Commit graph

33 commits

Author SHA1 Message Date
Guy Harris
7f5567a605 lsarpc_dissect_sec_desc_buf() and lsarpc_dissect_struct_dom_sid2() are
used in the Netlogon dissector, so don't make them static.

Now that we've added HEADER START/HEADER END to Pidl, use it to declare
those routines in packet-dcerpc-lsa.h.  Don't declare them in
packet-dcerpc-netlogon.c, as they're now declared in the header.

svn path=/trunk/; revision=54723
2014-01-13 21:23:46 +00:00
Guy Harris
7620abccdc Make routines not used outside packet-dcerpc-lsa.c static.
svn path=/trunk/; revision=54712
2014-01-13 19:29:21 +00:00
Michael Mann
e2df7c83cb Move dceprc_procedure_name from packet_info to dcerpc_info. Doesn't appear to be "used" by dissectors, just stored (for help in debugging?).
svn path=/trunk/; revision=53552
2013-11-24 20:55:55 +00:00
Michael Mann
22760b2d2a Remove pinfo->private_data from DCERPC dissectors and instead have dcerpc_info* infomation be passed in as a function parameter. Bug 9387 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9387)
All "generated" source was manually modified (with the power of search/replace), but I believe the "source input" files have been adjusted (checked into revs 53098 and 53099) to reflect the necessary changes (with possible whitespace formatting differences).

The Microsoft compiler doesn't flag "unused function parameters", so I apologize in advance if I may have missed a few.  The "dcerpc_info* di" parameter is used in almost every function.

svn path=/trunk/; revision=53100
2013-11-06 14:31:29 +00:00
Michael Mann
87e55cb9e0 Sync with latest SAMBA PIDL source per http://www.wireshark.org/lists/wireshark-dev/201310/msg00217.html
Didn't integrate
0010-frsrpc-Regenerate-frsrpc-due-to-changes-in-the-pidl-.patch
0016-Regenerate-the-dnserver.patch

due to compilation errors on Windows.

svn path=/trunk/; revision=52744
2013-10-21 19:41:54 +00:00
Michael Mann
0334c5b425 Remove check_col from generated DCE/RPC dissectors. Bug 8804 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8804).
I still couldn't figure out how to generate the source, so I made the modifications to the generated dissectors "manually" (search/replace tool in VS) that would match the "PIDL source" included here.

I will be sending the "PIDL source" (non dissector files) to the samba team.

svn path=/trunk/; revision=52313
2013-10-01 14:45:03 +00:00
Jeff Morriss
2552c750e5 We always HAVE_CONFIG_H so don't bother checking whether we have it or not.
svn path=/trunk/; revision=45017
2012-09-20 02:03:38 +00:00
Jeff Morriss
554ed113a9 Add an SVN Id to these PIDL-generated dissectors. A patch to PIDL will be sent upstream to the Samba developers.
svn path=/trunk/; revision=34713
2010-10-30 14:35:05 +00:00
Jeff Morriss
112fd18410 Make the absolute_time_display_e enum start at 1000 to avoid overlapping with
the base_display_e enum.

Fix a couple of dissectors that were still using FT_ABSOLUTE_TIME with
BASE_NONE.  (The time format chosen is based only on an attempt to not change
the behavior.  I don't know that it's right.)  One of these is built by Pidl.
I'll send a patch upstream too.

When checking hfinfos, display the absolute_time_display_e values too.
Display "bit count: X" instead of "unknown" when the display value doesn't
match one of the enumerated values.

svn path=/trunk/; revision=32552
2010-04-24 19:07:21 +00:00
Ronnie Sahlberg
b4c02070e8 try autogenerate lsa in preparation for updates to the lsa idl file
svn path=/trunk/; revision=31827
2010-02-08 01:48:33 +00:00
Guy Harris
8e236e55de For fields of type FT_ABSOLUTE_TIME, have the "display" value be one of
ABSOLUTE_TIME_LOCAL or ABSOLUTE_TIME_UTC, indicating whether to display
the date/time in local time or UTC. (int)ABSOLUTE_TIME_LOCAL ==
(int)BASE_NONE, so there's no source or binary compatiblity issue,
although we might want to eliminate BASE_NONE at some point and have the
BASE_ values used with integral types start at 0, so that you can't
specify BASE_NONE for an integral field.

svn path=/trunk/; revision=31319
2009-12-19 03:17:44 +00:00
Stig Bjørlykke
33987544f9 Removed some unused prototypes.
svn path=/trunk/; revision=30630
2009-10-20 08:27:25 +00:00
Stig Bjørlykke
fad8c1105e Fixed a signed/unsigned warning.
svn path=/trunk/; revision=30327
2009-10-05 15:16:11 +00:00
Stig Bjørlykke
b228488bc0 From Kovarththanan Rajaratnam via bug 3548:
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
    for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
    FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero

svn path=/trunk/; revision=28770
2009-06-18 21:30:42 +00:00
Ronnie Sahlberg
c61094cca2 Call out to GPEF EFSBLOB from the LSA dissector
svn path=/trunk/; revision=26324
2008-10-01 05:01:59 +00:00
Ronnie Sahlberg
7d2d454373 add description of PolicyServerRole
svn path=/trunk/; revision=26322
2008-10-01 01:42:10 +00:00
Ronnie Sahlberg
f413579fdc add two more constants to the lsa_PolicyInfo enum
add a new constant to the lsa_DomainInfoEnum enum



svn path=/trunk/; revision=26321
2008-10-01 01:28:52 +00:00
Ronnie Sahlberg
3e15613ed6 add the new autogenerated lsa dissector
this changes some call signatures requiring changes to the netlogon 
dissector as well


svn path=/trunk/; revision=26320
2008-10-01 00:48:27 +00:00
Ronnie Sahlberg
011e836f26 dissect lookupnames3
svn path=/trunk/; revision=26299
2008-09-29 22:10:40 +00:00
Ronnie Sahlberg
8fde3b7561 rename dcerpc_smb_store_pol_name to dcerpc_store_polhnd_name
rename dcerpc_smb_fetch_pol  to dcerpc_fetch_polhnd_data and also make 
it take an additional parameter to return the "type" of the policy 
handle, if such a type was stored.

extend the pol_value structure used to track policy handles to also 
store a type to represent what created the policy handle
types could be USER/ALIAS/CONNECT/... etc handles returned from the 
SAMR interface

add a new helper function  dcerpc_store_polhnd_type()

track policy handles between request/responses for dcerpc

update the samr.cnf file to make the samr dissectors for
SetSecurity/QuerySecurity dissect the specific bits for the security 
descriptor correctly based on whether the policy handle refers to a 
CONNECT/DOMAIN/USER/ALIAS or GROUP



svn path=/trunk/; revision=22703
2007-08-28 11:45:08 +00:00
Ronnie Sahlberg
f6976864bf the way we pass dcerpc strings from deep down in helpers to high level dissector functions (dcv->private_data) for things such as strings and sids is a mess and very difficult to handle without a lot of memory leakage.
the biggest problem in changing this is the dcv->private_data usage.


add a dcv->se_data which can keep data around from a request to a response and use this to change the LSA/OpenPolicy2 servername passing from request to response as a test pattern of moving all users of dcv->private data over to use dcv->se_data.

once all users are migrated over we can then change the dcv->private data pointer to be of ep scope and thus not need an explicit free (which is quite difficult and it is quite difficult in the old semantics to know WHEN we need to free this pointer)

this will eventually make the usage more clean and at the same time close down quite a few memory leaks.


eventually this will make dissect_ndr_nt_SID return a pointer to ep allocated memory that need not be explicitely freed.



svn path=/trunk/; revision=19226
2006-09-13 08:30:16 +00:00
Ronnie Sahlberg
feab79e328 change a whole bunch of ethereal into wireshark
svn path=/trunk/; revision=18196
2006-05-21 04:49:01 +00:00
Ronnie Sahlberg
107f59142d the new type of sid/rid structure is for lookupnames2 not lookupnames
svn path=/trunk/; revision=17642
2006-03-16 08:47:19 +00:00
Ronnie Sahlberg
5dd314e53a lookupnames2 takes a different sid structure compared to lookupnames
update it to dissect it as such and create new helpers for the new structure  that takes one extra guint32 at the end of the previous structure.


svn path=/trunk/; revision=17632
2006-03-15 08:26:21 +00:00
Guy Harris
2a8e47b11a Don't ensure all the bytes of a security descriptor exist before calling
"dissect_nt_sec_desc()".  Add a Boolean argument to
"dissect_nt_sec_desc()" to indicate whether a length was passed to it
(so we don't treat -1 as a special value; we want to stop treating -1 as
a special length value, and, in fact, want to stop treating *any*
negative length values specially, so that we don't have to worry about
passing arbitrary 32-bit values from packets as lengths), and have
"dissect_nt_sec_desc()" initially create the protocol tree item for the
security descriptor with a length of "go to the end of the tvbuff", and
set the length once we're done dissecting it - and, if the length was
specified, check at *that* point, *after* we've dissected the security
descriptor, whether we have the entire security descriptor in the
tvbuff.

That means that we don't have to worry about overflows after
"dissect_nt_sec_desc()" returns - if the length was so large that we
would have gotten an overflow, we'd have thrown an exception in the
"tvb_ensure_bytes_exist()" call at the end of "dissect_nt_sec_desc()".

Do sanity checks on offsets within the security descriptor, so we know
the item referred to by the offset is after the fixed-length portion of
the descriptor.

svn path=/trunk/; revision=16113
2005-10-04 10:23:40 +00:00
Ulf Lamping
6f98654a6a bugfix: don't simply use length field value from packet data, ensure the bytes really exist
svn path=/trunk/; revision=15963
2005-09-22 21:09:02 +00:00
Luis Ontanon
4dd73467de some ememification
svn path=/trunk/; revision=15431
2005-08-19 15:35:42 +00:00
Ronnie Sahlberg
bb7160249d rename lsa_dissect_LSA_SECURITY_DESCRIPTOR to lsa_dissect_sec_desc_buf
change its signature to match the autogenerated signatures.

add a small wrapper function so tha tthe handwritten lsa can still call the
function through dissect_ndr_pointer()

no changes in functionality,  essentially just a rename of a function and signature change


svn path=/trunk/; revision=13207
2005-01-30 13:00:35 +00:00
Ronnie Sahlberg
7fc663c738 rename lsa_dissect_LSA_SECURITY_DESCRIPTOR_data to lsa_dissect_sec_desc_buf_data
to make the symbol compatible with an autogenerated LSA dissector.

no changes to the code, just a rename.


svn path=/trunk/; revision=13206
2005-01-30 12:38:38 +00:00
Ronnie Sahlberg
ae9fe25e4f rename lsa_dissect_POLICY_DNS_DOMAIN_INFO to lsa_dissect_DnsDomainInfo and change the signature slightly.
the signature change is to make it compatilbe with the signatures the idl compiler generates.


svn path=/trunk/; revision=13205
2005-01-30 12:21:17 +00:00
Ronnie Sahlberg
610da77693 older MS DCE/RPC interfaces often use a construct that is to be treated as a 64 bit integer but in reality is a struct containing 2 32bit integers.
this construct is aligned on 4 byte boundaries in ndr and NOT
8 bytes as a real uint64 (== hyper) would be.


rename the existing dissect_ndr_uint64  ro  dissect_ndr_duint32  (double uint32) to make it reflect better the alignment of the type.



svn path=/trunk/; revision=13184
2005-01-28 09:29:49 +00:00
Guy Harris
13bb12c4f1 Move a bunch of stuff that's more Windows-related than SMB-related to
"packet-windows-common.[ch]".

svn path=/trunk/; revision=11592
2004-08-03 02:28:49 +00:00
Gilbert Ramirez
669db206cb Move dissectors to epan/dissectors directory.
Also move ncp222.py, x11-fields, process-x11-fields.pl,
make-reg-dotc, and make-reg-dotc.py.

Adjust #include lines in files that include packet-*.h
files.

svn path=/trunk/; revision=11410
2004-07-18 18:06:47 +00:00
Renamed from packet-dcerpc-lsa.c (Browse further)