Wireshark 4.7.3
The Wireshark network protocol analyzer
Loading...
Searching...
No Matches
packet-dcom.h
1/* packet-dcom.h
2 * Routines for DCOM generics
3 *
4 * Wireshark - Network traffic analyzer
5 * By Gerald Combs <[email protected]>
6 * Copyright 1998 Gerald Combs
7 *
8 * SPDX-License-Identifier: GPL-2.0-or-later
9 */
10
11#ifndef __PACKET_DCOM_H
12#define __PACKET_DCOM_H
13
14#include <epan/dissectors/packet-dcerpc.h>
15#include "ws_symbol_export.h"
16
17WS_DLL_PUBLIC const value_string dcom_hresult_vals[];
18WS_DLL_PUBLIC const value_string dcom_variant_type_vals[];
19extern const value_string dcom_protseq_vals[];
20
21extern int hf_dcom_iid;
22extern int hf_dcom_clsid;
23extern int hf_dcom_oxid;
24extern int hf_dcom_oid;
25extern int hf_dcom_ipid;
26
27extern GHashTable *dcom_uuids;
28
29/* preferences */
30WS_DLL_PUBLIC bool dcom_prefs_display_unmarshalling_details;
31
32
33typedef struct dcom_machine_s {
34 GList *objects;
35 int first_packet;
36
37 address ip;
38} dcom_machine_t;
39
40typedef struct dcom_object_s {
41 dcom_machine_t *parent;
42 GList *interfaces;
43 void *private_data;
44 int first_packet;
45
46 uint64_t oid;
47 uint64_t oxid;
48} dcom_object_t;
49
50typedef struct dcom_interface_s {
51 dcom_object_t *parent;
52 void *private_data;
53 int first_packet;
54
55 e_guid_t iid;
56 e_guid_t ipid; /* the DCE/RPC Object UUID */
57} dcom_interface_t;
58
59typedef unsigned (*dcom_dissect_fn_t) (tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
60 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int size);
61
62typedef struct dcom_marshaler_s {
63 dcom_object_t *parent;
64 void *private_data;
65
66 e_guid_t uuid;
67 dcom_dissect_fn_t routine;
68} dcom_marshaler_t;
69
70WS_DLL_PUBLIC dcom_interface_t *dcom_interface_new(packet_info *pinfo, const address *addr, e_guid_t *iid, uint64_t oxid, uint64_t oid, e_guid_t *ipid);
71WS_DLL_PUBLIC dcom_interface_t *dcom_interface_find(packet_info *pinfo, const address *addr, e_guid_t *ipid);
72#ifdef DEBUG
73extern void dcom_interface_dump(void);
74#endif
75extern unsigned dcom_register_routine(dcom_dissect_fn_t routine, e_guid_t* uuid);
76extern void dcom_register_common_routines_(void);
77
78extern dcom_dissect_fn_t dcom_get_routine_by_uuid(const e_guid_t* uuid);
79
80/* the essential DCOM this and that, starting every call */
81WS_DLL_PUBLIC unsigned
82dissect_dcom_this(tvbuff_t *tvb, unsigned offset,
83 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep);
84WS_DLL_PUBLIC unsigned
85dissect_dcom_that(tvbuff_t *tvb, unsigned offset,
86 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep);
87
88
89/* dissection of somewhat more simple data types */
90#define dissect_dcom_BOOLEAN dissect_ndr_uint8
91#define dissect_dcom_BYTE dissect_ndr_uint8
92#define dissect_dcom_WORD dissect_ndr_uint16
93#define dissect_dcom_DWORD dissect_ndr_uint32
94#define dissect_dcom_I8 dissect_ndr_uint64
95#define dissect_dcom_ID dissect_ndr_duint32
96#define dissect_dcom_FILETIME dissect_ndr_duint32 /* ToBeDone */
97#define dissect_dcom_VARIANT_BOOL dissect_ndr_uint16
98#define dissect_dcom_FLOAT dissect_ndr_float
99#define dissect_dcom_DOUBLE dissect_ndr_double
100#define dissect_dcom_DATE dissect_ndr_double
101
102WS_DLL_PUBLIC unsigned
103dissect_dcom_UUID(tvbuff_t *tvb, unsigned offset,
104 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep,
105 int hfindex, e_guid_t *uuid);
106
107WS_DLL_PUBLIC unsigned
108dissect_dcom_append_UUID(tvbuff_t *tvb, unsigned offset,
109 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep,
110 int hfindex, int field_index, e_guid_t *uuid);
111
112extern unsigned
113dissect_dcom_indexed_WORD(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
114 proto_tree *tree, dcerpc_info *di, uint8_t *drep,
115 int hfindex, uint16_t * pu16WORD, int field_index);
116
117WS_DLL_PUBLIC unsigned
118dissect_dcom_indexed_DWORD(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
119 proto_tree *tree, dcerpc_info *di, uint8_t *drep,
120 int hfindex, uint32_t * pu32DWORD, int field_index);
121
122WS_DLL_PUBLIC unsigned
123dissect_dcom_HRESULT(tvbuff_t *tvb, unsigned offset,
124 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep, uint32_t * pu32hresult);
125
126WS_DLL_PUBLIC unsigned
127dissect_dcom_HRESULT_item(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
128 proto_tree *tree, dcerpc_info *di, uint8_t *drep,
129 uint32_t * pu32HResult, int field_index, proto_item **item);
130
131WS_DLL_PUBLIC unsigned
132dissect_dcom_indexed_HRESULT(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
133 proto_tree *tree, dcerpc_info *di, uint8_t *drep,
134 uint32_t * pu32hresult, int field_index);
135
136extern unsigned
137dissect_dcom_COMVERSION(tvbuff_t *tvb, unsigned offset,
138 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep,
139 uint16_t * pu16version_major, uint16_t * pu16version_minor);
140
141typedef void (*sa_callback_t) (tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
142 proto_tree *tree, dcerpc_info *di, uint8_t *drep,
143 uint32_t u32VarType, uint32_t u32ArraySize);
144
145WS_DLL_PUBLIC unsigned
146dissect_dcom_SAFEARRAY(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
147 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex _U_, sa_callback_t sacb);
148
149WS_DLL_PUBLIC unsigned
150dissect_dcom_LPWSTR(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
151 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex,
152 char *psz_buffer, uint32_t u32max_buffer);
153
154WS_DLL_PUBLIC unsigned
155dissect_dcom_indexed_LPWSTR(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
156 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex,
157 char *pszStr, uint32_t u32MaxStr, int field_index);
158
159WS_DLL_PUBLIC unsigned
160dissect_dcom_BSTR(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
161 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex,
162 char *psz_buffer, uint32_t u32max_buffer);
163
164extern unsigned
165dissect_dcom_DUALSTRINGARRAY(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
166 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex, char *ip);
167
168extern unsigned
169dissect_dcom_STDOBJREF(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
170 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex,
171 uint64_t *oxid, uint64_t *oid, e_guid_t *ipid);
172extern unsigned
173dissect_dcom_OBJREF(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
174 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex, dcom_interface_t **interf);
175
176WS_DLL_PUBLIC unsigned
177dissect_dcom_MInterfacePointer(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
178 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex, dcom_interface_t **interf);
179WS_DLL_PUBLIC unsigned
180dissect_dcom_PMInterfacePointer(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
181 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex, dcom_interface_t **interf);
182
183WS_DLL_PUBLIC unsigned
184dissect_dcom_VARTYPE(tvbuff_t *tvb, unsigned offset,
185 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep,
186 uint16_t *pu16Vartype);
187
188WS_DLL_PUBLIC unsigned
189dissect_dcom_VARIANT(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
190 proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex);
191
192/* dcom "dcerpc internal" unmarshalling */
193WS_DLL_PUBLIC unsigned
194dissect_dcom_dcerpc_array_size(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
195 proto_tree *tree, dcerpc_info *di, uint8_t *drep, uint32_t *pu32array_size);
196
197WS_DLL_PUBLIC unsigned
198dissect_dcom_dcerpc_pointer(tvbuff_t *tvb, unsigned offset, packet_info *pinfo,
199 proto_tree *tree, dcerpc_info *di, uint8_t *drep, uint32_t *pu32pointer);
200
201/* mark things as "to be done" */
202extern unsigned
203dissect_dcom_tobedone_data(tvbuff_t *tvb, unsigned offset,
204 packet_info *pinfo, proto_tree *tree, uint8_t *drep, int length);
205
206/* mark things "no specification available" */
207extern unsigned
208dissect_dcom_nospec_data(tvbuff_t *tvb, unsigned offset,
209 packet_info *pinfo, proto_tree *tree, uint8_t *drep, int length);
210
211/* very simple parameter-profiles dissectors (for very simple requests ;-) */
212/* request: no parameters */
213WS_DLL_PUBLIC unsigned
214dissect_dcom_simple_rqst(tvbuff_t *tvb, unsigned offset,
215 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep);
216/* response: only HRESULT */
217WS_DLL_PUBLIC unsigned
218dissect_dcom_simple_resp(tvbuff_t *tvb, unsigned offset,
219 packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep);
220
221#endif /* packet-dcom.h */
address
struct _address address
Holds a network or link-layer address of any supported type.
packet_info
struct _packet_info packet_info
Represents the metadata and indexing information for a single captured frame.
proto_item
proto_node proto_item
Definition proto.h:927
e_guid_t
struct _e_guid_t e_guid_t
Represents a GUID/UUID value; may be larger than GUID_LEN so must not be used to directly overlay pac...
dcom_interface_s
Definition packet-dcom.h:50
dcom_machine_s
Definition packet-dcom.h:33
dcom_marshaler_s
Definition packet-dcom.h:62
dcom_object_s
Definition packet-dcom.h:40
value_string
struct _value_string value_string
Mapping between a 32-bit integer value and its string representation.
Generated by doxygen 1.15.0