From Stefan Metzmacher:

I created two patches:
1.) move the handling of the compressed strings in CLDAP 'netlogon' replies into a generic place.
2.) implement dissection of SMB_NETLOGON cmd's 0x17 and 0x19

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@19970 f5534014-38df-0310-8fa8-9805f1628bb7

diff --git a/epan/dissectors/packet-ldap.c b/epan/dissectors/packet-ldap.c
index 666dce0af5092eb91302544e2869ffceecb32cc3..26bb53608573896266deb570f856a469affee4f4 100644 (file)
--- a/epan/dissectors/packet-ldap.c
+++ b/epan/dissectors/packet-ldap.c
@@ -94,6 +94,7 @@
 #include <epan/strutil.h>
 #include <epan/dissectors/packet-tcp.h>
 #include <epan/dissectors/packet-windows-common.h>
 #include <epan/strutil.h>
 #include <epan/dissectors/packet-tcp.h>
 #include <epan/dissectors/packet-windows-common.h>

+#include <epan/dissectors/packet-smb-common.h>

 #include <epan/dissectors/packet-dcerpc.h>
 
 #include "packet-frame.h"
 #include <epan/dissectors/packet-dcerpc.h>
 
 #include "packet-frame.h"


@@ -3427,65 +3428,6 @@ dissect_ldap_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gboolean i
     }
 }
 
     }
 }
 

-static int dissect_mscldap_string(tvbuff_t *tvb, int offset, char *str, int maxlen, gboolean prepend_dot)
-{
-  guint8 len;
-
-  len=tvb_get_guint8(tvb, offset);
-  offset+=1;
-  *str=0;
-
-  while(len){
-    /* add potential field separation dot */
-    if(prepend_dot){
-      if(!maxlen){
-        *str=0;
-        return offset;
-      }
-      maxlen--;
-      *str++='.';
-      *str=0;
-    }
-
-    if(len==0xc0){
-      int new_offset;
-      /* ops its a mscldap compressed string */
-
-      new_offset=tvb_get_guint8(tvb, offset);
-      if (new_offset == offset - 1)
-        THROW(ReportedBoundsError);
-      offset+=1;
-
-      dissect_mscldap_string(tvb, new_offset, str, maxlen, FALSE);
-
-      return offset;
-    }
-
-    prepend_dot=TRUE;
-
-    if(maxlen<=len){
-      if(maxlen>3){
-        *str++='.';
-        *str++='.';
-        *str++='.';
-      }
-      *str=0;
-      return offset; /* will mess up offset in caller, is unlikely */
-    }
-    tvb_memcpy(tvb, str, offset, len);
-    str+=len;
-    *str=0;
-    maxlen-=len;
-    offset+=len;
-
-
-    len=tvb_get_guint8(tvb, offset);
-    offset+=1;
-  }
-  *str=0;
-  return offset;
-}
-

 /* These flag bits were found to be defined in the samba sources.
  * I hope they are correct (but have serious doubts about the CLOSEST
  * bit being used or being meaningful).
 /* These flag bits were found to be defined in the samba sources.
  * I hope they are correct (but have serious doubts about the CLOSEST
  * bit being used or being meaningful).


@@ -3583,8 +3525,7 @@ static int dissect_mscldap_netlogon_flags(proto_tree *parent_tree, tvbuff_t *tvb
 
 static void dissect_NetLogon_PDU(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 {
 
 static void dissect_NetLogon_PDU(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 {

-  int old_offset, offset=0;
-  char str[256];
+  int offset=0;

 
   ldm_tree = NULL;
 
 
   ldm_tree = NULL;
 


@@ -3603,44 +3544,28 @@ static void dissect_NetLogon_PDU(tvbuff_t *tvb, packet_info *pinfo, proto_tree *
   offset += 16;
 
   /* Forest */
   offset += 16;
 
   /* Forest */

-  old_offset=offset;
-  offset=dissect_mscldap_string(tvb, offset, str, 255, FALSE);
-  proto_tree_add_string(tree, hf_mscldap_forest, tvb, old_offset, offset-old_offset, str);
+  offset=dissect_ms_compressed_string(tvb, tree, offset, hf_mscldap_forest, FALSE, NULL);

 
   /* Domain */
 
   /* Domain */

-  old_offset=offset;
-  offset=dissect_mscldap_string(tvb, offset, str, 255, FALSE);
-  proto_tree_add_string(tree, hf_mscldap_domain, tvb, old_offset, offset-old_offset, str);
+  offset=dissect_ms_compressed_string(tvb, tree, offset, hf_mscldap_domain, FALSE, NULL);

 
   /* Hostname */
 
   /* Hostname */

-  old_offset=offset;
-  offset=dissect_mscldap_string(tvb, offset, str, 255, FALSE);
-  proto_tree_add_string(tree, hf_mscldap_hostname, tvb, old_offset, offset-old_offset, str);
+  offset=dissect_ms_compressed_string(tvb, tree, offset, hf_mscldap_hostname, FALSE, NULL);

 
   /* NetBios Domain */
 
   /* NetBios Domain */

-  old_offset=offset;
-  offset=dissect_mscldap_string(tvb, offset, str, 255, FALSE);
-  proto_tree_add_string(tree, hf_mscldap_nb_domain, tvb, old_offset, offset-old_offset, str);
+  offset=dissect_ms_compressed_string(tvb, tree, offset, hf_mscldap_nb_domain, FALSE, NULL);

 
   /* NetBios Hostname */
 
   /* NetBios Hostname */

-  old_offset=offset;
-  offset=dissect_mscldap_string(tvb, offset, str, 255, FALSE);
-  proto_tree_add_string(tree, hf_mscldap_nb_hostname, tvb, old_offset, offset-old_offset, str);
+  offset=dissect_ms_compressed_string(tvb, tree, offset, hf_mscldap_nb_hostname, FALSE, NULL);

 
   /* User */
 
   /* User */

-  old_offset=offset;
-  offset=dissect_mscldap_string(tvb, offset, str, 255, FALSE);
-  proto_tree_add_string(tree, hf_mscldap_username, tvb, old_offset, offset-old_offset, str);
+  offset=dissect_ms_compressed_string(tvb, tree, offset, hf_mscldap_username, FALSE, NULL);

 
   /* Site */
 
   /* Site */

-  old_offset=offset;
-  offset=dissect_mscldap_string(tvb, offset, str, 255, FALSE);
-  proto_tree_add_string(tree, hf_mscldap_sitename, tvb, old_offset, offset-old_offset, str);
+  offset=dissect_ms_compressed_string(tvb, tree, offset, hf_mscldap_sitename, FALSE, NULL);

 
   /* Client Site */
 
   /* Client Site */

-  old_offset=offset;
-  offset=dissect_mscldap_string(tvb, offset, str, 255, FALSE);
-  proto_tree_add_string(tree, hf_mscldap_clientsitename, tvb, old_offset, offset-old_offset, str);
+  offset=dissect_ms_compressed_string(tvb, tree, offset, hf_mscldap_clientsitename, FALSE, NULL);

 
   /* Version */
   proto_tree_add_item(tree, hf_mscldap_netlogon_version, tvb, offset, 4, TRUE);
 
   /* Version */
   proto_tree_add_item(tree, hf_mscldap_netlogon_version, tvb, offset, 4, TRUE);

diff --git a/epan/dissectors/packet-smb-common.c b/epan/dissectors/packet-smb-common.c
index 14116b95432084aaff4f52c035e5039555f1eb3c..081195650f7098d7fd0ea0c6e9b4a25969ca8607 100644 (file)
--- a/epan/dissectors/packet-smb-common.c
+++ b/epan/dissectors/packet-smb-common.c
@@ -125,9 +125,87 @@ int display_unicode_string(tvbuff_t *tvb, proto_tree *tree, int offset, int hf_i
        return  offset+len;
 }
 
        return  offset+len;
 }
 

+static int dissect_ms_compressed_string_internal(tvbuff_t *tvb, int offset, char *str, int maxlen, gboolean prepend_dot)
+{
+  guint8 len;
+
+  len=tvb_get_guint8(tvb, offset);
+  offset+=1;
+  *str=0;
+
+  while(len){
+    /* add potential field separation dot */
+    if(prepend_dot){
+      if(!maxlen){
+        *str=0;
+        return offset;
+      }
+      maxlen--;
+      *str++='.';
+      *str=0;
+    }
+
+    if(len==0xc0){
+      int new_offset;
+      /* ops its a mscldap compressed string */
+
+      new_offset=tvb_get_guint8(tvb, offset);
+      if (new_offset == offset - 1)
+        THROW(ReportedBoundsError);
+      offset+=1;
+
+      dissect_ms_compressed_string_internal(tvb, new_offset, str, maxlen, FALSE);
+
+      return offset;
+    }
+
+    prepend_dot=TRUE;
+
+    if(maxlen<=len){
+      if(maxlen>3){
+        *str++='.';
+        *str++='.';
+        *str++='.';
+      }
+      *str=0;
+      return offset; /* will mess up offset in caller, is unlikely */
+    }
+    tvb_memcpy(tvb, str, offset, len);
+    str+=len;
+    *str=0;
+    maxlen-=len;
+    offset+=len;
+
+
+    len=tvb_get_guint8(tvb, offset);
+    offset+=1;
+  }
+  *str=0;
+  return offset;
+}
+

 /* Max string length for displaying Unicode strings.  */
 #define        MAX_UNICODE_STR_LEN     256
 
 /* Max string length for displaying Unicode strings.  */
 #define        MAX_UNICODE_STR_LEN     256
 

+int dissect_ms_compressed_string(tvbuff_t *tvb, proto_tree *tree, int offset, int hf_index,
+                                gboolean prepend_dot, char **data)
+{
+       int old_offset=offset;
+       char *str;
+       int len;
+
+       len = MAX_UNICODE_STR_LEN+3+1;
+       str=ep_alloc(len);
+
+       offset=dissect_ms_compressed_string_internal(tvb, offset, str, len, prepend_dot);
+       proto_tree_add_string(tree, hf_index, tvb, old_offset, offset-old_offset, str);
+
+       if (data)
+               *data = str;
+
+       return offset;
+}
+

 /* Turn a little-endian Unicode '\0'-terminated string into a string we
    can display.
    XXX - for now, we just handle the ISO 8859-1 characters.
 /* Turn a little-endian Unicode '\0'-terminated string into a string we
    can display.
    XXX - for now, we just handle the ISO 8859-1 characters.

diff --git a/epan/dissectors/packet-smb-common.h b/epan/dissectors/packet-smb-common.h
index 5a89f0d7c21de07fd192c825581ba6715b68bfc5..0188bf47cd32b036d50a6f73053b0aa113ccf66f 100644 (file)
--- a/epan/dissectors/packet-smb-common.h
+++ b/epan/dissectors/packet-smb-common.h
@@ -36,6 +36,9 @@ int display_unicode_string(tvbuff_t *tvb, proto_tree *tree, int offset, int hf_i
 
 int display_ms_string(tvbuff_t *tvb, proto_tree *tree, int offset, int hf_index, char **data);
 
 
 int display_ms_string(tvbuff_t *tvb, proto_tree *tree, int offset, int hf_index, char **data);
 

+int dissect_ms_compressed_string(tvbuff_t *tvb, proto_tree *tree, int offset, int hf_index,
+                                gboolean prepend_dot, char **data);
+

 const gchar *get_unicode_or_ascii_string(tvbuff_t *tvb, int *offsetp,
     gboolean useunicode, int *len, gboolean nopad, gboolean exactlen,
     guint16 *bcp);
 const gchar *get_unicode_or_ascii_string(tvbuff_t *tvb, int *offsetp,
     gboolean useunicode, int *len, gboolean nopad, gboolean exactlen,
     guint16 *bcp);