aboutsummaryrefslogtreecommitdiffstats
path: root/packet-dcerpc.c
AgeCommit message (Collapse)AuthorFilesLines
2002-05-27Changed toplevel REF pointer dissection to create a subtree. Not creating a ↵Ronnie Sahlberg1-2/+10
subtree was a design mistake which caused ugliness in the unicode string str dissector and in other places. Dissectors will temporarily have less pretty output for topleve ref pointers until their output is retuned. svn path=/trunk/; revision=5573
2002-05-25Fix a bug for dcerpc. If we do not have reassembly of fragments enabled, ↵Ronnie Sahlberg1-6/+18
only call the subdissector for the first fragment. svn path=/trunk/; revision=5556
2002-05-24Reassembly of fragmented DCE/RPC (only for connection oriented DCE/RPC).Ronnie Sahlberg1-8/+303
svn path=/trunk/; revision=5548
2002-05-23Additions to the MAPI dissector. Function 02 for MAPI.Ronnie Sahlberg1-2/+2
The function request/call are dissected but the main body of the function in/out parameters consists of a unidimensional conformant and varying array of bytes which content is encrypted/obfuscated. Whoever can tell me how to decrypt/unobfuscate these bytes will get a case of VB next time in Sydney. svn path=/trunk/; revision=5532
2002-05-07Added extra check in the function that parses NDR pointers.Ronnie Sahlberg1-1/+58
When the representation for a pointer type gets dissected, the dissector is actually called twice. Once with conformant_run==1 and once ==0. The idea is that when conformant_run is ==1, the ONLY bytes that will be dissected and would be the array structure preceeding the actual data. And the normal data and content will be dissected when conformant_run ==0. This is to handle the case properly when conformant arrays are embedded inside aggregated types, in which case there will be other data inserted between these array control data, and the array content. The check that is added will assert that no other data is actually eaten for conformant_run==1 than just this data. This will help debugging dcerpc dissectors. svn path=/trunk/; revision=5412
2002-05-02From Joerg Mayer: get rid of some unused variables and arguments, andGuy Harris1-9/+9
mark other unused arguments as such. svn path=/trunk/; revision=5366
2002-04-30Changed COL_INFO string from 'rqst FOO(...)' to 'FOO request' as perTim Potter1-13/+20
discussion on dev list. svn path=/trunk/; revision=5299
2002-04-29Removal (or, at least, #ifdeffing out) of unused variables andGuy Harris1-5/+3
functions, from David Frascone. svn path=/trunk/; revision=5288
2002-04-22Frame numbers are unsigned, and 0 is not a valid frame number; make theGuy Harris1-10/+10
frame number arguments, and elements in data structures, unsigned, display them with "%u" rather than "%d", and use 0, rather than -1, as "not known". svn path=/trunk/; revision=5223
2002-03-22For DCE RPC requests and replies, put an item into the protocol tree forGuy Harris1-13/+73
the sub-protocol containing the actual operation number (which isn't necessarily the operation number in a connectionless reply's PDU; sometimes the operation number in a connectionless reply appears to be garbage, and it's not what we use to dissect the reply in any case), and also giving the name of the operation, if we know it. Show the authentication data in connectionless PDUs, if present, as an item in the protocol tree. svn path=/trunk/; revision=5002
2002-03-21From Todd Sabin: set the tvbuff length of the stub data forGuy Harris1-35/+137
connectionless calls to the fragment length. Add value_string tables for authentication protocol and level values. Show the authentication protocol in decimal in connectionless PDUs, just as we do in connection-oriented PDUs. Get the authentication level from connection-oriented request and reply PDUs and, if it's DCE_C_AUTHN_LEVEL_PKT_PRIVACY, don't hand the stub data to subdissectors, just show it as encrypted stub data. svn path=/trunk/; revision=4998
2002-03-19Secondary addresses are NUL-terminated strings; treat them as such.Guy Harris1-2/+2
svn path=/trunk/; revision=4981
2002-03-18Don't show a secondary address if the secondary address length is 0.Guy Harris1-4/+6
svn path=/trunk/; revision=4968
2002-03-16Put an item into the protocol tree for the secondary address in a bindGuy Harris1-1/+6
ack PDU. svn path=/trunk/; revision=4958
2002-03-10Catch another "(NULL pointer)%s" we didn't catch with the previousGuy Harris1-2/+2
checkin. svn path=/trunk/; revision=4911
2002-03-10Put a space between "(NULL pointer)" and the name of the item beingGuy Harris1-4/+4
dissected, just as is done with "(duplicate PTR)". svn path=/trunk/; revision=4910
2002-03-06Fixed bug in dissect_ndr_pointer(). Top level Unique and Full pointers areRonnie Sahlberg1-5/+31
not encoded in the same way in the NDR representation. svn path=/trunk/; revision=4887
2002-02-13From Ronnie Sahlberg: display the opnum also for reply packets.Guy Harris1-1/+2
svn path=/trunk/; revision=4728
2002-02-12Display the fragment length, and fragment ordinal number, in decimal.Guy Harris1-3/+3
svn path=/trunk/; revision=4722
2002-02-12From Ronnie Sahlberg:Guy Harris1-22/+68
SAMR updates; a bugfix in dissect_ndr_pointer() (should not check referent id for aliases for unique pointers); enhancement to dissect_ndr_pointer() to make it possible to hand a generic int value to the dissector for the pointer object in a similar way as hf_index values are passed through the pointer layer. svn path=/trunk/; revision=4721
2002-02-11From Ronnie Sahlberg:Guy Harris1-6/+10
fix to LookupRids to match what the IDL file says; fix to "dissect_ndr_uint64()" to specify the right length to "proto_tree_add_item()"; give the protocol tree items for array header counts and offsets the correct offsets in the packet. svn path=/trunk/; revision=4719
2002-02-10From Todd Sabin:Guy Harris1-12/+23
dissect dcerpc UDP replies correctly - use the opnum from the request, ont the reply (the opnum from the request is frequently wrong in Microsoft's DCE RPC implementation); don't crash if the packet isn't found in the hash tables; dissect SamrLookupDomain requests properly. svn path=/trunk/; revision=4718
2002-02-08Fixes from Ronnie Sahlberg.Guy Harris1-18/+11
svn path=/trunk/; revision=4710
2002-02-06From Ronnie Sahlberg:Guy Harris1-1/+9
the count fields in SAMR replies aren't array max_count values, so don't display them as such; Put conformant and conformant varying array length/offset/etc. values into the protocol tree. svn path=/trunk/; revision=4701
2002-01-29DCE RPC enhancements, and SAMR improvements, from Ronnie Sahlberg.Guy Harris1-9/+103
svn path=/trunk/; revision=4618
2002-01-25From Ronnie Sahlberg:Guy Harris1-2/+295
NDR pointer handling in DCE RPC SAMR updates svn path=/trunk/; revision=4608
2002-01-24Replace a bunch of "tvb_length()" and "tvb_length_remaining()" calls inGuy Harris1-3/+3
arguments to "proto_tree_add_text()", and to "proto_tree_add_XXX()" calls that add FT_NONE or FT_PROTO items to the protocol tree, with -1. Replace some calls to "tvb_length()" or "tvb_length_remaining()" with calls to "tvb_reported_length()" and "tvb_reported_length_remaining()", as those give the actual length of the data in the packet, not just the data that happened to be captured. svn path=/trunk/; revision=4605
2002-01-23From Ronnie Sahlberg: add support for finding the response that matchesGuy Harris1-120/+272
a request. svn path=/trunk/; revision=4600
2002-01-21Include files from the "epan" directory and subdirectories thereof withGuy Harris1-3/+3
"epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
2002-01-03SPOOLSS RPC dissector, from Tim Potter. This includes adding additionalGuy Harris1-7/+26
DOS error codes to the table of them, and exporting that table to other dissectors for protocols using DOS error codes. svn path=/trunk/; revision=4470
2001-12-17Check whether the protocol for a DCERPC subdissector is enabled, andGuy Harris1-2/+11
don't call the subdissector (or even create a subtree for the protocol) if it's not enabled. Save the current protocol string, and set it to the string for the subdissector's protocol, before calling the subdissector, and restore it after the subdissector returns. svn path=/trunk/; revision=4418
2001-12-10Move the pointer to the "column_info" structure in the "frame_data"Guy Harris1-22/+22
structure to the "packet_info" structure; only stuff that's permanently stored with each frame should be in the "frame_data" structure, and the "column_info" structure is not guaranteed to hold the column values for that frame at all times - it was only in the "frame_data" structure so that it could be passed to dissectors, and, as all dissectors are now passed a pointer to a "packet_info" structure, it could just as well be put in the "packet_info" structure. That saves memory, by shrinking the "frame_data" structure (there's one of those per frame), and also lets us clean up the code a bit. svn path=/trunk/; revision=4370
2001-12-05Support for reassembly of DCERPC over SMB, from Ronnie Sahlberg.Guy Harris1-2/+2
svn path=/trunk/; revision=4335
2001-11-27Add { 0, NULL } terminators to some "value_string" arrays lacking them.Guy Harris1-4/+8
Make some static that don't need to be exported. svn path=/trunk/; revision=4288
2001-11-27When returning the length of the DCE RPC PDU, add 4 if the packet wasGuy Harris1-5/+13
preceded by 4 bytes of zero padding. svn path=/trunk/; revision=4287
2001-11-27Rename the heuristic dissector table "msrpc" to "smb_transact", toGuy Harris1-2/+2
indicate that it's to be used for SMB transactions; a different table, using different dissectors, would be needed for, say, reads and writes over a named pipe, as those are byte streams and SMB transactions are packets, so the dissectors for the first one need to worry about multiple PDUs per segment and desegmentation, while the dissectors for the second one don't - and, in fact, can't do desegmentation stuff. svn path=/trunk/; revision=4286
2001-11-27From Todd Sabin:Guy Harris1-43/+140
o Modifies the dcerpc handoff to subdissectors slightly. It also needs to pass the data representation to the subdissector. Also, if no subdissector is found, it puts a "Stub data" entry in the tree. o Adds optional TCP desegmentation to the dcerpc layer. Note that dcerpc has it's own ability to fragment PDUs. This isn't for dealing with that, but with the case of a single PDU being broken over more than one TCP segment. o Adds a little bit of dissection to packet-dcerpc-epm.c. Mainly just proof of concept for the dcerpc handoff stuff. (Writing this is how I realized the need for the drep.) o Adds packet-dcerpc-ndr.c, which will contain NDR dissection routines for use by subdissectors. Also, support added for multiple PDUs per segment for DCERPC-over-TCP (and, potentially, other byte-stream transports). svn path=/trunk/; revision=4285
2001-11-18From Tim Potter: use the FID, for DCE RPC-over-SMB, as part of theGuy Harris1-3/+29
conversation matching. svn path=/trunk/; revision=4220
2001-11-12From Tim Potter: added code to call request and reply subdissectors in DCEGuy Harris1-6/+13
RPC. svn path=/trunk/; revision=4195
2001-11-12Support for DCE RPC atop SMB, and support for several Microsoft DCE RPCGuy Harris1-1/+2
services used with SMB, from Tim Potter. svn path=/trunk/; revision=4194
2001-10-05Update from Todd Sabin to the data representation decoding:Guy Harris1-23/+30
Fixes a typo in the offset used for the floating point byte (offset should be offset+1), changes cn_drep* to just drep* (since it's the same for connection oriented and connectionless packets), and adds the corresponding code to the connectionless side of things. svn path=/trunk/; revision=3998
2001-09-30For requests and responses for unknown interfaces, put an entry into theGuy Harris1-98/+164
DCE RPC protocol tree for the stub data. Use the counts of context items and transfer syntax items when dissecting a bind or alter context PDU. In bind and alter context PDUs, create the conversation, attach the context ID and interface to it, and put the interface information into the Info column as soon as the first context item is dissected, so that if we get an exception after that, we've still processed the context ID and interface information. Use the count of results when dissecting a bind ack PDU. In bind ack PDUs, dissect the transfer syntax and syntax version fields, and put the opnum and context ID information into the Info column as soon as it's dissected. When dissecting a connection-oriented request or response, don't make the tvbuff the full fragment length if we don't have that much data in the frame being dissected. (We should do TCP reassembly there, eventually.) In connection-oriented response PDUs, put the opnum and context ID information into the Info column as soon as it's dissected. svn path=/trunk/; revision=3982
2001-09-30Committing Pasi Eronen's patches to dcerpc.Richard Sharpe1-2/+40
svn path=/trunk/; revision=3980
2001-09-28From Todd Sabin: dissect the auth info in connection oriented dcerpcGuy Harris1-5/+89
packets. Make a "dissect_netbios_payload()" routine, called from the NetBIOS-over-802.2 (NBF), NetBIOS-over-IPX, and NetBIOS-over-TCP dissectors. Take Todd Sabin's changes to add a heuristic dissector list to the NBSS dissector, and apply them to "dissect_netbios_payload()" instead. Make the SMB dissector heuristic, returning FALSE if it doesn't see 0xFF S M B at the beginning of the packet, and have "dissect_netbios_payload()" first try the heuristic dissector list, then try the SMB dissector if no other heuristic dissector claims the packet, then just dissect the payload as data. From Todd Sabin: have the DCE/RPC dissector register as a heuristic dissector for NetBIOS. svn path=/trunk/; revision=3969
2001-09-03Instead of having a single datum attached to a conversation, have a listGuy Harris1-3/+3
of protocol-id-plus-datum pairs, so that multiple protocols can attach information to the same conversation. Dissectors that attach information to a conversation should not assume that if they find a conversation it has one of its data attached to it; the conversation might've been created by another dissector. svn path=/trunk/; revision=3901
2001-07-11Not all C compilers allow C++-style comments.Guy Harris1-2/+2
svn path=/trunk/; revision=3685
2001-07-11Support for dissectors of protocols running atop DCE RPC registeringGuy Harris1-174/+541
themselves with the DCE RPC dissector, and support for some of the protocols atop DCE RPC that are part of DCE RPC, from Todd Sabin. svn path=/trunk/; revision=3681
2001-06-18From Joerg Mayer: explicitly fill in all members of aGuy Harris1-63/+63
"header_field_info" structure, including the ones that are later set by the routines to register fields. svn path=/trunk/; revision=3561
2001-04-27More signed-vs-unsigned changes from Joerg Mayer.Guy Harris1-2/+2
svn path=/trunk/; revision=3386
2001-04-19DCE RPC updates from Todd Sabin.Guy Harris1-157/+483
svn path=/trunk/; revision=3338
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-27 09:54:06 +0000