2003-06-25 10:33:10 +00:00
|
|
|
/* packet-dcerpc-messenger.c
|
2003-09-27 23:45:25 +00:00
|
|
|
* Routines for SMB \PIPE\msgsvc packet disassembly
|
2003-06-25 10:33:10 +00:00
|
|
|
* Copyright 2003 Ronnie Sahlberg
|
|
|
|
*
|
2006-05-21 04:49:01 +00:00
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
2003-06-25 10:33:10 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
2018-02-12 11:23:27 +00:00
|
|
|
* SPDX-License-Identifier: GPL-2.0-or-later
|
2003-06-25 10:33:10 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
#include "config.h"
|
|
|
|
|
2014-12-20 21:23:59 +00:00
|
|
|
#include <epan/packet.h>
|
2003-06-25 10:33:10 +00:00
|
|
|
#include "packet-dcerpc.h"
|
2003-06-26 10:31:18 +00:00
|
|
|
#include "packet-dcerpc-nt.h"
|
2004-08-03 02:28:49 +00:00
|
|
|
#include "packet-windows-common.h"
|
2003-06-25 10:33:10 +00:00
|
|
|
|
2013-12-14 12:45:57 +00:00
|
|
|
void proto_register_dcerpc_messenger(void);
|
|
|
|
void proto_reg_handoff_dcerpc_messenger(void);
|
2003-06-25 10:33:10 +00:00
|
|
|
|
|
|
|
static int proto_dcerpc_messenger = -1;
|
|
|
|
static int hf_messenger_opnum = -1;
|
2003-06-26 10:31:18 +00:00
|
|
|
static int hf_messenger_rc = -1;
|
|
|
|
static int hf_messenger_server = -1;
|
|
|
|
static int hf_messenger_client = -1;
|
|
|
|
static int hf_messenger_message = -1;
|
2003-06-25 10:33:10 +00:00
|
|
|
|
|
|
|
static gint ett_dcerpc_messenger = -1;
|
|
|
|
|
2003-09-27 23:45:25 +00:00
|
|
|
|
|
|
|
/* Windows messenger service listens on two endpoints:
|
|
|
|
* \pipe\msgsvc named pipe
|
|
|
|
* a dynamic UDP port
|
|
|
|
*/
|
|
|
|
|
2015-03-03 10:47:53 +00:00
|
|
|
static e_guid_t uuid_dcerpc_messenger = {
|
2014-09-30 23:12:26 +00:00
|
|
|
0x5a7b91f8, 0xff00, 0x11d0,
|
|
|
|
{ 0xa9, 0xb2, 0x00, 0xc0, 0x4f, 0xb6, 0xe6, 0xfc}
|
2003-06-25 10:33:10 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
static guint16 ver_dcerpc_messenger = 1;
|
|
|
|
|
2003-06-26 10:31:18 +00:00
|
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
* IDL [in][string][ref] char *server;
|
|
|
|
* IDL [in][string][ref] char *client;
|
|
|
|
* IDL [in][string][ref] char *message;
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
messenger_dissect_send_message_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
2013-11-06 14:31:29 +00:00
|
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
2003-06-26 10:31:18 +00:00
|
|
|
{
|
2014-09-30 23:12:26 +00:00
|
|
|
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep,
|
2003-06-26 10:31:18 +00:00
|
|
|
dissect_ndr_char_cvstring, NDR_POINTER_REF,
|
|
|
|
"Server", hf_messenger_server);
|
2014-09-30 23:12:26 +00:00
|
|
|
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep,
|
2003-06-26 10:31:18 +00:00
|
|
|
dissect_ndr_char_cvstring, NDR_POINTER_REF,
|
|
|
|
"Client", hf_messenger_client);
|
2014-09-30 23:12:26 +00:00
|
|
|
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep,
|
2003-06-26 10:31:18 +00:00
|
|
|
dissect_ndr_char_cvstring, NDR_POINTER_REF,
|
|
|
|
"Message", hf_messenger_message);
|
|
|
|
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
static int
|
|
|
|
messenger_dissect_send_message_reply(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
2016-04-15 17:17:07 +00:00
|
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
2003-06-26 10:31:18 +00:00
|
|
|
{
|
2014-09-30 23:12:26 +00:00
|
|
|
offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep,
|
2003-06-26 10:31:18 +00:00
|
|
|
hf_messenger_rc, NULL);
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-25 10:33:10 +00:00
|
|
|
static dcerpc_sub_dissector dcerpc_messenger_dissectors[] = {
|
2014-09-30 23:12:26 +00:00
|
|
|
{0, "NetrSendMessage",
|
2003-06-26 10:31:18 +00:00
|
|
|
messenger_dissect_send_message_rqst,
|
|
|
|
messenger_dissect_send_message_reply },
|
2014-09-30 23:12:26 +00:00
|
|
|
{0, NULL, NULL, NULL }
|
2003-06-25 10:33:10 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
void
|
|
|
|
proto_register_dcerpc_messenger(void)
|
|
|
|
{
|
2014-09-30 23:12:26 +00:00
|
|
|
static hf_register_info hf[] = {
|
2003-06-25 10:33:10 +00:00
|
|
|
|
|
|
|
{ &hf_messenger_opnum,
|
|
|
|
{ "Operation", "messenger.opnum", FT_UINT16, BASE_DEC,
|
From Kovarththanan Rajaratnam via bug 3548:
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
2009-06-18 21:30:42 +00:00
|
|
|
NULL, 0x0, NULL, HFILL }},
|
2003-06-26 10:31:18 +00:00
|
|
|
|
2014-09-30 23:12:26 +00:00
|
|
|
{ &hf_messenger_rc,
|
|
|
|
{ "Return code", "messenger.rc", FT_UINT32, BASE_HEX | BASE_EXT_STRING, &NT_errors_ext, 0x0, NULL, HFILL }},
|
2003-06-26 10:31:18 +00:00
|
|
|
|
|
|
|
{ &hf_messenger_server, {
|
2013-10-13 19:56:52 +00:00
|
|
|
"Server", "messenger.server",
|
2003-06-26 10:31:18 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0, "Server to send the message to", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_messenger_client, {
|
2013-10-13 19:56:52 +00:00
|
|
|
"Client", "messenger.client",
|
2003-06-26 10:31:18 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0, "Client that sent the message", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_messenger_message, {
|
2013-10-13 19:56:52 +00:00
|
|
|
"Message", "messenger.message",
|
2003-06-26 10:31:18 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0, "The message being sent", HFILL }}
|
2003-06-25 10:33:10 +00:00
|
|
|
|
2014-09-30 23:12:26 +00:00
|
|
|
};
|
2003-06-25 10:33:10 +00:00
|
|
|
|
2014-09-30 23:12:26 +00:00
|
|
|
static gint *ett[] = {
|
|
|
|
&ett_dcerpc_messenger
|
|
|
|
};
|
2003-06-25 10:33:10 +00:00
|
|
|
|
2014-09-30 23:12:26 +00:00
|
|
|
proto_dcerpc_messenger = proto_register_protocol(
|
|
|
|
"Microsoft Messenger Service", "Messenger", "messenger");
|
2003-06-25 10:33:10 +00:00
|
|
|
|
2014-09-30 23:12:26 +00:00
|
|
|
proto_register_field_array (proto_dcerpc_messenger, hf, array_length (hf));
|
|
|
|
proto_register_subtree_array(ett, array_length(ett));
|
2003-06-25 10:33:10 +00:00
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
proto_reg_handoff_dcerpc_messenger(void)
|
|
|
|
{
|
2014-09-30 23:12:26 +00:00
|
|
|
/* Register protocol as dcerpc */
|
2003-06-25 10:33:10 +00:00
|
|
|
|
2014-09-30 23:12:26 +00:00
|
|
|
dcerpc_init_uuid(proto_dcerpc_messenger, ett_dcerpc_messenger, &uuid_dcerpc_messenger,
|
|
|
|
ver_dcerpc_messenger, dcerpc_messenger_dissectors, hf_messenger_opnum);
|
2003-06-25 10:33:10 +00:00
|
|
|
}
|
2014-09-30 23:12:26 +00:00
|
|
|
|
|
|
|
/*
|
2019-07-26 18:43:17 +00:00
|
|
|
* Editor modelines - https://www.wireshark.org/tools/modelines.html
|
2014-09-30 23:12:26 +00:00
|
|
|
*
|
|
|
|
* Local variables:
|
|
|
|
* c-basic-offset: 8
|
|
|
|
* tab-width: 8
|
|
|
|
* indent-tabs-mode: t
|
|
|
|
* End:
|
|
|
|
*
|
|
|
|
* vi: set shiftwidth=8 tabstop=8 noexpandtab:
|
|
|
|
* :indentSize=8:tabSize=8:noTabs=false:
|
|
|
|
*/
|