epan/dissectors/pidl/witness/witness.cnf

   1 MANUAL witness_dissect_element_interfaceInfo_group_name
   2 NOEMIT witness_dissect_element_interfaceInfo_group_name
   3 MANUAL witness_dissect_struct_notifyResponse
   4 MANUAL witness_dissect_element_notifyResponse_messages
   5 NOEMIT witness_dissect_element_notifyResponse_messages
   6 MANUAL witness_dissect_struct_IPaddrInfoList
   7 NOEMIT witness_dissect_struct_IPaddrInfoList
   8 NOEMIT witness_dissect_element_IPaddrInfoList_addr
   9
  10 MANUAL witness_dissect_element_notifyResponse_type
  11 NOEMIT witness_dissect_element_notifyResponse_type
  12
  13 HF_FIELD hf_witness_witness_notifyResponse_messages_ "Messages" "witness.witness_notifyResponse.messages_" FT_NONE BASE_NONE NULL 0 "" "" ""
  14
  15 TYPE ipv4address "offset=PIDL_dissect_ipv4address(tvb, offset, pinfo, tree, di, drep, @HF@, PIDL_SET_COL_INFO);" FT_IPv4 BASE_NONE 0 NULL 4
  16
  17 TYPE ipv6address "offset=PIDL_dissect_ipv6address(tvb, offset, pinfo, tree, di, drep, @HF@, PIDL_SET_COL_INFO);" FT_IPv6 BASE_NONE 0 NULL 2
  18
  19 CODE START
  20
  21  #include "to_str.h"
  22
  23 static int
  24 witness_dissect_notifyResponse_message(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_);
  25
  26 static int
  27 witness_dissect_notifyResponse_message_(tvbuff_t *tvb, int offset, int length _U_, packet_info *pinfo,
  28                                         proto_tree *tree, dcerpc_info *di, uint8_t *drep _U_)
  29 {
  30         uint32_t *type = (uint32_t *)di->private_data;
  31         uint8_t le_drep[4] = { DREP_LITTLE_ENDIAN, };
  32         return witness_dissect_notifyResponse_message(tvb, offset, pinfo, tree, di, le_drep,
  33                                                       hf_witness_witness_notifyResponse_messages_, *type);
  34 }
  35
  36 static int
  37 witness_dissect_element_notifyResponse_messages(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info *di _U_, uint8_t *drep _U_)
  38 {
  39         offset = dissect_ndr_ucarray_block(tvb, offset, pinfo, tree, di, drep,
  40                                            witness_dissect_notifyResponse_message_);
  41         return offset;
  42 }
  43
  44 static int
  45 witness_dissect_element_notifyResponse_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, uint32_t *type)
  46 {
  47         offset = witness_dissect_enum_notifyResponse_type(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_notifyResponse_type, type);
  48
  49         return offset;
  50 }
  51
  52 int
  53 witness_dissect_struct_notifyResponse(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
  54 {
  55         uint32_t *type = NULL;
  56         proto_item *item = NULL;
  57         proto_tree *tree = NULL;
  58         int old_offset;
  59         uint32_t num = 0;
  60
  61         ALIGN_TO_4_BYTES;
  62
  63         old_offset = offset;
  64
  65         if (parent_tree) {
  66                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
  67                 tree = proto_item_add_subtree(item, ett_witness_witness_notifyResponse);
  68         }
  69
  70         type = wmem_new0(pinfo->pool, uint32_t);
  71
  72         offset = witness_dissect_element_notifyResponse_type(tvb, offset, pinfo, tree, di, drep, type);
  73
  74         offset = witness_dissect_element_notifyResponse_length(tvb, offset, pinfo, tree, di, drep);
  75
  76         offset = witness_dissect_element_notifyResponse_num(tvb, offset, pinfo, tree, di, drep, &num);
  77
  78         di->private_data = type;
  79         offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep,
  80                                               witness_dissect_element_notifyResponse_messages,
  81                                               NDR_POINTER_UNIQUE, "Pointer to Message Buffer (uint8)",
  82                                               hf_witness_witness_notifyResponse_messages);
  83
  84         proto_item_set_len(item, offset-old_offset);
  85
  86         if (di->call_data->flags & DCERPC_IS_NDR64) {
  87                 ALIGN_TO_4_BYTES;
  88         }
  89
  90         return offset;
  91 }
  92
  93 static int
  94 witness_dissect_element_IPaddrInfoList_addr(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
  95 {
  96         offset = witness_dissect_struct_IPaddrInfo(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_IPaddrInfoList_addr,0);
  97
  98         return offset;
  99 }
 100
 101 int
 102 witness_dissect_struct_IPaddrInfoList(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 103 {
 104         proto_item *item = NULL;
 105         proto_tree *tree = NULL;
 106         bool oldalign = di->no_align;
 107         int old_offset;
 108         uint32_t i, num;
 109
 110         di->no_align = true;
 111
 112         old_offset = offset;
 113
 114         if (parent_tree) {
 115                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 116                 tree = proto_item_add_subtree(item, ett_witness_witness_IPaddrInfoList);
 117         }
 118
 119         offset = witness_dissect_element_IPaddrInfoList_length(tvb, offset, pinfo, tree, di, drep);
 120
 121         offset = witness_dissect_element_IPaddrInfoList_reserved(tvb, offset, pinfo, tree, di, drep);
 122
 123         offset = witness_dissect_element_IPaddrInfoList_num(tvb, offset, pinfo, tree, di, drep, &num);
 124
 125         for (i = 0; i < num; i++) {
 126                 offset = witness_dissect_element_IPaddrInfoList_addr(tvb, offset, pinfo, tree, di, drep);
 127         }
 128
 129         proto_item_set_len(item, offset-old_offset);
 130
 131         di->no_align = oldalign;
 132
 133         return offset;
 134 }
 135
 136 static int
 137 witness_dissect_element_interfaceInfo_group_name(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *parent_tree, dcerpc_info *di _U_, uint8_t *drep _U_)
 138 {
 139         int totlen, stringlen;
 140         char *str;
 141         proto_item *pi;
 142
 143         /*
 144          * XXX - this is described as
 145          *
 146          *    [charset(UTF16),to_null] uint16 group_name[260];
 147          *
 148          * I haven't found any documentation for what "to_null" means
 149          * in PIDL; is this a null-padded 260*2-byte array, so that
 150          * strings can be up to 260 16-bit units in length, or is
 151          * it a null-*terminated* string, so that it can be up to 259
 152          * 16-bit units in length?
 153          *
 154          * We assume it's null-padded, for now, and scan for a 2-byte
 155          * null terminator within the 260 2-byte units, and use
 156          * that as the length, with the length being 2*260 if there
 157          * isn't one.
 158          *
 159          * This will result in totlen being the total length, in
 160          * bytes, of the string, including the null terminator, if
 161          * present, and stringlen being the total length, in bytes.
 162          * not counting any null terminator.
 163          */
 164         totlen = 0;
 165         stringlen = 0;
 166         while (totlen < 2*260) {
 167                 /*
 168                  * These 2 bytes are either part of the string
 169                  * or part of the null terminator, so count
 170                  * them.
 171                  */
 172                 totlen += 2;
 173                 if (tvb_get_letohs(tvb, offset + stringlen) == 0)
 174                         break;
 175                 /*
 176                  * Those 2 bytes are part of the string, so
 177                  * count them.
 178                  */
 179                 stringlen += 2;
 180         }
 181         pi = proto_tree_add_item_ret_display_string(parent_tree,
 182             hf_witness_witness_interfaceInfo_group_name, tvb, offset, stringlen,
 183             ENC_UTF_16|ENC_LITTLE_ENDIAN,
 184             pinfo->pool, &str);
 185         proto_item_append_text(pi, " [%d]", totlen);
 186         proto_item_append_text(parent_tree, ": %s", str);
 187
 188         /*
 189          * All 260 16-bit units are part of the field, as they're always
 190          * there even if they don't need to be.
 191          */
 192         return offset + 2*260;
 193 }
 194
 195 static int
 196 PIDL_dissect_ipv4address(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep _U_, int hfindex, uint32_t param)
 197 {
 198         if (di->conformant_run) {
 199                 /* just a run to handle conformant arrays, no scalars to dissect */
 200                 return offset;
 201         }
 202
 203
 204         if (!di->no_align && (offset % 4)) {
 205                 offset += 4 - (offset % 4);
 206         }
 207
 208         proto_tree_add_item(tree, hfindex, tvb, offset, 4, ENC_BIG_ENDIAN);
 209
 210         if (param & PIDL_SET_COL_INFO) {
 211                 const char *ip = tvb_ip_to_str(pinfo->pool, tvb, offset);
 212                 header_field_info *hf_info = proto_registrar_get_nth(hfindex);
 213
 214                 proto_item_append_text(proto_tree_get_parent(tree), " %s:%s", hf_info->name, ip);
 215
 216                 col_append_fstr(pinfo->cinfo, COL_INFO," %s:%s", hf_info->name, ip);
 217         }
 218         return offset + 4;
 219 }
 220
 221 static int
 222 PIDL_dissect_ipv6address(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep _U_, int hfindex, uint32_t param)
 223 {
 224         if (di->conformant_run) {
 225                 /* just a run to handle conformant arrays, no scalars to dissect */
 226                 return offset;
 227         }
 228
 229
 230         if (!di->no_align && (offset % 2)) {
 231                 offset += 2 - (offset % 2);
 232         }
 233
 234         proto_tree_add_item(tree, hfindex, tvb, offset, 16, ENC_BIG_ENDIAN);
 235
 236         if (param & PIDL_SET_COL_INFO) {
 237                 const char *ip = tvb_ip6_to_str(pinfo->pool, tvb, offset);
 238                 header_field_info *hf_info = proto_registrar_get_nth(hfindex);
 239
 240                 proto_item_append_text(proto_tree_get_parent(tree), " %s:%s", hf_info->name, ip);
 241
 242                 col_append_fstr(pinfo->cinfo, COL_INFO," %s:%s", hf_info->name, ip);
 243         }
 244
 245         return offset + 16;
 246 }
 247
 248 CODE END