osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity
wireshark/packet-dcerpc.h

222 lines
7.2 KiB
C
Raw Blame History

/* packet-dcerpc.h
* Copyright 2001, Todd Sabin <tas@webspan.net>
*
* $Id: packet-dcerpc.h,v 1.19 2002/08/28 21:00:12 jmayer Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
* Copyright 1998 Gerald Combs
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*/
#ifndef __PACKET_DCERPC_H__
#define __PACKET_DCERPC_H__
#include <epan/conversation.h>
typedef struct _e_uuid_t {
guint32 Data1;
guint16 Data2;
guint16 Data3;
guint8 Data4[8];
} e_uuid_t;
typedef struct _e_ctx_hnd {
guint32 Data1;
e_uuid_t uuid;
} e_ctx_hnd;
typedef struct _e_dce_cn_common_hdr_t {
guint8 rpc_ver;
guint8 rpc_ver_minor;
guint8 ptype;
guint8 flags;
guint8 drep[4];
guint16 frag_len;
guint16 auth_len;
guint32 call_id;
} e_dce_cn_common_hdr_t;
typedef struct _e_dce_dg_common_hdr_t {
guint8 rpc_ver;
guint8 ptype;
guint8 flags1;
guint8 flags2;
guint8 drep[3];
guint8 serial_hi;
e_uuid_t obj_id;
e_uuid_t if_id;
e_uuid_t act_id;
guint32 server_boot;
guint32 if_ver;
guint32 seqnum;
guint16 opnum;
guint16 ihint;
guint16 ahint;
guint16 frag_len;
guint16 frag_num;
guint8 auth_proto;
guint8 serial_lo;
} e_dce_dg_common_hdr_t;
#define PDU_REQ 0
#define PDU_PING 1
#define PDU_RESP 2
#define PDU_FAULT 3
#define PDU_WORKING 4
#define PDU_NOCALL 5
#define PDU_REJECT 6
#define PDU_ACK 7
#define PDU_CL_CANCEL 8
#define PDU_FACK 9
#define PDU_CANCEL_ACK 10
#define PDU_BIND 11
#define PDU_BIND_ACK 12
#define PDU_BIND_NAK 13
#define PDU_ALTER 14
#define PDU_ALTER_ACK 15
#define PDU_AUTH3 16
#define PDU_SHUTDOWN 17
#define PDU_CO_CANCEL 18
#define PDU_ORPHANED 19
/*
* helpers for packet-dcerpc.c and packet-dcerpc-ndr.c
* If you're writing a subdissector, you almost certainly want the
* NDR functions below.
*/
guint16 dcerpc_tvb_get_ntohs (tvbuff_t *tvb, gint offset, char *drep);
guint32 dcerpc_tvb_get_ntohl (tvbuff_t *tvb, gint offset, char *drep);
void dcerpc_tvb_get_uuid (tvbuff_t *tvb, gint offset, char *drep, e_uuid_t *uuid);
int dissect_dcerpc_uint8 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
int hfindex, guint8 *pdata);
int dissect_dcerpc_uint16 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
int hfindex, guint16 *pdata);
int dissect_dcerpc_uint32 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
int hfindex, guint32 *pdata);
int dissect_dcerpc_uint64 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
int hfindex, unsigned char *pdata);
/*
* NDR routines for subdissectors.
*/
int dissect_ndr_uint8 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
int hfindex, guint8 *pdata);
int dissect_ndr_uint16 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
int hfindex, guint16 *pdata);
int dissect_ndr_uint32 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
int hfindex, guint32 *pdata);
int dissect_ndr_uint64 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
int hfindex, unsigned char *pdata);
int dissect_ndr_uuid_t (tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
int hfindex, e_uuid_t *pdata);
int dissect_ndr_ctx_hnd (tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
int hfindex, e_ctx_hnd *pdata);
typedef int (dcerpc_dissect_fnct_t)(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep);
#define NDR_POINTER_REF 1
#define NDR_POINTER_UNIQUE 2
#define NDR_POINTER_PTR 3
int dissect_ndr_pointer (tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
dcerpc_dissect_fnct_t *fnct, int type, char *text, int hf_index, int levels);
/* dissect a NDR unidimensional conformant array */
int dissect_ndr_ucarray(tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
dcerpc_dissect_fnct_t *fnct);
/* dissect a NDR unidimensional conformant and varying array */
int dissect_ndr_ucvarray(tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
dcerpc_dissect_fnct_t *fnct);
typedef struct _dcerpc_sub_dissector {
guint16 num;
gchar *name;
dcerpc_dissect_fnct_t *dissect_rqst;
dcerpc_dissect_fnct_t *dissect_resp;
} dcerpc_sub_dissector;
/* registration function for subdissectors */
void dcerpc_init_uuid (int proto, int ett, e_uuid_t *uuid, guint16 ver, dcerpc_sub_dissector *procs, int opnum_hf);
/* Private data structure to pass to DCERPC dissector. This is used to
pass transport specific information down to the dissector from the
dissector that parsed this encapsulated calls. */
#define DCERPC_TRANSPORT_SMB 1
typedef struct _dcerpc_private_info {
int transport_type; /* Tag */
union {
struct { /* DCERPC_TRANSPORT_SMB */
guint16 fid;
} smb;
} data;
} dcerpc_private_info;
/* Private data passed to subdissectors from the main DCERPC dissector. */
typedef struct _dcerpc_call_value {
e_uuid_t uuid;
guint16 ver;
guint16 opnum;
guint32 req_frame;
guint32 rep_frame;
guint32 max_ptr;
void *private_data;
} dcerpc_call_value;
typedef struct _dcerpc_info {
conversation_t *conv; /* Which TCP stream we are in */
guint32 call_id; /* Context id for this call */
guint16 smb_fid; /* FID for DCERPC over SMB */
gboolean request;
gboolean conformant_run;
gint32 conformant_eaten; /* how many bytes did the conformant run eat?*/
guint32 array_max_count; /* max_count for conformant arrays */
guint32 array_max_count_offset;
guint32 array_offset;
guint32 array_offset_offset;
guint32 array_actual_count;
guint32 array_actual_count_offset;
int hf_index;
int levels; /* number of levels upwards in the tree to append text*/
dcerpc_call_value *call_data;
void *private_data;
} dcerpc_info;
#endif /* packet-dcerpc.h */
View Git Blame Copy Permalink