diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-dcerpc-samr.c ethereal/packet-dcerpc-samr.c --- ethereal-orig/packet-dcerpc-samr.c Mon Feb 11 20:41:26 2002 +++ ethereal/packet-dcerpc-samr.c Tue Feb 12 00:20:31 2002 @@ -146,6 +146,8 @@ extern int hf_nt_string_size; extern gint ett_nt_unicode_string; + +/* XXX this one is to be removed later and to be replaced with the one below */ int dissect_ndr_nt_UNICODE_STRING_string (tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, @@ -187,10 +189,88 @@ return offset; } -int -dissect_ndr_nt_UNICODE_STRING (tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *parent_tree, - char *drep, int hf_index) + + + + +/* this function will dissect the + [size_is(size/2), length_is(len/2), ptr] unsigned short *string; + part of the unicode string + + struct { + short len; + short size; + [size_is(size/2), length_is(len/2), ptr] unsigned short *string; + } UNICODE_STRING; + structure used by NT to transmit unicode string values. + + This function also looks at di->levels to see if whoever called us wanted us to append + the name:string to any higher levels in the tree . +*/ + +static int +dissect_ndr_nt_UNICODE_STRING_str(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + char *drep) +{ + guint32 len, off, max_len; + guint16 *data16; + char *text; + int old_offset; + header_field_info *hfi; + dcerpc_info *di; + + di=pinfo->private_data; + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_nt_str_len, &len); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_nt_str_off, &off); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_nt_str_max_len, &max_len); + + old_offset=offset; + offset = prs_uint16s(tvb, offset, pinfo, tree, max_len, &data16, NULL); + text = fake_unicode(data16, max_len); + + hfi = proto_registrar_get_nth(di->hf_index); + proto_tree_add_string_format(tree, di->hf_index, + tvb, old_offset, offset-old_offset, + text, "%s: %s", hfi->name, text); + + if(tree){ + proto_item_set_text(tree, "%s:%s ", hfi->name, text); + tree=tree->parent; + proto_item_set_text(tree, "%s:%s ", hfi->name, text); + while(di->levels>0){ + tree=tree->parent; + proto_item_append_text(tree, "%s ",text); + di->levels--; + } + } + return offset; +} + +/* this function will dissect the + struct { + short len; + short size; + [size_is(size/2), length_is(len/2), ptr] unsigned short *string; + } UNICODE_STRING; + structure used by NT to transmit unicode string values. + + the function takes one additional parameter, level + which specifies how many additional levels up in the tree where we should + append "Name:string" +*/ +static int +dissect_ndr_nt_UNICODE_STRING(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep, int hf_index, int levels) { proto_item *item=NULL; proto_tree *tree=NULL; @@ -205,17 +285,18 @@ if(parent_tree){ item = proto_tree_add_text(parent_tree, tvb, offset, 0, - "Unicode String"); + "unicode string"); tree = proto_item_add_subtree(item, ett_nt_unicode_string); } - offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, - hf_nt_string_length, NULL); - offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, - hf_nt_string_size, NULL); - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - dissect_ndr_nt_UNICODE_STRING_string, NDR_POINTER_PTR, - hf_index); + offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, + hf_nt_string_length, NULL); + offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, + hf_nt_string_size, NULL); + di->levels=1; + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR, + "", hf_index, levels); proto_item_set_len(item, offset-old_offset); return offset; @@ -297,7 +378,7 @@ hf_nt_string_size, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, dissect_ndr_nt_STRING_string, NDR_POINTER_PTR, - hf_index); + "", hf_index, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -357,9 +438,9 @@ packet_info *pinfo, proto_tree *tree, char *drep) { - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_SID, NDR_POINTER_UNIQUE, - -1); + "SID", -1, 0); return offset; } @@ -448,7 +529,7 @@ } offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - di->hf_index); + di->hf_index, di->levels); return offset; } @@ -506,11 +587,11 @@ offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_acct_ctrl, NULL); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_full_name); + hf_samr_full_name, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_desc); + hf_samr_acct_desc, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -548,7 +629,7 @@ hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_DISPINFO_1_ARRAY_users, NDR_POINTER_PTR, - -1); + "USER_DISPINFO_1_ARRAY", -1, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -578,9 +659,9 @@ offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_acct_ctrl, NULL); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_desc); + hf_samr_acct_desc, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -618,7 +699,7 @@ hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_DISPINFO_2_ARRAY_users, NDR_POINTER_PTR, - -1); + "USER_DISPINFO_2_ARRAY", -1, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -651,9 +732,9 @@ offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_acct_ctrl, NULL); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_desc); + hf_samr_acct_desc, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -690,7 +771,7 @@ hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_GROUP_DISPINFO_ARRAY_groups, NDR_POINTER_PTR, - -1); + "GROUP_DISPINFO_ARRAY", -1, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -760,7 +841,7 @@ hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_ASCII_DISPINFO_ARRAY_users, NDR_POINTER_PTR, - -1); + "ACSII_DISPINFO_ARRAY", -1, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -819,13 +900,13 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - hf_samr_total_size); + "", hf_samr_total_size, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - hf_samr_ret_size); + "", hf_samr_ret_size, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_DISPLAY_INFO, NDR_POINTER_REF, - -1); + "", -1, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -855,7 +936,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - hf_samr_index); + "", hf_samr_index, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -898,7 +979,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_PASSWORD_INFO, NDR_POINTER_REF, - -1); + "", -1, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); return offset; @@ -935,7 +1016,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_connect2_server, NDR_POINTER_UNIQUE, - hf_samr_server); + "Server", hf_samr_server, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_access, NULL); @@ -1012,7 +1093,7 @@ hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_GROUP_ARRAY_groups, NDR_POINTER_UNIQUE, - -1); + "USER_GROUP_ARRAY", -1, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -1025,7 +1106,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_GROUP_ARRAY, NDR_POINTER_UNIQUE, - -1); + "USER_GROUP_ARRAY", -1, 0); return offset; } @@ -1036,7 +1117,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_GROUP_ARRAY_ptr, NDR_POINTER_REF, - -1); + "", -1, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); return offset; @@ -1055,7 +1136,7 @@ hf_samr_access, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_SID, NDR_POINTER_REF, - -1); + "", -1, 0); return offset; } @@ -1082,7 +1163,7 @@ hf_samr_hnd, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_SID, NDR_POINTER_REF, - -1); + "SID", -1, 0); return offset; } @@ -1128,7 +1209,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_short, NDR_POINTER_REF, - hf_samr_unknown_short); + "", hf_samr_unknown_short, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); return offset; @@ -1143,8 +1224,9 @@ { offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep, hf_samr_hnd, NULL); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF, + "", hf_samr_acct_name, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_access, NULL); return offset; @@ -1187,12 +1269,12 @@ { offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_desc); + hf_samr_acct_desc, 0); return offset; } @@ -1222,12 +1304,12 @@ case 2: offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); break; case 3: offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_desc); + hf_samr_acct_desc, 0); break; } @@ -1242,7 +1324,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_ALIAS_INFO, NDR_POINTER_UNIQUE, - -1); + "ALIAS_INFO", -1, 0); return offset; } @@ -1253,7 +1335,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_ALIAS_INFO_ptr, NDR_POINTER_REF, - -1); + "", -1, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); return offset; @@ -1270,7 +1352,7 @@ hf_samr_level, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_ALIAS_INFO, NDR_POINTER_REF, - -1); + "", -1, 0); return offset; } @@ -1307,16 +1389,16 @@ hf_samr_hnd, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_STRING, NDR_POINTER_UNIQUE, - hf_samr_server); + "Server", hf_samr_server, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_STRING, NDR_POINTER_REF, - hf_samr_acct_name); + "", hf_samr_acct_name, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_PASSWORD, NDR_POINTER_UNIQUE, - -1); + "Password", -1, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - -1); + "Hash", -1, 0); return offset; } @@ -1329,24 +1411,24 @@ hf_samr_hnd, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE, - hf_samr_server); + "Server", hf_samr_server, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF, - hf_samr_acct_name); + "Account", hf_samr_acct_name, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_PASSWORD, NDR_POINTER_UNIQUE, - -1); + "Password", -1, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - -1); + "Hash", -1, 0); offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep, hf_samr_lm_change, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_PASSWORD, NDR_POINTER_UNIQUE, - -1); + "Password", -1, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - -1); + "Hash", -1, 0); return offset; } @@ -1361,10 +1443,10 @@ hf_samr_unknown_short, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE, - hf_samr_unknown_string); + "Unknown", hf_samr_unknown_string, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE, - hf_samr_unknown_string); + "Unknown", hf_samr_unknown_string, 0); return offset; } @@ -1377,8 +1459,9 @@ offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep, hf_samr_hnd, NULL); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF, + "", hf_samr_acct_name, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_acct_ctrl, NULL); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, @@ -1412,8 +1495,9 @@ hf_samr_hnd, NULL); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, hf_samr_level, NULL); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF, + "", hf_samr_acct_name, 0); return offset; } @@ -1440,28 +1524,28 @@ hf_samr_unknown_char, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - -1); + "Hash", -1, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - -1); + "Hash", -1, 0); offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep, hf_samr_unknown_char, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - -1); + "Hash", -1, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - -1); + "Hash", -1, 0); offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep, hf_samr_unknown_char, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - -1); + "Hash", -1, 0); offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep, hf_samr_unknown_char, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - -1); + "Hash", -1, 0); return offset; } @@ -1486,14 +1570,14 @@ { offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_attrib, NULL); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_desc); + hf_samr_acct_desc, 0); return offset; } @@ -1523,7 +1607,7 @@ case 2: offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); break; case 3: offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, @@ -1532,7 +1616,7 @@ case 4: offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_desc); + hf_samr_acct_desc, 0); break; } @@ -1547,7 +1631,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_GROUP_INFO, NDR_POINTER_UNIQUE, - -1); + "GROUP_INFO", -1, 0); return offset; } @@ -1570,7 +1654,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_GROUP_INFO_ptr, NDR_POINTER_REF, - -1); + "", -1, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); return offset; @@ -1587,7 +1671,7 @@ hf_samr_level, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_GROUP_INFO, NDR_POINTER_REF, - -1); + "", -1, 0); return offset; } @@ -1603,7 +1687,7 @@ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_STRING, NDR_POINTER_UNIQUE, - hf_samr_domain); + "Domain", hf_samr_domain, 0); return offset; } @@ -1655,11 +1739,11 @@ offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep, hf_samr_unknown_time); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_unknown_string); + hf_samr_unknown_string, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_domain); + hf_samr_domain, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_controller); + hf_samr_controller, 0); offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep, hf_samr_unknown_time); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, @@ -1814,17 +1898,17 @@ break; case 4: offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, - tree, drep, hf_samr_unknown_string); + tree, drep, hf_samr_unknown_string, 0); break; case 5: offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, - tree, drep, hf_samr_domain); + tree, drep, hf_samr_domain, 0); break; case 6: offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, - tree, drep, hf_samr_controller); + tree, drep, hf_samr_controller, 0); break; case 7: @@ -1864,7 +1948,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_DOMAIN_INFO, NDR_POINTER_UNIQUE, - hf_samr_domain); + "Domain", hf_samr_domain, 0); return offset; } @@ -1875,7 +1959,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_DOMAIN_INFO_ptr, NDR_POINTER_REF, - hf_samr_domain); + "DOMAIN_INFO", hf_samr_domain, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); return offset; @@ -1899,13 +1983,14 @@ static int samr_dissect_lookup_domain_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, - char *drep) + packet_info *pinfo, proto_tree *tree, + char *drep) { - offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); - offset = dissect_ndr_nt_UNICODE_STRING (tvb, offset, pinfo, tree, drep, - hf_samr_domain); + offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep, + hf_samr_hnd, NULL); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF, + "", hf_samr_domain, 0); return offset; } @@ -1916,7 +2001,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_SID_ptr, NDR_POINTER_REF, - -1); + "", -1, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); return offset; @@ -1939,7 +2024,7 @@ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_SID, NDR_POINTER_UNIQUE, - -1); + "SID", -1, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -1978,7 +2063,7 @@ hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_PSID_ARRAY_sids, NDR_POINTER_UNIQUE, - -1); + "PSID_ARRAY", -1, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -2036,7 +2121,7 @@ hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_INDEX_ARRAY_value, NDR_POINTER_UNIQUE, - di->hf_index); + "INDEX_ARRAY", di->hf_index, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -2052,7 +2137,7 @@ hf_samr_hnd, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_PSID_ARRAY, NDR_POINTER_REF, - -1); + "", -1, 0); return offset; } @@ -2063,7 +2148,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_INDEX_ARRAY, NDR_POINTER_REF, - hf_samr_alias); + "", hf_samr_alias, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); return offset; @@ -2084,14 +2169,14 @@ if(parent_tree){ item = proto_tree_add_text(parent_tree, tvb, offset, 0, - "IDX_AND_NAME"); + "%s:",proto_registrar_get_name(di->hf_index)); tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1); } offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_index, NULL); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, - tree, drep, di->hf_index); + tree, drep, di->hf_index, 4); proto_item_set_len(item, offset-old_offset); return offset; @@ -2119,12 +2204,15 @@ proto_tree *tree=NULL; int old_offset=offset; dcerpc_info *di; + char str[256]; di=pinfo->private_data; + snprintf(str, 255, "%ss:",proto_registrar_get_name(di->hf_index)); + if(parent_tree){ item = proto_tree_add_text(parent_tree, tvb, offset, 0, - "IDX_AND_NAME Array"); + "%s",str); tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1); } @@ -2133,7 +2221,7 @@ hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_IDX_AND_NAME_entry, NDR_POINTER_UNIQUE, - di->hf_index); + str, di->hf_index, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -2144,9 +2232,15 @@ packet_info *pinfo, proto_tree *tree, char *drep) { + char str[256]; + dcerpc_info *di; + + di=pinfo->private_data; + + snprintf(str, 255, "%ss:",proto_registrar_get_name(di->hf_index)); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_IDX_AND_NAME_ARRAY, NDR_POINTER_UNIQUE, - hf_samr_domain); + str, di->hf_index, 0); return offset; } @@ -2159,7 +2253,7 @@ hf_samr_hnd, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - hf_samr_resume_hnd); + "", hf_samr_resume_hnd, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_pref_maxsize, NULL); return offset; @@ -2172,13 +2266,13 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - hf_samr_resume_hnd); + "", hf_samr_resume_hnd, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_IDX_AND_NAME_ARRAY_ptr, NDR_POINTER_REF, - hf_samr_domain); + "", hf_samr_domain, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - hf_samr_entries); + "", hf_samr_entries, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); return offset; @@ -2193,7 +2287,7 @@ hf_samr_hnd, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - hf_samr_resume_hnd); + "", hf_samr_resume_hnd, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_mask, NULL); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, @@ -2208,13 +2302,13 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - hf_samr_resume_hnd); + "", hf_samr_resume_hnd, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_IDX_AND_NAME_ARRAY_ptr, NDR_POINTER_REF, - hf_samr_group); + "", hf_samr_group, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - hf_samr_entries); + "", hf_samr_entries, 0); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); return offset; @@ -2227,13 +2321,13 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - hf_samr_resume_hnd); + "", hf_samr_resume_hnd, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_IDX_AND_NAME_ARRAY_ptr, NDR_POINTER_REF, - hf_samr_alias); + "", hf_samr_alias, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - hf_samr_entries); + "", hf_samr_entries, 0); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); return offset; @@ -2246,7 +2340,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_PSID_ARRAY, NDR_POINTER_REF, - -1); + "", -1, 0); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -2309,7 +2403,7 @@ of 11? */ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_LOGON_HOURS_hours, NDR_POINTER_UNIQUE, - -1); + "LOGON_HOURS", -1, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -2332,15 +2426,15 @@ } offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_full_name); + hf_samr_full_name, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_acct_ctrl, NULL); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_home); + hf_samr_home, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_script); + hf_samr_script, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -2362,9 +2456,9 @@ } offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_full_name); + hf_samr_full_name, 0); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, hf_samr_bad_pwd_count, NULL); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, @@ -2390,23 +2484,23 @@ } offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_full_name); + hf_samr_full_name, 0); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_group, NULL); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_home); + hf_samr_home, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_home_drive); + hf_samr_home_drive, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_script); + hf_samr_script, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_desc); + hf_samr_acct_desc, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_workstations); + hf_samr_workstations, 0); offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep, hf_samr_logon_time); offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep, @@ -2445,9 +2539,9 @@ } offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_full_name); + hf_samr_full_name, 0); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, @@ -2457,15 +2551,15 @@ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep, hf_samr_codepage, NULL); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_home); + hf_samr_home, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_home_drive); + hf_samr_home_drive, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_script); + hf_samr_script, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_desc); + hf_samr_acct_desc, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_workstations); + hf_samr_workstations, 0); offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep, hf_samr_logon_time); offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep, @@ -2502,9 +2596,9 @@ } offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_full_name); + hf_samr_full_name, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -2621,7 +2715,7 @@ hf_samr_count, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_BUFFER_buffer, NDR_POINTER_UNIQUE, - -1); + "BUFFER", -1, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -2634,7 +2728,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_BUFFER, NDR_POINTER_UNIQUE, - -1); + "BUFFER", -1, 0); return offset; } @@ -2666,31 +2760,31 @@ offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep, hf_samr_pwd_must_change_time); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_full_name); + hf_samr_full_name, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_home); + hf_samr_home, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_home_drive); + hf_samr_home_drive, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_script); + hf_samr_script, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_profile); + hf_samr_profile, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_desc); + hf_samr_acct_desc, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_workstations); + hf_samr_workstations, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_comment); + hf_samr_comment, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_parameters); + hf_samr_parameters, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_unknown_string); + hf_samr_unknown_string, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_unknown_string); + hf_samr_unknown_string, 0); offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_unknown_string); + hf_samr_unknown_string, 0); offset = samr_dissect_BUFFER(tvb, offset, pinfo, tree, drep); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); @@ -2835,11 +2929,11 @@ break; case 7: offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_full_name); + hf_samr_full_name, 0); break; case 8: offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_desc); + hf_samr_acct_desc, 0); break; case 9: offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, @@ -2851,19 +2945,19 @@ break; case 11: offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_home); + hf_samr_home, 0); break; case 12: offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_home_drive); + hf_samr_home_drive, 0); break; case 13: offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_script); + hf_samr_script, 0); break; case 14: offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_workstations); + hf_samr_workstations, 0); break; case 16: offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, @@ -2883,7 +2977,7 @@ break; case 20: offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_profile); + hf_samr_profile, 0); break; case 21: offset = samr_dissect_USER_INFO_21( @@ -2914,7 +3008,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_INFO, NDR_POINTER_UNIQUE, - -1); + "USER_INFO", -1, 0); return offset; } @@ -2929,7 +3023,7 @@ hf_samr_level, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_INFO, NDR_POINTER_REF, - -1); + "", -1, 0); return offset; } @@ -2941,7 +3035,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_INFO_ptr, NDR_POINTER_REF, - -1); + "", -1, 0); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -3040,10 +3134,10 @@ hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_MEMBER_ARRAY_rids, NDR_POINTER_UNIQUE, - -1); + "RIDs", -1, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_MEMBER_ARRAY_types, NDR_POINTER_UNIQUE, - -1); + "Types", -1, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -3056,7 +3150,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_MEMBER_ARRAY, NDR_POINTER_UNIQUE, - -1); + "MEMBER_ARRAY", -1, 0); return offset; } @@ -3067,7 +3161,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_MEMBER_ARRAY_ptr, NDR_POINTER_REF, - -1); + "", -1, 0); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -3085,7 +3179,7 @@ hf_samr_info_type, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_BUFFER, NDR_POINTER_REF, - -1); + "", -1, 0); return offset; } @@ -3110,7 +3204,7 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_BUFFER_ptr, NDR_POINTER_REF, - -1); + "", -1, 0); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -3124,7 +3218,7 @@ char *drep) { offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); return offset; } @@ -3162,7 +3256,7 @@ hf_samr_count, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_LOOKUP_NAMES, NDR_POINTER_REF, - -1); + "", -1, 0); return offset; } @@ -3174,10 +3268,10 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_INDEX_ARRAY, NDR_POINTER_REF, - hf_samr_rid); + "", hf_samr_rid, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_INDEX_ARRAY, NDR_POINTER_REF, - hf_samr_type); + "", hf_samr_type, 0); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -3229,7 +3323,7 @@ hf_samr_count, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_LOOKUP_RIDS, NDR_POINTER_REF, - -1); + "", -1, 0); return offset; } @@ -3240,7 +3334,7 @@ char *drep) { offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_name); + hf_samr_acct_name, 0); return offset; } @@ -3274,7 +3368,7 @@ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_UNICODE_STRING_ARRAY_names, NDR_POINTER_UNIQUE, - -1); + "Strings", -1, 0); proto_item_set_len(item, offset-old_offset); return offset; @@ -3290,10 +3384,10 @@ { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_UNICODE_STRING_ARRAY, NDR_POINTER_REF, - hf_samr_rid); + "", hf_samr_rid, 0); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_INDEX_ARRAY, NDR_POINTER_REF, - hf_samr_type); + "", hf_samr_type, 0); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-dcerpc.c ethereal/packet-dcerpc.c --- ethereal-orig/packet-dcerpc.c Mon Feb 11 20:41:26 2002 +++ ethereal/packet-dcerpc.c Tue Feb 12 00:22:43 2002 @@ -172,6 +172,7 @@ static int hf_dcerpc_array_max_count = -1; static int hf_dcerpc_array_offset = -1; static int hf_dcerpc_array_actual_count = -1; +static int hf_dcerpc_referent_id = -1; static gint ett_dcerpc = -1; static gint ett_dcerpc_cn_flags = -1; @@ -537,6 +538,7 @@ proto_tree *tree; dcerpc_dissect_fnct_t *fnct; /*if non-NULL, we have not called it yet*/ int hf_index; + int levels; } ndr_pointer_data_t; static void @@ -585,7 +587,7 @@ tnpd->fnct=NULL; ndr_pointer_list_pos=i+1; di->hf_index=tnpd->hf_index; - + di->levels=tnpd->levels; /* first a run to handle any conformant array headers */ di->conformant_run=1; @@ -604,7 +606,7 @@ static void add_pointer_to_list(packet_info *pinfo, proto_tree *tree, - dcerpc_dissect_fnct_t *fnct, guint32 id, int hf_index) + dcerpc_dissect_fnct_t *fnct, guint32 id, int hf_index, int levels) { ndr_pointer_data_t *npd; @@ -617,8 +619,10 @@ value=di->call_data; if(di->request){ - if(id>value->max_ptr){ - value->max_ptr=id; + if(!(pinfo->fd->flags.visited)){ + if(id>value->max_ptr){ + value->max_ptr=id; + } } } else { /* if we havent seen the request bail out since we cant @@ -641,6 +645,7 @@ npd->tree=tree; npd->fnct=fnct; npd->hf_index=hf_index; + npd->levels=levels; ndr_pointer_list = g_slist_insert(ndr_pointer_list, npd, ndr_pointer_list_pos); ndr_pointer_list_pos++; @@ -666,13 +671,24 @@ return -1; } +/* this function dissects an NDR pointer and stores the callback for later deferred dissection. + * fnct is the callback function for when we have reached this object in the bytestream. + * type is what type of pointer this is + * text is what text we should put in any created tree node + * hf_index is what hf value we want to pass to the callback function when it is called, + * the callback can later pich this one up from di->hf_index. + * levels is a generic int we want to pass to teh callback function. + * the callback can later pick it up from di->levels + * + * See packet-dcerpc-samr.c for examples + */ int dissect_ndr_pointer(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree, char *drep, - dcerpc_dissect_fnct_t *fnct, int type, int hf_index) + dcerpc_dissect_fnct_t *fnct, int type, char *text, int hf_index, int levels) { dcerpc_info *di; - + di=pinfo->private_data; if(di->conformant_run){ /* this call was only for dissecting the header for any @@ -685,7 +701,7 @@ /*TOP LEVEL REFERENCE POINTER*/ if( pointers_are_top_level && (type==NDR_POINTER_REF) ){ - add_pointer_to_list(pinfo, tree, fnct, 0xffffffff, hf_index); + add_pointer_to_list(pinfo, tree, fnct, 0xffffffff, hf_index, levels); goto after_ref_id; } @@ -704,7 +720,7 @@ /* we got a NULL pointer */ if(id==0){ proto_tree_add_text(tree, tvb, offset-4, 4, - "NULL pointer"); + "(NULL pointer)%s",text); goto after_ref_id; } @@ -714,15 +730,16 @@ /* we have seen this pointer before */ if(idx>=0){ proto_tree_add_text(tree, tvb, offset-4, 4, - "Referent ID:0x%08x",id); + "(duplicate) %s",text); goto after_ref_id; } /* new pointer */ item=proto_tree_add_text(tree, tvb, offset-4, 4, - "Referent ID:0x%08x", id); + "%s", text); tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data); - add_pointer_to_list(pinfo, tr, fnct, id, hf_index); + proto_tree_add_uint(tr, hf_dcerpc_referent_id, tvb, offset-4, 4, id); + add_pointer_to_list(pinfo, tr, fnct, id, hf_index, levels); goto after_ref_id; } @@ -738,16 +755,16 @@ /* new pointer */ item=proto_tree_add_text(tree, tvb, offset-4, 4, - "Referent ID:0x%08x", id); + "%s",text); tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data); - add_pointer_to_list(pinfo, tr, fnct, 0xffffffff, hf_index); + proto_tree_add_uint(tr, hf_dcerpc_referent_id, tvb, offset-4, 4, id); + add_pointer_to_list(pinfo, tr, fnct, 0xffffffff, hf_index, levels); goto after_ref_id; } - /*EMBEDDED FULL POINTER*/ /*EMBEDDED UNIQUE POINTER*/ if( (!pointers_are_top_level) - && ((type==NDR_POINTER_PTR)||(type==NDR_POINTER_UNIQUE)) ){ + && (type==NDR_POINTER_UNIQUE) ){ int idx; guint32 id; proto_item *item; @@ -759,7 +776,34 @@ /* we got a NULL pointer */ if(id==0){ proto_tree_add_text(tree, tvb, offset-4, 4, - "NULL pointer"); + "(NULL pointer)%s", text); + goto after_ref_id; + } + + /* new pointer */ + item=proto_tree_add_text(tree, tvb, offset-4, 4, + "%s",text); + tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data); + proto_tree_add_uint(tr, hf_dcerpc_referent_id, tvb, offset-4, 4, id); + add_pointer_to_list(pinfo, tr, fnct, 0xffffffff, hf_index, levels); + goto after_ref_id; + } + + /*EMBEDDED FULL POINTER*/ + if( (!pointers_are_top_level) + && (type==NDR_POINTER_PTR) ){ + int idx; + guint32 id; + proto_item *item; + proto_tree *tr; + + /* get the referent id */ + offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id); + + /* we got a NULL pointer */ + if(id==0){ + proto_tree_add_text(tree, tvb, offset-4, 4, + "(NULL pointer)%s",text); goto after_ref_id; } @@ -768,16 +812,16 @@ /* we have seen this pointer before */ if(idx>=0){ - proto_tree_add_text(tree, tvb, offset-4, 4, - "Referent ID:0x%08x",id); + proto_tree_add_uint(tree, hf_dcerpc_referent_id, tvb, offset-4, 4, id); goto after_ref_id; } /* new pointer */ item=proto_tree_add_text(tree, tvb, offset-4, 4, - "Referent ID:0x%08x", id); + "%s", text); tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data); - add_pointer_to_list(pinfo, tr, fnct, id, hf_index); + proto_tree_add_uint(tr, hf_dcerpc_referent_id, tvb, offset-4, 4, id); + add_pointer_to_list(pinfo, tr, fnct, id, hf_index, levels); goto after_ref_id; } @@ -787,7 +831,6 @@ dissect all deferrals before we move on to the next top level argument */ if(pointers_are_top_level==TRUE){ - pointers_are_top_level=FALSE; offset = dissect_deferred_pointers(pinfo, tree, tvb, offset, drep); pointers_are_top_level=TRUE; @@ -1975,6 +2018,9 @@ { &hf_dcerpc_response_in, { "Response in", "dcerpc.response_in", FT_UINT32, BASE_DEC, NULL, 0, "The response to this packet is in this packet", HFILL }}, + { &hf_dcerpc_referent_id, + { "Referent ID", "dcerpc.referent_id", FT_UINT32, BASE_HEX, + NULL, 0, "Referent ID for this NDR encoded pointer", HFILL }}, { &hf_dcerpc_ver, { "Version", "dcerpc.ver", FT_UINT8, BASE_DEC, NULL, 0x0, "", HFILL }}, { &hf_dcerpc_ver_minor, diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-dcerpc.h ethereal/packet-dcerpc.h --- ethereal-orig/packet-dcerpc.h Mon Feb 11 20:41:26 2002 +++ ethereal/packet-dcerpc.h Mon Feb 11 23:09:58 2002 @@ -142,7 +142,7 @@ #define NDR_POINTER_PTR 3 int dissect_ndr_pointer (tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree, char *drep, - dcerpc_dissect_fnct_t *fnct, int type, int hf_index); + dcerpc_dissect_fnct_t *fnct, int type, char *text, int hf_index, int levels); /* dissect a NDR unidimensional conformant array */ int dissect_ndr_ucarray(tvbuff_t *tvb, gint offset, packet_info *pinfo, @@ -206,6 +206,7 @@ guint32 array_actual_count; guint32 array_actual_count_offset; int hf_index; + int levels; /* number of levels upwards in the tree to append text*/ dcerpc_call_value *call_data; } dcerpc_info;