So the currently missing LSA call dissectors, such as LSALOOKUPNAMES,
which were in the old dissector, will reappear at some point?
Yes, I will implement the ones missing from the original one
to be functionally equivalent as the original ones.
I am not too sure about the other missing ones since the idl file:
lsarpc.idl is very different/incompatible with the muddle generated one
lsa-muddle.idl for the missing calls.
I expect the muddle one being more correct as for what types the packets
contain but can not be sure.
Any captures for "missing" lsa calls would be appreciated since it would
allow whether it is lsarpc.idl or lsa-muddle.idl that is correct.
Alternatively, I can just ignore lsa-muddle.idl completely and just
implement everything as described in lsarpc.idl? comments?
Different topic:
Guy, the changes you made to the dissection of the NT Security descriptor in
packet-smb.c , well , this structure is NOT described as just a blob in
lsa-muddle.idl.
lsa-muddle.idl which is a machine generated idl file for the lsa interface
actually has a complete NDR representation of this very structure.
The NDR representation is byte compatible with what is in packet-smb.c
if one chooses the UNIQUE pointers (which are just NULL or non-NULL) ((where
non-NULL just means the pointer points to a structure, the pointer value,
non-NULL, can be any arbitrary value))
It is perfectly legal for a LSA implementation to choose the pointers when
they should be non-NULL as being the offset which SMB uses.
According to lsa-muddle.idl these are unique pointers so it would be
perfectly legal as well to choose these pointers when non-NULL to always
have the value 0x01, though then it would not be compatilbe with the
original NT Security Descriptor dissector in packet-smb.c
I.e. NT Security Descriptor when used from LSA/(and other interfaces as
well) ARE NDR encoded structures.
They just happen to have an indentical representation to what
SMB/Transaction use if one chooses the Unique pointer values carefully.
best regards
ronnie sahlberg
_________________________________________________________________
Join the worlds largest e-mail service with MSN Hotmail.
http://www.hotmail.com
