aboutsummaryrefslogtreecommitdiffstats
path: root/packet-dcerpc-nt.c
Commit message (Collapse)AuthorAgeFilesLines
* Rename "dissect_ndr_char_string()" and "dissect_ndr_wchar_string()" toGuy Harris2003-02-071-3/+3
| | | | | | | | | | "dissect_ndr_char_cvstring()" and "dissect_ndr_wchar_cvstring()", to indicate that they're for conformant varying strings. Rename "dissect_ndr_character_array()" to "dissect_ndr_cvstring()", to indicate that it's for conformant varying strings. svn path=/trunk/; revision=7096
* Rename "dissect_ndr_char_array" and "disect_ndr_wchar_array" toGuy Harris2003-02-071-3/+3
| | | | | | | "dissect_ndr_char_string" and "dissect_ndr_wchar_string", to make it clearer what it does. svn path=/trunk/; revision=7095
* Fix a typo in the multiple-include protection in "packet-dcerpc-nt.h".Guy Harris2003-02-071-134/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Rename "dissect_ndr_element_array()" to "dissect_ndr_character_array()", move it out of "packet-dcerpc-nt.c" to "packet-dcerpc.c", and have it use the standard DCE RPC array max count/offset/count fields rather than their own private versions of those fields. Give it an option to create a subtree, and an argument to specify the field to use for the actual data buffer, and export it. Move the routines for handling arrays of "char" and "wchar" as strings out of "packet-dcerpc-nt.c" to "packet-dcerpc.c". Add a routine to handle an array of "char" as an opaque blob of bytes. Use "dissect_ndr_character_array()" to dissect character strings in MAPI (the strings in question are ASCII, not Unicode), and use the routine to handle an array of "char" as an opaque blob of bytes to dissect encrypted data (again, it's bytes, not 16-bit quantities). Show them as encrypted data, not unknown data. Use "dissect_ndr_character_array()" to dissect a form name in "dissect_form_name()" in the SPOOLSS dissector. svn path=/trunk/; revision=7091
* Move dissect_nt_access_mask() from packet-dcerpc-nt.c to packet-smb.cTim Potter2003-02-071-343/+1
| | | | | | | | | Give dissect_nt_sec_desc() and dissect_nt_access_mask() a specific rights function parameter for dissecting specific access rights. Fix callers in packet-smb.c to use the new interface. svn path=/trunk/; revision=7086
* Replace the confusing collection of Windows DCERPC string handlingTim Potter2003-02-031-192/+168
| | | | | | | | | | | | | | | | | | | | | | | | functions with something a little less confusing. We now have two sets of functions to dissect strings: - dissect_ndr_wchar_array() which dissects NDR arrays of wide characters (uint32, uint32, uint32, buffer) - dissect_ndr_counted_string() which dissects a "counted string" (uint16, uint16, pointer to array of wchar) There are three contexts for dissecting counted strings: 1. "in-line" using dissect_ndr_counted_string() 2. as a callback to dissect_ndr_pointer() 3. as a callback to dissect_ndr_pointer_cb() Context 2 is used when you have a pointer to a counted string. Context 3 is when you wish to perform some special processing with the returned string. svn path=/trunk/; revision=7068
* If "dissect_ndr_nt_STRING()" is being used to dissect a byte stringGuy Harris2003-01-311-2/+8
| | | | | | | rather than a character string, don't decorate anything above that item in the tree with the "string". svn path=/trunk/; revision=7058
* Don't append string to upper-level proto_items if item == NULL.Tim Potter2003-01-301-2/+2
| | | | svn path=/trunk/; revision=7050
* Generalize "cb_str_postprocess()" to allow the string to be appended toGuy Harris2003-01-301-9/+22
| | | | | | | items N levels up from the item being processed, and use that to decorate the tree as it was decorated before. svn path=/trunk/; revision=7043
* NDR strings begin with a uint32, so they start on a 4-byte boundary.Guy Harris2003-01-301-1/+6
| | | | svn path=/trunk/; revision=7041
* Removed some out of date comments.Tim Potter2003-01-281-7/+1
| | | | svn path=/trunk/; revision=7029
* Defined a useful callback function for dissect_ndr_pointer() which canTim Potter2003-01-281-49/+97
| | | | | | | | | | | | | | | | be used to help out in most DCERPC strings. The cb_str_postprocess() function reads the callback_args and either appends the value of the string to the COL_INFO field, appends it to the NDR pointer item, or saves the string to dcv->private_data. Calling cb_str_postprocess() with CB_STR_ITEM is the same as calling dissect_ndr_pointer() with levels = 0. Renamed some of the pointer dissection functions with a suffix of _cb and created helpers of the original which call the _cb function with NULL args. This should help minimise the amount of code changes in the bulk of the DCERPC dissectors. svn path=/trunk/; revision=7016
* Perform the initialisation for the NT specific DCERPC dissectors as partTim Potter2003-01-241-192/+188
| | | | | | | | | | of the DCERPC dissector instead of creating a dummy protocol to hang the ett and hf values off. Make the open and close frame values in NT policy handles FT_FRAMENUM's so the "Go to Corresponding Frame" menu item can be used on them. svn path=/trunk/; revision=6995
* Clean up some unused variables in dissect_ndr_nt_UNICODE_STRING_str()Tim Potter2003-01-161-8/+8
| | | | | | | Undo change to dissect_doserror() and dissect_ntstatus() made in revision 1.42 as it breaks the display of rpc errors in COL_INFO. svn path=/trunk/; revision=6934
* Put Unicode strings into the protocol tree with the appropriate protocolGuy Harris2003-01-111-45/+13
| | | | | | | | | tree item, not with hf_nt_str. Get rid of hf_nt_str, as it's no longer used. Put ASCII strings into the protocol tree only once. svn path=/trunk/; revision=6910
* "hf_nt_str" is of type FT_STRING, so it should be set to an ASCIIGuy Harris2003-01-111-6/+33
| | | | | | | | | | | string; set it to the result of the "fake_unicode()" call, not to the raw Unicode string. (Yes, we should have support for strings that don't have 8-bit characters - and somehow handle strings in packets in multiple character sets, e.g. ISO 8859/x and other EUC codes, the Macintosh extended character set, various DOS/Windows code pages, and Unicode - but we don't have it now.) svn path=/trunk/; revision=6909
* Delete all prs_* functions. Huzzah!Tim Potter2003-01-111-101/+11
| | | | svn path=/trunk/; revision=6900
* Get rid of some no-longer-used routines; there are other routines thatGuy Harris2002-12-021-190/+2
| | | | | | have taken their places. svn path=/trunk/; revision=6723
* Get rid of a no-longer-used variable.Guy Harris2002-12-021-5/+1
| | | | svn path=/trunk/; revision=6717
* Get rid of the "pdata" argument to "dissect_dcerpc_uint16s()" andGuy Harris2002-11-281-7/+4
| | | | | | | | | | "dissect_ndr_uint16s()"; "dissect_ndr_uint16s()" is always passed a null pointer, "dissect_dcerpc_uint16s()" is only called by "dissect_ndr_uint16s()", and the pointer returned through "pdata" is *NOT* guaranteed to be aligned on a 16-bit boundary so we don't want to tempt people to blithely dereference that pointer. svn path=/trunk/; revision=6699
* Arguments to hash routines are gconstpointer's; assign them to constGuy Harris2002-11-281-12/+12
| | | | | | | | | | | | | | pointers. The first argument to "sscanf()" is a "const char *"; don't cast const pointers to "char *" when passing them to "sscanf()". Assign the result of "tvb_get_ptr()" to const pointers, not non-const pointers. Make the "pdata" argument to various DCE routines a const pointer. svn path=/trunk/; revision=6688
* Removed trailing whitespaces from .h and .c files using theJörg Mayer2002-08-281-84/+84
| | | | | | | winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
* Put the top-level item for an NT access mask into the protocol tree withGuy Harris2002-08-221-3/+2
| | | | | | | | "proto_tree_add_uint()" and the hfindex passed to us, rather than as a text item. That means it has the name our caller gave to it, and that it's a filterable field. svn path=/trunk/; revision=6062
* Some cleanups and fixes from Guy:Tim Potter2002-08-221-14/+8
| | | | | | | | | | | | | | - combine proto_tree_add_text() and proto_tree_append_text() calls in the access mask dissector - make the specific access bits dissector functions return void instead of an offset I think Samba has the create user reply wrong. There is perhaps a uint32 marked as unknown that shouldn't be there. Removing this parses all the captures I have. svn path=/trunk/; revision=6057
* Added a NT access mask dissector. The breaks the permission bits up intoTim Potter2002-08-211-1/+361
| | | | | | | generic, standard and specific mode bits. A protocol dissector can pass in it's own function for dissecting the specific mode bits, if known. svn path=/trunk/; revision=6053
* In dissect_doserror and dissect_ntstatus, don't add anything to theTim Potter2002-08-071-3/+3
| | | | | | | | COL_INFO field if the proto_tree parameter is NULL. This prevents duplicate error messages when we just want to peek at the value of the error. svn path=/trunk/; revision=5963
* Removed unused variable.Tim Potter2002-06-281-2/+1
| | | | svn path=/trunk/; revision=5775
* Cleaned up NT policy handle hashing a bit. Split the store functionTim Potter2002-06-281-58/+65
| | | | | | | | | | into two - one that stores request/reply frame numbers and another that associates a text name with a policy handle. Removed all calls to prs_policy_hnd() and converted to calls to dissect_nt_policy_hnd(). svn path=/trunk/; revision=5772
* Same for a NT status code.Tim Potter2002-06-251-2/+2
| | | | svn path=/trunk/; revision=5762
* Display the error code for a dos error that doesn't have a value string defined.Tim Potter2002-06-251-2/+2
| | | | svn path=/trunk/; revision=5761
* Added dissect_ndr_uint16s() utility function for dissecting a bufferTim Potter2002-06-051-1/+40
| | | | | | of uint16 values. svn path=/trunk/; revision=5624
* Additions to the MAPI dissector. Function 02 for MAPI.Ronnie Sahlberg2002-05-231-7/+7
| | | | | | | | | The function request/call are dissected but the main body of the function in/out parameters consists of a unidimensional conformant and varying array of bytes which content is encrypted/obfuscated. Whoever can tell me how to decrypt/unobfuscate these bytes will get a case of VB next time in Sydney. svn path=/trunk/; revision=5532
* Set the length field correctly for proto_tree_add_text() when marking theTim Potter2002-05-151-4/+5
| | | | | | undissected part of a long frame. svn path=/trunk/; revision=5470
* Mark unused arguments as such.Guy Harris2002-05-111-2/+3
| | | | svn path=/trunk/; revision=5450
* In "dissect_nt_policy_hnd()":Guy Harris2002-05-111-11/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | add arguments to specify whether the policy handle is being opened or closed, and don't set the "open frame" for the handle unless it's being opened and don't set the "close frame" for the handle unless it's being closed; store the policy handle before fetching it, so that an open or close is marked appropriately in the protocol tree on the first pass; if the policy handle has a name associated with it, put that name into the top-level item for the policy handle. In "packet-dcerpc-spoolss.c": get rid of aun unused variable; make "setjob_commands[]" static, as it's not used outside "packet-dcerpc-spoolss.c"; put a "VALS()" call around the reference to "setjob_commands", to squelch compiler warnings; give the SPOOLSS return code field the appropriate "value_string" array. svn path=/trunk/; revision=5448
* Added a routine to dissect a DOS error code. These are used in the spoolssTim Potter2002-05-091-1/+65
| | | | | | | | | | | (also registry and srvsvc?) pipe dissectors. Also added some helper routines for decoding a range of uint8s. These map nicely to the dissect_{dcerpc,ndr}_foo() format with the addition of a length parameter, but aren't really part of the NDR specification and are probably only going to be used in the NT dcerpc dissectors. svn path=/trunk/; revision=5421
* Fix up item lengths for policy handle subtree and subitems under it.Tim Potter2002-05-071-4/+8
| | | | svn path=/trunk/; revision=5410
* From Joerg Mayer: mark unused arguments as such.Guy Harris2002-05-041-11/+11
| | | | svn path=/trunk/; revision=5380
* Get rid of some unused arguments, and mark some others as unused.Guy Harris2002-04-301-3/+2
| | | | | | | | Remove the declaration of "dissect_nt_sid()" from "packet-dcerpc-samr.c"; get it by including "packet-smb-common.h", instead. svn path=/trunk/; revision=5313
* Frame numbers are unsigned, and 0 is not a valid frame number; make theGuy Harris2002-04-221-9/+9
| | | | | | | | frame number arguments, and elements in data structures, unsigned, display them with "%u" rather than "%d", and use 0, rather than -1, as "not known". svn path=/trunk/; revision=5223
* Add a "proto_register_dcerpc_smb()" which registers ett_ values forGuy Harris2002-04-181-11/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "packet-dcerpc-nt.c", and registers "dcerpc_smb_init()" as an initialization routine. Take the ett_ registration out of the latter routine, and also take out the "do this only once" stuff. Get rid of the initialization routines for netlogon, samr, and spoolss; they just call "dcerpc_smb_init()", which is now an initialization routine of its own. The policy hash initialization should be done before every capture, so it should be done in an initialization routine, and should not do any "do this only once" stuff. It should also be called only once before every capture, rather than 3 times. The ett_ initialization should, however, be done at the same time all other ett_ initialization is done - at protocol registration time - so it should be done in a "proto_register_" routine. This fixes a bug I saw wherein 1) the tree for Unicode strings was open by default and 2) if you closed one and then exited, Ethereal would crash. The problem is that "proto_register_subtree_array()" doesn't expand the array, it just bumps the number of registered ett_ values; the array is allocated in "proto_init()". As such, if you register ett_ values with "proto_register_subtree_array()" *after* "proto_init()" is called - and, even for the first capture, initialization routines are called after "proto_init()" is called - you will get ett_ numbers that go past the number of elements in the array. Move the declaration of "ett_nt_unicode_string" to "packet-dcerpc-nt.h", as it's exported from "packet-dcerpc-nt.c". Get rid of the declaration of "dcerpc_smb_init()" in "packet-dcerpc-nt.h", and make it static, as it's no longer called from outside "packet-dcerpc-nt.c". svn path=/trunk/; revision=5196
* Use policy handle hash code in DCERPC/SMB SAMR dissector.Tim Potter2002-04-171-2/+70
| | | | | | Start to move some common stuff into packet-dcerpc-nt.[ch] svn path=/trunk/; revision=5176
* Display non-zero return codes in COL_INFO.Tim Potter2002-04-161-1/+23
| | | | svn path=/trunk/; revision=5170
* len and max_len were swapped in the UNICODE_STRING dissectorRonnie Sahlberg2002-03-291-5/+5
| | | | svn path=/trunk/; revision=5043
* Use dcerpc_call_value structure to fetch request/response frame numbersTim Potter2002-03-261-267/+1
| | | | | | | | and storage of private data. Fix memory leaks in form dissectors. svn path=/trunk/; revision=5020
* Some refactoring of the spoolss dissector:Tim Potter2002-03-251-1/+509
| | | | | | | | | | | | | - rewrote request/response hashing code and moved it into packet-dcerpc-nt.c for use by other dcerpc/smb dissectors - rewrote policy handle hashing code as above, with nifty improvements - moved check for unparsed data and end of frame into a function - fixed matching of printername to handle in addprinterex svn path=/trunk/; revision=5014
* Fix "dissect_ndr_nt_UNICODE_STRING_str()" so that the "di->levels" valueGuy Harris2002-03-241-15/+7
| | | | | | | | | | | | | | | | | | is decremented after every level is appended to, so that it correctly specifies the number of levels up the tree to which to append stuff. Fix some arguments to various printing routines to specify the correct level. This includes making "dissect_ndr_nt_UNICODE_STRING()" add 1 to the level argument it's passed before passing it on to "dissect_ndr_pointer()". Add a "netlogon_dissect_UNICODE_STRING()" routine to put the fields of a bunch of NDR_POINTER_REF UNICODE_STRING values into subtrees. Fix the labels passed as arguments in a bunch of "dissect_ndr_pointer()" calls. svn path=/trunk/; revision=5011
* In "fake_unicode()", check to make sure we have all the data in theGuy Harris2002-03-201-12/+9
| | | | | | | | | | | | | | | | | | string available in the tvbuff before we allocate the buffer; this means that 1) we don't have to register a cleanup function to free the buffer if we throw an exception trying to fetch some of the data, because we won't even try to allocate the buffer if we don't have all the data and 2) we won't try to allocate a buffer with a bogus too-large length, as if the length is too large, we'll throw an exception in the check. svn path=/trunk/; revision=4990
* There is no guarantee that a buffer obtained using "tvb_get_ptr()" isGuy Harris2002-03-191-54/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | neatly aligned on a 2-byte or a 4-byte boundary, and there is no guarantee that a misaligned pointer can be dereferenced without getting a fault. Furthermore, there is no guarantee that, even if you *can* dereference a pointer to a 2-byte or 4-byte quantity in a packet, the resulting number you get back is in the right byte order; the data in the packet might have a different byte order from the machine on which you're running. Therefore, we change "prs_uint8s()", "prs_uint16s()", and "prs_uint32s()" to return the starting offset, in the tvbuff, of the collection of 8-bit, 16-bit, or 32-bit integral values, rather than a pointer to the raw packet data, and change their callers to fetch the data using "tvb_get_guint8()", "tvb_get_letohs()", and "tvb_get_letohl()" (the stuff in all the NT protocols is presumed to be little-endian here). We also change "fake_unicode()" to take a tvbuff and an offset, rather than a data pointer, as arguments, and to use "tvb_get_letohs()" to fetch the Unicode characters (again, we assume little-endian Unicode). This requires "fake_unicode()" to establish a cleanup handler, so we don't leak memory if it throws an exception. We also make "fake_unicode()" use "g_malloc()" to allocate its buffer (we weren't checking for allocation failures in any case; with "g_malloc()", we'll abort on an allocation failure - if we can come up with a cleverer way of handling them, fine), and the matching frees to use "g_free()". (We also insert some missing frees....) Fix some formats to print unsigned quantities with "%u", not "%d". Don't append text to items in the tree for non-string values in "dissect_ndr_nt_STRING_string()". svn path=/trunk/; revision=4986
* Pretty up Policy Handles.Richard Sharpe2002-03-151-2/+3
| | | | svn path=/trunk/; revision=4949
* Moved the value_string for MS country codes from packet-dcerpc-nt.c toRonnie Sahlberg2002-03-151-111/+1
| | | | | | packet-smb.c so that packet-smb-pipe.c can reference this struct as well. svn path=/trunk/; revision=4947
generated by cgit v1.2.3 (git 2.25.1) at 2025-02-27 04:34:45 +0000