epan/dissectors/packet-dcom-remact.c

   1 /* packet-dcom-remact.c
   2  * Routines for DCOM Remote Activation
   3  * Copyright 2001, Todd Sabin <tas@webspan.net>
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 /* see packet-dcom.c for details about DCOM */
  27
  28 #ifdef HAVE_CONFIG_H
  29 #include "config.h"
  30 #endif
  31
  32 #include <glib.h>
  33 #include <epan/packet.h>
  34 #include "packet-dcerpc.h"
  35 #include "packet-dcom.h"
  36
  37 static int hf_remact_opnum = -1;
  38
  39 static int hf_remact_requested_protseqs = -1;
  40 static int hf_remact_protseqs = -1;
  41 static int hf_remact_interfaces = -1;
  42 static int hf_remact_mode = -1;
  43 static int hf_remact_client_impl_level = -1;
  44 static int hf_remact_object_name = -1;
  45 static int hf_remact_object_storage = -1;
  46 static int hf_remact_interface_data = -1;
  47
  48 static int hf_remact_oxid_bindings = -1;
  49 static int hf_remact_authn_hint = -1;
  50
  51
  52 static int proto_remact = -1;
  53 static gint ett_remact = -1;
  54 static e_uuid_t uuid_remact = { 0x4d9f4ab8, 0x7d1c, 0x11cf, { 0x86, 0x1e, 0x00, 0x20, 0xaf, 0x6e, 0x7c, 0x57 } };
  55 static guint16  ver_remact = 0;
  56
  57
  58 static int
  59 dissect_remact_remote_activation_rqst(tvbuff_t *tvb, int offset,
  60                                       packet_info *pinfo, proto_tree *tree, guint8 *drep)
  61 {
  62         guint32 u32ClientImpLevel;
  63         guint32 u32Mode;
  64         guint32 u32Interfaces;
  65         guint32 u32Pointer;
  66         guint32 u32ArraySize;
  67         guint32 u32ItemIdx;
  68         guint16 u16ProtSeqs;
  69         e_uuid_t clsid;
  70         e_uuid_t iid;
  71
  72         gchar   szObjName[1000] = { 0 };
  73         guint32 u32ObjNameLen = sizeof(szObjName);
  74
  75         offset = dissect_dcom_this(tvb, offset, pinfo, tree, drep);
  76
  77         offset = dissect_dcom_append_UUID(tvb, offset, pinfo, tree, drep,
  78                                           hf_dcom_clsid, -1, &clsid);
  79
  80         offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, drep,
  81                                              &u32Pointer);
  82         if (u32Pointer) {
  83                 offset = dissect_dcom_BSTR(tvb, offset, pinfo, tree, drep,
  84                                            hf_remact_object_name, szObjName, u32ObjNameLen);
  85         }
  86
  87         offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, drep,
  88                                                  hf_remact_object_storage, NULL /* XXX */);
  89
  90         offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep,
  91                                     hf_remact_client_impl_level, &u32ClientImpLevel);
  92         offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep,
  93                                     hf_remact_mode, &u32Mode);
  94
  95         /* Interfaces */
  96         offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep,
  97                                     hf_remact_interfaces, &u32Interfaces);
  98         offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, drep,
  99                                              &u32Pointer);
 100         if (u32Pointer) {
 101                 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep,
 102                                                         &u32ArraySize);
 103                 u32ItemIdx = 1;
 104                 while (u32Interfaces--) {
 105                         offset = dissect_dcom_append_UUID(tvb, offset, pinfo, tree, drep,
 106                                                           hf_dcom_iid, u32ItemIdx, &iid);
 107
 108                         u32ItemIdx++;
 109                 }
 110         }
 111
 112         offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, drep,
 113                                    hf_remact_requested_protseqs, &u16ProtSeqs);
 114
 115         offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep,
 116                                                 &u32ArraySize);
 117         u32ItemIdx = 1;
 118         while (u32ArraySize--) {
 119                 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, drep,
 120                                            hf_remact_protseqs, &u16ProtSeqs);
 121                 u32ItemIdx++;
 122         }
 123
 124         return offset;
 125 }
 126
 127
 128 static int
 129 dissect_remact_remote_activation_resp(tvbuff_t *tvb, int offset,
 130                                       packet_info *pinfo, proto_tree *tree, guint8 *drep)
 131 {
 132         guint32 u32Pointer;
 133         e_uuid_t ipid;
 134         guint32 u32AuthnHint;
 135         guint16 u16VersionMajor;
 136         guint16 u16VersionMinor;
 137         guint32 u32HResult;
 138         guint32 u32ArraySize;
 139         guint32 u32Idx;
 140         guint32 u32VariableOffset;
 141
 142
 143         offset = dissect_dcom_that(tvb, offset, pinfo, tree, drep);
 144
 145         offset = dissect_dcom_ID(tvb, offset, pinfo, tree, drep,
 146                                  hf_dcom_oxid, NULL);
 147         offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, drep,
 148                                              &u32Pointer);
 149         if (u32Pointer) {
 150                 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep,
 151                                                         &u32ArraySize);
 152                 offset = dissect_dcom_DUALSTRINGARRAY(tvb, offset, pinfo, tree, drep,
 153                                                       hf_remact_oxid_bindings, NULL);
 154         }
 155
 156         offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, drep,
 157                                    hf_dcom_ipid, &ipid);
 158         offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep,
 159                                     hf_remact_authn_hint, &u32AuthnHint);
 160         offset = dissect_dcom_COMVERSION(tvb, offset, pinfo, tree, drep,
 161                                          &u16VersionMajor, &u16VersionMinor);
 162
 163         offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, drep,
 164                                       &u32HResult);
 165
 166         offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep,
 167                                                 &u32ArraySize);
 168         u32VariableOffset = offset + u32ArraySize * 4;
 169         while (u32ArraySize--) {
 170                 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, drep,
 171                                                      &u32Pointer);
 172                 if (u32Pointer) {
 173                         u32VariableOffset = dissect_dcom_MInterfacePointer(tvb, u32VariableOffset, pinfo, tree, drep,
 174                                                                            hf_remact_interface_data, NULL /* XXX */);
 175                 }
 176         }
 177         offset = u32VariableOffset;
 178
 179         offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep,
 180                                                 &u32ArraySize);
 181         u32Idx = 1;
 182         while (u32ArraySize--) {
 183                 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, tree, drep,
 184                                                       &u32HResult, u32Idx);
 185                 /* update column info now */
 186                 if (check_col(pinfo->cinfo, COL_INFO)) {
 187                         col_append_fstr(pinfo->cinfo, COL_INFO, " %s[%u]",
 188                                         val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)"),
 189                                         u32Idx);
 190                 }
 191                 u32Idx++;
 192         }
 193
 194         offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, drep,
 195                                       &u32HResult);
 196
 197         /* update column info now */
 198         if (check_col(pinfo->cinfo, COL_INFO)) {
 199                 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
 200                                 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)"));
 201         }
 202
 203         return offset;
 204 }
 205
 206
 207 static dcerpc_sub_dissector remact_dissectors[] = {
 208         { 0, "RemoteActivation", dissect_remact_remote_activation_rqst, dissect_remact_remote_activation_resp },
 209         { 0, NULL, NULL, NULL },
 210 };
 211
 212
 213 void
 214 proto_register_remact (void)
 215 {
 216         static hf_register_info hf_remact[] = {
 217                 { &hf_remact_opnum,
 218                   { "Operation", "remact_opnum", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 219
 220                 { &hf_remact_requested_protseqs,
 221                   { "RequestedProtSeqs", "remact_req_prot_seqs", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 222                 { &hf_remact_protseqs,
 223                   { "ProtSeqs", "remact_prot_seqs", FT_UINT16, BASE_DEC, VALS(dcom_protseq_vals), 0x0, NULL, HFILL }},
 224                 { &hf_remact_interfaces,
 225                   { "Interfaces", "remact_interfaces", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 226                 { &hf_remact_mode,
 227                   { "Mode", "remact_mode", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 228                 { &hf_remact_client_impl_level,
 229                   { "ClientImplLevel", "remact_client_impl_level", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 230                 { &hf_remact_object_name,
 231                   { "ObjectName", "remact_object_name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 232                 { &hf_remact_object_storage,
 233                   { "ObjectStorage", "remact_object_storage", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 234                 { &hf_remact_interface_data,
 235                   { "InterfaceData", "remact_interface_data", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 236
 237                 { &hf_remact_oxid_bindings,
 238                   { "OxidBindings", "hf_remact_oxid_bindings", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 239                 { &hf_remact_authn_hint,
 240                   { "AuthnHint", "remact_authn_hint", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 241         };
 242
 243         static gint *ett[] = {
 244                 &ett_remact
 245         };
 246
 247         proto_remact = proto_register_protocol ("DCOM IRemoteActivation", "REMACT", "remact");
 248         proto_register_field_array (proto_remact, hf_remact, array_length (hf_remact));
 249         proto_register_subtree_array (ett, array_length (ett));
 250 }
 251
 252 void
 253 proto_reg_handoff_remact (void)
 254 {
 255         /* Register the protocol as dcerpc */
 256         dcerpc_init_uuid (proto_remact, ett_remact, &uuid_remact, ver_remact, remact_dissectors, hf_remact_opnum);
 257 }