epan/dissectors/packet-dcom.h

   1 /* packet-dcom.h
   2  * Routines for DCOM generics
   3  *
   4  * $Id$
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License
  12  * as published by the Free Software Foundation; either version 2
  13  * of the License, or (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  23  */
  24
  25 #ifndef __PACKET_DCERPC_DCOM_H
  26 #define __PACKET_DCERPC_DCOM_H
  27
  28 #include "ws_symbol_export.h"
  29
  30 WS_DLL_PUBLIC const value_string dcom_hresult_vals[];
  31 WS_DLL_PUBLIC const value_string dcom_variant_type_vals[];
  32 extern const value_string dcom_protseq_vals[];
  33
  34 extern int hf_dcom_iid;
  35 extern int hf_dcom_clsid;
  36 extern int hf_dcom_oxid;
  37 extern int hf_dcom_oid;
  38 extern int hf_dcom_ipid;
  39
  40 extern GHashTable *dcom_uuids;
  41
  42 /* preferences */
  43 WS_DLL_PUBLIC gboolean dcom_prefs_display_unmarshalling_details;
  44
  45
  46 typedef struct dcom_machine_s {
  47     GList           *objects;
  48     gint            first_packet;
  49
  50     guint8          ip[4];
  51 } dcom_machine_t;
  52
  53 typedef struct dcom_object_s {
  54     dcom_machine_t  *parent;
  55     GList           *interfaces;
  56     void            *private_data;
  57     gint            first_packet;
  58
  59     guint64         oid;
  60     guint64         oxid;
  61 } dcom_object_t;
  62
  63 typedef struct dcom_interface_s {
  64     dcom_object_t   *parent;
  65     void            *private_data;
  66     gint            first_packet;
  67
  68     e_uuid_t        iid;
  69     e_uuid_t        ipid;   /* the DCE/RPC Object UUID */
  70 } dcom_interface_t;
  71
  72 typedef int (*dcom_dissect_fn_t) (tvbuff_t *tvb, gint offset, packet_info *pinfo,
  73                        proto_tree *tree, dcerpc_info *di, guint8 *drep, gint size);
  74
  75 typedef struct dcom_marshaler_s {
  76     dcom_object_t   *parent;
  77     void            *private_data;
  78
  79     e_uuid_t        uuid;
  80     dcom_dissect_fn_t routine;
  81 } dcom_marshaler_t;
  82
  83 WS_DLL_PUBLIC dcom_interface_t *dcom_interface_new(packet_info *pinfo, const guint8 *ip, e_uuid_t *iid, guint64 oxid, guint64 oid, e_uuid_t *ipid);
  84 WS_DLL_PUBLIC dcom_interface_t *dcom_interface_find(packet_info *pinfo, const guint8 *ip, e_uuid_t *ipid);
  85 extern void dcom_interface_dump(void);
  86
  87 extern int dcom_register_rountine(dcom_dissect_fn_t routine, e_uuid_t* uuid);
  88 extern void dcom_register_common_routines_(void);
  89
  90 extern dcom_dissect_fn_t dcom_get_rountine_by_uuid(const e_uuid_t* uuid);
  91
  92 /* the essential DCOM this and that, starting every call */
  93 WS_DLL_PUBLIC int
  94 dissect_dcom_this(tvbuff_t *tvb, int offset,
  95         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep);
  96 WS_DLL_PUBLIC int
  97 dissect_dcom_that(tvbuff_t *tvb, int offset,
  98         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep);
  99
 100
 101 /* dissection of somewhat more simple data types */
 102 #define dissect_dcom_BOOLEAN            dissect_ndr_uint8
 103 #define dissect_dcom_BYTE                       dissect_ndr_uint8
 104 #define dissect_dcom_WORD                       dissect_ndr_uint16
 105 #define dissect_dcom_DWORD                      dissect_ndr_uint32
 106 #define dissect_dcom_I8                 dissect_ndr_uint64
 107 #define dissect_dcom_ID                         dissect_ndr_duint32
 108 #define dissect_dcom_FILETIME           dissect_ndr_duint32 /* ToBeDone */
 109 #define dissect_dcom_VARIANT_BOOL       dissect_ndr_uint16
 110 #define dissect_dcom_FLOAT                      dissect_ndr_float
 111 #define dissect_dcom_DOUBLE                     dissect_ndr_double
 112 #define dissect_dcom_DATE                       dissect_ndr_double
 113
 114 extern int
 115 dissect_dcom_UUID(tvbuff_t *tvb, int offset,
 116         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep,
 117         int hfindex, e_uuid_t *uuid);
 118
 119 extern int
 120 dissect_dcom_append_UUID(tvbuff_t *tvb, int offset,
 121         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep,
 122         int hfindex, int field_index, e_uuid_t *uuid);
 123
 124 extern int
 125 dissect_dcom_indexed_WORD(tvbuff_t *tvb, int offset,    packet_info *pinfo,
 126                                          proto_tree *tree, dcerpc_info *di, guint8 *drep,
 127                                          int hfindex, guint16 * pu16WORD, int field_index);
 128
 129 WS_DLL_PUBLIC int
 130 dissect_dcom_indexed_DWORD(tvbuff_t *tvb, int offset,   packet_info *pinfo,
 131                                          proto_tree *tree, dcerpc_info *di, guint8 *drep,
 132                                          int hfindex, guint32 * pu32DWORD, int field_index);
 133
 134 WS_DLL_PUBLIC int
 135 dissect_dcom_HRESULT(tvbuff_t *tvb, int offset,
 136         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep, guint32 * pu32hresult);
 137
 138 WS_DLL_PUBLIC int
 139 dissect_dcom_HRESULT_item(tvbuff_t *tvb, int offset,    packet_info *pinfo,
 140                                          proto_tree *tree, dcerpc_info *di, guint8 *drep,
 141                                          guint32 * pu32HResult, int field_index, proto_item **item);
 142
 143 WS_DLL_PUBLIC int
 144 dissect_dcom_indexed_HRESULT(tvbuff_t *tvb, int offset, packet_info *pinfo,
 145                                          proto_tree *tree, dcerpc_info *di, guint8 *drep,
 146                                          guint32 * pu32hresult, int field_index);
 147
 148 extern int
 149 dissect_dcom_COMVERSION(tvbuff_t *tvb, int offset,
 150         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep,
 151         guint16 * pu16version_major, guint16 * pu16version_minor);
 152
 153 typedef void (*sa_callback_t) (tvbuff_t *tvb, gint offset, packet_info *pinfo,
 154                        proto_tree *tree, dcerpc_info *di, guint8 *drep,
 155                        guint32 u32VarType, guint32 u32ArraySize);
 156
 157 WS_DLL_PUBLIC int
 158 dissect_dcom_SAFEARRAY(tvbuff_t *tvb, int offset, packet_info *pinfo,
 159                                                 proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex _U_, sa_callback_t sacb);
 160
 161 WS_DLL_PUBLIC int
 162 dissect_dcom_LPWSTR(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 163                        proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex,
 164                                            gchar *psz_buffer, guint32 u32max_buffer);
 165
 166 WS_DLL_PUBLIC int
 167 dissect_dcom_indexed_LPWSTR(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 168                        proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex,
 169                                            gchar *pszStr, guint32 u32MaxStr, int field_index);
 170
 171 WS_DLL_PUBLIC int
 172 dissect_dcom_BSTR(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 173                        proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex,
 174                                            gchar *psz_buffer, guint32 u32max_buffer);
 175
 176 extern int
 177 dissect_dcom_DUALSTRINGARRAY(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 178                        proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex, gchar *ip);
 179
 180 extern int
 181 dissect_dcom_STDOBJREF(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 182                        proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex,
 183                        guint64 *oxid, guint64 *oid, e_uuid_t *ipid);
 184 extern int
 185 dissect_dcom_OBJREF(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 186                        proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex, dcom_interface_t **interf);
 187
 188 WS_DLL_PUBLIC int
 189 dissect_dcom_MInterfacePointer(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 190                        proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex, dcom_interface_t **interf);
 191 WS_DLL_PUBLIC int
 192 dissect_dcom_PMInterfacePointer(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 193                        proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex, dcom_interface_t **interf);
 194
 195 WS_DLL_PUBLIC int
 196 dissect_dcom_VARTYPE(tvbuff_t *tvb, int offset,
 197         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep,
 198         guint16 *pu16Vartype);
 199
 200 WS_DLL_PUBLIC int
 201 dissect_dcom_VARIANT(tvbuff_t *tvb, int offset, packet_info *pinfo,
 202                                          proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex);
 203
 204 /* dcom "dcerpc internal" unmarshalling */
 205 WS_DLL_PUBLIC int
 206 dissect_dcom_dcerpc_array_size(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 207                        proto_tree *tree, dcerpc_info *di, guint8 *drep, guint32 *pu32array_size);
 208
 209 WS_DLL_PUBLIC int
 210 dissect_dcom_dcerpc_pointer(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 211                        proto_tree *tree, dcerpc_info *di, guint8 *drep, guint32 *pu32pointer);
 212
 213 /* mark things as "to be done" */
 214 extern int
 215 dissect_dcom_tobedone_data(tvbuff_t *tvb, int offset,
 216         packet_info *pinfo, proto_tree *tree, guint8 *drep, int length);
 217
 218 /* mark things "no specification available" */
 219 extern int
 220 dissect_dcom_nospec_data(tvbuff_t *tvb, int offset,
 221         packet_info *pinfo, proto_tree *tree, guint8 *drep, int length);
 222
 223 /* very simple parameter-profiles dissectors (for very simple requests ;-) */
 224 /* request: no parameters */
 225 WS_DLL_PUBLIC int
 226 dissect_dcom_simple_rqst(tvbuff_t *tvb, int offset,
 227         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep);
 228 /* response: only HRESULT */
 229 WS_DLL_PUBLIC int
 230 dissect_dcom_simple_resp(tvbuff_t *tvb, int offset,
 231         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep);
 232
 233 #endif /* packet-dcerpc-dcom.h */