static int dissect_rs_cache_data_t (tvbuff_t * tvb, int offset, packet_info * pinfo, proto_tree * parent_tree, dcerpc_info *di, guint8 * drep) { /* typedef struct { uuid_t site_id; sec_timeval_sec_t person_dtm; sec_timeval_sec_t group_dtm; sec_timeval_sec_t org_dtm; } rs_cache_data_t; */ proto_item *item = NULL; proto_tree *tree = NULL; int old_offset = offset; guint32 person_dtm, group_dtm, org_dtm; e_uuid_t uuid1; if (di->conformant_run) { return offset; } if (parent_tree) { item = proto_tree_add_text (parent_tree, tvb, offset, -1, "rs_cache_data_t"); tree = proto_item_add_subtree (item, ett_rs_cache_data_t); } offset = dissect_ndr_uuid_t(tvb, offset, pinfo, tree, di, drep, hf_rs_uuid1, &uuid1); offset = dissect_dcerpc_time_t (tvb, offset, pinfo, tree, drep, hf_rs_timeval, &person_dtm); offset = dissect_dcerpc_time_t (tvb, offset, pinfo, tree, drep, hf_rs_timeval, &group_dtm); offset = dissect_dcerpc_time_t (tvb, offset, pinfo, tree, drep, hf_rs_timeval, &org_dtm); col_append_fstr (pinfo->cinfo, COL_INFO, " siteid %08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x person_dtm:%u group_dtm:%u org_dtm:%u", uuid1.Data1, uuid1.Data2, uuid1.Data3, uuid1.Data4[0], uuid1.Data4[1], uuid1.Data4[2], uuid1.Data4[3], uuid1.Data4[4], uuid1.Data4[5], uuid1.Data4[6], uuid1.Data4[7], person_dtm, group_dtm, org_dtm); proto_item_set_len (item, offset - old_offset); return offset; }
/* handles unix 32 bit time_t */ int dissect_ndr_time_t (tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree, guint8 *drep, int hfindex, guint32 *pdata) { dcerpc_info *di; di=pinfo->private_data; if(di->conformant_run){ /* just a run to handle conformant arrays, no scalars to dissect */ return offset; } if (offset % 4) { offset += 4 - (offset % 4); } return dissect_dcerpc_time_t (tvb, offset, pinfo, tree, drep, hfindex, pdata); }
/* handles unix 32 bit time_t */ int dissect_ndr_time_t(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex, guint32 *pdata) { /* Some callers expect us to initialize pdata, even in error conditions, so * do it right away in case we forget later */ if (pdata) *pdata = 0; if (di->conformant_run) { /* just a run to handle conformant arrays, no scalars to dissect */ return offset; } if (!di->no_align && (offset % 4)) { offset += 4 - (offset % 4); } return dissect_dcerpc_time_t(tvb, offset, pinfo, tree, drep, hfindex, pdata); }