aboutsummaryrefslogtreecommitdiffstats
path: root/packet-dcerpc.c
AgeCommit message (Collapse)AuthorFilesLines
2004-06-24from todd ssahlberg1-51/+89
update to reassembly of dg style dcerpc git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@11227 f5534014-38df-0310-8fa8-9805f1628bb7
2004-06-09DCERPC problem reported by JBM and identified by Todd Sabinsahlberg1-40/+80
Other protocol, not only SMB will populate pinfo->private_data thus checking for existence of non-NULL pinfo->private_data is not sufficient to determine we have SMB data and this is what it is. Refactor the adding of salt/FID from lower layer protocols and generalize it. Create a new dissector_handle specific for SMB so that we know that IFF we came in through that handle, then whatever pinfo->private_data is what we expect it to be. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@11129 f5534014-38df-0310-8fa8-9805f1628bb7
2004-06-05Yaniv Kaul: Add some more UUID decoding on Windowsjmayer1-1/+13
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@11120 f5534014-38df-0310-8fa8-9805f1628bb7
2004-06-04bugfix: when saving connectionless DCERPC fragments,ulfl1-2/+4
add a hashed activity_id to the sequence number. This will prevent missdissected fragments. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@11111 f5534014-38df-0310-8fa8-9805f1628bb7
2004-05-29Squelch a compiler warning by removing a "/*" from the middle of aguy1-2/+2
comment. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@11029 f5534014-38df-0310-8fa8-9805f1628bb7
2004-05-28connectionless cancel PDU's don't have a dg_server_accepting_cancels fieldulfl1-3/+6
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@11027 f5534014-38df-0310-8fa8-9805f1628bb7
2004-05-15Remove call to PROTO_ITEM_SET_LINK().tpot1-2/+1
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10902 f5534014-38df-0310-8fa8-9805f1628bb7
2004-05-15remove FI_LINK again,ulfl1-6/+1
as this info can be derived from the presence of the FT_FRAMENUM field git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10901 f5534014-38df-0310-8fa8-9805f1628bb7
2004-05-14add support to link from specially marked fields to related packets,ulfl1-1/+2
a doubleclick will follow the link git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10896 f5534014-38df-0310-8fa8-9805f1628bb7
2004-05-14add support to link from specially marked fields to related packets,ulfl1-1/+6
a doubleclick will follow the link git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10893 f5534014-38df-0310-8fa8-9805f1628bb7
2004-05-07Compile fixes for change to dcerpc_info structure.tpot1-2/+3
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10815 f5534014-38df-0310-8fa8-9805f1628bb7
2004-05-07replace info field "gboolean request" by "guint8 ptype",ulfl1-8/+8
so the packet type can be better detected git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10812 f5534014-38df-0310-8fa8-9805f1628bb7
2004-05-07tag some protocol items as generatedulfl1-15/+32
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10811 f5534014-38df-0310-8fa8-9805f1628bb7
2004-05-04Display a server boot time of 0 as "Unknown" (as that's what's sent whenguy1-5/+12
the client sends its first PDU to the server, and when the endpoint mapper sends back an error PDU on behalf of the server, because they don't know the server's boot time - it's unlikely that the server was booted precisely at January 1, 1970, 00:00:00 GMT). Clean up some white space. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10784 f5534014-38df-0310-8fa8-9805f1628bb7
2004-04-24some additional output while reassembling fragments,ulfl1-22/+47
to give the user better information about the fragmenting going on, some other minor changes git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10681 f5534014-38df-0310-8fa8-9805f1628bb7
2004-04-23update to netlogon to dissect the timestamps in VALIDATION_UAS_INFOsahlberg1-2/+7
update to dcerpc time_t dissector to print the string "No time specified" when the seconds field is 0xffffffff git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10678 f5534014-38df-0310-8fa8-9805f1628bb7
2004-03-05we need to export init_ndr_pointer_list() from packet-dcerpc so thatsahlberg1-2/+2
we can manually call functions to dissect NDR encoded structures without going through the DCERPC interface. There are NDR encoded blobs that are not encapsulated inside DCERPC such as in kerberos and those dissectors need this. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10321 f5534014-38df-0310-8fa8-9805f1628bb7
2004-03-03Yaniv Kaul: show interface names - win32 onlyjmayer1-3/+54
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10291 f5534014-38df-0310-8fa8-9805f1628bb7
2004-02-21From Jaime Fournier:guy1-10/+12
The UNKUUID col_info update was only working as dcerpc_try_handoff() would fail to find the subdissector, and thus did not clobber it with col_add_str(). It is now in the right place to determine a UUID that was either not found, or is disabled. The boolean dcerpc.unknown_if_id is now only set on cases where the handoff fails. This has been tested, and the boolean now works as it should, and is not set for ALL packets as it was in the old location. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10163 f5534014-38df-0310-8fa8-9805f1628bb7
2004-02-18using G_MAXFLOAT and G_MAXDOUBLE,ulfl1-5/+5
DCERPC is talking about a response, not a reply git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10096 f5534014-38df-0310-8fa8-9805f1628bb7
2004-02-18From Jaime Fournier: add a hidden FT_BOOLEAN variable that's present ifguy1-5/+11
the interface UUID in a datagram call is unknown. Clean up white space a bit. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10084 f5534014-38df-0310-8fa8-9805f1628bb7
2004-01-19char *drep -> guint8 *drepjmayer1-22/+22
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9735 f5534014-38df-0310-8fa8-9805f1628bb7
2003-12-08From Jamie Fournier: don't show UNKUUID information for fragments forguy1-6/+12
known dissectors. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9208 f5534014-38df-0310-8fa8-9805f1628bb7
2003-11-25From Jaime Fournier: show the RPC version of the unknown interface inguy1-11/+7
the Info column. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9081 f5534014-38df-0310-8fa8-9805f1628bb7
2003-11-21From Jamie Fournier: add the UUID to the Info column for datagram calls.guy1-3/+9
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9054 f5534014-38df-0310-8fa8-9805f1628bb7
2003-11-16Export "protocol_t" as an opaque type.guy1-4/+5
Make "proto_is_protocol_enabled()" and "proto_get_protocol_short_name()" take a "protocol_t *" as an argument, so they don't have to look up the "protocol_t" - this will probably speed them up considerably, and they're called on almost every dissector handoff. Get rid of a number of "proto_is_protocol_enabled()" calls that aren't necessary (dissectors called through handles, including those called through dissector tables, or called as heuristic dissectors, aren't even called if their protocol isn't enabled). Change some direct dissector calls to go through handles. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8979 f5534014-38df-0310-8fa8-9805f1628bb7
2003-11-13From Jaime Fournier: get rid of space in field name.guy1-2/+2
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8958 f5534014-38df-0310-8fa8-9805f1628bb7
2003-11-12Put stub data back where it was in the tree before.guy1-3/+3
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8947 f5534014-38df-0310-8fa8-9805f1628bb7
2003-11-06Update a comment.guy1-2/+8
Catch another case where we need to check for a null decrypted_tvb. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8894 f5534014-38df-0310-8fa8-9805f1628bb7
2003-11-06Bugfix for dcerpc parsing of encrypted short packets.sahlberg1-3/+11
Sometimes if we cant decrypt a DCERPC packet decrypted_tvb is NULL. do not pass a NULL pointer to show_stub_data() since this will dump core. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8890 f5534014-38df-0310-8fa8-9805f1628bb7
2003-10-23Fix a call to "dissect_dcerpc_cn()" to handle the new return value.guy1-2/+2
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8761 f5534014-38df-0310-8fa8-9805f1628bb7
2003-10-23Catch exceptions in "dissect_dcerpc_cn_bs()", so that if we get anguy1-20/+54
exception dissecting stuff past the DCE RPC header, we still drive on and dissect the next PDU, if any. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8760 f5534014-38df-0310-8fa8-9805f1628bb7
2003-10-23Get rid of the "offset" argument to "dcerpc_try_handoff()" - it's alwaysguy1-121/+203
0. In "dcerpc_try_handoff()", remove the authentication padding from the stub data handed to the subdissector - that's not really stub data for the subdissector, and it should throw an exception if the request or response would go into the authentication padding. Don't even try to dissect the remaining stub data if the authentication padding value consumes all the stub data or would consume even more than that. Show any "Long frame" data before the authentication padding, and show the authentication padding as the stuff at the very end of the stub data, after the "Long frame" data. Catch all exceptions when dissecting authentication information, so that even if it's bad or we don't have all of it, we still dissect the stub data. Try dissecting authentication trailer information even if we don't have all of it in the tvbuff - we want an exception to be thrown if we don't. Don't try to dissect it if it eats into the stub data, however. Don't bother catching exceptions in "dissect_auth_verf()" - we now always catch exceptions in above it in the DCE RPC dissector call tree. Use CATCH_ALL and "show_exception()" when calling the sub-dissector for a connection-oriented PDU; that means we won't have to worry about adding new exception types unless they're types that we should rethrow. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8759 f5534014-38df-0310-8fa8-9805f1628bb7
2003-10-22From Yaniv Kaul: if there's more than one context item in a BIND PDU, showguy1-2/+5
the number of context items before showing the first one. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8753 f5534014-38df-0310-8fa8-9805f1628bb7
2003-10-21Catch exceptions when dissecting a verifier, so we still dissect theguy1-100/+112
stub data even if there's a problem dissecting the verifier. Show stub data as "Encrypted stub data" if it's encrypted, "Decrypted stub data" if it was encrypted but we decrypted it, and "Stub data" if it wasn't encrypted. Don't attempt to decrypt data unless it was encrypted (i.e., the authentication level is "Packet privacy". Get rid of "decrypted_data" member of "packet_info" structure - we don't need it any more. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8743 f5534014-38df-0310-8fa8-9805f1628bb7
2003-10-14"dce_try_handoff()" isn't necessarily passed a non-null "auth_info"guy1-4/+6
argument - don't dereference it if it's null. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8685 f5534014-38df-0310-8fa8-9805f1628bb7
2003-10-10Updated the DCERPC service response time to also offer the menu tosahlberg1-1/+18
Filter, Find and Colorize selected procedures in the same way as SMB and ONC-RPC already does. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8667 f5534014-38df-0310-8fa8-9805f1628bb7
2003-10-08Change dissect_deferred_pointer()sahlberg1-2/+5
from being Ordo(n^2) into being Ordo(n) Makes it slightly faster when n (the number of pointers) is >10.000 The mother of all dcerpc packets (containing one array of >10.000 pointers) was a bit slow. It is still slow but at least completes in out lifetime. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8647 f5534014-38df-0310-8fa8-9805f1628bb7
2003-09-26This commit refactors the dcerpc authentication subdissectors fortpot1-125/+105
handling encrypted request/response PDUs. Instead of having dissection function pointers which perform both decryption and dissection, the function pointers now only decrypt the DCERPC fragment payload. Dissection is handled by the dcerpc_try_handoff() function (with DCERPC fragment reassembly if necessary). Details: - Move the dcerpc_auth_info struct into dcerpc.h as it is now used in the function prototype for the decryption function handlers. - decode_encrypted_data() was refactored to take a boolean request parameter instead of passing the DCERPC PDU packet type. - A tvbuff_t * data field was added to dcerpc_auth to hold the verifier. This is passed as an argument to the decryption function handlers. - Dissection of verifiers in request and response PDUs was moved to before the payload. - The dissect_dcerpc_cn_stub() function was refactored to perform the decryption process and hand decrypted data to the reassembly code instead of performing the decryption after reassembly. - Removed references to decrypted_info_t as it's not necessary anymore. Code was tested using encrypted and unencrypted fragmented PDUs. Before this commit ethereal could not dissect unencrypted (!) fragmented PDUs correctly. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8546 f5534014-38df-0310-8fa8-9805f1628bb7
2003-09-26Use zero to mean we haven't seen any authentication level informationtpot1-7/+7
in dcerpc_auth_info since auth_level is an unsigned type. Zero is not a valid authentication level anyway (s13.1.2.1, p611 CAE spec). Remove two inscrutable debugging comments that don't seem to mean anything. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8545 f5534014-38df-0310-8fa8-9805f1628bb7
2003-09-19Put the presentation context list and transfer syntax list of a dcerpctpot1-12/+33
bind request into some subtrees to make things look a bit nicer. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8497 f5534014-38df-0310-8fa8-9805f1628bb7
2003-09-11Do not take the pointer to a stack object and pass it to the tap system.sahlberg1-36/+58
The tap listener will try to parse this pointer at a much later stage where the stack frame where this object lived will have dissapeared and possible got overwritten. best that can happen is that service response times for dcerpc interfaces is screwed up more probable is that we get a coredump git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8455 f5534014-38df-0310-8fa8-9805f1628bb7
2003-08-04Guy suggested that the dcerpc opnum value_string code could be simplifiedtpot1-12/+22
somewhat. Now the dynamic initialisation of the value_string is contained in the value_string_from_subdissectors() function instead of being distributed amongst the dcerpc dissectors. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8123 f5534014-38df-0310-8fa8-9805f1628bb7
2003-07-21From Devin Heitmueller: include the authentication padding in the stubguy1-11/+16
data when decrypting it, as, at least for NTLMSSP encryption, the stub *and* the authentication padding are encrypted as a single lump. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8058 f5534014-38df-0310-8fa8-9805f1628bb7
2003-07-18Alter_context is sort of like Bind, and its authentication stubs areguy1-1/+3
dissected like those on Binds; the same is true for their corresponding acks. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8043 f5534014-38df-0310-8fa8-9805f1628bb7
2003-07-16Squelch a (potentially-valid) compiler warning.guy1-2/+2
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8027 f5534014-38df-0310-8fa8-9805f1628bb7
2003-07-16Move all DCERPC authentication/encryption dissection code from packet-dcerpc.ctpot1-199/+181
to the dissector that handles the particular authentication flavour. This gets rid of a couple of ugly switch statements and allows other authentication modules to be written easily. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8026 f5534014-38df-0310-8fa8-9805f1628bb7
2003-06-26Dynamically create DCERPC opnum value_strings from the subdissectortpot1-1/+23
list rather than duplicating this information in the dissector. Some of the opnum strings were starting to get out of date as developers forgot to update the information in both places. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7936 f5534014-38df-0310-8fa8-9805f1628bb7
2003-06-19Squelch a compiler warning (for something that's potentially a realguy1-2/+2
problem). git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7901 f5534014-38df-0310-8fa8-9805f1628bb7
2003-06-19Initialize di.hf_index in dissect_dcerpc_cn_rqst(). Alan Hood sent me agerald1-1/+2
fuzz-generated packet that made it all the way to proto_registrar_get_name() without hf_index being initialized. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7899 f5534014-38df-0310-8fa8-9805f1628bb7
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-26 13:38:53 +0000