Wireshark  4.3.0
The Wireshark network protocol analyzer
packet-dcerpc-nt.h
1 /* packet-dcerpc-nt.h
2  * Routines for DCERPC over SMB packet disassembly
3  * Copyright 2001-2003 Tim Potter <tpot@samba.org>
4  *
5  * Wireshark - Network traffic analyzer
6  * By Gerald Combs <gerald@wireshark.org>
7  * Copyright 1998 Gerald Combs
8  *
9  * SPDX-License-Identifier: GPL-2.0-or-later
10  */
11 
12 #ifndef __PACKET_DCERPC_NT_H
13 #define __PACKET_DCERPC_NT_H
14 
15 #include "ws_symbol_export.h"
16 
17 /*
18  * Platform ID values, used by several dissectors.
19  */
20 extern const value_string platform_id_vals[];
21 
22 /* Routines for handling deferral of referants in NDR */
23 
24 #define ALIGN_TO_8_BYTES \
25  { \
26  if(!di->conformant_run) { \
27  if(offset&0x07) { \
28  offset=(offset&0xfffffff8)+8; \
29  } \
30  } \
31  }
32 #define ALIGN_TO_4_BYTES \
33  { \
34  if(!di->conformant_run) { \
35  if(offset&0x03) { \
36  offset=(offset&0xfffffffc)+4; \
37  } \
38  } \
39  }
40 #define ALIGN_TO_2_BYTES \
41  { \
42  if(!di->conformant_run) { \
43  if(offset&0x01) { \
44  offset=(offset&0xfffffffe)+2; \
45  } \
46  } \
47  }
48 
49 #define ALIGN_TO_5_BYTES ALIGN_TO_4_OR_8_BYTES
50 
51 #define ALIGN_TO_4_OR_8_BYTES \
52  { \
53  if (di->call_data->flags & DCERPC_IS_NDR64) { \
54  ALIGN_TO_8_BYTES; \
55  } else { \
56  ALIGN_TO_4_BYTES; \
57  } \
58  }
59 
60 #define ALIGN_TO_3_BYTES ALIGN_TO_2_OR_4_BYTES
61 
62 #define ALIGN_TO_2_OR_4_BYTES \
63  { \
64  if (di->call_data->flags & DCERPC_IS_NDR64) { \
65  ALIGN_TO_4_BYTES; \
66  } else { \
67  ALIGN_TO_2_BYTES; \
68  } \
69  }
70 int
71 dissect_ndr_datablob(tvbuff_t *tvb, int offset, packet_info *pinfo,
72  proto_tree *tree, dcerpc_info *di, guint8 *drep, int hf_index,
73  int use_remaining_space);
74 
75 int
76 dissect_null_term_string(tvbuff_t *tvb, int offset, packet_info *pinfo,
77  proto_tree *tree, guint8 *drep, int hf_index,
78  int levels);
79 
80 int
81 dissect_null_term_wstring(tvbuff_t *tvb, int offset, packet_info *pinfo,
82  proto_tree *tree, guint8 *drep, int hf_index,
83  int levels);
84 
85 int
86 dissect_ndr_counted_ascii_string_cb(tvbuff_t *tvb, int offset,
87  packet_info *pinfo, proto_tree *tree,
88  dcerpc_info *di, guint8 *drep, int hf_index,
89  dcerpc_callback_fnct_t *callback,
90  void *callback_args);
91 int
92 dissect_ndr_counted_ascii_string(tvbuff_t *tvb, int offset,
93  packet_info *pinfo, proto_tree *tree,
94  dcerpc_info *di, guint8 *drep, int hf_index, int levels);
95 
96 int
97 dissect_ndr_counted_string_cb(tvbuff_t *tvb, int offset,
98  packet_info *pinfo, proto_tree *tree,
99  dcerpc_info *di, guint8 *drep, int hf_index,
100  dcerpc_callback_fnct_t *callback,
101  void *callback_args);
102 
103 int
104 dissect_ndr_counted_string_ptr(tvbuff_t *tvb, int offset,
105  packet_info *pinfo, proto_tree *parent_tree,
106  dcerpc_info *di, guint8 *drep);
107 
108 int
109 dissect_ndr_counted_string(tvbuff_t *tvb, int offset,
110  packet_info *pinfo, proto_tree *parent_tree,
111  dcerpc_info *di, guint8 *drep, int hf_index, int levels);
112 
113 int
114 dissect_ndr_counted_byte_array(tvbuff_t *tvb, int offset,
115  packet_info *pinfo, proto_tree *parent_tree,
116  dcerpc_info *di, guint8 *drep, int hf_index, int levels);
117 
118 int
119 dissect_ndr_counted_byte_array_cb(tvbuff_t *tvb, int offset,
120  packet_info *pinfo, proto_tree *tree,
121  dcerpc_info *di, guint8 *drep, int hf_index,
122  dcerpc_callback_fnct_t *callback,
123  void *callback_args);
124 
125 int
126 dissect_ndr_nt_acct_ctrl(tvbuff_t *tvb, int offset, packet_info *pinfo,
127  proto_tree *parent_tree, dcerpc_info *di, guint8 *drep);
128 
129 int
130 dissect_nt_GUID(tvbuff_t *tvb, int offset,
131  packet_info *pinfo, proto_tree *tree,
132  dcerpc_info *di, guint8 *drep);
133 
134 int
135 dissect_ndr_lsa_String(tvbuff_t *tvb, int offset, packet_info *pinfo,
136  proto_tree *parent_tree, dcerpc_info *di, guint8 *drep,
137  guint32 param, int hfindex);
138 
139 WS_DLL_PUBLIC
140 int
141 dissect_ndr_nt_NTTIME (tvbuff_t *tvb, int offset,
142  packet_info *pinfo, proto_tree *tree,
143  dcerpc_info *di, guint8 *drep, int hf_index);
144 int
145 dissect_ndr_nt_NTTIME_hyper (tvbuff_t *tvb, int offset,
146  packet_info *pinfo, proto_tree *tree,
147  dcerpc_info *di, guint8 *drep, int hf_index, gboolean onesec_resolution);
148 int
149 dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset,
150  packet_info *pinfo, proto_tree *parent_tree,
151  dcerpc_info *di, guint8 *drep);
152 int
153 dissect_ndr_nt_SID(tvbuff_t *tvb, int offset,
154  packet_info *pinfo, proto_tree *tree,
155  dcerpc_info *di, guint8 *drep);
156 int
157 dissect_ndr_nt_SID_with_options(tvbuff_t *tvb, int offset,
158  packet_info *pinfo, proto_tree *tree,
159  dcerpc_info *di, guint8 *drep, guint32 options, int hf_index);
160 int
161 dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset,
162  packet_info *pinfo, proto_tree *parent_tree,
163  dcerpc_info *di, guint8 *drep);
164 int
165 dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset,
166  packet_info *pinfo, proto_tree *parent_tree,
167  dcerpc_info *di, guint8 *drep);
168 
169 int
170 dissect_ndr_nt_SE_GROUP_ATTRIBUTES(tvbuff_t *tvb, int offset,
171  packet_info *pinfo, proto_tree *parent_tree,
172  dcerpc_info *di, guint8 *drep);
173 
174 int
175 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
176  packet_info *pinfo, proto_tree *parent_tree,
177  dcerpc_info *di, guint8 *drep);
178 int
179 dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
180  packet_info *pinfo, proto_tree *parent_tree,
181  dcerpc_info *di, guint8 *drep);
182 
183 int
184 dissect_ndr_nt_SID28(tvbuff_t *tvb, int offset, packet_info *pinfo,
185  proto_tree *tree, dcerpc_info *di, guint8 *drep, int hf_index);
186 /*
187  * Policy handle hashing
188  */
189 
190 /* Store open and close packet numbers for a policy handle */
191 
192 void
193 dcerpc_smb_store_pol_pkts(e_ctx_hnd *policy_hnd, packet_info *pinfo,
194  gboolean is_open, gboolean is_close);
195 
196 /* Store a name with a policy handle */
197 
198 void
199 dcerpc_store_polhnd_name(e_ctx_hnd *policy_hnd, packet_info *pinfo,
200  const char *name);
201 
202 /* Fetch details stored with a policy handle */
203 
204 gboolean
205 dcerpc_fetch_polhnd_data(e_ctx_hnd *policy_hnd, char **name, guint32 *type,
206  guint32 *open_frame, guint32 *close_frame,
207  guint32 cur_frame);
208 
209 /* Dissect NT specific things */
210 
211 int
212 dissect_ntstatus(tvbuff_t *tvb, gint offset, packet_info *pinfo,
213  proto_tree *tree, dcerpc_info *di, guint8 *drep,
214  int hfindex, guint32 *pdata);
215 
216 int
217 dissect_doserror(tvbuff_t *tvb, gint offset, packet_info *pinfo,
218  proto_tree *tree, dcerpc_info *di, guint8 *drep,
219  int hfindex, guint32 *pdata);
220 
221 int
222 dissect_hresult(tvbuff_t *tvb, gint offset, packet_info *pinfo,
223  proto_tree *tree, dcerpc_info *di, guint8 *drep,
224  int hfindex, guint32 *pdata);
225 
226 int
227 dissect_nt_policy_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
228  proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex,
229  e_ctx_hnd *pdata, proto_item **pitem,
230  gboolean is_open, gboolean is_close);
231 
232 int
233 PIDL_dissect_policy_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
234  proto_tree *tree, dcerpc_info* di, guint8 *drep, int hfindex,
235  guint32 param);
236 
237 int
238 dissect_nt_guid_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
239  proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex,
240  e_ctx_hnd *pdata, proto_item **pitem,
241  gboolean is_open, gboolean is_close);
242 
243 int
244 dissect_nt_LUID(tvbuff_t *tvb, int offset,
245  packet_info *pinfo, proto_tree *tree,
246  guint8 *drep);
247 
248 /* Stored here instead of packet-dcerpc{,-ndr}.c as they are probably not
249  official NDR representations. */
250 
251 int dissect_dcerpc_uint8s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
252  proto_tree *tree, dcerpc_info *di, guint8 *drep,
253  int hfindex, int length, const guint8 **pdata);
254 
255 int dissect_ndr_uint8s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
256  proto_tree *tree, dcerpc_info *di, guint8 *drep,
257  int hfindex, int length, const guint8 **pdata);
258 
259 int dissect_dcerpc_uint16s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
260  proto_tree *tree, guint8 *drep,
261  int hfindex, int length);
262 
263 int dissect_ndr_uint16s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
264  proto_tree *tree, dcerpc_info *di, guint8 *drep,
265  int hfindex, int length);
266 
267 int dissect_ndr_str_pointer_item(tvbuff_t *tvb, gint offset,
268  packet_info *pinfo, proto_tree *tree,
269  dcerpc_info *di, guint8 *drep, int type, const char *text,
270  int hf_index, int levels);
271 
272 int nt_dissect_MIDL_NDRHEADERBLOB(proto_tree *parent_tree, tvbuff_t *tvb, int offset, guint8 *drep);
273 
274 /*
275  * Helper routines for dissecting NDR strings
276  */
277 
278 /* Number of levels to go up appending string to pointer item */
279 #define CB_STR_ITEM_LEVELS(x) ((x) & 0xFFFF)
280 #define CB_STR_SAVE 0x20000000 /* Save string to dcv->private_data */
281 #define CB_STR_COL_INFO 0x10000000 /* Append string to COL_INFO */
282 
283 void cb_wstr_postprocess(packet_info *pinfo, proto_tree *tree _U_,
284  proto_item *item, dcerpc_info *di, tvbuff_t *tvb,
285  int start_offset, int end_offset,
286  void *callback_args);
287 void cb_str_postprocess(packet_info *pinfo, proto_tree *tree _U_,
288  proto_item *item, dcerpc_info *di, tvbuff_t *tvb,
289  int start_offset, int end_offset,
290  void *callback_args);
291 
292 /* Initialise DCERPC over SMB */
293 
294 void dcerpc_smb_init(int proto_dcerpc);
295 
296 /* Used into packet-dcerpc-netlogon.c*/
297 extern int hf_nt_cs_len;
298 extern int hf_nt_cs_size;
299 
300 #endif /* packet-dcerpc-nt.h */
Definition: packet-dcerpc.h:154
Definition: packet-dcerpc.h:54
Definition: packet_info.h:44
Definition: proto.h:904
Definition: value_string.h:26
Definition: tvbuff-int.h:35