packet-dcerpc-nt.h

   1 /* packet-dcerpc-nt.h
   2  * Routines for DCERPC over SMB packet disassembly
   3  * Copyright 2001, Tim Potter <tpot@samba.org>
   4  *
   5  * $Id: packet-dcerpc-nt.h,v 1.30 2002/08/28 21:00:10 jmayer Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 #ifndef __PACKET_DCERPC_NT_H
  27 #define __PACKET_DCEPRC_NT_H
  28
  29 /*
  30  * ett_ value for Unicode strings.
  31  */
  32 extern gint ett_nt_unicode_string;
  33
  34 /* Routines for parsing simple types */
  35
  36 int prs_align(int offset, int n);
  37
  38 int prs_uint8(tvbuff_t *tvb, int offset, packet_info *pinfo,
  39               proto_tree *tree, guint8 *data, char *name);
  40
  41 int prs_uint8s(tvbuff_t *tvb, int offset, packet_info *pinfo,
  42                proto_tree *tree, int count, int *data_offset, char *name);
  43
  44 int prs_uint16(tvbuff_t *tvb, int offset, packet_info *pinfo,
  45                proto_tree *tree, guint16 *data, char *name);
  46
  47 int prs_uint16s(tvbuff_t *tvb, int offset, packet_info *pinfo,
  48                 proto_tree *tree, int count, int *data_offset, char *name);
  49
  50 int prs_uint32(tvbuff_t *tvb, int offset, packet_info *pinfo,
  51                proto_tree *tree, guint32 *data, char *name);
  52
  53 int prs_uint32s(tvbuff_t *tvb, int offset, packet_info *pinfo,
  54                 proto_tree *tree, int count, int *data_offset, char *name);
  55
  56 /* Parse NT status code */
  57
  58 int prs_ntstatus(tvbuff_t *tvb, int offset, packet_info *pinfo,
  59                  proto_tree *tree);
  60
  61 /* Parse some common RPC structures */
  62
  63 char *fake_unicode(tvbuff_t *tvb, int offset, int len);
  64
  65 int prs_UNISTR2(tvbuff_t *tvb, int offset, packet_info *pinfo,
  66                 proto_tree *tree, int flags, char **data, char *name);
  67
  68 /* Routines for handling deferral of referants in NDR */
  69
  70 #define PARSE_SCALARS 1
  71 #define PARSE_BUFFERS 2
  72
  73 int prs_push_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo,
  74                  proto_tree *tree, GList **ptr_list, char *name);
  75
  76 guint32 prs_pop_ptr(GList **ptr_list, char *name);
  77
  78
  79
  80 #define ALIGN_TO_4_BYTES \
  81         { dcerpc_info *xzdi; \
  82           xzdi=pinfo->private_data; \
  83           if(!xzdi->conformant_run) { \
  84                 if(offset&0x03) { \
  85                         offset=(offset&0xfffffffc)+4; \
  86                 } \
  87           } \
  88         }
  89
  90 int
  91 dissect_ndr_nt_UNICODE_STRING_str(tvbuff_t *tvb, int offset,
  92                         packet_info *pinfo, proto_tree *tree,
  93                         char *drep);
  94 int
  95 dissect_ndr_nt_UNICODE_STRING(tvbuff_t *tvb, int offset,
  96                         packet_info *pinfo, proto_tree *parent_tree,
  97                         char *drep, int hf_index, int levels);
  98 int
  99 dissect_ndr_nt_STRING_string (tvbuff_t *tvb, int offset,
 100                              packet_info *pinfo, proto_tree *tree,
 101                              char *drep);
 102 int
 103 dissect_ndr_nt_STRING (tvbuff_t *tvb, int offset,
 104                         packet_info *pinfo, proto_tree *parent_tree,
 105                         char *drep, int hf_index, int levels);
 106 int
 107 dissect_ndr_nt_acct_ctrl(tvbuff_t *tvb, int offset, packet_info *pinfo,
 108                         proto_tree *parent_tree, char *drep);
 109 int
 110 dissect_ndr_nt_NTTIME (tvbuff_t *tvb, int offset,
 111                         packet_info *pinfo, proto_tree *tree,
 112                         char *drep, int hf_index);
 113 int
 114 dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset,
 115                         packet_info *pinfo, proto_tree *parent_tree,
 116                         char *drep);
 117 int
 118 dissect_ndr_nt_SID(tvbuff_t *tvb, int offset,
 119                         packet_info *pinfo, proto_tree *tree,
 120                         char *drep);
 121 int
 122 dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset,
 123                              packet_info *pinfo, proto_tree *parent_tree,
 124                              char *drep);
 125 int
 126 dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset,
 127                         packet_info *pinfo, proto_tree *parent_tree,
 128                         char *drep);
 129
 130 int
 131 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
 132                         packet_info *pinfo, proto_tree *parent_tree,
 133                         char *drep);
 134 int
 135 dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
 136                         packet_info *pinfo, proto_tree *parent_tree,
 137                         char *drep);
 138
 139 /*
 140  * Policy handle hashing
 141  */
 142
 143 /* Store open and close packet numbers for a policy handle */
 144
 145 void
 146 dcerpc_smb_store_pol_pkts(e_ctx_hnd *policy_hnd, guint32 open_frame,
 147                           guint32 close_frame);
 148
 149 /* Store a name with a policy handle */
 150
 151 void
 152 dcerpc_smb_store_pol_name(e_ctx_hnd *policy_hnd, char *name);
 153
 154 /* Fetch details stored with a policy handle */
 155
 156 gboolean
 157 dcerpc_smb_fetch_pol(e_ctx_hnd *policy_hnd, char **name,
 158                      guint32 *open_frame, guint32 *close_frame);
 159
 160 /* Check for unparsed data at the end of a frame */
 161
 162 void
 163 dcerpc_smb_check_long_frame(tvbuff_t *tvb, int offset,
 164                             packet_info *pinfo, proto_tree *tree);
 165
 166 /* Dissect NT specific things */
 167
 168 int
 169 dissect_ntstatus(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 170                  proto_tree *tree, char *drep,
 171                  int hfindex, guint32 *pdata);
 172
 173 int
 174 dissect_doserror(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 175                  proto_tree *tree, char *drep,
 176                  int hfindex, guint32 *pdata);
 177
 178 int
 179 dissect_nt_policy_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 180                       proto_tree *tree, char *drep, int hfindex,
 181                       e_ctx_hnd *pdata, gboolean is_open, gboolean is_close);
 182
 183 int
 184 dissect_nt_GUID(tvbuff_t *tvb, int offset,
 185                         packet_info *pinfo, proto_tree *parent_tree,
 186                         char *drep);
 187
 188 int
 189 dissect_nt_LUID(tvbuff_t *tvb, int offset,
 190                         packet_info *pinfo, proto_tree *tree,
 191                         char *drep);
 192
 193 /* Stored here instead of packet-dcerpc{,-ndr}.c as they are probably not
 194    official NDR representations. */
 195
 196 int dissect_dcerpc_uint8s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 197                           proto_tree *tree, char *drep,
 198                           int hfindex, int length, guint8 **pdata);
 199
 200 int dissect_ndr_uint8s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 201                        proto_tree *tree, char *drep,
 202                        int hfindex, int length, guint8 **pdata);
 203
 204 int dissect_dcerpc_uint16s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 205                            proto_tree *tree, char *drep,
 206                            int hfindex, int length, guint16 **pdata);
 207
 208 int dissect_ndr_uint16s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 209                         proto_tree *tree, char *drep,
 210                         int hfindex, int length, guint16 **pdata);
 211
 212 /* Dissect an NT access mask */
 213
 214 typedef void (nt_access_mask_fn_t)(tvbuff_t *tvb, gint offset,
 215                                    proto_tree *tree, guint32 access);
 216
 217 int
 218 dissect_nt_access_mask(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 219                        proto_tree *tree, char *drep, int hfindex,
 220                        nt_access_mask_fn_t *specific_rights_fn);
 221
 222 #endif /* packet-dcerpc-nt.h */