Wireshark 2.9.0-477-g68ec514b The Wireshark network protocol analyzer

- Main Page
- Related Pages
- Modules
- Namespaces
- Classes
- Files

- File List
- File Members

packet-dcerpc-nt.h
1 /* packet-dcerpc-nt.h
2 * Routines for DCERPC over SMB packet disassembly
3 * Copyright 2001-2003 Tim Potter <tpot@samba.org>
4 *
5 * Wireshark - Network traffic analyzer
6 * By Gerald Combs <gerald@wireshark.org>
7 * Copyright 1998 Gerald Combs
8 *
9 * SPDX-License-Identifier: GPL-2.0-or-later
10 */
11
12 #ifndef __PACKET_DCERPC_NT_H
13 #define __PACKET_DCERPC_NT_H
14
15 #include "ws_symbol_export.h"
16
17 /*
18 * Platform ID values, used by several dissectors.
19 */
20 extern const value_string platform_id_vals[];
21
22 /* Routines for handling deferral of referants in NDR */
23
24 #define ALIGN_TO_8_BYTES \
25 { \
26 if(!di->conformant_run) { \
27 if(offset&0x07) { \
28 offset=(offset&0xfffffff8)+8; \
29 } \
30 } \
31 }
32 #define ALIGN_TO_4_BYTES \
33 { \
34 if(!di->conformant_run) { \
35 if(offset&0x03) { \
36 offset=(offset&0xfffffffc)+4; \
37 } \
38 } \
39 }
40 #define ALIGN_TO_2_BYTES \
41 { \
42 if(!di->conformant_run) { \
43 if(offset&0x01) { \
44 offset=(offset&0xfffffffe)+2; \
45 } \
46 } \
47 }
48
49 #define ALIGN_TO_5_BYTES ALIGN_TO_4_OR_8_BYTES
50
51 #define ALIGN_TO_4_OR_8_BYTES \
52 { \
53 if (di->call_data->flags & DCERPC_IS_NDR64) { \
54 ALIGN_TO_8_BYTES; \
55 } else { \
56 ALIGN_TO_4_BYTES; \
57 } \
58 }
59
60 #define ALIGN_TO_3_BYTES ALIGN_TO_2_OR_4_BYTES
61
62 #define ALIGN_TO_2_OR_4_BYTES \
63 { \
64 if (di->call_data->flags & DCERPC_IS_NDR64) { \
65 ALIGN_TO_4_BYTES; \
66 } else { \
67 ALIGN_TO_2_BYTES; \
68 } \
69 }
70 int
71 dissect_ndr_datablob(tvbuff_t *tvb, int offset, packet_info *pinfo,
72 proto_tree *tree, dcerpc_info *di, guint8 *drep, int hf_index,
73 int use_remaining_space);
74
75 int
76 dissect_null_term_string(tvbuff_t *tvb, int offset, packet_info *pinfo,
77 proto_tree *tree, guint8 *drep, int hf_index,
78 int levels);
79
80 int
81 dissect_null_term_wstring(tvbuff_t *tvb, int offset, packet_info *pinfo,
82 proto_tree *tree, guint8 *drep, int hf_index,
83 int levels);
84
85 int
86 dissect_ndr_counted_ascii_string_cb(tvbuff_t *tvb, int offset,
87 packet_info *pinfo, proto_tree *tree,
88 dcerpc_info *di, guint8 *drep, int hf_index,
89 dcerpc_callback_fnct_t *callback,
90 void *callback_args);
91 int
92 dissect_ndr_counted_ascii_string(tvbuff_t *tvb, int offset,
93 packet_info *pinfo, proto_tree *tree,
94 dcerpc_info *di, guint8 *drep, int hf_index, int levels);
95
96 int
97 dissect_ndr_counted_string_cb(tvbuff_t *tvb, int offset,
98 packet_info *pinfo, proto_tree *tree,
99 dcerpc_info *di, guint8 *drep, int hf_index,
100 dcerpc_callback_fnct_t *callback,
101 void *callback_args);
102
103 int
104 dissect_ndr_counted_string_ptr(tvbuff_t *tvb, int offset,
105 packet_info *pinfo, proto_tree *parent_tree,
106 dcerpc_info *di, guint8 *drep);
107
108 int
109 dissect_ndr_counted_string(tvbuff_t *tvb, int offset,
110 packet_info *pinfo, proto_tree *parent_tree,
111 dcerpc_info *di, guint8 *drep, int hf_index, int levels);
112
113 int
114 dissect_ndr_counted_byte_array(tvbuff_t *tvb, int offset,
115 packet_info *pinfo, proto_tree *parent_tree,
116 dcerpc_info *di, guint8 *drep, int hf_index, int levels);
117
118 int
119 dissect_ndr_counted_byte_array_cb(tvbuff_t *tvb, int offset,
120 packet_info *pinfo, proto_tree *tree,
121 dcerpc_info *di, guint8 *drep, int hf_index,
122 dcerpc_callback_fnct_t *callback,
123 void *callback_args);
124
125 int
126 dissect_ndr_nt_acct_ctrl(tvbuff_t *tvb, int offset, packet_info *pinfo,
127 proto_tree *parent_tree, dcerpc_info *di, guint8 *drep);
128
129 int
130 dissect_nt_GUID(tvbuff_t *tvb, int offset,
131 packet_info *pinfo, proto_tree *tree,
132 dcerpc_info *di, guint8 *drep);
133
134 int
135 dissect_ndr_lsa_String(tvbuff_t *tvb, int offset, packet_info *pinfo,
136 proto_tree *parent_tree, dcerpc_info *di, guint8 *drep,
137 guint32 param, int hfindex);
138
139 WS_DLL_PUBLIC
140 int
141 dissect_ndr_nt_NTTIME (tvbuff_t *tvb, int offset,
142 packet_info *pinfo, proto_tree *tree,
143 dcerpc_info *di, guint8 *drep, int hf_index);
144 int
145 dissect_ndr_nt_NTTIME_hyper (tvbuff_t *tvb, int offset,
146 packet_info *pinfo, proto_tree *tree,
147 dcerpc_info *di, guint8 *drep, int hf_index, gboolean onesec_resolution);
148 int
149 dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset,
150 packet_info *pinfo, proto_tree *parent_tree,
151 dcerpc_info *di, guint8 *drep);
152 int
153 dissect_ndr_nt_SID(tvbuff_t *tvb, int offset,
154 packet_info *pinfo, proto_tree *tree,
155 dcerpc_info *di, guint8 *drep);
156 int
157 dissect_ndr_nt_SID_with_options(tvbuff_t *tvb, int offset,
158 packet_info *pinfo, proto_tree *tree,
159 dcerpc_info *di, guint8 *drep, guint32 options);
160 int
161 dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset,
162 packet_info *pinfo, proto_tree *parent_tree,
163 dcerpc_info *di, guint8 *drep);
164 int
165 dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset,
166 packet_info *pinfo, proto_tree *parent_tree,
167 dcerpc_info *di, guint8 *drep);
168
169 int
170 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
171 packet_info *pinfo, proto_tree *parent_tree,
172 dcerpc_info *di, guint8 *drep);
173 int
174 dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
175 packet_info *pinfo, proto_tree *parent_tree,
176 dcerpc_info *di, guint8 *drep);
177
178 int
179 dissect_ndr_nt_SID28(tvbuff_t *tvb, int offset, packet_info *pinfo,
180 proto_tree *tree, dcerpc_info *di, guint8 *drep);
181 /*
182 * Policy handle hashing
183 */
184
185 /* Store open and close packet numbers for a policy handle */
186
187 void
188 dcerpc_smb_store_pol_pkts(e_ctx_hnd *policy_hnd, packet_info *pinfo,
189 gboolean is_open, gboolean is_close);
190
191 /* Store a name with a policy handle */
192
193 void
194 dcerpc_store_polhnd_name(e_ctx_hnd *policy_hnd, packet_info *pinfo,
195 const char *name);
196
197 /* Fetch details stored with a policy handle */
198
199 gboolean
200 dcerpc_fetch_polhnd_data(e_ctx_hnd *policy_hnd, char **name, guint32 *type,
201 guint32 *open_frame, guint32 *close_frame,
202 guint32 cur_frame);
203
204 /* Dissect NT specific things */
205
206 int
207 dissect_ntstatus(tvbuff_t *tvb, gint offset, packet_info *pinfo,
208 proto_tree *tree, dcerpc_info *di, guint8 *drep,
209 int hfindex, guint32 *pdata);
210
211 int
212 dissect_doserror(tvbuff_t *tvb, gint offset, packet_info *pinfo,
213 proto_tree *tree, dcerpc_info *di, guint8 *drep,
214 int hfindex, guint32 *pdata);
215
216 int
217 dissect_nt_policy_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
218 proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex,
219 e_ctx_hnd *pdata, proto_item **pitem,
220 gboolean is_open, gboolean is_close);
221
222 int
223 PIDL_dissect_policy_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
224 proto_tree *tree, dcerpc_info* di, guint8 *drep, int hfindex,
225 guint32 param);
226
227 int
228 dissect_nt_guid_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
229 proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex,
230 e_ctx_hnd *pdata, proto_item **pitem,
231 gboolean is_open, gboolean is_close);
232
233 int
234 dissect_nt_LUID(tvbuff_t *tvb, int offset,
235 packet_info *pinfo, proto_tree *tree,
236 guint8 *drep);
237
238 /* Stored here instead of packet-dcerpc{,-ndr}.c as they are probably not
239 official NDR representations. */
240
241 int dissect_dcerpc_uint8s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
242 proto_tree *tree, dcerpc_info *di, guint8 *drep,
243 int hfindex, int length, const guint8 **pdata);
244
245 int dissect_ndr_uint8s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
246 proto_tree *tree, dcerpc_info *di, guint8 *drep,
247 int hfindex, int length, const guint8 **pdata);
248
249 int dissect_dcerpc_uint16s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
250 proto_tree *tree, guint8 *drep,
251 int hfindex, int length);
252
253 int dissect_ndr_uint16s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
254 proto_tree *tree, dcerpc_info *di, guint8 *drep,
255 int hfindex, int length);
256
257 int dissect_ndr_str_pointer_item(tvbuff_t *tvb, gint offset,
258 packet_info *pinfo, proto_tree *tree,
259 dcerpc_info *di, guint8 *drep, int type, const char *text,
260 int hf_index, int levels);
261
262 int nt_dissect_MIDL_NDRHEADERBLOB(proto_tree *parent_tree, tvbuff_t *tvb, int offset, guint8 *drep);
263
264 /*
265 * Helper routines for dissecting NDR strings
266 */
267
268 /* Number of levels to go up appending string to pointer item */
269 #define CB_STR_ITEM_LEVELS(x) ((x) & 0xFFFF)
270 #define CB_STR_SAVE 0x20000000 /* Save string to dcv->private_data */
271 #define CB_STR_COL_INFO 0x10000000 /* Append string to COL_INFO */
272
273 void cb_wstr_postprocess(packet_info *pinfo, proto_tree *tree _U_,
274 proto_item *item, dcerpc_info *di, tvbuff_t *tvb,
275 int start_offset, int end_offset,
276 void *callback_args);
277 void cb_str_postprocess(packet_info *pinfo, proto_tree *tree _U_,
278 proto_item *item, dcerpc_info *di, tvbuff_t *tvb,
279 int start_offset, int end_offset,
280 void *callback_args);
281
282 /* Initialise DCERPC over SMB */
283
284 void dcerpc_smb_init(int proto_dcerpc);
285
286 /* Used into packet-dcerpc-netlogon.c*/
287 extern int hf_nt_cs_len;
288 extern int hf_nt_cs_size;
289
290 #endif /* packet-dcerpc-nt.h */
_packet_info
Definition: packet_info.h:44
tvbuff
Definition: tvbuff-int.h:35
_e_ctx_hnd
Definition: packet-dcerpc.h:53
_value_string
Definition: value_string.h:24
_proto_node
Definition: proto.h:759
_dcerpc_info
Definition: packet-dcerpc.h:151