For proto_tree_add_item(..., proto_xxx, ...)use ENC_NA as the encoding arg.

[obnox/wireshark/wip.git] / epan / dissectors / packet-ntlmssp.c

diff --git a/epan/dissectors/packet-ntlmssp.c b/epan/dissectors/packet-ntlmssp.c
index 8fcb6763328ebafcf05a1173ef517a662bdee9e4..abba774efb95028cd32db55c16d00a488200ad77 100644 (file)
--- a/epan/dissectors/packet-ntlmssp.c
+++ b/epan/dissectors/packet-ntlmssp.c
@@ -53,7 +53,7 @@
 #include <epan/crypt/crypt-des.h>
 #include "packet-dcerpc.h"
 #include "packet-gssapi.h"
-#include <epan/crc32.h>
+#include <wsutil/crc32.h>
 
 #include "packet-ntlmssp.h"
 
@@ -974,7 +974,7 @@ dissect_ntlmssp_blob (tvbuff_t *tvb, int offset,
       {
         proto_tree_add_item (ntlmssp_tree,
                              hf_ntlmssp_ntlm_client_challenge,
-                             tvb, blob_offset, 8, FALSE);
+                             tvb, blob_offset, 8, ENC_NA);
       }
     }
   }
@@ -986,7 +986,7 @@ dissect_ntlmssp_blob (tvbuff_t *tvb, int offset,
   {
     proto_tree_add_item (ntlmssp_tree,
                          hf_ntlmssp_ntlm_client_challenge,
-                         tvb, blob_offset+32, 8, FALSE);
+                         tvb, blob_offset+32, 8, ENC_NA);
     dissect_ntlmv2_response(tvb, tree, blob_offset, blob_length);
   }
 
@@ -1327,26 +1327,26 @@ dissect_ntlmv2_response(tvbuff_t *tvb, proto_tree *tree, int offset, int len)
   if (tree) {
     ntlmv2_item = proto_tree_add_item(
       tree, hf_ntlmssp_ntlmv2_response, tvb,
-      offset, len, TRUE);
+      offset, len, ENC_NA);
     ntlmv2_tree = proto_item_add_subtree(
       ntlmv2_item, ett_ntlmssp_ntlmv2_response);
   }
 
   proto_tree_add_item(
     ntlmv2_tree, hf_ntlmssp_ntlmv2_response_hmac, tvb,
-    offset, 16, TRUE);
+    offset, 16, ENC_NA);
 
   offset += 16;
 
   proto_tree_add_item(
     ntlmv2_tree, hf_ntlmssp_ntlmv2_response_header, tvb,
-    offset, 4, TRUE);
+    offset, 4, ENC_LITTLE_ENDIAN);
 
   offset += 4;
 
   proto_tree_add_item(
     ntlmv2_tree, hf_ntlmssp_ntlmv2_response_reserved, tvb,
-    offset, 4, TRUE);
+    offset, 4, ENC_LITTLE_ENDIAN);
 
   offset += 4;
 
@@ -1355,13 +1355,13 @@ dissect_ntlmv2_response(tvbuff_t *tvb, proto_tree *tree, int offset, int len)
 
   proto_tree_add_item(
     ntlmv2_tree, hf_ntlmssp_ntlmv2_response_chal, tvb,
-    offset, 8, TRUE);
+    offset, 8, ENC_NA);
 
   offset += 8;
 
   proto_tree_add_item(
     ntlmv2_tree, hf_ntlmssp_ntlmv2_response_unknown, tvb,
-    offset, 4, TRUE);
+    offset, 4, ENC_LITTLE_ENDIAN);
 
   offset += 4;
 
@@ -1444,7 +1444,7 @@ dissect_ntlmssp_challenge_target_info_blob (tvbuff_t *tvb, int offset,
 
   if (ntlmssp_tree) {
     tf = proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_challenge_target_info, tvb,
-                              challenge_target_info_offset, challenge_target_info_length, FALSE);
+                              challenge_target_info_offset, challenge_target_info_length, ENC_NA);
     challenge_target_info_tree = proto_item_add_subtree(tf, ett_ntlmssp_challenge_target_info);
   }
   proto_tree_add_uint(challenge_target_info_tree, hf_ntlmssp_challenge_target_info_len,
@@ -1507,7 +1507,7 @@ dissect_ntlmssp_challenge (tvbuff_t *tvb, packet_info *pinfo, int offset,
   /* NTLMSSP NT Lan Manager Challenge */
   proto_tree_add_item (ntlmssp_tree,
                        hf_ntlmssp_ntlm_server_challenge,
-                       tvb, offset, 8, FALSE);
+                       tvb, offset, 8, ENC_NA);
 
   /*
    * Store the flags and the RC4 state information with the conversation,
@@ -1575,7 +1575,7 @@ dissect_ntlmssp_challenge (tvbuff_t *tvb, packet_info *pinfo, int offset,
    * It also says that that information may be omitted.
    */
   proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_reserved,
-                       tvb, offset, 8, FALSE);
+                       tvb, offset, 8, ENC_NA);
   offset += 8;
 
   /*
@@ -1750,7 +1750,7 @@ dissect_ntlmssp_auth (tvbuff_t *tvb, packet_info *pinfo, int offset,
   data_start = MIN(data_start, item_start);
   data_end = MAX(data_end, item_end);
 
-  col_append_fstr(pinfo->cinfo, COL_INFO, ", User: %s\\%s",
+  col_append_sep_fstr(pinfo->cinfo, COL_INFO, ", ", "User: %s\\%s",
                   ntlmssph->domain_name, ntlmssph->acct_name);
 
   /* hostname */
@@ -1957,7 +1957,7 @@ dissect_ntlmssp_payload(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree )
   if (tree) {
     tf = proto_tree_add_item (tree,
                               hf_ntlmssp_verf,
-                              tvb, offset, -1, FALSE);
+                              tvb, offset, -1, ENC_NA);
 
     ntlmssp_tree = proto_item_add_subtree (tf,
                                            ett_ntlmssp);
@@ -1979,12 +1979,12 @@ dissect_ntlmssp_payload(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree )
   TRY {
     /* Version number */
     proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_verf_vers,
-                         tvb, offset, 4, TRUE);
+                         tvb, offset, 4, ENC_LITTLE_ENDIAN);
     offset += 4;
 
     /* Encrypted body */
     proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_verf_body,
-                         tvb, offset, ntlm_signature_size + ntlm_seq_size, TRUE);
+                         tvb, offset, ntlm_signature_size + ntlm_seq_size, ENC_NA);
     tvb_memcpy(tvb, key, offset, ntlm_signature_size + ntlm_seq_size);
     /* Try to decrypt */
     decrypt_data_payload (tvb, offset+(ntlm_signature_size + ntlm_seq_size), encrypted_block_length-(ntlm_signature_size + ntlm_seq_size), pinfo, ntlmssp_tree,key);
@@ -2133,7 +2133,7 @@ dissect_ntlmssp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
   if (tree) {
     tf = proto_tree_add_item (tree,
                               proto_ntlmssp,
-                              tvb, offset, -1, FALSE);
+                              tvb, offset, -1, ENC_NA);
 
     ntlmssp_tree = proto_item_add_subtree (tf,
                                            ett_ntlmssp);
@@ -2155,16 +2155,16 @@ dissect_ntlmssp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
   TRY {
     /* NTLMSSP constant */
     proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth,
-                         tvb, offset, 8, FALSE);
+                         tvb, offset, 8, ENC_ASCII|ENC_NA);
     offset += 8;
 
     /* NTLMSSP Message Type */
     proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_message_type,
-                         tvb, offset, 4, TRUE);
+                         tvb, offset, 4, ENC_LITTLE_ENDIAN);
     ntlmssph->type = tvb_get_letohl (tvb, offset);
     offset += 4;
 
-    col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
+    col_append_sep_fstr(pinfo->cinfo, COL_INFO, ", ","%s",
                     val_to_str(ntlmssph->type,
                                ntlmssp_message_types,
                                "Unknown message type"));
@@ -2204,6 +2204,18 @@ dissect_ntlmssp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
   /*tap_queue_packet(ntlmssp_tap, pinfo, ntlmssph);*/
 }
 
+static gboolean
+dissect_ntlmssp_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
+{
+
+  if(tvb_memeql(tvb, 0, "NTLMSSP", 8) == 0) {
+
+    dissect_ntlmssp(tvb, pinfo, parent_tree);
+    return TRUE;
+  }
+
+  return FALSE;
+}
 
 
 /*
@@ -2349,31 +2361,31 @@ decrypt_verifier(tvbuff_t *tvb, int offset, guint32 encrypted_block_length,
 
   if(( conv_ntlmssp_info->flags & NTLMSSP_NEGOTIATE_EXTENDED_SECURITY )) {
     proto_tree_add_item (decr_tree, hf_ntlmssp_verf_hmacmd5,
-                         decr_tvb, decrypted_offset, 8,TRUE);
+                         decr_tvb, decrypted_offset, 8,ENC_NA);
     decrypted_offset += 8;
 
 
 
     /* Incrementing sequence number of DCE conversation */
    proto_tree_add_item (decr_tree, hf_ntlmssp_verf_sequence,
-                        decr_tvb, decrypted_offset, 4, TRUE);
+                        decr_tvb, decrypted_offset, 4, ENC_NA);
     decrypted_offset += 4;
   }
   else {
 
     /* RANDOM PAD usually it's 0 */
     proto_tree_add_item (decr_tree, hf_ntlmssp_verf_randompad,
-                         decr_tvb, decrypted_offset, 4, TRUE);
+                         decr_tvb, decrypted_offset, 4, ENC_LITTLE_ENDIAN);
     decrypted_offset += 4;
 
     /* CRC32 of the DCE fragment data */
     proto_tree_add_item (decr_tree, hf_ntlmssp_verf_crc32,
-                         decr_tvb, decrypted_offset, 4, TRUE);
+                         decr_tvb, decrypted_offset, 4, ENC_LITTLE_ENDIAN);
     decrypted_offset += 4;
 
     /* Incrementing sequence number of DCE conversation */
    proto_tree_add_item (decr_tree, hf_ntlmssp_verf_sequence,
-                        decr_tvb, decrypted_offset, 4, TRUE);
+                        decr_tvb, decrypted_offset, 4, ENC_NA);
     decrypted_offset += 4;
   }
 }
@@ -2397,7 +2409,7 @@ dissect_ntlmssp_payload_only(tvbuff_t *tvb, packet_info *pinfo, _U_ proto_tree *
   if (tree) {
     tf = proto_tree_add_item (tree,
                               hf_ntlmssp_verf,
-                              tvb, offset, -1, FALSE);
+                              tvb, offset, -1, ENC_NA);
 
     ntlmssp_tree = proto_item_add_subtree (tf,
                                            ett_ntlmssp);
@@ -2463,7 +2475,7 @@ dissect_ntlmssp_verf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
   if (tree) {
     tf = proto_tree_add_item (tree,
                               hf_ntlmssp_verf,
-                              tvb, offset, -1, FALSE);
+                              tvb, offset, -1, ENC_NA);
 
     ntlmssp_tree = proto_item_add_subtree (tf,
                                            ett_ntlmssp);
@@ -2485,12 +2497,12 @@ dissect_ntlmssp_verf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
   TRY {
     /* Version number */
     proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_verf_vers,
-                         tvb, offset, 4, TRUE);
+                         tvb, offset, 4, ENC_LITTLE_ENDIAN);
     offset += 4;
 
     /* Encrypted body */
     proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_verf_body,
-                         tvb, offset, encrypted_block_length, TRUE);
+                         tvb, offset, encrypted_block_length, ENC_NA);
 
     /* Try to decrypt */
     decrypt_verifier (tvb, offset, encrypted_block_length, pinfo, ntlmssp_tree,NULL);
@@ -3021,6 +3033,9 @@ proto_reg_handoff_ntlmssp(void)
                                     DCE_C_RPC_AUTHN_PROTOCOL_NTLMSSP,
                                     &ntlmssp_seal_fns);
   ntlmssp_tap = register_tap("ntlmssp");
+
+  heur_dissector_add("credssp", dissect_ntlmssp_heur, proto_ntlmssp);
+
 }
 
 /*
@@ -3032,6 +3047,6 @@ proto_reg_handoff_ntlmssp(void)
  * indent-tabs-mode: nil
  * End:
  *
- * vi: set shiftwidth=2 tabstop=8 expandtab
+ * vi: set shiftwidth=2 tabstop=8 expandtab:
  * :indentSize=2:tabSize=8:noTabs=true:
  */