packet-dcerpc-messenger.c

   1 /* packet-dcerpc-messenger.c
   2  * Routines for SMB \PIPE\msgsvc packet disassembly
   3  * Copyright 2003 Ronnie Sahlberg
   4  *
   5  * $Id: packet-dcerpc-messenger.c,v 1.5 2003/09/27 23:45:25 sahlberg Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 #ifdef HAVE_CONFIG_H
  27 #include "config.h"
  28 #endif
  29
  30 #include <glib.h>
  31 #include "prefs.h"
  32 #include "packet-dcerpc.h"
  33 #include "packet-dcerpc-nt.h"
  34 #include "smb.h"
  35
  36
  37 static int proto_dcerpc_messenger = -1;
  38 static int hf_messenger_opnum = -1;
  39 static int hf_messenger_rc = -1;
  40 static int hf_messenger_server = -1;
  41 static int hf_messenger_client = -1;
  42 static int hf_messenger_message = -1;
  43
  44 static gint ett_dcerpc_messenger = -1;
  45
  46
  47 /* Windows messenger service listens on two endpoints:
  48  *   \pipe\msgsvc named pipe
  49  *   a dynamic UDP port
  50  */
  51
  52 static e_uuid_t uuid_dcerpc_messenger = {
  53         0x5a7b91f8, 0xff00, 0x11d0,
  54         { 0xa9, 0xb2, 0x00, 0xc0, 0x4f, 0xb6, 0xe6, 0xfc}
  55 };
  56
  57 static guint16 ver_dcerpc_messenger = 1;
  58
  59
  60
  61 /*
  62  * IDL  [in][string][ref] char *server;
  63  * IDL  [in][string][ref] char *client;
  64  * IDL  [in][string][ref] char *message;
  65  */
  66 static int
  67 messenger_dissect_send_message_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo,
  68                             proto_tree *tree, char *drep)
  69 {
  70         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
  71                         dissect_ndr_char_cvstring, NDR_POINTER_REF,
  72                         "Server", hf_messenger_server);
  73         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
  74                         dissect_ndr_char_cvstring, NDR_POINTER_REF,
  75                         "Client", hf_messenger_client);
  76         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
  77                         dissect_ndr_char_cvstring, NDR_POINTER_REF,
  78                         "Message", hf_messenger_message);
  79
  80
  81         return offset;
  82 }
  83 static int
  84 messenger_dissect_send_message_reply(tvbuff_t *tvb, int offset, packet_info *pinfo,
  85                             proto_tree *tree, char *drep)
  86 {
  87         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
  88                                   hf_messenger_rc, NULL);
  89
  90         return offset;
  91 }
  92
  93
  94
  95 static dcerpc_sub_dissector dcerpc_messenger_dissectors[] = {
  96         {0, "NetrSendMessage",
  97                 messenger_dissect_send_message_rqst,
  98                 messenger_dissect_send_message_reply },
  99         {0, NULL, NULL,  NULL }
 100 };
 101
 102 void
 103 proto_register_dcerpc_messenger(void)
 104 {
 105         static hf_register_info hf[] = {
 106
 107                 { &hf_messenger_opnum,
 108                   { "Operation", "messenger.opnum", FT_UINT16, BASE_DEC,
 109                     NULL, 0x0, "Operation", HFILL }},
 110
 111                 { &hf_messenger_rc,
 112                   { "Return code", "messenger.rc", FT_UINT32, BASE_HEX, VALS (NT_errors), 0x0, "", HFILL }},
 113
 114                 { &hf_messenger_server, {
 115                 "Server", "messenger.server",
 116                 FT_STRING, BASE_NONE, NULL, 0, "Server to send the message to", HFILL }},
 117
 118                 { &hf_messenger_client, {
 119                 "Client", "messenger.client",
 120                 FT_STRING, BASE_NONE, NULL, 0, "Client that sent the message", HFILL }},
 121
 122                 { &hf_messenger_message, {
 123                 "Message", "messenger.message",
 124                 FT_STRING, BASE_NONE, NULL, 0, "The message being sent", HFILL }}
 125
 126         };
 127
 128         static gint *ett[] = {
 129                 &ett_dcerpc_messenger
 130         };
 131
 132         proto_dcerpc_messenger = proto_register_protocol(
 133                 "Microsoft Messenger Service", "Messenger", "messenger");
 134
 135         proto_register_field_array (proto_dcerpc_messenger, hf, array_length (hf));
 136         proto_register_subtree_array(ett, array_length(ett));
 137
 138 }
 139
 140 void
 141 proto_reg_handoff_dcerpc_messenger(void)
 142 {
 143         /* Register protocol as dcerpc */
 144
 145         dcerpc_init_uuid(proto_dcerpc_messenger, ett_dcerpc_messenger, &uuid_dcerpc_messenger,
 146                          ver_dcerpc_messenger, dcerpc_messenger_dissectors, hf_messenger_opnum);
 147 }