aboutsummaryrefslogtreecommitdiffstats
path: root/epan/dissectors/packet-dcerpc-eventlog.c
AgeCommit message (Collapse)AuthorFilesLines
2017-01-10Rename tvb_new_subset() to tvb_new_subset_length_caplen().Guy Harris1-2/+2
This emphasizes that there is no such thing as *the* routine to construct a subset tvbuff; you need to choose one of tvb_new_subset_remaining() (if you want a new tvbuff that contains everything past a certain point in an existing tvbuff), tvb_new_subset_length() (if you want a subset that contains everything past a certain point, for some number of bytes, in an existing tvbuff), and tvb_new_subset_length_caplen() (for all other cases). Many of the calls to tvb_new_subset_length_caplen() should really be calling one of the other routines; that's the next step. (This also makes it easier to find the calls that need fixing.) Change-Id: Ieb3d676d8cda535451c119487d7cd3b559221f2b Reviewed-on: https://code.wireshark.org/review/19597 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-11-06Get rid of Boolean "flags" that don't have any bit set.Guy Harris1-8/+0
And tweak the Pidl generator for Wireshark not to generate "flags" like that. (The generator also does field name and true/false strings' case differently, so I didn't use it to regenerate the dissectors; that needs to be looked at.) Change-Id: Ie1657a782ebdb107e58792cedd29bbaa79b17bd4 Reviewed-on: https://code.wireshark.org/review/18695 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-06tools/pidl: Keep case from fieldnames.Günther Deschner1-93/+93
Change-Id: I5626cfa0487cc88eb65cc349c05ae1762bc953f4 Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-on: https://code.wireshark.org/review/16720 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-18DCE/RPC: fix array of pointers with NULLBinh Trinh1-0/+2
Change-Id: Ie89f8fd4ec744d427d41866206d5a6784c5b224f Reviewed-on: https://code.wireshark.org/review/16004 Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-16DCE/RPC proto_tree_add_boolean -> proto_tree_add_bitmask_with_flagsMichael Mann1-102/+28
Change-Id: I8891ec90244ffd9609d8443df631a7c8e6453b7e Reviewed-on: https://code.wireshark.org/review/15942 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-05-02Revert "PIDL: Remove _U_ and remove unused-parameter via pragma"Guy Harris1-251/+249
This reverts commit db4f7fcdeac833f24807994b372d1e42479754bf. That doesn't work with the compiler being used on the OS X buildbot; that compiler is probably some version of llvm-gcc, which might be based on an older version of GCC without support for that pragma, or might not support it properly courtesy of the GCC front end and the LLVM back end not quite fitting together Change-Id: I6cd5f1322b4872ef0c4eb5695f021cec00ba85b7 Reviewed-on: https://code.wireshark.org/review/15246 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-05-02PIDL: Remove _U_ and remove unused-parameter via pragmaAlexis La Goutte1-249/+251
Change-Id: Ic40f86850dc94338a8c2205e04679793f368672f Reviewed-on: https://code.wireshark.org/review/14967 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2016-02-29PIDL: regen pidl-generated dissectorsAurelien Aptel1-9/+3
mapi&nspi dissectors skipped on purpose since they the output is malformed. This was already the case before the samba sync. Change-Id: Ib3b78459e3506c755aaa219433ac6b5865482f01 Signed-off-by: Aurelien Aptel <aaptel@suse.com> Reviewed-on: https://code.wireshark.org/review/13968 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-07-14Correct eventlog.eventlog_OpenEventLogW.Module dissection by providing ↵Michael Mann1-28/+16
lsa_String type in .cnf There seem to be multiple definitions of an "lsa_String" depending on the DCE/RPC dissector, so change was made just in EventLog. Bug: 10264 Change-Id: I32e97c2a537b01d3bfe9dd03452b8ee1af4d1c2e Reviewed-on: https://code.wireshark.org/review/9598 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-06-23Remove deprecated tvb_length from PIDL dissectorsEvan Huus1-3/+3
Also regenerate all to pick up the usage of https in some comment links. Change-Id: Ic17b6368d2118627178b0b560031450d98e5b5e5 Reviewed-on: https://code.wireshark.org/review/9060 Reviewed-by: Evan Huus <eapache@gmail.com>
2015-03-03Eliminate e_uuid_t in favor of e_guid_t.Guy Harris1-1/+1
That eliminates a redundant and confusing data type, and avoids issues with one piece of code using e_uuid_t but wanting to use routines expecting an e_guid_t. Change-Id: I95e172d46d342ab40f6254300ecbd2a0530cde60 Reviewed-on: https://code.wireshark.org/review/7506 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-11-03Regenerate DCE RPC dissectors with the current pidl.Guy Harris1-232/+238
Change-Id: I3cfb9399a9e5ed783083fa5b26a39646fb53875f Reviewed-on: https://code.wireshark.org/review/5101 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-08Remove #pragma warning (MSVC) for PIDL generate dissectorAlexis La Goutte1-7/+0
Change-Id: I1e4c7944a2cd877f5c707703dcff44fe9f955a2c Reviewed-on: https://code.wireshark.org/review/4479 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-09-28PIDL (DCERPC eventlog): enhance dissectorAlexis La Goutte1-18/+0
* Fix -Wunused-function (Add functions to eventlog.cnf with NOEMIT) * Remove dissector DCERPC eventlog from DIRTY list Change-Id: I29710ce4f548a6e4d9bf1dd6e652acf1eeaddf2c Reviewed-on: https://code.wireshark.org/review/4324 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-09-28PIDL: fix -Wmissing-prototypeAlexis La Goutte1-0/+2
Change-Id: I4cae47450e8026b10bd373828f235184560e0a99 Reviewed-on: https://code.wireshark.org/review/4308 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-09-27PIDL: Fix Dead Store (Dead assignement/Dead increment) warning found by ClangAlexis La Goutte1-2/+2
Change-Id: I7f6f974732b7905f4ea4686e1a79ca6fbef78fa8 Reviewed-on: https://code.wireshark.org/review/4319 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-09-27Regenerate PIDL dissectors with our current PIDL.Guy Harris1-241/+241
Change-Id: I63a1874d157c55df6c3c3f69c68098528adbb384 Reviewed-on: https://code.wireshark.org/review/4330 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-09-20proto_tree_add_text -> proto_tree_add_subtree[_format] for DCE/RPC dissectors.Michael Mann1-257/+257
Change-Id: I84755d059ef70ca98b0e7626b6425360daf0529d Reviewed-on: https://code.wireshark.org/review/4199 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-09-19Update generated DCE/RPC dissectors.Michael Mann1-248/+248
Now all generated dissectors can successfully compile. Change-Id: I74728926915d5a9f1694cc49c753b80f213df767 Reviewed-on: https://code.wireshark.org/review/2598 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-09-08Fix automatic generation of the dcerpc-eventlog dissector.Jeff Morriss1-270/+262
The problem described in the README is simply because the conformance file hadn't been updated. Remove trailing white space from the .idl and .cnf files. Change-Id: I778f206aa103e5f60574fe2c5c699597969dc644 Reviewed-on: https://code.wireshark.org/review/4042 Reviewed-by: Evan Huus <eapache@gmail.com> Petri-Dish: Evan Huus <eapache@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-06-19Revert "Fixup: tvb_* -> tvb_captured"Michael Mann1-2/+2
https://www.wireshark.org/lists/wireshark-dev/201406/msg00131.html This reverts commit 246fe2ca4c67d8c98caa84e2f57694f6322e2f96. Change-Id: Ib24bae0198c13a84bd7f731bf4af921212109a8f Reviewed-on: https://code.wireshark.org/review/2430 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-06-18Fixup: tvb_* -> tvb_capturedDario Lombardo1-2/+2
Change-Id: I9209c1271967405c34c1b6fa43e1726a4d3a5a3f Reviewed-on: https://code.wireshark.org/review/2377 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-31Continue to remove $Id$ from top of fileAlexis La Goutte1-3/+1
(Using sed : sed -i '/^ \t$Id\$/,+0 d') (tab before $Id$) Also modify generator (NDR.pm) Change-Id: I348a1d129d1d1320bd80b428038ea5ed291d6ca8 Reviewed-on: https://code.wireshark.org/review/878 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-01-21Get rid of tvb_get_faked_unicode() - tvb_get_string_enc() does the jobGuy Harris1-32/+19
better. We don't need eventlog_get_unicode_string_length() in the eventlog dissector, either - tvb_unicode_strsize() does the job just as well. svn path=/trunk/; revision=54874
2013-11-24Move dceprc_procedure_name from packet_info to dcerpc_info. Doesn't appear ↵Michael Mann1-48/+48
to be "used" by dissectors, just stored (for help in debugging?). svn path=/trunk/; revision=53552
2013-11-06Remove pinfo->private_data from DCERPC dissectors and instead have ↵Michael Mann1-526/+519
dcerpc_info* infomation be passed in as a function parameter. Bug 9387 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9387) All "generated" source was manually modified (with the power of search/replace), but I believe the "source input" files have been adjusted (checked into revs 53098 and 53099) to reflect the necessary changes (with possible whitespace formatting differences). The Microsoft compiler doesn't flag "unused function parameters", so I apologize in advance if I may have missed a few. The "dcerpc_info* di" parameter is used in almost every function. svn path=/trunk/; revision=53100
2013-10-21Sync with latest SAMBA PIDL source per ↵Michael Mann1-11/+30
http://www.wireshark.org/lists/wireshark-dev/201310/msg00217.html Didn't integrate 0010-frsrpc-Regenerate-frsrpc-due-to-changes-in-the-pidl-.patch 0016-Regenerate-the-dnserver.patch due to compilation errors on Windows. svn path=/trunk/; revision=52744
2013-10-01Remove check_col from generated DCE/RPC dissectors. Bug 8804 ↵Michael Mann1-24/+24
(https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8804). I still couldn't figure out how to generate the source, so I made the modifications to the generated dissectors "manually" (search/replace tool in VS) that would match the "PIDL source" included here. I will be sending the "PIDL source" (non dissector files) to the samba team. svn path=/trunk/; revision=52313
2013-09-30Convert some proto_tree_add_string_format calls to something more appropriate.Michael Mann1-1/+1
There seem to be several cases of proto_tree_add_string_format where a "string" value/filter doesn't really make sense because it's always empty, and is just being used as a "filterable subtree header (placeholder)". They appear to be more for "presense" than "value" and should probably be FT_NONE, although I'd almost argue for removing the filter in favor of proto_tree_add_text. svn path=/trunk/; revision=52296
2013-09-22emem -> wmem conversion:Pascal Quantin1-3/+3
- ep_tvb_get_bits() -> wmem_packet_tvb_get_bits() - tvb_g_memdup()/ep_tvb_memdup() -> tvb_memdup() - tvb_fake_unicode()/tvb_get_ephemeral_faked_unicode() -> tvb_get_faked_unicode() - tvb_get_g_string()/tvb_get_ephemeral_string()/tvb_get_seasonal_string() -> tvb_get_string() - tvb_get_g_unicode_string()/tvb_get_ephemeral_unicode_string() -> tvb_get_unicode_string() - tvb_get_ephemeral_string_enc() -> tvb_get_string_enc() - update docs accordingly svn path=/trunk/; revision=52172
2012-09-20We always HAVE_CONFIG_H so don't bother checking whether we have it or not.Jeff Morriss1-2/+0
svn path=/trunk/; revision=45017
2010-10-30Add an SVN Id to these PIDL-generated dissectors. A patch to PIDL will be ↵Jeff Morriss1-0/+2
sent upstream to the Samba developers. svn path=/trunk/; revision=34713
2009-07-29start describing ReportEventW in the IDL and make use of the "bitmap" Ronnie Sahlberg1-1/+129
for EventTypes. This addresses also bug 3552 with the until now unusued code. The eventlog dissector is very incomplete. While the protocol specification is available now, what is lacking is example capture files to test with when implementing more of the IDL definitions. svn path=/trunk/; revision=29231
2009-07-29Fixup the correct names of the parameters for OpenEventLogWRonnie Sahlberg1-32/+32
svn path=/trunk/; revision=29230
2009-07-29update the idl to correctly dissect the read eventlog w flags as a Ronnie Sahlberg1-216/+225
bitmap and not as a uint32 this addresses bug 3691 (that was already manually addressed by hand in the generated dissector) svn path=/trunk/; revision=29229
2009-07-12From Kovarththanan Rajaratnam via bug 3702:Stig Bjørlykke1-1/+1
This patch optimizes the data source name processing in add_new_data_source() by delaying it. We now simply store the constant string and lazily compute the name when needed. This gives a performance boost because we only need the name if we have multiple data sources. svn path=/trunk/; revision=29066
2009-06-18From Kovarththanan Rajaratnam via bug 3548:Stig Bjørlykke1-84/+84
(1) Trailing/leading spaces are removed from 'name's/'blurb's (2) Duplicate 'blurb's are replaced with NULL (3) Empty ("") 'blurb's are replaced with NULL (4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME, FT_PROTOCOL, FT_STRING and FT_STRINGZ field types (5) Only allow non-zero value for 'display' if 'bitmask' is non-zero svn path=/trunk/; revision=28770
2008-06-22Removed an unused static entry.Stig Bjørlykke1-1/+0
svn path=/trunk/; revision=25521
2007-03-29regenerate the dissectors with an even newer patched version of pidl to add ↵Ronnie Sahlberg1-0/+2
two more pragmas you need this patch ontop of svn pidl to regenerate the files : Index: lib/Parse/Pidl/Wireshark/NDR.pm =================================================================== --- lib/Parse/Pidl/Wireshark/NDR.pm (revision 22005) +++ lib/Parse/Pidl/Wireshark/NDR.pm (working copy) @@ -916,6 +916,14 @@ $res{headers} .= "#ifdef HAVE_CONFIG_H\n"; $res{headers} .= "#include \"config.h\"\n"; $res{headers} .= "#endif\n\n"; + + $res{headers} .= "#ifdef _MSC_VER\n"; + $res{headers} .= "#pragma warning(disable:4005)\n"; + $res{headers} .= "#pragma warning(disable:4013)\n"; + $res{headers} .= "#pragma warning(disable:4018)\n"; + $res{headers} .= "#pragma warning(disable:4101)\n"; + $res{headers} .= "#endif\n\n"; + $res{headers} .= "#include <glib.h>\n"; $res{headers} .= "#include <string.h>\n"; $res{headers} .= "#include <epan/packet.h>\n\n"; svn path=/trunk/; revision=21262
2007-03-29fixup the idl to always use pointer for out parametersRonnie Sahlberg1-12/+57
regenerate with patched pidl svn path=/trunk/; revision=21261
2007-03-28from Gisle Vanem: some more #pragma's that MingW don't likeUlf Lamping1-1/+1
svn path=/trunk/; revision=21240
2007-03-27fix the remaining MSVC warnings by setting individual ↵Ulf Lamping1-0/+5
#pragma(warning:disable) settings - this is very certainly not the way to go, but the way to prevent additional warnings rushing in ... svn path=/trunk/; revision=21221
2007-03-22Using a patched version of pidl that decorates all parameters with _U_Ronnie Sahlberg1-261/+261
and updates to the conformance file, regenerate the eventlog dissector to remove a lot of compiler warnings svn path=/trunk/; revision=21110
2007-02-24update EFS and EVENTLOG conformance files to use the new definesRonnie Sahlberg1-71/+124
for when policy handles are opened/closed and regenerate the dissector with the latest version of PIDL svn path=/trunk/; revision=20917
2006-11-05add tracking of policy_handles to the eventlog dissectorRonnie Sahlberg1-12/+12
svn path=/trunk/; revision=19801
2006-09-24dissect_ndr_uint16()'s last argument points to a guint16, not a guint.Guy Harris1-1/+1
svn path=/trunk/; revision=19316
2006-09-22update where the extra strings in the record are being dissected to that the ↵Ronnie Sahlberg1-8/+6
decode follows the packet structure more closely svn path=/trunk/; revision=19283
2006-09-22update to eventlog recordRonnie Sahlberg1-16/+29
dissect the informational strings that may be present inside an event svn path=/trunk/; revision=19282
2006-09-22add conformance file magic to decode the non-NDR source/computer name ↵Ronnie Sahlberg1-40/+85
strings of the eventlog_Record svn path=/trunk/; revision=19280
2006-09-22updates to eventlog to use the pidl generated dissector and enhance the ↵Ronnie Sahlberg1-609/+1957
conformance file to dissect parts of the eventlog Records. (record dissection is incomplete since this is not really NDR encoded but better than nothing) svn path=/trunk/; revision=19279
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-05 02:00:29 +0000