packet-dcerpc-nt.h

   1 /* packet-dcerpc-nt.h
   2  * Routines for DCERPC over SMB packet disassembly
   3  * Copyright 2001-2003 Tim Potter <tpot@samba.org>
   4  *
   5  * $Id: packet-dcerpc-nt.h,v 1.47 2003/06/05 04:22:03 guy Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 #ifndef __PACKET_DCERPC_NT_H
  27 #define __PACKET_DCERPC_NT_H
  28
  29 /*
  30  * ett_ value for Unicode strings.
  31  */
  32 extern gint ett_nt_unicode_string;
  33
  34 /*
  35  * Platform ID values, used by several dissectors.
  36  */
  37 extern const value_string platform_id_vals[];
  38
  39 /* Routines for handling deferral of referants in NDR */
  40
  41 #define ALIGN_TO_4_BYTES \
  42         { dcerpc_info *xzdi; \
  43           xzdi=pinfo->private_data; \
  44           if(!xzdi->conformant_run) { \
  45                 if(offset&0x03) { \
  46                         offset=(offset&0xfffffffc)+4; \
  47                 } \
  48           } \
  49         }
  50
  51 int
  52 dissect_ndr_counted_string_cb(tvbuff_t *tvb, int offset,
  53                               packet_info *pinfo, proto_tree *tree,
  54                               char *drep, int hf_index,
  55                               dcerpc_callback_fnct_t *callback,
  56                               void *callback_args);
  57
  58 int
  59 dissect_ndr_counted_string_ptr(tvbuff_t *tvb, int offset,
  60                                packet_info *pinfo, proto_tree *parent_tree,
  61                                char *drep);
  62
  63 int
  64 dissect_ndr_counted_string(tvbuff_t *tvb, int offset,
  65                            packet_info *pinfo, proto_tree *parent_tree,
  66                            char *drep, int hf_index, int levels);
  67
  68 int
  69 dissect_ndr_counted_byte_array(tvbuff_t *tvb, int offset,
  70                                packet_info *pinfo, proto_tree *parent_tree,
  71                                char *drep, int hf_index);
  72
  73 int
  74 dissect_ndr_counted_byte_array_cb(tvbuff_t *tvb, int offset,
  75                                   packet_info *pinfo, proto_tree *tree,
  76                                   char *drep, int hf_index,
  77                                   dcerpc_callback_fnct_t *callback,
  78                                   void *callback_args);
  79
  80 int
  81 dissect_ndr_nt_acct_ctrl(tvbuff_t *tvb, int offset, packet_info *pinfo,
  82                         proto_tree *parent_tree, char *drep);
  83 int
  84 dissect_ndr_nt_NTTIME (tvbuff_t *tvb, int offset,
  85                         packet_info *pinfo, proto_tree *tree,
  86                         char *drep, int hf_index);
  87 int
  88 dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset,
  89                         packet_info *pinfo, proto_tree *parent_tree,
  90                         char *drep);
  91 int
  92 dissect_ndr_nt_SID(tvbuff_t *tvb, int offset,
  93                         packet_info *pinfo, proto_tree *tree,
  94                         char *drep, int hf_sid);
  95 int
  96 dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset,
  97                              packet_info *pinfo, proto_tree *parent_tree,
  98                              char *drep, int hf_sid);
  99 int
 100 dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset,
 101                         packet_info *pinfo, proto_tree *parent_tree,
 102                         char *drep);
 103
 104 int
 105 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
 106                         packet_info *pinfo, proto_tree *parent_tree,
 107                         char *drep);
 108 int
 109 dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
 110                         packet_info *pinfo, proto_tree *parent_tree,
 111                         char *drep);
 112
 113 /*
 114  * Policy handle hashing
 115  */
 116
 117 /* Store open and close packet numbers for a policy handle */
 118
 119 void
 120 dcerpc_smb_store_pol_pkts(e_ctx_hnd *policy_hnd, packet_info *pinfo,
 121                           gboolean is_open, gboolean is_close);
 122
 123 /* Store a name with a policy handle */
 124
 125 void
 126 dcerpc_smb_store_pol_name(e_ctx_hnd *policy_hnd, packet_info *pinfo,
 127                           char *name);
 128
 129 /* Fetch details stored with a policy handle */
 130
 131 gboolean
 132 dcerpc_smb_fetch_pol(e_ctx_hnd *policy_hnd, char **name,
 133                      guint32 *open_frame, guint32 *close_frame,
 134                      guint32 cur_frame);
 135
 136 /* Check for unparsed data at the end of a frame */
 137
 138 void
 139 dcerpc_smb_check_long_frame(tvbuff_t *tvb, int offset,
 140                             packet_info *pinfo, proto_tree *tree);
 141
 142 /* Dissect NT specific things */
 143
 144 int
 145 dissect_ntstatus(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 146                  proto_tree *tree, char *drep,
 147                  int hfindex, guint32 *pdata);
 148
 149 int
 150 dissect_doserror(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 151                  proto_tree *tree, char *drep,
 152                  int hfindex, guint32 *pdata);
 153
 154 int
 155 dissect_nt_policy_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 156                       proto_tree *tree, char *drep, int hfindex,
 157                       e_ctx_hnd *pdata, proto_item **pitem,
 158                       gboolean is_open, gboolean is_close);
 159
 160 int
 161 dissect_nt_GUID(tvbuff_t *tvb, int offset,
 162                         packet_info *pinfo, proto_tree *parent_tree,
 163                         char *drep);
 164
 165 int
 166 dissect_nt_LUID(tvbuff_t *tvb, int offset,
 167                         packet_info *pinfo, proto_tree *tree,
 168                         char *drep);
 169
 170 /* Stored here instead of packet-dcerpc{,-ndr}.c as they are probably not
 171    official NDR representations. */
 172
 173 int dissect_dcerpc_uint8s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 174                           proto_tree *tree, char *drep,
 175                           int hfindex, int length, const guint8 **pdata);
 176
 177 int dissect_ndr_uint8s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 178                        proto_tree *tree, char *drep,
 179                        int hfindex, int length, const guint8 **pdata);
 180
 181 int dissect_dcerpc_uint16s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 182                            proto_tree *tree, char *drep,
 183                            int hfindex, int length);
 184
 185 int dissect_ndr_uint16s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 186                         proto_tree *tree, char *drep,
 187                         int hfindex, int length);
 188
 189 int dissect_ndr_str_pointer_item(tvbuff_t *tvb, gint offset,
 190                                  packet_info *pinfo, proto_tree *tree,
 191                                  char *drep, int type, char *text,
 192                                  int hf_index, int levels);
 193
 194 /*
 195  * Helper routines for dissecting NDR strings
 196  */
 197
 198 /* Number of levels to go up appending string to pointer item */
 199 #define CB_STR_ITEM_LEVELS(x)   ((x) & 0xFFFF)
 200 #define CB_STR_COL_INFO 0x10000 /* Append string to COL_INFO */
 201 #define CB_STR_SAVE     0x20000 /* Save string to dcv->private_data */
 202
 203 void cb_wstr_postprocess(packet_info *pinfo, proto_tree *tree _U_,
 204                         proto_item *item, tvbuff_t *tvb,
 205                         int start_offset, int end_offset,
 206                         void *callback_args);
 207 void cb_str_postprocess(packet_info *pinfo, proto_tree *tree _U_,
 208                         proto_item *item, tvbuff_t *tvb,
 209                         int start_offset, int end_offset,
 210                         void *callback_args);
 211
 212 /* Initialise DCERPC over SMB */
 213
 214 void dcerpc_smb_init(int proto_dcerpc);
 215
 216 #endif /* packet-dcerpc-nt.h */