aboutsummaryrefslogtreecommitdiffstats
path: root/packet-dcerpc-nt.h
Commit message (Collapse)AuthorAgeFilesLines
* In the policy handle hashing, handle more than one policy handle havingGuy Harris2003-06-051-6/+9
| | | | | | | | | | | | | | | | | | the same value, as an open might return handle XXX, handle XXX might then be closed, and a subsequent handle might return handle XXX, and we want to keep the two handles distinct to avoid, for example, displaying handles closed before they're opened. In policy handle open replies, store the handle name only if the operation succeeded. We can now do that without parsing the packet twice. Have "dissect_nt_policy_hnd()" optionally return, through a pointer, the protocol tree item for the handle, so that its caller can decorate the item with the name of the handle - that's done on opens, where we do that only if the operation succeeds. svn path=/trunk/; revision=7787
* Change the interface to dissect_ndr_nt_SID to take the extra parameter hf_sidRonnie Sahlberg2003-05-211-2/+2
| | | | | | if the caller wants something else instead of "smb.sid" svn path=/trunk/; revision=7707
* Change the interface to dissect_ndr_nt_PSID to take one extra parameter ↵Ronnie Sahlberg2003-05-211-2/+2
| | | | | | which if !=-1 is a hf field for the sid to use instead of the default smb.sid one. svn path=/trunk/; revision=7706
* Move the value_string of platform ID values to "packet-dcerpc-nt.c", andGuy Harris2003-05-151-1/+6
| | | | | | | declare it in "packet-dcerpc-nt.h", as it's used both by the srvsvc and wkssvc dissectors. svn path=/trunk/; revision=7672
* Add a dissect_ndr_counted_byte_array_cb function which can take a callbackTim Potter2003-05-091-1/+8
| | | | | | to call when dissecting the array data. svn path=/trunk/; revision=7656
* Not all strings in MS interfaces are unicode.Ronnie Sahlberg2003-04-271-1/+5
| | | | | | | | Rename cb_str_postprocess which handles unicode strings to cb_wstr_postprocess. Add cb_str_postprocess which handles ASCII strings svn path=/trunk/; revision=7572
* Have "dissect_ndr_counted_string()" add 2, not 1, to its argument, as itGuy Harris2003-02-081-1/+6
| | | | | | | | | | | | | | | | adds 2 levels to the tree. Fix calls to it not to add 1 for that level. The NT and LM challenges in a NETWORK_INFO structure are opaque arrays of bytes, not Unicode strings; dissect them as such, adding a new routine "dissect_ndr_counted_byte_array()" for that purpose. Get rid of some extra colons in names - the colon is put there if a string is appended, so putting a colon in there explicitly gives double colons. Decorate some higher-level tree nodes with strings. svn path=/trunk/; revision=7107
* Fix a typo in the multiple-include protection in "packet-dcerpc-nt.h".Guy Harris2003-02-071-14/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Rename "dissect_ndr_element_array()" to "dissect_ndr_character_array()", move it out of "packet-dcerpc-nt.c" to "packet-dcerpc.c", and have it use the standard DCE RPC array max count/offset/count fields rather than their own private versions of those fields. Give it an option to create a subtree, and an argument to specify the field to use for the actual data buffer, and export it. Move the routines for handling arrays of "char" and "wchar" as strings out of "packet-dcerpc-nt.c" to "packet-dcerpc.c". Add a routine to handle an array of "char" as an opaque blob of bytes. Use "dissect_ndr_character_array()" to dissect character strings in MAPI (the strings in question are ASCII, not Unicode), and use the routine to handle an array of "char" as an opaque blob of bytes to dissect encrypted data (again, it's bytes, not 16-bit quantities). Show them as encrypted data, not unknown data. Use "dissect_ndr_character_array()" to dissect a form name in "dissect_form_name()" in the SPOOLSS dissector. svn path=/trunk/; revision=7091
* Move dissect_nt_access_mask() from packet-dcerpc-nt.c to packet-smb.cTim Potter2003-02-071-11/+1
| | | | | | | | | Give dissect_nt_sec_desc() and dissect_nt_access_mask() a specific rights function parameter for dissecting specific access rights. Fix callers in packet-smb.c to use the new interface. svn path=/trunk/; revision=7086
* Replace the confusing collection of Windows DCERPC string handlingTim Potter2003-02-031-27/+20
| | | | | | | | | | | | | | | | | | | | | | | | functions with something a little less confusing. We now have two sets of functions to dissect strings: - dissect_ndr_wchar_array() which dissects NDR arrays of wide characters (uint32, uint32, uint32, buffer) - dissect_ndr_counted_string() which dissects a "counted string" (uint16, uint16, pointer to array of wchar) There are three contexts for dissecting counted strings: 1. "in-line" using dissect_ndr_counted_string() 2. as a callback to dissect_ndr_pointer() 3. as a callback to dissect_ndr_pointer_cb() Context 2 is used when you have a pointer to a counted string. Context 3 is when you wish to perform some special processing with the returned string. svn path=/trunk/; revision=7068
* Generalize "cb_str_postprocess()" to allow the string to be appended toGuy Harris2003-01-301-6/+7
| | | | | | | items N levels up from the item being processed, and use that to decorate the tree as it was decorated before. svn path=/trunk/; revision=7043
* Defined a useful callback function for dissect_ndr_pointer() which canTim Potter2003-01-281-8/+41
| | | | | | | | | | | | | | | | be used to help out in most DCERPC strings. The cb_str_postprocess() function reads the callback_args and either appends the value of the string to the COL_INFO field, appends it to the NDR pointer item, or saves the string to dcv->private_data. Calling cb_str_postprocess() with CB_STR_ITEM is the same as calling dissect_ndr_pointer() with levels = 0. Renamed some of the pointer dissection functions with a suffix of _cb and created helpers of the original which call the _cb function with NULL args. This should help minimise the amount of code changes in the bulk of the DCERPC dissectors. svn path=/trunk/; revision=7016
* Perform the initialisation for the NT specific DCERPC dissectors as partTim Potter2003-01-241-1/+6
| | | | | | | | | | of the DCERPC dissector instead of creating a dummy protocol to hang the ett and hf values off. Make the open and close frame values in NT policy handles FT_FRAMENUM's so the "Go to Corresponding Frame" menu item can be used on them. svn path=/trunk/; revision=6995
* Delete all prs_* functions. Huzzah!Tim Potter2003-01-111-17/+1
| | | | svn path=/trunk/; revision=6900
* Get rid of some no-longer-used routines; there are other routines thatGuy Harris2002-12-021-25/+1
| | | | | | have taken their places. svn path=/trunk/; revision=6723
* Get rid of the "pdata" argument to "dissect_dcerpc_uint16s()" andGuy Harris2002-11-281-3/+3
| | | | | | | | | | "dissect_ndr_uint16s()"; "dissect_ndr_uint16s()" is always passed a null pointer, "dissect_dcerpc_uint16s()" is only called by "dissect_ndr_uint16s()", and the pointer returned through "pdata" is *NOT* guaranteed to be aligned on a 16-bit boundary so we don't want to tempt people to blithely dereference that pointer. svn path=/trunk/; revision=6699
* Arguments to hash routines are gconstpointer's; assign them to constGuy Harris2002-11-281-5/+5
| | | | | | | | | | | | | | pointers. The first argument to "sscanf()" is a "const char *"; don't cast const pointers to "char *" when passing them to "sscanf()". Assign the result of "tvb_get_ptr()" to const pointers, not non-const pointers. Make the "pdata" argument to various DCE routines a const pointer. svn path=/trunk/; revision=6688
* Removed trailing whitespaces from .h and .c files using theJörg Mayer2002-08-281-39/+39
| | | | | | | winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
* Some cleanups and fixes from Guy:Tim Potter2002-08-221-3/+3
| | | | | | | | | | | | | | - combine proto_tree_add_text() and proto_tree_append_text() calls in the access mask dissector - make the specific access bits dissector functions return void instead of an offset I think Samba has the create user reply wrong. There is perhaps a uint32 marked as unknown that shouldn't be there. Removing this parses all the captures I have. svn path=/trunk/; revision=6057
* Added a NT access mask dissector. The breaks the permission bits up intoTim Potter2002-08-211-1/+11
| | | | | | | generic, standard and specific mode bits. A protocol dissector can pass in it's own function for dissecting the specific mode bits, if known. svn path=/trunk/; revision=6053
* Cleaned up NT policy handle hashing a bit. Split the store functionTim Potter2002-06-281-8/+15
| | | | | | | | | | into two - one that stores request/reply frame numbers and another that associates a text name with a policy handle. Removed all calls to prs_policy_hnd() and converted to calls to dissect_nt_policy_hnd(). svn path=/trunk/; revision=5772
* We must make sure that the ALIGN_TO_4_BYTES macro does not change the offsetRonnie Sahlberg2002-06-161-2/+10
| | | | | | when we do the conformance run. svn path=/trunk/; revision=5682
* Added dissect_ndr_uint16s() utility function for dissecting a bufferTim Potter2002-06-051-1/+9
| | | | | | of uint16 values. svn path=/trunk/; revision=5624
* In "dissect_nt_policy_hnd()":Guy Harris2002-05-111-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | add arguments to specify whether the policy handle is being opened or closed, and don't set the "open frame" for the handle unless it's being opened and don't set the "close frame" for the handle unless it's being closed; store the policy handle before fetching it, so that an open or close is marked appropriately in the protocol tree on the first pass; if the policy handle has a name associated with it, put that name into the top-level item for the policy handle. In "packet-dcerpc-spoolss.c": get rid of aun unused variable; make "setjob_commands[]" static, as it's not used outside "packet-dcerpc-spoolss.c"; put a "VALS()" call around the reference to "setjob_commands", to squelch compiler warnings; give the SPOOLSS return code field the appropriate "value_string" array. svn path=/trunk/; revision=5448
* Added a routine to dissect a DOS error code. These are used in the spoolssTim Potter2002-05-091-1/+17
| | | | | | | | | | | (also registry and srvsvc?) pipe dissectors. Also added some helper routines for decoding a range of uint8s. These map nicely to the dissect_{dcerpc,ndr}_foo() format with the addition of a length parameter, but aren't really part of the NDR specification and are probably only going to be used in the NT dcerpc dissectors. svn path=/trunk/; revision=5421
* Frame numbers are unsigned, and 0 is not a valid frame number; make theGuy Harris2002-04-221-4/+4
| | | | | | | | frame number arguments, and elements in data structures, unsigned, display them with "%u" rather than "%d", and use 0, rather than -1, as "not known". svn path=/trunk/; revision=5223
* Add a "proto_register_dcerpc_smb()" which registers ett_ values forGuy Harris2002-04-181-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "packet-dcerpc-nt.c", and registers "dcerpc_smb_init()" as an initialization routine. Take the ett_ registration out of the latter routine, and also take out the "do this only once" stuff. Get rid of the initialization routines for netlogon, samr, and spoolss; they just call "dcerpc_smb_init()", which is now an initialization routine of its own. The policy hash initialization should be done before every capture, so it should be done in an initialization routine, and should not do any "do this only once" stuff. It should also be called only once before every capture, rather than 3 times. The ett_ initialization should, however, be done at the same time all other ett_ initialization is done - at protocol registration time - so it should be done in a "proto_register_" routine. This fixes a bug I saw wherein 1) the tree for Unicode strings was open by default and 2) if you closed one and then exited, Ethereal would crash. The problem is that "proto_register_subtree_array()" doesn't expand the array, it just bumps the number of registered ett_ values; the array is allocated in "proto_init()". As such, if you register ett_ values with "proto_register_subtree_array()" *after* "proto_init()" is called - and, even for the first capture, initialization routines are called after "proto_init()" is called - you will get ett_ numbers that go past the number of elements in the array. Move the declaration of "ett_nt_unicode_string" to "packet-dcerpc-nt.h", as it's exported from "packet-dcerpc-nt.c". Get rid of the declaration of "dcerpc_smb_init()" in "packet-dcerpc-nt.h", and make it static, as it's no longer called from outside "packet-dcerpc-nt.c". svn path=/trunk/; revision=5196
* Added dissection and support functions for LSAENUMERATEPRIVILEGESRonnie Sahlberg2002-04-171-1/+6
| | | | | | function. svn path=/trunk/; revision=5187
* LSA dissector updates. Adds a lot of LSA functions to the dissector.Ronnie Sahlberg2002-04-171-1/+6
| | | | | | | Also export dissect-nt-GUID() from netlogon since this structure is common to other interfaces as well. svn path=/trunk/; revision=5181
* Use policy handle hash code in DCERPC/SMB SAMR dissector.Tim Potter2002-04-171-1/+6
| | | | | | Start to move some common stuff into packet-dcerpc-nt.[ch] svn path=/trunk/; revision=5176
* Display non-zero return codes in COL_INFO.Tim Potter2002-04-161-1/+8
| | | | svn path=/trunk/; revision=5170
* Use dcerpc_call_value structure to fetch request/response frame numbersTim Potter2002-03-261-26/+4
| | | | | | | | and storage of private data. Fix memory leaks in form dissectors. svn path=/trunk/; revision=5020
* Some refactoring of the spoolss dissector:Tim Potter2002-03-251-1/+41
| | | | | | | | | | | | | - rewrote request/response hashing code and moved it into packet-dcerpc-nt.c for use by other dcerpc/smb dissectors - rewrote policy handle hashing code as above, with nifty improvements - moved check for unparsed data and end of frame into a function - fixed matching of printername to handle in addprinterex svn path=/trunk/; revision=5014
* There is no guarantee that a buffer obtained using "tvb_get_ptr()" isGuy Harris2002-03-191-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | neatly aligned on a 2-byte or a 4-byte boundary, and there is no guarantee that a misaligned pointer can be dereferenced without getting a fault. Furthermore, there is no guarantee that, even if you *can* dereference a pointer to a 2-byte or 4-byte quantity in a packet, the resulting number you get back is in the right byte order; the data in the packet might have a different byte order from the machine on which you're running. Therefore, we change "prs_uint8s()", "prs_uint16s()", and "prs_uint32s()" to return the starting offset, in the tvbuff, of the collection of 8-bit, 16-bit, or 32-bit integral values, rather than a pointer to the raw packet data, and change their callers to fetch the data using "tvb_get_guint8()", "tvb_get_letohs()", and "tvb_get_letohl()" (the stuff in all the NT protocols is presumed to be little-endian here). We also change "fake_unicode()" to take a tvbuff and an offset, rather than a data pointer, as arguments, and to use "tvb_get_letohs()" to fetch the Unicode characters (again, we assume little-endian Unicode). This requires "fake_unicode()" to establish a cleanup handler, so we don't leak memory if it throws an exception. We also make "fake_unicode()" use "g_malloc()" to allocate its buffer (we weren't checking for allocation failures in any case; with "g_malloc()", we'll abort on an allocation failure - if we can come up with a cleverer way of handling them, fine), and the matching frees to use "g_free()". (We also insert some missing frees....) Fix some formats to print unsigned quantities with "%u", not "%d". Don't append text to items in the tree for non-string values in "dissect_ndr_nt_STRING_string()". svn path=/trunk/; revision=4986
* Moved the value_string for MS country codes from packet-dcerpc-nt.c toRonnie Sahlberg2002-03-151-3/+1
| | | | | | packet-smb.c so that packet-smb-pipe.c can reference this struct as well. svn path=/trunk/; revision=4947
* Added a value_string for the countreis which have their MS contry code listedRonnie Sahlberg2002-03-141-1/+4
| | | | | | at www.unicode.org and made samr and netlogon use it. svn path=/trunk/; revision=4943
* Final patch in preparing for NETLOGON dissector.Ronnie Sahlberg2002-03-111-1/+23
| | | | | | | Exported some functions from packet-dcerpc-samr.c and added two more functions the netlogon dissector will need. svn path=/trunk/; revision=4921
* Move the STRING dissector to packet-dcerpc-nt.c and add one more parameterRonnie Sahlberg2002-03-111-1/+9
| | | | | | to make it more similar to the UNICODE_STRING dissector. svn path=/trunk/; revision=4920
* Rename samr_dissect_LOGON_HOURS() to dissect_ndr_nt_LOGON_HOURS() andRonnie Sahlberg2002-03-111-1/+6
| | | | | | | export it to other modules. NETLOGON dissector (and others) will need this function. svn path=/trunk/; revision=4919
* Moved dissect_ndr_nt_NTTIME() from packet-dcerpc-samr.c to packet-dcerpc-nt.cRonnie Sahlberg2002-03-101-1/+5
| | | | | | since this function will be used by other NT services as well such as NETLOGON. svn path=/trunk/; revision=4918
* Use "dissect_ndr_nt_UNICODE_STRING_str()", notGuy Harris2002-03-101-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "dissect_ndr_nt_UNICODE_STRING_string()", in "samr_dissect_connect2_server()"; that eliminates an unnecessary extra level of protocol tree. That removes the last call to "dissect_ndr_nt_UNICODE_STRING_string()"; eliminate that routine. In "dissect_ndr_nt_UNICODE_STRING()", initially create the subtree with the name of the field as a string, so that if an exception is thrown before the name is set, the subtree won't show up as blank when displayed or printed. Also pass in the name to "dissect_ndr_pointer()", so the same happens for subtrees below it. Append only the string data, not its name, to items up the tree, as the name was put in when the item was created. Also, when adding a colon before the string, put a space after the colon, as is done elsewhere in Ethereal. When appending additional strings, put the blank before the new string, not after it. In "dissect_ndr_nt_STRING()", put the subtree into the string with the name of the field, rather than just "String". Pass in that name to "dissect_ndr_pointer()", so subtrees below it get a name when they're initially created. Get rid of colons in the name string passed to "dissect_ndr_pointer()" in some calls. Supply a non-null name string in more calls to "dissect_ndr_pointer()", and fix some calls to pass in the name of the field being handed to "dissect_ndr_pointer()". There's no need to fetch the entire "header_field_info" structure for a protocol field in order to get the field's name - just use "proto_registrar_get_name()" to get the name. Use a length of -1, not 0, when creating a subtree whose length will be set when the dissection of the items under the subtree is complete; that way, if an exception is thrown while dissecting the items - which means the item goes past the end of the tvbuff - the item will refer to all data to the end of the tvbuff, rather than referring to nothing. Fix a typo in the name of the "hf_samr_unknown_string" field. svn path=/trunk/; revision=4912
* Rename function and variables for dissecting an NT service Account ControlRonnie Sahlberg2002-03-061-1/+4
| | | | | | | | bitmap and make the function not static. This bitmap is present in other RPC protocols for NT services as well besides SAMR. svn path=/trunk/; revision=4889
* Moved dissector for UNICODE_STRING structure from packet-dcerpc-samr.c to ↵Ronnie Sahlberg2002-03-061-1/+17
| | | | | | packet-dcerpc-nt.c since this is a structure that is common to all NT services and not only SAMR. svn path=/trunk/; revision=4888
* DCE RPC enhancements, and SAMR improvements, from Ronnie Sahlberg.Guy Harris2002-01-291-8/+1
| | | | svn path=/trunk/; revision=4618
* From Ronnie Sahlberg:Guy Harris2002-01-251-1/+8
| | | | | | | NDR pointer handling in DCE RPC SAMR updates svn path=/trunk/; revision=4608
* SPOOLSS RPC dissector, from Tim Potter. This includes adding additionalGuy Harris2002-01-031-2/+4
| | | | | | | DOS error codes to the table of them, and exporting that table to other dissectors for protocols using DOS error codes. svn path=/trunk/; revision=4470
* From Tim Potter: dissect some of the LSA RPCs stub data.Guy Harris2001-12-161-0/+74
svn path=/trunk/; revision=4407
generated by cgit v1.2.3 (git 2.25.1) at 2025-02-27 02:59:08 +0000