osmocom
/
wireshark
14
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

From Ronnie Sahlberg: 

NDR pointer handling in DCE RPC
	SAMR updates

svn path=/trunk/; revision=4608
This commit is contained in:
Guy Harris 2002-01-25 08:35:59 +00:00
parent 7f0ef5ec87
commit 55bed21e45
7 changed files with 975 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
AUTHORS
View File

@ -573,6 +573,8 @@ Ronnie Sahlberg <sahlberg[AT]optushome.com.au> {
File handle to file name resolution in NFS and realted protocols
In DCE RPC dissector, add support for finding the response that
matches a request
NDR pointer handling in DCE RPC
SAMR updates
}
Borosa Tomislav <tomislav.borosa[AT]SIEMENS.HR> {

3
packet-dcerpc-ndr.c
View File

@ -2,7 +2,7 @@
* Routines for DCERPC NDR dissection
* Copyright 2001, Todd Sabin <tas@webspan.net>
*
* $Id: packet-dcerpc-ndr.c,v 1.3 2002/01/21 07:36:33 guy Exp $
* $Id: packet-dcerpc-ndr.c,v 1.4 2002/01/25 08:35:59 guy Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
@ -128,4 +128,3 @@ dissect_ndr_ctx_hnd (tvbuff_t *tvb, gint offset, packet_info *pinfo,
}
return offset + 20;
}

160
packet-dcerpc-nt.c
View File

@ -2,7 +2,7 @@
* Routines for DCERPC over SMB packet disassembly
* Copyright 2001, Tim Potter <tpot@samba.org>
*
* $Id: packet-dcerpc-nt.c,v 1.4 2002/01/21 07:36:33 guy Exp $
* $Id: packet-dcerpc-nt.c,v 1.5 2002/01/25 08:35:59 guy Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
@ -390,3 +390,161 @@ int prs_policy_hnd(tvbuff_t *tvb, int offset, packet_info *pinfo,
return offset + 20;
}
/* functions to dissect a UNICODE_STRING structure, common to many
NT services
struct {
short len;
short size;
[size_is(size/2), length_is(len/2), ptr] unsigned short *string;
} UNICODE_STRING;
these variables can be found in packet-dcerpc-samr.c
*/
extern int hf_nt_str_len;
extern int hf_nt_str_off;
extern int hf_nt_str_max_len;
extern int hf_nt_string_length;
extern int hf_nt_string_size;
extern gint ett_nt_unicode_string;
static int
dissect_ndr_nt_UNICODE_STRING_string (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep)
{
guint32 len, off, max_len;
guint16 *data16;
char *text;
int old_offset;
dcerpc_info *di;
header_field_info *hfi;
di=pinfo->private_data;
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_nt_str_len, &len);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_nt_str_off, &off);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_nt_str_max_len, &max_len);
old_offset=offset;
offset = prs_uint16s(tvb, offset, pinfo, tree, max_len, &data16, NULL);
text = fake_unicode(data16, max_len);
hfi = proto_registrar_get_nth(di->hf_index);
proto_tree_add_string_format(tree, di->hf_index,
tvb, old_offset, offset-old_offset,
text, "%s: %s", hfi->name, text);
if(tree){
proto_item_set_text(tree, "%s: %s", hfi->name, text);
proto_item_set_text(tree->parent, "%s: %s", hfi->name, text);
}
return offset;
}
int
dissect_ndr_nt_UNICODE_STRING (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep, int hf_index)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
int old_offset=offset;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
"Unicode String");
tree = proto_item_add_subtree(item, ett_nt_unicode_string);
}
offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
hf_nt_string_length, NULL);
offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
hf_nt_string_size, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
dissect_ndr_nt_UNICODE_STRING_string, NDR_POINTER_PTR,
hf_index);
proto_item_set_len(item, offset-old_offset);
return offset;
}
/* functions to dissect a STRING structure, common to many
NT services
struct {
short len;
short size;
[size_is(size), length_is(len), ptr] char *string;
} STRING;
*/
static int
dissect_ndr_nt_STRING_string (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep)
{
guint32 len, off, max_len;
guint8 *text;
int old_offset;
dcerpc_info *di;
header_field_info *hfi;
di=pinfo->private_data;
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_nt_str_len, &len);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_nt_str_off, &off);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_nt_str_max_len, &max_len);
old_offset=offset;
offset = prs_uint8s(tvb, offset, pinfo, tree, max_len, &text, NULL);
hfi = proto_registrar_get_nth(di->hf_index);
proto_tree_add_string_format(tree, di->hf_index,
tvb, old_offset, offset-old_offset,
text, "%s: %s", hfi->name, text);
if(tree){
proto_item_set_text(tree, "%s: %s", hfi->name, text);
proto_item_set_text(tree->parent, "%s: %s", hfi->name, text);
}
return offset;
}
int
dissect_ndr_nt_STRING (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep, int hf_index)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
int old_offset=offset;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
"Unicode String");
tree = proto_item_add_subtree(item, ett_nt_unicode_string);
}
offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
hf_nt_string_length, NULL);
offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
hf_nt_string_size, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
dissect_ndr_nt_STRING_string, NDR_POINTER_PTR,
hf_index);
proto_item_set_len(item, offset-old_offset);
return offset;
}

9
packet-dcerpc-nt.h
View File

@ -2,7 +2,7 @@
* Routines for DCERPC over SMB packet disassembly
* Copyright 2001, Tim Potter <tpot@samba.org>
*
* $Id: packet-dcerpc-nt.h,v 1.2 2002/01/03 20:42:40 guy Exp $
* $Id: packet-dcerpc-nt.h,v 1.3 2002/01/25 08:35:59 guy Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
@ -73,4 +73,11 @@ int prs_push_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo,
guint32 prs_pop_ptr(GList **ptr_list, char *name);
int dissect_ndr_nt_UNICODE_STRING (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep, int hf_index);
int dissect_ndr_nt_STRING (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep, int hf_index);
#endif /* packet-dcerpc-nt.h */

495
packet-dcerpc-samr.c
View File

@ -2,7 +2,7 @@
* Routines for SMB \\PIPE\\samr packet disassembly
* Copyright 2001, Tim Potter <tpot@samba.org>
*
* $Id: packet-dcerpc-samr.c,v 1.3 2002/01/21 07:36:33 guy Exp $
* $Id: packet-dcerpc-samr.c,v 1.4 2002/01/25 08:35:59 guy Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
@ -30,6 +30,7 @@
#include <glib.h>
#include <epan/packet.h>
#include "packet-dcerpc.h"
#include "packet-dcerpc-nt.h"
#include "packet-dcerpc-samr.h"
#include "smb.h" /* for "NT_errors[]" */
@ -39,8 +40,31 @@ static int hf_samr_hnd = -1;
static int hf_samr_perms = -1;
static int hf_samr_rid = -1;
static int hf_samr_rc = -1;
static int hf_samr_index = -1;
static int hf_samr_acct_ctrl = -1;
static int hf_samr_array_max_count = -1;
static int hf_samr_level = -1;
static int hf_samr_start_idx = -1;
static int hf_samr_max_entries = -1;
static int hf_samr_pref_maxsize = -1;
static int hf_samr_total_size = -1;
static int hf_samr_ret_size = -1;
static int hf_samr_acct_name = -1;
static int hf_samr_full_name = -1;
static int hf_samr_acct_desc = -1;
/* these are used by functions in packet-dcerpc-nt.c */
int hf_nt_str_len = -1;
int hf_nt_str_off = -1;
int hf_nt_str_max_len = -1;
int hf_nt_string_length = -1;
int hf_nt_string_size = -1;
static gint ett_dcerpc_samr = -1;
gint ett_nt_unicode_string = -1; /* used by packet-dcerpc-nt.c*/
static gint ett_samr_user_dispinfo_1 = -1;
static e_uuid_t uuid_dcerpc_samr = {
0x12345778, 0x1234, 0xabcd,
@ -86,6 +110,402 @@ samr_dissect_open_user_rqst (tvbuff_t *tvb, int offset,
}
static int
samr_dissect_query_dispinfo_level (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep)
{
offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
hf_samr_level, NULL);
return offset;
}
static int
samr_dissect_query_dispinfo_rqst (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep)
{
offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
hf_samr_hnd, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
samr_dissect_query_dispinfo_level, NDR_POINTER_REF,
-1);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_start_idx, NULL);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_max_entries, NULL);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_pref_maxsize, NULL);
return offset;
}
static int
samr_dissect_USER_DISPINFO_1 (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
int old_offset=offset;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
"User_DispInfo_1");
tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
}
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_index, NULL);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_rid, NULL);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_acct_ctrl, NULL);
offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
hf_samr_acct_name);
offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
hf_samr_full_name);
offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
hf_samr_acct_desc);
proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
samr_dissect_USER_DISPINFO_1_ARRAY_users (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep)
{
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
samr_dissect_USER_DISPINFO_1);
return offset;
}
static int
samr_dissect_USER_DISPINFO_1_ARRAY (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep)
{
guint32 count;
proto_item *item=NULL;
proto_tree *tree=NULL;
int old_offset=offset;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
"User_DispInfo_1 Array");
tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
}
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_array_max_count, &count);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
samr_dissect_USER_DISPINFO_1_ARRAY_users, NDR_POINTER_PTR,
-1);
proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
samr_dissect_USER_DISPINFO_2 (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
int old_offset=offset;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
"User_DispInfo_2");
tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
}
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_index, NULL);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_rid, NULL);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_acct_ctrl, NULL);
offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
hf_samr_acct_name);
offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
hf_samr_acct_desc);
proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
samr_dissect_USER_DISPINFO_2_ARRAY_users (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep)
{
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
samr_dissect_USER_DISPINFO_2);
return offset;
}
static int
samr_dissect_USER_DISPINFO_2_ARRAY (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep)
{
guint32 count;
proto_item *item=NULL;
proto_tree *tree=NULL;
int old_offset=offset;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
"User_DispInfo_2 Array");
tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
}
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_array_max_count, &count);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
samr_dissect_USER_DISPINFO_2_ARRAY_users, NDR_POINTER_PTR,
-1);
proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
samr_dissect_GROUP_DISPINFO (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
int old_offset=offset;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
"Group_DispInfo");
tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
}
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_index, NULL);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_rid, NULL);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_acct_ctrl, NULL);
offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
hf_samr_acct_name);
offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
hf_samr_acct_desc);
proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
samr_dissect_GROUP_DISPINFO_ARRAY_groups (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep)
{
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
samr_dissect_GROUP_DISPINFO);
return offset;
}
static int
samr_dissect_GROUP_DISPINFO_ARRAY (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep)
{
guint32 count;
proto_item *item=NULL;
proto_tree *tree=NULL;
int old_offset=offset;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
"Group_DispInfo Array");
tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
}
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_array_max_count, &count);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
samr_dissect_GROUP_DISPINFO_ARRAY_groups, NDR_POINTER_PTR,
-1);
proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
samr_dissect_ASCII_DISPINFO (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
int old_offset=offset;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
"Ascii_DispInfo");
tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
}
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_index, NULL);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_rid, NULL);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_acct_ctrl, NULL);
offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
hf_samr_acct_name);
offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
hf_samr_acct_desc);
proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
samr_dissect_ASCII_DISPINFO_ARRAY_users (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep)
{
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
samr_dissect_ASCII_DISPINFO);
return offset;
}
static int
samr_dissect_ASCII_DISPINFO_ARRAY (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep)
{
guint32 count;
proto_item *item=NULL;
proto_tree *tree=NULL;
int old_offset=offset;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
"Ascii_DispInfo Array");
tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
}
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_array_max_count, &count);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
samr_dissect_ASCII_DISPINFO_ARRAY_users, NDR_POINTER_PTR,
-1);
proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
samr_dissect_DISPLAY_INFO (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
char *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
int old_offset=offset;
guint16 level;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
"DispInfo");
tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
}
offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
hf_samr_level, &level);
switch(level){
case 1:
offset = samr_dissect_USER_DISPINFO_1_ARRAY(
tvb, offset, pinfo, tree, drep);
break;
case 2:
offset = samr_dissect_USER_DISPINFO_2_ARRAY(
tvb, offset, pinfo, tree, drep);
break;
case 3:
offset = samr_dissect_GROUP_DISPINFO_ARRAY(
tvb, offset, pinfo, tree, drep);
break;
case 4:
offset = samr_dissect_ASCII_DISPINFO_ARRAY(
tvb, offset, pinfo, tree, drep);
break;
case 5:
offset = samr_dissect_ASCII_DISPINFO_ARRAY(
tvb, offset, pinfo, tree, drep);
break;
}
proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
samr_dissect_query_dispinfo_total_size (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep)
{
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_total_size, NULL);
return offset;
}
static int
samr_dissect_query_dispinfo_ret_size (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep)
{
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_ret_size, NULL);
return offset;
}
static int
samr_dissect_query_dispinfo_reply (tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
samr_dissect_query_dispinfo_total_size, NDR_POINTER_REF,
-1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
samr_dissect_query_dispinfo_ret_size, NDR_POINTER_REF,
-1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
samr_dissect_DISPLAY_INFO, NDR_POINTER_REF,
-1);
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_samr_rc, NULL);
return offset;
}
static dcerpc_sub_dissector dcerpc_samr_dissectors[] = {
{ SAMR_CONNECT_ANON, "SAMR_CONNECT_ANON", NULL, samr_dissect_gen_open_reply },
{ SAMR_CLOSE_HND, "SAMR_CLOSE_HND", samr_dissect_close_hnd_rqst, samr_dissect_gen_open_reply },
@ -124,7 +544,7 @@ static dcerpc_sub_dissector dcerpc_samr_dissectors[] = {
{ SAMR_QUERY_USERINFO, "SAMR_QUERY_USERINFO", NULL, NULL },
{ SAMR_SET_USERINFO2, "SAMR_SET_USERINFO2", NULL, NULL },
{ SAMR_QUERY_USERGROUPS, "SAMR_QUERY_USERGROUPS", NULL, NULL },
{ SAMR_QUERY_DISPINFO, "SAMR_QUERY_DISPINFO", NULL, NULL },
{ SAMR_QUERY_DISPINFO, "SAMR_QUERY_DISPINFO", samr_dissect_query_dispinfo_rqst, samr_dissect_query_dispinfo_reply },
{ SAMR_UNKNOWN_29, "SAMR_UNKNOWN_29", NULL, NULL },
{ SAMR_UNKNOWN_2a, "SAMR_UNKNOWN_2a", NULL, NULL },
{ SAMR_UNKNOWN_2b, "SAMR_UNKNOWN_2b", NULL, NULL },
@ -159,9 +579,80 @@ proto_register_dcerpc_samr(void)
{ "Rid", "samr.rid", FT_UINT32, BASE_HEX, NULL, 0x0, "", HFILL }},
{ &hf_samr_rc,
{ "Return code", "samr.rc", FT_UINT32, BASE_HEX, VALS (NT_errors), 0x0, "", HFILL }},
{ &hf_samr_level,
{ "Level", "samr.level", FT_UINT16, BASE_DEC,
NULL, 0x0, "Level requested/returned for Information", HFILL }},
{ &hf_samr_start_idx,
{ "Start Idx", "samr.start_idx", FT_UINT32, BASE_DEC,
NULL, 0x0, "Start Index for returned Information", HFILL }},
{ &hf_samr_max_entries,
{ "Max Entries", "samr.max_entries", FT_UINT32, BASE_DEC,
NULL, 0x0, "Maximum number of entries to return", HFILL }},
{ &hf_samr_pref_maxsize,
{ "Pref MaxSize", "samr.pref_maxsize", FT_UINT32, BASE_DEC,
NULL, 0x0, "Maximum Size of data to return", HFILL }},
{ &hf_samr_total_size,
{ "Total Size", "samr.total_size", FT_UINT32, BASE_DEC,
NULL, 0x0, "Total size of data", HFILL }},
{ &hf_samr_ret_size,
{ "Returned Size", "samr.ret_size", FT_UINT32, BASE_DEC,
NULL, 0x0, "Number of returned objects in this PDU", HFILL }},
{ &hf_samr_index,
{ "Index", "samr.index", FT_UINT32, BASE_DEC,
NULL, 0x0, "Index", HFILL }},
{ &hf_samr_acct_ctrl,
{ "Acct Ctrl", "samr.acct_ctrl", FT_UINT32, BASE_DEC,
NULL, 0x0, "Acct CTRL", HFILL }},
{ &hf_samr_array_max_count,
{ "Max Count", "samr.array.max_count", FT_UINT32, BASE_DEC, NULL, 0x0, "Maximum Count: Number of elements in the array", HFILL }},
{ &hf_samr_acct_name,
{ "Account Name", "samr.acct_name", FT_STRING, BASE_NONE,
NULL, 0, "Name of Account", HFILL }},
{ &hf_samr_full_name,
{ "Full Name", "samr.full_name", FT_STRING, BASE_NONE,
NULL, 0, "Full Name of Account", HFILL }},
{ &hf_samr_acct_desc,
{ "Account Desc", "samr.acct_desc", FT_STRING, BASE_NONE,
NULL, 0, "Account Description", HFILL }},
/* these are used by packet-dcerpc-nt.c */
{ &hf_nt_string_length,
{ "Length", "nt.string.length", FT_UINT16, BASE_DEC,
NULL, 0x0, "Length of string in bytes", HFILL }},
{ &hf_nt_string_size,
{ "Size", "nt.string.size", FT_UINT16, BASE_DEC,
NULL, 0x0, "Size of string in bytes", HFILL }},
{ &hf_nt_str_len,
{ "Length", "nt.str.len", FT_UINT32, BASE_DEC,
NULL, 0x0, "Length of string in short integers", HFILL }},
{ &hf_nt_str_off,
{ "Offset", "nt.str.offset", FT_UINT32, BASE_DEC,
NULL, 0x0, "Offset into string in short integers", HFILL }},
{ &hf_nt_str_max_len,
{ "Max Length", "nt.str.max_len", FT_UINT32, BASE_DEC,
NULL, 0x0, "Max Length of string in short integers", HFILL }},
};
static gint *ett[] = {
&ett_dcerpc_samr,
&ett_nt_unicode_string,
&ett_samr_user_dispinfo_1,
};
proto_dcerpc_samr = proto_register_protocol(

297
packet-dcerpc.c
View File

@ -2,7 +2,7 @@
* Routines for DCERPC packet disassembly
* Copyright 2001, Todd Sabin <tas@webspan.net>
*
* $Id: packet-dcerpc.c,v 1.26 2002/01/24 09:20:47 guy Exp $
* $Id: packet-dcerpc.c,v 1.27 2002/01/25 08:35:59 guy Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
@ -169,12 +169,14 @@ static int hf_dcerpc_opnum = -1;
static int hf_dcerpc_dg_seqnum = -1;
static int hf_dcerpc_dg_server_boot = -1;
static int hf_dcerpc_dg_if_ver = -1;
static int hf_dcerpc_array_max_count = -1;
static gint ett_dcerpc = -1;
static gint ett_dcerpc_cn_flags = -1;
static gint ett_dcerpc_drep = -1;
static gint ett_dcerpc_dg_flags1 = -1;
static gint ett_dcerpc_dg_flags2 = -1;
static gint ett_dcerpc_pointer_data = -1;
/* try to desegment big DCE/RPC packets over TCP? */
static gboolean dcerpc_cn_desegment = TRUE;
@ -422,6 +424,287 @@ dcerpc_tvb_get_uuid (tvbuff_t *tvb, gint offset, char *drep, e_uuid_t *uuid)
}
}
/* NDR arrays */
/* function to dissect a unidimensional conformant array */
int
dissect_ndr_ucarray(tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
dcerpc_dissect_fnct_t *fnct)
{
guint32 i, count;
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_dcerpc_array_max_count, &count);
for(i=0;i<count;i++){
offset = (*fnct)(tvb, offset, pinfo, tree, drep);
}
return offset;
}
/* ndr pointer handling */
/* list of pointers encountered so far */
static GSList *ndr_pointer_list = NULL;
/* position where in the list to insert newly encountered pointers */
static int ndr_pointer_list_pos=0;
/* boolean controlling whether pointers are top-level or embedded */
static gboolean pointers_are_top_level = TRUE;
/* as a kludge, we represent all embedded reference pointers as id==-1
hoping that his will not collide with any non-ref pointers */
typedef struct ndr_pointer_data {
guint32 id;
proto_tree *tree;
dcerpc_dissect_fnct_t *fnct; /*if non-NULL, we have not called it yet*/
int hf_index;
} ndr_pointer_data_t;
static void
init_ndr_pointer_list(void)
{
while(ndr_pointer_list){
ndr_pointer_data_t *npd;
npd=g_slist_nth_data(ndr_pointer_list, 0);
ndr_pointer_list=g_slist_remove(ndr_pointer_list, npd);
if(npd){
g_free(npd);
}
}
ndr_pointer_list=NULL;
ndr_pointer_list_pos=0;
pointers_are_top_level=TRUE;
}
static int
dissect_deferred_pointers(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset, char *drep)
{
int found_new_pointer;
dcerpc_info *di;
di=pinfo->private_data;
do{
int i, len;
found_new_pointer=0;
len=g_slist_length(ndr_pointer_list);
for(i=0;i<len;i++){
ndr_pointer_data_t *tnpd;
tnpd=g_slist_nth_data(ndr_pointer_list, i);
if(tnpd->fnct){
dcerpc_dissect_fnct_t *fnct;
found_new_pointer=1;
fnct=tnpd->fnct;
tnpd->fnct=NULL;
ndr_pointer_list_pos=i+1;
di->hf_index=tnpd->hf_index;
offset = (*(fnct))(tvb, offset, pinfo, tnpd->tree, drep);
break;
}
}
} while(found_new_pointer);
return offset;
}
static void
add_pointer_to_list(packet_info *pinfo, proto_tree *tree,
dcerpc_dissect_fnct_t *fnct, guint32 id, int hf_index)
{
ndr_pointer_data_t *npd;
/* check if this pointer is valid */
if(id!=0xffffffff){
dcerpc_info *di;
dcerpc_call_value *value;
di=pinfo->private_data;
value=di->call_data;
if(di->request){
if(id>value->max_ptr){
value->max_ptr=id;
}
} else {
/* if we havent seen the request bail out since we cant
know whether this is the first non-NULL instance
or not */
if(value->req_frame==-1){
/* XXX THROW EXCEPTION */
}
/* We saw this one in the request frame, nothing to
dissect later */
if(id<=value->max_ptr){
return;
}
}
}
npd=g_malloc(sizeof(ndr_pointer_data_t));
npd->id=id;
npd->tree=tree;
npd->fnct=fnct;
npd->hf_index=hf_index;
ndr_pointer_list = g_slist_insert(ndr_pointer_list, npd,
ndr_pointer_list_pos);
ndr_pointer_list_pos++;
}
static int
find_pointer_index(guint32 id)
{
ndr_pointer_data_t *npd;
int i,len;
len=g_slist_length(ndr_pointer_list);
for(i=0;i<len;i++){
npd=g_slist_nth_data(ndr_pointer_list, i);
if(npd){
if(npd->id==id){
return i;
}
}
}
return -1;
}
int
dissect_ndr_pointer(tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
dcerpc_dissect_fnct_t *fnct, int type, int hf_index)
{
/*TOP LEVEL REFERENCE POINTER*/
if( pointers_are_top_level
&& (type==NDR_POINTER_REF) ){
add_pointer_to_list(pinfo, tree, fnct, 0xffffffff, hf_index);
goto after_ref_id;
}
/*TOP LEVEL FULL POINTER*/
/*TOP LEVEL UNIQUE POINTER*/
if( pointers_are_top_level
&& ((type==NDR_POINTER_PTR)||(type==NDR_POINTER_UNIQUE)) ){
int idx;
guint32 id;
proto_item *item;
proto_tree *tr;
/* get the referent id */
dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id);
/* we got a NULL pointer */
if(id==0){
proto_tree_add_text(tree, tvb, offset, 4,
"NULL pointer");
offset+=4;
goto after_ref_id;
}
/* see if we have seen this pointer before */
idx=find_pointer_index(id);
/* we have seen this pointer before */
if(idx>=0){
proto_tree_add_text(tree, tvb, offset, 4,
"Referent ID:0x%08x",id);
offset+=4;
goto after_ref_id;
}
/* new pointer */
item=proto_tree_add_text(tree, tvb, offset, 4,
"Referent ID:0x%08x", id);
offset+=4;
tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data);
add_pointer_to_list(pinfo, tr, fnct, id, hf_index);
goto after_ref_id;
}
/*EMBEDDED REFERENCE POINTER*/
if( (!pointers_are_top_level)
&& (type==NDR_POINTER_REF) ){
guint32 id;
proto_item *item;
proto_tree *tr;
/* get the referent id */
dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id);
/* new pointer */
item=proto_tree_add_text(tree, tvb, offset, 4,
"Referent ID:0x%08x", id);
offset+=4;
tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data);
add_pointer_to_list(pinfo, tr, fnct, 0xffffffff, hf_index);
goto after_ref_id;
}
/*EMBEDDED FULL POINTER*/
/*EMBEDDED UNIQUE POINTER*/
if( (!pointers_are_top_level)
&& ((type==NDR_POINTER_PTR)||(type==NDR_POINTER_UNIQUE)) ){
int idx;
guint32 id;
proto_item *item;
proto_tree *tr;
/* get the referent id */
dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id);
/* we got a NULL pointer */
if(id==0){
proto_tree_add_text(tree, tvb, offset, 4,
"NULL pointer");
offset+=4;
goto after_ref_id;
}
/* see if we have seen this pointer before */
idx=find_pointer_index(id);
/* we have seen this pointer before */
if(idx>=0){
proto_tree_add_text(tree, tvb, offset, 4,
"Referent ID:0x%08x",id);
offset+=4;
goto after_ref_id;
}
/* new pointer */
item=proto_tree_add_text(tree, tvb, offset, 4,
"Referent ID:0x%08x", id);
offset+=4;
tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data);
add_pointer_to_list(pinfo, tr, fnct, id, hf_index);
goto after_ref_id;
}
after_ref_id:
/* After each top level pointer we have dissected we have to
dissect all deferrals before we move on to the next top level
argument */
if(pointers_are_top_level==TRUE){
pointers_are_top_level=FALSE;
offset = dissect_deferred_pointers(pinfo, tree, tvb, offset, drep);
pointers_are_top_level=TRUE;
}
return offset;
}
static int
dcerpc_try_handoff (packet_info *pinfo, proto_tree *tree,
proto_tree *dcerpc_tree,
@ -494,7 +777,8 @@ dcerpc_try_handoff (packet_info *pinfo, proto_tree *tree,
pinfo->current_proto = sub_proto->name;
pinfo->private_data = (void *)info;
sub_dissect (tvb, offset, pinfo, sub_tree, drep);
init_ndr_pointer_list();
offset = sub_dissect (tvb, offset, pinfo, sub_tree, drep);
pinfo->current_proto = saved_proto;
pinfo->private_data = saved_private_data;
@ -890,6 +1174,7 @@ dissect_dcerpc_cn_rqst (tvbuff_t *tvb, packet_info *pinfo, proto_tree *dcerpc_tr
call_value->opnum = opnum;
call_value->req_frame=pinfo->fd->num;
call_value->rep_frame=-1;
call_value->max_ptr=0;
call_value->private_data = NULL;
g_hash_table_insert (dcerpc_calls, call_key, call_value);
@ -913,6 +1198,7 @@ dissect_dcerpc_cn_rqst (tvbuff_t *tvb, packet_info *pinfo, proto_tree *dcerpc_tr
di.conv = conv;
di.call_id = hdr->call_id;
di.smb_fid = get_smb_fid(pinfo->private_data);
di.request = TRUE;
di.call_data = value;
if(value->rep_frame!=-1){
@ -1001,6 +1287,7 @@ dissect_dcerpc_cn_resp (tvbuff_t *tvb, packet_info *pinfo, proto_tree *dcerpc_tr
di.conv = conv;
di.call_id = hdr->call_id;
di.smb_fid = get_smb_fid(pinfo->private_data);
di.request = FALSE;
di.call_data = value;
if(value->req_frame!=-1){
@ -1464,6 +1751,7 @@ dissect_dcerpc_dg (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
call_value->opnum = hdr.opnum;
call_value->req_frame=pinfo->fd->num;
call_value->rep_frame=-1;
call_value->max_ptr=0;
call_value->private_data = NULL;
g_hash_table_insert (dcerpc_calls, call_key, call_value);
@ -1475,6 +1763,7 @@ dissect_dcerpc_dg (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
di.conv = conv;
di.call_id = hdr.seqnum;
di.smb_fid = -1;
di.request = TRUE;
di.call_data = value;
dcerpc_try_handoff (pinfo, tree, dcerpc_tree, tvb, offset,
@ -1502,6 +1791,7 @@ dissect_dcerpc_dg (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
di.conv = conv;
di.call_id = 0;
di.smb_fid = -1;
di.request = FALSE;
if(value) {
di.call_data = value;
} else {
@ -1731,6 +2021,8 @@ proto_register_dcerpc (void)
{ "Activitiy", "dcerpc.dg_act_id", FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }},
{ &hf_dcerpc_opnum,
{ "Opnum", "dcerpc.opnum", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
{ &hf_dcerpc_array_max_count,
{ "Max Count", "dcerpc.array.max_count", FT_UINT32, BASE_DEC, NULL, 0x0, "Maximum Count: Number of elements in the array", HFILL }},
};
@ -1740,6 +2032,7 @@ proto_register_dcerpc (void)
&ett_dcerpc_drep,
&ett_dcerpc_dg_flags1,
&ett_dcerpc_dg_flags2,
&ett_dcerpc_pointer_data,
};
proto_dcerpc = proto_register_protocol ("DCE RPC", "DCERPC", "dcerpc");

18
packet-dcerpc.h
View File

@ -1,7 +1,7 @@
/* packet-dcerpc.h
* Copyright 2001, Todd Sabin <tas@webspan.net>
*
* $Id: packet-dcerpc.h,v 1.8 2002/01/23 05:37:38 guy Exp $
* $Id: packet-dcerpc.h,v 1.9 2002/01/25 08:35:59 guy Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
@ -131,6 +131,19 @@ int dissect_ndr_ctx_hnd (tvbuff_t *tvb, gint offset, packet_info *pinfo,
typedef int (dcerpc_dissect_fnct_t)(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep);
#define NDR_POINTER_REF 1
#define NDR_POINTER_UNIQUE 2
#define NDR_POINTER_PTR 3
int dissect_ndr_pointer (tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
dcerpc_dissect_fnct_t *fnct, int type, int hf_index);
/* dissect a NDR unidimensional conformant array */
int dissect_ndr_ucarray(tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *tree, char *drep,
dcerpc_dissect_fnct_t *fnct);
typedef struct _dcerpc_sub_dissector {
guint16 num;
gchar *name;
@ -164,6 +177,7 @@ typedef struct _dcerpc_call_value {
guint16 opnum;
gint32 req_frame;
gint32 rep_frame;
guint32 max_ptr;
void *private_data;
} dcerpc_call_value;
@ -171,6 +185,8 @@ typedef struct _dcerpc_info {
conversation_t *conv; /* Which TCP stream we are in */
guint32 call_id; /* Context id for this call */
guint16 smb_fid; /* FID for DCERPC over SMB */
gboolean request;
int hf_index;
dcerpc_call_value *call_data;
} dcerpc_info;