aboutsummaryrefslogtreecommitdiffstats
path: root/packet-dcerpc.c
AgeCommit message (Collapse)AuthorFilesLines
2003-12-08From Jamie Fournier: don't show UNKUUID information for fragments forGuy Harris1-6/+12
known dissectors. svn path=/trunk/; revision=9208
2003-11-25From Jaime Fournier: show the RPC version of the unknown interface inGuy Harris1-11/+7
the Info column. svn path=/trunk/; revision=9081
2003-11-21From Jamie Fournier: add the UUID to the Info column for datagram calls.Guy Harris1-3/+9
svn path=/trunk/; revision=9054
2003-11-16Export "protocol_t" as an opaque type.Guy Harris1-4/+5
Make "proto_is_protocol_enabled()" and "proto_get_protocol_short_name()" take a "protocol_t *" as an argument, so they don't have to look up the "protocol_t" - this will probably speed them up considerably, and they're called on almost every dissector handoff. Get rid of a number of "proto_is_protocol_enabled()" calls that aren't necessary (dissectors called through handles, including those called through dissector tables, or called as heuristic dissectors, aren't even called if their protocol isn't enabled). Change some direct dissector calls to go through handles. svn path=/trunk/; revision=8979
2003-11-13From Jaime Fournier: get rid of space in field name.Guy Harris1-2/+2
svn path=/trunk/; revision=8958
2003-11-12Put stub data back where it was in the tree before.Guy Harris1-3/+3
svn path=/trunk/; revision=8947
2003-11-06Update a comment.Guy Harris1-2/+8
Catch another case where we need to check for a null decrypted_tvb. svn path=/trunk/; revision=8894
2003-11-06Bugfix for dcerpc parsing of encrypted short packets.Ronnie Sahlberg1-3/+11
Sometimes if we cant decrypt a DCERPC packet decrypted_tvb is NULL. do not pass a NULL pointer to show_stub_data() since this will dump core. svn path=/trunk/; revision=8890
2003-10-23Fix a call to "dissect_dcerpc_cn()" to handle the new return value.Guy Harris1-2/+2
svn path=/trunk/; revision=8761
2003-10-23Catch exceptions in "dissect_dcerpc_cn_bs()", so that if we get anGuy Harris1-20/+54
exception dissecting stuff past the DCE RPC header, we still drive on and dissect the next PDU, if any. svn path=/trunk/; revision=8760
2003-10-23Get rid of the "offset" argument to "dcerpc_try_handoff()" - it's alwaysGuy Harris1-121/+203
0. In "dcerpc_try_handoff()", remove the authentication padding from the stub data handed to the subdissector - that's not really stub data for the subdissector, and it should throw an exception if the request or response would go into the authentication padding. Don't even try to dissect the remaining stub data if the authentication padding value consumes all the stub data or would consume even more than that. Show any "Long frame" data before the authentication padding, and show the authentication padding as the stuff at the very end of the stub data, after the "Long frame" data. Catch all exceptions when dissecting authentication information, so that even if it's bad or we don't have all of it, we still dissect the stub data. Try dissecting authentication trailer information even if we don't have all of it in the tvbuff - we want an exception to be thrown if we don't. Don't try to dissect it if it eats into the stub data, however. Don't bother catching exceptions in "dissect_auth_verf()" - we now always catch exceptions in above it in the DCE RPC dissector call tree. Use CATCH_ALL and "show_exception()" when calling the sub-dissector for a connection-oriented PDU; that means we won't have to worry about adding new exception types unless they're types that we should rethrow. svn path=/trunk/; revision=8759
2003-10-22From Yaniv Kaul: if there's more than one context item in a BIND PDU, showGuy Harris1-2/+5
the number of context items before showing the first one. svn path=/trunk/; revision=8753
2003-10-21Catch exceptions when dissecting a verifier, so we still dissect theGuy Harris1-100/+112
stub data even if there's a problem dissecting the verifier. Show stub data as "Encrypted stub data" if it's encrypted, "Decrypted stub data" if it was encrypted but we decrypted it, and "Stub data" if it wasn't encrypted. Don't attempt to decrypt data unless it was encrypted (i.e., the authentication level is "Packet privacy". Get rid of "decrypted_data" member of "packet_info" structure - we don't need it any more. svn path=/trunk/; revision=8743
2003-10-14"dce_try_handoff()" isn't necessarily passed a non-null "auth_info"Guy Harris1-4/+6
argument - don't dereference it if it's null. svn path=/trunk/; revision=8685
2003-10-10Updated the DCERPC service response time to also offer the menu toRonnie Sahlberg1-1/+18
Filter, Find and Colorize selected procedures in the same way as SMB and ONC-RPC already does. svn path=/trunk/; revision=8667
2003-10-08Change dissect_deferred_pointer()Ronnie Sahlberg1-2/+5
from being Ordo(n^2) into being Ordo(n) Makes it slightly faster when n (the number of pointers) is >10.000 The mother of all dcerpc packets (containing one array of >10.000 pointers) was a bit slow. It is still slow but at least completes in out lifetime. svn path=/trunk/; revision=8647
2003-09-26This commit refactors the dcerpc authentication subdissectors forTim Potter1-125/+105
handling encrypted request/response PDUs. Instead of having dissection function pointers which perform both decryption and dissection, the function pointers now only decrypt the DCERPC fragment payload. Dissection is handled by the dcerpc_try_handoff() function (with DCERPC fragment reassembly if necessary). Details: - Move the dcerpc_auth_info struct into dcerpc.h as it is now used in the function prototype for the decryption function handlers. - decode_encrypted_data() was refactored to take a boolean request parameter instead of passing the DCERPC PDU packet type. - A tvbuff_t * data field was added to dcerpc_auth to hold the verifier. This is passed as an argument to the decryption function handlers. - Dissection of verifiers in request and response PDUs was moved to before the payload. - The dissect_dcerpc_cn_stub() function was refactored to perform the decryption process and hand decrypted data to the reassembly code instead of performing the decryption after reassembly. - Removed references to decrypted_info_t as it's not necessary anymore. Code was tested using encrypted and unencrypted fragmented PDUs. Before this commit ethereal could not dissect unencrypted (!) fragmented PDUs correctly. svn path=/trunk/; revision=8546
2003-09-26Use zero to mean we haven't seen any authentication level informationTim Potter1-7/+7
in dcerpc_auth_info since auth_level is an unsigned type. Zero is not a valid authentication level anyway (s13.1.2.1, p611 CAE spec). Remove two inscrutable debugging comments that don't seem to mean anything. svn path=/trunk/; revision=8545
2003-09-19Put the presentation context list and transfer syntax list of a dcerpcTim Potter1-12/+33
bind request into some subtrees to make things look a bit nicer. svn path=/trunk/; revision=8497
2003-09-11Do not take the pointer to a stack object and pass it to the tap system.Ronnie Sahlberg1-36/+58
The tap listener will try to parse this pointer at a much later stage where the stack frame where this object lived will have dissapeared and possible got overwritten. best that can happen is that service response times for dcerpc interfaces is screwed up more probable is that we get a coredump svn path=/trunk/; revision=8455
2003-08-04Guy suggested that the dcerpc opnum value_string code could be simplifiedTim Potter1-12/+22
somewhat. Now the dynamic initialisation of the value_string is contained in the value_string_from_subdissectors() function instead of being distributed amongst the dcerpc dissectors. svn path=/trunk/; revision=8123
2003-07-21From Devin Heitmueller: include the authentication padding in the stubGuy Harris1-11/+16
data when decrypting it, as, at least for NTLMSSP encryption, the stub *and* the authentication padding are encrypted as a single lump. svn path=/trunk/; revision=8058
2003-07-18Alter_context is sort of like Bind, and its authentication stubs areGuy Harris1-1/+3
dissected like those on Binds; the same is true for their corresponding acks. svn path=/trunk/; revision=8043
2003-07-16Squelch a (potentially-valid) compiler warning.Guy Harris1-2/+2
svn path=/trunk/; revision=8027
2003-07-16Move all DCERPC authentication/encryption dissection code from packet-dcerpc.cTim Potter1-199/+181
to the dissector that handles the particular authentication flavour. This gets rid of a couple of ugly switch statements and allows other authentication modules to be written easily. svn path=/trunk/; revision=8026
2003-06-26Dynamically create DCERPC opnum value_strings from the subdissectorTim Potter1-1/+23
list rather than duplicating this information in the dissector. Some of the opnum strings were starting to get out of date as developers forgot to update the information in both places. svn path=/trunk/; revision=7936
2003-06-19Squelch a compiler warning (for something that's potentially a realGuy Harris1-2/+2
problem). svn path=/trunk/; revision=7901
2003-06-19Initialize di.hf_index in dissect_dcerpc_cn_rqst(). Alan Hood sent me aGerald Combs1-1/+2
fuzz-generated packet that made it all the way to proto_registrar_get_name() without hf_index being initialized. svn path=/trunk/; revision=7899
2003-06-17Remove silly dcerpc_smb_check_long_frame() function and all calls to it.Tim Potter1-1/+12
A much better place to do this is after the subdissector function has been called in dcercp_try_handoff(). svn path=/trunk/; revision=7895
2003-06-12Add new routines:Guy Harris1-7/+4
tvb_get_string() - takes a tvbuff, an offset, and a length as arguments, allocates a buffer big enough to hold a string with the specified number of bytes plus an added null terminator (i.e., length+1), copies the specified number of bytes from the tvbuff, at the specified offset, to that buffer and puts in a null terminator, and returns a pointer to that buffer (or throws an exception before allocating the buffer if that many bytes aren't available in the tvbuff); tvb_get_stringz() - takes a tvbuff, an offset, and a pointer to a "gint" as arguments, gets the size of the null-terminated string starting at the specified offset in the tvbuff (throwing an exception if the null terminator isn't found), allocates a buffer big enough to hold that string, copies the string to that buffer, and returns a pointer to that buffer and stores the length of the string (including the terminating null) in the variable pointed to by the "gint" pointer. Replace many pieces of code allocating a buffer and copying a string with calls to "tvb_get_string()" (for one thing, "tvb_get_string()" doesn't require you to remember that the argument to "tvb_get_nstringz0()" is the size of the buffer into which you're copying the string, which might be the length of the string to be copied *plus 1*). Don't use fixed-length buffers for null-terminated strings (even if the code that generates those packets has a #define to limit the length of the string). Use "tvb_get_stringz()", instead. In some cases where a value is fetched but is only used to pass an argument to a "proto_tree_add_XXX" routine, use "proto_tree_add_item()" instead. svn path=/trunk/; revision=7859
2003-06-10As "tvb_strneql()" and "tvb_memeql()" now just return -1, rather thanGuy Harris1-3/+2
throwing an exception, if the bytes to be compared aren't available in the tvbuff, we don't need to check for their existence before calling those routines. svn path=/trunk/; revision=7826
2003-06-04There can be more than one DCE RPC call per frame, e.g. there can beGuy Harris1-22/+73
multiple NetBIOS-over-TCP session service messages in a TCP segment, and they can contain the final portions of different DCERPC calls. Don't assume a frame number is sufficient to identify DCE RPC calls. svn path=/trunk/; revision=7777
2003-05-27Put back the stuff for connection-oriented data to show fragment data asGuy Harris1-4/+17
"Fragment data (N bytes)" if we aren't dissecting it. svn path=/trunk/; revision=7751
2003-05-26Null-terminate ASCII string values in "dissect_ndr_cvstring()".Guy Harris1-1/+2
svn path=/trunk/; revision=7744
2003-05-23Fix typo in name of ett for krb5 auth verifier.Tim Potter1-35/+54
svn path=/trunk/; revision=7721
2003-05-15Move dissection of NETLOGON secure channel auth verifier intoTim Potter1-45/+9
packet-dcerpc-netlogon.c svn path=/trunk/; revision=7670
2003-05-15Dissect authentication data for netlogon secure channel bind and bind acks.Tim Potter1-9/+51
Also, recommit a change lost in the hardware failure which was to note the type of a DCE/RPC fragment when noting it in COL_INFO. A fragment can be either a first, middle, last or whole (first+last) fragment. svn path=/trunk/; revision=7666
2003-05-14Re-commit stuff that was lost...Richard Sharpe1-2/+58
This contains an initial break-out of the verifier for secure-channel and maybe more ... svn path=/trunk/; revision=7665
2003-05-10Have "dissect_ndr_cvstring()" set the length of the top-level item toGuy Harris1-2/+4
cover all the parts of the item, rather than just making it be 0. svn path=/trunk/; revision=7661
2003-05-10Use "tvb_ensure_bytes_exist()" to cause an exception to be thrownGuy Harris1-22/+31
*before* attempting to allocate a buffer for a string, if the copy into the buffer will thrown an exception; that prevents us from 1) leaking memory if we can allocate the buffer (we'd throw an exception before we freed the buffer); 2) crashing if we can't allocate the buffer because the length is bogus and large. svn path=/trunk/; revision=7658
2003-05-08Based on a patch from Jean-Baptiste Marchand, mark stub data asGuy Harris1-43/+41
encrypted if appropriate; this change adds a "show_stub_data()" to handle that, and that routine also cleans up the stub data display a bit in some other ways. svn path=/trunk/; revision=7654
2003-04-20Add a pointer to an hf_ value for a "reassembled_in" field (which can beGuy Harris1-1/+2
null) to the "fragment_items" structure, and don't pass that value into "process_reassembled_data()", just have it use the value in the "fragment_items" structure passed to it. Make "process_reassembled_data()" capable of handling reassembly done by "fragment_add_seq_check()", and use it in the ATP and 802.11 dissectors; give them "reassembled_in" fields. Make "process_reassembled_data()" handle only the case of a completed reassembly (fd_head != NULL) so that we can use it in those dissectors without gunking the code up too much. svn path=/trunk/; revision=7513
2003-04-15Don't put "[DCE/RPC fragment]" into the Info column if the packet isn'tGuy Harris1-5/+7
fragmented. "PFC_NOT_FRAGMENTED()" is checked early in "dissect_dcerpc_cn_stub()"; there's no need to check it again in either of the code paths after that, as we know it's true in the first code path and false in the second. svn path=/trunk/; revision=7460
2003-04-14Reassembly of DCE/RPC fragments for Request packets was slightly broken.Ronnie Sahlberg1-131/+183
Fixed this and rewrote the fragment reassembly routine to make it cleaner and hopefully easier to read. svn path=/trunk/; revision=7453
2003-03-31Do the same for dissect_ndr_char_cvstring.Guy Harris1-2/+5
svn path=/trunk/; revision=7383
2003-03-17change dissect_ndr_wchar_cvstring so that it uses the hf_index the dissector ↵Ronnie Sahlberg1-2/+5
has passed to it and not the generic dcerpc_character_buffer. we need this to be able to filter for various dcerpc related strings such as lsa.domain svn path=/trunk/; revision=7356
2003-03-10Pointer <--> int converions cause warnings on ia64.Jörg Mayer1-2/+3
Modified a patch originally contained in the SuSE distro to do the conversions via glib macros. svn path=/trunk/; revision=7330
2003-03-05Use the reported length, not the captured length, as the fragment lengthGuy Harris1-53/+58
when doing reassembly. In some additional places, use "tvb_bytes_exist()" to check whether we have enough data to do reassembly, rather than checking to see if the frame is short (it might be short but we might still have enough data to do reassembly). In DCE RPC, use the fragment length from the header as the number of bytes of fragment data. There's no need to check "pinfo->fragmented" before doing reassembly in the DCERPC-over-SMB-pipes code - either we have all the data or we don't. In SNA and WTP reassembly, add a check to make sure we have all the data to be reassembled. svn path=/trunk/; revision=7282
2003-02-24Rename "fake_unicode()" to "tvb_fake_unicode()" as it works on a tvbuff,Guy Harris1-35/+3
give it a byte-order argument, and move it to "epan/tvbuff.c". Use it to handle UCS-2 strings in version 1 of the Service Location Protocol. In SRVLOC V1, use registered fields that are already there for SRVLOC V2, and add some as needed. Fix some field names. svn path=/trunk/; revision=7186
2003-02-21Well, perhaps that padding really *is* padding, or maybe it's some otherGuy Harris1-12/+1
gunk stuck in there to make NTLMSSP happy (perhaps the encrypted body length has to be a multiple of 16 bytes or something such as that for the encryption to work). No packet in any capture I have appears to be misdissected if you get rid of the mod 4 stuff, so I'm removing it. svn path=/trunk/; revision=7181
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-30 10:01:12 +0000