epan/dissectors/packet-dcerpc-nt.h

   1 /* packet-dcerpc-nt.h
   2  * Routines for DCERPC over SMB packet disassembly
   3  * Copyright 2001-2003 Tim Potter <tpot@samba.org>
   4  *
   5  * Wireshark - Network traffic analyzer
   6  * By Gerald Combs <gerald@wireshark.org>
   7  * Copyright 1998 Gerald Combs
   8  *
   9  * SPDX-License-Identifier: GPL-2.0-or-later
  10  */
  11
  12 #ifndef __PACKET_DCERPC_NT_H
  13 #define __PACKET_DCERPC_NT_H
  14
  15 #include "ws_symbol_export.h"
  16
  17 /*
  18  * Platform ID values, used by several dissectors.
  19  */
  20 extern const value_string platform_id_vals[];
  21
  22 /* Routines for handling deferral of referants in NDR */
  23
  24 #define ALIGN_TO_8_BYTES \
  25         { \
  26           if(!di->conformant_run) { \
  27                 if(offset&0x07) { \
  28                         offset=(offset&0xfffffff8)+8; \
  29                 } \
  30           } \
  31         }
  32 #define ALIGN_TO_4_BYTES \
  33         { \
  34           if(!di->conformant_run) { \
  35                 if(offset&0x03) { \
  36                         offset=(offset&0xfffffffc)+4; \
  37                 } \
  38           } \
  39         }
  40 #define ALIGN_TO_2_BYTES \
  41         { \
  42           if(!di->conformant_run) { \
  43                 if(offset&0x01) { \
  44                         offset=(offset&0xfffffffe)+2; \
  45                 } \
  46           } \
  47         }
  48
  49 #define ALIGN_TO_5_BYTES ALIGN_TO_4_OR_8_BYTES
  50
  51 #define ALIGN_TO_4_OR_8_BYTES \
  52         { \
  53           if (di->call_data->flags & DCERPC_IS_NDR64) { \
  54             ALIGN_TO_8_BYTES; \
  55           } else { \
  56             ALIGN_TO_4_BYTES; \
  57           } \
  58         }
  59
  60 #define ALIGN_TO_3_BYTES ALIGN_TO_2_OR_4_BYTES
  61
  62 #define ALIGN_TO_2_OR_4_BYTES \
  63         { \
  64           if (di->call_data->flags & DCERPC_IS_NDR64) { \
  65             ALIGN_TO_4_BYTES; \
  66           } else { \
  67             ALIGN_TO_2_BYTES; \
  68           } \
  69         }
  70
  71 #define UNION_ALIGN_TO_2_BYTES \
  72         do { \
  73           if (di->call_data->flags & DCERPC_IS_NDR64) { \
  74             ALIGN_TO_2_BYTES; \
  75           } \
  76         } while(0)
  77
  78 #define UNION_ALIGN_TO_3_BYTES \
  79         do { \
  80           if (di->call_data->flags & DCERPC_IS_NDR64) { \
  81             ALIGN_TO_3_BYTES; \
  82           } \
  83         } while(0)
  84
  85 #define UNION_ALIGN_TO_4_BYTES \
  86         do { \
  87           if (di->call_data->flags & DCERPC_IS_NDR64) { \
  88             ALIGN_TO_4_BYTES; \
  89           } \
  90         } while(0)
  91
  92 #define UNION_ALIGN_TO_5_BYTES \
  93         do { \
  94           if (di->call_data->flags & DCERPC_IS_NDR64) { \
  95             ALIGN_TO_5_BYTES; \
  96           } \
  97         } while(0)
  98
  99 #define UNION_ALIGN_TO_8_BYTES \
 100         do { \
 101           if (di->call_data->flags & DCERPC_IS_NDR64) { \
 102             ALIGN_TO_8_BYTES; \
 103           } \
 104         } while(0)
 105
 106 int
 107 dissect_ndr_datablob(tvbuff_t *tvb, int offset, packet_info *pinfo,
 108                         proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hf_index,
 109                         int use_remaining_space);
 110
 111 int
 112 dissect_null_term_string(tvbuff_t *tvb, int offset, packet_info *pinfo,
 113                                                         proto_tree *tree, uint8_t *drep, int hf_index,
 114                                                         int levels);
 115
 116 int
 117 dissect_null_term_wstring(tvbuff_t *tvb, int offset, packet_info *pinfo,
 118                                                         proto_tree *tree, uint8_t *drep, int hf_index,
 119                                                         int levels);
 120
 121 int
 122 dissect_ndr_counted_ascii_string_cb(tvbuff_t *tvb, int offset,
 123                                   packet_info *pinfo, proto_tree *tree,
 124                                   dcerpc_info *di, uint8_t *drep, int hf_index,
 125                                   dcerpc_callback_fnct_t *callback,
 126                                     void *callback_args);
 127 int
 128 dissect_ndr_counted_ascii_string(tvbuff_t *tvb, int offset,
 129                                packet_info *pinfo, proto_tree *tree,
 130                                    dcerpc_info *di, uint8_t *drep, int hf_index, int levels);
 131
 132 int
 133 dissect_ndr_counted_string_cb(tvbuff_t *tvb, int offset,
 134                               packet_info *pinfo, proto_tree *tree,
 135                               dcerpc_info *di, uint8_t *drep, int hf_index,
 136                               dcerpc_callback_fnct_t *callback,
 137                               void *callback_args);
 138
 139 int
 140 dissect_ndr_counted_string_ptr(tvbuff_t *tvb, int offset,
 141                                packet_info *pinfo, proto_tree *parent_tree,
 142                                dcerpc_info *di, uint8_t *drep);
 143
 144 int
 145 dissect_ndr_counted_string(tvbuff_t *tvb, int offset,
 146                            packet_info *pinfo, proto_tree *parent_tree,
 147                            dcerpc_info *di, uint8_t *drep, int hf_index, int levels);
 148
 149 int
 150 dissect_ndr_counted_byte_array(tvbuff_t *tvb, int offset,
 151                                packet_info *pinfo, proto_tree *parent_tree,
 152                                dcerpc_info *di, uint8_t *drep, int hf_index, int levels);
 153
 154 int
 155 dissect_ndr_counted_byte_array_cb(tvbuff_t *tvb, int offset,
 156                                   packet_info *pinfo, proto_tree *tree,
 157                                   dcerpc_info *di, uint8_t *drep, int hf_index,
 158                                   dcerpc_callback_fnct_t *callback,
 159                                   void *callback_args);
 160
 161 int
 162 dissect_ndr_nt_acct_ctrl(tvbuff_t *tvb, int offset, packet_info *pinfo,
 163                         proto_tree *parent_tree, dcerpc_info *di, uint8_t *drep);
 164
 165 int
 166 dissect_nt_GUID(tvbuff_t *tvb, int offset,
 167                         packet_info *pinfo, proto_tree *tree,
 168                         dcerpc_info *di, uint8_t *drep);
 169
 170 int
 171 dissect_ndr_lsa_String(tvbuff_t *tvb, int offset, packet_info *pinfo,
 172                        proto_tree *parent_tree, dcerpc_info *di, uint8_t *drep,
 173                        uint32_t param, int hfindex);
 174
 175 WS_DLL_PUBLIC
 176 int
 177 dissect_ndr_nt_NTTIME (tvbuff_t *tvb, int offset,
 178                         packet_info *pinfo, proto_tree *tree,
 179                         dcerpc_info *di, uint8_t *drep, int hf_index);
 180 int
 181 dissect_ndr_nt_NTTIME_hyper (tvbuff_t *tvb, int offset,
 182                                 packet_info *pinfo, proto_tree *tree,
 183                                 dcerpc_info *di, uint8_t *drep, int hf_index);
 184 int
 185 dissect_ndr_nt_NTTIME_1sec (tvbuff_t *tvb, int offset,
 186                                 packet_info *pinfo, proto_tree *tree,
 187                                 dcerpc_info *di, uint8_t *drep, int hf_index);
 188 int
 189 dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset,
 190                         packet_info *pinfo, proto_tree *parent_tree,
 191                         dcerpc_info *di, uint8_t *drep);
 192 int
 193 dissect_ndr_nt_SID(tvbuff_t *tvb, int offset,
 194                    packet_info *pinfo, proto_tree *tree,
 195                    dcerpc_info *di, uint8_t *drep);
 196 int
 197 dissect_ndr_nt_SID_with_options(tvbuff_t *tvb, int offset,
 198                    packet_info *pinfo, proto_tree *tree,
 199                         dcerpc_info *di, uint8_t *drep, uint32_t options, int hf_index);
 200 int
 201 dissect_ndr_nt_PSID_cb(tvbuff_t *tvb, int offset,
 202                        packet_info *pinfo, proto_tree *parent_tree,
 203                        dcerpc_info *di, uint8_t *drep,
 204                        dcerpc_callback_fnct_t *callback, void *callback_args);
 205 int
 206 dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset,
 207                     packet_info *pinfo, proto_tree *parent_tree,
 208                     dcerpc_info *di, uint8_t *drep);
 209 int
 210 dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset,
 211                         packet_info *pinfo, proto_tree *parent_tree,
 212                         dcerpc_info *di, uint8_t *drep);
 213
 214 int
 215 dissect_ndr_nt_SE_GROUP_ATTRIBUTES(tvbuff_t *tvb, int offset,
 216                         packet_info *pinfo, proto_tree *parent_tree,
 217                         dcerpc_info *di, uint8_t *drep);
 218
 219 int
 220 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
 221                         packet_info *pinfo, proto_tree *parent_tree,
 222                         dcerpc_info *di, uint8_t *drep);
 223 int
 224 dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
 225                         packet_info *pinfo, proto_tree *parent_tree,
 226                         dcerpc_info *di, uint8_t *drep);
 227
 228 int
 229 dissect_ndr_nt_SID28(tvbuff_t *tvb, int offset, packet_info *pinfo,
 230                         proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hf_index);
 231 /*
 232  * Policy handle hashing
 233  */
 234
 235 /* Store open and close packet numbers for a policy handle */
 236
 237 void
 238 dcerpc_smb_store_pol_pkts(e_ctx_hnd *policy_hnd, packet_info *pinfo,
 239                           uint32_t param);
 240
 241 /* Store a name with a policy handle */
 242
 243 void
 244 dcerpc_store_polhnd_name(e_ctx_hnd *policy_hnd, packet_info *pinfo,
 245                           const char *name);
 246
 247 /* Fetch details stored with a policy handle */
 248
 249 bool
 250 dcerpc_fetch_polhnd_data(e_ctx_hnd *policy_hnd, char **name, uint32_t *type,
 251                      uint32_t *open_frame, uint32_t *close_frame,
 252                      uint32_t cur_frame);
 253
 254 /* Dissect NT specific things */
 255
 256 int
 257 dissect_ntstatus(tvbuff_t *tvb, int offset, packet_info *pinfo,
 258                  proto_tree *tree, dcerpc_info *di, uint8_t *drep,
 259                  int hfindex, uint32_t *pdata);
 260
 261 int
 262 dissect_doserror(tvbuff_t *tvb, int offset, packet_info *pinfo,
 263                  proto_tree *tree, dcerpc_info *di, uint8_t *drep,
 264                  int hfindex, uint32_t *pdata);
 265
 266 int
 267 dissect_hresult(tvbuff_t *tvb, int offset, packet_info *pinfo,
 268                 proto_tree *tree, dcerpc_info *di, uint8_t *drep,
 269                 int hfindex, uint32_t *pdata);
 270
 271 int
 272 dissect_nt_policy_hnd(tvbuff_t *tvb, int offset, packet_info *pinfo,
 273                       proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex,
 274                       e_ctx_hnd *pdata, proto_item **pitem,
 275                       uint32_t param);
 276
 277 int
 278 PIDL_dissect_policy_hnd(tvbuff_t *tvb, int offset, packet_info *pinfo,
 279                       proto_tree *tree, dcerpc_info* di, uint8_t *drep, int hfindex,
 280                       uint32_t param);
 281
 282 int
 283 dissect_nt_guid_hnd(tvbuff_t *tvb, int offset, packet_info *pinfo,
 284                       proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex,
 285                       e_ctx_hnd *pdata, proto_item **pitem,
 286                       uint32_t param);
 287
 288 int
 289 dissect_nt_LUID(tvbuff_t *tvb, int offset,
 290                         packet_info *pinfo, proto_tree *tree,
 291                         uint8_t *drep);
 292
 293 /* Stored here instead of packet-dcerpc{,-ndr}.c as they are probably not
 294    official NDR representations. */
 295
 296 int dissect_dcerpc_uint8s(tvbuff_t *tvb, int offset, packet_info *pinfo,
 297                           proto_tree *tree, dcerpc_info *di, uint8_t *drep,
 298                           int hfindex, int length, const uint8_t **pdata);
 299
 300 int dissect_ndr_uint8s(tvbuff_t *tvb, int offset, packet_info *pinfo,
 301                        proto_tree *tree, dcerpc_info *di, uint8_t *drep,
 302                        int hfindex, int length, const uint8_t **pdata);
 303
 304 int dissect_dcerpc_uint16s(tvbuff_t *tvb, int offset, packet_info *pinfo,
 305                            proto_tree *tree, uint8_t *drep,
 306                            int hfindex, int length);
 307
 308 int dissect_ndr_uint16s(tvbuff_t *tvb, int offset, packet_info *pinfo,
 309                         proto_tree *tree, dcerpc_info *di, uint8_t *drep,
 310                         int hfindex, int length);
 311
 312 int dissect_ndr_str_pointer_item(tvbuff_t *tvb, int offset,
 313                                  packet_info *pinfo, proto_tree *tree,
 314                                  dcerpc_info *di, uint8_t *drep, int type, const char *text,
 315                                  int hf_index, int levels);
 316
 317 int nt_dissect_MIDL_NDRHEADERBLOB(proto_tree *parent_tree, tvbuff_t *tvb, int offset, uint8_t *drep);
 318
 319 /*
 320  * Helper routines for dissecting NDR strings
 321  */
 322
 323 /* Number of levels to go up appending string to pointer item */
 324 #define CB_STR_ITEM_LEVELS(x)   ((x) & 0xFFFF)
 325 #define CB_STR_SAVE     0x20000000      /* Save string to dcv->private_data */
 326 #define CB_STR_COL_INFO 0x10000000      /* Append string to COL_INFO */
 327
 328 void cb_wstr_postprocess(packet_info *pinfo, proto_tree *tree _U_,
 329                         proto_item *item, dcerpc_info *di, tvbuff_t *tvb,
 330                         int start_offset, int end_offset,
 331                         void *callback_args);
 332 void cb_str_postprocess(packet_info *pinfo, proto_tree *tree _U_,
 333                         proto_item *item, dcerpc_info *di, tvbuff_t *tvb,
 334                         int start_offset, int end_offset,
 335                         void *callback_args);
 336
 337 /* Initialise DCERPC over SMB */
 338
 339 void dcerpc_smb_init(int proto_dcerpc);
 340
 341 /* Used into packet-dcerpc-netlogon.c*/
 342 extern int hf_nt_cs_len;
 343 extern int hf_nt_cs_size;
 344
 345 #endif /* packet-dcerpc-nt.h */