, ENC_BIG_ENDIAN);
1801 return offset + 2;
1802 }
1803
1804 /* -------------------------- */
1805 static gint
1806 decode_vol_did(proto_tree *tree, tvbuff_t *tvb, gint offset)
1807 {
1808 Vol = tvb_get_ntohs(tvb, offset);
1809 proto_tree_add_item(tree, hf_afp_vol_id, tvb, offset, 2, ENC_BIG_ENDIAN);
1810 offset += 2;
1811
1812 Did = tvb_get_ntohl(tvb, offset);
1813 proto_tree_add_item(tree, hf_afp_did, tvb, offset, 4, ENC_BIG_ENDIAN);
1814 offset += 4;
1815 return offset;
1816 }
1817
1818 /* -------------------------- */
1819 static gint
1820 decode_vol_did_file_dir_bitmap (proto_tree *tree, tvbuff_t *tvb, gint offset)
1821 {
1822 offset = decode_vol_did(tree, tvb, offset);
1823
1824 decode_file_bitmap(tree, tvb, offset);
1825 offset += 2;
1826
1827 decode_dir_bitmap(tree, tvb, offset);
1828 offset += 2;
1829
1830 return offset;
1831 }
1832
1833 /* ------------------------ */
1834 static const gchar *
1835 get_name(tvbuff_t *tvb, int offset, int type)
1836 {
1837 int len;
1838 const gchar *string;
1839
1840 switch (type) {
1841 case 1:
1842 case 2:
1843 len = tvb_get_guint8(tvb, offset);
1844 offset++;
1845 string = tvb_format_text(tvb,offset, len);
1846 break;
1847 case 3:
1848 len = tvb_get_ntohs(tvb, offset +4);
1849 offset += 6;
1850 string = tvb_format_text(tvb,offset, len);
1851 break;
1852 default:
1853 string = "Unknown type";
1854 break;
1855 }
1856 return string;
1857 }
1858 /* -------------------------- */
1859 static gint
1860 decode_name_label (proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, gint offset, const gchar *label)
1861 {
1862 int len;
1863 int header;
1864 const gchar *name;
1865 guint8 type;
1866 proto_tree *sub_tree = NULL;
1867 proto_item *item;
1868
1869 type = tvb_get_guint8(tvb, offset);
1870 if (type == 3) {
1871 header = 7;
1872 len = tvb_get_ntohs(tvb, offset +5);
1873 }
1874 else {
1875 header = 2;
1876 len = tvb_get_guint8(tvb, offset +1);
1877 }
1878 name = get_name(tvb, offset +1, type);
1879
1880 if (pinfo) {
1881 col_append_fstr(pinfo->cinfo, COL_INFO, ": Vol=%u Did=%u", Vol, Did);
1882 if (len) {
1883 col_append_fstr(pinfo->cinfo, COL_INFO, " Name=%s", name);
1884 }
1885 }
1886
1887 if (tree) {
1888 item = proto_tree_add_text(tree, tvb, offset, len +header, label, name);
1889 sub_tree = proto_item_add_subtree(item, ett_afp_path_name);
1890
1891 proto_tree_add_item( sub_tree, hf_afp_path_type, tvb, offset, 1, ENC_BIG_ENDIAN);
1892 offset++;
1893 if (type == 3) {
1894 proto_tree_add_item( sub_tree, hf_afp_path_unicode_hint, tvb, offset, 4, ENC_BIG_ENDIAN);
1895 offset += 4;
1896 proto_tree_add_item( sub_tree, hf_afp_path_unicode_len, tvb, offset, 2, ENC_BIG_ENDIAN);
1897 offset += 2;
1898 }
1899 else {
1900 proto_tree_add_item( sub_tree, hf_afp_path_len, tvb, offset, 1, ENC_BIG_ENDIAN);
1901 offset++;
1902 }
1903
1904 proto_tree_add_string(sub_tree, hf_afp_path_name, tvb, offset, len,name);
1905 }
1906 else
1907 offset += header;
1908
1909 return offset +len;
1910 }
1911
1912 /* -------------------------- */
1913 static gint
1914 decode_name (proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, gint offset)
1915 {
1916 return decode_name_label(tree, pinfo, tvb, offset, "Path: %s");
1917 }
1918
1919 /* -------------------------- */
1920 static void
1921 add_info_fork(tvbuff_t *tvb, packet_info *pinfo, gint offset)
1922 {
1923 guint16 ofork;
1924
1925 ofork = tvb_get_ntohs(tvb, offset);
1926 if (ofork) {
1927 col_append_fstr(pinfo->cinfo, COL_INFO, ": Fork=%u", ofork);
1928 }
1929 }
1930
1931 /* -------------------------- */
1932 static void
1933 add_info_vol(tvbuff_t *tvb, packet_info *pinfo, gint offset)
1934 {
1935 guint16 vol;
1936
1937 vol = tvb_get_ntohs(tvb, offset);
1938 col_append_fstr(pinfo->cinfo, COL_INFO, ": Vol=%u", vol);
1939 }
1940
1941 /* ************************** */
1942 static gint
1943 dissect_query_afp_open_vol(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
1944 {
1945 int len;
1946 const gchar *rep;
1947
1948 PAD(1);
1949
1950 decode_vol_bitmap(tree, tvb, offset);
1951 offset += 2;
1952
1953 len = tvb_get_guint8(tvb, offset);
1954
1955 rep = get_name(tvb, offset, 2);
1956 col_append_fstr(pinfo->cinfo, COL_INFO, ": %s", rep);
1957
1958 if (!tree)
1959 return offset;
1960
1961 proto_tree_add_item(tree, hf_afp_vol_name, tvb, offset, 1, ENC_UTF_8|ENC_BIG_ENDIAN);
1962 offset += len +1;
1963
1964 len = tvb_reported_length_remaining(tvb,offset);
1965 if (len >= 8) {
1966 /* optional password */
1967 proto_tree_add_item(tree, hf_afp_passwd, tvb, offset, 8, ENC_UTF_8|ENC_NA);
1968 offset += 8;
1969 }
1970 return offset;
1971 }
1972
1973 /* -------------------------- */
1974 static gint
1975 dissect_reply_afp_open_vol(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
1976 {
1977 guint16 bitmap;
1978
1979 if (!tree)
1980 return offset;
1981 bitmap = decode_vol_bitmap(tree, tvb, offset);
1982 offset += 2;
1983 offset = parse_vol_bitmap(tree, tvb, offset, bitmap);
1984
1985 return offset;
1986 }
1987
1988 /* ************************** */
1989 static gint
1990 dissect_reply_afp_get_server_param(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
1991 {
1992 guint8 num;
1993 guint8 len;
1994 guint8 flag;
1995 guint8 i;
1996 proto_tree *sub_tree = NULL;
1997 proto_tree *flag_tree;
1998 proto_item *item;
1999 proto_item *ti;
2000
2001 if (!tree)
2002 return offset;
2003
2004 print_date(tree, hf_afp_server_time,tvb, offset);
2005 offset += 4;
2006
2007 num = tvb_get_guint8(tvb, offset);
2008 item = proto_tree_add_text(tree, tvb, offset, 1, "Volumes : %d", num);
2009 sub_tree = proto_item_add_subtree(item, ett_afp_server_vol);
2010 offset++;
2011
2012 for (i = 0; i < num; i++) {
2013 const gchar *rep;
2014
2015 item = proto_tree_add_text(sub_tree, tvb, offset, -1,"Volume");
2016 tree = proto_item_add_subtree(item, ett_afp_vol_list);
2017
2018 flag = tvb_get_guint8(tvb, offset);
2019
2020 ti = proto_tree_add_text(tree, tvb, offset , 1,"Flags : 0x%02x", flag);
2021 flag_tree = proto_item_add_subtree(ti, ett_afp_vol_flag);
2022 proto_tree_add_item(flag_tree, hf_afp_vol_flag_passwd, tvb, offset, 1, ENC_BIG_ENDIAN);
2023 proto_tree_add_item(flag_tree, hf_afp_vol_flag_has_config, tvb, offset, 1, ENC_BIG_ENDIAN);
2024 offset++;
2025
2026 len = tvb_get_guint8(tvb, offset) +1;
2027 rep = get_name(tvb, offset, 2);
2028 proto_item_set_text(item, "%s", rep);
2029 proto_item_set_len(item, len +1);
2030
2031 proto_tree_add_item(tree, hf_afp_vol_name, tvb, offset, 1, ENC_UTF_8|ENC_BIG_ENDIAN);
2032
2033 offset += len;
2034 }
2035 return offset;
2036 }
2037
2038 /* **************************
2039 next calls use the same format :
2040 1 pad byte
2041 volume id
2042 AFP_FLUSH
2043 AFP_CLOSEVOL
2044 AFP_OPENDT
2045 */
2046 static gint
2047 dissect_query_afp_with_vol_id(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2048 {
2049
2050 if (!tree)
2051 return offset;
2052 PAD(1);
2053
2054 proto_tree_add_item(tree, hf_afp_vol_id, tvb, offset, 2, ENC_BIG_ENDIAN);
2055 offset += 2;
2056 return offset;
2057 }
2058
2059 /* ************************** */
2060 static gint
2061 dissect_query_afp_open_fork(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
2062 {
2063 proto_tree *sub_tree = NULL;
2064 proto_item *item;
2065
2066 proto_tree_add_item(tree, hf_afp_fork_type, tvb, offset, 1, ENC_BIG_ENDIAN);
2067 offset++;
2068
2069 offset = decode_vol_did(tree, tvb, offset);
2070
2071 decode_file_bitmap(tree, tvb, offset);
2072 offset += 2;
2073 if (tree) {
2074 item = proto_tree_add_item(tree, hf_afp_access_mode, tvb, offset, 2, ENC_BIG_ENDIAN);
2075 sub_tree = proto_item_add_subtree(item, ett_afp_access_mode);
2076
2077 proto_tree_add_item(sub_tree, hf_afp_access_read , tvb, offset, 2, ENC_BIG_ENDIAN);
2078 proto_tree_add_item(sub_tree, hf_afp_access_write , tvb, offset, 2, ENC_BIG_ENDIAN);
2079 proto_tree_add_item(sub_tree, hf_afp_access_deny_read , tvb, offset, 2, ENC_BIG_ENDIAN);
2080 proto_tree_add_item(sub_tree, hf_afp_access_deny_write, tvb, offset, 2, ENC_BIG_ENDIAN);
2081 }
2082 offset += 2;
2083
2084 offset = decode_name(tree, pinfo, tvb, offset);
2085
2086 return offset;
2087 }
2088
2089 /* -------------------------- */
2090 static gint
2091 dissect_reply_afp_open_fork(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
2092 {
2093 guint16 f_bitmap;
2094
2095 f_bitmap = decode_file_bitmap(tree, tvb, offset);
2096 offset += 2;
2097
2098 add_info_fork(tvb, pinfo, offset);
2099 proto_tree_add_item(tree, hf_afp_ofork, tvb, offset, 2, ENC_BIG_ENDIAN);
2100 offset += 2;
2101
2102 offset = parse_file_bitmap(tree, tvb, offset, f_bitmap,0);
2103
2104 return offset;
2105 }
2106
2107 /* ************************** */
2108 static gint
2109 dissect_query_afp_enumerate_ext2(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
2110 {
2111
2112 PAD(1);
2113 offset = decode_vol_did_file_dir_bitmap(tree, tvb, offset);
2114
2115 proto_tree_add_item(tree, hf_afp_req_count, tvb, offset, 2, ENC_BIG_ENDIAN);
2116 offset += 2;
2117
2118 proto_tree_add_item(tree, hf_afp_start_index32, tvb, offset, 4, ENC_BIG_ENDIAN);
2119 offset += 4;
2120
2121 proto_tree_add_item(tree, hf_afp_max_reply_size32, tvb, offset, 4, ENC_BIG_ENDIAN);
2122 offset += 4;
2123
2124 offset = decode_name(tree, pinfo, tvb, offset);
2125
2126 return offset;
2127 }
2128
2129 /* ************************** */
2130 static gint
2131 dissect_query_afp_enumerate(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
2132 {
2133
2134 PAD(1);
2135 offset = decode_vol_did_file_dir_bitmap(tree, tvb, offset);
2136
2137 proto_tree_add_item(tree, hf_afp_req_count, tvb, offset, 2, ENC_BIG_ENDIAN);
2138 offset += 2;
2139
2140 proto_tree_add_item(tree, hf_afp_start_index, tvb, offset, 2, ENC_BIG_ENDIAN);
2141 offset += 2;
2142
2143 proto_tree_add_item(tree, hf_afp_max_reply_size, tvb, offset, 2, ENC_BIG_ENDIAN);
2144 offset += 2;
2145
2146 offset = decode_name(tree, pinfo, tvb, offset);
2147
2148 return offset;
2149 }
2150
2151 /* -------------------------- */
2152 static int
2153 loop_record(tvbuff_t *tvb, proto_tree *ptree, gint offset,
2154 int count, guint16 d_bitmap, guint16 f_bitmap, int add, int ext)
2155 {
2156 proto_tree *tree = NULL;
2157 proto_item *item;
2158 guint8 *name;
2159 guint8 flags;
2160 guint size;
2161 gint org;
2162 int i;
2163 int decal;
2164
2165 for (i = 0; i < count; i++) {
2166 org = offset;
2167 if (ext) {
2168 size = tvb_get_ntohs(tvb, offset) +add *2;
2169 decal = 2;
2170 }
2171 else {
2172 size = tvb_get_guint8(tvb, offset) +add;
2173 decal = 1;
2174 }
2175 if (!size)
2176 return offset; /* packet is malformed */
2177 flags = tvb_get_guint8(tvb, offset +decal);
2178
2179 decal += (ext)?2:1;
2180
2181 if (ptree) {
2182 if (flags) {
2183 name = name_in_dbitmap(tvb, offset +decal, d_bitmap);
2184 }
2185 else {
2186 name = name_in_fbitmap(tvb, offset +decal, f_bitmap);
2187 }
2188 if (name) {
2189 item = proto_tree_add_text(ptree, tvb, offset, size, "%s", name);
2190 }
2191 else {
2192 item = proto_tree_add_text(ptree, tvb, offset, size, "line %d", i+1);
2193 }
2194 tree = proto_item_add_subtree(item, ett_afp_enumerate_line);
2195 }
2196 if (ext) {
2197 proto_tree_add_item(tree, hf_afp_struct_size16, tvb, offset, 2, ENC_BIG_ENDIAN);
2198 offset += 2;
2199 }
2200 else {
2201 proto_tree_add_item(tree, hf_afp_struct_size, tvb, offset, 1, ENC_BIG_ENDIAN);
2202 offset++;
2203 }
2204
2205 proto_tree_add_item(tree, hf_afp_file_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
2206 offset++;
2207 if (ext) {
2208 PAD(1);
2209 }
2210 if (flags) {
2211 offset = parse_dir_bitmap(tree, tvb, offset, d_bitmap);
2212 }
2213 else {
2214 offset = parse_file_bitmap(tree, tvb, offset, f_bitmap,0);
2215 }
2216 if ((offset & 1))
2217 PAD(1);
2218 offset = org +size; /* play safe */
2219 }
2220 return offset;
2221 }
2222 /* ------------------------- */
2223 static gint
2224 reply_enumerate(tvbuff_t *tvb, proto_tree *tree, gint offset, int ext)
2225 {
2226 proto_tree *sub_tree = NULL;
2227 proto_item *item;
2228 int count;
2229 guint16 f_bitmap;
2230 guint16 d_bitmap;
2231
2232 f_bitmap = decode_file_bitmap(tree, tvb, offset);
2233 offset += 2;
2234
2235 d_bitmap = decode_dir_bitmap(tree, tvb, offset);
2236 offset += 2;
2237
2238 count = tvb_get_ntohs(tvb, offset);
2239 if (tree) {
2240 item = proto_tree_add_item(tree, hf_afp_req_count, tvb, offset, 2, ENC_BIG_ENDIAN);
2241 sub_tree = proto_item_add_subtree(item, ett_afp_enumerate);
2242 }
2243 offset += 2;
2244
2245 return loop_record(tvb,sub_tree, offset, count, d_bitmap, f_bitmap,0, ext);
2246 }
2247
2248 /* ------------------------- */
2249 static gint
2250 dissect_reply_afp_enumerate(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2251 {
2252 return reply_enumerate(tvb, tree, offset, 0);
2253 }
2254
2255 /* **************************/
2256 static gint
2257 dissect_reply_afp_enumerate_ext(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2258 {
2259 return reply_enumerate(tvb, tree, offset, 1);
2260 }
2261
2262 /* **************************/
2263 static gint
2264 catsearch_spec(tvbuff_t *tvb, proto_tree *ptree, gint offset, int ext, guint32 bitmap, const gchar *label)
2265 {
2266 proto_tree *tree = NULL;
2267 proto_item *item;
2268 guint16 size;
2269 gint org;
2270
2271 org = offset;
2272
2273 if (ext) {
2274 size = tvb_get_ntohs(tvb, offset) +2;
2275 }
2276 else {
2277 size = tvb_get_guint8(tvb, offset) +2;
2278 }
2279
2280 item = proto_tree_add_text(ptree, tvb, offset, size, "%s", label);
2281 tree = proto_item_add_subtree(item, ett_afp_cat_spec);
2282
2283 if (ext) {
2284 proto_tree_add_item(tree, hf_afp_struct_size16, tvb, offset, 2, ENC_BIG_ENDIAN);
2285 offset += 2;
2286 }
2287 else {
2288 proto_tree_add_item(tree, hf_afp_struct_size, tvb, offset, 1, ENC_BIG_ENDIAN);
2289 offset++;
2290 PAD(1);
2291 }
2292
2293 parse_file_bitmap(tree, tvb, offset, (guint16) bitmap,0);
2294 offset = org +size;
2295
2296 return offset;
2297 }
2298
2299 /* ------------------------- */
2300 static gint
2301 query_catsearch(tvbuff_t *tvb, proto_tree *ptree, gint offset, int ext)
2302 {
2303 proto_tree *tree = NULL, *sub_tree;
2304 proto_item *item;
2305 guint16 f_bitmap;
2306 guint16 d_bitmap;
2307 guint32 r_bitmap;
2308
2309 if (!ptree)
2310 return offset;
2311 PAD(1);
2312
2313 proto_tree_add_item(ptree, hf_afp_vol_id, tvb, offset, 2, ENC_BIG_ENDIAN);
2314 offset += 2;
2315
2316 proto_tree_add_item(ptree, hf_afp_cat_req_matches, tvb, offset, 4, ENC_BIG_ENDIAN);
2317 offset += 4;
2318
2319 proto_tree_add_item(ptree, hf_afp_reserved, tvb, offset, 4, ENC_NA);
2320 offset += 4;
2321
2322 proto_tree_add_item(ptree, hf_afp_cat_position, tvb, offset, 16, ENC_NA);
2323 offset += 16;
2324
2325 f_bitmap = decode_file_bitmap(ptree, tvb, offset);
2326 offset += 2;
2327
2328 d_bitmap = decode_dir_bitmap(ptree, tvb, offset);
2329 offset += 2;
2330
2331 r_bitmap = tvb_get_ntohl(tvb, offset);
2332 /* Already checked this above: if (ptree) */ {
2333 item = proto_tree_add_item(ptree, hf_afp_file_bitmap, tvb, offset, 4, ENC_BIG_ENDIAN);
2334 sub_tree = proto_item_add_subtree(item, ett_afp_cat_r_bitmap);
2335
2336 proto_tree_add_item(sub_tree, hf_afp_request_bitmap_Attributes , tvb, offset, 4, ENC_BIG_ENDIAN);
2337 proto_tree_add_item(sub_tree, hf_afp_request_bitmap_ParentDirID, tvb, offset, 4, ENC_BIG_ENDIAN);
2338 proto_tree_add_item(sub_tree, hf_afp_request_bitmap_CreateDate , tvb, offset, 4, ENC_BIG_ENDIAN);
2339 proto_tree_add_item(sub_tree, hf_afp_request_bitmap_ModDate , tvb, offset, 4, ENC_BIG_ENDIAN);
2340 proto_tree_add_item(sub_tree, hf_afp_request_bitmap_BackupDate , tvb, offset, 4, ENC_BIG_ENDIAN);
2341 proto_tree_add_item(sub_tree, hf_afp_request_bitmap_FinderInfo , tvb, offset, 4, ENC_BIG_ENDIAN);
2342 proto_tree_add_item(sub_tree, hf_afp_request_bitmap_LongName , tvb, offset, 4, ENC_BIG_ENDIAN);
2343
2344 if (d_bitmap == 0) {
2345 /* Only for file-only searches */
2346 proto_tree_add_item(sub_tree, hf_afp_request_bitmap_DataForkLen , tvb, offset, 4, ENC_BIG_ENDIAN);
2347 proto_tree_add_item(sub_tree, hf_afp_request_bitmap_RsrcForkLen , tvb, offset, 4, ENC_BIG_ENDIAN);
2348 proto_tree_add_item(sub_tree, hf_afp_request_bitmap_ExtDataForkLen , tvb, offset, 4, ENC_BIG_ENDIAN);
2349 }
2350 if (f_bitmap == 0) {
2351 /* Only for directory-only searches */
2352 proto_tree_add_item(sub_tree, hf_afp_request_bitmap_OffspringCount , tvb, offset, 4, ENC_BIG_ENDIAN);
2353 }
2354
2355 proto_tree_add_item(sub_tree, hf_afp_request_bitmap_UTF8Name , tvb, offset, 4, ENC_BIG_ENDIAN);
2356
2357 if (d_bitmap == 0) {
2358 /* Only for file-only searches */
2359 proto_tree_add_item(sub_tree, hf_afp_request_bitmap_ExtRsrcForkLen , tvb, offset, 4, ENC_BIG_ENDIAN);
2360 }
2361 proto_tree_add_item(sub_tree, hf_afp_request_bitmap_PartialNames , tvb, offset, 4, ENC_BIG_ENDIAN);
2362 }
2363 offset += 4;
2364
2365 /* spec 1 */
2366 offset = catsearch_spec(tvb, ptree, offset, ext, r_bitmap, "Spec 1");
2367
2368 /* spec 2 */
2369 offset = catsearch_spec(tvb, ptree, offset, ext, r_bitmap, "Spec 2");
2370
2371 return offset;
2372 }
2373
2374 /* ------------------------- */
2375 static gint
2376 dissect_query_afp_cat_search(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *ptree, gint offset)
2377 {
2378 return query_catsearch(tvb, ptree, offset, 0);
2379
2380 }
2381 /* **************************/
2382 static gint
2383 dissect_query_afp_cat_search_ext(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *ptree, gint offset)
2384 {
2385 return query_catsearch(tvb, ptree, offset, 1);
2386
2387 }
2388
2389 /* **************************/
2390 static gint
2391 reply_catsearch(tvbuff_t *tvb, proto_tree *tree, gint offset, int ext)
2392 {
2393 proto_tree *sub_tree = NULL;
2394 proto_item *item;
2395 guint16 f_bitmap;
2396 guint16 d_bitmap;
2397 int count;
2398
2399 proto_tree_add_item(tree, hf_afp_cat_position, tvb, offset, 16, ENC_NA);
2400 offset += 16;
2401
2402 f_bitmap = decode_file_bitmap(tree, tvb, offset);
2403 offset += 2;
2404
2405 d_bitmap = decode_dir_bitmap(tree, tvb, offset);
2406 offset += 2;
2407
2408 count = tvb_get_ntohl(tvb, offset);
2409 if (tree) {
2410 item = proto_tree_add_item(tree, hf_afp_cat_count, tvb, offset, 4, ENC_BIG_ENDIAN);
2411 sub_tree = proto_item_add_subtree(item, ett_afp_cat_search);
2412 }
2413 offset += 4;
2414
2415 return loop_record(tvb,sub_tree, offset, count, d_bitmap, f_bitmap, 2, ext);
2416 }
2417
2418 /* -------------------------- */
2419 static gint
2420 dissect_reply_afp_cat_search(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2421 {
2422 return reply_catsearch(tvb, tree, offset, 0);
2423 }
2424
2425 /* **************************/
2426 static gint
2427 dissect_reply_afp_cat_search_ext(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2428 {
2429 return reply_catsearch(tvb, tree, offset, 1);
2430 }
2431
2432 /* **************************/
2433 static gint
2434 dissect_query_afp_get_vol_param(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
2435 {
2436
2437 PAD(1)
2438 add_info_vol(tvb, pinfo, offset);
2439
2440 proto_tree_add_item(tree, hf_afp_vol_id, tvb, offset, 2, ENC_BIG_ENDIAN);
2441 offset += 2;
2442
2443 decode_vol_bitmap(tree, tvb, offset);
2444 offset += 2;
2445
2446 return offset;
2447 }
2448
2449 /* ------------------------ */
2450 static gint
2451 dissect_reply_afp_get_vol_param(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2452 {
2453 guint16 bitmap;
2454
2455 bitmap = decode_vol_bitmap(tree, tvb, offset);
2456 offset += 2;
2457
2458 offset = parse_vol_bitmap(tree, tvb, offset, bitmap);
2459
2460 return offset;
2461 }
2462
2463 /* **************************/
2464 static gint
2465 dissect_query_afp_set_vol_param(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
2466 {
2467 guint16 bitmap;
2468
2469 PAD(1)
2470
2471 add_info_vol(tvb, pinfo, offset);
2472 proto_tree_add_item(tree, hf_afp_vol_id, tvb, offset, 2, ENC_BIG_ENDIAN);
2473 offset += 2;
2474
2475 bitmap = decode_vol_bitmap(tree, tvb, offset);
2476 offset += 2;
2477
2478 offset = parse_vol_bitmap(tree, tvb, offset, bitmap);
2479
2480 return offset;
2481 }
2482
2483 /* ***************************/
2484 static gint
2485 decode_uam_parameters(const guint8 *uam, int len_uam, tvbuff_t *tvb, proto_tree *tree, gint offset)
2486 {
2487 int len;
2488
2489 if (!g_ascii_strncasecmp(uam, "Cleartxt passwrd", len_uam)) {
2490 if ((offset & 1))
2491 PAD(1);
2492
2493 len = 8; /* tvb_strsize(tvb, offset);*/
2494 proto_tree_add_item(tree, hf_afp_passwd, tvb, offset, len, ENC_UTF_8|ENC_NA);
2495 offset += len;
2496 }
2497 else if (!g_ascii_strncasecmp(uam, "DHCAST128", len_uam)) {
2498 if ((offset & 1))
2499 PAD(1);
2500
2501 len = 16;
2502 proto_tree_add_item(tree, hf_afp_random, tvb, offset, len, ENC_NA);
2503 offset += len;
2504 }
2505 else if (!g_ascii_strncasecmp(uam, "2-Way Randnum exchange", len_uam)) {
2506 /* nothing */
2507 return offset;
2508 }
2509 return offset;
2510 }
2511
2512 /* ---------------- */
2513 static gint
2514 dissect_query_afp_login(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2515 {
2516 int len;
2517 int len_uam;
2518 const guint8 *uam;
2519
2520 len = tvb_get_guint8(tvb, offset);
2521 proto_tree_add_item(tree, hf_afp_Version, tvb, offset, 1, ENC_UTF_8|ENC_BIG_ENDIAN);
2522 offset += len +1;
2523 len_uam = tvb_get_guint8(tvb, offset);
2524 uam = tvb_get_string(wmem_packet_scope(), tvb, offset +1, len_uam);
2525 proto_tree_add_item(tree, hf_afp_UAM, tvb, offset, 1, ENC_UTF_8|ENC_BIG_ENDIAN);
2526 offset += len_uam +1;
2527
2528 if (!g_ascii_strncasecmp(uam, "No User Authent", len_uam)) {
2529 return offset;
2530 }
2531
2532 len = tvb_get_guint8(tvb, offset);
2533 proto_tree_add_item(tree, hf_afp_user, tvb, offset, 1, ENC_UTF_8|ENC_BIG_ENDIAN);
2534 offset += len +1;
2535
2536 return decode_uam_parameters(uam, len_uam, tvb, tree, offset);
2537 }
2538
2539 /* ***************************/
2540 static gint
2541 dissect_query_afp_login_ext(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2542 {
2543 int len;
2544 int len_uam;
2545 const guint8 *uam;
2546 guint8 path_type;
2547
2548 PAD(1);
2549 proto_tree_add_item(tree, hf_afp_login_flags, tvb, offset, 2, ENC_BIG_ENDIAN);
2550 offset += 2;
2551
2552 len = tvb_get_guint8(tvb, offset);
2553 proto_tree_add_item(tree, hf_afp_Version, tvb, offset, 1, ENC_UTF_8|ENC_BIG_ENDIAN);
2554 offset += len +1;
2555
2556 len_uam = tvb_get_guint8(tvb, offset);
2557 uam = tvb_get_string(wmem_packet_scope(), tvb, offset +1, len_uam);
2558 proto_tree_add_item(tree, hf_afp_UAM, tvb, offset, 1, ENC_UTF_8|ENC_BIG_ENDIAN);
2559 offset += len_uam +1;
2560
2561 proto_tree_add_item(tree, hf_afp_user_type, tvb, offset, 1, ENC_BIG_ENDIAN);
2562 offset++;
2563 /* only type 3 */
2564 len = tvb_get_ntohs(tvb, offset);
2565 proto_tree_add_item(tree, hf_afp_user_len, tvb, offset, 2, ENC_BIG_ENDIAN);
2566 offset += 2;
2567 proto_tree_add_item(tree, hf_afp_user_name, tvb, offset, len, ENC_UTF_8|ENC_NA);
2568 offset += len;
2569
2570 /* directory service */
2571 path_type = tvb_get_guint8(tvb, offset);
2572 proto_tree_add_item(tree, hf_afp_path_type, tvb, offset, 1, ENC_BIG_ENDIAN);
2573 offset++;
2574 /* FIXME use 16 bit len + unicode from smb dissector */
2575 switch (path_type) {
2576 case 1:
2577 case 2:
2578 len = tvb_get_guint8(tvb, offset);
2579 proto_tree_add_item(tree, hf_afp_path_len, tvb, offset, 1, ENC_BIG_ENDIAN);
2580 offset++;
2581 proto_tree_add_item(tree, hf_afp_path_name, tvb, offset, len, ENC_UTF_8|ENC_NA);
2582 offset += len;
2583 break;
2584 case 3:
2585 len = tvb_get_ntohs(tvb, offset);
2586 proto_tree_add_item( tree, hf_afp_path_unicode_len, tvb, offset, 2, ENC_BIG_ENDIAN);
2587 offset += 2;
2588 proto_tree_add_item(tree, hf_afp_path_name, tvb, offset, len, ENC_UTF_8|ENC_NA);
2589 offset += len;
2590 break;
2591 default:
2592 break;
2593 }
2594
2595 return decode_uam_parameters(uam, len_uam, tvb, tree, offset);
2596 }
2597
2598 /* ************************** */
2599 static gint
2600 dissect_query_afp_write(tvbuff_t *tvb, packet_info *pinfo , proto_tree *tree, gint offset)
2601 {
2602 int param;
2603
2604
2605 proto_tree_add_item(tree, hf_afp_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
2606 offset += 1;
2607
2608 add_info_fork(tvb, pinfo, offset);
2609 proto_tree_add_item(tree, hf_afp_ofork, tvb, offset, 2, ENC_BIG_ENDIAN);
2610 offset += 2;
2611
2612 proto_tree_add_item(tree, hf_afp_offset, tvb, offset, 4, ENC_BIG_ENDIAN);
2613 param = tvb_get_ntohl(tvb, offset);
2614 col_append_fstr(pinfo->cinfo, COL_INFO, " Offset=%d", param);
2615 offset += 4;
2616
2617 proto_tree_add_item(tree, hf_afp_rw_count, tvb, offset, 4, ENC_BIG_ENDIAN);
2618 param = tvb_get_ntohl(tvb, offset);
2619 col_append_fstr(pinfo->cinfo, COL_INFO, " Size=%d", param);
2620 offset += 4;
2621
2622 return offset;
2623 }
2624
2625 static gint
2626 dissect_reply_afp_write(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2627 {
2628 proto_tree_add_item(tree, hf_afp_last_written, tvb, offset, 4, ENC_BIG_ENDIAN);
2629 offset += 4;
2630
2631 return offset;
2632 }
2633
2634 /* ************************** */
2635 static gint
2636 dissect_query_afp_write_ext(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2637 {
2638 proto_tree_add_item(tree, hf_afp_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
2639 offset += 1;
2640
2641 add_info_fork(tvb, pinfo, offset);
2642 proto_tree_add_item(tree, hf_afp_ofork, tvb, offset, 2, ENC_BIG_ENDIAN);
2643 offset += 2;
2644
2645 proto_tree_add_item(tree, hf_afp_offset64, tvb, offset, 8, ENC_BIG_ENDIAN);
2646 offset += 8;
2647
2648 proto_tree_add_item(tree, hf_afp_rw_count64, tvb, offset, 8, ENC_BIG_ENDIAN);
2649 offset += 8;
2650
2651 return offset;
2652 }
2653
2654 static gint
2655 dissect_reply_afp_write_ext(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2656 {
2657 proto_tree_add_item(tree, hf_afp_last_written64, tvb, offset, 8, ENC_BIG_ENDIAN);
2658 offset += 8;
2659
2660 return offset;
2661 }
2662
2663 /* ************************** */
2664 static gint
2665 dissect_query_afp_read(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2666 {
2667 int param;
2668
2669 PAD(1);
2670
2671 add_info_fork(tvb, pinfo, offset);
2672 proto_tree_add_item(tree, hf_afp_ofork, tvb, offset, 2, ENC_BIG_ENDIAN);
2673 offset += 2;
2674
2675 proto_tree_add_item(tree, hf_afp_offset, tvb, offset, 4, ENC_BIG_ENDIAN);
2676 param = tvb_get_ntohl(tvb, offset);
2677 col_append_fstr(pinfo->cinfo, COL_INFO, " Offset=%d", param);
2678 offset += 4;
2679
2680 proto_tree_add_item(tree, hf_afp_rw_count, tvb, offset, 4, ENC_BIG_ENDIAN);
2681 param = tvb_get_ntohl(tvb, offset);
2682 col_append_fstr(pinfo->cinfo, COL_INFO, " Size=%d", param);
2683 offset += 4;
2684
2685 proto_tree_add_item(tree, hf_afp_newline_mask, tvb, offset, 1, ENC_BIG_ENDIAN);
2686 offset++;
2687
2688 proto_tree_add_item(tree, hf_afp_newline_char, tvb, offset, 1, ENC_BIG_ENDIAN);
2689 offset++;
2690
2691 return offset;
2692 }
2693
2694 /* ************************** */
2695 static gint
2696 dissect_query_afp_read_ext(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2697 {
2698 PAD(1);
2699
2700 add_info_fork(tvb, pinfo, offset);
2701 proto_tree_add_item(tree, hf_afp_ofork, tvb, offset, 2, ENC_BIG_ENDIAN);
2702 offset += 2;
2703
2704 proto_tree_add_item(tree, hf_afp_offset64, tvb, offset, 8, ENC_BIG_ENDIAN);
2705 offset += 8;
2706
2707 proto_tree_add_item(tree, hf_afp_rw_count64, tvb, offset, 8, ENC_BIG_ENDIAN);
2708 offset += 8;
2709
2710 return offset;
2711 }
2712
2713 /* **************************
2714 Open desktop call
2715 query is the same than AFP_FLUSH, AFP_CLOSEVOL
2716
2717 */
2718 static gint
2719 dissect_reply_afp_open_dt(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2720 {
2721 proto_tree_add_item(tree, hf_afp_dt_ref, tvb, offset, 2, ENC_BIG_ENDIAN);
2722 offset += 2;
2723
2724 return offset;
2725 }
2726
2727 /* **************************
2728 no reply
2729 */
2730 static gint
2731 dissect_query_afp_close_dt(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2732 {
2733 PAD(1);
2734 proto_tree_add_item(tree, hf_afp_dt_ref, tvb, offset, 2, ENC_BIG_ENDIAN);
2735 offset += 2;
2736
2737 return offset;
2738 }
2739
2740 /* **************************
2741 calls using the same format :
2742 1 pad byte
2743 fork number
2744 AFP_FLUSHFORK
2745 AFP_CLOSEFORK
2746 AFP_SYNCFORK
2747 */
2748 static gint
2749 dissect_query_afp_with_fork(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
2750 {
2751 PAD(1);
2752 add_info_fork(tvb, pinfo, offset);
2753 proto_tree_add_item(tree, hf_afp_ofork, tvb, offset, 2, ENC_BIG_ENDIAN);
2754 offset += 2;
2755
2756 return offset;
2757 }
2758
2759 /* ************************** */
2760 static gint
2761 dissect_query_afp_get_fldr_param(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
2762 {
2763 PAD(1);
2764 offset = decode_vol_did_file_dir_bitmap(tree, tvb, offset);
2765
2766 offset = decode_name(tree, pinfo, tvb, offset);
2767
2768 return offset;
2769 }
2770
2771 /* -------------------------- */
2772 static gint
2773 dissect_reply_afp_get_fldr_param(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2774 {
2775 guint8 flags;
2776 guint16 f_bitmap, d_bitmap;
2777
2778 f_bitmap = decode_file_bitmap(tree, tvb, offset);
2779 offset += 2;
2780
2781 d_bitmap = decode_dir_bitmap(tree, tvb, offset);
2782 offset += 2;
2783
2784 flags = tvb_get_guint8(tvb, offset);
2785 proto_tree_add_item(tree, hf_afp_file_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
2786 offset++;
2787 PAD(1);
2788 if (flags) {
2789 offset = parse_dir_bitmap(tree, tvb, offset, d_bitmap);
2790 }
2791 else {
2792 offset = parse_file_bitmap(tree, tvb, offset, f_bitmap,0);
2793 }
2794 return offset;
2795 }
2796
2797 /* **************************
2798 no reply
2799 */
2800 static gint
2801 dissect_query_afp_set_fldr_param(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
2802 {
2803 guint16 f_bitmap;
2804
2805 PAD(1);
2806 offset = decode_vol_did(tree, tvb, offset);
2807
2808 f_bitmap = decode_file_bitmap(tree, tvb, offset);
2809 offset += 2;
2810
2811 offset = decode_name(tree, pinfo, tvb, offset);
2812
2813 if ((offset & 1))
2814 PAD(1);
2815 /* did:name can be a file or a folder but only the intersection between
2816 * file bitmap and dir bitmap can be set.
2817 * Well it's in afp spec, but clients (Mac) are setting 'file only' bits with this call
2818 * (WriteInhibit for example).
2819 */
2820 offset = parse_file_bitmap(tree, tvb, offset, f_bitmap, 1);
2821
2822 return offset;
2823 }
2824
2825 /* **************************
2826 no reply
2827 */
2828 static gint
2829 dissect_query_afp_set_file_param(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
2830 {
2831 guint16 f_bitmap;
2832
2833 PAD(1);
2834 offset = decode_vol_did(tree, tvb, offset);
2835
2836 f_bitmap = decode_file_bitmap(tree, tvb, offset);
2837 offset += 2;
2838
2839 offset = decode_name(tree, pinfo, tvb, offset);
2840
2841 if ((offset & 1))
2842 PAD(1);
2843 offset = parse_file_bitmap(tree, tvb, offset, f_bitmap, 0);
2844
2845 return offset;
2846 }
2847
2848 /* **************************
2849 no reply
2850 */
2851 static gint
2852 dissect_query_afp_set_dir_param(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
2853 {
2854 guint16 d_bitmap;
2855
2856 PAD(1);
2857 offset = decode_vol_did(tree, tvb, offset);
2858
2859 d_bitmap = decode_dir_bitmap(tree, tvb, offset);
2860 offset += 2;
2861
2862 offset = decode_name(tree, pinfo, tvb, offset);
2863
2864 if ((offset & 1))
2865 PAD(1);
2866 offset = parse_dir_bitmap(tree, tvb, offset, d_bitmap);
2867
2868 offset += 4;
2869 return offset;
2870 }
2871
2872 /* **************************
2873 AFP_DELETE
2874 AFP_CREATE_DIR
2875 */
2876 static gint
2877 dissect_query_afp_create_id(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
2878 {
2879 PAD(1);
2880 offset = decode_vol_did(tree, tvb, offset);
2881
2882 offset = decode_name(tree, pinfo, tvb, offset);
2883 return offset;
2884 }
2885
2886 /* --------------------------
2887 AFP_MOVE
2888 */
2889 static gint
2890 dissect_reply_afp_create_id(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2891 {
2892 proto_tree_add_item(tree, hf_afp_file_id, tvb, offset, 4, ENC_BIG_ENDIAN);
2893 offset += 4;
2894
2895 return offset;
2896 }
2897
2898 /* -------------------------- */
2899 static gint
2900 dissect_reply_afp_create_dir(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2901 {
2902 proto_tree_add_item(tree, hf_afp_did, tvb, offset, 4, ENC_BIG_ENDIAN);
2903 offset += 4;
2904
2905 return offset;
2906 }
2907
2908 /* **************************
2909 no reply
2910 */
2911 static gint
2912 dissect_query_afp_delete_id(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2913 {
2914 PAD(1);
2915 proto_tree_add_item(tree, hf_afp_vol_id, tvb, offset, 2, ENC_BIG_ENDIAN);
2916 offset += 2;
2917 proto_tree_add_item(tree, hf_afp_file_id, tvb, offset, 4, ENC_BIG_ENDIAN);
2918 offset += 4;
2919
2920 return offset;
2921 }
2922
2923 /* **************************
2924 same reply as get_fork_param
2925 */
2926 static gint
2927 dissect_query_afp_resolve_id(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2928 {
2929 PAD(1);
2930 proto_tree_add_item(tree, hf_afp_vol_id, tvb, offset, 2, ENC_BIG_ENDIAN);
2931 offset += 2;
2932 proto_tree_add_item(tree, hf_afp_file_id, tvb, offset, 4, ENC_BIG_ENDIAN);
2933 offset += 4;
2934
2935 decode_file_bitmap(tree, tvb, offset);
2936 offset += 2;
2937
2938 return offset;
2939 }
2940
2941 /* ************************** */
2942 static gint
2943 dissect_query_afp_get_fork_param(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
2944 {
2945
2946 PAD(1);
2947 add_info_fork(tvb, pinfo, offset);
2948 proto_tree_add_item(tree, hf_afp_ofork, tvb, offset, 2, ENC_BIG_ENDIAN);
2949 offset += 2;
2950
2951 decode_file_bitmap(tree, tvb, offset);
2952 offset += 2;
2953 return offset;
2954 }
2955
2956 /* -------------------------- */
2957 static gint
2958 dissect_reply_afp_get_fork_param(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
2959 {
2960 guint16 f_bitmap;
2961
2962 f_bitmap = decode_file_bitmap(tree, tvb, offset);
2963 offset += 2;
2964
2965 offset = parse_file_bitmap(tree, tvb, offset, f_bitmap,0);
2966
2967 return offset;
2968 }
2969
2970 /* ************************** */
2971 static gint
2972 dissect_query_afp_set_fork_param(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
2973 {
2974 guint16 bitmap;
2975 int param;
2976
2977 PAD(1);
2978 add_info_fork(tvb, pinfo, offset);
2979 proto_tree_add_item(tree, hf_afp_ofork, tvb, offset, 2, ENC_BIG_ENDIAN);
2980 offset += 2;
2981
2982 bitmap = decode_file_bitmap(tree, tvb, offset);
2983 offset += 2;
2984
2985 if ((bitmap & kFPExtDataForkLenBit) || (bitmap & kFPExtRsrcForkLenBit)) {
2986 proto_tree_add_item(tree, hf_afp_ofork_len64, tvb, offset, 8, ENC_BIG_ENDIAN);
2987 offset += 8;
2988 }
2989 else {
2990 proto_tree_add_item(tree, hf_afp_ofork_len, tvb, offset, 4, ENC_BIG_ENDIAN);
2991 param = tvb_get_ntohl(tvb, offset);
2992 col_append_fstr(pinfo->cinfo, COL_INFO, " Size=%d", param);
2993 offset += 4;
2994 }
2995 return offset;
2996 }
2997
2998 /* ************************** */
2999 static gint
3000 dissect_query_afp_move(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
3001 {
3002
3003 PAD(1);
3004 offset = decode_vol_did(tree, tvb, offset);
3005
3006 proto_tree_add_item(tree, hf_afp_did, tvb, offset, 4, ENC_BIG_ENDIAN);
3007 offset += 4;
3008
3009 offset = decode_name_label(tree, pinfo, tvb, offset, "Source path: %s");
3010 offset = decode_name_label(tree, NULL, tvb, offset, "Dest dir: %s");
3011 offset = decode_name_label(tree, NULL, tvb, offset, "New name: %s");
3012
3013 return offset;
3014 }
3015
3016 /* ************************** */
3017 static gint
3018 dissect_query_afp_exchange_file(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
3019 {
3020
3021 PAD(1);
3022 offset = decode_vol_did(tree, tvb, offset);
3023
3024 proto_tree_add_item(tree, hf_afp_did, tvb, offset, 4, ENC_BIG_ENDIAN);
3025 offset += 4;
3026
3027 offset = decode_name_label(tree, pinfo, tvb, offset, "Source path: %s");
3028 offset = decode_name_label(tree, NULL, tvb, offset, "Dest path: %s");
3029
3030 return offset;
3031 }
3032 /* ************************** */
3033 static gint
3034 dissect_query_afp_copy_file(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
3035 {
3036 proto_tree *sub_tree = NULL;
3037 proto_item *item;
3038
3039 PAD(1);
3040 if (tree) {
3041 item = proto_tree_add_text(tree, tvb, offset, 6,"Source volume");
3042 sub_tree = proto_item_add_subtree(item, ett_afp_vol_did);
3043 }
3044 offset = decode_vol_did(sub_tree, tvb, offset);
3045
3046 if (tree) {
3047 item = proto_tree_add_text(tree, tvb, offset, 6,"Dest volume");
3048 sub_tree = proto_item_add_subtree(item, ett_afp_vol_did);
3049 }
3050 offset = decode_vol_did(sub_tree, tvb, offset);
3051
3052 offset = decode_name_label(tree, pinfo, tvb, offset, "Source path: %s");
3053 offset = decode_name_label(tree, NULL, tvb, offset, "Dest dir: %s");
3054 offset = decode_name_label(tree, NULL, tvb, offset, "New name: %s");
3055
3056 return offset;
3057 }
3058
3059 /* ************************** */
3060 static gint
3061 dissect_query_afp_rename(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
3062 {
3063
3064 PAD(1);
3065 offset = decode_vol_did(tree, tvb, offset);
3066
3067 offset = decode_name_label(tree, pinfo, tvb, offset, "Old name: %s");
3068 offset = decode_name_label(tree, NULL, tvb, offset, "New name: %s");
3069
3070 return offset;
3071 }
3072
3073 /* ************************** */
3074 static gint
3075 dissect_query_afp_byte_lock(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3076 {
3077 proto_tree *sub_tree = NULL;
3078 proto_item *item;
3079 guint8 flag;
3080
3081 flag = tvb_get_guint8(tvb, offset);
3082 if (tree) {
3083 item = proto_tree_add_text(tree, tvb, offset, 1, "Flags: 0x%02x", flag);
3084 sub_tree = proto_item_add_subtree(item, ett_afp_lock_flags);
3085 }
3086
3087 proto_tree_add_item(sub_tree, hf_afp_lock_op, tvb, offset, 1, ENC_BIG_ENDIAN);
3088 proto_tree_add_item(sub_tree, hf_afp_lock_from, tvb, offset, 1, ENC_BIG_ENDIAN);
3089 offset += 1;
3090
3091 proto_tree_add_item(tree, hf_afp_ofork, tvb, offset, 2, ENC_BIG_ENDIAN);
3092 offset += 2;
3093
3094 proto_tree_add_item(tree, hf_afp_lock_offset, tvb, offset, 4, ENC_BIG_ENDIAN);
3095 offset += 4;
3096
3097 proto_tree_add_item(tree, hf_afp_lock_len, tvb, offset, 4, ENC_BIG_ENDIAN);
3098 offset += 4;
3099 return offset;
3100 }
3101
3102 /* -------------------------- */
3103 static gint
3104 dissect_reply_afp_byte_lock(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3105 {
3106 proto_tree_add_item(tree, hf_afp_lock_range_start, tvb, offset, 4, ENC_BIG_ENDIAN);
3107 offset += 4;
3108
3109 return offset;
3110 }
3111
3112 /* ************************** */
3113 static gint
3114 dissect_query_afp_byte_lock_ext(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3115 {
3116 proto_tree *sub_tree = NULL;
3117 proto_item *item;
3118 guint8 flag;
3119
3120 flag = tvb_get_guint8(tvb, offset);
3121 if (tree) {
3122 item = proto_tree_add_text(tree, tvb, offset, 1, "Flags: 0x%02x", flag);
3123 sub_tree = proto_item_add_subtree(item, ett_afp_lock_flags);
3124 }
3125
3126 proto_tree_add_item(sub_tree, hf_afp_lock_op, tvb, offset, 1, ENC_BIG_ENDIAN);
3127 proto_tree_add_item(sub_tree, hf_afp_lock_from, tvb, offset, 1, ENC_BIG_ENDIAN);
3128 offset += 1;
3129
3130 proto_tree_add_item(tree, hf_afp_ofork, tvb, offset, 2, ENC_BIG_ENDIAN);
3131 offset += 2;
3132
3133 proto_tree_add_item(tree, hf_afp_lock_offset64, tvb, offset, 8, ENC_BIG_ENDIAN);
3134 offset += 8;
3135
3136 proto_tree_add_item(tree, hf_afp_lock_len64, tvb, offset, 8, ENC_BIG_ENDIAN);
3137 offset += 8;
3138 return offset;
3139 }
3140
3141 /* -------------------------- */
3142 static gint
3143 dissect_reply_afp_byte_lock_ext(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3144 {
3145 proto_tree_add_item(tree, hf_afp_lock_range_start64, tvb, offset, 8, ENC_BIG_ENDIAN);
3146 offset += 8;
3147
3148 return offset;
3149 }
3150
3151 /* ************************** */
3152 static gint
3153 dissect_query_afp_add_cmt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
3154 {
3155 guint8 len;
3156
3157 PAD(1);
3158 proto_tree_add_item(tree, hf_afp_dt_ref, tvb, offset, 2, ENC_BIG_ENDIAN);
3159 offset += 2;
3160
3161 proto_tree_add_item(tree, hf_afp_did, tvb, offset, 4, ENC_BIG_ENDIAN);
3162 offset += 4;
3163
3164 offset = decode_name(tree, pinfo, tvb, offset);
3165
3166 if ((offset & 1))
3167 PAD(1);
3168
3169 len = tvb_get_guint8(tvb, offset);
3170 proto_tree_add_item(tree, hf_afp_comment, tvb, offset, 1, ENC_UTF_8|ENC_BIG_ENDIAN);
3171 offset += len +1;
3172
3173 return offset;
3174 }
3175
3176
3177 /* ************************** */
3178 static gint
3179 dissect_query_afp_get_cmt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
3180 {
3181
3182 PAD(1);
3183 proto_tree_add_item(tree, hf_afp_dt_ref, tvb, offset, 2, ENC_BIG_ENDIAN);
3184 offset += 2;
3185
3186 proto_tree_add_item(tree, hf_afp_did, tvb, offset, 4, ENC_BIG_ENDIAN);
3187 offset += 4;
3188
3189 offset = decode_name(tree, pinfo, tvb, offset);
3190 return offset;
3191 }
3192
3193 /* -------------------------- */
3194 static gint
3195 dissect_reply_afp_get_cmt(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3196 {
3197 guint8 len;
3198
3199 len = tvb_get_guint8(tvb, offset);
3200 proto_tree_add_item(tree, hf_afp_comment, tvb, offset, 1, ENC_UTF_8|ENC_BIG_ENDIAN);
3201 offset += len +1;
3202
3203 return offset;
3204 }
3205
3206 /* ************************** */
3207 static gint
3208 dissect_query_afp_get_icon(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3209 {
3210
3211 PAD(1);
3212 proto_tree_add_item(tree, hf_afp_dt_ref, tvb, offset, 2, ENC_BIG_ENDIAN);
3213 offset += 2;
3214 proto_tree_add_item(tree, hf_afp_file_creator, tvb, offset, 4, ENC_UTF_8|ENC_NA);
3215 offset += 4;
3216
3217 proto_tree_add_item(tree, hf_afp_file_type, tvb, offset, 4, ENC_ASCII|ENC_NA);
3218 offset += 4;
3219
3220 proto_tree_add_item(tree, hf_afp_icon_type, tvb, offset, 1, ENC_BIG_ENDIAN);
3221 offset += 1;
3222 PAD(1);
3223
3224 proto_tree_add_item(tree, hf_afp_icon_length, tvb, offset, 2, ENC_BIG_ENDIAN);
3225 offset += 2;
3226
3227 return offset;
3228 }
3229
3230 /* ************************** */
3231 static gint
3232 dissect_query_afp_get_icon_info(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3233 {
3234
3235 PAD(1);
3236 proto_tree_add_item(tree, hf_afp_dt_ref, tvb, offset, 2, ENC_BIG_ENDIAN);
3237 offset += 2;
3238 proto_tree_add_item(tree, hf_afp_file_creator, tvb, offset, 4, ENC_ASCII|ENC_NA);
3239 offset += 4;
3240
3241 proto_tree_add_item(tree, hf_afp_icon_index, tvb, offset, 2, ENC_BIG_ENDIAN);
3242 offset += 2;
3243
3244 return offset;
3245 }
3246
3247 /* -------------------------- */
3248 static gint
3249 dissect_reply_afp_get_icon_info(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3250 {
3251
3252 proto_tree_add_item(tree, hf_afp_icon_tag, tvb, offset, 4, ENC_BIG_ENDIAN);
3253 offset += 4;
3254
3255 proto_tree_add_item(tree, hf_afp_file_type, tvb, offset, 4, ENC_ASCII|ENC_NA);
3256 offset += 4;
3257
3258 proto_tree_add_item(tree, hf_afp_icon_type, tvb, offset, 1, ENC_BIG_ENDIAN);
3259 offset += 1;
3260
3261 PAD(1);
3262 proto_tree_add_item(tree, hf_afp_icon_length, tvb, offset, 2, ENC_BIG_ENDIAN);
3263 offset += 2;
3264
3265 return offset;
3266 }
3267
3268 /* ************************** */
3269 static gint
3270 dissect_query_afp_add_icon(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3271 {
3272
3273 PAD(1);
3274 proto_tree_add_item(tree, hf_afp_dt_ref, tvb, offset, 2, ENC_BIG_ENDIAN);
3275 offset += 2;
3276 proto_tree_add_item(tree, hf_afp_file_creator, tvb, offset, 4, ENC_ASCII|ENC_NA);
3277 offset += 4;
3278
3279 proto_tree_add_item(tree, hf_afp_file_type, tvb, offset, 4, ENC_ASCII|ENC_NA);
3280 offset += 4;
3281
3282 proto_tree_add_item(tree, hf_afp_icon_type, tvb, offset, 1, ENC_BIG_ENDIAN);
3283 offset += 1;
3284
3285 PAD(1);
3286 proto_tree_add_item(tree, hf_afp_icon_tag, tvb, offset, 4, ENC_BIG_ENDIAN);
3287 offset += 4;
3288
3289 proto_tree_add_item(tree, hf_afp_icon_length, tvb, offset, 2, ENC_BIG_ENDIAN);
3290 offset += 2;
3291
3292 return offset;
3293 }
3294
3295 /* **************************
3296 no reply
3297 */
3298 static gint
3299 decode_dt_did(proto_tree *tree, tvbuff_t *tvb, gint offset)
3300 {
3301 /* FIXME it's not volume but dt cf decode_name*/
3302 Vol = tvb_get_ntohs(tvb, offset);
3303 proto_tree_add_item(tree, hf_afp_dt_ref, tvb, offset, 2, ENC_BIG_ENDIAN);
3304 offset += 2;
3305
3306 Did = tvb_get_ntohl(tvb, offset);
3307 proto_tree_add_item(tree, hf_afp_did, tvb, offset, 4, ENC_BIG_ENDIAN);
3308 offset += 4;
3309 return offset;
3310 }
3311
3312 /* -------------------------- */
3313 static gint
3314 dissect_query_afp_add_appl(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
3315 {
3316
3317 PAD(1);
3318 offset = decode_dt_did(tree, tvb, offset);
3319
3320 proto_tree_add_item(tree, hf_afp_file_creator, tvb, offset, 4, ENC_ASCII|ENC_NA);
3321 offset += 4;
3322
3323 proto_tree_add_item(tree, hf_afp_appl_tag, tvb, offset, 4, ENC_BIG_ENDIAN);
3324 offset += 4;
3325
3326 offset = decode_name(tree, pinfo, tvb, offset);
3327
3328 return offset;
3329 }
3330
3331 /* **************************
3332 no reply
3333 */
3334 static gint
3335 dissect_query_afp_rmv_appl(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
3336 {
3337
3338 PAD(1);
3339 offset = decode_dt_did(tree, tvb, offset);
3340
3341 proto_tree_add_item(tree, hf_afp_file_creator, tvb, offset, 4, ENC_ASCII|ENC_NA);
3342 offset += 4;
3343
3344 offset = decode_name(tree, pinfo, tvb, offset);
3345
3346 return offset;
3347 }
3348
3349 /* ************************** */
3350 static gint
3351 dissect_query_afp_get_appl(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3352 {
3353
3354 PAD(1);
3355 proto_tree_add_item(tree, hf_afp_dt_ref, tvb, offset, 2, ENC_BIG_ENDIAN);
3356 offset += 2;
3357
3358 proto_tree_add_item(tree, hf_afp_file_creator, tvb, offset, 4, ENC_ASCII|ENC_NA);
3359 offset += 4;
3360
3361 proto_tree_add_item(tree, hf_afp_appl_index, tvb, offset, 2, ENC_BIG_ENDIAN);
3362 offset += 2;
3363
3364 decode_file_bitmap(tree, tvb, offset);
3365 offset += 2;
3366
3367 return offset;
3368 }
3369
3370 /* -------------------------- */
3371 static gint
3372 dissect_reply_afp_get_appl(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3373 {
3374 proto_tree_add_item(tree, hf_afp_appl_tag, tvb, offset, 4, ENC_BIG_ENDIAN);
3375 offset += 4;
3376
3377 return offset;
3378 }
3379
3380 /* ************************** */
3381 static gint
3382 dissect_query_afp_create_file(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
3383 {
3384 proto_tree_add_item(tree, hf_afp_create_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
3385 offset++;
3386
3387 offset = decode_vol_did(tree, tvb, offset);
3388
3389 offset = decode_name(tree, pinfo, tvb, offset);
3390
3391 return offset;
3392 }
3393
3394 /* ************************** */
3395 static gint
3396 dissect_query_afp_map_id(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3397 {
3398 guint8 type;
3399
3400 type = tvb_get_guint8(tvb, offset);
3401 proto_tree_add_item(tree, hf_afp_map_id_type, tvb, offset, 1, ENC_BIG_ENDIAN);
3402 offset++;
3403
3404 if ( type < 5) {
3405 proto_tree_add_item(tree, hf_afp_map_id, tvb, offset, 4, ENC_BIG_ENDIAN);
3406 offset += 4;
3407 }
3408 else {
3409 proto_tree_add_item(tree, hf_afp_UUID, tvb, offset, 16, ENC_BIG_ENDIAN);
3410 offset += 16;
3411 }
3412
3413 return offset;
3414 }
3415
3416 /* -------------------------- */
3417 static gint
3418 dissect_reply_afp_map_id(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3419 {
3420 int len;
3421 int size = 1;
3422
3423 len = tvb_get_guint8(tvb, offset);
3424 /* for type 3 and 4 len is 16 bits but we don't keep the type from the request
3425 * XXX assume name < 256, ie the first byte is zero.
3426 */
3427 if (!len) {
3428 len = tvb_get_guint8(tvb, offset +1);
3429 if (!len) {
3430 /* assume it's undocumented type 5 or 6 reply */
3431 proto_tree_add_item(tree, hf_afp_map_id_reply_type, tvb, offset, 4, ENC_BIG_ENDIAN);
3432 offset += 4;
3433
3434 proto_tree_add_item(tree, hf_afp_map_id, tvb, offset, 4, ENC_BIG_ENDIAN);
3435 offset += 4;
3436
3437 size = 2;
3438 len = tvb_get_guint8(tvb, offset +1);
3439
3440 }
3441 else {
3442 gint remain = tvb_reported_length_remaining(tvb,offset);
3443 if (remain == len +2) {
3444 size = 2;
3445 }
3446 else {
3447 /* give up */
3448 len = remain;
3449 size = 0;
3450 }
3451 }
3452 }
3453 if (size) {
3454 proto_tree_add_item(tree, hf_afp_map_name, tvb, offset, size, ENC_ASCII|ENC_NA);
3455 }
3456 else {
3457 proto_tree_add_item(tree, hf_afp_unknown, tvb, offset, len, ENC_NA);
3458 }
3459 offset += len +size;
3460 return offset;
3461 }
3462
3463 /* ************************** */
3464 static gint
3465 dissect_query_afp_map_name(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3466 {
3467 int len;
3468 int type;
3469 int size;
3470
3471 type = tvb_get_guint8(tvb, offset);
3472 proto_tree_add_item(tree, hf_afp_map_name_type, tvb, offset, 1, ENC_BIG_ENDIAN);
3473 offset++;
3474 switch (type) {
3475 case 5: /* use 16 bits length */
3476 case 6:
3477 size = 2;
3478 len = tvb_get_ntohs(tvb, offset);
3479 break;
3480 default:
3481 size = 1;
3482 len = tvb_get_guint8(tvb, offset);
3483 break;
3484 }
3485 proto_tree_add_item(tree, hf_afp_map_name, tvb, offset, size, ENC_ASCII|ENC_NA);
3486 offset += len +size;
3487
3488 return offset;
3489 }
3490
3491 /* -------------------------- */
3492 static gint
3493 dissect_reply_afp_map_name(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3494 {
3495 gint remain;
3496
3497 /* We don't keep the type from the request */
3498 /* If remain == 16, assume UUID */
3499 remain = tvb_reported_length(tvb);
3500 if (remain == 16) {
3501 proto_tree_add_item(tree, hf_afp_UUID, tvb, offset, 16, ENC_BIG_ENDIAN);
3502 offset += 16;
3503 }
3504 else {
3505 proto_tree_add_item(tree, hf_afp_map_id, tvb, offset, 4, ENC_BIG_ENDIAN);
3506 offset += 4;
3507 }
3508
3509 return offset;
3510 }
3511
3512 /* ************************** */
3513 static gint
3514 dissect_query_afp_disconnect_old_session(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3515 {
3516 int len, orig_offset = offset;
3517
3518 PAD(1);
3519
3520 proto_tree_add_item(tree, hf_afp_session_token_type, tvb, offset, 2, ENC_BIG_ENDIAN);
3521 offset += 2;
3522
3523 len = tvb_get_ntohl(tvb, offset);
3524 proto_tree_add_item(tree, hf_afp_session_token_len, tvb, offset, 4, ENC_BIG_ENDIAN);
3525 offset += 4;
3526
3527 proto_tree_add_item(tree, hf_afp_session_token, tvb, offset, len, ENC_NA);
3528 offset += len;
3529
3530 if (offset <= orig_offset)
3531 THROW(ReportedBoundsError);
3532
3533 return offset;
3534 }
3535
3536 /* ************************** */
3537 static gint
3538 dissect_query_afp_get_session_token(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3539 {
3540 guint16 token;
3541 int len, orig_offset = offset;
3542
3543 PAD(1);
3544 token = tvb_get_ntohs(tvb, offset);
3545 proto_tree_add_item(tree, hf_afp_session_token_type, tvb, offset, 2, ENC_BIG_ENDIAN);
3546 offset += 2;
3547 if (token == kLoginWithoutID || token == kGetKerberosSessionKey) /* 0 || 8 */
3548 return offset;
3549
3550 len = tvb_get_ntohl(tvb, offset);
3551 proto_tree_add_item(tree, hf_afp_session_token_len, tvb, offset, 4, ENC_BIG_ENDIAN);
3552 offset += 4;
3553
3554 switch (token) {
3555 case kLoginWithTimeAndID:
3556 case kReconnWithTimeAndID:
3557 proto_tree_add_item(tree, hf_afp_session_token_timestamp, tvb, offset, 4, ENC_BIG_ENDIAN);
3558 offset += 4;
3559 }
3560
3561 proto_tree_add_item(tree, hf_afp_session_token, tvb, offset, len, ENC_NA);
3562 offset += len;
3563
3564 if (offset <= orig_offset)
3565 THROW(ReportedBoundsError);
3566
3567 return offset;
3568 }
3569
3570 /* -------------------------- */
3571 static gint
3572 dissect_reply_afp_get_session_token(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3573 {
3574 int len, orig_offset = offset;
3575 int size;
3576
3577 /* FIXME spec and capture disagree : or it's 4 bytes with no token type, or it's 2 bytes */
3578 size = 4;
3579 /* [cm]: FIXME continued: Since size is set to 4, this test is never true.
3580 if (size == 2) {
3581 proto_tree_add_item(tree, hf_afp_session_token_type, tvb, offset, 2, ENC_BIG_ENDIAN);
3582 offset += 2;
3583 }
3584 */
3585 len = tvb_get_ntohl(tvb, offset);
3586 proto_tree_add_item(tree, hf_afp_session_token_len, tvb, offset, size, ENC_BIG_ENDIAN);
3587 offset += size;
3588
3589 proto_tree_add_item(tree, hf_afp_session_token, tvb, offset, len, ENC_NA);
3590 offset += len;
3591
3592 if (offset <= orig_offset)
3593 THROW(ReportedBoundsError);
3594
3595 return offset;
3596 }
3597
3598 /* ************************** */
3599 static gint
3600 dissect_query_afp_get_server_message(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3601 {
3602
3603 PAD(1);
3604 proto_tree_add_item(tree, hf_afp_message_type, tvb, offset, 2, ENC_BIG_ENDIAN);
3605 offset += 2;
3606
3607 if (tree) {
3608 proto_tree *sub_tree;
3609 proto_item *item;
3610
3611 item = proto_tree_add_item(tree, hf_afp_message_bitmap, tvb, offset, 2, ENC_BIG_ENDIAN);
3612 sub_tree = proto_item_add_subtree(item, ett_afp_message_bitmap);
3613 proto_tree_add_item(sub_tree, hf_afp_message_bitmap_REQ, tvb, offset, 2, ENC_BIG_ENDIAN);
3614 proto_tree_add_item(sub_tree, hf_afp_message_bitmap_UTF, tvb, offset, 2, ENC_BIG_ENDIAN);
3615 }
3616 offset += 2;
3617
3618 return offset;
3619 }
3620
3621 /* ************************** */
3622 static gint
3623 dissect_reply_afp_get_server_message(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3624 {
3625 guint16 bitmap;
3626 guint16 len = 0;
3627
3628 /* FIXME: APF 3.1 specs also specify a long reply format, yet unused */
3629
3630 proto_tree_add_item(tree, hf_afp_message_type, tvb, offset, 2, ENC_BIG_ENDIAN);
3631 offset += 2;
3632
3633 bitmap = tvb_get_ntohs(tvb, offset);
3634 if (tree) {
3635 proto_tree *sub_tree;
3636 proto_item *item;
3637
3638 item = proto_tree_add_item(tree, hf_afp_message_bitmap, tvb, offset, 2, ENC_BIG_ENDIAN);
3639 sub_tree = proto_item_add_subtree(item, ett_afp_message_bitmap);
3640 proto_tree_add_item(sub_tree, hf_afp_message_bitmap_REQ, tvb, offset, 2, ENC_BIG_ENDIAN);
3641 proto_tree_add_item(sub_tree, hf_afp_message_bitmap_UTF, tvb, offset, 2, ENC_BIG_ENDIAN);
3642 }
3643 offset += 2;
3644
3645 /*
3646 * XXX - the spec says that the 0x01 bit indicates whether
3647 * the ServerMessage field contains a server message or a login
3648 * message.
3649 */
3650 if (bitmap & 0x02) {
3651 /* Message is UTF-8, and message length is 2 bytes */
3652 len = tvb_get_ntohs(tvb, offset);
3653 proto_tree_add_item(tree, hf_afp_message_len, tvb, offset, 2, ENC_BIG_ENDIAN);
3654 offset += 2;
3655 if (len) {
3656 proto_tree_add_item(tree, hf_afp_message, tvb, offset, len , ENC_UTF_8|ENC_NA);
3657 offset += len;
3658 }
3659 } else {
3660 /*
3661 * Message is not UTF-8, and message length is 1 byte.
3662 *
3663 * Is the message in some Mac encoding? Always Mac Roman,
3664 * or possibly some other encoding for other locales?
3665 */
3666 len = tvb_get_guint8(tvb, offset);
3667 proto_tree_add_item(tree, hf_afp_message_len, tvb, offset, 1, ENC_BIG_ENDIAN);
3668 offset += 1;
3669 if (len) {
3670 proto_tree_add_item(tree, hf_afp_message, tvb, offset, len , ENC_ASCII|ENC_NA);
3671 offset += len;
3672 }
3673 }
3674
3675 return offset;
3676 }
3677
3678 /* ************************** */
3679 static gint
3680 dissect_query_afp_get_user_info(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3681 {
3682
3683 proto_tree_add_item(tree, hf_afp_user_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
3684 offset++;
3685
3686 proto_tree_add_item(tree, hf_afp_user_ID, tvb, offset, 4, ENC_BIG_ENDIAN);
3687 offset += 4;
3688
3689 if (tree) {
3690 proto_tree *sub_tree;
3691 proto_item *item;
3692
3693 item = proto_tree_add_item(tree, hf_afp_user_bitmap, tvb, offset, 2, ENC_BIG_ENDIAN);
3694 sub_tree = proto_item_add_subtree(item, ett_afp_user_bitmap);
3695 proto_tree_add_item(sub_tree, hf_afp_user_bitmap_UID, tvb, offset, 2, ENC_BIG_ENDIAN);
3696 proto_tree_add_item(sub_tree, hf_afp_user_bitmap_GID, tvb, offset, 2, ENC_BIG_ENDIAN);
3697 proto_tree_add_item(sub_tree, hf_afp_user_bitmap_UUID, tvb, offset, 2, ENC_BIG_ENDIAN);
3698 }
3699 offset += 2;
3700
3701 return offset;
3702 }
3703
3704 /* -------------------------- */
3705 static gint
3706 dissect_reply_afp_get_user_info(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3707 {
3708 guint16 bitmap;
3709
3710 bitmap = tvb_get_ntohs(tvb, offset);
3711 if (tree) {
3712 proto_tree *sub_tree;
3713 proto_item *item;
3714
3715 item = proto_tree_add_item(tree, hf_afp_user_bitmap, tvb, offset, 2, ENC_BIG_ENDIAN);
3716 sub_tree = proto_item_add_subtree(item, ett_afp_user_bitmap);
3717 proto_tree_add_item(sub_tree, hf_afp_user_bitmap_UID, tvb, offset, 2, ENC_BIG_ENDIAN);
3718 proto_tree_add_item(sub_tree, hf_afp_user_bitmap_GID, tvb, offset, 2, ENC_BIG_ENDIAN);
3719 proto_tree_add_item(sub_tree, hf_afp_user_bitmap_UUID, tvb, offset, 2, ENC_BIG_ENDIAN);
3720 }
3721
3722 offset += 2;
3723 if ((bitmap & 1)) {
3724 proto_tree_add_item(tree, hf_afp_user_ID, tvb, offset, 4, ENC_BIG_ENDIAN);
3725 offset += 4;
3726 }
3727
3728 if ((bitmap & 2)) {
3729 proto_tree_add_item(tree, hf_afp_group_ID, tvb, offset, 4, ENC_BIG_ENDIAN);
3730 offset += 4;
3731 }
3732
3733 if ((bitmap & 4)) {
3734 proto_tree_add_item(tree, hf_afp_UUID, tvb, offset, 16, ENC_BIG_ENDIAN);
3735 offset += 16;
3736 }
3737 return offset;
3738 }
3739
3740
3741 /* ************************** */
3742 static gint
3743 decode_attr_name (proto_tree *tree, packet_info *pinfo _U_, tvbuff_t *tvb, gint offset, const gchar *label)
3744 {
3745 int len;
3746
3747 if ((offset & 1))
3748 PAD(1);
3749
3750 len = tvb_get_ntohs(tvb, offset);
3751
3752 if (tree) {
3753 gchar *name;
3754 proto_tree *sub_tree;
3755 proto_item *item;
3756
3757 name = tvb_format_text(tvb,offset+2, len);
3758 item = proto_tree_add_text(tree, tvb, offset, len + 2, label, name);
3759 sub_tree = proto_item_add_subtree(item, ett_afp_extattr_names);
3760
3761 proto_tree_add_item(sub_tree, hf_afp_extattr_namelen, tvb, offset, 2, ENC_BIG_ENDIAN);
3762 proto_tree_add_item(sub_tree, hf_afp_extattr_name, tvb, offset +2, len, ENC_UTF_8|ENC_NA);
3763 }
3764 offset += 2 +len;
3765
3766 return offset;
3767 }
3768
3769 /* ************************** */
3770 static gint
3771 decode_attr_bitmap (proto_tree *tree, tvbuff_t *tvb, gint offset)
3772 {
3773
3774 if (tree) {
3775 proto_tree *sub_tree;
3776 proto_item *item;
3777
3778 item = proto_tree_add_item(tree, hf_afp_extattr_bitmap, tvb, offset, 2, ENC_BIG_ENDIAN);
3779 sub_tree = proto_item_add_subtree(item, ett_afp_extattr_bitmap);
3780 proto_tree_add_item(sub_tree, hf_afp_extattr_bitmap_NoFollow, tvb, offset, 2, ENC_BIG_ENDIAN);
3781 proto_tree_add_item(sub_tree, hf_afp_extattr_bitmap_Create, tvb, offset, 2, ENC_BIG_ENDIAN);
3782 proto_tree_add_item(sub_tree, hf_afp_extattr_bitmap_Replace, tvb, offset, 2, ENC_BIG_ENDIAN);
3783 }
3784 offset += 2;
3785 return offset;
3786 }
3787
3788 /* ************************** */
3789 static gint
3790 dissect_query_afp_get_ext_attr(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
3791 {
3792 PAD(1);
3793 offset = decode_vol_did(tree, tvb, offset);
3794
3795 offset = decode_attr_bitmap(tree, tvb, offset);
3796
3797 /* 8byte offset */
3798 proto_tree_add_item(tree, hf_afp_offset64, tvb, offset, 8, ENC_BIG_ENDIAN);
3799 offset += 8;
3800 /* 8byte reqcount */
3801 proto_tree_add_item(tree, hf_afp_reqcount64, tvb, offset, 8, ENC_BIG_ENDIAN);
3802 offset += 8;
3803
3804 /* maxreply */
3805 proto_tree_add_item(tree, hf_afp_extattr_reply_size, tvb, offset, 4, ENC_BIG_ENDIAN);
3806 offset += 4;
3807
3808 offset = decode_name(tree, pinfo, tvb, offset);
3809
3810 offset = decode_attr_name(tree, pinfo, tvb, offset, "Attribute: %s");
3811
3812 return offset;
3813 }
3814
3815 /* -------------------------- */
3816 static gint
3817 dissect_reply_afp_get_ext_attr(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3818 {
3819 guint32 len;
3820 guint remain;
3821 int orig_offset = offset;
3822
3823 offset = decode_attr_bitmap(tree, tvb, offset);
3824
3825 len = tvb_get_ntohl(tvb, offset);
3826 proto_tree_add_item(tree, hf_afp_extattr_len, tvb, offset, 4, ENC_BIG_ENDIAN);
3827 offset += 4;
3828
3829 remain = tvb_reported_length_remaining(tvb, offset);
3830 if (len && remain >= len ) {
3831 proto_tree_add_item(tree, hf_afp_extattr_data, tvb, offset, len, ENC_NA);
3832 offset += len;
3833 }
3834
3835 if (offset <= orig_offset)
3836 THROW(ReportedBoundsError);
3837
3838 return offset;
3839 }
3840
3841 /* ************************** */
3842 static gint
3843 dissect_query_afp_set_ext_attr(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
3844 {
3845 guint16 len;
3846
3847 PAD(1);
3848 offset = decode_vol_did(tree, tvb, offset);
3849
3850 offset = decode_attr_bitmap(tree, tvb, offset);
3851
3852 /* 8byte offset */
3853 proto_tree_add_item(tree, hf_afp_offset64, tvb, offset, 8, ENC_BIG_ENDIAN);
3854 offset += 8;
3855
3856 offset = decode_name(tree, pinfo, tvb, offset);
3857
3858 offset = decode_attr_name(tree, pinfo, tvb, offset, "Attribute: %s");
3859
3860 len = tvb_get_ntohl(tvb, offset);
3861 proto_tree_add_item(tree, hf_afp_extattr_len, tvb, offset, 4, ENC_BIG_ENDIAN);
3862 offset += 4;
3863
3864 proto_tree_add_item(tree, hf_afp_extattr_data, tvb, offset, len, ENC_NA);
3865 offset += len;
3866
3867 return offset;
3868 }
3869
3870 /* ************************** */
3871 static gint
3872 dissect_query_afp_list_ext_attrs(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
3873 {
3874 PAD(1);
3875 offset = decode_vol_did(tree, tvb, offset);
3876
3877 /* for this command only kXAttrNoFollow is valid */
3878 offset = decode_attr_bitmap(tree, tvb, offset);
3879
3880 proto_tree_add_item(tree, hf_afp_extattr_req_count, tvb, offset, 2, ENC_BIG_ENDIAN);
3881 offset += 2;
3882
3883 proto_tree_add_item(tree, hf_afp_extattr_start_index, tvb, offset, 4, ENC_BIG_ENDIAN);
3884 offset += 4;
3885
3886 proto_tree_add_item(tree, hf_afp_extattr_reply_size, tvb, offset, 4, ENC_BIG_ENDIAN);
3887 offset += 4;
3888
3889 offset = decode_name(tree, pinfo, tvb, offset);
3890
3891 return offset;
3892 }
3893
3894 /* -------------------------- */
3895 static gint
3896 dissect_reply_afp_list_ext_attrs(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
3897 {
3898 proto_item *item;
3899 proto_tree *sub_tree;
3900 gint length = 0, orig_offset = offset;
3901 int remain;
3902
3903 offset = decode_attr_bitmap(tree, tvb, offset);
3904
3905 length = tvb_get_ntohl(tvb, offset);
3906 proto_tree_add_item(tree, hf_afp_extattr_reply_size, tvb, offset, 4, ENC_BIG_ENDIAN);
3907 offset += 4;
3908
3909 /* If reply_size was 0 on request, server only reports the size of
3910 the entries without actually adding any entries */
3911 remain = tvb_reported_length_remaining(tvb, offset);
3912 if (remain >= length) {
3913
3914 item = proto_tree_add_text(tree, tvb, offset, remain , "Attributes");
3915 sub_tree = proto_item_add_subtree(item, ett_afp_extattr_names);
3916 while ( remain > 0) {
3917 length = tvb_strsize(tvb, offset);
3918 proto_tree_add_item(sub_tree, hf_afp_extattr_name, tvb, offset, length, ENC_UTF_8|ENC_NA);
3919 offset += length;
3920 remain -= length;
3921 }
3922
3923 }
3924
3925 if (offset <= orig_offset)
3926 THROW(ReportedBoundsError);
3927
3928 return offset;
3929 }
3930
3931 /* ************************** */
3932 static gint
3933 dissect_query_afp_remove_ext_attr(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
3934 {
3935 PAD(1);
3936 offset = decode_vol_did(tree, tvb, offset);
3937
3938 offset = decode_attr_bitmap(tree, tvb, offset);
3939
3940 offset = decode_name(tree, pinfo, tvb, offset);
3941
3942 offset = decode_attr_name(tree, pinfo, tvb, offset, "Attribute: %s");
3943
3944 return offset;
3945 }
3946
3947 /* ************************** */
3948 static gint
3949 decode_acl_access_bitmap(tvbuff_t *tvb, proto_tree *tree, gint offset)
3950 {
3951 guint32 bitmap;
3952
3953 bitmap = tvb_get_ntohl(tvb, offset);
3954 if (tree) {
3955 proto_tree *sub_tree;
3956 proto_item *item;
3957
3958 item = proto_tree_add_item(tree, hf_afp_acl_access_bitmap, tvb, offset, 4, ENC_BIG_ENDIAN);
3959 sub_tree = proto_item_add_subtree(item, ett_afp_acl_access_bitmap);
3960
3961 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_read_data , tvb, offset, 4, ENC_BIG_ENDIAN);
3962 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_write_data , tvb, offset, 4, ENC_BIG_ENDIAN);
3963 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_execute , tvb, offset, 4, ENC_BIG_ENDIAN);
3964 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_delete , tvb, offset, 4, ENC_BIG_ENDIAN);
3965 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_append_data , tvb, offset, 4, ENC_BIG_ENDIAN);
3966 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_delete_child , tvb, offset, 4, ENC_BIG_ENDIAN);
3967 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_read_attrs , tvb, offset, 4, ENC_BIG_ENDIAN);
3968 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_write_attrs , tvb, offset, 4, ENC_BIG_ENDIAN);
3969 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_read_extattrs , tvb, offset, 4, ENC_BIG_ENDIAN);
3970 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_write_extattrs , tvb, offset, 4, ENC_BIG_ENDIAN);
3971 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_read_security , tvb, offset, 4, ENC_BIG_ENDIAN);
3972 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_write_security , tvb, offset, 4, ENC_BIG_ENDIAN);
3973 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_change_owner , tvb, offset, 4, ENC_BIG_ENDIAN);
3974 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_synchronize , tvb, offset, 4, ENC_BIG_ENDIAN);
3975 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_generic_all , tvb, offset, 4, ENC_BIG_ENDIAN);
3976 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_generic_execute, tvb, offset, 4, ENC_BIG_ENDIAN);
3977 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_generic_write , tvb, offset, 4, ENC_BIG_ENDIAN);
3978 proto_tree_add_item(sub_tree, hf_afp_acl_access_bitmap_generic_read , tvb, offset, 4, ENC_BIG_ENDIAN);
3979 }
3980
3981 return bitmap;
3982 }
3983
3984 /* ************************** */
3985 static gint
3986 dissect_query_afp_access(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
3987 {
3988 PAD(1);
3989 offset = decode_vol_did(tree, tvb, offset);
3990
3991 proto_tree_add_item(tree, hf_afp_access_bitmap, tvb, offset, 2, ENC_BIG_ENDIAN);
3992 offset += 2;
3993
3994 proto_tree_add_item(tree, hf_afp_UUID, tvb, offset, 16, ENC_BIG_ENDIAN);
3995 offset += 16;
3996
3997 decode_acl_access_bitmap(tvb, tree, offset);
3998 offset += 4;
3999
4000 offset = decode_name(tree, pinfo, tvb, offset);
4001
4002 return offset;
4003 }
4004
4005 /* ************************** */
4006 static gint
4007 dissect_query_afp_with_did(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset)
4008 {
4009 PAD(1);
4010 offset = decode_vol_did(tree, tvb, offset);
4011
4012 proto_tree_add_item(tree, hf_afp_did, tvb, offset, 4, ENC_BIG_ENDIAN);
4013 offset += 4;
4014
4015 return offset;
4016 }
4017
4018 /* ************************** */
4019
4020 #define SQ_TYPE_NULL 0x0000
4021 #define SQ_TYPE_COMPLEX 0x0200
4022 #define SQ_TYPE_INT64 0x8400
4023 #define SQ_TYPE_BOOL 0x0100
4024 #define SQ_TYPE_FLOAT 0x8500
4025 #define SQ_TYPE_DATA 0x0700
4026 #define SQ_TYPE_CNIDS 0x8700
4027 #define SQ_TYPE_UUID 0x0e00
4028 #define SQ_TYPE_DATE 0x8600
4029
4030 #define SQ_CPX_TYPE_ARRAY 0x0a00
4031 #define SQ_CPX_TYPE_STRING 0x0c00
4032 #define SQ_CPX_TYPE_UTF16_STRING 0x1c00
4033 #define SQ_CPX_TYPE_DICT 0x0d00
4034 #define SQ_CPX_TYPE_CNIDS 0x1a00
4035 #define SQ_CPX_TYPE_FILEMETA 0x1b00
4036
4037 #define SUBQ_SAFETY_LIM 20
4038
4039 static gint
4040 spotlight_int64(tvbuff_t *tvb, proto_tree *tree, gint offset, guint encoding)
4041 {
4042 guint count, i;
4043 guint64 query_data64;
4044
4045 query_data64 = spotlight_ntoh64(tvb, offset, encoding);
4046 count = (guint)(query_data64 >> 32);
4047 offset += 8;
4048
4049 for (i = 0; i < count; i++) {
4050 query_data64 = spotlight_ntoh64(tvb, offset, encoding);
4051 proto_tree_add_text(tree, tvb, offset, 8, "int64: 0x%016" G_GINT64_MODIFIER "x", query_data64);
4052 offset += 8;
4053 }
4054
4055 return count;
4056 }
4057
4058 static gint
4059 spotlight_date(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset, guint encoding)
4060 {
4061 guint count, i;
4062 guint64 query_data64;
4063 nstime_t t;
4064
4065 query_data64 = spotlight_ntoh64(tvb, offset, encoding);
4066 count = (guint)(query_data64 >> 32);
4067 offset += 8;
4068
4069 if (count > SUBQ_SAFETY_LIM) {
4070 expert_add_info_format(pinfo, tree, &ei_afp_subquery_count_over_safety_limit,
4071 "Subquery count (%d) > safety limit (%d)", count, SUBQ_SAFETY_LIM);
4072 return -1;
4073 }
4074
4075 for (i = 0; i < count; i++) {
4076 query_data64 = spotlight_ntoh64(tvb, offset, encoding) >> 24;
4077 t.secs = (time_t)(query_data64 - SPOTLIGHT_TIME_DELTA);
4078 t.nsecs = 0;
4079 proto_tree_add_time(tree, hf_afp_spotlight_date, tvb, offset, 8, &t);
4080 offset += 8;
4081 }
4082
4083 return count;
4084 }
4085
4086 static gint
4087 spotlight_uuid(tvbuff_t *tvb, proto_tree *tree, gint offset, guint encoding)
4088 {
4089 guint count, i;
4090 guint64 query_data64;
4091
4092 query_data64 = spotlight_ntoh64(tvb, offset, encoding);
4093 count = (guint)(query_data64 >> 32);
4094 offset += 8;
4095
4096 for (i = 0; i < count; i++) {
4097 proto_tree_add_item(tree, hf_afp_spotlight_uuid, tvb, offset, 16, ENC_BIG_ENDIAN);
4098 offset += 16;
4099 }
4100
4101 return count;
4102 }
4103
4104 static gint
4105 spotlight_float(tvbuff_t *tvb, proto_tree *tree, gint offset, guint encoding)
4106 {
4107 guint count, i;
4108 guint64 query_data64;
4109 gdouble fval;
4110
4111 query_data64 = spotlight_ntoh64(tvb, offset, encoding);
4112 count = (guint)(query_data64 >> 32);
4113 offset += 8;
4114
4115 for (i = 0; i < count; i++) {
4116 fval = spotlight_ntohieee_double(tvb, offset, encoding);
4117 proto_tree_add_text(tree, tvb, offset, 8, "float: %f", fval);
4118 offset += 8;
4119 }
4120
4121 return count;
4122 }
4123
4124 static gint
4125 spotlight_CNID_array(tvbuff_t *tvb, proto_tree *tree, gint offset, guint encoding)
4126 {
4127 guint count;
4128 guint64 query_data64;
4129 guint16 unknown1;
4130 guint32 unknown2;
4131
4132 query_data64 = spotlight_ntoh64(tvb, offset, encoding);
4133 count = (guint)(query_data64 & 0xffff);
4134 unknown1 = (query_data64 & 0xffff0000) >> 16;
4135 unknown2 = (guint32)(query_data64 >> 32);
4136
4137 proto_tree_add_text(tree, tvb, offset + 2, 2, "unknown1: 0x%04" G_GINT16_MODIFIER "x",
4138 unknown1);
4139 proto_tree_add_text(tree, tvb, offset + 4, 4, "unknown2: 0x%08" G_GINT32_MODIFIER "x",
4140 unknown2);
4141 offset += 8;
4142
4143
4144 while (count --) {
4145 query_data64 = spotlight_ntoh64(tvb, offset, encoding);
4146 proto_tree_add_text(tree, tvb, offset, 8, "CNID: %" G_GINT64_MODIFIER "u",
4147 query_data64);
4148 offset += 8;
4149 }
4150
4151 return 0;
4152 }
4153
4154 static const char *spotlight_get_qtype_string(guint64 query_type)
4155 {
4156 switch (query_type) {
4157 case SQ_TYPE_NULL:
4158 return "null";
4159 case SQ_TYPE_COMPLEX:
4160 return "complex";
4161 case SQ_TYPE_INT64:
4162 return "int64";
4163 case SQ_TYPE_BOOL:
4164 return "bool";
4165 case SQ_TYPE_FLOAT:
4166 return "float";
4167 case SQ_TYPE_DATA:
4168 return "data";
4169 case SQ_TYPE_CNIDS:
4170 return "CNIDs";
4171 default:
4172 return "unknown";
4173 }
4174 }
4175
4176 static const char *spotlight_get_cpx_qtype_string(guint64 cpx_query_type)
4177 {
4178 switch (cpx_query_type) {
4179 case SQ_CPX_TYPE_ARRAY:
4180 return "array";
4181 case SQ_CPX_TYPE_STRING:
4182 return "string";
4183 case SQ_CPX_TYPE_UTF16_STRING:
4184 return "utf-16 string";
4185 case SQ_CPX_TYPE_DICT:
4186 return "dictionary";
4187 case SQ_CPX_TYPE_CNIDS:
4188 return "CNIDs";
4189 case SQ_CPX_TYPE_FILEMETA:
4190 return "FileMeta";
4191 default:
4192 return "unknown";
4193 }
4194 }
4195
4196 static gint
4197 spotlight_dissect_query_loop(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset,
4198 guint64 cpx_query_type, gint count, gint toc_offset, guint encoding)
4199 {
4200 gint i, j;
4201 gint subquery_count;
4202 gint toc_index;
4203 guint64 query_data64;
4204 gint query_length;
4205 guint64 query_type;
4206 guint64 complex_query_type;
4207 guint unicode_encoding;
4208 gboolean mark_exists;
4209
4210 proto_item *item_query;
4211 proto_tree *sub_tree;
4212
4213 /*
4214 * This loops through a possibly nested query data structure.
4215 * The outermost one is always without count and called from
4216 * dissect_spotlight() with count = INT_MAX thus the while (...)
4217 * loop terminates if (offset >= toc_offset).
4218 * If nested structures are found, these will have an encoded element
4219 * count which is used in a recursive call to
4220 * spotlight_dissect_query_loop as count parameter, thus in this case
4221 * the while (...) loop will terminate when count reaches 0.
4222 */
4223 while ((offset < (toc_offset - 8)) && (count > 0)) {
4224 query_data64 = spotlight_ntoh64(tvb, offset, encoding);
4225 query_length = ((gint)query_data64 & 0xffff) * 8;
4226 if (query_length == 0) {
4227 /* XXX - report this as an error */
4228 break;
4229 }
4230 query_type = (query_data64 & 0xffff0000) >> 16;
4231
4232 switch (query_type) {
4233 case SQ_TYPE_COMPLEX:
4234 toc_index = (gint)((query_data64 >> 32) - 1);
4235 query_data64 = spotlight_ntoh64(tvb, toc_offset + toc_index * 8, encoding);
4236 complex_query_type = (query_data64 & 0xffff0000) >> 16;
4237
4238 switch (complex_query_type) {
4239 case SQ_CPX_TYPE_ARRAY:
4240 case SQ_CPX_TYPE_DICT:
4241 subquery_count = (gint)(query_data64 >> 32);
4242 item_query = proto_tree_add_text(tree, tvb, offset, query_length,
4243 "%s, toc index: %u, children: %u",
4244 spotlight_get_cpx_qtype_string(complex_query_type),
4245 toc_index + 1,
4246 subquery_count);
4247 break;
4248 case SQ_CPX_TYPE_STRING:
4249 subquery_count = 1;
4250 query_data64 = spotlight_ntoh64(tvb, offset + 8, encoding);
4251 query_length = ((gint)query_data64 & 0xffff) * 8;
4252 item_query = proto_tree_add_text(tree, tvb, offset, query_length + 8,
4253 "%s, toc index: %u, string: '%s'",
4254 spotlight_get_cpx_qtype_string(complex_query_type),
4255 toc_index + 1,
4256 tvb_get_string(wmem_packet_scope(), tvb, offset + 16, query_length - 8));
4257 break;
4258 case SQ_CPX_TYPE_UTF16_STRING:
4259 /*
4260 * This is an UTF-16 string.
4261 * Dissections show the typical byte order mark 0xFFFE or 0xFEFF, respectively.
4262 * However the existence of such a mark can not be assumed.
4263 * If the mark is missing, big endian encoding is assumed.
4264 */
4265
4266 subquery_count = 1;
4267 query_data64 = spotlight_ntoh64(tvb, offset + 8, encoding);
4268 query_length = ((gint)query_data64 & 0xffff) * 8;
4269
4270 unicode_encoding = spotlight_get_utf16_string_encoding(tvb, offset + 16, query_length - 8, encoding);
4271 mark_exists = (unicode_encoding & ENC_UTF_16);
4272 unicode_encoding &= ~ENC_UTF_16;
4273
4274 item_query = proto_tree_add_text(tree, tvb, offset, query_length + 8,
4275 "%s, toc index: %u, utf-16 string: '%s'",
4276 spotlight_get_cpx_qtype_string(complex_query_type),
4277 toc_index + 1,
4278 tvb_get_unicode_string(wmem_packet_scope(), tvb, offset + (mark_exists ? 18 : 16),
4279 query_length - (mark_exists? 10 : 8), unicode_encoding));
4280 break;
4281 default:
4282 subquery_count = 1;
4283 item_query = proto_tree_add_text(tree, tvb, offset, query_length,
4284 "type: %s (%s), toc index: %u, children: %u",
4285 spotlight_get_qtype_string(query_type),
4286 spotlight_get_cpx_qtype_string(complex_query_type),
4287 toc_index + 1,
4288 subquery_count);
4289 break;
4290 }
4291
4292 sub_tree = proto_item_add_subtree(item_query, ett_afp_spotlight_query_line);
4293 offset += 8;
4294 offset = spotlight_dissect_query_loop(tvb, pinfo, sub_tree, offset, complex_query_type, subquery_count, toc_offset, encoding);
4295 count--;
4296 break;
4297 case SQ_TYPE_NULL:
4298 subquery_count = (gint)(query_data64 >> 32);
4299 if (subquery_count > count) {
4300 item_query = proto_tree_add_text(tree, tvb, offset, query_length, "null");
4301 expert_add_info_format(pinfo, item_query, &ei_afp_subquery_count_over_query_count,
4302 "Subquery count (%d) > query count (%d)", subquery_count, count);
4303 count = 0;
4304 } else if (subquery_count > 20) {
4305 item_query = proto_tree_add_text(tree, tvb, offset, query_length, "null");
4306 expert_add_info_format(pinfo, item_query, &ei_afp_abnormal_num_subqueries,
4307 "Abnormal number of subqueries (%d)", subquery_count);
4308 count -= subquery_count;
4309 } else {
4310 for (i = 0; i < subquery_count; i++, count--)
4311 proto_tree_add_text(tree, tvb, offset, query_length, "null");
4312 }
4313 offset += query_length;
4314 break;
4315 case SQ_TYPE_BOOL:
4316 proto_tree_add_text(tree, tvb, offset, query_length, "bool: %s",
4317 (query_data64 >> 32) ? "true" : "false");
4318 count--;
4319 offset += query_length;
4320 break;
4321 case SQ_TYPE_INT64:
4322 item_query = proto_tree_add_text(tree, tvb, offset, 8, "int64");
4323 sub_tree = proto_item_add_subtree(item_query, ett_afp_spotlight_query_line);
4324 j = spotlight_int64(tvb, sub_tree, offset, encoding);
4325 count -= j;
4326 offset += query_length;
4327 break;
4328 case SQ_TYPE_UUID:
4329 item_query = proto_tree_add_text(tree, tvb, offset, 8, "UUID");
4330 sub_tree = proto_item_add_subtree(item_query, ett_afp_spotlight_query_line);
4331 j = spotlight_uuid(tvb, sub_tree, offset, encoding);
4332 count -= j;
4333 offset += query_length;
4334 break;
4335 case SQ_TYPE_FLOAT:
4336 item_query = proto_tree_add_text(tree, tvb, offset, 8, "float");
4337 sub_tree = proto_item_add_subtree(item_query, ett_afp_spotlight_query_line);
4338 j = spotlight_float(tvb, sub_tree, offset, encoding);
4339 count -= j;
4340 offset += query_length;
4341 break;
4342 case SQ_TYPE_DATA:
4343 switch (cpx_query_type) {
4344 case SQ_CPX_TYPE_STRING:
4345 proto_tree_add_text(tree, tvb, offset, query_length, "string: '%s'",
4346 tvb_get_string(wmem_packet_scope(), tvb, offset + 8, query_length - 8));
4347 break;
4348 case SQ_CPX_TYPE_UTF16_STRING: {
4349 /* description see above */
4350 unicode_encoding = spotlight_get_utf16_string_encoding(tvb, offset + 8, query_length, encoding);
4351 mark_exists = (unicode_encoding & ENC_UTF_16);
4352 unicode_encoding &= ~ENC_UTF_16;
4353
4354 proto_tree_add_text(tree, tvb, offset, query_length, "utf-16 string: '%s'",
4355 tvb_get_unicode_string(wmem_packet_scope(), tvb, offset + (mark_exists ? 10 : 8),
4356 query_length - (mark_exists? 10 : 8), unicode_encoding));
4357 break;
4358 }
4359 case SQ_CPX_TYPE_FILEMETA:
4360 if (query_length <= 8) {
4361 /* item_query = */ proto_tree_add_text(tree, tvb, offset, query_length, "filemeta (empty)");
4362 } else {
4363 item_query = proto_tree_add_text(tree, tvb, offset, query_length, "filemeta");
4364 sub_tree = proto_item_add_subtree(item_query, ett_afp_spotlight_query_line);
4365 (void)dissect_spotlight(tvb, pinfo, sub_tree, offset + 8);
4366 }
4367 break;
4368 }
4369 count--;
4370 offset += query_length;
4371 break;
4372 case SQ_TYPE_CNIDS:
4373 if (query_length <= 8) {
4374 /* item_query = */ proto_tree_add_text(tree, tvb, offset, query_length, "CNID Array (empty)");
4375 } else {
4376 item_query = proto_tree_add_text(tree, tvb, offset, query_length, "CNID Array");
4377 sub_tree = proto_item_add_subtree(item_query, ett_afp_spotlight_query_line);
4378 spotlight_CNID_array(tvb, sub_tree, offset + 8, encoding);
4379 }
4380 count--;
4381 offset += query_length;
4382 break;
4383 case SQ_TYPE_DATE:
4384 if ((j = spotlight_date(tvb, pinfo, tree, offset, encoding)) == -1)
4385 return offset;
4386 count -= j;
4387 offset += query_length;
4388 break;
4389 default:
4390 proto_tree_add_text(tree, tvb, offset, query_length, "type: %s",
4391 spotlight_get_qtype_string(query_type));
4392 count--;
4393 offset += query_length;
4394 break;
4395 }
4396 }
4397
4398 return offset;
4399 }
4400
4401 static gint
4402 dissect_spotlight(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
4403 {
4404 guint encoding;
4405 gint i;
4406 guint64 toc_offset;
4407 guint64 querylen;
4408 gint toc_entries;
4409 guint64 toc_entry;
4410
4411 proto_item *item_queries_data;
4412 proto_tree *sub_tree_queries;
4413 proto_item *item_toc;
4414 proto_tree *sub_tree_toc;
4415
4416 if (strncmp(tvb_get_string(wmem_packet_scope(), tvb, offset, 8), "md031234", 8) == 0)
4417 encoding = ENC_BIG_ENDIAN;
4418 else
4419 encoding = ENC_LITTLE_ENDIAN;
4420 proto_tree_add_text(tree,
4421 tvb,
4422 offset,
4423 8,
4424 "Endianness: %s",
4425 encoding == ENC_BIG_ENDIAN ?
4426 "Big Endian" : "Litte Endian");
4427 offset += 8;
4428
4429 toc_offset = (spotlight_ntoh64(tvb, offset, encoding) >> 32) * 8;
4430 if (toc_offset < 8) {
4431 proto_tree_add_text(tree,
4432 tvb,
4433 offset,
4434 8,
4435 "ToC Offset: %" G_GINT64_MODIFIER "u < 8 (bogus)",
4436 toc_offset);
4437 return -1;
4438 }
4439 toc_offset -= 8;
4440 if (offset + toc_offset + 8 > G_MAXINT) {
4441 proto_tree_add_text(tree,
4442 tvb,
4443 offset,
4444 8,
4445 "ToC Offset: %" G_GINT64_MODIFIER "u > %u (bogus)",
4446 toc_offset,
4447 G_MAXINT - 8 - offset);
4448 return -1;
4449 }
4450 querylen = (spotlight_ntoh64(tvb, offset, encoding) & 0xffffffff) * 8;
4451 if (querylen < 8) {
4452 proto_tree_add_text(tree,
4453 tvb,
4454 offset,
4455 8,
4456 "ToC Offset: %" G_GINT64_MODIFIER "u Bytes, Query length: %" G_GINT64_MODIFIER "u < 8 (bogus)",
4457 toc_offset,
4458 querylen);
4459 return -1;
4460 }
4461 querylen -= 8;
4462 if (querylen > G_MAXINT) {
4463 proto_tree_add_text(tree,
4464 tvb,
4465 offset,
4466 8,
4467 "ToC Offset: %" G_GINT64_MODIFIER "u Bytes, Query length: %" G_GINT64_MODIFIER "u > %u (bogus)",
4468 toc_offset,
4469 querylen,
4470 G_MAXINT);
4471 return -1;
4472 }
4473 proto_tree_add_text(tree,
4474 tvb,
4475 offset,
4476 8,
4477 "ToC Offset: %" G_GINT64_MODIFIER "u Bytes, Query length: %" G_GINT64_MODIFIER "u Bytes",
4478 toc_offset,
4479 querylen);
4480 offset += 8;
4481
4482 toc_entries = (gint)(spotlight_ntoh64(tvb, offset + (gint)toc_offset, encoding) & 0xffff);
4483
4484 item_queries_data = proto_tree_add_text(tree,
4485 tvb,
4486 offset,
4487 (gint)toc_offset,
4488 "Spotlight RPC data");
4489 sub_tree_queries = proto_item_add_subtree(item_queries_data, ett_afp_spotlight_queries);
4490
4491 /* Queries */
4492 offset = spotlight_dissect_query_loop(tvb, pinfo, sub_tree_queries, offset, SQ_CPX_TYPE_ARRAY, INT_MAX, offset + (gint)toc_offset + 8, encoding);
4493
4494 /* ToC */
4495 if (toc_entries < 1) {
4496 proto_tree_add_text(tree,
4497 tvb,
4498 offset,
4499 (gint)querylen - (gint)toc_offset,
4500 "Complex types ToC (%u < 1 - bogus)",
4501 toc_entries);
4502 return -1;
4503 }
4504 toc_entries -= 1;
4505 item_toc = proto_tree_add_text(tree,
4506 tvb,
4507 offset,
4508 (gint)querylen - (gint)toc_offset,
4509 "Complex types ToC (%u entries)",
4510 toc_entries);
4511 sub_tree_toc = proto_item_add_subtree(item_toc, ett_afp_spotlight_toc);
4512 proto_tree_add_text(sub_tree_toc, tvb, offset, 2, "Number of entries (%u)", toc_entries);
4513 proto_tree_add_text(sub_tree_toc, tvb, offset + 2, 2, "unknown");
4514 proto_tree_add_text(sub_tree_toc, tvb, offset + 4, 4, "unknown");
4515
4516 offset += 8;
4517 for (i = 0; i < toc_entries; i++, offset += 8) {
4518 toc_entry = spotlight_ntoh64(tvb, offset, encoding);
4519 if ((((toc_entry & 0xffff0000) >> 16) == SQ_CPX_TYPE_ARRAY)
4520 || (((toc_entry & 0xffff0000) >> 16) == SQ_CPX_TYPE_DICT)) {
4521 proto_tree_add_text(sub_tree_toc,
4522 tvb,
4523 offset,
4524 8,
4525 "%u: count: %" G_GINT64_MODIFIER "u, type: %s, offset: %" G_GINT64_MODIFIER "u",
4526 i+1,
4527 toc_entry >> 32,
4528 spotlight_get_cpx_qtype_string((toc_entry & 0xffff0000) >> 16),
4529 (toc_entry & 0xffff) * 8);
4530 } else if ((((toc_entry & 0xffff0000) >> 16) == SQ_CPX_TYPE_STRING)
4531 || (((toc_entry & 0xffff0000) >> 16) == SQ_CPX_TYPE_UTF16_STRING)) {
4532 proto_tree_add_text(sub_tree_toc,
4533 tvb,
4534 offset,
4535 8,
4536 "%u: pad byte count: %" G_GINT64_MODIFIER "x, type: %s, offset: %" G_GINT64_MODIFIER "u",
4537 i+1,
4538 8 - (toc_entry >> 32),
4539 spotlight_get_cpx_qtype_string((toc_entry & 0xffff0000) >> 16),
4540 (toc_entry & 0xffff) * 8);
4541 }
4542 else {
4543 proto_tree_add_text(sub_tree_toc,
4544 tvb,
4545 offset,
4546 8,
4547 "%u: unknown: 0x%08" G_GINT64_MODIFIER "x, type: %s, offset: %" G_GINT64_MODIFIER "u",
4548 i+1,
4549 toc_entry >> 32,
4550 spotlight_get_cpx_qtype_string((toc_entry & 0xffff0000) >> 16),
4551 (toc_entry & 0xffff) * 8);
4552 }
4553
4554
4555 }
4556
4557 return offset;
4558 }
4559
4560 static gint
4561 dissect_query_afp_spotlight(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset, afp_request_val *request_val)
4562 {
4563 gint len;
4564
4565 PAD(1);
4566 offset = decode_vol(tree, tvb, offset);
4567
4568 proto_tree_add_item(tree, hf_afp_spotlight_request_flags, tvb, offset, 4, ENC_BIG_ENDIAN);
4569 offset += 4;
4570
4571 proto_tree_add_item(tree, hf_afp_spotlight_request_command, tvb, offset, 4, ENC_BIG_ENDIAN);
4572 offset += 4;
4573
4574 proto_tree_add_item(tree, hf_afp_spotlight_request_reserved, tvb, offset, 4, ENC_BIG_ENDIAN);
4575 offset += 4;
4576
4577 switch (request_val->spotlight_req_command) {
4578
4579 case SPOTLIGHT_CMD_GET_VOLPATH:
4580 tvb_get_stringz(wmem_packet_scope(), tvb, offset, &len);
4581 proto_tree_add_item(tree, hf_afp_spotlight_volpath_client, tvb, offset, len, ENC_UTF_8|ENC_NA);
4582 offset += len;
4583 break;
4584
4585 case SPOTLIGHT_CMD_GET_VOLID:
4586 /* empty */
4587 break;
4588
4589 case SPOTLIGHT_CMD_GET_THREE:
4590 proto_tree_add_item(tree, hf_afp_spotlight_volflags, tvb, offset, 4, ENC_BIG_ENDIAN);
4591 offset += 4;
4592
4593 proto_tree_add_item(tree, hf_afp_spotlight_reqlen, tvb, offset, 4, ENC_BIG_ENDIAN);
4594 offset += 4;
4595
4596 offset = dissect_spotlight(tvb, pinfo, tree, offset);
4597
4598 break;
4599 }
4600 return offset;
4601 }
4602
4603 /* ************************** */
4604 static guint16
4605 decode_acl_list_bitmap(tvbuff_t *tvb, proto_tree *tree, gint offset)
4606 {
4607 guint16 bitmap;
4608
4609 bitmap = tvb_get_ntohs(tvb, offset);
4610 if (tree) {
4611 proto_tree *sub_tree;
4612 proto_item *item;
4613
4614 item = proto_tree_add_item(tree, hf_afp_acl_list_bitmap, tvb, offset, 2, ENC_BIG_ENDIAN);
4615 sub_tree = proto_item_add_subtree(item, ett_afp_acl_list_bitmap);
4616 proto_tree_add_item(sub_tree, hf_afp_acl_list_bitmap_UUID, tvb, offset, 2, ENC_BIG_ENDIAN);
4617 proto_tree_add_item(sub_tree, hf_afp_acl_list_bitmap_GRPUUID, tvb, offset, 2, ENC_BIG_ENDIAN);
4618 proto_tree_add_item(sub_tree, hf_afp_acl_list_bitmap_ACL, tvb, offset, 2, ENC_BIG_ENDIAN);
4619 proto_tree_add_item(sub_tree, hf_afp_acl_list_bitmap_REMOVEACL, tvb, offset, 2, ENC_BIG_ENDIAN);
4620 proto_tree_add_item(sub_tree, hf_afp_acl_list_bitmap_Inherit, tvb, offset, 2, ENC_BIG_ENDIAN);
4621 }
4622
4623 return bitmap;
4624 }
4625
4626
4627 /* ************************** */
4628 static guint32
4629 decode_ace_flags_bitmap(tvbuff_t *tvb, proto_tree *tree, gint offset)
4630 {
4631 guint32 bitmap;
4632
4633 bitmap = tvb_get_ntohl(tvb, offset);
4634 if (tree) {
4635 proto_tree *sub_tree;
4636 proto_item *item;
4637
4638 item = proto_tree_add_item(tree, hf_afp_ace_flags, tvb, offset, 4, ENC_BIG_ENDIAN);
4639 sub_tree = proto_item_add_subtree(item, ett_afp_ace_flags);
4640 proto_tree_add_item(sub_tree, hf_afp_ace_flags_allow, tvb, offset, 4, ENC_BIG_ENDIAN);
4641 proto_tree_add_item(sub_tree, hf_afp_ace_flags_deny, tvb, offset, 4, ENC_BIG_ENDIAN);
4642 proto_tree_add_item(sub_tree, hf_afp_ace_flags_inherited, tvb, offset, 4, ENC_BIG_ENDIAN);
4643 proto_tree_add_item(sub_tree, hf_afp_ace_flags_fileinherit, tvb, offset, 4, ENC_BIG_ENDIAN);
4644 proto_tree_add_item(sub_tree, hf_afp_ace_flags_dirinherit, tvb, offset, 4, ENC_BIG_ENDIAN);
4645 proto_tree_add_item(sub_tree, hf_afp_ace_flags_limitinherit, tvb, offset, 4, ENC_BIG_ENDIAN);
4646 proto_tree_add_item(sub_tree, hf_afp_ace_flags_onlyinherit, tvb, offset, 4, ENC_BIG_ENDIAN);
4647 }
4648
4649 return bitmap;
4650 }
4651
4652 static gint
4653 decode_kauth_ace(tvbuff_t *tvb, proto_tree *tree, gint offset)
4654 {
4655 /* FIXME: preliminary decoding... */
4656 if (tree) {
4657 proto_tree_add_item(tree, hf_afp_UUID, tvb, offset, 16, ENC_BIG_ENDIAN);
4658 offset += 16;
4659
4660 decode_ace_flags_bitmap(tvb, tree, offset);
4661 offset += 4;
4662
4663 decode_acl_access_bitmap(tvb, tree, offset);
4664 offset += 4;
4665 }
4666 else {
4667 offset += 24;
4668 }
4669 return offset;
4670 }
4671
4672 #define AFP_MAX_ACL_ENTRIES 500 /* Arbitrary. */
4673 static gint
4674 decode_kauth_acl(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
4675 {
4676 int entries;
4677 int i;
4678 proto_tree *sub_tree;
4679 proto_tree *ace_tree;
4680 proto_item *item;
4681
4682 /* FIXME: preliminary decoding... */
4683 entries = tvb_get_ntohl(tvb, offset);
4684
4685 item = proto_tree_add_item(tree, hf_afp_acl_entrycount, tvb, offset, 4, ENC_BIG_ENDIAN);
4686 sub_tree = proto_item_add_subtree(item, ett_afp_ace_entries);
4687 offset += 4;
4688
4689 proto_tree_add_item(tree, hf_afp_acl_flags, tvb, offset, 4, ENC_BIG_ENDIAN);
4690 offset += 4;
4691
4692 if (entries > AFP_MAX_ACL_ENTRIES) {
4693 expert_add_info_format(pinfo, item, &ei_afp_too_many_acl_entries, "Too many ACL entries (%u). Stopping dissection.", entries);
4694 THROW(ReportedBoundsError);
4695 }
4696
4697 for (i = 0; i < entries; i++) {
4698 item = proto_tree_add_text(sub_tree, tvb, offset, 24, "ACE: %u", i);
4699 ace_tree = proto_item_add_subtree(item, ett_afp_ace_entry);
4700
4701 offset = decode_kauth_ace(tvb, ace_tree, offset);
4702 }
4703
4704 return offset;
4705 }
4706
4707 static gint
4708 decode_uuid_acl(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset, guint16 bitmap)
4709 {
4710 if ((offset & 1))
4711 PAD(1);
4712
4713 if ((bitmap & kFileSec_UUID)) {
4714 proto_tree_add_item(tree, hf_afp_UUID, tvb, offset, 16, ENC_BIG_ENDIAN);
4715 offset += 16;
4716 }
4717
4718 if ((bitmap & kFileSec_GRPUUID)) {
4719 proto_tree_add_item(tree, hf_afp_GRPUUID, tvb, offset, 16, ENC_BIG_ENDIAN);
4720 offset += 16;
4721 }
4722
4723 if ((bitmap & kFileSec_ACL)) {
4724 offset = decode_kauth_acl(tvb, pinfo, tree, offset);
4725 }
4726
4727 return offset;
4728 }
4729
4730 /* ************************** */
4731 static gint
4732 dissect_query_afp_set_acl(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
4733 {
4734 guint16 bitmap;
4735
4736 PAD(1);
4737 offset = decode_vol_did(tree, tvb, offset);
4738
4739 bitmap = decode_acl_list_bitmap(tvb, tree, offset);
4740 offset += 2;
4741
4742 offset = decode_name(tree, pinfo, tvb, offset);
4743
4744 offset = decode_uuid_acl(tvb, pinfo, tree, offset, bitmap);
4745
4746 return offset;
4747 }
4748
4749 /* ************************** */
4750 static gint
4751 dissect_query_afp_get_acl(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
4752 {
4753 PAD(1);
4754 offset = decode_vol_did(tree, tvb, offset);
4755
4756 decode_acl_list_bitmap(tvb, tree, offset);
4757 offset += 2;
4758
4759 proto_tree_add_item(tree, hf_afp_max_reply_size32, tvb, offset, 4, ENC_BIG_ENDIAN);
4760 offset += 4;
4761
4762 offset = decode_name(tree, pinfo, tvb, offset);
4763
4764 return offset;
4765 }
4766
4767 /* -------------------------- */
4768 static gint
4769 dissect_reply_afp_get_acl(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
4770 {
4771 guint16 bitmap;
4772
4773 bitmap = decode_acl_list_bitmap(tvb, tree, offset);
4774 offset += 2;
4775
4776 offset = decode_uuid_acl(tvb, pinfo, tree, offset, bitmap);
4777
4778 return offset;
4779 }
4780
4781 /* ************************** */
4782 static gint
4783 dissect_reply_afp_spotlight(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset, afp_request_val *request_val)
4784 {
4785 gint len;
4786
4787 switch (request_val->spotlight_req_command) {
4788
4789 case SPOTLIGHT_CMD_GET_VOLPATH:
4790 proto_tree_add_item(tree, hf_afp_vol_id, tvb, offset, 4, ENC_BIG_ENDIAN);
4791 offset += 4;
4792
4793 proto_tree_add_item(tree, hf_afp_spotlight_reply_reserved, tvb, offset, 4, ENC_BIG_ENDIAN);
4794 offset += 4;
4795
4796 tvb_get_stringz(wmem_packet_scope(), tvb, offset, &len);
4797 proto_tree_add_item(tree, hf_afp_spotlight_volpath_server, tvb, offset, len, ENC_UTF_8|ENC_NA);
4798 offset += len;
4799 break;
4800
4801 case SPOTLIGHT_CMD_GET_VOLID:
4802 proto_tree_add_item(tree, hf_afp_spotlight_volflags, tvb, offset, 4, ENC_BIG_ENDIAN);
4803 offset += 4;
4804 break;
4805
4806 case SPOTLIGHT_CMD_GET_THREE:
4807 proto_tree_add_item(tree, hf_afp_spotlight_returncode, tvb, offset, 4, ENC_BIG_ENDIAN);
4808 offset += 4;
4809
4810 offset = dissect_spotlight(tvb, pinfo, tree, offset);
4811 break;
4812 }
4813 return offset;
4814 }
4815
4816
4817 /* ************************** */
4818 static int
4819 dissect_afp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
4820 {
4821 struct aspinfo *aspinfo = (struct aspinfo*)data;
4822 proto_tree *afp_tree = NULL;
4823 proto_item *ti;
4824 conversation_t *conversation;
4825 gint offset = 0;
4826 afp_request_key request_key, *new_request_key;
4827 afp_request_val *request_val;
4828 guint8 afp_command;
4829 nstime_t delta_ts;
4830
4831 int len = tvb_reported_length(tvb);
4832
4833 col_set_str(pinfo->cinfo, COL_PROTOCOL, "AFP");
4834 col_clear(pinfo->cinfo, COL_INFO);
4835
4836 conversation = find_or_create_conversation(pinfo);
4837
4838 request_key.conversation = conversation->index;
4839 request_key.seq = aspinfo->seq;
4840
4841 request_val = (afp_request_val *) g_hash_table_lookup(
4842 afp_request_hash, &request_key);
4843
4844 if (!request_val && !aspinfo->reply) {
4845 afp_command = tvb_get_guint8(tvb, offset);
4846 new_request_key = wmem_new(wmem_file_scope(), afp_request_key);
4847 *new_request_key = request_key;
4848
4849 request_val = wmem_new(wmem_file_scope(), afp_request_val);
4850 request_val->command = afp_command;
4851
4852 if (afp_command == AFP_SPOTLIGHTRPC)
4853 request_val->spotlight_req_command = tvb_get_ntohl(tvb, offset + 2 + 2 + 4);
4854 else
4855 request_val->spotlight_req_command = -1;
4856
4857 request_val->frame_req = pinfo->fd->num;
4858 request_val->frame_res = 0;
4859 request_val->req_time=pinfo->fd->abs_ts;
4860
4861 g_hash_table_insert(afp_request_hash, new_request_key,
4862 request_val);
4863 }
4864
4865 if (!request_val) { /* missing request */
4866 col_set_str(pinfo->cinfo, COL_INFO, "[Reply without query?]");
4867 return tvb_length(tvb);
4868 }
4869
4870 afp_command = request_val->command;
4871 col_add_fstr(pinfo->cinfo, COL_INFO, "%s %s",
4872 val_to_str_ext(afp_command, &CommandCode_vals_ext,
4873 "Unknown command (%u)"),
4874 aspinfo->reply ? "reply" : "request");
4875 if (aspinfo->reply && aspinfo->code != 0) {
4876 col_append_fstr(pinfo->cinfo, COL_INFO, ": %s (%d)",
4877 val_to_str_ext(aspinfo->code, &asp_error_vals_ext,
4878 "Unknown error (%u)"), aspinfo->code);
4879 }
4880
4881 if (tree)
4882 {
4883 ti = proto_tree_add_item(tree, proto_afp, tvb, offset, -1, ENC_NA);
4884 afp_tree = proto_item_add_subtree(ti, ett_afp);
4885 }
4886 if (!aspinfo->reply) {
4887
4888 ti = proto_tree_add_uint(afp_tree, hf_afp_command, tvb,offset, 1, afp_command);
4889 if (afp_command != tvb_get_guint8(tvb, offset))
4890 {
4891 /* we have the same conversation for different connections eg:
4892 * ip1:2048 --> ip2:548
4893 * ip1:2048 --> ip2:548 <RST>
4894 * ....
4895 * ip1:2048 --> ip2:548 <SYN> use the same port but it's a new session!
4896 */
4897 col_set_str(pinfo->cinfo, COL_INFO,
4898 "[Error!IP port reused, you need to split the capture file]");
4899 expert_add_info(pinfo, ti, &ei_afp_ip_port_reused);
4900 return tvb_length(tvb);
4901 }
4902
4903 /*
4904 * Put in a field for the frame number of the frame to which
4905 * this is a response if we know that frame number (i.e.,
4906 * it's not 0).
4907 */
4908 if (request_val->frame_res != 0) {
4909 ti = proto_tree_add_uint(afp_tree, hf_afp_response_in,
4910 tvb, 0, 0, request_val->frame_res);
4911 PROTO_ITEM_SET_GENERATED(ti);
4912 }
4913
4914 offset++;
4915 switch(afp_command) {
4916 case AFP_BYTELOCK:
4917 offset = dissect_query_afp_byte_lock(tvb, pinfo, afp_tree, offset);
4918 break;
4919 case AFP_BYTELOCK_EXT:
4920 offset = dissect_query_afp_byte_lock_ext(tvb, pinfo, afp_tree, offset);
4921 break;
4922 case AFP_OPENDT: /* same as close vol */
4923 case AFP_FLUSH:
4924 case AFP_CLOSEVOL:
4925 offset = dissect_query_afp_with_vol_id(tvb, pinfo, afp_tree, offset);
4926 break;
4927 case AFP_CLOSEDIR:
4928 /* offset = dissect_query_afp_close_dir(tvb, pinfo, afp_tree, offset); */
4929 break;
4930 case AFP_CLOSEDT:
4931 offset = dissect_query_afp_close_dt(tvb, pinfo, afp_tree, offset);
4932 break;
4933 case AFP_FLUSHFORK: /* same packet as closefork */
4934 case AFP_SYNCFORK:
4935 case AFP_CLOSEFORK:
4936 offset = dissect_query_afp_with_fork(tvb, pinfo, afp_tree, offset);
4937 break;
4938 case AFP_COPYFILE:
4939 offset = dissect_query_afp_copy_file(tvb, pinfo, afp_tree, offset);
4940 break;
4941 case AFP_CREATEFILE:
4942 offset = dissect_query_afp_create_file(tvb, pinfo, afp_tree, offset);
4943 break;
4944 case AFP_DISCTOLDSESS:
4945 offset = dissect_query_afp_disconnect_old_session(tvb, pinfo, afp_tree, offset);
4946 break;
4947 case AFP_ENUMERATE_EXT2:
4948 offset = dissect_query_afp_enumerate_ext2(tvb, pinfo, afp_tree, offset);
4949 break;
4950 case AFP_ENUMERATE_EXT:
4951 case AFP_ENUMERATE:
4952 offset = dissect_query_afp_enumerate(tvb, pinfo, afp_tree, offset);
4953 break;
4954 case AFP_GETFORKPARAM:
4955 offset = dissect_query_afp_get_fork_param(tvb, pinfo, afp_tree, offset);
4956 break;
4957 case AFP_GETSESSTOKEN:
4958 offset = dissect_query_afp_get_session_token(tvb, pinfo, afp_tree, offset);
4959 break;
4960 case AFP_GETUSERINFO:
4961 offset = dissect_query_afp_get_user_info(tvb, pinfo, afp_tree, offset);
4962 break;
4963 case AFP_GETSRVINFO:
4964 /* offset = dissect_query_afp_get_server_info(tvb, pinfo, afp_tree, offset); */
4965 break;
4966 case AFP_GETSRVPARAM:
4967 break; /* no parameters */
4968 case AFP_GETVOLPARAM:
4969 offset = dissect_query_afp_get_vol_param(tvb, pinfo, afp_tree, offset);
4970 break;
4971 case AFP_LOGIN_EXT:
4972 offset = dissect_query_afp_login_ext(tvb, pinfo, afp_tree, offset);
4973 break;
4974 case AFP_LOGIN:
4975 offset = dissect_query_afp_login(tvb, pinfo, afp_tree, offset);
4976 break;
4977 case AFP_LOGINCONT:
4978 case AFP_LOGOUT:
4979 break;
4980 case AFP_MAPID:
4981 offset = dissect_query_afp_map_id(tvb, pinfo, afp_tree, offset);
4982 break;
4983 case AFP_MAPNAME:
4984 offset = dissect_query_afp_map_name(tvb, pinfo, afp_tree, offset);
4985 break;
4986 case AFP_MOVE:
4987 offset = dissect_query_afp_move(tvb, pinfo, afp_tree, offset);
4988 break;
4989 case AFP_OPENVOL:
4990 offset = dissect_query_afp_open_vol(tvb, pinfo, afp_tree, offset);
4991 break;
4992 case AFP_OPENDIR:
4993 break;
4994 case AFP_OPENFORK:
4995 offset = dissect_query_afp_open_fork(tvb, pinfo, afp_tree, offset);
4996 break;
4997 case AFP_READ:
4998 offset = dissect_query_afp_read(tvb, pinfo, afp_tree, offset);
4999 break;
5000 case AFP_READ_EXT:
5001 offset = dissect_query_afp_read_ext(tvb, pinfo, afp_tree, offset);
5002 break;
5003 case AFP_RENAME:
5004 offset = dissect_query_afp_rename(tvb, pinfo, afp_tree, offset);
5005 break;
5006 case AFP_SETDIRPARAM:
5007 offset = dissect_query_afp_set_dir_param(tvb, pinfo, afp_tree, offset);
5008 break;
5009 case AFP_SETFILEPARAM:
5010 offset = dissect_query_afp_set_file_param(tvb, pinfo, afp_tree, offset);
5011 break;
5012 case AFP_SETFORKPARAM:
5013 offset = dissect_query_afp_set_fork_param(tvb, pinfo, afp_tree, offset);
5014 break;
5015 case AFP_SETVOLPARAM:
5016 offset = dissect_query_afp_set_vol_param(tvb, pinfo, afp_tree, offset);
5017 break;
5018 case AFP_WRITE:
5019 offset = dissect_query_afp_write(tvb, pinfo, afp_tree, offset);
5020 break;
5021 case AFP_WRITE_EXT:
5022 offset = dissect_query_afp_write_ext(tvb, pinfo, afp_tree, offset);
5023 break;
5024 case AFP_GETFLDRPARAM:
5025 offset = dissect_query_afp_get_fldr_param(tvb, pinfo, afp_tree, offset);
5026 break;
5027 case AFP_SETFLDRPARAM:
5028 offset = dissect_query_afp_set_fldr_param(tvb, pinfo, afp_tree, offset);
5029 break;
5030 case AFP_CHANGEPW:
5031 break;
5032 case AFP_GETSRVRMSG:
5033 offset = dissect_query_afp_get_server_message(tvb, pinfo, afp_tree, offset);
5034 break;
5035 case AFP_DELETE: /* same as create_id */
5036 case AFP_CREATEDIR:
5037 case AFP_CREATEID:
5038 offset = dissect_query_afp_create_id(tvb, pinfo, afp_tree, offset);
5039 break;
5040 case AFP_DELETEID:
5041 offset = dissect_query_afp_delete_id(tvb, pinfo, afp_tree, offset);
5042 break;
5043 case AFP_RESOLVEID:
5044 offset = dissect_query_afp_resolve_id(tvb, pinfo, afp_tree, offset);
5045 break;
5046 case AFP_EXCHANGEFILE:
5047 offset = dissect_query_afp_exchange_file(tvb, pinfo, afp_tree, offset);
5048 break;
5049 case AFP_CATSEARCH_EXT:
5050 offset = dissect_query_afp_cat_search_ext(tvb, pinfo, afp_tree, offset);
5051 break;
5052 case AFP_CATSEARCH:
5053 offset = dissect_query_afp_cat_search(tvb, pinfo, afp_tree, offset);
5054 break;
5055 case AFP_GETICON:
5056 offset = dissect_query_afp_get_icon(tvb, pinfo, afp_tree, offset);
5057 break;
5058 case AFP_GTICNINFO:
5059 offset = dissect_query_afp_get_icon_info(tvb, pinfo, afp_tree, offset);
5060 break;
5061 case AFP_ADDAPPL:
5062 offset = dissect_query_afp_add_appl(tvb, pinfo, afp_tree, offset);
5063 break;
5064 case AFP_RMVAPPL:
5065 offset = dissect_query_afp_rmv_appl(tvb, pinfo, afp_tree, offset);
5066 break;
5067 case AFP_GETAPPL:
5068 offset = dissect_query_afp_get_appl(tvb, pinfo, afp_tree, offset);
5069 break;
5070 case AFP_ADDCMT:
5071 offset = dissect_query_afp_add_cmt(tvb, pinfo, afp_tree, offset);
5072 break;
5073 case AFP_RMVCMT: /* same as get_cmt */
5074 case AFP_GETCMT:
5075 offset = dissect_query_afp_get_cmt(tvb, pinfo, afp_tree, offset);
5076 break;
5077 case AFP_ADDICON:
5078 offset = dissect_query_afp_add_icon(tvb, pinfo, afp_tree, offset);
5079 break;
5080 case AFP_GETEXTATTR:
5081 offset = dissect_query_afp_get_ext_attr(tvb, pinfo, afp_tree, offset);
5082 break;
5083 case AFP_SETEXTATTR:
5084 offset = dissect_query_afp_set_ext_attr(tvb, pinfo, afp_tree, offset);
5085 break;
5086 case AFP_LISTEXTATTR:
5087 offset = dissect_query_afp_list_ext_attrs(tvb, pinfo, afp_tree, offset);
5088 break;
5089 case AFP_REMOVEATTR:
5090 offset = dissect_query_afp_remove_ext_attr(tvb, pinfo, afp_tree, offset);
5091 break;
5092 case AFP_GETACL:
5093 offset = dissect_query_afp_get_acl(tvb, pinfo, afp_tree, offset);
5094 break;
5095 case AFP_SETACL:
5096 offset = dissect_query_afp_set_acl(tvb, pinfo, afp_tree, offset);
5097 break;
5098 case AFP_ACCESS:
5099 offset = dissect_query_afp_access(tvb, pinfo, afp_tree, offset);
5100 break;
5101 case AFP_SYNCDIR:
5102 offset = dissect_query_afp_with_did(tvb, pinfo, afp_tree, offset);
5103 break;
5104 case AFP_SPOTLIGHTRPC:
5105 offset = dissect_query_afp_spotlight(tvb, pinfo, afp_tree, offset, request_val);
5106 if (offset == -1)
5107 return tvb_length(tvb); /* bogus spotlight RPC */
5108 break;
5109 }
5110 }
5111 else {
5112 proto_tree_add_uint(afp_tree, hf_afp_command, tvb, 0, 0, afp_command);
5113
5114 /*
5115 * Put in fields for the frame with the response to this
5116 * frame - if we know the frame number (i.e., it's not 0).
5117 */
5118 if (request_val->frame_req != 0) {
5119 ti = proto_tree_add_uint(afp_tree, hf_afp_response_to,
5120 tvb, 0, 0, request_val->frame_req);
5121 PROTO_ITEM_SET_GENERATED(ti);
5122 nstime_delta(&delta_ts, &pinfo->fd->abs_ts, &request_val->req_time);
5123 ti = proto_tree_add_time(afp_tree, hf_afp_time, tvb,
5124 0, 0, &delta_ts);
5125 PROTO_ITEM_SET_GENERATED(ti);
5126 }
5127
5128 /*
5129 * Set "frame_res" if it's not already known.
5130 */
5131 if (request_val->frame_res == 0)
5132 request_val->frame_res = pinfo->fd->num;
5133
5134 /*
5135 * Tap the packet before the dissectors are called so we
5136 * still get the tap listener called even if there is an
5137 * exception.
5138 */
5139 tap_queue_packet(afp_tap, pinfo, request_val);
5140
5141 if (!len) {
5142 /* for some calls if the reply is an error there's no data
5143 */
5144 return tvb_length(tvb);
5145 }
5146
5147 switch(afp_command) {
5148 case AFP_BYTELOCK:
5149 offset = dissect_reply_afp_byte_lock(tvb, pinfo, afp_tree, offset);
5150 break;
5151 case AFP_BYTELOCK_EXT:
5152 offset = dissect_reply_afp_byte_lock_ext(tvb, pinfo, afp_tree, offset);
5153 break;
5154 case AFP_ENUMERATE_EXT2:
5155 case AFP_ENUMERATE_EXT:
5156 offset = dissect_reply_afp_enumerate_ext(tvb, pinfo, afp_tree, offset);
5157 break;
5158 case AFP_ENUMERATE:
5159 offset = dissect_reply_afp_enumerate(tvb, pinfo, afp_tree, offset);
5160 break;
5161 case AFP_OPENVOL:
5162 offset = dissect_reply_afp_open_vol(tvb, pinfo, afp_tree, offset);
5163 break;
5164 case AFP_OPENFORK:
5165 offset = dissect_reply_afp_open_fork(tvb, pinfo, afp_tree, offset);
5166 break;
5167 case AFP_RESOLVEID:
5168 case AFP_GETFORKPARAM:
5169 offset = dissect_reply_afp_get_fork_param(tvb, pinfo, afp_tree, offset);
5170 break;
5171 case AFP_GETUSERINFO:
5172 offset = dissect_reply_afp_get_user_info(tvb, pinfo, afp_tree, offset);
5173 break;
5174 case AFP_GETSRVPARAM:
5175 offset = dissect_reply_afp_get_server_param(tvb, pinfo, afp_tree, offset);
5176 break;
5177 case AFP_GETSRVRMSG:
5178 offset = dissect_reply_afp_get_server_message(tvb, pinfo, afp_tree, offset);
5179 break;
5180 case AFP_CREATEDIR:
5181 offset = dissect_reply_afp_create_dir(tvb, pinfo, afp_tree, offset);
5182 break;
5183 case AFP_MAPID:
5184 offset = dissect_reply_afp_map_id(tvb, pinfo, afp_tree, offset);
5185 break;
5186 case AFP_MAPNAME:
5187 offset = dissect_reply_afp_map_name(tvb, pinfo, afp_tree, offset);
5188 break;
5189 case AFP_MOVE: /* same as create_id */
5190 case AFP_CREATEID:
5191 offset = dissect_reply_afp_create_id(tvb, pinfo, afp_tree, offset);
5192 break;
5193 case AFP_GETSESSTOKEN:
5194 offset = dissect_reply_afp_get_session_token(tvb, pinfo, afp_tree, offset);
5195 break;
5196 case AFP_GETVOLPARAM:
5197 offset = dissect_reply_afp_get_vol_param(tvb, pinfo, afp_tree, offset);
5198 break;
5199 case AFP_GETFLDRPARAM:
5200 offset = dissect_reply_afp_get_fldr_param(tvb, pinfo, afp_tree, offset);
5201 break;
5202 case AFP_OPENDT:
5203 offset = dissect_reply_afp_open_dt(tvb, pinfo, afp_tree, offset);
5204 break;
5205 case AFP_CATSEARCH_EXT:
5206 offset = dissect_reply_afp_cat_search_ext(tvb, pinfo, afp_tree, offset);
5207 break;
5208 case AFP_CATSEARCH:
5209 offset = dissect_reply_afp_cat_search(tvb, pinfo, afp_tree, offset);
5210 break;
5211 case AFP_GTICNINFO:
5212 offset = dissect_reply_afp_get_icon_info(tvb, pinfo, afp_tree, offset);
5213 break;
5214 case AFP_GETAPPL:
5215 offset = dissect_reply_afp_get_appl(tvb, pinfo, afp_tree, offset);
5216 break;
5217 case AFP_GETCMT:
5218 offset = dissect_reply_afp_get_cmt(tvb, pinfo, afp_tree, offset);
5219 break;
5220 case AFP_WRITE:
5221 offset = dissect_reply_afp_write(tvb, pinfo, afp_tree, offset);
5222 break;
5223 case AFP_WRITE_EXT:
5224 offset = dissect_reply_afp_write_ext(tvb, pinfo, afp_tree, offset);
5225 break;
5226 case AFP_GETEXTATTR:
5227 offset = dissect_reply_afp_get_ext_attr(tvb, pinfo, afp_tree, offset);
5228 break;
5229 case AFP_LISTEXTATTR:
5230 offset = dissect_reply_afp_list_ext_attrs(tvb, pinfo, afp_tree, offset);
5231 break;
5232 case AFP_GETACL:
5233 offset = dissect_reply_afp_get_acl(tvb, pinfo, afp_tree, offset);
5234 break;
5235 case AFP_SPOTLIGHTRPC:
5236 offset = dissect_reply_afp_spotlight(tvb, pinfo, afp_tree, offset, request_val);
5237 if (offset == -1)
5238 return tvb_length(tvb); /* bogus */
5239 break;
5240 }
5241 }
5242 if (offset < len) {
5243 call_dissector(data_handle, tvb_new_subset_remaining(tvb, offset),
5244 pinfo, afp_tree);
5245 }
5246
5247 return tvb_length(tvb);
5248 }
5249
5250 static void afp_reinit( void)
5251 {
5252
5253 if (afp_request_hash)
5254 g_hash_table_destroy(afp_request_hash);
5255
5256 afp_request_hash = g_hash_table_new(afp_hash, afp_equal);
5257
5258 }
5259
5260 void
5261 proto_register_afp(void)
5262 {
5263
5264 static hf_register_info hf[] = {
5265 { &hf_afp_command,
5266 { "Command", "afp.command",
5267 FT_UINT8, BASE_DEC|BASE_EXT_STRING, &CommandCode_vals_ext, 0x0,
5268 "AFP function", HFILL }},
5269
5270 { &hf_afp_pad,
5271 { "Pad", "afp.pad",
5272 FT_NONE, BASE_NONE, NULL, 0,
5273 "Pad Byte", HFILL }},
5274
5275 { &hf_afp_Version,
5276 { "AFP Version", "afp.Version",
5277 FT_UINT_STRING, BASE_NONE, NULL, 0x0,
5278 "Client AFP version", HFILL }},
5279
5280 { &hf_afp_UAM,
5281 { "UAM", "afp.UAM",
5282 FT_UINT_STRING, BASE_NONE, NULL, 0x0,
5283 "User Authentication Method", HFILL }},
5284
5285 { &hf_afp_user,
5286 { "User", "afp.user",
5287 FT_UINT_STRING, BASE_NONE, NULL, 0x0,
5288 NULL, HFILL }},
5289
5290 { &hf_afp_user_type,
5291 { "Type", "afp.user_type",
5292 FT_UINT8, BASE_HEX, VALS(path_type_vals), 0,
5293 "Type of user name", HFILL }},
5294 { &hf_afp_user_len,
5295 { "Len", "afp.user_len",
5296 FT_UINT16, BASE_DEC, NULL, 0x0,
5297 "User name length (unicode)", HFILL }},
5298 { &hf_afp_user_name,
5299 { "User", "afp.user_name",
5300 FT_STRING, BASE_NONE, NULL, 0x0,
5301 "User name (unicode)", HFILL }},
5302
5303 { &hf_afp_passwd,
5304 { "Password", "afp.passwd",
5305 FT_STRINGZ, BASE_NONE, NULL, 0x0,
5306 NULL, HFILL }},
5307
5308 { &hf_afp_random,
5309 { "Random number", "afp.random",
5310 FT_BYTES, BASE_NONE, NULL, 0x0,
5311 "UAM random number", HFILL }},
5312
5313 { &hf_afp_response_to,
5314 { "Response to", "afp.response_to",
5315 FT_FRAMENUM, BASE_NONE, NULL, 0x0,
5316 "This packet is a response to the packet in this frame", HFILL }},
5317
5318 { &hf_afp_time,
5319 { "Time from request", "afp.time",
5320 FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
5321 "Time between Request and Response for AFP cmds", HFILL }},
5322
5323 { &hf_afp_response_in,
5324 { "Response in", "afp.response_in",
5325 FT_FRAMENUM, BASE_NONE, NULL, 0x0,
5326 "The response to this packet is in this packet", HFILL }},
5327
5328 { &hf_afp_login_flags,
5329 { "Flags", "afp.login_flags",
5330 FT_UINT16, BASE_HEX, NULL, 0 /* 0x0FFF*/,
5331 "Login flags", HFILL }},
5332
5333 { &hf_afp_vol_bitmap,
5334 { "Bitmap", "afp.vol_bitmap",
5335 FT_UINT16, BASE_HEX, NULL, 0 /* 0x0FFF*/,
5336 "Volume bitmap", HFILL }},
5337
5338 { &hf_afp_vol_bitmap_Attributes,
5339 { "Attributes", "afp.vol_bitmap.attributes",
5340 FT_BOOLEAN, 16, NULL, kFPVolAttributeBit,
5341 "Volume attributes", HFILL }},
5342
5343 { &hf_afp_vol_attribute,
5344 { "Attributes", "afp.vol_attributes",
5345 FT_UINT16, BASE_HEX, NULL, 0,
5346 "Volume attributes", HFILL }},
5347
5348 { &hf_afp_vol_attribute_ReadOnly,
5349 { "Read only", "afp.vol_attribute.read_only",
5350 FT_BOOLEAN, 16, NULL, kReadOnly,
5351 "Read only volume", HFILL }},
5352
5353 { &hf_afp_vol_attribute_HasVolumePassword,
5354 { "Volume password", "afp.vol_attribute.passwd",
5355 FT_BOOLEAN, 16, NULL, kHasVolumePassword,
5356 "Has a volume password", HFILL }},
5357
5358 { &hf_afp_vol_attribute_SupportsFileIDs,
5359 { "File IDs", "afp.vol_attribute.fileIDs",
5360 FT_BOOLEAN, 16, NULL, kSupportsFileIDs,
5361 "Supports file IDs", HFILL }},
5362
5363 { &hf_afp_vol_attribute_SupportsCatSearch,
5364 { "Catalog search", "afp.vol_attribute.cat_search",
5365 FT_BOOLEAN, 16, NULL, kSupportsCatSearch,
5366 "Supports catalog search operations", HFILL }},
5367
5368 { &hf_afp_vol_attribute_SupportsBlankAccessPrivs,
5369 { "Blank access privileges", "afp.vol_attribute.blank_access_privs",
5370 FT_BOOLEAN, 16, NULL, kSupportsBlankAccessPrivs,
5371 "Supports blank access privileges", HFILL }},
5372
5373 { &hf_afp_vol_attribute_SupportsUnixPrivs,
5374 { "UNIX access privileges", "afp.vol_attribute.unix_privs",
5375 FT_BOOLEAN, 16, NULL, kSupportsUnixPrivs,
5376 "Supports UNIX access privileges", HFILL }},
5377
5378 { &hf_afp_vol_attribute_SupportsUTF8Names,
5379 { "UTF-8 names", "afp.vol_attribute.utf8_names",
5380 FT_BOOLEAN, 16, NULL, kSupportsUTF8Names,
5381 "Supports UTF-8 names", HFILL }},
5382
5383 { &hf_afp_vol_attribute_NoNetworkUserID,
5384 { "No Network User ID", "afp.vol_attribute.network_user_id",
5385 FT_BOOLEAN, 16, NULL, kNoNetworkUserIDs,
5386 NULL, HFILL }},
5387
5388 { &hf_afp_vol_attribute_DefaultPrivsFromParent,
5389 { "Inherit parent privileges", "afp.vol_attribute.inherit_parent_privs",
5390 FT_BOOLEAN, 16, NULL, kDefaultPrivsFromParent,
5391 NULL, HFILL }},
5392
5393 { &hf_afp_vol_attribute_NoExchangeFiles,
5394 { "No exchange files", "afp.vol_attribute.no_exchange_files",
5395 FT_BOOLEAN, 16, NULL, kNoExchangeFiles,
5396 "Exchange files not supported", HFILL }},
5397
5398 { &hf_afp_vol_attribute_SupportsExtAttrs,
5399 { "Extended Attributes", "afp.vol_attribute.extended_attributes",
5400 FT_BOOLEAN, 16, NULL, kSupportsExtAttrs,
5401 "Supports Extended Attributes", HFILL }},
5402
5403 { &hf_afp_vol_attribute_SupportsACLs,
5404 { "ACLs", "afp.vol_attribute.acls",
5405 FT_BOOLEAN, 16, NULL, kSupportsACLs,
5406 "Supports access control lists", HFILL }},
5407
5408 { &hf_afp_vol_attribute_CaseSensitive,
5409 { "Case sensitive", "afp.vol_attribute.case_sensitive",
5410 FT_BOOLEAN, 16, NULL, kCaseSensitive,
5411 "Supports case-sensitive filenames", HFILL }},
5412
5413 { &hf_afp_vol_attribute_SupportsTMLockSteal,
5414 { "TM lock steal", "afp.vol_attribute.TM_lock_steal",
5415 FT_BOOLEAN, 16, NULL, kSupportsTMLockSteal,
5416 "Supports Time Machine lock stealing", HFILL }},
5417
5418 { &hf_afp_vol_bitmap_Signature,
5419 { "Signature", "afp.vol_bitmap.signature",
5420 FT_BOOLEAN, 16, NULL, kFPVolSignatureBit,
5421 "Volume signature", HFILL }},
5422
5423 { &hf_afp_vol_bitmap_CreateDate,
5424 { "Creation date", "afp.vol_bitmap.create_date",
5425 FT_BOOLEAN, 16, NULL, kFPVolCreateDateBit,
5426 "Volume creation date", HFILL }},
5427
5428 { &hf_afp_vol_bitmap_ModDate,
5429 { "Modification date", "afp.vol_bitmap.mod_date",
5430 FT_BOOLEAN, 16, NULL, kFPVolModDateBit,
5431 "Volume modification date", HFILL }},
5432
5433 { &hf_afp_vol_bitmap_BackupDate,
5434 { "Backup date", "afp.vol_bitmap.backup_date",
5435 FT_BOOLEAN, 16, NULL, kFPVolBackupDateBit,
5436 "Volume backup date", HFILL }},
5437
5438 { &hf_afp_vol_bitmap_ID,
5439 { "ID", "afp.vol_bitmap.id",
5440 FT_BOOLEAN, 16, NULL, kFPVolIDBit,
5441 "Volume ID", HFILL }},
5442
5443 { &hf_afp_vol_bitmap_BytesFree,
5444 { "Bytes free", "afp.vol_bitmap.bytes_free",
5445 FT_BOOLEAN, 16, NULL, kFPVolBytesFreeBit,
5446 "Volume free bytes", HFILL }},
5447
5448 { &hf_afp_vol_bitmap_BytesTotal,
5449 { "Bytes total", "afp.vol_bitmap.bytes_total",
5450 FT_BOOLEAN, 16, NULL, kFPVolBytesTotalBit,
5451 "Volume total bytes", HFILL }},
5452
5453 { &hf_afp_vol_bitmap_Name,
5454 { "Name", "afp.vol_bitmap.name",
5455 FT_BOOLEAN, 16, NULL, kFPVolNameBit,
5456 "Volume name", HFILL }},
5457
5458 { &hf_afp_vol_bitmap_ExtBytesFree,
5459 { "Extended bytes free", "afp.vol_bitmap.ex_bytes_free",
5460 FT_BOOLEAN, 16, NULL, kFPVolExtBytesFreeBit,
5461 "Volume extended (>2GB) free bytes", HFILL }},
5462
5463 { &hf_afp_vol_bitmap_ExtBytesTotal,
5464 { "Extended bytes total", "afp.vol_bitmap.ex_bytes_total",
5465 FT_BOOLEAN, 16, NULL, kFPVolExtBytesTotalBit,
5466 "Volume extended (>2GB) total bytes", HFILL }},
5467
5468 { &hf_afp_vol_bitmap_BlockSize,
5469 { "Block size", "afp.vol_bitmap.block_size",
5470 FT_BOOLEAN, 16, NULL, kFPVolBlockSizeBit,
5471 "Volume block size", HFILL }},
5472
5473 { &hf_afp_dir_bitmap_Attributes,
5474 { "Attributes", "afp.dir_bitmap.attributes",
5475 FT_BOOLEAN, 16, NULL, kFPAttributeBit,
5476 "Return attributes if directory", HFILL }},
5477
5478 { &hf_afp_dir_bitmap_ParentDirID,
5479 { "DID", "afp.dir_bitmap.did",
5480 FT_BOOLEAN, 16, NULL, kFPParentDirIDBit,
5481 "Return parent directory ID if directory", HFILL }},
5482
5483 { &hf_afp_dir_bitmap_CreateDate,
5484 { "Creation date", "afp.dir_bitmap.create_date",
5485 FT_BOOLEAN, 16, NULL, kFPCreateDateBit,
5486 "Return creation date if directory", HFILL }},
5487
5488 { &hf_afp_dir_bitmap_ModDate,
5489 { "Modification date", "afp.dir_bitmap.mod_date",
5490 FT_BOOLEAN, 16, NULL, kFPModDateBit,
5491 "Return modification date if directory", HFILL }},
5492
5493 { &hf_afp_dir_bitmap_BackupDate,
5494 { "Backup date", "afp.dir_bitmap.backup_date",
5495 FT_BOOLEAN, 16, NULL, kFPBackupDateBit,
5496 "Return backup date if directory", HFILL }},
5497
5498 { &hf_afp_dir_bitmap_FinderInfo,
5499 { "Finder info", "afp.dir_bitmap.finder_info",
5500 FT_BOOLEAN, 16, NULL, kFPFinderInfoBit,
5501 "Return finder info if directory", HFILL }},
5502
5503 { &hf_afp_dir_bitmap_LongName,
5504 { "Long name", "afp.dir_bitmap.long_name",
5505 FT_BOOLEAN, 16, NULL, kFPLongNameBit,
5506 "Return long name if directory", HFILL }},
5507
5508 { &hf_afp_dir_bitmap_ShortName,
5509 { "Short name", "afp.dir_bitmap.short_name",
5510 FT_BOOLEAN, 16, NULL, kFPShortNameBit,
5511 "Return short name if directory", HFILL }},
5512
5513 { &hf_afp_dir_bitmap_NodeID,
5514 { "File ID", "afp.dir_bitmap.fid",
5515 FT_BOOLEAN, 16, NULL, kFPNodeIDBit,
5516 "Return file ID if directory", HFILL }},
5517
5518 { &hf_afp_dir_bitmap_OffspringCount,
5519 { "Offspring count", "afp.dir_bitmap.offspring_count",
5520 FT_BOOLEAN, 16, NULL, kFPOffspringCountBit,
5521 "Return offspring count if directory", HFILL }},
5522
5523 { &hf_afp_dir_bitmap_OwnerID,
5524 { "Owner id", "afp.dir_bitmap.owner_id",
5525 FT_BOOLEAN, 16, NULL, kFPOwnerIDBit,
5526 "Return owner id if directory", HFILL }},
5527
5528 { &hf_afp_dir_bitmap_GroupID,
5529 { "Group id", "afp.dir_bitmap.group_id",
5530 FT_BOOLEAN, 16, NULL, kFPGroupIDBit,
5531 "Return group id if directory", HFILL }},
5532
5533 { &hf_afp_dir_bitmap_AccessRights,
5534 { "Access rights", "afp.dir_bitmap.access_rights",
5535 FT_BOOLEAN, 16, NULL, kFPAccessRightsBit,
5536 "Return access rights if directory", HFILL }},
5537
5538 { &hf_afp_dir_bitmap_UTF8Name,
5539 { "UTF-8 name", "afp.dir_bitmap.UTF8_name",
5540 FT_BOOLEAN, 16, NULL, kFPUTF8NameBit,
5541 "Return UTF-8 name if directory", HFILL }},
5542
5543 { &hf_afp_dir_bitmap_UnixPrivs,
5544 { "UNIX privileges", "afp.dir_bitmap.unix_privs",
5545 FT_BOOLEAN, 16, NULL, kFPUnixPrivsBit,
5546 "Return UNIX privileges if directory", HFILL }},
5547
5548 { &hf_afp_dir_attribute_Invisible,
5549 { "Invisible", "afp.dir_attribute.invisible",
5550 FT_BOOLEAN, 16, NULL, kFPInvisibleBit,
5551 "Directory is not visible", HFILL }},
5552
5553 { &hf_afp_dir_attribute_IsExpFolder,
5554 { "Share point", "afp.dir_attribute.share",
5555 FT_BOOLEAN, 16, NULL, kFPMultiUserBit,
5556 "Directory is a share point", HFILL }},
5557
5558 { &hf_afp_dir_attribute_System,
5559 { "System", "afp.dir_attribute.system",
5560 FT_BOOLEAN, 16, NULL, kFPSystemBit,
5561 "Directory is a system directory", HFILL }},
5562
5563 { &hf_afp_dir_attribute_Mounted,
5564 { "Mounted", "afp.dir_attribute.mounted",
5565 FT_BOOLEAN, 16, NULL, kFPDAlreadyOpenBit,
5566 "Directory is mounted", HFILL }},
5567
5568 { &hf_afp_dir_attribute_InExpFolder,
5569 { "Shared area", "afp.dir_attribute.in_exported_folder",
5570 FT_BOOLEAN, 16, NULL, kFPRAlreadyOpenBit,
5571 "Directory is in a shared area", HFILL }},
5572
5573 { &hf_afp_dir_attribute_BackUpNeeded,
5574 { "Backup needed", "afp.dir_attribute.backup_needed",
5575 FT_BOOLEAN, 16, NULL, kFPBackUpNeededBit,
5576 "Directory needs to be backed up", HFILL }},
5577
5578 { &hf_afp_dir_attribute_RenameInhibit,
5579 { "Rename inhibit", "afp.dir_attribute.rename_inhibit",
5580 FT_BOOLEAN, 16, NULL, kFPRenameInhibitBit,
5581 NULL, HFILL }},
5582
5583 { &hf_afp_dir_attribute_DeleteInhibit,
5584 { "Delete inhibit", "afp.dir_attribute.delete_inhibit",
5585 FT_BOOLEAN, 16, NULL, kFPDeleteInhibitBit,
5586 NULL, HFILL }},
5587
5588 { &hf_afp_file_bitmap_Attributes,
5589 { "Attributes", "afp.file_bitmap.attributes",
5590 FT_BOOLEAN, 16, NULL, kFPAttributeBit,
5591 "Return attributes if file", HFILL }},
5592
5593 { &hf_afp_file_bitmap_ParentDirID,
5594 { "DID", "afp.file_bitmap.did",
5595 FT_BOOLEAN, 16, NULL, kFPParentDirIDBit,
5596 "Return parent directory ID if file", HFILL }},
5597
5598 { &hf_afp_file_bitmap_CreateDate,
5599 { "Creation date", "afp.file_bitmap.create_date",
5600 FT_BOOLEAN, 16, NULL, kFPCreateDateBit,
5601 "Return creation date if file", HFILL }},
5602
5603 { &hf_afp_file_bitmap_ModDate,
5604 { "Modification date", "afp.file_bitmap.mod_date",
5605 FT_BOOLEAN, 16, NULL, kFPModDateBit,
5606 "Return modification date if file", HFILL }},
5607
5608 { &hf_afp_file_bitmap_BackupDate,
5609 { "Backup date", "afp.file_bitmap.backup_date",
5610 FT_BOOLEAN, 16, NULL, kFPBackupDateBit,
5611 "Return backup date if file", HFILL }},
5612
5613 { &hf_afp_file_bitmap_FinderInfo,
5614 { "Finder info", "afp.file_bitmap.finder_info",
5615 FT_BOOLEAN, 16, NULL, kFPFinderInfoBit,
5616 "Return finder info if file", HFILL }},
5617
5618 { &hf_afp_file_bitmap_LongName,
5619 { "Long name", "afp.file_bitmap.long_name",
5620 FT_BOOLEAN, 16, NULL, kFPLongNameBit,
5621 "Return long name if file", HFILL }},
5622
5623 { &hf_afp_file_bitmap_ShortName,
5624 { "Short name", "afp.file_bitmap.short_name",
5625 FT_BOOLEAN, 16, NULL, kFPShortNameBit,
5626 "Return short name if file", HFILL }},
5627
5628 { &hf_afp_file_bitmap_NodeID,
5629 { "File ID", "afp.file_bitmap.fid",
5630 FT_BOOLEAN, 16, NULL, kFPNodeIDBit,
5631 "Return file ID if file", HFILL }},
5632
5633 { &hf_afp_file_bitmap_DataForkLen,
5634 { "Data fork size", "afp.file_bitmap.data_fork_len",
5635 FT_BOOLEAN, 16, NULL, kFPDataForkLenBit,
5636 "Return data fork size if file", HFILL }},
5637
5638 { &hf_afp_file_bitmap_RsrcForkLen,
5639 { "Resource fork size", "afp.file_bitmap.resource_fork_len",
5640 FT_BOOLEAN, 16, NULL, kFPRsrcForkLenBit,
5641 "Return resource fork size if file", HFILL }},
5642
5643 { &hf_afp_file_bitmap_ExtDataForkLen,
5644 { "Extended data fork size", "afp.file_bitmap.ex_data_fork_len",
5645 FT_BOOLEAN, 16, NULL, kFPExtDataForkLenBit,
5646 "Return extended (>2GB) data fork size if file", HFILL }},
5647
5648 { &hf_afp_file_bitmap_LaunchLimit,
5649 { "Launch limit", "afp.file_bitmap.launch_limit",
5650 FT_BOOLEAN, 16, NULL, kFPLaunchLimitBit,
5651 "Return launch limit if file", HFILL }},
5652
5653 { &hf_afp_file_bitmap_UTF8Name,
5654 { "UTF-8 name", "afp.file_bitmap.UTF8_name",
5655 FT_BOOLEAN, 16, NULL, kFPUTF8NameBit,
5656 "Return UTF-8 name if file", HFILL }},
5657
5658 { &hf_afp_file_bitmap_ExtRsrcForkLen,
5659 { "Extended resource fork size", "afp.file_bitmap.ex_resource_fork_len",
5660 FT_BOOLEAN, 16, NULL, kFPExtRsrcForkLenBit,
5661 "Return extended (>2GB) resource fork size if file", HFILL }},
5662
5663 { &hf_afp_file_bitmap_UnixPrivs,
5664 { "UNIX privileges", "afp.file_bitmap.unix_privs",
5665 FT_BOOLEAN, 16, NULL, kFPUnixPrivsBit,
5666 "Return UNIX privileges if file", HFILL }},
5667
5668 /* ---------- */
5669 { &hf_afp_file_attribute_Invisible,
5670 { "Invisible", "afp.file_attribute.invisible",
5671 FT_BOOLEAN, 16, NULL, kFPInvisibleBit,
5672 "File is not visible", HFILL }},
5673
5674 { &hf_afp_file_attribute_MultiUser,
5675 { "Multi user", "afp.file_attribute.multi_user",
5676 FT_BOOLEAN, 16, NULL, kFPMultiUserBit,
5677 NULL, HFILL }},
5678
5679 { &hf_afp_file_attribute_System,
5680 { "System", "afp.file_attribute.system",
5681 FT_BOOLEAN, 16, NULL, kFPSystemBit,
5682 "File is a system file", HFILL }},
5683
5684 { &hf_afp_file_attribute_DAlreadyOpen,
5685 { "Data fork open", "afp.file_attribute.df_open",
5686 FT_BOOLEAN, 16, NULL, kFPDAlreadyOpenBit,
5687 "Data fork already open", HFILL }},
5688
5689 { &hf_afp_file_attribute_RAlreadyOpen,
5690 { "Resource fork open", "afp.file_attribute.rf_open",
5691 FT_BOOLEAN, 16, NULL, kFPRAlreadyOpenBit,
5692 "Resource fork already open", HFILL }},
5693
5694 { &hf_afp_file_attribute_WriteInhibit,
5695 { "Write inhibit", "afp.file_attribute.write_inhibit",
5696 FT_BOOLEAN, 16, NULL, kFPWriteInhibitBit,
5697 NULL, HFILL }},
5698
5699 { &hf_afp_file_attribute_BackUpNeeded,
5700 { "Backup needed", "afp.file_attribute.backup_needed",
5701 FT_BOOLEAN, 16, NULL, kFPBackUpNeededBit,
5702 "File needs to be backed up", HFILL }},
5703
5704 { &hf_afp_file_attribute_RenameInhibit,
5705 { "Rename inhibit", "afp.file_attribute.rename_inhibit",
5706 FT_BOOLEAN, 16, NULL, kFPRenameInhibitBit,
5707 NULL, HFILL }},
5708
5709 { &hf_afp_file_attribute_DeleteInhibit,
5710 { "Delete inhibit", "afp.file_attribute.delete_inhibit",
5711 FT_BOOLEAN, 16, NULL, kFPDeleteInhibitBit,
5712 NULL, HFILL }},
5713
5714 { &hf_afp_file_attribute_CopyProtect,
5715 { "Copy protect", "afp.file_attribute.copy_protect",
5716 FT_BOOLEAN, 16, NULL, kFPCopyProtectBit,
5717 NULL, HFILL }},
5718
5719 { &hf_afp_file_attribute_SetClear,
5720 { "Set", "afp.file_attribute.set_clear",
5721 FT_BOOLEAN, 16, NULL, kFPSetClearBit,
5722 "Clear/set attribute", HFILL }},
5723 /* ---------- */
5724
5725 { &hf_afp_vol_name,
5726 { "Volume", "afp.vol_name",
5727 FT_UINT_STRING, BASE_NONE, NULL, 0x0,
5728 "Volume name", HFILL }},
5729
5730 { &hf_afp_vol_flag_passwd,
5731 { "Password", "afp.vol_flag_passwd",
5732 FT_BOOLEAN, 8, NULL, 128,
5733 "Volume is password-protected", HFILL }},
5734
5735 { &hf_afp_vol_flag_has_config,
5736 { "Has config", "afp.vol_flag_has_config",
5737 FT_BOOLEAN, 8, NULL, 1,
5738 "Volume has Apple II config info", HFILL }},
5739
5740 { &hf_afp_vol_id,
5741 { "Volume id", "afp.vol_id",
5742 FT_UINT16, BASE_DEC, NULL, 0x0,
5743 NULL, HFILL }},
5744
5745 { &hf_afp_vol_signature,
5746 { "Signature", "afp.vol_signature",
5747 FT_UINT16, BASE_DEC, VALS(vol_signature_vals), 0x0,
5748 "Volume signature", HFILL }},
5749
5750 { &hf_afp_vol_name_offset,
5751 { "Volume name offset","afp.vol_name_offset",
5752 FT_UINT16, BASE_DEC, NULL, 0x0,
5753 "Volume name offset in packet", HFILL }},
5754
5755 { &hf_afp_vol_creation_date,
5756 { "Creation date", "afp.vol_creation_date",
5757 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
5758 "Volume creation date", HFILL }},
5759
5760 { &hf_afp_vol_modification_date,
5761 { "Modification date", "afp.vol_modification_date",
5762 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
5763 "Volume modification date", HFILL }},
5764
5765 { &hf_afp_vol_backup_date,
5766 { "Backup date", "afp.vol_backup_date",
5767 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
5768 "Volume backup date", HFILL }},
5769
5770 { &hf_afp_vol_bytes_free,
5771 { "Bytes free", "afp.vol_bytes_free",
5772 FT_UINT32, BASE_DEC, NULL, 0x0,
5773 "Free space", HFILL }},
5774
5775 { &hf_afp_vol_bytes_total,
5776 { "Bytes total", "afp.vol_bytes_total",
5777 FT_UINT32, BASE_DEC, NULL, 0x0,
5778 "Volume size", HFILL }},
5779
5780 { &hf_afp_vol_ex_bytes_free,
5781 { "Extended bytes free", "afp.vol_ex_bytes_free",
5782 FT_UINT64, BASE_DEC, NULL, 0x0,
5783 "Extended (>2GB) free space", HFILL }},
5784
5785 { &hf_afp_vol_ex_bytes_total,
5786 { "Extended bytes total", "afp.vol_ex_bytes_total",
5787 FT_UINT64, BASE_DEC, NULL, 0x0,
5788 "Extended (>2GB) volume size", HFILL }},
5789
5790 { &hf_afp_vol_block_size,
5791 { "Block size", "afp.vol_block_size",
5792 FT_UINT32, BASE_DEC, NULL, 0x0,
5793 "Volume block size", HFILL }},
5794
5795 { &hf_afp_did,
5796 { "DID", "afp.did",
5797 FT_UINT32, BASE_DEC, NULL, 0x0,
5798 "Parent directory ID", HFILL }},
5799
5800 { &hf_afp_dir_bitmap,
5801 { "Directory bitmap", "afp.dir_bitmap",
5802 FT_UINT16, BASE_HEX, NULL, 0x0,
5803 NULL, HFILL }},
5804
5805 { &hf_afp_dir_offspring,
5806 { "Offspring", "afp.dir_offspring",
5807 FT_UINT16, BASE_DEC, NULL, 0x0,
5808 "Directory offspring", HFILL }},
5809
5810 { &hf_afp_dir_OwnerID,
5811 { "Owner ID", "afp.dir_owner_id",
5812 FT_INT32, BASE_DEC, NULL, 0x0,
5813 "Directory owner ID", HFILL }},
5814
5815 { &hf_afp_dir_GroupID,
5816 { "Group ID", "afp.dir_group_id",
5817 FT_INT32, BASE_DEC, NULL, 0x0,
5818 "Directory group ID", HFILL }},
5819
5820 { &hf_afp_creation_date,
5821 { "Creation date", "afp.creation_date",
5822 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
5823 NULL, HFILL }},
5824
5825 { &hf_afp_modification_date,
5826 { "Modification date", "afp.modification_date",
5827 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
5828 NULL, HFILL }},
5829
5830 { &hf_afp_backup_date,
5831 { "Backup date", "afp.backup_date",
5832 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
5833 NULL, HFILL }},
5834
5835 { &hf_afp_finder_info,
5836 { "Finder info", "afp.finder_info",
5837 FT_BYTES, BASE_NONE, NULL, 0x0,
5838 NULL, HFILL }},
5839
5840 { &hf_afp_long_name_offset,
5841 { "Long name offset", "afp.long_name_offset",
5842 FT_UINT16, BASE_DEC, NULL, 0x0,
5843 "Long name offset in packet", HFILL }},
5844
5845 { &hf_afp_short_name_offset,
5846 { "Short name offset", "afp.short_name_offset",
5847 FT_UINT16, BASE_DEC, NULL, 0x0,
5848 "Short name offset in packet", HFILL }},
5849
5850 { &hf_afp_unicode_name_offset,
5851 { "Unicode name offset", "afp.unicode_name_offset",
5852 FT_UINT16, BASE_DEC, NULL, 0x0,
5853 "Unicode name offset in packet", HFILL }},
5854
5855 { &hf_afp_unix_privs_uid,
5856 { "UID", "afp.unix_privs.uid",
5857 FT_UINT32, BASE_DEC, NULL, 0x0,
5858 "User ID", HFILL }},
5859
5860 { &hf_afp_unix_privs_gid,
5861 { "GID", "afp.unix_privs.gid",
5862 FT_UINT32, BASE_DEC, NULL, 0x0,
5863 "Group ID", HFILL }},
5864
5865 { &hf_afp_unix_privs_permissions,
5866 { "Permissions", "afp.unix_privs.permissions",
5867 FT_UINT32, BASE_OCT, NULL, 0x0,
5868 NULL, HFILL }},
5869
5870 { &hf_afp_unix_privs_ua_permissions,
5871 { "User's access rights", "afp.unix_privs.ua_permissions",
5872 FT_UINT32, BASE_HEX, NULL, 0x0,
5873 NULL, HFILL }},
5874
5875 { &hf_afp_file_id,
5876 { "File ID", "afp.file_id",
5877 FT_UINT32, BASE_DEC, NULL, 0x0,
5878 "File/directory ID", HFILL }},
5879
5880 { &hf_afp_file_DataForkLen,
5881 { "Data fork size", "afp.data_fork_len",
5882 FT_UINT32, BASE_DEC, NULL, 0x0,
5883 NULL, HFILL }},
5884
5885 { &hf_afp_file_RsrcForkLen,
5886 { "Resource fork size", "afp.resource_fork_len",
5887 FT_UINT32, BASE_DEC, NULL, 0x0,
5888 NULL, HFILL }},
5889
5890 { &hf_afp_file_ExtDataForkLen,
5891 { "Extended data fork size", "afp.ext_data_fork_len",
5892 FT_UINT64, BASE_DEC, NULL, 0x0,
5893 "Extended (>2GB) data fork length", HFILL }},
5894
5895 { &hf_afp_file_ExtRsrcForkLen,
5896 { "Extended resource fork size", "afp.ext_resource_fork_len",
5897 FT_UINT64, BASE_DEC, NULL, 0x0,
5898 "Extended (>2GB) resource fork length", HFILL }},
5899
5900 { &hf_afp_file_bitmap,
5901 { "File bitmap", "afp.file_bitmap",
5902 FT_UINT16, BASE_HEX, NULL, 0x0,
5903 NULL, HFILL }},
5904
5905 { &hf_afp_req_count,
5906 { "Req count", "afp.req_count",
5907 FT_UINT16, BASE_DEC, NULL, 0x0,
5908 "Maximum number of structures returned", HFILL }},
5909
5910 { &hf_afp_start_index,
5911 { "Start index", "afp.start_index",
5912 FT_UINT16, BASE_DEC, NULL, 0x0,
5913 "First structure returned", HFILL }},
5914
5915 { &hf_afp_max_reply_size,
5916 { "Reply size", "afp.reply_size",
5917 FT_UINT16, BASE_DEC, NULL, 0x0,
5918 NULL, HFILL }},
5919
5920 { &hf_afp_start_index32,
5921 { "Start index", "afp.start_index32",
5922 FT_UINT32, BASE_DEC, NULL, 0x0,
5923 "First structure returned", HFILL }},
5924
5925 { &hf_afp_max_reply_size32,
5926 { "Reply size", "afp.reply_size32",
5927 FT_UINT32, BASE_DEC, NULL, 0x0,
5928 NULL, HFILL }},
5929
5930 { &hf_afp_file_flag,
5931 { "Dir", "afp.file_flag",
5932 FT_BOOLEAN, 8, NULL, 0x80,
5933 "Is a dir", HFILL }},
5934
5935 { &hf_afp_create_flag,
5936 { "Hard create", "afp.create_flag",
5937 FT_BOOLEAN, 8, NULL, 0x80,
5938 "Soft/hard create file", HFILL }},
5939
5940 { &hf_afp_request_bitmap_Attributes,
5941 { "Attributes", "afp.request_bitmap.attributes",
5942 FT_BOOLEAN, 32, NULL, kFPAttributeBit,
5943 "Search attributes", HFILL }},
5944
5945 { &hf_afp_request_bitmap_ParentDirID,
5946 { "DID", "afp.request_bitmap.did",
5947 FT_BOOLEAN, 32, NULL, kFPParentDirIDBit,
5948 "Search parent directory ID", HFILL }},
5949
5950 { &hf_afp_request_bitmap_CreateDate,
5951 { "Creation date", "afp.request_bitmap.create_date",
5952 FT_BOOLEAN, 32, NULL, kFPCreateDateBit,
5953 "Search creation date", HFILL }},
5954
5955 { &hf_afp_request_bitmap_ModDate,
5956 { "Modification date", "afp.request_bitmap.mod_date",
5957 FT_BOOLEAN, 32, NULL, kFPModDateBit,
5958 "Search modification date", HFILL }},
5959
5960 { &hf_afp_request_bitmap_BackupDate,
5961 { "Backup date", "afp.request_bitmap.backup_date",
5962 FT_BOOLEAN, 32, NULL, kFPBackupDateBit,
5963 "Search backup date", HFILL }},
5964
5965 { &hf_afp_request_bitmap_FinderInfo,
5966 { "Finder info", "afp.request_bitmap.finder_info",
5967 FT_BOOLEAN, 32, NULL, kFPFinderInfoBit,
5968 "Search finder info", HFILL }},
5969
5970 { &hf_afp_request_bitmap_LongName,
5971 { "Long name", "afp.request_bitmap.long_name",
5972 FT_BOOLEAN, 32, NULL, kFPLongNameBit,
5973 "Search long name", HFILL }},
5974
5975 { &hf_afp_request_bitmap_DataForkLen,
5976 { "Data fork size", "afp.request_bitmap.data_fork_len",
5977 FT_BOOLEAN, 32, NULL, kFPDataForkLenBit,
5978 "Search data fork size", HFILL }},
5979
5980 { &hf_afp_request_bitmap_OffspringCount,
5981 { "Offspring count", "afp.request_bitmap.offspring_count",
5982 FT_BOOLEAN, 32, NULL, kFPOffspringCountBit,
5983 "Search offspring count", HFILL }},
5984
5985 { &hf_afp_request_bitmap_RsrcForkLen,
5986 { "Resource fork size", "afp.request_bitmap.resource_fork_len",
5987 FT_BOOLEAN, 32, NULL, kFPRsrcForkLenBit,
5988 "Search resource fork size", HFILL }},
5989
5990 { &hf_afp_request_bitmap_ExtDataForkLen,
5991 { "Extended data fork size", "afp.request_bitmap.ex_data_fork_len",
5992 FT_BOOLEAN, 32, NULL, kFPExtDataForkLenBit,
5993 "Search extended (>2GB) data fork size", HFILL }},
5994
5995 { &hf_afp_request_bitmap_UTF8Name,
5996 { "UTF-8 name", "afp.request_bitmap.UTF8_name",
5997 FT_BOOLEAN, 32, NULL, kFPUTF8NameBit,
5998 "Search UTF-8 name", HFILL }},
5999
6000 { &hf_afp_request_bitmap_ExtRsrcForkLen,
6001 { "Extended resource fork size", "afp.request_bitmap.ex_resource_fork_len",
6002 FT_BOOLEAN, 32, NULL, kFPExtRsrcForkLenBit,
6003 "Search extended (>2GB) resource fork size", HFILL }},
6004
6005 { &hf_afp_request_bitmap_PartialNames,
6006 { "Match on partial names", "afp.request_bitmap.partial_names",
6007 FT_BOOLEAN, 32, NULL, 0x80000000,
6008 NULL, HFILL }},
6009
6010 { &hf_afp_struct_size,
6011 { "Struct size", "afp.struct_size",
6012 FT_UINT8, BASE_DEC, NULL,0,
6013 "Sizeof of struct", HFILL }},
6014
6015 { &hf_afp_struct_size16,
6016 { "Struct size", "afp.struct_size16",
6017 FT_UINT16, BASE_DEC, NULL,0,
6018 "Sizeof of struct", HFILL }},
6019
6020 { &hf_afp_flag,
6021 { "From", "afp.flag",
6022 FT_UINT8, BASE_HEX, VALS(flag_vals), 0x80,
6023 "Offset is relative to start/end of the fork", HFILL }},
6024
6025 { &hf_afp_dt_ref,
6026 { "DT ref", "afp.dt_ref",
6027 FT_UINT16, BASE_DEC, NULL, 0x0,
6028 "Desktop database reference num", HFILL }},
6029
6030 { &hf_afp_ofork,
6031 { "Fork", "afp.ofork",
6032 FT_UINT16, BASE_DEC, NULL, 0x0,
6033 "Open fork reference number", HFILL }},
6034
6035 { &hf_afp_offset,
6036 { "Offset", "afp.offset",
6037 FT_INT32, BASE_DEC, NULL, 0x0,
6038 NULL, HFILL }},
6039
6040 { &hf_afp_rw_count,
6041 { "Count", "afp.rw_count",
6042 FT_INT32, BASE_DEC, NULL, 0x0,
6043 "Number of bytes to be read/written", HFILL }},
6044
6045 { &hf_afp_newline_mask,
6046 { "Newline mask", "afp.newline_mask",
6047 FT_UINT8, BASE_HEX, NULL, 0x0,
6048 "Value to AND bytes with when looking for newline", HFILL }},
6049
6050 { &hf_afp_newline_char,
6051 { "Newline char", "afp.newline_char",
6052 FT_UINT8, BASE_HEX, NULL, 0x0,
6053 "Value to compare ANDed bytes with when looking for newline", HFILL }},
6054
6055 { &hf_afp_last_written,
6056 { "Last written", "afp.last_written",
6057 FT_UINT32, BASE_DEC, NULL, 0x0,
6058 "Offset of the last byte written", HFILL }},
6059
6060 { &hf_afp_ofork_len,
6061 { "New length", "afp.ofork_len",
6062 FT_INT32, BASE_DEC, NULL, 0x0,
6063 NULL, HFILL }},
6064
6065 { &hf_afp_path_type,
6066 { "Type", "afp.path_type",
6067 FT_UINT8, BASE_HEX, VALS(path_type_vals), 0,
6068 "Type of names", HFILL }},
6069
6070 { &hf_afp_path_len,
6071 { "Len", "afp.path_len",
6072 FT_UINT8, BASE_DEC, NULL, 0x0,
6073 "Path length", HFILL }},
6074
6075 { &hf_afp_path_unicode_len,
6076 { "Len", "afp.path_unicode_len",
6077 FT_UINT16, BASE_DEC, NULL, 0x0,
6078 "Path length (unicode)", HFILL }},
6079
6080 { &hf_afp_path_unicode_hint,
6081 { "Unicode hint", "afp.path_unicode_hint",
6082 FT_UINT32, BASE_HEX|BASE_EXT_STRING, &unicode_hint_vals_ext, 0x0,
6083 NULL, HFILL }},
6084
6085 { &hf_afp_path_name,
6086 { "Name", "afp.path_name",
6087 FT_STRING, BASE_NONE, NULL, 0x0,
6088 "Path name", HFILL }},
6089
6090 { &hf_afp_fork_type,
6091 { "Resource fork", "afp.fork_type",
6092 FT_BOOLEAN, 8, NULL, 0x80,
6093 "Data/resource fork", HFILL }},
6094
6095 { &hf_afp_access_mode,
6096 { "Access mode", "afp.access",
6097 FT_UINT8, BASE_HEX, NULL, 0x0,
6098 "Fork access mode", HFILL }},
6099
6100 { &hf_afp_access_read,
6101 { "Read", "afp.access.read",
6102 FT_BOOLEAN, 8, NULL, 1,
6103 "Open for reading", HFILL }},
6104
6105 { &hf_afp_access_write,
6106 { "Write", "afp.access.write",
6107 FT_BOOLEAN, 8, NULL, 2,
6108 "Open for writing", HFILL }},
6109
6110 { &hf_afp_access_deny_read,
6111 { "Deny read", "afp.access.deny_read",
6112 FT_BOOLEAN, 8, NULL, 0x10,
6113 NULL, HFILL }},
6114
6115 { &hf_afp_access_deny_write,
6116 { "Deny write", "afp.access.deny_write",
6117 FT_BOOLEAN, 8, NULL, 0x20,
6118 NULL, HFILL }},
6119
6120 { &hf_afp_comment,
6121 { "Comment", "afp.comment",
6122 FT_UINT_STRING, BASE_NONE, NULL, 0x0,
6123 "File/folder comment", HFILL }},
6124
6125 /*
6126 * XXX - should this be a type that's displayed as
6127 * text if it's all printable ASCII and hex otherwise,
6128 * or something such as that?
6129 */
6130 { &hf_afp_file_creator,
6131 { "File creator", "afp.file_creator",
6132 FT_STRING, BASE_NONE, NULL, 0x0,
6133 NULL, HFILL }},
6134
6135 /*
6136 * XXX - should this be a type that's displayed as
6137 * text if it's all printable ASCII and hex otherwise,
6138 * or something such as that?
6139 */
6140 { &hf_afp_file_type,
6141 { "File type", "afp.file_type",
6142 FT_STRING, BASE_NONE, NULL, 0x0,
6143 NULL, HFILL }},
6144
6145 { &hf_afp_icon_type,
6146 { "Icon type", "afp.icon_type",
6147 FT_UINT8, BASE_HEX, NULL , 0,
6148 NULL, HFILL }},
6149
6150 { &hf_afp_icon_length,
6151 { "Size", "afp.icon_length",
6152 FT_UINT16, BASE_DEC, NULL, 0x0,
6153 "Size for icon bitmap", HFILL }},
6154
6155 { &hf_afp_icon_index,
6156 { "Index", "afp.icon_index",
6157 FT_UINT16, BASE_DEC, NULL, 0x0,
6158 "Icon index in desktop database", HFILL }},
6159
6160 { &hf_afp_icon_tag,
6161 { "Tag", "afp.icon_tag",
6162 FT_UINT32, BASE_HEX, NULL, 0x0,
6163 "Icon tag", HFILL }},
6164
6165 { &hf_afp_appl_index,
6166 { "Index", "afp.appl_index",
6167 FT_UINT16, BASE_DEC, NULL, 0x0,
6168 "Application index", HFILL }},
6169
6170 { &hf_afp_appl_tag,
6171 { "Tag", "afp.appl_tag",
6172 FT_UINT32, BASE_HEX, NULL, 0x0,
6173 "Application tag", HFILL }},
6174
6175 { &hf_afp_lock_op,
6176 { "unlock", "afp.lock_op",
6177 FT_BOOLEAN, 8, NULL, 0x1,
6178 "Lock/unlock op", HFILL }},
6179
6180 { &hf_afp_lock_from,
6181 { "End", "afp.lock_from",
6182 FT_BOOLEAN, 8, NULL, 0x80,
6183 "Offset is relative to the end of the fork", HFILL }},
6184
6185 { &hf_afp_lock_offset,
6186 { "Offset", "afp.lock_offset",
6187 FT_INT32, BASE_DEC, NULL, 0x0,
6188 "First byte to be locked", HFILL }},
6189
6190 { &hf_afp_lock_len,
6191 { "Length", "afp.lock_len",
6192 FT_INT32, BASE_DEC, NULL, 0x0,
6193 "Number of bytes to be locked/unlocked", HFILL }},
6194
6195 { &hf_afp_lock_range_start,
6196 { "Start", "afp.lock_range_start",
6197 FT_INT32, BASE_DEC, NULL, 0x0,
6198 "First byte locked/unlocked", HFILL }},
6199
6200 { &hf_afp_dir_ar,
6201 { "Access rights", "afp.dir_ar",
6202 FT_UINT32, BASE_HEX, NULL, 0x0,
6203 "Directory access rights", HFILL }},
6204
6205 { &hf_afp_dir_ar_o_search,
6206 { "Owner has search access", "afp.dir_ar.o_search",
6207 FT_BOOLEAN, 32, NULL, AR_O_SEARCH,
6208 NULL, HFILL }},
6209
6210 { &hf_afp_dir_ar_o_read,
6211 { "Owner has read access", "afp.dir_ar.o_read",
6212 FT_BOOLEAN, 32, NULL, AR_O_READ,
6213 NULL, HFILL }},
6214
6215 { &hf_afp_dir_ar_o_write,
6216 { "Owner has write access", "afp.dir_ar.o_write",
6217 FT_BOOLEAN, 32, NULL, AR_O_WRITE,
6218 NULL, HFILL }},
6219
6220 { &hf_afp_dir_ar_g_search,
6221 { "Group has search access", "afp.dir_ar.g_search",
6222 FT_BOOLEAN, 32, NULL, AR_G_SEARCH,
6223 NULL, HFILL }},
6224
6225 { &hf_afp_dir_ar_g_read,
6226 { "Group has read access", "afp.dir_ar.g_read",
6227 FT_BOOLEAN, 32, NULL, AR_G_READ,
6228 NULL, HFILL }},
6229
6230 { &hf_afp_dir_ar_g_write,
6231 { "Group has write access", "afp.dir_ar.g_write",
6232 FT_BOOLEAN, 32, NULL, AR_G_WRITE,
6233 NULL, HFILL }},
6234
6235 { &hf_afp_dir_ar_e_search,
6236 { "Everyone has search access", "afp.dir_ar.e_search",
6237 FT_BOOLEAN, 32, NULL, AR_E_SEARCH,
6238 NULL, HFILL }},
6239
6240 { &hf_afp_dir_ar_e_read,
6241 { "Everyone has read access", "afp.dir_ar.e_read",
6242 FT_BOOLEAN, 32, NULL, AR_E_READ,
6243 NULL, HFILL }},
6244
6245 { &hf_afp_dir_ar_e_write,
6246 { "Everyone has write access", "afp.dir_ar.e_write",
6247 FT_BOOLEAN, 32, NULL, AR_E_WRITE,
6248 NULL, HFILL }},
6249
6250 { &hf_afp_dir_ar_u_search,
6251 { "User has search access", "afp.dir_ar.u_search",
6252 FT_BOOLEAN, 32, NULL, AR_U_SEARCH,
6253 NULL, HFILL }},
6254
6255 { &hf_afp_dir_ar_u_read,
6256 { "User has read access", "afp.dir_ar.u_read",
6257 FT_BOOLEAN, 32, NULL, AR_U_READ,
6258 NULL, HFILL }},
6259
6260 { &hf_afp_dir_ar_u_write,
6261 { "User has write access", "afp.dir_ar.u_write",
6262 FT_BOOLEAN, 32, NULL, AR_U_WRITE,
6263 NULL, HFILL }},
6264
6265 { &hf_afp_dir_ar_blank,
6266 { "Blank access right", "afp.dir_ar.blank",
6267 FT_BOOLEAN, 32, NULL, AR_BLANK,
6268 NULL, HFILL }},
6269
6270 { &hf_afp_dir_ar_u_own,
6271 { "User is the owner", "afp.dir_ar.u_owner",
6272 FT_BOOLEAN, 32, NULL, AR_U_OWN,
6273 "Current user is the directory owner", HFILL }},
6274
6275 { &hf_afp_server_time,
6276 { "Server time", "afp.server_time",
6277 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
6278 NULL, HFILL }},
6279
6280 { &hf_afp_cat_req_matches,
6281 { "Max answers", "afp.cat_req_matches",
6282 FT_INT32, BASE_DEC, NULL, 0x0,
6283 "Maximum number of matches to return.", HFILL }},
6284
6285 { &hf_afp_reserved,
6286 { "Reserved", "afp.reserved",
6287 FT_BYTES, BASE_NONE, NULL, 0x0,
6288 NULL, HFILL }},
6289
6290 { &hf_afp_cat_count,
6291 { "Cat count", "afp.cat_count",
6292 FT_UINT32, BASE_DEC, NULL, 0x0,
6293 "Number of structures returned", HFILL }},
6294
6295 { &hf_afp_cat_position,
6296 { "Position", "afp.cat_position",
6297 FT_BYTES, BASE_NONE, NULL, 0x0,
6298 "Catalog position", HFILL }},
6299
6300 { &hf_afp_map_name_type,
6301 { "Type", "afp.map_name_type",
6302 FT_UINT8, BASE_DEC|BASE_EXT_STRING, &map_name_type_vals_ext, 0x0,
6303 "Map name type", HFILL }},
6304
6305 { &hf_afp_map_id_type,
6306 { "Type", "afp.map_id_type",
6307 FT_UINT8, BASE_DEC|BASE_EXT_STRING, &map_id_type_vals_ext, 0x0,
6308 "Map ID type", HFILL }},
6309
6310 { &hf_afp_map_id,
6311 { "ID", "afp.map_id",
6312 FT_UINT32, BASE_DEC, NULL, 0x0,
6313 "User/Group ID", HFILL }},
6314
6315 { &hf_afp_map_id_reply_type,
6316 { "Reply type", "afp.map_id_reply_type",
6317 FT_UINT32, BASE_DEC, VALS(map_id_reply_type_vals), 0x0,
6318 "Map ID reply type", HFILL }},
6319
6320 { &hf_afp_map_name,
6321 { "Name", "afp.map_name",
6322 FT_UINT_STRING, BASE_NONE, NULL, 0x0,
6323 "User/Group name", HFILL }},
6324
6325 /* AFP 3.0 */
6326 { &hf_afp_lock_offset64,
6327 { "Offset", "afp.lock_offset64",
6328 FT_INT64, BASE_DEC, NULL, 0x0,
6329 "First byte to be locked (64 bits)", HFILL }},
6330
6331 { &hf_afp_lock_len64,
6332 { "Length", "afp.lock_len64",
6333 FT_INT64, BASE_DEC, NULL, 0x0,
6334 "Number of bytes to be locked/unlocked (64 bits)", HFILL }},
6335
6336 { &hf_afp_lock_range_start64,
6337 { "Start", "afp.lock_range_start64",
6338 FT_INT64, BASE_DEC, NULL, 0x0,
6339 "First byte locked/unlocked (64 bits)", HFILL }},
6340
6341 { &hf_afp_offset64,
6342 { "Offset", "afp.offset64",
6343 FT_INT64, BASE_DEC, NULL, 0x0,
6344 "Offset (64 bits)", HFILL }},
6345
6346 { &hf_afp_rw_count64,
6347 { "Count", "afp.rw_count64",
6348 FT_INT64, BASE_DEC, NULL, 0x0,
6349 "Number of bytes to be read/written (64 bits)", HFILL }},
6350
6351 { &hf_afp_last_written64,
6352 { "Last written", "afp.last_written64",
6353 FT_UINT64, BASE_DEC, NULL, 0x0,
6354 "Offset of the last byte written (64 bits)", HFILL }},
6355
6356 { &hf_afp_ofork_len64,
6357 { "New length", "afp.ofork_len64",
6358 FT_INT64, BASE_DEC, NULL, 0x0,
6359 "New length (64 bits)", HFILL }},
6360
6361 { &hf_afp_session_token_type,
6362 { "Type", "afp.session_token_type",
6363 FT_UINT16, BASE_HEX|BASE_EXT_STRING, &token_type_vals_ext, 0x0,
6364 "Session token type", HFILL }},
6365
6366 /* FIXME FT_UINT32 in specs */
6367 { &hf_afp_session_token_len,
6368 { "Len", "afp.session_token_len",
6369 FT_UINT32, BASE_DEC, NULL, 0x0,
6370 "Session token length", HFILL }},
6371
6372 { &hf_afp_session_token_timestamp,
6373 { "Time stamp", "afp.session_token_timestamp",
6374 FT_UINT32, BASE_HEX, NULL, 0x0,
6375 "Session time stamp", HFILL }},
6376
6377 { &hf_afp_session_token,
6378 { "Token", "afp.session_token",
6379 FT_BYTES, BASE_NONE, NULL, 0x0,
6380 "Session token", HFILL }},
6381
6382 { &hf_afp_user_flag,
6383 { "Flag", "afp.user_flag",
6384 FT_UINT8, BASE_HEX, VALS(user_flag_vals), 0x01,
6385 "User Info flag", HFILL }},
6386
6387 { &hf_afp_user_ID,
6388 { "User ID", "afp.user_ID",
6389 FT_UINT32, BASE_DEC, NULL, 0x0,
6390 NULL, HFILL }},
6391
6392 { &hf_afp_group_ID,
6393 { "Group ID", "afp.group_ID",
6394 FT_UINT32, BASE_DEC, NULL, 0x0,
6395 NULL, HFILL }},
6396
6397 { &hf_afp_UUID,
6398 { "UUID", "afp.uuid",
6399 FT_GUID, BASE_NONE, NULL, 0x0,
6400 NULL, HFILL }},
6401
6402 { &hf_afp_GRPUUID,
6403 { "GRPUUID", "afp.grpuuid",
6404 FT_GUID, BASE_NONE, NULL, 0x0,
6405 "Group UUID", HFILL }},
6406
6407 { &hf_afp_user_bitmap,
6408 { "Bitmap", "afp.user_bitmap",
6409 FT_UINT16, BASE_HEX, NULL, 0,
6410 "User Info bitmap", HFILL }},
6411
6412 { &hf_afp_user_bitmap_UID,
6413 { "User ID", "afp.user_bitmap.UID",
6414 FT_BOOLEAN, 16, NULL, 0x01,
6415 NULL, HFILL }},
6416
6417 { &hf_afp_user_bitmap_GID,
6418 { "Primary group ID", "afp.user_bitmap.GID",
6419 FT_BOOLEAN, 16, NULL, 0x02,
6420 NULL, HFILL }},
6421
6422 { &hf_afp_user_bitmap_UUID,
6423 { "UUID", "afp.user_bitmap.UUID",
6424 FT_BOOLEAN, 16, NULL, 0x04,
6425 NULL, HFILL }},
6426
6427 { &hf_afp_message_type,
6428 { "Type", "afp.message_type",
6429 FT_UINT16, BASE_HEX, VALS(server_message_type), 0,
6430 "Type of server message", HFILL }},
6431
6432 { &hf_afp_message_bitmap,
6433 { "Bitmap", "afp.message_bitmap",
6434 FT_UINT16, BASE_HEX, NULL, 0,
6435 "Message bitmap", HFILL }},
6436
6437 /*
6438 * XXX - in the reply, this indicates whether the message
6439 * is a server message or a login message.
6440 */
6441 { &hf_afp_message_bitmap_REQ,
6442 { "Request message", "afp.message_bitmap.requested",
6443 FT_BOOLEAN, 16, NULL, 0x01,
6444 "Message Requested", HFILL }},
6445
6446 { &hf_afp_message_bitmap_UTF,
6447 { "Message is UTF8", "afp.message_bitmap.utf8",
6448 FT_BOOLEAN, 16, NULL, 0x02,
6449 NULL, HFILL }},
6450
6451 { &hf_afp_message_len,
6452 { "Len", "afp.message_length",
6453 FT_UINT32, BASE_DEC, NULL, 0x0,
6454 "Message length", HFILL }},
6455
6456 { &hf_afp_message,
6457 { "Message", "afp.message",
6458 FT_STRING, BASE_NONE, NULL, 0x0,
6459 NULL, HFILL }},
6460
6461 { &hf_afp_reqcount64,
6462 { "Count", "afp.reqcount64",
6463 FT_INT64, BASE_DEC, NULL, 0x0,
6464 "Request Count (64 bits)", HFILL }},
6465
6466 { &hf_afp_extattr_bitmap,
6467 { "Bitmap", "afp.extattr_bitmap",
6468 FT_UINT16, BASE_HEX, NULL, 0,
6469 "Extended attributes bitmap", HFILL }},
6470
6471 { &hf_afp_extattr_bitmap_NoFollow,
6472 { "No follow symlinks", "afp.extattr_bitmap.nofollow",
6473 FT_BOOLEAN, 16, NULL, 0x01,
6474 "Do not follow symlink", HFILL }},
6475
6476 { &hf_afp_extattr_bitmap_Create,
6477 { "Create", "afp.extattr_bitmap.create",
6478 FT_BOOLEAN, 16, NULL, 0x02,
6479 "Create extended attribute", HFILL }},
6480
6481 { &hf_afp_extattr_bitmap_Replace,
6482 { "Replace", "afp.extattr_bitmap.replace",
6483 FT_BOOLEAN, 16, NULL, 0x04,
6484 "Replace extended attribute", HFILL }},
6485
6486 { &hf_afp_extattr_namelen,
6487 { "Length", "afp.extattr.namelen",
6488 FT_UINT16, BASE_DEC, NULL, 0x0,
6489 "Extended attribute name length", HFILL }},
6490
6491 { &hf_afp_extattr_name,
6492 { "Name", "afp.extattr.name",
6493 FT_STRING, BASE_NONE, NULL, 0x0,
6494 "Extended attribute name", HFILL }},
6495
6496 { &hf_afp_extattr_len,
6497 { "Length", "afp.extattr.len",
6498 FT_UINT32, BASE_DEC, NULL, 0x0,
6499 "Extended attribute length", HFILL }},
6500
6501 { &hf_afp_extattr_data,
6502 { "Data", "afp.extattr.data",
6503 FT_BYTES, BASE_NONE, NULL, 0x0,
6504 "Extended attribute data", HFILL }},
6505
6506 { &hf_afp_extattr_req_count,
6507 { "Request Count", "afp.extattr.req_count",
6508 FT_UINT16, BASE_DEC, NULL, 0x0,
6509 "Request Count.", HFILL }},
6510
6511 { &hf_afp_extattr_start_index,
6512 { "Index", "afp.extattr.start_index",
6513 FT_UINT32, BASE_DEC, NULL, 0x0,
6514 "Start index", HFILL }},
6515
6516 { &hf_afp_extattr_reply_size,
6517 { "Reply size", "afp.extattr.reply_size",
6518 FT_UINT32, BASE_DEC, NULL, 0x0,
6519 NULL, HFILL }},
6520
6521 /* ACL control list bitmap */
6522 { &hf_afp_access_bitmap,
6523 { "Bitmap", "afp.access_bitmap",
6524 FT_UINT16, BASE_HEX, NULL, 0,
6525 "Bitmap (reserved)", HFILL }},
6526
6527 { &hf_afp_acl_list_bitmap,
6528 { "ACL bitmap", "afp.acl_list_bitmap",
6529 FT_UINT16, BASE_HEX, NULL, 0,
6530 "ACL control list bitmap", HFILL }},
6531
6532 { &hf_afp_acl_list_bitmap_UUID,
6533 { "UUID", "afp.acl_list_bitmap.UUID",
6534 FT_BOOLEAN, 16, NULL, kFileSec_UUID,
6535 "User UUID", HFILL }},
6536
6537 { &hf_afp_acl_list_bitmap_GRPUUID,
6538 { "GRPUUID", "afp.acl_list_bitmap.GRPUUID",
6539 FT_BOOLEAN, 16, NULL, kFileSec_GRPUUID,
6540 "Group UUID", HFILL }},
6541
6542 { &hf_afp_acl_list_bitmap_ACL,
6543 { "ACL", "afp.acl_list_bitmap.ACL",
6544 FT_BOOLEAN, 16, NULL, kFileSec_ACL,
6545 NULL, HFILL }},
6546
6547 { &hf_afp_acl_list_bitmap_REMOVEACL,
6548 { "Remove ACL", "afp.acl_list_bitmap.REMOVEACL",
6549 FT_BOOLEAN, 16, NULL, kFileSec_REMOVEACL,
6550 NULL, HFILL }},
6551
6552 { &hf_afp_acl_list_bitmap_Inherit,
6553 { "Inherit", "afp.acl_list_bitmap.Inherit",
6554 FT_BOOLEAN, 16, NULL, kFileSec_Inherit,
6555 "Inherit ACL", HFILL }},
6556
6557 { &hf_afp_acl_entrycount,
6558 { "ACEs count", "afp.acl_entrycount",
6559 FT_UINT32, BASE_HEX, NULL, 0,
6560 "Number of ACL entries", HFILL }},
6561
6562 { &hf_afp_acl_flags,
6563 { "ACL flags", "afp.acl_flags",
6564 FT_UINT32, BASE_HEX, NULL, 0,
6565 NULL, HFILL }},
6566
6567 { &hf_afp_acl_access_bitmap,
6568 { "Bitmap", "afp.acl_access_bitmap",
6569 FT_UINT32, BASE_HEX, NULL, 0,
6570 "ACL access bitmap", HFILL }},
6571
6572 { &hf_afp_acl_access_bitmap_read_data,
6573 { "Read/List", "afp.acl_access_bitmap.read_data",
6574 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_READ_DATA,
6575 "Read data / list directory", HFILL }},
6576
6577 { &hf_afp_acl_access_bitmap_write_data,
6578 { "Write/Add file", "afp.acl_access_bitmap.write_data",
6579 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_WRITE_DATA,
6580 "Write data to a file / add a file to a directory", HFILL }},
6581
6582 { &hf_afp_acl_access_bitmap_execute,
6583 { "Execute/Search", "afp.acl_access_bitmap.execute",
6584 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_EXECUTE,
6585 "Execute a program", HFILL }},
6586
6587 { &hf_afp_acl_access_bitmap_delete,
6588 { "Delete", "afp.acl_access_bitmap.delete",
6589 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_DELETE,
6590 NULL, HFILL }},
6591
6592 { &hf_afp_acl_access_bitmap_append_data,
6593 { "Append data/create subdir", "afp.acl_access_bitmap.append_data",
6594 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_APPEND_DATA,
6595 "Append data to a file / create a subdirectory", HFILL }},
6596
6597 { &hf_afp_acl_access_bitmap_delete_child,
6598 { "Delete dir", "afp.acl_access_bitmap.delete_child",
6599 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_DELETE_CHILD,
6600 "Delete directory", HFILL }},
6601
6602 { &hf_afp_acl_access_bitmap_read_attrs,
6603 { "Read attributes", "afp.acl_access_bitmap.read_attrs",
6604 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_READ_ATTRIBUTES,
6605 NULL, HFILL }},
6606
6607 { &hf_afp_acl_access_bitmap_write_attrs,
6608 { "Write attributes", "afp.acl_access_bitmap.write_attrs",
6609 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_WRITE_ATTRIBUTES,
6610 NULL, HFILL }},
6611
6612 { &hf_afp_acl_access_bitmap_read_extattrs,
6613 { "Read extended attributes", "afp.acl_access_bitmap.read_extattrs",
6614 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_READ_EXTATTRIBUTES,
6615 NULL, HFILL }},
6616
6617 { &hf_afp_acl_access_bitmap_write_extattrs,
6618 { "Write extended attributes", "afp.acl_access_bitmap.write_extattrs",
6619 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_WRITE_EXTATTRIBUTES,
6620 NULL, HFILL }},
6621
6622 { &hf_afp_acl_access_bitmap_read_security,
6623 { "Read security", "afp.acl_access_bitmap.read_security",
6624 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_READ_SECURITY,
6625 "Read access rights", HFILL }},
6626
6627 { &hf_afp_acl_access_bitmap_write_security,
6628 { "Write security", "afp.acl_access_bitmap.write_security",
6629 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_WRITE_SECURITY,
6630 "Write access rights", HFILL }},
6631
6632 { &hf_afp_acl_access_bitmap_change_owner,
6633 { "Change owner", "afp.acl_access_bitmap.change_owner",
6634 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_CHANGE_OWNER,
6635 NULL, HFILL }},
6636
6637 { &hf_afp_acl_access_bitmap_synchronize,
6638 { "Synchronize", "afp.acl_access_bitmap.synchronize",
6639 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_SYNCHRONIZE,
6640 NULL, HFILL }},
6641
6642 { &hf_afp_acl_access_bitmap_generic_all,
6643 { "Generic all", "afp.acl_access_bitmap.generic_all",
6644 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_GENERIC_ALL,
6645 NULL, HFILL }},
6646
6647 { &hf_afp_acl_access_bitmap_generic_execute,
6648 { "Generic execute", "afp.acl_access_bitmap.generic_execute",
6649 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_GENERIC_EXECUTE,
6650 NULL, HFILL }},
6651
6652 { &hf_afp_acl_access_bitmap_generic_write,
6653 { "Generic write", "afp.acl_access_bitmap.generic_write",
6654 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_GENERIC_WRITE,
6655 NULL, HFILL }},
6656
6657 { &hf_afp_acl_access_bitmap_generic_read,
6658 { "Generic read", "afp.acl_access_bitmap.generic_read",
6659 FT_BOOLEAN, 32, NULL, KAUTH_VNODE_GENERIC_READ,
6660 NULL, HFILL }},
6661
6662 { &hf_afp_ace_flags,
6663 { "Flags", "afp.ace_flags",
6664 FT_UINT32, BASE_HEX, NULL, 0,
6665 "ACE flags", HFILL }},
6666
6667 { &hf_afp_ace_flags_allow,
6668 { "Allow", "afp.ace_flags.allow",
6669 FT_BOOLEAN, 32, NULL, ACE_ALLOW,
6670 "Allow rule", HFILL }},
6671
6672 { &hf_afp_ace_flags_deny,
6673 { "Deny", "afp.ace_flags.deny",
6674 FT_BOOLEAN, 32, NULL, ACE_DENY,
6675 "Deny rule", HFILL }},
6676
6677 { &hf_afp_ace_flags_inherited,
6678 { "Inherited", "afp.ace_flags.inherited",
6679 FT_BOOLEAN, 32, NULL, ACE_INHERITED,
6680 NULL, HFILL }},
6681
6682 { &hf_afp_ace_flags_fileinherit,
6683 { "File inherit", "afp.ace_flags.file_inherit",
6684 FT_BOOLEAN, 32, NULL, ACE_FILE_INHERIT,
6685 NULL, HFILL }},
6686
6687 { &hf_afp_ace_flags_dirinherit,
6688 { "Dir inherit", "afp.ace_flags.directory_inherit",
6689 FT_BOOLEAN, 32, NULL, ACE_DIR_INHERIT,
6690 NULL, HFILL }},
6691
6692 { &hf_afp_ace_flags_limitinherit,
6693 { "Limit inherit", "afp.ace_flags.limit_inherit",
6694 FT_BOOLEAN, 32, NULL, ACE_LIMIT_INHERIT,
6695 NULL, HFILL }},
6696
6697 { &hf_afp_ace_flags_onlyinherit,
6698 { "Only inherit", "afp.ace_flags.only_inherit",
6699 FT_BOOLEAN, 32, NULL, ACE_ONLY_INHERIT,
6700 NULL, HFILL }},
6701
6702 { &hf_afp_spotlight_request_flags,
6703 { "Flags", "afp.spotlight.flags",
6704 FT_UINT32, BASE_HEX, NULL, 0x0,
6705 "Spotlight RPC Flags", HFILL }},
6706
6707 { &hf_afp_spotlight_request_command,
6708 { "Command", "afp.spotlight.command",
6709 FT_UINT32, BASE_HEX, NULL, 0x0,
6710 "Spotlight RPC Command", HFILL }},
6711
6712 { &hf_afp_spotlight_request_reserved,
6713 { "Padding", "afp.spotlight.reserved",
6714 FT_UINT32, BASE_HEX, NULL, 0x0,
6715 "Spotlight RPC Padding", HFILL }},
6716
6717 { &hf_afp_spotlight_reply_reserved,
6718 { "Reserved", "afp.spotlight.reserved",
6719 FT_UINT32, BASE_HEX, NULL, 0x0,
6720 "Spotlight RPC Padding", HFILL }},
6721
6722 { &hf_afp_spotlight_volpath_client,
6723 { "Client's volume path", "afp.spotlight.volpath_client",
6724 FT_STRING, BASE_NONE, NULL, 0x0,
6725 NULL, HFILL }},
6726
6727 { &hf_afp_spotlight_volpath_server,
6728 { "Server's volume path", "afp.spotlight.volpath_server",
6729 FT_STRING, BASE_NONE, NULL, 0x0,
6730 "Servers's volume path", HFILL }},
6731
6732 { &hf_afp_spotlight_returncode,
6733 { "Return code", "afp.spotlight.return",
6734 FT_INT32, BASE_DEC, NULL, 0x0,
6735 NULL, HFILL }},
6736
6737 { &hf_afp_spotlight_volflags,
6738 { "Volume flags", "afp.spotlight.volflags",
6739 FT_UINT32, BASE_HEX, NULL, 0x0,
6740 NULL, HFILL }},
6741
6742 { &hf_afp_spotlight_reqlen,
6743 { "Length", "afp.spotlight.reqlen",
6744 FT_UINT32, BASE_DEC, NULL, 0x0,
6745 NULL, HFILL }},
6746
6747 { &hf_afp_spotlight_uuid,
6748 { "UUID", "afp.spotlight.uuid",
6749 FT_GUID, BASE_NONE, NULL, 0x0,
6750 NULL, HFILL }},
6751
6752 { &hf_afp_spotlight_date,
6753 { "Date", "afp.spotlight.date",
6754 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
6755 NULL, HFILL }},
6756
6757 { &hf_afp_unknown,
6758 { "Unknown parameter", "afp.unknown",
6759 FT_BYTES, BASE_NONE, NULL, 0x0,
6760 NULL, HFILL }},
6761 };
6762
6763 static gint *ett[] = {
6764 &ett_afp,
6765 &ett_afp_server_vol,
6766 &ett_afp_vol_list,
6767 &ett_afp_vol_flag,
6768 &ett_afp_vol_bitmap,
6769 &ett_afp_vol_attribute,
6770 &ett_afp_dir_bitmap,
6771 &ett_afp_file_bitmap,
6772 &ett_afp_unix_privs,
6773 &ett_afp_enumerate,
6774 &ett_afp_enumerate_line,
6775 &ett_afp_access_mode,
6776 &ett_afp_dir_attribute,
6777 &ett_afp_file_attribute,
6778 &ett_afp_path_name,
6779 &ett_afp_lock_flags,
6780 &ett_afp_dir_ar,
6781 &ett_afp_cat_search,
6782 &ett_afp_cat_r_bitmap,
6783 &ett_afp_cat_spec,
6784 &ett_afp_vol_did,
6785 &ett_afp_user_bitmap,
6786 &ett_afp_message_bitmap,
6787 &ett_afp_extattr_bitmap,
6788 &ett_afp_extattr_names,
6789 &ett_afp_acl_list_bitmap,
6790 &ett_afp_acl_access_bitmap,
6791 &ett_afp_ace_entries,
6792 &ett_afp_ace_entry,
6793 &ett_afp_ace_flags,
6794 &ett_afp_spotlight_queries,
6795 &ett_afp_spotlight_query_line,
6796 &ett_afp_spotlight_query,
6797 &ett_afp_spotlight_data,
6798 &ett_afp_spotlight_toc
6799 };
6800
6801 static ei_register_info ei[] = {
6802 { &ei_afp_subquery_count_over_safety_limit, { "afp.subquery_count_over_safety_limit", PI_MALFORMED, PI_ERROR, "Subquery count > safety limit ", EXPFILL }},
6803 { &ei_afp_subquery_count_over_query_count, { "afp.subquery_count_over_query_count", PI_MALFORMED, PI_ERROR, "Subquery count > query count", EXPFILL }},
6804 { &ei_afp_abnormal_num_subqueries, { "afp.abnormal_num_subqueries", PI_PROTOCOL, PI_WARN, "Abnormal number of subqueries", EXPFILL }},
6805 { &ei_afp_too_many_acl_entries, { "afp.too_many_acl_entries", PI_UNDECODED, PI_WARN, "Too many ACL entries", EXPFILL }},
6806 { &ei_afp_ip_port_reused, { "afp.ip_port_reused", PI_SEQUENCE, PI_WARN, "IP port reused, you need to split the capture file", EXPFILL }},
6807 };
6808 expert_module_t* expert_afp;
6809
6810 proto_afp = proto_register_protocol("Apple Filing Protocol", "AFP", "afp");
6811 proto_register_field_array(proto_afp, hf, array_length(hf));
6812 proto_register_subtree_array(ett, array_length(ett));
6813 expert_afp = expert_register_protocol(proto_afp);
6814 expert_register_field_array(expert_afp, ei, array_length(ei));
6815
6816 register_init_routine(afp_reinit);
6817
6818 new_register_dissector("afp", dissect_afp, proto_afp);
6819
6820 afp_tap = register_tap("afp");
6821 }
6822
6823 void
6824 proto_reg_handoff_afp(void)
6825 {
6826 data_handle = find_dissector("data");
6827 }
6828
6829 /* -------------------------------
6830 end
6831 */