2 * Routines for dcerpc endpoint mapper dissection
3 * Copyright 2001, Todd Sabin <tas@webspan.net>
7 * Wireshark - Network traffic analyzer
8 * By Gerald Combs <gerald@wireshark.org>
9 * Copyright 1998 Gerald Combs
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version 2
14 * of the License, or (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
31 #include <epan/packet.h>
32 #include <epan/expert.h>
33 #include "packet-dcerpc.h"
34 #include "packet-dcerpc-nt.h"
37 static int proto_epm3 = -1;
38 static int proto_epm4 = -1;
40 static int hf_epm_opnum = -1;
41 static int hf_epm_inquiry_type = -1;
42 static int hf_epm_object = -1;
43 static int hf_epm_if_id = -1;
44 static int hf_epm_ver_maj = -1;
45 static int hf_epm_ver_min = -1;
46 static int hf_epm_ver_opt = -1;
47 static int hf_epm_hnd = -1;
48 static int hf_epm_max_ents = -1;
49 static int hf_epm_num_ents = -1;
50 static int hf_epm_uuid = -1;
51 static int hf_epm_tower_length = -1;
52 static int hf_epm_tower_data = -1;
53 static int hf_epm_max_towers = -1;
54 static int hf_epm_num_towers = -1;
55 static int hf_epm_rc = -1;
56 static int hf_epm_replace = -1;
57 static int hf_epm_tower_num_floors = -1;
58 static int hf_epm_tower_rhs_len = -1;
59 static int hf_epm_tower_lhs_len = -1;
60 static int hf_epm_tower_proto_id = -1;
61 static int hf_epm_annotation = -1;
62 static int hf_epm_ann_offset = -1;
63 static int hf_epm_ann_len = -1;
64 static int hf_epm_proto_named_pipes = -1;
65 static int hf_epm_proto_netbios_name = -1;
66 static int hf_epm_proto_ip = -1;
67 static int hf_epm_proto_udp_port = -1;
68 static int hf_epm_proto_tcp_port = -1;
69 static int hf_epm_proto_http_port = -1;
71 static gint ett_epm = -1;
72 static gint ett_epm_tower_floor = -1;
73 static gint ett_epm_entry = -1;
75 /* the UUID is identical for interface versions 3 and 4 */
76 static e_uuid_t uuid_epm = { 0xe1af8308, 0x5d1f, 0x11c9, { 0x91, 0xa4, 0x08, 0x00, 0x2b, 0x14, 0xa0, 0xfa } };
77 static guint16 ver_epm3 = 3;
78 static guint16 ver_epm4 = 4;
82 static const value_string ep_service[] = {
83 { 0, "rpc_c_ep_all_elts" },
84 { 1, "rpc_c_ep_match_by_if" },
85 { 2, "rpc_c_ep_match_by_obj" },
86 { 3, "rpc_c_ep_match_by_both" },
91 unsigned int tower_len,
92 [size_is(tower_len)] char tower[];
95 static int epm_dissect_tower (tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, guint8 *drep);
99 epm_dissect_pointer_IF_ID(tvbuff_t *tvb, int offset,
100 packet_info *pinfo, proto_tree *tree,
105 di=pinfo->private_data;
106 offset = dissect_ndr_uuid_t (tvb, offset, pinfo, tree, drep,
108 offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
109 hf_epm_ver_maj, NULL);
110 offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
111 hf_epm_ver_min, NULL);
116 epm_dissect_pointer_UUID(tvbuff_t *tvb, int offset,
117 packet_info *pinfo, proto_tree *tree,
122 di=pinfo->private_data;
123 offset = dissect_ndr_uuid_t (tvb, offset, pinfo, tree, drep,
129 epm_dissect_ept_lookup_rqst (tvbuff_t *tvb, int offset,
130 packet_info *pinfo, proto_tree *tree,
133 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
134 hf_epm_inquiry_type, NULL);
136 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
137 epm_dissect_pointer_UUID, NDR_POINTER_PTR,
138 "Object:", hf_epm_object);
140 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
141 epm_dissect_pointer_IF_ID, NDR_POINTER_PTR,
142 "Interface:", hf_epm_if_id);
144 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
145 hf_epm_ver_opt, NULL);
147 offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
150 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
151 hf_epm_max_ents, NULL);
157 epm_dissect_ept_entry_t(tvbuff_t *tvb, int offset,
158 packet_info *pinfo, proto_tree *parent_tree,
161 proto_item *item=NULL;
162 proto_tree *tree=NULL;
163 int old_offset=offset;
168 di=pinfo->private_data;
169 if(di->conformant_run){
174 item = proto_tree_add_text(parent_tree, tvb, offset, -1, "Entry:");
175 tree = proto_item_add_subtree(item, ett_epm_entry);
178 offset = dissect_ndr_uuid_t (tvb, offset, pinfo, tree, drep,
179 hf_epm_object, NULL);
181 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
182 epm_dissect_tower, NDR_POINTER_PTR,
183 "Tower pointer:", -1);
185 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
186 hf_epm_ann_offset, NULL);
187 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
188 hf_epm_ann_len, &len);
189 str=tvb_get_ephemeral_string(tvb, offset, len);
190 proto_tree_add_item(tree, hf_epm_annotation, tvb, offset, len, ENC_ASCII|ENC_NA);
195 proto_item_append_text(item, " Service:%s ", str);
196 proto_item_append_text(tree->parent, " Service:%s ", str);
198 if (check_col(pinfo->cinfo, COL_INFO)) {
199 col_append_fstr(pinfo->cinfo, COL_INFO, ", Service:%s", str);
203 proto_item_set_len(item, offset-old_offset);
208 epm_dissect_ept_entry_t_array(tvbuff_t *tvb, int offset,
209 packet_info *pinfo, proto_tree *tree,
212 offset = dissect_ndr_ucvarray(tvb, offset, pinfo, tree, drep,
213 epm_dissect_ept_entry_t);
219 epm_dissect_ept_lookup_resp (tvbuff_t *tvb, int offset,
220 packet_info *pinfo, proto_tree *tree,
223 offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
226 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
227 hf_epm_num_ents, NULL);
229 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
230 epm_dissect_ept_entry_t_array, NDR_POINTER_REF,
233 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
240 epm_dissect_uuid (tvbuff_t *tvb, int offset,
241 packet_info *pinfo, proto_tree *tree,
244 offset = dissect_ndr_uuid_t (tvb, offset, pinfo, tree, drep,
249 #define PROTO_ID_OSI_OID 0x00
250 #define PROTO_ID_DNA_SESSCTL 0x02
251 #define PROTO_ID_DNA_SESSCTL_V3 0x03
252 #define PROTO_ID_DNA_NSP 0x04
253 #define PROTO_ID_OSI_TP4 0x05
254 #define PROTO_ID_OSI_CLNS 0x06
255 #define PROTO_ID_TCP 0x07
256 #define PROTO_ID_UDP 0x08
257 #define PROTO_ID_IP 0x09
258 #define PROTO_ID_RPC_CL 0x0a
259 #define PROTO_ID_RPC_CO 0x0b
260 #define PROTO_ID_SPX 0x0c /* from DCOM spec (is this correct?) */
261 #define PROTO_ID_UUID 0x0d
262 #define PROTO_ID_IPX 0x0e /* from DCOM spec (is this correct?) */
263 #define PROTO_ID_NAMED_PIPES 0x0f
264 #define PROTO_ID_NAMED_PIPES_2 0x10
265 #define PROTO_ID_NETBIOS 0x11
266 #define PROTO_ID_NETBEUI 0x12
267 #define PROTO_ID_NETWARE_SPX 0x13
268 #define PROTO_ID_NETWARE_IPX 0x14
269 #define PROTO_ID_ATALK_STREAM 0x16
270 #define PROTO_ID_ATALK_DATAGRAM 0x17
271 #define PROTO_ID_ATALK 0x18
272 #define PROTO_ID_NETBIOS_2 0x19
273 #define PROTO_ID_VINES_SPP 0x1a
274 #define PROTO_ID_VINES_IPC 0x1b
275 #define PROTO_ID_STREETTALK 0x1c
276 #define PROTO_ID_HTTP 0x1f
277 #define PROTO_ID_UNIX_DOMAIN 0x20
278 #define PROTO_ID_NULL 0x21
279 #define PROTO_ID_NETBIOS_3 0x22
281 static const value_string proto_id_vals[] = {
282 { PROTO_ID_OSI_OID, "OSI OID"},
283 { PROTO_ID_DNA_SESSCTL, "DNA Session Control"},
284 { PROTO_ID_DNA_SESSCTL_V3, "DNA Session Control V3"},
285 { PROTO_ID_DNA_NSP, "DNA NSP Transport"},
286 { PROTO_ID_OSI_TP4, "OSI TP4"},
287 { PROTO_ID_OSI_CLNS, "OSI CLNS or DNA Routing"},
288 { PROTO_ID_TCP, "DOD TCP"},
289 { PROTO_ID_UDP, "DOD UDP"},
290 { PROTO_ID_IP, "DOD IP"},
291 { PROTO_ID_RPC_CL, "RPC connectionless protocol"},
292 { PROTO_ID_RPC_CO, "RPC connection-oriented protocol"},
293 { PROTO_ID_SPX, "SPX?"},
294 { PROTO_ID_UUID, "UUID"},
295 { PROTO_ID_IPX, "IPX?"},
296 { PROTO_ID_NAMED_PIPES, "Named Pipes"},
297 { PROTO_ID_NAMED_PIPES_2, "Named Pipes"},
298 { PROTO_ID_NETBIOS, "NetBIOS"},
299 { PROTO_ID_NETBEUI, "NetBEUI"},
300 { PROTO_ID_NETWARE_SPX, "Netware SPX"},
301 { PROTO_ID_NETWARE_IPX, "Netware IPX"},
302 { PROTO_ID_ATALK_STREAM, "Appletalk Stream"},
303 { PROTO_ID_ATALK_DATAGRAM, "Appletalk Datagram"},
304 { PROTO_ID_ATALK, "Appletalk"},
305 { PROTO_ID_NETBIOS_2, "NetBIOS"},
306 { PROTO_ID_VINES_SPP, "Vines SPP"},
307 { PROTO_ID_VINES_IPC, "Vines IPC"},
308 { PROTO_ID_STREETTALK, "StreetTalk"},
309 { PROTO_ID_HTTP, "RPC over HTTP"},
310 { PROTO_ID_UNIX_DOMAIN, "Unix Domain Socket"},
311 { PROTO_ID_NULL, "null"},
312 { PROTO_ID_NETBIOS_3, "NetBIOS"},
317 /* XXX this function assumes LE encoding. can not use the NDR routines
318 since they assume padding.
321 epm_dissect_tower_data (tvbuff_t *tvb, int offset,
322 packet_info *pinfo, proto_tree *tree,
325 guint16 num_floors, i;
327 const char *uuid_name;
328 guint8 u8little_endian = DREP_LITTLE_ENDIAN;
330 di=pinfo->private_data;
331 if(di->conformant_run){
335 num_floors = tvb_get_letohs(tvb, offset);
336 proto_tree_add_uint(tree, hf_epm_tower_num_floors, tvb, offset, 2, num_floors);
339 for(i=1;i<=num_floors;i++){
340 proto_item *it = NULL;
341 proto_tree *tr = NULL;
342 int old_offset = offset;
348 it = proto_tree_add_text(tree, tvb, offset, 0, "Floor %d ", i);
349 tr = proto_item_add_subtree(it, ett_epm_tower_floor);
351 len = tvb_get_letohs(tvb, offset);
352 proto_tree_add_uint(tr, hf_epm_tower_lhs_len, tvb, offset, 2, len);
355 proto_id = tvb_get_guint8(tvb, offset);
356 proto_tree_add_uint(tr, hf_epm_tower_proto_id, tvb, offset, 1, proto_id);
360 dcerpc_tvb_get_uuid (tvb, offset+1, &u8little_endian, &uuid);
362 uuid_name = guids_get_uuid_name(&uuid);
364 if(uuid_name != NULL) {
365 proto_tree_add_guid_format (tr, hf_epm_uuid, tvb, offset+1, 16, (e_guid_t *) &uuid,
366 "UUID: %s (%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x)",
368 uuid.Data1, uuid.Data2, uuid.Data3,
369 uuid.Data4[0], uuid.Data4[1],
370 uuid.Data4[2], uuid.Data4[3],
371 uuid.Data4[4], uuid.Data4[5],
372 uuid.Data4[6], uuid.Data4[7]);
374 proto_tree_add_guid_format (tr, hf_epm_uuid, tvb, offset+1, 16, (e_guid_t *) &uuid,
375 "UUID: %08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
376 uuid.Data1, uuid.Data2, uuid.Data3,
377 uuid.Data4[0], uuid.Data4[1],
378 uuid.Data4[2], uuid.Data4[3],
379 uuid.Data4[4], uuid.Data4[5],
380 uuid.Data4[6], uuid.Data4[7]);
382 proto_tree_add_text(tr, tvb, offset+17, 2, "Version %d.%d", tvb_get_guint8(tvb, offset+17), tvb_get_guint8(tvb, offset+18));
385 guint16 version = tvb_get_ntohs(tvb, offset+17);
386 const char *service = dcerpc_get_proto_name(&uuid, version);
387 if (service || uuid_name) {
388 const char *s = service ? service : uuid_name;
389 proto_item_append_text(tr, "UUID: %s", s);
390 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", s);
392 proto_item_append_text(tr, "UUID: %08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x Version %d.%d", uuid.Data1, uuid.Data2, uuid.Data3,
393 uuid.Data4[0], uuid.Data4[1],
394 uuid.Data4[2], uuid.Data4[3],
395 uuid.Data4[4], uuid.Data4[5],
396 uuid.Data4[6], uuid.Data4[7],
397 tvb_get_guint8(tvb, offset+17),
398 tvb_get_guint8(tvb, offset+18));
405 len = tvb_get_letohs(tvb, offset);
406 pi = proto_tree_add_uint(tr, hf_epm_tower_rhs_len, tvb, offset, 2, len);
412 /* XXX - is this big or little endian? */
413 proto_tree_add_item(tr, hf_epm_ver_min, tvb, offset, 2, ENC_BIG_ENDIAN);
415 case PROTO_ID_TCP: /* this one is always big endian */
416 proto_tree_add_item(tr, hf_epm_proto_tcp_port, tvb, offset, 2, ENC_BIG_ENDIAN);
417 proto_item_append_text(tr, "TCP Port:%d", tvb_get_ntohs(tvb, offset));
420 case PROTO_ID_UDP: /* this one is always big endian */
421 proto_tree_add_item(tr, hf_epm_proto_udp_port, tvb, offset, 2, ENC_BIG_ENDIAN);
422 proto_item_append_text(tr, "UDP Port:%d", tvb_get_ntohs(tvb, offset));
425 case PROTO_ID_IP: /* this one is always big endian */
426 proto_tree_add_item(tr, hf_epm_proto_ip, tvb, offset, 4, ENC_BIG_ENDIAN);
427 proto_item_append_text(tr, "IP:%s", tvb_ip_to_str(tvb, offset));
430 case PROTO_ID_RPC_CO:
431 proto_item_append_text(tr, "RPC connection-oriented protocol");
434 case PROTO_ID_RPC_CL:
435 proto_item_append_text(tr, "RPC connectionless protocol");
436 /* XXX - is this big or little endian? */
437 proto_tree_add_item(tr, hf_epm_ver_min, tvb, offset, 2, ENC_BIG_ENDIAN);
440 case PROTO_ID_NAMED_PIPES: /* \\PIPE\xxx named pipe */
441 proto_tree_add_item(tr, hf_epm_proto_named_pipes, tvb, offset, len, ENC_ASCII|ENC_NA);
442 proto_item_append_text(tr, "NamedPipe:%s", tvb_get_ephemeral_string(tvb, offset, len));
445 case PROTO_ID_NAMED_PIPES_2: /* PIPENAME named pipe */
446 proto_tree_add_item(tr, hf_epm_proto_named_pipes, tvb, offset, len, ENC_ASCII|ENC_NA);
447 proto_item_append_text(tr, "PIPE:%s", tvb_get_ephemeral_string(tvb, offset, len));
450 case PROTO_ID_NETBIOS: /* \\NETBIOS netbios name */
451 proto_tree_add_item(tr, hf_epm_proto_netbios_name, tvb, offset, len, ENC_ASCII|ENC_NA);
452 proto_item_append_text(tr, "NetBIOS:%s", tvb_get_ephemeral_string(tvb, offset, len));
454 case PROTO_ID_HTTP: /* RPC over HTTP */
455 proto_tree_add_item(tr, hf_epm_proto_http_port, tvb, offset, 2, ENC_BIG_ENDIAN);
456 proto_item_append_text(tr, "RPC over HTTP Port:%d", tvb_get_ntohs(tvb, offset));
461 expert_add_info_format(pinfo, pi, PI_UNDECODED, PI_WARN, "RightHandSide not decoded yet for proto_id 0x%x",
463 tvb_ensure_bytes_exist(tvb, offset, len);
464 proto_tree_add_text(tr, tvb, offset, len, "RightHandSide not decoded yet for proto_id 0x%x", proto_id);
469 proto_item_set_len(it, offset-old_offset);
475 unsigned int tower_len,
476 [size_is(tower_len)] char tower[];
480 epm_dissect_tower (tvbuff_t *tvb, int offset,
481 packet_info *pinfo, proto_tree *tree,
487 di=pinfo->private_data;
488 if(di->conformant_run){
492 /* first one is the header of the conformant array, second one is the
494 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
495 hf_epm_tower_length, &len);
496 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
497 hf_epm_tower_length, NULL);
498 offset = epm_dissect_tower_data(tvb, offset, pinfo, tree, drep);
503 epm_dissect_tower_pointer (tvbuff_t *tvb, int offset,
504 packet_info *pinfo, proto_tree *tree,
507 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
508 epm_dissect_tower, NDR_POINTER_PTR,
509 "Tower pointer:", -1);
513 epm_dissect_tower_array (tvbuff_t *tvb, int offset,
514 packet_info *pinfo, proto_tree *tree,
517 offset = dissect_ndr_ucvarray(tvb, offset, pinfo, tree, drep,
518 epm_dissect_tower_pointer);
524 epm_dissect_ept_map_rqst (tvbuff_t *tvb, int offset,
525 packet_info *pinfo, proto_tree *tree,
528 /* [in, ptr] uuid_p_t object */
529 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
530 epm_dissect_uuid, NDR_POINTER_PTR,
531 "UUID pointer:", -1);
533 /* [in, ptr] twr_p_t map_tower */
534 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
535 epm_dissect_tower, NDR_POINTER_PTR,
536 "Tower pointer:", -1);
538 /* [in, out] ept_lookup_handle_t *entry_handle */
539 offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
542 /* [in] unsigned32 max_towers */
543 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
544 hf_epm_max_towers, NULL);
550 epm_dissect_ept_map_resp (tvbuff_t *tvb, int offset,
551 packet_info *pinfo, proto_tree *tree,
554 /* [in, out] ept_lookup_handle_t *entry_handle */
555 offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
558 /* [out, ptr] unsigned32 *num_towers */
559 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
560 hf_epm_num_towers, NULL);
562 /* [out, length_is(*num_towers), size_is(max_towers), ptr] twr_p_t towers[] */
563 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
564 epm_dissect_tower_array, NDR_POINTER_REF,
567 /* [out] error_status_t *status */
568 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
575 epm_dissect_ept_entry_t_ucarray(tvbuff_t *tvb, int offset,
576 packet_info *pinfo, proto_tree *tree,
579 offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
580 epm_dissect_ept_entry_t);
586 epm_dissect_ept_insert_rqst (tvbuff_t *tvb, int offset,
587 packet_info *pinfo, proto_tree *tree,
590 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
591 hf_epm_num_ents, NULL);
593 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
594 epm_dissect_ept_entry_t_ucarray, NDR_POINTER_REF,
597 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
598 hf_epm_replace, NULL);
606 epm_dissect_ept_insert_resp (tvbuff_t *tvb, int offset,
607 packet_info *pinfo, proto_tree *tree,
610 /* [out] error_status_t *status */
611 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
619 epm_dissect_ept_delete_rqst (tvbuff_t *tvb, int offset,
620 packet_info *pinfo, proto_tree *tree,
623 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
624 hf_epm_num_ents, NULL);
626 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
627 epm_dissect_ept_entry_t_ucarray, NDR_POINTER_REF,
636 epm_dissect_ept_delete_resp (tvbuff_t *tvb, int offset,
637 packet_info *pinfo, proto_tree *tree,
640 /* [out] error_status_t *status */
641 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
650 epm_dissect_ept_lookup_handle_free_rqst (tvbuff_t *tvb, int offset,
651 packet_info *pinfo, proto_tree *tree,
654 /* [in, out] ept_lookup_handle_t *entry_handle */
655 offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
662 epm_dissect_ept_lookup_handle_free_resp (tvbuff_t *tvb, int offset,
663 packet_info *pinfo, proto_tree *tree,
666 /* [in, out] ept_lookup_handle_t *entry_handle */
667 offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
670 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
677 static dcerpc_sub_dissector epm_dissectors[] = {
679 epm_dissect_ept_insert_rqst,
680 epm_dissect_ept_insert_resp },
682 epm_dissect_ept_delete_rqst,
683 epm_dissect_ept_delete_resp },
685 epm_dissect_ept_lookup_rqst,
686 epm_dissect_ept_lookup_resp },
688 epm_dissect_ept_map_rqst,
689 epm_dissect_ept_map_resp },
690 { 4, "LookupHandleFree",
691 epm_dissect_ept_lookup_handle_free_rqst,
692 epm_dissect_ept_lookup_handle_free_resp },
693 { 5, "InqObject", NULL, NULL },
694 { 6, "MgmtDelete", NULL, NULL },
695 { 0, NULL, NULL, NULL }
699 proto_register_epm (void)
701 static hf_register_info hf[] = {
703 { "Operation", "epm.opnum", FT_UINT16, BASE_DEC,
704 NULL, 0x0, NULL, HFILL }},
705 { &hf_epm_inquiry_type,
706 { "Inquiry type", "epm.inq_type", FT_UINT32, BASE_DEC, VALS(ep_service), 0x0, NULL, HFILL }},
708 { "Object", "epm.object", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
710 { "Interface", "epm.if_id", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
712 { "Version Major", "epm.ver_maj", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
714 { "Version Minor", "epm.ver_min", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
716 { "Version Option", "epm.ver_opt", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
718 { "Handle", "epm.hnd", FT_BYTES, BASE_NONE, NULL, 0x0, "Context handle", HFILL }},
720 { "Max entries", "epm.max_ents", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
722 { "Num entries", "epm.num_ents", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
724 { "UUID", "epm.uuid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
725 { &hf_epm_annotation,
726 { "Annotation", "epm.annotation", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
727 { &hf_epm_proto_named_pipes,
728 { "Named Pipe", "epm.proto.named_pipe", FT_STRING, BASE_NONE, NULL, 0x0, "Name of the named pipe for this service", HFILL }},
729 { &hf_epm_proto_netbios_name,
730 { "NetBIOS Name", "epm.proto.netbios_name", FT_STRING, BASE_NONE, NULL, 0x0, "NetBIOS name where this service can be found", HFILL }},
731 { &hf_epm_tower_length,
732 { "Length", "epm.tower.len", FT_UINT32, BASE_DEC, NULL, 0x0, "Length of tower data", HFILL }},
733 { &hf_epm_tower_data,
734 { "Tower", "epm.tower", FT_BYTES, BASE_NONE, NULL, 0x0, "Tower data", HFILL }},
735 { &hf_epm_max_towers,
736 { "Max Towers", "epm.max_towers", FT_UINT32, BASE_DEC, NULL, 0x0, "Maximum number of towers to return", HFILL }},
737 { &hf_epm_num_towers,
738 { "Num Towers", "epm.num_towers", FT_UINT32, BASE_DEC, NULL, 0x0, "Number number of towers to return", HFILL }},
739 { &hf_epm_ann_offset,
740 { "Annotation offset", "epm.ann_offset", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
742 { "Annotation length", "epm.ann_len", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
744 { "Return code", "epm.rc", FT_UINT32, BASE_HEX, NULL, 0x0, "EPM return value", HFILL }},
746 { "Replace", "epm.replace", FT_UINT8, BASE_DEC, NULL, 0x0, "Replace existing objects?", HFILL }},
747 { &hf_epm_tower_num_floors,
748 { "Number of floors", "epm.tower.num_floors", FT_UINT16, BASE_DEC, NULL, 0x0, "Number of floors in tower", HFILL }},
749 { &hf_epm_proto_udp_port,
750 { "UDP Port", "epm.proto.udp_port", FT_UINT16, BASE_DEC, NULL, 0x0, "UDP Port where this service can be found", HFILL }},
751 { &hf_epm_proto_tcp_port,
752 { "TCP Port", "epm.proto.tcp_port", FT_UINT16, BASE_DEC, NULL, 0x0, "TCP Port where this service can be found", HFILL }},
753 { &hf_epm_proto_http_port,
754 { "TCP Port", "epm.proto.http_port", FT_UINT16, BASE_DEC, NULL, 0x0, "TCP Port where this service can be found", HFILL }},
755 { &hf_epm_tower_rhs_len,
756 { "RHS Length", "epm.tower.rhs.len", FT_UINT16, BASE_DEC, NULL, 0x0, "Length of RHS data", HFILL }},
757 { &hf_epm_tower_lhs_len,
758 { "LHS Length", "epm.tower.lhs.len", FT_UINT16, BASE_DEC, NULL, 0x0, "Length of LHS data", HFILL }},
760 { "IP", "epm.proto.ip", FT_IPv4, BASE_NONE, NULL, 0x0, "IP address where service is located", HFILL }},
761 { &hf_epm_tower_proto_id,
762 { "Protocol", "epm.tower.proto_id", FT_UINT8, BASE_HEX, VALS(proto_id_vals), 0x0, "Protocol identifier", HFILL }}
764 static gint *ett[] = {
766 &ett_epm_tower_floor,
770 /* interface version 3 */
771 proto_epm3 = proto_register_protocol ("DCE/RPC Endpoint Mapper", "EPM", "epm");
772 proto_register_field_array (proto_epm3, hf, array_length (hf));
773 proto_register_subtree_array (ett, array_length (ett));
775 /* interface version 4 */
776 proto_epm4 = proto_register_protocol ("DCE/RPC Endpoint Mapper v4", "EPMv4", "epm4");
780 proto_reg_handoff_epm (void)
782 /* Register the protocol as dcerpc */
783 dcerpc_init_uuid (proto_epm3, ett_epm, &uuid_epm, ver_epm3, epm_dissectors, hf_epm_opnum);
784 dcerpc_init_uuid (proto_epm4, ett_epm, &uuid_epm, ver_epm4, epm_dissectors, hf_epm_opnum);
788 * Editor modelines - http://www.wireshark.org/tools/modelines.html
793 * indent-tabs-mode: nil
796 * vi: set shiftwidth=4 tabstop=8 expandtab:
797 * :indentSize=4:tabSize=8:noTabs=true: