From Ronnie Sahlberg:
authorguy <guy@f5534014-38df-0310-8fa8-9805f1628bb7>
Fri, 25 Jan 2002 08:35:59 +0000 (08:35 +0000)
committerguy <guy@f5534014-38df-0310-8fa8-9805f1628bb7>
Fri, 25 Jan 2002 08:35:59 +0000 (08:35 +0000)
NDR pointer handling in DCE RPC
SAMR updates

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4608 f5534014-38df-0310-8fa8-9805f1628bb7

AUTHORS
packet-dcerpc-ndr.c
packet-dcerpc-nt.c
packet-dcerpc-nt.h
packet-dcerpc-samr.c
packet-dcerpc.c
packet-dcerpc.h

diff --git a/AUTHORS b/AUTHORS
index 773eee3fd69e07025a1162637b337c00f091b829..93ed33db0b72ae633ef2d419b51923e35f3c3508 100644 (file)
--- a/AUTHORS
+++ b/AUTHORS
@@ -573,6 +573,8 @@ Ronnie Sahlberg <sahlberg[AT]optushome.com.au> {
        File handle to file name resolution in NFS and realted protocols
        In DCE RPC dissector, add support for finding the response that
            matches a request
+       NDR pointer handling in DCE RPC
+       SAMR updates
 }
 
 Borosa Tomislav <tomislav.borosa[AT]SIEMENS.HR> {
index ac95fc10036b6f8b0f41d2ae61bcf2169bf91fd5..6e5dc2d9e1561b0c5e18c3252609ea8aa23902fd 100644 (file)
@@ -2,7 +2,7 @@
  * Routines for DCERPC NDR dissection
  * Copyright 2001, Todd Sabin <tas@webspan.net>
  *
- * $Id: packet-dcerpc-ndr.c,v 1.3 2002/01/21 07:36:33 guy Exp $
+ * $Id: packet-dcerpc-ndr.c,v 1.4 2002/01/25 08:35:59 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -128,4 +128,3 @@ dissect_ndr_ctx_hnd (tvbuff_t *tvb, gint offset, packet_info *pinfo,
     }
     return offset + 20;
 }
-
index 4721930cb054da7b3515fba5bda652e53bb18500..f4aa4396fe1c7a79fcc1ab1fdce046572de5962c 100644 (file)
@@ -2,7 +2,7 @@
  * Routines for DCERPC over SMB packet disassembly
  * Copyright 2001, Tim Potter <tpot@samba.org>
  *
- * $Id: packet-dcerpc-nt.c,v 1.4 2002/01/21 07:36:33 guy Exp $
+ * $Id: packet-dcerpc-nt.c,v 1.5 2002/01/25 08:35:59 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -390,3 +390,161 @@ int prs_policy_hnd(tvbuff_t *tvb, int offset, packet_info *pinfo,
 
        return offset + 20;
 }
+
+
+
+/* functions to dissect a UNICODE_STRING structure, common to many 
+   NT services
+   struct {
+     short len;
+     short size;
+     [size_is(size/2), length_is(len/2), ptr] unsigned short *string;
+   } UNICODE_STRING;
+
+   these variables can be found in packet-dcerpc-samr.c 
+*/
+extern int hf_nt_str_len;
+extern int hf_nt_str_off;
+extern int hf_nt_str_max_len;
+extern int hf_nt_string_length;
+extern int hf_nt_string_size;
+extern gint ett_nt_unicode_string;
+
+static int
+dissect_ndr_nt_UNICODE_STRING_string (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *tree, 
+                             char *drep)
+{
+       guint32 len, off, max_len;
+       guint16 *data16;
+       char *text;
+       int old_offset;
+       dcerpc_info *di;
+       header_field_info *hfi;
+
+       di=pinfo->private_data;
+
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_nt_str_len, &len);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_nt_str_off, &off);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_nt_str_max_len, &max_len);
+
+       old_offset=offset;
+       offset = prs_uint16s(tvb, offset, pinfo, tree, max_len, &data16, NULL);
+       text = fake_unicode(data16, max_len);
+
+       hfi = proto_registrar_get_nth(di->hf_index);
+       proto_tree_add_string_format(tree, di->hf_index, 
+               tvb, old_offset, offset-old_offset,
+               text, "%s: %s", hfi->name, text);
+
+       if(tree){
+               proto_item_set_text(tree, "%s: %s", hfi->name, text);
+               proto_item_set_text(tree->parent, "%s: %s", hfi->name, text);
+       }
+       return offset;
+}
+
+int
+dissect_ndr_nt_UNICODE_STRING (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *parent_tree, 
+                             char *drep, int hf_index)
+{
+       proto_item *item=NULL;
+       proto_tree *tree=NULL;
+       int old_offset=offset;
+
+       if(parent_tree){
+               item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+                       "Unicode String");
+               tree = proto_item_add_subtree(item, ett_nt_unicode_string);
+       }
+
+        offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
+                                     hf_nt_string_length, NULL);
+        offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
+                                     hf_nt_string_size, NULL);
+        offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+                       dissect_ndr_nt_UNICODE_STRING_string, NDR_POINTER_PTR,
+                       hf_index);
+
+       proto_item_set_len(item, offset-old_offset);
+       return offset;
+}
+
+/* functions to dissect a STRING structure, common to many 
+   NT services
+   struct {
+     short len;
+     short size;
+     [size_is(size), length_is(len), ptr] char *string;
+   } STRING;
+*/
+
+static int
+dissect_ndr_nt_STRING_string (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *tree, 
+                             char *drep)
+{
+       guint32 len, off, max_len;
+       guint8 *text;
+       int old_offset;
+       dcerpc_info *di;
+       header_field_info *hfi;
+
+       di=pinfo->private_data;
+
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_nt_str_len, &len);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_nt_str_off, &off);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_nt_str_max_len, &max_len);
+
+       old_offset=offset;
+       offset = prs_uint8s(tvb, offset, pinfo, tree, max_len, &text, NULL);
+
+       hfi = proto_registrar_get_nth(di->hf_index);
+       proto_tree_add_string_format(tree, di->hf_index, 
+               tvb, old_offset, offset-old_offset,
+               text, "%s: %s", hfi->name, text);
+
+       if(tree){
+               proto_item_set_text(tree, "%s: %s", hfi->name, text);
+               proto_item_set_text(tree->parent, "%s: %s", hfi->name, text);
+       }
+       return offset;
+}
+
+int
+dissect_ndr_nt_STRING (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *parent_tree, 
+                             char *drep, int hf_index)
+{
+       proto_item *item=NULL;
+       proto_tree *tree=NULL;
+       int old_offset=offset;
+
+       if(parent_tree){
+               item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+                       "Unicode String");
+               tree = proto_item_add_subtree(item, ett_nt_unicode_string);
+       }
+
+        offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
+                                     hf_nt_string_length, NULL);
+        offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
+                                     hf_nt_string_size, NULL);
+        offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+                       dissect_ndr_nt_STRING_string, NDR_POINTER_PTR,
+                       hf_index);
+
+       proto_item_set_len(item, offset-old_offset);
+       return offset;
+}
+
+
+
+
index 0eefb97e137acdd07321ce6ce41bd8f396cb6624..48300f0612b4877a29cd0b78a899ddabf0c16f7e 100644 (file)
@@ -2,7 +2,7 @@
  * Routines for DCERPC over SMB packet disassembly
  * Copyright 2001, Tim Potter <tpot@samba.org>
  *
- * $Id: packet-dcerpc-nt.h,v 1.2 2002/01/03 20:42:40 guy Exp $
+ * $Id: packet-dcerpc-nt.h,v 1.3 2002/01/25 08:35:59 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -73,4 +73,11 @@ int prs_push_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo,
 
 guint32 prs_pop_ptr(GList **ptr_list, char *name);
 
+int dissect_ndr_nt_UNICODE_STRING (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *parent_tree, 
+                                  char *drep, int hf_index);
+int dissect_ndr_nt_STRING (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *parent_tree, 
+                                  char *drep, int hf_index);
+
 #endif /* packet-dcerpc-nt.h */
index 550004b3bdfb3443d9e90722d34db55fa8e28f41..674a1cdb903557ff9de346653451273cc775371d 100644 (file)
@@ -2,7 +2,7 @@
  * Routines for SMB \\PIPE\\samr packet disassembly
  * Copyright 2001, Tim Potter <tpot@samba.org>
  *
- * $Id: packet-dcerpc-samr.c,v 1.3 2002/01/21 07:36:33 guy Exp $
+ * $Id: packet-dcerpc-samr.c,v 1.4 2002/01/25 08:35:59 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -30,6 +30,7 @@
 #include <glib.h>
 #include <epan/packet.h>
 #include "packet-dcerpc.h"
+#include "packet-dcerpc-nt.h"
 #include "packet-dcerpc-samr.h"
 #include "smb.h"       /* for "NT_errors[]" */
 
@@ -39,8 +40,31 @@ static int hf_samr_hnd = -1;
 static int hf_samr_perms = -1;
 static int hf_samr_rid = -1;
 static int hf_samr_rc = -1;
+static int hf_samr_index = -1;
+static int hf_samr_acct_ctrl = -1;
+static int hf_samr_array_max_count = -1;
+
+static int hf_samr_level = -1;
+static int hf_samr_start_idx = -1;
+static int hf_samr_max_entries = -1;
+static int hf_samr_pref_maxsize = -1;
+static int hf_samr_total_size = -1;
+static int hf_samr_ret_size = -1;
+static int hf_samr_acct_name = -1;
+static int hf_samr_full_name = -1;
+static int hf_samr_acct_desc = -1;
+
+/* these are used by functions in packet-dcerpc-nt.c */
+int hf_nt_str_len = -1;
+int hf_nt_str_off = -1;
+int hf_nt_str_max_len = -1;
+int hf_nt_string_length = -1;
+int hf_nt_string_size = -1;
+
 
 static gint ett_dcerpc_samr = -1;
+gint ett_nt_unicode_string = -1;       /* used by packet-dcerpc-nt.c*/
+static gint ett_samr_user_dispinfo_1 = -1;
 
 static e_uuid_t uuid_dcerpc_samr = {
         0x12345778, 0x1234, 0xabcd, 
@@ -86,6 +110,402 @@ samr_dissect_open_user_rqst (tvbuff_t *tvb, int offset,
 }
 
 
+static int
+samr_dissect_query_dispinfo_level (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *tree, 
+                             char *drep)
+{
+        offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_level, NULL);
+
+       return offset;
+}
+
+static int
+samr_dissect_query_dispinfo_rqst (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *tree, 
+                             char *drep)
+{
+        offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
+                                      hf_samr_hnd, NULL);
+        offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+                       samr_dissect_query_dispinfo_level, NDR_POINTER_REF,
+                       -1);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_start_idx, NULL);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_max_entries, NULL);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_pref_maxsize, NULL);
+        return offset;
+}
+
+static int
+samr_dissect_USER_DISPINFO_1 (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *parent_tree, 
+                             char *drep)
+{
+       proto_item *item=NULL;
+       proto_tree *tree=NULL;
+       int old_offset=offset;
+
+       if(parent_tree){
+               item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+                       "User_DispInfo_1");
+               tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
+       }
+
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_index, NULL);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_rid, NULL);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_acct_ctrl, NULL);
+       offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+                       hf_samr_acct_name);
+       offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+                       hf_samr_full_name);
+       offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+                       hf_samr_acct_desc);
+
+       proto_item_set_len(item, offset-old_offset);
+       return offset;
+}
+
+static int
+samr_dissect_USER_DISPINFO_1_ARRAY_users (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *tree, 
+                             char *drep)
+{
+       offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+                       samr_dissect_USER_DISPINFO_1);
+
+       return offset;
+}
+
+static int
+samr_dissect_USER_DISPINFO_1_ARRAY (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *parent_tree, 
+                             char *drep)
+{
+       guint32 count;
+       proto_item *item=NULL;
+       proto_tree *tree=NULL;
+       int old_offset=offset;
+
+       if(parent_tree){
+               item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+                       "User_DispInfo_1 Array");
+               tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
+       }
+
+
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_array_max_count, &count);
+        offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+                       samr_dissect_USER_DISPINFO_1_ARRAY_users, NDR_POINTER_PTR,
+                       -1);
+
+       proto_item_set_len(item, offset-old_offset);
+       return offset;
+}
+
+
+
+static int
+samr_dissect_USER_DISPINFO_2 (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *parent_tree, 
+                             char *drep)
+{
+       proto_item *item=NULL;
+       proto_tree *tree=NULL;
+       int old_offset=offset;
+
+       if(parent_tree){
+               item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+                       "User_DispInfo_2");
+               tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
+       }
+
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_index, NULL);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_rid, NULL);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_acct_ctrl, NULL);
+       offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+                       hf_samr_acct_name);
+       offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+                       hf_samr_acct_desc);
+
+       proto_item_set_len(item, offset-old_offset);
+       return offset;
+}
+
+static int
+samr_dissect_USER_DISPINFO_2_ARRAY_users (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *tree, 
+                             char *drep)
+{
+       offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+                       samr_dissect_USER_DISPINFO_2);
+
+       return offset;
+}
+
+static int
+samr_dissect_USER_DISPINFO_2_ARRAY (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *parent_tree, 
+                             char *drep)
+{
+       guint32 count;
+       proto_item *item=NULL;
+       proto_tree *tree=NULL;
+       int old_offset=offset;
+
+       if(parent_tree){
+               item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+                       "User_DispInfo_2 Array");
+               tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
+       }
+
+
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_array_max_count, &count);
+        offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+                       samr_dissect_USER_DISPINFO_2_ARRAY_users, NDR_POINTER_PTR,
+                       -1);
+
+       proto_item_set_len(item, offset-old_offset);
+       return offset;
+}
+
+
+
+
+
+static int
+samr_dissect_GROUP_DISPINFO (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *parent_tree, 
+                             char *drep)
+{
+       proto_item *item=NULL;
+       proto_tree *tree=NULL;
+       int old_offset=offset;
+
+       if(parent_tree){
+               item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+                       "Group_DispInfo");
+               tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
+       }
+
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_index, NULL);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_rid, NULL);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_acct_ctrl, NULL);
+       offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+                       hf_samr_acct_name);
+       offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+                       hf_samr_acct_desc);
+
+       proto_item_set_len(item, offset-old_offset);
+       return offset;
+}
+
+static int
+samr_dissect_GROUP_DISPINFO_ARRAY_groups (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *tree, 
+                             char *drep)
+{
+       offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+                       samr_dissect_GROUP_DISPINFO);
+
+       return offset;
+}
+
+static int
+samr_dissect_GROUP_DISPINFO_ARRAY (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *parent_tree, 
+                             char *drep)
+{
+       guint32 count;
+       proto_item *item=NULL;
+       proto_tree *tree=NULL;
+       int old_offset=offset;
+
+       if(parent_tree){
+               item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+                       "Group_DispInfo Array");
+               tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
+       }
+
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_array_max_count, &count);
+        offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+                       samr_dissect_GROUP_DISPINFO_ARRAY_groups, NDR_POINTER_PTR,
+                       -1);
+
+       proto_item_set_len(item, offset-old_offset);
+       return offset;
+}
+
+
+
+static int
+samr_dissect_ASCII_DISPINFO (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *parent_tree, 
+                             char *drep)
+{
+       proto_item *item=NULL;
+       proto_tree *tree=NULL;
+       int old_offset=offset;
+
+       if(parent_tree){
+               item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+                       "Ascii_DispInfo");
+               tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
+       }
+
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_index, NULL);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_rid, NULL);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_acct_ctrl, NULL);
+       offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
+                       hf_samr_acct_name);
+       offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
+                       hf_samr_acct_desc);
+
+       proto_item_set_len(item, offset-old_offset);
+       return offset;
+}
+
+static int
+samr_dissect_ASCII_DISPINFO_ARRAY_users (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *tree, 
+                             char *drep)
+{
+       offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+                       samr_dissect_ASCII_DISPINFO);
+
+       return offset;
+}
+
+static int
+samr_dissect_ASCII_DISPINFO_ARRAY (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *parent_tree,
+                             char *drep)
+{
+       guint32 count;
+       proto_item *item=NULL;
+       proto_tree *tree=NULL;
+       int old_offset=offset;
+
+       if(parent_tree){
+               item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+                       "Ascii_DispInfo Array");
+               tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
+       }
+
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_array_max_count, &count);
+        offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+                       samr_dissect_ASCII_DISPINFO_ARRAY_users, NDR_POINTER_PTR,
+                       -1);
+
+       proto_item_set_len(item, offset-old_offset);
+       return offset;
+}
+
+
+static int
+samr_dissect_DISPLAY_INFO (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *parent_tree,
+                             char *drep)
+{
+       proto_item *item=NULL;
+       proto_tree *tree=NULL;
+       int old_offset=offset;
+       guint16 level;
+
+       if(parent_tree){
+               item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+                       "DispInfo");
+               tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
+       }
+
+        offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_level, &level);
+       switch(level){
+       case 1: 
+               offset = samr_dissect_USER_DISPINFO_1_ARRAY(
+                               tvb, offset, pinfo, tree, drep);
+               break;
+       case 2: 
+               offset = samr_dissect_USER_DISPINFO_2_ARRAY(
+                               tvb, offset, pinfo, tree, drep);
+               break;
+       case 3: 
+               offset = samr_dissect_GROUP_DISPINFO_ARRAY(
+                               tvb, offset, pinfo, tree, drep);
+               break;
+       case 4: 
+               offset = samr_dissect_ASCII_DISPINFO_ARRAY(
+                               tvb, offset, pinfo, tree, drep);
+               break;
+       case 5: 
+               offset = samr_dissect_ASCII_DISPINFO_ARRAY(
+                               tvb, offset, pinfo, tree, drep);
+               break;
+       }
+
+       proto_item_set_len(item, offset-old_offset);
+       return offset;
+}
+
+static int
+samr_dissect_query_dispinfo_total_size (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *tree, 
+                             char *drep)
+{
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_total_size, NULL);
+       return offset;
+}
+static int
+samr_dissect_query_dispinfo_ret_size (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *tree, 
+                             char *drep)
+{
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_ret_size, NULL);
+       return offset;
+}
+
+static int
+samr_dissect_query_dispinfo_reply (tvbuff_t *tvb, int offset, 
+                             packet_info *pinfo, proto_tree *tree, 
+                             char *drep)
+{
+        offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+                       samr_dissect_query_dispinfo_total_size, NDR_POINTER_REF,
+                       -1);
+        offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+                       samr_dissect_query_dispinfo_ret_size, NDR_POINTER_REF,
+                       -1);
+        offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+                       samr_dissect_DISPLAY_INFO, NDR_POINTER_REF,
+                       -1);
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_samr_rc, NULL);
+
+       return offset;
+}
+
+
 static dcerpc_sub_dissector dcerpc_samr_dissectors[] = {
         { SAMR_CONNECT_ANON, "SAMR_CONNECT_ANON", NULL, samr_dissect_gen_open_reply },
         { SAMR_CLOSE_HND, "SAMR_CLOSE_HND", samr_dissect_close_hnd_rqst, samr_dissect_gen_open_reply },
@@ -124,7 +544,7 @@ static dcerpc_sub_dissector dcerpc_samr_dissectors[] = {
         { SAMR_QUERY_USERINFO, "SAMR_QUERY_USERINFO", NULL, NULL },
         { SAMR_SET_USERINFO2, "SAMR_SET_USERINFO2", NULL, NULL },
         { SAMR_QUERY_USERGROUPS, "SAMR_QUERY_USERGROUPS", NULL, NULL },
-        { SAMR_QUERY_DISPINFO, "SAMR_QUERY_DISPINFO", NULL, NULL },
+        { SAMR_QUERY_DISPINFO, "SAMR_QUERY_DISPINFO", samr_dissect_query_dispinfo_rqst, samr_dissect_query_dispinfo_reply },
         { SAMR_UNKNOWN_29, "SAMR_UNKNOWN_29", NULL, NULL },
         { SAMR_UNKNOWN_2a, "SAMR_UNKNOWN_2a", NULL, NULL },
         { SAMR_UNKNOWN_2b, "SAMR_UNKNOWN_2b", NULL, NULL },
@@ -159,9 +579,80 @@ proto_register_dcerpc_samr(void)
                   { "Rid", "samr.rid", FT_UINT32, BASE_HEX, NULL, 0x0, "", HFILL }},
                 { &hf_samr_rc,
                   { "Return code", "samr.rc", FT_UINT32, BASE_HEX, VALS (NT_errors), 0x0, "", HFILL }},
+
+       { &hf_samr_level,
+               { "Level", "samr.level", FT_UINT16, BASE_DEC, 
+               NULL, 0x0, "Level requested/returned for Information", HFILL }},
+       { &hf_samr_start_idx,
+               { "Start Idx", "samr.start_idx", FT_UINT32, BASE_DEC, 
+               NULL, 0x0, "Start Index for returned Information", HFILL }},
+
+       { &hf_samr_max_entries,
+               { "Max Entries", "samr.max_entries", FT_UINT32, BASE_DEC, 
+               NULL, 0x0, "Maximum number of entries to return", HFILL }},
+
+       { &hf_samr_pref_maxsize,
+               { "Pref MaxSize", "samr.pref_maxsize", FT_UINT32, BASE_DEC, 
+               NULL, 0x0, "Maximum Size of data to return", HFILL }},
+
+       { &hf_samr_total_size,
+               { "Total Size", "samr.total_size", FT_UINT32, BASE_DEC, 
+               NULL, 0x0, "Total size of data", HFILL }},
+
+       { &hf_samr_ret_size,
+               { "Returned Size", "samr.ret_size", FT_UINT32, BASE_DEC, 
+               NULL, 0x0, "Number of returned objects in this PDU", HFILL }},
+
+       { &hf_samr_index,
+               { "Index", "samr.index", FT_UINT32, BASE_DEC, 
+               NULL, 0x0, "Index", HFILL }},
+
+       { &hf_samr_acct_ctrl,
+               { "Acct Ctrl", "samr.acct_ctrl", FT_UINT32, BASE_DEC, 
+               NULL, 0x0, "Acct CTRL", HFILL }},
+
+        { &hf_samr_array_max_count,
+          { "Max Count", "samr.array.max_count", FT_UINT32, BASE_DEC, NULL, 0x0, "Maximum Count: Number of elements in the array", HFILL }},
+
+       { &hf_samr_acct_name,
+               { "Account Name", "samr.acct_name", FT_STRING, BASE_NONE,
+               NULL, 0, "Name of Account", HFILL }},
+
+       { &hf_samr_full_name,
+               { "Full Name", "samr.full_name", FT_STRING, BASE_NONE,
+               NULL, 0, "Full Name of Account", HFILL }},
+
+       { &hf_samr_acct_desc,
+               { "Account Desc", "samr.acct_desc", FT_STRING, BASE_NONE,
+               NULL, 0, "Account Description", HFILL }},
+
+
+
+       /* these are used by packet-dcerpc-nt.c */
+       { &hf_nt_string_length,
+               { "Length", "nt.string.length", FT_UINT16, BASE_DEC, 
+               NULL, 0x0, "Length of string in bytes", HFILL }},
+
+       { &hf_nt_string_size,
+               { "Size", "nt.string.size", FT_UINT16, BASE_DEC, 
+               NULL, 0x0, "Size of string in bytes", HFILL }},
+
+       { &hf_nt_str_len,
+               { "Length", "nt.str.len", FT_UINT32, BASE_DEC, 
+               NULL, 0x0, "Length of string in short integers", HFILL }},
+
+       { &hf_nt_str_off,
+               { "Offset", "nt.str.offset", FT_UINT32, BASE_DEC, 
+               NULL, 0x0, "Offset into string in short integers", HFILL }},
+
+       { &hf_nt_str_max_len,
+               { "Max Length", "nt.str.max_len", FT_UINT32, BASE_DEC, 
+               NULL, 0x0, "Max Length of string in short integers", HFILL }},
         };
         static gint *ett[] = {
                 &ett_dcerpc_samr,
+                &ett_nt_unicode_string,
+               &ett_samr_user_dispinfo_1,
         };
 
         proto_dcerpc_samr = proto_register_protocol(
index 9ca8fec673079f16c9ee12256b51fb909a49d665..0b53fb99ace499b5b4cb729c0cabcfea0b0b3fff 100644 (file)
@@ -2,7 +2,7 @@
  * Routines for DCERPC packet disassembly
  * Copyright 2001, Todd Sabin <tas@webspan.net>
  *
- * $Id: packet-dcerpc.c,v 1.26 2002/01/24 09:20:47 guy Exp $
+ * $Id: packet-dcerpc.c,v 1.27 2002/01/25 08:35:59 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -169,12 +169,14 @@ static int hf_dcerpc_opnum = -1;
 static int hf_dcerpc_dg_seqnum = -1;
 static int hf_dcerpc_dg_server_boot = -1;
 static int hf_dcerpc_dg_if_ver = -1;
+static int hf_dcerpc_array_max_count = -1;
 
 static gint ett_dcerpc = -1;
 static gint ett_dcerpc_cn_flags = -1;
 static gint ett_dcerpc_drep = -1;
 static gint ett_dcerpc_dg_flags1 = -1;
 static gint ett_dcerpc_dg_flags2 = -1;
+static gint ett_dcerpc_pointer_data = -1;
 
 /* try to desegment big DCE/RPC packets over TCP? */
 static gboolean dcerpc_cn_desegment = TRUE;
@@ -422,6 +424,287 @@ dcerpc_tvb_get_uuid (tvbuff_t *tvb, gint offset, char *drep, e_uuid_t *uuid)
     }
 }
 
+
+/* NDR arrays */
+/* function to dissect a unidimensional conformant array */
+int 
+dissect_ndr_ucarray(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                        proto_tree *tree, char *drep, 
+                        dcerpc_dissect_fnct_t *fnct)
+{
+       guint32 i, count;
+
+        offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+                                     hf_dcerpc_array_max_count, &count);
+       for(i=0;i<count;i++){
+               offset = (*fnct)(tvb, offset, pinfo, tree, drep);
+       }
+
+       return offset;
+}
+
+
+/* ndr pointer handling */
+/* list of pointers encountered so far */
+static GSList *ndr_pointer_list = NULL;
+
+/* position where in the list to insert newly encountered pointers */
+static int ndr_pointer_list_pos=0;
+
+/* boolean controlling whether pointers are top-level or embedded */
+static gboolean pointers_are_top_level = TRUE;
+
+/* as a kludge, we represent all embedded reference pointers as id==-1
+   hoping that his will not collide with any non-ref pointers */
+typedef struct ndr_pointer_data {
+       guint32 id;
+       proto_tree *tree;
+       dcerpc_dissect_fnct_t *fnct; /*if non-NULL, we have not called it yet*/
+       int hf_index;
+} ndr_pointer_data_t;
+
+static void
+init_ndr_pointer_list(void)
+{
+       while(ndr_pointer_list){
+               ndr_pointer_data_t *npd;
+       
+               npd=g_slist_nth_data(ndr_pointer_list, 0);
+               ndr_pointer_list=g_slist_remove(ndr_pointer_list, npd);
+               if(npd){
+                       g_free(npd);
+               }
+       }
+
+       ndr_pointer_list=NULL;
+       ndr_pointer_list_pos=0;
+       pointers_are_top_level=TRUE;
+}
+
+static int
+dissect_deferred_pointers(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset, char *drep)
+{
+       int found_new_pointer;
+       dcerpc_info *di;
+
+       di=pinfo->private_data;
+       do{
+               int i, len;
+
+               found_new_pointer=0;
+               len=g_slist_length(ndr_pointer_list);
+               for(i=0;i<len;i++){
+                       ndr_pointer_data_t *tnpd;
+                       tnpd=g_slist_nth_data(ndr_pointer_list, i);
+                       if(tnpd->fnct){
+                               dcerpc_dissect_fnct_t *fnct;
+
+                               found_new_pointer=1;
+                               fnct=tnpd->fnct;
+                               tnpd->fnct=NULL;
+                               ndr_pointer_list_pos=i+1;
+                               di->hf_index=tnpd->hf_index;
+                               offset = (*(fnct))(tvb, offset, pinfo, tnpd->tree, drep);
+                               break;
+                       }
+               }
+       } while(found_new_pointer);
+
+       return offset;
+}
+                                               
+
+static void
+add_pointer_to_list(packet_info *pinfo, proto_tree *tree, 
+               dcerpc_dissect_fnct_t *fnct, guint32 id, int hf_index)
+{
+       ndr_pointer_data_t *npd;
+
+       /* check if this pointer is valid */
+       if(id!=0xffffffff){
+               dcerpc_info *di;
+               dcerpc_call_value *value;
+
+               di=pinfo->private_data;
+               value=di->call_data;
+
+               if(di->request){
+                       if(id>value->max_ptr){
+                               value->max_ptr=id;
+                       }
+               } else {
+                       /* if we havent seen the request bail out since we cant
+                          know whether this is the first non-NULL instance 
+                          or not */
+                       if(value->req_frame==-1){
+                               /* XXX THROW EXCEPTION */
+                       }
+
+                       /* We saw this one in the request frame, nothing to
+                          dissect later */
+                       if(id<=value->max_ptr){
+                               return;
+                       }
+               }
+       }
+
+       npd=g_malloc(sizeof(ndr_pointer_data_t));
+       npd->id=id;
+       npd->tree=tree;
+       npd->fnct=fnct;
+       npd->hf_index=hf_index;
+       ndr_pointer_list = g_slist_insert(ndr_pointer_list, npd, 
+                                       ndr_pointer_list_pos);
+       ndr_pointer_list_pos++;
+}
+
+
+static int
+find_pointer_index(guint32 id)
+{
+       ndr_pointer_data_t *npd;
+       int i,len;
+       
+       len=g_slist_length(ndr_pointer_list);
+       for(i=0;i<len;i++){
+               npd=g_slist_nth_data(ndr_pointer_list, i);
+               if(npd){
+                       if(npd->id==id){
+                               return i;
+                       }
+               }
+       }
+       
+       return -1;
+}
+
+int 
+dissect_ndr_pointer(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                        proto_tree *tree, char *drep, 
+                        dcerpc_dissect_fnct_t *fnct, int type, int hf_index)
+{
+
+       /*TOP LEVEL REFERENCE POINTER*/
+       if( pointers_are_top_level
+       && (type==NDR_POINTER_REF) ){
+               add_pointer_to_list(pinfo, tree, fnct, 0xffffffff, hf_index);
+               goto after_ref_id;
+       }
+
+       /*TOP LEVEL FULL POINTER*/
+       /*TOP LEVEL UNIQUE POINTER*/
+       if( pointers_are_top_level
+       && ((type==NDR_POINTER_PTR)||(type==NDR_POINTER_UNIQUE)) ){
+               int idx;
+               guint32 id;
+               proto_item *item;
+               proto_tree *tr;
+
+               /* get the referent id */
+               dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id);
+       
+               /* we got a NULL pointer */
+               if(id==0){
+                       proto_tree_add_text(tree, tvb, offset, 4,
+                               "NULL pointer");
+                       offset+=4;
+                       goto after_ref_id;
+               }
+
+               /* see if we have seen this pointer before */
+               idx=find_pointer_index(id);
+
+               /* we have seen this pointer before */
+               if(idx>=0){
+                       proto_tree_add_text(tree, tvb, offset, 4,
+                               "Referent ID:0x%08x",id);
+                       offset+=4;
+                       goto after_ref_id;
+               }
+
+               /* new pointer */
+               item=proto_tree_add_text(tree, tvb, offset, 4, 
+                       "Referent ID:0x%08x", id);
+               offset+=4;
+               tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data);
+               add_pointer_to_list(pinfo, tr, fnct, id, hf_index);
+               goto after_ref_id;
+       }
+
+       /*EMBEDDED REFERENCE POINTER*/
+       if( (!pointers_are_top_level)
+       && (type==NDR_POINTER_REF) ){
+               guint32 id;
+               proto_item *item;
+               proto_tree *tr;
+
+               /* get the referent id */
+               dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id);
+       
+               /* new pointer */
+               item=proto_tree_add_text(tree, tvb, offset, 4, 
+                       "Referent ID:0x%08x", id);
+               offset+=4;
+               tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data);
+               add_pointer_to_list(pinfo, tr, fnct, 0xffffffff, hf_index);
+               goto after_ref_id;
+       }
+
+       /*EMBEDDED FULL POINTER*/
+       /*EMBEDDED UNIQUE POINTER*/
+       if( (!pointers_are_top_level)
+       && ((type==NDR_POINTER_PTR)||(type==NDR_POINTER_UNIQUE)) ){
+               int idx;
+               guint32 id;
+               proto_item *item;
+               proto_tree *tr;
+
+               /* get the referent id */
+               dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep, -1, &id);
+       
+               /* we got a NULL pointer */
+               if(id==0){
+                       proto_tree_add_text(tree, tvb, offset, 4,
+                               "NULL pointer");
+                       offset+=4;
+                       goto after_ref_id;
+               }
+
+               /* see if we have seen this pointer before */
+               idx=find_pointer_index(id);
+
+               /* we have seen this pointer before */
+               if(idx>=0){
+                       proto_tree_add_text(tree, tvb, offset, 4,
+                               "Referent ID:0x%08x",id);
+                       offset+=4;
+                       goto after_ref_id;
+               }
+
+               /* new pointer */
+               item=proto_tree_add_text(tree, tvb, offset, 4, 
+                       "Referent ID:0x%08x", id);
+               offset+=4;
+               tr=proto_item_add_subtree(item,ett_dcerpc_pointer_data);
+               add_pointer_to_list(pinfo, tr, fnct, id, hf_index);
+               goto after_ref_id;
+       }
+
+
+after_ref_id:
+       /* After each top level pointer we have dissected we have to
+          dissect all deferrals before we move on to the next top level
+          argument */
+       if(pointers_are_top_level==TRUE){
+
+               pointers_are_top_level=FALSE;
+               offset = dissect_deferred_pointers(pinfo, tree, tvb, offset, drep);
+               pointers_are_top_level=TRUE;
+       }
+
+       return offset;
+}
+
 static int
 dcerpc_try_handoff (packet_info *pinfo, proto_tree *tree,
                     proto_tree *dcerpc_tree,
@@ -494,7 +777,8 @@ dcerpc_try_handoff (packet_info *pinfo, proto_tree *tree,
         pinfo->current_proto = sub_proto->name;
        pinfo->private_data = (void *)info;
 
-        sub_dissect (tvb, offset, pinfo, sub_tree, drep);
+       init_ndr_pointer_list();
+        offset = sub_dissect (tvb, offset, pinfo, sub_tree, drep);
 
         pinfo->current_proto = saved_proto;
        pinfo->private_data = saved_private_data;
@@ -890,6 +1174,7 @@ dissect_dcerpc_cn_rqst (tvbuff_t *tvb, packet_info *pinfo, proto_tree *dcerpc_tr
                        call_value->opnum = opnum;
                        call_value->req_frame=pinfo->fd->num;
                        call_value->rep_frame=-1;
+                       call_value->max_ptr=0;
                        call_value->private_data = NULL;
                        g_hash_table_insert (dcerpc_calls, call_key, call_value);
 
@@ -913,6 +1198,7 @@ dissect_dcerpc_cn_rqst (tvbuff_t *tvb, packet_info *pinfo, proto_tree *dcerpc_tr
            di.conv = conv;
            di.call_id = hdr->call_id;
            di.smb_fid = get_smb_fid(pinfo->private_data);
+           di.request = TRUE;
            di.call_data = value;
 
            if(value->rep_frame!=-1){
@@ -1001,6 +1287,7 @@ dissect_dcerpc_cn_resp (tvbuff_t *tvb, packet_info *pinfo, proto_tree *dcerpc_tr
            di.conv = conv;
            di.call_id = hdr->call_id;
            di.smb_fid = get_smb_fid(pinfo->private_data);
+           di.request = FALSE;
            di.call_data = value;
 
            if(value->req_frame!=-1){
@@ -1464,6 +1751,7 @@ dissect_dcerpc_dg (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
                call_value->opnum = hdr.opnum;
                call_value->req_frame=pinfo->fd->num;
                call_value->rep_frame=-1;
+               call_value->max_ptr=0;
                call_value->private_data = NULL;
                g_hash_table_insert (dcerpc_calls, call_key, call_value);
 
@@ -1475,6 +1763,7 @@ dissect_dcerpc_dg (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
        di.conv = conv;
        di.call_id = hdr.seqnum;
        di.smb_fid = -1;
+       di.request = TRUE;
        di.call_data = value;
 
         dcerpc_try_handoff (pinfo, tree, dcerpc_tree, tvb, offset,
@@ -1502,6 +1791,7 @@ dissect_dcerpc_dg (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
        di.conv = conv;
        di.call_id = 0; 
        di.smb_fid = -1;
+       di.request = FALSE;
        if(value) {
                di.call_data = value;
        } else {
@@ -1731,6 +2021,8 @@ proto_register_dcerpc (void)
           { "Activitiy", "dcerpc.dg_act_id", FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }},
         { &hf_dcerpc_opnum,
           { "Opnum", "dcerpc.opnum", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
+        { &hf_dcerpc_array_max_count,
+          { "Max Count", "dcerpc.array.max_count", FT_UINT32, BASE_DEC, NULL, 0x0, "Maximum Count: Number of elements in the array", HFILL }},
 
 
     };
@@ -1740,6 +2032,7 @@ proto_register_dcerpc (void)
         &ett_dcerpc_drep,
         &ett_dcerpc_dg_flags1,
         &ett_dcerpc_dg_flags2,
+        &ett_dcerpc_pointer_data,
     };
 
     proto_dcerpc = proto_register_protocol ("DCE RPC", "DCERPC", "dcerpc");
index 481897790fdfd44b2e4287a0dd4d4e9f15b4221b..92ec7e100cabe6be12a74b5a203fc90941ad5cde 100644 (file)
@@ -1,7 +1,7 @@
 /* packet-dcerpc.h
  * Copyright 2001, Todd Sabin <tas@webspan.net>
  *
- * $Id: packet-dcerpc.h,v 1.8 2002/01/23 05:37:38 guy Exp $
+ * $Id: packet-dcerpc.h,v 1.9 2002/01/25 08:35:59 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -131,6 +131,19 @@ int dissect_ndr_ctx_hnd (tvbuff_t *tvb, gint offset, packet_info *pinfo,
 
 typedef int (dcerpc_dissect_fnct_t)(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, char *drep);
 
+#define NDR_POINTER_REF                1
+#define NDR_POINTER_UNIQUE     2
+#define NDR_POINTER_PTR                3
+int dissect_ndr_pointer (tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                        proto_tree *tree, char *drep, 
+                        dcerpc_dissect_fnct_t *fnct, int type, int hf_index);
+
+/* dissect a NDR unidimensional conformant array */
+int dissect_ndr_ucarray(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                        proto_tree *tree, char *drep, 
+                        dcerpc_dissect_fnct_t *fnct);
+
+
 typedef struct _dcerpc_sub_dissector {
     guint16 num;
     gchar   *name;
@@ -164,6 +177,7 @@ typedef struct _dcerpc_call_value {
     guint16 opnum;
     gint32 req_frame;
     gint32 rep_frame;
+    guint32 max_ptr;
     void *private_data;
 } dcerpc_call_value;
 
@@ -171,6 +185,8 @@ typedef struct _dcerpc_info {
        conversation_t *conv;   /* Which TCP stream we are in */
        guint32 call_id;        /* Context id for this call */
        guint16 smb_fid;        /* FID for DCERPC over SMB */
+       gboolean request;
+       int hf_index;
        dcerpc_call_value *call_data;
 } dcerpc_info;