* Routines for NTLM Secure Service Provider
* Devin Heitmueller <dheitmueller@netilla.com>
*
- * $Id: packet-ntlmssp.c,v 1.1 2002/07/09 20:49:27 tpot Exp $
+ * $Id: packet-ntlmssp.c,v 1.8 2002/08/21 21:25:23 tpot Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
# include "config.h"
#endif
-#ifdef HAVE_SYS_TYPES_H
-# include <sys/types.h>
-#endif
-
#include <glib.h>
#include <epan/packet.h>
+#include "packet-smb-common.h"
+
/* Message types */
#define NTLMSSP_NEGOTIATE 1
{ NTLMSSP_NEGOTIATE, "NTLMSSP_NEGOTIATE" },
{ NTLMSSP_CHALLENGE, "NTLMSSP_CHALLENGE" },
{ NTLMSSP_AUTH, "NTLMSSP_AUTH" },
- { NTLMSSP_UNKNOWN, "NTLMSSP_UNKNOWN" }
-};
-
-static const true_false_string flags_set_truth = {
- "Set",
- "Not set"
+ { NTLMSSP_UNKNOWN, "NTLMSSP_UNKNOWN" },
+ { 0, NULL }
};
/*
static int hf_ntlmssp_reserved = -1;
static int hf_ntlmssp_challenge_unknown1 = -1;
static int hf_ntlmssp_challenge_unknown2 = -1;
-
+static int hf_ntlmssp_auth_lmresponse_strlen = -1;
+static int hf_ntlmssp_auth_lmresponse_maxlen = -1;
+static int hf_ntlmssp_auth_lmresponse_offset = -1;
+static int hf_ntlmssp_auth_ntresponse_strlen = -1;
+static int hf_ntlmssp_auth_ntresponse_maxlen = -1;
+static int hf_ntlmssp_auth_ntresponse_offset = -1;
+static int hf_ntlmssp_auth_domain_strlen = -1;
+static int hf_ntlmssp_auth_domain_maxlen = -1;
+static int hf_ntlmssp_auth_domain_offset = -1;
+static int hf_ntlmssp_auth_username_strlen = -1;
+static int hf_ntlmssp_auth_username_maxlen = -1;
+static int hf_ntlmssp_auth_username_offset = -1;
+static int hf_ntlmssp_auth_hostname_strlen = -1;
+static int hf_ntlmssp_auth_hostname_maxlen = -1;
+static int hf_ntlmssp_auth_hostname_offset = -1;
+static int hf_ntlmssp_auth_unknown1_strlen = -1;
+static int hf_ntlmssp_auth_unknown1_maxlen = -1;
+static int hf_ntlmssp_auth_unknown1_offset = -1;
+static int hf_ntlmssp_auth_username = -1;
+static int hf_ntlmssp_auth_domain = -1;
+static int hf_ntlmssp_auth_hostname = -1;
+static int hf_ntlmssp_auth_lmresponse = -1;
+static int hf_ntlmssp_auth_ntresponse = -1;
+static int hf_ntlmssp_auth_unknown1 = -1;
static gint ett_ntlmssp = -1;
static gint ett_ntlmssp_negotiate_flags = -1;
}
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_01,
- tvb, offset, 4, negotiate_flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_02,
+ hf_ntlmssp_negotiate_flags_80000000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_04,
+ hf_ntlmssp_negotiate_flags_40000000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_08,
+ hf_ntlmssp_negotiate_flags_20000000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_10,
+ hf_ntlmssp_negotiate_flags_10000000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_20,
+ hf_ntlmssp_negotiate_flags_8000000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_40,
- tvb, offset, 4, negotiate_flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_80,
+ hf_ntlmssp_negotiate_flags_4000000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_100,
+ hf_ntlmssp_negotiate_flags_2000000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_200,
+ hf_ntlmssp_negotiate_flags_1000000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_400,
+ hf_ntlmssp_negotiate_flags_800000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_800,
- tvb, offset, 4, negotiate_flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_1000,
+ hf_ntlmssp_negotiate_flags_400000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_2000,
+ hf_ntlmssp_negotiate_flags_200000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_4000,
+ hf_ntlmssp_negotiate_flags_100000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_8000,
+ hf_ntlmssp_negotiate_flags_80000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_10000,
+ hf_ntlmssp_negotiate_flags_40000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
hf_ntlmssp_negotiate_flags_20000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_40000,
+ hf_ntlmssp_negotiate_flags_10000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_80000,
+ hf_ntlmssp_negotiate_flags_8000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_100000,
+ hf_ntlmssp_negotiate_flags_4000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_200000,
+ hf_ntlmssp_negotiate_flags_2000,
+ tvb, offset, 4, negotiate_flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_ntlmssp_negotiate_flags_1000,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_400000,
+ hf_ntlmssp_negotiate_flags_800,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_800000,
+ hf_ntlmssp_negotiate_flags_400,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_1000000,
+ hf_ntlmssp_negotiate_flags_200,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_2000000,
+ hf_ntlmssp_negotiate_flags_100,
+ tvb, offset, 4, negotiate_flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_ntlmssp_negotiate_flags_80,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_4000000,
+ hf_ntlmssp_negotiate_flags_40,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_8000000,
+ hf_ntlmssp_negotiate_flags_20,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_10000000,
+ hf_ntlmssp_negotiate_flags_10,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_20000000,
+ hf_ntlmssp_negotiate_flags_08,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_40000000,
+ hf_ntlmssp_negotiate_flags_04,
tvb, offset, 4, negotiate_flags);
proto_tree_add_boolean (negotiate_flags_tree,
- hf_ntlmssp_negotiate_flags_80000000,
+ hf_ntlmssp_negotiate_flags_02,
tvb, offset, 4, negotiate_flags);
-
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_ntlmssp_negotiate_flags_01,
+ tvb, offset, 4, negotiate_flags);
return (offset + 4);
}
guint16 domain_length;
/* NTLMSSP Negotiate Flags */
- negotiate_flags = tvb_get_letohs (tvb, offset);
+ negotiate_flags = tvb_get_letohl (tvb, offset);
offset = dissect_ntlmssp_negotiate_flags (tvb, offset, ntlmssp_tree,
negotiate_flags);
offset += 2;
/* Calling workstation name buffer? */
- proto_tree_add_uint(ntlmssp_tree, hf_ntlmssp_negotiate_workstation_buffer,
+ proto_tree_add_item(ntlmssp_tree, hf_ntlmssp_negotiate_workstation_buffer,
tvb, offset, 4, TRUE);
offset += 4;
/* Calling workstation name */
- proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_negotiate_workstation,
- tvb, offset, workstation_length, FALSE);
- offset += workstation_length;
+ if (workstation_length != 0) {
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_negotiate_workstation,
+ tvb, offset, workstation_length, FALSE);
+ offset += workstation_length;
+ }
/* Calling domain name */
- proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_negotiate_domain,
- tvb, offset, domain_length, FALSE);
- offset += domain_length;
+ if (domain_length != 0) {
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_negotiate_domain,
+ tvb, offset, domain_length, FALSE);
+ offset += domain_length;
+ }
return offset;
}
offset += 4;
/* NTLMSSP Negotiate Flags */
- negotiate_flags = tvb_get_letohs (tvb, offset);
+ negotiate_flags = tvb_get_letohl (tvb, offset);
offset = dissect_ntlmssp_negotiate_flags (tvb, offset, ntlmssp_tree,
negotiate_flags);
return offset;
}
+static int
+dissect_ntlmssp_auth (tvbuff_t *tvb, int offset, proto_tree *ntlmssp_tree)
+{
+ guint16 lmresponse_length;
+ guint16 ntresponse_length;
+ guint16 domain_length;
+ guint16 username_length;
+ guint16 hostname_length;
+ guint16 unknown1_length;
+ guint32 negotiate_flags;
+ const gchar *username;
+ const gchar *domain;
+ const gchar *hostname;
+ int result_length;
+ guint16 bc;
+ gboolean unicode_strings = FALSE;
+
+ /* Lan Manager response length */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_lmresponse_strlen,
+ tvb, offset, 2, TRUE);
+ lmresponse_length = tvb_get_letohs (tvb, offset);
+ offset += 2;
+
+ /* Lan Manager response max length */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_lmresponse_maxlen,
+ tvb, offset, 2, TRUE);
+ offset += 2;
+
+ /* Lan Manager response offset */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_lmresponse_offset,
+ tvb, offset, 4, TRUE);
+ offset += 4;
+
+ /* NTLM response length */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_ntresponse_strlen,
+ tvb, offset, 2, TRUE);
+ ntresponse_length = tvb_get_letohs (tvb, offset);
+ offset += 2;
+
+ /* NTLM response max length */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_ntresponse_maxlen,
+ tvb, offset, 2, TRUE);
+ offset += 2;
+
+ /* NTLM response offset */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_ntresponse_offset,
+ tvb, offset, 4, TRUE);
+ offset += 4;
+
+ /* Domain name length */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_domain_strlen,
+ tvb, offset, 2, TRUE);
+ domain_length = tvb_get_letohs (tvb, offset);
+ offset += 2;
+
+ /* Domain name max length */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_domain_maxlen,
+ tvb, offset, 2, TRUE);
+ offset += 2;
+
+ /* Domain name offset */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_domain_offset,
+ tvb, offset, 4, TRUE);
+ offset += 4;
+
+ /* Username length */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_username_strlen,
+ tvb, offset, 2, TRUE);
+ username_length = tvb_get_letohs (tvb, offset);
+ offset += 2;
+
+ /* Username max length */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_username_maxlen,
+ tvb, offset, 2, TRUE);
+ offset += 2;
+
+ /* Username offset */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_username_offset,
+ tvb, offset, 4, TRUE);
+ offset += 4;
+
+ /* Hostname length */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_hostname_strlen,
+ tvb, offset, 2, TRUE);
+ hostname_length = tvb_get_letohs (tvb, offset);
+ offset += 2;
+
+ /* Hostname max length */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_hostname_maxlen,
+ tvb, offset, 2, TRUE);
+ offset += 2;
+
+ /* Hostname offset */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_hostname_offset,
+ tvb, offset, 4, TRUE);
+ offset += 4;
+
+ /* Unknown1 length */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_unknown1_strlen,
+ tvb, offset, 2, TRUE);
+ unknown1_length = tvb_get_letohs (tvb, offset);
+ offset += 2;
+
+ /* Unknown1 max length */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_unknown1_maxlen,
+ tvb, offset, 2, TRUE);
+ offset += 2;
+
+ /* Unknown1 offset */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_unknown1_offset,
+ tvb, offset, 4, TRUE);
+ offset += 4;
+
+ /* NTLMSSP Negotiate Flags */
+ negotiate_flags = tvb_get_letohl (tvb, offset);
+ offset = dissect_ntlmssp_negotiate_flags (tvb, offset, ntlmssp_tree,
+ negotiate_flags);
+
+ if (negotiate_flags && NTLMSSP_NEGOTIATE_UNICODE)
+ unicode_strings = TRUE;
+
+ /* Domain name */
+ if (domain_length != 0) {
+ bc = domain_length;
+ domain = get_unicode_or_ascii_string(tvb, &offset,
+ unicode_strings, &result_length,
+ FALSE, FALSE, &bc);
+ if (domain == NULL) {
+ offset += domain_length;
+ return offset;
+ }
+
+ proto_tree_add_string(ntlmssp_tree, hf_ntlmssp_auth_domain, tvb,
+ offset, result_length, domain);
+ offset += domain_length;
+ }
+
+ /* User name */
+ if (username_length != 0) {
+ bc = username_length;
+ username = get_unicode_or_ascii_string(tvb, &offset,
+ unicode_strings, &result_length,
+ FALSE, FALSE, &bc);
+ if (username == NULL) {
+ offset += username_length;
+ return offset;
+ }
+
+ proto_tree_add_string(ntlmssp_tree, hf_ntlmssp_auth_username, tvb,
+ offset, result_length, username);
+ offset += username_length;
+ }
+
+ /* Host name */
+ if (hostname_length != 0) {
+ bc = hostname_length;
+ hostname = get_unicode_or_ascii_string(tvb, &offset,
+ unicode_strings, &result_length,
+ FALSE, FALSE, &bc);
+ if (hostname == NULL) {
+ offset += hostname_length;
+ return offset;
+ }
+
+ proto_tree_add_string(ntlmssp_tree, hf_ntlmssp_auth_hostname, tvb,
+ offset, result_length, hostname);
+ offset += hostname_length;
+ }
+
+ /* Lan Manager Response */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_lmresponse,
+ tvb, offset, lmresponse_length, FALSE);
+ offset += lmresponse_length;
+
+ /* NTLM Response */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_ntresponse,
+ tvb, offset, ntresponse_length, FALSE);
+ offset += ntresponse_length;
+
+ /* Unknown1 */
+ proto_tree_add_item (ntlmssp_tree, hf_ntlmssp_auth_unknown1,
+ tvb, offset, unknown1_length, FALSE);
+ offset += unknown1_length;
+
+ return offset;
+}
static void
dissect_ntlmssp(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree)
offset += 4;
/* Call the appropriate dissector based on the Message Type */
- if (ntlmssp_message_type == NTLMSSP_NEGOTIATE)
+ switch (ntlmssp_message_type) {
+
+ case NTLMSSP_NEGOTIATE:
offset = dissect_ntlmssp_negotiate (tvb, offset, ntlmssp_tree);
- else if (ntlmssp_message_type == NTLMSSP_CHALLENGE)
+ break;
+
+ case NTLMSSP_CHALLENGE:
offset = dissect_ntlmssp_challenge (tvb, offset, ntlmssp_tree);
- else {
+ break;
+
+ case NTLMSSP_AUTH:
+ offset = dissect_ntlmssp_auth (tvb, offset, ntlmssp_tree);
+ break;
+
+ default:
/* Unrecognized message type */
proto_tree_add_text (ntlmssp_tree, tvb, offset,
(payloadsize - 12),
"Unrecognized NTLMSSP Message");
+ break;
}
}
{ &hf_ntlmssp_negotiate_flags_80000000,
{ "Negotiate 0x80000000", "ntlmssp.negotiatent80000000", FT_BOOLEAN, 32, TFS (&flags_set_truth), NTLMSSP_NEGOTIATE_80000000, "", HFILL }},
{ &hf_ntlmssp_negotiate_workstation_strlen,
- { "Calling workstation name length", "ntlmssp.negotiate.callingworkstation.strlen", FT_UINT16, BASE_HEX, NULL, 0x0, "", HFILL }},
+ { "Calling workstation name length", "ntlmssp.negotiate.callingworkstation.strlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
{ &hf_ntlmssp_negotiate_workstation_maxlen,
- { "Calling workstation name max length", "ntlmssp.negotiate.callingworkstation.maxlen", FT_UINT16, BASE_HEX, NULL, 0x0, "", HFILL }},
+ { "Calling workstation name max length", "ntlmssp.negotiate.callingworkstation.maxlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
{ &hf_ntlmssp_negotiate_workstation_buffer,
{ "Calling workstation name buffer", "ntlmssp.negotiate.callingworkstation.buffer", FT_UINT32, BASE_HEX, NULL, 0x0, "", HFILL }},
{ &hf_ntlmssp_negotiate_workstation,
{ "Calling workstation name", "ntlmssp.negotiate.callingworkstation", FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }},
{ &hf_ntlmssp_negotiate_domain_strlen,
- { "Calling workstation domain length", "ntlmssp.negotiate.domain.strlen", FT_UINT16, BASE_HEX, NULL, 0x0, "", HFILL }},
+ { "Calling workstation domain length", "ntlmssp.negotiate.domain.strlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
{ &hf_ntlmssp_negotiate_domain_maxlen,
- { "Calling workstation domain max length", "ntlmssp.negotiate.domain.maxlen", FT_UINT16, BASE_HEX, NULL, 0x0, "", HFILL }},
+ { "Calling workstation domain max length", "ntlmssp.negotiate.domain.maxlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
{ &hf_ntlmssp_negotiate_domain_buffer,
{ "Calling workstation domain buffer", "ntlmssp.negotiate.domain.buffer", FT_UINT32, BASE_HEX, NULL, 0x0, "", HFILL }},
{ &hf_ntlmssp_negotiate_domain,
{ "Unknown1", "ntlmssp.challenge.unknown1", FT_UINT32, BASE_HEX, NULL, 0x0, "", HFILL }},
{ &hf_ntlmssp_challenge_unknown2,
{ "Unknown2", "ntlmssp.challenge.unknown2", FT_UINT32, BASE_HEX, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_lmresponse_strlen,
+ { "Lan Manager response length", "ntlmssp.auth.lmresponse.strlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_lmresponse_maxlen,
+ { "Lan Manager response max length", "ntlmssp.auth.lmresponse.maxlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_lmresponse_offset,
+ { "Lan Manager response offset", "ntlmssp.auth.lmresponse.offset", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_ntresponse_strlen,
+ { "NTLM response length", "ntlmssp.auth.ntresponse.strlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_ntresponse_maxlen,
+ { "NTLM response max length", "ntlmssp.auth.ntresponse.maxlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_ntresponse_offset,
+ { "NTLM response offset", "ntlmssp.auth.ntresponse.offset", FT_UINT32, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_domain_strlen,
+ { "Domain name length", "ntlmssp.auth.domain.strlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_domain_maxlen,
+ { "Domain name max length", "ntlmssp.auth.domain.maxlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_domain_offset,
+ { "Domain name offset", "ntlmssp.auth.domain.offset", FT_UINT32, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_username_strlen,
+ { "Username length", "ntlmssp.auth.username.strlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_username_maxlen,
+ { "Username max length", "ntlmssp.auth.username.maxlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_username_offset,
+ { "Username offset", "ntlmssp.auth.username.offset", FT_UINT32, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_hostname_strlen,
+ { "Hostname length", "ntlmssp.auth.hostname.strlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_hostname_maxlen,
+ { "Hostname max length", "ntlmssp.auth.hostname.maxlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_hostname_offset,
+ { "Hostname offset", "ntlmssp.auth.hostname.offset", FT_UINT32, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_unknown1_strlen,
+ { "Unknown1 length", "ntlmssp.auth.unknown1.strlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_unknown1_maxlen,
+ { "Unknown1 max length", "ntlmssp.auth.unknown1.maxlen", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_unknown1_offset,
+ { "Unknown1 offset", "ntlmssp.auth.unknown1.offset", FT_UINT32, BASE_DEC, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_domain,
+ { "Domain name", "ntlmssp.auth.domain", FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_username,
+ { "User name", "ntlmssp.auth.username", FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_hostname,
+ { "Host name", "ntlmssp.auth.hostname", FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_lmresponse,
+ { "Lan Manager Response", "ntlmssp.auth.lmresponse", FT_BYTES, BASE_HEX, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_ntresponse,
+ { "NTLM Response", "ntlmssp.auth.ntresponse", FT_BYTES, BASE_HEX, NULL, 0x0, "", HFILL }},
+ { &hf_ntlmssp_auth_unknown1,
+ { "Unknown1", "ntlmssp.auth.unknown1", FT_BYTES, BASE_HEX, NULL, 0x0, "", HFILL }}
};
git.samba.org / obnox / wireshark / wip.git / blobdiff