X-Git-Url: http://git.samba.org/samba.git/?a=blobdiff_plain;f=packet-dcerpc-samr.c;h=e1f912875c4a949608f942ff8cedf17b48695d81;hb=3f78ca22e27d9dba872420493f1edf4799602f09;hp=4ff0419b73edfdbf5428bed1ee4d848d5a2c4046;hpb=72418d32d165270f367d269da16bc02c79bbef5d;p=obnox%2Fwireshark%2Fwip.git diff --git a/packet-dcerpc-samr.c b/packet-dcerpc-samr.c index 4ff0419b73..e1f912875c 100644 --- a/packet-dcerpc-samr.c +++ b/packet-dcerpc-samr.c @@ -1,24 +1,24 @@ /* packet-dcerpc-samr.c * Routines for SMB \PIPE\samr packet disassembly - * Copyright 2001, Tim Potter + * Copyright 2001,2003 Tim Potter * 2002 Added all command dissectors Ronnie Sahlberg * - * $Id: packet-dcerpc-samr.c,v 1.37 2002/04/30 01:44:34 tpot Exp $ + * $Id: packet-dcerpc-samr.c,v 1.102 2003/09/29 00:01:26 tpot Exp $ * * Ethereal - Network traffic analyzer * By Gerald Combs * Copyright 1998 Gerald Combs - * + * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. - * + * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. - * + * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. @@ -31,15 +31,23 @@ #include #include #include +#include "prefs.h" #include "packet-dcerpc.h" #include "packet-dcerpc-nt.h" #include "packet-dcerpc-samr.h" +#include "packet-dcerpc-lsa.h" #include "smb.h" /* for "NT_errors[]" */ +#include "packet-smb-common.h" +#include "crypt-md4.h" +#include "crypt-rc4.h" -int dissect_nt_sid(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *parent_tree, char *name); +#ifdef NEED_SNPRINTF_H +# include "snprintf.h" +#endif static int proto_dcerpc_samr = -1; +static int hf_samr_opnum = -1; static int hf_samr_hnd = -1; static int hf_samr_group = -1; static int hf_samr_rid = -1; @@ -71,10 +79,18 @@ static int hf_samr_server = -1; static int hf_samr_domain = -1; static int hf_samr_controller = -1; static int hf_samr_access = -1; -static int hf_samr_mask = -1; +static int hf_samr_access_granted = -1; static int hf_samr_crypt_password = -1; static int hf_samr_crypt_hash = -1; static int hf_samr_lm_change = -1; +static int hf_samr_lm_passchange_block = -1; +static int hf_samr_nt_passchange_block = -1; +static int hf_samr_nt_passchange_block_decrypted = -1; +static int hf_samr_nt_passchange_block_newpass = -1; +static int hf_samr_nt_passchange_block_newpass_len = -1; +static int hf_samr_nt_passchange_block_pseudorandom = -1; +static int hf_samr_lm_verifier = -1; +static int hf_samr_nt_verifier = -1; static int hf_samr_attrib = -1; static int hf_samr_max_pwd_age = -1; static int hf_samr_min_pwd_age = -1; @@ -111,12 +127,6 @@ static int hf_samr_unknown_char = -1; static int hf_samr_unknown_string = -1; static int hf_samr_unknown_time = -1; -/* these are used by functions in packet-dcerpc-nt.c */ -int hf_nt_str_len = -1; -int hf_nt_str_off = -1; -int hf_nt_str_max_len = -1; -int hf_nt_string_length = -1; -int hf_nt_string_size = -1; static int hf_nt_acct_ctrl = -1; static int hf_nt_acb_disabled = -1; static int hf_nt_acb_homedirreq = -1; @@ -187,21 +197,294 @@ static gint ett_samr_hnd = -1; #endif static e_uuid_t uuid_dcerpc_samr = { - 0x12345778, 0x1234, 0xabcd, + 0x12345778, 0x1234, 0xabcd, { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0x89, 0xac} }; static guint16 ver_dcerpc_samr = 1; +/* Configuration variables */ +static char *nt_password = NULL; + +/* Dissect connect specific access rights */ + +static gint hf_access_connect_connect_to_server = -1; +static gint hf_access_connect_shutdown_server = -1; +static gint hf_access_connect_initialize_server = -1; +static gint hf_access_connect_create_domain = -1; +static gint hf_access_connect_enum_domains = -1; +static gint hf_access_connect_open_domain = -1; + +static void +specific_rights_connect(tvbuff_t *tvb, gint offset, proto_tree *tree, + guint32 access) +{ + proto_tree_add_boolean( + tree, hf_access_connect_open_domain, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_connect_enum_domains, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_connect_create_domain, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_connect_initialize_server, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_connect_shutdown_server, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_connect_connect_to_server, + tvb, offset, 4, access); +} + +struct access_mask_info samr_connect_access_mask_info = { + "SAMR connect", + specific_rights_connect, + NULL, /* Generic rights mapping */ + NULL /* Standard rights mapping */ +}; + +/* Dissect domain specific access rights */ + +static gint hf_access_domain_lookup_info1 = -1; +static gint hf_access_domain_set_info1 = -1; +static gint hf_access_domain_lookup_info2 = -1; +static gint hf_access_domain_set_info2 = -1; +static gint hf_access_domain_create_user = -1; +static gint hf_access_domain_create_group = -1; +static gint hf_access_domain_create_alias = -1; +static gint hf_access_domain_lookup_alias_by_mem = -1; +static gint hf_access_domain_enum_accounts = -1; +static gint hf_access_domain_open_account = -1; +static gint hf_access_domain_set_info3 = -1; + +static void +specific_rights_domain(tvbuff_t *tvb, gint offset, proto_tree *tree, + guint32 access) +{ + proto_tree_add_boolean( + tree, hf_access_domain_set_info3, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_domain_open_account, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_domain_enum_accounts, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_domain_lookup_alias_by_mem, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_domain_create_alias, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_domain_create_group, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_domain_create_user, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_domain_set_info2, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_domain_lookup_info2, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_domain_set_info1, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_domain_lookup_info1, + tvb, offset, 4, access); + } + +struct access_mask_info samr_domain_access_mask_info = { + "SAMR domain", + specific_rights_domain, + NULL, /* Generic mapping table */ + NULL /* Standard mapping table */ +}; + +/* Dissect user specific access rights */ + +static gint hf_access_user_get_name_etc = -1; +static gint hf_access_user_get_locale = -1; +static gint hf_access_user_get_loc_com = -1; +static gint hf_access_user_get_logoninfo = -1; +static gint hf_access_user_get_attributes = -1; +static gint hf_access_user_set_attributes = -1; +static gint hf_access_user_change_password = -1; +static gint hf_access_user_set_password = -1; +static gint hf_access_user_get_groups = -1; +static gint hf_access_user_get_group_membership = -1; +static gint hf_access_user_change_group_membership = -1; + +static void +specific_rights_user(tvbuff_t *tvb, gint offset, proto_tree *tree, + guint32 access) +{ + proto_tree_add_boolean( + tree, hf_access_user_change_group_membership, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_user_get_group_membership, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_user_get_groups, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_user_set_password, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_user_change_password, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_user_set_attributes, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_user_get_attributes, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_user_get_logoninfo, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_user_get_loc_com, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_user_get_locale, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_user_get_name_etc, + tvb, offset, 4, access); +} + +struct access_mask_info samr_user_access_mask_info = { + "SAMR user", + specific_rights_user, + NULL, /* Generic mapping table */ + NULL /* Standard mapping table */ +}; + +/* Dissect alias specific access rights */ + +static gint hf_access_alias_add_member = -1; +static gint hf_access_alias_remove_member = -1; +static gint hf_access_alias_get_members = -1; +static gint hf_access_alias_lookup_info = -1; +static gint hf_access_alias_set_info = -1; + +static void +specific_rights_alias(tvbuff_t *tvb, gint offset, proto_tree *tree, + guint32 access) +{ + proto_tree_add_boolean( + tree, hf_access_alias_set_info, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_alias_lookup_info, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_alias_get_members, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_alias_remove_member, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_alias_add_member, + tvb, offset, 4, access); +} + +struct access_mask_info samr_alias_access_mask_info = { + "SAMR alias", + specific_rights_alias, + NULL, /* Generic mapping table */ + NULL /* Standard mapping table */ +}; + +/* Dissect group specific access rights */ + +static gint hf_access_group_lookup_info = -1; +static gint hf_access_group_set_info = -1; +static gint hf_access_group_add_member = -1; +static gint hf_access_group_remove_member = -1; +static gint hf_access_group_get_members = -1; + +static void +specific_rights_group(tvbuff_t *tvb, gint offset, proto_tree *tree, + guint32 access) +{ + proto_tree_add_boolean( + tree, hf_access_group_get_members, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_group_remove_member, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_group_add_member, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_group_set_info, + tvb, offset, 4, access); + + proto_tree_add_boolean( + tree, hf_access_group_lookup_info, + tvb, offset, 4, access); +} + +struct access_mask_info samr_group_access_mask_info = { + "SAMR group", + specific_rights_group, + NULL, /* Generic mapping table */ + NULL /* Standard mapping table */ +}; int -dissect_ndr_nt_SID(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, - char *drep) +dissect_ndr_nt_SID(tvbuff_t *tvb, int offset, packet_info *pinfo, + proto_tree *tree, char *drep, int hf_sid) { - dcerpc_info *di; + dcerpc_info *di = (dcerpc_info *)pinfo->private_data; + dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data; + char *sid_str; + char *name; - di=pinfo->private_data; + if(di->hf_index!=-1){ + name=proto_registrar_get_name(di->hf_index); + } else { + name="Domain"; + } if(di->conformant_run){ /* just a run to handle conformant arrays, no scalars to dissect */ return offset; @@ -209,21 +492,30 @@ dissect_ndr_nt_SID(tvbuff_t *tvb, int offset, /* the SID contains a conformant array, first we must eat the 4-byte max_count before we can hand it off */ + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_count, NULL); - offset = dissect_nt_sid(tvb, pinfo, offset, tree, "Domain"); + offset = dissect_nt_sid(tvb, offset, tree, name, &sid_str, hf_sid); + + dcv->private_data = sid_str; + return offset; } - static int -dissect_ndr_nt_SID_ptr(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, - char *drep) +dissect_ndr_nt_SID_no_hf(tvbuff_t *tvb, int offset, packet_info *pinfo, + proto_tree *tree, char *drep) { - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - dissect_ndr_nt_SID, NDR_POINTER_UNIQUE, - "SID pointer", -1, 1); + offset = dissect_ndr_nt_SID(tvb, offset, pinfo, tree, drep, -1); + return offset; +} +static int +dissect_ndr_nt_SID_hf_through_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, + proto_tree *tree, char *drep) +{ + dcerpc_info *di = (dcerpc_info *)pinfo->private_data; + + offset = dissect_ndr_nt_SID(tvb, offset, pinfo, tree, drep, di->hf_index); return offset; } @@ -274,7 +566,7 @@ static const true_false_string tfs_nt_acb_autolock = { "This account has NOT been auto locked" }; int -dissect_ndr_nt_acct_ctrl(tvbuff_t *tvb, int offset, packet_info *pinfo, +dissect_ndr_nt_acct_ctrl(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { guint32 mask; @@ -322,7 +614,7 @@ dissect_ndr_nt_acct_ctrl(tvbuff_t *tvb, int offset, packet_info *pinfo, */ static int -samr_dissect_open_user_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, +samr_dissect_open_user_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { dcerpc_info *di = (dcerpc_info *)pinfo->private_data; @@ -330,7 +622,7 @@ samr_dissect_open_user_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, guint32 rid; offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_access, NULL); @@ -341,28 +633,51 @@ samr_dissect_open_user_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, if (check_col(pinfo->cinfo, COL_INFO)) col_append_fstr(pinfo->cinfo, COL_INFO, ", rid 0x%x", rid); - dcv->private_data = (void *)rid; + dcv->private_data = GINT_TO_POINTER(rid); return offset; } static int -samr_dissect_open_user_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_open_user_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { + dcerpc_info *di = (dcerpc_info *)pinfo->private_data; + dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data; + e_ctx_hnd policy_hnd; + proto_item *hnd_item; + guint32 status; + guint32 rid = GPOINTER_TO_INT(dcv->private_data); + char *pol_name; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, &policy_hnd, &hnd_item, + TRUE, FALSE); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, - hf_samr_rc, NULL); + hf_samr_rc, &status); + + if (status == 0) { + if (rid) + pol_name = g_strdup_printf("OpenUser(rid 0x%x)", rid); + else + pol_name = g_strdup("OpenUser handle"); + + dcerpc_smb_store_pol_name(&policy_hnd, pinfo, pol_name); + + if (hnd_item != NULL) + proto_item_append_text(hnd_item, ": %s", pol_name); + + g_free(pol_name); + } return offset; } static int -samr_dissect_pointer_long(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_pointer_long(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { dcerpc_info *di; @@ -374,8 +689,8 @@ samr_dissect_pointer_long(tvbuff_t *tvb, int offset, } static int -samr_dissect_pointer_STRING(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_pointer_STRING(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { dcerpc_info *di; @@ -386,32 +701,14 @@ samr_dissect_pointer_STRING(tvbuff_t *tvb, int offset, return offset; } - offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, di->hf_index, 0); return offset; } static int -samr_dissect_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, - char *drep) -{ - dcerpc_info *di; - - di=pinfo->private_data; - if(di->conformant_run){ - /*just a run to handle conformant arrays, nothing to dissect */ - return offset; - } - - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - di->hf_index, di->levels); - return offset; -} - -static int -samr_dissect_pointer_short(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_pointer_short(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { dcerpc_info *di; @@ -424,28 +721,36 @@ samr_dissect_pointer_short(tvbuff_t *tvb, int offset, static int -samr_dissect_query_dispinfo_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_query_dispinfo_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { + guint16 level; + guint32 start_idx; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, - hf_samr_level, NULL); + hf_samr_level, &level); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_start_idx, NULL); + hf_samr_start_idx, &start_idx); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_max_entries, NULL); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_pref_maxsize, NULL); + if (check_col(pinfo->cinfo, COL_INFO)) + col_append_fstr( + pinfo->cinfo, COL_INFO, ", level %d, start_idx %d", + level, start_idx); + return offset; } static int -samr_dissect_USER_DISPINFO_1(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *parent_tree, +samr_dissect_USER_DISPINFO_1(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, char *drep) { proto_item *item=NULL; @@ -463,11 +768,11 @@ samr_dissect_USER_DISPINFO_1(tvbuff_t *tvb, int offset, offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_name, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_full_name, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_desc, 0); proto_item_set_len(item, offset-old_offset); @@ -475,8 +780,8 @@ samr_dissect_USER_DISPINFO_1(tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_DISPINFO_1_ARRAY_users(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_USER_DISPINFO_1_ARRAY_users(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, @@ -486,8 +791,8 @@ samr_dissect_USER_DISPINFO_1_ARRAY_users(tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_DISPINFO_1_ARRAY (tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *parent_tree, +samr_dissect_USER_DISPINFO_1_ARRAY (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, char *drep) { guint32 count; @@ -506,7 +811,7 @@ samr_dissect_USER_DISPINFO_1_ARRAY (tvbuff_t *tvb, int offset, hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_DISPINFO_1_ARRAY_users, NDR_POINTER_PTR, - "USER_DISPINFO_1_ARRAY", -1, 0); + "USER_DISPINFO_1_ARRAY", -1); proto_item_set_len(item, offset-old_offset); return offset; @@ -515,8 +820,8 @@ samr_dissect_USER_DISPINFO_1_ARRAY (tvbuff_t *tvb, int offset, static int -samr_dissect_USER_DISPINFO_2(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *parent_tree, +samr_dissect_USER_DISPINFO_2(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, char *drep) { proto_item *item=NULL; @@ -534,9 +839,9 @@ samr_dissect_USER_DISPINFO_2(tvbuff_t *tvb, int offset, offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_name, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_desc, 0); proto_item_set_len(item, offset-old_offset); @@ -544,8 +849,8 @@ samr_dissect_USER_DISPINFO_2(tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_DISPINFO_2_ARRAY_users (tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_USER_DISPINFO_2_ARRAY_users (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, @@ -555,8 +860,8 @@ samr_dissect_USER_DISPINFO_2_ARRAY_users (tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_DISPINFO_2_ARRAY (tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *parent_tree, +samr_dissect_USER_DISPINFO_2_ARRAY (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, char *drep) { guint32 count; @@ -575,19 +880,15 @@ samr_dissect_USER_DISPINFO_2_ARRAY (tvbuff_t *tvb, int offset, hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_DISPINFO_2_ARRAY_users, NDR_POINTER_PTR, - "USER_DISPINFO_2_ARRAY", -1, 0); + "USER_DISPINFO_2_ARRAY", -1); proto_item_set_len(item, offset-old_offset); return offset; } - - - - static int -samr_dissect_GROUP_DISPINFO(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *parent_tree, +samr_dissect_GROUP_DISPINFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, char *drep) { proto_item *item=NULL; @@ -600,15 +901,15 @@ samr_dissect_GROUP_DISPINFO(tvbuff_t *tvb, int offset, tree = proto_item_add_subtree(item, ett_samr_group_dispinfo); } - + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_index, NULL); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_name, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_desc, 0); proto_item_set_len(item, offset-old_offset); @@ -616,8 +917,8 @@ samr_dissect_GROUP_DISPINFO(tvbuff_t *tvb, int offset, } static int -samr_dissect_GROUP_DISPINFO_ARRAY_groups(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_GROUP_DISPINFO_ARRAY_groups(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, @@ -627,8 +928,8 @@ samr_dissect_GROUP_DISPINFO_ARRAY_groups(tvbuff_t *tvb, int offset, } static int -samr_dissect_GROUP_DISPINFO_ARRAY(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *parent_tree, +samr_dissect_GROUP_DISPINFO_ARRAY(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, char *drep) { guint32 count; @@ -646,7 +947,7 @@ samr_dissect_GROUP_DISPINFO_ARRAY(tvbuff_t *tvb, int offset, hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_GROUP_DISPINFO_ARRAY_groups, NDR_POINTER_PTR, - "GROUP_DISPINFO_ARRAY", -1, 0); + "GROUP_DISPINFO_ARRAY", -1); proto_item_set_len(item, offset-old_offset); return offset; @@ -655,8 +956,8 @@ samr_dissect_GROUP_DISPINFO_ARRAY(tvbuff_t *tvb, int offset, static int -samr_dissect_ASCII_DISPINFO(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *parent_tree, +samr_dissect_ASCII_DISPINFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, char *drep) { proto_item *item=NULL; @@ -669,24 +970,24 @@ samr_dissect_ASCII_DISPINFO(tvbuff_t *tvb, int offset, tree = proto_item_add_subtree(item, ett_samr_ascii_dispinfo); } - + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_index, NULL); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep); - offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_name, 0); - offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_desc,0 ); + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, + hf_samr_acct_desc, 0); proto_item_set_len(item, offset-old_offset); return offset; } static int -samr_dissect_ASCII_DISPINFO_ARRAY_users(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_ASCII_DISPINFO_ARRAY_users(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, @@ -696,7 +997,7 @@ samr_dissect_ASCII_DISPINFO_ARRAY_users(tvbuff_t *tvb, int offset, } static int -samr_dissect_ASCII_DISPINFO_ARRAY(tvbuff_t *tvb, int offset, +samr_dissect_ASCII_DISPINFO_ARRAY(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -715,7 +1016,7 @@ samr_dissect_ASCII_DISPINFO_ARRAY(tvbuff_t *tvb, int offset, hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_ASCII_DISPINFO_ARRAY_users, NDR_POINTER_PTR, - "ACSII_DISPINFO_ARRAY", -1, 0); + "ACSII_DISPINFO_ARRAY", -1); proto_item_set_len(item, offset-old_offset); return offset; @@ -723,7 +1024,7 @@ samr_dissect_ASCII_DISPINFO_ARRAY(tvbuff_t *tvb, int offset, static int -samr_dissect_DISPLAY_INFO (tvbuff_t *tvb, int offset, +samr_dissect_DISPLAY_INFO (tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -741,23 +1042,23 @@ samr_dissect_DISPLAY_INFO (tvbuff_t *tvb, int offset, offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, hf_samr_level, &level); switch(level){ - case 1: + case 1: offset = samr_dissect_USER_DISPINFO_1_ARRAY( tvb, offset, pinfo, tree, drep); break; - case 2: + case 2: offset = samr_dissect_USER_DISPINFO_2_ARRAY( tvb, offset, pinfo, tree, drep); break; - case 3: + case 3: offset = samr_dissect_GROUP_DISPINFO_ARRAY( tvb, offset, pinfo, tree, drep); break; - case 4: + case 4: offset = samr_dissect_ASCII_DISPINFO_ARRAY( tvb, offset, pinfo, tree, drep); break; - case 5: + case 5: offset = samr_dissect_ASCII_DISPINFO_ARRAY( tvb, offset, pinfo, tree, drep); break; @@ -768,51 +1069,56 @@ samr_dissect_DISPLAY_INFO (tvbuff_t *tvb, int offset, } static int -samr_dissect_query_dispinfo_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_query_dispinfo_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - "", hf_samr_total_size, 0); + "Total Size", hf_samr_total_size); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - "", hf_samr_ret_size, 0); + "Returned Size", hf_samr_ret_size); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_DISPLAY_INFO, NDR_POINTER_REF, - "", -1, 0); - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_rc, NULL); + "DISPLAY_INFO:", -1); + offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, + hf_samr_rc, NULL); return offset; } static int -samr_dissect_get_display_enumeration_index_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, - proto_tree *tree, +samr_dissect_get_display_enumeration_index_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, + proto_tree *tree, char *drep) { + guint16 level; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, - hf_samr_level, NULL); + hf_samr_level, &level); - offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep, + if (check_col(pinfo->cinfo, COL_INFO)) + col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_name, 0); return offset; } static int -samr_dissect_get_display_enumeration_index_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_get_display_enumeration_index_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - "", hf_samr_index, 0); + "Index", hf_samr_index); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -824,7 +1130,7 @@ samr_dissect_get_display_enumeration_index_reply(tvbuff_t *tvb, int offset, static int -samr_dissect_PASSWORD_INFO(tvbuff_t *tvb, int offset, +samr_dissect_PASSWORD_INFO(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -840,7 +1146,7 @@ samr_dissect_PASSWORD_INFO(tvbuff_t *tvb, int offset, tree = proto_item_add_subtree(item, ett_samr_password_info); } - + offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, hf_samr_unknown_short, NULL); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, @@ -851,112 +1157,152 @@ samr_dissect_PASSWORD_INFO(tvbuff_t *tvb, int offset, } static int -samr_dissect_get_usrdom_pwinfo_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_get_usrdom_pwinfo_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); return offset; } static int -samr_dissect_get_usrdom_pwinfo_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_get_usrdom_pwinfo_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_PASSWORD_INFO, NDR_POINTER_REF, - "", -1, 0); + "PASSWORD_INFO:", -1); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); return offset; } - - static int -samr_dissect_connect2_server(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *parent_tree, - char *drep) +samr_dissect_connect2_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + char *drep) { - proto_item *item=NULL; - proto_tree *tree=NULL; - int old_offset=offset; - - if(parent_tree){ - item = proto_tree_add_text(parent_tree, tvb, offset, -1, - "Server"); - tree = proto_item_add_subtree(item, ett_samr_server); - } + offset = dissect_ndr_pointer_cb( + tvb, offset, pinfo, tree, drep, + dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, + "Server", hf_samr_server, cb_wstr_postprocess, + GINT_TO_POINTER(CB_STR_COL_INFO | CB_STR_SAVE | 1)); - offset = dissect_ndr_nt_UNICODE_STRING_str(tvb, offset, pinfo, - tree, drep); + offset = dissect_nt_access_mask( + tvb, offset, pinfo, tree, drep, hf_samr_access, + &samr_connect_access_mask_info); - proto_item_set_len(item, offset-old_offset); return offset; } static int -samr_dissect_connect2_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_connect4_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_connect2_server, NDR_POINTER_UNIQUE, - "Server", hf_samr_server, 1); + offset = dissect_ndr_pointer_cb( + tvb, offset, pinfo, tree, drep, + dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, + "Server", hf_samr_server, cb_wstr_postprocess, + GINT_TO_POINTER(CB_STR_COL_INFO | 1)); + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_unknown_long, NULL); + + offset = dissect_nt_access_mask( + tvb, offset, pinfo, tree, drep, hf_samr_access, + &samr_connect_access_mask_info); - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_access, NULL); return offset; } static int -samr_dissect_connect2_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_connect2_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { + dcerpc_info *di = (dcerpc_info *)pinfo->private_data; + dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data; + e_ctx_hnd policy_hnd; + proto_item *hnd_item; + guint32 status; + char *server = (char *)dcv->private_data, *pol_name; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, &policy_hnd, &hnd_item, + TRUE, FALSE); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, - hf_samr_rc, NULL); + hf_samr_rc, &status); + + if (status == 0) { + if (server) + pol_name = g_strdup_printf("Connect2(%s)", server); + else + pol_name = g_strdup("Connect2 handle"); + + dcerpc_smb_store_pol_name(&policy_hnd, pinfo, pol_name); + + if (hnd_item != NULL) + proto_item_append_text(hnd_item, ": %s", pol_name); + + g_free(pol_name); + } + return offset; } static int -samr_dissect_connect_anon_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_connect_anon_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_connect2_server, NDR_POINTER_UNIQUE, - "Server", hf_samr_server, 1); + char str[2]; + guint16 server; - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_access, NULL); + offset=dissect_ndr_uint16(tvb, offset, pinfo, NULL, drep, + hf_samr_server, &server); + str[0]=server&0xff; + str[1]=0; + proto_tree_add_string_format(tree, hf_samr_server, tvb, offset-2, 2, + str, "Server: %s", str); return offset; } static int -samr_dissect_connect_anon_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_connect_anon_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { + e_ctx_hnd policy_hnd; + proto_item *hnd_item; + guint32 status; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, &policy_hnd, &hnd_item, + TRUE, FALSE); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, - hf_samr_rc, NULL); + hf_samr_rc, &status); + + if (status == 0) { + dcerpc_smb_store_pol_name(&policy_hnd, pinfo, + "ConnectAnon handle"); + + if (hnd_item != NULL) + proto_item_append_text(hnd_item, ": ConnectAnon handle"); + } return offset; } static int -samr_dissect_USER_GROUP(tvbuff_t *tvb, int offset, +samr_dissect_USER_GROUP(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -980,7 +1326,7 @@ samr_dissect_USER_GROUP(tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_GROUP_ARRAY_groups (tvbuff_t *tvb, int offset, +samr_dissect_USER_GROUP_ARRAY_groups (tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { @@ -991,7 +1337,7 @@ samr_dissect_USER_GROUP_ARRAY_groups (tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_GROUP_ARRAY(tvbuff_t *tvb, int offset, +samr_dissect_USER_GROUP_ARRAY(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -1010,42 +1356,42 @@ samr_dissect_USER_GROUP_ARRAY(tvbuff_t *tvb, int offset, hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_GROUP_ARRAY_groups, NDR_POINTER_UNIQUE, - "USER_GROUP_ARRAY", -1, 0); + "USER_GROUP_ARRAY", -1); proto_item_set_len(item, offset-old_offset); return offset; } static int -samr_dissect_USER_GROUP_ARRAY_ptr(tvbuff_t *tvb, int offset, +samr_dissect_USER_GROUP_ARRAY_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_GROUP_ARRAY, NDR_POINTER_UNIQUE, - "USER_GROUP_ARRAY", -1, 0); + "USER_GROUP_ARRAY", -1); return offset; } static int -samr_dissect_get_groups_for_user_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_get_groups_for_user_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); return offset; } static int -samr_dissect_get_groups_for_user_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_get_groups_for_user_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_GROUP_ARRAY_ptr, NDR_POINTER_REF, - "", -1, 0); + "USER_GROUP_ARRAY:", -1); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -1053,58 +1399,99 @@ samr_dissect_get_groups_for_user_reply(tvbuff_t *tvb, int offset, } +static void append_sid_col_info(packet_info *pinfo, proto_tree *tree _U_, + proto_item *item _U_, tvbuff_t *tvb _U_, + int start_offset _U_, int end_offset _U_, + void *callback_args _U_) +{ + dcerpc_info *di = (dcerpc_info *)pinfo->private_data; + dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data; + char *sid_str = dcv->private_data; + + if (sid_str && check_col(pinfo->cinfo, COL_INFO)) + col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", sid_str); +} static int -samr_dissect_open_domain_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_open_domain_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); + + offset = dissect_nt_access_mask( + tvb, offset, pinfo, tree, drep, hf_samr_access, + &samr_domain_access_mask_info); + + offset = dissect_ndr_pointer_cb( + tvb, offset, pinfo, tree, drep, dissect_ndr_nt_SID_no_hf, + NDR_POINTER_REF, "SID:", -1, append_sid_col_info, NULL); - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_access, NULL); - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - dissect_ndr_nt_SID, NDR_POINTER_REF, - "", -1, 0); return offset; } static int -samr_dissect_open_domain_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_open_domain_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { + dcerpc_info *di = (dcerpc_info *)pinfo->private_data; + dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data; + e_ctx_hnd policy_hnd; + proto_item *hnd_item; + guint32 status; + char *pol_name, *sid_str = (char *)dcv->private_data; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, &policy_hnd, &hnd_item, + TRUE, FALSE); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, - hf_samr_rc, NULL); + hf_samr_rc, &status); + + if (status == 0) { + if (sid_str) { + pol_name = g_strdup_printf("OpenDomain(%s)", sid_str); + } else { + pol_name = g_strdup("OpenDomain handle"); + } + + dcerpc_smb_store_pol_name(&policy_hnd, pinfo, pol_name); + + if (hnd_item != NULL) + proto_item_append_text(hnd_item, ": %s", pol_name); + + g_free(pol_name); + } return offset; } +#if 0 static int -samr_dissect_context_handle_SID(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_context_handle_SID(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + dissect_ndr_nt_SID_no_hf, NDR_POINTER_REF, + "SID pointer", -1); - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - dissect_ndr_nt_SID, NDR_POINTER_REF, - "SID", -1, 0); return offset; } +#endif static int -samr_dissect_add_member_to_group_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_add_member_to_group_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_group, NULL); @@ -1116,8 +1503,8 @@ samr_dissect_add_member_to_group_rqst(tvbuff_t *tvb, int offset, } static int -samr_dissect_add_member_to_group_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_add_member_to_group_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -1127,24 +1514,24 @@ samr_dissect_add_member_to_group_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_unknown_3c_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_get_boot_key_information_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); return offset; } static int -samr_dissect_unknown_3c_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_get_boot_key_information_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_short, NDR_POINTER_REF, - "", hf_samr_unknown_short, 0); + "unknown short", hf_samr_unknown_short); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -1152,72 +1539,88 @@ samr_dissect_unknown_3c_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_create_alias_in_domain_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_create_alias_in_domain_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF, - "Account Name", hf_samr_acct_name, 0); + dissect_ndr_counted_string_ptr, NDR_POINTER_REF, + "Account Name", hf_samr_acct_name); - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_access, NULL); + offset = dissect_nt_access_mask( + tvb, offset, pinfo, tree, drep, hf_samr_access, + &samr_alias_access_mask_info); return offset; } static int -samr_dissect_create_alias_in_domain_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_create_alias_in_domain_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { + e_ctx_hnd policy_hnd; + proto_item *hnd_item; + guint32 status; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, &policy_hnd, &hnd_item, + TRUE, FALSE); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, - hf_samr_rc, NULL); + hf_samr_rc, &status); + + if (status == 0) { + dcerpc_smb_store_pol_name(&policy_hnd, pinfo, + "CreateAlias handle"); + if (hnd_item != NULL) + proto_item_append_text(hnd_item, ": CreateAlias handle"); + } return offset; } static int -samr_dissect_query_information_alias_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_query_information_alias_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { + guint16 level; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, - hf_samr_level, NULL); + hf_samr_level, &level); + + if (check_col(pinfo->cinfo, COL_INFO)) + col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level); return offset; } static int -samr_dissect_ALIAS_INFO_1 (tvbuff_t *tvb, int offset, +samr_dissect_ALIAS_INFO_1 (tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, - tree, drep, - hf_samr_acct_name, 0); + offset = dissect_ndr_counted_string(tvb, offset, pinfo, + tree, drep, hf_samr_acct_name, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, - tree, drep, - hf_samr_acct_desc, 0); + offset = dissect_ndr_counted_string(tvb, offset, pinfo, + tree, drep, hf_samr_acct_desc, 0); return offset; } static int -samr_dissect_ALIAS_INFO(tvbuff_t *tvb, int offset, +samr_dissect_ALIAS_INFO(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -1235,19 +1638,17 @@ samr_dissect_ALIAS_INFO(tvbuff_t *tvb, int offset, offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, hf_samr_level, &level); switch(level){ - case 1: + case 1: offset = samr_dissect_ALIAS_INFO_1( tvb, offset, pinfo, tree, drep); break; - case 2: - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, - tree, drep, - hf_samr_acct_name, 0); + case 2: + offset = dissect_ndr_counted_string(tvb, offset, pinfo, + tree, drep, hf_samr_acct_name, 0); break; - case 3: - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, - tree, drep, - hf_samr_acct_desc, 0); + case 3: + offset = dissect_ndr_counted_string(tvb, offset, pinfo, + tree, drep, hf_samr_acct_desc, 0); break; } @@ -1256,24 +1657,24 @@ samr_dissect_ALIAS_INFO(tvbuff_t *tvb, int offset, } static int -samr_dissect_ALIAS_INFO_ptr(tvbuff_t *tvb, int offset, +samr_dissect_ALIAS_INFO_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_ALIAS_INFO, NDR_POINTER_UNIQUE, - "ALIAS_INFO", -1, 0); + "ALIAS_INFO", -1); return offset; } static int -samr_dissect_query_information_alias_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_query_information_alias_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_ALIAS_INFO_ptr, NDR_POINTER_REF, - "", -1, 0); + "ALIAS_INFO:", -1); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -1282,29 +1683,35 @@ samr_dissect_query_information_alias_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_set_information_alias_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_set_information_alias_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { + guint16 level; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, - hf_samr_level, NULL); + hf_samr_level, &level); + + if (check_col(pinfo->cinfo, COL_INFO)) + col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_ALIAS_INFO, NDR_POINTER_REF, - "", -1, 0); + "ALIAS_INFO:", -1); return offset; } static int -samr_dissect_set_information_alias_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_set_information_alias_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_ALIAS_INFO_ptr, NDR_POINTER_REF, - "", -1, 0); + "ALIAS_INFO", -1); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -1312,54 +1719,290 @@ samr_dissect_set_information_alias_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_CRYPT_PASSWORD(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, - char *drep) +samr_dissect_CRYPT_PASSWORD(tvbuff_t *tvb, int offset, + packet_info *pinfo _U_, proto_tree *tree, + char *drep _U_) { + dcerpc_info *di; + + di=pinfo->private_data; + if(di->conformant_run){ + /* just a run to handle conformant arrays, no scalars to dissect */ + return offset; + } + proto_tree_add_item(tree, hf_samr_crypt_password, tvb, offset, 516, - FALSE); + TRUE); offset += 516; return offset; } static int -samr_dissect_CRYPT_HASH(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, - char *drep) +samr_dissect_CRYPT_HASH(tvbuff_t *tvb, int offset, + packet_info *pinfo _U_, proto_tree *tree, + char *drep _U_) { + dcerpc_info *di; + + di=pinfo->private_data; + if(di->conformant_run){ + /* just a run to handle conformant arrays, no scalars to dissect */ + return offset; + } + proto_tree_add_item(tree, hf_samr_crypt_hash, tvb, offset, 16, - FALSE); + TRUE); offset += 16; return offset; } +#define NT_BLOCK_SIZE 516 + +static void +samr_dissect_decrypted_NT_PASSCHANGE_BLOCK(tvbuff_t *tvb, int offset, + packet_info *pinfo _U_, proto_tree *tree, + char *drep _U_) +{ + guint32 new_password_len = 0; + guint32 pseudorandom_len = 0; + const char *printable_password; + guint16 bc; + int result_length; + + /* The length of the new password is represented in the last four + octets of the decrypted buffer. Since the password length cannot + exceed 512, we can check the contents of those bytes to determine + if decryption was successful. If the decrypted contents of those + four bytes is less than 512, then there is a 99% chance that + we decrypted the buffer successfully. Of course, this isn't good + enough for a security application, (NT uses the "verifier" field + to come to the same conclusion), but it should be good enough for + our dissector. */ + + new_password_len = tvb_get_letohl(tvb, 512); + + if (new_password_len <= 512) + { + /* Decryption successful */ + proto_tree_add_text (tree, tvb, offset, -1, + "Decryption of NT Password Encrypted block successful"); + + /* Whatever is before the password is pseudorandom data. We calculate + the length by examining the password length (at the end), and working + backward */ + pseudorandom_len = NT_BLOCK_SIZE - new_password_len - 4; + + /* Pseudorandom data padding up to password */ + proto_tree_add_item(tree, hf_samr_nt_passchange_block_pseudorandom, + tvb, offset, pseudorandom_len, TRUE); + offset += pseudorandom_len; + + /* The new password itself */ + bc = new_password_len; + printable_password = get_unicode_or_ascii_string(tvb, &offset, + TRUE, + &result_length, + FALSE, TRUE, &bc); + proto_tree_add_string(tree, hf_samr_nt_passchange_block_newpass, + tvb, offset, result_length, + printable_password); + offset += new_password_len; + + /* Length of password */ + proto_tree_add_item(tree, hf_samr_nt_passchange_block_newpass_len, + tvb, offset, 4, TRUE); + } + else + { + /* Decryption failure. Just show the encrypted block */ + proto_tree_add_text (tree, tvb, offset, -1, + "Decryption of NT Passchange block failed"); + + proto_tree_add_item(tree, hf_samr_nt_passchange_block_decrypted, tvb, + offset, NT_BLOCK_SIZE, TRUE); + } +} + +static int +samr_dissect_NT_PASSCHANGE_BLOCK(tvbuff_t *tvb, int offset, + packet_info *pinfo _U_, proto_tree *tree, + char *drep _U_) +{ + dcerpc_info *di; + size_t password_len; + unsigned char *password_unicode; + size_t password_len_unicode; + unsigned char password_md4_hash[16]; + guint8 *block; + tvbuff_t *decr_tvb; /* Used to store decrypted buffer */ + rc4_state_struct rc4_state; + guint i; + + /* This implements the the algorithm discussed in lkcl -"DCE/RPC + over SMB" page 257. Note that this code does not properly support + Unicode. */ + + di=pinfo->private_data; + if(di->conformant_run){ + /* just a run to handle conformant arrays, no scalars to dissect */ + return offset; + } + + /* Put in a protocol tree entry for the encrypted block. */ + proto_tree_add_text(tree, tvb, offset, NT_BLOCK_SIZE, + "Encrypted NT Password Block"); + + if (nt_password[0] != '\0') { + /* We have an NT password, so we can decrypt the password + change block. */ + + /* Convert the password provided in the Ethereal GUI to Unicode + (UCS-2). Since the input is always ASCII, we can just fake + it and pad every other byte with a NUL. If we ever support + UTF-8 in the GUI, we would have to perform a real UTF-8 to + UCS-2 conversion */ + password_len = strlen(nt_password); + password_len_unicode = password_len*2; + password_unicode = g_malloc(password_len_unicode); + for (i = 0; i < password_len; i++) { + password_unicode[i*2] = nt_password[i]; + password_unicode[i*2+1] = 0; + } + + /* Run MD4 against the resulting Unicode password. This will + be used to perform RC4 decryption on the password change + block. Then free the Unicode password, as we're done + with it. */ + crypt_md4(password_md4_hash, password_unicode, + password_len_unicode); + g_free(password_unicode); + + /* Copy the block into a temporary buffer so we can decrypt + it */ + block = g_malloc(NT_BLOCK_SIZE); + memset(block, 0, NT_BLOCK_SIZE); + tvb_memcpy(tvb, block, offset, NT_BLOCK_SIZE); + + /* RC4 decrypt the block with the old NT password hash */ + crypt_rc4_init(&rc4_state, password_md4_hash, 16); + crypt_rc4(&rc4_state, block, NT_BLOCK_SIZE); + + /* Show the decrypted buffer in a new window */ + decr_tvb = tvb_new_real_data(block, NT_BLOCK_SIZE, + NT_BLOCK_SIZE); + tvb_set_free_cb(decr_tvb, g_free); + tvb_set_child_real_data_tvbuff(tvb, decr_tvb); + add_new_data_source(pinfo, decr_tvb, + "Decrypted NT Password Block"); + + /* Dissect the decrypted block */ + samr_dissect_decrypted_NT_PASSCHANGE_BLOCK(decr_tvb, 0, pinfo, + tree, drep); + } + offset += NT_BLOCK_SIZE; + return offset; +} + +static int +samr_dissect_LM_PASSCHANGE_BLOCK(tvbuff_t *tvb, int offset, + packet_info *pinfo _U_, proto_tree *tree, + char *drep _U_) +{ + dcerpc_info *di; + + /* Right now, this just dumps the output. In the long term, we can use + the algorithm discussed in lkcl -"DCE/RPC over SMB" page 257 to + actually decrypt the block */ + + di=pinfo->private_data; + if(di->conformant_run){ + /* just a run to handle conformant arrays, no scalars to dissect */ + return offset; + } + + proto_tree_add_item(tree, hf_samr_lm_passchange_block, tvb, offset, + 516, TRUE); + offset += 516; + return offset; +} static int -samr_dissect_oem_change_password_user2_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_LM_VERIFIER(tvbuff_t *tvb, int offset, + packet_info *pinfo _U_, proto_tree *tree, + char *drep _U_) +{ + dcerpc_info *di; + + /* Right now, this just dumps the output. In the long term, we can use + the algorithm discussed in lkcl -"DCE/RPC over SMB" page 257 to + actually validate the verifier */ + + di=pinfo->private_data; + if(di->conformant_run){ + /* just a run to handle conformant arrays, no scalars to dissect */ + return offset; + } + + proto_tree_add_item(tree, hf_samr_lm_verifier, tvb, offset, 16, + TRUE); + offset += 16; + return offset; +} + + +static int +samr_dissect_NT_VERIFIER(tvbuff_t *tvb, int offset, + packet_info *pinfo _U_, proto_tree *tree, + char *drep _U_) +{ + dcerpc_info *di; + + /* Right now, this just dumps the output. In the long term, we can use + the algorithm discussed in lkcl -"DCE/RPC over SMB" page 257 to + actually validate the verifier */ + + di=pinfo->private_data; + if(di->conformant_run){ + /* just a run to handle conformant arrays, no scalars to dissect */ + return offset; + } + + proto_tree_add_item(tree, hf_samr_nt_verifier, tvb, offset, 16, + TRUE); + offset += 16; + return offset; +} + + +static int +samr_dissect_oem_change_password_user2_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_STRING, NDR_POINTER_UNIQUE, - "Server", hf_samr_server, 0); + "Server", hf_samr_server); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_STRING, NDR_POINTER_REF, - "Account Name", hf_samr_acct_name, 0); + "Account Name", hf_samr_acct_name); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_PASSWORD, NDR_POINTER_UNIQUE, - "Password", -1, 0); + "Password", -1); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - "Hash", -1, 0); + "Hash", -1); return offset; } static int -samr_dissect_oem_change_password_user2_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_oem_change_password_user2_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -1369,39 +2012,41 @@ samr_dissect_oem_change_password_user2_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_unicode_change_password_user2_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_unicode_change_password_user2_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) -{ - offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); - +{ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE, - "Server", hf_samr_server, 0); + samr_dissect_PASSWORD_INFO, NDR_POINTER_REF, + "PASSWORD_INFO:", -1); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep, + NDR_POINTER_UNIQUE, "Server", hf_samr_server, 0); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF, - "Account Name", hf_samr_acct_name, 0); + dissect_ndr_counted_string_ptr, NDR_POINTER_REF, + "Account Name", hf_samr_acct_name); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_CRYPT_PASSWORD, NDR_POINTER_UNIQUE, - "Password", -1, 0); + samr_dissect_NT_PASSCHANGE_BLOCK, NDR_POINTER_UNIQUE, + "New NT Password Encrypted Block", -1); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - "Hash", -1, 0); + samr_dissect_NT_VERIFIER, NDR_POINTER_UNIQUE, + "NT Password Verifier", -1); offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep, hf_samr_lm_change, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_CRYPT_PASSWORD, NDR_POINTER_UNIQUE, - "Password", -1, 0); + samr_dissect_LM_PASSCHANGE_BLOCK, NDR_POINTER_UNIQUE, + "New Lan Manager Password Encrypted Block", -1); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - "Hash", -1, 0); + samr_dissect_LM_VERIFIER, NDR_POINTER_UNIQUE, + "Lan Manager Password Verifier", -1); return offset; } static int -samr_dissect_unicode_change_password_user2_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_unicode_change_password_user2_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -1411,27 +2056,27 @@ samr_dissect_unicode_change_password_user2_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_unknown_3b_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_set_boot_key_information_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, hf_samr_unknown_short, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE, - "Unknown", hf_samr_unknown_string, 0); + dissect_ndr_counted_string_ptr, NDR_POINTER_UNIQUE, + "Unknown", hf_samr_unknown_string); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE, - "Unknown", hf_samr_unknown_string, 0); + dissect_ndr_counted_string_ptr, NDR_POINTER_UNIQUE, + "Unknown", hf_samr_unknown_string); return offset; } static int -samr_dissect_unknown_3b_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_set_boot_key_information_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -1441,60 +2086,79 @@ samr_dissect_unknown_3b_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_create_user2_in_domain_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_create_user2_in_domain_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF, - "Account Name", hf_samr_acct_name, 0); + dissect_ndr_counted_string_ptr, NDR_POINTER_REF, + "Account Name", hf_samr_acct_name); + offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep); - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_access, NULL); + + offset = dissect_nt_access_mask( + tvb, offset, pinfo, tree, drep, hf_samr_access, + &samr_user_access_mask_info); return offset; } static int -samr_dissect_create_user2_in_domain_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_create_user2_in_domain_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { + e_ctx_hnd policy_hnd; + proto_item *hnd_item; + guint32 status; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, &policy_hnd, &hnd_item, + TRUE, FALSE); + + offset = dissect_nt_access_mask( + tvb, offset, pinfo, tree, drep, hf_samr_access_granted, + &samr_user_access_mask_info); - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_unknown_long, NULL); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, - hf_samr_rc, NULL); + hf_samr_rc, &status); + + if (status == 0) { + dcerpc_smb_store_pol_name(&policy_hnd, pinfo, + "CreateUser2 handle"); + + if (hnd_item != NULL) + proto_item_append_text(hnd_item, ": CreateUser2 handle"); + } + return offset; } static int -samr_dissect_get_display_enumeration_index2_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_get_display_enumeration_index2_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, hf_samr_level, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF, - "Account Name", hf_samr_acct_name, 0); + dissect_ndr_counted_string_ptr, NDR_POINTER_REF, + "Account Name", hf_samr_acct_name); return offset; } static int -samr_dissect_get_display_enumeration_index2_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_get_display_enumeration_index2_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, @@ -1506,46 +2170,46 @@ samr_dissect_get_display_enumeration_index2_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_change_password_user_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_change_password_user_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep, hf_samr_unknown_char, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - "Hash", -1, 0); + "Hash", -1); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - "Hash", -1, 0); + "Hash", -1); offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep, hf_samr_unknown_char, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - "Hash", -1, 0); + "Hash", -1); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - "Hash", -1, 0); + "Hash", -1); offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep, hf_samr_unknown_char, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - "Hash", -1, 0); + "Hash", -1); offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep, hf_samr_unknown_char, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE, - "Hash", -1, 0); + "Hash", -1); return offset; } static int -samr_dissect_change_password_user_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_change_password_user_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -1555,12 +2219,12 @@ samr_dissect_change_password_user_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_set_member_attributes_of_group_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_set_member_attributes_of_group_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_attrib, NULL); @@ -1568,8 +2232,8 @@ samr_dissect_set_member_attributes_of_group_rqst(tvbuff_t *tvb, int offset, } static int -samr_dissect_set_member_attributes_of_group_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_set_member_attributes_of_group_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -1579,25 +2243,23 @@ samr_dissect_set_member_attributes_of_group_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_GROUP_INFO_1 (tvbuff_t *tvb, int offset, +samr_dissect_GROUP_INFO_1 (tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, - tree, drep, - hf_samr_acct_name, 0); + offset = dissect_ndr_counted_string(tvb, offset, pinfo, + tree, drep, hf_samr_acct_name, 0); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_attrib, NULL); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, - tree, drep, - hf_samr_acct_desc, 0); + offset = dissect_ndr_counted_string(tvb, offset, pinfo, + tree, drep, hf_samr_acct_desc, 0); return offset; } static int -samr_dissect_GROUP_INFO(tvbuff_t *tvb, int offset, +samr_dissect_GROUP_INFO(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -1615,23 +2277,21 @@ samr_dissect_GROUP_INFO(tvbuff_t *tvb, int offset, offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, hf_samr_level, &level); switch(level){ - case 1: + case 1: offset = samr_dissect_GROUP_INFO_1( tvb, offset, pinfo, tree, drep); break; - case 2: - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, - tree, drep, - hf_samr_acct_name, 0); + case 2: + offset = dissect_ndr_counted_string(tvb, offset, pinfo, + tree, drep, hf_samr_acct_name, 0); break; case 3: offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_attrib, NULL); break; - case 4: - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, - tree, drep, - hf_samr_acct_desc, 0); + case 4: + offset = dissect_ndr_counted_string(tvb, offset, pinfo, + tree, drep, hf_samr_acct_desc, 0); break; } @@ -1640,23 +2300,23 @@ samr_dissect_GROUP_INFO(tvbuff_t *tvb, int offset, } static int -samr_dissect_GROUP_INFO_ptr(tvbuff_t *tvb, int offset, +samr_dissect_GROUP_INFO_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_GROUP_INFO, NDR_POINTER_UNIQUE, - "GROUP_INFO", -1, 0); + "GROUP_INFO", -1); return offset; } static int -samr_dissect_query_information_group_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_query_information_group_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, hf_samr_level, NULL); @@ -1665,13 +2325,13 @@ samr_dissect_query_information_group_rqst(tvbuff_t *tvb, int offset, } static int -samr_dissect_query_information_group_reply(tvbuff_t *tvb, int offset, +samr_dissect_query_information_group_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_GROUP_INFO_ptr, NDR_POINTER_REF, - "", -1, 0); + "GROUP_INFO", -1); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -1679,24 +2339,30 @@ samr_dissect_query_information_group_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_set_information_group_rqst(tvbuff_t *tvb, int offset, +samr_dissect_set_information_group_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { + guint16 level; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, - hf_samr_level, NULL); + hf_samr_level, &level); + + if (check_col(pinfo->cinfo, COL_INFO)) + col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_GROUP_INFO, NDR_POINTER_REF, - "", -1, 0); + "GROUP_INFO", -1); return offset; } static int -samr_dissect_set_information_group_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_set_information_group_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -1705,40 +2371,40 @@ samr_dissect_set_information_group_reply(tvbuff_t *tvb, int offset, return offset; } - static int -samr_dissect_get_domain_password_information_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_get_domain_password_information_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { - offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_pointer_STRING, NDR_POINTER_UNIQUE, - "Domain", hf_samr_domain, 0); + samr_dissect_PASSWORD_INFO, NDR_POINTER_REF, + "PASSWORD_INFO:", -1); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep, + NDR_POINTER_UNIQUE, "Domain", hf_samr_domain, 0); + return offset; } static int -samr_dissect_get_domain_password_information_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, - proto_tree *tree, +samr_dissect_get_domain_password_information_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, + proto_tree *tree, char *drep) { - /* - * XXX - really? Not the same as - * "samr_dissect_get_usrdom_pwinfo_reply()"? - */ - offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + samr_dissect_PASSWORD_INFO, NDR_POINTER_REF, + "PASSWORD_INFO:", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, + hf_samr_rc, NULL); return offset; } static int -samr_dissect_DOMAIN_INFO_1(tvbuff_t *tvb, int offset, +samr_dissect_DOMAIN_INFO_1(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -1746,7 +2412,7 @@ samr_dissect_DOMAIN_INFO_1(tvbuff_t *tvb, int offset, proto_tree *tree=NULL; int old_offset=offset; - ALIGN_TO_4_BYTES; /* strcture starts with short, but is aligned for longs */ + ALIGN_TO_4_BYTES; /* strcture starts with short, but is aligned for longs */ if(parent_tree){ item = proto_tree_add_text(parent_tree, tvb, offset, -1, @@ -1769,7 +2435,7 @@ samr_dissect_DOMAIN_INFO_1(tvbuff_t *tvb, int offset, } static int -samr_dissect_DOMAIN_INFO_2(tvbuff_t *tvb, int offset, +samr_dissect_DOMAIN_INFO_2(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -1785,11 +2451,11 @@ samr_dissect_DOMAIN_INFO_2(tvbuff_t *tvb, int offset, offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep, hf_samr_unknown_time); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_unknown_string, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_domain, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_controller, 0); offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep, hf_samr_unknown_time); @@ -1811,7 +2477,7 @@ samr_dissect_DOMAIN_INFO_2(tvbuff_t *tvb, int offset, } static int -samr_dissect_DOMAIN_INFO_8(tvbuff_t *tvb, int offset, +samr_dissect_DOMAIN_INFO_8(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -1835,7 +2501,7 @@ samr_dissect_DOMAIN_INFO_8(tvbuff_t *tvb, int offset, } static int -samr_dissect_REPLICATION_STATUS(tvbuff_t *tvb, int offset, +samr_dissect_REPLICATION_STATUS(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -1861,7 +2527,7 @@ samr_dissect_REPLICATION_STATUS(tvbuff_t *tvb, int offset, } static int -samr_dissect_DOMAIN_INFO_11(tvbuff_t *tvb, int offset, +samr_dissect_DOMAIN_INFO_11(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -1885,7 +2551,7 @@ samr_dissect_DOMAIN_INFO_11(tvbuff_t *tvb, int offset, } static int -samr_dissect_DOMAIN_INFO_13(tvbuff_t *tvb, int offset, +samr_dissect_DOMAIN_INFO_13(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -1912,7 +2578,7 @@ samr_dissect_DOMAIN_INFO_13(tvbuff_t *tvb, int offset, static int -samr_dissect_DOMAIN_INFO(tvbuff_t *tvb, int offset, +samr_dissect_DOMAIN_INFO(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -1932,11 +2598,11 @@ samr_dissect_DOMAIN_INFO(tvbuff_t *tvb, int offset, ALIGN_TO_4_BYTES; /* all union arms aligned to 4 bytes, case 7 and 9 need this */ switch(level){ - case 1: + case 1: offset = samr_dissect_DOMAIN_INFO_1( tvb, offset, pinfo, tree, drep); break; - case 2: + case 2: offset = samr_dissect_DOMAIN_INFO_2( tvb, offset, pinfo, tree, drep); break; @@ -1946,17 +2612,17 @@ samr_dissect_DOMAIN_INFO(tvbuff_t *tvb, int offset, hf_samr_unknown_time); break; case 4: - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_unknown_string, 0); break; case 5: - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_domain, 0); break; case 6: - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_controller, 0); break; @@ -1964,7 +2630,7 @@ samr_dissect_DOMAIN_INFO(tvbuff_t *tvb, int offset, offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, hf_samr_unknown_short, NULL); break; - case 8: + case 8: offset = samr_dissect_DOMAIN_INFO_8( tvb, offset, pinfo, tree, drep); break; @@ -1972,7 +2638,7 @@ samr_dissect_DOMAIN_INFO(tvbuff_t *tvb, int offset, offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, hf_samr_unknown_short, NULL); break; - case 11: + case 11: offset = samr_dissect_DOMAIN_INFO_11( tvb, offset, pinfo, tree, drep); break; @@ -1980,7 +2646,7 @@ samr_dissect_DOMAIN_INFO(tvbuff_t *tvb, int offset, offset = samr_dissect_REPLICATION_STATUS( tvb, offset, pinfo, tree, drep); break; - case 13: + case 13: offset = samr_dissect_DOMAIN_INFO_13( tvb, offset, pinfo, tree, drep); break; @@ -1991,34 +2657,29 @@ samr_dissect_DOMAIN_INFO(tvbuff_t *tvb, int offset, } static int -samr_dissect_DOMAIN_INFO_ptr(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, - char *drep) -{ - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_DOMAIN_INFO, NDR_POINTER_UNIQUE, - "DOMAIN_INFO pointer", hf_samr_domain, 0); - return offset; -} - -static int -samr_dissect_set_information_domain_rqst(tvbuff_t *tvb, int offset, +samr_dissect_set_information_domain_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { + guint16 level; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, - hf_samr_level, NULL); + hf_samr_level, &level); + + if (check_col(pinfo->cinfo, COL_INFO)) + col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level); + offset = samr_dissect_DOMAIN_INFO(tvb, offset, pinfo, tree, drep); return offset; } static int -samr_dissect_set_information_domain_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_set_information_domain_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -2028,31 +2689,28 @@ samr_dissect_set_information_domain_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_lookup_domain_rqst(tvbuff_t *tvb, int offset, +samr_dissect_lookup_domain_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF, - "", hf_samr_domain, 0); + dissect_ndr_counted_string_ptr, NDR_POINTER_REF, + "Domain", hf_samr_domain); return offset; } static int -samr_dissect_lookup_domain_reply(tvbuff_t *tvb, int offset, +samr_dissect_lookup_domain_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { - if (check_col(pinfo->cinfo, COL_INFO)) - col_set_str(pinfo->cinfo, COL_INFO, "QueryDomainInfo reponse"); - - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - dissect_ndr_nt_SID_ptr, NDR_POINTER_REF, - "", -1, 0); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + dissect_ndr_nt_SID_no_hf, NDR_POINTER_UNIQUE, + "SID pointer", -1); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -2060,9 +2718,9 @@ samr_dissect_lookup_domain_reply(tvbuff_t *tvb, int offset, } int -dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset, +dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, - char *drep) + char *drep, int hf_sid) { proto_item *item=NULL; proto_tree *tree=NULL; @@ -2074,29 +2732,36 @@ dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset, tree = proto_item_add_subtree(item, ett_samr_sid_pointer); } - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - dissect_ndr_nt_SID, NDR_POINTER_UNIQUE, - "SID", -1, 0); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + dissect_ndr_nt_SID_hf_through_ptr, NDR_POINTER_UNIQUE, + "SID pointer", hf_sid); proto_item_set_len(item, offset-old_offset); return offset; } - +static int +dissect_ndr_nt_PSID_no_hf(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + char *drep) +{ + offset=dissect_ndr_nt_PSID(tvb, offset, pinfo, parent_tree, drep, -1); + return offset; +} static int -dissect_ndr_nt_PSID_ARRAY_sids (tvbuff_t *tvb, int offset, +dissect_ndr_nt_PSID_ARRAY_sids (tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, - dissect_ndr_nt_PSID); + dissect_ndr_nt_PSID_no_hf); return offset; } int -dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset, +dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2115,7 +2780,7 @@ dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset, hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, dissect_ndr_nt_PSID_ARRAY_sids, NDR_POINTER_UNIQUE, - "PSID_ARRAY", -1, 0); + "PSID_ARRAY", -1); proto_item_set_len(item, offset-old_offset); return offset; @@ -2123,7 +2788,7 @@ dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset, /* called from NETLOGON but placed here since where are where the hf_fields are defined */ int -dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset, +dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2136,7 +2801,7 @@ dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset, tree = proto_item_add_subtree(item, ett_samr_sid_and_attributes); } - offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep); + offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep, -1); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_attrib, NULL); @@ -2145,11 +2810,10 @@ dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset, } int -dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset, +dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { - guint32 count; proto_item *item=NULL; proto_tree *tree=NULL; int old_offset=offset; @@ -2160,8 +2824,8 @@ dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset, tree = proto_item_add_subtree(item, ett_samr_sid_and_attributes_array); } - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_count, &count); + /*offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, + hf_samr_count, &count); */ offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, dissect_ndr_nt_SID_AND_ATTRIBUTES); @@ -2171,7 +2835,7 @@ dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset, static int -samr_dissect_index(tvbuff_t *tvb, int offset, +samr_dissect_index(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { @@ -2187,7 +2851,7 @@ samr_dissect_index(tvbuff_t *tvb, int offset, static int -samr_dissect_INDEX_ARRAY_value (tvbuff_t *tvb, int offset, +samr_dissect_INDEX_ARRAY_value (tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { @@ -2213,7 +2877,7 @@ plural_ending(const char *string) } static int -samr_dissect_INDEX_ARRAY(tvbuff_t *tvb, int offset, +samr_dissect_INDEX_ARRAY(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2240,55 +2904,44 @@ samr_dissect_INDEX_ARRAY(tvbuff_t *tvb, int offset, hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_INDEX_ARRAY_value, NDR_POINTER_UNIQUE, - str, di->hf_index, 0); + str, di->hf_index); proto_item_set_len(item, offset-old_offset); return offset; } static int -samr_dissect_get_alias_membership_rqst(tvbuff_t *tvb, int offset, +samr_dissect_get_alias_membership_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF, - "", -1, 0); - - return offset; -} - -static int -samr_dissect_get_alias_membership_response(tvbuff_t *tvb, int offset, - packet_info *pinfo, - proto_tree *tree, char *drep) -{ - offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, - hf_samr_rc, NULL); + "PSID_ARRAY:", -1); return offset; } static int -samr_dissect_get_alias_membership_reply(tvbuff_t *tvb, int offset, +samr_dissect_get_alias_membership_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_INDEX_ARRAY, NDR_POINTER_REF, - "", hf_samr_alias, 0); + "INDEX_ARRAY:", hf_samr_alias); - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_rc, NULL); + offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, + hf_samr_rc, NULL); return offset; } static int -samr_dissect_IDX_AND_NAME(tvbuff_t *tvb, int offset, +samr_dissect_IDX_AND_NAME(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2309,7 +2962,7 @@ samr_dissect_IDX_AND_NAME(tvbuff_t *tvb, int offset, offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_index, NULL); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, di->hf_index, 4); proto_item_set_len(item, offset-old_offset); @@ -2317,7 +2970,7 @@ samr_dissect_IDX_AND_NAME(tvbuff_t *tvb, int offset, } static int -samr_dissect_IDX_AND_NAME_entry (tvbuff_t *tvb, int offset, +samr_dissect_IDX_AND_NAME_entry (tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { @@ -2329,7 +2982,7 @@ samr_dissect_IDX_AND_NAME_entry (tvbuff_t *tvb, int offset, static int -samr_dissect_IDX_AND_NAME_ARRAY(tvbuff_t *tvb, int offset, +samr_dissect_IDX_AND_NAME_ARRAY(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2352,21 +3005,21 @@ samr_dissect_IDX_AND_NAME_ARRAY(tvbuff_t *tvb, int offset, tree = proto_item_add_subtree(item, ett_samr_idx_and_name_array); } - + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_count, &count); snprintf(str, 255, "IDX_AND_NAME pointer: %s%s:", field_name, plural_ending(field_name)); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_IDX_AND_NAME_entry, NDR_POINTER_UNIQUE, - str, di->hf_index, 0); + str, di->hf_index); proto_item_set_len(item, offset-old_offset); return offset; } static int -samr_dissect_IDX_AND_NAME_ARRAY_ptr(tvbuff_t *tvb, int offset, +samr_dissect_IDX_AND_NAME_ARRAY_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { @@ -2381,21 +3034,21 @@ samr_dissect_IDX_AND_NAME_ARRAY_ptr(tvbuff_t *tvb, int offset, plural_ending(field_name)); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_IDX_AND_NAME_ARRAY, NDR_POINTER_UNIQUE, - str, di->hf_index, 0); + str, di->hf_index); return offset; } static int -samr_dissect_enum_domains_rqst(tvbuff_t *tvb, int offset, +samr_dissect_enum_domains_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - "", hf_samr_resume_hnd, 0); + "Resume Handle", hf_samr_resume_hnd); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_pref_maxsize, NULL); @@ -2404,19 +3057,21 @@ samr_dissect_enum_domains_rqst(tvbuff_t *tvb, int offset, } static int -samr_dissect_enum_domains_reply(tvbuff_t *tvb, int offset, +samr_dissect_enum_domains_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - "", hf_samr_resume_hnd, 0); + "Resume Handle:", hf_samr_resume_hnd); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_IDX_AND_NAME_ARRAY_ptr, NDR_POINTER_REF, - "", hf_samr_domain, 0); + "IDX_AND_NAME_ARRAY:", hf_samr_domain); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - "", hf_samr_entries, 0); + "Entries:", hf_samr_entries); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -2425,18 +3080,20 @@ samr_dissect_enum_domains_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_enum_dom_groups_rqst(tvbuff_t *tvb, int offset, +samr_dissect_enum_dom_groups_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - "", hf_samr_resume_hnd, 0); - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_mask, NULL); + "Resume Handle:", hf_samr_resume_hnd); + + offset = dissect_ndr_nt_acct_ctrl( + tvb, offset, pinfo, tree, drep); + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_pref_maxsize, NULL); @@ -2444,19 +3101,21 @@ samr_dissect_enum_dom_groups_rqst(tvbuff_t *tvb, int offset, } static int -samr_dissect_enum_dom_groups_reply(tvbuff_t *tvb, int offset, +samr_dissect_enum_dom_groups_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - "", hf_samr_resume_hnd, 0); + "Resume Handle:", hf_samr_resume_hnd); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_IDX_AND_NAME_ARRAY_ptr, NDR_POINTER_REF, - "", hf_samr_group_name, 0); + "IDX_AND_NAME_ARRAY:", hf_samr_group_name); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - "", hf_samr_entries, 0); + "Entries:", hf_samr_entries); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -2465,19 +3124,19 @@ samr_dissect_enum_dom_groups_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_enum_dom_aliases_rqst(tvbuff_t *tvb, int offset, +samr_dissect_enum_dom_aliases_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - "", hf_samr_resume_hnd, 0); + "Resume Handle:", hf_samr_resume_hnd); - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_mask, NULL); + offset = dissect_ndr_nt_acct_ctrl( + tvb, offset, pinfo, tree, drep); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_pref_maxsize, NULL); @@ -2486,21 +3145,21 @@ samr_dissect_enum_dom_aliases_rqst(tvbuff_t *tvb, int offset, } static int -samr_dissect_enum_dom_aliases_reply(tvbuff_t *tvb, int offset, +samr_dissect_enum_dom_aliases_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - "", hf_samr_resume_hnd, 0); + "Resume Handle:", hf_samr_resume_hnd); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_IDX_AND_NAME_ARRAY_ptr, NDR_POINTER_REF, - "", hf_samr_alias_name, 0); + "IDX_AND_NAME_ARRAY:", hf_samr_alias_name); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_pointer_long, NDR_POINTER_REF, - "", hf_samr_entries, 0); + "Entries:", hf_samr_entries); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -2509,27 +3168,24 @@ samr_dissect_enum_dom_aliases_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_get_members_in_alias_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_get_members_in_alias_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { - if (check_col(pinfo->cinfo, COL_INFO)) - col_set_str(pinfo->cinfo, COL_INFO, "GetAliasMem request"); - offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); return offset; } static int -samr_dissect_get_members_in_alias_reply(tvbuff_t *tvb, int offset, +samr_dissect_get_members_in_alias_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF, - "", -1, 0); + "PSID_ARRAY:", -1); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -2538,7 +3194,7 @@ samr_dissect_get_members_in_alias_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_LOGON_HOURS_entry(tvbuff_t *tvb, int offset, +samr_dissect_LOGON_HOURS_entry(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { @@ -2548,7 +3204,7 @@ samr_dissect_LOGON_HOURS_entry(tvbuff_t *tvb, int offset, } static int -samr_dissect_LOGON_HOURS_hours(tvbuff_t *tvb, int offset, +samr_dissect_LOGON_HOURS_hours(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2572,7 +3228,7 @@ samr_dissect_LOGON_HOURS_hours(tvbuff_t *tvb, int offset, } int -dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset, +dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2595,7 +3251,7 @@ dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset, of 11? */ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_LOGON_HOURS_hours, NDR_POINTER_UNIQUE, - "LOGON_HOURS", -1, 0); + "LOGON_HOURS", -1); proto_item_set_len(item, offset-old_offset); return offset; @@ -2603,7 +3259,7 @@ dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset, static int -samr_dissect_USER_INFO_1(tvbuff_t *tvb, int offset, +samr_dissect_USER_INFO_1(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2617,14 +3273,14 @@ samr_dissect_USER_INFO_1(tvbuff_t *tvb, int offset, tree = proto_item_add_subtree(item, ett_samr_user_info_1); } - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_name, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_full_name, 0); offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_home, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_script, 0); proto_item_set_len(item, offset-old_offset); @@ -2632,7 +3288,7 @@ samr_dissect_USER_INFO_1(tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_INFO_2(tvbuff_t *tvb, int offset, +samr_dissect_USER_INFO_2(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2646,9 +3302,9 @@ samr_dissect_USER_INFO_2(tvbuff_t *tvb, int offset, tree = proto_item_add_subtree(item, ett_samr_user_info_2); } - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_name, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_full_name, 0); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, hf_samr_bad_pwd_count, NULL); @@ -2660,7 +3316,7 @@ samr_dissect_USER_INFO_2(tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_INFO_3(tvbuff_t *tvb, int offset, +samr_dissect_USER_INFO_3(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2674,23 +3330,23 @@ samr_dissect_USER_INFO_3(tvbuff_t *tvb, int offset, tree = proto_item_add_subtree(item, ett_samr_user_info_3); } - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_name, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_full_name, 0); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_group, NULL); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_home, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_home_drive, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_script, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_desc, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_workstations, 0); offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep, hf_samr_logon_time); @@ -2714,7 +3370,7 @@ samr_dissect_USER_INFO_3(tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_INFO_5(tvbuff_t *tvb, int offset, +samr_dissect_USER_INFO_5(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2728,9 +3384,9 @@ samr_dissect_USER_INFO_5(tvbuff_t *tvb, int offset, tree = proto_item_add_subtree(item, ett_samr_user_info_5); } - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_name, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_full_name, 0); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_rid, NULL); @@ -2740,15 +3396,15 @@ samr_dissect_USER_INFO_5(tvbuff_t *tvb, int offset, hf_samr_country, NULL); offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep, hf_samr_codepage, NULL); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_home, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_home_drive, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_script, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_desc, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_workstations, 0); offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep, hf_samr_logon_time); @@ -2770,7 +3426,7 @@ samr_dissect_USER_INFO_5(tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_INFO_6(tvbuff_t *tvb, int offset, +samr_dissect_USER_INFO_6(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2784,9 +3440,9 @@ samr_dissect_USER_INFO_6(tvbuff_t *tvb, int offset, tree = proto_item_add_subtree(item, ett_samr_user_info_6); } - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_name, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_full_name, 0); proto_item_set_len(item, offset-old_offset); @@ -2794,7 +3450,7 @@ samr_dissect_USER_INFO_6(tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_INFO_18(tvbuff_t *tvb, int offset, +samr_dissect_USER_INFO_18(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2822,7 +3478,7 @@ samr_dissect_USER_INFO_18(tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_INFO_19(tvbuff_t *tvb, int offset, +samr_dissect_USER_INFO_19(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2851,7 +3507,7 @@ samr_dissect_USER_INFO_19(tvbuff_t *tvb, int offset, } static int -samr_dissect_BUFFER_entry(tvbuff_t *tvb, int offset, +samr_dissect_BUFFER_entry(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { @@ -2862,7 +3518,7 @@ samr_dissect_BUFFER_entry(tvbuff_t *tvb, int offset, static int -samr_dissect_BUFFER_buffer(tvbuff_t *tvb, int offset, +samr_dissect_BUFFER_buffer(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2886,7 +3542,7 @@ samr_dissect_BUFFER_buffer(tvbuff_t *tvb, int offset, } static int -samr_dissect_BUFFER(tvbuff_t *tvb, int offset, +samr_dissect_BUFFER(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2903,25 +3559,14 @@ samr_dissect_BUFFER(tvbuff_t *tvb, int offset, hf_samr_count, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_BUFFER_buffer, NDR_POINTER_UNIQUE, - "BUFFER", -1, 0); + "BUFFER", -1); proto_item_set_len(item, offset-old_offset); return offset; } static int -samr_dissect_BUFFER_ptr(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, - char *drep) -{ - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_BUFFER, NDR_POINTER_UNIQUE, - "BUFFER", -1, 0); - return offset; -} - -static int -samr_dissect_USER_INFO_21(tvbuff_t *tvb, int offset, +samr_dissect_USER_INFO_21(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -2947,31 +3592,31 @@ samr_dissect_USER_INFO_21(tvbuff_t *tvb, int offset, hf_samr_pwd_can_change_time); offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep, hf_samr_pwd_must_change_time); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_name, 2); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_full_name, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_home, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_home_drive, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_script, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_profile, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_desc, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_workstations, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_comment, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_parameters, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_unknown_string, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_unknown_string, 0); - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_unknown_string, 0); offset = samr_dissect_BUFFER(tvb, offset, pinfo, tree, drep); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, @@ -3004,7 +3649,7 @@ samr_dissect_USER_INFO_21(tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_INFO_22(tvbuff_t *tvb, int offset, +samr_dissect_USER_INFO_22(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -3027,7 +3672,7 @@ samr_dissect_USER_INFO_22(tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_INFO_23(tvbuff_t *tvb, int offset, +samr_dissect_USER_INFO_23(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -3049,7 +3694,7 @@ samr_dissect_USER_INFO_23(tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_INFO_24(tvbuff_t *tvb, int offset, +samr_dissect_USER_INFO_24(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -3072,7 +3717,7 @@ samr_dissect_USER_INFO_24(tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_INFO (tvbuff_t *tvb, int offset, +samr_dissect_USER_INFO (tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -3090,95 +3735,95 @@ samr_dissect_USER_INFO (tvbuff_t *tvb, int offset, hf_samr_level, &level); switch(level){ - case 1: + case 1: offset = samr_dissect_USER_INFO_1( tvb, offset, pinfo, tree, drep); break; - case 2: + case 2: offset = samr_dissect_USER_INFO_2( tvb, offset, pinfo, tree, drep); break; - case 3: + case 3: offset = samr_dissect_USER_INFO_3( tvb, offset, pinfo, tree, drep); break; - case 4: + case 4: offset = dissect_ndr_nt_LOGON_HOURS( tvb, offset, pinfo, tree, drep); break; - case 5: + case 5: offset = samr_dissect_USER_INFO_5( tvb, offset, pinfo, tree, drep); break; - case 6: + case 6: offset = samr_dissect_USER_INFO_6( tvb, offset, pinfo, tree, drep); break; case 7: - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_full_name, 0); + offset = dissect_ndr_counted_string( + tvb, offset, pinfo, tree, drep, hf_samr_full_name, 0); break; case 8: - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_acct_desc, 0); + offset = dissect_ndr_counted_string( + tvb, offset, pinfo, tree, drep, hf_samr_acct_desc, 0); break; case 9: offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_unknown_long, NULL); break; - case 10: + case 10: offset = samr_dissect_USER_INFO_6( tvb, offset, pinfo, tree, drep); break; case 11: - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_home, 0); + offset = dissect_ndr_counted_string( + tvb, offset, pinfo, tree, drep, hf_samr_home, 0); break; case 12: - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_home_drive, 0); + offset = dissect_ndr_counted_string( + tvb, offset, pinfo, tree, drep, hf_samr_home_drive, 0); break; case 13: - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_script, 0); + offset = dissect_ndr_counted_string( + tvb, offset, pinfo, tree, drep, hf_samr_script, 0); break; case 14: - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_workstations, 0); + offset = dissect_ndr_counted_string( + tvb, offset, pinfo, tree, drep, hf_samr_workstations, 0); break; case 16: - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_unknown_long, NULL); + offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, + drep); break; case 17: offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep, hf_samr_unknown_time); break; - case 18: + case 18: offset = samr_dissect_USER_INFO_18( tvb, offset, pinfo, tree, drep); break; - case 19: + case 19: offset = samr_dissect_USER_INFO_19( tvb, offset, pinfo, tree, drep); break; case 20: - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, - hf_samr_profile, 0); + offset = dissect_ndr_counted_string( + tvb, offset, pinfo, tree, drep, hf_samr_profile, 0); break; - case 21: + case 21: offset = samr_dissect_USER_INFO_21( tvb, offset, pinfo, tree, drep); break; - case 22: + case 22: offset = samr_dissect_USER_INFO_22( tvb, offset, pinfo, tree, drep); break; - case 23: + case 23: offset = samr_dissect_USER_INFO_23( tvb, offset, pinfo, tree, drep); break; - case 24: + case 24: offset = samr_dissect_USER_INFO_24( tvb, offset, pinfo, tree, drep); break; @@ -3189,37 +3834,42 @@ samr_dissect_USER_INFO (tvbuff_t *tvb, int offset, } static int -samr_dissect_USER_INFO_ptr(tvbuff_t *tvb, int offset, +samr_dissect_USER_INFO_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_INFO, NDR_POINTER_UNIQUE, - "USER_INFO pointer", -1, 0); + "USER_INFO pointer", -1); return offset; } static int -samr_dissect_set_information_user2_rqst(tvbuff_t *tvb, int offset, +samr_dissect_set_information_user2_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { + guint16 level; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, - hf_samr_level, NULL); + hf_samr_level, &level); + + if (check_col(pinfo->cinfo, COL_INFO)) + col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_INFO, NDR_POINTER_REF, - "", -1, 0); + "USER_INFO:", -1); return offset; } static int -samr_dissect_set_information_user2_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_set_information_user2_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -3229,27 +3879,32 @@ samr_dissect_set_information_user2_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_unknown_2f_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_query_information_user2_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { + guint16 level; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, - hf_samr_level, NULL); + hf_samr_level, &level); + + if (check_col(pinfo->cinfo, COL_INFO)) + col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level); return offset; } static int -samr_dissect_unknown_2f_reply(tvbuff_t *tvb, int offset, +samr_dissect_query_information_user2_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_INFO_ptr, NDR_POINTER_REF, - "", -1, 0); + "USER_INFO:", -1); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -3258,7 +3913,7 @@ samr_dissect_unknown_2f_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_MEMBER_ARRAY_type(tvbuff_t *tvb, int offset, +samr_dissect_MEMBER_ARRAY_type(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { @@ -3270,7 +3925,7 @@ samr_dissect_MEMBER_ARRAY_type(tvbuff_t *tvb, int offset, static int -samr_dissect_MEMBER_ARRAY_types(tvbuff_t *tvb, int offset, +samr_dissect_MEMBER_ARRAY_types(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -3294,7 +3949,7 @@ samr_dissect_MEMBER_ARRAY_types(tvbuff_t *tvb, int offset, } static int -samr_dissect_MEMBER_ARRAY_rid(tvbuff_t *tvb, int offset, +samr_dissect_MEMBER_ARRAY_rid(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { @@ -3306,7 +3961,7 @@ samr_dissect_MEMBER_ARRAY_rid(tvbuff_t *tvb, int offset, static int -samr_dissect_MEMBER_ARRAY_rids(tvbuff_t *tvb, int offset, +samr_dissect_MEMBER_ARRAY_rids(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -3330,7 +3985,7 @@ samr_dissect_MEMBER_ARRAY_rids(tvbuff_t *tvb, int offset, } static int -samr_dissect_MEMBER_ARRAY(tvbuff_t *tvb, int offset, +samr_dissect_MEMBER_ARRAY(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -3349,44 +4004,45 @@ samr_dissect_MEMBER_ARRAY(tvbuff_t *tvb, int offset, hf_samr_count, &count); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_MEMBER_ARRAY_rids, NDR_POINTER_UNIQUE, - "RIDs", -1, 0); + "RIDs", -1); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_MEMBER_ARRAY_types, NDR_POINTER_UNIQUE, - "Types", -1, 0); + "Types", -1); proto_item_set_len(item, offset-old_offset); return offset; } static int -samr_dissect_MEMBER_ARRAY_ptr(tvbuff_t *tvb, int offset, +samr_dissect_MEMBER_ARRAY_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_MEMBER_ARRAY, NDR_POINTER_UNIQUE, - "MEMBER_ARRAY", -1, 0); + "MEMBER_ARRAY", -1); return offset; } static int -samr_dissect_query_groupmem_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_query_groupmem_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { - offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, + hf_samr_hnd, NULL, NULL, FALSE, FALSE); + return offset; } static int -samr_dissect_query_groupmem_reply(tvbuff_t *tvb, int offset, +samr_dissect_query_groupmem_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_MEMBER_ARRAY_ptr, NDR_POINTER_REF, - "", -1, 0); + "MEMBER_ARRAY:", -1); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -3395,26 +4051,32 @@ samr_dissect_query_groupmem_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_set_sec_object_rqst(tvbuff_t *tvb, int offset, +samr_dissect_set_sec_object_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { + guint32 info_type; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_info_type, NULL); + hf_samr_info_type, &info_type); + + if (check_col(pinfo->cinfo, COL_INFO)) + col_append_fstr( + pinfo->cinfo, COL_INFO, ", info type %d", info_type); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_BUFFER, NDR_POINTER_REF, - "", -1, 0); + lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF, + "LSA_SECURITY_DESCRIPTOR pointer: ", -1); return offset; } static int -samr_dissect_set_sec_object_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_set_sec_object_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -3424,27 +4086,33 @@ samr_dissect_set_sec_object_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_query_sec_object_rqst(tvbuff_t *tvb, int offset, +samr_dissect_query_sec_object_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { + guint32 info_type; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_info_type, NULL); + hf_samr_info_type, &info_type); + + if (check_col(pinfo->cinfo, COL_INFO)) + col_append_fstr( + pinfo->cinfo, COL_INFO, ", info_type %d", info_type); return offset; } static int -samr_dissect_query_sec_object_reply(tvbuff_t *tvb, int offset, +samr_dissect_query_sec_object_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_BUFFER_ptr, NDR_POINTER_REF, - "", -1, 0); + lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE, + "LSA_SECURITY_DESCRIPTOR pointer: ", -1); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -3453,17 +4121,17 @@ samr_dissect_query_sec_object_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_LOOKUP_NAMES_name(tvbuff_t *tvb, int offset, +samr_dissect_LOOKUP_NAMES_name(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_name, 1); return offset; } static int -samr_dissect_LOOKUP_NAMES(tvbuff_t *tvb, int offset, +samr_dissect_LOOKUP_NAMES(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -3486,34 +4154,35 @@ samr_dissect_LOOKUP_NAMES(tvbuff_t *tvb, int offset, static int -samr_dissect_lookup_names_rqst(tvbuff_t *tvb, int offset, +samr_dissect_lookup_names_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_count, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_LOOKUP_NAMES, NDR_POINTER_REF, - "", -1, 0); + "LOOKUP_NAMES:", -1); return offset; } static int -samr_dissect_lookup_names_reply(tvbuff_t *tvb, int offset, +samr_dissect_lookup_names_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_INDEX_ARRAY, NDR_POINTER_REF, - "", hf_samr_rid, 0); + "Rids:", hf_samr_rid); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_INDEX_ARRAY, NDR_POINTER_REF, - "", hf_samr_type, 0); + "Types:", hf_samr_type); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -3522,7 +4191,7 @@ samr_dissect_lookup_names_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_LOOKUP_RIDS_rid(tvbuff_t *tvb, int offset, +samr_dissect_LOOKUP_RIDS_rid(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { @@ -3533,7 +4202,7 @@ samr_dissect_LOOKUP_RIDS_rid(tvbuff_t *tvb, int offset, } static int -samr_dissect_LOOKUP_RIDS(tvbuff_t *tvb, int offset, +samr_dissect_LOOKUP_RIDS(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -3556,35 +4225,35 @@ samr_dissect_LOOKUP_RIDS(tvbuff_t *tvb, int offset, static int -samr_dissect_lookup_rids_rqst(tvbuff_t *tvb, int offset, +samr_dissect_lookup_rids_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep, hf_samr_count, NULL); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_LOOKUP_RIDS, NDR_POINTER_REF, - "", -1, 0); + "LOOKUP_RIDS:", -1); return offset; } static int -samr_dissect_UNICODE_STRING_ARRAY_name(tvbuff_t *tvb, int offset, +samr_dissect_UNICODE_STRING_ARRAY_name(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { - offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep, + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep, hf_samr_acct_name, 0); return offset; } static int -samr_dissect_UNICODE_STRING_ARRAY_names(tvbuff_t *tvb, int offset, +samr_dissect_UNICODE_STRING_ARRAY_names(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { @@ -3594,7 +4263,7 @@ samr_dissect_UNICODE_STRING_ARRAY_names(tvbuff_t *tvb, int offset, } static int -samr_dissect_UNICODE_STRING_ARRAY(tvbuff_t *tvb, int offset, +samr_dissect_UNICODE_STRING_ARRAY(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, char *drep) { @@ -3613,7 +4282,7 @@ samr_dissect_UNICODE_STRING_ARRAY(tvbuff_t *tvb, int offset, offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_UNICODE_STRING_ARRAY_names, NDR_POINTER_UNIQUE, - "Strings", -1, 0); + "Strings", -1); proto_item_set_len(item, offset-old_offset); return offset; @@ -3623,16 +4292,17 @@ samr_dissect_UNICODE_STRING_ARRAY(tvbuff_t *tvb, int offset, static int -samr_dissect_lookup_rids_reply(tvbuff_t *tvb, int offset, +samr_dissect_lookup_rids_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_UNICODE_STRING_ARRAY, NDR_POINTER_REF, - "", hf_samr_rid, 0); + "RIDs:", hf_samr_rid); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_INDEX_ARRAY, NDR_POINTER_REF, - "", hf_samr_type, 0); + "Types:", hf_samr_type); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -3641,21 +4311,31 @@ samr_dissect_lookup_rids_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_close_hnd_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, +samr_dissect_close_hnd_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { - offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + e_ctx_hnd policy_hnd; + char *name; + + offset = dissect_nt_policy_hnd( + tvb, offset, pinfo, tree, drep, hf_samr_hnd, &policy_hnd, + NULL, FALSE, TRUE); + + dcerpc_smb_fetch_pol(&policy_hnd, &name, NULL, NULL, pinfo->fd->num); + + if (name != NULL && check_col(pinfo->cinfo, COL_INFO)) + col_append_fstr( + pinfo->cinfo, COL_INFO, ", %s", name); return offset; } static int -samr_dissect_close_hnd_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, +samr_dissect_close_hnd_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -3664,19 +4344,19 @@ samr_dissect_close_hnd_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, } static int -samr_dissect_shutdown_sam_server_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_shutdown_sam_server_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { - offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, + hf_samr_hnd, NULL, NULL, FALSE, FALSE); return offset; } static int -samr_dissect_shutdown_sam_server_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_shutdown_sam_server_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -3686,19 +4366,19 @@ samr_dissect_shutdown_sam_server_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_delete_dom_group_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_delete_dom_group_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { - offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, + hf_samr_hnd, NULL, NULL, FALSE, FALSE); return offset; } static int -samr_dissect_delete_dom_group_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_delete_dom_group_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -3708,12 +4388,12 @@ samr_dissect_delete_dom_group_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_remove_member_from_group_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_remove_member_from_group_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_group, NULL); @@ -3725,8 +4405,8 @@ samr_dissect_remove_member_from_group_rqst(tvbuff_t *tvb, int offset, } static int -samr_dissect_remove_member_from_group_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_remove_member_from_group_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -3736,19 +4416,19 @@ samr_dissect_remove_member_from_group_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_delete_dom_alias_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_delete_dom_alias_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { - offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, + hf_samr_hnd, NULL, NULL, FALSE, FALSE); return offset; } static int -samr_dissect_delete_dom_alias_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_delete_dom_alias_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -3758,22 +4438,23 @@ samr_dissect_delete_dom_alias_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_add_alias_member_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_add_alias_member_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + dissect_ndr_nt_SID_no_hf, NDR_POINTER_REF, + "SID pointer", -1); - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - dissect_ndr_nt_SID, NDR_POINTER_REF, - "SID", -1, 0); return offset; } static int -samr_dissect_add_alias_member_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_add_alias_member_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -3783,22 +4464,23 @@ samr_dissect_add_alias_member_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_remove_alias_member_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_remove_alias_member_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + dissect_ndr_nt_SID_no_hf, NDR_POINTER_REF, + "SID pointer", -1); - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - dissect_ndr_nt_SID, NDR_POINTER_REF, - "SID", -1, 0); return offset; } static int -samr_dissect_remove_alias_member_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_remove_alias_member_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -3808,19 +4490,19 @@ samr_dissect_remove_alias_member_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_delete_dom_user_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_delete_dom_user_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); return offset; } static int -samr_dissect_delete_dom_user_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_delete_dom_user_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -3830,19 +4512,19 @@ samr_dissect_delete_dom_user_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_test_private_fns_domain_rqst(tvbuff_t *tvb, int offset, +samr_dissect_test_private_fns_domain_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); return offset; } static int -samr_dissect_test_private_fns_domain_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_test_private_fns_domain_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -3852,19 +4534,19 @@ samr_dissect_test_private_fns_domain_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_test_private_fns_user_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_test_private_fns_user_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); return offset; } static int -samr_dissect_test_private_fns_user_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_test_private_fns_user_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -3874,24 +4556,25 @@ samr_dissect_test_private_fns_user_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_remove_member_from_foreign_domain_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, - proto_tree *tree, +samr_dissect_remove_member_from_foreign_domain_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, + proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, + dissect_ndr_nt_SID_no_hf, NDR_POINTER_REF, + "SID pointer", -1); - offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - dissect_ndr_nt_SID, NDR_POINTER_REF, - "SID", -1, 0); return offset; } static int samr_dissect_remove_member_from_foreign_domain_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, - proto_tree *tree, + packet_info *pinfo, + proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -3901,27 +4584,27 @@ samr_dissect_remove_member_from_foreign_domain_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_remove_multiple_members_from_alias_rqst(tvbuff_t *tvb, - int offset, - packet_info *pinfo, - proto_tree *tree, +samr_dissect_remove_multiple_members_from_alias_rqst(tvbuff_t *tvb, + int offset, + packet_info *pinfo, + proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF, - "", -1, 0); + "PSID_ARRAY:", -1); return offset; } static int -samr_dissect_remove_multiple_members_from_alias_reply(tvbuff_t *tvb, - int offset, - packet_info *pinfo, - proto_tree *tree, +samr_dissect_remove_multiple_members_from_alias_reply(tvbuff_t *tvb, + int offset, + packet_info *pinfo, + proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -3931,7 +4614,7 @@ samr_dissect_remove_multiple_members_from_alias_reply(tvbuff_t *tvb, } static int -samr_dissect_open_group_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, +samr_dissect_open_group_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { dcerpc_info *di = (dcerpc_info *)pinfo->private_data; @@ -3939,10 +4622,11 @@ samr_dissect_open_group_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, guint32 rid; offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_access, NULL); + offset = dissect_nt_access_mask( + tvb, offset, pinfo, tree, drep, hf_samr_access, + &samr_group_access_mask_info); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rid, &rid); @@ -3950,27 +4634,50 @@ samr_dissect_open_group_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, if (check_col(pinfo->cinfo, COL_INFO)) col_append_fstr(pinfo->cinfo, COL_INFO, ", rid 0x%x", rid); - dcv->private_data = (void *)rid; + dcv->private_data = GINT_TO_POINTER(rid); return offset; } static int -samr_dissect_open_group_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_open_group_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { + dcerpc_info *di = (dcerpc_info *)pinfo->private_data; + dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data; + guint32 rid = GPOINTER_TO_INT(dcv->private_data); + e_ctx_hnd policy_hnd; + proto_item *hnd_item; + guint32 status; + char *pol_name; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, &policy_hnd, &hnd_item, + TRUE, FALSE); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, - hf_samr_rc, NULL); + hf_samr_rc, &status); + + if (status == 0) { + if (rid) + pol_name = g_strdup_printf("OpenGroup(rid 0x%x)", rid); + else + pol_name = g_strdup("OpenGroup handle"); + + dcerpc_smb_store_pol_name(&policy_hnd, pinfo, pol_name); + + if (hnd_item != NULL) + proto_item_append_text(hnd_item, ": %s", pol_name); + + g_free(pol_name); + } return offset; } static int -samr_dissect_open_alias_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, +samr_dissect_open_alias_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { dcerpc_info *di = (dcerpc_info *)pinfo->private_data; @@ -3978,10 +4685,11 @@ samr_dissect_open_alias_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, guint32 rid; offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_access, NULL); + offset = dissect_nt_access_mask( + tvb, offset, pinfo, tree, drep, hf_samr_access, + &samr_alias_access_mask_info); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, hf_samr_rid, &rid); @@ -3989,43 +4697,68 @@ samr_dissect_open_alias_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo, if (check_col(pinfo->cinfo, COL_INFO)) col_append_fstr(pinfo->cinfo, COL_INFO, ", rid 0x%x", rid); - dcv->private_data = (void *)rid; + dcv->private_data = GINT_TO_POINTER(rid); return offset; } static int -samr_dissect_open_alias_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_open_alias_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { + dcerpc_info *di = (dcerpc_info *)pinfo->private_data; + dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data; + e_ctx_hnd policy_hnd; + char *pol_name; + proto_item *hnd_item; + guint32 status; + guint32 rid; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, &policy_hnd, &hnd_item, + TRUE, FALSE); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, - hf_samr_rc, NULL); + hf_samr_rc, &status); + + if (status == 0) { + rid = GPOINTER_TO_INT(dcv->private_data); + + if (rid) + pol_name = g_strdup_printf("OpenAlias(rid 0x%x)", rid); + else + pol_name = g_strdup_printf("OpenAlias handle"); + + dcerpc_smb_store_pol_name(&policy_hnd, pinfo, pol_name); + + if (hnd_item != NULL) + proto_item_append_text(hnd_item, ": %s", pol_name); + + g_free(pol_name); + } return offset; } static int -samr_dissect_add_multiple_members_to_alias_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_add_multiple_members_to_alias_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF, - "", -1, 0); + "PSID_ARRAY:", -1); return offset; } static int -samr_dissect_add_multiple_members_to_alias_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_add_multiple_members_to_alias_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, @@ -4035,91 +4768,124 @@ samr_dissect_add_multiple_members_to_alias_reply(tvbuff_t *tvb, int offset, } static int -samr_dissect_create_group_in_domain_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, proto_tree *tree, +samr_dissect_create_group_in_domain_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF, - "Account Name", hf_samr_acct_name, 0); + dissect_ndr_counted_string_ptr, NDR_POINTER_REF, + "Account Name", hf_samr_acct_name); - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_access, NULL); + offset = dissect_nt_access_mask( + tvb, offset, pinfo, tree, drep, hf_samr_access, + &samr_group_access_mask_info); return offset; } static int -samr_dissect_create_group_in_domain_reply(tvbuff_t *tvb, int offset, +samr_dissect_create_group_in_domain_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { + e_ctx_hnd policy_hnd; + proto_item *hnd_item; + guint32 rid; + guint32 status; + char *pol_name; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, &policy_hnd, &hnd_item, + TRUE, FALSE); offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_rid, NULL); + hf_samr_rid, &rid); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, - hf_samr_rc, NULL); + hf_samr_rc, &status); + + if (status == 0) { + pol_name = g_strdup_printf("CreateGroup(rid 0x%x)", rid); + + dcerpc_smb_store_pol_name(&policy_hnd, pinfo, pol_name); + + if (hnd_item != NULL) + proto_item_append_text(hnd_item, ": %s", pol_name); + + g_free(pol_name); + } return offset; } static int -samr_dissect_query_information_domain_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_query_information_domain_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { + guint16 level; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, - hf_samr_level, NULL); + hf_samr_level, &level); + + if (check_col(pinfo->cinfo, COL_INFO)) + col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level); return offset; } static int -samr_dissect_query_information_domain_reply(tvbuff_t *tvb, int offset, +samr_dissect_query_information_domain_reply(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep) { + /* + * Yes, in at least one capture with replies from a W2K server, + * this was, indeed, a UNIQUE pointer, not a REF pointer. + */ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, - samr_dissect_DOMAIN_INFO_ptr, NDR_POINTER_REF, - "", hf_samr_domain, 0); + samr_dissect_DOMAIN_INFO, NDR_POINTER_UNIQUE, + "DOMAIN_INFO pointer", hf_samr_domain); - offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, - hf_samr_rc, NULL); + offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, + hf_samr_rc, NULL); return offset; } static int -samr_dissect_query_information_user_rqst(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_query_information_user_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { + guint16 level; + offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep, - hf_samr_hnd, NULL); + hf_samr_hnd, NULL, NULL, FALSE, FALSE); offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep, - hf_samr_level, NULL); + hf_samr_level, &level); + + if (check_col(pinfo->cinfo, COL_INFO)) + col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level); return offset; } static int -samr_dissect_query_information_user_reply(tvbuff_t *tvb, int offset, - packet_info *pinfo, +samr_dissect_query_information_user_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, char *drep) { offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, samr_dissect_USER_INFO_ptr, NDR_POINTER_REF, - "", -1, 0); + "USER_INFO:", -1); offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep, hf_samr_rc, NULL); @@ -4128,196 +4894,210 @@ samr_dissect_query_information_user_reply(tvbuff_t *tvb, int offset, } static dcerpc_sub_dissector dcerpc_samr_dissectors[] = { - { SAMR_CONNECT_ANON, "ConnectAnonymous", + { SAMR_CONNECT, "SamrConnect", samr_dissect_connect_anon_rqst, samr_dissect_connect_anon_reply }, - { SAMR_CLOSE_HND, "Close", + { SAMR_CLOSE_HND, "SamrCloseHandle", samr_dissect_close_hnd_rqst, samr_dissect_close_hnd_reply }, - { SAMR_SET_SEC_OBJECT, "SetSecObject", + { SAMR_SET_SEC_OBJECT, "SamrSetSecurityObject", samr_dissect_set_sec_object_rqst, samr_dissect_set_sec_object_reply }, - { SAMR_QUERY_SEC_OBJECT, "QuerySecObject", + { SAMR_QUERY_SEC_OBJECT, "SamrQuerySecurityObject", samr_dissect_query_sec_object_rqst, samr_dissect_query_sec_object_reply }, - { SAMR_SHUTDOWN_SAM_SERVER, "ShutdownSamServer", + { SAMR_SHUTDOWN_SAM_SERVER, "SamrShutdownSamServer", samr_dissect_shutdown_sam_server_rqst, samr_dissect_shutdown_sam_server_reply }, - { SAMR_LOOKUP_DOMAIN, "LookupDomain", + { SAMR_LOOKUP_DOMAIN, "SamrLookupDomainInSamServer", samr_dissect_lookup_domain_rqst, samr_dissect_lookup_domain_reply }, - { SAMR_ENUM_DOMAINS, "EnumDomains", + { SAMR_ENUM_DOMAINS, "SamrEnumerateDomainsInSamServer", samr_dissect_enum_domains_rqst, samr_dissect_enum_domains_reply }, - { SAMR_OPEN_DOMAIN, "OpenDomain", + { SAMR_OPEN_DOMAIN, "SamrOpenDomain", samr_dissect_open_domain_rqst, samr_dissect_open_domain_reply }, - { SAMR_QUERY_DOMAIN_INFO, "QueryDomainInfo", + { SAMR_QUERY_DOMAIN_INFO, "SamrQueryInformationDomain", samr_dissect_query_information_alias_rqst, samr_dissect_query_information_domain_reply }, - { SAMR_SET_DOMAIN_INFO, "SetDomainInfo", + { SAMR_SET_DOMAIN_INFO, "SamrSetInformationDomain", samr_dissect_set_information_domain_rqst, samr_dissect_set_information_domain_reply }, - { SAMR_CREATE_DOM_GROUP, "CreateGroup", + { SAMR_CREATE_DOM_GROUP, "SamrCreateGroupInDomain", samr_dissect_create_alias_in_domain_rqst, samr_dissect_create_alias_in_domain_reply }, - { SAMR_ENUM_DOM_GROUPS, "EnumDomainGroups", + { SAMR_ENUM_DOM_GROUPS, "SamrEnumerateGroupsInDomain", samr_dissect_enum_dom_groups_rqst, samr_dissect_enum_dom_groups_reply }, - { SAMR_CREATE_USER_IN_DOMAIN, "CreateUser", + { SAMR_CREATE_USER_IN_DOMAIN, "SamrCreateUserInDomain", samr_dissect_create_group_in_domain_rqst, samr_dissect_create_group_in_domain_reply }, - { SAMR_ENUM_DOM_USERS, "EnumDomainUsers", + { SAMR_ENUM_DOM_USERS, "SamrEnumerateUsersInDomain", samr_dissect_enum_dom_groups_rqst, samr_dissect_enum_dom_groups_reply }, - { SAMR_CREATE_DOM_ALIAS, "CreateAlias", + { SAMR_CREATE_DOM_ALIAS, "SamrCreateAliasInDomain", samr_dissect_create_alias_in_domain_rqst, samr_dissect_create_alias_in_domain_reply }, - { SAMR_ENUM_DOM_ALIASES, "EnumAlises", + { SAMR_ENUM_DOM_ALIASES, "SamrEnumerateAliasesInDomain", samr_dissect_enum_dom_aliases_rqst, samr_dissect_enum_dom_aliases_reply }, - { SAMR_GET_ALIAS_MEMBERSHIP, "GetAliasMem", + { SAMR_GET_ALIAS_MEMBERSHIP, "SamrGetAliasMembership", samr_dissect_get_alias_membership_rqst, samr_dissect_get_alias_membership_reply }, - { SAMR_LOOKUP_NAMES, "LookupNames", + { SAMR_LOOKUP_NAMES, "SamrLookupNamesInDomain", samr_dissect_lookup_names_rqst, samr_dissect_lookup_names_reply }, - { SAMR_LOOKUP_RIDS, "LookupRIDs", + { SAMR_LOOKUP_RIDS, "SamrLookupIdsInDomain", samr_dissect_lookup_rids_rqst, samr_dissect_lookup_rids_reply }, - { SAMR_OPEN_GROUP, "OpenGroup", + { SAMR_OPEN_GROUP, "SamrOpenGroup", samr_dissect_open_group_rqst, samr_dissect_open_group_reply }, - { SAMR_QUERY_GROUPINFO, "QueryGroupInfo", + { SAMR_QUERY_GROUPINFO, "SamrQueryInformationGroup", samr_dissect_query_information_group_rqst, samr_dissect_query_information_group_reply }, - { SAMR_SET_GROUPINFO, "SetGroupInfo", + { SAMR_SET_GROUPINFO, "SamrSetInformationGroup", samr_dissect_set_information_group_rqst, samr_dissect_set_information_group_reply }, - { SAMR_ADD_GROUPMEM, "AddGroupMem", + { SAMR_ADD_GROUPMEM, "SamrAddMemberToGroup", samr_dissect_add_member_to_group_rqst, samr_dissect_add_member_to_group_reply }, - { SAMR_DELETE_DOM_GROUP, "DeleteDomainGroup", + { SAMR_DELETE_DOM_GROUP, "SamrDeleteGroup", samr_dissect_delete_dom_group_rqst, samr_dissect_delete_dom_group_reply }, - { SAMR_DEL_GROUPMEM, "RemoveGroupMem", + { SAMR_DEL_GROUPMEM, "SamrRemoveMemberFromGroup", samr_dissect_remove_member_from_group_rqst, samr_dissect_remove_member_from_group_reply }, - { SAMR_QUERY_GROUPMEM, "QueryGroupMem", + { SAMR_QUERY_GROUPMEM, "SamrGetMembersInGroup", samr_dissect_query_groupmem_rqst, samr_dissect_query_groupmem_reply }, - { SAMR_SET_MEMBER_ATTRIBUTES_OF_GROUP, "SetMemberAttrGroup", + { SAMR_SET_MEMBER_ATTRIBUTES_OF_GROUP, "SamrSetMemberAttributesOfGroup", samr_dissect_set_member_attributes_of_group_rqst, samr_dissect_set_member_attributes_of_group_reply }, - { SAMR_OPEN_ALIAS, "OpenAlias", + { SAMR_OPEN_ALIAS, "SamrOpenAlias", samr_dissect_open_alias_rqst, samr_dissect_open_alias_reply }, - { SAMR_QUERY_ALIASINFO, "QueryAliasInfo", + { SAMR_QUERY_ALIASINFO, "SamrQueryInformationAlias", samr_dissect_query_information_alias_rqst, samr_dissect_query_information_alias_reply }, - { SAMR_SET_ALIASINFO, "SetAliasInfo", + { SAMR_SET_ALIASINFO, "SamrSetInformationAlias", samr_dissect_set_information_alias_rqst, samr_dissect_set_information_alias_reply }, - { SAMR_DELETE_DOM_ALIAS, "DeleteAlias", + { SAMR_DELETE_DOM_ALIAS, "SamrDeleteAlias", samr_dissect_delete_dom_alias_rqst, samr_dissect_delete_dom_alias_reply }, - { SAMR_ADD_ALIASMEM, "AddAliasMem", + { SAMR_ADD_ALIASMEM, "SamrAddMemberToAlias", samr_dissect_add_alias_member_rqst, samr_dissect_add_alias_member_reply }, - { SAMR_DEL_ALIASMEM, "RemoveAliasMem", + { SAMR_DEL_ALIASMEM, "SamrRemoveMemberFromAlias", samr_dissect_remove_alias_member_rqst, samr_dissect_remove_alias_member_reply }, - { SAMR_GET_MEMBERS_IN_ALIAS, "GetAliasMem", + { SAMR_GET_MEMBERS_IN_ALIAS, "SamrGetMembersInAlias", samr_dissect_get_members_in_alias_rqst, samr_dissect_get_members_in_alias_reply }, - { SAMR_OPEN_USER, "OpenUser", - samr_dissect_open_user_rqst, + { SAMR_OPEN_USER, "SamrOpenUser", + samr_dissect_open_user_rqst, samr_dissect_open_user_reply }, - { SAMR_DELETE_DOM_USER, "DeleteUser", + { SAMR_DELETE_DOM_USER, "SamrDeleteUser", samr_dissect_delete_dom_user_rqst, samr_dissect_delete_dom_user_reply }, - { SAMR_QUERY_USERINFO, "QueryUserInfo", + { SAMR_QUERY_USERINFO, "SamrQueryInformationUser", samr_dissect_query_information_user_rqst, samr_dissect_query_information_user_reply }, - { SAMR_SET_USERINFO2, "SetUserInfo2", + { SAMR_SET_USERINFO, "SamrSetInformationUser", samr_dissect_set_information_user2_rqst, samr_dissect_set_information_user2_reply }, - { SAMR_CHANGE_PASSWORD_USER, "ChangePassword", + { SAMR_CHANGE_PASSWORD_USER, "SamrChangePasswordUser", samr_dissect_change_password_user_rqst, samr_dissect_change_password_user_reply }, - { SAMR_GET_GROUPS_FOR_USER, "GetGroups", + { SAMR_GET_GROUPS_FOR_USER, "SamrGetGroupsForUser", samr_dissect_get_groups_for_user_rqst, samr_dissect_get_groups_for_user_reply }, - { SAMR_QUERY_DISPINFO, "QueryDispinfo", - samr_dissect_query_dispinfo_rqst, + { SAMR_QUERY_DISPINFO, "SamrQueryDisplayInformation", + samr_dissect_query_dispinfo_rqst, samr_dissect_query_dispinfo_reply }, - { SAMR_GET_DISPLAY_ENUMERATION_INDEX, "GetDispEnumNDX", - samr_dissect_get_display_enumeration_index_rqst, + { SAMR_GET_DISPLAY_ENUMERATION_INDEX, "SamrGetDisplayEnumerationIndex", + samr_dissect_get_display_enumeration_index_rqst, samr_dissect_get_display_enumeration_index_reply }, - { SAMR_TEST_PRIVATE_FUNCTIONS_DOMAIN, "TestPrivateFnsDomain", + { SAMR_TEST_PRIVATE_FUNCTIONS_DOMAIN, "SamrTestPrivateFunctionsDomain", samr_dissect_test_private_fns_domain_rqst, samr_dissect_test_private_fns_domain_reply }, - { SAMR_TEST_PRIVATE_FUNCTIONS_USER, "TestPrivateFnsUser", + { SAMR_TEST_PRIVATE_FUNCTIONS_USER, "SamrTestPrivateFunctionsUser", samr_dissect_test_private_fns_user_rqst, samr_dissect_test_private_fns_user_reply }, - { SAMR_GET_USRDOM_PWINFO, "GetUserDomPwInfo", + { SAMR_GET_USRDOM_PWINFO, "SamrGetUserDomainPasswordInformation", samr_dissect_get_usrdom_pwinfo_rqst, samr_dissect_get_usrdom_pwinfo_reply }, - { SAMR_REMOVE_MEMBER_FROM_FOREIGN_DOMAIN, "RemoveMemberForeignDomain", + { SAMR_REMOVE_MEMBER_FROM_FOREIGN_DOMAIN, "SamrRemoveMemberFromForeignDomain", samr_dissect_remove_member_from_foreign_domain_rqst, samr_dissect_remove_member_from_foreign_domain_reply }, - { SAMR_QUERY_INFORMATION_DOMAIN2, "QueryDomInfo2", + { SAMR_QUERY_INFORMATION_DOMAIN2, "SamrQueryInformationDomain2", samr_dissect_query_information_domain_rqst, samr_dissect_query_information_domain_reply }, - { SAMR_UNKNOWN_2f, "Unknown 0x2f", - samr_dissect_unknown_2f_rqst, - samr_dissect_unknown_2f_reply }, - { SAMR_QUERY_DISPINFO2, "QueryDispinfo2", + { SAMR_QUERY_INFORMATION_USER2, "SamrQueryInformationUser2", + samr_dissect_query_information_user2_rqst, + samr_dissect_query_information_user2_reply }, + { SAMR_QUERY_DISPINFO2, "SamrQueryDisplayInformation2", samr_dissect_query_dispinfo_rqst, samr_dissect_query_dispinfo_reply }, - { SAMR_GET_DISPLAY_ENUMERATION_INDEX2, "GetDispEnumNDX2", + { SAMR_GET_DISPLAY_ENUMERATION_INDEX2, "SamrGetDisplayEnumerationIndex2", samr_dissect_get_display_enumeration_index2_rqst, samr_dissect_get_display_enumeration_index2_reply }, - { SAMR_CREATE_USER2_IN_DOMAIN, "CreateUser2", + { SAMR_CREATE_USER2_IN_DOMAIN, "SamrCreateUser2InDomain", samr_dissect_create_user2_in_domain_rqst, samr_dissect_create_user2_in_domain_reply }, - { SAMR_QUERY_DISPINFO3, "QueryDispinfo3", + { SAMR_QUERY_DISPINFO3, "SamrQueryDisplayInformation3", samr_dissect_query_dispinfo_rqst, samr_dissect_query_dispinfo_reply }, - { SAMR_ADD_MULTIPLE_MEMBERS_TO_ALIAS, "AddAliasMemMultiple", + { SAMR_ADD_MULTIPLE_MEMBERS_TO_ALIAS, "SamrAddMultipleMembersToAlias", samr_dissect_add_multiple_members_to_alias_rqst, samr_dissect_add_multiple_members_to_alias_reply }, - { SAMR_REMOVE_MULTIPLE_MEMBERS_FROM_ALIAS, "RemoveAliasMemMultiple", + { SAMR_REMOVE_MULTIPLE_MEMBERS_FROM_ALIAS, "SamrRemoveMultipleMembersFromAlias", samr_dissect_remove_multiple_members_from_alias_rqst, samr_dissect_remove_multiple_members_from_alias_reply }, - { SAMR_OEM_CHANGE_PASSWORD_USER2, "OEMChangePassword2", + { SAMR_OEM_CHANGE_PASSWORD_USER2, "SamrOemChangePasswordUser2", samr_dissect_oem_change_password_user2_rqst, samr_dissect_oem_change_password_user2_reply }, - { SAMR_UNICODE_CHANGE_PASSWORD_USER2, "UnicodeChangePassword2", + { SAMR_UNICODE_CHANGE_PASSWORD_USER2, "SamrUnicodeChangePasswordUser2", samr_dissect_unicode_change_password_user2_rqst, samr_dissect_unicode_change_password_user2_reply }, - { SAMR_GET_DOM_PWINFO, "GetDomainPasswordInfo", + { SAMR_GET_DOM_PWINFO, "SamrGetDomainPasswordInformation", samr_dissect_get_domain_password_information_rqst, samr_dissect_get_domain_password_information_reply }, - { SAMR_CONNECT2, "Connect2", + { SAMR_CONNECT2, "SamrConnect2", samr_dissect_connect2_rqst, samr_dissect_connect2_reply }, - { SAMR_SET_USERINFO, "SetUserInfo", + { SAMR_SET_USERINFO2, "SamrSetInformationUser2", samr_dissect_set_information_user2_rqst, samr_dissect_set_information_user2_reply }, - { SAMR_UNKNOWN_3B, "Unknown 0x3b", - samr_dissect_unknown_3b_rqst, - samr_dissect_unknown_3b_reply }, - { SAMR_UNKNOWN_3C, "Unknown 0x3c", - samr_dissect_unknown_3c_rqst, - samr_dissect_unknown_3c_reply }, - {0, NULL, NULL, NULL }, + { SAMR_SET_BOOT_KEY_INFORMATION, "SamrSetBootKeyInformation", + samr_dissect_set_boot_key_information_rqst, + samr_dissect_set_boot_key_information_reply }, + { SAMR_GET_BOOT_KEY_INFORMATION, "SamrGetBootKeyInformation", + samr_dissect_get_boot_key_information_rqst, + samr_dissect_get_boot_key_information_reply }, + { SAMR_CONNECT3, "SamrConnect3", + samr_dissect_connect4_rqst, + samr_dissect_connect2_reply }, + { SAMR_CONNECT4, "SamrConnect4", + samr_dissect_connect4_rqst, + samr_dissect_connect2_reply }, + { SAMR_UNICODE_CHANGE_PASSWORD_USER3, "SamrUnicodeChangePasswordUser3", + NULL, NULL }, + { SAMR_CONNECT5, "SamrConnect5", NULL, NULL }, + { SAMR_RID_TO_SID, "SamrRidToSid", NULL, NULL }, + { SAMR_SET_DSRM_PASSWORD, "SamrSetDSRMPassword", NULL, NULL }, + { SAMR_VALIDATE_PASSWORD, "SamrValidatePassword", NULL, NULL }, + {0, NULL, NULL, NULL } }; -void +void proto_register_dcerpc_samr(void) { static hf_register_info hf[] = { + { &hf_samr_opnum, + { "Operation", "samr.opnum", FT_UINT16, BASE_DEC, NULL, 0x0, "Operation", HFILL }}, { &hf_samr_hnd, { "Context Handle", "samr.hnd", FT_BYTES, BASE_NONE, NULL, 0x0, "", HFILL }}, { &hf_samr_group, @@ -4336,42 +5116,42 @@ proto_register_dcerpc_samr(void) { "Return code", "samr.rc", FT_UINT32, BASE_HEX, VALS (NT_errors), 0x0, "", HFILL }}, { &hf_samr_level, - { "Level", "samr.level", FT_UINT16, BASE_DEC, + { "Level", "samr.level", FT_UINT16, BASE_DEC, NULL, 0x0, "Level requested/returned for Information", HFILL }}, { &hf_samr_start_idx, - { "Start Idx", "samr.start_idx", FT_UINT32, BASE_DEC, + { "Start Idx", "samr.start_idx", FT_UINT32, BASE_DEC, NULL, 0x0, "Start Index for returned Information", HFILL }}, { &hf_samr_entries, - { "Entries", "samr.entries", FT_UINT32, BASE_DEC, + { "Entries", "samr.entries", FT_UINT32, BASE_DEC, NULL, 0x0, "Number of entries to return", HFILL }}, { &hf_samr_max_entries, - { "Max Entries", "samr.max_entries", FT_UINT32, BASE_DEC, + { "Max Entries", "samr.max_entries", FT_UINT32, BASE_DEC, NULL, 0x0, "Maximum number of entries", HFILL }}, { &hf_samr_pref_maxsize, - { "Pref MaxSize", "samr.pref_maxsize", FT_UINT32, BASE_DEC, + { "Pref MaxSize", "samr.pref_maxsize", FT_UINT32, BASE_DEC, NULL, 0x0, "Maximum Size of data to return", HFILL }}, { &hf_samr_total_size, - { "Total Size", "samr.total_size", FT_UINT32, BASE_DEC, + { "Total Size", "samr.total_size", FT_UINT32, BASE_DEC, NULL, 0x0, "Total size of data", HFILL }}, { &hf_samr_bad_pwd_count, - { "Bad Pwd Count", "samr.bad_pwd_count", FT_UINT16, BASE_DEC, + { "Bad Pwd Count", "samr.bad_pwd_count", FT_UINT16, BASE_DEC, NULL, 0x0, "Number of bad pwd entries for this user", HFILL }}, { &hf_samr_logon_count, - { "Logon Count", "samr.logon_count", FT_UINT16, BASE_DEC, + { "Logon Count", "samr.logon_count", FT_UINT16, BASE_DEC, NULL, 0x0, "Number of logons for this user", HFILL }}, { &hf_samr_ret_size, - { "Returned Size", "samr.ret_size", FT_UINT32, BASE_DEC, + { "Returned Size", "samr.ret_size", FT_UINT32, BASE_DEC, NULL, 0x0, "Number of returned objects in this PDU", HFILL }}, { &hf_samr_index, - { "Index", "samr.index", FT_UINT32, BASE_DEC, + { "Index", "samr.index", FT_UINT32, BASE_DEC, NULL, 0x0, "Index", HFILL }}, { &hf_samr_count, @@ -4442,44 +5222,43 @@ proto_register_dcerpc_samr(void) NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }}, { &hf_samr_unknown_hyper, - { "Unknown hyper", "samr.unknown.hyper", FT_UINT64, BASE_HEX, + { "Unknown hyper", "samr.unknown.hyper", FT_UINT64, BASE_HEX, NULL, 0x0, "Unknown hyper. If you know what this is, contact ethereal developers.", HFILL }}, { &hf_samr_unknown_long, - { "Unknown long", "samr.unknown.long", FT_UINT32, BASE_HEX, + { "Unknown long", "samr.unknown.long", FT_UINT32, BASE_HEX, NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }}, { &hf_samr_unknown_short, - { "Unknown short", "samr.unknown.short", FT_UINT16, BASE_HEX, + { "Unknown short", "samr.unknown.short", FT_UINT16, BASE_HEX, NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }}, { &hf_samr_unknown_char, - { "Unknown char", "samr.unknown.char", FT_UINT8, BASE_HEX, + { "Unknown char", "samr.unknown.char", FT_UINT8, BASE_HEX, NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }}, { &hf_samr_revision, - { "Revision", "samr.revision", FT_UINT64, BASE_HEX, + { "Revision", "samr.revision", FT_UINT64, BASE_HEX, NULL, 0x0, "Revision number for this structure", HFILL }}, - + { &hf_samr_nt_pwd_set, - { "NT Pwd Set", "samr.nt_pwd_set", FT_UINT8, BASE_HEX, + { "NT Pwd Set", "samr.nt_pwd_set", FT_UINT8, BASE_HEX, NULL, 0x0, "Flag indicating whether the NT password has been set", HFILL }}, - + { &hf_samr_lm_pwd_set, - { "LM Pwd Set", "samr.lm_pwd_set", FT_UINT8, BASE_HEX, + { "LM Pwd Set", "samr.lm_pwd_set", FT_UINT8, BASE_HEX, NULL, 0x0, "Flag indicating whether the LanManager password has been set", HFILL }}, - + { &hf_samr_pwd_expired, - { "Expired flag", "samr.pwd_Expired", FT_UINT8, BASE_HEX, + { "Expired flag", "samr.pwd_Expired", FT_UINT8, BASE_HEX, NULL, 0x0, "Flag indicating if the password for this account has expired or not", HFILL }}, - /* XXX - is this a standard NT access mask? */ { &hf_samr_access, - { "Access Mask", "samr.access", FT_UINT32, BASE_HEX, + { "Access Mask", "samr.access", FT_UINT32, BASE_HEX, NULL, 0x0, "Access", HFILL }}, - { &hf_samr_mask, - { "Mask", "samr.mask", FT_UINT32, BASE_HEX, - NULL, 0x0, "Mask", HFILL }}, + { &hf_samr_access_granted, + { "Access Granted", "samr.access_granted", FT_UINT32, BASE_HEX, + NULL, 0x0, "Access Granted", HFILL }}, { &hf_samr_crypt_password, { "Password", "samr.crypt_password", FT_BYTES, BASE_HEX, @@ -4489,6 +5268,41 @@ proto_register_dcerpc_samr(void) "Hash", "samr.crypt_hash", FT_BYTES, BASE_HEX, NULL, 0, "Encrypted Hash", HFILL }}, + { &hf_samr_lm_verifier, { + "Verifier", "samr.lm_password_verifier", FT_BYTES, BASE_HEX, + NULL, 0, "Lan Manager Password Verifier", HFILL }}, + + { &hf_samr_nt_verifier, { + "Verifier", "samr.nt_password_verifier", FT_BYTES, BASE_HEX, + NULL, 0, "NT Password Verifier", HFILL }}, + + { &hf_samr_lm_passchange_block, { + "Encrypted Block", "samr.lm_passchange_block", FT_BYTES, + BASE_HEX, NULL, 0, "Lan Manager Password Change Block", + HFILL }}, + + { &hf_samr_nt_passchange_block, { + "Encrypted Block", "samr.nt_passchange_block", FT_BYTES, + BASE_HEX, NULL, 0, "NT Password Change Block", HFILL }}, + + { &hf_samr_nt_passchange_block_decrypted, { + "Decrypted Block", "samr.nt_passchange_block_decrypted", + FT_BYTES, BASE_HEX, NULL, 0, + "NT Password Change Decrypted Block", HFILL }}, + + { &hf_samr_nt_passchange_block_newpass, { + "New NT Password", "samr.nt_passchange_block_new_ntpassword", + FT_STRING, BASE_NONE, NULL, 0, "New NT Password", HFILL }}, + + { &hf_samr_nt_passchange_block_newpass_len, { + "New NT Unicode Password length", + "samr.nt_passchange_block_new_ntpassword_len", FT_UINT32, + BASE_DEC, NULL, 0, "New NT Password Unicode Length", HFILL }}, + + { &hf_samr_nt_passchange_block_pseudorandom, { + "Pseudorandom data", "samr.nt_passchange_block_pseudorandom", + FT_BYTES, BASE_HEX, NULL, 0, "Pseudorandom data", HFILL }}, + { &hf_samr_lm_change, { "LM Change", "samr.lm_change", FT_UINT8, BASE_HEX, NULL, 0, "LM Change value", HFILL }}, @@ -4556,29 +5370,8 @@ proto_register_dcerpc_samr(void) "Divisions", "samr.divisions", FT_UINT16, BASE_DEC, NULL, 0, "Number of divisions for LOGON_HOURS", HFILL }}, - /* these are used by packet-dcerpc-nt.c */ - { &hf_nt_string_length, - { "Length", "nt.string.length", FT_UINT16, BASE_DEC, - NULL, 0x0, "Length of string in bytes", HFILL }}, - - { &hf_nt_string_size, - { "Size", "nt.string.size", FT_UINT16, BASE_DEC, - NULL, 0x0, "Size of string in bytes", HFILL }}, - - { &hf_nt_str_len, - { "Length", "nt.str.len", FT_UINT32, BASE_DEC, - NULL, 0x0, "Length of string in short integers", HFILL }}, - - { &hf_nt_str_off, - { "Offset", "nt.str.offset", FT_UINT32, BASE_DEC, - NULL, 0x0, "Offset into string in short integers", HFILL }}, - - { &hf_nt_str_max_len, - { "Max Length", "nt.str.max_len", FT_UINT32, BASE_DEC, - NULL, 0x0, "Max Length of string in short integers", HFILL }}, - { &hf_nt_acct_ctrl, - { "Acct Ctrl", "nt.acct_ctrl", FT_UINT32, BASE_HEX, + { "Acct Ctrl", "nt.acct_ctrl", FT_UINT32, BASE_HEX, NULL, 0x0, "Acct CTRL", HFILL }}, { &hf_nt_acb_disabled, { @@ -4624,7 +5417,201 @@ proto_register_dcerpc_samr(void) { &hf_nt_acb_autolock, { "", "nt.acb.autolock", FT_BOOLEAN, 32, TFS(&tfs_nt_acb_autolock), 0x0400, "If this account has been autolocked", HFILL }}, + + /* Object specific access rights */ + + { &hf_access_domain_lookup_info1, + { "Lookup info1", "samr_access_mask.domain_lookup_info1", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + DOMAIN_ACCESS_LOOKUP_INFO_1, "Lookup info1", HFILL }}, + + { &hf_access_domain_set_info1, + { "Set info1", "samr_access_mask.domain_set_info1", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + DOMAIN_ACCESS_SET_INFO_1, "Set info1", HFILL }}, + + { &hf_access_domain_lookup_info2, + { "Lookup info2", "samr_access_mask.domain_lookup_info2", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + DOMAIN_ACCESS_LOOKUP_INFO_2, "Lookup info2", HFILL }}, + + { &hf_access_domain_set_info2, + { "Set info2", "samr_access_mask.domain_set_info2", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + DOMAIN_ACCESS_SET_INFO_2, "Set info2", HFILL }}, + + { &hf_access_domain_create_user, + { "Create user", "samr_access_mask.domain_create_user", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + DOMAIN_ACCESS_CREATE_USER, "Create user", HFILL }}, + + { &hf_access_domain_create_group, + { "Create group", "samr_access_mask.domain_create_group", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + DOMAIN_ACCESS_CREATE_GROUP, "Create group", HFILL }}, + + { &hf_access_domain_create_alias, + { "Create alias", "samr_access_mask.domain_create_alias", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + DOMAIN_ACCESS_CREATE_ALIAS, "Create alias", HFILL }}, + + { &hf_access_domain_lookup_alias_by_mem, + { "Lookup alias", "samr_access_mask.domain_lookup_alias_by_mem", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + DOMAIN_ACCESS_LOOKUP_ALIAS, "Lookup alias", HFILL }}, + + { &hf_access_domain_enum_accounts, + { "Enum accounts", "samr_access_mask.domain_enum_accounts", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + DOMAIN_ACCESS_ENUM_ACCOUNTS, "Enum accounts", HFILL }}, + + { &hf_access_domain_open_account, + { "Open account", "samr_access_mask.domain_open_account", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + DOMAIN_ACCESS_OPEN_ACCOUNT, "Open account", HFILL }}, + + { &hf_access_domain_set_info3, + { "Set info3", "samr_access_mask.domain_set_info3", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + DOMAIN_ACCESS_SET_INFO_3, "Set info3", HFILL }}, + + { &hf_access_user_get_name_etc, + { "Get name, etc", "samr_access_mask.user_get_name_etc", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + USER_ACCESS_GET_NAME_ETC, "Get name, etc", HFILL }}, + + { &hf_access_user_get_locale, + { "Get locale", "samr_access_mask.user_get_locale", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + USER_ACCESS_GET_LOCALE, "Get locale", HFILL }}, + + { &hf_access_user_get_loc_com, + { "Set loc com", "samr_access_mask.user_set_loc_com", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + USER_ACCESS_SET_LOC_COM, "Set loc com", HFILL }}, + + { &hf_access_user_get_logoninfo, + { "Get logon info", "samr_access_mask.user_get_logoninfo", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + USER_ACCESS_GET_LOGONINFO, "Get logon info", HFILL }}, + + { &hf_access_user_get_attributes, + { "Get attributes", "samr_access_mask.user_get_attributes", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + USER_ACCESS_GET_ATTRIBUTES, "Get attributes", HFILL }}, + + { &hf_access_user_set_attributes, + { "Set attributes", "samr_access_mask.user_set_attributes", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + USER_ACCESS_SET_ATTRIBUTES, "Set attributes", HFILL }}, + + { &hf_access_user_change_password, + { "Change password", "samr_access_mask.user_change_password", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + USER_ACCESS_CHANGE_PASSWORD, "Change password", HFILL }}, + + { &hf_access_user_set_password, + { "Set password", "samr_access_mask.user_set_password", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + USER_ACCESS_SET_PASSWORD, "Set password", HFILL }}, + + { &hf_access_user_get_groups, + { "Get groups", "samr_access_mask.user_get_groups", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + USER_ACCESS_GET_GROUPS, "Get groups", HFILL }}, + + { &hf_access_user_get_group_membership, + { "Get group membership", "samr_access_mask.user_get_group_membership", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + USER_ACCESS_GET_GROUP_MEMBERSHIP, "Get group membership", HFILL }}, + + { &hf_access_user_change_group_membership, + { "Change group membership", "samr_access_mask.user_change_group_membership", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + USER_ACCESS_CHANGE_GROUP_MEMBERSHIP, "Change group membership", HFILL }}, + + { &hf_access_group_lookup_info, + { "Lookup info", "samr_access_mask.group_lookup_info", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + GROUP_ACCESS_LOOKUP_INFO, "Lookup info", HFILL }}, + + { &hf_access_group_set_info, + { "Get info", "samr_access_mask.group_set_info", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + GROUP_ACCESS_SET_INFO, "Get info", HFILL }}, + + { &hf_access_group_add_member, + { "Add member", "samr_access_mask.group_add_member", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + GROUP_ACCESS_ADD_MEMBER, "Add member", HFILL }}, + + { &hf_access_group_remove_member, + { "Remove member", "samr_access_mask.group_remove_member", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + GROUP_ACCESS_REMOVE_MEMBER, "Remove member", HFILL }}, + + { &hf_access_group_get_members, + { "Get members", "samr_access_mask.group_get_members", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + GROUP_ACCESS_GET_MEMBERS, "Get members", HFILL }}, + + { &hf_access_alias_add_member, + { "Add member", "samr_access_mask.alias_add_member", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + ALIAS_ACCESS_ADD_MEMBER, "Add member", HFILL }}, + + { &hf_access_alias_remove_member, + { "Remove member", "samr_access_mask.alias_remove_member", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + ALIAS_ACCESS_REMOVE_MEMBER, "Remove member", HFILL }}, + + { &hf_access_alias_get_members, + { "Get members", "samr_access_mask.alias_get_members", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + ALIAS_ACCESS_GET_MEMBERS, "Get members", HFILL }}, + + { &hf_access_alias_lookup_info, + { "Lookup info", "samr_access_mask.alias_lookup_info", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + ALIAS_ACCESS_LOOKUP_INFO, "Lookup info", HFILL }}, + + { &hf_access_alias_set_info, + { "Set info", "samr_access_mask.alias_set_info", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + ALIAS_ACCESS_SET_INFO, "Set info", HFILL }}, + + { &hf_access_connect_connect_to_server, + { "Connect to server", "samr_access_mask.connect_connect_to_server", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + SAMR_ACCESS_CONNECT_TO_SERVER, "Connect to server", HFILL }}, + + { &hf_access_connect_shutdown_server, + { "Shutdown server", "samr_access_mask.connect_shutdown_server", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + SAMR_ACCESS_SHUTDOWN_SERVER, "Shutdown server", HFILL }}, + + { &hf_access_connect_initialize_server, + { "Initialize server", "samr_access_mask.connect_initialize_server", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + SAMR_ACCESS_INITIALIZE_SERVER, "Initialize server", HFILL }}, + + { &hf_access_connect_create_domain, + { "Create domain", "samr_access_mask.connect_create_domain", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + SAMR_ACCESS_CREATE_DOMAIN, "Create domain", HFILL }}, + + { &hf_access_connect_enum_domains, + { "Enum domains", "samr_access_mask.connect_enum_domains", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + SAMR_ACCESS_ENUM_DOMAINS, "Enum domains", HFILL }}, + + { &hf_access_connect_open_domain, + { "Open domain", "samr_access_mask.connect_open_domain", + FT_BOOLEAN, 32, TFS(&flags_set_truth), + SAMR_ACCESS_OPEN_DOMAIN, "Open domain", HFILL }} + }; + static gint *ett[] = { &ett_dcerpc_samr, &ett_samr_user_dispinfo_1, @@ -4679,12 +5666,20 @@ proto_register_dcerpc_samr(void) &ett_samr_sid_and_attributes, &ett_nt_acct_ctrl, }; + module_t *dcerpc_samr_module; proto_dcerpc_samr = proto_register_protocol( "Microsoft Security Account Manager", "SAMR", "samr"); proto_register_field_array (proto_dcerpc_samr, hf, array_length (hf)); proto_register_subtree_array(ett, array_length(ett)); + + dcerpc_samr_module = prefs_register_protocol(proto_dcerpc_samr, NULL); + + prefs_register_string_preference(dcerpc_samr_module, "nt_password", + "NT Password", + "NT Password (used to verify password changes)", + &nt_password); } void @@ -4693,5 +5688,5 @@ proto_reg_handoff_dcerpc_samr(void) /* Register protocol as dcerpc */ dcerpc_init_uuid(proto_dcerpc_samr, ett_dcerpc_samr, &uuid_dcerpc_samr, - ver_dcerpc_samr, dcerpc_samr_dissectors); + ver_dcerpc_samr, dcerpc_samr_dissectors, hf_samr_opnum); }