Adding upstream version 4.2.2.upstream/4.2.2

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 127 insertions, 0 deletions

diff --git a/epan/dissectors/pidl/svcctl/svcctl.cnf b/epan/dissectors/pidl/svcctl/svcctl.cnf
new file mode 100644
index 00000000..ce624d55
--- /dev/null
+++ b/epan/dissectors/pidl/svcctl/svcctl.cnf
@@ -0,0 +1,127 @@
+# Conformance file for svcctl
+
+HF_FIELD hf_svcctl_service_buffer_size "Buffer Size" "svcctl.services.buffer_size" FT_UINT32 BASE_DEC NULL 0 NULL HFILL
+HF_FIELD hf_svcctl_service_referent_id "Referent ID(offset)" "svcctl.ENUM_SERVICE_STATUSW.referent_id" FT_UINT32 BASE_DEC NULL 0 NULL HFILL
+
+MANUAL svcctl_dissect_EnumServicesStatusW_response
+
+ETT_FIELD ett_svcctl_service
+ETT_FIELD ett_svcctl_service_name
+ETT_FIELD ett_svcctl_display_name
+
+NOEMIT svcctl_dissect_element_EnumServicesStatusW_services
+NOEMIT svcctl_dissect_element_EnumServicesStatusW_bytes_needed
+NOEMIT svcctl_dissect_element_EnumServicesStatusW_services_returned
+
+CODE START
+
+/*  ENUM_SERVICE_STATUSW Caveats
+	https://github.com/fortra/impacket/blob/4888172ce638910104da4bda2c3301c24e17564c/impacket/dcerpc/v5/scmr.py#L1274
+*/
+static int
+svcctl_dissect_struct_ENUM_SERVICE_STATUSW_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, dcerpc_info* di, guint8 *drep, int hf_index, gint starting_offset);
+static int
+svcctl_dissect_struct_ENUM_SERVICE_STATUSW_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, dcerpc_info* di, guint8 *drep, int hf_index, gint starting_offset)
+{
+	proto_item *item = NULL;
+	proto_tree *tree = NULL;
+	proto_tree *tr = NULL;
+	int old_offset;
+	guint32 _referent_id = 0;
+
+	ALIGN_TO_5_BYTES;
+
+	old_offset = offset;
+
+	if (parent_tree) {
+		item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
+		tree = proto_item_add_subtree(item, ett_svcctl_ENUM_SERVICE_STATUSW);
+	}
+
+	// Service Name
+	tr = proto_tree_add_subtree(tree, tvb, offset, 4, ett_svcctl_service_name, NULL, "Pointer to Service Name");
+	offset = PIDL_dissect_uint32_val(tvb, offset, pinfo, tr, di, drep, hf_svcctl_service_referent_id, 0, &_referent_id);
+	dissect_null_term_wstring(tvb, starting_offset + _referent_id, pinfo, tr, drep, hf_svcctl_ENUM_SERVICE_STATUSW_service_name , 0);
+
+	// Display Name
+	tr = proto_tree_add_subtree(tree, tvb, offset, 4, ett_svcctl_display_name, NULL, "Pointer to Display Name");
+	offset = PIDL_dissect_uint32_val(tvb, offset, pinfo, tr, di, drep, hf_svcctl_service_referent_id, 0, &_referent_id);
+	dissect_null_term_wstring(tvb, starting_offset + _referent_id, pinfo, tr, drep, hf_svcctl_ENUM_SERVICE_STATUSW_display_name , 0);
+
+	// Status
+	offset = svcctl_dissect_element_ENUM_SERVICE_STATUSW_status(tvb, offset, pinfo, tree, di, drep);
+
+	proto_item_set_len(item, offset-old_offset);
+
+	if (di->call_data->flags & DCERPC_IS_NDR64) {
+		ALIGN_TO_5_BYTES;
+	}
+
+	return offset;
+}
+
+/*  REnumServicesStatusW
+	https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/22b4ff3d-29c6-481f-b598-8ce66a46944a
+*/
+static int
+svcctl_dissect_EnumServicesStatusW_response(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
+{
+	guint32 status;
+	guint32 services_returned= 0;
+	proto_item *item;
+	proto_tree  *tr           = NULL;
+	gint        services_buffer_offset;
+	gint        payload_starting_offset = offset;
+	guint64 buffer_size = 0;
+
+	ALIGN_TO_5_BYTES
+
+	di->dcerpc_procedure_name="EnumServicesStatusW";
+
+	tr = proto_tree_add_subtree(tree, tvb, offset, 0, ett_svcctl_service, &item, "Pointer to Services Status");
+
+	// Services Buffer Size
+	offset = dissect_ndr_uint3264(tvb, offset, pinfo, tr, di, drep, hf_svcctl_service_buffer_size, &buffer_size);
+	services_buffer_offset = offset;
+
+	offset += (int)buffer_size;
+
+	proto_item_set_len(item, offset-payload_starting_offset);
+
+	ALIGN_TO_4_BYTES
+
+	// Bytes Needed
+	offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_svcctl_svcctl_EnumServicesStatusW_bytes_needed, 0);
+
+	// Services Returned
+	offset = PIDL_dissect_uint32_val( tvb, offset, pinfo, tree, di, drep
+	                                , hf_svcctl_svcctl_EnumServicesStatusW_services_returned
+	                                , 0, &services_returned);
+
+	// Services
+	if (services_returned > 0){
+		payload_starting_offset = services_buffer_offset;
+		for(unsigned idx = 0; idx < services_returned ; ++idx){
+			services_buffer_offset = svcctl_dissect_struct_ENUM_SERVICE_STATUSW_ptr( tvb, services_buffer_offset
+			                                                                       , pinfo, tr, di, drep
+			                                                                       , hf_svcctl_svcctl_EnumDependentServicesW_service_status
+			                                                                       , payload_starting_offset);
+		}
+		dissect_deferred_pointers(pinfo, tvb, services_buffer_offset, di, drep);
+	}
+
+	// Resume Index
+	offset = svcctl_dissect_element_EnumServicesStatusW_resume_index(tvb, offset, pinfo, tree, di, drep);
+
+	offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
+
+	// Return status
+	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_svcctl_werror, &status);
+
+	if (status != 0)
+		col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x"));
+
+	return offset;
+}
+
+CODE END