diff options
author | guy <guy@f5534014-38df-0310-8fa8-9805f1628bb7> | 2003-01-11 07:11:21 +0000 |
---|---|---|
committer | guy <guy@f5534014-38df-0310-8fa8-9805f1628bb7> | 2003-01-11 07:11:21 +0000 |
commit | 77588eedb58c23130f3d57eb04d7f03233ebf640 (patch) | |
tree | ad01347f8e5268ab60335bc0b112ebd7ffea80b3 /packet-dcerpc-krb5rpc.c | |
parent | f753e18b5b2536c2b12b96647f407f6d52806eda (diff) |
From Jaime Fournier: extend the packet-dcerpc-krb5rpc dissectors to call
kerberos V.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6905 f5534014-38df-0310-8fa8-9805f1628bb7
Diffstat (limited to 'packet-dcerpc-krb5rpc.c')
-rw-r--r-- | packet-dcerpc-krb5rpc.c | 173 |
1 files changed, 146 insertions, 27 deletions
diff --git a/packet-dcerpc-krb5rpc.c b/packet-dcerpc-krb5rpc.c index 956ab8b80b..71cdfd1d2c 100644 --- a/packet-dcerpc-krb5rpc.c +++ b/packet-dcerpc-krb5rpc.c @@ -5,8 +5,7 @@ * This information is based off the released idl files from opengroup. * ftp://ftp.opengroup.org/pub/dce122/dce/src/security.tar.gz security/idl/krb5rpc.idl * - * - * $Id: packet-dcerpc-krb5rpc.c,v 1.2 2002/11/08 19:42:39 guy Exp $ + * $Id: packet-dcerpc-krb5rpc.c,v 1.3 2003/01/11 07:11:21 guy Exp $ * * Ethereal - Network traffic analyzer * By Gerald Combs <gerald@ethereal.com> @@ -41,49 +40,169 @@ #include <glib.h> #include <epan/packet.h> #include "packet-dcerpc.h" - +#include "packet-kerberos.h" +#include "packet-dcerpc-dce122.h" static int proto_krb5rpc = -1; -static int hf_krb5rpc_opnum = -1; - static gint ett_krb5rpc = -1; -static e_uuid_t uuid_krb5rpc = { 0x8f73de50, 0x768c, 0x11ca, { 0xbf, 0xfc, 0x08, 0x00, 0x1e, 0x03, 0x94, 0x31 } }; -static guint16 ver_krb5rpc = 1; +static e_uuid_t uuid_krb5rpc = + { 0x8f73de50, 0x768c, 0x11ca, {0xbf, 0xfc, 0x08, 0x00, 0x1e, 0x03, 0x94, + 0x31} +}; +static guint16 ver_krb5rpc = 1; +static int hf_krb5rpc_sendto_kdc_rqst_keysize = -1; +static int hf_krb5rpc_sendto_kdc_rqst_spare1 = -1; +static int hf_krb5rpc_sendto_kdc_resp_len = -1; +static int hf_krb5rpc_sendto_kdc_resp_max = -1; +static int hf_krb5rpc_sendto_kdc_resp_spare1 = -1; +static int hf_krb5rpc_sendto_kdc_resp_keysize = -1; +static int hf_krb5rpc_sendto_kdc_resp_st = -1; +static int hf_krb5rpc_sendto_kdc_rqst_out_buf_len = -1; +static int hf_krb5rpc_krb5 = -1; +static gint ett_krb5rpc_krb5 = -1; + +static int +krb5rpc_dissect_sendto_kdc_rqst (tvbuff_t * tvb, int offset, + packet_info * pinfo, proto_tree * tree, + char *drep) +{ + guint32 keysize, spare1, out_buf_len, remain; + proto_item *item; + tvbuff_t *krb5_tvb; + proto_tree *subtree; + + + /* + * [in] handle_t h, + * [in] unsigned32 len, + * [in, size_is(len)] + * byte message[], + * [in] unsigned32 out_buf_len, + */ + + offset = + dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_krb5rpc_sendto_kdc_rqst_keysize, &keysize); + offset = + dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_krb5rpc_sendto_kdc_rqst_spare1, &spare1); + item = proto_tree_add_item (tree, hf_krb5rpc_krb5, tvb, offset, -1, TRUE); + subtree = proto_item_add_subtree (item, ett_krb5rpc_krb5); + + remain = tvb_length_remaining(tvb, offset); + krb5_tvb = tvb_new_subset (tvb, offset, remain, remain); + offset = dissect_kerberos_main (krb5_tvb, pinfo, subtree, TRUE); + + + return offset; +} + + +static int +krb5rpc_dissect_sendto_kdc_resp (tvbuff_t * tvb, int offset, + packet_info * pinfo, proto_tree * tree, + char *drep) +{ + guint32 resp_len, maxsize, spare1, keysize, remain; + proto_item *item; + tvbuff_t *krb5_tvb; + proto_tree *subtree; + + + /* + * + * [out] unsigned32 *resp_len, + * [out, length_is(*resp_len), size_is(out_buf_len)] + * byte out_buf[], + * [out] error_status_t *st unsigned long + * + */ + + offset = + dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_krb5rpc_sendto_kdc_resp_len, &resp_len); + offset = + dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_krb5rpc_sendto_kdc_resp_max, &maxsize); + offset = + dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_krb5rpc_sendto_kdc_resp_spare1, &spare1); + offset = + dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_krb5rpc_sendto_kdc_resp_keysize, &keysize); + + + item = proto_tree_add_item (tree, hf_krb5rpc_krb5, tvb, offset, -1, TRUE); + subtree = proto_item_add_subtree (item, ett_krb5rpc_krb5); + remain = tvb_length_remaining(tvb, offset); + krb5_tvb = tvb_new_subset (tvb, offset, remain, remain); + + offset = dissect_kerberos_main (krb5_tvb, pinfo, subtree, TRUE); + offset += 16; /* no idea what this is, probably just extended encrypted text. */ + + return offset; +} static dcerpc_sub_dissector krb5rpc_dissectors[] = { - { 0, "rsec_krb5rpc_sendto_kdc", NULL, NULL }, - { 0, NULL, NULL, NULL } + {0, "rsec_krb5rpc_sendto_kdc", krb5rpc_dissect_sendto_kdc_rqst, + krb5rpc_dissect_sendto_kdc_resp}, + {0, NULL, NULL, NULL}, }; -static const value_string krb5rpc_opnum_vals[] = { - { 0, "rsec_krb5rpc_sendto_kdc" }, - { 0, NULL } -}; void proto_register_krb5rpc (void) { - static hf_register_info hf[] = { - { &hf_krb5rpc_opnum, - { "Operation", "krb5rpc.opnum", FT_UINT16, BASE_DEC, - VALS(krb5rpc_opnum_vals), 0x0, "Operation", HFILL }} - }; - - static gint *ett[] = { - &ett_krb5rpc, - }; - proto_krb5rpc = proto_register_protocol ("DCE/RPC Kerberos V", "KRB5RPC", "krb5rpc"); - proto_register_field_array (proto_krb5rpc, hf, array_length (hf)); - proto_register_subtree_array (ett, array_length (ett)); + static hf_register_info hf[] = { + {&hf_krb5rpc_sendto_kdc_rqst_keysize, + {"hf_krb5rpc_sendto_kdc_rqst_keysize", + "hf_krb5rpc_sendto_kdc_rqst_keysize", FT_UINT32, BASE_DEC, NULL, 0x0, + "", HFILL}}, + {&hf_krb5rpc_sendto_kdc_rqst_spare1, + {"hf_krb5rpc_sendto_kdc_rqst_spare1", + "hf_krb5rpc_sendto_kdc_rqst_spare1", FT_UINT32, BASE_DEC, NULL, 0x0, "", + HFILL}}, + {&hf_krb5rpc_sendto_kdc_resp_len, + {"hf_krb5rpc_sendto_kdc_resp_len", "hf_krb5rpc_sendto_kdc_resp_len", + FT_UINT32, BASE_DEC, NULL, 0x0, "", HFILL}}, + {&hf_krb5rpc_sendto_kdc_resp_max, + {"hf_krb5rpc_sendto_kdc_resp_max", "hf_krb5rpc_sendto_kdc_resp_max", + FT_UINT32, BASE_DEC, NULL, 0x0, "", HFILL}}, + {&hf_krb5rpc_sendto_kdc_resp_spare1, + {"hf_krb5rpc_sendto_kdc_resp_spare1", + "hf_krb5rpc_sendto_kdc_resp_spare1", FT_UINT32, BASE_DEC, NULL, 0x0, "", + HFILL}}, + {&hf_krb5rpc_sendto_kdc_resp_keysize, + {"hf_krb5rpc_sendto_kdc_resp_keysize", + "hf_krb5rpc_sendto_kdc_resp_keysize", FT_UINT32, BASE_DEC, NULL, 0x0, + "", HFILL}}, + {&hf_krb5rpc_sendto_kdc_resp_st, + {"hf_krb5rpc_sendto_kdc_resp_st", "hf_krb5rpc_sendto_kdc_resp_st", + FT_UINT32, BASE_DEC, NULL, 0x0, "", HFILL}}, + {&hf_krb5rpc_krb5, + {"hf_krb5rpc_krb5", "hf_krb5rpc_krb5", FT_BYTES, BASE_HEX, NULL, 0x0, + "krb5_blob", HFILL}}, + + }; + + static gint *ett[] = { + &ett_krb5rpc, + &ett_krb5rpc_krb5, + }; + proto_krb5rpc = + proto_register_protocol ("DCE/RPC Kerberos V", "KRB5RPC", "krb5rpc"); + proto_register_field_array (proto_krb5rpc, hf, array_length (hf)); + proto_register_subtree_array (ett, array_length (ett)); } void proto_reg_handoff_krb5rpc (void) { - /* Register the protocol as dcerpc */ - dcerpc_init_uuid (proto_krb5rpc, ett_krb5rpc, &uuid_krb5rpc, ver_krb5rpc, krb5rpc_dissectors, hf_krb5rpc_opnum); + /* Register the protocol as dcerpc */ + dcerpc_init_uuid (proto_krb5rpc, ett_krb5rpc, &uuid_krb5rpc, ver_krb5rpc, + krb5rpc_dissectors, -1); } |