Removed trailing whitespaces from .h and .c files using the
[obnox/wireshark/wip.git] / packet-dcerpc.c
1 /* packet-dcerpc.c
2  * Routines for DCERPC packet disassembly
3  * Copyright 2001, Todd Sabin <tas@webspan.net>
4  *
5  * $Id: packet-dcerpc.c,v 1.73 2002/08/22 20:04:54 tpot Exp $
6  *
7  * Ethereal - Network traffic analyzer
8  * By Gerald Combs <gerald@ethereal.com>
9  * Copyright 1998 Gerald Combs
10  * 
11  * This program is free software; you can redistribute it and/or
12  * modify it under the terms of the GNU General Public License
13  * as published by the Free Software Foundation; either version 2
14  * of the License, or (at your option) any later version.
15  * 
16  * This program is distributed in the hope that it will be useful,
17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19  * GNU General Public License for more details.
20  * 
21  * You should have received a copy of the GNU General Public License
22  * along with this program; if not, write to the Free Software
23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
24  */
25
26 #ifdef HAVE_CONFIG_H
27 #include "config.h"
28 #endif
29
30 #include <string.h>
31 #include <ctype.h>
32
33 #include <glib.h>
34 #include <epan/packet.h>
35 #include "packet-dcerpc.h"
36 #include <epan/conversation.h>
37 #include "prefs.h"
38 #include "reassemble.h"
39
40 static const value_string pckt_vals[] = {
41     { PDU_REQ,        "Request"},
42     { PDU_PING,       "Ping"},
43     { PDU_RESP,       "Response"},
44     { PDU_FAULT,      "Fault"},
45     { PDU_WORKING,    "Working"},
46     { PDU_NOCALL,     "Nocall"},
47     { PDU_REJECT,     "Reject"},
48     { PDU_ACK,        "Ack"},
49     { PDU_CL_CANCEL,  "Cl_cancel"},
50     { PDU_FACK,       "Fack"},
51     { PDU_CANCEL_ACK, "Cancel_ack"},
52     { PDU_BIND,       "Bind"},
53     { PDU_BIND_ACK,   "Bind_ack"},
54     { PDU_BIND_NAK,   "Bind_nak"},
55     { PDU_ALTER,      "Alter_context"},
56     { PDU_ALTER_ACK,  "Alter_context_resp"},
57     { PDU_AUTH3,      "AUTH3?"},
58     { PDU_SHUTDOWN,   "Shutdown"},
59     { PDU_CO_CANCEL,  "Co_cancel"},
60     { PDU_ORPHANED,   "Orphaned"},
61     { 0,              NULL }
62 };
63
64 static const value_string drep_byteorder_vals[] = {
65     { 0, "Big-endian" },
66     { 1, "Little-endian" },
67     { 0,  NULL }
68 };
69
70 static const value_string drep_character_vals[] = {
71     { 0, "ASCII" },
72     { 1, "EBCDIC" },
73     { 0,  NULL }
74 };
75
76 static const value_string drep_fp_vals[] = {
77     { 0, "IEEE" },
78     { 1, "VAX" },
79     { 2, "Cray" },
80     { 3, "IBM" },
81     { 0,  NULL }
82 };
83
84 /*
85  * Authentication services.
86  */
87 #define DCE_C_RPC_AUTHN_PROTOCOL_NONE           0
88 #define DCE_C_RPC_AUTHN_PROTOCOL_KRB5           1
89 #define DCE_C_RPC_AUTHN_PROTOCOL_SNEGO          9
90 #define DCE_C_RPC_AUTHN_PROTOCOL_NTLMSSP        10
91
92 static const value_string authn_protocol_vals[] = {
93         { DCE_C_RPC_AUTHN_PROTOCOL_NONE,    "None" },
94         { DCE_C_RPC_AUTHN_PROTOCOL_KRB5,    "Kerberos 5" },
95         { DCE_C_RPC_AUTHN_PROTOCOL_SNEGO,   "Snego" },
96         { DCE_C_RPC_AUTHN_PROTOCOL_NTLMSSP, "NTLMSSP" },
97         { 0, NULL }
98 };
99
100 /*
101  * Protection levels.
102  */
103 #define DCE_C_AUTHN_LEVEL_NONE          1
104 #define DCE_C_AUTHN_LEVEL_CONNECT       2
105 #define DCE_C_AUTHN_LEVEL_CALL          3
106 #define DCE_C_AUTHN_LEVEL_PKT           4
107 #define DCE_C_AUTHN_LEVEL_PKT_INTEGRITY 5
108 #define DCE_C_AUTHN_LEVEL_PKT_PRIVACY   6
109
110 static const value_string authn_level_vals[] = {
111         { DCE_C_AUTHN_LEVEL_NONE,          "None" },
112         { DCE_C_AUTHN_LEVEL_CONNECT,       "Connect" },
113         { DCE_C_AUTHN_LEVEL_CALL,          "Call" },
114         { DCE_C_AUTHN_LEVEL_PKT,           "Packet" },
115         { DCE_C_AUTHN_LEVEL_PKT_INTEGRITY, "Packet integrity" },
116         { DCE_C_AUTHN_LEVEL_PKT_PRIVACY,   "Packet privacy" },
117         { 0,                               NULL }
118 };
119
120 /*
121  * Flag bits in first flag field in connectionless PDU header.
122  */
123 #define PFCL1_RESERVED_01       0x01    /* Reserved for use by implementations */
124 #define PFCL1_LASTFRAG          0x02    /* If set, the PDU is the last
125                                          * fragment of a multi-PDU
126                                          * transmission */
127 #define PFCL1_FRAG              0x04    /* If set, the PDU is a fragment of
128                                            a multi-PDU transmission */
129 #define PFCL1_NOFACK            0x08    /* If set, the receiver is not
130                                          * requested to send a `fack' PDU
131                                          * for the fragment */
132 #define PFCL1_MAYBE             0x10    /* If set, the PDU is for a `maybe'
133                                          * request */
134 #define PFCL1_IDEMPOTENT        0x20    /* If set, the PDU is for an idempotent
135                                          * request */
136 #define PFCL1_BROADCAST         0x40    /* If set, the PDU is for a broadcast
137                                          * request */
138 #define PFCL1_RESERVED_80       0x80    /* Reserved for use by implementations */
139
140 /*
141  * Flag bits in second flag field in connectionless PDU header.
142  */
143 #define PFCL2_RESERVED_01       0x01    /* Reserved for use by implementations */
144 #define PFCL2_CANCEL_PENDING    0x02    /* Cancel pending at the call end */
145 #define PFCL2_RESERVED_04       0x04    /* Reserved for future use */
146 #define PFCL2_RESERVED_08       0x08    /* Reserved for future use */
147 #define PFCL2_RESERVED_10       0x10    /* Reserved for future use */
148 #define PFCL2_RESERVED_20       0x20    /* Reserved for future use */
149 #define PFCL2_RESERVED_40       0x40    /* Reserved for future use */
150 #define PFCL2_RESERVED_80       0x80    /* Reserved for future use */
151
152 /*
153  * Flag bits in connection-oriented PDU header.
154  */
155 #define PFC_FIRST_FRAG          0x01    /* First fragment */
156 #define PFC_LAST_FRAG           0x02    /* Last fragment */
157 #define PFC_PENDING_CANCEL      0x04    /* Cancel was pending at sender */
158 #define PFC_RESERVED_1          0x08
159 #define PFC_CONC_MPX            0x10    /* suports concurrent multiplexing
160                                          * of a single connection. */
161 #define PFC_DID_NOT_EXECUTE     0x20    /* only meaningful on `fault' packet;
162                                          * if true, guaranteed call did not
163                                          * execute. */
164 #define PFC_MAYBE               0x40    /* `maybe' call semantics requested */
165 #define PFC_OBJECT_UUID         0x80    /* if true, a non-nil object UUID
166                                          * was specified in the handle, and
167                                          * is present in the optional object
168                                          * field. If false, the object field
169                                          * is omitted. */
170
171 /*
172  * Tests whether a connection-oriented PDU is fragmented; returns TRUE if
173  * it's not fragmented (i.e., this is both the first *and* last fragment),
174  * and FALSE otherwise.
175  */
176 #define PFC_NOT_FRAGMENTED(hdr) \
177   ((hdr->flags&(PFC_FIRST_FRAG|PFC_LAST_FRAG))==(PFC_FIRST_FRAG|PFC_LAST_FRAG))
178
179 /*
180  * Presentation context negotiation result.
181  */
182 static const value_string p_cont_result_vals[] = {
183         { 0, "Acceptance" },
184         { 1, "User rejection" },
185         { 2, "Provider rejection" },
186         { 0, NULL }
187 };
188
189 /*
190  * Presentation context negotiation rejection reasons.
191  */
192 static const value_string p_provider_reason_vals[] = {
193         { 0, "Reason not specified" },
194         { 1, "Abstract syntax not supported" },
195         { 2, "Proposed transfer syntaxes not supported" },
196         { 3, "Local limit exceeded" },
197         { 0, NULL }
198 };
199
200 /*
201  * Reject reasons.
202  */
203 #define REASON_NOT_SPECIFIED            0
204 #define TEMPORARY_CONGESTION            1
205 #define LOCAL_LIMIT_EXCEEDED            2
206 #define CALLED_PADDR_UNKNOWN            3 /* not used */
207 #define PROTOCOL_VERSION_NOT_SUPPORTED  4
208 #define DEFAULT_CONTEXT_NOT_SUPPORTED   5 /* not used */
209 #define USER_DATA_NOT_READABLE          6 /* not used */
210 #define NO_PSAP_AVAILABLE               7 /* not used */
211
212 static const value_string reject_reason_vals[] = {
213         { REASON_NOT_SPECIFIED,           "Reason not specified" },
214         { TEMPORARY_CONGESTION,           "Temporary congestion" },
215         { LOCAL_LIMIT_EXCEEDED,           "Local limit exceeded" },
216         { CALLED_PADDR_UNKNOWN,           "Called paddr unknown" },
217         { PROTOCOL_VERSION_NOT_SUPPORTED, "Protocol version not supported" },
218         { DEFAULT_CONTEXT_NOT_SUPPORTED,  "Default context not supported" },
219         { USER_DATA_NOT_READABLE,         "User data not readable" },
220         { NO_PSAP_AVAILABLE,              "No PSAP available" },
221         { 0,                              NULL }
222 };
223
224 /*
225  * Reject status codes.
226  */
227 static const value_string reject_status_vals[] = {
228         { 0,          "Stub-defined exception" },
229         { 0x1c000001, "nca_s_fault_int_div_by_zero" },
230         { 0x1c000002, "nca_s_fault_addr_error" },
231         { 0x1c000003, "nca_s_fault_fp_div_zero" },
232         { 0x1c000004, "nca_s_fault_fp_underflow" },
233         { 0x1c000005, "nca_s_fault_fp_overflow" },
234         { 0x1c000006, "nca_s_fault_invalid_tag" },
235         { 0x1c000007, "nca_s_fault_invalid_bound" },
236         { 0x1c000008, "nca_rpc_version_mismatch" },
237         { 0x1c000009, "nca_unspec_reject" },
238         { 0x1c00000a, "nca_s_bad_actid" },
239         { 0x1c00000b, "nca_who_are_you_failed" },
240         { 0x1c00000c, "nca_manager_not_entered" },
241         { 0x1c00000d, "nca_s_fault_cancel" },
242         { 0x1c00000e, "nca_s_fault_ill_inst" },
243         { 0x1c00000f, "nca_s_fault_fp_error" },
244         { 0x1c000010, "nca_s_fault_int_overflow" },
245         { 0x1c000014, "nca_s_fault_pipe_empty" },
246         { 0x1c000015, "nca_s_fault_pipe_closed" },
247         { 0x1c000016, "nca_s_fault_pipe_order" },
248         { 0x1c000017, "nca_s_fault_pipe_discipline" },
249         { 0x1c000018, "nca_s_fault_pipe_comm_error" },
250         { 0x1c000019, "nca_s_fault_pipe_memory" },
251         { 0x1c00001a, "nca_s_fault_context_mismatch" },
252         { 0x1c00001b, "nca_s_fault_remote_no_memory" },
253         { 0x1c00001c, "nca_invalid_pres_context_id" },
254         { 0x1c00001d, "nca_unsupported_authn_level" },
255         { 0x1c00001f, "nca_invalid_checksum" },
256         { 0x1c000020, "nca_invalid_crc" },
257         { 0x1c000021, "ncs_s_fault_user_defined" },
258         { 0x1c000022, "nca_s_fault_tx_open_failed" },
259         { 0x1c000023, "nca_s_fault_codeset_conv_error" },
260         { 0x1c000024, "nca_s_fault_object_not_found" },
261         { 0x1c000025, "nca_s_fault_no_client_stub" },
262         { 0x1c010002, "nca_op_rng_error" },
263         { 0x1c010003, "nca_unk_if"},
264         { 0x1c010006, "nca_wrong_boot_time" },
265         { 0x1c010009, "nca_s_you_crashed" },
266         { 0x1c01000b, "nca_proto_error" },
267         { 0x1c010013, "nca_out_args_too_big" },
268         { 0x1c010014, "nca_server_too_busy" },
269         { 0x1c010017, "nca_unsupported_type" },
270         { 0,          NULL }
271 };
272
273 static int proto_dcerpc = -1;
274
275 /* field defines */
276 static int hf_dcerpc_request_in = -1;
277 static int hf_dcerpc_response_in = -1;
278 static int hf_dcerpc_ver = -1;
279 static int hf_dcerpc_ver_minor = -1;
280 static int hf_dcerpc_packet_type = -1;
281 static int hf_dcerpc_cn_flags = -1;
282 static int hf_dcerpc_cn_flags_first_frag = -1;
283 static int hf_dcerpc_cn_flags_last_frag = -1;
284 static int hf_dcerpc_cn_flags_cancel_pending = -1;
285 static int hf_dcerpc_cn_flags_reserved = -1;
286 static int hf_dcerpc_cn_flags_mpx = -1;
287 static int hf_dcerpc_cn_flags_dne = -1;
288 static int hf_dcerpc_cn_flags_maybe = -1;
289 static int hf_dcerpc_cn_flags_object = -1;
290 static int hf_dcerpc_drep = -1;
291 static int hf_dcerpc_drep_byteorder = -1;
292 static int hf_dcerpc_drep_character = -1;
293 static int hf_dcerpc_drep_fp = -1;
294 static int hf_dcerpc_cn_frag_len = -1;
295 static int hf_dcerpc_cn_auth_len = -1;
296 static int hf_dcerpc_cn_call_id = -1;
297 static int hf_dcerpc_cn_max_xmit = -1;
298 static int hf_dcerpc_cn_max_recv = -1;
299 static int hf_dcerpc_cn_assoc_group = -1;
300 static int hf_dcerpc_cn_num_ctx_items = -1;
301 static int hf_dcerpc_cn_ctx_id = -1;
302 static int hf_dcerpc_cn_num_trans_items = -1;
303 static int hf_dcerpc_cn_bind_if_id = -1;
304 static int hf_dcerpc_cn_bind_if_ver = -1;
305 static int hf_dcerpc_cn_bind_if_ver_minor = -1;
306 static int hf_dcerpc_cn_bind_trans_id = -1;
307 static int hf_dcerpc_cn_bind_trans_ver = -1;
308 static int hf_dcerpc_cn_alloc_hint = -1;
309 static int hf_dcerpc_cn_sec_addr_len = -1;
310 static int hf_dcerpc_cn_sec_addr = -1;
311 static int hf_dcerpc_cn_num_results = -1;
312 static int hf_dcerpc_cn_ack_result = -1;
313 static int hf_dcerpc_cn_ack_reason = -1;
314 static int hf_dcerpc_cn_ack_trans_id = -1;
315 static int hf_dcerpc_cn_ack_trans_ver = -1;
316 static int hf_dcerpc_cn_reject_reason = -1;
317 static int hf_dcerpc_cn_num_protocols = -1;
318 static int hf_dcerpc_cn_protocol_ver_major = -1;
319 static int hf_dcerpc_cn_protocol_ver_minor = -1;
320 static int hf_dcerpc_cn_cancel_count = -1;
321 static int hf_dcerpc_cn_status = -1;
322 static int hf_dcerpc_auth_type = -1;
323 static int hf_dcerpc_auth_level = -1;
324 static int hf_dcerpc_auth_pad_len = -1;
325 static int hf_dcerpc_auth_rsrvd = -1;
326 static int hf_dcerpc_auth_ctx_id = -1;
327 static int hf_dcerpc_dg_flags1 = -1;
328 static int hf_dcerpc_dg_flags1_rsrvd_01 = -1;
329 static int hf_dcerpc_dg_flags1_last_frag = -1;
330 static int hf_dcerpc_dg_flags1_frag = -1;
331 static int hf_dcerpc_dg_flags1_nofack = -1;
332 static int hf_dcerpc_dg_flags1_maybe = -1;
333 static int hf_dcerpc_dg_flags1_idempotent = -1;
334 static int hf_dcerpc_dg_flags1_broadcast = -1;
335 static int hf_dcerpc_dg_flags1_rsrvd_80 = -1;
336 static int hf_dcerpc_dg_flags2 = -1;
337 static int hf_dcerpc_dg_flags2_rsrvd_01 = -1;
338 static int hf_dcerpc_dg_flags2_cancel_pending = -1;
339 static int hf_dcerpc_dg_flags2_rsrvd_04 = -1;
340 static int hf_dcerpc_dg_flags2_rsrvd_08 = -1;
341 static int hf_dcerpc_dg_flags2_rsrvd_10 = -1;
342 static int hf_dcerpc_dg_flags2_rsrvd_20 = -1;
343 static int hf_dcerpc_dg_flags2_rsrvd_40 = -1;
344 static int hf_dcerpc_dg_flags2_rsrvd_80 = -1;
345 static int hf_dcerpc_dg_serial_hi = -1;
346 static int hf_dcerpc_obj_id = -1;
347 static int hf_dcerpc_dg_if_id = -1;
348 static int hf_dcerpc_dg_act_id = -1;
349 static int hf_dcerpc_dg_serial_lo = -1;
350 static int hf_dcerpc_dg_ahint = -1;
351 static int hf_dcerpc_dg_ihint = -1;
352 static int hf_dcerpc_dg_frag_len = -1;
353 static int hf_dcerpc_dg_frag_num = -1;
354 static int hf_dcerpc_dg_auth_proto = -1;
355 static int hf_dcerpc_opnum = -1;
356 static int hf_dcerpc_dg_seqnum = -1;
357 static int hf_dcerpc_dg_server_boot = -1;
358 static int hf_dcerpc_dg_if_ver = -1;
359 static int hf_dcerpc_dg_cancel_vers = -1;
360 static int hf_dcerpc_dg_cancel_id = -1;
361 static int hf_dcerpc_dg_server_accepting_cancels = -1;
362 static int hf_dcerpc_dg_fack_vers = -1;
363 static int hf_dcerpc_dg_fack_window_size = -1;
364 static int hf_dcerpc_dg_fack_max_tsdu = -1;
365 static int hf_dcerpc_dg_fack_max_frag_size = -1;
366 static int hf_dcerpc_dg_fack_serial_num = -1;
367 static int hf_dcerpc_dg_fack_selack_len = -1;
368 static int hf_dcerpc_dg_fack_selack = -1;
369 static int hf_dcerpc_dg_status = -1;
370 static int hf_dcerpc_array_max_count = -1;
371 static int hf_dcerpc_array_offset = -1;
372 static int hf_dcerpc_array_actual_count = -1;
373 static int hf_dcerpc_op = -1;
374 static int hf_dcerpc_referent_id = -1;
375 static int hf_dcerpc_fragments = -1;
376 static int hf_dcerpc_fragment = -1;
377 static int hf_dcerpc_fragment_overlap = -1;
378 static int hf_dcerpc_fragment_overlap_conflict = -1;
379 static int hf_dcerpc_fragment_multiple_tails = -1;
380 static int hf_dcerpc_fragment_too_long_fragment = -1;
381 static int hf_dcerpc_fragment_error = -1;
382
383 static gint ett_dcerpc = -1;
384 static gint ett_dcerpc_cn_flags = -1;
385 static gint ett_dcerpc_drep = -1;
386 static gint ett_dcerpc_dg_flags1 = -1;
387 static gint ett_dcerpc_dg_flags2 = -1;
388 static gint ett_dcerpc_pointer_data = -1;
389 static gint ett_dcerpc_fragments = -1;
390 static gint ett_dcerpc_fragment = -1;
391
392 static dissector_handle_t ntlmssp_handle, gssapi_handle;
393
394 fragment_items dcerpc_frag_items = {
395         &ett_dcerpc_fragments,
396         &ett_dcerpc_fragment,
397
398         &hf_dcerpc_fragments,
399         &hf_dcerpc_fragment,
400         &hf_dcerpc_fragment_overlap,
401         &hf_dcerpc_fragment_overlap_conflict,
402         &hf_dcerpc_fragment_multiple_tails,
403         &hf_dcerpc_fragment_too_long_fragment,
404         &hf_dcerpc_fragment_error,
405
406         "fragments"
407 };
408
409 /* try to desegment big DCE/RPC packets over TCP? */
410 static gboolean dcerpc_cn_desegment = TRUE;
411
412 /* reassemble DCE/RPC fragments */
413 /* reassembly of dcerpc fragments will not work for the case where ONE frame 
414    might contain multiple dcerpc fragments for different PDUs.
415    this case would be so unusual/weird so if you got captures like that:
416         too bad
417 */
418 static gboolean dcerpc_reassemble = FALSE;
419 static GHashTable *dcerpc_co_reassemble_table = NULL;
420 static GHashTable *dcerpc_cl_reassemble_table = NULL;
421
422 static void
423 dcerpc_reassemble_init(void)
424 {
425   fragment_table_init(&dcerpc_co_reassemble_table);
426   fragment_table_init(&dcerpc_cl_reassemble_table);
427 }
428
429 /*
430  * Subdissectors
431  */
432
433 /* the registered subdissectors */
434 static GHashTable *dcerpc_uuids;
435
436 typedef struct _dcerpc_uuid_key {
437     e_uuid_t uuid;
438     guint16 ver;
439 } dcerpc_uuid_key;
440
441 typedef struct _dcerpc_uuid_value {
442     int proto;
443     int ett;
444     gchar *name;
445     dcerpc_sub_dissector *procs;
446     int opnum_hf;
447 } dcerpc_uuid_value;
448
449 static gint
450 dcerpc_uuid_equal (gconstpointer k1, gconstpointer k2)
451 {
452     dcerpc_uuid_key *key1 = (dcerpc_uuid_key *)k1;
453     dcerpc_uuid_key *key2 = (dcerpc_uuid_key *)k2;
454     return ((memcmp (&key1->uuid, &key2->uuid, sizeof (e_uuid_t)) == 0)
455             && (key1->ver == key2->ver));
456 }
457
458 static guint
459 dcerpc_uuid_hash (gconstpointer k)
460 {
461     dcerpc_uuid_key *key = (dcerpc_uuid_key *)k;
462     /* This isn't perfect, but the Data1 part of these is almost always
463        unique. */
464     return key->uuid.Data1;
465 }
466
467 void
468 dcerpc_init_uuid (int proto, int ett, e_uuid_t *uuid, guint16 ver,
469                   dcerpc_sub_dissector *procs, int opnum_hf)
470 {
471     dcerpc_uuid_key *key = g_malloc (sizeof (*key));
472     dcerpc_uuid_value *value = g_malloc (sizeof (*value));
473
474     key->uuid = *uuid;
475     key->ver = ver;
476
477     value->proto = proto;
478     value->ett = ett;
479     value->name = proto_get_protocol_short_name (proto);
480     value->procs = procs;
481     value->opnum_hf = opnum_hf;
482
483     g_hash_table_insert (dcerpc_uuids, key, value);
484 }
485
486
487 /*
488  * To keep track of ctx_id mappings.
489  *
490  * Everytime we see a bind call we update this table.
491  * Note that we always specify a SMB FID. For non-SMB transports this
492  * value is 0.
493  */
494 static GHashTable *dcerpc_binds=NULL;
495
496 typedef struct _dcerpc_bind_key {
497     conversation_t *conv;
498     guint16 ctx_id;
499     guint16 smb_fid;
500 } dcerpc_bind_key;
501
502 typedef struct _dcerpc_bind_value {
503         e_uuid_t uuid;
504         guint16 ver;
505 } dcerpc_bind_value;
506
507 static GMemChunk *dcerpc_bind_key_chunk=NULL;
508 static GMemChunk *dcerpc_bind_value_chunk=NULL;
509
510 static gint
511 dcerpc_bind_equal (gconstpointer k1, gconstpointer k2)
512 {
513     dcerpc_bind_key *key1 = (dcerpc_bind_key *)k1;
514     dcerpc_bind_key *key2 = (dcerpc_bind_key *)k2;
515     return (key1->conv == key2->conv
516             && key1->ctx_id == key2->ctx_id
517             && key1->smb_fid == key2->smb_fid);
518 }
519
520 static guint
521 dcerpc_bind_hash (gconstpointer k)
522 {
523     dcerpc_bind_key *key = (dcerpc_bind_key *)k;
524     return ((guint)key->conv) + key->ctx_id + key->smb_fid;
525 }
526
527 /*
528  * To keep track of callid mappings.  Should really use some generic
529  * conversation support instead.
530  */
531 static GHashTable *dcerpc_calls=NULL;
532
533 typedef struct _dcerpc_call_key {
534     conversation_t *conv;
535     guint32 call_id;
536     guint16 smb_fid;
537 } dcerpc_call_key;
538
539 static GMemChunk *dcerpc_call_key_chunk=NULL;
540
541 static GMemChunk *dcerpc_call_value_chunk=NULL;
542
543 static gint
544 dcerpc_call_equal (gconstpointer k1, gconstpointer k2)
545 {
546     dcerpc_call_key *key1 = (dcerpc_call_key *)k1;
547     dcerpc_call_key *key2 = (dcerpc_call_key *)k2;
548     return (key1->conv == key2->conv
549             && key1->call_id == key2->call_id
550             && key1->smb_fid == key2->smb_fid);
551 }
552
553 static guint
554 dcerpc_call_hash (gconstpointer k)
555 {
556     dcerpc_call_key *key = (dcerpc_call_key *)k;
557     return ((guint32)key->conv) + key->call_id + key->smb_fid;
558 }
559
560
561 /* to keep track of matched calls/responses
562    this one uses the same value struct as calls, but the key is the frame id
563 */
564 static GHashTable *dcerpc_matched=NULL;
565 static gint
566 dcerpc_matched_equal (gconstpointer k1, gconstpointer k2)
567 {
568         return (guint32)k1 == (guint32)k2;
569 }
570
571 static guint
572 dcerpc_matched_hash (gconstpointer k)
573 {
574         return (guint32)k;
575 }
576
577
578
579 /*
580  * Utility functions.  Modeled after packet-rpc.c
581  */
582
583 int
584 dissect_dcerpc_uint8 (tvbuff_t *tvb, gint offset, packet_info *pinfo _U_,
585                       proto_tree *tree, char *drep, 
586                       int hfindex, guint8 *pdata)
587 {
588     guint8 data;
589
590     data = tvb_get_guint8 (tvb, offset);
591     if (tree) {
592         proto_tree_add_item (tree, hfindex, tvb, offset, 1, (drep[0] & 0x10));
593     }
594     if (pdata)
595         *pdata = data;
596     return offset + 1;
597 }
598
599 int
600 dissect_dcerpc_uint16 (tvbuff_t *tvb, gint offset, packet_info *pinfo _U_,
601                        proto_tree *tree, char *drep, 
602                        int hfindex, guint16 *pdata)
603 {
604     guint16 data;
605
606     data = ((drep[0] & 0x10)
607             ? tvb_get_letohs (tvb, offset)
608             : tvb_get_ntohs (tvb, offset));
609     
610     if (tree) {
611         proto_tree_add_item (tree, hfindex, tvb, offset, 2, (drep[0] & 0x10));
612     }
613     if (pdata)
614         *pdata = data;
615     return offset + 2;
616 }
617
618 int
619 dissect_dcerpc_uint32 (tvbuff_t *tvb, gint offset, packet_info *pinfo _U_,
620                        proto_tree *tree, char *drep, 
621                        int hfindex, guint32 *pdata)
622 {
623     guint32 data;
624
625     data = ((drep[0] & 0x10)
626             ? tvb_get_letohl (tvb, offset)
627             : tvb_get_ntohl (tvb, offset));
628     
629     if (tree) {
630         proto_tree_add_item (tree, hfindex, tvb, offset, 4, (drep[0] & 0x10));
631     }
632     if (pdata)
633         *pdata = data;
634     return offset+4;
635 }
636
637 int
638 dissect_dcerpc_uint64 (tvbuff_t *tvb, gint offset, packet_info *pinfo _U_,
639                        proto_tree *tree, char *drep, 
640                        int hfindex, unsigned char *pdata)
641 {
642     if(pdata){
643       tvb_memcpy(tvb, pdata, offset, 8);
644       if(drep[0] & 0x10){/* XXX this might be the wrong way around */
645         unsigned char data;
646         data=pdata[0];pdata[0]=pdata[7];pdata[7]=data;
647         data=pdata[1];pdata[1]=pdata[6];pdata[6]=data;
648         data=pdata[2];pdata[2]=pdata[5];pdata[5]=data;
649         data=pdata[3];pdata[3]=pdata[4];pdata[4]=data;
650       }
651     }
652
653     if (tree) {
654         proto_tree_add_item(tree, hfindex, tvb, offset, 8, (drep[0] & 0x10));
655     }
656
657     return offset+8;
658 }
659
660 /*
661  * a couple simpler things
662  */
663 guint16
664 dcerpc_tvb_get_ntohs (tvbuff_t *tvb, gint offset, char *drep)
665 {
666     if (drep[0] & 0x10) {
667         return tvb_get_letohs (tvb, offset);
668     } else {
669         return tvb_get_ntohs (tvb, offset);
670     }
671 }
672
673 guint32
674 dcerpc_tvb_get_ntohl (tvbuff_t *tvb, gint offset, char *drep)
675 {
676     if (drep[0] & 0x10) {
677         return tvb_get_letohl (tvb, offset);
678     } else {
679         return tvb_get_ntohl (tvb, offset);
680     }
681 }
682
683 void
684 dcerpc_tvb_get_uuid (tvbuff_t *tvb, gint offset, char *drep, e_uuid_t *uuid)
685 {
686     unsigned int i;
687     uuid->Data1 = dcerpc_tvb_get_ntohl (tvb, offset, drep);
688     uuid->Data2 = dcerpc_tvb_get_ntohs (tvb, offset+4, drep);
689     uuid->Data3 = dcerpc_tvb_get_ntohs (tvb, offset+6, drep);
690
691     for (i=0; i<sizeof (uuid->Data4); i++) {
692         uuid->Data4[i] = tvb_get_guint8 (tvb, offset+8+i);
693     }
694 }
695
696
697
698 /* NDR arrays */
699 /* function to dissect a unidimensional conformant array */
700 int 
701 dissect_ndr_ucarray(tvbuff_t *tvb, gint offset, packet_info *pinfo,
702                 proto_tree *tree, char *drep, 
703                 dcerpc_dissect_fnct_t *fnct)
704 {
705         guint32 i;
706         dcerpc_info *di;
707         int old_offset;
708
709         di=pinfo->private_data;
710         if(di->conformant_run){
711                 /* conformant run, just dissect the max_count header */
712                 old_offset=offset;
713                 di->conformant_run=0;
714                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
715                                 hf_dcerpc_array_max_count, &di->array_max_count);
716                 di->array_max_count_offset=offset-4;
717                 di->conformant_run=1;
718                 di->conformant_eaten=offset-old_offset;
719         } else {
720                 /* we dont dont remember where  in the bytestream this fields was */
721                 proto_tree_add_uint(tree, hf_dcerpc_array_max_count, tvb, di->array_max_count_offset, 4, di->array_max_count);
722
723                 /* real run, dissect the elements */
724                 for(i=0;i<di->array_max_count;i++){
725                         offset = (*fnct)(tvb, offset, pinfo, tree, drep);
726                 }
727         }
728
729         return offset;
730 }
731 /* function to dissect a unidimensional conformant and varying array */
732 int 
733 dissect_ndr_ucvarray(tvbuff_t *tvb, gint offset, packet_info *pinfo,
734                 proto_tree *tree, char *drep, 
735                 dcerpc_dissect_fnct_t *fnct)
736 {
737         guint32 i;
738         dcerpc_info *di;
739         int old_offset;
740
741         di=pinfo->private_data;
742         if(di->conformant_run){
743                 /* conformant run, just dissect the max_count header */
744                 old_offset=offset;
745                 di->conformant_run=0;
746                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
747                                 hf_dcerpc_array_max_count, &di->array_max_count);
748                 di->array_max_count_offset=offset-4;
749                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
750                                 hf_dcerpc_array_offset, &di->array_offset);
751                 di->array_offset_offset=offset-4;
752                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
753                                 hf_dcerpc_array_actual_count, &di->array_actual_count);
754                 di->array_actual_count_offset=offset-4;
755                 di->conformant_run=1;
756                 di->conformant_eaten=offset-old_offset;
757         } else {
758                 /* we dont dont remember where  in the bytestream these fields were */
759                 proto_tree_add_uint(tree, hf_dcerpc_array_max_count, tvb, di->array_max_count_offset, 4, di->array_max_count);
760                 proto_tree_add_uint(tree, hf_dcerpc_array_offset, tvb, di->array_offset_offset, 4, di->array_offset);
761                 proto_tree_add_uint(tree, hf_dcerpc_array_actual_count, tvb, di->array_actual_count_offset, 4, di->array_actual_count);
762
763                 /* real run, dissect the elements */
764                 for(i=0;i<di->array_actual_count;i++){
765                         offset = (*fnct)(tvb, offset, pinfo, tree, drep);
766                 }
767         }
768
769         return offset;
770 }
771
772
773 /* ndr pointer handling */
774 /* list of pointers encountered so far */
775 static GSList *ndr_pointer_list = NULL;
776
777 /* position where in the list to insert newly encountered pointers */
778 static int ndr_pointer_list_pos=0;
779
780 /* boolean controlling whether pointers are top-level or embedded */
781 static gboolean pointers_are_top_level = TRUE;
782
783 /* as a kludge, we represent all embedded reference pointers as id==-1
784    hoping that his will not collide with any non-ref pointers */
785 typedef struct ndr_pointer_data {
786         guint32 id;
787         proto_tree *tree;
788         dcerpc_dissect_fnct_t *fnct; /*if non-NULL, we have not called it yet*/
789         int hf_index;
790         int levels;
791 } ndr_pointer_data_t;
792
793 static void
794 init_ndr_pointer_list(packet_info *pinfo)
795 {
796         dcerpc_info *di;
797
798         di=pinfo->private_data;
799         di->conformant_run=0;
800
801         while(ndr_pointer_list){
802                 ndr_pointer_data_t *npd;
803         
804                 npd=g_slist_nth_data(ndr_pointer_list, 0);
805                 ndr_pointer_list=g_slist_remove(ndr_pointer_list, npd);
806                 if(npd){
807                         g_free(npd);
808                 }
809         }
810
811         ndr_pointer_list=NULL;
812         ndr_pointer_list_pos=0;
813         pointers_are_top_level=TRUE;
814 }
815
816 static int
817 dissect_deferred_pointers(packet_info *pinfo, tvbuff_t *tvb, int offset, char *drep)
818 {
819         int found_new_pointer;
820         dcerpc_info *di;
821         int old_offset;
822
823         di=pinfo->private_data;
824         do{
825                 int i, len;
826
827                 found_new_pointer=0;
828                 len=g_slist_length(ndr_pointer_list);
829                 for(i=0;i<len;i++){
830                         ndr_pointer_data_t *tnpd;
831                         tnpd=g_slist_nth_data(ndr_pointer_list, i);
832                         if(tnpd->fnct){
833                                 dcerpc_dissect_fnct_t *fnct;
834
835                                 found_new_pointer=1;
836                                 fnct=tnpd->fnct;
837                                 tnpd->fnct=NULL;
838                                 ndr_pointer_list_pos=i+1;
839                                 di->hf_index=tnpd->hf_index;
840                                 di->levels=tnpd->levels;
841                                 /* first a run to handle any conformant
842                                    array headers */
843                                 di->conformant_run=1;
844                                 di->conformant_eaten=0;
845                                 old_offset = offset;
846                                 offset = (*(fnct))(tvb, offset, pinfo, NULL, drep);
847
848                                 g_assert((offset-old_offset)==di->conformant_eaten);
849                                 /* This is to check for any bugs in the dissectors.
850                                  *
851                                  * Basically, the NDR representation will store all
852                                  * arrays in two blocks, one block with the dimension 
853                                  * discreption, like size, number of elements and such,
854                                  * and another block that contains the actual data stored
855                                  * in the array.
856                                  * If the array is embedded directly inside another, 
857                                  * encapsulating aggregate type, like a union or struct,
858                                  * then these two blocks will be stored at different places
859                                  * in the bytestream, with other data between the blocks.
860                                  *
861                                  * For this reason, all pointers to types (both aggregate
862                                  * and scalar, for simplicity no distinction is made)
863                                  * will have its dissector called twice.
864                                  * The dissector will first be called with conformant_run==1
865                                  * in which mode the dissector MUST NOT consume any data from
866                                  * the tvbuff (i.e. may not dissect anything) except the
867                                  * initial control block for arrays.
868                                  * The second time the dissector is called, with 
869                                  * conformant_run==0, all other data for the type will be 
870                                  * dissected.
871                                  *
872                                  * All dissect_ndr_<type> dissectors are already prepared
873                                  * for this and knows when it should eat data from the tvb
874                                  * and when not to, so implementors of dissectors will
875                                  * normally not need to worry about this or even know about
876                                  * it. However, if a dissector for an aggregate type calls
877                                  * a subdissector from outside packet-dcerpc.c, such as
878                                  * the dissector in packet-smb.c for NT Security Descriptors
879                                  * as an example, then it is VERY important to encapsulate
880                                  * this call to an external subdissector with the appropriate
881                                  * test for conformant_run, i.e. it will need something like
882                                  *
883                                  *      dcerpc_info *di;
884                                  *
885                                  *      di=pinfo->private_data;
886                                  *      if(di->conformant_run){
887                                  *              return offset;
888                                  *      }
889                                  * 
890                                  * to make sure it makes the right thing.
891                                  * This assert will signal when someone has forgotten to
892                                  * make the dissector aware of this requirement.
893                                  */
894
895                                 /* now we dissect the actual pointer */
896                                 di->conformant_run=0;
897                                 offset = (*(fnct))(tvb, offset, pinfo, tnpd->tree, drep);
898                                 break;
899                         }
900                 }
901         } while(found_new_pointer);
902
903         return offset;
904 }
905                                                 
906
907 static void
908 add_pointer_to_list(packet_info *pinfo, proto_tree *tree, 
909                 dcerpc_dissect_fnct_t *fnct, guint32 id, int hf_index, int levels)
910 {
911         ndr_pointer_data_t *npd;
912
913         /* check if this pointer is valid */
914         if(id!=0xffffffff){
915                 dcerpc_info *di;
916                 dcerpc_call_value *value;
917
918                 di=pinfo->private_data;
919                 value=di->call_data;
920
921                 if(di->request){
922                         if(!(pinfo->fd->flags.visited)){
923                                 if(id>value->max_ptr){
924                                         value->max_ptr=id;
925                                 }
926                         }
927                 } else {
928                         /* if we havent seen the request bail out since we cant
929                            know whether this is the first non-NULL instance 
930                            or not */
931                         if(value->req_frame==0){
932                                 /* XXX THROW EXCEPTION */
933                         }
934
935                         /* We saw this one in the request frame, nothing to
936                            dissect later */
937                         if(id<=value->max_ptr){
938                                 return;
939                         }
940                 }
941         }
942
943         npd=g_malloc(sizeof(ndr_pointer_data_t));
944         npd->id=id;
945         npd->tree=tree;
946         npd->fnct=fnct;
947         npd->hf_index=hf_index;
948         npd->levels=levels;
949         ndr_pointer_list = g_slist_insert(ndr_pointer_list, npd, 
950                                         ndr_pointer_list_pos);
951         ndr_pointer_list_pos++;
952 }
953
954
955 static int
956 find_pointer_index(guint32 id)
957 {
958         ndr_pointer_data_t *npd;
959         int i,len;
960         
961         len=g_slist_length(ndr_pointer_list);
962         for(i=0;i<len;i++){
963                 npd=g_slist_nth_data(ndr_pointer_list, i);
964                 if(npd){
965                         if(npd->id==id){
966                                 return i;
967                         }
968                 }
969         }
970         
971         return -1;
972 }
973
974 /* This function dissects an NDR pointer and stores the callback for later
975  * deferred dissection.  
976  *
977  *   fnct is the callback function for when we have reached this object in
978  *   the bytestream.  
979  * 
980  *   type is what type of pointer.
981  *
982  *   this is text is what text we should put in any created tree node.
983  *
984  *   hf_index is what hf value we want to pass to the callback function when
985  *   it is called, the callback can later pich this one up from di->hf_index.
986  * 
987  *   levels is a generic int we want to pass to teh callback function.  the
988  *   callback can later pick it up from di->levels
989  *
990  * See packet-dcerpc-samr.c for examples
991  */
992 int 
993 dissect_ndr_pointer(tvbuff_t *tvb, gint offset, packet_info *pinfo,
994                     proto_tree *tree, char *drep, dcerpc_dissect_fnct_t *fnct,
995                     int type, char *text, int hf_index, int levels)
996 {
997         dcerpc_info *di;
998         
999         di=pinfo->private_data;
1000         if(di->conformant_run){
1001                 /* this call was only for dissecting the header for any
1002                    embedded conformant array. we will not parse any
1003                    pointers in this mode.
1004                 */
1005                 return offset;
1006         }
1007
1008         /*TOP LEVEL REFERENCE POINTER*/
1009         if( pointers_are_top_level
1010         &&(type==NDR_POINTER_REF) ){
1011                 proto_item *item;
1012                 proto_tree *tr;
1013
1014                 /* we must find out a nice way to do the length here */
1015                 item=proto_tree_add_text(tree, tvb, offset, 0, 
1016                         "%s", text);
1017                 tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data);
1018
1019                 add_pointer_to_list(pinfo, tr, fnct, 0xffffffff, hf_index, levels);
1020                 goto after_ref_id;
1021         }
1022
1023         /*TOP LEVEL FULL POINTER*/
1024         if( pointers_are_top_level
1025         && (type==NDR_POINTER_PTR) ){
1026                 int idx;
1027                 guint32 id;
1028                 proto_item *item;
1029                 proto_tree *tr;
1030
1031                 /* get the referent id */
1032                 offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id);
1033         
1034                 /* we got a NULL pointer */
1035                 if(id==0){
1036                         proto_tree_add_text(tree, tvb, offset-4, 4,
1037                                 "(NULL pointer) %s",text);
1038                         goto after_ref_id;
1039                 }
1040
1041                 /* see if we have seen this pointer before */
1042                 idx=find_pointer_index(id);
1043
1044                 /* we have seen this pointer before */
1045                 if(idx>=0){
1046                         proto_tree_add_text(tree, tvb, offset-4, 4,
1047                                 "(duplicate PTR) %s",text);
1048                         goto after_ref_id;
1049                 }
1050
1051                 /* new pointer */
1052                 item=proto_tree_add_text(tree, tvb, offset-4, 4, 
1053                         "%s", text);
1054                 tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data);
1055                 proto_tree_add_uint(tr, hf_dcerpc_referent_id, tvb, offset-4, 4, id);
1056                 add_pointer_to_list(pinfo, tr, fnct, id, hf_index, levels);
1057                 goto after_ref_id;
1058         }
1059         /*TOP LEVEL UNIQUE POINTER*/
1060         if( pointers_are_top_level
1061         && (type==NDR_POINTER_UNIQUE) ){
1062                 guint32 id;
1063                 proto_item *item;
1064                 proto_tree *tr;
1065
1066                 /* get the referent id */
1067                 offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id);
1068         
1069                 /* we got a NULL pointer */
1070                 if(id==0){
1071                         proto_tree_add_text(tree, tvb, offset-4, 4,
1072                                 "(NULL pointer) %s",text);
1073                         goto after_ref_id;
1074                 }
1075
1076                 /* new pointer */
1077                 item=proto_tree_add_text(tree, tvb, offset-4, 4, 
1078                         "%s", text);
1079                 tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data);
1080                 proto_tree_add_uint(tr, hf_dcerpc_referent_id, tvb, offset-4, 4, id);
1081                 add_pointer_to_list(pinfo, tr, fnct, 0xffffffff, hf_index, levels);
1082                 goto after_ref_id;
1083         }
1084
1085         /*EMBEDDED REFERENCE POINTER*/
1086         if( (!pointers_are_top_level)
1087         && (type==NDR_POINTER_REF) ){
1088                 guint32 id;
1089                 proto_item *item;
1090                 proto_tree *tr;
1091
1092                 /* get the referent id */
1093                 offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id);
1094         
1095                 /* new pointer */
1096                 item=proto_tree_add_text(tree, tvb, offset-4, 4, 
1097                         "%s",text);
1098                 tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data);
1099                 proto_tree_add_uint(tr, hf_dcerpc_referent_id, tvb, offset-4, 4, id);
1100                 add_pointer_to_list(pinfo, tr, fnct, 0xffffffff, hf_index, levels);
1101                 goto after_ref_id;
1102         }
1103
1104         /*EMBEDDED UNIQUE POINTER*/
1105         if( (!pointers_are_top_level)
1106         && (type==NDR_POINTER_UNIQUE) ){
1107                 guint32 id;
1108                 proto_item *item;
1109                 proto_tree *tr;
1110
1111                 /* get the referent id */
1112                 offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id);
1113         
1114                 /* we got a NULL pointer */
1115                 if(id==0){
1116                         proto_tree_add_text(tree, tvb, offset-4, 4,
1117                                 "(NULL pointer) %s", text);
1118                         goto after_ref_id;
1119                 }
1120
1121                 /* new pointer */
1122                 item=proto_tree_add_text(tree, tvb, offset-4, 4, 
1123                         "%s",text);
1124                 tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data);
1125                 proto_tree_add_uint(tr, hf_dcerpc_referent_id, tvb, offset-4, 4, id);
1126                 add_pointer_to_list(pinfo, tr, fnct, 0xffffffff, hf_index, levels);
1127                 goto after_ref_id;
1128         }
1129
1130         /*EMBEDDED FULL POINTER*/
1131         if( (!pointers_are_top_level)
1132         && (type==NDR_POINTER_PTR) ){
1133                 int idx;
1134                 guint32 id;
1135                 proto_item *item;
1136                 proto_tree *tr;
1137
1138                 /* get the referent id */
1139                 offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id);
1140         
1141                 /* we got a NULL pointer */
1142                 if(id==0){
1143                         proto_tree_add_text(tree, tvb, offset-4, 4,
1144                                 "(NULL pointer) %s",text);
1145                         goto after_ref_id;
1146                 }
1147
1148                 /* see if we have seen this pointer before */
1149                 idx=find_pointer_index(id);
1150
1151                 /* we have seen this pointer before */
1152                 if(idx>=0){
1153                         proto_tree_add_text(tree, tvb, offset-4, 4,
1154                                 "(duplicate PTR) %s",text);
1155                         goto after_ref_id;
1156                 }
1157
1158                 /* new pointer */
1159                 item=proto_tree_add_text(tree, tvb, offset-4, 4, 
1160                         "%s", text);
1161                 tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data);
1162                 proto_tree_add_uint(tr, hf_dcerpc_referent_id, tvb, offset-4, 4, id);
1163                 add_pointer_to_list(pinfo, tr, fnct, id, hf_index, levels);
1164                 goto after_ref_id;
1165         }
1166
1167
1168 after_ref_id:
1169         /* After each top level pointer we have dissected we have to
1170            dissect all deferrals before we move on to the next top level
1171            argument */
1172         if(pointers_are_top_level==TRUE){
1173                 pointers_are_top_level=FALSE;
1174                 offset = dissect_deferred_pointers(pinfo, tvb, offset, drep);
1175                 pointers_are_top_level=TRUE;
1176         }
1177
1178         return offset;
1179 }
1180
1181
1182
1183 static int
1184 dcerpc_try_handoff (packet_info *pinfo, proto_tree *tree,
1185                     proto_tree *dcerpc_tree,
1186                     tvbuff_t *tvb, gint offset,
1187                     char *drep, dcerpc_info *info,
1188                     int auth_level)
1189 {
1190     dcerpc_uuid_key key;
1191     dcerpc_uuid_value *sub_proto;
1192     int length;
1193     proto_tree *sub_tree = NULL;
1194     dcerpc_sub_dissector *proc;
1195     gchar *name = NULL;
1196     dcerpc_dissect_fnct_t *sub_dissect;
1197     const char *saved_proto;
1198     void *saved_private_data;
1199
1200     key.uuid = info->call_data->uuid;
1201     key.ver = info->call_data->ver;
1202
1203     
1204     if ((sub_proto = g_hash_table_lookup (dcerpc_uuids, &key)) == NULL
1205          || !proto_is_protocol_enabled(sub_proto->proto)) {
1206         /*
1207          * We don't have a dissector for this UUID, or the protocol
1208          * for that UUID is disabled.
1209          */
1210         length = tvb_length_remaining (tvb, offset);
1211         if (length > 0) {
1212             proto_tree_add_text (dcerpc_tree, tvb, offset, length,
1213                                  "Stub data (%d byte%s)", length,
1214                                  plurality(length, "", "s"));
1215         }
1216         return -1;
1217     }
1218
1219     for (proc = sub_proto->procs; proc->name; proc++) {
1220         if (proc->num == info->call_data->opnum) {
1221             name = proc->name;
1222             break;
1223         }
1224     }
1225
1226     if (!name)
1227         name = "Unknown?!";
1228
1229     if (check_col (pinfo->cinfo, COL_PROTOCOL)) {
1230         col_set_str (pinfo->cinfo, COL_PROTOCOL, sub_proto->name);
1231     }
1232
1233     if (check_col (pinfo->cinfo, COL_INFO)) {
1234         col_add_fstr (pinfo->cinfo, COL_INFO, "%s %s",
1235                       name, info->request ? "request" : "reply");
1236     }
1237
1238     if (tree) {
1239         proto_item *sub_item;
1240         sub_item = proto_tree_add_item (tree, sub_proto->proto, tvb, offset, 
1241                                         -1, FALSE);
1242
1243         if (sub_item) {
1244             sub_tree = proto_item_add_subtree (sub_item, sub_proto->ett);
1245         }
1246         
1247         /*
1248          * Put the operation number into the tree along with
1249          * the operation's name.
1250          */
1251
1252         if (sub_proto->opnum_hf != -1)
1253                 proto_tree_add_uint_format(sub_tree, sub_proto->opnum_hf,
1254                                            tvb, 0, 0, info->call_data->opnum,
1255                                            "Operation: %s (%u)",
1256                                            name, info->call_data->opnum);
1257         else
1258                 proto_tree_add_uint_format(sub_tree, hf_dcerpc_op, tvb,
1259                                            0, 0, info->call_data->opnum,
1260                                            "Operation: %s (%u)",
1261                                            name, info->call_data->opnum);
1262     }
1263
1264     /* 
1265      * If the authentication level is DCE_C_AUTHN_LEVEL_PKT_PRIVACY,
1266      * the stub data is encrypted, and we can't dissect it.
1267      */
1268     if (auth_level == DCE_C_AUTHN_LEVEL_PKT_PRIVACY) {
1269         length = tvb_length_remaining (tvb, offset);
1270         if (length > 0) {
1271             proto_tree_add_text(sub_tree, tvb, offset, length,
1272                                 "Encrypted stub data (%d byte%s)",
1273                                 length, plurality(length, "", "s"));
1274         }
1275     } else {
1276         sub_dissect = info->request ? proc->dissect_rqst : proc->dissect_resp;
1277         if (sub_dissect) {
1278             saved_proto = pinfo->current_proto;
1279             saved_private_data = pinfo->private_data;
1280             pinfo->current_proto = sub_proto->name;
1281             pinfo->private_data = (void *)info;
1282
1283             init_ndr_pointer_list(pinfo);
1284             offset = sub_dissect (tvb, offset, pinfo, sub_tree, drep);
1285
1286             pinfo->current_proto = saved_proto;
1287             pinfo->private_data = saved_private_data;
1288         } else {
1289             length = tvb_length_remaining (tvb, offset);
1290             if (length > 0) {
1291                 proto_tree_add_text (sub_tree, tvb, offset, length,
1292                                      "Stub data (%d byte%s)", length,
1293                                      plurality(length, "", "s"));
1294             }
1295         }
1296     }
1297     return 0;
1298 }
1299
1300 static int
1301 dissect_dcerpc_cn_auth (tvbuff_t *tvb, packet_info *pinfo, proto_tree *dcerpc_tree,
1302                         e_dce_cn_common_hdr_t *hdr, int *auth_level_p)
1303 {
1304     int offset;
1305     guint8 auth_pad_len;
1306     guint8 auth_level;
1307     guint8 auth_type;
1308
1309     /*
1310      * Initially set "*auth_level_p" to -1 to indicate that we haven't
1311      * yet seen any authentication level information.
1312      */
1313     if (auth_level_p != NULL)
1314         *auth_level_p = -1;
1315
1316     /*
1317      * The authentication information is at the *end* of the PDU; in
1318      * request and response PDUs, the request and response stub data
1319      * come before it.
1320      *
1321      * If the full packet is here, and we've got an auth len, and it's
1322      * valid, then dissect the auth info.
1323      */
1324     if (tvb_length (tvb) >= hdr->frag_len
1325         && hdr->auth_len
1326         && (hdr->auth_len + 8 <= hdr->frag_len)) {
1327
1328         offset = hdr->frag_len - (hdr->auth_len + 8);
1329         
1330         offset = dissect_dcerpc_uint8 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1331                                        hf_dcerpc_auth_type, &auth_type);
1332         offset = dissect_dcerpc_uint8 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1333                                        hf_dcerpc_auth_level, &auth_level);
1334         if (auth_level_p != NULL)
1335             *auth_level_p = auth_level;
1336         offset = dissect_dcerpc_uint8 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1337                                        hf_dcerpc_auth_pad_len, &auth_pad_len);
1338         offset = dissect_dcerpc_uint8 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1339                                        hf_dcerpc_auth_rsrvd, NULL);
1340         offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1341                                         hf_dcerpc_auth_ctx_id, NULL);
1342
1343         /* Dissect the authentication data */
1344
1345         switch(auth_type) {
1346
1347                 /* NTLMSSP */
1348
1349         case DCE_C_RPC_AUTHN_PROTOCOL_NTLMSSP: {
1350                 tvbuff_t *ntlmssp_tvb;
1351
1352                 ntlmssp_tvb = tvb_new_subset(tvb, offset, hdr->auth_len,
1353                                              hdr->auth_len);
1354
1355                 call_dissector(ntlmssp_handle, ntlmssp_tvb, pinfo, 
1356                                dcerpc_tree);
1357
1358                 break;
1359         }
1360
1361                 /* Snego (rfc2478) */
1362
1363         case DCE_C_RPC_AUTHN_PROTOCOL_SNEGO: {
1364                 tvbuff_t *gssapi_tvb;
1365
1366                 gssapi_tvb = tvb_new_subset(tvb, offset, hdr->auth_len,
1367                                             hdr->auth_len);
1368
1369                 call_dissector(gssapi_handle, gssapi_tvb, pinfo, dcerpc_tree);
1370
1371                 break;
1372         }
1373
1374         default:
1375                 proto_tree_add_text (dcerpc_tree, tvb, offset, hdr->auth_len,
1376                                      "Auth Data");
1377         }
1378
1379         /* figure out where the auth padding starts */
1380         offset = hdr->frag_len - (hdr->auth_len + 8 + auth_pad_len);
1381         if (offset > 0 && auth_pad_len) {
1382             proto_tree_add_text (dcerpc_tree, tvb, offset, 
1383                                  auth_pad_len, "Auth padding");
1384             return hdr->auth_len + 8 + auth_pad_len;
1385         } else {
1386             return hdr->auth_len + 8;
1387         }
1388     } else {
1389         return 0;
1390     }
1391 }
1392
1393
1394 /* We need to hash in the SMB fid number to generate a unique hash table
1395    key as DCERPC over SMB allows several pipes over the same TCP/IP
1396    socket. */
1397
1398 static guint16 get_smb_fid (void *private_data)
1399 {
1400     dcerpc_private_info *priv = (dcerpc_private_info *)private_data;
1401         
1402     if (!priv)
1403         return 0;       /* Nothing to see here */
1404
1405     /* DCERPC over smb */
1406
1407     if (priv->transport_type == DCERPC_TRANSPORT_SMB)
1408         return priv->data.smb.fid;
1409
1410     /* Some other transport... */
1411
1412     return 0;
1413 }
1414
1415 /*
1416  * Connection oriented packet types
1417  */
1418
1419 static void
1420 dissect_dcerpc_cn_bind (tvbuff_t *tvb, packet_info *pinfo, proto_tree *dcerpc_tree,
1421                         e_dce_cn_common_hdr_t *hdr)
1422 {
1423     conversation_t *conv = NULL;
1424     guint8 num_ctx_items;
1425     guint i;
1426     gboolean saw_ctx_item = FALSE;
1427     guint16 ctx_id;
1428     guint16 num_trans_items;
1429     guint j;
1430     e_uuid_t if_id;
1431     e_uuid_t trans_id;
1432     guint32 trans_ver;
1433     guint16 if_ver, if_ver_minor;
1434     int offset = 16;
1435
1436     offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1437                                     hf_dcerpc_cn_max_xmit, NULL);
1438
1439     offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1440                                     hf_dcerpc_cn_max_recv, NULL);
1441
1442     offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1443                                     hf_dcerpc_cn_assoc_group, NULL);
1444
1445     offset = dissect_dcerpc_uint8 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1446                                     hf_dcerpc_cn_num_ctx_items, &num_ctx_items);
1447
1448     /* padding */
1449     offset += 3;
1450
1451     for (i = 0; i < num_ctx_items; i++) {
1452       offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1453                                       hf_dcerpc_cn_ctx_id, &ctx_id);
1454
1455       offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1456                                       hf_dcerpc_cn_num_trans_items, &num_trans_items);
1457
1458       dcerpc_tvb_get_uuid (tvb, offset, hdr->drep, &if_id);
1459       if (dcerpc_tree) {
1460           proto_tree_add_string_format (dcerpc_tree, hf_dcerpc_cn_bind_if_id, tvb,
1461                                         offset, 16, "HMMM",
1462                                         "Interface UUID: %08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
1463                                         if_id.Data1, if_id.Data2, if_id.Data3,
1464                                         if_id.Data4[0], if_id.Data4[1],
1465                                         if_id.Data4[2], if_id.Data4[3],
1466                                         if_id.Data4[4], if_id.Data4[5],
1467                                         if_id.Data4[6], if_id.Data4[7]);
1468       }
1469       offset += 16;
1470
1471       if (hdr->drep[0] & 0x10) {
1472           offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1473                                           hf_dcerpc_cn_bind_if_ver, &if_ver);
1474           offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1475                                           hf_dcerpc_cn_bind_if_ver_minor, &if_ver_minor);
1476       } else {
1477           offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1478                                           hf_dcerpc_cn_bind_if_ver_minor, &if_ver_minor);
1479           offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1480                                           hf_dcerpc_cn_bind_if_ver, &if_ver);
1481       }
1482
1483       if (!saw_ctx_item) {
1484         conv = find_conversation (&pinfo->src, &pinfo->dst, pinfo->ptype,
1485                                   pinfo->srcport, pinfo->destport, 0);
1486         if (conv == NULL) {
1487             conv = conversation_new (&pinfo->src, &pinfo->dst, pinfo->ptype,
1488                                      pinfo->srcport, pinfo->destport, 0);
1489         }
1490
1491         /* if this is the first time we see this packet, we need to
1492            update the dcerpc_binds table so that any later calls can
1493            match to the interface.
1494            XXX We assume that BINDs will NEVER be fragmented.
1495         */
1496         if(!(pinfo->fd->flags.visited)){
1497                 dcerpc_bind_key *key;
1498                 dcerpc_bind_value *value;
1499
1500                 key = g_mem_chunk_alloc (dcerpc_bind_key_chunk);
1501                 key->conv = conv;
1502                 key->ctx_id = ctx_id;
1503                 key->smb_fid = get_smb_fid(pinfo->private_data);
1504
1505                 value = g_mem_chunk_alloc (dcerpc_bind_value_chunk);
1506                 value->uuid = if_id;
1507                 value->ver = if_ver;
1508
1509                 /* add this entry to the bind table, first removing any
1510                    previous ones that are identical
1511                  */
1512                 if(g_hash_table_lookup(dcerpc_binds, key)){
1513                         g_hash_table_remove(dcerpc_binds, key);
1514                 }
1515                 g_hash_table_insert (dcerpc_binds, key, value);
1516         }
1517
1518         if (check_col (pinfo->cinfo, COL_INFO)) {
1519           dcerpc_uuid_key key;
1520           dcerpc_uuid_value *value;
1521
1522           key.uuid = if_id;
1523           key.ver = if_ver;
1524
1525           if ((value = g_hash_table_lookup(dcerpc_uuids, &key)))
1526                   col_append_fstr(pinfo->cinfo, COL_INFO, " UUID: %s", value->name);
1527           else
1528                   col_append_fstr(pinfo->cinfo, COL_INFO, " UUID: %08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x ver %u.%u",
1529                            if_id.Data1, if_id.Data2, if_id.Data3,
1530                            if_id.Data4[0], if_id.Data4[1],
1531                            if_id.Data4[2], if_id.Data4[3],
1532                            if_id.Data4[4], if_id.Data4[5],
1533                            if_id.Data4[6], if_id.Data4[7],
1534                            if_ver, if_ver_minor);
1535         }
1536         saw_ctx_item = TRUE;
1537       }
1538
1539       for (j = 0; j < num_trans_items; j++) {
1540         dcerpc_tvb_get_uuid (tvb, offset, hdr->drep, &trans_id);
1541         if (dcerpc_tree) {
1542             proto_tree_add_string_format (dcerpc_tree, hf_dcerpc_cn_bind_trans_id, tvb,
1543                                           offset, 16, "HMMM",
1544                                           "Transfer Syntax: %08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
1545                                           trans_id.Data1, trans_id.Data2, trans_id.Data3,
1546                                           trans_id.Data4[0], trans_id.Data4[1],
1547                                           trans_id.Data4[2], trans_id.Data4[3],
1548                                           trans_id.Data4[4], trans_id.Data4[5],
1549                                           trans_id.Data4[6], trans_id.Data4[7]);
1550         }
1551         offset += 16;
1552
1553         offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1554                                         hf_dcerpc_cn_bind_trans_ver, &trans_ver);
1555       }
1556     }
1557
1558     /*
1559      * XXX - we should save the authentication type *if* we have
1560      * an authentication header, and associate it with an authentication
1561      * context, so subsequent PDUs can use that context.
1562      */
1563     dissect_dcerpc_cn_auth (tvb, pinfo, dcerpc_tree, hdr, NULL);
1564 }
1565
1566 static void
1567 dissect_dcerpc_cn_bind_ack (tvbuff_t *tvb, packet_info *pinfo, proto_tree *dcerpc_tree,
1568                             e_dce_cn_common_hdr_t *hdr)
1569 {
1570     guint16 max_xmit, max_recv;
1571     guint16 sec_addr_len;
1572     guint8 num_results;
1573     guint i;
1574     guint16 result;
1575     guint16 reason;
1576     e_uuid_t trans_id;
1577     guint32 trans_ver;
1578
1579     int offset = 16;
1580
1581     offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1582                                     hf_dcerpc_cn_max_xmit, &max_xmit);
1583
1584     offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1585                                     hf_dcerpc_cn_max_recv, &max_recv);
1586
1587     offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1588                                     hf_dcerpc_cn_assoc_group, NULL);
1589
1590     offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1591                                     hf_dcerpc_cn_sec_addr_len, &sec_addr_len);
1592     if (sec_addr_len != 0) {
1593         proto_tree_add_item (dcerpc_tree, hf_dcerpc_cn_sec_addr, tvb, offset,
1594                              sec_addr_len, FALSE);
1595         offset += sec_addr_len;
1596     }
1597
1598     if (offset % 4) {
1599         offset += 4 - offset % 4;
1600     }
1601
1602     offset = dissect_dcerpc_uint8 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1603                                    hf_dcerpc_cn_num_results, &num_results);
1604
1605     /* padding */
1606     offset += 3;
1607
1608     for (i = 0; i < num_results; i++) {
1609         offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, 
1610                                         hdr->drep, hf_dcerpc_cn_ack_result,
1611                                         &result);
1612         if (result != 0) {
1613             offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, 
1614                                             hdr->drep, hf_dcerpc_cn_ack_reason,
1615                                             &reason);
1616         } else {
1617             /*
1618              * The reason for rejection isn't meaningful, and often isn't
1619              * set, when the syntax was accepted.
1620              */
1621             offset += 2;
1622         }
1623
1624         dcerpc_tvb_get_uuid (tvb, offset, hdr->drep, &trans_id);
1625         if (dcerpc_tree) {
1626             proto_tree_add_string_format (dcerpc_tree, hf_dcerpc_cn_ack_trans_id, tvb,
1627                                           offset, 16, "HMMM",
1628                                           "Transfer Syntax: %08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
1629                                           trans_id.Data1, trans_id.Data2, trans_id.Data3,
1630                                           trans_id.Data4[0], trans_id.Data4[1],
1631                                           trans_id.Data4[2], trans_id.Data4[3],
1632                                           trans_id.Data4[4], trans_id.Data4[5],
1633                                           trans_id.Data4[6], trans_id.Data4[7]);
1634         }
1635         offset += 16;
1636
1637         offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1638                                         hf_dcerpc_cn_ack_trans_ver, &trans_ver);
1639     }
1640     
1641     /*
1642      * XXX - do we need to do anything with the authentication level
1643      * we get back from this?
1644      */
1645     dissect_dcerpc_cn_auth (tvb, pinfo, dcerpc_tree, hdr, NULL);
1646
1647     if (check_col (pinfo->cinfo, COL_INFO)) {
1648         if (num_results != 0 && result == 0) {
1649             /* XXX - only checks the last result */
1650             col_append_fstr (pinfo->cinfo, COL_INFO,
1651                              " accept max_xmit: %u max_recv: %u",
1652                              max_xmit, max_recv);
1653         } else {
1654             /* XXX - only shows the last result and reason */
1655             col_append_fstr (pinfo->cinfo, COL_INFO, " %s, reason: %s",
1656                              val_to_str(result, p_cont_result_vals,
1657                                         "Unknown result (%u)"),
1658                              val_to_str(reason, p_provider_reason_vals,
1659                                         "Unknown (%u)"));
1660         }
1661     }
1662 }
1663
1664 static void
1665 dissect_dcerpc_cn_bind_nak (tvbuff_t *tvb, packet_info *pinfo, proto_tree *dcerpc_tree,
1666                             e_dce_cn_common_hdr_t *hdr)
1667 {
1668     guint16 reason;
1669     guint8 num_protocols;
1670     guint i;
1671
1672     int offset = 16;
1673
1674     offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, 
1675                                     hdr->drep, hf_dcerpc_cn_reject_reason,
1676                                     &reason);
1677
1678     if (check_col (pinfo->cinfo, COL_INFO)) {
1679         col_append_fstr (pinfo->cinfo, COL_INFO, " reason: %s",
1680                       val_to_str(reason, reject_reason_vals, "Unknown (%u)"));
1681     }
1682
1683     if (reason == PROTOCOL_VERSION_NOT_SUPPORTED) {
1684         offset = dissect_dcerpc_uint8 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1685                                        hf_dcerpc_cn_num_protocols,
1686                                        &num_protocols);
1687
1688         for (i = 0; i < num_protocols; i++) {
1689             offset = dissect_dcerpc_uint8 (tvb, offset, pinfo, dcerpc_tree, 
1690                                         hdr->drep, hf_dcerpc_cn_protocol_ver_major,
1691                                         NULL);
1692             offset = dissect_dcerpc_uint8 (tvb, offset, pinfo, dcerpc_tree, 
1693                                         hdr->drep, hf_dcerpc_cn_protocol_ver_minor,
1694                                         NULL);
1695         }
1696     }
1697 }
1698
1699 static void
1700 dissect_dcerpc_cn_stub (tvbuff_t *tvb, int offset, packet_info *pinfo,
1701                         proto_tree *dcerpc_tree, proto_tree *tree,
1702                         e_dce_cn_common_hdr_t *hdr, dcerpc_info *di,
1703                         int auth_sz, int auth_level, guint32 alloc_hint,
1704                         guint32 frame)
1705 {
1706     int length, reported_length, stub_length;
1707     gboolean save_fragmented;
1708
1709     length = tvb_length_remaining(tvb, offset);
1710     reported_length = tvb_reported_length_remaining(tvb, offset);
1711     stub_length = hdr->frag_len - offset - auth_sz;
1712     if (length > stub_length)
1713       length = stub_length;
1714     if (reported_length > stub_length)
1715       reported_length = stub_length;
1716
1717     save_fragmented = pinfo->fragmented;
1718
1719     /* If we don't have reassembly enabled, or this packet contains
1720        the entire PDU, or if this is a short frame (or a frame
1721        not reassembled at a lower layer) that doesn't include all
1722        the data in the fragment, just call the handoff directly if
1723        this is the first fragment or the PDU isn't fragmented. */
1724     if( (!dcerpc_reassemble) || PFC_NOT_FRAGMENTED(hdr) ||
1725                 stub_length > length ){
1726         if(hdr->flags&PFC_FIRST_FRAG){
1727             /* First fragment, possibly the only fragment */
1728             pinfo->fragmented = !PFC_NOT_FRAGMENTED(hdr);
1729             dcerpc_try_handoff (pinfo, tree, dcerpc_tree,
1730                                 tvb_new_subset (tvb, offset, length,
1731                                                 reported_length),
1732                                 0, hdr->drep, di, auth_level);
1733         } else {
1734             /* PDU is fragmented and this isn't the first fragment */
1735             if (check_col(pinfo->cinfo, COL_INFO)) {
1736                 col_append_fstr(pinfo->cinfo, COL_INFO,
1737                                 " [DCE/RPC fragment]");
1738             }
1739             if (dcerpc_tree) {
1740                 if (length > 0) {
1741                     proto_tree_add_text (dcerpc_tree, tvb, offset, length,
1742                                 "Fragment data (%d byte%s)", length,
1743                                 plurality(length, "", "s"));
1744                 }
1745             }
1746         }
1747     } else {
1748         /* Reassembly is enabled, the PDU is fragmented, and
1749            we have all the data in the fragment; the first two
1750            of those mean we should attempt reassembly, and the
1751            third means we can attempt reassembly. */
1752         if (dcerpc_tree) {
1753             if (length > 0) {
1754                 proto_tree_add_text (dcerpc_tree, tvb, offset, length,
1755                                 "Fragment data (%d byte%s)", length,
1756                                 plurality(length, "", "s"));
1757             }
1758         }
1759         if(hdr->flags&PFC_FIRST_FRAG){  /* FIRST fragment */
1760             if( (!pinfo->fd->flags.visited) && frame){
1761                 fragment_add(tvb, offset, pinfo, frame,
1762                              dcerpc_co_reassemble_table,
1763                              0,
1764                              length,
1765                              TRUE);
1766                 fragment_set_tot_len(pinfo, frame,
1767                              dcerpc_co_reassemble_table, alloc_hint);
1768             }
1769             if (check_col(pinfo->cinfo, COL_INFO)) {
1770                 col_append_fstr(pinfo->cinfo, COL_INFO,
1771                                 " [DCE/RPC fragment]");
1772             }
1773         } else if(hdr->flags&PFC_LAST_FRAG){  /* LAST fragment */
1774             if( frame ){
1775                 fragment_data *fd_head;
1776                 guint32 tot_len;
1777
1778                 tot_len = fragment_get_tot_len(pinfo, frame,
1779                                dcerpc_co_reassemble_table);
1780                 fd_head = fragment_add(tvb, offset, pinfo, 
1781                      frame,
1782                      dcerpc_co_reassemble_table,
1783                      tot_len-alloc_hint,
1784                      length,
1785                      TRUE);
1786
1787                 if(fd_head){
1788                     /* We completed reassembly */
1789                     tvbuff_t *next_tvb;
1790
1791                     next_tvb = tvb_new_real_data(fd_head->data, fd_head->datalen, fd_head->datalen);
1792                     tvb_set_child_real_data_tvbuff(tvb, next_tvb);
1793                     add_new_data_source(pinfo, next_tvb, "Reassembled DCE/RPC");
1794                     show_fragment_tree(fd_head, &dcerpc_frag_items,
1795                         dcerpc_tree, pinfo, next_tvb);
1796
1797                     pinfo->fragmented = FALSE;
1798                     dcerpc_try_handoff (pinfo, tree, dcerpc_tree, next_tvb,
1799                                 0, hdr->drep, di, auth_level);
1800                 } else {
1801                     /* Reassembly not complete - some fragments
1802                        are missing */
1803                     if (check_col(pinfo->cinfo, COL_INFO)) {
1804                         col_append_fstr(pinfo->cinfo, COL_INFO,
1805                                     " [DCE/RPC fragment]");
1806                     }
1807                 }
1808             }
1809         } else {  /* MIDDLE fragment(s) */
1810             if( (!pinfo->fd->flags.visited) && frame ){
1811                 guint32 tot_len;
1812                 tot_len = fragment_get_tot_len(pinfo, frame,
1813                                        dcerpc_co_reassemble_table);
1814                 fragment_add(tvb, offset, pinfo, frame,
1815                              dcerpc_co_reassemble_table,
1816                              tot_len-alloc_hint,
1817                              length,
1818                              TRUE);
1819             }
1820             if (check_col(pinfo->cinfo, COL_INFO)) {
1821                 col_append_fstr(pinfo->cinfo, COL_INFO,
1822                                 " [DCE/RPC fragment]");
1823             }
1824         }
1825     }
1826     pinfo->fragmented = save_fragmented;
1827 }
1828
1829 static void
1830 dissect_dcerpc_cn_rqst (tvbuff_t *tvb, packet_info *pinfo, proto_tree *dcerpc_tree,
1831                         proto_tree *tree, e_dce_cn_common_hdr_t *hdr)
1832 {
1833     conversation_t *conv;
1834     guint16 ctx_id;
1835     guint16 opnum;
1836     e_uuid_t obj_id;
1837     int auth_sz = 0;
1838     int auth_level;
1839     int offset = 16;
1840     guint32 alloc_hint;
1841     int length;
1842
1843     offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1844                                     hf_dcerpc_cn_alloc_hint, &alloc_hint);
1845
1846     offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1847                                     hf_dcerpc_cn_ctx_id, &ctx_id);
1848
1849     offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1850                                     hf_dcerpc_opnum, &opnum);
1851
1852     if (check_col (pinfo->cinfo, COL_INFO)) {
1853         col_append_fstr (pinfo->cinfo, COL_INFO, " opnum: %u ctx_id: %u",
1854                          opnum, ctx_id);
1855     }
1856
1857     if (hdr->flags & PFC_OBJECT_UUID) {
1858         dcerpc_tvb_get_uuid (tvb, offset, hdr->drep, &obj_id);
1859         if (dcerpc_tree) {
1860             proto_tree_add_string_format (dcerpc_tree, hf_dcerpc_obj_id, tvb,
1861                                           offset, 16, "HMMM",
1862                                           "Object UUID: %08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
1863                                           obj_id.Data1, obj_id.Data2, obj_id.Data3,
1864                                           obj_id.Data4[0],
1865                                           obj_id.Data4[1],
1866                                           obj_id.Data4[2],
1867                                           obj_id.Data4[3],
1868                                           obj_id.Data4[4],
1869                                           obj_id.Data4[5],
1870                                           obj_id.Data4[6],
1871                                           obj_id.Data4[7]);
1872         }
1873         offset += 16;
1874     }
1875
1876     /*
1877      * XXX - what if this was set when the connection was set up,
1878      * and we just have a security context?
1879      */
1880     auth_sz = dissect_dcerpc_cn_auth (tvb, pinfo, dcerpc_tree, hdr,
1881                                       &auth_level);
1882
1883     conv = find_conversation (&pinfo->src, &pinfo->dst, pinfo->ptype,
1884                               pinfo->srcport, pinfo->destport, 0);
1885     if (!conv) {
1886
1887     } else {
1888         dcerpc_call_value *value;
1889
1890         /* !!! we can NOT check flags.visited here since this will interact
1891            badly with when SMB handles (i.e. calls the subdissector)
1892            and desegmented pdu's .
1893            Instead we check if this pdu is already in the matched table or not
1894         */
1895         if(!g_hash_table_lookup(dcerpc_matched, (void *)pinfo->fd->num)){
1896                 dcerpc_bind_key bind_key;
1897                 dcerpc_bind_value *bind_value;
1898
1899                 bind_key.conv=conv;
1900                 bind_key.ctx_id=ctx_id;
1901                 bind_key.smb_fid=get_smb_fid(pinfo->private_data);
1902
1903                 if((bind_value=g_hash_table_lookup(dcerpc_binds, &bind_key))){
1904                         dcerpc_call_key *call_key;
1905                         dcerpc_call_value *call_value;
1906
1907                         /* We found the binding so just add the call
1908                            to both the call table and the matched table
1909                         */
1910                         call_key=g_mem_chunk_alloc (dcerpc_call_key_chunk);
1911                         call_key->conv=conv;
1912                         call_key->call_id=hdr->call_id;
1913                         call_key->smb_fid=get_smb_fid(pinfo->private_data);
1914
1915                         /* if there is already a matching call in the table
1916                            remove it so it is replaced with the new one */
1917                         if(g_hash_table_lookup(dcerpc_calls, call_key)){
1918                                 g_hash_table_remove(dcerpc_calls, call_key);
1919                         }
1920
1921                         call_value=g_mem_chunk_alloc (dcerpc_call_value_chunk);
1922                         call_value->uuid = bind_value->uuid;
1923                         call_value->ver = bind_value->ver;
1924                         call_value->opnum = opnum;
1925                         call_value->req_frame=pinfo->fd->num;
1926                         call_value->rep_frame=0;
1927                         call_value->max_ptr=0;
1928                         call_value->private_data = NULL;
1929                         g_hash_table_insert (dcerpc_calls, call_key, call_value);
1930
1931                         g_hash_table_insert (dcerpc_matched, (void *)pinfo->fd->num, call_value);       
1932                 }
1933         }
1934
1935         value=g_hash_table_lookup (dcerpc_matched, (void *)pinfo->fd->num);
1936
1937         if (value) {
1938             dcerpc_info di;
1939
1940             /* handoff this call */
1941             di.conv = conv;
1942             di.call_id = hdr->call_id;
1943             di.smb_fid = get_smb_fid(pinfo->private_data);
1944             di.request = TRUE;
1945             di.call_data = value;
1946
1947             if(value->rep_frame!=0){
1948                 proto_tree_add_uint(dcerpc_tree, hf_dcerpc_response_in, 
1949                                     tvb, 0, 0, value->rep_frame);
1950             }
1951
1952             dissect_dcerpc_cn_stub (tvb, offset, pinfo, dcerpc_tree, tree,
1953                                     hdr, &di, auth_sz, auth_level, alloc_hint,
1954                                     value->req_frame);
1955         } else {
1956             length = tvb_length_remaining (tvb, offset);
1957             if (length > 0) {
1958                 proto_tree_add_text (dcerpc_tree, tvb, offset, length,
1959                                      "Stub data (%d byte%s)", length,
1960                                      plurality(length, "", "s"));
1961             }
1962         }
1963     }
1964 }
1965
1966 static void
1967 dissect_dcerpc_cn_resp (tvbuff_t *tvb, packet_info *pinfo, proto_tree *dcerpc_tree,
1968                         proto_tree *tree, e_dce_cn_common_hdr_t *hdr)
1969 {
1970     dcerpc_call_value *value = NULL;
1971     conversation_t *conv;
1972     guint16 ctx_id;
1973     int auth_sz = 0;
1974     int offset = 16;
1975     int auth_level;
1976     guint32 alloc_hint;
1977     int length;
1978
1979     offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1980                                     hf_dcerpc_cn_alloc_hint, &alloc_hint);
1981
1982     offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1983                                     hf_dcerpc_cn_ctx_id, &ctx_id);
1984
1985     if (check_col (pinfo->cinfo, COL_INFO)) {
1986         col_append_fstr (pinfo->cinfo, COL_INFO, " ctx_id: %u", ctx_id);
1987     }
1988
1989     offset = dissect_dcerpc_uint8 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
1990                                    hf_dcerpc_cn_cancel_count, NULL);
1991     /* padding */
1992     offset++;
1993
1994     /*
1995      * XXX - what if this was set when the connection was set up,
1996      * and we just have a security context?
1997      */
1998     auth_sz = dissect_dcerpc_cn_auth (tvb, pinfo, dcerpc_tree, hdr,
1999                                       &auth_level);
2000
2001     conv = find_conversation (&pinfo->src, &pinfo->dst, pinfo->ptype,
2002                               pinfo->srcport, pinfo->destport, 0);
2003     if (!conv) {
2004         /* no point in creating one here, really */
2005     } else {
2006
2007         /* !!! we can NOT check flags.visited here since this will interact
2008            badly with when SMB handles (i.e. calls the subdissector)
2009            and desegmented pdu's .
2010            Instead we check if this pdu is already in the matched table or not
2011         */
2012         if(!g_hash_table_lookup(dcerpc_matched, (void *)pinfo->fd->num)){
2013                 dcerpc_call_key call_key;
2014                 dcerpc_call_value *call_value;
2015
2016                 call_key.conv=conv;
2017                 call_key.call_id=hdr->call_id;
2018                 call_key.smb_fid=get_smb_fid(pinfo->private_data);
2019
2020                 if((call_value=g_hash_table_lookup(dcerpc_calls, &call_key))){
2021                         g_hash_table_insert (dcerpc_matched, (void *)pinfo->fd->num, call_value);
2022                         if(call_value->rep_frame==0){
2023                                 call_value->rep_frame=pinfo->fd->num;
2024                         }
2025
2026                 }
2027         }
2028
2029         value=g_hash_table_lookup(dcerpc_matched, (void *)pinfo->fd->num);
2030
2031         if (value) {
2032             dcerpc_info di;
2033
2034             /* handoff this call */
2035             di.conv = conv;
2036             di.call_id = hdr->call_id;
2037             di.smb_fid = get_smb_fid(pinfo->private_data);
2038             di.request = FALSE;
2039             di.call_data = value;
2040
2041             proto_tree_add_uint (dcerpc_tree, hf_dcerpc_opnum, tvb, 0, 0, value->opnum);
2042             if(value->req_frame!=0){
2043                 proto_tree_add_uint(dcerpc_tree, hf_dcerpc_request_in, 
2044                                     tvb, 0, 0, value->req_frame);
2045             }
2046
2047             dissect_dcerpc_cn_stub (tvb, offset, pinfo, dcerpc_tree, tree,
2048                                     hdr, &di, auth_sz, auth_level, alloc_hint,
2049                                     value->rep_frame);
2050         } else {
2051             length = tvb_length_remaining (tvb, offset);
2052             if (length > 0) {
2053                 proto_tree_add_text (dcerpc_tree, tvb, offset, length,
2054                                      "Stub data (%d byte%s)", length,
2055                                      plurality(length, "", "s"));
2056             }
2057         }
2058     }
2059 }
2060
2061 static void
2062 dissect_dcerpc_cn_fault (tvbuff_t *tvb, packet_info *pinfo,
2063                          proto_tree *dcerpc_tree, e_dce_cn_common_hdr_t *hdr)
2064 {
2065     dcerpc_call_value *value = NULL;
2066     conversation_t *conv;
2067     guint16 ctx_id;
2068     guint32 status;
2069     int auth_sz = 0;
2070     int offset = 16;
2071     int auth_level;
2072     guint32 alloc_hint;
2073
2074     offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
2075                                     hf_dcerpc_cn_alloc_hint, &alloc_hint);
2076
2077     offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
2078                                     hf_dcerpc_cn_ctx_id, &ctx_id);
2079
2080     offset = dissect_dcerpc_uint8 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
2081                                    hf_dcerpc_cn_cancel_count, NULL);
2082     /* padding */
2083     offset++;
2084
2085     offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, hdr->drep,
2086                                     hf_dcerpc_cn_status, &status);
2087
2088     if (check_col (pinfo->cinfo, COL_INFO)) {
2089         col_append_fstr (pinfo->cinfo, COL_INFO,
2090                       " ctx_id: %u status: %s", ctx_id,
2091                       val_to_str(status, reject_status_vals,
2092                                  "Unknown (0x%08x)"));
2093     }
2094
2095     /* padding */
2096     offset += 4;
2097
2098     /*
2099      * XXX - what if this was set when the connection was set up,
2100      * and we just have a security context?
2101      */
2102     auth_sz = dissect_dcerpc_cn_auth (tvb, pinfo, dcerpc_tree, hdr,
2103                                       &auth_level);
2104
2105     conv = find_conversation (&pinfo->src, &pinfo->dst, pinfo->ptype,
2106                               pinfo->srcport, pinfo->destport, 0);
2107     if (!conv) {
2108         /* no point in creating one here, really */
2109     } else {
2110
2111         /* !!! we can NOT check flags.visited here since this will interact
2112            badly with when SMB handles (i.e. calls the subdissector)
2113            and desegmented pdu's .
2114            Instead we check if this pdu is already in the matched table or not
2115         */
2116         if(!g_hash_table_lookup(dcerpc_matched, (void *)pinfo->fd->num)){
2117                 dcerpc_call_key call_key;
2118                 dcerpc_call_value *call_value;
2119
2120                 call_key.conv=conv;
2121                 call_key.call_id=hdr->call_id;
2122                 call_key.smb_fid=get_smb_fid(pinfo->private_data);
2123
2124                 if((call_value=g_hash_table_lookup(dcerpc_calls, &call_key))){
2125                         g_hash_table_insert (dcerpc_matched, (void *)pinfo->fd->num, call_value);
2126                         if(call_value->rep_frame==0){
2127                                 call_value->rep_frame=pinfo->fd->num;
2128                         }
2129
2130                 }
2131         }
2132
2133         value=g_hash_table_lookup(dcerpc_matched, (void *)pinfo->fd->num);
2134
2135         if (value) {
2136             int length, reported_length, stub_length;
2137             dcerpc_info di;
2138
2139             /* handoff this call */
2140             di.conv = conv;
2141             di.call_id = hdr->call_id;
2142             di.smb_fid = get_smb_fid(pinfo->private_data);
2143             di.request = FALSE;
2144             di.call_data = value;
2145
2146             proto_tree_add_uint (dcerpc_tree, hf_dcerpc_opnum, tvb, 0, 0, value->opnum);
2147             if(value->req_frame!=0){
2148                 proto_tree_add_uint(dcerpc_tree, hf_dcerpc_request_in, 
2149                                     tvb, 0, 0, value->req_frame);
2150             }
2151
2152             length = tvb_length_remaining(tvb, offset);
2153             reported_length = tvb_reported_length_remaining(tvb, offset);
2154             stub_length = hdr->frag_len - offset - auth_sz;
2155             if (length > stub_length)
2156               length = stub_length;
2157             if (reported_length > stub_length)
2158               reported_length = stub_length;
2159
2160             /* If we don't have reassembly enabled, or this packet contains
2161                the entire PDU, or if this is a short frame (or a frame
2162                not reassembled at a lower layer) that doesn't include all
2163                the data in the fragment, just call the handoff directly if
2164                this is the first fragment or the PDU isn't fragmented. */
2165             if( (!dcerpc_reassemble) || PFC_NOT_FRAGMENTED(hdr) ||
2166                         stub_length > length ){
2167                 if(hdr->flags&PFC_FIRST_FRAG){
2168                     /* First fragment, possibly the only fragment */
2169                     /*
2170                      * XXX - should there be a third routine for each
2171                      * function in an RPC subdissector, to handle
2172                      * fault responses?  The DCE RPC 1.1 spec says
2173                      * three's "stub data" here, which I infer means
2174                      * that it's protocol-specific and call-specific.
2175                      *
2176                      * It should probably get passed the status code
2177                      * as well, as that might be protocol-specific.
2178                      */
2179                     if (dcerpc_tree) {
2180                         if (length > 0) {
2181                             proto_tree_add_text (dcerpc_tree, tvb, offset, length,
2182                                         "Fault stub data (%d byte%s)", length,
2183                                         plurality(length, "", "s"));
2184                         }
2185                     }
2186                 } else {
2187                     /* PDU is fragmented and this isn't the first fragment */
2188                     if (check_col(pinfo->cinfo, COL_INFO)) {
2189                         col_append_fstr(pinfo->cinfo, COL_INFO,
2190                                         " [DCE/RPC fragment]");
2191                     }
2192                     if (dcerpc_tree) {
2193                         if (length > 0) {
2194                             proto_tree_add_text (dcerpc_tree, tvb, offset, length,
2195                                         "Fragment data (%d byte%s)", length,
2196                                         plurality(length, "", "s"));
2197                         }
2198                     }
2199                 }
2200             } else {
2201                 /* Reassembly is enabled, the PDU is fragmented, and
2202                    we have all the data in the fragment; the first two
2203                    of those mean we should attempt reassembly, and the
2204                    third means we can attempt reassembly. */
2205                 if (dcerpc_tree) {
2206                     if (length > 0) {
2207                         proto_tree_add_text (dcerpc_tree, tvb, offset, length,
2208                                         "Fragment data (%d byte%s)", length,
2209                                         plurality(length, "", "s"));
2210                     }
2211                 }
2212                 if(hdr->flags&PFC_FIRST_FRAG){  /* FIRST fragment */
2213                     if( (!pinfo->fd->flags.visited) && value->rep_frame ){
2214                         fragment_add(tvb, offset, pinfo, value->rep_frame,
2215                              dcerpc_co_reassemble_table,
2216                              0,
2217                              length,
2218                              TRUE);
2219                         fragment_set_tot_len(pinfo, value->rep_frame,
2220                              dcerpc_co_reassemble_table, alloc_hint);
2221                     }
2222                     if (check_col(pinfo->cinfo, COL_INFO)) {
2223                         col_append_fstr(pinfo->cinfo, COL_INFO,
2224                                         " [DCE/RPC fragment]");
2225                     }
2226                 } else if(hdr->flags&PFC_LAST_FRAG){  /* LAST fragment */
2227                     if( value->rep_frame ){
2228                         fragment_data *fd_head;
2229                         guint32 tot_len;
2230
2231                         tot_len = fragment_get_tot_len(pinfo, value->rep_frame,
2232                                        dcerpc_co_reassemble_table);
2233                         fd_head = fragment_add(tvb, offset, pinfo, 
2234                              value->rep_frame,
2235                              dcerpc_co_reassemble_table,
2236                              tot_len-alloc_hint,
2237                              length,
2238                              TRUE);
2239
2240                         if(fd_head){
2241                             /* We completed reassembly */
2242                             tvbuff_t *next_tvb;
2243
2244                             next_tvb = tvb_new_real_data(fd_head->data, fd_head->datalen, fd_head->datalen);
2245                             tvb_set_child_real_data_tvbuff(tvb, next_tvb);
2246                             add_new_data_source(pinfo, next_tvb, "Reassembled DCE/RPC");
2247                             show_fragment_tree(fd_head, &dcerpc_frag_items,
2248                                 dcerpc_tree, pinfo, next_tvb);
2249
2250                             /*
2251                              * XXX - should there be a third routine for each
2252                              * function in an RPC subdissector, to handle
2253                              * fault responses?  The DCE RPC 1.1 spec says
2254                              * three's "stub data" here, which I infer means
2255                              * that it's protocol-specific and call-specific.
2256                              *
2257                              * It should probably get passed the status code
2258                              * as well, as that might be protocol-specific.
2259                              */
2260                             if (dcerpc_tree) {
2261                                 if (length > 0) {
2262                                     proto_tree_add_text (dcerpc_tree, tvb, offset, length,
2263                                                 "Fault stub data (%d byte%s)", length,
2264                                                 plurality(length, "", "s"));
2265                                 }
2266                             }
2267                         } else {
2268                             /* Reassembly not complete - some fragments
2269                                are missing */
2270                             if (check_col(pinfo->cinfo, COL_INFO)) {
2271                                 col_append_fstr(pinfo->cinfo, COL_INFO,
2272                                                 " [DCE/RPC fragment]");
2273                             }
2274                         }
2275                     }
2276                 } else {  /* MIDDLE fragment(s) */
2277                     if( (!pinfo->fd->flags.visited) && value->rep_frame ){
2278                         guint32 tot_len;
2279                         tot_len = fragment_get_tot_len(pinfo, value->rep_frame,
2280                                        dcerpc_co_reassemble_table);
2281                         fragment_add(tvb, offset, pinfo, value->rep_frame,
2282                              dcerpc_co_reassemble_table,
2283                              tot_len-alloc_hint,
2284                              length,
2285                              TRUE);
2286                     }
2287                     if (check_col(pinfo->cinfo, COL_INFO)) {
2288                         col_append_fstr(pinfo->cinfo, COL_INFO,
2289                                         " [DCE/RPC fragment]");
2290                     }
2291                 }
2292             }
2293         }
2294     }
2295 }
2296
2297 /*
2298  * DCERPC dissector for connection oriented calls
2299  */
2300 static int
2301 dissect_dcerpc_cn (tvbuff_t *tvb, int offset, packet_info *pinfo,
2302                    proto_tree *tree, gboolean can_desegment)
2303 {
2304     static char nulls[4] = { 0 };
2305     int start_offset;
2306     int padding = 0;
2307     proto_item *ti = NULL;
2308     proto_item *tf = NULL;
2309     proto_tree *dcerpc_tree = NULL;
2310     proto_tree *cn_flags_tree = NULL;
2311     proto_tree *drep_tree = NULL;
2312     e_dce_cn_common_hdr_t hdr;
2313
2314     /*
2315      * when done over nbt, dcerpc requests are padded with 4 bytes of null
2316      * data for some reason.
2317      *
2318      * XXX - if that's always the case, the right way to do this would
2319      * be to have a "dissect_dcerpc_cn_nb" routine which strips off
2320      * the 4 bytes of null padding, and make that the dissector
2321      * used for "netbios".
2322      */
2323     if (tvb_bytes_exist (tvb, offset, 4) &&
2324         tvb_memeql (tvb, offset, nulls, 4) == 0) {
2325
2326         /*
2327          * Skip the padding.
2328          */
2329         offset += 4;
2330         padding += 4;
2331     }
2332
2333     /*
2334      * Check if this looks like a C/O DCERPC call
2335      */
2336     if (!tvb_bytes_exist (tvb, offset, sizeof (hdr))) {
2337         return -1;
2338     }
2339     start_offset = offset;
2340     hdr.rpc_ver = tvb_get_guint8 (tvb, offset++);
2341     if (hdr.rpc_ver != 5)
2342         return -1;
2343     hdr.rpc_ver_minor = tvb_get_guint8 (tvb, offset++);
2344     if (hdr.rpc_ver_minor != 0 && hdr.rpc_ver_minor != 1)
2345         return -1;
2346     hdr.ptype = tvb_get_guint8 (tvb, offset++);
2347     if (hdr.ptype > 19)
2348         return -1;
2349
2350     if (check_col (pinfo->cinfo, COL_PROTOCOL))
2351         col_set_str (pinfo->cinfo, COL_PROTOCOL, "DCERPC");
2352     if (check_col (pinfo->cinfo, COL_INFO))
2353         col_add_str (pinfo->cinfo, COL_INFO, pckt_vals[hdr.ptype].strptr);
2354
2355     hdr.flags = tvb_get_guint8 (tvb, offset++);
2356     tvb_memcpy (tvb, (guint8 *)hdr.drep, offset, sizeof (hdr.drep));
2357     offset += sizeof (hdr.drep);
2358
2359     hdr.frag_len = dcerpc_tvb_get_ntohs (tvb, offset, hdr.drep);
2360     offset += 2;
2361     hdr.auth_len = dcerpc_tvb_get_ntohs (tvb, offset, hdr.drep);
2362     offset += 2;
2363     hdr.call_id = dcerpc_tvb_get_ntohl (tvb, offset, hdr.drep);
2364     offset += 4;
2365
2366     offset = start_offset;
2367     if (can_desegment && pinfo->can_desegment
2368         && hdr.frag_len > tvb_length_remaining (tvb, offset)) {
2369         pinfo->desegment_offset = offset;
2370         pinfo->desegment_len = hdr.frag_len - tvb_length_remaining (tvb, offset);
2371         return 0;       /* desegmentation required */
2372     }
2373
2374     if (check_col (pinfo->cinfo, COL_INFO))
2375         col_append_fstr (pinfo->cinfo, COL_INFO, ": call_id: %u", hdr.call_id);
2376     if (tree) {
2377         ti = proto_tree_add_item (tree, proto_dcerpc, tvb, offset, hdr.frag_len, FALSE);
2378         if (ti) {
2379             dcerpc_tree = proto_item_add_subtree (ti, ett_dcerpc);
2380         }
2381         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_ver, tvb, offset++, 1, hdr.rpc_ver);
2382         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_ver_minor, tvb, offset++, 1, hdr.rpc_ver_minor);
2383         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_packet_type, tvb, offset++, 1, hdr.ptype);
2384         tf = proto_tree_add_uint (dcerpc_tree, hf_dcerpc_cn_flags, tvb, offset, 1, hdr.flags);
2385         cn_flags_tree = proto_item_add_subtree (tf, ett_dcerpc_cn_flags);
2386         if (cn_flags_tree) {
2387             proto_tree_add_boolean (cn_flags_tree, hf_dcerpc_cn_flags_object, tvb, offset, 1, hdr.flags);
2388             proto_tree_add_boolean (cn_flags_tree, hf_dcerpc_cn_flags_maybe, tvb, offset, 1, hdr.flags);
2389             proto_tree_add_boolean (cn_flags_tree, hf_dcerpc_cn_flags_dne, tvb, offset, 1, hdr.flags);
2390             proto_tree_add_boolean (cn_flags_tree, hf_dcerpc_cn_flags_mpx, tvb, offset, 1, hdr.flags);
2391             proto_tree_add_boolean (cn_flags_tree, hf_dcerpc_cn_flags_reserved, tvb, offset, 1, hdr.flags);
2392             proto_tree_add_boolean (cn_flags_tree, hf_dcerpc_cn_flags_cancel_pending, tvb, offset, 1, hdr.flags);
2393             proto_tree_add_boolean (cn_flags_tree, hf_dcerpc_cn_flags_last_frag, tvb, offset, 1, hdr.flags);
2394             proto_tree_add_boolean (cn_flags_tree, hf_dcerpc_cn_flags_first_frag, tvb, offset, 1, hdr.flags);
2395         }
2396         offset++;
2397
2398         tf = proto_tree_add_bytes (dcerpc_tree, hf_dcerpc_drep, tvb, offset, 4, hdr.drep);
2399         drep_tree = proto_item_add_subtree (tf, ett_dcerpc_drep);
2400         if (drep_tree) {
2401             proto_tree_add_uint(drep_tree, hf_dcerpc_drep_byteorder, tvb, offset, 1, hdr.drep[0] >> 4);
2402             proto_tree_add_uint(drep_tree, hf_dcerpc_drep_character, tvb, offset, 1, hdr.drep[0] & 0x0f);
2403             proto_tree_add_uint(drep_tree, hf_dcerpc_drep_fp, tvb, offset+1, 1, hdr.drep[1]);
2404         }
2405         offset += sizeof (hdr.drep);
2406
2407         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_cn_frag_len, tvb, offset, 2, hdr.frag_len);
2408         offset += 2;
2409
2410         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_cn_auth_len, tvb, offset, 2, hdr.auth_len);
2411         offset += 2;
2412
2413         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_cn_call_id, tvb, offset, 4, hdr.call_id);
2414         offset += 4;
2415     }
2416
2417
2418     /*
2419      * Packet type specific stuff is next.
2420      */
2421     switch (hdr.ptype) {
2422     case PDU_BIND:
2423     case PDU_ALTER:
2424         dissect_dcerpc_cn_bind (tvb, pinfo, dcerpc_tree, &hdr);
2425         break;
2426
2427     case PDU_BIND_ACK:
2428     case PDU_ALTER_ACK:
2429         dissect_dcerpc_cn_bind_ack (tvb, pinfo, dcerpc_tree, &hdr);
2430         break;
2431
2432     case PDU_REQ:
2433         dissect_dcerpc_cn_rqst (tvb, pinfo, dcerpc_tree, tree, &hdr);
2434         break;
2435
2436     case PDU_RESP:
2437         dissect_dcerpc_cn_resp (tvb, pinfo, dcerpc_tree, tree, &hdr);
2438         break;
2439
2440     case PDU_FAULT:
2441         dissect_dcerpc_cn_fault (tvb, pinfo, dcerpc_tree, &hdr);
2442         break;
2443
2444     case PDU_BIND_NAK:
2445         dissect_dcerpc_cn_bind_nak (tvb, pinfo, dcerpc_tree, &hdr);
2446         break;
2447
2448     case PDU_CO_CANCEL:
2449     case PDU_ORPHANED:
2450         /*
2451          * Nothing after the common header other than an authentication
2452          * verifier.
2453          */
2454         dissect_dcerpc_cn_auth (tvb, pinfo, dcerpc_tree, &hdr, NULL);
2455         break;
2456
2457     case PDU_SHUTDOWN:
2458         /*
2459          * Nothing after the common header, not even an authentication
2460          * verifier.
2461          */
2462         break;
2463
2464     default:
2465         /* might as well dissect the auth info */
2466         dissect_dcerpc_cn_auth (tvb, pinfo, dcerpc_tree, &hdr, NULL);
2467         break;
2468     }
2469     return hdr.frag_len + padding;
2470 }
2471
2472 /*
2473  * DCERPC dissector for connection oriented calls over packet-oriented
2474  * transports
2475  */
2476 static gboolean
2477 dissect_dcerpc_cn_pk (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2478 {
2479     /*
2480      * Only one PDU per transport packet, and only one transport
2481      * packet per PDU.
2482      */
2483     if (dissect_dcerpc_cn (tvb, 0, pinfo, tree, FALSE) == -1) {
2484         /*
2485          * It wasn't a DCERPC PDU.
2486          */
2487         return FALSE;
2488     } else {
2489         /*
2490          * It was.
2491          */
2492         return TRUE;
2493     }
2494 }
2495
2496 /*
2497  * DCERPC dissector for connection oriented calls over byte-stream
2498  * transports
2499  */
2500 static gboolean
2501 dissect_dcerpc_cn_bs (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2502 {
2503     int offset = 0;
2504     int pdu_len;
2505     gboolean ret = FALSE;
2506
2507     /*
2508      * There may be multiple PDUs per transport packet; keep
2509      * processing them.
2510      */
2511     while (tvb_reported_length_remaining(tvb, offset) != 0) {
2512         pdu_len = dissect_dcerpc_cn (tvb, offset, pinfo, tree,
2513                                      dcerpc_cn_desegment);
2514         if (pdu_len == -1) {
2515             /*
2516              * Not a DCERPC PDU.
2517              */
2518             break;
2519         }
2520
2521         /*
2522          * Well, we've seen at least one DCERPC PDU.
2523          */
2524         ret = TRUE;
2525
2526         if (pdu_len == 0) {
2527             /*
2528              * Desegmentation required - bail now.
2529              */
2530             break;
2531         }
2532
2533         /*
2534          * Step to the next PDU.
2535          */
2536         offset += pdu_len;
2537     }
2538     return ret;
2539 }
2540
2541 static void
2542 dissect_dcerpc_dg_auth (tvbuff_t *tvb, int offset, proto_tree *dcerpc_tree,
2543                         e_dce_dg_common_hdr_t *hdr, int *auth_level_p)
2544 {
2545     /*
2546      * Initially set "*auth_level_p" to -1 to indicate that we haven't
2547      * yet seen any authentication level information.
2548      */
2549     if (auth_level_p != NULL)
2550         *auth_level_p = -1;
2551
2552     /*
2553      * The authentication information is at the *end* of the PDU; in
2554      * request and response PDUs, the request and response stub data
2555      * come before it.
2556      *
2557      * If the full packet is here, and there's data past the end of the
2558      * packet body, then dissect the auth info.
2559      */
2560     offset += hdr->frag_len;
2561     if (tvb_length_remaining(tvb, offset) > 0)
2562         proto_tree_add_text (dcerpc_tree, tvb, offset, -1, "Auth data");
2563 }
2564
2565 static void
2566 dissect_dcerpc_dg_cancel_ack (tvbuff_t *tvb, int offset, packet_info *pinfo,
2567                               proto_tree *dcerpc_tree,
2568                               e_dce_dg_common_hdr_t *hdr)
2569 {
2570     guint32 version;
2571
2572     offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, 
2573                                     hdr->drep, hf_dcerpc_dg_cancel_vers,
2574                                     &version);
2575
2576     switch (version) {
2577
2578     case 0:
2579         /* The only version we know about */
2580         offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, 
2581                                         hdr->drep, hf_dcerpc_dg_cancel_id,
2582                                         NULL);
2583         offset = dissect_dcerpc_uint8 (tvb, offset, pinfo, dcerpc_tree, 
2584                                        hdr->drep, hf_dcerpc_dg_server_accepting_cancels,
2585                                        NULL);
2586         break;
2587     }
2588 }
2589
2590 static void
2591 dissect_dcerpc_dg_cancel (tvbuff_t *tvb, int offset, packet_info *pinfo,
2592                           proto_tree *dcerpc_tree,
2593                           e_dce_dg_common_hdr_t *hdr)
2594 {
2595     guint32 version;
2596
2597     offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, 
2598                                     hdr->drep, hf_dcerpc_dg_cancel_vers,
2599                                     &version);
2600
2601     switch (version) {
2602
2603     case 0:
2604         /* The only version we know about */
2605         offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, 
2606                                         hdr->drep, hf_dcerpc_dg_cancel_id,
2607                                         NULL);
2608         /* XXX - are NDR booleans 32 bits? */
2609         offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, 
2610                                         hdr->drep, hf_dcerpc_dg_server_accepting_cancels,
2611                                         NULL);
2612         break;
2613     }
2614 }
2615
2616 static void
2617 dissect_dcerpc_dg_fack (tvbuff_t *tvb, int offset, packet_info *pinfo,
2618                         proto_tree *dcerpc_tree,
2619                         e_dce_dg_common_hdr_t *hdr)
2620 {
2621     guint8 version;
2622     guint16 serial_num;
2623     guint16 selack_len;
2624     guint i;
2625
2626     offset = dissect_dcerpc_uint8 (tvb, offset, pinfo, dcerpc_tree, 
2627                                   hdr->drep, hf_dcerpc_dg_fack_vers,
2628                                   &version);
2629     /* padding */
2630     offset++;
2631
2632     switch (version) {
2633
2634     case 0:     /* The only version documented in the DCE RPC 1.1 spec */
2635     case 1:     /* This appears to be the same */
2636         offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, 
2637                                         hdr->drep, hf_dcerpc_dg_fack_window_size,
2638                                         NULL);
2639         offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, 
2640                                         hdr->drep, hf_dcerpc_dg_fack_max_tsdu,
2641                                         NULL);
2642         offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, 
2643                                         hdr->drep, hf_dcerpc_dg_fack_max_frag_size,
2644                                         NULL);
2645         offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, 
2646                                         hdr->drep, hf_dcerpc_dg_fack_serial_num,
2647                                         &serial_num);
2648         if (check_col (pinfo->cinfo, COL_INFO)) {
2649             col_append_fstr (pinfo->cinfo, COL_INFO, " serial_num: %u",
2650                              serial_num);
2651         }
2652         offset = dissect_dcerpc_uint16 (tvb, offset, pinfo, dcerpc_tree, 
2653                                         hdr->drep, hf_dcerpc_dg_fack_selack_len,
2654                                         &selack_len);
2655         for (i = 0; i < selack_len; i++) {
2656             offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, 
2657                                             hdr->drep, hf_dcerpc_dg_fack_selack,
2658                                             NULL);
2659         }
2660
2661         break;
2662     }
2663 }
2664
2665 static void
2666 dissect_dcerpc_dg_reject_fault (tvbuff_t *tvb, int offset, packet_info *pinfo,
2667                         proto_tree *dcerpc_tree,
2668                         e_dce_dg_common_hdr_t *hdr)
2669 {
2670     guint32 status;
2671
2672     offset = dissect_dcerpc_uint32 (tvb, offset, pinfo, dcerpc_tree, 
2673                                     hdr->drep, hf_dcerpc_dg_status,
2674                                     &status);
2675
2676     if (check_col (pinfo->cinfo, COL_INFO)) {
2677         col_append_fstr (pinfo->cinfo, COL_INFO,
2678                       ": status: %s",
2679                       val_to_str(status, reject_status_vals, "Unknown (0x%08x)"));
2680     }
2681 }
2682
2683 static void
2684 dissect_dcerpc_dg_stub (tvbuff_t *tvb, int offset, packet_info *pinfo,
2685                         proto_tree *dcerpc_tree, proto_tree *tree,
2686                         e_dce_dg_common_hdr_t *hdr, dcerpc_info *di)
2687 {
2688     int length, reported_length, stub_length;
2689     gboolean save_fragmented;
2690     fragment_data *fd_head;
2691
2692     if (check_col (pinfo->cinfo, COL_INFO)) {
2693         col_append_fstr (pinfo->cinfo, COL_INFO, " opnum: %u",
2694                          di->call_data->opnum);
2695     }
2696
2697     length = tvb_length_remaining (tvb, offset);
2698     reported_length = tvb_reported_length_remaining (tvb, offset);
2699     stub_length = hdr->frag_len;
2700     if (length > stub_length)
2701         length = stub_length;
2702     if (reported_length > stub_length)
2703         reported_length = stub_length;
2704
2705     save_fragmented = pinfo->fragmented;
2706
2707     /* If we don't have reassembly enabled, or this packet contains
2708        the entire PDU, or if this is a short frame (or a frame
2709        not reassembled at a lower layer) that doesn't include all
2710        the data in the fragment, just call the handoff directly if
2711        this is the first fragment or the PDU isn't fragmented. */
2712     if( (!dcerpc_reassemble) || !(hdr->flags1 & PFCL1_FRAG) ||
2713                 stub_length > length ) {
2714         if(hdr->frag_num == 0) {
2715             /* First fragment, possibly the only fragment */
2716
2717             /*
2718              * XXX - authentication level?
2719              */
2720             pinfo->fragmented = (hdr->flags1 & PFCL1_FRAG);
2721             dcerpc_try_handoff (pinfo, tree, dcerpc_tree, 
2722                                 tvb_new_subset (tvb, offset, length, 
2723                                                 reported_length),
2724                                 0, hdr->drep, di, 0);
2725         } else {
2726             /* PDU is fragmented and this isn't the first fragment */
2727             if (check_col(pinfo->cinfo, COL_INFO)) {
2728                 col_append_fstr(pinfo->cinfo, COL_INFO, " [DCE/RPC fragment]");
2729             }
2730             if (dcerpc_tree) {
2731                 if (length > 0) {
2732                     proto_tree_add_text (dcerpc_tree, tvb, offset, length,
2733                                          "Fragment data (%d byte%s)", length,
2734                                          plurality(length, "", "s"));
2735                 }
2736             }
2737         }
2738     } else {
2739         /* Reassembly is enabled, the PDU is fragmented, and
2740            we have all the data in the fragment; the first two
2741            of those mean we should attempt reassembly, and the
2742            third means we can attempt reassembly. */
2743         if (dcerpc_tree) {
2744             if (length > 0) {
2745                 proto_tree_add_text (dcerpc_tree, tvb, offset, length,
2746                                      "Fragment data (%d byte%s)", length,
2747                                      plurality(length, "", "s"));
2748             }
2749         }
2750
2751         fd_head = fragment_add_seq(tvb, offset, pinfo,
2752                         hdr->seqnum, dcerpc_cl_reassemble_table,
2753                         hdr->frag_num, length, !(hdr->flags1 & PFCL1_LASTFRAG));
2754         if (fd_head != NULL) {
2755             /* We completed reassembly */
2756             tvbuff_t *next_tvb;
2757
2758             next_tvb = tvb_new_real_data(fd_head->data, fd_head->len, fd_head->len);
2759             tvb_set_child_real_data_tvbuff(tvb, next_tvb);
2760             add_new_data_source(pinfo, next_tvb, "Reassembled DCE/RPC");
2761             show_fragment_seq_tree(fd_head, &dcerpc_frag_items,
2762                                    dcerpc_tree, pinfo, next_tvb);
2763
2764             /*
2765              * XXX - authentication level?
2766              */
2767             pinfo->fragmented = FALSE;
2768             dcerpc_try_handoff (pinfo, tree, dcerpc_tree, next_tvb,
2769                                 0, hdr->drep, di, 0);
2770         } else {
2771             /* Reassembly isn't completed yet */
2772             if (check_col(pinfo->cinfo, COL_INFO)) {
2773                 col_append_fstr(pinfo->cinfo, COL_INFO, " [DCE/RPC fragment]");
2774             }
2775         }
2776     }
2777     pinfo->fragmented = save_fragmented;
2778 }
2779
2780 static void
2781 dissect_dcerpc_dg_rqst (tvbuff_t *tvb, int offset, packet_info *pinfo,
2782                         proto_tree *dcerpc_tree, proto_tree *tree,
2783                         e_dce_dg_common_hdr_t *hdr, conversation_t *conv)
2784 {
2785     dcerpc_info di;
2786     dcerpc_call_value *value, v;
2787
2788     if(!(pinfo->fd->flags.visited)){
2789         dcerpc_call_value *call_value;
2790         dcerpc_call_key *call_key;
2791
2792         call_key=g_mem_chunk_alloc (dcerpc_call_key_chunk);
2793         call_key->conv=conv;
2794         call_key->call_id=hdr->seqnum;
2795         call_key->smb_fid=get_smb_fid(pinfo->private_data);
2796
2797         call_value=g_mem_chunk_alloc (dcerpc_call_value_chunk);
2798         call_value->uuid = hdr->if_id;
2799         call_value->ver = hdr->if_ver;
2800         call_value->opnum = hdr->opnum;
2801         call_value->req_frame=pinfo->fd->num;
2802         call_value->rep_frame=0;
2803         call_value->max_ptr=0;
2804         call_value->private_data = NULL;
2805         g_hash_table_insert (dcerpc_calls, call_key, call_value);
2806
2807         g_hash_table_insert (dcerpc_matched, (void *)pinfo->fd->num, call_value);       
2808     }
2809
2810     value=g_hash_table_lookup(dcerpc_matched, (void *)pinfo->fd->num);
2811     if (!value) {
2812         v.uuid = hdr->if_id;
2813         v.ver = hdr->if_ver;
2814         v.opnum = hdr->opnum;
2815         v.req_frame = pinfo->fd->num;
2816         v.rep_frame = 0;
2817         v.max_ptr = 0;
2818         v.private_data=NULL;
2819         value = &v;
2820     }
2821
2822     di.conv = conv;
2823     di.call_id = hdr->seqnum;
2824     di.smb_fid = -1;
2825     di.request = TRUE;
2826     di.call_data = value;
2827
2828     dissect_dcerpc_dg_stub (tvb, offset, pinfo, dcerpc_tree, tree, hdr, &di);
2829 }
2830
2831 static void
2832 dissect_dcerpc_dg_resp (tvbuff_t *tvb, int offset, packet_info *pinfo,
2833                         proto_tree *dcerpc_tree, proto_tree *tree,
2834                         e_dce_dg_common_hdr_t *hdr, conversation_t *conv)
2835 {
2836     dcerpc_info di;
2837     dcerpc_call_value *value, v;
2838
2839     if(!(pinfo->fd->flags.visited)){
2840         dcerpc_call_value *call_value;
2841         dcerpc_call_key call_key;
2842
2843         call_key.conv=conv;
2844         call_key.call_id=hdr->seqnum;
2845         call_key.smb_fid=get_smb_fid(pinfo->private_data);
2846
2847         if((call_value=g_hash_table_lookup(dcerpc_calls, &call_key))){
2848             g_hash_table_insert (dcerpc_matched, (void *)pinfo->fd->num, call_value);
2849             if(call_value->rep_frame==0){
2850                 call_value->rep_frame=pinfo->fd->num;
2851             }
2852         }
2853     }
2854
2855     value=g_hash_table_lookup(dcerpc_matched, (void *)pinfo->fd->num);
2856     if (!value) {
2857         v.uuid = hdr->if_id;
2858         v.ver = hdr->if_ver;
2859         v.opnum = hdr->opnum;
2860         v.req_frame=0;
2861         v.rep_frame=pinfo->fd->num;
2862         v.private_data=NULL;
2863         value = &v;
2864     }
2865
2866     di.conv = conv;
2867     di.call_id = 0; 
2868     di.smb_fid = -1;
2869     di.request = FALSE;
2870     di.call_data = value;
2871
2872     dissect_dcerpc_dg_stub (tvb, offset, pinfo, dcerpc_tree, tree, hdr, &di);
2873 }
2874
2875 /*
2876  * DCERPC dissector for connectionless calls
2877  */
2878 static gboolean
2879 dissect_dcerpc_dg (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2880 {
2881     proto_item *ti = NULL;
2882     proto_item *tf = NULL;
2883     proto_tree *dcerpc_tree = NULL;
2884     proto_tree *dg_flags1_tree = NULL;
2885     proto_tree *dg_flags2_tree = NULL;
2886     proto_tree *drep_tree = NULL;
2887     e_dce_dg_common_hdr_t hdr;
2888     int offset = 0;
2889     conversation_t *conv;
2890
2891     /*
2892      * Check if this looks like a CL DCERPC call.  All dg packets
2893      * have an 80 byte header on them.  Which starts with
2894      * version (4), pkt_type.
2895      */
2896     if (!tvb_bytes_exist (tvb, 0, sizeof (hdr))) {
2897         return FALSE;
2898     }
2899     hdr.rpc_ver = tvb_get_guint8 (tvb, offset++);
2900     if (hdr.rpc_ver != 4)
2901         return FALSE;
2902     hdr.ptype = tvb_get_guint8 (tvb, offset++);
2903     if (hdr.ptype > 19)
2904         return FALSE;
2905
2906     if (check_col (pinfo->cinfo, COL_PROTOCOL))
2907         col_set_str (pinfo->cinfo, COL_PROTOCOL, "DCERPC");
2908     if (check_col (pinfo->cinfo, COL_INFO))
2909         col_add_str (pinfo->cinfo, COL_INFO, pckt_vals[hdr.ptype].strptr);
2910
2911     hdr.flags1 = tvb_get_guint8 (tvb, offset++);
2912     hdr.flags2 = tvb_get_guint8 (tvb, offset++);
2913     tvb_memcpy (tvb, (guint8 *)hdr.drep, offset, sizeof (hdr.drep));
2914     offset += sizeof (hdr.drep);
2915     hdr.serial_hi = tvb_get_guint8 (tvb, offset++);
2916     dcerpc_tvb_get_uuid (tvb, offset, hdr.drep, &hdr.obj_id);
2917     offset += 16;
2918     dcerpc_tvb_get_uuid (tvb, offset, hdr.drep, &hdr.if_id);
2919     offset += 16;
2920     dcerpc_tvb_get_uuid (tvb, offset, hdr.drep, &hdr.act_id);
2921     offset += 16;
2922     hdr.server_boot = dcerpc_tvb_get_ntohl (tvb, offset, hdr.drep);
2923     offset += 4;
2924     hdr.if_ver = dcerpc_tvb_get_ntohl (tvb, offset, hdr.drep);
2925     offset += 4;
2926     hdr.seqnum = dcerpc_tvb_get_ntohl (tvb, offset, hdr.drep);
2927     offset += 4;
2928     hdr.opnum = dcerpc_tvb_get_ntohs (tvb, offset, hdr.drep);
2929     offset += 2;
2930     hdr.ihint = dcerpc_tvb_get_ntohs (tvb, offset, hdr.drep);
2931     offset += 2;
2932     hdr.ahint = dcerpc_tvb_get_ntohs (tvb, offset, hdr.drep);
2933     offset += 2;
2934     hdr.frag_len = dcerpc_tvb_get_ntohs (tvb, offset, hdr.drep);
2935     offset += 2;
2936     hdr.frag_num = dcerpc_tvb_get_ntohs (tvb, offset, hdr.drep);
2937     offset += 2;
2938     hdr.auth_proto = tvb_get_guint8 (tvb, offset++);
2939     hdr.serial_lo = tvb_get_guint8 (tvb, offset++);
2940
2941     if (tree) {
2942         ti = proto_tree_add_item (tree, proto_dcerpc, tvb, 0, -1, FALSE);
2943         if (ti) {
2944             dcerpc_tree = proto_item_add_subtree(ti, ett_dcerpc);
2945         }
2946     }
2947     offset = 0;
2948
2949     if (tree)
2950         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_ver, tvb, offset, 1, hdr.rpc_ver);
2951     offset++;
2952
2953     if (tree)
2954         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_packet_type, tvb, offset, 1, hdr.ptype);
2955     offset++;
2956
2957     if (tree) {
2958         tf = proto_tree_add_uint (dcerpc_tree, hf_dcerpc_dg_flags1, tvb, offset, 1, hdr.flags1);
2959         dg_flags1_tree = proto_item_add_subtree (tf, ett_dcerpc_dg_flags1);
2960         if (dg_flags1_tree) {
2961             proto_tree_add_boolean (dg_flags1_tree, hf_dcerpc_dg_flags1_rsrvd_80, tvb, offset, 1, hdr.flags1);
2962             proto_tree_add_boolean (dg_flags1_tree, hf_dcerpc_dg_flags1_broadcast, tvb, offset, 1, hdr.flags1);
2963             proto_tree_add_boolean (dg_flags1_tree, hf_dcerpc_dg_flags1_idempotent, tvb, offset, 1, hdr.flags1);
2964             proto_tree_add_boolean (dg_flags1_tree, hf_dcerpc_dg_flags1_maybe, tvb, offset, 1, hdr.flags1);
2965             proto_tree_add_boolean (dg_flags1_tree, hf_dcerpc_dg_flags1_nofack, tvb, offset, 1, hdr.flags1);
2966             proto_tree_add_boolean (dg_flags1_tree, hf_dcerpc_dg_flags1_frag, tvb, offset, 1, hdr.flags1);
2967             proto_tree_add_boolean (dg_flags1_tree, hf_dcerpc_dg_flags1_last_frag, tvb, offset, 1, hdr.flags1);
2968             proto_tree_add_boolean (dg_flags1_tree, hf_dcerpc_dg_flags1_rsrvd_01, tvb, offset, 1, hdr.flags1);
2969         }
2970     }
2971     offset++;
2972
2973     if (tree) {
2974         tf = proto_tree_add_uint (dcerpc_tree, hf_dcerpc_dg_flags2, tvb, offset, 1, hdr.flags2);
2975         dg_flags2_tree = proto_item_add_subtree (tf, ett_dcerpc_dg_flags2);
2976         if (dg_flags2_tree) {
2977             proto_tree_add_boolean (dg_flags2_tree, hf_dcerpc_dg_flags2_rsrvd_80, tvb, offset, 1, hdr.flags2);
2978             proto_tree_add_boolean (dg_flags2_tree, hf_dcerpc_dg_flags2_rsrvd_40, tvb, offset, 1, hdr.flags2);
2979             proto_tree_add_boolean (dg_flags2_tree, hf_dcerpc_dg_flags2_rsrvd_20, tvb, offset, 1, hdr.flags2);
2980             proto_tree_add_boolean (dg_flags2_tree, hf_dcerpc_dg_flags2_rsrvd_10, tvb, offset, 1, hdr.flags2);
2981             proto_tree_add_boolean (dg_flags2_tree, hf_dcerpc_dg_flags2_rsrvd_08, tvb, offset, 1, hdr.flags2);
2982             proto_tree_add_boolean (dg_flags2_tree, hf_dcerpc_dg_flags2_rsrvd_04, tvb, offset, 1, hdr.flags2);
2983             proto_tree_add_boolean (dg_flags2_tree, hf_dcerpc_dg_flags2_cancel_pending, tvb, offset, 1, hdr.flags2);
2984             proto_tree_add_boolean (dg_flags2_tree, hf_dcerpc_dg_flags2_rsrvd_01, tvb, offset, 1, hdr.flags2);
2985         }
2986     }
2987     offset++;
2988
2989     if (tree) {
2990         tf = proto_tree_add_bytes (dcerpc_tree, hf_dcerpc_drep, tvb, offset, sizeof (hdr.drep), hdr.drep);
2991         drep_tree = proto_item_add_subtree (tf, ett_dcerpc_drep);
2992         if (drep_tree) {
2993             proto_tree_add_uint(drep_tree, hf_dcerpc_drep_byteorder, tvb, offset, 1, hdr.drep[0] >> 4);
2994             proto_tree_add_uint(drep_tree, hf_dcerpc_drep_character, tvb, offset, 1, hdr.drep[0] & 0x0f);
2995             proto_tree_add_uint(drep_tree, hf_dcerpc_drep_fp, tvb, offset+1, 1, hdr.drep[1]);
2996         }
2997     }
2998     offset += sizeof (hdr.drep);
2999
3000     if (tree)
3001         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_dg_serial_hi, tvb, offset, 1, hdr.serial_hi);
3002     offset++;
3003
3004     if (tree) {
3005         proto_tree_add_string_format (dcerpc_tree, hf_dcerpc_obj_id, tvb,
3006                                       offset, 16, "HMMM",
3007                                       "Object: %08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
3008                                       hdr.obj_id.Data1, hdr.obj_id.Data2, hdr.obj_id.Data3,
3009                                       hdr.obj_id.Data4[0],
3010                                       hdr.obj_id.Data4[1],
3011                                       hdr.obj_id.Data4[2],
3012                                       hdr.obj_id.Data4[3],
3013                                       hdr.obj_id.Data4[4],
3014                                       hdr.obj_id.Data4[5],
3015                                       hdr.obj_id.Data4[6],
3016                                       hdr.obj_id.Data4[7]);
3017     }
3018     offset += 16;
3019
3020     if (tree) {
3021         proto_tree_add_string_format (dcerpc_tree, hf_dcerpc_dg_if_id, tvb,
3022                                       offset, 16, "HMMM",
3023                                       "Interface: %08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
3024                                       hdr.if_id.Data1, hdr.if_id.Data2, hdr.if_id.Data3,
3025                                       hdr.if_id.Data4[0],
3026                                       hdr.if_id.Data4[1],
3027                                       hdr.if_id.Data4[2],
3028                                       hdr.if_id.Data4[3],
3029                                       hdr.if_id.Data4[4],
3030                                       hdr.if_id.Data4[5],
3031                                       hdr.if_id.Data4[6],
3032                                       hdr.if_id.Data4[7]);
3033     }
3034     offset += 16;
3035
3036     if (tree) {
3037         proto_tree_add_string_format (dcerpc_tree, hf_dcerpc_dg_act_id, tvb,
3038                                       offset, 16, "HMMM",
3039                                       "Activity: %08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
3040                                       hdr.act_id.Data1, hdr.act_id.Data2, hdr.act_id.Data3,
3041                                       hdr.act_id.Data4[0],
3042                                       hdr.act_id.Data4[1],
3043                                       hdr.act_id.Data4[2],
3044                                       hdr.act_id.Data4[3],
3045                                       hdr.act_id.Data4[4],
3046                                       hdr.act_id.Data4[5],
3047                                       hdr.act_id.Data4[6],
3048                                       hdr.act_id.Data4[7]);
3049     }
3050     offset += 16;
3051
3052     if (tree)
3053         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_dg_server_boot, tvb, offset, 4, hdr.server_boot);
3054     offset += 4;
3055
3056     if (tree)
3057         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_dg_if_ver, tvb, offset, 4, hdr.if_ver);
3058     offset += 4;
3059
3060     if (tree)
3061         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_dg_seqnum, tvb, offset, 4, hdr.seqnum);
3062     if (check_col (pinfo->cinfo, COL_INFO)) {
3063         col_append_fstr (pinfo->cinfo, COL_INFO, ": seq_num: %u", hdr.seqnum);
3064     }
3065     offset += 4;
3066
3067     if (tree)
3068         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_opnum, tvb, offset, 2, hdr.opnum);
3069     offset += 2;
3070
3071     if (tree)
3072         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_dg_ihint, tvb, offset, 2, hdr.ihint);
3073     offset += 2;
3074
3075     if (tree)
3076         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_dg_ahint, tvb, offset, 2, hdr.ahint);
3077     offset += 2;
3078
3079     if (tree)
3080         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_dg_frag_len, tvb, offset, 2, hdr.frag_len);
3081     offset += 2;
3082
3083     if (tree)
3084         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_dg_frag_num, tvb, offset, 2, hdr.frag_num);
3085     if (check_col (pinfo->cinfo, COL_INFO)) {
3086         if (hdr.flags1 & PFCL1_FRAG) {
3087             /* Fragmented - put the fragment number into the Info column */
3088             col_append_fstr (pinfo->cinfo, COL_INFO, " frag_num: %u",
3089                              hdr.frag_num);
3090         }
3091     }
3092     offset += 2;
3093
3094     if (tree)
3095         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_dg_auth_proto, tvb, offset, 1, hdr.auth_proto);
3096     offset++;
3097
3098     if (tree)
3099         proto_tree_add_uint (dcerpc_tree, hf_dcerpc_dg_serial_lo, tvb, offset, 1, hdr.serial_lo);
3100     if (check_col (pinfo->cinfo, COL_INFO)) {
3101         if (hdr.flags1 & PFCL1_FRAG) {
3102             /* Fragmented - put the serial number into the Info column */
3103             col_append_fstr (pinfo->cinfo, COL_INFO, " serial_num: %u",
3104                              (hdr.serial_hi << 8) | hdr.serial_lo);
3105         }
3106     }
3107     offset++;
3108
3109     if (tree) {
3110         /*
3111          * XXX - for Kerberos, we can get a protection level; if it's
3112          * DCE_C_AUTHN_LEVEL_PKT_PRIVACY, we can't dissect the
3113          * stub data.
3114          */
3115         dissect_dcerpc_dg_auth (tvb, offset, dcerpc_tree, &hdr, NULL);
3116     }
3117
3118     /* 
3119      * keeping track of the conversation shouldn't really be necessary
3120      * for connectionless packets, because everything we need to know
3121      * to dissect is in the header for each packet.  Unfortunately,
3122      * Microsoft's implementation is buggy and often puts the
3123      * completely wrong if_id in the header.  go figure.  So, keep
3124      * track of the seqnum and use that if possible.  Note: that's not
3125      * completely correct.  It should really be done based on both the
3126      * activity_id and seqnum.  I haven't seen anywhere that it would
3127      * make a difference, but for future reference...
3128      */
3129     conv = find_conversation (&pinfo->src, &pinfo->dst, pinfo->ptype,
3130                               pinfo->srcport, pinfo->destport, 0);
3131     if (!conv) {
3132         conv = conversation_new (&pinfo->src, &pinfo->dst, pinfo->ptype,
3133                                  pinfo->srcport, pinfo->destport, 0);
3134     }
3135
3136     /*
3137      * Packet type specific stuff is next.
3138      */
3139
3140     switch (hdr.ptype) {
3141
3142     case PDU_CANCEL_ACK:
3143         /* Body is optional */
3144         /* XXX - we assume "frag_len" is the length of the body */
3145         if (hdr.frag_len != 0)
3146             dissect_dcerpc_dg_cancel_ack (tvb, offset, pinfo, dcerpc_tree, &hdr);
3147         break;
3148
3149     case PDU_CL_CANCEL:
3150         /*
3151          * XXX - The DCE RPC 1.1 spec doesn't say the body is optional,
3152          * but in at least one capture none of the Cl_cancel PDUs had a
3153          * body.
3154          */
3155         /* XXX - we assume "frag_len" is the length of the body */
3156         if (hdr.frag_len != 0)
3157             dissect_dcerpc_dg_cancel (tvb, offset, pinfo, dcerpc_tree, &hdr);
3158         break;
3159
3160     case PDU_NOCALL:
3161         /* Body is optional; if present, it's the same as PDU_FACK */
3162         /* XXX - we assume "frag_len" is the length of the body */
3163         if (hdr.frag_len != 0)
3164             dissect_dcerpc_dg_fack (tvb, offset, pinfo, dcerpc_tree, &hdr);
3165         break;
3166
3167     case PDU_FACK:
3168         dissect_dcerpc_dg_fack (tvb, offset, pinfo, dcerpc_tree, &hdr);
3169         break;
3170
3171     case PDU_REJECT:
3172     case PDU_FAULT:
3173         dissect_dcerpc_dg_reject_fault (tvb, offset, pinfo, dcerpc_tree, &hdr);
3174         break;
3175
3176     case PDU_REQ:
3177         dissect_dcerpc_dg_rqst (tvb, offset, pinfo, dcerpc_tree, tree, &hdr, conv);
3178         break;
3179
3180     case PDU_RESP:
3181         dissect_dcerpc_dg_resp (tvb, offset, pinfo, dcerpc_tree, tree, &hdr, conv);
3182         break;
3183
3184     /* these requests have no body */
3185     case PDU_ACK:
3186     case PDU_PING:
3187     case PDU_WORKING:
3188     default:
3189         break;
3190     }
3191
3192     return TRUE;
3193 }
3194