2 * Copyright 2001, Todd Sabin <tas@webspan.net>
4 * $Id: packet-dcerpc.h,v 1.22 2002/10/22 00:59:25 guy Exp $
6 * Ethereal - Network traffic analyzer
7 * By Gerald Combs <gerald@ethereal.com>
8 * Copyright 1998 Gerald Combs
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version 2
13 * of the License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
25 #ifndef __PACKET_DCERPC_H__
26 #define __PACKET_DCERPC_H__
28 #include <epan/conversation.h>
30 typedef struct _e_uuid_t {
37 typedef struct _e_ctx_hnd {
42 typedef struct _e_dce_cn_common_hdr_t {
51 } e_dce_cn_common_hdr_t;
53 typedef struct _e_dce_dg_common_hdr_t {
73 } e_dce_dg_common_hdr_t;
85 #define PDU_CL_CANCEL 8
87 #define PDU_CANCEL_ACK 10
89 #define PDU_BIND_ACK 12
90 #define PDU_BIND_NAK 13
92 #define PDU_ALTER_ACK 15
94 #define PDU_SHUTDOWN 17
95 #define PDU_CO_CANCEL 18
96 #define PDU_ORPHANED 19
99 * helpers for packet-dcerpc.c and packet-dcerpc-ndr.c
100 * If you're writing a subdissector, you almost certainly want the
101 * NDR functions below.
103 guint16 dcerpc_tvb_get_ntohs (tvbuff_t *tvb, gint offset, char *drep);
104 guint32 dcerpc_tvb_get_ntohl (tvbuff_t *tvb, gint offset, char *drep);
105 void dcerpc_tvb_get_uuid (tvbuff_t *tvb, gint offset, char *drep, e_uuid_t *uuid);
106 int dissect_dcerpc_uint8 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
107 proto_tree *tree, char *drep,
108 int hfindex, guint8 *pdata);
109 int dissect_dcerpc_uint16 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
110 proto_tree *tree, char *drep,
111 int hfindex, guint16 *pdata);
112 int dissect_dcerpc_uint32 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
113 proto_tree *tree, char *drep,
114 int hfindex, guint32 *pdata);
115 int dissect_dcerpc_uint64 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
116 proto_tree *tree, char *drep,
117 int hfindex, unsigned char *pdata);
118 int dissect_dcerpc_float (tvbuff_t *tvb, gint offset, packet_info *pinfo,
119 proto_tree *tree, char *drep,
120 int hfindex, gfloat *pdata);
121 int dissect_dcerpc_double (tvbuff_t *tvb, gint offset, packet_info *pinfo,
122 proto_tree *tree, char *drep,
123 int hfindex, gdouble *pdata);
124 int dissect_dcerpc_time_t (tvbuff_t *tvb, gint offset, packet_info *pinfo,
125 proto_tree *tree, char *drep,
126 int hfindex, guint32 *pdata);
130 * NDR routines for subdissectors.
132 int dissect_ndr_uint8 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
133 proto_tree *tree, char *drep,
134 int hfindex, guint8 *pdata);
135 int dissect_ndr_uint16 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
136 proto_tree *tree, char *drep,
137 int hfindex, guint16 *pdata);
138 int dissect_ndr_uint32 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
139 proto_tree *tree, char *drep,
140 int hfindex, guint32 *pdata);
141 int dissect_ndr_uint64 (tvbuff_t *tvb, gint offset, packet_info *pinfo,
142 proto_tree *tree, char *drep,
143 int hfindex, unsigned char *pdata);
144 int dissect_ndr_float (tvbuff_t *tvb, gint offset, packet_info *pinfo,
145 proto_tree *tree, char *drep,
146 int hfindex, gfloat *pdata);
147 int dissect_ndr_double (tvbuff_t *tvb, gint offset, packet_info *pinfo,
148 proto_tree *tree, char *drep,
149 int hfindex, gdouble *pdata);
150 int dissect_ndr_time_t (tvbuff_t *tvb, gint offset, packet_info *pinfo,
151 proto_tree *tree, char *drep,
152 int hfindex, guint32 *pdata);
153 int dissect_ndr_uuid_t (tvbuff_t *tvb, gint offset, packet_info *pinfo,
154 proto_tree *tree, char *drep,
155 int hfindex, e_uuid_t *pdata);
156 int dissect_ndr_ctx_hnd (tvbuff_t *tvb, gint offset, packet_info *pinfo,
157 proto_tree *tree, char *drep,
158 int hfindex, e_ctx_hnd *pdata);
161 typedef int (dcerpc_dissect_fnct_t)(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep);
163 #define NDR_POINTER_REF 1
164 #define NDR_POINTER_UNIQUE 2
165 #define NDR_POINTER_PTR 3
167 int dissect_ndr_pointer (tvbuff_t *tvb, gint offset, packet_info *pinfo,
168 proto_tree *tree, char *drep,
169 dcerpc_dissect_fnct_t *fnct, int type, char *text, int hf_index, int levels);
171 /* dissect a NDR unidimensional conformant array */
172 int dissect_ndr_ucarray(tvbuff_t *tvb, gint offset, packet_info *pinfo,
173 proto_tree *tree, char *drep,
174 dcerpc_dissect_fnct_t *fnct);
176 /* dissect a NDR unidimensional conformant and varying array */
177 int dissect_ndr_ucvarray(tvbuff_t *tvb, gint offset, packet_info *pinfo,
178 proto_tree *tree, char *drep,
179 dcerpc_dissect_fnct_t *fnct);
183 typedef struct _dcerpc_sub_dissector {
186 dcerpc_dissect_fnct_t *dissect_rqst;
187 dcerpc_dissect_fnct_t *dissect_resp;
188 } dcerpc_sub_dissector;
190 /* registration function for subdissectors */
191 void dcerpc_init_uuid (int proto, int ett, e_uuid_t *uuid, guint16 ver, dcerpc_sub_dissector *procs, int opnum_hf);
193 /* Private data structure to pass to DCERPC dissector. This is used to
194 pass transport specific information down to the dissector from the
195 dissector that parsed this encapsulated calls. */
197 #define DCERPC_TRANSPORT_SMB 1
199 typedef struct _dcerpc_private_info {
200 int transport_type; /* Tag */
203 struct { /* DCERPC_TRANSPORT_SMB */
207 } dcerpc_private_info;
209 /* Private data passed to subdissectors from the main DCERPC dissector. */
210 typedef struct _dcerpc_call_value {
221 typedef struct _dcerpc_info {
222 conversation_t *conv; /* Which TCP stream we are in */
223 guint32 call_id; /* Context id for this call */
224 guint16 smb_fid; /* FID for DCERPC over SMB */
226 gboolean conformant_run;
227 gint32 conformant_eaten; /* how many bytes did the conformant run eat?*/
228 guint32 array_max_count; /* max_count for conformant arrays */
229 guint32 array_max_count_offset;
230 guint32 array_offset;
231 guint32 array_offset_offset;
232 guint32 array_actual_count;
233 guint32 array_actual_count_offset;
235 int levels; /* number of levels upwards in the tree to append text*/
236 dcerpc_call_value *call_data;
240 #endif /* packet-dcerpc.h */