?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Revert "TODO epan/dissectors/asn1/kerberos/packet-kerberos-template.c new GSS flags"
[wireshark-sm.git] / plugins / epan / profinet / packet-dcom-cba-acco.c
blobdb3e1753163c6eeee3ff28249b6a1e3e1da766bd
1 /* packet-dcom-cba-acco.c
2 * Routines for DCOM CBA
3 *
4 * Wireshark - Network traffic analyzer
5 * By Gerald Combs <gerald@wireshark.org>
6 * Copyright 1998 Gerald Combs
7 *
8 * SPDX-License-Identifier: GPL-2.0-or-later
9 */
10
11 #include "config.h"
12
13 #include <string.h>
14
15 #include <epan/packet.h>
16 #include <epan/expert.h>
17 #include <epan/addr_resolv.h>
18 #include <epan/conversation_filter.h>
19 #include <epan/proto_data.h>
20 #include <epan/dissectors/packet-dcerpc.h>
21 #include <epan/dissectors/packet-dcom.h>
22 #include "packet-dcom-cba-acco.h"
23 #include <epan/tfs.h>
24 #include <wsutil/array.h>
25
26 void proto_register_dcom_cba_acco(void);
27 void proto_reg_handoff_dcom_cba_acco(void);
28
29 static int hf_cba_acco_opnum;
30
31 static int hf_cba_acco_ping_factor;
32
33 static int hf_cba_acco_count;
34
35 static int hf_cba_acco_item;
36 static int hf_cba_acco_data;
37 static int hf_cba_acco_qc;
38 static int hf_cba_acco_time_stamp;
39
40 static int hf_cba_acco_conn_qos_type;
41 static int hf_cba_acco_conn_qos_value;
42 static int hf_cba_acco_conn_state;
43 static int hf_cba_acco_conn_cons_id;
44 static int hf_cba_acco_conn_version;
45 static int hf_cba_acco_conn_prov_id;
46 static int hf_cba_acco_conn_provider;
47 static int hf_cba_acco_conn_consumer;
48 static int hf_cba_acco_conn_provider_item;
49 static int hf_cba_acco_conn_consumer_item;
50 static int hf_cba_acco_conn_substitute;
51 static int hf_cba_acco_conn_epsilon;
52 static int hf_cba_acco_conn_persist;
53
54 static int hf_cba_acco_cb_length;
55 static int hf_cba_acco_cb_conn_data;
56 static int hf_cba_acco_cb_version;
57 static int hf_cba_acco_cb_flags;
58 static int hf_cba_acco_cb_count;
59 static int hf_cba_acco_cb_item;
60 static int hf_cba_acco_cb_item_hole;
61 static int hf_cba_acco_cb_item_length;
62 static int hf_cba_acco_cb_item_data;
63
64 static int hf_cba_connect_in;
65 static int hf_cba_disconnect_in;
66 static int hf_cba_connectcr_in;
67 static int hf_cba_disconnectcr_in;
68 static int hf_cba_disconnectme_in;
69 static int hf_cba_data_first_in;
70 static int hf_cba_data_last_in;
71
72 /* static int hf_cba_acco_server_pICBAAccoCallback; */
73
74 static int hf_cba_acco_server_first_connect;
75
76 static int hf_cba_acco_serversrt_prov_mac;
77 static int hf_cba_acco_serversrt_cons_mac;
78
79 static int hf_cba_acco_serversrt_cr_id;
80 static int hf_cba_acco_serversrt_cr_length;
81 static int hf_cba_acco_serversrt_cr_flags;
82 static int hf_cba_acco_serversrt_cr_flags_timestamped;
83 static int hf_cba_acco_serversrt_cr_flags_reconfigure;
84 static int hf_cba_acco_serversrt_record_length;
85 /* static int hf_cba_acco_serversrt_action; */
86 static int hf_cba_acco_serversrt_last_connect;
87
88 static int hf_cba_getprovconnout;
89
90 static int hf_cba_type_desc_len;
91
92 static int hf_cba_connectincr;
93 static int hf_cba_connectoutcr;
94 static int hf_cba_connectin;
95 static int hf_cba_connectout;
96 static int hf_cba_getconnectionout;
97 static int hf_cba_readitemout;
98 static int hf_cba_writeitemin;
99 static int hf_cba_addconnectionin;
100 static int hf_cba_addconnectionout;
101 static int hf_cba_getidout;
102
103 static int hf_cba_getconsconnout;
104 static int hf_cba_diagconsconnout;
105 static int hf_cba_acco_conn_error_state;
106
107 static int hf_cba_acco_info_max;
108 static int hf_cba_acco_info_curr;
109
110 static int hf_cba_acco_cdb_cookie;
111
112 static int hf_cba_acco_rtauto;
113
114 static int hf_cba_acco_prov_crid;
115
116 static int hf_cba_acco_diag_req;
117 static int hf_cba_acco_diag_in_length;
118 static int hf_cba_acco_diag_out_length;
119 static int hf_cba_acco_diag_data;
120 static int hf_cba_acco_dcom_call;
121 static int hf_cba_acco_srt_call;
122
123 int ett_cba_connectincr;
124 int ett_cba_connectoutcr;
125 int ett_cba_connectin;
126 int ett_cba_connectout;
127 int ett_cba_getprovconnout;
128 int ett_cba_addconnectionin;
129 int ett_cba_addconnectionout;
130 int ett_cba_getidout;
131 int ett_cba_getconnectionout;
132 int ett_cba_readitemout;
133 int ett_cba_writeitemin;
134 int ett_cba_acco_serversrt_cr_flags;
135 int ett_cba_frame_info;
136 int ett_cba_conn_info;
137
138 static expert_field ei_cba_acco_pdev_find;
139 static expert_field ei_cba_acco_prov_crid;
140 static expert_field ei_cba_acco_conn_consumer;
141 static expert_field ei_cba_acco_ldev_unknown;
142 static expert_field ei_cba_acco_no_request_info;
143 static expert_field ei_cba_acco_ipid_unknown;
144 static expert_field ei_cba_acco_qc;
145 static expert_field ei_cba_acco_pdev_find_unknown_interface;
146 static expert_field ei_cba_acco_disconnect;
147 static expert_field ei_cba_acco_connect;
148
149 static int proto_ICBAAccoMgt;
150 static int ett_ICBAAccoMgt;
151 static e_guid_t uuid_ICBAAccoMgt = { 0xcba00041, 0x6c97, 0x11d1, { 0x82, 0x71, 0x00, 0xa0, 0x24, 0x42, 0xdf, 0x7d } };
152 static uint16_t ver_ICBAAccoMgt;
153
154 static int proto_ICBAAccoMgt2;
155 static e_guid_t uuid_ICBAAccoMgt2 = { 0xcba00046, 0x6c97, 0x11d1, { 0x82, 0x71, 0x00, 0xa0, 0x24, 0x42, 0xdf, 0x7d } };
156 static uint16_t ver_ICBAAccoMgt2;
157
158 static int proto_ICBAAccoCallback;
159 static int ett_ICBAAccoCallback;
160 static int ett_ICBAAccoCallback_Buffer;
161 static int ett_ICBAAccoCallback_Item;
162 static e_guid_t uuid_ICBAAccoCallback = { 0xcba00042, 0x6c97, 0x11d1, { 0x82, 0x71, 0x00, 0xa0, 0x24, 0x42, 0xdf, 0x7d } };
163 static uint16_t ver_ICBAAccoCallback;
164
165 static int proto_ICBAAccoCallback2;
166 static e_guid_t uuid_ICBAAccoCallback2 = { 0xcba00047, 0x6c97, 0x11d1, { 0x82, 0x71, 0x00, 0xa0, 0x24, 0x42, 0xdf, 0x7d } };
167 static uint16_t ver_ICBAAccoCallback2;
168
169 static int proto_ICBAAccoServer;
170 static int ett_ICBAAccoServer;
171 static e_guid_t uuid_ICBAAccoServer = { 0xcba00043, 0x6c97, 0x11d1, { 0x82, 0x71, 0x00, 0xa0, 0x24, 0x42, 0xdf, 0x7d } };
172 static uint16_t ver_ICBAAccoServer;
173
174 static int proto_ICBAAccoServer2;
175 static e_guid_t uuid_ICBAAccoServer2 = { 0xcba00048, 0x6c97, 0x11d1, { 0x82, 0x71, 0x00, 0xa0, 0x24, 0x42, 0xdf, 0x7d } };
176 static uint16_t ver_ICBAAccoServer2;
177
178 static int proto_ICBAAccoServerSRT;
179 static int ett_ICBAAccoServerSRT;
180 static e_guid_t uuid_ICBAAccoServerSRT = { 0xcba00045, 0x6c97, 0x11d1, { 0x82, 0x71, 0x00, 0xa0, 0x24, 0x42, 0xdf, 0x7d } };
181 static uint16_t ver_ICBAAccoServerSRT;
182
183 static int proto_ICBAAccoSync;
184 static int ett_ICBAAccoSync;
185 static e_guid_t uuid_ICBAAccoSync = { 0xcba00044, 0x6c97, 0x11d1, { 0x82, 0x71, 0x00, 0xa0, 0x24, 0x42, 0xdf, 0x7d } };
186 static uint16_t ver_ICBAAccoSync;
187
188
189
190 static const value_string cba_acco_qc_vals[] = {
191 { 0x1c, "BadOutOfService" },
192 { 0x44, "UncertainLastUsableValue" },
193 { 0x48, "UncertainSubstituteSet" },
194 { 0x50, "UncertainSensorNotAccurate" },
195 { 0x80, "GoodNonCascOk" },
196 { 0, NULL }
197 };
198
199
200 static const value_string cba_qos_type_vals[] = {
201 { 0x00, "Acyclic" },
202 { 0x01, "Acyclic seconds" }, /* obsolete */
203 { 0x02, "Acyclic status" },
204 { 0x03, "Acyclic HMI" },
205 { 0x20, "Constant" },
206 { 0x30, "Cyclic Real-Time" },
207 { 0, NULL }
208 };
209
210
211 static const value_string cba_persist_vals[] = {
212 { 0x00, "Volatile" },
213 { 0x01, "PendingPersistent" },
214 { 0x02, "Persistent" },
215 { 0, NULL }
216 };
217
218
219 static const value_string cba_acco_conn_state_vals[] = {
220 { 0x00, "Passive" },
221 { 0x01, "Active" },
222 { 0, NULL }
223 };
224
225 #if 0
226 static const value_string cba_acco_serversrt_action_vals[] = {
227 { 0x00, "Activate" },
228 { 0x01, "Deactivate" },
229 { 0x02, "Remove" },
230 { 0, NULL }
231 };
232 #endif
233
234 static const value_string cba_acco_serversrt_last_connect_vals[] = {
235 { 0x00, "CR not complete" },
236 { 0x01, "CR complete" },
237 { 0, NULL }
238 };
239
240 static const value_string cba_acco_diag_req_vals[] = {
241 { 0x0000, "Function directory" },
242 { 0x1000, "DevCat statistic" },
243 { 0x2000, "Reset statistic" },
244 { 0x3000, "Consumer Comm. Events" },
245 { 0x4000, "Provider Comm. Events" },
246 { 0, NULL }
247 };
248
249 static const true_false_string cba_acco_call_flags = {
250 "Consumer calls Provider (true)",
251 "Provider calls Consumer (false)"
252 };
253
254 static const value_string cba_qos_type_short_vals[] = {
255 { 0x00, "DCOM" },
256 { 0x01, "DCOM(sec)" }, /* obsolete */
257 { 0x02, "Status" },
258 { 0x03, "HMI" },
259 { 0x20, "Const" },
260 { 0x30, "SRT" },
261 { 0, NULL }
262 };
263
264
265 typedef struct cba_frame_s {
266 cba_ldev_t *consparent;
267 cba_ldev_t *provparent;
268 GList *conns;
269 unsigned packet_connect;
270 unsigned packet_disconnect;
271 unsigned packet_disconnectme;
272 unsigned packet_first;
273 unsigned packet_last;
274
275 uint16_t length;
276 uint8_t consmac[6];
277 uint16_t conscrid;
278 uint32_t provcrid;
279 uint32_t conncrret;
280 uint16_t qostype;
281 uint16_t qosvalue;
282 uint16_t offset;
283 } cba_frame_t;
284
285 typedef struct cba_connection_s {
286 cba_ldev_t *consparentacco;
287 cba_ldev_t *provparentacco;
288 cba_frame_t *parentframe;
289 unsigned packet_connect;
290 unsigned packet_disconnect;
291 unsigned packet_disconnectme;
292 unsigned packet_first;
293 unsigned packet_last;
294
295 uint16_t length;
296 uint32_t consid;
297 uint32_t provid;
298 const char *provitem;
299 uint32_t connret;
300 uint16_t typedesclen;
301 uint16_t *typedesc;
302 uint16_t qostype;
303 uint16_t qosvalue;
304 uint16_t frame_offset;
305 } cba_connection_t;
306
307
308 typedef struct server_frame_call_s {
309 unsigned frame_count;
310 cba_frame_t **frames;
311 } server_frame_call_t;
312
313
314 typedef struct server_connect_call_s {
315 unsigned conn_count;
316 cba_frame_t *frame;
317 cba_connection_t **conns;
318 } server_connect_call_t;
319
320 typedef struct server_disconnectme_call_s {
321 cba_ldev_t *cons;
322 cba_ldev_t *prov;
323 } server_disconnectme_call_t;
324
325
326 GList *cba_pdevs;
327
328 /* as we are a plugin, we cannot get this from libwireshark! */
329 const true_false_string acco_flags_set_truth = { "Set", "Not set" };
330
331 static bool
332 cba_filter_valid(packet_info *pinfo, void *user_data _U_)
333 {
334 void* profinet_type = p_get_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0);
335
336 return ((profinet_type != NULL) && (GPOINTER_TO_UINT(profinet_type) < 10));
337 }
338
339 static char*
340 cba_build_filter(packet_info *pinfo, void *user_data _U_)
341 {
342 bool is_tcp = proto_is_frame_protocol(pinfo->layers, "tcp");
343 void* profinet_type = p_get_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0);
344
345 if ((pinfo->net_src.type == AT_IPv4) && (pinfo->net_dst.type == AT_IPv4) && is_tcp) {
346 /* IPv4 */
347 switch(GPOINTER_TO_UINT(profinet_type)) {
348 case 1:
349 return ws_strdup_printf("(ip.src eq %s and ip.dst eq %s and cba.acco.dcom == 1) || (ip.src eq %s and ip.dst eq %s and cba.acco.dcom == 0)",
350 address_to_str(pinfo->pool, &pinfo->net_dst),
351 address_to_str(pinfo->pool, &pinfo->net_src),
352 address_to_str(pinfo->pool, &pinfo->net_src),
353 address_to_str(pinfo->pool, &pinfo->net_dst));
354 case 2:
355 return ws_strdup_printf("(ip.src eq %s and ip.dst eq %s and cba.acco.dcom == 1) || (ip.src eq %s and ip.dst eq %s and cba.acco.dcom == 0)",
356 address_to_str(pinfo->pool, &pinfo->net_src),
357 address_to_str(pinfo->pool, &pinfo->net_dst),
358 address_to_str(pinfo->pool, &pinfo->net_dst),
359 address_to_str(pinfo->pool, &pinfo->net_src));
360 case 3:
361 return ws_strdup_printf("(ip.src eq %s and ip.dst eq %s and cba.acco.srt == 1) || (ip.src eq %s and ip.dst eq %s and cba.acco.srt == 0)",
362 address_to_str(pinfo->pool, &pinfo->net_dst),
363 address_to_str(pinfo->pool, &pinfo->net_src),
364 address_to_str(pinfo->pool, &pinfo->net_src),
365 address_to_str(pinfo->pool, &pinfo->net_dst));
366 case 4:
367 return ws_strdup_printf("(ip.src eq %s and ip.dst eq %s and cba.acco.srt == 1) || (ip.src eq %s and ip.dst eq %s and cba.acco.srt == 0)",
368 address_to_str(pinfo->pool, &pinfo->net_src),
369 address_to_str(pinfo->pool, &pinfo->net_dst),
370 address_to_str(pinfo->pool, &pinfo->net_dst),
371 address_to_str(pinfo->pool, &pinfo->net_src));
372 default:
373 return NULL;
374 }
375 }
376
377 return NULL;
378 }
379
380 #if 0
381 static void
382 cba_connection_dump(cba_connection_t *conn, const char *role)
383 {
384 if (conn->qostype != 0x30) {
385 ws_debug_printf(" %s#%5u: CID:0x%8x PID:0x%8x PItem:\"%s\" Type:%s QoS:%s/%u Ret:%s Data#%5u-#%5u",
386 role,
387 conn->packet_connect,
388 conn->consid, conn->provid, conn->provitem,
389 conn->typedesclen != 0 ? val_to_str(conn->typedesc[0], dcom_variant_type_vals, "Unknown (0x%08x)") : "-",
390 val_to_str(conn->qostype, cba_qos_type_short_vals, "0x%x"), conn->qosvalue,
391 conn->connret==0xffffffff ? "[pending]" : val_to_str(conn->connret, dcom_hresult_vals, "Unknown (0x%08x)"),
392 conn->packet_first, conn->packet_last);
393 } else {
394 ws_debug_printf(" %s#%5u: CID:0x%8x PID:0x%8x PItem:\"%s\" Type:%s QoS:%s/%u Ret:%s Off:%u",
395 role,
396 conn->packet_connect,
397 conn->consid, conn->provid, conn->provitem,
398 conn->typedesclen != 0 ? val_to_str(conn->typedesc[0], dcom_variant_type_vals, "Unknown (0x%08x)") : "-",
399 val_to_str(conn->qostype, cba_qos_type_short_vals, "0x%x"), conn->qosvalue,
400 conn->connret==0xffffffff ? "[pending]" : val_to_str(conn->connret, dcom_hresult_vals, "Unknown (0x%08x)"),
401 conn->frame_offset);
402 }
403 }
404
405
406 static void
407 cba_object_dump(void)
408 {
409 GList *pdevs;
410 GList *ldevs;
411 GList *frames;
412 GList *conns;
413 cba_pdev_t *pdev;
414 cba_ldev_t *ldev;
415 cba_frame_t *frame;
416 address addr;
417
418
419 for(pdevs = cba_pdevs; pdevs != NULL; pdevs = g_list_next(pdevs)) {
420 pdev = pdevs->data;
421 set_address(&addr, AT_IPv4, 4, pdev->ip);
422 ws_debug_printf("PDev #%5u: %s IFs:%u", pdev->first_packet, address_to_str(pinfo->pool, &addr),
423 pdev->object ? g_list_length(pdev->object->interfaces) : 0);
424
425 for(ldevs = pdev->ldevs; ldevs != NULL; ldevs = g_list_next(ldevs)) {
426 ldev = ldevs->data;
427 ws_debug_printf(" LDev#%5u: \"%s\" LDevIFs:%u AccoIFs:%u", ldev->first_packet, ldev->name,
428 ldev->ldev_object ? g_list_length(ldev->ldev_object->interfaces) : 0,
429 ldev->acco_object ? g_list_length(ldev->acco_object->interfaces) : 0);
430 for(frames = ldev->consframes; frames != NULL; frames = g_list_next(frames)) {
431 frame = frames->data;
432 ws_debug_printf(" ConsFrame#%5u: CCRID:0x%x PCRID:0x%x Len:%u Ret:%s Data#%5u-#%5u",
433 frame->packet_connect, frame->conscrid, frame->provcrid, frame->length,
434 frame->conncrret==0xffffffff ? "[pending]" : val_to_str(frame->conncrret, dcom_hresult_vals, "Unknown (0x%08x)"),
435 frame->packet_first, frame->packet_last);
436 for(conns = frame->conns; conns != NULL; conns = g_list_next(conns)) {
437 cba_connection_dump(conns->data, "ConsConn");
438 }
439 }
440 for(frames = ldev->provframes; frames != NULL; frames = g_list_next(frames)) {
441 frame = frames->data;
442 ws_debug_printf(" ProvFrame#%5u: CCRID:0x%x PCRID:0x%x Len:%u Ret:%s Data#%5u-#%5u",
443 frame->packet_connect, frame->conscrid, frame->provcrid, frame->length,
444 frame->conncrret==0xffffffff ? "[pending]" : val_to_str(frame->conncrret, dcom_hresult_vals, "Unknown (0x%08x)"),
445 frame->packet_first, frame->packet_last);
446 for(conns = frame->conns; conns != NULL; conns = g_list_next(conns)) {
447 cba_connection_dump(conns->data, "ProvConn");
448 }
449 }
450 for(conns = ldev->consconns; conns != NULL; conns = g_list_next(conns)) {
451 cba_connection_dump(conns->data, "ConsConn");
452 }
453 for(conns = ldev->provconns; conns != NULL; conns = g_list_next(conns)) {
454 cba_connection_dump(conns->data, "ProvConn");
455 }
456 }
457 }
458 }
459 #endif
460
461
462 cba_pdev_t *
463 cba_pdev_find(packet_info *pinfo, const address *addr, e_guid_t *ipid)
464 {
465 cba_pdev_t *pdev;
466 dcom_interface_t *interf;
467
468
469 interf = dcom_interface_find(pinfo, addr, ipid);
470 if (interf != NULL) {
471 pdev = (cba_pdev_t *)interf->parent->private_data;
472 if (pdev == NULL) {
473 expert_add_info_format(pinfo, NULL, &ei_cba_acco_pdev_find, "pdev_find: no pdev for IP:%s IPID:%s",
474 address_to_str(pinfo->pool, addr), guids_resolve_guid_to_str(ipid, pinfo->pool));
475 }
476 } else {
477 expert_add_info_format(pinfo, NULL, &ei_cba_acco_pdev_find_unknown_interface, "pdev_find: unknown interface of IP:%s IPID:%s",
478 address_to_str(pinfo->pool, addr), guids_resolve_guid_to_str(ipid, pinfo->pool));
479 pdev = NULL;
480 }
481
482 return pdev;
483 }
484
485
486 cba_pdev_t *
487 cba_pdev_add(packet_info *pinfo, const address *addr)
488 {
489 GList *cba_iter;
490 cba_pdev_t *pdev;
491
492
493 /* find pdev */
494 for(cba_iter = cba_pdevs; cba_iter != NULL; cba_iter = g_list_next(cba_iter)) {
495 pdev = (cba_pdev_t *)cba_iter->data;
496 if (memcmp(pdev->ip, addr->data, 4) == 0) {
497 return pdev;
498 }
499 }
500
501 /* not found, create a new */
502 pdev = wmem_new(wmem_file_scope(), cba_pdev_t);
503 memcpy( (void *) (pdev->ip), addr->data, 4);
504 pdev->first_packet = pinfo->num;
505 pdev->ldevs = NULL;
506 pdev->object = NULL;
507 cba_pdevs = g_list_append(cba_pdevs, pdev);
508
509 return pdev;
510 }
511
512
513 void
514 cba_pdev_link(packet_info *pinfo _U_, cba_pdev_t *pdev, dcom_interface_t *pdev_interf)
515 {
516
517 /* "crosslink" pdev interface and its object */
518 pdev->object = pdev_interf->parent;
519 pdev_interf->private_data = pdev;
520 if (pdev_interf->parent) {
521 pdev_interf->parent->private_data = pdev;
522 }
523 }
524
525
526 void
527 cba_ldev_link(packet_info *pinfo _U_, cba_ldev_t *ldev, dcom_interface_t *ldev_interf)
528 {
529
530 /* "crosslink" interface and its object */
531 ldev->ldev_object = ldev_interf->parent;
532 ldev_interf->private_data = ldev;
533 if (ldev_interf->parent) {
534 ldev_interf->parent->private_data = ldev;
535 }
536 }
537
538
539 void
540 cba_ldev_link_acco(packet_info *pinfo _U_, cba_ldev_t *ldev, dcom_interface_t *acco_interf)
541 {
542
543 /* "crosslink" interface and its object */
544 ldev->acco_object = acco_interf->parent;
545 acco_interf->private_data = ldev;
546 if (acco_interf->parent) {
547 acco_interf->parent->private_data = ldev;
548 }
549 }
550
551
552 cba_ldev_t *
553 cba_ldev_add(packet_info *pinfo, cba_pdev_t *pdev, const char *name)
554 {
555 GList *cba_iter;
556 cba_ldev_t *ldev;
557
558
559 /* find ldev */
560 for(cba_iter = pdev->ldevs; cba_iter != NULL; cba_iter = g_list_next(cba_iter)) {
561 ldev = (cba_ldev_t *)cba_iter->data;
562 if (strcmp(ldev->name, name) == 0) {
563 return ldev;
564 }
565 }
566
567 /* not found, create a new */
568 ldev = wmem_new(wmem_file_scope(), cba_ldev_t);
569 ldev->name = wmem_strdup(wmem_file_scope(), name);
570 ldev->first_packet = pinfo->num;
571 ldev->ldev_object = NULL;
572 ldev->acco_object = NULL;
573 ldev->parent = pdev;
574
575 ldev->provframes = NULL;
576 ldev->consframes = NULL;
577 ldev->provconns = NULL;
578 ldev->consconns = NULL;
579
580 pdev->ldevs = g_list_append(pdev->ldevs, ldev);
581
582 return ldev;
583 }
584
585
586 cba_ldev_t *
587 cba_ldev_find(packet_info *pinfo, const address *addr, e_guid_t *ipid) {
588 dcom_interface_t *interf;
589 cba_ldev_t *ldev;
590
591
592 interf = dcom_interface_find(pinfo, addr, ipid);
593 if (interf != NULL) {
594 ldev = (cba_ldev_t *)interf->private_data;
595
596 if (ldev == NULL) {
597 ldev = (cba_ldev_t *)interf->parent->private_data;
598 }
599 if (ldev == NULL) {
600 expert_add_info_format(pinfo, NULL, &ei_cba_acco_ldev_unknown, "Unknown LDev of %s",
601 address_to_str(pinfo->pool, addr));
602 }
603 } else {
604 expert_add_info_format(pinfo, NULL, &ei_cba_acco_ipid_unknown, "Unknown IPID of %s",
605 address_to_str(pinfo->pool, addr));
606 ldev = NULL;
607 }
608
609 return ldev;
610 }
611
612
613 static cba_ldev_t *
614 cba_acco_add(packet_info *pinfo, const char *acco)
615 {
616 char *ip_str;
617 char *delim;
618 uint32_t ip;
619 cba_pdev_t *pdev;
620 cba_ldev_t *ldev;
621 address addr;
622
623
624 ip_str = g_strdup(acco);
625 delim = strchr(ip_str, '!');
626 if (delim == NULL) {
627 g_free(ip_str);
628 return NULL;
629 }
630 *delim = 0;
631
632 if (!get_host_ipaddr(ip_str, &ip)) {
633 g_free(ip_str);
634 return NULL;
635 }
636
637 set_address(&addr, AT_IPv4, 4, &ip);
638 pdev = cba_pdev_add(pinfo, &addr);
639 delim++;
640
641 ldev = cba_ldev_add(pinfo, pdev, delim);
642
643 g_free(ip_str);
644
645 return ldev;
646 }
647
648
649 static bool
650 cba_packet_in_range(packet_info *pinfo, unsigned packet_connect, unsigned packet_disconnect, unsigned packet_disconnectme)
651 {
652
653 if (packet_connect == 0) {
654 expert_add_info_format(pinfo, NULL, &ei_cba_acco_connect, "cba_packet_in_range#%u: packet_connect not set?", pinfo->num);
655 }
656
657 if (packet_connect == 0 || pinfo->num < packet_connect) {
658 return false;
659 }
660 if (packet_disconnect != 0 && pinfo->num > packet_disconnect) {
661 return false;
662 }
663 if (packet_disconnectme != 0 && pinfo->num > packet_disconnectme) {
664 return false;
665 }
666
667 return true;
668 }
669
670
671 static void
672 cba_frame_info(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, cba_frame_t *frame)
673 {
674 if (tree) {
675 proto_item *item;
676 proto_item *sub_item;
677 proto_tree *sub_tree;
678
679 sub_tree = proto_tree_add_subtree_format(tree, tvb, 0, 0, ett_cba_frame_info, &sub_item,
680 "Cons:\"%s\" CCRID:0x%x Prov:\"%s\" PCRID:0x%x QoS:%s/%ums Len:%u",
681 frame->consparent ? frame->consparent->name : "", frame->conscrid,
682 frame->provparent ? frame->provparent->name : "", frame->provcrid,
683 val_to_str(frame->qostype, cba_qos_type_short_vals, "%u"),
684 frame->qosvalue, frame->length);
685 proto_item_set_generated(sub_item);
686
687 item = proto_tree_add_uint(sub_tree, hf_cba_acco_conn_qos_type, tvb, 0, 0, frame->qostype);
688 proto_item_set_generated(item);
689 item = proto_tree_add_uint(sub_tree, hf_cba_acco_conn_qos_value, tvb, 0, 0, frame->qosvalue);
690 proto_item_set_generated(item);
691 item = proto_tree_add_uint(sub_tree, hf_cba_acco_serversrt_cr_id, tvb, 0, 0, frame->conscrid);
692 proto_item_set_generated(item);
693 item = proto_tree_add_uint(sub_tree, hf_cba_acco_prov_crid, tvb, 0, 0, frame->provcrid);
694 proto_item_set_generated(item);
695 item = proto_tree_add_uint(sub_tree, hf_cba_acco_serversrt_cr_length, tvb, 0, 0, frame->length);
696 proto_item_set_generated(item);
697
698 if (frame->consparent != NULL) {
699 item = proto_tree_add_string(sub_tree, hf_cba_acco_conn_consumer, tvb, 0, 0, frame->consparent->name);
700 proto_item_set_generated(item);
701 }
702 if (frame->provparent != NULL) {
703 item = proto_tree_add_string(sub_tree, hf_cba_acco_conn_provider, tvb, 0, 0, frame->provparent->name);
704 proto_item_set_generated(item);
705 }
706
707 item = proto_tree_add_uint(sub_tree, hf_cba_connectcr_in,
708 tvb, 0, 0, frame->packet_connect);
709 proto_item_set_generated(item);
710 item = proto_tree_add_uint(sub_tree, hf_cba_data_first_in,
711 tvb, 0, 0, frame->packet_first);
712 proto_item_set_generated(item);
713 item = proto_tree_add_uint(sub_tree, hf_cba_data_last_in,
714 tvb, 0, 0, frame->packet_last);
715 proto_item_set_generated(item);
716 item = proto_tree_add_uint(sub_tree, hf_cba_disconnectcr_in,
717 tvb, 0, 0, frame->packet_disconnect);
718 proto_item_set_generated(item);
719 item = proto_tree_add_uint(sub_tree, hf_cba_disconnectme_in,
720 tvb, 0, 0, frame->packet_disconnectme);
721 proto_item_set_generated(item);
722 }
723 }
724
725
726 static cba_frame_t *
727 cba_frame_connect(packet_info *pinfo, cba_ldev_t *cons_ldev, cba_ldev_t *prov_ldev,
728 uint16_t qostype, uint16_t qosvalue, const uint8_t *consmac, uint16_t conscrid, uint16_t length)
729 {
730 GList *cba_iter;
731 cba_frame_t *frame;
732
733 /* find frame */
734 for(cba_iter = cons_ldev->consframes; cba_iter != NULL; cba_iter = g_list_next(cba_iter)) {
735 frame = (cba_frame_t *)cba_iter->data;
736 if ( frame->conscrid == conscrid &&
737 memcmp(frame->consmac, consmac, 6) == 0 &&
738 cba_packet_in_range(pinfo, frame->packet_connect, frame->packet_disconnect, frame->packet_disconnectme)) {
739 return frame;
740 }
741 }
742
743 frame = wmem_new(wmem_file_scope(), cba_frame_t);
744
745 frame->consparent = cons_ldev;
746 frame->provparent = prov_ldev;
747
748 frame->packet_connect = pinfo->num;
749 frame->packet_disconnect = 0;
750 frame->packet_disconnectme = 0;
751 frame->packet_first = 0;
752 frame->packet_last = 0;
753
754 frame->length = length;
755 memcpy( (uint8_t *) (frame->consmac), consmac, sizeof(frame->consmac));
756 frame->conscrid = conscrid;
757 frame->qostype = qostype;
758 frame->qosvalue = qosvalue;
759
760 frame->offset = 4;
761 frame->conns = NULL;
762
763 frame->provcrid = 0;
764 frame->conncrret = -1;
765
766 cons_ldev->consframes = g_list_append(cons_ldev->consframes, frame);
767 prov_ldev->provframes = g_list_append(prov_ldev->provframes, frame);
768
769 return frame;
770 }
771
772
773 static void
774 cba_frame_disconnect(packet_info *pinfo, cba_frame_t *frame)
775 {
776
777 if (frame->packet_disconnect == 0) {
778 frame->packet_disconnect = pinfo->num;
779 }
780
781 if (frame->packet_disconnect != pinfo->num) {
782 expert_add_info_format(pinfo, NULL, &ei_cba_acco_disconnect, "cba_frame_disconnect#%u: frame already disconnected in #%u",
783 pinfo->num, frame->packet_disconnect);
784 }
785 }
786
787
788 static void
789 cba_frame_disconnectme(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, cba_ldev_t *cons_ldev, cba_ldev_t *prov_ldev)
790 {
791 GList *frames;
792 cba_frame_t *frame;
793
794
795 for(frames = cons_ldev->consframes; frames != NULL; frames = g_list_next(frames)) {
796 frame = (cba_frame_t *)frames->data;
797
798 if ( frame->provparent == prov_ldev &&
799 cba_packet_in_range(pinfo, frame->packet_connect, frame->packet_disconnect, frame->packet_disconnectme)) {
800
801 cba_frame_info(tvb, pinfo, tree, frame);
802
803 if (frame->packet_disconnectme == 0) {
804 frame->packet_disconnectme = pinfo->num;
805 }
806
807 if (frame->packet_disconnectme != pinfo->num) {
808 expert_add_info_format(pinfo, tree, &ei_cba_acco_disconnect, "cba_frame_disconnectme#%u: frame already disconnectme'd in #%u",
809 pinfo->num, frame->packet_disconnectme);
810 }
811 }
812 }
813 }
814
815
816 static cba_frame_t *
817 cba_frame_find_by_cons(packet_info *pinfo, const uint8_t *consmac, uint16_t conscrid)
818 {
819 GList *pdevs;
820 GList *ldevs;
821 GList *frames;
822 cba_pdev_t *pdev;
823 cba_ldev_t *ldev;
824 cba_frame_t *frame;
825
826
827 /* find pdev */
828 for(pdevs = cba_pdevs; pdevs != NULL; pdevs = g_list_next(pdevs)) {
829 pdev = (cba_pdev_t *)pdevs->data;
830
831 /* find ldev */
832 for(ldevs = pdev->ldevs; ldevs != NULL; ldevs = g_list_next(ldevs)) {
833 ldev = (cba_ldev_t *)ldevs->data;
834
835 /* find frame */
836 for(frames = ldev->consframes; frames != NULL; frames = g_list_next(frames)) {
837 frame = (cba_frame_t *)frames->data;
838
839 if ( frame->conscrid == conscrid &&
840 memcmp(frame->consmac, consmac, 6) == 0 &&
841 cba_packet_in_range(pinfo, frame->packet_connect, frame->packet_disconnect, frame->packet_disconnectme)) {
842 return frame;
843 }
844 }
845 }
846 }
847
848 return NULL;
849 }
850
851
852 static cba_frame_t *
853 cba_frame_find_by_provcrid(packet_info *pinfo, cba_ldev_t *prov_ldev, uint32_t provcrid)
854 {
855 GList *frames;
856 cba_frame_t *frame;
857
858
859 if (prov_ldev == NULL) {
860 return NULL;
861 }
862
863 for(frames = prov_ldev->provframes; frames != NULL; frames = g_list_next(frames)) {
864 frame = (cba_frame_t *)frames->data;
865
866 if ( frame->provcrid == provcrid &&
867 cba_packet_in_range(pinfo, frame->packet_connect, frame->packet_disconnect, frame->packet_disconnectme)) {
868 return frame;
869 }
870 }
871
872 expert_add_info(pinfo, NULL, &ei_cba_acco_prov_crid);
873
874 return NULL;
875 }
876
877
878 static void
879 cba_frame_incoming_data(tvbuff_t *tvb _U_, packet_info *pinfo, proto_tree *tree _U_, cba_frame_t *frame)
880 {
881 if (frame->packet_first == 0) {
882 frame->packet_first = pinfo->num;
883 }
884
885 if ( pinfo->num > frame->packet_last &&
886 cba_packet_in_range(pinfo, frame->packet_connect, frame->packet_disconnect, frame->packet_disconnectme)) {
887 frame->packet_last = pinfo->num;
888 }
889 }
890
891
892 static void
893 cba_connection_info(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, cba_connection_t *conn)
894 {
895 if (tree) {
896 proto_item *item;
897 proto_item *sub_item;
898 proto_tree *sub_tree;
899
900 if (conn->qostype != 0x30) {
901 sub_tree = proto_tree_add_subtree_format(tree, tvb, 0, 0, ett_cba_conn_info, &sub_item,
902 "ProvItem:\"%s\" PID:0x%x CID:0x%x QoS:%s/%ums",
903 conn->provitem, conn->provid, conn->consid,
904 val_to_str(conn->qostype, cba_qos_type_short_vals, "%u"), conn->qosvalue);
905 } else {
906 sub_tree = proto_tree_add_subtree_format(tree, tvb, 0, 0, ett_cba_conn_info, &sub_item,
907 "ProvItem:\"%s\" PID:0x%x CID:0x%x Len:%u",
908 conn->provitem, conn->provid, conn->consid, conn->length);
909 }
910 proto_item_set_generated(sub_item);
911
912 item = proto_tree_add_string(sub_tree, hf_cba_acco_conn_provider_item, tvb, 0, 0 /* len */, conn->provitem);
913 proto_item_set_generated(item);
914 item = proto_tree_add_uint(sub_tree, hf_cba_acco_conn_prov_id, tvb, 0, 0 /* len */, conn->provid);
915 proto_item_set_generated(item);
916 item = proto_tree_add_uint(sub_tree, hf_cba_acco_conn_cons_id, tvb, 0, 0 /* len */, conn->consid);
917 proto_item_set_generated(item);
918 item = proto_tree_add_uint(sub_tree, hf_cba_acco_serversrt_record_length, tvb, 0, 0 /* len */, conn->length);
919 proto_item_set_generated(item);
920
921 if (conn->qostype != 0x30) {
922 item = proto_tree_add_uint(sub_tree, hf_cba_acco_conn_qos_type,
923 tvb, 0, 0, conn->qostype);
924 proto_item_set_generated(item);
925 item = proto_tree_add_uint(sub_tree, hf_cba_acco_conn_qos_value,
926 tvb, 0, 0, conn->qosvalue);
927 proto_item_set_generated(item);
928 item = proto_tree_add_uint(sub_tree, hf_cba_connect_in,
929 tvb, 0, 0, conn->packet_connect);
930 proto_item_set_generated(item);
931 item = proto_tree_add_uint(sub_tree, hf_cba_data_first_in,
932 tvb, 0, 0, conn->packet_first);
933 proto_item_set_generated(item);
934 item = proto_tree_add_uint(sub_tree, hf_cba_data_last_in,
935 tvb, 0, 0, conn->packet_last);
936 proto_item_set_generated(item);
937 item = proto_tree_add_uint(sub_tree, hf_cba_disconnect_in,
938 tvb, 0, 0, conn->packet_disconnect);
939 proto_item_set_generated(item);
940 item = proto_tree_add_uint(sub_tree, hf_cba_disconnectme_in,
941 tvb, 0, 0, conn->packet_disconnectme);
942 proto_item_set_generated(item);
943 }
944 }
945 }
946
947
948 static cba_connection_t *
949 cba_connection_connect(packet_info *pinfo, cba_ldev_t *cons_ldev, cba_ldev_t *prov_ldev, cba_frame_t *cons_frame,
950 uint16_t qostype, uint16_t qosvalue, const char *provitem, uint32_t consid, uint16_t length,
951 uint16_t *typedesc, uint16_t typedesclen)
952 {
953 GList *cba_iter;
954 cba_connection_t *conn;
955
956
957 /* find connection */
958 if (cons_frame != NULL) {
959 /* SRT: search in frame */
960 for(cba_iter = cons_frame->conns; cba_iter != NULL; cba_iter = g_list_next(cba_iter)) {
961 conn = (cba_connection_t *)cba_iter->data;
962 if (conn->consid == consid) {
963 return conn;
964 }
965 }
966 } else {
967 /* DCOM: search in ldev */
968 for(cba_iter = cons_ldev->consconns; cba_iter != NULL; cba_iter = g_list_next(cba_iter)) {
969 conn = (cba_connection_t *)cba_iter->data;
970 if ( conn->consid == consid &&
971 cba_packet_in_range(pinfo, conn->packet_connect, conn->packet_disconnect, conn->packet_disconnectme)) {
972 return conn;
973 }
974 }
975 }
976
977 conn = wmem_new(wmem_file_scope(), cba_connection_t);
978
979 conn->consparentacco = cons_ldev;
980 conn->provparentacco = prov_ldev;
981 conn->parentframe = cons_frame;
982
983 conn->packet_connect = pinfo->num;
984 conn->packet_disconnect = 0;
985 conn->packet_disconnectme = 0;
986 conn->packet_first = 0;
987 conn->packet_last = 0;
988
989 conn->consid = consid;
990 conn->provitem = wmem_strdup(wmem_file_scope(), provitem);
991 conn->typedesclen = typedesclen;
992 conn->typedesc = typedesc;
993 conn->qostype = qostype;
994 conn->qosvalue = qosvalue;
995 conn->length = length;
996
997 conn->provid = 0;
998 conn->connret = -1;
999
1000 if (cons_frame != NULL) {
1001 conn->frame_offset = cons_frame->offset;
1002 conn->length = length;
1003 cons_frame->offset += length;
1004 cons_frame->conns = g_list_append(cons_frame->conns, conn);
1005 } else {
1006 conn->frame_offset = 0;
1007 cons_ldev->consconns = g_list_append(cons_ldev->consconns, conn);
1008 prov_ldev->provconns = g_list_append(prov_ldev->provconns, conn);
1009 }
1010
1011 return conn;
1012 }
1013
1014
1015 static void
1016 cba_connection_disconnect(packet_info *pinfo, cba_connection_t *conn)
1017 {
1018 /* XXX - detect multiple disconnects? */
1019 if (conn->packet_disconnect == 0) {
1020 conn->packet_disconnect = pinfo->num;
1021 }
1022
1023 if (conn->packet_disconnect != pinfo->num) {
1024 expert_add_info_format(pinfo, NULL, &ei_cba_acco_disconnect, "connection_disconnect#%u: already disconnected",
1025 conn->packet_disconnect);
1026 }
1027 }
1028
1029
1030 static void
1031 cba_connection_disconnectme(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, cba_ldev_t *cons_ldev, cba_ldev_t *prov_ldev)
1032 {
1033 GList *conns;
1034 cba_connection_t *conn;
1035
1036
1037 for(conns = cons_ldev->consconns; conns != NULL; conns = g_list_next(conns)) {
1038 conn = (cba_connection_t *)conns->data;
1039
1040 if ( conn->provparentacco == prov_ldev &&
1041 cba_packet_in_range(pinfo, conn->packet_connect, conn->packet_disconnect, conn->packet_disconnectme)) {
1042
1043 cba_connection_info(tvb, pinfo, tree, conn);
1044
1045 if (conn->packet_disconnectme == 0) {
1046 conn->packet_disconnectme = pinfo->num;
1047 }
1048
1049 if (conn->packet_disconnectme != pinfo->num) {
1050 expert_add_info_format(pinfo, tree, &ei_cba_acco_disconnect, "connection_disconnectme#%u: already disconnectme'd",
1051 conn->packet_disconnectme);
1052 }
1053 }
1054 }
1055 }
1056
1057
1058 static cba_connection_t *
1059 cba_connection_find_by_provid(tvbuff_t *tvb _U_, packet_info *pinfo, proto_tree *tree _U_, cba_ldev_t *prov_ldev, uint32_t provid)
1060 {
1061 GList *cba_iter;
1062 cba_connection_t *conn;
1063
1064
1065 for(cba_iter = prov_ldev->provconns; cba_iter != NULL; cba_iter = g_list_next(cba_iter)) {
1066 conn = (cba_connection_t *)cba_iter->data;
1067 if ( conn->provid == provid &&
1068 cba_packet_in_range(pinfo, conn->packet_connect, conn->packet_disconnect, conn->packet_disconnectme)) {
1069 return conn;
1070 }
1071 }
1072 return NULL;
1073 }
1074
1075
1076 static void
1077 cba_connection_incoming_data(tvbuff_t *tvb _U_, packet_info *pinfo, proto_tree *tree _U_, cba_connection_t *conn)
1078 {
1079 if (conn->packet_first == 0) {
1080 conn->packet_first = pinfo->num;
1081 }
1082
1083 if ( pinfo->num > conn->packet_last &&
1084 cba_packet_in_range(pinfo, conn->packet_connect, conn->packet_disconnect, conn->packet_disconnectme)) {
1085 conn->packet_last = pinfo->num;
1086 }
1087 }
1088
1089
1090 /* dissect a response containing an array of hresults (e.g: ICBAAccoMgt::RemoveConnections) */
1091 static int
1092 dissect_HResultArray_resp(tvbuff_t *tvb, int offset,
1093 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1094 {
1095 uint32_t u32HResult;
1096 uint32_t u32Pointer;
1097 uint32_t u32ArraySize = 0;
1098 uint32_t u32Idx;
1099 uint32_t u32Tmp;
1100
1101
1102 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
1103
1104 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
1105 &u32Pointer);
1106
1107 if (u32Pointer) {
1108 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
1109 &u32ArraySize);
1110
1111 u32Idx = 1;
1112 u32Tmp = u32ArraySize;
1113 while (u32Tmp--) {
1114 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, tree, di, drep,
1115 &u32HResult, u32Idx);
1116 u32Idx++;
1117 }
1118 }
1119
1120 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
1121 &u32HResult);
1122
1123 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u -> %s",
1124 u32ArraySize,
1125 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
1126
1127 return offset;
1128 }
1129
1130
1131 static int
1132 dissect_ICBAAccoServer_SetActivation_resp(tvbuff_t *tvb, int offset,
1133 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1134 {
1135 uint32_t u32HResult;
1136 uint32_t u32Pointer;
1137 uint32_t u32ArraySize = 0;
1138 uint32_t u32Idx;
1139 uint32_t u32Tmp;
1140 proto_item *item;
1141
1142
1143 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
1144
1145 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, false);
1146 proto_item_set_generated(item);
1147 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(1));
1148
1149 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
1150 &u32Pointer);
1151
1152 if (u32Pointer) {
1153 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
1154 &u32ArraySize);
1155
1156 u32Idx = 1;
1157 u32Tmp = u32ArraySize;
1158 while (u32Tmp--) {
1159 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, tree, di, drep,
1160 &u32HResult, u32Idx);
1161 u32Idx++;
1162 }
1163 }
1164
1165 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
1166 &u32HResult);
1167
1168 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u -> %s",
1169 u32ArraySize,
1170 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
1171
1172 return offset;
1173 }
1174
1175
1176 static int
1177 dissect_ICBAAccoServerSRT_Disconnect_resp(tvbuff_t *tvb, int offset,
1178 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1179 {
1180 uint32_t u32HResult;
1181 uint32_t u32Pointer;
1182 uint32_t u32ArraySize = 0;
1183 uint32_t u32Idx;
1184 uint32_t u32Tmp;
1185 proto_item *item;
1186
1187
1188 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
1189
1190 item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, false);
1191 proto_item_set_generated(item);
1192 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(3));
1193
1194 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
1195 &u32Pointer);
1196
1197 if (u32Pointer) {
1198 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
1199 &u32ArraySize);
1200
1201 u32Idx = 1;
1202 u32Tmp = u32ArraySize;
1203 while (u32Tmp--) {
1204 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, tree, di, drep,
1205 &u32HResult, u32Idx);
1206 u32Idx++;
1207 }
1208 }
1209
1210 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
1211 &u32HResult);
1212
1213 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u -> %s",
1214 u32ArraySize,
1215 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
1216
1217 return offset;
1218 }
1219
1220
1221 static int
1222 dissect_ICBAAccoServerSRT_SetActivation_resp(tvbuff_t *tvb, int offset,
1223 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1224 {
1225 uint32_t u32HResult;
1226 uint32_t u32Pointer;
1227 uint32_t u32ArraySize = 0;
1228 uint32_t u32Idx;
1229 uint32_t u32Tmp;
1230 proto_item *item;
1231
1232
1233 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
1234
1235 item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, false);
1236 proto_item_set_generated(item);
1237 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(3));
1238
1239 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
1240 &u32Pointer);
1241
1242 if (u32Pointer) {
1243 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
1244 &u32ArraySize);
1245
1246 u32Idx = 1;
1247 u32Tmp = u32ArraySize;
1248 while (u32Tmp--) {
1249 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, tree, di, drep,
1250 &u32HResult, u32Idx);
1251 u32Idx++;
1252 }
1253 }
1254
1255 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
1256 &u32HResult);
1257
1258 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u -> %s",
1259 u32ArraySize,
1260 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
1261
1262 return offset;
1263 }
1264
1265
1266 static int
1267 dissect_ICBAAccoServer_Connect_rqst(tvbuff_t *tvb, int offset,
1268 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1269 {
1270 uint16_t u16QoSType;
1271 uint16_t u16QoSValue;
1272 uint8_t u8State;
1273 uint32_t u32Count;
1274 uint32_t u32ArraySize;
1275
1276 uint32_t u32VariableOffset;
1277 uint32_t u32SubStart;
1278 uint32_t u32Pointer;
1279 uint16_t u16VarType;
1280 uint32_t u32ConsID;
1281 char szItem[1000] = { 0 };
1282 uint32_t u32MaxItemLen = sizeof(szItem);
1283 char szCons[1000] = { 0 };
1284 uint32_t u32MaxConsLen = sizeof(szCons);
1285 uint32_t u32Idx;
1286
1287 proto_item *item;
1288 dcom_interface_t *cons_interf;
1289 cba_ldev_t *cons_ldev;
1290 cba_ldev_t *prov_ldev;
1291 cba_connection_t *conn;
1292 server_connect_call_t *call;
1293
1294
1295 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
1296
1297 /* get corresponding provider ldev */
1298 prov_ldev = cba_ldev_find(pinfo, &pinfo->net_dst, &di->call_data->object_uuid);
1299
1300 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, true);
1301 proto_item_set_generated(item);
1302 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(2));
1303
1304 offset = dissect_dcom_LPWSTR(tvb, offset, pinfo, tree, di, drep,
1305 hf_cba_acco_conn_consumer, szCons, u32MaxConsLen);
1306
1307 /* find the consumer ldev by its name */
1308 cons_ldev = cba_acco_add(pinfo, szCons);
1309
1310 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
1311 hf_cba_acco_conn_qos_type, &u16QoSType);
1312 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
1313 hf_cba_acco_conn_qos_value, &u16QoSValue);
1314 offset = dissect_dcom_BYTE(tvb, offset, pinfo, tree, di, drep,
1315 hf_cba_acco_conn_state, &u8State);
1316
1317 offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, di, drep, 0, &cons_interf);
1318 if (cons_interf == NULL) {
1319 expert_add_info_format(pinfo, NULL, &ei_cba_acco_conn_consumer,
1320 "Server_Connect: consumer interface invalid");
1321 }
1322
1323 /* "crosslink" consumer interface and its object */
1324 if (cons_interf != NULL && cons_ldev != NULL) {
1325 cba_ldev_link_acco(pinfo, cons_ldev, cons_interf);
1326 }
1327
1328 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
1329 hf_cba_acco_count, &u32Count);
1330
1331 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
1332 &u32ArraySize);
1333
1334 /* link connections infos to the call */
1335 if (prov_ldev != NULL && cons_ldev != NULL) {
1336 call = (server_connect_call_t *)wmem_alloc(wmem_file_scope(), sizeof(server_connect_call_t) + u32ArraySize * sizeof(cba_connection_t *));
1337 call->conn_count = 0;
1338 call->frame = NULL;
1339 call->conns = (cba_connection_t **) (call+1);
1340 di->call_data->private_data = call;
1341 } else{
1342 call = NULL;
1343 }
1344
1345 u32VariableOffset = offset + u32ArraySize*16;
1346
1347 /* array of CONNECTINs */
1348 u32Idx = 1;
1349 while (u32ArraySize--) {
1350 proto_item *sub_item;
1351 proto_tree *sub_tree;
1352
1353 sub_item = proto_tree_add_item(tree, hf_cba_connectin, tvb, offset, 0, ENC_NA);
1354 sub_tree = proto_item_add_subtree(sub_item, ett_cba_connectin);
1355 u32SubStart = offset;
1356
1357 /* ProviderItem */
1358 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
1359 &u32Pointer);
1360 if (u32Pointer) {
1361 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
1362 hf_cba_acco_conn_provider_item, szItem, u32MaxItemLen);
1363 }
1364
1365 /* DataType */
1366 offset = dissect_dcom_VARTYPE(tvb, offset, pinfo, sub_tree, di, drep,
1367 &u16VarType);
1368
1369 /* Epsilon */
1370 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
1371 &u32Pointer);
1372 if (u32Pointer) {
1373 u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
1374 hf_cba_acco_conn_epsilon);
1375 }
1376 /* ConsumerID */
1377 offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
1378 hf_cba_acco_conn_cons_id, &u32ConsID);
1379
1380 /* add to object database */
1381 if (prov_ldev != NULL && cons_ldev != NULL) {
1382 conn = cba_connection_connect(pinfo, cons_ldev, prov_ldev, /*cons_frame*/ NULL,
1383 u16QoSType, u16QoSValue, szItem, u32ConsID, 0,
1384 /* XXX - VarType must be translated to new type description if it includes an array (0x2000) */
1385 (uint16_t *)wmem_memdup(wmem_file_scope(), &u16VarType, 2), 1);
1386
1387 cba_connection_info(tvb, pinfo, sub_tree, conn);
1388 } else {
1389 conn = NULL;
1390 }
1391
1392 /* add to current call */
1393 if (call != NULL) {
1394 call->conn_count++;
1395 call->conns[u32Idx-1] = conn;
1396 }
1397
1398 /* update subtree header */
1399 proto_item_append_text(sub_item, "[%u]: ConsID=0x%x, ProvItem=\"%s\", VarType=%s",
1400 u32Idx, u32ConsID, szItem,
1401 val_to_str(u16VarType, dcom_variant_type_vals, "Unknown (0x%04x)") );
1402 proto_item_set_len(sub_item, offset - u32SubStart);
1403
1404 u32Idx++;
1405 }
1406
1407 col_append_fstr(pinfo->cinfo, COL_INFO, ": Consumer=\"%s\" Cnt=%u", szCons, u32Count);
1408
1409 return u32VariableOffset;
1410 }
1411
1412 static int
1413 dissect_ICBAAccoServer2_Connect2_rqst(tvbuff_t *tvb, int offset,
1414 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1415 {
1416 uint16_t u16QoSType;
1417 uint16_t u16QoSValue;
1418 uint8_t u8State;
1419 uint32_t u32Count;
1420 uint32_t u32ArraySize;
1421
1422 uint32_t u32VariableOffset;
1423 uint32_t u32SubStart;
1424 uint32_t u32Pointer;
1425 uint16_t u16VarType;
1426 uint32_t u32ConsID;
1427 char szItem[1000] = { 0 };
1428 uint32_t u32MaxItemLen = sizeof(szItem);
1429 char szCons[1000] = { 0 };
1430 uint32_t u32MaxConsLen = sizeof(szCons);
1431 uint32_t u32Idx;
1432 uint16_t u16TypeDescLen;
1433 uint32_t u32ArraySize2;
1434 uint32_t u32Idx2;
1435 uint16_t u16VarType2 = -1;
1436
1437 proto_item *item;
1438 dcom_interface_t *cons_interf;
1439 cba_ldev_t *prov_ldev;
1440 cba_ldev_t *cons_ldev;
1441 cba_connection_t *conn;
1442 uint16_t typedesclen = 0;
1443 uint16_t *typedesc = NULL;
1444 server_connect_call_t *call = NULL;
1445
1446
1447 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
1448
1449 /* get corresponding provider ldev */
1450 prov_ldev = cba_ldev_find(pinfo, &pinfo->net_dst, &di->call_data->object_uuid);
1451
1452 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, true);
1453 proto_item_set_generated(item);
1454 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(2));
1455
1456 offset = dissect_dcom_LPWSTR(tvb, offset, pinfo, tree, di, drep,
1457 hf_cba_acco_conn_consumer, szCons, u32MaxConsLen);
1458
1459 /* find the consumer ldev by its name */
1460 cons_ldev = cba_acco_add(pinfo, szCons);
1461
1462 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
1463 hf_cba_acco_conn_qos_type, &u16QoSType);
1464 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
1465 hf_cba_acco_conn_qos_value, &u16QoSValue);
1466 offset = dissect_dcom_BYTE(tvb, offset, pinfo, tree, di, drep,
1467 hf_cba_acco_conn_state, &u8State);
1468
1469 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep, &u32Pointer);
1470
1471 if (u32Pointer) {
1472 offset = dissect_dcom_MInterfacePointer(tvb, offset, pinfo, tree, di, drep, 0, &cons_interf);
1473 if (cons_interf == NULL) {
1474 expert_add_info_format(pinfo, NULL, &ei_cba_acco_conn_consumer,
1475 "Server2_Connect2: consumer interface invalid");
1476 }
1477 } else {
1478 /* GetConnectionData do it this way */
1479 cons_interf = NULL;
1480 }
1481
1482 /* "crosslink" consumer interface and its object */
1483 if (cons_interf != NULL && cons_ldev != NULL) {
1484 cba_ldev_link_acco(pinfo, cons_ldev, cons_interf);
1485 }
1486
1487 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
1488 hf_cba_acco_count, &u32Count);
1489
1490 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
1491 &u32ArraySize);
1492
1493 /* link connection infos to the call */
1494 if (prov_ldev != NULL && cons_ldev != NULL) {
1495 call = (server_connect_call_t *)wmem_alloc(wmem_file_scope(), sizeof(server_connect_call_t) + u32ArraySize * sizeof(cba_connection_t *));
1496 call->conn_count = 0;
1497 call->frame = NULL;
1498 call->conns = (cba_connection_t **) (call+1);
1499 di->call_data->private_data = call;
1500 } else{
1501 call = NULL;
1502 }
1503
1504 u32VariableOffset = offset + u32ArraySize*20;
1505
1506 /* array of CONNECTINs */
1507 u32Idx = 1;
1508 while (u32ArraySize--) {
1509 proto_item *sub_item;
1510 proto_tree *sub_tree;
1511
1512 sub_item = proto_tree_add_item(tree, hf_cba_connectin, tvb, offset, 0, ENC_NA);
1513 sub_tree = proto_item_add_subtree(sub_item, ett_cba_connectin);
1514 u32SubStart = offset;
1515
1516 /* ProviderItem */
1517 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
1518 &u32Pointer);
1519 if (u32Pointer) {
1520 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
1521 hf_cba_acco_conn_provider_item, szItem, u32MaxItemLen);
1522 }
1523
1524 /* TypeDescLen */
1525 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
1526 hf_cba_type_desc_len, &u16TypeDescLen);
1527
1528 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
1529 &u32Pointer);
1530 /* pTypeDesc */
1531 if (u32Pointer) {
1532 u32VariableOffset = dissect_dcom_dcerpc_array_size(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
1533 &u32ArraySize2);
1534
1535 /* limit the allocation to a reasonable size */
1536 if (u32ArraySize2 < 1000) {
1537 typedesc = (uint16_t *)wmem_alloc0(wmem_file_scope(), u32ArraySize2 * 2);
1538 typedesclen = u32ArraySize2;
1539 } else {
1540 typedesc = NULL;
1541 typedesclen = 0;
1542 }
1543
1544 /* extended type description will build an array here */
1545 u32Idx2 = 1;
1546 while (u32ArraySize2--) {
1547 /* ToBeDone: some of the type description values are counts */
1548 u32VariableOffset = dissect_dcom_VARTYPE(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
1549 &u16VarType);
1550
1551 if (typedesc != NULL && u32Idx2 <= typedesclen) {
1552 typedesc[u32Idx2-1] = u16VarType;
1553 }
1554
1555 /* remember first VarType only */
1556 if (u32Idx2 == 1) {
1557 u16VarType2 = u16VarType;
1558 }
1559 u32Idx2++;
1560 }
1561 }
1562
1563 /* Epsilon */
1564 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
1565 &u32Pointer);
1566 if (u32Pointer) {
1567 u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
1568 hf_cba_acco_conn_epsilon);
1569 }
1570 /* ConsumerID */
1571 offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
1572 hf_cba_acco_conn_cons_id, &u32ConsID);
1573
1574 /* add to object database */
1575 if (prov_ldev != NULL && cons_ldev != NULL) {
1576 conn = cba_connection_connect(pinfo, cons_ldev, prov_ldev, /*cons_frame*/ NULL,
1577 u16QoSType, u16QoSValue, szItem, u32ConsID, 0,
1578 typedesc, typedesclen);
1579
1580 cba_connection_info(tvb, pinfo, sub_tree, conn);
1581 } else {
1582 conn = NULL;
1583 }
1584
1585 /* add to current call */
1586 if (call != NULL) {
1587 call->conn_count++;
1588 call->conns[u32Idx-1] = conn;
1589 }
1590
1591 /* update subtree header */
1592 proto_item_append_text(sub_item, "[%u]: ConsID=0x%x, ProvItem=\"%s\", TypeDesc=%s",
1593 u32Idx, u32ConsID, szItem,
1594 val_to_str(u16VarType2, dcom_variant_type_vals, "Unknown (0x%04x)") );
1595 proto_item_set_len(sub_item, offset - u32SubStart);
1596
1597 u32Idx++;
1598 }
1599
1600 col_append_fstr(pinfo->cinfo, COL_INFO, ": Consumer=\"%s\" Cnt=%u", szCons, u32Count);
1601
1602
1603 return u32VariableOffset;
1604 }
1605
1606
1607 static int
1608 dissect_ICBAAccoServer_Connect_resp(tvbuff_t *tvb, int offset,
1609 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1610 {
1611 uint8_t u8FirstConnect;
1612 uint32_t u32Pointer;
1613 uint32_t u32ArraySize = 0;
1614 uint32_t u32HResult;
1615 uint32_t u32Idx = 1;
1616 uint32_t u32ProvID;
1617 uint32_t u32SubStart;
1618
1619 proto_item *item;
1620 cba_connection_t *conn;
1621 server_connect_call_t *call = (server_connect_call_t *)di->call_data->private_data;
1622
1623
1624 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
1625
1626 if (call == NULL) {
1627 expert_add_info(pinfo, NULL, &ei_cba_acco_no_request_info);
1628 }
1629
1630 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, false);
1631 proto_item_set_generated(item);
1632 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(1));
1633
1634 offset = dissect_dcom_BOOLEAN(tvb, offset, pinfo, tree, di, drep,
1635 hf_cba_acco_server_first_connect, &u8FirstConnect);
1636
1637 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
1638 &u32Pointer);
1639
1640 if (u32Pointer) {
1641 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
1642 &u32ArraySize);
1643
1644 /* array of CONNECTOUTs */
1645 while(u32ArraySize--) {
1646 proto_item *sub_item;
1647 proto_tree *sub_tree;
1648
1649 sub_item = proto_tree_add_item(tree, hf_cba_connectout, tvb, offset, 8, ENC_NA);
1650 sub_tree = proto_item_add_subtree(sub_item, ett_cba_connectout);
1651 u32SubStart = offset;
1652
1653 offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
1654 hf_cba_acco_conn_prov_id, &u32ProvID);
1655
1656 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, sub_tree, di, drep,
1657 &u32HResult, u32Idx);
1658
1659 /* put response data into the connection */
1660 if (call && u32Idx <= call->conn_count) {
1661 conn = call->conns[u32Idx-1];
1662 conn->provid = u32ProvID;
1663 conn->connret = u32HResult;
1664
1665 cba_connection_info(tvb, pinfo, sub_tree, conn);
1666 }
1667
1668 proto_item_append_text(sub_item, "[%u]: ProvID=0x%x %s",
1669 u32Idx, u32ProvID,
1670 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
1671 proto_item_set_len(sub_item, offset - u32SubStart);
1672
1673 u32Idx++;
1674 }
1675 }
1676
1677 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
1678 &u32HResult);
1679
1680 /* this might be a global HRESULT */
1681 while(call && u32Idx <= call->conn_count) {
1682 conn = call->conns[u32Idx-1];
1683 conn->provid = 0;
1684 conn->connret = u32HResult;
1685 u32Idx++;
1686 }
1687
1688 col_append_fstr(pinfo->cinfo, COL_INFO, ": %s Cnt=%u -> %s",
1689 (u8FirstConnect) ? "First" : "NotFirst",
1690 u32Idx-1,
1691 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
1692
1693 return offset;
1694 }
1695
1696
1697 static int
1698 dissect_ICBAAccoServer_Disconnect_rqst(tvbuff_t *tvb, int offset,
1699 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1700 {
1701 uint32_t u32Count;
1702 uint32_t u32ArraySize;
1703 uint32_t u32Idx;
1704 uint32_t u32ProvID;
1705
1706 proto_item *item;
1707 cba_ldev_t *prov_ldev;
1708 cba_connection_t *conn;
1709 server_connect_call_t *call;
1710
1711
1712 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
1713
1714 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, true);
1715 proto_item_set_generated(item);
1716 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(2));
1717
1718 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
1719 hf_cba_acco_count, &u32Count);
1720
1721 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
1722 &u32ArraySize);
1723
1724 prov_ldev = cba_ldev_find(pinfo, &pinfo->net_dst, &di->call_data->object_uuid);
1725
1726 /* link connection infos to the call */
1727 if (prov_ldev != NULL) {
1728 call = (server_connect_call_t *)wmem_alloc(wmem_file_scope(), sizeof(server_connect_call_t) + u32ArraySize * sizeof(cba_connection_t *));
1729 call->conn_count = 0;
1730 call->frame = NULL;
1731 call->conns = (cba_connection_t **) (call+1);
1732 di->call_data->private_data = call;
1733 } else{
1734 call = NULL;
1735 }
1736
1737 u32Idx = 1;
1738 while (u32ArraySize--) {
1739 offset = dissect_dcom_indexed_DWORD(tvb, offset, pinfo, tree, di, drep,
1740 hf_cba_acco_conn_prov_id, &u32ProvID, u32Idx);
1741
1742 /* add to current call */
1743 if (call != NULL) {
1744 conn = cba_connection_find_by_provid(tvb, pinfo, tree, prov_ldev, u32ProvID);
1745 call->conn_count++;
1746 call->conns[u32Idx-1] = conn;
1747 }
1748
1749 u32Idx++;
1750 }
1751
1752 /* update column info now */
1753 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count);
1754
1755
1756 return offset;
1757 }
1758
1759
1760 static int
1761 dissect_ICBAAccoServer_Disconnect_resp(tvbuff_t *tvb, int offset,
1762 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1763 {
1764 uint32_t u32HResult;
1765 uint32_t u32Pointer;
1766 uint32_t u32ArraySize = 0;
1767 uint32_t u32Idx;
1768 uint32_t u32Tmp;
1769
1770 proto_item *item;
1771 cba_connection_t *conn;
1772 server_connect_call_t *call = (server_connect_call_t *)di->call_data->private_data;
1773
1774
1775 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
1776
1777 if (call == NULL) {
1778 expert_add_info(pinfo, NULL, &ei_cba_acco_no_request_info);
1779 }
1780
1781 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, false);
1782 proto_item_set_generated(item);
1783 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(1));
1784
1785 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
1786 &u32Pointer);
1787
1788 if (u32Pointer) {
1789 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
1790 &u32ArraySize);
1791
1792 u32Idx = 1;
1793 u32Tmp = u32ArraySize;
1794 while (u32Tmp--) {
1795 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, tree, di, drep,
1796 &u32HResult, u32Idx);
1797
1798 /* mark this connection as disconnected */
1799 if (call && u32Idx <= call->conn_count) {
1800 conn = call->conns[u32Idx-1];
1801 if (conn != NULL) {
1802 cba_connection_disconnect(pinfo, conn);
1803 }
1804 }
1805
1806 u32Idx++;
1807 }
1808 }
1809
1810 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
1811 &u32HResult);
1812
1813 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u -> %s",
1814 u32ArraySize,
1815 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
1816
1817 return offset;
1818 }
1819
1820
1821 static int
1822 dissect_ICBAAccoServerSRT_Disconnect_rqst(tvbuff_t *tvb, int offset,
1823 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1824 {
1825 uint32_t u32Count;
1826 uint32_t u32ArraySize;
1827 uint32_t u32Idx;
1828 uint32_t u32ProvID;
1829 proto_item *item;
1830
1831
1832 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
1833
1834 item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, true);
1835 proto_item_set_generated(item);
1836 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(4));
1837
1838 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
1839 hf_cba_acco_count, &u32Count);
1840
1841 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
1842 &u32ArraySize);
1843
1844 u32Idx = 1;
1845 while (u32ArraySize--) {
1846 offset = dissect_dcom_indexed_DWORD(tvb, offset, pinfo, tree, di, drep,
1847 hf_cba_acco_conn_prov_id, &u32ProvID, u32Idx);
1848 u32Idx++;
1849 }
1850
1851 /* update column info now */
1852 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count);
1853
1854 return offset;
1855 }
1856
1857
1858 static int
1859 dissect_ICBAAccoServer_DisconnectMe_rqst(tvbuff_t *tvb, int offset,
1860 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1861 {
1862 char szStr[1000];
1863 uint32_t u32MaxStr = sizeof(szStr);
1864 proto_item *item;
1865 cba_ldev_t *prov_ldev;
1866 cba_ldev_t *cons_ldev;
1867 server_disconnectme_call_t *call;
1868
1869
1870 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
1871
1872 /* get corresponding provider ldev */
1873 prov_ldev = cba_ldev_find(pinfo, &pinfo->net_dst, &di->call_data->object_uuid);
1874
1875 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, true);
1876 proto_item_set_generated(item);
1877 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(2));
1878
1879 offset = dissect_dcom_LPWSTR(tvb, offset, pinfo, tree, di, drep,
1880 hf_cba_acco_conn_consumer, szStr, u32MaxStr);
1881
1882 /* find the consumer ldev by its name */
1883 cons_ldev = cba_acco_add(pinfo, szStr);
1884
1885 if (prov_ldev != NULL && cons_ldev != NULL) {
1886 call = wmem_new(wmem_file_scope(), server_disconnectme_call_t);
1887 call->cons = cons_ldev;
1888 call->prov = prov_ldev;
1889 di->call_data->private_data = call;
1890 }
1891
1892 /* update column info now */
1893 col_append_fstr(pinfo->cinfo, COL_INFO, " Consumer=\"%s\"", szStr);
1894
1895 return offset;
1896 }
1897
1898
1899 static int
1900 dissect_ICBAAccoServer_DisconnectMe_resp(tvbuff_t *tvb, int offset,
1901 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1902 {
1903 uint32_t u32HResult;
1904 proto_item *item;
1905 server_disconnectme_call_t *call;
1906
1907
1908 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
1909
1910 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, false);
1911 proto_item_set_generated(item);
1912 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(1));
1913
1914 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
1915 &u32HResult);
1916
1917 call = (server_disconnectme_call_t *)di->call_data->private_data;
1918 if (call) {
1919 cba_connection_disconnectme(tvb, pinfo, tree, call->cons, call->prov);
1920 }
1921
1922 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
1923 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
1924
1925 return offset;
1926 }
1927
1928
1929 static int
1930 dissect_ICBAAccoServerSRT_DisconnectMe_rqst(tvbuff_t *tvb, int offset,
1931 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1932 {
1933 char szStr[1000];
1934 uint32_t u32MaxStr = sizeof(szStr);
1935 proto_item *item;
1936 cba_ldev_t *prov_ldev;
1937 cba_ldev_t *cons_ldev;
1938 server_disconnectme_call_t *call;
1939
1940
1941 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
1942
1943 /* get corresponding provider ldev */
1944 prov_ldev = cba_ldev_find(pinfo, &pinfo->net_dst, &di->call_data->object_uuid);
1945
1946 item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, true);
1947 proto_item_set_generated(item);
1948 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(4));
1949
1950 offset = dissect_dcom_LPWSTR(tvb, offset, pinfo, tree, di, drep,
1951 hf_cba_acco_conn_consumer, szStr, u32MaxStr);
1952
1953 /* find the consumer ldev by its name */
1954 cons_ldev = cba_acco_add(pinfo, szStr);
1955
1956 if (prov_ldev != NULL && cons_ldev != NULL) {
1957 call = wmem_new(wmem_file_scope(), server_disconnectme_call_t);
1958 call->cons = cons_ldev;
1959 call->prov = prov_ldev;
1960 di->call_data->private_data = call;
1961 }
1962
1963 /* update column info now */
1964 col_append_fstr(pinfo->cinfo, COL_INFO, " Consumer=\"%s\"", szStr);
1965
1966 return offset;
1967 }
1968
1969
1970 static int
1971 dissect_ICBAAccoServerSRT_DisconnectMe_resp(tvbuff_t *tvb, int offset,
1972 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1973 {
1974 uint32_t u32HResult;
1975 proto_item *item;
1976 server_disconnectme_call_t *call;
1977
1978
1979 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
1980
1981 item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, false);
1982 proto_item_set_generated(item);
1983 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(3));
1984
1985 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
1986 &u32HResult);
1987
1988 call = (server_disconnectme_call_t *)di->call_data->private_data;
1989 if (call) {
1990 cba_frame_disconnectme(tvb, pinfo, tree, call->cons, call->prov);
1991 }
1992
1993 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
1994 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
1995
1996 return offset;
1997 }
1998
1999
2000 static int
2001 dissect_ICBAAccoServer_Ping_resp(tvbuff_t *tvb, int offset,
2002 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
2003 {
2004 uint32_t u32HResult;
2005 proto_item *item;
2006
2007
2008 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
2009
2010 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, false);
2011 proto_item_set_generated(item);
2012 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(1));
2013
2014 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
2015 &u32HResult);
2016
2017 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
2018 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
2019
2020 return offset;
2021 }
2022
2023
2024 static int
2025 dissect_ICBAAccoServer_SetActivation_rqst(tvbuff_t *tvb, int offset,
2026 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
2027 {
2028 uint8_t u8State;
2029 uint32_t u32Count;
2030 uint32_t u32ArraySize;
2031 uint32_t u32Idx;
2032 uint32_t u32ProvID;
2033 proto_item *item;
2034
2035
2036 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
2037
2038 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, true);
2039 proto_item_set_generated(item);
2040 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(2));
2041
2042 offset = dissect_dcom_BOOLEAN(tvb, offset, pinfo, tree, di, drep,
2043 hf_cba_acco_conn_state, &u8State);
2044
2045 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
2046 hf_cba_acco_count, &u32Count);
2047
2048 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
2049 &u32ArraySize);
2050
2051 u32Idx = 1;
2052 while (u32ArraySize--) {
2053 offset = dissect_dcom_indexed_DWORD(tvb, offset, pinfo, tree, di, drep,
2054 hf_cba_acco_conn_prov_id, &u32ProvID, u32Idx);
2055 u32Idx++;
2056 }
2057
2058 /* update column info now */
2059
2060 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count);
2061
2062 return offset;
2063 }
2064
2065
2066 static int
2067 dissect_ICBAAccoServerSRT_SetActivation_rqst(tvbuff_t *tvb, int offset,
2068 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
2069 {
2070 uint8_t u8State;
2071 uint32_t u32Count;
2072 uint32_t u32ArraySize;
2073 uint32_t u32Idx;
2074 uint32_t u32ProvID;
2075 proto_item *item;
2076
2077
2078 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
2079
2080 item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, true);
2081 proto_item_set_generated(item);
2082 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(4));
2083
2084 offset = dissect_dcom_BOOLEAN(tvb, offset, pinfo, tree, di, drep,
2085 hf_cba_acco_conn_state, &u8State);
2086
2087 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
2088 hf_cba_acco_count, &u32Count);
2089
2090 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
2091 &u32ArraySize);
2092
2093 u32Idx = 1;
2094 while (u32ArraySize--) {
2095 offset = dissect_dcom_indexed_DWORD(tvb, offset, pinfo, tree, di, drep,
2096 hf_cba_acco_conn_prov_id, &u32ProvID, u32Idx);
2097 u32Idx++;
2098 }
2099
2100 /* update column info now */
2101 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count);
2102
2103 return offset;
2104 }
2105
2106
2107 static int
2108 dissect_ICBAAccoServer_Ping_rqst(tvbuff_t *tvb, int offset,
2109 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
2110 {
2111 char szStr[1000];
2112 uint32_t u32MaxStr = sizeof(szStr);
2113 proto_item *item;
2114
2115
2116 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
2117
2118 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, true);
2119 proto_item_set_generated(item);
2120 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(2));
2121
2122 offset = dissect_dcom_LPWSTR(tvb, offset, pinfo, tree, di, drep,
2123 hf_cba_acco_conn_consumer, szStr, u32MaxStr);
2124
2125 /* update column info now */
2126 col_append_fstr(pinfo->cinfo, COL_INFO, " Consumer=\"%s\"", szStr);
2127
2128 return offset;
2129 }
2130
2131
2132 static int
2133 dissect_ICBAAccoServerSRT_ConnectCR_rqst(tvbuff_t *tvb, int offset,
2134 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
2135 {
2136 char szCons[1000] = { 0 };
2137 uint32_t u32MaxConsLen = sizeof(szCons);
2138 uint16_t u16QoSType;
2139 uint16_t u16QoSValue;
2140 uint8_t u8ConsMac[6];
2141 uint16_t u16CRID = 0;
2142 uint16_t u16CRLength = 0;
2143 uint32_t u32Flags;
2144 uint32_t u32Count;
2145 uint32_t u32ArraySize;
2146 uint32_t u32Idx;
2147 proto_item *item;
2148 proto_tree *flags_tree;
2149 uint32_t u32SubStart;
2150 dcom_interface_t *cons_interf;
2151 cba_ldev_t *prov_ldev;
2152 cba_ldev_t *cons_ldev;
2153 cba_frame_t *frame;
2154 server_frame_call_t *call;
2155
2156
2157 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
2158
2159 /* get corresponding provider ldev */
2160 prov_ldev = cba_ldev_find(pinfo, &pinfo->net_dst, &di->call_data->object_uuid);
2161
2162 item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, true);
2163 proto_item_set_generated(item);
2164 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(4));
2165
2166 /* szCons */
2167 offset = dissect_dcom_LPWSTR(tvb, offset, pinfo, tree, di, drep,
2168 hf_cba_acco_conn_consumer, szCons, u32MaxConsLen);
2169
2170 /* find the consumer ldev by its name */
2171 cons_ldev = cba_acco_add(pinfo, szCons);
2172
2173 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
2174 hf_cba_acco_conn_qos_type, &u16QoSType);
2175 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
2176 hf_cba_acco_conn_qos_value, &u16QoSValue);
2177
2178 offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, di, drep, 0, &cons_interf);
2179 if (cons_interf == NULL) {
2180 expert_add_info_format(pinfo, NULL, &ei_cba_acco_conn_consumer,
2181 "ServerSRT_ConnectCR: consumer interface invalid");
2182 }
2183
2184 /* "crosslink" consumer interface and its object */
2185 if (cons_interf != NULL && cons_ldev != NULL) {
2186 cba_ldev_link_acco(pinfo, cons_ldev, cons_interf);
2187 }
2188
2189 /* ConsumerMAC (big-endian, 1byte-aligned) */
2190 tvb_memcpy(tvb, u8ConsMac, offset, 6);
2191
2192 proto_tree_add_ether(tree, hf_cba_acco_serversrt_cons_mac, tvb,
2193 offset, 6, u8ConsMac);
2194 offset += 6;
2195
2196 /* add flags subtree */
2197 offset = dissect_dcom_DWORD(tvb, offset, pinfo, NULL /*tree*/, di, drep,
2198 0 /* hfindex */, &u32Flags);
2199 offset -= 4;
2200 item = proto_tree_add_uint_format_value(tree, hf_cba_acco_serversrt_cr_flags,
2201 tvb, offset, 4, u32Flags,
2202 "0x%02x (%s, %s)", u32Flags,
2203 (u32Flags & 0x2) ? "Reconfigure" : "not Reconfigure",
2204 (u32Flags & 0x1) ? "Timestamped" : "not Timestamped");
2205 flags_tree = proto_item_add_subtree(item, ett_cba_acco_serversrt_cr_flags);
2206 proto_tree_add_boolean(flags_tree, hf_cba_acco_serversrt_cr_flags_reconfigure, tvb, offset, 4, u32Flags);
2207 proto_tree_add_boolean(flags_tree, hf_cba_acco_serversrt_cr_flags_timestamped, tvb, offset, 4, u32Flags);
2208 offset += 4;
2209
2210 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
2211 hf_cba_acco_count, &u32Count);
2212
2213 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
2214 &u32ArraySize);
2215
2216 /* link frame infos to the call */
2217 if (prov_ldev != NULL && cons_ldev != NULL && u32ArraySize < 100) {
2218 call = (server_frame_call_t *)wmem_alloc(wmem_file_scope(), sizeof(server_frame_call_t) + u32ArraySize * sizeof(cba_frame_t *));
2219 call->frame_count = 0;
2220 call->frames = (cba_frame_t **) (call+1);
2221 di->call_data->private_data = call;
2222 } else {
2223 call = NULL;
2224 }
2225
2226 u32Idx = 1;
2227 while (u32ArraySize--) {
2228 proto_item *sub_item;
2229 proto_tree *sub_tree;
2230
2231 /* array of CONNECTINCRs */
2232 sub_item = proto_tree_add_item(tree, hf_cba_connectincr, tvb, offset, 0, ENC_NA);
2233 sub_tree = proto_item_add_subtree(sub_item, ett_cba_connectincr);
2234 u32SubStart = offset;
2235
2236 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
2237 hf_cba_acco_serversrt_cr_id, &u16CRID);
2238
2239 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
2240 hf_cba_acco_serversrt_cr_length, &u16CRLength);
2241
2242 /* add to object database */
2243 if (prov_ldev != NULL && cons_ldev != NULL) {
2244 frame = cba_frame_connect(pinfo, cons_ldev, prov_ldev, u16QoSType, u16QoSValue, u8ConsMac, u16CRID, u16CRLength);
2245
2246 cba_frame_info(tvb, pinfo, sub_tree, frame);
2247 } else {
2248 frame = NULL;
2249 }
2250
2251 /* add to current call */
2252 if (call != NULL) {
2253 call->frame_count++;
2254 call->frames[u32Idx-1] = frame;
2255 }
2256
2257 /* update subtree header */
2258 proto_item_append_text(sub_item, "[%u]: CRID=0x%x, CRLength=%u",
2259 u32Idx, u16CRID, u16CRLength);
2260 proto_item_set_len(sub_item, offset - u32SubStart);
2261
2262 u32Idx++;
2263 }
2264
2265
2266 /* update column info now */
2267 col_append_fstr(pinfo->cinfo, COL_INFO, ": %sConsCRID=0x%x Len=%u QoS=%u",
2268 (u32Flags & 0x2) ? "Reco " : "", u16CRID, u16CRLength, u16QoSValue);
2269
2270 return offset;
2271 }
2272
2273
2274 static int
2275 dissect_ICBAAccoServerSRT_ConnectCR_resp(tvbuff_t *tvb, int offset,
2276 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
2277 {
2278 uint8_t u8FirstConnect;
2279 uint8_t u8ProvMac[6];
2280 uint32_t u32ProvCRID = 0;
2281 uint32_t u32HResult;
2282 uint32_t u32ArraySize;
2283 uint32_t u32Idx = 1;
2284 uint32_t u32Pointer;
2285 uint32_t u32SubStart;
2286 proto_item *item;
2287 cba_frame_t *frame;
2288 server_frame_call_t *call = (server_frame_call_t *)di->call_data->private_data;
2289
2290
2291 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
2292
2293 if (call == NULL) {
2294 expert_add_info(pinfo, NULL, &ei_cba_acco_no_request_info);
2295 }
2296
2297 item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, false);
2298 proto_item_set_generated(item);
2299 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(3));
2300
2301 offset = dissect_dcom_BOOLEAN(tvb, offset, pinfo, tree, di, drep,
2302 hf_cba_acco_server_first_connect, &u8FirstConnect);
2303
2304 /* ProviderMAC (big-endian, 1byte-aligned) */
2305 tvb_memcpy(tvb, u8ProvMac, offset, 6);
2306
2307 proto_tree_add_ether(tree, hf_cba_acco_serversrt_prov_mac, tvb,
2308 offset, 6, u8ProvMac);
2309 offset += 6;
2310
2311
2312 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
2313 &u32Pointer);
2314 if (u32Pointer) {
2315
2316 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
2317 &u32ArraySize);
2318
2319 while (u32ArraySize--) {
2320 proto_item *sub_item;
2321 proto_tree *sub_tree;
2322
2323 /* array of CONNECTOUTCRs */
2324 sub_item = proto_tree_add_item(tree, hf_cba_connectoutcr, tvb, offset, 0, ENC_NA);
2325 sub_tree = proto_item_add_subtree(sub_item, ett_cba_connectoutcr);
2326 u32SubStart = offset;
2327
2328 offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
2329 hf_cba_acco_prov_crid, &u32ProvCRID);
2330
2331 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, sub_tree, di, drep,
2332 &u32HResult);
2333
2334 /* put response data into the frame */
2335 if (call && u32Idx <= call->frame_count) {
2336 frame = call->frames[u32Idx-1];
2337 frame->provcrid = u32ProvCRID;
2338 frame->conncrret = u32HResult;
2339
2340 cba_frame_info(tvb, pinfo, sub_tree, frame);
2341 }
2342
2343 /* update subtree header */
2344 proto_item_append_text(sub_item, "[%u]: ProvCRID=0x%x, %s",
2345 u32Idx, u32ProvCRID,
2346 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
2347 proto_item_set_len(sub_item, offset - u32SubStart);
2348
2349 u32Idx++;
2350 }
2351 }
2352
2353 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
2354 &u32HResult);
2355
2356 /* this might be a global HRESULT */
2357 while(call && u32Idx <= call->frame_count) {
2358 frame = call->frames[u32Idx-1];
2359 frame->provcrid = 0;
2360 frame->conncrret = u32HResult;
2361 u32Idx++;
2362 }
2363
2364 col_append_fstr(pinfo->cinfo, COL_INFO, ": %s PCRID=0x%x -> %s",
2365 (u8FirstConnect) ? "FirstCR" : "NotFirstCR",
2366 u32ProvCRID,
2367 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
2368
2369 return offset;
2370 }
2371
2372
2373 static int
2374 dissect_ICBAAccoServerSRT_DisconnectCR_rqst(tvbuff_t *tvb, int offset,
2375 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
2376 {
2377 uint32_t u32Count;
2378 uint32_t u32ArraySize;
2379 uint32_t u32Idx;
2380 uint32_t u32ProvCRID = 0;
2381 proto_item *item;
2382 cba_ldev_t *prov_ldev;
2383 cba_frame_t *frame;
2384 server_frame_call_t *call;
2385
2386
2387 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
2388
2389 /* get corresponding provider ldev */
2390 prov_ldev = cba_ldev_find(pinfo, &pinfo->net_dst, &di->call_data->object_uuid);
2391
2392 item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, true);
2393 proto_item_set_generated(item);
2394 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(4));
2395
2396 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
2397 hf_cba_acco_count, &u32Count);
2398
2399 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
2400 &u32ArraySize);
2401
2402 /* link frame infos to the call */
2403 if (prov_ldev != NULL) {
2404 call = (server_frame_call_t *)wmem_alloc(wmem_file_scope(), sizeof(server_frame_call_t) + u32ArraySize * sizeof(cba_frame_t *));
2405 call->frame_count = 0;
2406 call->frames = (cba_frame_t **) (call+1);
2407 di->call_data->private_data = call;
2408 } else{
2409 call = NULL;
2410 }
2411
2412 u32Idx = 1;
2413 while (u32ArraySize--) {
2414 offset = dissect_dcom_indexed_DWORD(tvb, offset, pinfo, tree, di, drep,
2415 hf_cba_acco_prov_crid, &u32ProvCRID, u32Idx);
2416
2417 /* find frame and add it to current call */
2418 if (call != NULL) {
2419 frame = cba_frame_find_by_provcrid(pinfo, prov_ldev, u32ProvCRID);
2420 call->frame_count++;
2421 call->frames[u32Idx-1] = frame;
2422 }
2423
2424 u32Idx++;
2425 }
2426
2427 /* update column info now */
2428 col_append_fstr(pinfo->cinfo, COL_INFO, ": PCRID=0x%x",
2429 u32ProvCRID);
2430
2431 return offset;
2432 }
2433
2434
2435 static int
2436 dissect_ICBAAccoServerSRT_DisconnectCR_resp(tvbuff_t *tvb, int offset,
2437 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
2438 {
2439 uint32_t u32HResult;
2440 uint32_t u32Pointer;
2441 uint32_t u32ArraySize = 0;
2442 uint32_t u32Idx;
2443 uint32_t u32Tmp;
2444 cba_frame_t *frame;
2445 proto_item *item;
2446 server_frame_call_t *call = (server_frame_call_t *)di->call_data->private_data;
2447
2448
2449 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
2450
2451 item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, false);
2452 proto_item_set_generated(item);
2453 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(3));
2454
2455 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
2456 &u32Pointer);
2457
2458 if (u32Pointer) {
2459 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
2460 &u32ArraySize);
2461
2462 u32Idx = 1;
2463 u32Tmp = u32ArraySize;
2464 while (u32Tmp--) {
2465 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, tree, di, drep,
2466 &u32HResult, u32Idx);
2467 /* put response data into the frame */
2468 if (call && u32Idx <= call->frame_count) {
2469 frame = call->frames[u32Idx-1];
2470 if (frame != NULL) {
2471 cba_frame_disconnect(pinfo, frame);
2472 }
2473 }
2474
2475 u32Idx++;
2476 }
2477 }
2478
2479 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
2480 &u32HResult);
2481
2482 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
2483 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
2484
2485 return offset;
2486 }
2487
2488
2489 static int
2490 dissect_ICBAAccoServerSRT_Connect_rqst(tvbuff_t *tvb, int offset,
2491 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
2492 {
2493 uint32_t u32ProvCRID;
2494 uint8_t u8State;
2495 uint8_t u8LastConnect;
2496 uint32_t u32Count;
2497 uint32_t u32ArraySize;
2498 uint32_t u32VariableOffset;
2499 uint32_t u32Idx;
2500 uint32_t u32SubStart;
2501 uint32_t u32Pointer;
2502 char szProvItem[1000] = { 0 };
2503 uint32_t u32MaxProvItemLen = sizeof(szProvItem);
2504 uint16_t u16TypeDescLen;
2505 uint32_t u32ArraySize2;
2506 uint32_t u32Idx2;
2507 uint16_t u16VarType2 = -1;
2508 uint16_t u16VarType;
2509 uint32_t u32ConsID;
2510 uint16_t u16RecordLength;
2511
2512 proto_item *item;
2513 cba_ldev_t *prov_ldev;
2514 cba_frame_t *frame = NULL;
2515 uint16_t typedesclen = 0;
2516 uint16_t *typedesc = NULL;
2517
2518 cba_connection_t *conn;
2519 server_connect_call_t *call;
2520
2521
2522 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
2523
2524 /* get corresponding provider ldev */
2525 prov_ldev = cba_ldev_find(pinfo, &pinfo->net_dst, &di->call_data->object_uuid);
2526
2527 item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, true);
2528 proto_item_set_generated(item);
2529 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(4));
2530
2531 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
2532 hf_cba_acco_prov_crid, &u32ProvCRID);
2533
2534 frame = cba_frame_find_by_provcrid(pinfo, prov_ldev, u32ProvCRID);
2535
2536 if (frame != NULL) {
2537 cba_frame_info(tvb, pinfo, tree, frame);
2538 }
2539
2540 offset = dissect_dcom_BYTE(tvb, offset, pinfo, tree, di, drep,
2541 hf_cba_acco_conn_state, &u8State);
2542
2543 offset = dissect_dcom_BYTE(tvb, offset, pinfo, tree, di, drep,
2544 hf_cba_acco_serversrt_last_connect, &u8LastConnect);
2545
2546
2547 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
2548 hf_cba_acco_count, &u32Count);
2549
2550 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
2551 &u32ArraySize);
2552
2553 /* link connections infos to the call */
2554 if (frame != NULL) {
2555 call = (server_connect_call_t *)wmem_alloc(wmem_file_scope(), sizeof(server_connect_call_t) + u32ArraySize * sizeof(cba_connection_t *));
2556 call->conn_count = 0;
2557 call->frame = frame;
2558 call->conns = (cba_connection_t **) (call+1);
2559 di->call_data->private_data = call;
2560 } else{
2561 call = NULL;
2562 }
2563
2564 u32VariableOffset = offset + u32ArraySize*20;
2565
2566 u32Idx = 1;
2567 while (u32ArraySize--) {
2568 proto_item *sub_item;
2569 proto_tree *sub_tree;
2570
2571 /* array of CONNECTINs */
2572 sub_item = proto_tree_add_item(tree, hf_cba_connectin, tvb, offset, 0, ENC_NA);
2573 sub_tree = proto_item_add_subtree(sub_item, ett_cba_connectin);
2574 u32SubStart = offset;
2575
2576 /* ProviderItem */
2577 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
2578 &u32Pointer);
2579 if (u32Pointer) {
2580 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
2581 hf_cba_acco_conn_provider_item, szProvItem, u32MaxProvItemLen);
2582 }
2583
2584 /* TypeDescLen */
2585 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
2586 hf_cba_type_desc_len, &u16TypeDescLen);
2587
2588 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
2589 &u32Pointer);
2590 /* pTypeDesc */
2591 if (u32Pointer) {
2592 u32VariableOffset = dissect_dcom_dcerpc_array_size(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
2593 &u32ArraySize2);
2594
2595 typedesc = (uint16_t *)wmem_alloc0(wmem_file_scope(), u32ArraySize2 * 2);
2596 typedesclen = u32ArraySize2;
2597
2598 /* extended type description will build an array here */
2599 u32Idx2 = 1;
2600 while (u32ArraySize2--) {
2601 /* ToBeDone: some of the type description values are counts */
2602 u32VariableOffset = dissect_dcom_VARTYPE(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
2603 &u16VarType);
2604
2605 if (u32Idx2 <= typedesclen) {
2606 typedesc[u32Idx2-1] = u16VarType;
2607 }
2608
2609 /* remember first VarType only */
2610 if (u32Idx2 == 1) {
2611 u16VarType2 = u16VarType;
2612 }
2613 u32Idx2++;
2614 }
2615 }
2616
2617 /* ConsumerID */
2618 offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
2619 hf_cba_acco_conn_cons_id, &u32ConsID);
2620
2621 /* RecordLength */
2622 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
2623 hf_cba_acco_serversrt_record_length, &u16RecordLength);
2624
2625 /* add to object database */
2626 if (frame != NULL) {
2627 conn = cba_connection_connect(pinfo, frame->consparent, frame->provparent, frame,
2628 frame->qostype, frame->qosvalue, szProvItem, u32ConsID, u16RecordLength,
2629 typedesc, typedesclen);
2630
2631 cba_connection_info(tvb, pinfo, sub_tree, conn);
2632 } else {
2633 conn = NULL;
2634 }
2635
2636 /* add to current call */
2637 if (call != NULL) {
2638 call->conn_count++;
2639 call->conns[u32Idx-1] = conn;
2640 }
2641
2642 /* update subtree header */
2643 proto_item_append_text(sub_item, "[%u]: ConsID=0x%x, ProvItem=\"%s\", TypeDesc=%s",
2644 u32Idx, u32ConsID, szProvItem,
2645 val_to_str(u16VarType2, dcom_variant_type_vals, "Unknown (0x%04x)") );
2646 proto_item_set_len(sub_item, offset - u32SubStart);
2647
2648
2649 u32Idx++;
2650 }
2651
2652 /* update column info now */
2653 col_append_fstr(pinfo->cinfo, COL_INFO, ": %s Cnt=%u PCRID=0x%x",
2654 (u8LastConnect) ? "LastOfCR" : "",
2655 u32Idx-1,
2656 u32ProvCRID);
2657
2658 return u32VariableOffset;
2659 }
2660
2661
2662 static int
2663 dissect_ICBAAccoServerSRT_Connect_resp(tvbuff_t *tvb, int offset,
2664 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
2665 {
2666 uint32_t u32Pointer;
2667 uint32_t u32ArraySize;
2668 uint32_t u32Idx = 1;
2669 uint32_t u32SubStart;
2670 uint32_t u32ProvID;
2671 uint32_t u32HResult;
2672
2673 proto_item *item;
2674
2675 server_connect_call_t *call = (server_connect_call_t *)di->call_data->private_data;
2676 cba_connection_t *conn;
2677
2678
2679 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
2680
2681 if (call == NULL) {
2682 expert_add_info(pinfo, NULL, &ei_cba_acco_no_request_info);
2683 }
2684
2685 item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, false);
2686 proto_item_set_generated(item);
2687 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(3));
2688
2689 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
2690 &u32Pointer);
2691
2692 if (call && call->frame != NULL) {
2693 cba_frame_info(tvb, pinfo, tree, call->frame);
2694 }
2695
2696 if (u32Pointer) {
2697 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
2698 &u32ArraySize);
2699
2700 /* array of CONNECTOUTs */
2701 while(u32ArraySize--) {
2702 proto_item *sub_item;
2703 proto_tree *sub_tree;
2704
2705 sub_item = proto_tree_add_item(tree, hf_cba_connectout, tvb, offset, 8, ENC_NA);
2706 sub_tree = proto_item_add_subtree(sub_item, ett_cba_connectout);
2707 u32SubStart = offset;
2708
2709 offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
2710 hf_cba_acco_conn_prov_id, &u32ProvID);
2711
2712 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, sub_tree, di, drep,
2713 &u32HResult, u32Idx);
2714
2715 /* put response data into the frame */
2716 if (call && u32Idx <= call->conn_count) {
2717 conn = call->conns[u32Idx-1];
2718 conn->provid = u32ProvID;
2719 conn->connret = u32HResult;
2720
2721 cba_connection_info(tvb, pinfo, sub_tree, conn);
2722 }
2723
2724 proto_item_append_text(sub_item, "[%u]: ProvID=0x%x %s",
2725 u32Idx, u32ProvID,
2726 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
2727 proto_item_set_len(sub_item, offset - u32SubStart);
2728
2729 u32Idx++;
2730 }
2731 }
2732
2733 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
2734 &u32HResult);
2735
2736 /* this might be a global HRESULT */
2737 while(call && u32Idx <= call->conn_count) {
2738 conn = call->conns[u32Idx-1];
2739 conn->provid = 0;
2740 conn->connret = u32HResult;
2741 u32Idx++;
2742 }
2743
2744 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u -> %s",
2745 u32Idx-1,
2746 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
2747
2748 return offset;
2749 }
2750
2751
2752 static int
2753 dissect_Server_GetProvIDs_resp(tvbuff_t *tvb, int offset,
2754 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
2755 {
2756 uint32_t u32Count;
2757 uint32_t u32Pointer;
2758 uint32_t u32ArraySize;
2759 uint32_t u32Idx;
2760 uint32_t u32ProvID;
2761 uint32_t u32HResult;
2762
2763
2764 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
2765
2766 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
2767 hf_cba_acco_count, &u32Count);
2768
2769 if (u32Count) {
2770 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u ProvID=", u32Count);
2771 } else {
2772 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count);
2773 }
2774
2775 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
2776 &u32Pointer);
2777 if (u32Pointer) {
2778 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
2779 &u32ArraySize);
2780
2781 u32Idx = 1;
2782 while (u32ArraySize--) {
2783 offset = dissect_dcom_indexed_DWORD(tvb, offset, pinfo,
2784 tree, di, drep,
2785 hf_cba_acco_conn_prov_id, &u32ProvID, u32Idx);
2786
2787 if (u32Idx == 1) {
2788 col_append_fstr(pinfo->cinfo, COL_INFO, "0x%x", u32ProvID);
2789 } else if (u32Idx < 10) {
2790 col_append_fstr(pinfo->cinfo, COL_INFO, ",0x%x", u32ProvID);
2791 } else if (u32Idx == 10) {
2792 col_append_str(pinfo->cinfo, COL_INFO, ",...");
2793 }
2794
2795 u32Idx++;
2796 }
2797 }
2798
2799 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
2800 &u32HResult);
2801
2802 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
2803 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
2804
2805 return offset;
2806 }
2807
2808
2809 static int
2810 dissect_Server_GetProvConnections_rqst(tvbuff_t *tvb, int offset,
2811 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
2812 {
2813 uint32_t u32Count;
2814 uint32_t u32ArraySize;
2815 uint32_t u32Idx;
2816 uint32_t u32ProvID;
2817
2818
2819 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
2820
2821 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
2822 hf_cba_acco_count, &u32Count);
2823
2824 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
2825 &u32ArraySize);
2826
2827 u32Idx = 1;
2828 while (u32ArraySize--) {
2829 offset = dissect_dcom_indexed_DWORD(tvb, offset, pinfo, tree, di, drep,
2830 hf_cba_acco_conn_prov_id, &u32ProvID, u32Idx);
2831 u32Idx++;
2832 }
2833
2834 /* update column info now */
2835 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count);
2836
2837 return offset;
2838 }
2839
2840
2841 static int
2842 dissect_Server_GetProvConnections_resp(tvbuff_t *tvb, int offset,
2843 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
2844 {
2845 uint32_t u32Count;
2846 uint32_t u32TmpCount;
2847 uint32_t u32Pointer;
2848 uint32_t u32VariableOffset;
2849 uint32_t u32Idx;
2850 uint32_t u32SubStart;
2851 char szCons[1000] = { 0 };
2852 uint32_t u32MaxConsLen = sizeof(szCons);
2853 char szProvItem[1000] = { 0 };
2854 uint32_t u32MaxProvItemLen = sizeof(szProvItem);
2855 uint32_t u32ConsID;
2856 uint16_t u16QoSType;
2857 uint16_t u16QoSValue;
2858 uint8_t u8State;
2859 uint32_t u32HResult;
2860
2861
2862 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
2863
2864 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
2865 &u32Pointer);
2866
2867 u32VariableOffset = offset;
2868
2869 if (u32Pointer) {
2870 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
2871 hf_cba_acco_count, &u32Count);
2872
2873 u32VariableOffset = offset + u32Count*28;
2874
2875 /* array fixed part (including pointers to variable part) */
2876 u32TmpCount = u32Count;
2877 u32Idx = 1;
2878 while (u32TmpCount--) {
2879 proto_item *sub_item;
2880 proto_tree *sub_tree;
2881
2882 sub_item = proto_tree_add_item(tree, hf_cba_getprovconnout, tvb, offset, 0, ENC_NA);
2883 sub_tree = proto_item_add_subtree(sub_item, ett_cba_getprovconnout);
2884 u32SubStart = offset;
2885
2886 /* wszConsumer */
2887 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
2888 &u32Pointer);
2889 if (u32Pointer) {
2890 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
2891 hf_cba_acco_conn_consumer, szCons, u32MaxConsLen);
2892 }
2893 /* wszProviderItem */
2894 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
2895 &u32Pointer);
2896 if (u32Pointer) {
2897 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
2898 hf_cba_acco_conn_provider_item, szProvItem, u32MaxProvItemLen);
2899 }
2900 /* dwConsID */
2901 offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
2902 hf_cba_acco_conn_cons_id, &u32ConsID);
2903
2904 /* Epsilon */
2905 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
2906 &u32Pointer);
2907 if (u32Pointer) {
2908 u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
2909 hf_cba_acco_conn_epsilon);
2910 }
2911
2912 /* QoS Type */
2913 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
2914 hf_cba_acco_conn_qos_type, &u16QoSType);
2915 /* QoS Value */
2916 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
2917 hf_cba_acco_conn_qos_value, &u16QoSValue);
2918 /* State */
2919 offset = dissect_dcom_BOOLEAN(tvb, offset, pinfo, sub_tree, di, drep,
2920 hf_cba_acco_conn_state, &u8State);
2921 /* PartialResult */
2922 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, sub_tree, di, drep,
2923 &u32HResult, u32Idx);
2924
2925 proto_item_append_text(sub_item, "[%u]: %s",
2926 u32Idx,
2927 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
2928 proto_item_set_len(sub_item, offset - u32SubStart);
2929
2930 u32Idx++;
2931 }
2932 }
2933
2934 u32VariableOffset = dissect_dcom_HRESULT(tvb, u32VariableOffset, pinfo, tree, di, drep,
2935 &u32HResult);
2936
2937 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
2938 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
2939
2940 return u32VariableOffset;
2941 }
2942
2943
2944 #define CBA_MRSH_VERSION_DCOM 0x01
2945 #define CBA_MRSH_VERSION_SRT_WITH_CONSID 0x10
2946 #define CBA_MRSH_VERSION_SRT_WITHOUT_CONSID 0x11
2947
2948
2949 static int
2950 dissect_CBA_Connection_Data(tvbuff_t *tvb,
2951 packet_info *pinfo, proto_tree *tree, cba_ldev_t *cons_ldev, cba_frame_t *frame)
2952 {
2953 uint8_t u8Version;
2954 uint8_t u8Flags;
2955 uint16_t u16CountFix;
2956 uint16_t u16Count;
2957 uint32_t u32ItemIdx;
2958 uint32_t u32HoleIdx;
2959 proto_item *conn_data_item = NULL;
2960 proto_tree *conn_data_tree = NULL;
2961 uint16_t u16Len;
2962 uint32_t u32ID;
2963 uint8_t u8QC;
2964 uint16_t u16DataLen;
2965 uint16_t u16HdrLen;
2966 int offset = 0;
2967 int offset_hole;
2968 bool qc_reported = false;
2969 int qc_good = 0;
2970 int qc_uncertain = 0;
2971 int qc_bad = 0;
2972 GList *conns;
2973 int item_offset;
2974 cba_connection_t *conn;
2975
2976
2977 /*** ALL data in this buffer is NOT aligned and always little endian ordered ***/
2978
2979 if (tree) {
2980 conn_data_item = proto_tree_add_item(tree, hf_cba_acco_cb_conn_data, tvb, offset, 0, ENC_NA);
2981 conn_data_tree = proto_item_add_subtree(conn_data_item, ett_ICBAAccoCallback_Buffer);
2982 }
2983
2984 /* add buffer header */
2985 u8Version = tvb_get_uint8 (tvb, offset);
2986 if (conn_data_tree) {
2987 proto_tree_add_item(conn_data_tree, hf_cba_acco_cb_version, tvb, offset, 1, ENC_LITTLE_ENDIAN);
2988 }
2989 offset += 1;
2990
2991 u8Flags = tvb_get_uint8 (tvb, offset);
2992 if (conn_data_tree) {
2993 proto_tree_add_item(conn_data_tree, hf_cba_acco_cb_flags, tvb, offset, 1, ENC_LITTLE_ENDIAN);
2994 }
2995 offset += 1;
2996
2997 u16Count = tvb_get_letohs (tvb, offset);
2998 if (conn_data_tree) {
2999 proto_tree_add_item(conn_data_tree, hf_cba_acco_cb_count, tvb, offset, 2, ENC_LITTLE_ENDIAN);
3000 }
3001 offset += 2;
3002 u16CountFix = u16Count;
3003
3004 /* show meta information */
3005 if (frame) {
3006 cba_frame_info(tvb, pinfo, conn_data_tree, frame);
3007 } else {
3008 if (cons_ldev && cons_ldev->name) {
3009 proto_item *item;
3010 item = proto_tree_add_string(conn_data_tree, hf_cba_acco_conn_consumer, tvb, offset, 0, cons_ldev->name);
3011 proto_item_set_generated(item);
3012 }
3013 }
3014
3015 /* update column info now */
3016 #if 0
3017 col_append_fstr(pinfo->cinfo, COL_INFO, " Cnt=%u", u16Count);
3018 #endif
3019
3020 /* is this an OnDataChanged buffer format (version), we know? */
3021 if ((u8Version != CBA_MRSH_VERSION_DCOM) &&
3022 (u8Version != CBA_MRSH_VERSION_SRT_WITH_CONSID) &&
3023 (u8Version != CBA_MRSH_VERSION_SRT_WITHOUT_CONSID))
3024 {
3025 return offset;
3026 }
3027
3028 /* Timestamps are currently unused -> flags must be zero */
3029 if (u8Flags != 0) {
3030 return offset;
3031 }
3032
3033 u32ItemIdx = 1;
3034 u32HoleIdx = 1;
3035 while (u16Count--) {
3036 proto_item *sub_item;
3037 proto_tree *sub_tree;
3038 proto_item *item;
3039
3040 /* find next record header */
3041 u16Len = tvb_get_letohs (tvb, offset);
3042
3043 /* trapped inside an empty hole? -> try to find next record header */
3044 if (u16Len == 0 &&
3045 (u8Version == CBA_MRSH_VERSION_SRT_WITH_CONSID ||
3046 u8Version == CBA_MRSH_VERSION_SRT_WITHOUT_CONSID))
3047 {
3048 u32HoleIdx++;
3049 offset_hole = offset;
3050 /* length smaller or larger than possible -> must be a hole */
3051 while (u16Len == 0) {
3052 offset++;
3053 u16Len = tvb_get_letohs(tvb, offset);
3054 /* this is a bit tricky here! we know: */
3055 /* u16Len must be greater than 3 (min. size of header itself) */
3056 /* u16Len must be a lot smaller than 0x300 (max. size of frame) */
3057 /* -> if we found a length larger than 0x300, */
3058 /* this must be actually the high byte, so do one more step */
3059 if (u16Len > 0x300) {
3060 u16Len = 0;
3061 }
3062 }
3063 proto_tree_add_none_format(conn_data_tree, hf_cba_acco_cb_item_hole, tvb,
3064 offset_hole, offset - offset_hole,
3065 "Hole(--): -------------, offset=%2u, length=%2u",
3066 offset_hole, offset - offset_hole);
3067 }
3068
3069 /* add callback-item subtree */
3070 sub_item = proto_tree_add_item(conn_data_tree, hf_cba_acco_cb_item, tvb, offset, 0, ENC_NA);
3071 sub_tree = proto_item_add_subtree(sub_item, ett_ICBAAccoCallback_Item);
3072
3073 item_offset = offset;
3074
3075 /* add item header fields */
3076 if (sub_tree) {
3077 proto_tree_add_item(sub_tree, hf_cba_acco_cb_item_length, tvb, offset, 2, ENC_LITTLE_ENDIAN);
3078 }
3079 offset += 2;
3080 u16HdrLen = 2;
3081
3082 if (u8Version == CBA_MRSH_VERSION_DCOM ||
3083 u8Version == CBA_MRSH_VERSION_SRT_WITH_CONSID)
3084 {
3085 u32ID = tvb_get_letohl (tvb, offset);
3086 if (sub_tree) {
3087 proto_tree_add_item(sub_tree, hf_cba_acco_conn_cons_id, tvb, offset, 4, ENC_LITTLE_ENDIAN);
3088 }
3089 offset += 4;
3090 u16HdrLen += 4;
3091 } else {
3092 u32ID = 0;
3093 }
3094
3095 u8QC = tvb_get_uint8 (tvb, offset);
3096 item = NULL;
3097 if (sub_tree) {
3098 item = proto_tree_add_item(sub_tree, hf_cba_acco_qc, tvb, offset, 1, ENC_LITTLE_ENDIAN);
3099 }
3100 offset += 1;
3101 u16HdrLen += 1;
3102
3103 if ( u8QC != 0x80 && /* GoodNonCascOk */
3104 u8QC != 0x1C && /* BadOutOfService (usually permanent, so don't report for every frame) */
3105 qc_reported == 0) {
3106 expert_add_info_format(pinfo, item, &ei_cba_acco_qc, "%s QC: %s",
3107 u8Version == CBA_MRSH_VERSION_DCOM ? "DCOM" : "SRT",
3108 val_to_str(u8QC, cba_acco_qc_vals, "Unknown (0x%02x)"));
3109 qc_reported = 0;
3110 }
3111
3112 switch(u8QC >> 6) {
3113 case(00):
3114 qc_bad++;
3115 break;
3116 case(01):
3117 qc_uncertain++;
3118 break;
3119 default:
3120 qc_good++;
3121 }
3122
3123 /* user data length is item length without headers */
3124 u16DataLen = u16Len - u16HdrLen;
3125
3126 /* append text to subtree header */
3127 if (u8Version == CBA_MRSH_VERSION_DCOM ||
3128 u8Version == CBA_MRSH_VERSION_SRT_WITH_CONSID)
3129 {
3130 proto_item_append_text(sub_item,
3131 "[%2u]: ConsID=0x%08x, offset=%2u, length=%2u (user-length=%2u), QC=%s (0x%02x)",
3132 u32ItemIdx, u32ID, offset - u16HdrLen, u16Len, u16DataLen,
3133 val_to_str(u8QC, cba_acco_qc_vals, "Unknown (0x%02x)"), u8QC );
3134 } else {
3135 proto_item_append_text(sub_item,
3136 "[%2u]: ConsID=-, offset=%2u, length=%2u (user-length=%2u), QC=%s (0x%02x)",
3137 u32ItemIdx, offset - u16HdrLen, u16Len, u16DataLen,
3138 val_to_str(u8QC, cba_acco_qc_vals, "Unknown (0x%02x)"), u8QC );
3139 }
3140 proto_item_set_len(sub_item, u16Len);
3141
3142 /* hexdump of user data */
3143 proto_tree_add_item(sub_tree, hf_cba_acco_cb_item_data, tvb, offset, u16DataLen, ENC_NA);
3144 offset += u16DataLen;
3145
3146 if (frame != NULL ) {
3147 /* find offset in SRT */
3148 /* XXX - expensive! */
3149 cba_frame_incoming_data(tvb, pinfo, sub_tree, frame);
3150 for(conns = frame->conns; conns != NULL; conns = g_list_next(conns)) {
3151 conn = (cba_connection_t *)conns->data;
3152 if (conn->frame_offset == item_offset) {
3153 cba_connection_info(tvb, pinfo, sub_tree, conn);
3154 break;
3155 }
3156 }
3157 } else {
3158 /* find consID in ldev */
3159 /* XXX - expensive! */
3160 if (cons_ldev != NULL) {
3161 for(conns = cons_ldev->consconns; conns != NULL; conns = g_list_next(conns)) {
3162 conn = (cba_connection_t *)conns->data;
3163 if (conn->consid == u32ID) {
3164 cba_connection_info(tvb, pinfo, sub_tree, conn);
3165 cba_connection_incoming_data(tvb, pinfo, sub_tree, conn);
3166 break;
3167 }
3168 }
3169 }
3170 }
3171
3172 u32ItemIdx++;
3173 }
3174
3175 if (u8Version == 1) {
3176 proto_item_append_text(conn_data_item,
3177 ": Version=0x%x (DCOM), Flags=0x%x, Count=%u",
3178 u8Version, u8Flags, u16CountFix);
3179 } else {
3180 proto_item_append_text(conn_data_item,
3181 ": Version=0x%x (SRT), Flags=0x%x, Count=%u, Items=%u, Holes=%u",
3182 u8Version, u8Flags, u16CountFix, u32ItemIdx-1, u32HoleIdx-1);
3183 }
3184 proto_item_set_len(conn_data_item, offset);
3185
3186 col_append_fstr(pinfo->cinfo, COL_INFO, ", QC (G:%u,U:%u,B:%u)",
3187 qc_good, qc_uncertain, qc_bad);
3188
3189 return offset;
3190 }
3191
3192
3193 static bool
3194 dissect_CBA_Connection_Data_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
3195 void *data)
3196 {
3197 uint8_t u8Version;
3198 uint8_t u8Flags;
3199 /* the tvb will NOT contain the frame_id here! */
3200 uint16_t u16FrameID = GPOINTER_TO_UINT(data);
3201 cba_frame_t *frame;
3202
3203 /* frame id must be in valid range (cyclic Real-Time, class=1 or class=2) */
3204 if (u16FrameID < 0x8000 || u16FrameID >= 0xfb00) {
3205 return false;
3206 }
3207
3208 u8Version = tvb_get_uint8 (tvb, 0);
3209 u8Flags = tvb_get_uint8 (tvb, 1);
3210
3211 /* version and flags must be ok */
3212 if (u8Version != 0x11 || u8Flags != 0x00) {
3213 return false;
3214 }
3215
3216 col_set_str(pinfo->cinfo, COL_PROTOCOL, "PN-CBA");
3217
3218 frame = cba_frame_find_by_cons(pinfo, (const uint8_t *)pinfo->dl_dst.data, u16FrameID);
3219
3220 dissect_CBA_Connection_Data(tvb, pinfo, tree, frame ? frame->consparent : NULL, frame);
3221
3222 return true;
3223 }
3224
3225
3226 static int
3227 dissect_ICBAAccoCallback_OnDataChanged_rqst(tvbuff_t *tvb, int offset,
3228 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3229 {
3230 uint32_t u32Length;
3231 uint32_t u32ArraySize;
3232 tvbuff_t *next_tvb;
3233 proto_item *item;
3234 cba_ldev_t *cons_ldev;
3235
3236
3237 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
3238
3239 /* get corresponding provider ldev */
3240 cons_ldev = cba_ldev_find(pinfo, &pinfo->net_dst, &di->call_data->object_uuid);
3241
3242 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, false);
3243 proto_item_set_generated(item);
3244 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(1));
3245
3246 /* length */
3247 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
3248 hf_cba_acco_cb_length, &u32Length);
3249
3250 /* array size */
3251 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
3252 &u32ArraySize);
3253
3254 /*** the data below is NOT ndr encoded (especially NOT aligned)!!! ***/
3255 /* dissect PROFINET component data (without header) */
3256 next_tvb = tvb_new_subset_remaining(tvb, offset);
3257
3258 offset += dissect_CBA_Connection_Data(next_tvb, pinfo, tree, cons_ldev, NULL /* frame */);
3259
3260 return offset;
3261 }
3262
3263
3264 static int
3265 dissect_ICBAAccoCallback_OnDataChanged_resp(tvbuff_t *tvb, int offset,
3266 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3267 {
3268 uint32_t u32HResult;
3269 proto_item *item;
3270
3271
3272 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
3273
3274 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, true);
3275 proto_item_set_generated(item);
3276 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(2));
3277
3278 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
3279 &u32HResult);
3280
3281 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
3282 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
3283
3284 return offset;
3285 }
3286
3287
3288 static int
3289 dissect_ICBAAccoCallback_Gnip_rqst(tvbuff_t *tvb, int offset,
3290 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3291 {
3292 proto_item *item;
3293
3294
3295 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
3296
3297 item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, false);
3298 proto_item_set_generated(item);
3299 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(3));
3300
3301 return offset;
3302 }
3303
3304
3305 static int
3306 dissect_ICBAAccoCallback_Gnip_resp(tvbuff_t *tvb, int offset,
3307 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3308 {
3309 uint32_t u32HResult;
3310 proto_item *item;
3311
3312
3313 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
3314
3315 item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, true);
3316 proto_item_set_generated(item);
3317 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(4));
3318
3319 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
3320 &u32HResult);
3321
3322 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
3323 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
3324
3325 return offset;
3326 }
3327
3328
3329 static int
3330 dissect_ICBAAccoServer2_GetConnectionData_rqst(tvbuff_t *tvb, int offset,
3331 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3332 {
3333 char szStr[1000];
3334 uint32_t u32MaxStr = sizeof(szStr);
3335 proto_item *item;
3336 cba_ldev_t *cons_ldev;
3337 cba_ldev_t **call;
3338
3339
3340 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
3341
3342 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, true);
3343 proto_item_set_generated(item);
3344 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(2));
3345
3346 offset = dissect_dcom_LPWSTR(tvb, offset, pinfo, tree, di, drep,
3347 hf_cba_acco_conn_consumer, szStr, u32MaxStr);
3348
3349 cons_ldev = cba_acco_add(pinfo, szStr);
3350
3351 /* link ldev to the call */
3352 if (cons_ldev != NULL) {
3353 call = (cba_ldev_t **)wmem_alloc(wmem_file_scope(), sizeof(cba_ldev_t *));
3354 *call = cons_ldev;
3355 di->call_data->private_data = call;
3356 }
3357
3358 /* update column info now */
3359 col_append_fstr(pinfo->cinfo, COL_INFO, " Consumer=\"%s\"", szStr);
3360
3361 return offset;
3362 }
3363
3364
3365 static int
3366 dissect_ICBAAccoServer2_GetConnectionData_resp(tvbuff_t *tvb, int offset,
3367 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3368 {
3369 uint32_t u32Length;
3370 uint32_t u32ArraySize;
3371 tvbuff_t *next_tvb;
3372 uint32_t u32Pointer;
3373 uint32_t u32HResult;
3374 proto_item *item;
3375 cba_ldev_t **call = (cba_ldev_t **)di->call_data->private_data;
3376 cba_ldev_t *cons_ldev = (call!=NULL) ? *call : NULL;
3377
3378
3379 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
3380
3381 if (cons_ldev == NULL) {
3382 expert_add_info(pinfo, NULL, &ei_cba_acco_no_request_info);
3383 }
3384
3385 item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, false);
3386 proto_item_set_generated(item);
3387 p_add_proto_data(pinfo->pool, pinfo, proto_ICBAAccoMgt, 0, GUINT_TO_POINTER(1));
3388
3389 /* length */
3390 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
3391 hf_cba_acco_cb_length, &u32Length);
3392
3393 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
3394 &u32Pointer);
3395 if (u32Pointer) {
3396 /* array size */
3397 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
3398 &u32ArraySize);
3399
3400 /*** the data below is NOT ndr encoded (especially NOT aligned)!!! ***/
3401 /* dissect PROFINET component data (without header) */
3402 next_tvb = tvb_new_subset_remaining(tvb, offset);
3403
3404 offset += dissect_CBA_Connection_Data(next_tvb, pinfo, tree, (call != NULL) ? *call : NULL, NULL /* frame */);
3405
3406 }
3407
3408 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
3409 &u32HResult);
3410
3411 /* update column info now */
3412 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
3413 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
3414
3415 return offset;
3416 }
3417
3418
3419 static int
3420 dissect_ICBAAccoMgt_AddConnections_rqst(tvbuff_t *tvb, int offset,
3421 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3422 {
3423 char szConsumer[1000] = { 0 };
3424 uint32_t u32MaxConsLen = sizeof(szConsumer);
3425 uint16_t u16QoSType;
3426 uint16_t u16QoSValue;
3427 uint8_t u8State;
3428 uint32_t u32Count;
3429 uint32_t u32ArraySize;
3430 uint32_t u32Pointer;
3431 uint16_t u16Persistence;
3432 char szConsItem[1000] = { 0 };
3433 uint32_t u32MaxConsItemLen = sizeof(szConsItem);
3434 char szProvItem[1000] = { 0 };
3435 uint32_t u32MaxProvItemLen = sizeof(szProvItem);
3436 uint32_t u32VariableOffset;
3437 uint32_t u32SubStart;
3438 uint32_t u32Idx;
3439
3440
3441 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
3442
3443 offset = dissect_dcom_LPWSTR(tvb, offset, pinfo, tree, di, drep,
3444 hf_cba_acco_conn_provider, szConsumer, u32MaxConsLen);
3445 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
3446 hf_cba_acco_conn_qos_type, &u16QoSType);
3447 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
3448 hf_cba_acco_conn_qos_value, &u16QoSValue);
3449 offset = dissect_dcom_BOOLEAN(tvb, offset, pinfo, tree, di, drep,
3450 hf_cba_acco_conn_state, &u8State);
3451
3452 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
3453 hf_cba_acco_count, &u32Count);
3454
3455 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
3456 &u32ArraySize);
3457
3458 u32VariableOffset = offset + u32ArraySize * 20;
3459
3460 u32Idx = 1;
3461 while (u32ArraySize--) {
3462 proto_item *sub_item;
3463 proto_tree *sub_tree;
3464
3465 sub_item = proto_tree_add_item(tree, hf_cba_addconnectionin, tvb, offset, 0, ENC_NA);
3466 sub_tree = proto_item_add_subtree(sub_item, ett_cba_addconnectionin);
3467 u32SubStart = offset;
3468
3469 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
3470 &u32Pointer);
3471 if (u32Pointer) {
3472 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
3473 hf_cba_acco_conn_provider_item, szProvItem, u32MaxProvItemLen);
3474 }
3475 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
3476 &u32Pointer);
3477 if (u32Pointer) {
3478 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
3479 hf_cba_acco_conn_consumer_item, szConsItem, u32MaxConsItemLen);
3480 }
3481 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
3482 hf_cba_acco_conn_persist, &u16Persistence);
3483
3484 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
3485 &u32Pointer);
3486 if (u32Pointer) {
3487 u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
3488 hf_cba_acco_conn_substitute);
3489 }
3490 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
3491 &u32Pointer);
3492 if (u32Pointer) {
3493 u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
3494 hf_cba_acco_conn_epsilon);
3495 }
3496 proto_item_append_text(sub_item, "[%u]: ConsItem=\"%s\" ProvItem=\"%s\" %s Pers=%u",
3497 u32Idx, szConsItem, szProvItem,
3498 val_to_str(u16Persistence, cba_persist_vals, "Unknown (0x%02x)"), u16Persistence);
3499 proto_item_set_len(sub_item, offset - u32SubStart);
3500
3501 u32Idx++;
3502 }
3503
3504 /* update column info now */
3505 col_append_fstr(pinfo->cinfo, COL_INFO, ": Prov=\"%s\" State=%s Cnt=%u",
3506 szConsumer,
3507 val_to_str(u8State, cba_acco_conn_state_vals, "Unknown (0x%02x)"),
3508 u32Count);
3509
3510 return u32VariableOffset;
3511 }
3512
3513
3514 static int
3515 dissect_ICBAAccoMgt_AddConnections_resp(tvbuff_t *tvb, int offset,
3516 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3517 {
3518 uint32_t u32Pointer;
3519 uint32_t u32ArraySize = 0;
3520 uint32_t u32ConsID;
3521 uint16_t u16ConnVersion;
3522 uint32_t u32HResult = 0;
3523 uint32_t u32Count = 0;
3524 uint32_t u32Idx;
3525 uint32_t u32SubStart;
3526
3527
3528 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
3529
3530 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
3531 &u32Pointer);
3532
3533 if (u32Pointer) {
3534 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
3535 &u32ArraySize);
3536
3537 u32Count = u32ArraySize;
3538 u32Idx = 1;
3539 while (u32ArraySize--) {
3540 proto_item *sub_item;
3541 proto_tree *sub_tree;
3542
3543 sub_item = proto_tree_add_item(tree, hf_cba_addconnectionout, tvb, offset, 0, ENC_NA);
3544 sub_tree = proto_item_add_subtree(sub_item, ett_cba_addconnectionout);
3545 u32SubStart = offset;
3546
3547 offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
3548 hf_cba_acco_conn_cons_id, &u32ConsID);
3549
3550 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
3551 hf_cba_acco_conn_version, &u16ConnVersion);
3552
3553 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, sub_tree, di, drep,
3554 &u32HResult, u32Idx);
3555
3556 proto_item_append_text(sub_item, "[%u]: ConsID=0x%x Version=%u %s",
3557 u32Idx, u32ConsID, u16ConnVersion,
3558 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
3559 proto_item_set_len(sub_item, offset - u32SubStart);
3560
3561 u32Idx++;
3562 }
3563
3564 /* update column info now */
3565 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count);
3566 }
3567
3568 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
3569 &u32HResult);
3570
3571 /* update column info now */
3572 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
3573 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
3574
3575 return offset;
3576 }
3577
3578
3579 static int
3580 dissect_ICBAAccoMgt_RemoveConnections_rqst(tvbuff_t *tvb, int offset,
3581 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3582 {
3583 uint32_t u32Count;
3584 uint32_t u32ArraySize;
3585 uint32_t u32Idx;
3586 uint32_t u32ConsID;
3587
3588
3589 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
3590
3591 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
3592 hf_cba_acco_count, &u32Count);
3593
3594 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
3595 &u32ArraySize);
3596
3597 u32Idx = 1;
3598 while (u32ArraySize--) {
3599 offset = dissect_dcom_indexed_DWORD(tvb, offset, pinfo, tree, di, drep,
3600 hf_cba_acco_conn_cons_id, &u32ConsID, u32Idx);
3601 u32Idx++;
3602 }
3603
3604 /* update column info now */
3605 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count);
3606
3607 return offset;
3608 }
3609
3610
3611 static int
3612 dissect_ICBAAccoMgt_SetActivationState_rqst(tvbuff_t *tvb, int offset,
3613 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3614 {
3615 uint8_t u8State;
3616 uint32_t u32Count;
3617 uint32_t u32ArraySize;
3618 uint32_t u32Idx;
3619 uint32_t u32ConsID;
3620
3621
3622 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
3623
3624 offset = dissect_dcom_BOOLEAN(tvb, offset, pinfo, tree, di, drep,
3625 hf_cba_acco_conn_state, &u8State);
3626
3627 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
3628 hf_cba_acco_count, &u32Count);
3629
3630 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
3631 &u32ArraySize);
3632
3633 u32Idx = 1;
3634 while (u32ArraySize--) {
3635 offset = dissect_dcom_indexed_DWORD(tvb, offset, pinfo, tree, di, drep,
3636 hf_cba_acco_conn_cons_id, &u32ConsID, u32Idx);
3637 u32Idx++;
3638 }
3639
3640 /* update column info now */
3641 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count);
3642
3643 return offset;
3644 }
3645
3646
3647 static int
3648 dissect_ICBAAccoMgt_GetInfo_resp(tvbuff_t *tvb, int offset,
3649 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3650 {
3651 uint32_t u32Max;
3652 uint32_t u32CurCnt;
3653 uint32_t u32HResult;
3654
3655
3656 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
3657
3658 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
3659 hf_cba_acco_info_max, &u32Max);
3660
3661 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
3662 hf_cba_acco_info_curr, &u32CurCnt);
3663
3664 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
3665 &u32HResult);
3666
3667 col_append_fstr(pinfo->cinfo, COL_INFO, ": %u/%u -> %s",
3668 u32CurCnt, u32Max,
3669 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
3670
3671 return offset;
3672 }
3673
3674
3675 static int
3676 dissect_ICBAAccoMgt_GetIDs_resp(tvbuff_t *tvb, int offset,
3677 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3678 {
3679 uint32_t u32Count;
3680 uint32_t u32Pointer;
3681 uint32_t u32ArraySize;
3682 uint32_t u32ConsID;
3683 uint8_t u8State;
3684 uint16_t u16Version;
3685 uint32_t u32HResult;
3686 uint32_t u32Idx;
3687 uint32_t u32SubStart;
3688
3689
3690 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
3691
3692 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
3693 hf_cba_acco_count, &u32Count);
3694
3695 if (u32Count) {
3696 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u ConsID=", u32Count);
3697 } else {
3698 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count);
3699 }
3700
3701 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
3702 &u32Pointer);
3703 if (u32Pointer) {
3704 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
3705 &u32ArraySize);
3706
3707 u32Idx = 1;
3708 while (u32ArraySize--) {
3709 proto_item *sub_item;
3710 proto_tree *sub_tree;
3711
3712 sub_item = proto_tree_add_item(tree, hf_cba_getidout, tvb, offset, 0, ENC_NA);
3713 sub_tree = proto_item_add_subtree(sub_item, ett_cba_getidout);
3714 u32SubStart = offset;
3715
3716 offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
3717 hf_cba_acco_conn_cons_id, &u32ConsID);
3718 offset = dissect_dcom_BOOLEAN(tvb, offset, pinfo, sub_tree, di, drep,
3719 hf_cba_acco_conn_state, &u8State);
3720 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
3721 hf_cba_acco_conn_version, &u16Version);
3722 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, sub_tree, di, drep,
3723 &u32HResult, u32Idx);
3724
3725 proto_item_append_text(sub_item, "[%u]: ConsID=0x%x State=%s Version=%u %s",
3726 u32Idx, u32ConsID,
3727 val_to_str(u8State, cba_acco_conn_state_vals, "Unknown (0x%02x)"),
3728 u16Version,
3729 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
3730 proto_item_set_len(sub_item, offset - u32SubStart);
3731
3732 if (u32Idx == 1) {
3733 col_append_fstr(pinfo->cinfo, COL_INFO, "0x%x", u32ConsID);
3734 } else if (u32Idx < 10) {
3735 col_append_fstr(pinfo->cinfo, COL_INFO, ",0x%x", u32ConsID);
3736 } else if (u32Idx == 10) {
3737 col_append_str(pinfo->cinfo, COL_INFO, ",...");
3738 }
3739
3740 u32Idx++;
3741 }
3742 }
3743
3744 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
3745 &u32HResult);
3746
3747 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
3748 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
3749
3750 return offset;
3751 }
3752
3753
3754 static int
3755 dissect_ICBAAccoMgt2_GetConsIDs_resp(tvbuff_t *tvb, int offset,
3756 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3757 {
3758 uint32_t u32Count;
3759 uint32_t u32Pointer;
3760 uint32_t u32ArraySize;
3761 uint32_t u32Idx;
3762 uint32_t u32ConsID;
3763 uint32_t u32HResult;
3764
3765
3766 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
3767
3768 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
3769 hf_cba_acco_count, &u32Count);
3770
3771 if (u32Count) {
3772 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u ConsID=", u32Count);
3773 } else {
3774 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count);
3775 }
3776
3777 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
3778 &u32Pointer);
3779 if (u32Pointer) {
3780 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
3781 &u32ArraySize);
3782
3783 u32Idx = 1;
3784 while (u32ArraySize--) {
3785 offset = dissect_dcom_indexed_DWORD(tvb, offset, pinfo,
3786 tree, di, drep,
3787 hf_cba_acco_conn_cons_id, &u32ConsID, u32Idx);
3788
3789 if (u32Idx == 1) {
3790 col_append_fstr(pinfo->cinfo, COL_INFO, "0x%x", u32ConsID);
3791 } else if (u32Idx < 10) {
3792 col_append_fstr(pinfo->cinfo, COL_INFO, ",0x%x", u32ConsID);
3793 } else if (u32Idx == 10) {
3794 col_append_str(pinfo->cinfo, COL_INFO, ",...");
3795 }
3796
3797 u32Idx++;
3798 }
3799 }
3800
3801 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
3802 &u32HResult);
3803
3804 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
3805 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
3806
3807 return offset;
3808 }
3809
3810
3811 static int
3812 dissect_ICBAAccoMgt2_GetConsConnections_resp(tvbuff_t *tvb, int offset,
3813 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3814 {
3815 uint32_t u32Count;
3816 uint32_t u32TmpCount;
3817 uint32_t u32Pointer;
3818 uint32_t u32HResult;
3819
3820 uint16_t u16QoSType;
3821 uint16_t u16QoSValue;
3822 uint8_t u8State;
3823 uint16_t u16Persistence;
3824 uint32_t u32SubStart;
3825 uint32_t u32Idx;
3826 uint32_t u32VariableOffset;
3827 char szProv[1000] = { 0 };
3828 uint32_t u32MaxProvLen = sizeof(szProv);
3829 char szProvItem[1000] = { 0 };
3830 uint32_t u32MaxProvItemLen = sizeof(szProvItem);
3831 char szConsItem[1000] = { 0 };
3832 uint32_t u32MaxConsItemLen = sizeof(szConsItem);
3833
3834
3835 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
3836
3837 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
3838 &u32Pointer);
3839
3840 u32VariableOffset = offset;
3841
3842 if (u32Pointer) {
3843 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
3844 hf_cba_acco_count, &u32Count);
3845
3846 u32VariableOffset = offset + u32Count*32;
3847
3848 /* array fixed part (including pointers to variable part) */
3849 u32TmpCount = u32Count;
3850 u32Idx = 1;
3851 while (u32TmpCount--) {
3852 proto_item *sub_item;
3853 proto_tree *sub_tree;
3854
3855 sub_item = proto_tree_add_item(tree, hf_cba_getconsconnout, tvb, offset, 0, ENC_NA);
3856 sub_tree = proto_item_add_subtree(sub_item, ett_cba_getconnectionout);
3857 u32SubStart = offset;
3858
3859 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
3860 &u32Pointer);
3861 if (u32Pointer) {
3862 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
3863 hf_cba_acco_conn_provider, szProv, u32MaxProvLen);
3864 }
3865 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
3866 &u32Pointer);
3867 if (u32Pointer) {
3868 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
3869 hf_cba_acco_conn_provider_item, szProvItem, u32MaxProvItemLen);
3870 }
3871 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
3872 &u32Pointer);
3873 if (u32Pointer) {
3874 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
3875 hf_cba_acco_conn_consumer_item, szConsItem, u32MaxConsItemLen);
3876 }
3877 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
3878 &u32Pointer);
3879 if (u32Pointer) {
3880 u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
3881 hf_cba_acco_conn_substitute);
3882 }
3883 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
3884 &u32Pointer);
3885 if (u32Pointer) {
3886 u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
3887 hf_cba_acco_conn_epsilon);
3888 }
3889
3890 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
3891 hf_cba_acco_conn_qos_type, &u16QoSType);
3892 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
3893 hf_cba_acco_conn_qos_value, &u16QoSValue);
3894 offset = dissect_dcom_BOOLEAN(tvb, offset, pinfo, sub_tree, di, drep,
3895 hf_cba_acco_conn_state, &u8State);
3896 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
3897 hf_cba_acco_conn_persist, &u16Persistence);
3898 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, sub_tree, di, drep,
3899 &u32HResult, u32Idx);
3900
3901 proto_item_append_text(sub_item, "[%u]: %s",
3902 u32Idx,
3903 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
3904 proto_item_set_len(sub_item, offset - u32SubStart);
3905
3906 u32Idx++;
3907 }
3908 }
3909
3910 u32VariableOffset = dissect_dcom_HRESULT(tvb, u32VariableOffset, pinfo, tree, di, drep,
3911 &u32HResult);
3912
3913 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
3914 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
3915
3916 return u32VariableOffset;
3917 }
3918
3919
3920 static int
3921 dissect_ICBAAccoMgt2_DiagConsConnections_resp(tvbuff_t *tvb, int offset,
3922 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
3923 {
3924 uint32_t u32Count;
3925 uint32_t u32TmpCount;
3926 uint32_t u32Pointer;
3927 uint32_t u32HResult;
3928 uint8_t u8State;
3929 uint16_t u16Persistence;
3930 uint16_t u16ConnVersion;
3931 uint32_t u32SubStart;
3932 uint32_t u32Idx;
3933 uint32_t u32VariableOffset;
3934 uint32_t u32ConnErrorState;
3935
3936
3937 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
3938
3939 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
3940 &u32Pointer);
3941
3942 u32VariableOffset = offset;
3943
3944 if (u32Pointer) {
3945 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
3946 hf_cba_acco_count, &u32Count);
3947
3948 u32VariableOffset = offset + u32Count*16;
3949
3950 /* array fixed part (including pointers to variable part) */
3951 u32TmpCount = u32Count;
3952 u32Idx = 1;
3953 while (u32TmpCount--) {
3954 proto_item *sub_item;
3955 proto_tree *sub_tree;
3956 proto_item *state_item;
3957
3958 sub_item = proto_tree_add_item(tree, hf_cba_diagconsconnout, tvb, offset, 0, ENC_NA);
3959 sub_tree = proto_item_add_subtree(sub_item, ett_cba_getconnectionout);
3960 u32SubStart = offset;
3961
3962 offset = dissect_dcom_BOOLEAN(tvb, offset, pinfo, sub_tree, di, drep,
3963 hf_cba_acco_conn_state, &u8State);
3964 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
3965 hf_cba_acco_conn_persist, &u16Persistence);
3966 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
3967 hf_cba_acco_conn_version, &u16ConnVersion);
3968 /* connection state */
3969 #if 0
3970 offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
3971 hf_cba_acco_conn_error_state, &u32ConnErrorState);
3972 #endif
3973 offset = dissect_dcom_HRESULT_item(tvb, offset, pinfo, sub_tree, di, drep,
3974 &u32ConnErrorState, hf_cba_acco_conn_error_state, &state_item);
3975 proto_item_set_text(state_item, "ConnErrorState: %s (0x%x)",
3976 val_to_str(u32ConnErrorState, dcom_hresult_vals, "Unknown (0x%08x)"),
3977 u32ConnErrorState);
3978
3979 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, sub_tree, di, drep,
3980 &u32HResult, u32Idx);
3981
3982 proto_item_append_text(sub_item, "[%u]: %s",
3983 u32Idx,
3984 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
3985 proto_item_set_len(sub_item, offset - u32SubStart);
3986
3987 u32Idx++;
3988 }
3989 }
3990
3991 u32VariableOffset = dissect_dcom_HRESULT(tvb, u32VariableOffset, pinfo, tree, di, drep,
3992 &u32HResult);
3993
3994 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
3995 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
3996
3997 return u32VariableOffset;
3998 }
3999
4000
4001 static int
4002 dissect_ICBAAccoMgt_GetConnections_rqst(tvbuff_t *tvb, int offset,
4003 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
4004 {
4005 uint32_t u32ConsID;
4006 uint32_t u32Count;
4007 uint32_t u32ArraySize;
4008 uint32_t u32Idx;
4009
4010
4011 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
4012
4013 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
4014 hf_cba_acco_count, &u32Count);
4015
4016 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
4017 &u32ArraySize);
4018
4019 u32Idx = 1;
4020 while (u32ArraySize--){
4021 offset = dissect_dcom_indexed_DWORD(tvb, offset, pinfo, tree, di, drep,
4022 hf_cba_acco_conn_cons_id, &u32ConsID, u32Idx);
4023 u32Idx++;
4024 }
4025
4026 return offset;
4027 }
4028
4029
4030 static int
4031 dissect_ICBAAccoMgt_GetConnections_resp(tvbuff_t *tvb, int offset,
4032 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
4033 {
4034 uint32_t u32Count;
4035 uint32_t u32TmpCount;
4036 uint32_t u32Pointer;
4037 uint32_t u32HResult;
4038
4039 uint16_t u16QoSType;
4040 uint16_t u16QoSValue;
4041 uint8_t u8State;
4042 uint16_t u16Persistence;
4043 uint16_t u16ConnVersion;
4044 uint32_t u32SubStart;
4045 uint32_t u32Idx;
4046 uint32_t u32VariableOffset;
4047 char szProv[1000] = { 0 };
4048 uint32_t u32MaxProvLen = sizeof(szProv);
4049 char szProvItem[1000] = { 0 };
4050 uint32_t u32MaxProvItemLen = sizeof(szProvItem);
4051 char szConsItem[1000] = { 0 };
4052 uint32_t u32MaxConsItemLen = sizeof(szConsItem);
4053
4054
4055 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
4056
4057 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
4058 &u32Pointer);
4059
4060 u32VariableOffset = offset;
4061
4062 if (u32Pointer) {
4063 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
4064 hf_cba_acco_count, &u32Count);
4065
4066 u32VariableOffset = offset + u32Count*36;
4067
4068 /* array fixed part (including pointers to variable part) */
4069 u32TmpCount = u32Count;
4070 u32Idx = 1;
4071 while (u32TmpCount--) {
4072 proto_item *sub_item;
4073 proto_tree *sub_tree;
4074
4075 sub_item = proto_tree_add_item(tree, hf_cba_getconnectionout, tvb, offset, 0, ENC_NA);
4076 sub_tree = proto_item_add_subtree(sub_item, ett_cba_getconnectionout);
4077 u32SubStart = offset;
4078
4079 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
4080 &u32Pointer);
4081 if (u32Pointer) {
4082 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
4083 hf_cba_acco_conn_provider, szProv, u32MaxProvLen);
4084 }
4085 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
4086 &u32Pointer);
4087 if (u32Pointer) {
4088 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
4089 hf_cba_acco_conn_provider_item, szProvItem, u32MaxProvItemLen);
4090 }
4091 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
4092 &u32Pointer);
4093 if (u32Pointer) {
4094 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
4095 hf_cba_acco_conn_consumer_item, szConsItem, u32MaxConsItemLen);
4096 }
4097 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
4098 &u32Pointer);
4099 if (u32Pointer) {
4100 u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
4101 hf_cba_acco_conn_substitute);
4102 }
4103 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
4104 &u32Pointer);
4105 if (u32Pointer) {
4106 u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
4107 hf_cba_acco_conn_epsilon);
4108 }
4109
4110 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
4111 hf_cba_acco_conn_qos_type, &u16QoSType);
4112 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
4113 hf_cba_acco_conn_qos_value, &u16QoSValue);
4114 offset = dissect_dcom_BOOLEAN(tvb, offset, pinfo, sub_tree, di, drep,
4115 hf_cba_acco_conn_state, &u8State);
4116 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
4117 hf_cba_acco_conn_persist, &u16Persistence);
4118 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
4119 hf_cba_acco_conn_version, &u16ConnVersion);
4120 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, sub_tree, di, drep,
4121 &u32HResult, u32Idx);
4122
4123 proto_item_append_text(sub_item, "[%u]: %s",
4124 u32Idx,
4125 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
4126 proto_item_set_len(sub_item, offset - u32SubStart);
4127
4128 u32Idx++;
4129 }
4130 }
4131
4132 u32VariableOffset = dissect_dcom_HRESULT(tvb, u32VariableOffset, pinfo, tree, di, drep,
4133 &u32HResult);
4134
4135 col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
4136 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
4137
4138 return u32VariableOffset;
4139 }
4140
4141
4142 static int
4143 dissect_ICBAAccoMgt_ReviseQoS_rqst(tvbuff_t *tvb, int offset,
4144 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
4145 {
4146 uint16_t u16QoSType;
4147 uint16_t u16QoSValue;
4148 char szStr[1000];
4149 uint32_t u32MaxStr = sizeof(szStr);
4150
4151
4152 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
4153
4154 offset = dissect_dcom_LPWSTR(tvb, offset, pinfo, tree, di, drep,
4155 hf_cba_acco_rtauto, szStr, u32MaxStr);
4156
4157 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
4158 hf_cba_acco_conn_qos_type, &u16QoSType);
4159
4160 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
4161 hf_cba_acco_conn_qos_value, &u16QoSValue);
4162
4163 col_append_fstr(pinfo->cinfo, COL_INFO, ": RTAuto=\"%s\" QoSType=%s QoSValue=%u",
4164 szStr,
4165 val_to_str(u16QoSType, cba_qos_type_vals, "Unknown (0x%04x)"),
4166 u16QoSValue);
4167
4168 return offset;
4169 }
4170
4171
4172 static int
4173 dissect_ICBAAccoMgt_ReviseQoS_resp(tvbuff_t *tvb, int offset,
4174 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
4175 {
4176 uint16_t u16QoSValue;
4177 uint32_t u32HResult;
4178
4179
4180 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
4181
4182 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
4183 hf_cba_acco_conn_qos_value, &u16QoSValue);
4184
4185 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
4186 &u32HResult);
4187
4188 col_append_fstr(pinfo->cinfo, COL_INFO, ": %u -> %s",
4189 u16QoSValue,
4190 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
4191
4192 return offset;
4193 }
4194
4195
4196 static int
4197 dissect_ICBAAccoMgt_get_PingFactor_resp(tvbuff_t *tvb, int offset,
4198 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
4199 {
4200 uint16_t u16PF;
4201 uint32_t u32HResult;
4202
4203
4204 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
4205
4206 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
4207 hf_cba_acco_ping_factor, &u16PF);
4208
4209 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
4210 &u32HResult);
4211
4212 col_append_fstr(pinfo->cinfo, COL_INFO, ": %u -> %s",
4213 u16PF,
4214 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
4215
4216 return offset;
4217 }
4218
4219
4220 static int
4221 dissect_ICBAAccoMgt_put_PingFactor_rqst(tvbuff_t *tvb, int offset,
4222 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
4223 {
4224 uint16_t u16PF;
4225
4226
4227 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
4228
4229 offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
4230 hf_cba_acco_ping_factor, &u16PF);
4231
4232 col_append_fstr(pinfo->cinfo, COL_INFO, ": %u", u16PF);
4233
4234 return offset;
4235 }
4236
4237
4238
4239 static int
4240 dissect_ICBAAccoMgt_get_CDBCookie_resp(tvbuff_t *tvb, int offset,
4241 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
4242 {
4243 uint32_t u32Cookie;
4244 uint32_t u32HResult;
4245
4246
4247 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
4248
4249 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
4250 hf_cba_acco_cdb_cookie, &u32Cookie);
4251
4252 offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
4253 &u32HResult);
4254
4255 col_append_fstr(pinfo->cinfo, COL_INFO, ": CDBCookie=0x%x -> %s",
4256 u32Cookie,
4257 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
4258
4259 return offset;
4260 }
4261
4262
4263 static int
4264 dissect_ICBAAccoMgt_GetDiagnosis_rqst(tvbuff_t *tvb, int offset,
4265 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
4266 {
4267 uint32_t u32Request;
4268 uint32_t u32InLength;
4269 uint32_t u32ArraySize;
4270
4271
4272 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
4273
4274 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
4275 hf_cba_acco_diag_req, &u32Request);
4276
4277 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
4278 hf_cba_acco_diag_in_length, &u32InLength);
4279
4280 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
4281 &u32ArraySize);
4282
4283 if (u32ArraySize != 0) {
4284 proto_tree_add_item(tree, hf_cba_acco_diag_data, tvb, offset, u32InLength, ENC_NA);
4285 }
4286
4287 col_append_fstr(pinfo->cinfo, COL_INFO, ": %s: %u bytes",
4288 val_to_str(u32Request, cba_acco_diag_req_vals, "Unknown request (0x%08x)"),
4289 u32InLength);
4290
4291 return offset;
4292 }
4293
4294
4295 static int
4296 dissect_ICBAAccoMgt_GetDiagnosis_resp(tvbuff_t *tvb, int offset,
4297 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
4298 {
4299 uint32_t u32OutLength;
4300
4301
4302 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
4303
4304 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
4305 hf_cba_acco_diag_out_length, &u32OutLength);
4306
4307 if (u32OutLength != 0) {
4308 proto_tree_add_item(tree, hf_cba_acco_diag_data, tvb, offset, u32OutLength, ENC_NA);
4309 }
4310
4311 col_append_fstr(pinfo->cinfo, COL_INFO, ": %u bytes",
4312 u32OutLength);
4313
4314 return offset;
4315 }
4316
4317
4318 static int
4319 dissect_ICBAAccoSync_ReadItems_rqst(tvbuff_t *tvb, int offset,
4320 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
4321 {
4322 uint32_t u32Count;
4323 char szStr[1000];
4324 uint32_t u32MaxStr = sizeof(szStr);
4325 uint32_t u32Pointer;
4326 uint32_t u32ArraySize;
4327 uint32_t u32VariableOffset;
4328 uint32_t u32Idx;
4329
4330
4331 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
4332
4333 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
4334 hf_cba_acco_count, &u32Count);
4335
4336 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
4337 &u32ArraySize);
4338
4339 u32VariableOffset = offset + u32ArraySize*4;
4340
4341 u32Idx = 1;
4342 while (u32ArraySize--) {
4343 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
4344 &u32Pointer);
4345 if (u32Pointer) {
4346 u32VariableOffset = dissect_dcom_indexed_LPWSTR(tvb, u32VariableOffset, pinfo, tree, di, drep,
4347 hf_cba_acco_item, szStr, u32MaxStr, u32Idx);
4348 }
4349
4350 u32Idx++;
4351 }
4352
4353 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count);
4354
4355 return u32VariableOffset;
4356 }
4357
4358
4359
4360
4361 static int
4362 dissect_ICBAAccoSync_ReadItems_resp(tvbuff_t *tvb, int offset,
4363 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
4364 {
4365 uint32_t u32Pointer;
4366 uint16_t u16QC;
4367 uint32_t u32ArraySize = 0;
4368 uint32_t u32HResult;
4369 uint32_t u32Idx;
4370 uint32_t u32SubStart;
4371 uint32_t u32VariableOffset;
4372 uint32_t u32Tmp;
4373
4374
4375 offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
4376
4377 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
4378 &u32Pointer);
4379 u32VariableOffset = offset;
4380
4381 if (u32Pointer) {
4382 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
4383 &u32ArraySize);
4384
4385 u32VariableOffset = offset + u32ArraySize * 20;
4386 u32Idx = 1;
4387 u32Tmp = u32ArraySize;
4388 while(u32Tmp--) {
4389 proto_item *sub_item;
4390 proto_tree *sub_tree;
4391
4392 sub_item = proto_tree_add_item(tree, hf_cba_readitemout, tvb, offset, 0, ENC_NA);
4393 sub_tree = proto_item_add_subtree(sub_item, ett_cba_readitemout);
4394 u32SubStart = offset;
4395
4396 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
4397 &u32Pointer);
4398 if (u32Pointer) {
4399 u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, sub_tree, di, drep, hf_cba_acco_data);
4400 }
4401
4402 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
4403 hf_cba_acco_qc, &u16QC);
4404 offset = dissect_dcom_FILETIME(tvb, offset, pinfo, sub_tree, di, drep,
4405 hf_cba_acco_time_stamp, NULL);
4406
4407 offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, sub_tree, di, drep,
4408 &u32HResult, u32Idx);
4409
4410 proto_item_append_text(sub_item, "[%u]: QC=%s (0x%02x) %s",
4411 u32Idx,
4412 val_to_str_const(u16QC, cba_acco_qc_vals, "Unknown"),
4413 u16QC,
4414 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
4415 proto_item_set_len(sub_item, offset - u32SubStart);
4416
4417 u32Idx++;
4418 }
4419 }
4420
4421 u32VariableOffset = dissect_dcom_HRESULT(tvb, u32VariableOffset, pinfo, tree, di, drep,
4422 &u32HResult);
4423
4424 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u -> %s",
4425 u32ArraySize,
4426 val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
4427
4428 return u32VariableOffset;
4429 }
4430
4431
4432 static int
4433 dissect_ICBAAccoSync_WriteItems_rqst(tvbuff_t *tvb, int offset,
4434 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
4435 {
4436 uint32_t u32Count;
4437 uint32_t u32ArraySize;
4438 char szStr[1000];
4439 uint32_t u32MaxStr = sizeof(szStr);
4440 uint32_t u32Pointer;
4441 uint32_t u32VariableOffset;
4442 uint32_t u32SubStart;
4443 uint32_t u32Idx;
4444
4445
4446 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
4447
4448 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
4449 hf_cba_acco_count, &u32Count);
4450
4451 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
4452 &u32ArraySize);
4453
4454 u32VariableOffset = offset + u32ArraySize * 8;
4455 u32Idx = 1;
4456 while(u32ArraySize--) {
4457 proto_item *sub_item;
4458 proto_tree *sub_tree;
4459
4460 sub_item = proto_tree_add_item(tree, hf_cba_writeitemin, tvb, offset, 0, ENC_NA);
4461 sub_tree = proto_item_add_subtree(sub_item, ett_cba_writeitemin);
4462 u32SubStart = offset;
4463
4464 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
4465 &u32Pointer);
4466 if (u32Pointer) {
4467 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
4468 hf_cba_acco_item, szStr, u32MaxStr);
4469 }
4470 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
4471 &u32Pointer);
4472 if (u32Pointer) {
4473 u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
4474 hf_cba_acco_data);
4475 }
4476
4477 proto_item_append_text(sub_item, "[%u]: Item=\"%s\"", u32Idx, szStr);
4478 proto_item_set_len(sub_item, offset - u32SubStart);
4479
4480 u32Idx++;
4481 }
4482
4483 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count);
4484
4485 return u32VariableOffset;
4486 }
4487
4488
4489
4490 static int
4491 dissect_ICBAAccoSync_WriteItemsQCD_rqst(tvbuff_t *tvb, int offset,
4492 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
4493 {
4494 uint32_t u32Count;
4495 uint32_t u32ArraySize;
4496 char szStr[1000];
4497 uint32_t u32MaxStr = sizeof(szStr);
4498 uint32_t u32Pointer;
4499 uint32_t u32VariableOffset;
4500 uint32_t u32SubStart;
4501 uint32_t u32Idx;
4502 uint16_t u16QC;
4503
4504 offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
4505
4506 offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
4507 hf_cba_acco_count, &u32Count);
4508
4509 offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
4510 &u32ArraySize);
4511
4512 u32VariableOffset = offset + u32ArraySize * 20;
4513 u32Idx = 1;
4514 while(u32ArraySize--) {
4515 proto_item *sub_item;
4516 proto_tree *sub_tree;
4517
4518 sub_item = proto_tree_add_item(tree, hf_cba_writeitemin, tvb, offset, 0, ENC_NA);
4519 sub_tree = proto_item_add_subtree(sub_item, ett_cba_writeitemin);
4520 u32SubStart = offset;
4521
4522 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
4523 &u32Pointer);
4524 if (u32Pointer) {
4525 u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
4526 hf_cba_acco_item, szStr, u32MaxStr);
4527 }
4528
4529 offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, di, drep,
4530 &u32Pointer);
4531 if (u32Pointer) {
4532 u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, sub_tree, di, drep,
4533 hf_cba_acco_data);
4534 }
4535
4536 offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
4537 hf_cba_acco_qc, &u16QC);
4538
4539 offset = dissect_dcom_FILETIME(tvb, offset, pinfo, sub_tree, di, drep,
4540 hf_cba_acco_time_stamp, NULL);
4541
4542 proto_item_append_text(sub_item, "[%u]: Item=\"%s\" QC=%s (0x%02x)",
4543 u32Idx, szStr,
4544 val_to_str_const(u16QC, cba_acco_qc_vals, "Unknown"), u16QC);
4545
4546 proto_item_set_len(sub_item, offset - u32SubStart);
4547 u32Idx++;
4548 }
4549
4550 col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count);
4551
4552 return u32VariableOffset;
4553 }
4554
4555
4556 /* sub dissector table of ICBAAccoMgt / ICBAAccoMgt2 interface */
4557 static const dcerpc_sub_dissector ICBAAccoMgt_dissectors[] = {
4558 { 0, "QueryInterface", NULL, NULL },
4559 { 1, "AddRef", NULL, NULL },
4560 { 2, "Release", NULL, NULL },
4561
4562 { 3, "AddConnections", dissect_ICBAAccoMgt_AddConnections_rqst, dissect_ICBAAccoMgt_AddConnections_resp },
4563 { 4, "RemoveConnections", dissect_ICBAAccoMgt_RemoveConnections_rqst, dissect_HResultArray_resp },
4564 { 5, "ClearConnections", dissect_dcom_simple_rqst, dissect_dcom_simple_resp },
4565 { 6, "SetActivationState", dissect_ICBAAccoMgt_SetActivationState_rqst, dissect_HResultArray_resp },
4566 { 7, "GetInfo", dissect_dcom_simple_rqst, dissect_ICBAAccoMgt_GetInfo_resp },
4567 { 8, "GetIDs", dissect_dcom_simple_rqst, dissect_ICBAAccoMgt_GetIDs_resp },
4568 { 9, "GetConnections", dissect_ICBAAccoMgt_GetConnections_rqst, dissect_ICBAAccoMgt_GetConnections_resp },
4569 {10, "ReviseQoS", dissect_ICBAAccoMgt_ReviseQoS_rqst, dissect_ICBAAccoMgt_ReviseQoS_resp },
4570 {11, "get_PingFactor", dissect_dcom_simple_rqst, dissect_ICBAAccoMgt_get_PingFactor_resp },
4571 {12, "put_PingFactor", dissect_ICBAAccoMgt_put_PingFactor_rqst, dissect_dcom_simple_resp },
4572 {13, "get_CDBCookie", dissect_dcom_simple_rqst, dissect_ICBAAccoMgt_get_CDBCookie_resp },
4573 /* stage 2 */
4574 {14, "GetConsIDs", dissect_dcom_simple_rqst, dissect_ICBAAccoMgt2_GetConsIDs_resp },
4575 {15, "GetConsConnections", dissect_ICBAAccoMgt_GetConnections_rqst, dissect_ICBAAccoMgt2_GetConsConnections_resp },
4576 {16, "DiagConsConnections", dissect_ICBAAccoMgt_GetConnections_rqst, dissect_ICBAAccoMgt2_DiagConsConnections_resp },
4577 {17, "GetProvIDs", dissect_dcom_simple_rqst, dissect_Server_GetProvIDs_resp },
4578 {18, "GetProvConnections", dissect_Server_GetProvConnections_rqst, dissect_Server_GetProvConnections_resp },
4579 {19, "GetDiagnosis", dissect_ICBAAccoMgt_GetDiagnosis_rqst, dissect_ICBAAccoMgt_GetDiagnosis_resp },
4580 { 0, NULL, NULL, NULL },
4581 };
4582
4583
4584 /* sub dissector table of ICBAAccoCallback interface */
4585 static const dcerpc_sub_dissector ICBAAccoCallback_dissectors[] = {
4586 { 0, "QueryInterface", NULL, NULL },
4587 { 1, "AddRef", NULL, NULL },
4588 { 2, "Release", NULL, NULL },
4589
4590 { 3, "OnDataChanged", dissect_ICBAAccoCallback_OnDataChanged_rqst, dissect_ICBAAccoCallback_OnDataChanged_resp },
4591 /* stage 2 */
4592 { 4, "Gnip", dissect_ICBAAccoCallback_Gnip_rqst, dissect_ICBAAccoCallback_Gnip_resp },
4593 { 0, NULL, NULL, NULL },
4594 };
4595
4596
4597 /* sub dissector table of ICBAAccoServer interface */
4598 static const dcerpc_sub_dissector ICBAAccoServer_dissectors[] = {
4599 { 0, "QueryInterface", NULL, NULL },
4600 { 1, "AddRef", NULL, NULL },
4601 { 2, "Release", NULL, NULL },
4602
4603 { 3, "Connect", dissect_ICBAAccoServer_Connect_rqst, dissect_ICBAAccoServer_Connect_resp },
4604 { 4, "Disconnect", dissect_ICBAAccoServer_Disconnect_rqst, dissect_ICBAAccoServer_Disconnect_resp },
4605 { 5, "DisconnectMe", dissect_ICBAAccoServer_DisconnectMe_rqst, dissect_ICBAAccoServer_DisconnectMe_resp },
4606 { 6, "SetActivation", dissect_ICBAAccoServer_SetActivation_rqst, dissect_ICBAAccoServer_SetActivation_resp },
4607 { 7, "Ping", dissect_ICBAAccoServer_Ping_rqst, dissect_ICBAAccoServer_Ping_resp },
4608 /* stage 2 */
4609 { 8, "Connect2", dissect_ICBAAccoServer2_Connect2_rqst, dissect_ICBAAccoServer_Connect_resp },
4610 { 9, "GetConnectionData", dissect_ICBAAccoServer2_GetConnectionData_rqst, dissect_ICBAAccoServer2_GetConnectionData_resp },
4611 { 0, NULL, NULL, NULL },
4612 };
4613
4614
4615 /* sub dissector table of ICBAAccoServerSRT interface (stage 2 only) */
4616 static const dcerpc_sub_dissector ICBAAccoServerSRT_dissectors[] = {
4617 { 0, "QueryInterface", NULL, NULL },
4618 { 1, "AddRef", NULL, NULL },
4619 { 2, "Release", NULL, NULL },
4620
4621 { 3, "ConnectCR", dissect_ICBAAccoServerSRT_ConnectCR_rqst, dissect_ICBAAccoServerSRT_ConnectCR_resp },
4622 { 4, "DisconnectCR", dissect_ICBAAccoServerSRT_DisconnectCR_rqst, dissect_ICBAAccoServerSRT_DisconnectCR_resp },
4623 { 5, "Connect", dissect_ICBAAccoServerSRT_Connect_rqst, dissect_ICBAAccoServerSRT_Connect_resp },
4624 { 6, "Disconnect", dissect_ICBAAccoServerSRT_Disconnect_rqst, dissect_ICBAAccoServerSRT_Disconnect_resp },
4625 { 7, "DisconnectMe", dissect_ICBAAccoServerSRT_DisconnectMe_rqst, dissect_ICBAAccoServerSRT_DisconnectMe_resp },
4626 { 8, "SetActivation", dissect_ICBAAccoServerSRT_SetActivation_rqst, dissect_ICBAAccoServerSRT_SetActivation_resp },
4627 { 0, NULL, NULL, NULL },
4628 };
4629
4630
4631 /* sub dissector table of ICBAAccoSync interface */
4632 static const dcerpc_sub_dissector ICBAAccoSync_dissectors[] = {
4633 { 0, "QueryInterface", NULL, NULL },
4634 { 1, "AddRef", NULL, NULL },
4635 { 2, "Release", NULL, NULL },
4636
4637 { 3, "ReadItems", dissect_ICBAAccoSync_ReadItems_rqst, dissect_ICBAAccoSync_ReadItems_resp },
4638 { 4, "WriteItems", dissect_ICBAAccoSync_WriteItems_rqst, dissect_HResultArray_resp },
4639 { 5, "WriteItemsQCD", dissect_ICBAAccoSync_WriteItemsQCD_rqst, dissect_HResultArray_resp },
4640 { 0, NULL, NULL, NULL },
4641 };
4642
4643
4644 /* register protocol */
4645 void
4646 proto_register_dcom_cba_acco (void)
4647 {
4648 static int *ett3[3];
4649 static int *ett4[4];
4650 static int *ett5[5];
4651
4652
4653 static hf_register_info hf_cba_acco_array[] = {
4654 { &hf_cba_acco_opnum,
4655 { "Operation", "cba.acco.opnum",
4656 FT_UINT16, BASE_DEC, NULL, 0x0,
4657 NULL, HFILL }
4658 },
4659 { &hf_cba_acco_ping_factor,
4660 { "PingFactor", "cba.acco.ping_factor",
4661 FT_UINT16, BASE_DEC, NULL, 0x0,
4662 NULL, HFILL }
4663 },
4664 { &hf_cba_acco_count,
4665 { "Count", "cba.acco.count",
4666 FT_UINT32, BASE_DEC, NULL, 0x0,
4667 NULL, HFILL }
4668 },
4669 { &hf_cba_acco_info_max,
4670 { "Max", "cba.acco.info_max",
4671 FT_UINT32, BASE_DEC, NULL, 0x0,
4672 NULL, HFILL }
4673 },
4674 { &hf_cba_acco_info_curr,
4675 { "Current", "cba.acco.info_curr",
4676 FT_UINT32, BASE_DEC, NULL, 0x0,
4677 NULL, HFILL }
4678 },
4679 { &hf_cba_acco_rtauto,
4680 { "RTAuto", "cba.acco.rtauto",
4681 FT_STRING, BASE_NONE, NULL, 0x0,
4682 NULL, HFILL }
4683 },
4684 { &hf_cba_acco_item,
4685 { "Item", "cba.acco.item",
4686 FT_STRING, BASE_NONE, NULL, 0x0,
4687 NULL, HFILL }
4688 },
4689 { &hf_cba_acco_data,
4690 { "Data", "cba.acco.data",
4691 FT_NONE, BASE_NONE, NULL, 0x0,
4692 NULL, HFILL }
4693 },
4694 { &hf_cba_acco_qc,
4695 { "QualityCode", "cba.acco.qc",
4696 FT_UINT8, BASE_HEX, VALS(cba_acco_qc_vals), 0x0,
4697 NULL, HFILL }
4698 },
4699 { &hf_cba_acco_time_stamp,
4700 { "TimeStamp", "cba.acco.time_stamp",
4701 FT_UINT64, BASE_DEC, NULL, 0x0,
4702 NULL, HFILL }
4703 },
4704 { &hf_cba_readitemout,
4705 { "ReadItemOut", "cba.acco.readitemout",
4706 FT_NONE, BASE_NONE, NULL, 0x0,
4707 NULL, HFILL }
4708 },
4709 { &hf_cba_writeitemin,
4710 { "WriteItemIn", "cba.acco.writeitemin",
4711 FT_NONE, BASE_NONE, NULL, 0x0,
4712 NULL, HFILL }
4713 },
4714 { &hf_cba_acco_cdb_cookie,
4715 { "CDBCookie", "cba.acco.cdb_cookie",
4716 FT_UINT32, BASE_HEX, NULL, 0x0,
4717 NULL, HFILL }
4718 },
4719 /* dcom_hresult_vals from packet-dcom.h doesn't work here, as length is unknown! */
4720 { &hf_cba_acco_conn_error_state,
4721 { "ConnErrorState", "cba.acco.conn_error_state",
4722 FT_UINT32, BASE_HEX, NULL /*VALS(dcom_hresult_vals)*/, 0x0,
4723 NULL, HFILL }
4724 },
4725 { &hf_cba_acco_diag_req,
4726 { "Request", "cba.acco.diag_req",
4727 FT_UINT32, BASE_HEX, VALS(cba_acco_diag_req_vals), 0x0,
4728 NULL, HFILL }
4729 },
4730 { &hf_cba_acco_diag_in_length,
4731 { "InLength", "cba.acco.diag_in_length",
4732 FT_UINT32, BASE_DEC, NULL, 0x0,
4733 NULL, HFILL }
4734 },
4735 { &hf_cba_acco_diag_out_length,
4736 { "OutLength", "cba.acco.diag_out_length",
4737 FT_UINT32, BASE_DEC, NULL, 0x0,
4738 NULL, HFILL }
4739 },
4740 { &hf_cba_acco_diag_data,
4741 { "Data", "cba.acco.diag_data",
4742 FT_BYTES, BASE_NONE, NULL, 0x0,
4743 NULL, HFILL }
4744 },
4745 { &hf_cba_acco_dcom_call,
4746 { "DcomRuntime", "cba.acco.dcom",
4747 FT_BOOLEAN, BASE_NONE, TFS(&cba_acco_call_flags), 0x0,
4748 "This is a DCOM runtime context", HFILL }
4749 },
4750 { &hf_cba_acco_srt_call,
4751 { "SrtRuntime", "cba.acco.srt",
4752 FT_BOOLEAN, BASE_NONE, TFS(&cba_acco_call_flags), 0x0,
4753 "This is an SRT runtime context", HFILL }
4754 }
4755
4756 };
4757
4758 static hf_register_info hf_cba_acco_server[] = {
4759 #if 0
4760 { &hf_cba_acco_server_pICBAAccoCallback,
4761 { "pICBAAccoCallback", "cba.acco.server_pICBAAccoCallback",
4762 FT_BYTES, BASE_NONE, NULL, 0x0,
4763 NULL, HFILL }
4764 },
4765 #endif
4766 { &hf_cba_acco_server_first_connect,
4767 { "FirstConnect", "cba.acco.server_first_connect",
4768 FT_UINT8, BASE_HEX, NULL, 0x0,
4769 NULL, HFILL }
4770 },
4771 { &hf_cba_getprovconnout,
4772 { "GETPROVCONNOUT", "cba.acco.getprovconnout",
4773 FT_NONE, BASE_NONE, NULL, 0x0,
4774 NULL, HFILL }
4775 },
4776 { &hf_cba_acco_serversrt_prov_mac,
4777 { "ProviderMAC", "cba.acco.serversrt_prov_mac",
4778 FT_ETHER, BASE_NONE, NULL, 0x0,
4779 NULL, HFILL }
4780 },
4781 { &hf_cba_acco_serversrt_cons_mac,
4782 { "ConsumerMAC", "cba.acco.serversrt_cons_mac",
4783 FT_ETHER, BASE_NONE, NULL, 0x0,
4784 NULL, HFILL }
4785 },
4786 { &hf_cba_acco_serversrt_cr_id,
4787 { "ConsumerCRID", "cba.acco.serversrt_cr_id",
4788 FT_UINT16, BASE_HEX, NULL, 0x0,
4789 NULL, HFILL }
4790 },
4791 { &hf_cba_acco_serversrt_cr_length,
4792 { "CRLength", "cba.acco.serversrt_cr_length",
4793 FT_UINT16, BASE_DEC, NULL, 0x0,
4794 NULL, HFILL }
4795 },
4796 { &hf_cba_acco_serversrt_cr_flags,
4797 { "Flags", "cba.acco.serversrt_cr_flags",
4798 FT_UINT32, BASE_HEX, 0, 0x0,
4799 NULL, HFILL }
4800 },
4801 { &hf_cba_acco_serversrt_cr_flags_timestamped,
4802 { "Timestamped", "cba.acco.serversrt_cr_flags_timestamped",
4803 FT_BOOLEAN, 32, TFS (&acco_flags_set_truth), 0x1,
4804 NULL, HFILL }
4805 },
4806 { &hf_cba_acco_serversrt_cr_flags_reconfigure,
4807 { "Reconfigure", "cba.acco.serversrt_cr_flags_reconfigure",
4808 FT_BOOLEAN, 32, TFS (&acco_flags_set_truth), 0x2,
4809 NULL, HFILL }
4810 },
4811 { &hf_cba_type_desc_len,
4812 { "TypeDescLen", "cba.acco.type_desc_len",
4813 FT_UINT16, BASE_DEC, NULL, 0x0,
4814 NULL, HFILL }
4815 },
4816 { &hf_cba_acco_serversrt_record_length,
4817 { "RecordLength", "cba.acco.serversrt_record_length",
4818 FT_UINT16, BASE_DEC, NULL, 0x0,
4819 NULL, HFILL }
4820 },
4821 #if 0
4822 { &hf_cba_acco_serversrt_action,
4823 { "Action", "cba.acco.serversrt_action",
4824 FT_UINT32, BASE_DEC, VALS(cba_acco_serversrt_action_vals), 0x0,
4825 NULL, HFILL }
4826 },
4827 #endif
4828 { &hf_cba_acco_serversrt_last_connect,
4829 { "LastConnect", "cba.acco.serversrt_last_connect",
4830 FT_UINT8, BASE_DEC, VALS(cba_acco_serversrt_last_connect_vals), 0x0,
4831 NULL, HFILL }
4832 },
4833 };
4834
4835 static hf_register_info hf_cba_connectcr_array[] = {
4836 { &hf_cba_acco_prov_crid,
4837 { "ProviderCRID", "cba.acco.prov_crid",
4838 FT_UINT32, BASE_HEX, NULL, 0x0,
4839 NULL, HFILL }
4840 },
4841 };
4842
4843 static hf_register_info hf_cba_connect_array[] = {
4844 { &hf_cba_addconnectionin,
4845 { "ADDCONNECTIONIN", "cba.acco.addconnectionin",
4846 FT_NONE, BASE_NONE, NULL, 0x0,
4847 NULL, HFILL }
4848 },
4849 { &hf_cba_addconnectionout,
4850 { "ADDCONNECTIONOUT", "cba.acco.addconnectionout",
4851 FT_NONE, BASE_NONE, NULL, 0x0,
4852 NULL, HFILL }
4853 },
4854 { &hf_cba_getidout,
4855 { "GETIDOUT", "cba.acco.getidout",
4856 FT_NONE, BASE_NONE, NULL, 0x0,
4857 NULL, HFILL }
4858 },
4859 { &hf_cba_getconnectionout,
4860 { "GETCONNECTIONOUT", "cba.acco.getconnectionout",
4861 FT_NONE, BASE_NONE, NULL, 0x0,
4862 NULL, HFILL }
4863 },
4864 { &hf_cba_getconsconnout,
4865 { "GETCONSCONNOUT", "cba.acco.getconsconnout",
4866 FT_NONE, BASE_NONE, NULL, 0x0,
4867 NULL, HFILL }
4868 },
4869 { &hf_cba_diagconsconnout,
4870 { "DIAGCONSCONNOUT", "cba.acco.diagconsconnout",
4871 FT_NONE, BASE_NONE, NULL, 0x0,
4872 NULL, HFILL }
4873 },
4874 { &hf_cba_connectincr,
4875 { "CONNECTINCR", "cba.acco.connectincr",
4876 FT_NONE, BASE_NONE, NULL, 0x0,
4877 NULL, HFILL }
4878 },
4879 { &hf_cba_connectoutcr,
4880 { "CONNECTOUTCR", "cba.acco.connectoutcr",
4881 FT_NONE, BASE_NONE, NULL, 0x0,
4882 NULL, HFILL }
4883 },
4884 { &hf_cba_connectin,
4885 { "CONNECTIN", "cba.acco.connectin",
4886 FT_NONE, BASE_NONE, NULL, 0x0,
4887 NULL, HFILL }
4888 },
4889 { &hf_cba_connectout,
4890 { "CONNECTOUT", "cba.acco.connectout",
4891 FT_NONE, BASE_NONE, NULL, 0x0,
4892 NULL, HFILL }
4893 },
4894 { &hf_cba_acco_conn_prov_id,
4895 { "ProviderID", "cba.acco.conn_prov_id",
4896 FT_UINT32, BASE_HEX, NULL, 0x0,
4897 NULL, HFILL }
4898 },
4899 { &hf_cba_acco_conn_cons_id,
4900 { "ConsumerID", "cba.acco.conn_cons_id",
4901 FT_UINT32, BASE_HEX, NULL, 0x0,
4902 NULL, HFILL }
4903 },
4904 { &hf_cba_acco_conn_version,
4905 { "ConnVersion", "cba.acco.conn_version",
4906 FT_UINT16, BASE_HEX, NULL, 0x0,
4907 NULL, HFILL }
4908 },
4909 { &hf_cba_acco_conn_consumer,
4910 { "Consumer", "cba.acco.conn_consumer",
4911 FT_STRING, BASE_NONE, NULL, 0x0,
4912 NULL, HFILL }
4913 },
4914 { &hf_cba_acco_conn_qos_type,
4915 { "QoSType", "cba.acco.conn_qos_type",
4916 FT_UINT16, BASE_HEX, VALS(cba_qos_type_vals), 0x0,
4917 NULL, HFILL }
4918 },
4919 { &hf_cba_acco_conn_qos_value,
4920 { "QoSValue", "cba.acco.conn_qos_value",
4921 FT_UINT16, BASE_DEC, NULL, 0x0,
4922 NULL, HFILL }
4923 },
4924 { &hf_cba_acco_conn_state,
4925 { "State", "cba.acco.conn_state",
4926 FT_UINT8, BASE_HEX, VALS(cba_acco_conn_state_vals), 0x0,
4927 NULL, HFILL }
4928 },
4929 { &hf_cba_acco_conn_provider,
4930 { "Provider", "cba.acco.conn_provider",
4931 FT_STRING, BASE_NONE, NULL, 0x0,
4932 NULL, HFILL }
4933 },
4934 { &hf_cba_acco_conn_provider_item,
4935 { "ProviderItem", "cba.acco.conn_provider_item",
4936 FT_STRING, BASE_NONE, NULL, 0x0,
4937 NULL, HFILL }
4938 },
4939 { &hf_cba_acco_conn_consumer_item,
4940 { "ConsumerItem", "cba.acco.conn_consumer_item",
4941 FT_STRING, BASE_NONE, NULL, 0x0,
4942 NULL, HFILL }
4943 },
4944 { &hf_cba_acco_conn_persist,
4945 { "Persistence", "cba.acco.conn_persist",
4946 FT_UINT16, BASE_HEX, VALS(cba_persist_vals), 0x0,
4947 NULL, HFILL }
4948 },
4949 { &hf_cba_acco_conn_epsilon,
4950 { "Epsilon", "cba.acco.conn_epsilon",
4951 FT_NONE, BASE_NONE, NULL, 0x0,
4952 NULL, HFILL }
4953 },
4954 { &hf_cba_acco_conn_substitute,
4955 { "Substitute", "cba.acco.conn_substitute",
4956 FT_NONE, BASE_NONE, NULL, 0x0,
4957 NULL, HFILL }
4958 },
4959 };
4960
4961 static hf_register_info hf_cba_acco_cb[] = {
4962 { &hf_cba_acco_cb_length,
4963 { "Length", "cba.acco.cb_length",
4964 FT_UINT32, BASE_DEC, NULL, 0x0,
4965 NULL, HFILL }
4966 },
4967 { &hf_cba_acco_cb_version,
4968 { "Version", "cba.acco.cb_version",
4969 FT_UINT8, BASE_HEX, NULL, 0x0,
4970 NULL, HFILL }
4971 },
4972 { &hf_cba_acco_cb_flags,
4973 { "Flags", "cba.acco.cb_flags",
4974 FT_UINT8, BASE_HEX, NULL, 0x0,
4975 NULL, HFILL }
4976 },
4977 { &hf_cba_acco_cb_count,
4978 { "Count", "cba.acco.cb_count",
4979 FT_UINT16, BASE_DEC, NULL, 0x0,
4980 NULL, HFILL }
4981 },
4982 { &hf_cba_acco_cb_conn_data,
4983 { "CBA Connection data", "cba.acco.cb_conn_data",
4984 FT_NONE, BASE_NONE, NULL, 0x0,
4985 NULL, HFILL }
4986 },
4987 { &hf_cba_acco_cb_item,
4988 { "Item", "cba.acco.cb_item",
4989 FT_NONE, BASE_NONE, NULL, 0x0,
4990 NULL, HFILL }
4991 },
4992 { &hf_cba_acco_cb_item_hole,
4993 { "Hole", "cba.acco.cb_item_hole",
4994 FT_NONE, BASE_NONE, NULL, 0x0,
4995 NULL, HFILL }
4996 },
4997 { &hf_cba_acco_cb_item_length,
4998 { "Length", "cba.acco.cb_item_length",
4999 FT_UINT16, BASE_DEC, NULL, 0x0,
5000 NULL, HFILL }
5001 },
5002 { &hf_cba_acco_cb_item_data,
5003 { "Data(Hex)", "cba.acco.cb_item_data",
5004 FT_BYTES, BASE_NONE, NULL, 0x0,
5005 NULL, HFILL }
5006 },
5007 { &hf_cba_connect_in,
5008 { "Connect in frame", "cba.connect_in",
5009 FT_FRAMENUM, BASE_NONE, NULL, 0,
5010 "This connection Connect was in the packet with this number", HFILL }
5011 },
5012 { &hf_cba_disconnect_in,
5013 { "Disconnect in frame", "cba.disconnect_in",
5014 FT_FRAMENUM, BASE_NONE, NULL, 0,
5015 "This connection Disconnect was in the packet with this number", HFILL }
5016 },
5017 { &hf_cba_connectcr_in,
5018 { "ConnectCR in frame", "cba.connectcr_in",
5019 FT_FRAMENUM, BASE_NONE, NULL, 0,
5020 "This frame ConnectCR was in the packet with this number", HFILL }
5021 },
5022 { &hf_cba_disconnectcr_in,
5023 { "DisconnectCR in frame", "cba.disconnectcr_in",
5024 FT_FRAMENUM, BASE_NONE, NULL, 0,
5025 "This frame DisconnectCR was in the packet with this number", HFILL }
5026 },
5027 { &hf_cba_disconnectme_in,
5028 { "DisconnectMe in frame", "cba.disconnectme_in",
5029 FT_FRAMENUM, BASE_NONE, NULL, 0,
5030 "This connection/frame DisconnectMe was in the packet with this number", HFILL }
5031 },
5032 { &hf_cba_data_first_in,
5033 { "First data in frame", "cba.data_first_in",
5034 FT_FRAMENUM, BASE_NONE, NULL, 0,
5035 "The first data of this connection/frame in the packet with this number", HFILL }
5036 },
5037 { &hf_cba_data_last_in,
5038 { "Last data in frame", "cba.data_last_in",
5039 FT_FRAMENUM, BASE_NONE, NULL, 0,
5040 "The last data of this connection/frame in the packet with this number", HFILL }
5041 },
5042 };
5043
5044 static ei_register_info ei[] = {
5045 { &ei_cba_acco_pdev_find, { "cba.acco.pdev_find.fail", PI_UNDECODED, PI_NOTE, "pdev_find: no pdev for IP", EXPFILL }},
5046 { &ei_cba_acco_pdev_find_unknown_interface, { "cba.acco.pdev_find.unknown_interface", PI_UNDECODED, PI_NOTE, "pdev_find: unknown interface", EXPFILL }},
5047 { &ei_cba_acco_ldev_unknown, { "cba.acco.ldev.unknown", PI_UNDECODED, PI_NOTE, "Unknown LDev", EXPFILL }},
5048 { &ei_cba_acco_ipid_unknown, { "cba.acco.ipid.unknown", PI_UNDECODED, PI_NOTE, "Unknown IPID", EXPFILL }},
5049 { &ei_cba_acco_prov_crid, { "cba.acco.prov_crid.unknown", PI_UNDECODED, PI_NOTE, "Unknown provider frame ProvCRID", EXPFILL }},
5050 { &ei_cba_acco_conn_consumer, { "cba.acco.conn_consumer.invalid", PI_UNDECODED, PI_NOTE, "Consumer interface invalid", EXPFILL }},
5051 { &ei_cba_acco_no_request_info, { "cba.acco.no_request_info", PI_UNDECODED, PI_NOTE, "No request info, response data ignored", EXPFILL }},
5052 { &ei_cba_acco_qc, { "cba.acco.qc.expert", PI_RESPONSE_CODE, PI_CHAT, "expert QC", EXPFILL }},
5053 { &ei_cba_acco_disconnect, { "cba.acco.disconnect", PI_SEQUENCE, PI_NOTE, "Disconnection sequence issue", EXPFILL }},
5054 { &ei_cba_acco_connect, { "cba.acco.connect_not_set", PI_SEQUENCE, PI_NOTE, "packet_connect not set", EXPFILL }},
5055 };
5056
5057 expert_module_t* expert_cba_acco;
5058
5059 ett5[0] = &ett_ICBAAccoMgt;
5060 ett5[1] = &ett_cba_addconnectionin;
5061 ett5[2] = &ett_cba_addconnectionout;
5062 ett5[3] = &ett_cba_getidout;
5063 ett5[4] = &ett_cba_getconnectionout;
5064 proto_ICBAAccoMgt = proto_register_protocol ("ICBAAccoMgt", "ICBAAccoMgt", "cba_acco_mgt");
5065 proto_register_field_array(proto_ICBAAccoMgt, hf_cba_acco_array, array_length(hf_cba_acco_array));
5066 proto_register_field_array(proto_ICBAAccoMgt, hf_cba_connect_array, array_length(hf_cba_connect_array));
5067 proto_register_field_array(proto_ICBAAccoMgt, hf_cba_connectcr_array, array_length(hf_cba_connectcr_array));
5068 proto_register_subtree_array (ett5, array_length (ett5));
5069
5070 /* XXX - just pick a protocol to register the expert info in */
5071 /* XXX - also, just pick a protocol to use proto_data for */
5072 expert_cba_acco = expert_register_protocol(proto_ICBAAccoMgt);
5073 expert_register_field_array(expert_cba_acco, ei, array_length(ei));
5074
5075 proto_ICBAAccoMgt2 = proto_register_protocol ("ICBAAccoMgt2", "ICBAAccoMgt2", "cba_acco_mgt2");
5076
5077 ett3[0] = &ett_ICBAAccoCallback;
5078 ett3[1] = &ett_ICBAAccoCallback_Item;
5079 ett3[2] = &ett_ICBAAccoCallback_Buffer;
5080 proto_ICBAAccoCallback = proto_register_protocol ("ICBAAccoCallback", "ICBAAccoCB", "cba_acco_cb");
5081 proto_register_field_array(proto_ICBAAccoCallback, hf_cba_acco_cb, array_length(hf_cba_acco_cb));
5082 proto_register_subtree_array (ett3, array_length (ett3));
5083
5084 proto_ICBAAccoCallback2 = proto_register_protocol ("ICBAAccoCallback2", "ICBAAccoCB2", "cba_acco_cb2");
5085
5086 ett4[0] = &ett_ICBAAccoServer;
5087 ett4[1] = &ett_cba_connectin;
5088 ett4[2] = &ett_cba_connectout;
5089 ett4[3] = &ett_cba_getprovconnout;
5090 proto_ICBAAccoServer = proto_register_protocol ("ICBAAccoServer", "ICBAAccoServ", "cba_acco_server");
5091 proto_register_field_array(proto_ICBAAccoServer, hf_cba_acco_server, array_length(hf_cba_acco_server));
5092 proto_register_subtree_array (ett4, array_length (ett4));
5093
5094 proto_ICBAAccoServer2 = proto_register_protocol ("ICBAAccoServer2", "ICBAAccoServ2", "cba_acco_server2");
5095
5096 ett4[0] = &ett_ICBAAccoServerSRT;
5097 ett4[1] = &ett_cba_acco_serversrt_cr_flags;
5098 ett4[2] = &ett_cba_connectincr;
5099 ett4[3] = &ett_cba_connectoutcr;
5100 proto_ICBAAccoServerSRT = proto_register_protocol ("ICBAAccoServerSRT", "ICBAAccoServSRT", "cba_acco_server_srt");
5101 proto_register_subtree_array (ett4, array_length (ett4));
5102
5103 ett5[0] = &ett_ICBAAccoSync;
5104 ett5[1] = &ett_cba_readitemout;
5105 ett5[2] = &ett_cba_writeitemin;
5106 ett5[3] = &ett_cba_frame_info;
5107 ett5[4] = &ett_cba_conn_info;
5108 proto_ICBAAccoSync = proto_register_protocol ("ICBAAccoSync", "ICBAAccoSync", "cba_acco_sync");
5109 proto_register_subtree_array (ett5, array_length (ett5));
5110
5111 register_conversation_filter("cba", "PN-CBA", cba_filter_valid, cba_build_filter, NULL);
5112 }
5113
5114
5115 /* handoff protocol */
5116 void
5117 proto_reg_handoff_dcom_cba_acco (void)
5118 {
5119 /* Register the interfaces */
5120 dcerpc_init_uuid(proto_ICBAAccoMgt, ett_ICBAAccoMgt,
5121 &uuid_ICBAAccoMgt, ver_ICBAAccoMgt, ICBAAccoMgt_dissectors, hf_cba_acco_opnum);
5122
5123 dcerpc_init_uuid(proto_ICBAAccoMgt2, ett_ICBAAccoMgt,
5124 &uuid_ICBAAccoMgt2, ver_ICBAAccoMgt2, ICBAAccoMgt_dissectors, hf_cba_acco_opnum);
5125
5126 dcerpc_init_uuid(proto_ICBAAccoCallback, ett_ICBAAccoCallback,
5127 &uuid_ICBAAccoCallback, ver_ICBAAccoCallback, ICBAAccoCallback_dissectors, hf_cba_acco_opnum);
5128
5129 dcerpc_init_uuid(proto_ICBAAccoCallback2, ett_ICBAAccoCallback,
5130 &uuid_ICBAAccoCallback2, ver_ICBAAccoCallback2, ICBAAccoCallback_dissectors, hf_cba_acco_opnum);
5131
5132 dcerpc_init_uuid(proto_ICBAAccoServer, ett_ICBAAccoServer,
5133 &uuid_ICBAAccoServer, ver_ICBAAccoServer, ICBAAccoServer_dissectors, hf_cba_acco_opnum);
5134
5135 dcerpc_init_uuid(proto_ICBAAccoServer2, ett_ICBAAccoServer,
5136 &uuid_ICBAAccoServer2, ver_ICBAAccoServer2, ICBAAccoServer_dissectors, hf_cba_acco_opnum);
5137
5138 dcerpc_init_uuid(proto_ICBAAccoServerSRT, ett_ICBAAccoServerSRT,
5139 &uuid_ICBAAccoServerSRT, ver_ICBAAccoServerSRT, ICBAAccoServerSRT_dissectors, hf_cba_acco_opnum);
5140
5141 dcerpc_init_uuid(proto_ICBAAccoSync, ett_ICBAAccoSync,
5142 &uuid_ICBAAccoSync, ver_ICBAAccoSync, ICBAAccoSync_dissectors, hf_cba_acco_opnum);
5143
5144
5145 heur_dissector_add("pn_rt", dissect_CBA_Connection_Data_heur, "PROFINET CBA IO", "pn_cba_pn_rt", proto_ICBAAccoServer, HEURISTIC_ENABLE);
5146 }
5147
5148 /*
5149 * Editor modelines - https://www.wireshark.org/tools/modelines.html
5150 *
5151 * Local variables:
5152 * c-basic-offset: 4
5153 * tab-width: 8
5154 * indent-tabs-mode: nil
5155 * End:
5156 *
5157 * vi: set shiftwidth=4 tabstop=8 expandtab:
5158 * :indentSize=4:tabSize=8:noTabs=true:
5159 */
Metzes wireshark repo