aboutsummaryrefslogtreecommitdiffstats
path: root/epan/dissectors/packet-dcerpc.h
AgeCommit message (Collapse)AuthorFilesLines
2020-01-22packet-dcerpc: pass down header/trailer for hdr_signingStefan Metzmacher1-2/+5
Change-Id: I1d14ffe928e1b303eee7e95a45a9617ffcfb151b Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-on: https://code.wireshark.org/review/35707 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-07-27HTTPS In Still More Places, update more URLs.Guy Harris1-1/+1
Microsoft reshuffled their documentation - almost all of it moved from msdn.microsoft.com to docs.microsoft.com. Some blogs moved to devblogs.microsoft.com; the comments *didn't* move, so in one case we go to the Wayback Machine - the link isn't dead, but it formats horribly, at least on my browser, but the archived version formats OK. Use the Wayback Machine for some URLs, and update others. Update the sections for MS-ADTS. Point to the HTML versions of some RFCs and I-Ds. Change-Id: I344b20f880de63f1ae2a4e3f9ff98af78a7fe139 Reviewed-on: https://code.wireshark.org/review/34101 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-12dissectors: use SPDX identifiers.Dario Lombardo1-13/+1
Change-Id: I92c94448e6641716d03158a5f332c8b53709423a Reviewed-on: https://code.wireshark.org/review/25756 Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-09-23packet-dcerpc: let dissect_dcerpc_cn_auth() always dissect the whole auth_infoStefan Metzmacher1-3/+9
As all this information belongs together I'm moving it into a subtree. Change-Id: I839a5a6294360976a78b4b43f219e30381b4f516 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-on: https://code.wireshark.org/review/17878 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-09-19Improve support for single-character fields and filter expressions.Guy Harris1-0/+4
Add an FT_CHAR type, which is like FT_UINT8 except that the value is displayed as a C-style character constant. Allow use of C-style character constants in filter expressions; they can be used in comparisons with all integral types, and in "contains" operators. Use that type for some fields that appear (based on the way they're displayed, or on the use of C-style character constants in their value_string tables) to be 1-byte characters rather than 8-bit numbers. Change-Id: I39a9f0dda0bd7f4fa02a9ca8373216206f4d7135 Reviewed-on: https://code.wireshark.org/review/17787 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-04Refactor DCE/RPC dissection to include a real dissector table.Michael Mann1-6/+1
This is hopefully just the first step in getting DCE/RPC dissection to use "standard" APIs instead of homegrown ones. For starters, it allows Decode As functionality to be less hacky (although incomplete in Qt) Change-Id: Ia0923a3d8d514ab7acce32e26ee7e08f6e24feca Reviewed-on: https://code.wireshark.org/review/11468 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-10-31packet-dcerpc: add dissect_ndr_ucarray_block()Stefan Metzmacher1-0/+4
Change-Id: Ibfb49738ea35d1d02220d69187a6083d5ebbae25 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-on: https://code.wireshark.org/review/11365 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-10-30packet-dcerpc: pass dcerpc_info to dcerpc_dissect_fnct_blk_tStefan Metzmacher1-1/+1
Change-Id: I92711ee39850f6710eaebf5c678496e7cd9b5f59 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-on: https://code.wireshark.org/review/11364 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-08-12Add DCE-RPC and ONC-RPC service response time dialogs.Gerald Combs1-0/+3
Add RpcServiceResponseTimeDialog, which handles DCE-RPC and ONC-RPC service response time statistics. Try to make it as lightweight as possible, since we might want to pull this into the RPC dissectors similar to the other SRT statistics. Allow program names on the command line in place of numbers or UUIDs. Make matches case-insensitive. E.g. the following are equivalent: -z rpc,srt,100003,3 -z rpc,srt,nfs,3 -z rpc,srt,NFS,3 as are the following: -z dcerpc,srt,f5cc5a18-4264-101a-8c59-08002b2f8426,56 -z dcerpc,srt,nspi,56 -z dcerpc,srt,NSPI,56 Change-Id: Ie451c64bf6fbc776f27d81e3bc248435c5cbc9e4 Reviewed-on: https://code.wireshark.org/review/9981 Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-06-21Further refactor SRT stats.Michael Mann1-0/+8
Create "common" SRT tap data collection intended for all GUIs. Refactor/merge functionality of existing dissectors that have SRT support (AFP, DCERPC, Diameter, FC, GTP, LDAP, NCP, RPC, SCIS, SMB, and SMB2) for both TShark and GTK. SMB and DCERPC "tap packet filtering" were different between TShark and GTK, so I went with GTK filter logic. CAMEL "tap packet filtering" was different between TShark and GTK, so GTK filtering logic was pushed to the dissector and the TShark tap was left alone. Change-Id: I7d6eaad0673fe628ef337f9165d7ed94f4a5e1cc Reviewed-on: https://code.wireshark.org/review/8894 Petri-Dish: Michael Mann <mmann78@netscape.net> Reviewed-by: Gerald Combs <gerald@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-05-31Eliminate proto_tree_add_text from packet-dcerpc-ndr.c and ↵Michael Mann1-0/+1
packet-dcerpc-netlogon.c Change-Id: I65eff9c8087424087a307f18b96a202f0364e371 Reviewed-on: https://code.wireshark.org/review/8714 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-04-29- Mark some DCE/RPC functions as public do allow calls from pluginsMicha Reiser1-0/+4
- DCOM: * Mark some DCOM functions as public do allow calls from plugins * Add Support for Additional Variant Types Money, I8, UI8 * Fix an uint32 overflow when dissecting nwstringz0 where the length is 0 * Use WS_DLL_PUBLIC instead of WS_DLL_PUBLIC_DEF Change-Id: I02861a09203c6b42326f5a7b7e652e0f7c26d369 Reviewed-on: https://code.wireshark.org/review/8222 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-03-03Eliminate e_uuid_t in favor of e_guid_t.Guy Harris1-22/+15
That eliminates a redundant and confusing data type, and avoids issues with one piece of code using e_uuid_t but wanting to use routines expecting an e_guid_t. Change-Id: I95e172d46d342ab40f6254300ecbd2a0530cde60 Reviewed-on: https://code.wireshark.org/review/7506 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-01-22packet-dcerpc: change transportsalt to guint64Stefan Metzmacher1-4/+4
This will be able to hold also SMB2 file ids and maybe other stuff in future. Change-Id: Ib55895a346b7dc6562291730693453728c99fe91 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-on: https://code.wireshark.org/review/6708 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-09-19Don't assert that values fit in 32 bits if the NDR64 flag is set.Michael Mann1-1/+1
For now, this just pacifies fuzz-testing. If real world examples have this, there needs to be a drastic overhaul to support fields that could be either 32 or 64-bit values. Bug:9329 Change-Id: I3e28808ca0291868a5f84258b0ee1e2a922703c2 Reviewed-on: https://code.wireshark.org/review/4189 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2013-12-15In dissect_ndr_byte_array(), use the field index from the dcerpc_infoGuy Harris1-0/+8
structure, rather than a fixed field. Get rid of that fixed field, as it's no longer needed. Use dissect_ndr_byte_array() rather than dissect_ndr_char_cvstring() in a case where we have an opaque byte array. Have dissect_ndr_cvstring() and dissect_ndr_vstring() - and, therefore, routines that call them, such as dissect_ndr_cstring(), dissect_ndr_char_cvstring(), dissect_ndr_char_vstring(), and dissect_ndr_wchar_vstring() - require that the field being used by an FT_STRING field. Manually fix a case where the PIDL generator makes such a field FT_NONE rather than FT_STRING. Also handle EBCDIC, just in case we happen to see a packet with EBCDIC strings. Use tvb_get_string_enc(), rather than tvb_get_unicode_string() or tvb_get_string(), in dissect_ndr_cvstring() and dissect_ndr_vstring(). svn path=/trunk/; revision=54134
2013-11-25Move DCERPC data in packet_info needed for Decode As into packet scoped ↵Michael Mann1-3/+2
proto data. svn path=/trunk/; revision=53559
2013-11-24Move dceprc_procedure_name from packet_info to dcerpc_info. Doesn't appear ↵Michael Mann1-0/+1
to be "used" by dissectors, just stored (for help in debugging?). svn path=/trunk/; revision=53552
2013-11-22Move common "decode as" preference code to epan.Gerald Combs1-3/+11
We presumably want "decode as" behavior to be consistent across UIs so call load_decode_as_entries() from read_prefs(). svn path=/trunk/; revision=53498
2013-11-20Provide "Decode As" functionality through dissectors themselves instead of ↵Michael Mann1-9/+5
the GUI. Bug 9450 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9450) The basic idea behind this design is to have dissectors register with a "decode as list" with their name and dissector table. When "Decode As" dialog is launched, any "registered" dissector found in the packet will cause a tab to be created in the dialog. Any GUI (GTK+/Qt/tshark) can just hook into the "decode as list" to see what can be provided. This patch includes the GUI portion of the functionality (including packet-dcerpc.[ch] because it had some GUI dependencies that are now removed). Other notes: 1. Some "GUI text" (UTF8_LEFTWARDS_ARROW and similar) made their way into the dissector code. Not sure how necessary it is and if reformatting the strings to avoid the macros is desired (TCP/UDP use it, SCTP doesn't). 2. I converted the SCTP functionality to have 2 tabs (instead of radio button), currently both are labeled "Transport" which could be confusing to users. Naming suggestions welcome (as well as for naming of tabs from other dissectors). 3. BER and DCERPC have more opportunity to use Decode As now that they are selected based on dissector presense, not packet_info values. 4. Catapult DCT2000 populates pinfo->ipproto, yet under new design will not show up to do Decode As. Should a "decode as item" be created for it? 5. BER dissector doesn't have Clear/Show Current functionality working (never did) 6. Bluetooth (in old design) could have been used "capture wide" instead of single packet (creating tabs of values not present in current packet), which goes against what I believe to be in the intent of Decode As, but I'm willing to hear counter-arguments. svn path=/trunk/; revision=53446
2013-11-06Remove pinfo->private_data from DCERPC dissectors and instead have ↵Michael Mann1-98/+110
dcerpc_info* infomation be passed in as a function parameter. Bug 9387 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9387) All "generated" source was manually modified (with the power of search/replace), but I believe the "source input" files have been adjusted (checked into revs 53098 and 53099) to reflect the necessary changes (with possible whitespace formatting differences). The Microsoft compiler doesn't flag "unused function parameters", so I apologize in advance if I may have missed a few. The "dcerpc_info* di" parameter is used in almost every function. svn path=/trunk/; revision=53100
2013-10-21Add a new api to allow dissection of the array payload as a whole. Bug 9307 ↵Michael Mann1-3/+10
(https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9307) From Matthieu Patou svn path=/trunk/; revision=52743
2013-10-21We can't really have conformant strings they are always conformant andMichael Mann1-1/+4
varying but pidl insists on having a different function. Bug 9306 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9306) From Matthieu Patou. svn path=/trunk/; revision=52742
2013-10-21Add APIs for PIDL generated code to return the value of the integer that was ↵Michael Mann1-1/+5
dissected. Bug 9305 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9305). From Matthieu Patou svn path=/trunk/; revision=52741
2013-10-13whitespace fixes; mostly: remove trailing blanksBill Meier1-29/+29
svn path=/trunk/; revision=52591
2013-03-01Export libwireshark symbols using WS_DLL_PUBLIC defineBalint Reczey1-2/+22
Also remove old WS_VAR_IMPORT define and related Makefile magic everywhere in the project. svn path=/trunk/; revision=47992
2012-11-26From Dirk Jagdmann: Fix a comment in the DCERPC dissector header.Gerald Combs1-1/+1
svn path=/trunk/; revision=46208
2012-06-28Update Free Software Foundation address.Jakub Zawadzki1-1/+1
(COPYING will be updated in next commit) svn path=/trunk/; revision=43536
2011-07-19Add a DREP_LITTLE_ENDIAN for the DCE RPC endianness bit in the dataGuy Harris1-0/+11
representation. Use it rather than a raw 0x10. Add a DREP_ENC_INTEGER() macro that takes a pointer to the data representation and returns either ENC_LITTLE_ENDIAN or ENC_BIG_ENDIAN; use it for the encoding argument to proto_tree_add_item(), rather than just the AND of drep[0] and DREP_LITTLE_ENDIAN, as it's not a boolean any more, and for string values we'll be supporting character encodings as well and thus won't be able to trust that the 0x10 bit will mean "little endian". Use ENC_NA for some other encoding values, i.e. for FT_BYTES and the like. Fix a couple of places in the DCOM dissector where we were passing the byte-order bit rather than the field value to proto_tree_add_uint_format(). Clean up white space. svn path=/trunk/; revision=38128
2010-12-23From Julien Kerihuel:Jaap Keuter1-1/+1
I've just finished to write a ncacn_http dissector for Wireshark which provides the ability to dissect Outlook anywhere packets properly (as specified by [MS-RPCH].pdf documentation. svn path=/trunk/; revision=35259
2010-01-20From Julien Kerihuel, add support forRonnie Sahlberg1-0/+1
unaligned unmarshalling of dissectors generated by PIDL. This will allow us to use PIDL and additional IDLs from the samba project since they use "noalign" for certain protocols. This may also allow us to use PIDL to describe, and machinegenerate dissectors for normal, non-DCERPC, protocols. This patch for PIDL is still under review, but the PIDL patch is l;ikely to be committed soonish. svn path=/trunk/; revision=31583
2009-10-04merge some changes to samr from the samba idlRonnie Sahlberg1-0/+1
svn path=/trunk/; revision=30272
2009-10-03rename 2or4 to a new type guint1632 and call the dissector for this Ronnie Sahlberg1-2/+5
function dissect_ndr_uint1632() svn path=/trunk/; revision=30265
2009-10-03rename dissect_ndr_4or8 to dissect_ndr_uint3264 to match hte name of Ronnie Sahlberg1-2/+5
the new datatype uint3264. create a fake guint3264 type as well svn path=/trunk/; revision=30264
2009-10-03add a helper that supports decoding either a 16 or 32 bit integer based Ronnie Sahlberg1-0/+3
on whether nrd or ndr64 is used. svn path=/trunk/; revision=30263
2009-10-03teach the dce/rpc pointer dissector about ndr64 and make it dissect Ronnie Sahlberg1-2/+5
pointers as 8 byte entities when ndr64 is negotiated svn path=/trunk/; revision=30253
2009-10-01we need to copy the information about the transport syntax, i.e. i fit Ronnie Sahlberg1-1/+3
is ndr64 or not, from the bind information to the data we store for each individual pdu, since the trnasport syntax may change dynamically back and forth between "normal" and "ndr64" on the same conversation. svn path=/trunk/; revision=30226
2009-06-14From Didier Gautheron via bug 3531: Gerald Combs1-0/+7
Recent glib versions always include signal.h in gbacktrace.h On Linux PPC signal.h defines PT_R4 which is also defined by samba and compilation fails. svn path=/trunk/; revision=28727
2008-10-01add more policy handle types for the new LSA dissectorRonnie Sahlberg1-0/+4
svn path=/trunk/; revision=26319
2008-02-08based on the novell idllib sources :Ronnie Sahlberg1-0/+1
add dissection of the 16 byte header prior to the NDR data when NDR is transported as a blob ontop of !dcerpc like the LOGON_INFO in the PAC in kerberos svn path=/trunk/; revision=24289
2007-08-28rename dcerpc_smb_store_pol_name to dcerpc_store_polhnd_nameRonnie Sahlberg1-2/+31
rename dcerpc_smb_fetch_pol to dcerpc_fetch_polhnd_data and also make it take an additional parameter to return the "type" of the policy handle, if such a type was stored. extend the pol_value structure used to track policy handles to also store a type to represent what created the policy handle types could be USER/ALIAS/CONNECT/... etc handles returned from the SAMR interface add a new helper function dcerpc_store_polhnd_type() track policy handles between request/responses for dcerpc update the samr.cnf file to make the samr dissectors for SetSecurity/QuerySecurity dissect the specific bits for the security descriptor correctly based on whether the policy handle refers to a CONNECT/DOMAIN/USER/ALIAS or GROUP svn path=/trunk/; revision=22703
2007-05-08update PIDL_dissect_cvstring so that it can be used in a future pidl to Ronnie Sahlberg1-1/+1
prettify strings svn path=/trunk/; revision=21722
2007-02-27add PIDL friendly helper to manage unicode stringsRonnie Sahlberg1-1/+5
svn path=/trunk/; revision=20941
2007-02-25add new flag for PIDL conformance files : PIDL_SET_COL_INFORonnie Sahlberg1-0/+2
which applies (for now only) to integer types. when this flag is specified as PARAM_VALUE the fields name and its value will be pushed onto the info column of the summary line svn path=/trunk/; revision=20922
2007-02-25move the defines for PIDL_POLHND_{OPEN|CLOSE} to packet-dcerpc.hRonnie Sahlberg1-0/+11
also change their values to use the top order bits of an uint32 instead of the least significant ones svn path=/trunk/; revision=20919
2007-02-25add new PIDL friendly helpers for dissection of integer types.Ronnie Sahlberg1-0/+4
these new helpers take a parameter that can be used to decorate the tree and summary line (when this parameter is acted upon/implemented in the code inside the helpers) WINREG was regenerated using a patched version of PIDL. Mainline version of PIDL does not yet have this patch applied. svn path=/trunk/; revision=20918
2006-09-13the way we pass dcerpc strings from deep down in helpers to high level ↵Ronnie Sahlberg1-2/+24
dissector functions (dcv->private_data) for things such as strings and sids is a mess and very difficult to handle without a lot of memory leakage. the biggest problem in changing this is the dcv->private_data usage. add a dcv->se_data which can keep data around from a request to a response and use this to change the LSA/OpenPolicy2 servername passing from request to response as a test pattern of moving all users of dcv->private data over to use dcv->se_data. once all users are migrated over we can then change the dcv->private data pointer to be of ep scope and thus not need an explicit free (which is quite difficult and it is quite difficult in the old semantics to know WHEN we need to free this pointer) this will eventually make the usage more clean and at the same time close down quite a few memory leaks. eventually this will make dissect_ndr_nt_SID return a pointer to ep allocated memory that need not be explicitely freed. svn path=/trunk/; revision=19226
2006-08-17some further work on the GUID/UUID resolvingsUlf Lamping1-3/+0
most of the relevant code moved to guid_utils lot of corresponding code cleanup in packet-dcerpc.c still using GHashTable still not using a manuf like file svn path=/trunk/; revision=18939
2006-06-29keep the (optional) Object UUID in the call valueUlf Lamping1-2/+5
svn path=/trunk/; revision=18613
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-02 22:04:32 +0000