osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity
wireshark/packet-dcerpc-nt.h

211 lines
6.3 KiB
C
Raw Normal View History

From Tim Potter: dissect some of the LSA RPCs stub data. svn path=/trunk/; revision=4407
2001-12-16 20:17:10 +00:00
/* packet-dcerpc-nt.h
* Routines for DCERPC over SMB packet disassembly
Defined a useful callback function for dissect_ndr_pointer() which can be used to help out in most DCERPC strings. The cb_str_postprocess() function reads the callback_args and either appends the value of the string to the COL_INFO field, appends it to the NDR pointer item, or saves the string to dcv->private_data. Calling cb_str_postprocess() with CB_STR_ITEM is the same as calling dissect_ndr_pointer() with levels = 0. Renamed some of the pointer dissection functions with a suffix of _cb and created helpers of the original which call the _cb function with NULL args. This should help minimise the amount of code changes in the bulk of the DCERPC dissectors. svn path=/trunk/; revision=7016
2003-01-28 06:27:01 +00:00
* Copyright 2001-2003 Tim Potter <tpot@samba.org>
From Tim Potter: dissect some of the LSA RPCs stub data. svn path=/trunk/; revision=4407
2001-12-16 20:17:10 +00:00
*
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
* $Id: packet-dcerpc-nt.h,v 1.49 2004/01/19 20:10:35 jmayer Exp $
From Tim Potter: dissect some of the LSA RPCs stub data. svn path=/trunk/; revision=4407
2001-12-16 20:17:10 +00:00
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
* Copyright 1998 Gerald Combs
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
*
From Tim Potter: dissect some of the LSA RPCs stub data. svn path=/trunk/; revision=4407
2001-12-16 20:17:10 +00:00
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
*
From Tim Potter: dissect some of the LSA RPCs stub data. svn path=/trunk/; revision=4407
2001-12-16 20:17:10 +00:00
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
*
From Tim Potter: dissect some of the LSA RPCs stub data. svn path=/trunk/; revision=4407
2001-12-16 20:17:10 +00:00
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*/
#ifndef __PACKET_DCERPC_NT_H
Fix a typo in the multiple-include protection in "packet-dcerpc-nt.h". Rename "dissect_ndr_element_array()" to "dissect_ndr_character_array()", move it out of "packet-dcerpc-nt.c" to "packet-dcerpc.c", and have it use the standard DCE RPC array max count/offset/count fields rather than their own private versions of those fields. Give it an option to create a subtree, and an argument to specify the field to use for the actual data buffer, and export it. Move the routines for handling arrays of "char" and "wchar" as strings out of "packet-dcerpc-nt.c" to "packet-dcerpc.c". Add a routine to handle an array of "char" as an opaque blob of bytes. Use "dissect_ndr_character_array()" to dissect character strings in MAPI (the strings in question are ASCII, not Unicode), and use the routine to handle an array of "char" as an opaque blob of bytes to dissect encrypted data (again, it's bytes, not 16-bit quantities). Show them as encrypted data, not unknown data. Use "dissect_ndr_character_array()" to dissect a form name in "dissect_form_name()" in the SPOOLSS dissector. svn path=/trunk/; revision=7091
2003-02-07 08:56:12 +00:00
#define __PACKET_DCERPC_NT_H
From Tim Potter: dissect some of the LSA RPCs stub data. svn path=/trunk/; revision=4407
2001-12-16 20:17:10 +00:00
Add a "proto_register_dcerpc_smb()" which registers ett_ values for "packet-dcerpc-nt.c", and registers "dcerpc_smb_init()" as an initialization routine. Take the ett_ registration out of the latter routine, and also take out the "do this only once" stuff. Get rid of the initialization routines for netlogon, samr, and spoolss; they just call "dcerpc_smb_init()", which is now an initialization routine of its own. The policy hash initialization should be done before every capture, so it should be done in an initialization routine, and should not do any "do this only once" stuff. It should also be called only once before every capture, rather than 3 times. The ett_ initialization should, however, be done at the same time all other ett_ initialization is done - at protocol registration time - so it should be done in a "proto_register_" routine. This fixes a bug I saw wherein 1) the tree for Unicode strings was open by default and 2) if you closed one and then exited, Ethereal would crash. The problem is that "proto_register_subtree_array()" doesn't expand the array, it just bumps the number of registered ett_ values; the array is allocated in "proto_init()". As such, if you register ett_ values with "proto_register_subtree_array()" *after* "proto_init()" is called - and, even for the first capture, initialization routines are called after "proto_init()" is called - you will get ett_ numbers that go past the number of elements in the array. Move the declaration of "ett_nt_unicode_string" to "packet-dcerpc-nt.h", as it's exported from "packet-dcerpc-nt.c". Get rid of the declaration of "dcerpc_smb_init()" in "packet-dcerpc-nt.h", and make it static, as it's no longer called from outside "packet-dcerpc-nt.c". svn path=/trunk/; revision=5196
2002-04-18 00:29:17 +00:00
/*
* ett_ value for Unicode strings.
*/
extern gint ett_nt_unicode_string;
Move the value_string of platform ID values to "packet-dcerpc-nt.c", and declare it in "packet-dcerpc-nt.h", as it's used both by the srvsvc and wkssvc dissectors. svn path=/trunk/; revision=7672
2003-05-15 05:24:19 +00:00
/*
* Platform ID values, used by several dissectors.
*/
extern const value_string platform_id_vals[];
From Tim Potter: dissect some of the LSA RPCs stub data. svn path=/trunk/; revision=4407
2001-12-16 20:17:10 +00:00
/* Routines for handling deferral of referants in NDR */
We must make sure that the ALIGN_TO_4_BYTES macro does not change the offset when we do the conformance run. svn path=/trunk/; revision=5682
2002-06-16 13:47:39 +00:00
#define ALIGN_TO_4_BYTES \
{ dcerpc_info *xzdi; \
xzdi=pinfo->private_data; \
if(!xzdi->conformant_run) { \
if(offset&0x03) { \
offset=(offset&0xfffffffc)+4; \
} \
} \
}
Moved dissector for UNICODE_STRING structure from packet-dcerpc-samr.c to packet-dcerpc-nt.c since this is a structure that is common to all NT services and not only SAMR. svn path=/trunk/; revision=4888
2002-03-06 08:58:01 +00:00
int
Replace the confusing collection of Windows DCERPC string handling functions with something a little less confusing. We now have two sets of functions to dissect strings: - dissect_ndr_wchar_array() which dissects NDR arrays of wide characters (uint32, uint32, uint32, buffer) - dissect_ndr_counted_string() which dissects a "counted string" (uint16, uint16, pointer to array of wchar) There are three contexts for dissecting counted strings: 1. "in-line" using dissect_ndr_counted_string() 2. as a callback to dissect_ndr_pointer() 3. as a callback to dissect_ndr_pointer_cb() Context 2 is used when you have a pointer to a counted string. Context 3 is when you wish to perform some special processing with the returned string. svn path=/trunk/; revision=7068
2003-02-03 02:00:54 +00:00
dissect_ndr_counted_string_cb(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep, int hf_index,
Replace the confusing collection of Windows DCERPC string handling functions with something a little less confusing. We now have two sets of functions to dissect strings: - dissect_ndr_wchar_array() which dissects NDR arrays of wide characters (uint32, uint32, uint32, buffer) - dissect_ndr_counted_string() which dissects a "counted string" (uint16, uint16, pointer to array of wchar) There are three contexts for dissecting counted strings: 1. "in-line" using dissect_ndr_counted_string() 2. as a callback to dissect_ndr_pointer() 3. as a callback to dissect_ndr_pointer_cb() Context 2 is used when you have a pointer to a counted string. Context 3 is when you wish to perform some special processing with the returned string. svn path=/trunk/; revision=7068
2003-02-03 02:00:54 +00:00
dcerpc_callback_fnct_t *callback,
void *callback_args);
Defined a useful callback function for dissect_ndr_pointer() which can be used to help out in most DCERPC strings. The cb_str_postprocess() function reads the callback_args and either appends the value of the string to the COL_INFO field, appends it to the NDR pointer item, or saves the string to dcv->private_data. Calling cb_str_postprocess() with CB_STR_ITEM is the same as calling dissect_ndr_pointer() with levels = 0. Renamed some of the pointer dissection functions with a suffix of _cb and created helpers of the original which call the _cb function with NULL args. This should help minimise the amount of code changes in the bulk of the DCERPC dissectors. svn path=/trunk/; revision=7016
2003-01-28 06:27:01 +00:00
int
Replace the confusing collection of Windows DCERPC string handling functions with something a little less confusing. We now have two sets of functions to dissect strings: - dissect_ndr_wchar_array() which dissects NDR arrays of wide characters (uint32, uint32, uint32, buffer) - dissect_ndr_counted_string() which dissects a "counted string" (uint16, uint16, pointer to array of wchar) There are three contexts for dissecting counted strings: 1. "in-line" using dissect_ndr_counted_string() 2. as a callback to dissect_ndr_pointer() 3. as a callback to dissect_ndr_pointer_cb() Context 2 is used when you have a pointer to a counted string. Context 3 is when you wish to perform some special processing with the returned string. svn path=/trunk/; revision=7068
2003-02-03 02:00:54 +00:00
dissect_ndr_counted_string_ptr(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep);
Defined a useful callback function for dissect_ndr_pointer() which can be used to help out in most DCERPC strings. The cb_str_postprocess() function reads the callback_args and either appends the value of the string to the COL_INFO field, appends it to the NDR pointer item, or saves the string to dcv->private_data. Calling cb_str_postprocess() with CB_STR_ITEM is the same as calling dissect_ndr_pointer() with levels = 0. Renamed some of the pointer dissection functions with a suffix of _cb and created helpers of the original which call the _cb function with NULL args. This should help minimise the amount of code changes in the bulk of the DCERPC dissectors. svn path=/trunk/; revision=7016
2003-01-28 06:27:01 +00:00
Move the STRING dissector to packet-dcerpc-nt.c and add one more parameter to make it more similar to the UNICODE_STRING dissector. svn path=/trunk/; revision=4920
2002-03-11 00:15:20 +00:00
int
Replace the confusing collection of Windows DCERPC string handling functions with something a little less confusing. We now have two sets of functions to dissect strings: - dissect_ndr_wchar_array() which dissects NDR arrays of wide characters (uint32, uint32, uint32, buffer) - dissect_ndr_counted_string() which dissects a "counted string" (uint16, uint16, pointer to array of wchar) There are three contexts for dissecting counted strings: 1. "in-line" using dissect_ndr_counted_string() 2. as a callback to dissect_ndr_pointer() 3. as a callback to dissect_ndr_pointer_cb() Context 2 is used when you have a pointer to a counted string. Context 3 is when you wish to perform some special processing with the returned string. svn path=/trunk/; revision=7068
2003-02-03 02:00:54 +00:00
dissect_ndr_counted_string(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep, int hf_index, int levels);
Defined a useful callback function for dissect_ndr_pointer() which can be used to help out in most DCERPC strings. The cb_str_postprocess() function reads the callback_args and either appends the value of the string to the COL_INFO field, appends it to the NDR pointer item, or saves the string to dcv->private_data. Calling cb_str_postprocess() with CB_STR_ITEM is the same as calling dissect_ndr_pointer() with levels = 0. Renamed some of the pointer dissection functions with a suffix of _cb and created helpers of the original which call the _cb function with NULL args. This should help minimise the amount of code changes in the bulk of the DCERPC dissectors. svn path=/trunk/; revision=7016
2003-01-28 06:27:01 +00:00
Have "dissect_ndr_counted_string()" add 2, not 1, to its argument, as it adds 2 levels to the tree. Fix calls to it not to add 1 for that level. The NT and LM challenges in a NETWORK_INFO structure are opaque arrays of bytes, not Unicode strings; dissect them as such, adding a new routine "dissect_ndr_counted_byte_array()" for that purpose. Get rid of some extra colons in names - the colon is put there if a string is appended, so putting a colon in there explicitly gives double colons. Decorate some higher-level tree nodes with strings. svn path=/trunk/; revision=7107
2003-02-08 09:41:44 +00:00
int
dissect_ndr_counted_byte_array(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep, int hf_index);
Have "dissect_ndr_counted_string()" add 2, not 1, to its argument, as it adds 2 levels to the tree. Fix calls to it not to add 1 for that level. The NT and LM challenges in a NETWORK_INFO structure are opaque arrays of bytes, not Unicode strings; dissect them as such, adding a new routine "dissect_ndr_counted_byte_array()" for that purpose. Get rid of some extra colons in names - the colon is put there if a string is appended, so putting a colon in there explicitly gives double colons. Decorate some higher-level tree nodes with strings. svn path=/trunk/; revision=7107
2003-02-08 09:41:44 +00:00
Add a dissect_ndr_counted_byte_array_cb function which can take a callback to call when dissecting the array data. svn path=/trunk/; revision=7656
2003-05-09 01:43:59 +00:00
int
dissect_ndr_counted_byte_array_cb(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep, int hf_index,
Add a dissect_ndr_counted_byte_array_cb function which can take a callback to call when dissecting the array data. svn path=/trunk/; revision=7656
2003-05-09 01:43:59 +00:00
dcerpc_callback_fnct_t *callback,
void *callback_args);
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
int
dissect_ndr_nt_acct_ctrl(tvbuff_t *tvb, int offset, packet_info *pinfo,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
proto_tree *parent_tree, guint8 *drep);
Moved dissect_ndr_nt_NTTIME() from packet-dcerpc-samr.c to packet-dcerpc-nt.c since this function will be used by other NT services as well such as NETLOGON. svn path=/trunk/; revision=4918
2002-03-10 23:24:48 +00:00
int
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
dissect_ndr_nt_NTTIME (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep, int hf_index);
Rename samr_dissect_LOGON_HOURS() to dissect_ndr_nt_LOGON_HOURS() and export it to other modules. NETLOGON dissector (and others) will need this function. svn path=/trunk/; revision=4919
2002-03-11 00:00:15 +00:00
int
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset,
Rename samr_dissect_LOGON_HOURS() to dissect_ndr_nt_LOGON_HOURS() and export it to other modules. NETLOGON dissector (and others) will need this function. svn path=/trunk/; revision=4919
2002-03-11 00:00:15 +00:00
packet_info *pinfo, proto_tree *parent_tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep);
Final patch in preparing for NETLOGON dissector. Exported some functions from packet-dcerpc-samr.c and added two more functions the netlogon dissector will need. svn path=/trunk/; revision=4921
2002-03-11 00:28:21 +00:00
int
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
dissect_ndr_nt_SID(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep, int hf_sid);
Final patch in preparing for NETLOGON dissector. Exported some functions from packet-dcerpc-samr.c and added two more functions the netlogon dissector will need. svn path=/trunk/; revision=4921
2002-03-11 00:28:21 +00:00
int
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset,
Final patch in preparing for NETLOGON dissector. Exported some functions from packet-dcerpc-samr.c and added two more functions the netlogon dissector will need. svn path=/trunk/; revision=4921
2002-03-11 00:28:21 +00:00
packet_info *pinfo, proto_tree *parent_tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep, int hf_sid);
Final patch in preparing for NETLOGON dissector. Exported some functions from packet-dcerpc-samr.c and added two more functions the netlogon dissector will need. svn path=/trunk/; revision=4921
2002-03-11 00:28:21 +00:00
int
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset,
Final patch in preparing for NETLOGON dissector. Exported some functions from packet-dcerpc-samr.c and added two more functions the netlogon dissector will need. svn path=/trunk/; revision=4921
2002-03-11 00:28:21 +00:00
packet_info *pinfo, proto_tree *parent_tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep);
Final patch in preparing for NETLOGON dissector. Exported some functions from packet-dcerpc-samr.c and added two more functions the netlogon dissector will need. svn path=/trunk/; revision=4921
2002-03-11 00:28:21 +00:00
int
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
Final patch in preparing for NETLOGON dissector. Exported some functions from packet-dcerpc-samr.c and added two more functions the netlogon dissector will need. svn path=/trunk/; revision=4921
2002-03-11 00:28:21 +00:00
packet_info *pinfo, proto_tree *parent_tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep);
Final patch in preparing for NETLOGON dissector. Exported some functions from packet-dcerpc-samr.c and added two more functions the netlogon dissector will need. svn path=/trunk/; revision=4921
2002-03-11 00:28:21 +00:00
int
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
Final patch in preparing for NETLOGON dissector. Exported some functions from packet-dcerpc-samr.c and added two more functions the netlogon dissector will need. svn path=/trunk/; revision=4921
2002-03-11 00:28:21 +00:00
packet_info *pinfo, proto_tree *parent_tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep);
Final patch in preparing for NETLOGON dissector. Exported some functions from packet-dcerpc-samr.c and added two more functions the netlogon dissector will need. svn path=/trunk/; revision=4921
2002-03-11 00:28:21 +00:00
Some refactoring of the spoolss dissector: - rewrote request/response hashing code and moved it into packet-dcerpc-nt.c for use by other dcerpc/smb dissectors - rewrote policy handle hashing code as above, with nifty improvements - moved check for unparsed data and end of frame into a function - fixed matching of printername to handle in addprinterex svn path=/trunk/; revision=5014
2002-03-25 05:42:02 +00:00
/*
* Policy handle hashing
*/
Cleaned up NT policy handle hashing a bit. Split the store function into two - one that stores request/reply frame numbers and another that associates a text name with a policy handle. Removed all calls to prs_policy_hnd() and converted to calls to dissect_nt_policy_hnd(). svn path=/trunk/; revision=5772
2002-06-28 01:23:26 +00:00
/* Store open and close packet numbers for a policy handle */
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
void
In the policy handle hashing, handle more than one policy handle having the same value, as an open might return handle XXX, handle XXX might then be closed, and a subsequent handle might return handle XXX, and we want to keep the two handles distinct to avoid, for example, displaying handles closed before they're opened. In policy handle open replies, store the handle name only if the operation succeeded. We can now do that without parsing the packet twice. Have "dissect_nt_policy_hnd()" optionally return, through a pointer, the protocol tree item for the handle, so that its caller can decorate the item with the name of the handle - that's done on opens, where we do that only if the operation succeeds. svn path=/trunk/; revision=7787
2003-06-05 04:22:04 +00:00
dcerpc_smb_store_pol_pkts(e_ctx_hnd *policy_hnd, packet_info *pinfo,
gboolean is_open, gboolean is_close);
Cleaned up NT policy handle hashing a bit. Split the store function into two - one that stores request/reply frame numbers and another that associates a text name with a policy handle. Removed all calls to prs_policy_hnd() and converted to calls to dissect_nt_policy_hnd(). svn path=/trunk/; revision=5772
2002-06-28 01:23:26 +00:00
/* Store a name with a policy handle */
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
void
In the policy handle hashing, handle more than one policy handle having the same value, as an open might return handle XXX, handle XXX might then be closed, and a subsequent handle might return handle XXX, and we want to keep the two handles distinct to avoid, for example, displaying handles closed before they're opened. In policy handle open replies, store the handle name only if the operation succeeded. We can now do that without parsing the packet twice. Have "dissect_nt_policy_hnd()" optionally return, through a pointer, the protocol tree item for the handle, so that its caller can decorate the item with the name of the handle - that's done on opens, where we do that only if the operation succeeds. svn path=/trunk/; revision=7787
2003-06-05 04:22:04 +00:00
dcerpc_smb_store_pol_name(e_ctx_hnd *policy_hnd, packet_info *pinfo,
char *name);
Cleaned up NT policy handle hashing a bit. Split the store function into two - one that stores request/reply frame numbers and another that associates a text name with a policy handle. Removed all calls to prs_policy_hnd() and converted to calls to dissect_nt_policy_hnd(). svn path=/trunk/; revision=5772
2002-06-28 01:23:26 +00:00
/* Fetch details stored with a policy handle */
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
gboolean
dcerpc_smb_fetch_pol(e_ctx_hnd *policy_hnd, char **name,
In the policy handle hashing, handle more than one policy handle having the same value, as an open might return handle XXX, handle XXX might then be closed, and a subsequent handle might return handle XXX, and we want to keep the two handles distinct to avoid, for example, displaying handles closed before they're opened. In policy handle open replies, store the handle name only if the operation succeeded. We can now do that without parsing the packet twice. Have "dissect_nt_policy_hnd()" optionally return, through a pointer, the protocol tree item for the handle, so that its caller can decorate the item with the name of the handle - that's done on opens, where we do that only if the operation succeeds. svn path=/trunk/; revision=7787
2003-06-05 04:22:04 +00:00
guint32 *open_frame, guint32 *close_frame,
guint32 cur_frame);
Some refactoring of the spoolss dissector: - rewrote request/response hashing code and moved it into packet-dcerpc-nt.c for use by other dcerpc/smb dissectors - rewrote policy handle hashing code as above, with nifty improvements - moved check for unparsed data and end of frame into a function - fixed matching of printername to handle in addprinterex svn path=/trunk/; revision=5014
2002-03-25 05:42:02 +00:00
Display non-zero return codes in COL_INFO. svn path=/trunk/; revision=5170
2002-04-16 02:02:04 +00:00
/* Dissect NT specific things */
int
dissect_ntstatus(tvbuff_t *tvb, gint offset, packet_info *pinfo,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
proto_tree *tree, guint8 *drep,
Display non-zero return codes in COL_INFO. svn path=/trunk/; revision=5170
2002-04-16 02:02:04 +00:00
int hfindex, guint32 *pdata);
Added a routine to dissect a DOS error code. These are used in the spoolss (also registry and srvsvc?) pipe dissectors. Also added some helper routines for decoding a range of uint8s. These map nicely to the dissect_{dcerpc,ndr}_foo() format with the addition of a length parameter, but aren't really part of the NDR specification and are probably only going to be used in the NT dcerpc dissectors. svn path=/trunk/; revision=5421
2002-05-09 02:44:22 +00:00
int
dissect_doserror(tvbuff_t *tvb, gint offset, packet_info *pinfo,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
proto_tree *tree, guint8 *drep,
Added a routine to dissect a DOS error code. These are used in the spoolss (also registry and srvsvc?) pipe dissectors. Also added some helper routines for decoding a range of uint8s. These map nicely to the dissect_{dcerpc,ndr}_foo() format with the addition of a length parameter, but aren't really part of the NDR specification and are probably only going to be used in the NT dcerpc dissectors. svn path=/trunk/; revision=5421
2002-05-09 02:44:22 +00:00
int hfindex, guint32 *pdata);
Use policy handle hash code in DCERPC/SMB SAMR dissector. Start to move some common stuff into packet-dcerpc-nt.[ch] svn path=/trunk/; revision=5176
2002-04-17 07:52:26 +00:00
int
dissect_nt_policy_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
proto_tree *tree, guint8 *drep, int hfindex,
In the policy handle hashing, handle more than one policy handle having the same value, as an open might return handle XXX, handle XXX might then be closed, and a subsequent handle might return handle XXX, and we want to keep the two handles distinct to avoid, for example, displaying handles closed before they're opened. In policy handle open replies, store the handle name only if the operation succeeded. We can now do that without parsing the packet twice. Have "dissect_nt_policy_hnd()" optionally return, through a pointer, the protocol tree item for the handle, so that its caller can decorate the item with the name of the handle - that's done on opens, where we do that only if the operation succeeds. svn path=/trunk/; revision=7787
2003-06-05 04:22:04 +00:00
e_ctx_hnd *pdata, proto_item **pitem,
gboolean is_open, gboolean is_close);
Use policy handle hash code in DCERPC/SMB SAMR dissector. Start to move some common stuff into packet-dcerpc-nt.[ch] svn path=/trunk/; revision=5176
2002-04-17 07:52:26 +00:00
LSA dissector updates. Adds a lot of LSA functions to the dissector. Also export dissect-nt-GUID() from netlogon since this structure is common to other interfaces as well. svn path=/trunk/; revision=5181
2002-04-17 09:24:09 +00:00
int
dissect_nt_GUID(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep);
LSA dissector updates. Adds a lot of LSA functions to the dissector. Also export dissect-nt-GUID() from netlogon since this structure is common to other interfaces as well. svn path=/trunk/; revision=5181
2002-04-17 09:24:09 +00:00
Added dissection and support functions for LSAENUMERATEPRIVILEGES function. svn path=/trunk/; revision=5187
2002-04-17 10:29:09 +00:00
int
dissect_nt_LUID(tvbuff_t *tvb, int offset,
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-28 21:04:11 +00:00
packet_info *pinfo, proto_tree *tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep);
Added dissection and support functions for LSAENUMERATEPRIVILEGES function. svn path=/trunk/; revision=5187
2002-04-17 10:29:09 +00:00
Added a routine to dissect a DOS error code. These are used in the spoolss (also registry and srvsvc?) pipe dissectors. Also added some helper routines for decoding a range of uint8s. These map nicely to the dissect_{dcerpc,ndr}_foo() format with the addition of a length parameter, but aren't really part of the NDR specification and are probably only going to be used in the NT dcerpc dissectors. svn path=/trunk/; revision=5421
2002-05-09 02:44:22 +00:00
/* Stored here instead of packet-dcerpc{,-ndr}.c as they are probably not
official NDR representations. */
int dissect_dcerpc_uint8s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
proto_tree *tree, guint8 *drep,
Arguments to hash routines are gconstpointer's; assign them to const pointers. The first argument to "sscanf()" is a "const char *"; don't cast const pointers to "char *" when passing them to "sscanf()". Assign the result of "tvb_get_ptr()" to const pointers, not non-const pointers. Make the "pdata" argument to various DCE routines a const pointer. svn path=/trunk/; revision=6688
2002-11-28 03:57:50 +00:00
int hfindex, int length, const guint8 **pdata);
Added a routine to dissect a DOS error code. These are used in the spoolss (also registry and srvsvc?) pipe dissectors. Also added some helper routines for decoding a range of uint8s. These map nicely to the dissect_{dcerpc,ndr}_foo() format with the addition of a length parameter, but aren't really part of the NDR specification and are probably only going to be used in the NT dcerpc dissectors. svn path=/trunk/; revision=5421
2002-05-09 02:44:22 +00:00
int dissect_ndr_uint8s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
proto_tree *tree, guint8 *drep,
Arguments to hash routines are gconstpointer's; assign them to const pointers. The first argument to "sscanf()" is a "const char *"; don't cast const pointers to "char *" when passing them to "sscanf()". Assign the result of "tvb_get_ptr()" to const pointers, not non-const pointers. Make the "pdata" argument to various DCE routines a const pointer. svn path=/trunk/; revision=6688
2002-11-28 03:57:50 +00:00
int hfindex, int length, const guint8 **pdata);
Added a routine to dissect a DOS error code. These are used in the spoolss (also registry and srvsvc?) pipe dissectors. Also added some helper routines for decoding a range of uint8s. These map nicely to the dissect_{dcerpc,ndr}_foo() format with the addition of a length parameter, but aren't really part of the NDR specification and are probably only going to be used in the NT dcerpc dissectors. svn path=/trunk/; revision=5421
2002-05-09 02:44:22 +00:00
Added dissect_ndr_uint16s() utility function for dissecting a buffer of uint16 values. svn path=/trunk/; revision=5624
2002-06-05 04:17:47 +00:00
int dissect_dcerpc_uint16s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
proto_tree *tree, guint8 *drep,
Get rid of the "pdata" argument to "dissect_dcerpc_uint16s()" and "dissect_ndr_uint16s()"; "dissect_ndr_uint16s()" is always passed a null pointer, "dissect_dcerpc_uint16s()" is only called by "dissect_ndr_uint16s()", and the pointer returned through "pdata" is *NOT* guaranteed to be aligned on a 16-bit boundary so we don't want to tempt people to blithely dereference that pointer. svn path=/trunk/; revision=6699
2002-11-28 21:03:36 +00:00
int hfindex, int length);
Added dissect_ndr_uint16s() utility function for dissecting a buffer of uint16 values. svn path=/trunk/; revision=5624
2002-06-05 04:17:47 +00:00
int dissect_ndr_uint16s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
proto_tree *tree, guint8 *drep,
Get rid of the "pdata" argument to "dissect_dcerpc_uint16s()" and "dissect_ndr_uint16s()"; "dissect_ndr_uint16s()" is always passed a null pointer, "dissect_dcerpc_uint16s()" is only called by "dissect_ndr_uint16s()", and the pointer returned through "pdata" is *NOT* guaranteed to be aligned on a 16-bit boundary so we don't want to tempt people to blithely dereference that pointer. svn path=/trunk/; revision=6699
2002-11-28 21:03:36 +00:00
int hfindex, int length);
Added dissect_ndr_uint16s() utility function for dissecting a buffer of uint16 values. svn path=/trunk/; revision=5624
2002-06-05 04:17:47 +00:00
Defined a useful callback function for dissect_ndr_pointer() which can be used to help out in most DCERPC strings. The cb_str_postprocess() function reads the callback_args and either appends the value of the string to the COL_INFO field, appends it to the NDR pointer item, or saves the string to dcv->private_data. Calling cb_str_postprocess() with CB_STR_ITEM is the same as calling dissect_ndr_pointer() with levels = 0. Renamed some of the pointer dissection functions with a suffix of _cb and created helpers of the original which call the _cb function with NULL args. This should help minimise the amount of code changes in the bulk of the DCERPC dissectors. svn path=/trunk/; revision=7016
2003-01-28 06:27:01 +00:00
int dissect_ndr_str_pointer_item(tvbuff_t *tvb, gint offset,
packet_info *pinfo, proto_tree *tree,
char *drep -> guint8 *drep svn path=/trunk/; revision=9735
2004-01-19 20:10:37 +00:00
guint8 *drep, int type, char *text,
Generalize "cb_str_postprocess()" to allow the string to be appended to items N levels up from the item being processed, and use that to decorate the tree as it was decorated before. svn path=/trunk/; revision=7043
2003-01-30 08:19:39 +00:00
int hf_index, int levels);
Defined a useful callback function for dissect_ndr_pointer() which can be used to help out in most DCERPC strings. The cb_str_postprocess() function reads the callback_args and either appends the value of the string to the COL_INFO field, appends it to the NDR pointer item, or saves the string to dcv->private_data. Calling cb_str_postprocess() with CB_STR_ITEM is the same as calling dissect_ndr_pointer() with levels = 0. Renamed some of the pointer dissection functions with a suffix of _cb and created helpers of the original which call the _cb function with NULL args. This should help minimise the amount of code changes in the bulk of the DCERPC dissectors. svn path=/trunk/; revision=7016
2003-01-28 06:27:01 +00:00
/*
* Helper routines for dissecting NDR strings
*/
Generalize "cb_str_postprocess()" to allow the string to be appended to items N levels up from the item being processed, and use that to decorate the tree as it was decorated before. svn path=/trunk/; revision=7043
2003-01-30 08:19:39 +00:00
/* Number of levels to go up appending string to pointer item */
#define CB_STR_ITEM_LEVELS(x) ((x) & 0xFFFF)
#define CB_STR_COL_INFO 0x10000 /* Append string to COL_INFO */
#define CB_STR_SAVE 0x20000 /* Save string to dcv->private_data */
Defined a useful callback function for dissect_ndr_pointer() which can be used to help out in most DCERPC strings. The cb_str_postprocess() function reads the callback_args and either appends the value of the string to the COL_INFO field, appends it to the NDR pointer item, or saves the string to dcv->private_data. Calling cb_str_postprocess() with CB_STR_ITEM is the same as calling dissect_ndr_pointer() with levels = 0. Renamed some of the pointer dissection functions with a suffix of _cb and created helpers of the original which call the _cb function with NULL args. This should help minimise the amount of code changes in the bulk of the DCERPC dissectors. svn path=/trunk/; revision=7016
2003-01-28 06:27:01 +00:00
Not all strings in MS interfaces are unicode. Rename cb_str_postprocess which handles unicode strings to cb_wstr_postprocess. Add cb_str_postprocess which handles ASCII strings svn path=/trunk/; revision=7572
2003-04-27 00:49:14 +00:00
void cb_wstr_postprocess(packet_info *pinfo, proto_tree *tree _U_,
proto_item *item, tvbuff_t *tvb,
int start_offset, int end_offset,
void *callback_args);
Defined a useful callback function for dissect_ndr_pointer() which can be used to help out in most DCERPC strings. The cb_str_postprocess() function reads the callback_args and either appends the value of the string to the COL_INFO field, appends it to the NDR pointer item, or saves the string to dcv->private_data. Calling cb_str_postprocess() with CB_STR_ITEM is the same as calling dissect_ndr_pointer() with levels = 0. Renamed some of the pointer dissection functions with a suffix of _cb and created helpers of the original which call the _cb function with NULL args. This should help minimise the amount of code changes in the bulk of the DCERPC dissectors. svn path=/trunk/; revision=7016
2003-01-28 06:27:01 +00:00
void cb_str_postprocess(packet_info *pinfo, proto_tree *tree _U_,
proto_item *item, tvbuff_t *tvb,
int start_offset, int end_offset,
void *callback_args);
Perform the initialisation for the NT specific DCERPC dissectors as part of the DCERPC dissector instead of creating a dummy protocol to hang the ett and hf values off. Make the open and close frame values in NT policy handles FT_FRAMENUM's so the "Go to Corresponding Frame" menu item can be used on them. svn path=/trunk/; revision=6995
2003-01-24 05:32:54 +00:00
/* Initialise DCERPC over SMB */
void dcerpc_smb_init(int proto_dcerpc);
From Tim Potter: dissect some of the LSA RPCs stub data. svn path=/trunk/; revision=4407
2001-12-16 20:17:10 +00:00
#endif /* packet-dcerpc-nt.h */