epan/dissectors/packet-dcerpc-misc.c

   1 /* DO NOT EDIT
   2         This filter was automatically generated
   3         from misc.idl and misc.cnf.
   4
   5         Pidl is a perl based IDL compiler for DCE/RPC idl files.
   6         It is maintained by the Samba team, not the Wireshark team.
   7         Instructions on how to download and install Pidl can be
   8         found at http://wiki.wireshark.org/Pidl
   9
  10         $Id$
  11 */
  12
  13
  14 #include "config.h"
  15 #ifdef _MSC_VER
  16 #pragma warning(disable:4005)
  17 #pragma warning(disable:4013)
  18 #pragma warning(disable:4018)
  19 #pragma warning(disable:4101)
  20 #endif
  21
  22 #include <glib.h>
  23 #include <string.h>
  24 #include <epan/packet.h>
  25
  26 #include "packet-dcerpc.h"
  27 #include "packet-dcerpc-nt.h"
  28 #include "packet-windows-common.h"
  29 #include "packet-dcerpc-misc.h"
  30
  31 /* Ett declarations */
  32 static gint ett_dcerpc_misc = -1;
  33 static gint ett_misc_GUID = -1;
  34 static gint ett_misc_ndr_syntax_id = -1;
  35 static gint ett_misc_policy_handle = -1;
  36 static gint ett_misc_KRB5_EDATA_NTSTATUS = -1;
  37 static gint ett_misc_winreg_Data = -1;
  38
  39
  40 /* Header field declarations */
  41 static gint hf_misc_GUID_time_mid = -1;
  42 static gint hf_misc_winreg_Data_value = -1;
  43 static gint hf_misc_GUID_time_low = -1;
  44 static gint hf_misc_KRB5_EDATA_NTSTATUS_unknown2 = -1;
  45 static gint hf_misc_GUID_time_hi_and_version = -1;
  46 static gint hf_misc_KRB5_EDATA_NTSTATUS_ntstatus = -1;
  47 static gint hf_misc_GUID_node = -1;
  48 static gint hf_misc_winreg_Data_string = -1;
  49 static gint hf_misc_winreg_Data_data = -1;
  50 static gint hf_misc_winreg_Data_binary = -1;
  51 static gint hf_misc_policy_handle_uuid = -1;
  52 static gint hf_misc_KRB5_EDATA_NTSTATUS_unknown1 = -1;
  53 static gint hf_misc_policy_handle_handle_type = -1;
  54 static gint hf_misc_ndr_syntax_id_uuid = -1;
  55 static gint hf_misc_opnum = -1;
  56 static gint hf_misc_GUID_clock_seq = -1;
  57 static gint hf_misc_winreg_Data_string_array = -1;
  58 static gint hf_misc_ndr_syntax_id_if_version = -1;
  59
  60 static gint proto_dcerpc_misc = -1;
  61 /* Version information */
  62
  63
  64 static e_uuid_t uuid_dcerpc_misc = {
  65         0x12345678, 0x1234, 0x1234,
  66         { 0x12, 0x34, 0xab, 0xcd, 0xef, 0x12, 0x34, 0x56 }
  67 };
  68 static guint16 ver_dcerpc_misc = 1;
  69
  70 static int misc_dissect_element_GUID_time_low(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
  71 static int misc_dissect_element_GUID_time_mid(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
  72 static int misc_dissect_element_GUID_time_hi_and_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
  73 static int misc_dissect_element_GUID_clock_seq(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
  74 static int misc_dissect_element_GUID_clock_seq_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
  75 static int misc_dissect_element_GUID_node(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
  76 static int misc_dissect_element_GUID_node_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
  77 static int misc_dissect_element_ndr_syntax_id_uuid(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
  78 static int misc_dissect_element_ndr_syntax_id_if_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
  79 static int misc_dissect_element_policy_handle_handle_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
  80 static int misc_dissect_element_policy_handle_uuid(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
  81 const value_string misc_netr_SchannelType_vals[] = {
  82         { SEC_CHAN_NULL, "SEC_CHAN_NULL" },
  83         { SEC_CHAN_LOCAL, "SEC_CHAN_LOCAL" },
  84         { SEC_CHAN_WKSTA, "SEC_CHAN_WKSTA" },
  85         { SEC_CHAN_DNS_DOMAIN, "SEC_CHAN_DNS_DOMAIN" },
  86         { SEC_CHAN_DOMAIN, "SEC_CHAN_DOMAIN" },
  87         { SEC_CHAN_LANMAN, "SEC_CHAN_LANMAN" },
  88         { SEC_CHAN_BDC, "SEC_CHAN_BDC" },
  89         { SEC_CHAN_RODC, "SEC_CHAN_RODC" },
  90 { 0, NULL }
  91 };
  92 static int misc_dissect_element_KRB5_EDATA_NTSTATUS_ntstatus(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
  93 static int misc_dissect_element_KRB5_EDATA_NTSTATUS_unknown1(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
  94 static int misc_dissect_element_KRB5_EDATA_NTSTATUS_unknown2(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
  95 const value_string misc_winreg_Type_vals[] = {
  96         { REG_NONE, "REG_NONE" },
  97         { REG_SZ, "REG_SZ" },
  98         { REG_EXPAND_SZ, "REG_EXPAND_SZ" },
  99         { REG_BINARY, "REG_BINARY" },
 100         { REG_DWORD, "REG_DWORD" },
 101         { REG_DWORD_BIG_ENDIAN, "REG_DWORD_BIG_ENDIAN" },
 102         { REG_LINK, "REG_LINK" },
 103         { REG_MULTI_SZ, "REG_MULTI_SZ" },
 104         { REG_RESOURCE_LIST, "REG_RESOURCE_LIST" },
 105         { REG_FULL_RESOURCE_DESCRIPTOR, "REG_FULL_RESOURCE_DESCRIPTOR" },
 106         { REG_RESOURCE_REQUIREMENTS_LIST, "REG_RESOURCE_REQUIREMENTS_LIST" },
 107         { REG_QWORD, "REG_QWORD" },
 108 { 0, NULL }
 109 };
 110 static int misc_dissect_element_winreg_Data_string(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 111 static int misc_dissect_element_winreg_Data_string(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 112 static int misc_dissect_element_winreg_Data_binary(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 113 static int misc_dissect_element_winreg_Data_value(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 114 static int misc_dissect_element_winreg_Data_value(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 115 static int misc_dissect_element_winreg_Data_string_array(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 116 static int misc_dissect_element_winreg_Data_data(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 117 static int
 118 misc_dissect_element_winreg_Data_string(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 119 {
 120         offset = dissect_null_term_wstring(tvb, offset, pinfo, tree, drep, hf_misc_winreg_Data_string , 0);
 121         return offset;
 122 }
 123 static int
 124 misc_dissect_element_winreg_Data_value(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 125 {
 126         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_misc_winreg_Data_value, 0);
 127         return offset;
 128 }
 129 static int
 130 misc_dissect_struct_string_array(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_)
 131 {
 132     /* We don't do it yet */
 133     return offset;
 134 }
 135
 136
 137 /* IDL: struct { */
 138 /* IDL:         uint32 time_low; */
 139 /* IDL:         uint16 time_mid; */
 140 /* IDL:         uint16 time_hi_and_version; */
 141 /* IDL:         uint8 clock_seq[2]; */
 142 /* IDL:         uint8 node[6]; */
 143 /* IDL: } */
 144
 145 static int
 146 misc_dissect_element_GUID_time_low(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 147 {
 148         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_misc_GUID_time_low, 0);
 149
 150         return offset;
 151 }
 152
 153 static int
 154 misc_dissect_element_GUID_time_mid(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 155 {
 156         offset = PIDL_dissect_uint16(tvb, offset, pinfo, tree, di, drep, hf_misc_GUID_time_mid, 0);
 157
 158         return offset;
 159 }
 160
 161 static int
 162 misc_dissect_element_GUID_time_hi_and_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 163 {
 164         offset = PIDL_dissect_uint16(tvb, offset, pinfo, tree, di, drep, hf_misc_GUID_time_hi_and_version, 0);
 165
 166         return offset;
 167 }
 168
 169 static int
 170 misc_dissect_element_GUID_clock_seq(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 171 {
 172         int i;
 173         for (i = 0; i < 2; i++)
 174                 offset = misc_dissect_element_GUID_clock_seq_(tvb, offset, pinfo, tree, di, drep);
 175
 176         return offset;
 177 }
 178
 179 static int
 180 misc_dissect_element_GUID_clock_seq_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 181 {
 182         offset = PIDL_dissect_uint8(tvb, offset, pinfo, tree, di, drep, hf_misc_GUID_clock_seq, 0);
 183
 184         return offset;
 185 }
 186
 187 static int
 188 misc_dissect_element_GUID_node(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 189 {
 190         int i;
 191         for (i = 0; i < 6; i++)
 192                 offset = misc_dissect_element_GUID_node_(tvb, offset, pinfo, tree, di, drep);
 193
 194         return offset;
 195 }
 196
 197 static int
 198 misc_dissect_element_GUID_node_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 199 {
 200         offset = PIDL_dissect_uint8(tvb, offset, pinfo, tree, di, drep, hf_misc_GUID_node, 0);
 201
 202         return offset;
 203 }
 204
 205 int
 206 misc_dissect_struct_GUID(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_)
 207 {
 208         proto_item *item = NULL;
 209         proto_tree *tree = NULL;
 210         int old_offset;
 211
 212         ALIGN_TO_4_BYTES;
 213
 214         old_offset = offset;
 215
 216         if (parent_tree) {
 217                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 218                 tree = proto_item_add_subtree(item, ett_misc_GUID);
 219         }
 220
 221         offset = misc_dissect_element_GUID_time_low(tvb, offset, pinfo, tree, di, drep);
 222
 223         offset = misc_dissect_element_GUID_time_mid(tvb, offset, pinfo, tree, di, drep);
 224
 225         offset = misc_dissect_element_GUID_time_hi_and_version(tvb, offset, pinfo, tree, di, drep);
 226
 227         offset = misc_dissect_element_GUID_clock_seq(tvb, offset, pinfo, tree, di, drep);
 228
 229         offset = misc_dissect_element_GUID_node(tvb, offset, pinfo, tree, di, drep);
 230
 231
 232         proto_item_set_len(item, offset-old_offset);
 233
 234
 235         if (di->call_data->flags & DCERPC_IS_NDR64) {
 236                 ALIGN_TO_4_BYTES;
 237         }
 238
 239         return offset;
 240 }
 241
 242
 243 /* IDL: struct { */
 244 /* IDL:         GUID uuid; */
 245 /* IDL:         uint32 if_version; */
 246 /* IDL: } */
 247
 248 static int
 249 misc_dissect_element_ndr_syntax_id_uuid(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 250 {
 251         offset = dissect_ndr_uuid_t(tvb, offset, pinfo, tree, di, drep, hf_misc_ndr_syntax_id_uuid, NULL);
 252
 253         return offset;
 254 }
 255
 256 static int
 257 misc_dissect_element_ndr_syntax_id_if_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 258 {
 259         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_misc_ndr_syntax_id_if_version, 0);
 260
 261         return offset;
 262 }
 263
 264 int
 265 misc_dissect_struct_ndr_syntax_id(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_)
 266 {
 267         proto_item *item = NULL;
 268         proto_tree *tree = NULL;
 269         int old_offset;
 270
 271         ALIGN_TO_4_BYTES;
 272
 273         old_offset = offset;
 274
 275         if (parent_tree) {
 276                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 277                 tree = proto_item_add_subtree(item, ett_misc_ndr_syntax_id);
 278         }
 279
 280         offset = misc_dissect_element_ndr_syntax_id_uuid(tvb, offset, pinfo, tree, di, drep);
 281
 282         offset = misc_dissect_element_ndr_syntax_id_if_version(tvb, offset, pinfo, tree, di, drep);
 283
 284
 285         proto_item_set_len(item, offset-old_offset);
 286
 287
 288         if (di->call_data->flags & DCERPC_IS_NDR64) {
 289                 ALIGN_TO_4_BYTES;
 290         }
 291
 292         return offset;
 293 }
 294
 295
 296 /* IDL: struct { */
 297 /* IDL:         uint32 handle_type; */
 298 /* IDL:         GUID uuid; */
 299 /* IDL: } */
 300
 301 static int
 302 misc_dissect_element_policy_handle_handle_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 303 {
 304         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_misc_policy_handle_handle_type, 0);
 305
 306         return offset;
 307 }
 308
 309 static int
 310 misc_dissect_element_policy_handle_uuid(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 311 {
 312         offset = dissect_ndr_uuid_t(tvb, offset, pinfo, tree, di, drep, hf_misc_policy_handle_uuid, NULL);
 313
 314         return offset;
 315 }
 316
 317 int
 318 misc_dissect_struct_policy_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_)
 319 {
 320         proto_item *item = NULL;
 321         proto_tree *tree = NULL;
 322         int old_offset;
 323
 324         ALIGN_TO_4_BYTES;
 325
 326         old_offset = offset;
 327
 328         if (parent_tree) {
 329                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 330                 tree = proto_item_add_subtree(item, ett_misc_policy_handle);
 331         }
 332
 333         offset = misc_dissect_element_policy_handle_handle_type(tvb, offset, pinfo, tree, di, drep);
 334
 335         offset = misc_dissect_element_policy_handle_uuid(tvb, offset, pinfo, tree, di, drep);
 336
 337
 338         proto_item_set_len(item, offset-old_offset);
 339
 340
 341         if (di->call_data->flags & DCERPC_IS_NDR64) {
 342                 ALIGN_TO_4_BYTES;
 343         }
 344
 345         return offset;
 346 }
 347
 348
 349 /* IDL: enum { */
 350 /* IDL:         SEC_CHAN_NULL=0, */
 351 /* IDL:         SEC_CHAN_LOCAL=1, */
 352 /* IDL:         SEC_CHAN_WKSTA=2, */
 353 /* IDL:         SEC_CHAN_DNS_DOMAIN=3, */
 354 /* IDL:         SEC_CHAN_DOMAIN=4, */
 355 /* IDL:         SEC_CHAN_LANMAN=5, */
 356 /* IDL:         SEC_CHAN_BDC=6, */
 357 /* IDL:         SEC_CHAN_RODC=7, */
 358 /* IDL: } */
 359
 360 int
 361 misc_dissect_enum_netr_SchannelType(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 *param _U_)
 362 {
 363         guint1632 parameter=0;
 364         if(param){
 365                 parameter=(guint1632)*param;
 366         }
 367         offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, &parameter);
 368         if(param){
 369                 *param=(guint32)parameter;
 370         }
 371         return offset;
 372 }
 373
 374
 375 /* IDL: struct { */
 376 /* IDL:         NTSTATUS ntstatus; */
 377 /* IDL:         uint32 unknown1; */
 378 /* IDL:         uint32 unknown2; */
 379 /* IDL: } */
 380
 381 static int
 382 misc_dissect_element_KRB5_EDATA_NTSTATUS_ntstatus(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 383 {
 384         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_misc_KRB5_EDATA_NTSTATUS_ntstatus, 0);
 385
 386         return offset;
 387 }
 388
 389 static int
 390 misc_dissect_element_KRB5_EDATA_NTSTATUS_unknown1(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 391 {
 392         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_misc_KRB5_EDATA_NTSTATUS_unknown1, 0);
 393
 394         return offset;
 395 }
 396
 397 static int
 398 misc_dissect_element_KRB5_EDATA_NTSTATUS_unknown2(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 399 {
 400         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_misc_KRB5_EDATA_NTSTATUS_unknown2, 0);
 401
 402         return offset;
 403 }
 404
 405 int
 406 misc_dissect_struct_KRB5_EDATA_NTSTATUS(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_)
 407 {
 408         proto_item *item = NULL;
 409         proto_tree *tree = NULL;
 410         int old_offset;
 411
 412         ALIGN_TO_4_BYTES;
 413
 414         old_offset = offset;
 415
 416         if (parent_tree) {
 417                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 418                 tree = proto_item_add_subtree(item, ett_misc_KRB5_EDATA_NTSTATUS);
 419         }
 420
 421         offset = misc_dissect_element_KRB5_EDATA_NTSTATUS_ntstatus(tvb, offset, pinfo, tree, di, drep);
 422
 423         offset = misc_dissect_element_KRB5_EDATA_NTSTATUS_unknown1(tvb, offset, pinfo, tree, di, drep);
 424
 425         offset = misc_dissect_element_KRB5_EDATA_NTSTATUS_unknown2(tvb, offset, pinfo, tree, di, drep);
 426
 427
 428         proto_item_set_len(item, offset-old_offset);
 429
 430
 431         if (di->call_data->flags & DCERPC_IS_NDR64) {
 432                 ALIGN_TO_4_BYTES;
 433         }
 434
 435         return offset;
 436 }
 437
 438
 439 /* IDL: enum { */
 440 /* IDL:         REG_NONE=0, */
 441 /* IDL:         REG_SZ=1, */
 442 /* IDL:         REG_EXPAND_SZ=2, */
 443 /* IDL:         REG_BINARY=3, */
 444 /* IDL:         REG_DWORD=4, */
 445 /* IDL:         REG_DWORD_BIG_ENDIAN=5, */
 446 /* IDL:         REG_LINK=6, */
 447 /* IDL:         REG_MULTI_SZ=7, */
 448 /* IDL:         REG_RESOURCE_LIST=8, */
 449 /* IDL:         REG_FULL_RESOURCE_DESCRIPTOR=9, */
 450 /* IDL:         REG_RESOURCE_REQUIREMENTS_LIST=10, */
 451 /* IDL:         REG_QWORD=11, */
 452 /* IDL: } */
 453
 454 int
 455 misc_dissect_enum_winreg_Type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 *param _U_)
 456 {
 457         guint32 parameter=0;
 458         if(param){
 459                 parameter=(guint32)*param;
 460         }
 461         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &parameter);
 462         if(param){
 463                 *param=(guint32)parameter;
 464         }
 465         return offset;
 466 }
 467
 468
 469 /* IDL: [public(1)] [nodiscriminant(1)] [flag(LIBNDR_FLAG_LITTLE_ENDIAN)] union { */
 470 /* IDL: [case(REG_NONE)] [case(REG_NONE)] EMPTY ; */
 471 /* IDL: [case(REG_SZ)] [flag(LIBNDR_FLAG_STR_NULLTERM)] [case(REG_SZ)] string string; */
 472 /* IDL: [case(REG_EXPAND_SZ)] [flag(LIBNDR_FLAG_STR_NULLTERM)] [case(REG_EXPAND_SZ)] string string; */
 473 /* IDL: [case(REG_BINARY)] [flag(LIBNDR_FLAG_REMAINING)] [case(REG_BINARY)] DATA_BLOB binary; */
 474 /* IDL: [case(REG_DWORD)] [case(REG_DWORD)] uint32 value; */
 475 /* IDL: [case(REG_DWORD_BIG_ENDIAN)] [flag(LIBNDR_FLAG_BIGENDIAN)] [case(REG_DWORD_BIG_ENDIAN)] uint32 value; */
 476 /* IDL: [case(REG_MULTI_SZ)] [flag(LIBNDR_FLAG_STR_NULLTERM)] [case(REG_MULTI_SZ)] string_array string_array; */
 477 /* IDL: [default] ; */
 478 /* IDL: } */
 479
 480 static int
 481 misc_dissect_element_winreg_Data_binary(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 482 {
 483         offset = dissect_ndr_datablob(tvb, offset, pinfo, tree, di, drep, hf_misc_winreg_Data_binary, 1);
 484
 485         return offset;
 486 }
 487
 488 static int
 489 misc_dissect_element_winreg_Data_string_array(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 490 {
 491         offset = misc_dissect_struct_string_array(tvb,offset,pinfo,tree,drep,hf_misc_winreg_Data_string_array,0);
 492
 493         return offset;
 494 }
 495
 496 static int
 497 misc_dissect_element_winreg_Data_data(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 498 {
 499         offset = dissect_ndr_datablob(tvb, offset, pinfo, tree, di, drep, hf_misc_winreg_Data_data, 1);
 500
 501         return offset;
 502 }
 503
 504 static int
 505 misc_dissect_winreg_Data(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_)
 506 {
 507         proto_item *item = NULL;
 508         proto_tree *tree = NULL;
 509         int old_offset;
 510         guint32 level = param;
 511
 512         old_offset = offset;
 513         if (parent_tree) {
 514                 item = proto_tree_add_text(parent_tree, tvb, offset, -1, "winreg_Data");
 515                 tree = proto_item_add_subtree(item, ett_misc_winreg_Data);
 516         }
 517
 518         switch(level) {
 519                 case REG_NONE:
 520                 break;
 521
 522                 case REG_SZ:
 523                         offset = misc_dissect_element_winreg_Data_string(tvb, offset, pinfo, tree, di, drep);
 524                 break;
 525
 526                 case REG_EXPAND_SZ:
 527                         offset = misc_dissect_element_winreg_Data_string(tvb, offset, pinfo, tree, di, drep);
 528                 break;
 529
 530                 case REG_BINARY:
 531                         offset = misc_dissect_element_winreg_Data_binary(tvb, offset, pinfo, tree, di, drep);
 532                 break;
 533
 534                 case REG_DWORD:
 535                         offset = misc_dissect_element_winreg_Data_value(tvb, offset, pinfo, tree, di, drep);
 536                 break;
 537
 538                 case REG_DWORD_BIG_ENDIAN:
 539                         offset = misc_dissect_element_winreg_Data_value(tvb, offset, pinfo, tree, di, drep);
 540                 break;
 541
 542                 case REG_MULTI_SZ:
 543                         offset = misc_dissect_element_winreg_Data_string_array(tvb, offset, pinfo, tree, di, drep);
 544                 break;
 545
 546                 default:
 547                         offset = misc_dissect_element_winreg_Data_data(tvb, offset, pinfo, tree, di, drep);
 548                 break;
 549         }
 550         proto_item_set_len(item, offset-old_offset);
 551
 552
 553         return offset;
 554 }
 555
 556 static dcerpc_sub_dissector misc_dissectors[] = {
 557         { 0, NULL, NULL, NULL }
 558 };
 559
 560 void proto_register_dcerpc_misc(void)
 561 {
 562         static hf_register_info hf[] = {
 563         { &hf_misc_GUID_time_mid,
 564           { "Time Mid", "misc.GUID.time_mid", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 565         { &hf_misc_winreg_Data_value,
 566           { "Value", "misc.winreg_Data.value", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 567         { &hf_misc_GUID_time_low,
 568           { "Time Low", "misc.GUID.time_low", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 569         { &hf_misc_KRB5_EDATA_NTSTATUS_unknown2,
 570           { "Unknown2", "misc.KRB5_EDATA_NTSTATUS.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 571         { &hf_misc_GUID_time_hi_and_version,
 572           { "Time Hi And Version", "misc.GUID.time_hi_and_version", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 573         { &hf_misc_KRB5_EDATA_NTSTATUS_ntstatus,
 574           { "Ntstatus", "misc.KRB5_EDATA_NTSTATUS.ntstatus", FT_UINT32, BASE_DEC, VALS(NT_errors), 0, NULL, HFILL }},
 575         { &hf_misc_GUID_node,
 576           { "Node", "misc.GUID.node", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
 577         { &hf_misc_winreg_Data_string,
 578           { "String", "misc.winreg_Data.string", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 579         { &hf_misc_winreg_Data_data,
 580           { "Data", "misc.winreg_Data.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 581         { &hf_misc_winreg_Data_binary,
 582           { "Binary", "misc.winreg_Data.binary", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 583         { &hf_misc_policy_handle_uuid,
 584           { "Uuid", "misc.policy_handle.uuid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
 585         { &hf_misc_KRB5_EDATA_NTSTATUS_unknown1,
 586           { "Unknown1", "misc.KRB5_EDATA_NTSTATUS.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 587         { &hf_misc_policy_handle_handle_type,
 588           { "Handle Type", "misc.policy_handle.handle_type", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 589         { &hf_misc_ndr_syntax_id_uuid,
 590           { "Uuid", "misc.ndr_syntax_id.uuid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
 591         { &hf_misc_opnum,
 592           { "Operation", "misc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 593         { &hf_misc_GUID_clock_seq,
 594           { "Clock Seq", "misc.GUID.clock_seq", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
 595         { &hf_misc_winreg_Data_string_array,
 596           { "String Array", "misc.winreg_Data.string_array", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 597         { &hf_misc_ndr_syntax_id_if_version,
 598           { "If Version", "misc.ndr_syntax_id.if_version", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 599         };
 600
 601
 602         static gint *ett[] = {
 603                 &ett_dcerpc_misc,
 604                 &ett_misc_GUID,
 605                 &ett_misc_ndr_syntax_id,
 606                 &ett_misc_policy_handle,
 607                 &ett_misc_KRB5_EDATA_NTSTATUS,
 608                 &ett_misc_winreg_Data,
 609         };
 610
 611         proto_dcerpc_misc = proto_register_protocol("MISC (pidl)", "MISC", "misc");
 612         proto_register_field_array(proto_dcerpc_misc, hf, array_length (hf));
 613         proto_register_subtree_array(ett, array_length(ett));
 614 }
 615
 616 void proto_reg_handoff_dcerpc_misc(void)
 617 {
 618         dcerpc_init_uuid(proto_dcerpc_misc, ett_dcerpc_misc,
 619                 &uuid_dcerpc_misc, ver_dcerpc_misc,
 620                 misc_dissectors, hf_misc_opnum);
 621 }