aboutsummaryrefslogtreecommitdiffstats
path: root/packet-dcerpc.c
AgeCommit message (Collapse)AuthorFilesLines
2003-02-24Rename "fake_unicode()" to "tvb_fake_unicode()" as it works on a tvbuff,Guy Harris1-35/+3
give it a byte-order argument, and move it to "epan/tvbuff.c". Use it to handle UCS-2 strings in version 1 of the Service Location Protocol. In SRVLOC V1, use registered fields that are already there for SRVLOC V2, and add some as needed. Fix some field names. svn path=/trunk/; revision=7186
2003-02-21Well, perhaps that padding really *is* padding, or maybe it's some otherGuy Harris1-12/+1
gunk stuck in there to make NTLMSSP happy (perhaps the encrypted body length has to be a multiple of 16 bytes or something such as that for the encryption to work). No packet in any capture I have appears to be misdissected if you get rid of the mod 4 stuff, so I'm removing it. svn path=/trunk/; revision=7181
2003-02-11When putting the lowest-level protocol tree item in for a UnicodeGuy Harris1-9/+24
string, use the "fake Unicode" value for it. svn path=/trunk/; revision=7119
2003-02-10In dissect_ndr_cvstring(), return string data even if tree == NULL.Tim Potter1-10/+11
svn path=/trunk/; revision=7114
2003-02-10Added a comment about the length argument to fake_unicode. It should beTim Potter1-10/+14
the number of guint16's to convert from unicode. Allow dissect_ndr_cvstring to return a malloced copy of the string. svn path=/trunk/; revision=7108
2003-02-07Fix some comments.Guy Harris1-3/+3
svn path=/trunk/; revision=7097
2003-02-07Rename "dissect_ndr_char_string()" and "dissect_ndr_wchar_string()" toGuy Harris1-10/+22
"dissect_ndr_char_cvstring()" and "dissect_ndr_wchar_cvstring()", to indicate that they're for conformant varying strings. Rename "dissect_ndr_character_array()" to "dissect_ndr_cvstring()", to indicate that it's for conformant varying strings. svn path=/trunk/; revision=7096
2003-02-07Rename "dissect_ndr_char_array" and "disect_ndr_wchar_array" toGuy Harris1-10/+18
"dissect_ndr_char_string" and "dissect_ndr_wchar_string", to make it clearer what it does. svn path=/trunk/; revision=7095
2003-02-07Catch ReportedBoundsError when dissecting even non-encrypted stub data,Guy Harris1-5/+15
so that even if the stub data is bad, we still dissect and show the verifier. svn path=/trunk/; revision=7092
2003-02-07Fix a typo in the multiple-include protection in "packet-dcerpc-nt.h".Guy Harris1-1/+173
Rename "dissect_ndr_element_array()" to "dissect_ndr_character_array()", move it out of "packet-dcerpc-nt.c" to "packet-dcerpc.c", and have it use the standard DCE RPC array max count/offset/count fields rather than their own private versions of those fields. Give it an option to create a subtree, and an argument to specify the field to use for the actual data buffer, and export it. Move the routines for handling arrays of "char" and "wchar" as strings out of "packet-dcerpc-nt.c" to "packet-dcerpc.c". Add a routine to handle an array of "char" as an opaque blob of bytes. Use "dissect_ndr_character_array()" to dissect character strings in MAPI (the strings in question are ASCII, not Unicode), and use the routine to handle an array of "char" as an opaque blob of bytes to dissect encrypted data (again, it's bytes, not 16-bit quantities). Show them as encrypted data, not unknown data. Use "dissect_ndr_character_array()" to dissect a form name in "dissect_form_name()" in the SPOOLSS dissector. svn path=/trunk/; revision=7091
2003-02-05Make the dcerpc.request_in and dcerpc.response_in fields FT_FRAMENUM's.Tim Potter1-3/+3
svn path=/trunk/; revision=7074
2003-01-28Replace the 'levels' argument to dissect_ndr_pointer() with a callbackTim Potter1-18/+41
function and a void * callback args. The callback is executed after the dissection of the ndr pointer buffer which may be called, depending on the number of pointers in the structure, after the return of the dissect_ndr_pointer() call. The callback function is of type: void (dcerpc_callback_fnct_t)(packet_info *pinfo, proto_tree *tree, proto_item *item, tvbuff_t *tvb, int start_offset, int end_offset, void *callback_args); where the proto tree and item are the tree and item created by dissect_ndr_pointer() and the tvb plus offsets are the buffer pointed to by the pointer. svn path=/trunk/; revision=7015
2003-01-24Add a missing include packet-dcerpc-nt.hJörg Mayer1-1/+2
svn path=/trunk/; revision=6999
2003-01-24Perform the initialisation for the NT specific DCERPC dissectors as partTim Potter1-1/+2
of the DCERPC dissector instead of creating a dummy protocol to hang the ett and hf values off. Make the open and close frame values in NT policy handles FT_FRAMENUM's so the "Go to Corresponding Frame" menu item can be used on them. svn path=/trunk/; revision=6995
2003-01-14Catch ReportedBoundsError exceptions when dissecting decrypted stubGuy Harris1-5/+19
data, as the error could be due to the decryption being bad, and we should still dissect the authentication data. svn path=/trunk/; revision=6924
2003-01-06Update DCERPC so that for (NTLMSSP) PDUs that have been decryptedRonnie Sahlberg1-2/+23
we also call the proper DCERPC subdissector. With this change ethereal will call the SAMR dissector and dissect the decrypted SAMR packets in devins capture. svn path=/trunk/; revision=6855
2002-12-31Fix a braino in a last-minute fix I put into the previous checkin.Guy Harris1-1/+2
svn path=/trunk/; revision=6826
2002-12-31From Devin Heitmueller: support for decrypting DCERPC conversationsGuy Harris1-89/+148
using NTLMSSP version 1. Show stub data as such for all requests and replies where we can't dissect the stub data as a request or reply for some DCERPC-based protocol. svn path=/trunk/; revision=6825
2002-12-19Update reassemble.c/show_item and all callers to use FT_FRAMENUM for the ↵Ronnie Sahlberg1-3/+3
list of packets corresponding to a reassembled pdu svn path=/trunk/; revision=6807
2002-12-14When processing a connection-oriented DCERPC PDU, don't set the columnsGuy Harris1-7/+6
until we know that we have the entire PDU - we might not have all of it, as some of it might be in, for example, a later TCP segment. svn path=/trunk/; revision=6785
2002-12-11From Devin Heitmueller:Guy Harris1-31/+22
Minor change to the connection oriented DCE/RPC function calls. Now the offset is provided in the call, instead of having a hard-coded value in each function. Also makes the calling convention consistent with the datagram equivalents for the functions. Didn't do it for dissect_dcerpc_cn_auth() yet, as that is a special case (and I am in the process of restructuring it to make verifier decryption work properly). svn path=/trunk/; revision=6778
2002-12-05It seems pretty clear that a PDU_AUTH3 really is an AUTH3 PDU, and weGuy Harris1-2/+2
know what it is (a PDU for the third stage in a 3-way authentication handshake, as is done with NTLMSSP authentication, for example) - get rid of the question mark after "AUTH3". svn path=/trunk/; revision=6746
2002-11-28Arguments to hash routines are gconstpointer's; assign them to constGuy Harris1-10/+10
pointers. The first argument to "sscanf()" is a "const char *"; don't cast const pointers to "char *" when passing them to "sscanf()". Assign the result of "tvb_get_ptr()" to const pointers, not non-const pointers. Make the "pdata" argument to various DCE routines a const pointer. svn path=/trunk/; revision=6688
2002-11-10Dissect NTLMSSP authentication verifiers, as per lkcl's "DCE/RPC overGuy Harris1-4/+17
SMB" book. svn path=/trunk/; revision=6598
2002-11-05In connection-oriented DCE RPC, the authentication data are credentialsGuy Harris1-21/+58
only in bind, bind_ack, alter_context, alter_context_response, and auth3 PDUs; they're a verifier of some sort in other PDUs. The verifier appears to start with an OID for the real authentication mechanism if the authentication type is SPNEGO. svn path=/trunk/; revision=6563
2002-11-03Use the full name of the "hf_dcerpc_obj_id" field when formatting theGuy Harris1-5/+12
protocol tree item for it. Fix a typo. svn path=/trunk/; revision=6555
2002-11-02From Jean-Baptiste Marchand update the proto_tree_add_ for UUIDs in theRonnie Sahlberg1-66/+95
dcerpc layer (and the subdissectors using dissect_ndr_uuid_t()) so that it is possible to use display filters on these items. svn path=/trunk/; revision=6547
2002-10-25From Ronnie Sahlberg: Ethereal support for DCERPCSTAT.Guy Harris1-15/+2
svn path=/trunk/; revision=6499
2002-10-24Add a "fragment_add_seq_next()" to reassemble fragments that don't haveGuy Harris1-2/+2
sequence numbers or offsets and are thus assumed to be received in order with no duplicates or dropped fragments (e.g., for NetBIOS Frame, where 802.2 LLC guarantees in-order delivery to NetBIOS with no duplicates or dropped fragments). "show_fragment_tree()' and "show_fragment_seq_tree()" don't modify the "fragment_items" to which the "fit" argument points, so make that argument a "const fragment_items *". Make all the "fragment_items" tables "static" (as they're not used outside the modules defining them) and "const" (as they're not modified). Add support for reassembly of NetBIOS fragmented requests and responses. Get rid of an unnecessary include of "packet-tr.c" in the NetBIOS dissector, and make its table of dissection function pointers static. Fix some typos in the AppleTalk and NetBIOS dissectors. svn path=/trunk/; revision=6491
2002-10-23From Ronnie Sahlberg: add a tap for statistics for DCERPC interfaces.Guy Harris1-1/+40
svn path=/trunk/; revision=6479
2002-10-22From Ronnie Sahlberg: track and display the time between requests andGuy Harris1-2/+42
replies for DCERPC similar to what is already done for ONC-RPC. svn path=/trunk/; revision=6465
2002-09-26From Jaime Fournier: updates to dcerpc conversation managerRonnie Sahlberg1-1/+25
svn path=/trunk/; revision=6339
2002-09-09Dissect the autentication verifier for Kerberos 5 authentication inGuy Harris1-5/+46
connectionless PDUs. svn path=/trunk/; revision=6240
2002-09-08Auth type 8 is NETLOGON secure channel used for BDC replication.Tim Potter1-2/+4
svn path=/trunk/; revision=6230
2002-09-03From Ulf Lamping, support for ieee float and double types in the dcerpcRonnie Sahlberg1-5/+79
dissectors. svn path=/trunk/; revision=6170
2002-08-30snego -> spnegoTim Potter1-5/+5
svn path=/trunk/; revision=6138
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-87/+87
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-22These guys got lost in a merge. Actually call the gssapi dissector fromTim Potter1-18/+37
the relevant parts of the SMB and DCERPC dissectors. svn path=/trunk/; revision=6066
2002-08-21Moved the generic true_false_string saying "Set", "Not set" intoTim Potter1-6/+1
epan/packet.c It was cut and pasted into seven other dissectors! svn path=/trunk/; revision=6052
2002-08-13Display the protocol name for the UUID in the COL_INFO field if weTim Potter1-2/+11
know it. This reduces clutter in the top pane considerably. svn path=/trunk/; revision=5985
2002-08-02Replace the types from sys/types.h and netinet/in.h by their glib.hJörg Mayer1-5/+1
equivalents for the toplevel directory. The removal of winsock2.h will hopefully not cause any problems under MSVC++, as those files using struct timeval still include wtap.h, which still includes winsock2.h. svn path=/trunk/; revision=5932
2002-07-25For connection-oriented DCE RPC, show the stub data if we can't actuallyGuy Harris1-2/+18
do anything else with a request or reply (e.g., because we haven't seen the bind request). svn path=/trunk/; revision=5904
2002-07-11Added another authentication service for Snego.Tim Potter1-1/+4
svn path=/trunk/; revision=5858
2002-07-10Put back the code to show the authentication data as "Auth Data"; callGuy Harris1-15/+20
it if we don't show it as NTLMSSP. Use #defines for the authentication protocols. svn path=/trunk/; revision=5853
2002-07-10Reordered some boolean fields to be consistent with the rest of ethereal.Tim Potter1-22/+26
svn path=/trunk/; revision=5850
2002-07-09Dissector for DCERPC auth type == 10 (NTLMSSP) fromTim Potter1-3/+18
dheitmueller@netilla.com. svn path=/trunk/; revision=5848
2002-06-24Put the code to reassemble fragmented connection-oriented andGuy Harris1-403/+215
connectionless DCE RPC PDUs into common routines, and call those routines when dissecting DCE RPC requests and responses. Get rid of arguments to "dcerpc_try_handoff()" whose values are also in the "dcerpc_info" structure pointed to by its "info" argument. svn path=/trunk/; revision=5757
2002-06-24Change each DCERPC dissector to pass in a hf value on initialisationTim Potter1-19/+15
for a value_string that corresponds to that dissectors opnums. Pass in -1 if no such table is available. svn path=/trunk/; revision=5749
2002-06-22From Jaime Fournier: handle DCE RPC connectionless CANCEL PDUs with noGuy Harris1-2/+10
body. svn path=/trunk/; revision=5730
2002-06-19Don't hand off the stub body of a Fault PDU to the subdissector for theGuy Harris1-9/+21
protocol. svn path=/trunk/; revision=5704
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-02 22:01:32 +0000