2001-12-16 20:17:10 +00:00
|
|
|
/* packet-dcerpc-nt.h
|
|
|
|
* Routines for DCERPC over SMB packet disassembly
|
|
|
|
* Copyright 2001, Tim Potter <tpot@samba.org>
|
|
|
|
*
|
2002-04-17 09:24:09 +00:00
|
|
|
* $Id: packet-dcerpc-nt.h,v 1.19 2002/04/17 09:24:09 sahlberg Exp $
|
2001-12-16 20:17:10 +00:00
|
|
|
*
|
|
|
|
* Ethereal - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@ethereal.com>
|
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef __PACKET_DCERPC_NT_H
|
|
|
|
#define __PACKET_DCEPRC_NT_H
|
|
|
|
|
|
|
|
/* Routines for parsing simple types */
|
|
|
|
|
|
|
|
int prs_align(int offset, int n);
|
|
|
|
|
|
|
|
int prs_uint8(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, guint8 *data, char *name);
|
|
|
|
|
|
|
|
int prs_uint8s(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
There is no guarantee that a buffer obtained using "tvb_get_ptr()" is
neatly aligned on a 2-byte or a 4-byte boundary, and there is no
guarantee that a misaligned pointer can be dereferenced without getting
a fault.
Furthermore, there is no guarantee that, even if you *can* dereference a
pointer to a 2-byte or 4-byte quantity in a packet, the resulting number
you get back is in the right byte order; the data in the packet might
have a different byte order from the machine on which you're running.
Therefore, we change "prs_uint8s()", "prs_uint16s()", and
"prs_uint32s()" to return the starting offset, in the tvbuff, of the
collection of 8-bit, 16-bit, or 32-bit integral values, rather than a
pointer to the raw packet data, and change their callers to fetch the
data using "tvb_get_guint8()", "tvb_get_letohs()", and
"tvb_get_letohl()" (the stuff in all the NT protocols is presumed to be
little-endian here). We also change "fake_unicode()" to take a tvbuff
and an offset, rather than a data pointer, as arguments, and to use
"tvb_get_letohs()" to fetch the Unicode characters (again, we assume
little-endian Unicode).
This requires "fake_unicode()" to establish a cleanup handler, so we
don't leak memory if it throws an exception.
We also make "fake_unicode()" use "g_malloc()" to allocate its buffer
(we weren't checking for allocation failures in any case; with
"g_malloc()", we'll abort on an allocation failure - if we can come up
with a cleverer way of handling them, fine), and the matching frees to
use "g_free()". (We also insert some missing frees....)
Fix some formats to print unsigned quantities with "%u", not "%d".
Don't append text to items in the tree for non-string values in
"dissect_ndr_nt_STRING_string()".
svn path=/trunk/; revision=4986
2002-03-19 22:09:23 +00:00
|
|
|
proto_tree *tree, int count, int *data_offset, char *name);
|
2001-12-16 20:17:10 +00:00
|
|
|
|
|
|
|
int prs_uint16(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, guint16 *data, char *name);
|
|
|
|
|
|
|
|
int prs_uint16s(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
There is no guarantee that a buffer obtained using "tvb_get_ptr()" is
neatly aligned on a 2-byte or a 4-byte boundary, and there is no
guarantee that a misaligned pointer can be dereferenced without getting
a fault.
Furthermore, there is no guarantee that, even if you *can* dereference a
pointer to a 2-byte or 4-byte quantity in a packet, the resulting number
you get back is in the right byte order; the data in the packet might
have a different byte order from the machine on which you're running.
Therefore, we change "prs_uint8s()", "prs_uint16s()", and
"prs_uint32s()" to return the starting offset, in the tvbuff, of the
collection of 8-bit, 16-bit, or 32-bit integral values, rather than a
pointer to the raw packet data, and change their callers to fetch the
data using "tvb_get_guint8()", "tvb_get_letohs()", and
"tvb_get_letohl()" (the stuff in all the NT protocols is presumed to be
little-endian here). We also change "fake_unicode()" to take a tvbuff
and an offset, rather than a data pointer, as arguments, and to use
"tvb_get_letohs()" to fetch the Unicode characters (again, we assume
little-endian Unicode).
This requires "fake_unicode()" to establish a cleanup handler, so we
don't leak memory if it throws an exception.
We also make "fake_unicode()" use "g_malloc()" to allocate its buffer
(we weren't checking for allocation failures in any case; with
"g_malloc()", we'll abort on an allocation failure - if we can come up
with a cleverer way of handling them, fine), and the matching frees to
use "g_free()". (We also insert some missing frees....)
Fix some formats to print unsigned quantities with "%u", not "%d".
Don't append text to items in the tree for non-string values in
"dissect_ndr_nt_STRING_string()".
svn path=/trunk/; revision=4986
2002-03-19 22:09:23 +00:00
|
|
|
proto_tree *tree, int count, int *data_offset, char *name);
|
2001-12-16 20:17:10 +00:00
|
|
|
|
|
|
|
int prs_uint32(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, guint32 *data, char *name);
|
|
|
|
|
|
|
|
int prs_uint32s(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
There is no guarantee that a buffer obtained using "tvb_get_ptr()" is
neatly aligned on a 2-byte or a 4-byte boundary, and there is no
guarantee that a misaligned pointer can be dereferenced without getting
a fault.
Furthermore, there is no guarantee that, even if you *can* dereference a
pointer to a 2-byte or 4-byte quantity in a packet, the resulting number
you get back is in the right byte order; the data in the packet might
have a different byte order from the machine on which you're running.
Therefore, we change "prs_uint8s()", "prs_uint16s()", and
"prs_uint32s()" to return the starting offset, in the tvbuff, of the
collection of 8-bit, 16-bit, or 32-bit integral values, rather than a
pointer to the raw packet data, and change their callers to fetch the
data using "tvb_get_guint8()", "tvb_get_letohs()", and
"tvb_get_letohl()" (the stuff in all the NT protocols is presumed to be
little-endian here). We also change "fake_unicode()" to take a tvbuff
and an offset, rather than a data pointer, as arguments, and to use
"tvb_get_letohs()" to fetch the Unicode characters (again, we assume
little-endian Unicode).
This requires "fake_unicode()" to establish a cleanup handler, so we
don't leak memory if it throws an exception.
We also make "fake_unicode()" use "g_malloc()" to allocate its buffer
(we weren't checking for allocation failures in any case; with
"g_malloc()", we'll abort on an allocation failure - if we can come up
with a cleverer way of handling them, fine), and the matching frees to
use "g_free()". (We also insert some missing frees....)
Fix some formats to print unsigned quantities with "%u", not "%d".
Don't append text to items in the tree for non-string values in
"dissect_ndr_nt_STRING_string()".
svn path=/trunk/; revision=4986
2002-03-19 22:09:23 +00:00
|
|
|
proto_tree *tree, int count, int *data_offset, char *name);
|
2001-12-16 20:17:10 +00:00
|
|
|
|
|
|
|
/* Parse NT status code */
|
|
|
|
|
|
|
|
int prs_ntstatus(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree);
|
|
|
|
|
|
|
|
/* Parse some common RPC structures */
|
|
|
|
|
There is no guarantee that a buffer obtained using "tvb_get_ptr()" is
neatly aligned on a 2-byte or a 4-byte boundary, and there is no
guarantee that a misaligned pointer can be dereferenced without getting
a fault.
Furthermore, there is no guarantee that, even if you *can* dereference a
pointer to a 2-byte or 4-byte quantity in a packet, the resulting number
you get back is in the right byte order; the data in the packet might
have a different byte order from the machine on which you're running.
Therefore, we change "prs_uint8s()", "prs_uint16s()", and
"prs_uint32s()" to return the starting offset, in the tvbuff, of the
collection of 8-bit, 16-bit, or 32-bit integral values, rather than a
pointer to the raw packet data, and change their callers to fetch the
data using "tvb_get_guint8()", "tvb_get_letohs()", and
"tvb_get_letohl()" (the stuff in all the NT protocols is presumed to be
little-endian here). We also change "fake_unicode()" to take a tvbuff
and an offset, rather than a data pointer, as arguments, and to use
"tvb_get_letohs()" to fetch the Unicode characters (again, we assume
little-endian Unicode).
This requires "fake_unicode()" to establish a cleanup handler, so we
don't leak memory if it throws an exception.
We also make "fake_unicode()" use "g_malloc()" to allocate its buffer
(we weren't checking for allocation failures in any case; with
"g_malloc()", we'll abort on an allocation failure - if we can come up
with a cleverer way of handling them, fine), and the matching frees to
use "g_free()". (We also insert some missing frees....)
Fix some formats to print unsigned quantities with "%u", not "%d".
Don't append text to items in the tree for non-string values in
"dissect_ndr_nt_STRING_string()".
svn path=/trunk/; revision=4986
2002-03-19 22:09:23 +00:00
|
|
|
char *fake_unicode(tvbuff_t *tvb, int offset, int len);
|
2002-01-03 20:42:41 +00:00
|
|
|
|
2001-12-16 20:17:10 +00:00
|
|
|
int prs_UNISTR2(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, int flags, char **data, char *name);
|
|
|
|
|
|
|
|
int prs_policy_hnd(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
2002-01-03 20:42:41 +00:00
|
|
|
proto_tree *tree, const guint8 **data);
|
2001-12-16 20:17:10 +00:00
|
|
|
|
|
|
|
/* Routines for handling deferral of referants in NDR */
|
|
|
|
|
|
|
|
#define PARSE_SCALARS 1
|
|
|
|
#define PARSE_BUFFERS 2
|
|
|
|
|
|
|
|
int prs_push_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, GList **ptr_list, char *name);
|
|
|
|
|
|
|
|
guint32 prs_pop_ptr(GList **ptr_list, char *name);
|
|
|
|
|
2002-03-06 08:58:01 +00:00
|
|
|
|
2002-03-14 10:04:02 +00:00
|
|
|
|
2002-03-06 08:58:01 +00:00
|
|
|
#define ALIGN_TO_4_BYTES {if(offset&0x03)offset=(offset&0xfffffffc)+4;}
|
|
|
|
|
|
|
|
int
|
|
|
|
dissect_ndr_nt_UNICODE_STRING_str(tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *tree,
|
|
|
|
char *drep);
|
|
|
|
int
|
|
|
|
dissect_ndr_nt_UNICODE_STRING(tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *parent_tree,
|
|
|
|
char *drep, int hf_index, int levels);
|
2002-03-11 00:15:20 +00:00
|
|
|
int
|
|
|
|
dissect_ndr_nt_STRING_string (tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *tree,
|
|
|
|
char *drep);
|
|
|
|
int
|
|
|
|
dissect_ndr_nt_STRING (tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *parent_tree,
|
|
|
|
char *drep, int hf_index, int levels);
|
2002-03-06 10:01:17 +00:00
|
|
|
int
|
|
|
|
dissect_ndr_nt_acct_ctrl(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *parent_tree, char *drep);
|
2002-03-10 23:24:48 +00:00
|
|
|
int
|
|
|
|
dissect_ndr_nt_NTTIME (tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *tree,
|
|
|
|
char *drep, int hf_index);
|
2002-03-11 00:00:15 +00:00
|
|
|
int
|
|
|
|
dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *parent_tree,
|
|
|
|
char *drep);
|
2002-03-11 00:28:21 +00:00
|
|
|
int
|
|
|
|
dissect_ndr_nt_SID(tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *tree,
|
|
|
|
char *drep);
|
|
|
|
int
|
|
|
|
dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *parent_tree,
|
|
|
|
char *drep);
|
|
|
|
int
|
|
|
|
dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *parent_tree,
|
|
|
|
char *drep);
|
|
|
|
|
|
|
|
int
|
|
|
|
dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *parent_tree,
|
|
|
|
char *drep);
|
|
|
|
int
|
|
|
|
dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *parent_tree,
|
|
|
|
char *drep);
|
|
|
|
|
2002-03-25 05:42:02 +00:00
|
|
|
/*
|
|
|
|
* Policy handle hashing
|
|
|
|
*/
|
|
|
|
|
|
|
|
gboolean
|
|
|
|
dcerpc_smb_fetch_pol(const guint8 *policy_hnd, char **name,
|
|
|
|
int *open_frame, int *close_frame);
|
|
|
|
void
|
|
|
|
dcerpc_smb_store_pol(const guint8 *policy_hnd, char *name, int open_frame,
|
|
|
|
int close_frame);
|
|
|
|
|
|
|
|
/* Check for unparsed data at the end of a frame */
|
2002-03-11 00:00:15 +00:00
|
|
|
|
2002-03-25 05:42:02 +00:00
|
|
|
void
|
|
|
|
dcerpc_smb_check_long_frame(tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *tree);
|
2002-03-06 08:58:01 +00:00
|
|
|
|
2002-03-26 05:20:51 +00:00
|
|
|
void
|
|
|
|
dcerpc_smb_init(void);
|
|
|
|
|
2002-04-16 02:02:04 +00:00
|
|
|
/* Dissect NT specific things */
|
|
|
|
|
|
|
|
int
|
|
|
|
dissect_ntstatus(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, char *drep,
|
|
|
|
int hfindex, guint32 *pdata);
|
|
|
|
|
2002-04-17 07:52:26 +00:00
|
|
|
int
|
|
|
|
dissect_nt_policy_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, char *drep, int hfindex,
|
|
|
|
e_ctx_hnd *pdata);
|
|
|
|
|
2002-04-17 09:24:09 +00:00
|
|
|
int
|
|
|
|
dissect_nt_GUID(tvbuff_t *tvb, int offset,
|
|
|
|
packet_info *pinfo, proto_tree *parent_tree,
|
|
|
|
char *drep);
|
|
|
|
|
2001-12-16 20:17:10 +00:00
|
|
|
#endif /* packet-dcerpc-nt.h */
|