Commit Graph

63 Commits

Author SHA1 Message Date
Jeff Morriss 33f116a46d Restore pinfo->private_data after an exception was thrown by a subdissector.
This is necessary in case a subdissector had changed it but was unable to
restore it (due to the exception).

Remove check_col().

svn path=/trunk/; revision=34436
2010-10-08 17:48:22 +00:00
Bill Meier bd4da13134 #if 0 an used function
svn path=/trunk/; revision=34355
2010-10-03 19:49:15 +00:00
Bill Meier 107e909761 Make a number of functions static;
Rename two g_... functions so as to not be in GLib namespace;
Move proto_register... to just before proto_reg_handoff...
Reformat some lines;
More Whitespace cleanup.

svn path=/trunk/; revision=34354
2010-10-03 19:43:14 +00:00
Bill Meier f5962f094e Whitespace & formatting cleanup;
Use #if 0/#endif instead of /* */ to comment out code in a few places.

svn path=/trunk/; revision=34351
2010-10-03 18:51:38 +00:00
Bill Meier 8af9d02b8c Refactor dissection of CHALLENGE target-info & AUTHENTICATE ntlmv2-response attributes:
- decode all attributes as specified in MS-NLMP;
 - use common code for target-info and ntlmv2 attribute dissection;
Add filter for the "version" field;
Remove some obsolete #if 0'd code.

svn path=/trunk/; revision=34350
2010-10-03 18:23:46 +00:00
Bill Meier 8cd2038a8b Fix some mangled comments (apparently mangled so that code could be commented out by an
enclosing comment). The code is now commented out with #if 0.

svn path=/trunk/; revision=34300
2010-09-30 21:32:42 +00:00
Bill Meier e6eec902f0 Fix compilation error.
svn path=/trunk/; revision=34298
2010-09-30 21:14:44 +00:00
Bill Meier 8d6dbc5677 More fixes and comments:
- NEGOTIATE: dissect version field (if present) when empty Workstation domain & name fields;
- AUTHENTICATE: Use flags from message if no previous CHALLENGE seen to determine 
                character set encoding; Fixes Bug #5251
                https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5251


svn path=/trunk/; revision=34295
2010-09-30 20:26:13 +00:00
Bill Meier e5bb2e0541 Oops: remove a // comment (note to myself)
svn path=/trunk/; revision=34272
2010-09-28 15:26:58 +00:00
Bill Meier 9dcccb0e6a Improve dissection:
1. Negotiation/Challenge/Authoriation messages:
   - dissect Version field (if present);
2. Authorization messages:
   - Dissect fields following session-key (flags/... if present) even 
     when session key is empty;
   - Dissect "MIC" field (if present);
3. Challenge message:
   - Rename "Domain" field to "Target Name" as per Microsoft spec (MS-NLMP).

svn path=/trunk/; revision=34271
2010-09-28 14:14:12 +00:00
Stig Bjørlykke bc11261a75 From Yaniv Kaul via bug 5193:
Dissect NTLMSSP type 0x5 (DNS Forest name).

svn path=/trunk/; revision=34077
2010-09-08 09:24:53 +00:00
Jeff Morriss 16653c5a6c Fix the crash reported in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5157 :
If get_unicode_or_ascii_string() returns a NULL pointer, return a pointer to an
empty string back to our caller.

svn path=/trunk/; revision=34018
2010-08-30 17:05:37 +00:00
Bill Meier 7b85f43d0e Do some constifying [or other] based upon gcc -Wwrite-strings warnings.
svn path=/trunk/; revision=33198
2010-06-09 18:12:17 +00:00
Jeff Morriss 729de1a635 As suggested in http://www.wireshark.org/lists/wireshark-dev/200809/msg00075.html
(as referenced in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2907 ) and
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3411 :

Write a new convenience routine for finding a conversation and, if it is not
found, create it.  The frame number and addresses are taken from pinfo (as is
the common case).

Use this function in a bunch of dissectors.

svn path=/trunk/; revision=32790
2010-05-13 18:28:34 +00:00
Ronnie Sahlberg 10ee49cdb1 From Matthieu Patou <mat+Informatique.Samba@matws.net>
Enhancements to NETLOGON and ability to decrypt SCHANNEL



svn path=/trunk/; revision=31625
2010-01-22 22:34:24 +00:00
Bill Meier 9b568ea691 Fix gcc -Wshadow warnings
svn path=/trunk/; revision=31561
2010-01-19 00:37:39 +00:00
Stig Bjørlykke 35cdf7d240 Use proto_ntlmssp for protocol tree item.
svn path=/trunk/; revision=31424
2010-01-03 14:59:38 +00:00
Guy Harris 8e236e55de For fields of type FT_ABSOLUTE_TIME, have the "display" value be one of
ABSOLUTE_TIME_LOCAL or ABSOLUTE_TIME_UTC, indicating whether to display
the date/time in local time or UTC. (int)ABSOLUTE_TIME_LOCAL ==
(int)BASE_NONE, so there's no source or binary compatiblity issue,
although we might want to eliminate BASE_NONE at some point and have the
BASE_ values used with integral types start at 0, so that you can't
specify BASE_NONE for an integral field.

svn path=/trunk/; revision=31319
2009-12-19 03:17:44 +00:00
Gerald Combs f075c30958 Don't let the session blob length go stomping all over the stack with
muddy boots. Fixes bug 4239.

svn path=/trunk/; revision=30975
2009-11-16 17:08:12 +00:00
Anders Broman 88bb44a51e From Jakub Zawadzki:
Cleanup dissector code - use proper memory functions.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4164

svn path=/trunk/; revision=30691
2009-10-25 11:43:30 +00:00
Ronnie Sahlberg edcd3abdeb From Matthieu Patou
Update ntlmssp to automatically re-read the keytab file if it changes


svn path=/trunk/; revision=30556
2009-10-14 07:22:40 +00:00
Kovarththanan Rajaratnam ad7042d2a4 calculate_crc32c -> crc32c_calculate for proper 'namespacing'
svn path=/trunk/; revision=30405
2009-10-08 15:10:43 +00:00
Jaap Keuter 75f1e13c12 Cleanup header fields.
svn path=/trunk/; revision=30394
2009-10-07 23:08:22 +00:00
Guy Harris 3f8748951f Fix some LLP64 issues.
svn path=/trunk/; revision=30393
2009-10-07 22:36:33 +00:00
Jeff Morriss 4c70f4fad0 Get it compiling when we don't have kerberos libraries.
svn path=/trunk/; revision=30392
2009-10-07 21:00:14 +00:00
Stig Bjørlykke 1559ec3e5f Avoid dereference of null pointer.
svn path=/trunk/; revision=30377
2009-10-06 19:21:29 +00:00
Kovarththanan Rajaratnam cec0e21e2b Use ep_alloc()
svn path=/trunk/; revision=30367
2009-10-06 14:20:59 +00:00
Kovarththanan Rajaratnam 71f7469141 Don't include unistd.h
svn path=/trunk/; revision=30360
2009-10-06 13:21:44 +00:00
Anders Broman 809e9e9e71 Make it compile on windows.
svn path=/trunk/; revision=30357
2009-10-06 11:54:08 +00:00
Ronnie Sahlberg 161667e6bd From Matthieu Patou,
add code to decrypt ntlmv1 and v2 traffic





svn path=/trunk/; revision=30355
2009-10-06 09:13:57 +00:00
Stig Bjørlykke 4d8dd01e8e Changed flags_set_truth -> tfs_set_notset
svn path=/trunk/; revision=28989
2009-07-07 14:54:15 +00:00
Stig Bjørlykke b228488bc0 From Kovarththanan Rajaratnam via bug 3548:
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
    for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
    FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero

svn path=/trunk/; revision=28770
2009-06-18 21:30:42 +00:00
Anders Broman c91a384702 Apply some of the patches from:
http://wiki.wireshark.org/Development/Optimization

svn path=/trunk/; revision=28356
2009-05-13 19:46:11 +00:00
Anders Broman d36eb041ed From Jon Larimer:
NTLMSSP protocol dissector doesn't parse NTLMSSP in DCERPC packets with packet level auth
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2444

svn path=/trunk/; revision=25155
2008-04-23 20:28:30 +00:00
Stig Bjørlykke 28ae535b00 Removed even more "statement not reached" warnings.
svn path=/trunk/; revision=24286
2008-02-07 15:44:45 +00:00
Anders Broman 1950ffc214 Apply the small performance enhancment patches for:
- if offset is 0, tvb_length is the same as tvb_length_remaining, just faster.
Replace 
- col_append_fstr() with faster  col_append_str() 
- col_add_str() with col_set_str()
when it's safe

svn path=/trunk/; revision=23252
2007-10-23 05:50:00 +00:00
Gerald Combs 9d5858f635 Move cryptography code to epan/crypt.
svn path=/trunk/; revision=20359
2007-01-09 22:14:07 +00:00
Jaap Keuter 28560580d3 From Marc Bevandi:
Please apply this patch (made against Wireshark 0.99.4). It defines the
NTLMSSP_NEGOTIATE_ANONYMOUS flag as described in
<http://davenport.sourceforge.net/ntlm.html>.

svn path=/trunk/; revision=20022
2006-11-30 07:16:39 +00:00
Ronnie Sahlberg 05fcb684ed create subtrees also for unknown address types instead of creating the items inside the previous expansion created
svn path=/trunk/; revision=18871
2006-08-10 10:52:16 +00:00
Ronnie Sahlberg feab79e328 change a whole bunch of ethereal into wireshark
svn path=/trunk/; revision=18196
2006-05-21 04:49:01 +00:00
Ronnie Sahlberg 6fcf2d8c66 smb2:
if the secblob starts with 'NTLMSSP'   call the ntlmssp handle directly and not the gssapi one

ntlmssp:
dont change offset when dissecting a client_time,   offset will be changed properly later outside the switch.



svn path=/trunk/; revision=17215
2006-02-08 08:48:23 +00:00
Ronnie Sahlberg 4df342823a add the CLIENT_TIME ntlmv2 addr name type
svn path=/trunk/; revision=17203
2006-02-07 12:50:58 +00:00
Ronnie Sahlberg 56b2184927 make ntlmssp tappable
svn path=/trunk/; revision=16721
2005-12-07 13:09:42 +00:00
Ronnie Sahlberg c30eeef7d8 some more gmemchunk -> se_alloc() updates
there are only 5 gmemchunks left   but they have different litetime for their allocations   than the 100+   ones that have been removed.

The remaining 5 should be converted some other way.




svn path=/trunk/; revision=15328
2005-08-13 01:29:31 +00:00
Ronnie Sahlberg efa1f43005 convert some tvb_fake_unicode() to tvb_get_ephemeral_faked_unicode()
svn path=/trunk/; revision=15272
2005-08-10 14:17:27 +00:00
Guy Harris 554f620001 Constify to remove a bunch of warnings. Add some casts to squelch
(presumably-)harmless-but-otherwise-unremovable const-to-nonconst
warnings.

In the TACACS dissector, clean up the variables used in option parsing
to avoid some const-to-nonconst warnings.

Clean up some white space.

svn path=/trunk/; revision=15043
2005-07-24 19:01:28 +00:00
Guy Harris ef1bfb6f9b In NTLMSP_AUTH messages, include the domain name and user name in the
Info column.

svn path=/trunk/; revision=14902
2005-07-11 22:48:51 +00:00
Ronnie Sahlberg b958accede move one function only used by SPNEGO to packet-spnego.c
remove the include of <epan/asn1.h> from kerberos, ntlmssp and gssapi since they no longer need to include that file.


svn path=/trunk/; revision=14709
2005-06-20 05:28:56 +00:00
Ronnie Sahlberg 8700645d54 add support to decrypt and dissect sign-and-sealed traffic.
(cifs: dc's talking to eachother   and when longhorn comes out: anyone wanting to talk dce to a dc!)

((this is an incredibly advanced feature well worthy of mentioning in NEWS))


svn path=/trunk/; revision=13690
2005-03-10 10:16:49 +00:00
Ronnie Sahlberg 0180d280fe change the signature for the functions to decrypt data for the
dcerpc_auth_subdissector_fns structure.

the SignAndSeal decryption (which works really well) needs this.



svn path=/trunk/; revision=13688
2005-03-10 08:50:18 +00:00