[Tim Potter <tpot@xxxxxxxxx>]

This hidden field business got me thinking.  I've made a small change to
the dcerpc init routines which allows you to filter by string names for
dcerpc subcommands.

I've changed dcerpc_init_uuid() to take an extra value - a hf field
which corresponds to the opnum for the subdissector with a value_string
array associated with it.  The dcerpc_try_handoff() routine inserts a
hidden field with the value of the dcerpc.op for both the request and
reply.  For the spoolss dissector this now means you can do things like
'spoolss.opnum == addprinterdriver' rather than having to look up the
hex value of the opnum for the subcommand.

Here's some selected bits of the diff.  I haven't included the value
string array because it's too big and boring.


Tim.

*** packet-dcerpc.c.~1.48.~	Thu May  9 15:07:56 2002
--- packet-dcerpc.c	Tue May 14 15:09:11 2002
***************
*** 233,238 ****
--- 233,239 ----
      int ett;
      gchar *name;
      dcerpc_sub_dissector *procs;
+     int hf_opnum_valstr;	/* hf value for opnum value strings */
  } dcerpc_uuid_value;
  
  static gint
***************
*** 255,261 ****
  
  void
  dcerpc_init_uuid (int proto, int ett, e_uuid_t *uuid, guint16 ver,
!                   dcerpc_sub_dissector *procs)
  {
      dcerpc_uuid_key *key = g_malloc (sizeof (*key));
      dcerpc_uuid_value *value = g_malloc (sizeof (*value));
--- 256,262 ----
  
  void
  dcerpc_init_uuid (int proto, int ett, e_uuid_t *uuid, guint16 ver,
!                   dcerpc_sub_dissector *procs, int hf_opnum_valstr)
  {
      dcerpc_uuid_key *key = g_malloc (sizeof (*key));
      dcerpc_uuid_value *value = g_malloc (sizeof (*value));
***************
*** 267,272 ****
--- 268,274 ----
      value->ett = ett;
      value->name = proto_get_protocol_short_name (proto);
      value->procs = procs;
+     value->hf_opnum_valstr = hf_opnum_valstr;
  
      g_hash_table_insert (dcerpc_uuids, key, value);
  }
***************
*** 1081,1086 ****
--- 1083,1096 ----
              }
          }
      }
+ 
+     /* Add a hidden field for opnum which has a valstr associated with it.
+        We can then use this for text fields in the filter string. */
+ 
+     if (sub_proto->hf_opnum_valstr)
+ 	    proto_tree_add_uint_hidden(sub_tree, sub_proto->hf_opnum_valstr,
+ 				       tvb, 0, 0, opnum);
+ 
      return 0;
  }
  
*** packet-dcerpc-spoolss.c.~1.29.~	Mon May 13 11:27:07 2002
--- packet-dcerpc-spoolss.c	Wed May 15 11:42:17 2002
***************
*** 40,45 ****
--- 40,46 ----
  
  /* Global objects */
  
+ static int hf_spoolss_opnum = -1;
  static int hf_spoolss_hnd = -1;
  static int hf_spoolss_rc = -1;
  static int hf_spoolss_offered = -1;
***************
*** 3917,3922 ****
--- 4225,4233 ----
  proto_register_dcerpc_spoolss(void)
  {
          static hf_register_info hf[] = {
+ 		{ &hf_spoolss_opnum,
+ 		  { "Opnum", "spoolss.opnum", FT_UINT32, BASE_DEC,
+ 		    VALS(spoolss_opnum_vals), 0, "SPOOLSS opnum", HFILL }},
  		{ &hf_spoolss_hnd,
  		  { "Context handle", "spoolss.hnd", FT_BYTES, BASE_NONE, 
  		    NULL, 0x0, "SPOOLSS policy handle", HFILL }},
***************
*** 4091,4096 ****
          /* Register protocol as dcerpc */
  
          dcerpc_init_uuid(proto_dcerpc_spoolss, ett_dcerpc_spoolss, 
!                          &uuid_dcerpc_spoolss, ver_dcerpc_spoolss, 
!                          dcerpc_spoolss_dissectors);
  }
--- 4439,4444 ----
          /* Register protocol as dcerpc */
  
          dcerpc_init_uuid(proto_dcerpc_spoolss, ett_dcerpc_spoolss, 
!                          &uuid_dcerpc_spoolss, ver_dcerpc_spoolss,
!                          dcerpc_spoolss_dissectors, hf_spoolss_opnum);
  }