2001-12-16 20:17:10 +00:00
|
|
|
/* packet-dcerpc-nt.c
|
|
|
|
* Routines for DCERPC over SMB packet disassembly
|
|
|
|
* Copyright 2001, Tim Potter <tpot@samba.org>
|
|
|
|
*
|
Use "dissect_ndr_nt_UNICODE_STRING_str()", not
"dissect_ndr_nt_UNICODE_STRING_string()", in
"samr_dissect_connect2_server()"; that eliminates an unnecessary extra
level of protocol tree.
That removes the last call to "dissect_ndr_nt_UNICODE_STRING_string()";
eliminate that routine.
In "dissect_ndr_nt_UNICODE_STRING()", initially create the subtree with
the name of the field as a string, so that if an exception is thrown
before the name is set, the subtree won't show up as blank when
displayed or printed. Also pass in the name to "dissect_ndr_pointer()",
so the same happens for subtrees below it. Append only the string data,
not its name, to items up the tree, as the name was put in when the item
was created. Also, when adding a colon before the string, put a space
after the colon, as is done elsewhere in Ethereal.
When appending additional strings, put the blank before the new string,
not after it.
In "dissect_ndr_nt_STRING()", put the subtree into the string with the
name of the field, rather than just "String". Pass in that name to
"dissect_ndr_pointer()", so subtrees below it get a name when they're
initially created.
Get rid of colons in the name string passed to "dissect_ndr_pointer()"
in some calls. Supply a non-null name string in more calls to
"dissect_ndr_pointer()", and fix some calls to pass in the name of the
field being handed to "dissect_ndr_pointer()".
There's no need to fetch the entire "header_field_info" structure for a
protocol field in order to get the field's name - just use
"proto_registrar_get_name()" to get the name.
Use a length of -1, not 0, when creating a subtree whose length will be
set when the dissection of the items under the subtree is complete; that
way, if an exception is thrown while dissecting the items - which means
the item goes past the end of the tvbuff - the item will refer to all
data to the end of the tvbuff, rather than referring to nothing.
Fix a typo in the name of the "hf_samr_unknown_string" field.
svn path=/trunk/; revision=4912
2002-03-10 21:30:11 +00:00
|
|
|
* $Id: packet-dcerpc-nt.c,v 1.10 2002/03/10 21:30:10 guy Exp $
|
2001-12-16 20:17:10 +00:00
|
|
|
*
|
|
|
|
* Ethereal - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@ethereal.com>
|
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
#include "config.h"
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include <glib.h>
|
2002-01-21 07:37:49 +00:00
|
|
|
#include <epan/packet.h>
|
2001-12-16 20:17:10 +00:00
|
|
|
#include "packet-dcerpc.h"
|
|
|
|
#include "packet-dcerpc-nt.h"
|
|
|
|
#include "smb.h"
|
|
|
|
|
|
|
|
/*
|
|
|
|
* This file contains helper routines that are used by the DCERPC over SMB
|
|
|
|
* dissectors for ethereal.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/* Align offset to a n-byte boundary */
|
|
|
|
|
|
|
|
int prs_align(int offset, int n)
|
|
|
|
{
|
|
|
|
if (offset % n)
|
|
|
|
offset += n - (offset % n);
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Parse a 8-bit integer */
|
|
|
|
|
|
|
|
int prs_uint8(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, guint8 *data, char *name)
|
|
|
|
{
|
|
|
|
guint8 i;
|
|
|
|
|
|
|
|
/* No alignment required */
|
|
|
|
|
|
|
|
i = tvb_get_guint8(tvb, offset);
|
|
|
|
offset++;
|
|
|
|
|
|
|
|
if (name && tree)
|
|
|
|
proto_tree_add_text(tree, tvb, offset - 1, 1,
|
|
|
|
"%s: %d", name, i);
|
|
|
|
|
|
|
|
if (data)
|
|
|
|
*data = i;
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
int prs_uint8s(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, int count, guint8 **data, char *name)
|
|
|
|
{
|
|
|
|
const guint8 *ptr;
|
|
|
|
|
2002-01-07 19:55:48 +00:00
|
|
|
/* The tvb_get_ptr() function fails an assertion if count < -1 */
|
|
|
|
|
|
|
|
if (count < -1)
|
|
|
|
THROW(BoundsError);
|
|
|
|
|
2001-12-16 20:17:10 +00:00
|
|
|
/* No alignment required */
|
|
|
|
|
|
|
|
ptr = tvb_get_ptr(tvb, offset, count);
|
|
|
|
|
|
|
|
if (name && tree)
|
|
|
|
proto_tree_add_text(tree, tvb, offset, count, "%s", name);
|
|
|
|
|
|
|
|
if (data)
|
|
|
|
*data = (guint8 *)ptr;
|
|
|
|
|
|
|
|
offset += count;
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Parse a 16-bit integer */
|
|
|
|
|
|
|
|
int prs_uint16(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, guint16 *data, char *name)
|
|
|
|
{
|
|
|
|
guint16 i;
|
|
|
|
|
|
|
|
offset = prs_align(offset, 2);
|
|
|
|
|
|
|
|
i = tvb_get_letohs(tvb, offset);
|
|
|
|
offset += 2;
|
|
|
|
|
|
|
|
if (name && tree)
|
|
|
|
proto_tree_add_text(tree, tvb, offset - 2, 2,
|
|
|
|
"%s: %d", name, i);
|
|
|
|
if (data)
|
|
|
|
*data = i;
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Parse a number of uint16's */
|
|
|
|
|
|
|
|
int prs_uint16s(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, int count, guint16 **data, char *name)
|
|
|
|
{
|
|
|
|
const guint8 *ptr;
|
|
|
|
|
2002-01-07 19:55:48 +00:00
|
|
|
/* The tvb_get_ptr() function fails an assertion if count < -1 */
|
|
|
|
|
|
|
|
if (count < -1)
|
|
|
|
THROW(BoundsError);
|
|
|
|
|
2001-12-16 20:17:10 +00:00
|
|
|
offset = prs_align(offset, 2);
|
|
|
|
|
|
|
|
ptr = tvb_get_ptr(tvb, offset, count * 2);
|
|
|
|
|
|
|
|
if (name && tree)
|
|
|
|
proto_tree_add_text(tree, tvb, offset, count * 2,
|
|
|
|
"%s", name);
|
|
|
|
if (data)
|
|
|
|
*data = (guint16 *)ptr;
|
|
|
|
|
|
|
|
offset += count * 2;
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Parse a 32-bit integer */
|
|
|
|
|
|
|
|
int prs_uint32(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, guint32 *data, char *name)
|
|
|
|
{
|
|
|
|
guint32 i;
|
|
|
|
|
|
|
|
offset = prs_align(offset, 4);
|
|
|
|
|
|
|
|
i = tvb_get_letohl(tvb, offset);
|
|
|
|
offset += 4;
|
|
|
|
|
|
|
|
if (name && tree)
|
|
|
|
proto_tree_add_text(tree, tvb, offset - 4, 4,
|
|
|
|
"%s: %d", name, i);
|
|
|
|
|
|
|
|
if (data)
|
|
|
|
*data = i;
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Parse a number of 32-bit integers */
|
|
|
|
|
|
|
|
int prs_uint32s(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, int count, guint32 **data, char *name)
|
|
|
|
{
|
|
|
|
const guint8 *ptr;
|
|
|
|
|
2002-01-07 19:55:48 +00:00
|
|
|
/* The tvb_get_ptr() function fails an assertion if count < -1 */
|
|
|
|
|
|
|
|
if (count < -1)
|
|
|
|
THROW(BoundsError);
|
|
|
|
|
2001-12-16 20:17:10 +00:00
|
|
|
offset = prs_align(offset, 4);
|
|
|
|
|
|
|
|
ptr = tvb_get_ptr(tvb, offset, count * 4);
|
|
|
|
|
|
|
|
if (name && tree)
|
|
|
|
proto_tree_add_text(tree, tvb, offset - 4, 4,
|
|
|
|
"%s", name);
|
|
|
|
if (data)
|
|
|
|
*data = (guint32 *)ptr;
|
|
|
|
|
|
|
|
offset += count * 4;
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Parse a NT status code */
|
|
|
|
|
|
|
|
int prs_ntstatus(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree)
|
|
|
|
{
|
|
|
|
guint32 status;
|
|
|
|
|
|
|
|
offset = prs_uint32(tvb, offset, pinfo, tree, &status, NULL);
|
|
|
|
|
|
|
|
if (tree)
|
|
|
|
proto_tree_add_text(tree, tvb, offset - 4, 4, "Status: %s",
|
|
|
|
val_to_str(status, NT_errors, "???"));
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* We need to keep track of deferred referrents as they appear in the
|
|
|
|
* packet after all the non-pointer objects.
|
|
|
|
* to keep track of pointers as they are parsed as scalars and need to be
|
|
|
|
* remembered for the next call to the prs function.
|
|
|
|
*
|
|
|
|
* Pointers are stored in a linked list and pushed in the PARSE_SCALARS
|
|
|
|
* section of the prs function and popped in the PARSE_BUFFERS section. If
|
|
|
|
* we try to pop off a referrent that has a different name then we are
|
|
|
|
* expecting then something has gone wrong.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#undef DEBUG_PTRS
|
|
|
|
|
|
|
|
struct ptr {
|
|
|
|
char *name;
|
|
|
|
guint32 value;
|
|
|
|
};
|
|
|
|
|
|
|
|
/* Create a new pointer */
|
|
|
|
|
|
|
|
static struct ptr *new_ptr(char *name, guint32 value)
|
|
|
|
{
|
|
|
|
struct ptr *p;
|
|
|
|
|
|
|
|
p = g_malloc(sizeof(struct ptr));
|
|
|
|
|
|
|
|
p->name = g_strdup(name);
|
|
|
|
p->value = value;
|
|
|
|
|
|
|
|
return p;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Free a pointer */
|
|
|
|
|
|
|
|
static void free_ptr(struct ptr *p)
|
|
|
|
{
|
|
|
|
if (p) {
|
|
|
|
g_free(p->name);
|
|
|
|
g_free(p);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Parse a pointer and store it's value in a linked list */
|
|
|
|
|
|
|
|
int prs_push_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, GList **ptr_list, char *name)
|
|
|
|
{
|
|
|
|
struct ptr *p;
|
|
|
|
guint32 value;
|
|
|
|
|
|
|
|
offset = prs_uint32(tvb, offset, pinfo, tree, &value, NULL);
|
|
|
|
|
|
|
|
if (name && tree)
|
|
|
|
proto_tree_add_text(tree, tvb, offset - 4, 4,
|
|
|
|
"%s pointer: 0x%08x", name, value);
|
|
|
|
|
|
|
|
p = new_ptr(name, value);
|
|
|
|
|
|
|
|
*ptr_list = g_list_append(*ptr_list, p);
|
|
|
|
|
|
|
|
#ifdef DEBUG_PTRS
|
|
|
|
fprintf(stderr, "DEBUG_PTRS: pushing %s ptr = 0x%08x, %d ptrs in "
|
|
|
|
"list\n", name, value, g_list_length(*ptr_list));
|
|
|
|
#endif
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Pop a pointer of a given name. Return it's value. */
|
|
|
|
|
|
|
|
guint32 prs_pop_ptr(GList **ptr_list, char *name)
|
|
|
|
{
|
|
|
|
GList *elt;
|
|
|
|
struct ptr *p;
|
|
|
|
guint32 result;
|
|
|
|
|
|
|
|
g_assert(g_list_length(*ptr_list) != 0); /* List too short */
|
|
|
|
|
|
|
|
/* Get pointer at head of list */
|
|
|
|
|
|
|
|
elt = g_list_first(*ptr_list);
|
|
|
|
p = (struct ptr *)elt->data;
|
|
|
|
result = p->value;
|
|
|
|
|
|
|
|
#ifdef DEBUG_PTRS
|
|
|
|
if (strcmp(p->name, name) != 0) {
|
|
|
|
fprintf(stderr, "DEBUG_PTRS: wrong pointer (%s != %s)\n",
|
|
|
|
p->name, name);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/* Free pointer record */
|
|
|
|
|
|
|
|
*ptr_list = g_list_remove_link(*ptr_list, elt);
|
|
|
|
|
|
|
|
#ifdef DEBUG_PTRS
|
|
|
|
fprintf(stderr, "DEBUG_PTRS: popping %s ptr = 0x%08x, %d ptrs in "
|
|
|
|
"list\n", p->name, p->value, g_list_length(*ptr_list));
|
|
|
|
#endif
|
|
|
|
|
|
|
|
free_ptr(p);
|
|
|
|
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Parse a UNISTR2 structure
|
|
|
|
*
|
|
|
|
* typedef struct {
|
|
|
|
* short length;
|
|
|
|
* short size;
|
|
|
|
* [size_is(size/2)] [length_is(length/2)] [unique] wchar_t *string;
|
|
|
|
* } UNICODE_STRING;
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
|
|
|
|
/* Convert a string from little-endian unicode to ascii. At the moment we
|
|
|
|
fake it by taking every odd byte. )-: The caller must free the
|
|
|
|
result returned. */
|
|
|
|
|
2002-01-03 20:42:41 +00:00
|
|
|
char *fake_unicode(guint16 *data, int len)
|
2001-12-16 20:17:10 +00:00
|
|
|
{
|
|
|
|
char *buffer;
|
|
|
|
int i;
|
|
|
|
|
|
|
|
buffer = malloc(len + 1);
|
|
|
|
|
|
|
|
for (i = 0; i < len; i++)
|
|
|
|
buffer[i] = data[i] & 0xff;
|
|
|
|
|
|
|
|
buffer[len] = 0;
|
|
|
|
|
|
|
|
return buffer;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Parse a UNISTR2 structure */
|
|
|
|
|
|
|
|
int prs_UNISTR2(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, int flags, char **data, char *name)
|
|
|
|
{
|
|
|
|
guint32 len = 0, unknown = 0, max_len = 0;
|
|
|
|
|
|
|
|
if (flags & PARSE_SCALARS) {
|
|
|
|
offset = prs_uint32(tvb, offset, pinfo, tree, &len, "Length");
|
|
|
|
offset = prs_uint32(tvb, offset, pinfo, tree, &unknown,
|
|
|
|
"Offset");
|
|
|
|
offset = prs_uint32(tvb, offset, pinfo, tree, &max_len,
|
|
|
|
"Max length");
|
|
|
|
}
|
|
|
|
|
|
|
|
if (flags & PARSE_BUFFERS) {
|
|
|
|
guint16 *data16;
|
|
|
|
|
|
|
|
offset = prs_uint16s(tvb, offset, pinfo, tree, max_len,
|
|
|
|
&data16, "Buffer");
|
|
|
|
|
|
|
|
if (data)
|
|
|
|
*data = fake_unicode(data16, max_len);
|
|
|
|
}
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Parse a policy handle. */
|
|
|
|
|
|
|
|
int prs_policy_hnd(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
2002-01-03 20:42:41 +00:00
|
|
|
proto_tree *tree, const guint8 **data)
|
2001-12-16 20:17:10 +00:00
|
|
|
{
|
2002-01-03 20:42:41 +00:00
|
|
|
const guint8 *data8;
|
|
|
|
|
2001-12-16 20:17:10 +00:00
|
|
|
offset = prs_align(offset, 4);
|
|
|
|
|
|
|
|
proto_tree_add_text(tree, tvb, offset, 20, "Policy Handle");
|
|
|
|
|
2002-01-03 20:42:41 +00:00
|
|
|
data8 = tvb_get_ptr(tvb, offset, 20);
|
|
|
|
|
|
|
|
if (data)
|
|
|
|
*data = data8;
|
|
|
|
|
2001-12-16 20:17:10 +00:00
|
|
|
return offset + 20;
|
|
|
|
}
|
2002-01-25 08:35:59 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
2002-03-06 08:58:01 +00:00
|
|
|
/* following are a few functions for dissecting common structures used by NT
|
|
|
|
services. These might need to be cleaned up at a later time but at least we get
|
|
|
|
them out of the real service dissectors.
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
/* UNICODE_STRING BEGIN */
|
|
|
|
/* functions to dissect a UNICODE_STRING structure, common to many
|
|
|
|
NT services
|
|
|
|
struct {
|
|
|
|
short len;
|
|
|
|
short size;
|
|
|
|
[size_is(size/2), length_is(len/2), ptr] unsigned short *string;
|
|
|
|
} UNICODE_STRING;
|
|
|
|
|
|
|
|
these variables can be found in packet-dcerpc-samr.c
|
|
|
|
*/
|
|
|
|
extern int hf_nt_str_len;
|
|
|
|
extern int hf_nt_str_off;
|
|
|
|
extern int hf_nt_str_max_len;
|
|
|
|
extern int hf_nt_string_length;
|
|
|
|
extern int hf_nt_string_size;
|
|
|
|
extern gint ett_nt_unicode_string;
|
|
|
|
|
|
|
|
|
|
|
|
/* this function will dissect the
|
|
|
|
[size_is(size/2), length_is(len/2), ptr] unsigned short *string;
|
|
|
|
part of the unicode string
|
|
|
|
|
|
|
|
struct {
|
|
|
|
short len;
|
|
|
|
short size;
|
|
|
|
[size_is(size/2), length_is(len/2), ptr] unsigned short *string;
|
|
|
|
} UNICODE_STRING;
|
|
|
|
structure used by NT to transmit unicode string values.
|
|
|
|
|
|
|
|
This function also looks at di->levels to see if whoever called us wanted us to append
|
|
|
|
the name: string to any higher levels in the tree .
|
|
|
|
*/
|
|
|
|
int
|
|
|
|
dissect_ndr_nt_UNICODE_STRING_str(tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *tree,
|
|
|
|
char *drep)
|
|
|
|
{
|
|
|
|
guint32 len, off, max_len;
|
|
|
|
guint16 *data16;
|
|
|
|
char *text;
|
|
|
|
int old_offset;
|
Use "dissect_ndr_nt_UNICODE_STRING_str()", not
"dissect_ndr_nt_UNICODE_STRING_string()", in
"samr_dissect_connect2_server()"; that eliminates an unnecessary extra
level of protocol tree.
That removes the last call to "dissect_ndr_nt_UNICODE_STRING_string()";
eliminate that routine.
In "dissect_ndr_nt_UNICODE_STRING()", initially create the subtree with
the name of the field as a string, so that if an exception is thrown
before the name is set, the subtree won't show up as blank when
displayed or printed. Also pass in the name to "dissect_ndr_pointer()",
so the same happens for subtrees below it. Append only the string data,
not its name, to items up the tree, as the name was put in when the item
was created. Also, when adding a colon before the string, put a space
after the colon, as is done elsewhere in Ethereal.
When appending additional strings, put the blank before the new string,
not after it.
In "dissect_ndr_nt_STRING()", put the subtree into the string with the
name of the field, rather than just "String". Pass in that name to
"dissect_ndr_pointer()", so subtrees below it get a name when they're
initially created.
Get rid of colons in the name string passed to "dissect_ndr_pointer()"
in some calls. Supply a non-null name string in more calls to
"dissect_ndr_pointer()", and fix some calls to pass in the name of the
field being handed to "dissect_ndr_pointer()".
There's no need to fetch the entire "header_field_info" structure for a
protocol field in order to get the field's name - just use
"proto_registrar_get_name()" to get the name.
Use a length of -1, not 0, when creating a subtree whose length will be
set when the dissection of the items under the subtree is complete; that
way, if an exception is thrown while dissecting the items - which means
the item goes past the end of the tvbuff - the item will refer to all
data to the end of the tvbuff, rather than referring to nothing.
Fix a typo in the name of the "hf_samr_unknown_string" field.
svn path=/trunk/; revision=4912
2002-03-10 21:30:11 +00:00
|
|
|
char *name;
|
2002-03-06 08:58:01 +00:00
|
|
|
dcerpc_info *di;
|
|
|
|
|
|
|
|
di=pinfo->private_data;
|
|
|
|
if(di->conformant_run){
|
|
|
|
/*just a run to handle conformant arrays, nothing to dissect */
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
|
|
|
|
hf_nt_str_len, &len);
|
|
|
|
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
|
|
|
|
hf_nt_str_off, &off);
|
|
|
|
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
|
|
|
|
hf_nt_str_max_len, &max_len);
|
|
|
|
|
|
|
|
old_offset=offset;
|
|
|
|
offset = prs_uint16s(tvb, offset, pinfo, tree, max_len, &data16, NULL);
|
|
|
|
text = fake_unicode(data16, max_len);
|
|
|
|
|
Use "dissect_ndr_nt_UNICODE_STRING_str()", not
"dissect_ndr_nt_UNICODE_STRING_string()", in
"samr_dissect_connect2_server()"; that eliminates an unnecessary extra
level of protocol tree.
That removes the last call to "dissect_ndr_nt_UNICODE_STRING_string()";
eliminate that routine.
In "dissect_ndr_nt_UNICODE_STRING()", initially create the subtree with
the name of the field as a string, so that if an exception is thrown
before the name is set, the subtree won't show up as blank when
displayed or printed. Also pass in the name to "dissect_ndr_pointer()",
so the same happens for subtrees below it. Append only the string data,
not its name, to items up the tree, as the name was put in when the item
was created. Also, when adding a colon before the string, put a space
after the colon, as is done elsewhere in Ethereal.
When appending additional strings, put the blank before the new string,
not after it.
In "dissect_ndr_nt_STRING()", put the subtree into the string with the
name of the field, rather than just "String". Pass in that name to
"dissect_ndr_pointer()", so subtrees below it get a name when they're
initially created.
Get rid of colons in the name string passed to "dissect_ndr_pointer()"
in some calls. Supply a non-null name string in more calls to
"dissect_ndr_pointer()", and fix some calls to pass in the name of the
field being handed to "dissect_ndr_pointer()".
There's no need to fetch the entire "header_field_info" structure for a
protocol field in order to get the field's name - just use
"proto_registrar_get_name()" to get the name.
Use a length of -1, not 0, when creating a subtree whose length will be
set when the dissection of the items under the subtree is complete; that
way, if an exception is thrown while dissecting the items - which means
the item goes past the end of the tvbuff - the item will refer to all
data to the end of the tvbuff, rather than referring to nothing.
Fix a typo in the name of the "hf_samr_unknown_string" field.
svn path=/trunk/; revision=4912
2002-03-10 21:30:11 +00:00
|
|
|
name = proto_registrar_get_name(di->hf_index);
|
2002-03-06 08:58:01 +00:00
|
|
|
proto_tree_add_string_format(tree, di->hf_index,
|
|
|
|
tvb, old_offset, offset-old_offset,
|
Use "dissect_ndr_nt_UNICODE_STRING_str()", not
"dissect_ndr_nt_UNICODE_STRING_string()", in
"samr_dissect_connect2_server()"; that eliminates an unnecessary extra
level of protocol tree.
That removes the last call to "dissect_ndr_nt_UNICODE_STRING_string()";
eliminate that routine.
In "dissect_ndr_nt_UNICODE_STRING()", initially create the subtree with
the name of the field as a string, so that if an exception is thrown
before the name is set, the subtree won't show up as blank when
displayed or printed. Also pass in the name to "dissect_ndr_pointer()",
so the same happens for subtrees below it. Append only the string data,
not its name, to items up the tree, as the name was put in when the item
was created. Also, when adding a colon before the string, put a space
after the colon, as is done elsewhere in Ethereal.
When appending additional strings, put the blank before the new string,
not after it.
In "dissect_ndr_nt_STRING()", put the subtree into the string with the
name of the field, rather than just "String". Pass in that name to
"dissect_ndr_pointer()", so subtrees below it get a name when they're
initially created.
Get rid of colons in the name string passed to "dissect_ndr_pointer()"
in some calls. Supply a non-null name string in more calls to
"dissect_ndr_pointer()", and fix some calls to pass in the name of the
field being handed to "dissect_ndr_pointer()".
There's no need to fetch the entire "header_field_info" structure for a
protocol field in order to get the field's name - just use
"proto_registrar_get_name()" to get the name.
Use a length of -1, not 0, when creating a subtree whose length will be
set when the dissection of the items under the subtree is complete; that
way, if an exception is thrown while dissecting the items - which means
the item goes past the end of the tvbuff - the item will refer to all
data to the end of the tvbuff, rather than referring to nothing.
Fix a typo in the name of the "hf_samr_unknown_string" field.
svn path=/trunk/; revision=4912
2002-03-10 21:30:11 +00:00
|
|
|
text, "%s: %s", name, text);
|
2002-03-06 08:58:01 +00:00
|
|
|
|
|
|
|
if(tree){
|
Use "dissect_ndr_nt_UNICODE_STRING_str()", not
"dissect_ndr_nt_UNICODE_STRING_string()", in
"samr_dissect_connect2_server()"; that eliminates an unnecessary extra
level of protocol tree.
That removes the last call to "dissect_ndr_nt_UNICODE_STRING_string()";
eliminate that routine.
In "dissect_ndr_nt_UNICODE_STRING()", initially create the subtree with
the name of the field as a string, so that if an exception is thrown
before the name is set, the subtree won't show up as blank when
displayed or printed. Also pass in the name to "dissect_ndr_pointer()",
so the same happens for subtrees below it. Append only the string data,
not its name, to items up the tree, as the name was put in when the item
was created. Also, when adding a colon before the string, put a space
after the colon, as is done elsewhere in Ethereal.
When appending additional strings, put the blank before the new string,
not after it.
In "dissect_ndr_nt_STRING()", put the subtree into the string with the
name of the field, rather than just "String". Pass in that name to
"dissect_ndr_pointer()", so subtrees below it get a name when they're
initially created.
Get rid of colons in the name string passed to "dissect_ndr_pointer()"
in some calls. Supply a non-null name string in more calls to
"dissect_ndr_pointer()", and fix some calls to pass in the name of the
field being handed to "dissect_ndr_pointer()".
There's no need to fetch the entire "header_field_info" structure for a
protocol field in order to get the field's name - just use
"proto_registrar_get_name()" to get the name.
Use a length of -1, not 0, when creating a subtree whose length will be
set when the dissection of the items under the subtree is complete; that
way, if an exception is thrown while dissecting the items - which means
the item goes past the end of the tvbuff - the item will refer to all
data to the end of the tvbuff, rather than referring to nothing.
Fix a typo in the name of the "hf_samr_unknown_string" field.
svn path=/trunk/; revision=4912
2002-03-10 21:30:11 +00:00
|
|
|
proto_item_append_text(tree, ": %s", text);
|
2002-03-06 08:58:01 +00:00
|
|
|
if(di->levels>-1){
|
|
|
|
tree=tree->parent;
|
Use "dissect_ndr_nt_UNICODE_STRING_str()", not
"dissect_ndr_nt_UNICODE_STRING_string()", in
"samr_dissect_connect2_server()"; that eliminates an unnecessary extra
level of protocol tree.
That removes the last call to "dissect_ndr_nt_UNICODE_STRING_string()";
eliminate that routine.
In "dissect_ndr_nt_UNICODE_STRING()", initially create the subtree with
the name of the field as a string, so that if an exception is thrown
before the name is set, the subtree won't show up as blank when
displayed or printed. Also pass in the name to "dissect_ndr_pointer()",
so the same happens for subtrees below it. Append only the string data,
not its name, to items up the tree, as the name was put in when the item
was created. Also, when adding a colon before the string, put a space
after the colon, as is done elsewhere in Ethereal.
When appending additional strings, put the blank before the new string,
not after it.
In "dissect_ndr_nt_STRING()", put the subtree into the string with the
name of the field, rather than just "String". Pass in that name to
"dissect_ndr_pointer()", so subtrees below it get a name when they're
initially created.
Get rid of colons in the name string passed to "dissect_ndr_pointer()"
in some calls. Supply a non-null name string in more calls to
"dissect_ndr_pointer()", and fix some calls to pass in the name of the
field being handed to "dissect_ndr_pointer()".
There's no need to fetch the entire "header_field_info" structure for a
protocol field in order to get the field's name - just use
"proto_registrar_get_name()" to get the name.
Use a length of -1, not 0, when creating a subtree whose length will be
set when the dissection of the items under the subtree is complete; that
way, if an exception is thrown while dissecting the items - which means
the item goes past the end of the tvbuff - the item will refer to all
data to the end of the tvbuff, rather than referring to nothing.
Fix a typo in the name of the "hf_samr_unknown_string" field.
svn path=/trunk/; revision=4912
2002-03-10 21:30:11 +00:00
|
|
|
proto_item_append_text(tree, ": %s", text);
|
2002-03-06 08:58:01 +00:00
|
|
|
while(di->levels>0){
|
|
|
|
tree=tree->parent;
|
Use "dissect_ndr_nt_UNICODE_STRING_str()", not
"dissect_ndr_nt_UNICODE_STRING_string()", in
"samr_dissect_connect2_server()"; that eliminates an unnecessary extra
level of protocol tree.
That removes the last call to "dissect_ndr_nt_UNICODE_STRING_string()";
eliminate that routine.
In "dissect_ndr_nt_UNICODE_STRING()", initially create the subtree with
the name of the field as a string, so that if an exception is thrown
before the name is set, the subtree won't show up as blank when
displayed or printed. Also pass in the name to "dissect_ndr_pointer()",
so the same happens for subtrees below it. Append only the string data,
not its name, to items up the tree, as the name was put in when the item
was created. Also, when adding a colon before the string, put a space
after the colon, as is done elsewhere in Ethereal.
When appending additional strings, put the blank before the new string,
not after it.
In "dissect_ndr_nt_STRING()", put the subtree into the string with the
name of the field, rather than just "String". Pass in that name to
"dissect_ndr_pointer()", so subtrees below it get a name when they're
initially created.
Get rid of colons in the name string passed to "dissect_ndr_pointer()"
in some calls. Supply a non-null name string in more calls to
"dissect_ndr_pointer()", and fix some calls to pass in the name of the
field being handed to "dissect_ndr_pointer()".
There's no need to fetch the entire "header_field_info" structure for a
protocol field in order to get the field's name - just use
"proto_registrar_get_name()" to get the name.
Use a length of -1, not 0, when creating a subtree whose length will be
set when the dissection of the items under the subtree is complete; that
way, if an exception is thrown while dissecting the items - which means
the item goes past the end of the tvbuff - the item will refer to all
data to the end of the tvbuff, rather than referring to nothing.
Fix a typo in the name of the "hf_samr_unknown_string" field.
svn path=/trunk/; revision=4912
2002-03-10 21:30:11 +00:00
|
|
|
proto_item_append_text(tree, " %s", text);
|
2002-03-06 08:58:01 +00:00
|
|
|
di->levels--;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* this function will dissect the
|
|
|
|
struct {
|
|
|
|
short len;
|
|
|
|
short size;
|
|
|
|
[size_is(size/2), length_is(len/2), ptr] unsigned short *string;
|
|
|
|
} UNICODE_STRING;
|
|
|
|
structure used by NT to transmit unicode string values.
|
|
|
|
|
|
|
|
the function takes one additional parameter, level
|
|
|
|
which specifies how many additional levels up in the tree where we should
|
Use "dissect_ndr_nt_UNICODE_STRING_str()", not
"dissect_ndr_nt_UNICODE_STRING_string()", in
"samr_dissect_connect2_server()"; that eliminates an unnecessary extra
level of protocol tree.
That removes the last call to "dissect_ndr_nt_UNICODE_STRING_string()";
eliminate that routine.
In "dissect_ndr_nt_UNICODE_STRING()", initially create the subtree with
the name of the field as a string, so that if an exception is thrown
before the name is set, the subtree won't show up as blank when
displayed or printed. Also pass in the name to "dissect_ndr_pointer()",
so the same happens for subtrees below it. Append only the string data,
not its name, to items up the tree, as the name was put in when the item
was created. Also, when adding a colon before the string, put a space
after the colon, as is done elsewhere in Ethereal.
When appending additional strings, put the blank before the new string,
not after it.
In "dissect_ndr_nt_STRING()", put the subtree into the string with the
name of the field, rather than just "String". Pass in that name to
"dissect_ndr_pointer()", so subtrees below it get a name when they're
initially created.
Get rid of colons in the name string passed to "dissect_ndr_pointer()"
in some calls. Supply a non-null name string in more calls to
"dissect_ndr_pointer()", and fix some calls to pass in the name of the
field being handed to "dissect_ndr_pointer()".
There's no need to fetch the entire "header_field_info" structure for a
protocol field in order to get the field's name - just use
"proto_registrar_get_name()" to get the name.
Use a length of -1, not 0, when creating a subtree whose length will be
set when the dissection of the items under the subtree is complete; that
way, if an exception is thrown while dissecting the items - which means
the item goes past the end of the tvbuff - the item will refer to all
data to the end of the tvbuff, rather than referring to nothing.
Fix a typo in the name of the "hf_samr_unknown_string" field.
svn path=/trunk/; revision=4912
2002-03-10 21:30:11 +00:00
|
|
|
append the string. If unsure, specify levels as 0.
|
2002-03-06 08:58:01 +00:00
|
|
|
*/
|
|
|
|
int
|
|
|
|
dissect_ndr_nt_UNICODE_STRING(tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *parent_tree,
|
|
|
|
char *drep, int hf_index, int levels)
|
|
|
|
{
|
|
|
|
proto_item *item=NULL;
|
|
|
|
proto_tree *tree=NULL;
|
|
|
|
int old_offset=offset;
|
|
|
|
dcerpc_info *di;
|
Use "dissect_ndr_nt_UNICODE_STRING_str()", not
"dissect_ndr_nt_UNICODE_STRING_string()", in
"samr_dissect_connect2_server()"; that eliminates an unnecessary extra
level of protocol tree.
That removes the last call to "dissect_ndr_nt_UNICODE_STRING_string()";
eliminate that routine.
In "dissect_ndr_nt_UNICODE_STRING()", initially create the subtree with
the name of the field as a string, so that if an exception is thrown
before the name is set, the subtree won't show up as blank when
displayed or printed. Also pass in the name to "dissect_ndr_pointer()",
so the same happens for subtrees below it. Append only the string data,
not its name, to items up the tree, as the name was put in when the item
was created. Also, when adding a colon before the string, put a space
after the colon, as is done elsewhere in Ethereal.
When appending additional strings, put the blank before the new string,
not after it.
In "dissect_ndr_nt_STRING()", put the subtree into the string with the
name of the field, rather than just "String". Pass in that name to
"dissect_ndr_pointer()", so subtrees below it get a name when they're
initially created.
Get rid of colons in the name string passed to "dissect_ndr_pointer()"
in some calls. Supply a non-null name string in more calls to
"dissect_ndr_pointer()", and fix some calls to pass in the name of the
field being handed to "dissect_ndr_pointer()".
There's no need to fetch the entire "header_field_info" structure for a
protocol field in order to get the field's name - just use
"proto_registrar_get_name()" to get the name.
Use a length of -1, not 0, when creating a subtree whose length will be
set when the dissection of the items under the subtree is complete; that
way, if an exception is thrown while dissecting the items - which means
the item goes past the end of the tvbuff - the item will refer to all
data to the end of the tvbuff, rather than referring to nothing.
Fix a typo in the name of the "hf_samr_unknown_string" field.
svn path=/trunk/; revision=4912
2002-03-10 21:30:11 +00:00
|
|
|
char *name;
|
2002-03-06 08:58:01 +00:00
|
|
|
|
|
|
|
ALIGN_TO_4_BYTES; /* strcture starts with short, but is aligned for longs */
|
|
|
|
|
|
|
|
di=pinfo->private_data;
|
|
|
|
if(di->conformant_run){
|
|
|
|
/*just a run to handle conformant arrays, nothing to dissect */
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
Use "dissect_ndr_nt_UNICODE_STRING_str()", not
"dissect_ndr_nt_UNICODE_STRING_string()", in
"samr_dissect_connect2_server()"; that eliminates an unnecessary extra
level of protocol tree.
That removes the last call to "dissect_ndr_nt_UNICODE_STRING_string()";
eliminate that routine.
In "dissect_ndr_nt_UNICODE_STRING()", initially create the subtree with
the name of the field as a string, so that if an exception is thrown
before the name is set, the subtree won't show up as blank when
displayed or printed. Also pass in the name to "dissect_ndr_pointer()",
so the same happens for subtrees below it. Append only the string data,
not its name, to items up the tree, as the name was put in when the item
was created. Also, when adding a colon before the string, put a space
after the colon, as is done elsewhere in Ethereal.
When appending additional strings, put the blank before the new string,
not after it.
In "dissect_ndr_nt_STRING()", put the subtree into the string with the
name of the field, rather than just "String". Pass in that name to
"dissect_ndr_pointer()", so subtrees below it get a name when they're
initially created.
Get rid of colons in the name string passed to "dissect_ndr_pointer()"
in some calls. Supply a non-null name string in more calls to
"dissect_ndr_pointer()", and fix some calls to pass in the name of the
field being handed to "dissect_ndr_pointer()".
There's no need to fetch the entire "header_field_info" structure for a
protocol field in order to get the field's name - just use
"proto_registrar_get_name()" to get the name.
Use a length of -1, not 0, when creating a subtree whose length will be
set when the dissection of the items under the subtree is complete; that
way, if an exception is thrown while dissecting the items - which means
the item goes past the end of the tvbuff - the item will refer to all
data to the end of the tvbuff, rather than referring to nothing.
Fix a typo in the name of the "hf_samr_unknown_string" field.
svn path=/trunk/; revision=4912
2002-03-10 21:30:11 +00:00
|
|
|
name = proto_registrar_get_name(hf_index);
|
2002-03-06 08:58:01 +00:00
|
|
|
if(parent_tree){
|
2002-03-09 22:46:29 +00:00
|
|
|
item = proto_tree_add_text(parent_tree, tvb, offset, -1,
|
Use "dissect_ndr_nt_UNICODE_STRING_str()", not
"dissect_ndr_nt_UNICODE_STRING_string()", in
"samr_dissect_connect2_server()"; that eliminates an unnecessary extra
level of protocol tree.
That removes the last call to "dissect_ndr_nt_UNICODE_STRING_string()";
eliminate that routine.
In "dissect_ndr_nt_UNICODE_STRING()", initially create the subtree with
the name of the field as a string, so that if an exception is thrown
before the name is set, the subtree won't show up as blank when
displayed or printed. Also pass in the name to "dissect_ndr_pointer()",
so the same happens for subtrees below it. Append only the string data,
not its name, to items up the tree, as the name was put in when the item
was created. Also, when adding a colon before the string, put a space
after the colon, as is done elsewhere in Ethereal.
When appending additional strings, put the blank before the new string,
not after it.
In "dissect_ndr_nt_STRING()", put the subtree into the string with the
name of the field, rather than just "String". Pass in that name to
"dissect_ndr_pointer()", so subtrees below it get a name when they're
initially created.
Get rid of colons in the name string passed to "dissect_ndr_pointer()"
in some calls. Supply a non-null name string in more calls to
"dissect_ndr_pointer()", and fix some calls to pass in the name of the
field being handed to "dissect_ndr_pointer()".
There's no need to fetch the entire "header_field_info" structure for a
protocol field in order to get the field's name - just use
"proto_registrar_get_name()" to get the name.
Use a length of -1, not 0, when creating a subtree whose length will be
set when the dissection of the items under the subtree is complete; that
way, if an exception is thrown while dissecting the items - which means
the item goes past the end of the tvbuff - the item will refer to all
data to the end of the tvbuff, rather than referring to nothing.
Fix a typo in the name of the "hf_samr_unknown_string" field.
svn path=/trunk/; revision=4912
2002-03-10 21:30:11 +00:00
|
|
|
"%s", name);
|
2002-03-06 08:58:01 +00:00
|
|
|
tree = proto_item_add_subtree(item, ett_nt_unicode_string);
|
|
|
|
}
|
|
|
|
|
|
|
|
offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
|
|
|
|
hf_nt_string_length, NULL);
|
|
|
|
offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
|
|
|
|
hf_nt_string_size, NULL);
|
|
|
|
di->levels=1;
|
|
|
|
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
|
|
|
|
dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
|
Use "dissect_ndr_nt_UNICODE_STRING_str()", not
"dissect_ndr_nt_UNICODE_STRING_string()", in
"samr_dissect_connect2_server()"; that eliminates an unnecessary extra
level of protocol tree.
That removes the last call to "dissect_ndr_nt_UNICODE_STRING_string()";
eliminate that routine.
In "dissect_ndr_nt_UNICODE_STRING()", initially create the subtree with
the name of the field as a string, so that if an exception is thrown
before the name is set, the subtree won't show up as blank when
displayed or printed. Also pass in the name to "dissect_ndr_pointer()",
so the same happens for subtrees below it. Append only the string data,
not its name, to items up the tree, as the name was put in when the item
was created. Also, when adding a colon before the string, put a space
after the colon, as is done elsewhere in Ethereal.
When appending additional strings, put the blank before the new string,
not after it.
In "dissect_ndr_nt_STRING()", put the subtree into the string with the
name of the field, rather than just "String". Pass in that name to
"dissect_ndr_pointer()", so subtrees below it get a name when they're
initially created.
Get rid of colons in the name string passed to "dissect_ndr_pointer()"
in some calls. Supply a non-null name string in more calls to
"dissect_ndr_pointer()", and fix some calls to pass in the name of the
field being handed to "dissect_ndr_pointer()".
There's no need to fetch the entire "header_field_info" structure for a
protocol field in order to get the field's name - just use
"proto_registrar_get_name()" to get the name.
Use a length of -1, not 0, when creating a subtree whose length will be
set when the dissection of the items under the subtree is complete; that
way, if an exception is thrown while dissecting the items - which means
the item goes past the end of the tvbuff - the item will refer to all
data to the end of the tvbuff, rather than referring to nothing.
Fix a typo in the name of the "hf_samr_unknown_string" field.
svn path=/trunk/; revision=4912
2002-03-10 21:30:11 +00:00
|
|
|
name, hf_index, levels);
|
2002-03-06 08:58:01 +00:00
|
|
|
|
|
|
|
proto_item_set_len(item, offset-old_offset);
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
/* UNICODE_STRING END */
|