Re: [Ethereal-dev] UNICODE and EMC Filers ...

[Guy Harris <guy@xxxxxxxxxx>]

On Tue, Mar 04, 2003 at 02:28:03PM -0800, Richard Sharpe wrote:
> I have seen an SMB/CIFS capture from an EMC filer with some interesting 
> characteristics. The EMC CIFS guy here at Connectathon says that it is a 
> configuration issue.
> 
> However. What we are seeing is in a NegProt response. LanMan2.1 or better, 
> type 17. The Domain and Server name are clearly in UniCode. 
> 
> Flags2 says UNICODE is in use, while Capabilities says it is not! Clearly 
> one confused filer :-)
> 
> I think we should change dissect_negprot_reply to look at the flags2 field 
> rather than the capabilities field, or in addition to the capabilities 
> field.

Well, the SNIA CIFS spec:

	http://www.snia.org/tech_activities/CIFS/CIFS-TR-1p00_FINAL.pdf

says on page 21 ("33 of 150"), in the table describing the Flags2 field:

	Bit	Name: SMB_FLAGS2_	Meaning			Earliest Dialect
	15	UNICODE			If set, any fields of	NT LM 0.12
					datatype STRING in this
					SMB message are encoded
					as UNICODE. Otherwise,
					they are in ASCII. The
					character encoding for
					Unicode fields SHOULD
					be UTF-16 (little
					endian).

so that would suggest that it's the right bit to test.

However, the description of NegProt also makes one wonder how the hell
the server can claim not to support Unicode strings *in the very reply
that contains a Unicode string*.

On the other hand, that description *also* says that the OemDomainName
in an NT 0.12 NegProt resposne is "in OEM chars", but apparently it's
not always in OEM characters, sometimes it's in Unicode.