packet-dcerpc-browser.c

   1 /* packet-dcerpc-browser.c
   2  * Routines for DCERPC Browser packet disassembly
   3  * Copyright 2001, Ronnie Sahlberg
   4  *
   5  * $Id: packet-dcerpc-browser.c,v 1.10 2003/01/30 08:19:37 guy Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 /* The IDL file for this interface can be extracted by grepping for idl
  27  * in capitals.
  28  */
  29
  30 #ifdef HAVE_CONFIG_H
  31 #include "config.h"
  32 #endif
  33
  34 #include <glib.h>
  35 #include <epan/packet.h>
  36 #include "packet-dcerpc.h"
  37 #include "packet-dcerpc-browser.h"
  38 #include "packet-dcerpc-nt.h"
  39 #include "smb.h"
  40
  41 static int proto_dcerpc_browser = -1;
  42 static int hf_browser_rc = -1;
  43 static int hf_browser_unknown_long = -1;
  44 static int hf_browser_unknown_hyper = -1;
  45 static int hf_browser_unknown_bytes = -1;
  46 static int hf_browser_unknown_string = -1;
  47
  48
  49 static gint ett_dcerpc_browser = -1;
  50
  51
  52 static int
  53 dissect_browser_long_pointer(tvbuff_t *tvb, int offset,
  54                              packet_info *pinfo, proto_tree *tree,
  55                              char *drep)
  56 {
  57         dcerpc_info *di;
  58
  59         di=pinfo->private_data;
  60         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
  61                                      di->hf_index, NULL);
  62         return offset;
  63 }
  64
  65
  66
  67 /*
  68  IDL [ uuid(6bffd098-a112-3610-9833-012892020162),
  69  IDL   version(0.0),
  70  IDL   implicit_handle(handle_t rpc_binding)
  71  IDL ] interface browser
  72  IDL {
  73 */
  74
  75 static e_uuid_t uuid_dcerpc_browser = {
  76         0x6bffd098, 0xa112, 0x3610,
  77         { 0x98, 0x33, 0x01, 0x28, 0x92, 0x02, 0x01, 0x62 }
  78 };
  79
  80 static guint16 ver_dcerpc_browser = 0;
  81
  82
  83 /*
  84   IDL typedef struct {
  85   IDL   long element_7;
  86   IDL   [size_is(element_7)] [unique] byte *element_8;
  87   IDL } TYPE_4;
  88 */
  89 static int
  90 dissect_browser_TYPE_4_data(tvbuff_t *tvb, int offset,
  91                         packet_info *pinfo, proto_tree *tree,
  92                         char *drep)
  93 {
  94         guint32 len;
  95         dcerpc_info *di;
  96
  97         di=pinfo->private_data;
  98         if(di->conformant_run){
  99                 /* this call is to make ethereal eat the array header for the conformant run */
 100                 offset =dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, NULL);
 101
 102                 return offset;
 103         }
 104         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 105                 hf_browser_unknown_long, &len);
 106
 107         proto_tree_add_item(tree, hf_browser_unknown_bytes, tvb, offset, len,
 108                 FALSE);
 109         offset += len;
 110
 111         return len;
 112 }
 113 static int
 114 dissect_browser_TYPE_4(tvbuff_t *tvb, int offset,
 115                         packet_info *pinfo, proto_tree *tree,
 116                         char *drep)
 117 {
 118         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 119                 hf_browser_unknown_long, NULL);
 120
 121         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 122                 dissect_browser_TYPE_4_data, NDR_POINTER_UNIQUE,
 123                 "unknown TYPE_4", -1);
 124
 125         return offset;
 126 }
 127
 128
 129 /*
 130   IDL typedef struct {
 131   IDL   long element_5;
 132   IDL   [size_is(element_5)] [unique] byte *element_6;
 133   IDL } TYPE_3;
 134 */
 135 static int
 136 dissect_browser_TYPE_3_data(tvbuff_t *tvb, int offset,
 137                         packet_info *pinfo, proto_tree *tree,
 138                         char *drep)
 139 {
 140         guint32 len;
 141         dcerpc_info *di;
 142
 143         di=pinfo->private_data;
 144         if(di->conformant_run){
 145                 /* this call is to make ethereal eat the array header for the conformant run */
 146                 offset =dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, NULL);
 147
 148                 return offset;
 149         }
 150
 151         /* this is really the length of the encoded data */
 152         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 153                 hf_browser_unknown_long, &len);
 154         proto_tree_add_item(tree, hf_browser_unknown_bytes, tvb, offset, len,
 155                 FALSE);
 156         offset += len;
 157
 158         return len;
 159 }
 160 static int
 161 dissect_browser_TYPE_3(tvbuff_t *tvb, int offset,
 162                         packet_info *pinfo, proto_tree *tree,
 163                         char *drep)
 164 {
 165         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 166                 hf_browser_unknown_long, NULL);
 167
 168         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 169                 dissect_browser_TYPE_3_data, NDR_POINTER_UNIQUE,
 170                 "unknown TYPE_3", -1);
 171
 172         return offset;
 173 }
 174
 175
 176
 177 /*
 178   IDL typedef [switch_type(long)] union {
 179   IDL   [case(100)] [unique] TYPE_3 *element_3;
 180   IDL   [case(101)] [unique] TYPE_4 *element_4;
 181   IDL } TYPE_2;
 182 */
 183 static int
 184 dissect_browser_TYPE_2(tvbuff_t *tvb, int offset,
 185                         packet_info *pinfo, proto_tree *tree,
 186                         char *drep)
 187 {
 188         guint32 level;
 189
 190         /* this is really the union switch arm */
 191         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 192                 hf_browser_unknown_long, &level);
 193
 194         ALIGN_TO_4_BYTES;
 195
 196         switch(level){
 197         case 100:
 198                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 199                         dissect_browser_TYPE_3, NDR_POINTER_UNIQUE,
 200                         "unknown TYPE_3", -1);
 201                 break;
 202         case 101:
 203                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 204                         dissect_browser_TYPE_4, NDR_POINTER_UNIQUE,
 205                         "unknown TYPE_4", -1);
 206                 break;
 207         }
 208
 209         return offset;
 210 }
 211
 212
 213 /*
 214   IDL typedef struct {
 215   IDL   long element_1;
 216   IDL   TYPE_2 element_2;
 217   IDL } TYPE_1;
 218 */
 219 static int
 220 dissect_browser_TYPE_1(tvbuff_t *tvb, int offset,
 221                         packet_info *pinfo, proto_tree *tree,
 222                         char *drep)
 223 {
 224         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 225                 hf_browser_unknown_long, NULL);
 226
 227         offset = dissect_browser_TYPE_2(tvb, offset, pinfo, tree, drep);
 228
 229         return offset;
 230 }
 231
 232
 233
 234 /*
 235  IDL  long Function_00(
 236  IDL        [in] [unique] [string] wchar_t *element_9,
 237  IDL        [in] [unique] [string] wchar_t *element_10,
 238  IDL        [in] [unique] [string] wchar_t *element_11,
 239  IDL        [in,out] [ref] TYPE_1 *element_12,
 240  IDL        [in] long element_13,
 241  IDL        [out] long element_14,
 242  IDL        [in] long element_15,
 243  IDL        [in] [unique] [string] wchar_t *element_16,
 244  IDL        [in,out] [unique] long *element_17
 245  IDL  );
 246 */
 247 static int
 248 dissect_browser_UNKNOWN_00_rqst(tvbuff_t *tvb, int offset,
 249                         packet_info *pinfo, proto_tree *tree,
 250                         char *drep)
 251 {
 252         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 253                         NDR_POINTER_UNIQUE, "unknown string",
 254                         hf_browser_unknown_string, 0);
 255
 256         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 257                         NDR_POINTER_UNIQUE, "unknown string",
 258                         hf_browser_unknown_string, 0);
 259
 260         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 261                         NDR_POINTER_UNIQUE, "unknown string",
 262                         hf_browser_unknown_string, 0);
 263
 264         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 265                         dissect_browser_TYPE_1, NDR_POINTER_REF,
 266                         "unknown TYPE_1", -1);
 267
 268         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 269                 hf_browser_unknown_long, NULL);
 270
 271         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 272                 hf_browser_unknown_long, NULL);
 273
 274         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 275                         NDR_POINTER_UNIQUE, "unknown string",
 276                         hf_browser_unknown_string, 0);
 277
 278         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 279                         dissect_browser_long_pointer, NDR_POINTER_UNIQUE,
 280                         "unknown long", hf_browser_unknown_long);
 281
 282         return offset;
 283 }
 284 static int
 285 dissect_browser_UNKNOWN_00_reply(tvbuff_t *tvb, int offset,
 286                         packet_info *pinfo, proto_tree *tree,
 287                         char *drep)
 288 {
 289         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 290                         dissect_browser_TYPE_1, NDR_POINTER_REF,
 291                         "unknown TYPE_1", -1);
 292
 293         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 294                 hf_browser_unknown_long, NULL);
 295
 296         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 297                         dissect_browser_long_pointer, NDR_POINTER_UNIQUE,
 298                         "unknown long", hf_browser_unknown_long);
 299
 300         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 301                 hf_browser_rc, NULL);
 302
 303         return offset;
 304 }
 305
 306 /*
 307   IDL long Function_01(
 308   IDL       [in] [unique] [string] wchar_t *element_18,
 309   IDL       [in] long element_19,
 310   IDL       [in] long element_20
 311   IDL );
 312 */
 313 static int
 314 dissect_browser_UNKNOWN_01_rqst(tvbuff_t *tvb, int offset,
 315                         packet_info *pinfo, proto_tree *tree,
 316                         char *drep)
 317 {
 318         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 319                         NDR_POINTER_UNIQUE, "unknown string",
 320                         hf_browser_unknown_string, 0);
 321
 322         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 323                 hf_browser_unknown_long, NULL);
 324
 325         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 326                 hf_browser_unknown_long, NULL);
 327
 328         return offset;
 329 }
 330 static int
 331 dissect_browser_UNKNOWN_01_reply(tvbuff_t *tvb, int offset,
 332                         packet_info *pinfo, proto_tree *tree,
 333                         char *drep)
 334 {
 335         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 336                 hf_browser_rc, NULL);
 337
 338         return offset;
 339 }
 340
 341
 342 /*
 343   IDL long Function_02(
 344   IDL       [in] [unique] [string] wchar_t *element_21,
 345   IDL       [in,out] [ref] TYPE_1 *element_22,
 346   IDL       [out] long element_23
 347   IDL );
 348 */
 349 static int
 350 dissect_browser_UNKNOWN_02_rqst(tvbuff_t *tvb, int offset,
 351                         packet_info *pinfo, proto_tree *tree,
 352                         char *drep)
 353 {
 354         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 355                         NDR_POINTER_UNIQUE, "unknown string",
 356                         hf_browser_unknown_string, 0);
 357
 358         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 359                         dissect_browser_TYPE_1, NDR_POINTER_REF,
 360                         "unknown TYPE_1", -1);
 361
 362         return offset;
 363 }
 364 static int
 365 dissect_browser_UNKNOWN_02_reply(tvbuff_t *tvb, int offset,
 366                         packet_info *pinfo, proto_tree *tree,
 367                         char *drep)
 368 {
 369         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 370                 hf_browser_unknown_long, NULL);
 371
 372         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 373                 hf_browser_rc, NULL);
 374
 375         return offset;
 376 }
 377
 378
 379 /*
 380   IDL long Function_03(
 381   IDL       [in] [unique] [string] wchar_t *element_24
 382   IDL );
 383 */
 384 static int
 385 dissect_browser_UNKNOWN_03_rqst(tvbuff_t *tvb, int offset,
 386                         packet_info *pinfo, proto_tree *tree,
 387                         char *drep)
 388 {
 389         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 390                         NDR_POINTER_UNIQUE, "unknown string",
 391                         hf_browser_unknown_string, 0);
 392
 393         return offset;
 394 }
 395 static int
 396 dissect_browser_UNKNOWN_03_reply(tvbuff_t *tvb, int offset,
 397                         packet_info *pinfo, proto_tree *tree,
 398                         char *drep)
 399 {
 400         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 401                 hf_browser_rc, NULL);
 402
 403         return offset;
 404 }
 405
 406
 407 /*
 408   IDL long Function_04(
 409   IDL       [in] [unique] [string] wchar_t *element_25,
 410   IDL       [in] [string] char element_26
 411   IDL );
 412 */
 413 static int
 414 dissect_browser_UNKNOWN_04_rqst(tvbuff_t *tvb, int offset,
 415                         packet_info *pinfo, proto_tree *tree,
 416                         char *drep)
 417 {
 418         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 419                         NDR_POINTER_UNIQUE, "unknown string",
 420                         hf_browser_unknown_string, 0);
 421
 422         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 423                         NDR_POINTER_REF, "unknown string",
 424                         hf_browser_unknown_string, 0);
 425
 426         return offset;
 427 }
 428 static int
 429 dissect_browser_UNKNOWN_04_reply(tvbuff_t *tvb, int offset,
 430                         packet_info *pinfo, proto_tree *tree,
 431                         char *drep)
 432 {
 433         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 434                 hf_browser_rc, NULL);
 435
 436         return offset;
 437 }
 438
 439
 440
 441 /*
 442   IDL typedef struct {
 443   IDL   TYPE_6 element_27;
 444   IDL   TYPE_6 element_28;
 445   IDL   TYPE_6 element_29;
 446   IDL   long element_30;
 447   IDL   long element_31;
 448   IDL   long element_32;
 449   IDL   long element_33;
 450   IDL   long element_34;
 451   IDL   long element_35;
 452   IDL   long element_36;
 453   IDL   long element_37;
 454   IDL   long element_38;
 455   IDL   long element_39;
 456   IDL   long element_40;
 457   IDL   long element_41;
 458   IDL   long element_42;
 459   IDL   long element_43;
 460   IDL   long element_44;
 461   IDL   TYPE_6 element_45;
 462   IDL } TYPE_5;
 463   IDL
 464   IDL typedef struct {
 465   IDL   hyper element_46;
 466   IDL } TYPE_6;
 467 */
 468 static int
 469 dissect_browser_TYPE_5(tvbuff_t *tvb, int offset,
 470                         packet_info *pinfo, proto_tree *tree,
 471                         char *drep)
 472 {
 473         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 474                 hf_browser_unknown_hyper, NULL);
 475
 476         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 477                 hf_browser_unknown_hyper, NULL);
 478
 479         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 480                 hf_browser_unknown_hyper, NULL);
 481
 482         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 483                 hf_browser_unknown_long, NULL);
 484
 485         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 486                 hf_browser_unknown_long, NULL);
 487
 488         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 489                 hf_browser_unknown_long, NULL);
 490
 491         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 492                 hf_browser_unknown_long, NULL);
 493
 494         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 495                 hf_browser_unknown_long, NULL);
 496
 497         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 498                 hf_browser_unknown_long, NULL);
 499
 500         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 501                 hf_browser_unknown_long, NULL);
 502
 503         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 504                 hf_browser_unknown_long, NULL);
 505
 506         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 507                 hf_browser_unknown_long, NULL);
 508
 509         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 510                 hf_browser_unknown_long, NULL);
 511
 512         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 513                 hf_browser_unknown_long, NULL);
 514
 515         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 516                 hf_browser_unknown_long, NULL);
 517
 518         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 519                 hf_browser_unknown_long, NULL);
 520
 521         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 522                 hf_browser_unknown_long, NULL);
 523
 524         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 525                 hf_browser_unknown_long, NULL);
 526
 527         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 528                 hf_browser_unknown_hyper, NULL);
 529
 530         return offset;
 531 }
 532
 533
 534 /*
 535   IDL long Function_05(
 536   IDL       [in] [unique] [string] wchar_t *element_47,
 537   IDL       [out] [ref] TYPE_5 **element_48
 538   IDL );
 539 */
 540 static int
 541 dissect_browser_UNKNOWN_05_rqst(tvbuff_t *tvb, int offset,
 542                         packet_info *pinfo, proto_tree *tree,
 543                         char *drep)
 544 {
 545         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 546                         NDR_POINTER_UNIQUE, "unknown string",
 547                         hf_browser_unknown_string, 0);
 548
 549         return offset;
 550 }
 551 static int
 552 dissect_browser_UNKNOWN_05_reply(tvbuff_t *tvb, int offset,
 553                         packet_info *pinfo, proto_tree *tree,
 554                         char *drep)
 555 {
 556         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 557                         dissect_browser_TYPE_5, NDR_POINTER_UNIQUE,
 558                         "unknown TYPE_5", -1);
 559
 560         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 561                 hf_browser_rc, NULL);
 562
 563         return offset;
 564 }
 565
 566
 567 /*
 568   IDL long Function_06(
 569   IDL       [in] [unique] [string] wchar_t *element_49
 570   IDL );
 571 */
 572 static int
 573 dissect_browser_UNKNOWN_06_rqst(tvbuff_t *tvb, int offset,
 574                         packet_info *pinfo, proto_tree *tree,
 575                         char *drep)
 576 {
 577         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 578                         NDR_POINTER_UNIQUE, "unknown string",
 579                         hf_browser_unknown_string, 0);
 580
 581         return offset;
 582 }
 583 static int
 584 dissect_browser_UNKNOWN_06_reply(tvbuff_t *tvb, int offset,
 585                         packet_info *pinfo, proto_tree *tree,
 586                         char *drep)
 587 {
 588         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 589                 hf_browser_rc, NULL);
 590
 591         return offset;
 592 }
 593
 594
 595 /*
 596   IDL long Function_07(
 597   IDL       [in] [unique] [string] wchar_t *element_49
 598   IDL );
 599 */
 600 static int
 601 dissect_browser_UNKNOWN_07_rqst(tvbuff_t *tvb, int offset,
 602                         packet_info *pinfo, proto_tree *tree,
 603                         char *drep)
 604 {
 605         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 606                         NDR_POINTER_UNIQUE, "unknown string",
 607                         hf_browser_unknown_string, 0);
 608
 609         return offset;
 610 }
 611 static int
 612 dissect_browser_UNKNOWN_07_reply(tvbuff_t *tvb, int offset,
 613                         packet_info *pinfo, proto_tree *tree,
 614                         char *drep)
 615 {
 616         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 617                 hf_browser_rc, NULL);
 618
 619         return offset;
 620 }
 621
 622
 623 /*
 624   IDL typedef struct {
 625   IDL   TYPE_6 element_59;
 626   IDL   TYPE_6 element_60;
 627   IDL   TYPE_6 element_61;
 628   IDL   long element_62;
 629   IDL   long element_63;
 630   IDL   long element_64;
 631   IDL   TYPE_6 element_65;
 632   IDL   long element_66;
 633   IDL   long element_67;
 634   IDL   long element_68;
 635   IDL   long element_69;
 636   IDL   long element_70;
 637   IDL   long element_71;
 638   IDL   long element_72;
 639   IDL   long element_73;
 640   IDL   long element_74;
 641   IDL } TYPE_11;
 642 */
 643 static int
 644 dissect_browser_TYPE_11(tvbuff_t *tvb, int offset,
 645                         packet_info *pinfo, proto_tree *tree,
 646                         char *drep)
 647 {
 648         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 649                 hf_browser_unknown_hyper, NULL);
 650
 651         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 652                 hf_browser_unknown_hyper, NULL);
 653
 654         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 655                 hf_browser_unknown_hyper, NULL);
 656
 657         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 658                 hf_browser_unknown_long, NULL);
 659
 660         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 661                 hf_browser_unknown_long, NULL);
 662
 663         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 664                 hf_browser_unknown_long, NULL);
 665
 666         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 667                 hf_browser_unknown_hyper, NULL);
 668
 669         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 670                 hf_browser_unknown_long, NULL);
 671
 672         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 673                 hf_browser_unknown_long, NULL);
 674
 675         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 676                 hf_browser_unknown_long, NULL);
 677
 678         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 679                 hf_browser_unknown_long, NULL);
 680
 681         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 682                 hf_browser_unknown_long, NULL);
 683
 684         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 685                 hf_browser_unknown_long, NULL);
 686
 687         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 688                 hf_browser_unknown_long, NULL);
 689
 690         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 691                 hf_browser_unknown_long, NULL);
 692
 693         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 694                 hf_browser_unknown_long, NULL);
 695
 696         return offset;
 697 }
 698
 699 /*
 700   IDL typedef struct {
 701   IDL   long element_57;
 702   IDL   [size_is(element_57)] [unique] TYPE_11 *element_58;
 703   IDL } TYPE_10;
 704 */
 705 static int
 706 dissect_browser_TYPE_11_array(tvbuff_t *tvb, int offset,
 707                         packet_info *pinfo, proto_tree *tree,
 708                         char *drep)
 709 {
 710         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 711                 dissect_browser_TYPE_11);
 712
 713         return offset;
 714 }
 715
 716 static int
 717 dissect_browser_TYPE_10(tvbuff_t *tvb, int offset,
 718                         packet_info *pinfo, proto_tree *tree,
 719                         char *drep)
 720 {
 721         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 722                 hf_browser_unknown_long, NULL);
 723
 724         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 725                 dissect_browser_TYPE_11_array, NDR_POINTER_UNIQUE,
 726                 "unknown TYPE_11_ARRAY", -1);
 727
 728         return offset;
 729 }
 730
 731
 732 /*
 733   IDL typedef struct {
 734   IDL   long element_55;
 735   IDL   [size_is(element_55)] [unique] byte *element_56;
 736   IDL } TYPE_9;
 737 */
 738 static int
 739 dissect_browser_TYPE_9_data(tvbuff_t *tvb, int offset,
 740                         packet_info *pinfo, proto_tree *tree,
 741                         char *drep)
 742 {
 743         guint32 len;
 744         dcerpc_info *di;
 745
 746         di=pinfo->private_data;
 747         if(di->conformant_run){
 748                 /* this call is to make ethereal eat the array header for the conformant run */
 749                 offset =dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, NULL);
 750
 751                 return offset;
 752         }
 753
 754         /* this is really the length of the encoded data */
 755         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 756                 hf_browser_unknown_long, &len);
 757
 758         proto_tree_add_item(tree, hf_browser_unknown_bytes, tvb, offset, len,
 759                 FALSE);
 760         offset += len;
 761
 762         return len;
 763 }
 764 static int
 765 dissect_browser_TYPE_9(tvbuff_t *tvb, int offset,
 766                         packet_info *pinfo, proto_tree *tree,
 767                         char *drep)
 768 {
 769         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 770                 hf_browser_unknown_long, NULL);
 771
 772         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 773                 dissect_browser_TYPE_9_data, NDR_POINTER_UNIQUE,
 774                 "unknown TYPE_9", -1);
 775
 776         return offset;
 777 }
 778
 779
 780 /*
 781   IDL typedef [switch_type(long)] union {
 782   IDL   [case(100)] [unique] TYPE_9 *element_53;
 783   IDL   [case(101)] [unique] TYPE_10 *element_54;
 784   IDL } TYPE_8;
 785 */
 786 static int
 787 dissect_browser_TYPE_8(tvbuff_t *tvb, int offset,
 788                         packet_info *pinfo, proto_tree *tree,
 789                         char *drep)
 790 {
 791         guint32 level;
 792
 793         /* this is really the union switch arm */
 794         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 795                 hf_browser_unknown_long, &level);
 796
 797         ALIGN_TO_4_BYTES;
 798
 799         switch(level){
 800         case 100:
 801                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 802                         dissect_browser_TYPE_9, NDR_POINTER_UNIQUE,
 803                         "unknown TYPE_9", -1);
 804                 break;
 805         case 101:
 806                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 807                         dissect_browser_TYPE_10, NDR_POINTER_UNIQUE,
 808                         "unknown TYPE_10", -1);
 809                 break;
 810         }
 811
 812         return offset;
 813 }
 814
 815
 816 /*
 817   IDL typedef struct {
 818   IDL   long element_51;
 819   IDL   TYPE_8 element_52;
 820   IDL } TYPE_7;
 821 */
 822 static int
 823 dissect_browser_TYPE_7(tvbuff_t *tvb, int offset,
 824                         packet_info *pinfo, proto_tree *tree,
 825                         char *drep)
 826 {
 827         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 828                 hf_browser_unknown_long, NULL);
 829
 830         offset = dissect_browser_TYPE_8(tvb, offset, pinfo, tree, drep);
 831
 832         return offset;
 833 }
 834
 835
 836 /*
 837   IDL long Function_08(
 838   IDL       [in] [unique] [string] wchar_t *element_75,
 839   IDL       [in] long element_76,
 840   IDL   [in,out] [ref] TYPE_7 *element_77
 841   IDL );
 842 */
 843 static int
 844 dissect_browser_UNKNOWN_08_rqst(tvbuff_t *tvb, int offset,
 845                         packet_info *pinfo, proto_tree *tree,
 846                         char *drep)
 847 {
 848         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 849                         NDR_POINTER_UNIQUE, "unknown string",
 850                         hf_browser_unknown_string, 0);
 851
 852         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 853                 hf_browser_unknown_long, NULL);
 854
 855         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 856                         dissect_browser_TYPE_7, NDR_POINTER_REF,
 857                         "unknown TYPE_7", -1);
 858
 859         return offset;
 860 }
 861 static int
 862 dissect_browser_UNKNOWN_08_reply(tvbuff_t *tvb, int offset,
 863                         packet_info *pinfo, proto_tree *tree,
 864                         char *drep)
 865 {
 866         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 867                         dissect_browser_TYPE_7, NDR_POINTER_REF,
 868                         "unknown TYPE_7", -1);
 869
 870         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 871                 hf_browser_rc, NULL);
 872
 873         return offset;
 874 }
 875
 876
 877 /*
 878   IDL long Function_09(
 879   IDL       [in] [unique] [string] wchar_t *element_78,
 880   IDL       [in] [ref] [string] wchar_t *element_79,
 881   IDL       [in] [unique] [string] wchar_t *element_80,
 882   IDL       [in] long element_81
 883   IDL );
 884 */
 885 static int
 886 dissect_browser_UNKNOWN_09_rqst(tvbuff_t *tvb, int offset,
 887                         packet_info *pinfo, proto_tree *tree,
 888                         char *drep)
 889 {
 890         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 891                         NDR_POINTER_UNIQUE, "unknown string",
 892                         hf_browser_unknown_string, 0);
 893
 894         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 895                         NDR_POINTER_REF, "unknown string",
 896                         hf_browser_unknown_string, 0);
 897
 898         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 899                         NDR_POINTER_UNIQUE, "unknown string",
 900                         hf_browser_unknown_string, 0);
 901
 902         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 903                 hf_browser_unknown_long, NULL);
 904
 905         return offset;
 906 }
 907 static int
 908 dissect_browser_UNKNOWN_09_reply(tvbuff_t *tvb, int offset,
 909                         packet_info *pinfo, proto_tree *tree,
 910                         char *drep)
 911 {
 912         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 913                 hf_browser_rc, NULL);
 914
 915         return offset;
 916 }
 917
 918
 919
 920
 921 /*
 922   IDL typedef struct {
 923   IDL   long element_82;
 924   IDL   [size_is(element_82)] [unique] byte *element_83;
 925   IDL } TYPE_12;
 926 */
 927 static int
 928 dissect_browser_TYPE_12_data(tvbuff_t *tvb, int offset,
 929                         packet_info *pinfo, proto_tree *tree,
 930                         char *drep)
 931 {
 932         guint32 len;
 933         dcerpc_info *di;
 934
 935         di=pinfo->private_data;
 936         if(di->conformant_run){
 937                 /* this call is to make ethereal eat the array header for the conformant run */
 938                 offset =dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, NULL);
 939
 940                 return offset;
 941         }
 942
 943         /* this is really the length of the encoded data */
 944         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 945                 hf_browser_unknown_long, &len);
 946
 947         proto_tree_add_item(tree, hf_browser_unknown_bytes, tvb, offset, len,
 948                 FALSE);
 949         offset += len;
 950
 951         return len;
 952 }
 953 static int
 954 dissect_browser_TYPE_12(tvbuff_t *tvb, int offset,
 955                         packet_info *pinfo, proto_tree *tree,
 956                         char *drep)
 957 {
 958         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 959                 hf_browser_unknown_long, NULL);
 960
 961         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 962                 dissect_browser_TYPE_12_data, NDR_POINTER_UNIQUE,
 963                 "unknown TYPE_12", -1);
 964
 965         return offset;
 966 }
 967
 968
 969 /*
 970   IDL long Function_0a(
 971   IDL       [in] [unique] [string] wchar_t *element_84,
 972   IDL       [in,out] [ref] TYPE_12 *element_85
 973   );
 974 */
 975 static int
 976 dissect_browser_UNKNOWN_0a_rqst(tvbuff_t *tvb, int offset,
 977                         packet_info *pinfo, proto_tree *tree,
 978                         char *drep)
 979 {
 980         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 981                         NDR_POINTER_UNIQUE, "unknown string",
 982                         hf_browser_unknown_string, 0);
 983
 984         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 985                         dissect_browser_TYPE_12, NDR_POINTER_REF,
 986                         "unknown TYPE_12", -1);
 987
 988         return offset;
 989 }
 990 static int
 991 dissect_browser_UNKNOWN_0a_reply(tvbuff_t *tvb, int offset,
 992                         packet_info *pinfo, proto_tree *tree,
 993                         char *drep)
 994 {
 995         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 996                         dissect_browser_TYPE_12, NDR_POINTER_REF,
 997                         "unknown TYPE_12", -1);
 998
 999         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1000                 hf_browser_rc, NULL);
1001
1002         return offset;
1003 }
1004
1005
1006 /*
1007   IDL long Function_0b(
1008   IDL       [in] [unique] [string] wchar_t *element_86,
1009   IDL       [in] [unique] [string] wchar_t *element_87,
1010   IDL       [in] [unique] [string] wchar_t *element_88,
1011   IDL       [in,out] [ref] TYPE_1 *element_89,
1012   IDL       [in] long element_90,
1013   IDL       [out] long element_91,
1014   IDL       [in] long element_92,
1015   IDL       [in] [unique] [string] wchar_t *element_93,
1016   IDL       [in] [unique] [string] wchar_t *element_94
1017   IDL );
1018 */
1019 static int
1020 dissect_browser_UNKNOWN_0b_rqst(tvbuff_t *tvb, int offset,
1021                         packet_info *pinfo, proto_tree *tree,
1022                         char *drep)
1023 {
1024         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1025                         NDR_POINTER_UNIQUE, "unknown string",
1026                         hf_browser_unknown_string, 0);
1027
1028         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1029                         NDR_POINTER_UNIQUE, "unknown string",
1030                         hf_browser_unknown_string, 0);
1031
1032         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1033                         NDR_POINTER_UNIQUE, "unknown string",
1034                         hf_browser_unknown_string, 0);
1035
1036         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1037                         dissect_browser_TYPE_1, NDR_POINTER_REF,
1038                         "unknown TYPE_1", -1);
1039
1040         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1041                 hf_browser_unknown_long, NULL);
1042
1043         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1044                 hf_browser_unknown_long, NULL);
1045
1046         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1047                         NDR_POINTER_UNIQUE, "unknown string",
1048                         hf_browser_unknown_string, 0);
1049
1050         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1051                         NDR_POINTER_UNIQUE, "unknown string",
1052                         hf_browser_unknown_string, 0);
1053
1054         return offset;
1055 }
1056 static int
1057 dissect_browser_UNKNOWN_0b_reply(tvbuff_t *tvb, int offset,
1058                         packet_info *pinfo, proto_tree *tree,
1059                         char *drep)
1060 {
1061         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1062                         dissect_browser_TYPE_1, NDR_POINTER_REF,
1063                         "unknown TYPE_1", -1);
1064
1065         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1066                 hf_browser_unknown_long, NULL);
1067
1068         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1069                 hf_browser_rc, NULL);
1070
1071         return offset;
1072 }
1073
1074
1075
1076 /*
1077   IDL }
1078 */
1079 static dcerpc_sub_dissector dcerpc_browser_dissectors[] = {
1080         { BROWSER_UNKNOWN_00, "BROWSER_UNKNOWN_00",
1081                 dissect_browser_UNKNOWN_00_rqst,
1082                 dissect_browser_UNKNOWN_00_reply },
1083         { BROWSER_UNKNOWN_01, "BROWSER_UNKNOWN_01",
1084                 dissect_browser_UNKNOWN_01_rqst,
1085                 dissect_browser_UNKNOWN_01_reply },
1086         { BROWSER_UNKNOWN_02, "BROWSER_UNKNOWN_02",
1087                 dissect_browser_UNKNOWN_02_rqst,
1088                 dissect_browser_UNKNOWN_02_reply },
1089         { BROWSER_UNKNOWN_03, "BROWSER_UNKNOWN_03",
1090                 dissect_browser_UNKNOWN_03_rqst,
1091                 dissect_browser_UNKNOWN_03_reply },
1092         { BROWSER_UNKNOWN_04, "BROWSER_UNKNOWN_04",
1093                 dissect_browser_UNKNOWN_04_rqst,
1094                 dissect_browser_UNKNOWN_04_reply },
1095         { BROWSER_UNKNOWN_05, "BROWSER_UNKNOWN_05",
1096                 dissect_browser_UNKNOWN_05_rqst,
1097                 dissect_browser_UNKNOWN_05_reply },
1098         { BROWSER_UNKNOWN_06, "BROWSER_UNKNOWN_06",
1099                 dissect_browser_UNKNOWN_06_rqst,
1100                 dissect_browser_UNKNOWN_06_reply },
1101         { BROWSER_UNKNOWN_07, "BROWSER_UNKNOWN_07",
1102                 dissect_browser_UNKNOWN_07_rqst,
1103                 dissect_browser_UNKNOWN_07_reply },
1104         { BROWSER_UNKNOWN_08, "BROWSER_UNKNOWN_08",
1105                 dissect_browser_UNKNOWN_08_rqst,
1106                 dissect_browser_UNKNOWN_08_reply },
1107         { BROWSER_UNKNOWN_09, "BROWSER_UNKNOWN_09",
1108                 dissect_browser_UNKNOWN_09_rqst,
1109                 dissect_browser_UNKNOWN_09_reply },
1110         { BROWSER_UNKNOWN_0a, "BROWSER_UNKNOWN_0a",
1111                 dissect_browser_UNKNOWN_0a_rqst,
1112                 dissect_browser_UNKNOWN_0a_reply },
1113         { BROWSER_UNKNOWN_0b, "BROWSER_UNKNOWN_0b",
1114                 dissect_browser_UNKNOWN_0b_rqst,
1115                 dissect_browser_UNKNOWN_0b_reply },
1116
1117         {0, NULL, NULL,  NULL }
1118 };
1119
1120 void
1121 proto_register_dcerpc_browser(void)
1122 {
1123 static hf_register_info hf[] = {
1124         { &hf_browser_rc, {
1125                 "Return code", "rpc_browser.rc", FT_UINT32, BASE_HEX,
1126                 VALS(NT_errors), 0x0, "Browser return code", HFILL }},
1127
1128         { &hf_browser_unknown_long, {
1129                 "Unknown long", "rpc_browser.unknown.long", FT_UINT32, BASE_HEX,
1130                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
1131
1132         { &hf_browser_unknown_hyper, {
1133                 "Unknown hyper", "rpc_browser.unknown.hyper", FT_UINT64, BASE_HEX,
1134                 NULL, 0x0, "Unknown hyper. If you know what this is, contact ethereal developers.", HFILL }},
1135
1136         { &hf_browser_unknown_bytes, {
1137                 "Unknown bytes", "rpc_browser.unknown.bytes", FT_BYTES, BASE_HEX,
1138                 NULL, 0x0, "Unknown bytes. If you know what this is, contact ethereal developers.", HFILL }},
1139
1140         { &hf_browser_unknown_string, {
1141                 "Unknown string", "rpc_browser.unknown.string", FT_STRING, BASE_HEX,
1142                 NULL, 0x0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }}
1143
1144         };
1145         static gint *ett[] = {
1146                 &ett_dcerpc_browser
1147         };
1148
1149         proto_dcerpc_browser = proto_register_protocol(
1150                 "RPC Browser", "RPC_BROWSER", "rpc_browser");
1151
1152         proto_register_field_array(proto_dcerpc_browser, hf,
1153                                    array_length(hf));
1154         proto_register_subtree_array(ett, array_length(ett));
1155 }
1156
1157 void
1158 proto_reg_handoff_dcerpc_browser(void)
1159 {
1160         /* Register protocol as dcerpc */
1161
1162         dcerpc_init_uuid(proto_dcerpc_browser, ett_dcerpc_browser,
1163                          &uuid_dcerpc_browser, ver_dcerpc_browser,
1164                          dcerpc_browser_dissectors, -1);
1165 }