/* packet-dcerpc-lsa-ds.c
* Routines for SMB \PIPE\lsarpc packet disassembly
- * Copyright 2002, Tim Potter <tpot@samba.org>
+ * Copyright 2002-2003, Tim Potter <tpot@samba.org>
+ * Copyright 2002, Jim McDonough <jmcd@samba.org>
*
- * $Id: packet-dcerpc-lsa-ds.c,v 1.2 2002/11/02 22:55:49 guy Exp $
+ * $Id: packet-dcerpc-lsa-ds.c,v 1.11 2003/06/26 04:30:27 tpot Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
#include <epan/packet.h>
#include "packet-dcerpc.h"
#include "packet-dcerpc-nt.h"
+#include "smb.h"
+
+#define LSA_DS_DSROLEGETDOMINFO 0x0000
+
+#define LSA_DS_DSROLE_BASIC_INFO 0x0001
+#define LSA_DS_DSROLE_UPGRADE_STATUS 0x0002
+#define LSA_DS_DSROLE_OP_STATUS 0x0003
static int proto_dcerpc_lsa_ds = -1;
+static int hf_lsa_ds_opnum = -1;
+static int hf_lsa_ds_dominfo_level = -1;
+static int hf_lsa_ds_machine_role = -1;
+static int hf_lsa_ds_dominfo_flags = -1;
+static int hf_lsa_ds_dominfo_netb_name = -1;
+static int hf_lsa_ds_dominfo_dns_name = -1;
+static int hf_lsa_ds_dominfo_forest_name = -1;
+static int hf_lsa_ds_upgrade_state = -1;
+static int hf_lsa_ds_previous_role = -1;
+static int hf_lsa_ds_op_status = -1;
+static int hf_lsa_ds_rc = -1;
+
static gint ett_dcerpc_lsa_ds = -1;
+static gint ett_lsa_ds_domain_info = -1;
+static gint ett_lsa_ds_basic_domain_info = -1;
+static gint ett_lsa_ds_upgrade_status = -1;
+static gint ett_lsa_ds_op_status = -1;
+
+static int
+lsa_ds_dissect_DSROLE_BASIC_INFO(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *parent_tree, char *drep)
+{
+ proto_item *item=NULL;
+ proto_tree *tree=NULL;
+ int old_offset=offset;
+
+ if(parent_tree){
+ item = proto_tree_add_text(parent_tree, tvb, offset, -1,
+ "DSROLE_BASIC_DOMAIN_INFO:");
+ tree = proto_item_add_subtree(item,
+ ett_lsa_ds_basic_domain_info);
+ }
+
+ ALIGN_TO_4_BYTES;
+ /* role */
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_lsa_ds_machine_role, 0);
+
+ /* flags */
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_ds_dominfo_flags, 0);
+
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "NetBIOS domain name pointer",
+ hf_lsa_ds_dominfo_netb_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "DNS domain pointer",
+ hf_lsa_ds_dominfo_dns_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "DNS forest name pointer",
+ hf_lsa_ds_dominfo_forest_name, 0);
+
+ /* GUID */
+ offset = dissect_nt_GUID(tvb, offset, pinfo, tree, drep);
+
+ proto_item_set_len(item, offset-old_offset);
+ return offset;
+}
+
+static int
+lsa_ds_dissect_DSROLE_UPGRADE_STATUS(tvbuff_t *tvb, int offset,
+ packet_info *pinfo,
+ proto_tree *parent_tree, char *drep)
+{
+ proto_item *item=NULL;
+ proto_tree *tree=NULL;
+ int old_offset=offset;
+
+ if(parent_tree){
+ item = proto_tree_add_text(parent_tree, tvb, offset, -1,
+ "DSROLE_UPGRADE_STATUS:");
+ tree = proto_item_add_subtree(item,
+ ett_lsa_ds_upgrade_status);
+ }
+
+ offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_ds_upgrade_state, NULL);
+ offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_ds_previous_role, NULL);
+ proto_item_set_len(item, offset-old_offset);
+
+ return offset;
+}
+
+static int
+lsa_ds_dissect_DSROLE_OP_STATUS(tvbuff_t *tvb, int offset,
+ packet_info *pinfo,
+ proto_tree *parent_tree, char *drep)
+{
+ proto_item *item=NULL;
+ proto_tree *tree=NULL;
+ int old_offset=offset;
+
+ if(parent_tree){
+ item = proto_tree_add_text(parent_tree, tvb, offset, -1,
+ "DSROLE_OP_STATUS:");
+ tree = proto_item_add_subtree(item,
+ ett_lsa_ds_op_status);
+ }
+ offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_ds_op_status, NULL);
+ proto_item_set_len(item, offset-old_offset);
+
+ return offset;
+}
+
+static int
+lsa_ds_dissect_DS_DOMINFO_CTR(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *parent_tree, char *drep)
+{
+ proto_item *item=NULL;
+ proto_tree *tree=NULL;
+ int old_offset=offset;
+ guint16 level;
+
+ if(parent_tree){
+ item = proto_tree_add_text(parent_tree, tvb, offset, -1,
+ "DOMAIN_INFO:");
+ tree = proto_item_add_subtree(item, ett_lsa_ds_domain_info);
+ }
+
+ offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_ds_dominfo_level, &level);
+
+ switch(level){
+ case LSA_DS_DSROLE_BASIC_INFO:
+ offset = lsa_ds_dissect_DSROLE_BASIC_INFO(
+ tvb, offset, pinfo, tree, drep);
+ break;
+ case LSA_DS_DSROLE_UPGRADE_STATUS:
+ offset = lsa_ds_dissect_DSROLE_UPGRADE_STATUS(
+ tvb, offset, pinfo, tree, drep);
+ break;
+ case LSA_DS_DSROLE_OP_STATUS:
+ offset = lsa_ds_dissect_DSROLE_OP_STATUS(
+ tvb, offset, pinfo, tree, drep);
+ break;
+ }
+ proto_item_set_len(item, offset-old_offset);
+
+ return offset;
+}
+
+static int
+lsa_ds_dissect_role_get_dom_info_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ guint16 level;
+
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_lsa_ds_dominfo_level, &level);
+
+ if (check_col(pinfo->cinfo, COL_INFO))
+ col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
+
+ return offset;
+}
+
+static int
+lsa_ds_dissect_role_get_dom_info_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_ds_dissect_DS_DOMINFO_CTR, NDR_POINTER_UNIQUE,
+ "DOMAIN_INFORMATION pointer", -1);
+
+ offset = dissect_ntstatus(
+ tvb, offset, pinfo, tree, drep, hf_lsa_ds_rc, NULL);
+
+ return offset;
+}
+
+static const value_string lsa_ds_dominfo_levels[] = {
+ { LSA_DS_DSROLE_BASIC_INFO, "DsRoleBasicInfo"},
+ { LSA_DS_DSROLE_UPGRADE_STATUS, "DsRoleUpgradeStatus"},
+ { LSA_DS_DSROLE_OP_STATUS, "DsRoleOpStatus"},
+ { 0, NULL }
+};
+
+static const value_string lsa_ds_role_vals[] = {
+ { 0, "Standalone Workstation" },
+ { 1, "Domain Member Workstation" },
+ { 2, "Standalone Server" },
+ { 3, "Domain Member Server" },
+ { 4, "Backup Domain Controller" },
+ { 5, "Primary Domain Controller" },
+ { 0, NULL }
+};
+
+static const value_string lsa_ds_upgrade_vals[] = {
+ { 0, "Not currently upgrading"},
+ { 1, "Upgrade in progress"},
+ { 0, NULL }
+};
+
+static const value_string lsa_ds_previous_roles[] = {
+ { 0, "Unknown state" },
+ { 1, "Primary" },
+ { 2, "Backup" },
+ { 0, NULL }
+};
+
+static const value_string lsa_ds_op_states[] = {
+ { 0, "Idle" },
+ { 1, "Active" },
+ { 2, "Needs reboot" },
+ { 0, NULL }
+};
void
proto_register_dcerpc_lsa_ds(void)
{
+ static hf_register_info hf[] = {
+
+ { &hf_lsa_ds_opnum,
+ { "Operation", "ls_ads.opnum", FT_UINT16, BASE_DEC,
+ NULL, 0x0, "Operation", HFILL }},
+
+ { &hf_lsa_ds_dominfo_level,
+ { "Level", "lsa_ds.dominfo.level", FT_UINT16, BASE_DEC,
+ VALS(lsa_ds_dominfo_levels), 0x0,
+ "Information level of requested data", HFILL }},
+
+ { &hf_lsa_ds_machine_role,
+ { "Machine role", "lsa_ds.role", FT_UINT16, BASE_HEX,
+ VALS(lsa_ds_role_vals), 0x0, "Role of machine in domain", HFILL}},
+
+ { &hf_lsa_ds_dominfo_flags,
+ { "Flags", "lsa_ds.dominfo.flags", FT_UINT32, BASE_HEX,
+ NULL, 0x0, "Machine flags", HFILL }},
+
+ { &hf_lsa_ds_dominfo_netb_name,
+ { "Netbios name", "lsa_ds.dominfo.nbname", FT_STRING, BASE_NONE,
+ NULL, 0x0, "Netbios Domain Name", HFILL}},
+
+ { &hf_lsa_ds_dominfo_dns_name,
+ { "DNS name", "lsa_ds.dominfo.dnsname", FT_STRING, BASE_NONE,
+ NULL, 0x0, "DNS Domain Name", HFILL}},
+
+ { &hf_lsa_ds_dominfo_forest_name,
+ { "Forest name", "lsa_ds.dominfo.forest", FT_STRING, BASE_NONE,
+ NULL, 0x0, "DNS Forest Name", HFILL}},
+
+ { &hf_lsa_ds_upgrade_state,
+ { "Upgrading", "ls_ads.upgrading", FT_UINT32, BASE_DEC,
+ VALS(lsa_ds_upgrade_vals), 0x0, "Upgrade State", HFILL }},
+
+ { &hf_lsa_ds_previous_role,
+ { "Previous role", "ls_ads.upgrading", FT_UINT16, BASE_DEC,
+ VALS(lsa_ds_previous_roles), 0x0,
+ "Previous server role before upgrade", HFILL }},
+
+ { &hf_lsa_ds_op_status,
+ { "Operational status", "ls_ads.op_status", FT_UINT16, BASE_DEC,
+ VALS(lsa_ds_op_states), 0x0,
+ "Current operational status", HFILL }},
+
+ { &hf_lsa_ds_rc,
+ { "Return code", "lsa_ds.rc", FT_UINT32, BASE_HEX,
+ VALS (NT_errors), 0x0, "LSA_DS return status code", HFILL }},
+ };
+
static gint *ett[] = {
- &ett_dcerpc_lsa_ds
+ &ett_dcerpc_lsa_ds,
+ &ett_lsa_ds_domain_info,
+ &ett_lsa_ds_basic_domain_info,
+ &ett_lsa_ds_upgrade_status,
+ &ett_lsa_ds_op_status
};
proto_dcerpc_lsa_ds = proto_register_protocol(
"Microsoft Local Security Architecture (Directory Services)",
"LSA_DS", "lsa_ds");
+ proto_register_field_array(proto_dcerpc_lsa_ds, hf, array_length(hf));
proto_register_subtree_array(ett, array_length(ett));
}
static guint16 ver_dcerpc_lsa_ds = 0;
static dcerpc_sub_dissector lsa_ds_dissectors[] = {
- { 0, NULL, NULL, NULL },
+ { LSA_DS_DSROLEGETDOMINFO, "DsRoleGetDomInfo",
+ lsa_ds_dissect_role_get_dom_info_rqst,
+ lsa_ds_dissect_role_get_dom_info_reply },
+ { 0, NULL, NULL, NULL },
};
void
proto_reg_handoff_dcerpc_lsa_ds(void)
{
+ header_field_info *hf_info;
+
/* Register protocol as dcerpc */
dcerpc_init_uuid(proto_dcerpc_lsa_ds, ett_dcerpc_lsa_ds,
&uuid_dcerpc_lsa_ds, ver_dcerpc_lsa_ds,
- lsa_ds_dissectors, -1);
+ lsa_ds_dissectors, hf_lsa_ds_opnum);
+
+ /* Set opnum strings from subdissector list */
+
+ hf_info = proto_registrar_get_nth(hf_lsa_ds_opnum);
+ hf_info->strings = value_string_from_subdissectors(
+ lsa_ds_dissectors, array_length(lsa_ds_dissectors));
}
git.samba.org / metze / wireshark / wip.git / blobdiff