Wireshark  4.3.0
The Wireshark network protocol analyzer
packet-dcerpc-nt.h
1 /* packet-dcerpc-nt.h
2  * Routines for DCERPC over SMB packet disassembly
3  * Copyright 2001-2003 Tim Potter <tpot@samba.org>
4  *
5  * Wireshark - Network traffic analyzer
6  * By Gerald Combs <gerald@wireshark.org>
7  * Copyright 1998 Gerald Combs
8  *
9  * SPDX-License-Identifier: GPL-2.0-or-later
10  */
11 
12 #ifndef __PACKET_DCERPC_NT_H
13 #define __PACKET_DCERPC_NT_H
14 
15 #include "ws_symbol_export.h"
16 
17 /*
18  * Platform ID values, used by several dissectors.
19  */
20 extern const value_string platform_id_vals[];
21 
22 /* Routines for handling deferral of referants in NDR */
23 
24 #define ALIGN_TO_8_BYTES \
25  { \
26  if(!di->conformant_run) { \
27  if(offset&0x07) { \
28  offset=(offset&0xfffffff8)+8; \
29  } \
30  } \
31  }
32 #define ALIGN_TO_4_BYTES \
33  { \
34  if(!di->conformant_run) { \
35  if(offset&0x03) { \
36  offset=(offset&0xfffffffc)+4; \
37  } \
38  } \
39  }
40 #define ALIGN_TO_2_BYTES \
41  { \
42  if(!di->conformant_run) { \
43  if(offset&0x01) { \
44  offset=(offset&0xfffffffe)+2; \
45  } \
46  } \
47  }
48 
49 #define ALIGN_TO_5_BYTES ALIGN_TO_4_OR_8_BYTES
50 
51 #define ALIGN_TO_4_OR_8_BYTES \
52  { \
53  if (di->call_data->flags & DCERPC_IS_NDR64) { \
54  ALIGN_TO_8_BYTES; \
55  } else { \
56  ALIGN_TO_4_BYTES; \
57  } \
58  }
59 
60 #define ALIGN_TO_3_BYTES ALIGN_TO_2_OR_4_BYTES
61 
62 #define ALIGN_TO_2_OR_4_BYTES \
63  { \
64  if (di->call_data->flags & DCERPC_IS_NDR64) { \
65  ALIGN_TO_4_BYTES; \
66  } else { \
67  ALIGN_TO_2_BYTES; \
68  } \
69  }
70 int
71 dissect_ndr_datablob(tvbuff_t *tvb, int offset, packet_info *pinfo,
72  proto_tree *tree, dcerpc_info *di, guint8 *drep, int hf_index,
73  int use_remaining_space);
74 
75 int
76 dissect_null_term_string(tvbuff_t *tvb, int offset, packet_info *pinfo,
77  proto_tree *tree, guint8 *drep, int hf_index,
78  int levels);
79 
80 int
81 dissect_null_term_wstring(tvbuff_t *tvb, int offset, packet_info *pinfo,
82  proto_tree *tree, guint8 *drep, int hf_index,
83  int levels);
84 
85 int
86 dissect_ndr_counted_ascii_string_cb(tvbuff_t *tvb, int offset,
87  packet_info *pinfo, proto_tree *tree,
88  dcerpc_info *di, guint8 *drep, int hf_index,
89  dcerpc_callback_fnct_t *callback,
90  void *callback_args);
91 int
92 dissect_ndr_counted_ascii_string(tvbuff_t *tvb, int offset,
93  packet_info *pinfo, proto_tree *tree,
94  dcerpc_info *di, guint8 *drep, int hf_index, int levels);
95 
96 int
97 dissect_ndr_counted_string_cb(tvbuff_t *tvb, int offset,
98  packet_info *pinfo, proto_tree *tree,
99  dcerpc_info *di, guint8 *drep, int hf_index,
100  dcerpc_callback_fnct_t *callback,
101  void *callback_args);
102 
103 int
104 dissect_ndr_counted_string_ptr(tvbuff_t *tvb, int offset,
105  packet_info *pinfo, proto_tree *parent_tree,
106  dcerpc_info *di, guint8 *drep);
107 
108 int
109 dissect_ndr_counted_string(tvbuff_t *tvb, int offset,
110  packet_info *pinfo, proto_tree *parent_tree,
111  dcerpc_info *di, guint8 *drep, int hf_index, int levels);
112 
113 int
114 dissect_ndr_counted_byte_array(tvbuff_t *tvb, int offset,
115  packet_info *pinfo, proto_tree *parent_tree,
116  dcerpc_info *di, guint8 *drep, int hf_index, int levels);
117 
118 int
119 dissect_ndr_counted_byte_array_cb(tvbuff_t *tvb, int offset,
120  packet_info *pinfo, proto_tree *tree,
121  dcerpc_info *di, guint8 *drep, int hf_index,
122  dcerpc_callback_fnct_t *callback,
123  void *callback_args);
124 
125 int
126 dissect_ndr_nt_acct_ctrl(tvbuff_t *tvb, int offset, packet_info *pinfo,
127  proto_tree *parent_tree, dcerpc_info *di, guint8 *drep);
128 
129 int
130 dissect_nt_GUID(tvbuff_t *tvb, int offset,
131  packet_info *pinfo, proto_tree *tree,
132  dcerpc_info *di, guint8 *drep);
133 
134 int
135 dissect_ndr_lsa_String(tvbuff_t *tvb, int offset, packet_info *pinfo,
136  proto_tree *parent_tree, dcerpc_info *di, guint8 *drep,
137  guint32 param, int hfindex);
138 
139 WS_DLL_PUBLIC
140 int
141 dissect_ndr_nt_NTTIME (tvbuff_t *tvb, int offset,
142  packet_info *pinfo, proto_tree *tree,
143  dcerpc_info *di, guint8 *drep, int hf_index);
144 int
145 dissect_ndr_nt_NTTIME_hyper (tvbuff_t *tvb, int offset,
146  packet_info *pinfo, proto_tree *tree,
147  dcerpc_info *di, guint8 *drep, int hf_index, gboolean onesec_resolution);
148 int
149 dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset,
150  packet_info *pinfo, proto_tree *parent_tree,
151  dcerpc_info *di, guint8 *drep);
152 int
153 dissect_ndr_nt_SID(tvbuff_t *tvb, int offset,
154  packet_info *pinfo, proto_tree *tree,
155  dcerpc_info *di, guint8 *drep);
156 int
157 dissect_ndr_nt_SID_with_options(tvbuff_t *tvb, int offset,
158  packet_info *pinfo, proto_tree *tree,
159  dcerpc_info *di, guint8 *drep, guint32 options, int hf_index);
160 int
161 dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset,
162  packet_info *pinfo, proto_tree *parent_tree,
163  dcerpc_info *di, guint8 *drep);
164 int
165 dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset,
166  packet_info *pinfo, proto_tree *parent_tree,
167  dcerpc_info *di, guint8 *drep);
168 
169 int
170 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
171  packet_info *pinfo, proto_tree *parent_tree,
172  dcerpc_info *di, guint8 *drep);
173 int
174 dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
175  packet_info *pinfo, proto_tree *parent_tree,
176  dcerpc_info *di, guint8 *drep);
177 
178 int
179 dissect_ndr_nt_SID28(tvbuff_t *tvb, int offset, packet_info *pinfo,
180  proto_tree *tree, dcerpc_info *di, guint8 *drep, int hf_index);
181 /*
182  * Policy handle hashing
183  */
184 
185 /* Store open and close packet numbers for a policy handle */
186 
187 void
188 dcerpc_smb_store_pol_pkts(e_ctx_hnd *policy_hnd, packet_info *pinfo,
189  gboolean is_open, gboolean is_close);
190 
191 /* Store a name with a policy handle */
192 
193 void
194 dcerpc_store_polhnd_name(e_ctx_hnd *policy_hnd, packet_info *pinfo,
195  const char *name);
196 
197 /* Fetch details stored with a policy handle */
198 
199 gboolean
200 dcerpc_fetch_polhnd_data(e_ctx_hnd *policy_hnd, char **name, guint32 *type,
201  guint32 *open_frame, guint32 *close_frame,
202  guint32 cur_frame);
203 
204 /* Dissect NT specific things */
205 
206 int
207 dissect_ntstatus(tvbuff_t *tvb, gint offset, packet_info *pinfo,
208  proto_tree *tree, dcerpc_info *di, guint8 *drep,
209  int hfindex, guint32 *pdata);
210 
211 int
212 dissect_doserror(tvbuff_t *tvb, gint offset, packet_info *pinfo,
213  proto_tree *tree, dcerpc_info *di, guint8 *drep,
214  int hfindex, guint32 *pdata);
215 
216 int
217 dissect_hresult(tvbuff_t *tvb, gint offset, packet_info *pinfo,
218  proto_tree *tree, dcerpc_info *di, guint8 *drep,
219  int hfindex, guint32 *pdata);
220 
221 int
222 dissect_nt_policy_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
223  proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex,
224  e_ctx_hnd *pdata, proto_item **pitem,
225  gboolean is_open, gboolean is_close);
226 
227 int
228 PIDL_dissect_policy_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
229  proto_tree *tree, dcerpc_info* di, guint8 *drep, int hfindex,
230  guint32 param);
231 
232 int
233 dissect_nt_guid_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
234  proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex,
235  e_ctx_hnd *pdata, proto_item **pitem,
236  gboolean is_open, gboolean is_close);
237 
238 int
239 dissect_nt_LUID(tvbuff_t *tvb, int offset,
240  packet_info *pinfo, proto_tree *tree,
241  guint8 *drep);
242 
243 /* Stored here instead of packet-dcerpc{,-ndr}.c as they are probably not
244  official NDR representations. */
245 
246 int dissect_dcerpc_uint8s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
247  proto_tree *tree, dcerpc_info *di, guint8 *drep,
248  int hfindex, int length, const guint8 **pdata);
249 
250 int dissect_ndr_uint8s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
251  proto_tree *tree, dcerpc_info *di, guint8 *drep,
252  int hfindex, int length, const guint8 **pdata);
253 
254 int dissect_dcerpc_uint16s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
255  proto_tree *tree, guint8 *drep,
256  int hfindex, int length);
257 
258 int dissect_ndr_uint16s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
259  proto_tree *tree, dcerpc_info *di, guint8 *drep,
260  int hfindex, int length);
261 
262 int dissect_ndr_str_pointer_item(tvbuff_t *tvb, gint offset,
263  packet_info *pinfo, proto_tree *tree,
264  dcerpc_info *di, guint8 *drep, int type, const char *text,
265  int hf_index, int levels);
266 
267 int nt_dissect_MIDL_NDRHEADERBLOB(proto_tree *parent_tree, tvbuff_t *tvb, int offset, guint8 *drep);
268 
269 /*
270  * Helper routines for dissecting NDR strings
271  */
272 
273 /* Number of levels to go up appending string to pointer item */
274 #define CB_STR_ITEM_LEVELS(x) ((x) & 0xFFFF)
275 #define CB_STR_SAVE 0x20000000 /* Save string to dcv->private_data */
276 #define CB_STR_COL_INFO 0x10000000 /* Append string to COL_INFO */
277 
278 void cb_wstr_postprocess(packet_info *pinfo, proto_tree *tree _U_,
279  proto_item *item, dcerpc_info *di, tvbuff_t *tvb,
280  int start_offset, int end_offset,
281  void *callback_args);
282 void cb_str_postprocess(packet_info *pinfo, proto_tree *tree _U_,
283  proto_item *item, dcerpc_info *di, tvbuff_t *tvb,
284  int start_offset, int end_offset,
285  void *callback_args);
286 
287 /* Initialise DCERPC over SMB */
288 
289 void dcerpc_smb_init(int proto_dcerpc);
290 
291 /* Used into packet-dcerpc-netlogon.c*/
292 extern int hf_nt_cs_len;
293 extern int hf_nt_cs_size;
294 
295 #endif /* packet-dcerpc-nt.h */
Definition: packet-dcerpc.h:154
Definition: packet-dcerpc.h:54
Definition: packet_info.h:44
Definition: proto.h:897
Definition: value_string.h:26
Definition: tvbuff-int.h:35