epan/dissectors/packet-dcerpc-browser.c

   1 /* packet-dcerpc-browser.c
   2  * Routines for DCERPC Browser packet disassembly
   3  * Copyright 2001, Ronnie Sahlberg
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 /* The IDL file for this interface can be extracted by grepping for idl
  27  * in capitals.
  28  */
  29
  30 #ifdef HAVE_CONFIG_H
  31 #include "config.h"
  32 #endif
  33
  34 #include <glib.h>
  35 #include <epan/packet.h>
  36 #include "packet-dcerpc.h"
  37 #include "packet-dcerpc-browser.h"
  38 #include "packet-dcerpc-nt.h"
  39 #include "packet-windows-common.h"
  40
  41 static int proto_dcerpc_browser = -1;
  42 static int hf_browser_opnum = -1;
  43 static int hf_browser_rc = -1;
  44 static int hf_browser_unknown_long = -1;
  45 static int hf_browser_unknown_hyper = -1;
  46 static int hf_browser_unknown_bytes = -1;
  47 static int hf_browser_unknown_string = -1;
  48
  49
  50 static gint ett_dcerpc_browser = -1;
  51
  52
  53 static int
  54 dissect_browser_long_pointer(tvbuff_t *tvb, int offset,
  55                              packet_info *pinfo, proto_tree *tree,
  56                              guint8 *drep)
  57 {
  58         dcerpc_info *di;
  59
  60         di=pinfo->private_data;
  61         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
  62                                      di->hf_index, NULL);
  63         return offset;
  64 }
  65
  66
  67
  68 /*
  69  IDL [ uuid(6bffd098-a112-3610-9833-012892020162),
  70  IDL   version(0.0),
  71  IDL   implicit_handle(handle_t rpc_binding)
  72  IDL ] interface browser
  73  IDL {
  74 */
  75
  76 static e_uuid_t uuid_dcerpc_browser = {
  77         0x6bffd098, 0xa112, 0x3610,
  78         { 0x98, 0x33, 0x01, 0x28, 0x92, 0x02, 0x01, 0x62 }
  79 };
  80
  81 static guint16 ver_dcerpc_browser = 0;
  82
  83
  84 /*
  85   IDL typedef struct {
  86   IDL   long element_7;
  87   IDL   [size_is(element_7)] [unique] byte *element_8;
  88   IDL } TYPE_4;
  89 */
  90 static int
  91 dissect_browser_TYPE_4_data(tvbuff_t *tvb, int offset,
  92                         packet_info *pinfo, proto_tree *tree,
  93                         guint8 *drep)
  94 {
  95         guint32 len;
  96         dcerpc_info *di;
  97         int old_offset = offset;
  98
  99         di=pinfo->private_data;
 100         if(di->conformant_run){
 101                 /* this call is to make wireshark eat the array header for the conformant run */
 102                 offset =dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, NULL);
 103
 104                 return offset;
 105         }
 106         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 107                 hf_browser_unknown_long, &len);
 108
 109         proto_tree_add_item(tree, hf_browser_unknown_bytes, tvb, offset, len,
 110                 FALSE);
 111         offset += len;
 112         if (offset < old_offset)
 113                 THROW(ReportedBoundsError);
 114
 115         return len;
 116 }
 117 static int
 118 dissect_browser_TYPE_4(tvbuff_t *tvb, int offset,
 119                         packet_info *pinfo, proto_tree *tree,
 120                         guint8 *drep)
 121 {
 122         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 123                 hf_browser_unknown_long, NULL);
 124
 125         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 126                 dissect_browser_TYPE_4_data, NDR_POINTER_UNIQUE,
 127                 "unknown TYPE_4", -1);
 128
 129         return offset;
 130 }
 131
 132
 133 /*
 134   IDL typedef struct {
 135   IDL   long element_5;
 136   IDL   [size_is(element_5)] [unique] byte *element_6;
 137   IDL } TYPE_3;
 138 */
 139 static int
 140 dissect_browser_TYPE_3_data(tvbuff_t *tvb, int offset,
 141                         packet_info *pinfo, proto_tree *tree,
 142                         guint8 *drep)
 143 {
 144         guint32 len;
 145         dcerpc_info *di;
 146         int old_offset = offset;
 147
 148         di=pinfo->private_data;
 149         if(di->conformant_run){
 150                 /* this call is to make wireshark eat the array header for the conformant run */
 151                 offset =dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, NULL);
 152
 153                 return offset;
 154         }
 155
 156         /* this is really the length of the encoded data */
 157         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 158                 hf_browser_unknown_long, &len);
 159         proto_tree_add_item(tree, hf_browser_unknown_bytes, tvb, offset, len,
 160                 FALSE);
 161         offset += len;
 162         if (offset < old_offset)
 163                 THROW(ReportedBoundsError);
 164
 165         return len;
 166 }
 167 static int
 168 dissect_browser_TYPE_3(tvbuff_t *tvb, int offset,
 169                         packet_info *pinfo, proto_tree *tree,
 170                         guint8 *drep)
 171 {
 172         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 173                 hf_browser_unknown_long, NULL);
 174
 175         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 176                 dissect_browser_TYPE_3_data, NDR_POINTER_UNIQUE,
 177                 "unknown TYPE_3", -1);
 178
 179         return offset;
 180 }
 181
 182
 183
 184 /*
 185   IDL typedef [switch_type(long)] union {
 186   IDL   [case(100)] [unique] TYPE_3 *element_3;
 187   IDL   [case(101)] [unique] TYPE_4 *element_4;
 188   IDL } TYPE_2;
 189 */
 190 static int
 191 dissect_browser_TYPE_2(tvbuff_t *tvb, int offset,
 192                         packet_info *pinfo, proto_tree *tree,
 193                         guint8 *drep)
 194 {
 195         guint32 level;
 196
 197         /* this is really the union switch arm */
 198         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 199                 hf_browser_unknown_long, &level);
 200
 201         ALIGN_TO_4_BYTES;
 202
 203         switch(level){
 204         case 100:
 205                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 206                         dissect_browser_TYPE_3, NDR_POINTER_UNIQUE,
 207                         "unknown TYPE_3", -1);
 208                 break;
 209         case 101:
 210                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 211                         dissect_browser_TYPE_4, NDR_POINTER_UNIQUE,
 212                         "unknown TYPE_4", -1);
 213                 break;
 214         }
 215
 216         return offset;
 217 }
 218
 219
 220 /*
 221   IDL typedef struct {
 222   IDL   long element_1;
 223   IDL   TYPE_2 element_2;
 224   IDL } TYPE_1;
 225 */
 226 static int
 227 dissect_browser_TYPE_1(tvbuff_t *tvb, int offset,
 228                         packet_info *pinfo, proto_tree *tree,
 229                         guint8 *drep)
 230 {
 231         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 232                 hf_browser_unknown_long, NULL);
 233
 234         offset = dissect_browser_TYPE_2(tvb, offset, pinfo, tree, drep);
 235
 236         return offset;
 237 }
 238
 239
 240
 241 /*
 242  IDL  long BrowserrServerEnum(
 243  IDL        [in] [unique] [string] wchar_t *element_9,
 244  IDL        [in] [unique] [string] wchar_t *element_10,
 245  IDL        [in] [unique] [string] wchar_t *element_11,
 246  IDL        [in,out] [ref] TYPE_1 *element_12,
 247  IDL        [in] long element_13,
 248  IDL        [out] long element_14,
 249  IDL        [in] long element_15,
 250  IDL        [in] [unique] [string] wchar_t *element_16,
 251  IDL        [in,out] [unique] long *element_17
 252  IDL  );
 253 */
 254 static int
 255 dissect_browser_browserr_server_enum_rqst(tvbuff_t *tvb, int offset,
 256                         packet_info *pinfo, proto_tree *tree,
 257                         guint8 *drep)
 258 {
 259         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 260                         NDR_POINTER_UNIQUE, "unknown string",
 261                         hf_browser_unknown_string, 0);
 262
 263         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 264                         NDR_POINTER_UNIQUE, "unknown string",
 265                         hf_browser_unknown_string, 0);
 266
 267         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 268                         NDR_POINTER_UNIQUE, "unknown string",
 269                         hf_browser_unknown_string, 0);
 270
 271         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 272                         dissect_browser_TYPE_1, NDR_POINTER_REF,
 273                         "unknown TYPE_1", -1);
 274
 275         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 276                 hf_browser_unknown_long, NULL);
 277
 278         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 279                 hf_browser_unknown_long, NULL);
 280
 281         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 282                         NDR_POINTER_UNIQUE, "unknown string",
 283                         hf_browser_unknown_string, 0);
 284
 285         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 286                         dissect_browser_long_pointer, NDR_POINTER_UNIQUE,
 287                         "unknown long", hf_browser_unknown_long);
 288
 289         return offset;
 290 }
 291 static int
 292 dissect_browser_browserr_server_enum_reply(tvbuff_t *tvb, int offset,
 293                         packet_info *pinfo, proto_tree *tree,
 294                         guint8 *drep)
 295 {
 296         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 297                         dissect_browser_TYPE_1, NDR_POINTER_REF,
 298                         "unknown TYPE_1", -1);
 299
 300         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 301                 hf_browser_unknown_long, NULL);
 302
 303         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 304                         dissect_browser_long_pointer, NDR_POINTER_UNIQUE,
 305                         "unknown long", hf_browser_unknown_long);
 306
 307         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 308                 hf_browser_rc, NULL);
 309
 310         return offset;
 311 }
 312
 313 /*
 314   IDL long BrowserrDebugCall(
 315   IDL       [in] [unique] [string] wchar_t *element_18,
 316   IDL       [in] long element_19,
 317   IDL       [in] long element_20
 318   IDL );
 319 */
 320 static int
 321 dissect_browser_browserr_debug_call_rqst(tvbuff_t *tvb, int offset,
 322                         packet_info *pinfo, proto_tree *tree,
 323                         guint8 *drep)
 324 {
 325         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 326                         NDR_POINTER_UNIQUE, "unknown string",
 327                         hf_browser_unknown_string, 0);
 328
 329         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 330                 hf_browser_unknown_long, NULL);
 331
 332         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 333                 hf_browser_unknown_long, NULL);
 334
 335         return offset;
 336 }
 337 static int
 338 dissect_browser_browserr_debug_call_reply(tvbuff_t *tvb, int offset,
 339                         packet_info *pinfo, proto_tree *tree,
 340                         guint8 *drep)
 341 {
 342         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 343                 hf_browser_rc, NULL);
 344
 345         return offset;
 346 }
 347
 348
 349 /*
 350   IDL long BrowserrQueryOtherDomains(
 351   IDL       [in] [unique] [string] wchar_t *element_21,
 352   IDL       [in,out] [ref] TYPE_1 *element_22,
 353   IDL       [out] long element_23
 354   IDL );
 355 */
 356 static int
 357 dissect_browser_browserr_query_other_domains_rqst(tvbuff_t *tvb, int offset,
 358                         packet_info *pinfo, proto_tree *tree,
 359                         guint8 *drep)
 360 {
 361         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 362                         NDR_POINTER_UNIQUE, "unknown string",
 363                         hf_browser_unknown_string, 0);
 364
 365         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 366                         dissect_browser_TYPE_1, NDR_POINTER_REF,
 367                         "unknown TYPE_1", -1);
 368
 369         return offset;
 370 }
 371 static int
 372 dissect_browser_browserr_query_other_domains_reply(tvbuff_t *tvb, int offset,
 373                         packet_info *pinfo, proto_tree *tree,
 374                         guint8 *drep)
 375 {
 376         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 377                 hf_browser_unknown_long, NULL);
 378
 379         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 380                 hf_browser_rc, NULL);
 381
 382         return offset;
 383 }
 384
 385
 386 /*
 387   IDL long BrowserrResetNetlogonState(
 388   IDL       [in] [unique] [string] wchar_t *element_24
 389   IDL );
 390 */
 391 static int
 392 dissect_browser_browserr_reset_netlogon_state_rqst(tvbuff_t *tvb, int offset,
 393                         packet_info *pinfo, proto_tree *tree,
 394                         guint8 *drep)
 395 {
 396         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 397                         NDR_POINTER_UNIQUE, "unknown string",
 398                         hf_browser_unknown_string, 0);
 399
 400         return offset;
 401 }
 402 static int
 403 dissect_browser_browserr_reset_netlogon_state_reply(tvbuff_t *tvb, int offset,
 404                         packet_info *pinfo, proto_tree *tree,
 405                         guint8 *drep)
 406 {
 407         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 408                 hf_browser_rc, NULL);
 409
 410         return offset;
 411 }
 412
 413
 414 /*
 415   IDL long BrowserrDebugTrace(
 416   IDL       [in] [unique] [string] wchar_t *element_25,
 417   IDL       [in] [string] char element_26
 418   IDL );
 419 */
 420 static int
 421 dissect_browser_browserr_debug_trace_rqst(tvbuff_t *tvb, int offset,
 422                         packet_info *pinfo, proto_tree *tree,
 423                         guint8 *drep)
 424 {
 425         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 426                         NDR_POINTER_UNIQUE, "unknown string",
 427                         hf_browser_unknown_string, 0);
 428
 429         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 430                         NDR_POINTER_REF, "unknown string",
 431                         hf_browser_unknown_string, 0);
 432
 433         return offset;
 434 }
 435 static int
 436 dissect_browser_browserr_debug_trace_reply(tvbuff_t *tvb, int offset,
 437                         packet_info *pinfo, proto_tree *tree,
 438                         guint8 *drep)
 439 {
 440         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 441                 hf_browser_rc, NULL);
 442
 443         return offset;
 444 }
 445
 446
 447
 448 /*
 449   IDL typedef struct {
 450   IDL   TYPE_6 element_27;
 451   IDL   TYPE_6 element_28;
 452   IDL   TYPE_6 element_29;
 453   IDL   long element_30;
 454   IDL   long element_31;
 455   IDL   long element_32;
 456   IDL   long element_33;
 457   IDL   long element_34;
 458   IDL   long element_35;
 459   IDL   long element_36;
 460   IDL   long element_37;
 461   IDL   long element_38;
 462   IDL   long element_39;
 463   IDL   long element_40;
 464   IDL   long element_41;
 465   IDL   long element_42;
 466   IDL   long element_43;
 467   IDL   long element_44;
 468   IDL   TYPE_6 element_45;
 469   IDL } TYPE_5;
 470   IDL
 471   IDL typedef struct {
 472   IDL   hyper element_46;
 473   IDL } TYPE_6;
 474 */
 475 static int
 476 dissect_browser_TYPE_5(tvbuff_t *tvb, int offset,
 477                         packet_info *pinfo, proto_tree *tree,
 478                         guint8 *drep)
 479 {
 480         offset = dissect_ndr_duint32(tvb, offset, pinfo, tree, drep,
 481                 hf_browser_unknown_hyper, NULL);
 482
 483         offset = dissect_ndr_duint32(tvb, offset, pinfo, tree, drep,
 484                 hf_browser_unknown_hyper, NULL);
 485
 486         offset = dissect_ndr_duint32(tvb, offset, pinfo, tree, drep,
 487                 hf_browser_unknown_hyper, NULL);
 488
 489         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 490                 hf_browser_unknown_long, NULL);
 491
 492         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 493                 hf_browser_unknown_long, NULL);
 494
 495         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 496                 hf_browser_unknown_long, NULL);
 497
 498         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 499                 hf_browser_unknown_long, NULL);
 500
 501         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 502                 hf_browser_unknown_long, NULL);
 503
 504         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 505                 hf_browser_unknown_long, NULL);
 506
 507         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 508                 hf_browser_unknown_long, NULL);
 509
 510         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 511                 hf_browser_unknown_long, NULL);
 512
 513         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 514                 hf_browser_unknown_long, NULL);
 515
 516         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 517                 hf_browser_unknown_long, NULL);
 518
 519         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 520                 hf_browser_unknown_long, NULL);
 521
 522         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 523                 hf_browser_unknown_long, NULL);
 524
 525         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 526                 hf_browser_unknown_long, NULL);
 527
 528         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 529                 hf_browser_unknown_long, NULL);
 530
 531         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 532                 hf_browser_unknown_long, NULL);
 533
 534         offset = dissect_ndr_duint32(tvb, offset, pinfo, tree, drep,
 535                 hf_browser_unknown_hyper, NULL);
 536
 537         return offset;
 538 }
 539
 540
 541 /*
 542   IDL long BrowserrQueryStatistics(
 543   IDL       [in] [unique] [string] wchar_t *element_47,
 544   IDL       [out] [ref] TYPE_5 **element_48
 545   IDL );
 546 */
 547 static int
 548 dissect_browser_browserr_query_statistics_rqst(tvbuff_t *tvb, int offset,
 549                         packet_info *pinfo, proto_tree *tree,
 550                         guint8 *drep)
 551 {
 552         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 553                         NDR_POINTER_UNIQUE, "unknown string",
 554                         hf_browser_unknown_string, 0);
 555
 556         return offset;
 557 }
 558 static int
 559 dissect_browser_browserr_query_statistics_reply(tvbuff_t *tvb, int offset,
 560                         packet_info *pinfo, proto_tree *tree,
 561                         guint8 *drep)
 562 {
 563         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 564                         dissect_browser_TYPE_5, NDR_POINTER_UNIQUE,
 565                         "unknown TYPE_5", -1);
 566
 567         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 568                 hf_browser_rc, NULL);
 569
 570         return offset;
 571 }
 572
 573
 574 /*
 575   IDL long BrowserrResetStatistics(
 576   IDL       [in] [unique] [string] wchar_t *element_49
 577   IDL );
 578 */
 579 static int
 580 dissect_browser_browserr_reset_statistics_rqst(tvbuff_t *tvb, int offset,
 581                         packet_info *pinfo, proto_tree *tree,
 582                         guint8 *drep)
 583 {
 584         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 585                         NDR_POINTER_UNIQUE, "unknown string",
 586                         hf_browser_unknown_string, 0);
 587
 588         return offset;
 589 }
 590 static int
 591 dissect_browser_browserr_reset_statistics_reply(tvbuff_t *tvb, int offset,
 592                         packet_info *pinfo, proto_tree *tree,
 593                         guint8 *drep)
 594 {
 595         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 596                 hf_browser_rc, NULL);
 597
 598         return offset;
 599 }
 600
 601
 602 /*
 603   IDL long NetrBrowserStatisticsClear(
 604   IDL       [in] [unique] [string] wchar_t *element_49
 605   IDL );
 606 */
 607 static int
 608 dissect_browser_netr_browser_statistics_clear_rqst(tvbuff_t *tvb, int offset,
 609                         packet_info *pinfo, proto_tree *tree,
 610                         guint8 *drep)
 611 {
 612         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 613                         NDR_POINTER_UNIQUE, "unknown string",
 614                         hf_browser_unknown_string, 0);
 615
 616         return offset;
 617 }
 618 static int
 619 dissect_browser_netr_browser_statistics_clear_reply(tvbuff_t *tvb, int offset,
 620                         packet_info *pinfo, proto_tree *tree,
 621                         guint8 *drep)
 622 {
 623         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 624                 hf_browser_rc, NULL);
 625
 626         return offset;
 627 }
 628
 629
 630 /*
 631   IDL typedef struct {
 632   IDL   TYPE_6 element_59;
 633   IDL   TYPE_6 element_60;
 634   IDL   TYPE_6 element_61;
 635   IDL   long element_62;
 636   IDL   long element_63;
 637   IDL   long element_64;
 638   IDL   TYPE_6 element_65;
 639   IDL   long element_66;
 640   IDL   long element_67;
 641   IDL   long element_68;
 642   IDL   long element_69;
 643   IDL   long element_70;
 644   IDL   long element_71;
 645   IDL   long element_72;
 646   IDL   long element_73;
 647   IDL   long element_74;
 648   IDL } TYPE_11;
 649 */
 650 static int
 651 dissect_browser_TYPE_11(tvbuff_t *tvb, int offset,
 652                         packet_info *pinfo, proto_tree *tree,
 653                         guint8 *drep)
 654 {
 655         offset = dissect_ndr_duint32(tvb, offset, pinfo, tree, drep,
 656                 hf_browser_unknown_hyper, NULL);
 657
 658         offset = dissect_ndr_duint32(tvb, offset, pinfo, tree, drep,
 659                 hf_browser_unknown_hyper, NULL);
 660
 661         offset = dissect_ndr_duint32(tvb, offset, pinfo, tree, drep,
 662                 hf_browser_unknown_hyper, NULL);
 663
 664         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 665                 hf_browser_unknown_long, NULL);
 666
 667         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 668                 hf_browser_unknown_long, NULL);
 669
 670         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 671                 hf_browser_unknown_long, NULL);
 672
 673         offset = dissect_ndr_duint32(tvb, offset, pinfo, tree, drep,
 674                 hf_browser_unknown_hyper, NULL);
 675
 676         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 677                 hf_browser_unknown_long, NULL);
 678
 679         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 680                 hf_browser_unknown_long, NULL);
 681
 682         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 683                 hf_browser_unknown_long, NULL);
 684
 685         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 686                 hf_browser_unknown_long, NULL);
 687
 688         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 689                 hf_browser_unknown_long, NULL);
 690
 691         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 692                 hf_browser_unknown_long, NULL);
 693
 694         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 695                 hf_browser_unknown_long, NULL);
 696
 697         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 698                 hf_browser_unknown_long, NULL);
 699
 700         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 701                 hf_browser_unknown_long, NULL);
 702
 703         return offset;
 704 }
 705
 706 /*
 707   IDL typedef struct {
 708   IDL   long element_57;
 709   IDL   [size_is(element_57)] [unique] TYPE_11 *element_58;
 710   IDL } TYPE_10;
 711 */
 712 static int
 713 dissect_browser_TYPE_11_array(tvbuff_t *tvb, int offset,
 714                         packet_info *pinfo, proto_tree *tree,
 715                         guint8 *drep)
 716 {
 717         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 718                 dissect_browser_TYPE_11);
 719
 720         return offset;
 721 }
 722
 723 static int
 724 dissect_browser_TYPE_10(tvbuff_t *tvb, int offset,
 725                         packet_info *pinfo, proto_tree *tree,
 726                         guint8 *drep)
 727 {
 728         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 729                 hf_browser_unknown_long, NULL);
 730
 731         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 732                 dissect_browser_TYPE_11_array, NDR_POINTER_UNIQUE,
 733                 "unknown TYPE_11_ARRAY", -1);
 734
 735         return offset;
 736 }
 737
 738
 739 /*
 740   IDL typedef struct {
 741   IDL   long element_55;
 742   IDL   [size_is(element_55)] [unique] byte *element_56;
 743   IDL } TYPE_9;
 744 */
 745 static int
 746 dissect_browser_TYPE_9_data(tvbuff_t *tvb, int offset,
 747                         packet_info *pinfo, proto_tree *tree,
 748                         guint8 *drep)
 749 {
 750         guint32 len;
 751         dcerpc_info *di;
 752         int old_offset = offset;
 753
 754         di=pinfo->private_data;
 755         if(di->conformant_run){
 756                 /* this call is to make wireshark eat the array header for the conformant run */
 757                 offset =dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, NULL);
 758
 759                 return offset;
 760         }
 761
 762         /* this is really the length of the encoded data */
 763         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 764                 hf_browser_unknown_long, &len);
 765
 766         proto_tree_add_item(tree, hf_browser_unknown_bytes, tvb, offset, len,
 767                 FALSE);
 768         offset += len;
 769         if (offset < old_offset)
 770                 THROW(ReportedBoundsError);
 771
 772         return len;
 773 }
 774 static int
 775 dissect_browser_TYPE_9(tvbuff_t *tvb, int offset,
 776                         packet_info *pinfo, proto_tree *tree,
 777                         guint8 *drep)
 778 {
 779         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 780                 hf_browser_unknown_long, NULL);
 781
 782         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 783                 dissect_browser_TYPE_9_data, NDR_POINTER_UNIQUE,
 784                 "unknown TYPE_9", -1);
 785
 786         return offset;
 787 }
 788
 789
 790 /*
 791   IDL typedef [switch_type(long)] union {
 792   IDL   [case(100)] [unique] TYPE_9 *element_53;
 793   IDL   [case(101)] [unique] TYPE_10 *element_54;
 794   IDL } TYPE_8;
 795 */
 796 static int
 797 dissect_browser_TYPE_8(tvbuff_t *tvb, int offset,
 798                         packet_info *pinfo, proto_tree *tree,
 799                         guint8 *drep)
 800 {
 801         guint32 level;
 802
 803         /* this is really the union switch arm */
 804         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 805                 hf_browser_unknown_long, &level);
 806
 807         ALIGN_TO_4_BYTES;
 808
 809         switch(level){
 810         case 100:
 811                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 812                         dissect_browser_TYPE_9, NDR_POINTER_UNIQUE,
 813                         "unknown TYPE_9", -1);
 814                 break;
 815         case 101:
 816                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 817                         dissect_browser_TYPE_10, NDR_POINTER_UNIQUE,
 818                         "unknown TYPE_10", -1);
 819                 break;
 820         }
 821
 822         return offset;
 823 }
 824
 825
 826 /*
 827   IDL typedef struct {
 828   IDL   long element_51;
 829   IDL   TYPE_8 element_52;
 830   IDL } TYPE_7;
 831 */
 832 static int
 833 dissect_browser_TYPE_7(tvbuff_t *tvb, int offset,
 834                         packet_info *pinfo, proto_tree *tree,
 835                         guint8 *drep)
 836 {
 837         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 838                 hf_browser_unknown_long, NULL);
 839
 840         offset = dissect_browser_TYPE_8(tvb, offset, pinfo, tree, drep);
 841
 842         return offset;
 843 }
 844
 845
 846 /*
 847   IDL long NetrBrowserStatisticsGet(
 848   IDL       [in] [unique] [string] wchar_t *element_75,
 849   IDL       [in] long element_76,
 850   IDL   [in,out] [ref] TYPE_7 *element_77
 851   IDL );
 852 */
 853 static int
 854 dissect_browser_netr_browser_statistics_get_rqst(tvbuff_t *tvb, int offset,
 855                         packet_info *pinfo, proto_tree *tree,
 856                         guint8 *drep)
 857 {
 858         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 859                         NDR_POINTER_UNIQUE, "unknown string",
 860                         hf_browser_unknown_string, 0);
 861
 862         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 863                 hf_browser_unknown_long, NULL);
 864
 865         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 866                         dissect_browser_TYPE_7, NDR_POINTER_REF,
 867                         "unknown TYPE_7", -1);
 868
 869         return offset;
 870 }
 871 static int
 872 dissect_browser_netr_browser_statistics_get_reply(tvbuff_t *tvb, int offset,
 873                         packet_info *pinfo, proto_tree *tree,
 874                         guint8 *drep)
 875 {
 876         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 877                         dissect_browser_TYPE_7, NDR_POINTER_REF,
 878                         "unknown TYPE_7", -1);
 879
 880         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 881                 hf_browser_rc, NULL);
 882
 883         return offset;
 884 }
 885
 886
 887 /*
 888   IDL long BrowserrSetNetlogonState(
 889   IDL       [in] [unique] [string] wchar_t *element_78,
 890   IDL       [in] [ref] [string] wchar_t *element_79,
 891   IDL       [in] [unique] [string] wchar_t *element_80,
 892   IDL       [in] long element_81
 893   IDL );
 894 */
 895 static int
 896 dissect_browser_browserr_set_netlogon_state_rqst(tvbuff_t *tvb, int offset,
 897                         packet_info *pinfo, proto_tree *tree,
 898                         guint8 *drep)
 899 {
 900         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 901                         NDR_POINTER_UNIQUE, "unknown string",
 902                         hf_browser_unknown_string, 0);
 903
 904         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 905                         NDR_POINTER_REF, "unknown string",
 906                         hf_browser_unknown_string, 0);
 907
 908         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 909                         NDR_POINTER_UNIQUE, "unknown string",
 910                         hf_browser_unknown_string, 0);
 911
 912         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 913                 hf_browser_unknown_long, NULL);
 914
 915         return offset;
 916 }
 917 static int
 918 dissect_browser_browserr_set_netlogon_state_reply(tvbuff_t *tvb, int offset,
 919                         packet_info *pinfo, proto_tree *tree,
 920                         guint8 *drep)
 921 {
 922         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 923                 hf_browser_rc, NULL);
 924
 925         return offset;
 926 }
 927
 928
 929
 930
 931 /*
 932   IDL typedef struct {
 933   IDL   long element_82;
 934   IDL   [size_is(element_82)] [unique] byte *element_83;
 935   IDL } TYPE_12;
 936 */
 937 static int
 938 dissect_browser_TYPE_12_data(tvbuff_t *tvb, int offset,
 939                         packet_info *pinfo, proto_tree *tree,
 940                         guint8 *drep)
 941 {
 942         guint32 len;
 943         dcerpc_info *di;
 944         int old_offset = offset;
 945
 946         di=pinfo->private_data;
 947         if(di->conformant_run){
 948                 /* this call is to make wireshark eat the array header for the conformant run */
 949                 offset =dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, NULL);
 950
 951                 return offset;
 952         }
 953
 954         /* this is really the length of the encoded data */
 955         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 956                 hf_browser_unknown_long, &len);
 957
 958         proto_tree_add_item(tree, hf_browser_unknown_bytes, tvb, offset, len,
 959                 FALSE);
 960         offset += len;
 961         if (offset < old_offset)
 962                 THROW(ReportedBoundsError);
 963
 964         return offset;
 965 }
 966 static int
 967 dissect_browser_TYPE_12(tvbuff_t *tvb, int offset,
 968                         packet_info *pinfo, proto_tree *tree,
 969                         guint8 *drep)
 970 {
 971         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 972                 hf_browser_unknown_long, NULL);
 973
 974         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 975                 dissect_browser_TYPE_12_data, NDR_POINTER_UNIQUE,
 976                 "unknown TYPE_12", -1);
 977
 978         return offset;
 979 }
 980
 981
 982 /*
 983   IDL long BrowserrQueryEmulatedDomains(
 984   IDL       [in] [unique] [string] wchar_t *element_84,
 985   IDL       [in,out] [ref] TYPE_12 *element_85
 986   );
 987 */
 988 static int
 989 dissect_browser_browserr_query_emulated_domains_rqst(tvbuff_t *tvb, int offset,
 990                         packet_info *pinfo, proto_tree *tree,
 991                         guint8 *drep)
 992 {
 993         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 994                         NDR_POINTER_UNIQUE, "unknown string",
 995                         hf_browser_unknown_string, 0);
 996
 997         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 998                         dissect_browser_TYPE_12, NDR_POINTER_REF,
 999                         "unknown TYPE_12", -1);
1000
1001         return offset;
1002 }
1003 static int
1004 dissect_browser_browserr_query_emulated_domains_reply(tvbuff_t *tvb, int offset,
1005                         packet_info *pinfo, proto_tree *tree,
1006                         guint8 *drep)
1007 {
1008         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1009                         dissect_browser_TYPE_12, NDR_POINTER_REF,
1010                         "unknown TYPE_12", -1);
1011
1012         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1013                 hf_browser_rc, NULL);
1014
1015         return offset;
1016 }
1017
1018
1019 /*
1020   IDL long BrowserrServerEnumEx(
1021   IDL       [in] [unique] [string] wchar_t *element_86,
1022   IDL       [in] [unique] [string] wchar_t *element_87,
1023   IDL       [in] [unique] [string] wchar_t *element_88,
1024   IDL       [in,out] [ref] TYPE_1 *element_89,
1025   IDL       [in] long element_90,
1026   IDL       [out] long element_91,
1027   IDL       [in] long element_92,
1028   IDL       [in] [unique] [string] wchar_t *element_93,
1029   IDL       [in] [unique] [string] wchar_t *element_94
1030   IDL );
1031 */
1032 static int
1033 dissect_browser_browserr_server_enum_ex_rqst(tvbuff_t *tvb, int offset,
1034                         packet_info *pinfo, proto_tree *tree,
1035                         guint8 *drep)
1036 {
1037         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1038                         NDR_POINTER_UNIQUE, "unknown string",
1039                         hf_browser_unknown_string, 0);
1040
1041         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1042                         NDR_POINTER_UNIQUE, "unknown string",
1043                         hf_browser_unknown_string, 0);
1044
1045         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1046                         NDR_POINTER_UNIQUE, "unknown string",
1047                         hf_browser_unknown_string, 0);
1048
1049         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1050                         dissect_browser_TYPE_1, NDR_POINTER_REF,
1051                         "unknown TYPE_1", -1);
1052
1053         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1054                 hf_browser_unknown_long, NULL);
1055
1056         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1057                 hf_browser_unknown_long, NULL);
1058
1059         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1060                         NDR_POINTER_UNIQUE, "unknown string",
1061                         hf_browser_unknown_string, 0);
1062
1063         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1064                         NDR_POINTER_UNIQUE, "unknown string",
1065                         hf_browser_unknown_string, 0);
1066
1067         return offset;
1068 }
1069 static int
1070 dissect_browser_browserr_server_enum_ex_reply(tvbuff_t *tvb, int offset,
1071                         packet_info *pinfo, proto_tree *tree,
1072                         guint8 *drep)
1073 {
1074         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1075                         dissect_browser_TYPE_1, NDR_POINTER_REF,
1076                         "unknown TYPE_1", -1);
1077
1078         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1079                 hf_browser_unknown_long, NULL);
1080
1081         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1082                 hf_browser_rc, NULL);
1083
1084         return offset;
1085 }
1086
1087
1088
1089 /*
1090   IDL }
1091 */
1092 static dcerpc_sub_dissector dcerpc_browser_dissectors[] = {
1093         { BROWSER_BROWSERR_SERVER_ENUM, "BrowserrServerEnum",
1094                 dissect_browser_browserr_server_enum_rqst,
1095                 dissect_browser_browserr_server_enum_reply },
1096         { BROWSER_BROWSERR_DEBUG_CALL, "BrowserrDebugCall",
1097                 dissect_browser_browserr_debug_call_rqst,
1098                 dissect_browser_browserr_debug_call_reply },
1099         { BROWSER_BROWSERR_QUERY_OTHER_DOMAINS,
1100           "BrowserrQueryOtherDomains",
1101                 dissect_browser_browserr_query_other_domains_rqst,
1102                 dissect_browser_browserr_query_other_domains_reply },
1103         { BROWSER_BROWSERR_RESET_NETLOGON_STATE,
1104           "BrowserrResetNetlogonState",
1105                 dissect_browser_browserr_reset_netlogon_state_rqst,
1106                 dissect_browser_browserr_reset_netlogon_state_reply },
1107         { BROWSER_BROWSERR_DEBUG_TRACE,
1108           "BrowserrDebugTrace",
1109                 dissect_browser_browserr_debug_trace_rqst,
1110                 dissect_browser_browserr_debug_trace_reply },
1111         { BROWSER_BROWSERR_QUERY_STATISTICS,
1112           "BrowserrQueryStatistics",
1113                 dissect_browser_browserr_query_statistics_rqst,
1114                 dissect_browser_browserr_query_statistics_reply },
1115         { BROWSER_BROWSERR_RESET_STATISTICS,
1116           "BrowserrResetStatistics",
1117                 dissect_browser_browserr_reset_statistics_rqst,
1118                 dissect_browser_browserr_reset_statistics_reply },
1119         { BROWSER_NETR_BROWSER_STATISTICS_CLEAR,
1120           "NetrBrowserStatisticsClear",
1121                 dissect_browser_netr_browser_statistics_clear_rqst,
1122                 dissect_browser_netr_browser_statistics_clear_reply },
1123         { BROWSER_NETR_BROWSER_STATISTICS_GET,
1124           "NetrBrowserStatisticsGet",
1125                 dissect_browser_netr_browser_statistics_get_rqst,
1126                 dissect_browser_netr_browser_statistics_get_reply },
1127         { BROWSER_BROWSERR_SET_NETLOGON_STATE,
1128           "BrowserrSetNetlogonState",
1129                 dissect_browser_browserr_set_netlogon_state_rqst,
1130                 dissect_browser_browserr_set_netlogon_state_reply },
1131         { BROWSER_BROWSERR_QUERY_EMULATED_DOMAINS,
1132           "BrowserrQueryEmulatedDomains",
1133                 dissect_browser_browserr_query_emulated_domains_rqst,
1134                 dissect_browser_browserr_query_emulated_domains_reply },
1135         { BROWSER_BROWSERR_SERVER_ENUM_EX,
1136           "BrowserrServerEnumEx",
1137                 dissect_browser_browserr_server_enum_ex_rqst,
1138                 dissect_browser_browserr_server_enum_ex_reply },
1139
1140         {0, NULL, NULL,  NULL }
1141 };
1142
1143 void
1144 proto_register_dcerpc_browser(void)
1145 {
1146 static hf_register_info hf[] = {
1147
1148         { &hf_browser_opnum, {
1149                 "Operation", "rpc_browser.opnum", FT_UINT16, BASE_DEC,
1150                 NULL, 0x0, NULL, HFILL }},
1151
1152         { &hf_browser_rc, {
1153                 "Return code", "rpc_browser.rc", FT_UINT32, BASE_HEX,
1154                 VALS(NT_errors), 0x0, "Browser return code", HFILL }},
1155
1156         { &hf_browser_unknown_long, {
1157                 "Unknown long", "rpc_browser.unknown.long", FT_UINT32, BASE_HEX,
1158                 NULL, 0x0, "Unknown long. If you know what this is, contact wireshark developers.", HFILL }},
1159
1160         { &hf_browser_unknown_hyper, {
1161                 "Unknown hyper", "rpc_browser.unknown.hyper", FT_UINT64, BASE_HEX,
1162                 NULL, 0x0, "Unknown hyper. If you know what this is, contact wireshark developers.", HFILL }},
1163
1164         { &hf_browser_unknown_bytes, {
1165                 "Unknown bytes", "rpc_browser.unknown.bytes", FT_BYTES, BASE_NONE,
1166                 NULL, 0x0, "Unknown bytes. If you know what this is, contact wireshark developers.", HFILL }},
1167
1168         { &hf_browser_unknown_string, {
1169                 "Unknown string", "rpc_browser.unknown.string", FT_STRING, BASE_NONE,
1170                 NULL, 0x0, "Unknown string. If you know what this is, contact wireshark developers.", HFILL }}
1171
1172         };
1173         static gint *ett[] = {
1174                 &ett_dcerpc_browser
1175         };
1176
1177         proto_dcerpc_browser = proto_register_protocol(
1178                 "RPC Browser", "RPC_BROWSER", "rpc_browser");
1179
1180         proto_register_field_array(proto_dcerpc_browser, hf,
1181                                    array_length(hf));
1182         proto_register_subtree_array(ett, array_length(ett));
1183 }
1184
1185 void
1186 proto_reg_handoff_dcerpc_browser(void)
1187 {
1188         /* Register protocol as dcerpc */
1189
1190         dcerpc_init_uuid(proto_dcerpc_browser, ett_dcerpc_browser,
1191                          &uuid_dcerpc_browser, ver_dcerpc_browser,
1192                          dcerpc_browser_dissectors, hf_browser_opnum);
1193 }