packet-dcerpc-lsa-ds.c

   1 /* packet-dcerpc-lsa-ds.c
   2  * Routines for SMB \PIPE\lsarpc packet disassembly
   3  * Copyright 2002-2003, Tim Potter <tpot@samba.org>
   4  * Copyright 2002, Jim McDonough <jmcd@samba.org>
   5  *
   6  * $Id: packet-dcerpc-lsa-ds.c,v 1.12 2003/08/04 02:49:02 tpot Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <string.h>
  33
  34 #include <epan/packet.h>
  35 #include "packet-dcerpc.h"
  36 #include "packet-dcerpc-nt.h"
  37 #include "smb.h"
  38
  39 #define LSA_DS_DSROLEGETDOMINFO 0x0000
  40
  41 #define LSA_DS_DSROLE_BASIC_INFO 0x0001
  42 #define LSA_DS_DSROLE_UPGRADE_STATUS 0x0002
  43 #define LSA_DS_DSROLE_OP_STATUS 0x0003
  44
  45 static int proto_dcerpc_lsa_ds = -1;
  46
  47 static int hf_lsa_ds_opnum = -1;
  48 static int hf_lsa_ds_dominfo_level = -1;
  49 static int hf_lsa_ds_machine_role = -1;
  50 static int hf_lsa_ds_dominfo_flags = -1;
  51 static int hf_lsa_ds_dominfo_netb_name = -1;
  52 static int hf_lsa_ds_dominfo_dns_name = -1;
  53 static int hf_lsa_ds_dominfo_forest_name = -1;
  54 static int hf_lsa_ds_upgrade_state = -1;
  55 static int hf_lsa_ds_previous_role = -1;
  56 static int hf_lsa_ds_op_status = -1;
  57 static int hf_lsa_ds_rc = -1;
  58
  59 static gint ett_dcerpc_lsa_ds = -1;
  60 static gint ett_lsa_ds_domain_info = -1;
  61 static gint ett_lsa_ds_basic_domain_info = -1;
  62 static gint ett_lsa_ds_upgrade_status = -1;
  63 static gint ett_lsa_ds_op_status = -1;
  64
  65 static int
  66 lsa_ds_dissect_DSROLE_BASIC_INFO(tvbuff_t *tvb, int offset,
  67         packet_info *pinfo, proto_tree *parent_tree, char *drep)
  68 {
  69         proto_item *item=NULL;
  70         proto_tree *tree=NULL;
  71         int old_offset=offset;
  72
  73         if(parent_tree){
  74                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
  75                         "DSROLE_BASIC_DOMAIN_INFO:");
  76                 tree = proto_item_add_subtree(item,
  77                                               ett_lsa_ds_basic_domain_info);
  78         }
  79
  80         ALIGN_TO_4_BYTES;
  81         /* role */
  82         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
  83                                     hf_lsa_ds_machine_role, 0);
  84
  85         /* flags */
  86         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
  87                                     hf_lsa_ds_dominfo_flags, 0);
  88
  89         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
  90                 NDR_POINTER_UNIQUE, "NetBIOS domain name pointer",
  91                 hf_lsa_ds_dominfo_netb_name, 0);
  92         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
  93                 NDR_POINTER_UNIQUE, "DNS domain pointer",
  94                 hf_lsa_ds_dominfo_dns_name, 0);
  95         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
  96                 NDR_POINTER_UNIQUE, "DNS forest name pointer",
  97                 hf_lsa_ds_dominfo_forest_name, 0);
  98
  99         /* GUID */
 100         offset = dissect_nt_GUID(tvb, offset, pinfo, tree, drep);
 101
 102         proto_item_set_len(item, offset-old_offset);
 103         return offset;
 104 }
 105
 106 static int
 107 lsa_ds_dissect_DSROLE_UPGRADE_STATUS(tvbuff_t *tvb, int offset,
 108                                      packet_info *pinfo,
 109                                      proto_tree *parent_tree, char *drep)
 110 {
 111         proto_item *item=NULL;
 112         proto_tree *tree=NULL;
 113         int old_offset=offset;
 114
 115         if(parent_tree){
 116                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 117                         "DSROLE_UPGRADE_STATUS:");
 118                 tree = proto_item_add_subtree(item,
 119                                               ett_lsa_ds_upgrade_status);
 120         }
 121
 122         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 123                                      hf_lsa_ds_upgrade_state, NULL);
 124         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 125                                      hf_lsa_ds_previous_role, NULL);
 126         proto_item_set_len(item, offset-old_offset);
 127
 128         return offset;
 129 }
 130
 131 static int
 132 lsa_ds_dissect_DSROLE_OP_STATUS(tvbuff_t *tvb, int offset,
 133                                      packet_info *pinfo,
 134                                      proto_tree *parent_tree, char *drep)
 135 {
 136         proto_item *item=NULL;
 137         proto_tree *tree=NULL;
 138         int old_offset=offset;
 139
 140         if(parent_tree){
 141                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 142                         "DSROLE_OP_STATUS:");
 143                 tree = proto_item_add_subtree(item,
 144                                               ett_lsa_ds_op_status);
 145         }
 146         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 147                                      hf_lsa_ds_op_status, NULL);
 148         proto_item_set_len(item, offset-old_offset);
 149
 150         return offset;
 151 }
 152
 153 static int
 154 lsa_ds_dissect_DS_DOMINFO_CTR(tvbuff_t *tvb, int offset,
 155         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 156 {
 157         proto_item *item=NULL;
 158         proto_tree *tree=NULL;
 159         int old_offset=offset;
 160         guint16 level;
 161
 162         if(parent_tree){
 163                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 164                         "DOMAIN_INFO:");
 165                 tree = proto_item_add_subtree(item, ett_lsa_ds_domain_info);
 166         }
 167
 168         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 169                                      hf_lsa_ds_dominfo_level, &level);
 170
 171         switch(level){
 172         case LSA_DS_DSROLE_BASIC_INFO:
 173                 offset = lsa_ds_dissect_DSROLE_BASIC_INFO(
 174                         tvb, offset, pinfo, tree, drep);
 175                 break;
 176         case LSA_DS_DSROLE_UPGRADE_STATUS:
 177                 offset = lsa_ds_dissect_DSROLE_UPGRADE_STATUS(
 178                         tvb, offset, pinfo, tree, drep);
 179                 break;
 180         case LSA_DS_DSROLE_OP_STATUS:
 181                 offset = lsa_ds_dissect_DSROLE_OP_STATUS(
 182                         tvb, offset, pinfo, tree, drep);
 183                 break;
 184         }
 185         proto_item_set_len(item, offset-old_offset);
 186
 187         return offset;
 188 }
 189
 190 static int
 191 lsa_ds_dissect_role_get_dom_info_rqst(tvbuff_t *tvb, int offset,
 192         packet_info *pinfo, proto_tree *tree, char *drep)
 193 {
 194         guint16 level;
 195
 196         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 197                                     hf_lsa_ds_dominfo_level, &level);
 198
 199         if (check_col(pinfo->cinfo, COL_INFO))
 200                 col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
 201
 202         return offset;
 203 }
 204
 205 static int
 206 lsa_ds_dissect_role_get_dom_info_reply(tvbuff_t *tvb, int offset,
 207         packet_info *pinfo, proto_tree *tree, char *drep)
 208 {
 209         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 210                 lsa_ds_dissect_DS_DOMINFO_CTR, NDR_POINTER_UNIQUE,
 211                 "DOMAIN_INFORMATION pointer", -1);
 212
 213         offset = dissect_ntstatus(
 214                 tvb, offset, pinfo, tree, drep, hf_lsa_ds_rc, NULL);
 215
 216         return offset;
 217 }
 218
 219 static const value_string lsa_ds_dominfo_levels[] = {
 220         { LSA_DS_DSROLE_BASIC_INFO, "DsRoleBasicInfo"},
 221         { LSA_DS_DSROLE_UPGRADE_STATUS, "DsRoleUpgradeStatus"},
 222         { LSA_DS_DSROLE_OP_STATUS, "DsRoleOpStatus"},
 223         { 0, NULL }
 224 };
 225
 226 static const value_string lsa_ds_role_vals[] = {
 227         { 0, "Standalone Workstation" },
 228         { 1, "Domain Member Workstation" },
 229         { 2, "Standalone Server" },
 230         { 3, "Domain Member Server" },
 231         { 4, "Backup Domain Controller" },
 232         { 5, "Primary Domain Controller" },
 233         { 0, NULL }
 234 };
 235
 236 static const value_string lsa_ds_upgrade_vals[] = {
 237         { 0, "Not currently upgrading"},
 238         { 1, "Upgrade in progress"},
 239         { 0, NULL }
 240 };
 241
 242 static const value_string lsa_ds_previous_roles[] = {
 243         { 0, "Unknown state" },
 244         { 1, "Primary" },
 245         { 2, "Backup" },
 246         { 0, NULL }
 247 };
 248
 249 static const value_string lsa_ds_op_states[] = {
 250         { 0, "Idle" },
 251         { 1, "Active" },
 252         { 2, "Needs reboot" },
 253         { 0, NULL }
 254 };
 255
 256 void
 257 proto_register_dcerpc_lsa_ds(void)
 258 {
 259         static hf_register_info hf[] = {
 260
 261         { &hf_lsa_ds_opnum,
 262           { "Operation", "ls_ads.opnum", FT_UINT16, BASE_DEC,
 263             NULL, 0x0, "Operation", HFILL }},
 264
 265         { &hf_lsa_ds_dominfo_level,
 266           { "Level", "lsa_ds.dominfo.level", FT_UINT16, BASE_DEC,
 267             VALS(lsa_ds_dominfo_levels), 0x0,
 268             "Information level of requested data", HFILL }},
 269
 270         { &hf_lsa_ds_machine_role,
 271           { "Machine role", "lsa_ds.role", FT_UINT16, BASE_HEX,
 272             VALS(lsa_ds_role_vals), 0x0, "Role of machine in domain", HFILL}},
 273
 274         { &hf_lsa_ds_dominfo_flags,
 275           { "Flags", "lsa_ds.dominfo.flags", FT_UINT32, BASE_HEX,
 276             NULL, 0x0, "Machine flags", HFILL }},
 277
 278         { &hf_lsa_ds_dominfo_netb_name,
 279           { "Netbios name", "lsa_ds.dominfo.nbname", FT_STRING, BASE_NONE,
 280             NULL, 0x0, "Netbios Domain Name", HFILL}},
 281
 282         { &hf_lsa_ds_dominfo_dns_name,
 283           { "DNS name", "lsa_ds.dominfo.dnsname", FT_STRING, BASE_NONE,
 284             NULL, 0x0, "DNS Domain Name", HFILL}},
 285
 286         { &hf_lsa_ds_dominfo_forest_name,
 287           { "Forest name", "lsa_ds.dominfo.forest", FT_STRING, BASE_NONE,
 288             NULL, 0x0, "DNS Forest Name", HFILL}},
 289
 290         { &hf_lsa_ds_upgrade_state,
 291           { "Upgrading", "ls_ads.upgrading", FT_UINT32, BASE_DEC,
 292             VALS(lsa_ds_upgrade_vals), 0x0, "Upgrade State", HFILL }},
 293
 294         { &hf_lsa_ds_previous_role,
 295           { "Previous role", "ls_ads.upgrading", FT_UINT16, BASE_DEC,
 296             VALS(lsa_ds_previous_roles), 0x0,
 297             "Previous server role before upgrade", HFILL }},
 298
 299         { &hf_lsa_ds_op_status,
 300           { "Operational status", "ls_ads.op_status", FT_UINT16, BASE_DEC,
 301             VALS(lsa_ds_op_states), 0x0,
 302             "Current operational status", HFILL }},
 303
 304         { &hf_lsa_ds_rc,
 305           { "Return code", "lsa_ds.rc", FT_UINT32, BASE_HEX,
 306           VALS (NT_errors), 0x0, "LSA_DS return status code", HFILL }},
 307         };
 308
 309         static gint *ett[] = {
 310                 &ett_dcerpc_lsa_ds,
 311                 &ett_lsa_ds_domain_info,
 312                 &ett_lsa_ds_basic_domain_info,
 313                 &ett_lsa_ds_upgrade_status,
 314                 &ett_lsa_ds_op_status
 315         };
 316
 317         proto_dcerpc_lsa_ds = proto_register_protocol(
 318                 "Microsoft Local Security Architecture (Directory Services)",
 319                 "LSA_DS", "lsa_ds");
 320         proto_register_field_array(proto_dcerpc_lsa_ds, hf, array_length(hf));
 321         proto_register_subtree_array(ett, array_length(ett));
 322 }
 323
 324 /* Protocol handoff */
 325
 326 static e_uuid_t uuid_dcerpc_lsa_ds = {
 327         0x3919286a, 0xb10c, 0x11d0,
 328         { 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5}
 329 };
 330
 331 static guint16 ver_dcerpc_lsa_ds = 0;
 332
 333 static dcerpc_sub_dissector lsa_ds_dissectors[] = {
 334         { LSA_DS_DSROLEGETDOMINFO, "DsRoleGetDomInfo",
 335           lsa_ds_dissect_role_get_dom_info_rqst,
 336           lsa_ds_dissect_role_get_dom_info_reply },
 337         { 0, NULL, NULL, NULL },
 338 };
 339
 340 void
 341 proto_reg_handoff_dcerpc_lsa_ds(void)
 342 {
 343         /* Register protocol as dcerpc */
 344
 345         dcerpc_init_uuid(proto_dcerpc_lsa_ds, ett_dcerpc_lsa_ds,
 346                          &uuid_dcerpc_lsa_ds, ver_dcerpc_lsa_ds,
 347                          lsa_ds_dissectors, hf_lsa_ds_opnum);
 348 }