diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-dcerpc-ndr.c ethereal/packet-dcerpc-ndr.c --- ethereal-orig/packet-dcerpc-ndr.c Fri Dec 7 10:30:35 2001 +++ ethereal/packet-dcerpc-ndr.c Thu Jan 24 02:19:50 2002 @@ -129,3 +129,8 @@ return offset + 20; } + + + + + diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-dcerpc-nt.c ethereal/packet-dcerpc-nt.c --- ethereal-orig/packet-dcerpc-nt.c Tue Jan 8 06:55:48 2002 +++ ethereal/packet-dcerpc-nt.c Thu Jan 24 21:07:01 2002 @@ -390,3 +390,161 @@ return offset + 20; } + + + +/* functions to dissect a UNICODE_STRING structure, common to many + NT services + struct { + short len; + short size; + [size_is(size/2), length_is(len/2), ptr] unsigned short *string; + } UNICODE_STRING; + + these variables can be found in packet-dcerpc-samr.c +*/ +extern int hf_nt_str_len; +extern int hf_nt_str_off; +extern int hf_nt_str_max_len; +extern int hf_nt_string_length; +extern int hf_nt_string_size; +extern gint ett_nt_unicode_string; + +static int +dissect_ndr_nt_UNICODE_STRING_string (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + char *drep) +{ + guint32 len, off, max_len; + guint16 *data16; + char *text; + int old_offset; + dcerpc_info *di; + header_field_info *hfi; + + di=pinfo->private_data; + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_nt_str_len, &len); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_nt_str_off, &off); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_nt_str_max_len, &max_len); + + old_offset=offset; + offset = prs_uint16s(tvb, offset, pinfo, tree, max_len, &data16, NULL); + text = fake_unicode(data16, max_len); + + hfi = proto_registrar_get_nth(di->hf_index); + proto_tree_add_string_format(tree, di->hf_index, + tvb, old_offset, offset-old_offset, + text, "%s: %s", hfi->name, text); + + if(tree){ + proto_item_set_text(tree, "%s: %s", hfi->name, text); + proto_item_set_text(tree->parent, "%s: %s", hfi->name, text); + } + return offset; +} + +int +dissect_ndr_nt_UNICODE_STRING (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep, int hf_index) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + item = proto_tree_add_text(parent_tree, tvb, offset, 0, + "Unicode String"); + tree = proto_item_add_subtree(item, ett_nt_unicode_string); + } + + offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, + hf_nt_string_length, NULL); + offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, + hf_nt_string_size, NULL); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + dissect_ndr_nt_UNICODE_STRING_string, NDR_POINTER_PTR, + hf_index); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +/* functions to dissect a STRING structure, common to many + NT services + struct { + short len; + short size; + [size_is(size), length_is(len), ptr] char *string; + } STRING; +*/ + +static int +dissect_ndr_nt_STRING_string (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + char *drep) +{ + guint32 len, off, max_len; + guint8 *text; + int old_offset; + dcerpc_info *di; + header_field_info *hfi; + + di=pinfo->private_data; + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_nt_str_len, &len); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_nt_str_off, &off); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_nt_str_max_len, &max_len); + + old_offset=offset; + offset = prs_uint8s(tvb, offset, pinfo, tree, max_len, &text, NULL); + + hfi = proto_registrar_get_nth(di->hf_index); + proto_tree_add_string_format(tree, di->hf_index, + tvb, old_offset, offset-old_offset, + text, "%s: %s", hfi->name, text); + + if(tree){ + proto_item_set_text(tree, "%s: %s", hfi->name, text); + proto_item_set_text(tree->parent, "%s: %s", hfi->name, text); + } + return offset; +} + +int +dissect_ndr_nt_STRING (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep, int hf_index) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + item = proto_tree_add_text(parent_tree, tvb, offset, 0, + "Unicode String"); + tree = proto_item_add_subtree(item, ett_nt_unicode_string); + } + + offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, + hf_nt_string_length, NULL); + offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, + hf_nt_string_size, NULL); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + dissect_ndr_nt_STRING_string, NDR_POINTER_PTR, + hf_index); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + + + + diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-dcerpc-nt.h ethereal/packet-dcerpc-nt.h --- ethereal-orig/packet-dcerpc-nt.h Fri Jan 4 07:42:40 2002 +++ ethereal/packet-dcerpc-nt.h Thu Jan 24 21:05:44 2002 @@ -73,4 +73,11 @@ guint32 prs_pop_ptr(GList **ptr_list, char *name); +int dissect_ndr_nt_UNICODE_STRING (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep, int hf_index); +int dissect_ndr_nt_STRING (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep, int hf_index); + #endif /* packet-dcerpc-nt.h */ diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-dcerpc-samr.c ethereal/packet-dcerpc-samr.c --- ethereal-orig/packet-dcerpc-samr.c Fri Dec 7 10:30:35 2001 +++ ethereal/packet-dcerpc-samr.c Thu Jan 24 21:22:06 2002 @@ -30,6 +30,7 @@ #include #include "packet.h" #include "packet-dcerpc.h" +#include "packet-dcerpc-nt.h" #include "packet-dcerpc-samr.h" #include "smb.h" /* for "NT_errors[]" */ @@ -39,8 +40,31 @@ static int hf_samr_perms = -1; static int hf_samr_rid = -1; static int hf_samr_rc = -1; +static int hf_samr_index = -1; +static int hf_samr_acct_ctrl = -1; +static int hf_samr_array_max_count = -1; + +static int hf_samr_level = -1; +static int hf_samr_start_idx = -1; +static int hf_samr_max_entries = -1; +static int hf_samr_pref_maxsize = -1; +static int hf_samr_total_size = -1; +static int hf_samr_ret_size = -1; +static int hf_samr_acct_name = -1; +static int hf_samr_full_name = -1; +static int hf_samr_acct_desc = -1; + +/* these are used by functions in packet-dcerpc-nt.c */ +int hf_nt_str_len = -1; +int hf_nt_str_off = -1; +int hf_nt_str_max_len = -1; +int hf_nt_string_length = -1; +int hf_nt_string_size = -1; + static gint ett_dcerpc_samr = -1; +gint ett_nt_unicode_string = -1; /* used by packet-dcerpc-nt.c*/ +static gint ett_samr_user_dispinfo_1 = -1; static e_uuid_t uuid_dcerpc_samr = { 0x12345778, 0x1234, 0xabcd, @@ -86,6 +110,402 @@ } +static int +samr_dissect_query_dispinfo_level (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + char *drep) +{ + offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, + hf_samr_level, NULL); + + return offset; +} + +static int +samr_dissect_query_dispinfo_rqst (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + char *drep) +{ + offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep, + hf_samr_hnd, NULL); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + samr_dissect_query_dispinfo_level, NDR_POINTER_REF, + -1); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_start_idx, NULL); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_max_entries, NULL); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_pref_maxsize, NULL); + return offset; +} + +static int +samr_dissect_USER_DISPINFO_1 (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + item = proto_tree_add_text(parent_tree, tvb, offset, 0, + "User_DispInfo_1"); + tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1); + } + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_index, NULL); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_rid, NULL); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_acct_ctrl, NULL); + offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + hf_samr_acct_name); + offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + hf_samr_full_name); + offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + hf_samr_acct_desc); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +static int +samr_dissect_USER_DISPINFO_1_ARRAY_users (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + char *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, + samr_dissect_USER_DISPINFO_1); + + return offset; +} + +static int +samr_dissect_USER_DISPINFO_1_ARRAY (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep) +{ + guint32 count; + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + item = proto_tree_add_text(parent_tree, tvb, offset, 0, + "User_DispInfo_1 Array"); + tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1); + } + + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_array_max_count, &count); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + samr_dissect_USER_DISPINFO_1_ARRAY_users, NDR_POINTER_PTR, + -1); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + + + +static int +samr_dissect_USER_DISPINFO_2 (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + item = proto_tree_add_text(parent_tree, tvb, offset, 0, + "User_DispInfo_2"); + tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1); + } + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_index, NULL); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_rid, NULL); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_acct_ctrl, NULL); + offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + hf_samr_acct_name); + offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + hf_samr_acct_desc); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +static int +samr_dissect_USER_DISPINFO_2_ARRAY_users (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + char *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, + samr_dissect_USER_DISPINFO_2); + + return offset; +} + +static int +samr_dissect_USER_DISPINFO_2_ARRAY (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep) +{ + guint32 count; + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + item = proto_tree_add_text(parent_tree, tvb, offset, 0, + "User_DispInfo_2 Array"); + tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1); + } + + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_array_max_count, &count); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + samr_dissect_USER_DISPINFO_2_ARRAY_users, NDR_POINTER_PTR, + -1); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + + + + + +static int +samr_dissect_GROUP_DISPINFO (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + item = proto_tree_add_text(parent_tree, tvb, offset, 0, + "Group_DispInfo"); + tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1); + } + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_index, NULL); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_rid, NULL); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_acct_ctrl, NULL); + offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + hf_samr_acct_name); + offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + hf_samr_acct_desc); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +static int +samr_dissect_GROUP_DISPINFO_ARRAY_groups (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + char *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, + samr_dissect_GROUP_DISPINFO); + + return offset; +} + +static int +samr_dissect_GROUP_DISPINFO_ARRAY (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep) +{ + guint32 count; + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + item = proto_tree_add_text(parent_tree, tvb, offset, 0, + "Group_DispInfo Array"); + tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1); + } + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_array_max_count, &count); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + samr_dissect_GROUP_DISPINFO_ARRAY_groups, NDR_POINTER_PTR, + -1); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + + + +static int +samr_dissect_ASCII_DISPINFO (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + item = proto_tree_add_text(parent_tree, tvb, offset, 0, + "Ascii_DispInfo"); + tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1); + } + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_index, NULL); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_rid, NULL); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_acct_ctrl, NULL); + offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep, + hf_samr_acct_name); + offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep, + hf_samr_acct_desc); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +static int +samr_dissect_ASCII_DISPINFO_ARRAY_users (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + char *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, + samr_dissect_ASCII_DISPINFO); + + return offset; +} + +static int +samr_dissect_ASCII_DISPINFO_ARRAY (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep) +{ + guint32 count; + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + item = proto_tree_add_text(parent_tree, tvb, offset, 0, + "Ascii_DispInfo Array"); + tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1); + } + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_array_max_count, &count); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + samr_dissect_ASCII_DISPINFO_ARRAY_users, NDR_POINTER_PTR, + -1); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + + +static int +samr_dissect_DISPLAY_INFO (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + guint16 level; + + if(parent_tree){ + item = proto_tree_add_text(parent_tree, tvb, offset, 0, + "DispInfo"); + tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1); + } + + offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, + hf_samr_level, &level); + switch(level){ + case 1: + offset = samr_dissect_USER_DISPINFO_1_ARRAY( + tvb, offset, pinfo, tree, drep); + break; + case 2: + offset = samr_dissect_USER_DISPINFO_2_ARRAY( + tvb, offset, pinfo, tree, drep); + break; + case 3: + offset = samr_dissect_GROUP_DISPINFO_ARRAY( + tvb, offset, pinfo, tree, drep); + break; + case 4: + offset = samr_dissect_ASCII_DISPINFO_ARRAY( + tvb, offset, pinfo, tree, drep); + break; + case 5: + offset = samr_dissect_ASCII_DISPINFO_ARRAY( + tvb, offset, pinfo, tree, drep); + break; + } + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +static int +samr_dissect_query_dispinfo_total_size (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + char *drep) +{ + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_total_size, NULL); + return offset; +} +static int +samr_dissect_query_dispinfo_ret_size (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + char *drep) +{ + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_ret_size, NULL); + return offset; +} + +static int +samr_dissect_query_dispinfo_reply (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + char *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + samr_dissect_query_dispinfo_total_size, NDR_POINTER_REF, + -1); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + samr_dissect_query_dispinfo_ret_size, NDR_POINTER_REF, + -1); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + samr_dissect_DISPLAY_INFO, NDR_POINTER_REF, + -1); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_rc, NULL); + + return offset; +} + + static dcerpc_sub_dissector dcerpc_samr_dissectors[] = { { SAMR_CONNECT_ANON, "SAMR_CONNECT_ANON", NULL, samr_dissect_gen_open_reply }, { SAMR_CLOSE_HND, "SAMR_CLOSE_HND", samr_dissect_close_hnd_rqst, samr_dissect_gen_open_reply }, @@ -124,7 +544,7 @@ { SAMR_QUERY_USERINFO, "SAMR_QUERY_USERINFO", NULL, NULL }, { SAMR_SET_USERINFO2, "SAMR_SET_USERINFO2", NULL, NULL }, { SAMR_QUERY_USERGROUPS, "SAMR_QUERY_USERGROUPS", NULL, NULL }, - { SAMR_QUERY_DISPINFO, "SAMR_QUERY_DISPINFO", NULL, NULL }, + { SAMR_QUERY_DISPINFO, "SAMR_QUERY_DISPINFO", samr_dissect_query_dispinfo_rqst, samr_dissect_query_dispinfo_reply }, { SAMR_UNKNOWN_29, "SAMR_UNKNOWN_29", NULL, NULL }, { SAMR_UNKNOWN_2a, "SAMR_UNKNOWN_2a", NULL, NULL }, { SAMR_UNKNOWN_2b, "SAMR_UNKNOWN_2b", NULL, NULL }, @@ -159,9 +579,80 @@ { "Rid", "samr.rid", FT_UINT32, BASE_HEX, NULL, 0x0, "", HFILL }}, { &hf_samr_rc, { "Return code", "samr.rc", FT_UINT32, BASE_HEX, VALS (NT_errors), 0x0, "", HFILL }}, + + { &hf_samr_level, + { "Level", "samr.level", FT_UINT16, BASE_DEC, + NULL, 0x0, "Level requested/returned for Information", HFILL }}, + { &hf_samr_start_idx, + { "Start Idx", "samr.start_idx", FT_UINT32, BASE_DEC, + NULL, 0x0, "Start Index for returned Information", HFILL }}, + + { &hf_samr_max_entries, + { "Max Entries", "samr.max_entries", FT_UINT32, BASE_DEC, + NULL, 0x0, "Maximum number of entries to return", HFILL }}, + + { &hf_samr_pref_maxsize, + { "Pref MaxSize", "samr.pref_maxsize", FT_UINT32, BASE_DEC, + NULL, 0x0, "Maximum Size of data to return", HFILL }}, + + { &hf_samr_total_size, + { "Total Size", "samr.total_size", FT_UINT32, BASE_DEC, + NULL, 0x0, "Total size of data", HFILL }}, + + { &hf_samr_ret_size, + { "Returned Size", "samr.ret_size", FT_UINT32, BASE_DEC, + NULL, 0x0, "Number of returned objects in this PDU", HFILL }}, + + { &hf_samr_index, + { "Index", "samr.index", FT_UINT32, BASE_DEC, + NULL, 0x0, "Index", HFILL }}, + + { &hf_samr_acct_ctrl, + { "Acct Ctrl", "samr.acct_ctrl", FT_UINT32, BASE_DEC, + NULL, 0x0, "Acct CTRL", HFILL }}, + + { &hf_samr_array_max_count, + { "Max Count", "samr.array.max_count", FT_UINT32, BASE_DEC, NULL, 0x0, "Maximum Count: Number of elements in the array", HFILL }}, + + { &hf_samr_acct_name, + { "Account Name", "samr.acct_name", FT_STRING, BASE_NONE, + NULL, 0, "Name of Account", HFILL }}, + + { &hf_samr_full_name, + { "Full Name", "samr.full_name", FT_STRING, BASE_NONE, + NULL, 0, "Full Name of Account", HFILL }}, + + { &hf_samr_acct_desc, + { "Account Desc", "samr.acct_desc", FT_STRING, BASE_NONE, + NULL, 0, "Account Description", HFILL }}, + + + + /* these are used by packet-dcerpc-nt.c */ + { &hf_nt_string_length, + { "Length", "nt.string.length", FT_UINT16, BASE_DEC, + NULL, 0x0, "Length of string in bytes", HFILL }}, + + { &hf_nt_string_size, + { "Size", "nt.string.size", FT_UINT16, BASE_DEC, + NULL, 0x0, "Size of string in bytes", HFILL }}, + + { &hf_nt_str_len, + { "Length", "nt.str.len", FT_UINT32, BASE_DEC, + NULL, 0x0, "Length of string in short integers", HFILL }}, + + { &hf_nt_str_off, + { "Offset", "nt.str.offset", FT_UINT32, BASE_DEC, + NULL, 0x0, "Offset into string in short integers", HFILL }}, + + { &hf_nt_str_max_len, + { "Max Length", "nt.str.max_len", FT_UINT32, BASE_DEC, + NULL, 0x0, "Max Length of string in short integers", HFILL }}, }; static gint *ett[] = { &ett_dcerpc_samr, + &ett_nt_unicode_string, + &ett_samr_user_dispinfo_1, }; proto_dcerpc_samr = proto_register_protocol( diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-dcerpc.c ethereal/packet-dcerpc.c --- ethereal-orig/packet-dcerpc.c Wed Jan 23 19:53:59 2002 +++ ethereal/packet-dcerpc.c Thu Jan 24 19:30:34 2002 @@ -169,12 +169,14 @@ static int hf_dcerpc_dg_seqnum = -1; static int hf_dcerpc_dg_server_boot = -1; static int hf_dcerpc_dg_if_ver = -1; +static int hf_dcerpc_array_max_count = -1; static gint ett_dcerpc = -1; static gint ett_dcerpc_cn_flags = -1; static gint ett_dcerpc_drep = -1; static gint ett_dcerpc_dg_flags1 = -1; static gint ett_dcerpc_dg_flags2 = -1; +static gint ett_dcerpc_pointer_data = -1; /* try to desegment big DCE/RPC packets over TCP? */ static gboolean dcerpc_cn_desegment = TRUE; @@ -422,6 +424,287 @@ } } + +/* NDR arrays */ +/* function to dissect a unidimensional conformant array */ +int +dissect_ndr_ucarray(tvbuff_t *tvb, gint offset, packet_info *pinfo, + proto_tree *tree, char *drep, + dcerpc_dissect_fnct_t *fnct) +{ + guint32 i, count; + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_dcerpc_array_max_count, &count); + for(i=0;iprivate_data; + do{ + int i, len; + + found_new_pointer=0; + len=g_slist_length(ndr_pointer_list); + for(i=0;ifnct){ + dcerpc_dissect_fnct_t *fnct; + + found_new_pointer=1; + fnct=tnpd->fnct; + tnpd->fnct=NULL; + ndr_pointer_list_pos=i+1; + di->hf_index=tnpd->hf_index; + offset = (*(fnct))(tvb, offset, pinfo, tnpd->tree, drep); + break; + } + } + } while(found_new_pointer); + + return offset; +} + + +static void +add_pointer_to_list(packet_info *pinfo, proto_tree *tree, + dcerpc_dissect_fnct_t *fnct, guint32 id, int hf_index) +{ + ndr_pointer_data_t *npd; + + /* check if this pointer is valid */ + if(id!=0xffffffff){ + dcerpc_info *di; + dcerpc_call_value *value; + + di=pinfo->private_data; + value=di->call_data; + + if(di->request){ + if(id>value->max_ptr){ + value->max_ptr=id; + } + } else { + /* if we havent seen the request bail out since we cant + know whether this is the first non-NULL instance + or not */ + if(value->req_frame==-1){ + /* XXX THROW EXCEPTION */ + } + + /* We saw this one in the request frame, nothing to + dissect later */ + if(id<=value->max_ptr){ + return; + } + } + } + + npd=g_malloc(sizeof(ndr_pointer_data_t)); + npd->id=id; + npd->tree=tree; + npd->fnct=fnct; + npd->hf_index=hf_index; + ndr_pointer_list = g_slist_insert(ndr_pointer_list, npd, + ndr_pointer_list_pos); + ndr_pointer_list_pos++; +} + + +static int +find_pointer_index(guint32 id) +{ + ndr_pointer_data_t *npd; + int i,len; + + len=g_slist_length(ndr_pointer_list); + for(i=0;iid==id){ + return i; + } + } + } + + return -1; +} + +int +dissect_ndr_pointer(tvbuff_t *tvb, gint offset, packet_info *pinfo, + proto_tree *tree, char *drep, + dcerpc_dissect_fnct_t *fnct, int type, int hf_index) +{ + + /*TOP LEVEL REFERENCE POINTER*/ + if( pointers_are_top_level + && (type==NDR_POINTER_REF) ){ + add_pointer_to_list(pinfo, tree, fnct, 0xffffffff, hf_index); + goto after_ref_id; + } + + /*TOP LEVEL FULL POINTER*/ + /*TOP LEVEL UNIQUE POINTER*/ + if( pointers_are_top_level + && ((type==NDR_POINTER_PTR)||(type==NDR_POINTER_UNIQUE)) ){ + int idx; + guint32 id; + proto_item *item; + proto_tree *tr; + + /* get the referent id */ + dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id); + + /* we got a NULL pointer */ + if(id==0){ + proto_tree_add_text(tree, tvb, offset, 4, + "NULL pointer"); + offset+=4; + goto after_ref_id; + } + + /* see if we have seen this pointer before */ + idx=find_pointer_index(id); + + /* we have seen this pointer before */ + if(idx>=0){ + proto_tree_add_text(tree, tvb, offset, 4, + "Referent ID:0x%08x",id); + offset+=4; + goto after_ref_id; + } + + /* new pointer */ + item=proto_tree_add_text(tree, tvb, offset, 4, + "Referent ID:0x%08x", id); + offset+=4; + tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data); + add_pointer_to_list(pinfo, tr, fnct, id, hf_index); + goto after_ref_id; + } + + /*EMBEDDED REFERENCE POINTER*/ + if( (!pointers_are_top_level) + && (type==NDR_POINTER_REF) ){ + guint32 id; + proto_item *item; + proto_tree *tr; + + /* get the referent id */ + dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id); + + /* new pointer */ + item=proto_tree_add_text(tree, tvb, offset, 4, + "Referent ID:0x%08x", id); + offset+=4; + tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data); + add_pointer_to_list(pinfo, tr, fnct, 0xffffffff, hf_index); + goto after_ref_id; + } + + /*EMBEDDED FULL POINTER*/ + /*EMBEDDED UNIQUE POINTER*/ + if( (!pointers_are_top_level) + && ((type==NDR_POINTER_PTR)||(type==NDR_POINTER_UNIQUE)) ){ + int idx; + guint32 id; + proto_item *item; + proto_tree *tr; + + /* get the referent id */ + dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id); + + /* we got a NULL pointer */ + if(id==0){ + proto_tree_add_text(tree, tvb, offset, 4, + "NULL pointer"); + offset+=4; + goto after_ref_id; + } + + /* see if we have seen this pointer before */ + idx=find_pointer_index(id); + + /* we have seen this pointer before */ + if(idx>=0){ + proto_tree_add_text(tree, tvb, offset, 4, + "Referent ID:0x%08x",id); + offset+=4; + goto after_ref_id; + } + + /* new pointer */ + item=proto_tree_add_text(tree, tvb, offset, 4, + "Referent ID:0x%08x", id); + offset+=4; + tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data); + add_pointer_to_list(pinfo, tr, fnct, id, hf_index); + goto after_ref_id; + } + + +after_ref_id: + /* After each top level pointer we have dissected we have to + dissect all deferrals before we move on to the next top level + argument */ + if(pointers_are_top_level==TRUE){ + + pointers_are_top_level=FALSE; + offset = dissect_deferred_pointers(pinfo, tree, tvb, offset, drep); + pointers_are_top_level=TRUE; + } + + return offset; +} + static int dcerpc_try_handoff (packet_info *pinfo, proto_tree *tree, proto_tree *dcerpc_tree, @@ -494,7 +777,8 @@ pinfo->current_proto = sub_proto->name; pinfo->private_data = (void *)info; - sub_dissect (tvb, offset, pinfo, sub_tree, drep); + init_ndr_pointer_list(); + offset = sub_dissect (tvb, offset, pinfo, sub_tree, drep); pinfo->current_proto = saved_proto; pinfo->private_data = saved_private_data; @@ -890,6 +1174,7 @@ call_value->opnum = opnum; call_value->req_frame=pinfo->fd->num; call_value->rep_frame=-1; + call_value->max_ptr=0; call_value->private_data = NULL; g_hash_table_insert (dcerpc_calls, call_key, call_value); @@ -913,6 +1198,7 @@ di.conv = conv; di.call_id = hdr->call_id; di.smb_fid = get_smb_fid(pinfo->private_data); + di.request = TRUE; di.call_data = value; if(value->rep_frame!=-1){ @@ -1001,6 +1287,7 @@ di.conv = conv; di.call_id = hdr->call_id; di.smb_fid = get_smb_fid(pinfo->private_data); + di.request = FALSE; di.call_data = value; if(value->req_frame!=-1){ @@ -1464,6 +1751,7 @@ call_value->opnum = hdr.opnum; call_value->req_frame=pinfo->fd->num; call_value->rep_frame=-1; + call_value->max_ptr=0; call_value->private_data = NULL; g_hash_table_insert (dcerpc_calls, call_key, call_value); @@ -1475,6 +1763,7 @@ di.conv = conv; di.call_id = hdr.seqnum; di.smb_fid = -1; + di.request = TRUE; di.call_data = value; dcerpc_try_handoff (pinfo, tree, dcerpc_tree, tvb, offset, @@ -1502,6 +1791,7 @@ di.conv = conv; di.call_id = 0; di.smb_fid = -1; + di.request = FALSE; if(value) { di.call_data = value; } else { @@ -1731,6 +2021,8 @@ { "Activitiy", "dcerpc.dg_act_id", FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }}, { &hf_dcerpc_opnum, { "Opnum", "dcerpc.opnum", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }}, + { &hf_dcerpc_array_max_count, + { "Max Count", "dcerpc.array.max_count", FT_UINT32, BASE_DEC, NULL, 0x0, "Maximum Count: Number of elements in the array", HFILL }}, }; @@ -1740,6 +2032,7 @@ &ett_dcerpc_drep, &ett_dcerpc_dg_flags1, &ett_dcerpc_dg_flags2, + &ett_dcerpc_pointer_data, }; proto_dcerpc = proto_register_protocol ("DCE RPC", "DCERPC", "dcerpc"); diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-dcerpc.h ethereal/packet-dcerpc.h --- ethereal-orig/packet-dcerpc.h Wed Jan 23 19:53:59 2002 +++ ethereal/packet-dcerpc.h Thu Jan 24 19:27:29 2002 @@ -131,6 +131,19 @@ typedef int (dcerpc_dissect_fnct_t)(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep); +#define NDR_POINTER_REF 1 +#define NDR_POINTER_UNIQUE 2 +#define NDR_POINTER_PTR 3 +int dissect_ndr_pointer (tvbuff_t *tvb, gint offset, packet_info *pinfo, + proto_tree *tree, char *drep, + dcerpc_dissect_fnct_t *fnct, int type, int hf_index); + +/* dissect a NDR unidimensional conformant array */ +int dissect_ndr_ucarray(tvbuff_t *tvb, gint offset, packet_info *pinfo, + proto_tree *tree, char *drep, + dcerpc_dissect_fnct_t *fnct); + + typedef struct _dcerpc_sub_dissector { guint16 num; gchar *name; @@ -164,6 +177,7 @@ guint16 opnum; gint32 req_frame; gint32 rep_frame; + guint32 max_ptr; void *private_data; } dcerpc_call_value; @@ -171,6 +185,8 @@ conversation_t *conv; /* Which TCP stream we are in */ guint32 call_id; /* Context id for this call */ guint16 smb_fid; /* FID for DCERPC over SMB */ + gboolean request; + int hf_index; dcerpc_call_value *call_data; } dcerpc_info;