Wireshark 4.5.0
The Wireshark network protocol analyzer
Loading...
Searching...
No Matches
packet-dcerpc-nt.h
1/* packet-dcerpc-nt.h
2 * Routines for DCERPC over SMB packet disassembly
3 * Copyright 2001-2003 Tim Potter <tpot@samba.org>
4 *
5 * Wireshark - Network traffic analyzer
6 * By Gerald Combs <gerald@wireshark.org>
7 * Copyright 1998 Gerald Combs
8 *
9 * SPDX-License-Identifier: GPL-2.0-or-later
10 */
11
12#ifndef __PACKET_DCERPC_NT_H
13#define __PACKET_DCERPC_NT_H
14
15#include "ws_symbol_export.h"
16
17/*
18 * Platform ID values, used by several dissectors.
19 */
20extern const value_string platform_id_vals[];
21
22/* Routines for handling deferral of referants in NDR */
23
24#define ALIGN_TO_8_BYTES \
25 { \
26 if(!di->conformant_run) { \
27 if(offset&0x07) { \
28 offset=(offset&0xfffffff8)+8; \
29 } \
30 } \
31 }
32#define ALIGN_TO_4_BYTES \
33 { \
34 if(!di->conformant_run) { \
35 if(offset&0x03) { \
36 offset=(offset&0xfffffffc)+4; \
37 } \
38 } \
39 }
40#define ALIGN_TO_2_BYTES \
41 { \
42 if(!di->conformant_run) { \
43 if(offset&0x01) { \
44 offset=(offset&0xfffffffe)+2; \
45 } \
46 } \
47 }
48
49#define ALIGN_TO_5_BYTES ALIGN_TO_4_OR_8_BYTES
50
51#define ALIGN_TO_4_OR_8_BYTES \
52 { \
53 if (di->call_data->flags & DCERPC_IS_NDR64) { \
54 ALIGN_TO_8_BYTES; \
55 } else { \
56 ALIGN_TO_4_BYTES; \
57 } \
58 }
59
60#define ALIGN_TO_3_BYTES ALIGN_TO_2_OR_4_BYTES
61
62#define ALIGN_TO_2_OR_4_BYTES \
63 { \
64 if (di->call_data->flags & DCERPC_IS_NDR64) { \
65 ALIGN_TO_4_BYTES; \
66 } else { \
67 ALIGN_TO_2_BYTES; \
68 } \
69 }
70int
71dissect_ndr_datablob(tvbuff_t *tvb, int offset, packet_info *pinfo,
72 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hf_index,
73 int use_remaining_space);
74
75int
76dissect_null_term_string(tvbuff_t *tvb, int offset, packet_info *pinfo,
77 proto_tree *tree, uint8_t *drep, int hf_index,
78 int levels);
79
80int
81dissect_null_term_wstring(tvbuff_t *tvb, int offset, packet_info *pinfo,
82 proto_tree *tree, uint8_t *drep, int hf_index,
83 int levels);
84
85int
86dissect_ndr_counted_ascii_string_cb(tvbuff_t *tvb, int offset,
87 packet_info *pinfo, proto_tree *tree,
88 dcerpc_info *di, uint8_t *drep, int hf_index,
89 dcerpc_callback_fnct_t *callback,
90 void *callback_args);
91int
92dissect_ndr_counted_ascii_string(tvbuff_t *tvb, int offset,
93 packet_info *pinfo, proto_tree *tree,
94 dcerpc_info *di, uint8_t *drep, int hf_index, int levels);
95
96int
97dissect_ndr_counted_string_cb(tvbuff_t *tvb, int offset,
98 packet_info *pinfo, proto_tree *tree,
99 dcerpc_info *di, uint8_t *drep, int hf_index,
100 dcerpc_callback_fnct_t *callback,
101 void *callback_args);
102
103int
104dissect_ndr_counted_string_ptr(tvbuff_t *tvb, int offset,
105 packet_info *pinfo, proto_tree *parent_tree,
106 dcerpc_info *di, uint8_t *drep);
107
108int
109dissect_ndr_counted_string(tvbuff_t *tvb, int offset,
110 packet_info *pinfo, proto_tree *parent_tree,
111 dcerpc_info *di, uint8_t *drep, int hf_index, int levels);
112
113int
114dissect_ndr_counted_byte_array(tvbuff_t *tvb, int offset,
115 packet_info *pinfo, proto_tree *parent_tree,
116 dcerpc_info *di, uint8_t *drep, int hf_index, int levels);
117
118int
119dissect_ndr_counted_byte_array_cb(tvbuff_t *tvb, int offset,
120 packet_info *pinfo, proto_tree *tree,
121 dcerpc_info *di, uint8_t *drep, int hf_index,
122 dcerpc_callback_fnct_t *callback,
123 void *callback_args);
124
125int
126dissect_ndr_nt_acct_ctrl(tvbuff_t *tvb, int offset, packet_info *pinfo,
127 proto_tree *parent_tree, dcerpc_info *di, uint8_t *drep);
128
129int
130dissect_nt_GUID(tvbuff_t *tvb, int offset,
131 packet_info *pinfo, proto_tree *tree,
132 dcerpc_info *di, uint8_t *drep);
133
134int
135dissect_ndr_lsa_String(tvbuff_t *tvb, int offset, packet_info *pinfo,
136 proto_tree *parent_tree, dcerpc_info *di, uint8_t *drep,
137 uint32_t param, int hfindex);
138
139WS_DLL_PUBLIC
140int
141dissect_ndr_nt_NTTIME (tvbuff_t *tvb, int offset,
142 packet_info *pinfo, proto_tree *tree,
143 dcerpc_info *di, uint8_t *drep, int hf_index);
144int
145dissect_ndr_nt_NTTIME_hyper (tvbuff_t *tvb, int offset,
146 packet_info *pinfo, proto_tree *tree,
147 dcerpc_info *di, uint8_t *drep, int hf_index);
148int
149dissect_ndr_nt_NTTIME_1sec (tvbuff_t *tvb, int offset,
150 packet_info *pinfo, proto_tree *tree,
151 dcerpc_info *di, uint8_t *drep, int hf_index);
152int
153dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset,
154 packet_info *pinfo, proto_tree *parent_tree,
155 dcerpc_info *di, uint8_t *drep);
156int
157dissect_ndr_nt_SID(tvbuff_t *tvb, int offset,
158 packet_info *pinfo, proto_tree *tree,
159 dcerpc_info *di, uint8_t *drep);
160int
161dissect_ndr_nt_SID_with_options(tvbuff_t *tvb, int offset,
162 packet_info *pinfo, proto_tree *tree,
163 dcerpc_info *di, uint8_t *drep, uint32_t options, int hf_index);
164int
165dissect_ndr_nt_PSID_cb(tvbuff_t *tvb, int offset,
166 packet_info *pinfo, proto_tree *parent_tree,
167 dcerpc_info *di, uint8_t *drep,
168 dcerpc_callback_fnct_t *callback, void *callback_args);
169int
170dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset,
171 packet_info *pinfo, proto_tree *parent_tree,
172 dcerpc_info *di, uint8_t *drep);
173int
174dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset,
175 packet_info *pinfo, proto_tree *parent_tree,
176 dcerpc_info *di, uint8_t *drep);
177
178int
179dissect_ndr_nt_SE_GROUP_ATTRIBUTES(tvbuff_t *tvb, int offset,
180 packet_info *pinfo, proto_tree *parent_tree,
181 dcerpc_info *di, uint8_t *drep);
182
183int
184dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
185 packet_info *pinfo, proto_tree *parent_tree,
186 dcerpc_info *di, uint8_t *drep);
187int
188dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
189 packet_info *pinfo, proto_tree *parent_tree,
190 dcerpc_info *di, uint8_t *drep);
191
192int
193dissect_ndr_nt_SID28(tvbuff_t *tvb, int offset, packet_info *pinfo,
194 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hf_index);
195/*
196 * Policy handle hashing
197 */
198
199/* Store open and close packet numbers for a policy handle */
200
201void
202dcerpc_smb_store_pol_pkts(e_ctx_hnd *policy_hnd, packet_info *pinfo,
203 uint32_t param);
204
205/* Store a name with a policy handle */
206
207void
208dcerpc_store_polhnd_name(e_ctx_hnd *policy_hnd, packet_info *pinfo,
209 const char *name);
210
211/* Fetch details stored with a policy handle */
212
213bool
214dcerpc_fetch_polhnd_data(e_ctx_hnd *policy_hnd, char **name, uint32_t *type,
215 uint32_t *open_frame, uint32_t *close_frame,
216 uint32_t cur_frame);
217
218/* Dissect NT specific things */
219
220int
221dissect_ntstatus(tvbuff_t *tvb, int offset, packet_info *pinfo,
222 proto_tree *tree, dcerpc_info *di, uint8_t *drep,
223 int hfindex, uint32_t *pdata);
224
225int
226dissect_doserror(tvbuff_t *tvb, int offset, packet_info *pinfo,
227 proto_tree *tree, dcerpc_info *di, uint8_t *drep,
228 int hfindex, uint32_t *pdata);
229
230int
231dissect_hresult(tvbuff_t *tvb, int offset, packet_info *pinfo,
232 proto_tree *tree, dcerpc_info *di, uint8_t *drep,
233 int hfindex, uint32_t *pdata);
234
235int
236dissect_nt_policy_hnd(tvbuff_t *tvb, int offset, packet_info *pinfo,
237 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex,
238 e_ctx_hnd *pdata, proto_item **pitem,
239 uint32_t param);
240
241int
242PIDL_dissect_policy_hnd(tvbuff_t *tvb, int offset, packet_info *pinfo,
243 proto_tree *tree, dcerpc_info* di, uint8_t *drep, int hfindex,
244 uint32_t param);
245
246int
247dissect_nt_guid_hnd(tvbuff_t *tvb, int offset, packet_info *pinfo,
248 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex,
249 e_ctx_hnd *pdata, proto_item **pitem,
250 uint32_t param);
251
252int
253dissect_nt_LUID(tvbuff_t *tvb, int offset,
254 packet_info *pinfo, proto_tree *tree,
255 uint8_t *drep);
256
257/* Stored here instead of packet-dcerpc{,-ndr}.c as they are probably not
258 official NDR representations. */
259
260int dissect_dcerpc_uint8s(tvbuff_t *tvb, int offset, packet_info *pinfo,
261 proto_tree *tree, dcerpc_info *di, uint8_t *drep,
262 int hfindex, int length, const uint8_t **pdata);
263
264int dissect_ndr_uint8s(tvbuff_t *tvb, int offset, packet_info *pinfo,
265 proto_tree *tree, dcerpc_info *di, uint8_t *drep,
266 int hfindex, int length, const uint8_t **pdata);
267
268int dissect_dcerpc_uint16s(tvbuff_t *tvb, int offset, packet_info *pinfo,
269 proto_tree *tree, uint8_t *drep,
270 int hfindex, int length);
271
272int dissect_ndr_uint16s(tvbuff_t *tvb, int offset, packet_info *pinfo,
273 proto_tree *tree, dcerpc_info *di, uint8_t *drep,
274 int hfindex, int length);
275
276int dissect_ndr_str_pointer_item(tvbuff_t *tvb, int offset,
277 packet_info *pinfo, proto_tree *tree,
278 dcerpc_info *di, uint8_t *drep, int type, const char *text,
279 int hf_index, int levels);
280
281int nt_dissect_MIDL_NDRHEADERBLOB(proto_tree *parent_tree, tvbuff_t *tvb, int offset, uint8_t *drep);
282
283/*
284 * Helper routines for dissecting NDR strings
285 */
286
287/* Number of levels to go up appending string to pointer item */
288#define CB_STR_ITEM_LEVELS(x) ((x) & 0xFFFF)
289#define CB_STR_SAVE 0x20000000 /* Save string to dcv->private_data */
290#define CB_STR_COL_INFO 0x10000000 /* Append string to COL_INFO */
291
292void cb_wstr_postprocess(packet_info *pinfo, proto_tree *tree _U_,
293 proto_item *item, dcerpc_info *di, tvbuff_t *tvb,
294 int start_offset, int end_offset,
295 void *callback_args);
296void cb_str_postprocess(packet_info *pinfo, proto_tree *tree _U_,
297 proto_item *item, dcerpc_info *di, tvbuff_t *tvb,
298 int start_offset, int end_offset,
299 void *callback_args);
300
301/* Initialise DCERPC over SMB */
302
303void dcerpc_smb_init(int proto_dcerpc);
304
305/* Used into packet-dcerpc-netlogon.c*/
306extern int hf_nt_cs_len;
307extern int hf_nt_cs_size;
308
309#endif /* packet-dcerpc-nt.h */
Definition packet-dcerpc.h:154
Definition packet-dcerpc.h:54
Definition packet_info.h:43
Definition proto.h:901
Definition value_string.h:25
Definition tvbuff-int.h:35