aboutsummaryrefslogtreecommitdiffstats
path: root/packet-ldap.c
AgeCommit message (Collapse)AuthorFilesLines
2004-04-20try to dissect the ms cldap netlogon rpc flags bits.sahlberg1-6/+139
the information comes from the samba sources and may or may not be reliable or menaingful. ms documentation in their knowledgebase says that the only really important part in the netlogon response is the sitename. (i have reasons to belive at least one of the flags, closest, is completely bogous) git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10649 f5534014-38df-0310-8fa8-9805f1628bb7
2004-01-19Before checking for SASL security stuff, make sure the bytes you'reguy1-2/+3
going to check exist. Doing so arranges that "tvb_reported_length_remaining(tvb, offset) is >= 5 (unless the reported length is less than the data length, but that "shouldn't happen"). Instead of comparing "tvb_get_ntohl(tvb, offset) - 4" against "tvb_reported_length_remaining(tvb, offset)", which runs the risk of giving a bogus answer if "tvb_get_ntohl(tvb, offset)" is < 4, compare "tvb_get_ntohl(tvb, offset) against "tvb_reported_length_remaining(tvb, offset)-4", as the latter is guaranteed to be > 0 (and cast the latter expression to get rid of the signed/unsigned comparison warning that caused me to notice this issue in the first place). git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9738 f5534014-38df-0310-8fa8-9805f1628bb7
2004-01-19Update to CLDAPsahlberg1-39/+349
dissect the CLDAP netlogon rpc call git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9730 f5534014-38df-0310-8fa8-9805f1628bb7
2003-12-18From Ronnie Sahlberg: if the GSSAPI token is empty, don't dissect it.guy1-1/+5
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9344 f5534014-38df-0310-8fa8-9805f1628bb7
2003-12-04update to ldap.sahlberg1-4/+73
some implementations specify GSSAPI in the bind call. the encapsulation seems to be the same as GSS-SPNEGO so handle it the same way git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9169 f5534014-38df-0310-8fa8-9805f1628bb7
2003-11-10Not all LDAP PDUs are aligned to the start of a TCP segment.sahlberg1-2/+8
If we failed to dissect the GSS-SPNEGO blob it probably means that the segment is somewhere in the middle of an LDAP PDU. Just bail out and stop dissecting the PDU instead of aborting ethereal completely using g_assert() since this is not really a pathological error, its just something that can and will happen normally. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8925 f5534014-38df-0310-8fa8-9805f1628bb7
2003-11-07In some captures we might have already established and BOUND LDAPsahlberg1-1/+16
session where GSS-SPNEGO is used. If we havent seen the BIND call ethereal would assume it is vanilla non-GSS-SPNEGO LDAP and would fail to decode the packet. Add heuristics to the LDAP dissector so that IF the first 4 bytes of the LDAP PDU looks like ity could be a length field and IF the fifth byte has the value 0x60 then assume what we have is GSS-SPNEGO and assume this and all further commands on this session is GSS-SPNEGO as well. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8904 f5534014-38df-0310-8fa8-9805f1628bb7
2003-11-06Update to LDAP and TCPsahlberg1-9/+15
LDAP messages that span multiple segments will throw an exception unless we have reassembly enabled. Update TCP so that IF an exception was thrown that we still pick up any hints provided by the subdissector about where the next PDU starts. Update LDAP so that it will rpovide hints to TCP about where the next LDAP PDU starts in the sequence number space. Thus now ethereal can find and dissect LDAP PDUs that starts somewhere in the middle of a TCP segment. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8895 f5534014-38df-0310-8fa8-9805f1628bb7
2003-11-05A "GHashFunc()" returns a "guint", not a "gint".guy1-3/+5
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8887 f5534014-38df-0310-8fa8-9805f1628bb7
2003-11-05update for LDAPsahlberg1-175/+344
measure the response time for some LDAP commands and add a service response time dialog for it git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8885 f5534014-38df-0310-8fa8-9805f1628bb7
2003-08-17Sigh. I think I once tried making the last argument to "col_set_str()"guy1-3/+3
be a "const gchar *", and it ended up being like pulling a thread out of a sweater - more things had to change, which meant still more things had to change, and I might've even run into something that didn't change very well at all. (Or perhaps that was constifying something else.) For now, we just cast away the constness in calls to "col_set_str()"; the column code won't actually overwrite the string. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8174 f5534014-38df-0310-8fa8-9805f1628bb7
2003-08-12Put CLDAP instead of LDAP in COL_INFO for LDAP over UDP.tpot1-5/+12
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8161 f5534014-38df-0310-8fa8-9805f1628bb7
2003-07-31From Bernd Leibing: catch another place where we weren't checkingguy1-2/+2
whether the domain name was null before putting it into the Info column. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8114 f5534014-38df-0310-8fa8-9805f1628bb7
2003-07-30"read_string()" can return a null pointer for the string, so check forguy1-3/+3
that. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8103 f5534014-38df-0310-8fa8-9805f1628bb7
2003-07-18Put in an XXX comment about the code to remember the number of resultsguy1-1/+5
between the LDAP_RES_SEARCH_ENTRY and LDAP_RES_SEARCH_RESULT messages depending on those messages occurring in the same frame. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8044 f5534014-38df-0310-8fa8-9805f1628bb7
2003-07-14COL_INFO goodies for ldap dissector:tpot1-81/+125
- display DN in COL_INFO for bindi, search and add requests - display errors in COL_INFO for all replies - for search entries, display the number of results returned - display the message type in the "top level" protocol item git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8021 f5534014-38df-0310-8fa8-9805f1628bb7
2003-07-03The Windows 2000 global catalog is LDAP on TCP port 3268, as per IANA assignedtpot1-1/+3
port numbers document. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7961 f5534014-38df-0310-8fa8-9805f1628bb7
2003-07-02Dissect LDAPv3 search result references (s4.5.3 in rfc 2251).tpot1-1/+15
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7959 f5534014-38df-0310-8fa8-9805f1628bb7
2003-06-09Each LDAP message gets a top-level LDAP tree of its own; there's no needguy1-32/+26
for a subtree for the message. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7814 f5534014-38df-0310-8fa8-9805f1628bb7
2003-04-29From Jean-Baptiste Marchand: fix typo in value_string table for LDAPguy1-2/+2
message types. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7595 f5534014-38df-0310-8fa8-9805f1628bb7
2003-04-25From Tony Schene: after freeing saved authentication mechanism stringsguy1-1/+3
in the "auth_info_items" list, and free all the items in that list, we need to null out the pointer to that list to indicate that it's been emptied out. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7563 f5534014-38df-0310-8fa8-9805f1628bb7
2003-04-21From Jean-Baptiste Marchand: put the LDAP message ID and message typeguy1-4/+4
into the protocol tree as visible fields. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7515 f5534014-38df-0310-8fa8-9805f1628bb7
2002-11-28Don't dissect SASL stuff as GSS_Wrapped unless we're actually usingguy1-31/+43
GSS-SPNEGO. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6693 f5534014-38df-0310-8fa8-9805f1628bb7
2002-11-28Handle GSS_Wrap header information as well as context-level tokens. Aguy1-10/+41
call to "gssapi_init_oid()" supplies both dissectors for context-level tokens and GSS_Wrap header information; the latter dissector should return the number of bytes of header information, so that if the header information and the message for the protocol that's using GSSAPI are treated as a single blob of data (as is the case with LDAP, but not with DCE RPC, for example), the dissector for the protocol using GSSAPI knows where to start dissecting. We associate a pointer to the entire data structure for the OID, not the handle for context-level token dissector for the OID, with conversations and frames. Make the dissector for NTLMSSP verifiers be the handler for GSS_Wrap stuff for NTLMSSP, and add support for GSS_Wrap stuff for Kerberos. Support SASL GSS-SPNEGO wrapping of LDAP messages. (XXX - this should really check for GSS-SPNEGO.) git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6692 f5534014-38df-0310-8fa8-9805f1628bb7
2002-11-27Try to handle LDAP messages encapsulated inside a SASL security layer.guy1-191/+463
Reorganize the desegmentation to match a bit more closely the desegmentation code in "tcp_dissect_pdus()" (eventually, we should see if we can just use that code). git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6676 f5534014-38df-0310-8fa8-9805f1628bb7
2002-11-25From Jason Greene:guy1-2/+3
This patch fixes decoding of the newSuperior attribute of an LDAPv3 modrdn request. The current implementation attempts to decode the attribute as an LDAPDN (Octext String, 0x4), when its definition is actually Context 0 (0x80). git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6672 f5534014-38df-0310-8fa8-9805f1628bb7
2002-11-12From Ronald Henderson: in LDAP dissector, handle Sequence Of headerguy1-2/+27
being split across TCP segments. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6618 f5534014-38df-0310-8fa8-9805f1628bb7
2002-09-09If we see SASL authentication in a bind request, attach to theguy1-53/+242
conversation a data structure containing the authentication type and mechanism, and use that to dissect the credentials in subsequent bind responses. Call the bind request and response dissectors regardless of whether we're building a protocol tree or not, so that we call the authentication subdissectors. "read_string()" doesn't return anything through the string-pointer argument if the string is zero-length; handle those cases. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6241 f5534014-38df-0310-8fa8-9805f1628bb7
2002-08-28Removed trailing whitespaces from .h and .c files using thejmayer1-46/+46
winapi_cleanup tool written by Patrik Stridvall for the wine project. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6117 f5534014-38df-0310-8fa8-9805f1628bb7
2002-08-26Dissect SASL credentials.guy1-8/+155
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6087 f5534014-38df-0310-8fa8-9805f1628bb7
2002-08-21Dissect udp port 389 which is connectionless LDAP as implemented bytpot1-1/+3
Microsoft. It would be nice if this proto was called CLDAP in the protocol field - maybe later. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6041 f5534014-38df-0310-8fa8-9805f1628bb7
2002-08-02Replace the types from sys/types.h and netinet/in.h by their glib.hjmayer1-9/+1
equivalents for the toplevel directory. The removal of winsock2.h will hopefully not cause any problems under MSVC++, as those files using struct timeval still include wtap.h, which still includes winsock2.h. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5932 f5534014-38df-0310-8fa8-9805f1628bb7
2002-05-06Note that not all attribute values are text strings.guy1-1/+13
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5406 f5534014-38df-0310-8fa8-9805f1628bb7
2002-03-31Get rid of an unused variable.guy1-2/+1
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5060 f5534014-38df-0310-8fa8-9805f1628bb7
2002-03-03Report ASN.1 BER parsing errors closer to the point at which they'reguy1-206/+320
detected, so we do a better job of reporting the item with the problem. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4853 f5534014-38df-0310-8fa8-9805f1628bb7
2002-03-02As there's nothing to dissect for LDAP_REQ_UNBIND, set "ret" toguy1-2/+3
ASN1_ERR_NOERROR, as you can't have a dissection error if you've dissected nothing. When dissecting a Bind reply, set "ret" to the return value of "dissect_ldap_response_bind()", so errors get reported properly. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4851 f5534014-38df-0310-8fa8-9805f1628bb7
2002-03-02Don't check the message type if it's not of class ASN1_APL; instead,guy1-49/+58
just display the message type and body as an error. If the message type isn't a type we dissect, display the "Unknown message type" entry with the right offset and length. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4850 f5534014-38df-0310-8fa8-9805f1628bb7
2002-03-02Treat LDAP_REQ_UNBIND as a request with nothing in it, not as an unknownguy1-4/+7
request type. Put the request types in order in the switch statement. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4849 f5534014-38df-0310-8fa8-9805f1628bb7
2002-03-01Have the routines that supply a pointer to a newly-constructed itemguy1-22/+18
always set that pointer if they return ASN1_ERR_NOERROR. Have the routines that call them use the value only if the routine returns ASN1_ERR_NOERROR. Don't bother setting the pointer before calling the routine. Report unknown modify operation types. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4834 f5534014-38df-0310-8fa8-9805f1628bb7
2002-03-01Add a routine to "asn1.c" to translate ASN1_ERR_ values to strings. Useguy1-142/+283
that in the SNMP dissector. Check the return values of ASN.1 routines in the LDAP dissector, and have all the subroutines in that disesctor that can return error indications return ASN1_ERR_ values. Have the routines that can supply a pointer to a newly-created protocol-tree item use the right type for items ("proto_item *", not "proto_tree *", even though they are, at least currently, typedefs for the same type), and use "proto_item" for the type of the item a pointer to which is passed to those routines. Before calling those routines, set the item pointer to null, in case the routine fails. Don't check the return value of "parse_filter_strings()" against -1 - that routine can't return -1. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4833 f5534014-38df-0310-8fa8-9805f1628bb7
2002-01-24Replace a bunch of "tvb_length()" and "tvb_length_remaining()" calls inguy1-4/+4
arguments to "proto_tree_add_text()", and to "proto_tree_add_XXX()" calls that add FT_NONE or FT_PROTO items to the protocol tree, with -1. Replace some calls to "tvb_length()" or "tvb_length_remaining()" with calls to "tvb_reported_length()" and "tvb_reported_length_remaining()", as those give the actual length of the data in the packet, not just the data that happened to be captured. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4605 f5534014-38df-0310-8fa8-9805f1628bb7
2002-01-21Include files from the "epan" directory and subdirectories thereof withguy1-2/+2
"epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4586 f5534014-38df-0310-8fa8-9805f1628bb7
2002-01-14Give each LDAP packet its own top-level protocol tree item. (This alsoguy1-17/+30
means if there are no complete LDAP packets in a TCP segment, there is no LDAP top-level protocol tree item, which is as it should be.) git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4539 f5534014-38df-0310-8fa8-9805f1628bb7
2002-01-14Add support for TCP desegmentation.guy1-10/+51
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4538 f5534014-38df-0310-8fa8-9805f1628bb7
2001-12-10Move the pointer to the "column_info" structure in the "frame_data"guy1-11/+11
structure to the "packet_info" structure; only stuff that's permanently stored with each frame should be in the "frame_data" structure, and the "column_info" structure is not guaranteed to hold the column values for that frame at all times - it was only in the "frame_data" structure so that it could be passed to dissectors, and, as all dissectors are now passed a pointer to a "packet_info" structure, it could just as well be put in the "packet_info" structure. That saves memory, by shrinking the "frame_data" structure (there's one of those per frame), and also lets us clean up the code a bit. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4370 f5534014-38df-0310-8fa8-9805f1628bb7
2001-12-03Make "dissector_add()", "dissector_delete()", and "dissector_change()"guy1-3/+6
take a dissector handle as an argument, rather than a pointer to a dissector function and a protocol ID. Associate dissector handles with dissector table entries. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4308 f5534014-38df-0310-8fa8-9805f1628bb7
2001-10-26Fix the rest of the signed/unsigned comparison warnings.gram1-2/+2
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4088 f5534014-38df-0310-8fa8-9805f1628bb7
2001-06-18From Joerg Mayer: explicitly fill in all members of aguy1-31/+31
"header_field_info" structure, including the ones that are later set by the routines to register fields. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3561 f5534014-38df-0310-8fa8-9805f1628bb7
2001-05-08Only set the Info column to an error indication if we haven't alreadyguy1-3/+3
put a packet description there. git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3405 f5534014-38df-0310-8fa8-9805f1628bb7
2001-05-08Additional LDAP checks for invalid packets, from Scott Renfro.guy1-5/+20
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3404 f5534014-38df-0310-8fa8-9805f1628bb7
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-22 12:50:09 +0000