epan/dissectors/packet-dcom-remact.c

   1 /* packet-dcom-remact.c
   2  * Routines for DCOM Remote Activation
   3  * Copyright 2001, Todd Sabin <tas@webspan.net>
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 /* see packet-dcom.c for details about DCOM */
  27
  28 #ifdef HAVE_CONFIG_H
  29 #include "config.h"
  30 #endif
  31
  32
  33 #include <string.h>
  34
  35 #include <glib.h>
  36 #include <epan/packet.h>
  37 #include "packet-dcerpc.h"
  38 #include "packet-dcom.h"
  39
  40 static int hf_remact_opnum = -1;
  41
  42 static int hf_remact_requested_protseqs = -1;
  43 static int hf_remact_protseqs = -1;
  44 static int hf_remact_interfaces = -1;
  45 static int hf_remact_mode = -1;
  46 static int hf_remact_client_impl_level = -1;
  47 static int hf_remact_object_name = -1;
  48 static int hf_remact_object_storage = -1;
  49 static int hf_remact_interface_data = -1;
  50
  51 static int hf_remact_oxid_bindings = -1;
  52 static int hf_remact_authn_hint = -1;
  53
  54
  55 static int proto_remact = -1;
  56 static gint ett_remact = -1;
  57 static e_uuid_t uuid_remact = { 0x4d9f4ab8, 0x7d1c, 0x11cf, { 0x86, 0x1e, 0x00, 0x20, 0xaf, 0x6e, 0x7c, 0x57 } };
  58 static guint16  ver_remact = 0;
  59
  60
  61 static int
  62 dissect_remact_remote_activation_rqst(tvbuff_t *tvb, int offset,
  63         packet_info *pinfo, proto_tree *tree, guint8 *drep)
  64 {
  65         guint32 u32ClientImpLevel;
  66         guint32 u32Mode;
  67         guint32 u32Interfaces;
  68         guint32 u32Pointer;
  69         guint32 u32ArraySize;
  70         guint32 u32ItemIdx;
  71         guint16 u16ProtSeqs;
  72     e_uuid_t clsid;
  73     e_uuid_t iid;
  74
  75         gchar   szObjName[1000] = { 0 };
  76         guint32 u32ObjNameLen = sizeof(szObjName);
  77
  78     offset = dissect_dcom_this(tvb, offset, pinfo, tree, drep);
  79
  80         offset = dissect_dcom_append_UUID(tvb, offset, pinfo, tree, drep,
  81                 hf_dcom_clsid, -1, &clsid);
  82
  83         offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, drep,
  84                                                 &u32Pointer);
  85         if (u32Pointer) {
  86                 offset = dissect_dcom_BSTR(tvb, offset, pinfo, tree, drep,
  87                                                 hf_remact_object_name, szObjName, u32ObjNameLen);
  88         }
  89
  90         offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, drep,
  91                                                 hf_remact_object_storage, NULL /* XXX */);
  92
  93         offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep,
  94                                                 hf_remact_client_impl_level, &u32ClientImpLevel);
  95         offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep,
  96                                                 hf_remact_mode, &u32Mode);
  97
  98         /* Interfaces */
  99         offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep,
 100                                                 hf_remact_interfaces, &u32Interfaces);
 101         offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, drep,
 102                                                 &u32Pointer);
 103         if (u32Pointer) {
 104                 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep,
 105                                                         &u32ArraySize);
 106                 u32ItemIdx = 1;
 107                 while (u32Interfaces--) {
 108                         offset = dissect_dcom_append_UUID(tvb, offset, pinfo, tree, drep,
 109                                 hf_dcom_iid, u32ItemIdx, &iid);
 110
 111                         u32ItemIdx++;
 112                 }
 113         }
 114
 115         offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, drep,
 116                         hf_remact_requested_protseqs, &u16ProtSeqs);
 117
 118         offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep,
 119                                                 &u32ArraySize);
 120         u32ItemIdx = 1;
 121         while (u32ArraySize--) {
 122                 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, drep,
 123                                                         hf_remact_protseqs, &u16ProtSeqs);
 124                 u32ItemIdx++;
 125         }
 126
 127         return offset;
 128 }
 129
 130
 131 static int
 132 dissect_remact_remote_activation_resp(tvbuff_t *tvb, int offset,
 133         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 134 {
 135         guint32 u32Pointer;
 136         e_uuid_t ipid;
 137         guint32 u32AuthnHint;
 138         guint16 u16VersionMajor;
 139         guint16 u16VersionMinor;
 140         guint32 u32HResult;
 141         guint32 u32ArraySize;
 142         guint32 u32Idx;
 143         guint32 u32VariableOffset;
 144
 145
 146     offset = dissect_dcom_that(tvb, offset, pinfo, tree, drep);
 147
 148         offset = dissect_dcom_ID(tvb, offset, pinfo, tree, drep,
 149                                                 hf_dcom_oxid, NULL);
 150         offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, drep,
 151                                                 &u32Pointer);
 152         if (u32Pointer) {
 153                 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep,
 154                                                         &u32ArraySize);
 155                 offset = dissect_dcom_DUALSTRINGARRAY(tvb, offset, pinfo, tree, drep,
 156                                                         hf_remact_oxid_bindings, NULL);
 157         }
 158
 159         offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, drep,
 160                         hf_dcom_ipid, &ipid);
 161         offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep,
 162                                                 hf_remact_authn_hint, &u32AuthnHint);
 163         offset = dissect_dcom_COMVERSION(tvb, offset, pinfo, tree, drep,
 164                                 &u16VersionMajor, &u16VersionMinor);
 165
 166         offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, drep,
 167                                 &u32HResult);
 168
 169         offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep,
 170                                                 &u32ArraySize);
 171         u32VariableOffset = offset + u32ArraySize * 4;
 172         while (u32ArraySize--) {
 173                 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, drep,
 174                                                         &u32Pointer);
 175                 if (u32Pointer) {
 176                         u32VariableOffset = dissect_dcom_MInterfacePointer(tvb, u32VariableOffset, pinfo, tree, drep,
 177                                                 hf_remact_interface_data, NULL /* XXX */);
 178                 }
 179         }
 180         offset = u32VariableOffset;
 181
 182         offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep,
 183                                                 &u32ArraySize);
 184         u32Idx = 1;
 185         while (u32ArraySize--) {
 186                 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, tree, drep,
 187                                         &u32HResult, u32Idx);
 188                 /* update column info now */
 189                 if (check_col(pinfo->cinfo, COL_INFO)) {
 190                   col_append_fstr(pinfo->cinfo, COL_INFO, " %s[%u]",
 191                           val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)"),
 192                           u32Idx);
 193                 }
 194                 u32Idx++;
 195         }
 196
 197         offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, drep,
 198                                 &u32HResult);
 199
 200         /* update column info now */
 201     if (check_col(pinfo->cinfo, COL_INFO)) {
 202       col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
 203                   val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)"));
 204         }
 205
 206         return offset;
 207 }
 208
 209
 210 static dcerpc_sub_dissector remact_dissectors[] = {
 211     { 0, "RemoteActivation", dissect_remact_remote_activation_rqst, dissect_remact_remote_activation_resp },
 212     { 0, NULL, NULL, NULL },
 213 };
 214
 215
 216 void
 217 proto_register_remact (void)
 218 {
 219         static hf_register_info hf_remact[] = {
 220         { &hf_remact_opnum,
 221             { "Operation", "remact_opnum", FT_UINT16, BASE_DEC, NULL, 0x0, "Operation", HFILL }},
 222
 223                 { &hf_remact_requested_protseqs,
 224                 { "RequestedProtSeqs", "remact_req_prot_seqs", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
 225                 { &hf_remact_protseqs,
 226                 { "ProtSeqs", "remact_prot_seqs", FT_UINT16, BASE_DEC, VALS(dcom_protseq_vals), 0x0, "", HFILL }},
 227                 { &hf_remact_interfaces,
 228                 { "Interfaces", "remact_interfaces", FT_UINT32, BASE_DEC, NULL, 0x0, "", HFILL }},
 229                 { &hf_remact_mode,
 230                 { "Mode", "remact_mode", FT_UINT32, BASE_DEC, NULL, 0x0, "", HFILL }},
 231                 { &hf_remact_client_impl_level,
 232                 { "ClientImplLevel", "remact_client_impl_level", FT_UINT32, BASE_DEC, NULL, 0x0, "", HFILL }},
 233                 { &hf_remact_object_name,
 234                 { "ObjectName", "remact_object_name", FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }},
 235                 { &hf_remact_object_storage,
 236                 { "ObjectStorage", "remact_object_storage", FT_NONE, BASE_HEX, NULL, 0x0, "", HFILL }},
 237                 { &hf_remact_interface_data,
 238                 { "InterfaceData", "remact_interface_data", FT_NONE, BASE_NONE, NULL, 0x0, "", HFILL }},
 239
 240                 { &hf_remact_oxid_bindings,
 241                 { "OxidBindings", "hf_remact_oxid_bindings", FT_NONE, BASE_DEC, NULL, 0x0, "", HFILL }},
 242                 { &hf_remact_authn_hint,
 243                 { "AuthnHint", "remact_authn_hint", FT_UINT32, BASE_DEC, NULL, 0x0, "", HFILL }},
 244         };
 245
 246         static gint *ett[] = {
 247                 &ett_remact
 248         };
 249
 250         proto_remact = proto_register_protocol ("DCOM IRemoteActivation", "REMACT", "remact");
 251         proto_register_field_array (proto_remact, hf_remact, array_length (hf_remact));
 252         proto_register_subtree_array (ett, array_length (ett));
 253 }
 254
 255 void
 256 proto_reg_handoff_remact (void)
 257 {
 258         /* Register the protocol as dcerpc */
 259         dcerpc_init_uuid (proto_remact, ett_remact, &uuid_remact, ver_remact, remact_dissectors, hf_remact_opnum);
 260 }