Wireshark  4.3.0
The Wireshark network protocol analyzer
packet-dcerpc-nt.h
1 /* packet-dcerpc-nt.h
2  * Routines for DCERPC over SMB packet disassembly
3  * Copyright 2001-2003 Tim Potter <tpot@samba.org>
4  *
5  * Wireshark - Network traffic analyzer
6  * By Gerald Combs <gerald@wireshark.org>
7  * Copyright 1998 Gerald Combs
8  *
9  * SPDX-License-Identifier: GPL-2.0-or-later
10  */
11 
12 #ifndef __PACKET_DCERPC_NT_H
13 #define __PACKET_DCERPC_NT_H
14 
15 #include "ws_symbol_export.h"
16 
17 /*
18  * Platform ID values, used by several dissectors.
19  */
20 extern const value_string platform_id_vals[];
21 
22 /* Routines for handling deferral of referants in NDR */
23 
24 #define ALIGN_TO_8_BYTES \
25  { \
26  if(!di->conformant_run) { \
27  if(offset&0x07) { \
28  offset=(offset&0xfffffff8)+8; \
29  } \
30  } \
31  }
32 #define ALIGN_TO_4_BYTES \
33  { \
34  if(!di->conformant_run) { \
35  if(offset&0x03) { \
36  offset=(offset&0xfffffffc)+4; \
37  } \
38  } \
39  }
40 #define ALIGN_TO_2_BYTES \
41  { \
42  if(!di->conformant_run) { \
43  if(offset&0x01) { \
44  offset=(offset&0xfffffffe)+2; \
45  } \
46  } \
47  }
48 
49 #define ALIGN_TO_5_BYTES ALIGN_TO_4_OR_8_BYTES
50 
51 #define ALIGN_TO_4_OR_8_BYTES \
52  { \
53  if (di->call_data->flags & DCERPC_IS_NDR64) { \
54  ALIGN_TO_8_BYTES; \
55  } else { \
56  ALIGN_TO_4_BYTES; \
57  } \
58  }
59 
60 #define ALIGN_TO_3_BYTES ALIGN_TO_2_OR_4_BYTES
61 
62 #define ALIGN_TO_2_OR_4_BYTES \
63  { \
64  if (di->call_data->flags & DCERPC_IS_NDR64) { \
65  ALIGN_TO_4_BYTES; \
66  } else { \
67  ALIGN_TO_2_BYTES; \
68  } \
69  }
70 int
71 dissect_ndr_datablob(tvbuff_t *tvb, int offset, packet_info *pinfo,
72  proto_tree *tree, dcerpc_info *di, guint8 *drep, int hf_index,
73  int use_remaining_space);
74 
75 int
76 dissect_null_term_string(tvbuff_t *tvb, int offset, packet_info *pinfo,
77  proto_tree *tree, guint8 *drep, int hf_index,
78  int levels);
79 
80 int
81 dissect_null_term_wstring(tvbuff_t *tvb, int offset, packet_info *pinfo,
82  proto_tree *tree, guint8 *drep, int hf_index,
83  int levels);
84 
85 int
86 dissect_ndr_counted_ascii_string_cb(tvbuff_t *tvb, int offset,
87  packet_info *pinfo, proto_tree *tree,
88  dcerpc_info *di, guint8 *drep, int hf_index,
89  dcerpc_callback_fnct_t *callback,
90  void *callback_args);
91 int
92 dissect_ndr_counted_ascii_string(tvbuff_t *tvb, int offset,
93  packet_info *pinfo, proto_tree *tree,
94  dcerpc_info *di, guint8 *drep, int hf_index, int levels);
95 
96 int
97 dissect_ndr_counted_string_cb(tvbuff_t *tvb, int offset,
98  packet_info *pinfo, proto_tree *tree,
99  dcerpc_info *di, guint8 *drep, int hf_index,
100  dcerpc_callback_fnct_t *callback,
101  void *callback_args);
102 
103 int
104 dissect_ndr_counted_string_ptr(tvbuff_t *tvb, int offset,
105  packet_info *pinfo, proto_tree *parent_tree,
106  dcerpc_info *di, guint8 *drep);
107 
108 int
109 dissect_ndr_counted_string(tvbuff_t *tvb, int offset,
110  packet_info *pinfo, proto_tree *parent_tree,
111  dcerpc_info *di, guint8 *drep, int hf_index, int levels);
112 
113 int
114 dissect_ndr_counted_byte_array(tvbuff_t *tvb, int offset,
115  packet_info *pinfo, proto_tree *parent_tree,
116  dcerpc_info *di, guint8 *drep, int hf_index, int levels);
117 
118 int
119 dissect_ndr_counted_byte_array_cb(tvbuff_t *tvb, int offset,
120  packet_info *pinfo, proto_tree *tree,
121  dcerpc_info *di, guint8 *drep, int hf_index,
122  dcerpc_callback_fnct_t *callback,
123  void *callback_args);
124 
125 int
126 dissect_ndr_nt_acct_ctrl(tvbuff_t *tvb, int offset, packet_info *pinfo,
127  proto_tree *parent_tree, dcerpc_info *di, guint8 *drep);
128 
129 int
130 dissect_nt_GUID(tvbuff_t *tvb, int offset,
131  packet_info *pinfo, proto_tree *tree,
132  dcerpc_info *di, guint8 *drep);
133 
134 int
135 dissect_ndr_lsa_String(tvbuff_t *tvb, int offset, packet_info *pinfo,
136  proto_tree *parent_tree, dcerpc_info *di, guint8 *drep,
137  guint32 param, int hfindex);
138 
139 WS_DLL_PUBLIC
140 int
141 dissect_ndr_nt_NTTIME (tvbuff_t *tvb, int offset,
142  packet_info *pinfo, proto_tree *tree,
143  dcerpc_info *di, guint8 *drep, int hf_index);
144 int
145 dissect_ndr_nt_NTTIME_hyper (tvbuff_t *tvb, int offset,
146  packet_info *pinfo, proto_tree *tree,
147  dcerpc_info *di, guint8 *drep, int hf_index, gboolean onesec_resolution);
148 int
149 dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset,
150  packet_info *pinfo, proto_tree *parent_tree,
151  dcerpc_info *di, guint8 *drep);
152 int
153 dissect_ndr_nt_SID(tvbuff_t *tvb, int offset,
154  packet_info *pinfo, proto_tree *tree,
155  dcerpc_info *di, guint8 *drep);
156 int
157 dissect_ndr_nt_SID_with_options(tvbuff_t *tvb, int offset,
158  packet_info *pinfo, proto_tree *tree,
159  dcerpc_info *di, guint8 *drep, guint32 options, int hf_index);
160 int
161 dissect_ndr_nt_PSID_cb(tvbuff_t *tvb, int offset,
162  packet_info *pinfo, proto_tree *parent_tree,
163  dcerpc_info *di, guint8 *drep,
164  dcerpc_callback_fnct_t *callback, void *callback_args);
165 int
166 dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset,
167  packet_info *pinfo, proto_tree *parent_tree,
168  dcerpc_info *di, guint8 *drep);
169 int
170 dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset,
171  packet_info *pinfo, proto_tree *parent_tree,
172  dcerpc_info *di, guint8 *drep);
173 
174 int
175 dissect_ndr_nt_SE_GROUP_ATTRIBUTES(tvbuff_t *tvb, int offset,
176  packet_info *pinfo, proto_tree *parent_tree,
177  dcerpc_info *di, guint8 *drep);
178 
179 int
180 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
181  packet_info *pinfo, proto_tree *parent_tree,
182  dcerpc_info *di, guint8 *drep);
183 int
184 dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
185  packet_info *pinfo, proto_tree *parent_tree,
186  dcerpc_info *di, guint8 *drep);
187 
188 int
189 dissect_ndr_nt_SID28(tvbuff_t *tvb, int offset, packet_info *pinfo,
190  proto_tree *tree, dcerpc_info *di, guint8 *drep, int hf_index);
191 /*
192  * Policy handle hashing
193  */
194 
195 /* Store open and close packet numbers for a policy handle */
196 
197 void
198 dcerpc_smb_store_pol_pkts(e_ctx_hnd *policy_hnd, packet_info *pinfo,
199  gboolean is_open, gboolean is_close);
200 
201 /* Store a name with a policy handle */
202 
203 void
204 dcerpc_store_polhnd_name(e_ctx_hnd *policy_hnd, packet_info *pinfo,
205  const char *name);
206 
207 /* Fetch details stored with a policy handle */
208 
209 gboolean
210 dcerpc_fetch_polhnd_data(e_ctx_hnd *policy_hnd, char **name, guint32 *type,
211  guint32 *open_frame, guint32 *close_frame,
212  guint32 cur_frame);
213 
214 /* Dissect NT specific things */
215 
216 int
217 dissect_ntstatus(tvbuff_t *tvb, gint offset, packet_info *pinfo,
218  proto_tree *tree, dcerpc_info *di, guint8 *drep,
219  int hfindex, guint32 *pdata);
220 
221 int
222 dissect_doserror(tvbuff_t *tvb, gint offset, packet_info *pinfo,
223  proto_tree *tree, dcerpc_info *di, guint8 *drep,
224  int hfindex, guint32 *pdata);
225 
226 int
227 dissect_hresult(tvbuff_t *tvb, gint offset, packet_info *pinfo,
228  proto_tree *tree, dcerpc_info *di, guint8 *drep,
229  int hfindex, guint32 *pdata);
230 
231 int
232 dissect_nt_policy_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
233  proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex,
234  e_ctx_hnd *pdata, proto_item **pitem,
235  gboolean is_open, gboolean is_close);
236 
237 int
238 PIDL_dissect_policy_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
239  proto_tree *tree, dcerpc_info* di, guint8 *drep, int hfindex,
240  guint32 param);
241 
242 int
243 dissect_nt_guid_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
244  proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex,
245  e_ctx_hnd *pdata, proto_item **pitem,
246  gboolean is_open, gboolean is_close);
247 
248 int
249 dissect_nt_LUID(tvbuff_t *tvb, int offset,
250  packet_info *pinfo, proto_tree *tree,
251  guint8 *drep);
252 
253 /* Stored here instead of packet-dcerpc{,-ndr}.c as they are probably not
254  official NDR representations. */
255 
256 int dissect_dcerpc_uint8s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
257  proto_tree *tree, dcerpc_info *di, guint8 *drep,
258  int hfindex, int length, const guint8 **pdata);
259 
260 int dissect_ndr_uint8s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
261  proto_tree *tree, dcerpc_info *di, guint8 *drep,
262  int hfindex, int length, const guint8 **pdata);
263 
264 int dissect_dcerpc_uint16s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
265  proto_tree *tree, guint8 *drep,
266  int hfindex, int length);
267 
268 int dissect_ndr_uint16s(tvbuff_t *tvb, gint offset, packet_info *pinfo,
269  proto_tree *tree, dcerpc_info *di, guint8 *drep,
270  int hfindex, int length);
271 
272 int dissect_ndr_str_pointer_item(tvbuff_t *tvb, gint offset,
273  packet_info *pinfo, proto_tree *tree,
274  dcerpc_info *di, guint8 *drep, int type, const char *text,
275  int hf_index, int levels);
276 
277 int nt_dissect_MIDL_NDRHEADERBLOB(proto_tree *parent_tree, tvbuff_t *tvb, int offset, guint8 *drep);
278 
279 /*
280  * Helper routines for dissecting NDR strings
281  */
282 
283 /* Number of levels to go up appending string to pointer item */
284 #define CB_STR_ITEM_LEVELS(x) ((x) & 0xFFFF)
285 #define CB_STR_SAVE 0x20000000 /* Save string to dcv->private_data */
286 #define CB_STR_COL_INFO 0x10000000 /* Append string to COL_INFO */
287 
288 void cb_wstr_postprocess(packet_info *pinfo, proto_tree *tree _U_,
289  proto_item *item, dcerpc_info *di, tvbuff_t *tvb,
290  int start_offset, int end_offset,
291  void *callback_args);
292 void cb_str_postprocess(packet_info *pinfo, proto_tree *tree _U_,
293  proto_item *item, dcerpc_info *di, tvbuff_t *tvb,
294  int start_offset, int end_offset,
295  void *callback_args);
296 
297 /* Initialise DCERPC over SMB */
298 
299 void dcerpc_smb_init(int proto_dcerpc);
300 
301 /* Used into packet-dcerpc-netlogon.c*/
302 extern int hf_nt_cs_len;
303 extern int hf_nt_cs_size;
304 
305 #endif /* packet-dcerpc-nt.h */
Definition: packet-dcerpc.h:154
Definition: packet-dcerpc.h:54
Definition: packet_info.h:44
Definition: proto.h:904
Definition: value_string.h:26
Definition: tvbuff-int.h:35