packet-dcerpc-oxid.c

   1 /* packet-dcerpc-oxid.c
   2  * Routines for DCOM OXID Resolver
   3  * Copyright 2001, Todd Sabin <tas@webspan.net>
   4  *
   5  * $Id: packet-dcerpc-oxid.c,v 1.11 2004/01/19 20:10:35 jmayer Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 #ifdef HAVE_CONFIG_H
  27 #include "config.h"
  28 #endif
  29
  30 #include <string.h>
  31
  32 #include <glib.h>
  33 #include <epan/packet.h>
  34 #include "packet-dcerpc.h"
  35 #include "packet-dcerpc-dcom.h"
  36 #include "packet-smb-common.h"
  37
  38 static int proto_oxid = -1;
  39
  40 static int hf_opnum = -1;
  41 static int hf_COMVERSION_MjrVer = -1;
  42 static int hf_COMVERSION_MnrVer = -1;
  43 static int hf_wNumEntries = -1;
  44 static int hf_wSecurityOffset = -1;
  45 static int hf_wTowerId = -1;
  46 static int hf_aNetworkAddr = -1;
  47 static int hf_wAuthnSvc = -1;
  48 static int hf_wAuthzSvc = -1;
  49 static int hf_aPrinceName = -1;
  50 static int hf_Unknown1 = -1;
  51 static int hf_Unknown2 = -1;
  52
  53 static gint ett_oxid = -1;
  54
  55 static e_uuid_t uuid_oxid = { 0x99fcfec4, 0x5260, 0x101b, { 0xbb, 0xcb, 0x00, 0xaa, 0x00, 0x21, 0x34, 0x7a } };
  56 static guint16  ver_oxid = 0;
  57
  58 static const char *
  59 authz_val2str(unsigned short authz) {
  60         switch (authz) {
  61                 case 0:
  62                         return "RPC_C_AUTHZ_NONE";
  63                         break;
  64                 case 1:
  65                         return "RPC_C_AUTHZ_NAME";
  66                         break;
  67                 case 2:
  68                         return "RPC_C_AUTHZ_DCE";
  69                         break;
  70                 case 0xffff:
  71                         return "Default";
  72                         break;
  73                 default:
  74                         return "Unknown";
  75                         break;
  76         }
  77 }
  78
  79 static const char *
  80 authn_val2str(unsigned short authn) {
  81         switch (authn) {
  82                 case 0:
  83                         return "RPC_C_AUTHN_NONE";
  84                         break;
  85                 case 1:
  86                         return "RPC_C_AUTHN_DCE_PRIVATE";
  87                         break;
  88                 case 2:
  89                         return "RPC_C_AUTHN_DCE_PUBLIC";
  90                         break;
  91                 case 4:
  92                         return "RPC_C_AUTHN_DEC_PUBLIC";
  93                         break;
  94                 case 9:
  95                         return "RPC_C_AUTHN_GSS_NEGOTIATE";
  96                         break;
  97                 case 10:
  98                         return "RPC_C_AUTH_WINNT";
  99                         break;
 100                 case 14:
 101                         return "RPC_C_AUTHN_GSS_SCHANNEL";
 102                         break;
 103                 case 16:
 104                         return "RPC_C_AUTHN_GSS_KERBEROS";
 105                         break;
 106                 case 17:
 107                         return "RPC_C_AUTHN_MSN";
 108                         break;
 109                 case 18:
 110                         return "RPC_C_AUTHN_DPA";
 111                         break;
 112                 case 100:
 113                         return "RPC_C_AUTHN_MQ";
 114                         break;
 115                 case 0xffff:
 116                         return "RPC_C_AUTHN_DEFAULT";
 117                         break;
 118                 default:
 119                         return "Unknown";
 120                         break;
 121         }
 122 }
 123
 124 static const char *
 125 towerid_val2str(unsigned short tower) {
 126         switch (tower) {
 127                 case 0x4:
 128                         return "NCACN_DNET_NSP";
 129                         break;
 130                 case 0x7:
 131                         return "NCACN_IP_TCP";
 132                         break;
 133                 case 0x8:
 134                         return "NCADG_IP_UDP";
 135                         break;
 136                 case 0xC:
 137                         return "NCACN_SPX";
 138                         break;
 139
 140                 case 0xD:
 141                         return "NCACN_NB_IPX";
 142                         break;
 143                 case 0xE:
 144                         return "NCADG_IPX";
 145                         break;
 146                 case 0x12:
 147                         return "NCACN_NB_NB";
 148                         break;
 149                 case 0x1F:
 150                         return "NCACN_HTTP";
 151                         break;
 152                 default:
 153                         return "Unknown";
 154                         break;
 155         }
 156 }
 157
 158 static int
 159 oxid_server_alive2_dissect_rply(tvbuff_t *tvb, int offset, packet_info *pinfo,
 160                                 proto_tree *tree, guint8 *drep) {
 161         COMVERSION comver;
 162         DUALSTRINGARRAY stringarray;
 163         STRINGBINDING stringbind;
 164         SECURITYBINDING securitybind;
 165         proto_item *bind_hdr, *entries_hdr, *sec_hdr;
 166         proto_tree *bind_tree, *entries_tree, *sec_tree;
 167         char *aNetworkAddr = NULL;
 168         char *aPrinceName = NULL;
 169         unsigned short string_len = 0;
 170         unsigned short security_len = 0;
 171         unsigned char unknown1[8];
 172         unsigned char unknown2[8];
 173
 174         dissect_dcerpc_uint16(tvb, offset, pinfo, tree, drep, hf_COMVERSION_MjrVer, &comver.MajorVersion);
 175         offset += sizeof(comver.MajorVersion);
 176
 177         dissect_dcerpc_uint16(tvb, offset, pinfo, tree, drep, hf_COMVERSION_MnrVer, &comver.MinorVersion);
 178         offset += sizeof(comver.MinorVersion);
 179
 180         dissect_dcerpc_uint64(tvb , offset, pinfo, tree, drep, hf_Unknown1, unknown1);
 181
 182         offset += sizeof(unknown1); /*FIXME - understand what those 8 bytes mean! don't skip'em!*/
 183         string_len = dcerpc_tvb_get_ntohs(tvb, offset, drep) * 2;
 184         bind_hdr = proto_tree_add_text(tree, tvb, offset, (int)string_len, "DUALSTRINGARRAY structure");
 185         bind_tree = proto_item_add_subtree(bind_hdr, 0);
 186
 187         dissect_dcerpc_uint16(tvb, offset, pinfo, bind_tree, drep, hf_wNumEntries, &stringarray.wNumEntries);
 188         offset += sizeof(stringarray.wNumEntries);
 189
 190         security_len = dcerpc_tvb_get_ntohs(tvb, offset, drep) * 2;
 191         dissect_dcerpc_uint16(tvb, offset, pinfo, bind_tree, drep, hf_wSecurityOffset, &stringarray.wSecurityOffset);
 192         offset += sizeof(stringarray.wSecurityOffset);
 193
 194         entries_hdr = proto_tree_add_text(bind_tree, tvb, offset, (int)security_len, "STRING BINDING");
 195         entries_tree = proto_item_add_subtree(entries_hdr, 0);
 196
 197         while(tvb_get_ntohs(tvb, offset) != 0) { /* check that this is not terminating zero */
 198
 199                 stringbind.wTowerId = dcerpc_tvb_get_ntohs(tvb, offset, drep);
 200                 proto_tree_add_text(entries_tree, tvb, offset, sizeof(stringbind.wTowerId), "Network Protocol ('TowerID'): %s (0x%x)",towerid_val2str(stringbind.wTowerId), stringbind.wTowerId);
 201
 202                 offset += sizeof(stringbind.wTowerId);
 203
 204                 offset = display_unicode_string(tvb, entries_tree, offset, hf_aNetworkAddr, &aNetworkAddr);
 205         }
 206         offset += 2; /* hop over the extra terminating zero */
 207
 208         sec_hdr = proto_tree_add_text(bind_tree, tvb, offset, 0, "SECURITY BINDING");
 209         sec_tree = proto_item_add_subtree(sec_hdr, 0);
 210
 211         while(tvb_get_ntohs(tvb, offset) != 0) {
 212                 securitybind.wAuthnSvc = dcerpc_tvb_get_ntohs(tvb, offset, drep);
 213                 proto_tree_add_text(sec_tree, tvb, offset, sizeof(securitybind.wAuthnSvc), "Authentication Service: %s (0x%x)",authn_val2str(securitybind.wAuthnSvc),securitybind.wAuthnSvc);
 214                 offset += sizeof(securitybind.wAuthnSvc);
 215
 216                 securitybind.wAuthzSvc = dcerpc_tvb_get_ntohs(tvb, offset, drep);
 217                 proto_tree_add_text(sec_tree, tvb, offset, sizeof(securitybind.wAuthzSvc), "Authorization Service: %s (0x%x)",authz_val2str(securitybind.wAuthzSvc),securitybind.wAuthzSvc);
 218                 offset += sizeof(securitybind.wAuthzSvc);
 219
 220                 offset = display_unicode_string(tvb, sec_tree, offset, hf_aPrinceName, &aPrinceName);
 221         }
 222         offset += 2; /* hop over the extra terminating zero */
 223
 224         dissect_dcerpc_uint64(tvb, offset, pinfo, tree, drep, hf_Unknown2, unknown2);
 225         offset += sizeof(unknown2);
 226         return offset;
 227 }
 228
 229 static dcerpc_sub_dissector oxid_dissectors[] = {
 230     { 0, "ResolveOxid", NULL, NULL },
 231     { 1, "SimplePing", NULL, NULL },
 232     { 2, "ComplexPing", NULL, NULL },
 233     { 3, "ServerAlive", NULL, NULL },
 234     { 4, "ResolveOxid2", NULL, NULL },
 235     { 5, "ServerAlive2", NULL, oxid_server_alive2_dissect_rply },
 236     { 0, NULL, NULL, NULL },
 237 };
 238
 239 void
 240 proto_register_oxid (void)
 241 {
 242         static hf_register_info hf[] = {
 243                 { &hf_opnum,
 244                   { "Operation", "oxid.opnum", FT_UINT16, BASE_DEC,
 245                     NULL, 0x0, "", HFILL }},
 246                 { &hf_COMVERSION_MjrVer,
 247                   { "COM Major Version", "oxid5.com_mjr_ver", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
 248                 { &hf_COMVERSION_MnrVer,
 249                   { "COM Minor Version", "oxid5.com_mnr_ver", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
 250                 { &hf_wNumEntries,
 251                   { "Total Entries length (in 16 bytes blocks)", "oxid5.NumEntries", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
 252                 { &hf_wSecurityOffset,
 253                   { "Offset of Security Binding (in 16 bytes blocks)", "oxid5.SecurityOffset", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
 254                 { &hf_wTowerId,
 255                   { "Network Protocol ('TowerID')", "oxid5.wTowerId", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
 256                 { &hf_aNetworkAddr,
 257                   { "Network Address ('aNetworkAddr')", "oxid5.aNetworkAddr", FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }},
 258                                 { &hf_wAuthnSvc,
 259                   { "Authentication Service", "oxid5.AuthnSvc", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
 260                 { &hf_wAuthzSvc,
 261                   { "Autherization Service", "oxid5.AuthzSvc", FT_UINT16, BASE_HEX, NULL, 0x0, "", HFILL }},
 262                 { &hf_aPrinceName,
 263                   { "aPrinceName", "oxid5.aPrinceName", FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }},
 264                 { &hf_Unknown1,
 265                   { "unknown 8 bytes 1", "oxid5.unknown1", FT_UINT64, BASE_HEX, NULL, 0x0, "", HFILL }},
 266                 { &hf_Unknown2,
 267                   { "unknown 8 bytes 2", "oxid5.unknown2", FT_UINT64, BASE_HEX, NULL, 0x0, "", HFILL }},
 268         };
 269         static gint *ett[] = {
 270                 &ett_oxid
 271         };
 272         proto_oxid = proto_register_protocol ("DCOM OXID Resolver", "OXID", "oxid");
 273         proto_register_field_array (proto_oxid, hf, array_length (hf));
 274         proto_register_subtree_array (ett, array_length (ett));
 275 }
 276
 277 void
 278 proto_reg_handoff_oxid (void)
 279 {
 280         /* Register the protocol as dcerpc */
 281         dcerpc_init_uuid (proto_oxid, ett_oxid, &uuid_oxid, ver_oxid, oxid_dissectors, hf_opnum);
 282 }