On Aug 11, 2011, at 1:17 AM, sahlberg@xxxxxxxxxxxxx wrote:
> http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=38476
>
> User: sahlberg
> Date: 2011/08/11 01:17 AM
>
> Log:
> Regenerate a new updated FRSRPC dissector.
> This dissectors now dissects a whole lot more of the FRS protocol.
...and violate one of the checks in checkapi, namely that you can't have leading white space in a field's long name.
The entry in the IDL that contains the offending field is
/*****************/
/* Function 0x01 */
/* this function always return WERR_CALL_NOT_IMPLEMENTED */
WERROR frsrpc_FrsVerifyPromotionParent(
[in,unique,string,charset(UTF16)] uint16 *parent_account,
[in,unique,string,charset(UTF16)] uint16 *parent_password,
[in,unique,string,charset(UTF16)] uint16 *replica_set_name,
[in,unique,string,charset(UTF16)] uint16 *replica_set_type,
[in] frsrpc_PartnerAuthLevel partner_auth_level,
[in] uint32 __ndr_guid_size
);
I assume the generator script converts the IDL field name to a field's long name by replacing underscores with spaces and capitalizing each of the resulting tokens, hence "__ndr_guid_size" becomes " Ndr Guid Size"; can the .cnf file be used to map it to "NDR GUID Size", for example, e.g. with an HF_FIELD entry? (It'd be nice if there were a way to override just the name, without overriding any of the field's other attribues.)
