aboutsummaryrefslogtreecommitdiffstats
path: root/packet-dcerpc.c
AgeCommit message (Collapse)AuthorFilesLines
2003-01-14Catch ReportedBoundsError exceptions when dissecting decrypted stubGuy Harris1-5/+19
data, as the error could be due to the decryption being bad, and we should still dissect the authentication data. svn path=/trunk/; revision=6924
2003-01-06Update DCERPC so that for (NTLMSSP) PDUs that have been decryptedRonnie Sahlberg1-2/+23
we also call the proper DCERPC subdissector. With this change ethereal will call the SAMR dissector and dissect the decrypted SAMR packets in devins capture. svn path=/trunk/; revision=6855
2002-12-31Fix a braino in a last-minute fix I put into the previous checkin.Guy Harris1-1/+2
svn path=/trunk/; revision=6826
2002-12-31From Devin Heitmueller: support for decrypting DCERPC conversationsGuy Harris1-89/+148
using NTLMSSP version 1. Show stub data as such for all requests and replies where we can't dissect the stub data as a request or reply for some DCERPC-based protocol. svn path=/trunk/; revision=6825
2002-12-19Update reassemble.c/show_item and all callers to use FT_FRAMENUM for the ↵Ronnie Sahlberg1-3/+3
list of packets corresponding to a reassembled pdu svn path=/trunk/; revision=6807
2002-12-14When processing a connection-oriented DCERPC PDU, don't set the columnsGuy Harris1-7/+6
until we know that we have the entire PDU - we might not have all of it, as some of it might be in, for example, a later TCP segment. svn path=/trunk/; revision=6785
2002-12-11From Devin Heitmueller:Guy Harris1-31/+22
Minor change to the connection oriented DCE/RPC function calls. Now the offset is provided in the call, instead of having a hard-coded value in each function. Also makes the calling convention consistent with the datagram equivalents for the functions. Didn't do it for dissect_dcerpc_cn_auth() yet, as that is a special case (and I am in the process of restructuring it to make verifier decryption work properly). svn path=/trunk/; revision=6778
2002-12-05It seems pretty clear that a PDU_AUTH3 really is an AUTH3 PDU, and weGuy Harris1-2/+2
know what it is (a PDU for the third stage in a 3-way authentication handshake, as is done with NTLMSSP authentication, for example) - get rid of the question mark after "AUTH3". svn path=/trunk/; revision=6746
2002-11-28Arguments to hash routines are gconstpointer's; assign them to constGuy Harris1-10/+10
pointers. The first argument to "sscanf()" is a "const char *"; don't cast const pointers to "char *" when passing them to "sscanf()". Assign the result of "tvb_get_ptr()" to const pointers, not non-const pointers. Make the "pdata" argument to various DCE routines a const pointer. svn path=/trunk/; revision=6688
2002-11-10Dissect NTLMSSP authentication verifiers, as per lkcl's "DCE/RPC overGuy Harris1-4/+17
SMB" book. svn path=/trunk/; revision=6598
2002-11-05In connection-oriented DCE RPC, the authentication data are credentialsGuy Harris1-21/+58
only in bind, bind_ack, alter_context, alter_context_response, and auth3 PDUs; they're a verifier of some sort in other PDUs. The verifier appears to start with an OID for the real authentication mechanism if the authentication type is SPNEGO. svn path=/trunk/; revision=6563
2002-11-03Use the full name of the "hf_dcerpc_obj_id" field when formatting theGuy Harris1-5/+12
protocol tree item for it. Fix a typo. svn path=/trunk/; revision=6555
2002-11-02From Jean-Baptiste Marchand update the proto_tree_add_ for UUIDs in theRonnie Sahlberg1-66/+95
dcerpc layer (and the subdissectors using dissect_ndr_uuid_t()) so that it is possible to use display filters on these items. svn path=/trunk/; revision=6547
2002-10-25From Ronnie Sahlberg: Ethereal support for DCERPCSTAT.Guy Harris1-15/+2
svn path=/trunk/; revision=6499
2002-10-24Add a "fragment_add_seq_next()" to reassemble fragments that don't haveGuy Harris1-2/+2
sequence numbers or offsets and are thus assumed to be received in order with no duplicates or dropped fragments (e.g., for NetBIOS Frame, where 802.2 LLC guarantees in-order delivery to NetBIOS with no duplicates or dropped fragments). "show_fragment_tree()' and "show_fragment_seq_tree()" don't modify the "fragment_items" to which the "fit" argument points, so make that argument a "const fragment_items *". Make all the "fragment_items" tables "static" (as they're not used outside the modules defining them) and "const" (as they're not modified). Add support for reassembly of NetBIOS fragmented requests and responses. Get rid of an unnecessary include of "packet-tr.c" in the NetBIOS dissector, and make its table of dissection function pointers static. Fix some typos in the AppleTalk and NetBIOS dissectors. svn path=/trunk/; revision=6491
2002-10-23From Ronnie Sahlberg: add a tap for statistics for DCERPC interfaces.Guy Harris1-1/+40
svn path=/trunk/; revision=6479
2002-10-22From Ronnie Sahlberg: track and display the time between requests andGuy Harris1-2/+42
replies for DCERPC similar to what is already done for ONC-RPC. svn path=/trunk/; revision=6465
2002-09-26From Jaime Fournier: updates to dcerpc conversation managerRonnie Sahlberg1-1/+25
svn path=/trunk/; revision=6339
2002-09-09Dissect the autentication verifier for Kerberos 5 authentication inGuy Harris1-5/+46
connectionless PDUs. svn path=/trunk/; revision=6240
2002-09-08Auth type 8 is NETLOGON secure channel used for BDC replication.Tim Potter1-2/+4
svn path=/trunk/; revision=6230
2002-09-03From Ulf Lamping, support for ieee float and double types in the dcerpcRonnie Sahlberg1-5/+79
dissectors. svn path=/trunk/; revision=6170
2002-08-30snego -> spnegoTim Potter1-5/+5
svn path=/trunk/; revision=6138
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-87/+87
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-22These guys got lost in a merge. Actually call the gssapi dissector fromTim Potter1-18/+37
the relevant parts of the SMB and DCERPC dissectors. svn path=/trunk/; revision=6066
2002-08-21Moved the generic true_false_string saying "Set", "Not set" intoTim Potter1-6/+1
epan/packet.c It was cut and pasted into seven other dissectors! svn path=/trunk/; revision=6052
2002-08-13Display the protocol name for the UUID in the COL_INFO field if weTim Potter1-2/+11
know it. This reduces clutter in the top pane considerably. svn path=/trunk/; revision=5985
2002-08-02Replace the types from sys/types.h and netinet/in.h by their glib.hJörg Mayer1-5/+1
equivalents for the toplevel directory. The removal of winsock2.h will hopefully not cause any problems under MSVC++, as those files using struct timeval still include wtap.h, which still includes winsock2.h. svn path=/trunk/; revision=5932
2002-07-25For connection-oriented DCE RPC, show the stub data if we can't actuallyGuy Harris1-2/+18
do anything else with a request or reply (e.g., because we haven't seen the bind request). svn path=/trunk/; revision=5904
2002-07-11Added another authentication service for Snego.Tim Potter1-1/+4
svn path=/trunk/; revision=5858
2002-07-10Put back the code to show the authentication data as "Auth Data"; callGuy Harris1-15/+20
it if we don't show it as NTLMSSP. Use #defines for the authentication protocols. svn path=/trunk/; revision=5853
2002-07-10Reordered some boolean fields to be consistent with the rest of ethereal.Tim Potter1-22/+26
svn path=/trunk/; revision=5850
2002-07-09Dissector for DCERPC auth type == 10 (NTLMSSP) fromTim Potter1-3/+18
dheitmueller@netilla.com. svn path=/trunk/; revision=5848
2002-06-24Put the code to reassemble fragmented connection-oriented andGuy Harris1-403/+215
connectionless DCE RPC PDUs into common routines, and call those routines when dissecting DCE RPC requests and responses. Get rid of arguments to "dcerpc_try_handoff()" whose values are also in the "dcerpc_info" structure pointed to by its "info" argument. svn path=/trunk/; revision=5757
2002-06-24Change each DCERPC dissector to pass in a hf value on initialisationTim Potter1-19/+15
for a value_string that corresponds to that dissectors opnums. Pass in -1 if no such table is available. svn path=/trunk/; revision=5749
2002-06-22From Jaime Fournier: handle DCE RPC connectionless CANCEL PDUs with noGuy Harris1-2/+10
body. svn path=/trunk/; revision=5730
2002-06-19Don't hand off the stub body of a Fault PDU to the subdissector for theGuy Harris1-9/+21
protocol. svn path=/trunk/; revision=5704
2002-06-19Dissect the bodies of some additional PDU types.Guy Harris1-295/+950
Show presentation context negotiation results and rejection reasons, PDU rejection reasons, and rejection status codes symbolically. Show the presentation context negotiation rejection reason only if there was a rejection, and, if so, show it in the Info column as well as the protocol tree. Show more fields in the Info column. Show the packet type in decimal in the protocol tree - it's shown as decimal in the Info column and the values are shown as decimal in the DCE RPC 1.1 spec. Show the sequence number for connectionless PDUs as decimal in the protcool tree - it's snown as decimal in the Info column, and the call ID for connection-oriented PDUs is shown as decimal in the protocol tree. svn path=/trunk/; revision=5701
2002-06-18There's no more need for separate request and response reassembly hashGuy Harris1-143/+150
tables for connectionless PDUs than for connection-oriented PDUs; just have one connectionless PDU reassembly hash table. Get rid of unnecessary tests of "dcerpc_reassemble" - the code to handle requests and responses was if (!dcerpc_reassemble || packet not fragmented || frame is short) don't reassemble; else if (dcerpc_reassemble) reassemble but if we go into the "else" clause we know that all three conditions in the "if" are false, including "!dcerpc_reassemble", so we know "dcerpc_reassemble" is true. Set "pinfo->fragmented" based on whether the PDU being dissected is an unreassembled first fragment or not. Put a "Fragment data" item into the protocol tree for all fragments. Properly maintain the offset when dissecting the header of a connectionless PDU, even if we aren't building a protocol tree. "fd_head->datalen" is bogus for sequence-number-based reassembly; use "fd_head->len" instead. svn path=/trunk/; revision=5695
2002-06-18The offset of the authentication information in a connectionless PDU isGuy Harris1-9/+5
the fragment length *plus the offset of the beginning of the fragment data*, not just the fragment length. svn path=/trunk/; revision=5694
2002-06-17Add support for reassembly of fragmented connectionless PDUs.Guy Harris1-80/+196
Don't try to add a fragment to a reassembly operation if we don't have all of the stub data (because the frame is short, or because it's part of a packet fragmented at a layer below RPC and not reassembled). Put an entry into the protocol tree for the fragment data of the last fragment. svn path=/trunk/; revision=5688
2002-06-17Add #defines for the bits in the flag fields, and a macro to testGuy Harris1-87/+247
whether a connection-oriented PDU is fragmented or not. Clean up the handling of fragmented connection-oriented PDUs (the code to handle fragmented PDUs can assume that it is not the case that both PFC_FIRST_FRAG and PFC_LAST_FRAG are set, as that's an unfragmented PDU). Put an entry into the protocol tree for the fragment data in fragmented PDUs. For fragmented connectionless PDUs, don't hand the payload of any fragment other than the first fragment to the subdissector. svn path=/trunk/; revision=5687
2002-06-07Add "show_fragment_seq_tree()", which is like "show_fragment_tree()",Guy Harris1-2/+4
but for stuff reassembled with "fragment_add_seq()" or "fragment_add_seq_check()". Add a "fragment tag" string to the "fragment_items", so that packets with fragmentation errors can be properly flagged as having "Illegal fragments" or "Illegal segments" depending on the term used with the protocol in question. Make all the dissectors that can use "show_fragment_tree()" or "show_fragment_seq_tree()", and don't already use them, do so. svn path=/trunk/; revision=5644
2002-06-05Added show_fragment_tree() to reassemble. This function will do the commonRonnie Sahlberg1-103/+20
task of creating a fregment tree for the fragmented packets. Having this identical code to create this tree in every dissector that does PDU reassembly is a huge waste and duplication of code. Updated IP, SMB and DCERPC to use the new function. svn path=/trunk/; revision=5626
2002-06-04Get rid of the "data_src" member of the "frame_data" structure; put itGuy Harris1-3/+3
in the "packet_info" structure instead, as we don't need a pointer for every single frame in the capture file, just for each frame for which we currently have an open "epan_dissect_t". svn path=/trunk/; revision=5614
2002-05-27Changed toplevel REF pointer dissection to create a subtree. Not creating a ↵Ronnie Sahlberg1-2/+10
subtree was a design mistake which caused ugliness in the unicode string str dissector and in other places. Dissectors will temporarily have less pretty output for topleve ref pointers until their output is retuned. svn path=/trunk/; revision=5573
2002-05-25Fix a bug for dcerpc. If we do not have reassembly of fragments enabled, ↵Ronnie Sahlberg1-6/+18
only call the subdissector for the first fragment. svn path=/trunk/; revision=5556
2002-05-24Reassembly of fragmented DCE/RPC (only for connection oriented DCE/RPC).Ronnie Sahlberg1-8/+303
svn path=/trunk/; revision=5548
2002-05-23Additions to the MAPI dissector. Function 02 for MAPI.Ronnie Sahlberg1-2/+2
The function request/call are dissected but the main body of the function in/out parameters consists of a unidimensional conformant and varying array of bytes which content is encrypted/obfuscated. Whoever can tell me how to decrypt/unobfuscate these bytes will get a case of VB next time in Sydney. svn path=/trunk/; revision=5532
2002-05-07Added extra check in the function that parses NDR pointers.Ronnie Sahlberg1-1/+58
When the representation for a pointer type gets dissected, the dissector is actually called twice. Once with conformant_run==1 and once ==0. The idea is that when conformant_run is ==1, the ONLY bytes that will be dissected and would be the array structure preceeding the actual data. And the normal data and content will be dissected when conformant_run ==0. This is to handle the case properly when conformant arrays are embedded inside aggregated types, in which case there will be other data inserted between these array control data, and the array content. The check that is added will assert that no other data is actually eaten for conformant_run==1 than just this data. This will help debugging dcerpc dissectors. svn path=/trunk/; revision=5412
2002-05-02From Joerg Mayer: get rid of some unused variables and arguments, andGuy Harris1-9/+9
mark other unused arguments as such. svn path=/trunk/; revision=5366
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-05 08:50:28 +0000