From Todd Sabin:

	add "dissect_ndr_ctx_hnd()" for dissecting context handles, and
	use it in various DCERPC dissectors;

	beef up the MS Security Account Manager dissector.

Also, export "NT_errors[]" for use by that dissector.

svn path=/trunk/; revision=4350

diff --git a/packet-dcerpc-epm.c b/packet-dcerpc-epm.c
index c16b05a14d0a3f3a1036d17c12f2989bf519a78b..26af6a669dc584200d515607602728f30d4314c8 100644 (file)
--- a/packet-dcerpc-epm.c
+++ b/packet-dcerpc-epm.c
@@ -2,7 +2,7 @@
  * Routines for dcerpc endpoint mapper dissection
  * Copyright 2001, Todd Sabin <tas@webspan.net>
  *
- * $Id: packet-dcerpc-epm.c,v 1.2 2001/11/27 09:27:29 guy Exp $
+ * $Id: packet-dcerpc-epm.c,v 1.3 2001/12/06 23:30:35 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -105,12 +105,9 @@ epm_dissect_ept_lookup_resp (tvbuff_t *tvb, int offset,
 {
     guint32 dummy;
 
-    /* need a dissect_ndr_ctx_handle */
-    if (tree) {
-        proto_tree_add_bytes (tree, hf_epm_lookup_hnd, tvb, offset, 20,
-                              tvb_get_ptr (tvb, offset, 20));
-    }
-    offset += 20;
+
+    offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
+                                  hf_epm_lookup_hnd, NULL);
 
     offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
                                  hf_epm_num_ents, NULL);

diff --git a/packet-dcerpc-ndr.c b/packet-dcerpc-ndr.c
index 1db0672b6ee7698bd64f481a1089906ca05b2446..c1e80458cdc58aa60909123f935523f997d73686 100644 (file)
--- a/packet-dcerpc-ndr.c
+++ b/packet-dcerpc-ndr.c
@@ -2,7 +2,7 @@
  * Routines for DCERPC NDR dissection
  * Copyright 2001, Todd Sabin <tas@webspan.net>
  *
- * $Id: packet-dcerpc-ndr.c,v 1.1 2001/11/27 09:27:29 guy Exp $
+ * $Id: packet-dcerpc-ndr.c,v 1.2 2001/12/06 23:30:35 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -106,3 +106,26 @@ dissect_ndr_uuid_t (tvbuff_t *tvb, gint offset, packet_info *pinfo,
     return offset + 16;
 }
 
+
+int
+dissect_ndr_ctx_hnd (tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                     proto_tree *tree, char *drep, 
+                     int hfindex, e_ctx_hnd *pdata)
+{
+    e_ctx_hnd ctx_hnd;
+
+    if (offset % 4) {
+        offset += 4 - (offset % 4);
+    }
+    ctx_hnd.Data1 = dcerpc_tvb_get_ntohl (tvb, offset, drep);
+    dcerpc_tvb_get_uuid (tvb, offset+4, drep, &ctx_hnd.uuid);
+    if (tree) {
+        proto_tree_add_bytes (tree, hfindex, tvb, offset, 20,
+                              tvb_get_ptr (tvb, offset, 20));
+    }
+    if (pdata) {
+        *pdata = ctx_hnd;
+    }
+    return offset + 20;
+}
+

diff --git a/packet-dcerpc-samr.c b/packet-dcerpc-samr.c
index a170c292a7ab29259338de40e9e0487f801806bb..1592962cb26435c2fb5282fd194baa1b8eeb45b2 100644 (file)
--- a/packet-dcerpc-samr.c
+++ b/packet-dcerpc-samr.c
@@ -2,7 +2,7 @@
  * Routines for SMB \\PIPE\\samr packet disassembly
  * Copyright 2001, Tim Potter <tpot@samba.org>
  *
- * $Id: packet-dcerpc-samr.c,v 1.1 2001/11/21 02:08:57 guy Exp $
+ * $Id: packet-dcerpc-samr.c,v 1.2 2001/12/06 23:30:35 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -31,8 +31,15 @@
 #include "packet.h"
 #include "packet-dcerpc.h"
 #include "packet-dcerpc-samr.h"
+#include "smb.h"       /* for "NT_errors[]" */
 
 static int proto_dcerpc_samr = -1;
+
+static int hf_samr_hnd = -1;
+static int hf_samr_perms = -1;
+static int hf_samr_rid = -1;
+static int hf_samr_rc = -1;
+
 static gint ett_dcerpc_samr = -1;
 
 static e_uuid_t uuid_dcerpc_samr = {
@@ -42,15 +49,52 @@ static e_uuid_t uuid_dcerpc_samr = {
 
 static guint16 ver_dcerpc_samr = 1;
 
+static int
+samr_dissect_gen_open_reply (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *tree, 
+                             char *drep)
+{
+        offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
+                                      hf_samr_hnd, NULL);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_rc, NULL);
+        return offset;
+}
+
+static int
+samr_dissect_close_hnd_rqst (tvbuff_t *tvb, int offset, 
+                              packet_info *pinfo, proto_tree *tree, 
+                              char *drep)
+{
+        offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
+                                      hf_samr_hnd, NULL);
+        return offset;
+}
+
+static int
+samr_dissect_open_user_rqst (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *tree, 
+                             char *drep)
+{
+        offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
+                                      hf_samr_hnd, NULL);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_perms, NULL);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_rid, NULL);
+        return offset;
+}
+
+
 static dcerpc_sub_dissector dcerpc_samr_dissectors[] = {
-        { SAMR_CONNECT_ANON, "SAMR_CONNECT_ANON", NULL, NULL },
-        { SAMR_CLOSE_HND, "SAMR_CLOSE_HND", NULL, NULL },
+        { SAMR_CONNECT_ANON, "SAMR_CONNECT_ANON", NULL, samr_dissect_gen_open_reply },
+        { SAMR_CLOSE_HND, "SAMR_CLOSE_HND", samr_dissect_close_hnd_rqst, samr_dissect_gen_open_reply },
         { SAMR_UNKNOWN_2, "SAMR_UNKNOWN_2", NULL, NULL },
         { SAMR_QUERY_SEC_OBJECT, "SAMR_QUERY_SEC_OBJECT", NULL, NULL },
         { SAMR_UNKNOWN_4, "SAMR_UNKNOWN_4", NULL, NULL },
         { SAMR_LOOKUP_DOMAIN, "SAMR_LOOKUP_DOMAIN", NULL, NULL },
         { SAMR_ENUM_DOMAINS, "SAMR_ENUM_DOMAINS", NULL, NULL },
-        { SAMR_OPEN_DOMAIN, "SAMR_OPEN_DOMAIN", NULL, NULL },
+        { SAMR_OPEN_DOMAIN, "SAMR_OPEN_DOMAIN", NULL, samr_dissect_gen_open_reply },
         { SAMR_QUERY_DOMAIN_INFO, "SAMR_QUERY_DOMAIN_INFO", NULL, NULL },
         { SAMR_CREATE_DOM_GROUP, "SAMR_CREATE_DOM_GROUP", NULL, NULL },
         { SAMR_ENUM_DOM_GROUPS, "SAMR_ENUM_DOM_GROUPS", NULL, NULL },
@@ -60,7 +104,7 @@ static dcerpc_sub_dissector dcerpc_samr_dissectors[] = {
         { SAMR_QUERY_USERALIASES, "SAMR_QUERY_USERALIASES", NULL, NULL },
         { SAMR_LOOKUP_NAMES, "SAMR_LOOKUP_NAMES", NULL, NULL },
         { SAMR_LOOKUP_RIDS, "SAMR_LOOKUP_RIDS", NULL, NULL },
-        { SAMR_OPEN_GROUP, "SAMR_OPEN_GROUP", NULL, NULL },
+        { SAMR_OPEN_GROUP, "SAMR_OPEN_GROUP", NULL, samr_dissect_gen_open_reply },
         { SAMR_QUERY_GROUPINFO, "SAMR_QUERY_GROUPINFO", NULL, NULL },
         { SAMR_SET_GROUPINFO, "SAMR_SET_GROUPINFO", NULL, NULL },
         { SAMR_ADD_GROUPMEM, "SAMR_ADD_GROUPMEM", NULL, NULL },
@@ -68,14 +112,14 @@ static dcerpc_sub_dissector dcerpc_samr_dissectors[] = {
         { SAMR_DEL_GROUPMEM, "SAMR_DEL_GROUPMEM", NULL, NULL },
         { SAMR_QUERY_GROUPMEM, "SAMR_QUERY_GROUPMEM", NULL, NULL },
         { SAMR_UNKNOWN_1A, "SAMR_UNKNOWN_1A", NULL, NULL },
-        { SAMR_OPEN_ALIAS, "SAMR_OPEN_ALIAS", NULL, NULL },
+        { SAMR_OPEN_ALIAS, "SAMR_OPEN_ALIAS", NULL, samr_dissect_gen_open_reply },
         { SAMR_QUERY_ALIASINFO, "SAMR_QUERY_ALIASINFO", NULL, NULL },
         { SAMR_SET_ALIASINFO, "SAMR_SET_ALIASINFO", NULL, NULL },
         { SAMR_DELETE_DOM_ALIAS, "SAMR_DELETE_DOM_ALIAS", NULL, NULL },
         { SAMR_ADD_ALIASMEM, "SAMR_ADD_ALIASMEM", NULL, NULL },
         { SAMR_DEL_ALIASMEM, "SAMR_DEL_ALIASMEM", NULL, NULL },
         { SAMR_QUERY_ALIASMEM, "SAMR_QUERY_ALIASMEM", NULL, NULL },
-        { SAMR_OPEN_USER, "SAMR_OPEN_USER", NULL, NULL },
+        { SAMR_OPEN_USER, "SAMR_OPEN_USER", samr_dissect_open_user_rqst, samr_dissect_gen_open_reply },
         { SAMR_DELETE_DOM_USER, "SAMR_DELETE_DOM_USER", NULL, NULL },
         { SAMR_QUERY_USERINFO, "SAMR_QUERY_USERINFO", NULL, NULL },
         { SAMR_SET_USERINFO2, "SAMR_SET_USERINFO2", NULL, NULL },
@@ -97,7 +141,7 @@ static dcerpc_sub_dissector dcerpc_samr_dissectors[] = {
         { SAMR_UNKNOWN_36, "SAMR_UNKNOWN_36", NULL, NULL },
         { SAMR_CHGPASSWD_USER, "SAMR_CHGPASSWD_USER", NULL, NULL },
         { SAMR_GET_DOM_PWINFO, "SAMR_GET_DOM_PWINFO", NULL, NULL },
-        { SAMR_CONNECT, "SAMR_CONNECT", NULL, NULL },
+        { SAMR_CONNECT, "SAMR_CONNECT", NULL, samr_dissect_gen_open_reply },
         { SAMR_SET_USERINFO, "SAMR_SET_USERINFO", NULL, NULL },
 
         {0, NULL, NULL,  NULL },
@@ -106,6 +150,16 @@ static dcerpc_sub_dissector dcerpc_samr_dissectors[] = {
 void 
 proto_register_dcerpc_samr(void)
 {
+        static hf_register_info hf[] = {
+                { &hf_samr_hnd,
+                  { "Context Handle", "samr.hnd", FT_BYTES, BASE_NONE, NULL, 0x0, "", HFILL }},
+                { &hf_samr_perms,
+                  { "Access Mask", "samr.perms", FT_UINT32, BASE_HEX, NULL, 0x0, "", HFILL }},
+                { &hf_samr_rid,
+                  { "Rid", "samr.rid", FT_UINT32, BASE_HEX, NULL, 0x0, "", HFILL }},
+                { &hf_samr_rc,
+                  { "Return code", "samr.rc", FT_UINT32, BASE_HEX, VALS (NT_errors), 0x0, "", HFILL }},
+        };
         static gint *ett[] = {
                 &ett_dcerpc_samr,
         };
@@ -113,6 +167,7 @@ proto_register_dcerpc_samr(void)
         proto_dcerpc_samr = proto_register_protocol(
                 "Microsoft Security Account Manager", "SAMR", "samr");
 
+        proto_register_field_array (proto_dcerpc_samr, hf, array_length (hf));
         proto_register_subtree_array(ett, array_length(ett));
 }
 

diff --git a/packet-dcerpc.h b/packet-dcerpc.h
index 14a207a98867adc689c69f750196735b858f2c8d..c2799ccb17c75beb44f1fdfa5f42adb943455b74 100644 (file)
--- a/packet-dcerpc.h
+++ b/packet-dcerpc.h
@@ -1,7 +1,7 @@
 /* packet-dcerpc.h
  * Copyright 2001, Todd Sabin <tas@webspan.net>
  *
- * $Id: packet-dcerpc.h,v 1.4 2001/11/27 09:27:29 guy Exp $
+ * $Id: packet-dcerpc.h,v 1.5 2001/12/06 23:30:35 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -32,6 +32,11 @@ typedef struct _e_uuid_t {
     guint8 Data4[8];
 } e_uuid_t;
 
+typedef struct _e_ctx_hnd {
+    guint32 Data1;
+    e_uuid_t uuid;
+} e_ctx_hnd;
+
 typedef struct _e_dce_cn_common_hdr_t {
     guint8 rpc_ver;
     guint8 rpc_ver_minor;
@@ -117,6 +122,9 @@ int dissect_ndr_uint32 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
 int dissect_ndr_uuid_t (tvbuff_t *tvb, gint offset, packet_info *pinfo,
                         proto_tree *tree, char *drep, 
                         int hfindex, e_uuid_t *pdata);
+int dissect_ndr_ctx_hnd (tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                         proto_tree *tree, char *drep, 
+                         int hfindex, e_ctx_hnd *pdata);
 
 
 typedef int (dcerpc_dissect_fnct_t)(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep);

diff --git a/packet-smb.c b/packet-smb.c
index 8c5267f3547df4b5ad1ceb4a3b7804f72357cde5..554212e6e318e468c88bbd2727d3ccd0068590a3 100644 (file)
--- a/packet-smb.c
+++ b/packet-smb.c
@@ -2,7 +2,7 @@
  * Routines for smb packet dissection
  * Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com>
  *
- * $Id: packet-smb.c,v 1.182 2001/12/06 09:24:02 guy Exp $
+ * $Id: packet-smb.c,v 1.183 2001/12/06 23:30:35 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -11994,7 +11994,7 @@ static char *decode_smb_error(guint8 errcls, guint16 errcode)
  *
  *     http://www.wildpackets.com/elements/SMB_NT_Status_Codes.txt
  */
-static const value_string NT_errors[] = {
+const value_string NT_errors[] = {
   { 0x00000000, "STATUS_SUCCESS" },
   { 0x00000000, "STATUS_WAIT_0" },
   { 0x00000001, "STATUS_WAIT_1" },

diff --git a/smb.h b/smb.h
index 56c90f12e79a3db13274693ea82914f41a41a795..646ab9cbc7024333afb67ea8472b5a1e2aef7912 100644 (file)
--- a/smb.h
+++ b/smb.h
@@ -2,7 +2,7 @@
  * Defines for smb packet dissection
  * Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com>
  *
- * $Id: smb.h,v 1.29 2001/12/05 08:20:30 guy Exp $
+ * $Id: smb.h,v 1.30 2001/12/06 23:30:36 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -283,4 +283,8 @@ extern int dissect_ipc_state(tvbuff_t *tvb, packet_info *pinfo,
 extern gboolean smb_dcerpc_reassembly;
 extern GHashTable *dcerpc_fragment_table;
 
+/*
+ * NT error codes.
+ */
+extern const value_string NT_errors[];
 #endif