packet-dcerpc-samr.c

   1 /* packet-dcerpc-samr.c
   2  * Routines for SMB \PIPE\samr packet disassembly
   3  * Copyright 2001, Tim Potter <tpot@samba.org>
   4  *   2002 Added all command dissectors  Ronnie Sahlberg
   5  *
   6  * $Id: packet-dcerpc-samr.c,v 1.36 2002/04/29 10:30:18 guy Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <epan/packet.h>
  33 #include <string.h>
  34 #include "packet-dcerpc.h"
  35 #include "packet-dcerpc-nt.h"
  36 #include "packet-dcerpc-samr.h"
  37 #include "smb.h"        /* for "NT_errors[]" */
  38
  39 int dissect_nt_sid(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *parent_tree, char *name);
  40
  41 static int proto_dcerpc_samr = -1;
  42
  43 static int hf_samr_hnd = -1;
  44 static int hf_samr_group = -1;
  45 static int hf_samr_rid = -1;
  46 static int hf_samr_type = -1;
  47 static int hf_samr_alias = -1;
  48 static int hf_samr_rid_attrib = -1;
  49 static int hf_samr_rc = -1;
  50 static int hf_samr_index = -1;
  51 static int hf_samr_count = -1;
  52
  53 static int hf_samr_level = -1;
  54 static int hf_samr_start_idx = -1;
  55 static int hf_samr_max_entries = -1;
  56 static int hf_samr_entries = -1;
  57 static int hf_samr_pref_maxsize = -1;
  58 static int hf_samr_total_size = -1;
  59 static int hf_samr_ret_size = -1;
  60 static int hf_samr_alias_name = -1;
  61 static int hf_samr_group_name = -1;
  62 static int hf_samr_acct_name = -1;
  63 static int hf_samr_full_name = -1;
  64 static int hf_samr_acct_desc = -1;
  65 static int hf_samr_home = -1;
  66 static int hf_samr_home_drive = -1;
  67 static int hf_samr_script = -1;
  68 static int hf_samr_workstations = -1;
  69 static int hf_samr_profile = -1;
  70 static int hf_samr_server = -1;
  71 static int hf_samr_domain = -1;
  72 static int hf_samr_controller = -1;
  73 static int hf_samr_access = -1;
  74 static int hf_samr_mask = -1;
  75 static int hf_samr_crypt_password = -1;
  76 static int hf_samr_crypt_hash = -1;
  77 static int hf_samr_lm_change = -1;
  78 static int hf_samr_attrib = -1;
  79 static int hf_samr_max_pwd_age = -1;
  80 static int hf_samr_min_pwd_age = -1;
  81 static int hf_samr_min_pwd_len = -1;
  82 static int hf_samr_pwd_history_len = -1;
  83 static int hf_samr_num_users = -1;
  84 static int hf_samr_num_groups = -1;
  85 static int hf_samr_num_aliases = -1;
  86 static int hf_samr_resume_hnd = -1;
  87 static int hf_samr_bad_pwd_count = -1;
  88 static int hf_samr_logon_count = -1;
  89 static int hf_samr_logon_time = -1;
  90 static int hf_samr_logoff_time = -1;
  91 static int hf_samr_kickoff_time = -1;
  92 static int hf_samr_pwd_last_set_time = -1;
  93 static int hf_samr_pwd_can_change_time = -1;
  94 static int hf_samr_pwd_must_change_time = -1;
  95 static int hf_samr_acct_expiry_time = -1;
  96 static int hf_samr_country = -1;
  97 static int hf_samr_codepage = -1;
  98 static int hf_samr_comment = -1;
  99 static int hf_samr_parameters = -1;
 100 static int hf_samr_nt_pwd_set = -1;
 101 static int hf_samr_lm_pwd_set = -1;
 102 static int hf_samr_pwd_expired = -1;
 103 static int hf_samr_revision = -1;
 104 static int hf_samr_divisions = -1;
 105 static int hf_samr_info_type = -1;
 106
 107 static int hf_samr_unknown_hyper = -1;
 108 static int hf_samr_unknown_long = -1;
 109 static int hf_samr_unknown_short = -1;
 110 static int hf_samr_unknown_char = -1;
 111 static int hf_samr_unknown_string = -1;
 112 static int hf_samr_unknown_time = -1;
 113
 114 /* these are used by functions in packet-dcerpc-nt.c */
 115 int hf_nt_str_len = -1;
 116 int hf_nt_str_off = -1;
 117 int hf_nt_str_max_len = -1;
 118 int hf_nt_string_length = -1;
 119 int hf_nt_string_size = -1;
 120 static int hf_nt_acct_ctrl = -1;
 121 static int hf_nt_acb_disabled = -1;
 122 static int hf_nt_acb_homedirreq = -1;
 123 static int hf_nt_acb_pwnotreq = -1;
 124 static int hf_nt_acb_tempdup = -1;
 125 static int hf_nt_acb_normal = -1;
 126 static int hf_nt_acb_mns = -1;
 127 static int hf_nt_acb_domtrust = -1;
 128 static int hf_nt_acb_wstrust = -1;
 129 static int hf_nt_acb_svrtrust = -1;
 130 static int hf_nt_acb_pwnoexp = -1;
 131 static int hf_nt_acb_autolock = -1;
 132
 133 static gint ett_dcerpc_samr = -1;
 134 static gint ett_samr_user_dispinfo_1 = -1;
 135 static gint ett_samr_user_dispinfo_1_array = -1;
 136 static gint ett_samr_user_dispinfo_2 = -1;
 137 static gint ett_samr_user_dispinfo_2_array = -1;
 138 static gint ett_samr_group_dispinfo = -1;
 139 static gint ett_samr_group_dispinfo_array = -1;
 140 static gint ett_samr_ascii_dispinfo = -1;
 141 static gint ett_samr_ascii_dispinfo_array = -1;
 142 static gint ett_samr_display_info = -1;
 143 static gint ett_samr_password_info = -1;
 144 static gint ett_samr_server = -1;
 145 static gint ett_samr_user_group = -1;
 146 static gint ett_samr_user_group_array = -1;
 147 static gint ett_samr_alias_info = -1;
 148 static gint ett_samr_group_info = -1;
 149 static gint ett_samr_domain_info_1 = -1;
 150 static gint ett_samr_domain_info_2 = -1;
 151 static gint ett_samr_domain_info_8 = -1;
 152 static gint ett_samr_replication_status = -1;
 153 static gint ett_samr_domain_info_11 = -1;
 154 static gint ett_samr_domain_info_13 = -1;
 155 static gint ett_samr_domain_info = -1;
 156 static gint ett_samr_sid_pointer = -1;
 157 static gint ett_samr_sid_array = -1;
 158 static gint ett_samr_index_array = -1;
 159 static gint ett_samr_idx_and_name = -1;
 160 static gint ett_samr_idx_and_name_array = -1;
 161 static gint ett_samr_logon_hours = -1;
 162 static gint ett_samr_logon_hours_hours = -1;
 163 static gint ett_samr_user_info_1 = -1;
 164 static gint ett_samr_user_info_2 = -1;
 165 static gint ett_samr_user_info_3 = -1;
 166 static gint ett_samr_user_info_5 = -1;
 167 static gint ett_samr_user_info_6 = -1;
 168 static gint ett_samr_user_info_18 = -1;
 169 static gint ett_samr_user_info_19 = -1;
 170 static gint ett_samr_buffer_buffer = -1;
 171 static gint ett_samr_buffer = -1;
 172 static gint ett_samr_user_info_21 = -1;
 173 static gint ett_samr_user_info_22 = -1;
 174 static gint ett_samr_user_info_23 = -1;
 175 static gint ett_samr_user_info_24 = -1;
 176 static gint ett_samr_user_info = -1;
 177 static gint ett_samr_member_array_types = -1;
 178 static gint ett_samr_member_array_rids = -1;
 179 static gint ett_samr_member_array = -1;
 180 static gint ett_samr_names = -1;
 181 static gint ett_samr_rids = -1;
 182 static gint ett_nt_acct_ctrl = -1;
 183 static gint ett_samr_sid_and_attributes_array = -1;
 184 static gint ett_samr_sid_and_attributes = -1;
 185 #ifdef SAMR_UNUSED_HANDLES
 186 static gint ett_samr_hnd = -1;
 187 #endif
 188
 189 static e_uuid_t uuid_dcerpc_samr = {
 190         0x12345778, 0x1234, 0xabcd,
 191         { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0x89, 0xac}
 192 };
 193
 194 static guint16 ver_dcerpc_samr = 1;
 195
 196
 197 int
 198 dissect_ndr_nt_SID(tvbuff_t *tvb, int offset,
 199                         packet_info *pinfo, proto_tree *tree,
 200                         char *drep)
 201 {
 202         dcerpc_info *di;
 203
 204         di=pinfo->private_data;
 205         if(di->conformant_run){
 206                 /* just a run to handle conformant arrays, no scalars to dissect */
 207                 return offset;
 208         }
 209
 210         /* the SID contains a conformant array, first we must eat
 211            the 4-byte max_count before we can hand it off */
 212         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 213                         hf_samr_count, NULL);
 214
 215         offset = dissect_nt_sid(tvb, pinfo, offset, tree, "Domain");
 216         return offset;
 217 }
 218
 219 static int
 220 dissect_ndr_nt_SID_ptr(tvbuff_t *tvb, int offset,
 221                         packet_info *pinfo, proto_tree *tree,
 222                         char *drep)
 223 {
 224         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 225                         dissect_ndr_nt_SID, NDR_POINTER_UNIQUE,
 226                         "SID pointer", -1, 1);
 227         return offset;
 228 }
 229
 230
 231
 232 static const true_false_string tfs_nt_acb_disabled = {
 233         "Account is DISABLED",
 234         "Account is NOT disabled"
 235 };
 236 static const true_false_string tfs_nt_acb_homedirreq = {
 237         "Homedir is REQUIRED",
 238         "Homedir is NOT required"
 239 };
 240 static const true_false_string tfs_nt_acb_pwnotreq = {
 241         "Password is NOT required",
 242         "Password is REQUIRED"
 243 };
 244 static const true_false_string tfs_nt_acb_tempdup = {
 245         "This is a TEMPORARY DUPLICATE account",
 246         "This is NOT a temporary duplicate account"
 247 };
 248 static const true_false_string tfs_nt_acb_normal = {
 249         "This is a NORMAL USER account",
 250         "This is NOT a normal user account"
 251 };
 252 static const true_false_string tfs_nt_acb_mns = {
 253         "This is a MNS account",
 254         "This is NOT a mns account"
 255 };
 256 static const true_false_string tfs_nt_acb_domtrust = {
 257         "This is a DOMAIN TRUST account",
 258         "This is NOT a domain trust account"
 259 };
 260 static const true_false_string tfs_nt_acb_wstrust = {
 261         "This is a WORKSTATION TRUST account",
 262         "This is NOT a workstation trust account"
 263 };
 264 static const true_false_string tfs_nt_acb_svrtrust = {
 265         "This is a SERVER TRUST account",
 266         "This is NOT a server trust account"
 267 };
 268 static const true_false_string tfs_nt_acb_pwnoexp = {
 269         "Passwords does NOT expire",
 270         "Password will EXPIRE"
 271 };
 272 static const true_false_string tfs_nt_acb_autolock = {
 273         "This account has been AUTO LOCKED",
 274         "This account has NOT been auto locked"
 275 };
 276 int
 277 dissect_ndr_nt_acct_ctrl(tvbuff_t *tvb, int offset, packet_info *pinfo,
 278                         proto_tree *parent_tree, char *drep)
 279 {
 280         guint32 mask;
 281         proto_item *item = NULL;
 282         proto_tree *tree = NULL;
 283
 284         offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
 285                         hf_nt_acct_ctrl, &mask);
 286
 287         if(parent_tree){
 288                 item = proto_tree_add_uint(parent_tree, hf_nt_acct_ctrl,
 289                         tvb, offset-4, 4, mask);
 290                 tree = proto_item_add_subtree(item, ett_nt_acct_ctrl);
 291         }
 292
 293         proto_tree_add_boolean(tree, hf_nt_acb_autolock,
 294                 tvb, offset-4, 4, mask);
 295         proto_tree_add_boolean(tree, hf_nt_acb_pwnoexp,
 296                 tvb, offset-4, 4, mask);
 297         proto_tree_add_boolean(tree, hf_nt_acb_svrtrust,
 298                 tvb, offset-4, 4, mask);
 299         proto_tree_add_boolean(tree, hf_nt_acb_wstrust,
 300                 tvb, offset-4, 4, mask);
 301         proto_tree_add_boolean(tree, hf_nt_acb_domtrust,
 302                 tvb, offset-4, 4, mask);
 303         proto_tree_add_boolean(tree, hf_nt_acb_mns,
 304                 tvb, offset-4, 4, mask);
 305         proto_tree_add_boolean(tree, hf_nt_acb_normal,
 306                 tvb, offset-4, 4, mask);
 307         proto_tree_add_boolean(tree, hf_nt_acb_tempdup,
 308                 tvb, offset-4, 4, mask);
 309         proto_tree_add_boolean(tree, hf_nt_acb_pwnotreq,
 310                 tvb, offset-4, 4, mask);
 311         proto_tree_add_boolean(tree, hf_nt_acb_homedirreq,
 312                 tvb, offset-4, 4, mask);
 313         proto_tree_add_boolean(tree, hf_nt_acb_disabled,
 314                 tvb, offset-4, 4, mask);
 315
 316         return offset;
 317 }
 318
 319
 320 /* above this line, just some general support routines which should be placed
 321    in some more generic file common to all NT services dissectors
 322 */
 323
 324 static int
 325 samr_dissect_open_user_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo,
 326                             proto_tree *tree, char *drep)
 327 {
 328         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 329         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 330         guint32 rid;
 331
 332         if (check_col(pinfo->cinfo, COL_INFO))
 333                 col_set_str(pinfo->cinfo, COL_INFO, "OpenUser request");
 334
 335         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 336                                        hf_samr_hnd, NULL);
 337
 338         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 339                         hf_samr_access, NULL);
 340
 341         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 342                         hf_samr_rid, &rid);
 343
 344         if (check_col(pinfo->cinfo, COL_INFO))
 345                 col_append_fstr(pinfo->cinfo, COL_INFO, ", rid 0x%x", rid);
 346
 347         dcv->private_data = (void *)rid;
 348
 349         return offset;
 350 }
 351
 352 static int
 353 samr_dissect_open_user_reply(tvbuff_t *tvb, int offset,
 354                              packet_info *pinfo, proto_tree *tree,
 355                              char *drep)
 356 {
 357         if (check_col(pinfo->cinfo, COL_INFO))
 358                 col_set_str(pinfo->cinfo, COL_INFO, "OpenUser response");
 359
 360         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 361                                        hf_samr_hnd, NULL);
 362
 363         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
 364                         hf_samr_rc, NULL);
 365
 366         return offset;
 367 }
 368
 369 static int
 370 samr_dissect_pointer_long(tvbuff_t *tvb, int offset,
 371                              packet_info *pinfo, proto_tree *tree,
 372                              char *drep)
 373 {
 374         dcerpc_info *di;
 375
 376         di=pinfo->private_data;
 377         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 378                                      di->hf_index, NULL);
 379         return offset;
 380 }
 381
 382 static int
 383 samr_dissect_pointer_STRING(tvbuff_t *tvb, int offset,
 384                              packet_info *pinfo, proto_tree *tree,
 385                              char *drep)
 386 {
 387         dcerpc_info *di;
 388
 389         di=pinfo->private_data;
 390         if(di->conformant_run){
 391                 /*just a run to handle conformant arrays, nothing to dissect */
 392                 return offset;
 393         }
 394
 395         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 396                         di->hf_index, 0);
 397         return offset;
 398 }
 399
 400 static int
 401 samr_dissect_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
 402                              packet_info *pinfo, proto_tree *tree,
 403                              char *drep)
 404 {
 405         dcerpc_info *di;
 406
 407         di=pinfo->private_data;
 408         if(di->conformant_run){
 409                 /*just a run to handle conformant arrays, nothing to dissect */
 410                 return offset;
 411         }
 412
 413         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 414                         di->hf_index, di->levels);
 415         return offset;
 416 }
 417
 418 static int
 419 samr_dissect_pointer_short(tvbuff_t *tvb, int offset,
 420                              packet_info *pinfo, proto_tree *tree,
 421                              char *drep)
 422 {
 423         dcerpc_info *di;
 424
 425         di=pinfo->private_data;
 426         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 427                                      di->hf_index, NULL);
 428         return offset;
 429 }
 430
 431
 432 static int
 433 samr_dissect_query_dispinfo_rqst(tvbuff_t *tvb, int offset,
 434                                  packet_info *pinfo, proto_tree *tree,
 435                                  char *drep)
 436 {
 437         if (check_col(pinfo->cinfo, COL_INFO))
 438                 col_set_str(pinfo->cinfo, COL_INFO, "QueryDispInfo request");
 439
 440         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 441                                        hf_samr_hnd, NULL);
 442
 443         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 444                                      hf_samr_level, NULL);
 445         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 446                                      hf_samr_start_idx, NULL);
 447         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 448                                      hf_samr_max_entries, NULL);
 449         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 450                                      hf_samr_pref_maxsize, NULL);
 451
 452         return offset;
 453 }
 454
 455 static int
 456 samr_dissect_USER_DISPINFO_1(tvbuff_t *tvb, int offset,
 457                         packet_info *pinfo, proto_tree *parent_tree,
 458                         char *drep)
 459 {
 460         proto_item *item=NULL;
 461         proto_tree *tree=NULL;
 462         int old_offset=offset;
 463
 464         if(parent_tree){
 465                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 466                         "User_DispInfo_1");
 467                 tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1);
 468         }
 469
 470         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 471                                 hf_samr_index, NULL);
 472         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 473                                 hf_samr_rid, NULL);
 474         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
 475         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 476                                 hf_samr_acct_name, 0);
 477         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 478                                 hf_samr_full_name, 0);
 479         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 480                                 hf_samr_acct_desc, 0);
 481
 482         proto_item_set_len(item, offset-old_offset);
 483         return offset;
 484 }
 485
 486 static int
 487 samr_dissect_USER_DISPINFO_1_ARRAY_users(tvbuff_t *tvb, int offset,
 488                         packet_info *pinfo, proto_tree *tree,
 489                         char *drep)
 490 {
 491         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 492                         samr_dissect_USER_DISPINFO_1);
 493
 494         return offset;
 495 }
 496
 497 static int
 498 samr_dissect_USER_DISPINFO_1_ARRAY (tvbuff_t *tvb, int offset,
 499                              packet_info *pinfo, proto_tree *parent_tree,
 500                              char *drep)
 501 {
 502         guint32 count;
 503         proto_item *item=NULL;
 504         proto_tree *tree=NULL;
 505         int old_offset=offset;
 506
 507         if(parent_tree){
 508                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 509                         "User_DispInfo_1 Array");
 510                 tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_1_array);
 511         }
 512
 513
 514         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 515                                      hf_samr_count, &count);
 516         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 517                         samr_dissect_USER_DISPINFO_1_ARRAY_users, NDR_POINTER_PTR,
 518                         "USER_DISPINFO_1_ARRAY", -1, 0);
 519
 520         proto_item_set_len(item, offset-old_offset);
 521         return offset;
 522 }
 523
 524
 525
 526 static int
 527 samr_dissect_USER_DISPINFO_2(tvbuff_t *tvb, int offset,
 528                         packet_info *pinfo, proto_tree *parent_tree,
 529                         char *drep)
 530 {
 531         proto_item *item=NULL;
 532         proto_tree *tree=NULL;
 533         int old_offset=offset;
 534
 535         if(parent_tree){
 536                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 537                         "User_DispInfo_2");
 538                 tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_2);
 539         }
 540
 541         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 542                         hf_samr_index, NULL);
 543         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 544                         hf_samr_rid, NULL);
 545         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
 546         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 547                         hf_samr_acct_name, 0);
 548         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 549                         hf_samr_acct_desc, 0);
 550
 551         proto_item_set_len(item, offset-old_offset);
 552         return offset;
 553 }
 554
 555 static int
 556 samr_dissect_USER_DISPINFO_2_ARRAY_users (tvbuff_t *tvb, int offset,
 557                              packet_info *pinfo, proto_tree *tree,
 558                              char *drep)
 559 {
 560         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 561                         samr_dissect_USER_DISPINFO_2);
 562
 563         return offset;
 564 }
 565
 566 static int
 567 samr_dissect_USER_DISPINFO_2_ARRAY (tvbuff_t *tvb, int offset,
 568                              packet_info *pinfo, proto_tree *parent_tree,
 569                              char *drep)
 570 {
 571         guint32 count;
 572         proto_item *item=NULL;
 573         proto_tree *tree=NULL;
 574         int old_offset=offset;
 575
 576         if(parent_tree){
 577                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 578                         "User_DispInfo_2 Array");
 579                 tree = proto_item_add_subtree(item, ett_samr_user_dispinfo_2_array);
 580         }
 581
 582
 583         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 584                                      hf_samr_count, &count);
 585         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 586                         samr_dissect_USER_DISPINFO_2_ARRAY_users, NDR_POINTER_PTR,
 587                         "USER_DISPINFO_2_ARRAY", -1, 0);
 588
 589         proto_item_set_len(item, offset-old_offset);
 590         return offset;
 591 }
 592
 593
 594
 595
 596
 597 static int
 598 samr_dissect_GROUP_DISPINFO(tvbuff_t *tvb, int offset,
 599                         packet_info *pinfo, proto_tree *parent_tree,
 600                         char *drep)
 601 {
 602         proto_item *item=NULL;
 603         proto_tree *tree=NULL;
 604         int old_offset=offset;
 605
 606         if(parent_tree){
 607                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 608                         "Group_DispInfo");
 609                 tree = proto_item_add_subtree(item, ett_samr_group_dispinfo);
 610         }
 611
 612
 613         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 614                         hf_samr_index, NULL);
 615         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 616                         hf_samr_rid, NULL);
 617         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
 618         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 619                         hf_samr_acct_name, 0);
 620         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 621                         hf_samr_acct_desc, 0);
 622
 623         proto_item_set_len(item, offset-old_offset);
 624         return offset;
 625 }
 626
 627 static int
 628 samr_dissect_GROUP_DISPINFO_ARRAY_groups(tvbuff_t *tvb, int offset,
 629                         packet_info *pinfo, proto_tree *tree,
 630                         char *drep)
 631 {
 632         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 633                         samr_dissect_GROUP_DISPINFO);
 634
 635         return offset;
 636 }
 637
 638 static int
 639 samr_dissect_GROUP_DISPINFO_ARRAY(tvbuff_t *tvb, int offset,
 640                         packet_info *pinfo, proto_tree *parent_tree,
 641                         char *drep)
 642 {
 643         guint32 count;
 644         proto_item *item=NULL;
 645         proto_tree *tree=NULL;
 646         int old_offset=offset;
 647
 648         if(parent_tree){
 649                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 650                         "Group_DispInfo Array");
 651                 tree = proto_item_add_subtree(item, ett_samr_group_dispinfo_array);
 652         }
 653
 654         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 655                                      hf_samr_count, &count);
 656         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 657                         samr_dissect_GROUP_DISPINFO_ARRAY_groups, NDR_POINTER_PTR,
 658                         "GROUP_DISPINFO_ARRAY", -1, 0);
 659
 660         proto_item_set_len(item, offset-old_offset);
 661         return offset;
 662 }
 663
 664
 665
 666 static int
 667 samr_dissect_ASCII_DISPINFO(tvbuff_t *tvb, int offset,
 668                         packet_info *pinfo, proto_tree *parent_tree,
 669                         char *drep)
 670 {
 671         proto_item *item=NULL;
 672         proto_tree *tree=NULL;
 673         int old_offset=offset;
 674
 675         if(parent_tree){
 676                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 677                         "Ascii_DispInfo");
 678                 tree = proto_item_add_subtree(item, ett_samr_ascii_dispinfo);
 679         }
 680
 681
 682         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 683                         hf_samr_index, NULL);
 684         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 685                         hf_samr_rid, NULL);
 686         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
 687         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 688                         hf_samr_acct_name, 0);
 689         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 690                         hf_samr_acct_desc,0 );
 691
 692         proto_item_set_len(item, offset-old_offset);
 693         return offset;
 694 }
 695
 696 static int
 697 samr_dissect_ASCII_DISPINFO_ARRAY_users(tvbuff_t *tvb, int offset,
 698                         packet_info *pinfo, proto_tree *tree,
 699                         char *drep)
 700 {
 701         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 702                         samr_dissect_ASCII_DISPINFO);
 703
 704         return offset;
 705 }
 706
 707 static int
 708 samr_dissect_ASCII_DISPINFO_ARRAY(tvbuff_t *tvb, int offset,
 709                         packet_info *pinfo, proto_tree *parent_tree,
 710                         char *drep)
 711 {
 712         guint32 count;
 713         proto_item *item=NULL;
 714         proto_tree *tree=NULL;
 715         int old_offset=offset;
 716
 717         if(parent_tree){
 718                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 719                         "Ascii_DispInfo Array");
 720                 tree = proto_item_add_subtree(item, ett_samr_ascii_dispinfo_array);
 721         }
 722
 723         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 724                                      hf_samr_count, &count);
 725         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 726                         samr_dissect_ASCII_DISPINFO_ARRAY_users, NDR_POINTER_PTR,
 727                         "ACSII_DISPINFO_ARRAY", -1, 0);
 728
 729         proto_item_set_len(item, offset-old_offset);
 730         return offset;
 731 }
 732
 733
 734 static int
 735 samr_dissect_DISPLAY_INFO (tvbuff_t *tvb, int offset,
 736                              packet_info *pinfo, proto_tree *parent_tree,
 737                              char *drep)
 738 {
 739         proto_item *item=NULL;
 740         proto_tree *tree=NULL;
 741         int old_offset=offset;
 742         guint16 level;
 743
 744         if(parent_tree){
 745                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 746                         "DISP_INFO:");
 747                 tree = proto_item_add_subtree(item, ett_samr_display_info);
 748         }
 749
 750         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 751                                      hf_samr_level, &level);
 752         switch(level){
 753         case 1:
 754                 offset = samr_dissect_USER_DISPINFO_1_ARRAY(
 755                                 tvb, offset, pinfo, tree, drep);
 756                 break;
 757         case 2:
 758                 offset = samr_dissect_USER_DISPINFO_2_ARRAY(
 759                                 tvb, offset, pinfo, tree, drep);
 760                 break;
 761         case 3:
 762                 offset = samr_dissect_GROUP_DISPINFO_ARRAY(
 763                                 tvb, offset, pinfo, tree, drep);
 764                 break;
 765         case 4:
 766                 offset = samr_dissect_ASCII_DISPINFO_ARRAY(
 767                                 tvb, offset, pinfo, tree, drep);
 768                 break;
 769         case 5:
 770                 offset = samr_dissect_ASCII_DISPINFO_ARRAY(
 771                                 tvb, offset, pinfo, tree, drep);
 772                 break;
 773         }
 774
 775         proto_item_set_len(item, offset-old_offset);
 776         return offset;
 777 }
 778
 779 static int
 780 samr_dissect_query_dispinfo_reply(tvbuff_t *tvb, int offset,
 781                                   packet_info *pinfo, proto_tree *tree,
 782                                   char *drep)
 783 {
 784         if (check_col(pinfo->cinfo, COL_INFO))
 785                 col_set_str(pinfo->cinfo, COL_INFO, "QueryDispInfo response");
 786
 787         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 788                         samr_dissect_pointer_long, NDR_POINTER_REF,
 789                         "", hf_samr_total_size, 0);
 790         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 791                         samr_dissect_pointer_long, NDR_POINTER_REF,
 792                         "", hf_samr_ret_size, 0);
 793         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 794                         samr_dissect_DISPLAY_INFO, NDR_POINTER_REF,
 795                         "", -1, 0);
 796         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 797                                      hf_samr_rc, NULL);
 798
 799         return offset;
 800 }
 801
 802 static int
 803 samr_dissect_get_display_enumeration_index_rqst(tvbuff_t *tvb, int offset,
 804                                                 packet_info *pinfo,
 805                                                 proto_tree *tree,
 806                                                 char *drep)
 807 {
 808         if (check_col(pinfo->cinfo, COL_INFO))
 809                 col_set_str(pinfo->cinfo, COL_INFO,
 810                             "GetDispEnumIndex request");
 811
 812         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 813                                        hf_samr_hnd, NULL);
 814
 815         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 816                                      hf_samr_level, NULL);
 817
 818         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 819                         hf_samr_acct_name, 0);
 820
 821         return offset;
 822 }
 823
 824 static int
 825 samr_dissect_get_display_enumeration_index_reply(tvbuff_t *tvb, int offset,
 826                              packet_info *pinfo, proto_tree *tree,
 827                              char *drep)
 828 {
 829         if (check_col(pinfo->cinfo, COL_INFO))
 830                 col_set_str(pinfo->cinfo, COL_INFO,
 831                             "GetDispEnumIndex response");
 832
 833         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 834                         samr_dissect_pointer_long, NDR_POINTER_REF,
 835                         "", hf_samr_index, 0);
 836
 837         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
 838                                   hf_samr_rc, NULL);
 839
 840         return offset;
 841 }
 842
 843
 844
 845
 846 static int
 847 samr_dissect_PASSWORD_INFO(tvbuff_t *tvb, int offset,
 848                         packet_info *pinfo, proto_tree *parent_tree,
 849                         char *drep)
 850 {
 851         proto_item *item=NULL;
 852         proto_tree *tree=NULL;
 853         int old_offset=offset;
 854
 855         ALIGN_TO_4_BYTES;  /* strcture starts with short, but is aligned for longs */
 856
 857         if(parent_tree){
 858                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 859                         "PASSWORD_INFO:");
 860                 tree = proto_item_add_subtree(item, ett_samr_password_info);
 861         }
 862
 863
 864         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 865                         hf_samr_unknown_short, NULL);
 866         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 867                         hf_samr_unknown_long, NULL);
 868
 869         proto_item_set_len(item, offset-old_offset);
 870         return offset;
 871 }
 872
 873 static int
 874 samr_dissect_get_usrdom_pwinfo_rqst(tvbuff_t *tvb, int offset,
 875                                     packet_info *pinfo, proto_tree *tree,
 876                                     char *drep)
 877 {
 878         if (check_col(pinfo->cinfo, COL_INFO))
 879                 col_set_str(pinfo->cinfo, COL_INFO, "GetPwInfo request");
 880
 881         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 882                                        hf_samr_hnd, NULL);
 883
 884         return offset;
 885 }
 886
 887 static int
 888 samr_dissect_get_usrdom_pwinfo_reply(tvbuff_t *tvb, int offset,
 889                              packet_info *pinfo, proto_tree *tree,
 890                              char *drep)
 891 {
 892         if (check_col(pinfo->cinfo, COL_INFO))
 893                 col_set_str(pinfo->cinfo, COL_INFO, "GetPwInfo response");
 894
 895         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 896                         samr_dissect_PASSWORD_INFO, NDR_POINTER_REF,
 897                         "", -1, 0);
 898
 899         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
 900                                   hf_samr_rc, NULL);
 901         return offset;
 902 }
 903
 904
 905
 906 static int
 907 samr_dissect_connect2_server(tvbuff_t *tvb, int offset,
 908                              packet_info *pinfo, proto_tree *parent_tree,
 909                              char *drep)
 910 {
 911         proto_item *item=NULL;
 912         proto_tree *tree=NULL;
 913         int old_offset=offset;
 914
 915         if(parent_tree){
 916                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 917                         "Server");
 918                 tree = proto_item_add_subtree(item, ett_samr_server);
 919         }
 920
 921         offset = dissect_ndr_nt_UNICODE_STRING_str(tvb, offset, pinfo,
 922                         tree, drep);
 923
 924         proto_item_set_len(item, offset-old_offset);
 925         return offset;
 926 }
 927
 928 static int
 929 samr_dissect_connect2_rqst(tvbuff_t *tvb, int offset,
 930                            packet_info *pinfo, proto_tree *tree,
 931                            char *drep)
 932 {
 933         if (check_col(pinfo->cinfo, COL_INFO))
 934                 col_set_str(pinfo->cinfo, COL_INFO, "Connect2 request");
 935
 936         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 937                         samr_dissect_connect2_server, NDR_POINTER_UNIQUE,
 938                         "Server", hf_samr_server, 1);
 939
 940         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 941                                      hf_samr_access, NULL);
 942         return offset;
 943 }
 944
 945 static int
 946 samr_dissect_connect2_reply(tvbuff_t *tvb, int offset,
 947                              packet_info *pinfo, proto_tree *tree,
 948                              char *drep)
 949 {
 950         if (check_col(pinfo->cinfo, COL_INFO))
 951                 col_set_str(pinfo->cinfo, COL_INFO, "Connect2 response");
 952
 953         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 954                                        hf_samr_hnd, NULL);
 955
 956         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
 957                                   hf_samr_rc, NULL);
 958         return offset;
 959 }
 960
 961 static int
 962 samr_dissect_connect_anon_rqst(tvbuff_t *tvb, int offset,
 963                                packet_info *pinfo, proto_tree *tree,
 964                                char *drep)
 965 {
 966         if (check_col(pinfo->cinfo, COL_INFO))
 967                 col_set_str(pinfo->cinfo, COL_INFO, "ConnectAnon request");
 968
 969         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 970                         samr_dissect_connect2_server, NDR_POINTER_UNIQUE,
 971                         "Server", hf_samr_server, 1);
 972
 973         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 974                                      hf_samr_access, NULL);
 975
 976         return offset;
 977 }
 978
 979 static int
 980 samr_dissect_connect_anon_reply(tvbuff_t *tvb, int offset,
 981                                 packet_info *pinfo, proto_tree *tree,
 982                                 char *drep)
 983 {
 984         if (check_col(pinfo->cinfo, COL_INFO))
 985                 col_set_str(pinfo->cinfo, COL_INFO, "ConnectAnon response");
 986
 987         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 988                                        hf_samr_hnd, NULL);
 989
 990         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
 991                                   hf_samr_rc, NULL);
 992
 993         return offset;
 994 }
 995
 996 static int
 997 samr_dissect_USER_GROUP(tvbuff_t *tvb, int offset,
 998                              packet_info *pinfo, proto_tree *parent_tree,
 999                              char *drep)
1000 {
1001         proto_item *item=NULL;
1002         proto_tree *tree=NULL;
1003         int old_offset=offset;
1004
1005         if(parent_tree){
1006                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1007                         "USER_GROUP:");
1008                 tree = proto_item_add_subtree(item, ett_samr_user_group);
1009         }
1010
1011         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1012                                      hf_samr_rid, NULL);
1013         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1014                                      hf_samr_rid_attrib, NULL);
1015
1016         proto_item_set_len(item, offset-old_offset);
1017         return offset;
1018 }
1019
1020 static int
1021 samr_dissect_USER_GROUP_ARRAY_groups (tvbuff_t *tvb, int offset,
1022                              packet_info *pinfo, proto_tree *tree,
1023                              char *drep)
1024 {
1025         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1026                         samr_dissect_USER_GROUP);
1027
1028         return offset;
1029 }
1030
1031 static int
1032 samr_dissect_USER_GROUP_ARRAY(tvbuff_t *tvb, int offset,
1033                         packet_info *pinfo, proto_tree *parent_tree,
1034                         char *drep)
1035 {
1036         guint32 count;
1037         proto_item *item=NULL;
1038         proto_tree *tree=NULL;
1039         int old_offset=offset;
1040
1041         if(parent_tree){
1042                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1043                         "USER_GROUP_ARRAY");
1044                 tree = proto_item_add_subtree(item, ett_samr_user_group_array);
1045         }
1046
1047         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1048                         hf_samr_count, &count);
1049         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1050                         samr_dissect_USER_GROUP_ARRAY_groups, NDR_POINTER_UNIQUE,
1051                         "USER_GROUP_ARRAY", -1, 0);
1052
1053         proto_item_set_len(item, offset-old_offset);
1054         return offset;
1055 }
1056
1057 static int
1058 samr_dissect_USER_GROUP_ARRAY_ptr(tvbuff_t *tvb, int offset,
1059                         packet_info *pinfo, proto_tree *tree,
1060                         char *drep)
1061 {
1062         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1063                         samr_dissect_USER_GROUP_ARRAY, NDR_POINTER_UNIQUE,
1064                         "USER_GROUP_ARRAY", -1, 0);
1065         return offset;
1066 }
1067
1068 static int
1069 samr_dissect_get_groups_for_user_rqst(tvbuff_t *tvb, int offset,
1070                                       packet_info *pinfo, proto_tree *tree,
1071                                       char *drep)
1072 {
1073         if (check_col(pinfo->cinfo, COL_INFO))
1074                 col_set_str(pinfo->cinfo, COL_INFO, "GetUserGroups request");
1075
1076         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1077                                        hf_samr_hnd, NULL);
1078
1079         return offset;
1080 }
1081
1082 static int
1083 samr_dissect_get_groups_for_user_reply(tvbuff_t *tvb, int offset,
1084                                        packet_info *pinfo, proto_tree *tree,
1085                                        char *drep)
1086 {
1087         if (check_col(pinfo->cinfo, COL_INFO))
1088                 col_set_str(pinfo->cinfo, COL_INFO, "GetUserGroups response");
1089
1090         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1091                         samr_dissect_USER_GROUP_ARRAY_ptr, NDR_POINTER_REF,
1092                         "", -1, 0);
1093
1094         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1095                                   hf_samr_rc, NULL);
1096         return offset;
1097 }
1098
1099
1100
1101 static int
1102 samr_dissect_open_domain_rqst(tvbuff_t *tvb, int offset,
1103                               packet_info *pinfo, proto_tree *tree,
1104                               char *drep)
1105 {
1106         if (check_col(pinfo->cinfo, COL_INFO))
1107                 col_set_str(pinfo->cinfo, COL_INFO, "OpenDomain request");
1108
1109         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1110                                        hf_samr_hnd, NULL);
1111
1112         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1113                                      hf_samr_access, NULL);
1114         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1115                         dissect_ndr_nt_SID, NDR_POINTER_REF,
1116                         "", -1, 0);
1117         return offset;
1118 }
1119
1120 static int
1121 samr_dissect_open_domain_reply(tvbuff_t *tvb, int offset,
1122                              packet_info *pinfo, proto_tree *tree,
1123                              char *drep)
1124 {
1125         if (check_col(pinfo->cinfo, COL_INFO))
1126                 col_set_str(pinfo->cinfo, COL_INFO, "OpenDomain response");
1127
1128         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1129                                        hf_samr_hnd, NULL);
1130
1131         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1132                                   hf_samr_rc, NULL);
1133
1134         return offset;
1135 }
1136
1137 static int
1138 samr_dissect_context_handle_SID(tvbuff_t *tvb, int offset,
1139                              packet_info *pinfo, proto_tree *tree,
1140                              char *drep)
1141 {
1142         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1143                                        hf_samr_hnd, NULL);
1144
1145         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1146                         dissect_ndr_nt_SID, NDR_POINTER_REF,
1147                         "SID", -1, 0);
1148         return offset;
1149 }
1150
1151 static int
1152 samr_dissect_add_member_to_group_rqst(tvbuff_t *tvb, int offset,
1153                                       packet_info *pinfo, proto_tree *tree,
1154                                       char *drep)
1155 {
1156         if (check_col(pinfo->cinfo, COL_INFO))
1157                 col_set_str(pinfo->cinfo, COL_INFO, "AddGroupMem request");
1158
1159         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1160                                        hf_samr_hnd, NULL);
1161
1162         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1163                                      hf_samr_group, NULL);
1164
1165         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1166                                      hf_samr_rid, NULL);
1167
1168         return offset;
1169 }
1170
1171 static int
1172 samr_dissect_add_member_to_group_reply(tvbuff_t *tvb, int offset,
1173                                        packet_info *pinfo, proto_tree *tree,
1174                                        char *drep)
1175 {
1176         if (check_col(pinfo->cinfo, COL_INFO))
1177                 col_set_str(pinfo->cinfo, COL_INFO, "AddGroupMem response");
1178
1179         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1180                                   hf_samr_rc, NULL);
1181
1182         return offset;
1183 }
1184
1185 static int
1186 samr_dissect_unknown_3c_rqst(tvbuff_t *tvb, int offset,
1187                              packet_info *pinfo, proto_tree *tree,
1188                              char *drep)
1189 {
1190         if (check_col(pinfo->cinfo, COL_INFO))
1191                 col_set_str(pinfo->cinfo, COL_INFO, "Unknown 0x3c request");
1192
1193         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1194                                        hf_samr_hnd, NULL);
1195
1196         return offset;
1197 }
1198
1199 static int
1200 samr_dissect_unknown_3c_reply(tvbuff_t *tvb, int offset,
1201                              packet_info *pinfo, proto_tree *tree,
1202                              char *drep)
1203 {
1204         if (check_col(pinfo->cinfo, COL_INFO))
1205                 col_set_str(pinfo->cinfo, COL_INFO, "Unknown 0x3c response");
1206
1207         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1208                         samr_dissect_pointer_short, NDR_POINTER_REF,
1209                         "", hf_samr_unknown_short, 0);
1210
1211         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1212                                   hf_samr_rc, NULL);
1213         return offset;
1214 }
1215
1216 static int
1217 samr_dissect_create_alias_in_domain_rqst(tvbuff_t *tvb, int offset,
1218                                          packet_info *pinfo, proto_tree *tree,
1219                                          char *drep)
1220 {
1221         if (check_col(pinfo->cinfo, COL_INFO))
1222                 col_set_str(pinfo->cinfo, COL_INFO, "CreateAlias request");
1223
1224         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1225                                        hf_samr_hnd, NULL);
1226
1227         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1228                         samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF,
1229                         "Account Name", hf_samr_acct_name, 0);
1230
1231         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1232                                      hf_samr_access, NULL);
1233
1234         return offset;
1235 }
1236
1237 static int
1238 samr_dissect_create_alias_in_domain_reply(tvbuff_t *tvb, int offset,
1239                              packet_info *pinfo, proto_tree *tree,
1240                              char *drep)
1241 {
1242         if (check_col(pinfo->cinfo, COL_INFO))
1243                 col_set_str(pinfo->cinfo, COL_INFO, "CreateAlias response");
1244
1245         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1246                                        hf_samr_hnd, NULL);
1247
1248         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1249                                      hf_samr_rid, NULL);
1250
1251         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1252                                   hf_samr_rc, NULL);
1253
1254         return offset;
1255 }
1256
1257 static int
1258 samr_dissect_query_information_alias_rqst(tvbuff_t *tvb, int offset,
1259                                           packet_info *pinfo,
1260                                           proto_tree *tree, char *drep)
1261 {
1262         if (check_col(pinfo->cinfo, COL_INFO))
1263                 col_set_str(pinfo->cinfo, COL_INFO, "QueryAliasInfo request");
1264
1265         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1266                                        hf_samr_hnd, NULL);
1267
1268         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1269                         hf_samr_level, NULL);
1270
1271         return offset;
1272 }
1273
1274 static int
1275 samr_dissect_ALIAS_INFO_1 (tvbuff_t *tvb, int offset,
1276                              packet_info *pinfo, proto_tree *tree,
1277                              char *drep)
1278 {
1279         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo,
1280                 tree, drep,
1281                 hf_samr_acct_name, 0);
1282         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1283                                      hf_samr_rid, NULL);
1284         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo,
1285                 tree, drep,
1286                 hf_samr_acct_desc, 0);
1287         return offset;
1288 }
1289
1290 static int
1291 samr_dissect_ALIAS_INFO(tvbuff_t *tvb, int offset,
1292                         packet_info *pinfo, proto_tree *parent_tree,
1293                         char *drep)
1294 {
1295         proto_item *item=NULL;
1296         proto_tree *tree=NULL;
1297         int old_offset=offset;
1298         guint16 level;
1299
1300         if(parent_tree){
1301                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1302                         "ALIAS_INFO:");
1303                 tree = proto_item_add_subtree(item, ett_samr_alias_info);
1304         }
1305
1306         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1307                                      hf_samr_level, &level);
1308         switch(level){
1309         case 1:
1310                 offset = samr_dissect_ALIAS_INFO_1(
1311                                 tvb, offset, pinfo, tree, drep);
1312                 break;
1313         case 2:
1314                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo,
1315                         tree, drep,
1316                         hf_samr_acct_name, 0);
1317                 break;
1318         case 3:
1319                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo,
1320                         tree, drep,
1321                         hf_samr_acct_desc, 0);
1322                 break;
1323         }
1324
1325         proto_item_set_len(item, offset-old_offset);
1326         return offset;
1327 }
1328
1329 static int
1330 samr_dissect_ALIAS_INFO_ptr(tvbuff_t *tvb, int offset,
1331                         packet_info *pinfo, proto_tree *tree,
1332                         char *drep)
1333 {
1334         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1335                         samr_dissect_ALIAS_INFO, NDR_POINTER_UNIQUE,
1336                         "ALIAS_INFO", -1, 0);
1337         return offset;
1338 }
1339
1340 static int
1341 samr_dissect_query_information_alias_reply(tvbuff_t *tvb, int offset,
1342                                            packet_info *pinfo,
1343                                            proto_tree *tree, char *drep)
1344 {
1345         if (check_col(pinfo->cinfo, COL_INFO))
1346                 col_set_str(pinfo->cinfo, COL_INFO, "QueryAliasInfo response");
1347
1348         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1349                         samr_dissect_ALIAS_INFO_ptr, NDR_POINTER_REF,
1350                         "", -1, 0);
1351
1352         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1353                                   hf_samr_rc, NULL);
1354
1355         return offset;
1356 }
1357
1358 static int
1359 samr_dissect_set_information_alias_rqst(tvbuff_t *tvb, int offset,
1360                              packet_info *pinfo, proto_tree *tree,
1361                              char *drep)
1362 {
1363         if (check_col(pinfo->cinfo, COL_INFO))
1364                 col_set_str(pinfo->cinfo, COL_INFO, "SetAliasInfo request");
1365
1366         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1367                                        hf_samr_hnd, NULL);
1368
1369         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1370                                      hf_samr_level, NULL);
1371         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1372                         samr_dissect_ALIAS_INFO, NDR_POINTER_REF,
1373                         "", -1, 0);
1374         return offset;
1375 }
1376
1377 static int
1378 samr_dissect_set_information_alias_reply(tvbuff_t *tvb, int offset,
1379                                          packet_info *pinfo, proto_tree *tree,
1380                                          char *drep)
1381 {
1382         if (check_col(pinfo->cinfo, COL_INFO))
1383                 col_set_str(pinfo->cinfo, COL_INFO, "SetAliasInfo response");
1384
1385         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1386                         samr_dissect_ALIAS_INFO_ptr, NDR_POINTER_REF,
1387                         "", -1, 0);
1388
1389         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1390                                   hf_samr_rc, NULL);
1391         return offset;
1392 }
1393
1394 static int
1395 samr_dissect_CRYPT_PASSWORD(tvbuff_t *tvb, int offset,
1396                         packet_info *pinfo, proto_tree *tree,
1397                         char *drep)
1398 {
1399         proto_tree_add_item(tree, hf_samr_crypt_password, tvb, offset, 516,
1400                 FALSE);
1401         offset += 516;
1402         return offset;
1403 }
1404
1405 static int
1406 samr_dissect_CRYPT_HASH(tvbuff_t *tvb, int offset,
1407                         packet_info *pinfo, proto_tree *tree,
1408                         char *drep)
1409 {
1410         proto_tree_add_item(tree, hf_samr_crypt_hash, tvb, offset, 16,
1411                 FALSE);
1412         offset += 16;
1413         return offset;
1414 }
1415
1416
1417 static int
1418 samr_dissect_oem_change_password_user2_rqst(tvbuff_t *tvb, int offset,
1419                                             packet_info *pinfo,
1420                                             proto_tree *tree, char *drep)
1421 {
1422         if (check_col(pinfo->cinfo, COL_INFO))
1423                 col_set_str(pinfo->cinfo, COL_INFO,
1424                             "OEMChangePassword request");
1425
1426         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1427                                        hf_samr_hnd, NULL);
1428
1429         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1430                         samr_dissect_pointer_STRING, NDR_POINTER_UNIQUE,
1431                         "Server", hf_samr_server, 0);
1432         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1433                         samr_dissect_pointer_STRING, NDR_POINTER_REF,
1434                         "Account Name", hf_samr_acct_name, 0);
1435         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1436                         samr_dissect_CRYPT_PASSWORD, NDR_POINTER_UNIQUE,
1437                         "Password", -1, 0);
1438         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1439                         samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE,
1440                         "Hash", -1, 0);
1441         return offset;
1442 }
1443
1444 static int
1445 samr_dissect_oem_change_password_user2_reply(tvbuff_t *tvb, int offset,
1446                                              packet_info *pinfo,
1447                                              proto_tree *tree, char *drep)
1448 {
1449         if (check_col(pinfo->cinfo, COL_INFO))
1450                 col_set_str(pinfo->cinfo, COL_INFO,
1451                             "OEMChangePassword response");
1452
1453         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1454                                   hf_samr_rc, NULL);
1455
1456         return offset;
1457 }
1458
1459 static int
1460 samr_dissect_unicode_change_password_user2_rqst(tvbuff_t *tvb, int offset,
1461                                                 packet_info *pinfo,
1462                                                 proto_tree *tree, char *drep)
1463 {
1464         if (check_col(pinfo->cinfo, COL_INFO))
1465                 col_set_str(pinfo->cinfo, COL_INFO,
1466                             "UnicodeChangePassword request");
1467
1468         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1469                                        hf_samr_hnd, NULL);
1470
1471         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1472                         samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
1473                         "Server", hf_samr_server, 0);
1474         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1475                         samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF,
1476                         "Account Name", hf_samr_acct_name, 0);
1477         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1478                         samr_dissect_CRYPT_PASSWORD, NDR_POINTER_UNIQUE,
1479                         "Password", -1, 0);
1480         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1481                         samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE,
1482                         "Hash", -1, 0);
1483         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
1484                                      hf_samr_lm_change, NULL);
1485         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1486                         samr_dissect_CRYPT_PASSWORD, NDR_POINTER_UNIQUE,
1487                         "Password", -1, 0);
1488         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1489                         samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE,
1490                         "Hash", -1, 0);
1491         return offset;
1492 }
1493
1494 static int
1495 samr_dissect_unicode_change_password_user2_reply(tvbuff_t *tvb, int offset,
1496                                                  packet_info *pinfo,
1497                                                  proto_tree *tree, char *drep)
1498 {
1499         if (check_col(pinfo->cinfo, COL_INFO))
1500                 col_set_str(pinfo->cinfo, COL_INFO,
1501                             "UnicodeChangePassword response");
1502
1503         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1504                                   hf_samr_rc, NULL);
1505
1506         return offset;
1507 }
1508
1509 static int
1510 samr_dissect_unknown_3b_rqst(tvbuff_t *tvb, int offset,
1511                              packet_info *pinfo, proto_tree *tree,
1512                              char *drep)
1513 {
1514         if (check_col(pinfo->cinfo, COL_INFO))
1515                 col_set_str(pinfo->cinfo, COL_INFO, "Unknown 0x3b request");
1516
1517         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1518                                        hf_samr_hnd, NULL);
1519
1520         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1521                                      hf_samr_unknown_short, NULL);
1522         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1523                         samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
1524                         "Unknown", hf_samr_unknown_string, 0);
1525         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1526                         samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
1527                         "Unknown", hf_samr_unknown_string, 0);
1528         return offset;
1529 }
1530
1531 static int
1532 samr_dissect_unknown_3b_reply(tvbuff_t *tvb, int offset,
1533                               packet_info *pinfo, proto_tree *tree,
1534                               char *drep)
1535 {
1536         if (check_col(pinfo->cinfo, COL_INFO))
1537                 col_set_str(pinfo->cinfo, COL_INFO, "Unknown 0x3b response");
1538
1539         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1540                                   hf_samr_rc, NULL);
1541
1542         return offset;
1543 }
1544
1545 static int
1546 samr_dissect_create_user2_in_domain_rqst(tvbuff_t *tvb, int offset,
1547                                          packet_info *pinfo, proto_tree *tree,
1548                                          char *drep)
1549 {
1550         if (check_col(pinfo->cinfo, COL_INFO))
1551                 col_set_str(pinfo->cinfo, COL_INFO, "CreateDomUser request");
1552
1553         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1554                                        hf_samr_hnd, NULL);
1555
1556         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1557                         samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF,
1558                         "Account Name", hf_samr_acct_name, 0);
1559         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
1560         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1561                         hf_samr_access, NULL);
1562
1563         return offset;
1564 }
1565
1566 static int
1567 samr_dissect_create_user2_in_domain_reply(tvbuff_t *tvb, int offset,
1568                              packet_info *pinfo, proto_tree *tree,
1569                              char *drep)
1570 {
1571         if (check_col(pinfo->cinfo, COL_INFO))
1572                 col_set_str(pinfo->cinfo, COL_INFO, "CreateDomUser response");
1573
1574         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1575                                        hf_samr_hnd, NULL);
1576
1577         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1578                                      hf_samr_unknown_long, NULL);
1579         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1580                                      hf_samr_rid, NULL);
1581
1582         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1583                                   hf_samr_rc, NULL);
1584         return offset;
1585 }
1586
1587 static int
1588 samr_dissect_get_display_enumeration_index2_rqst(tvbuff_t *tvb, int offset,
1589                                                  packet_info *pinfo,
1590                                                  proto_tree *tree, char *drep)
1591 {
1592         if (check_col(pinfo->cinfo, COL_INFO))
1593                 col_set_str(pinfo->cinfo, COL_INFO,
1594                             "GetDispEnumIndex2 request");
1595
1596         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1597                                        hf_samr_hnd, NULL);
1598
1599         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1600                                      hf_samr_level, NULL);
1601         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1602                         samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF,
1603                         "Account Name", hf_samr_acct_name, 0);
1604         return offset;
1605 }
1606
1607 static int
1608 samr_dissect_get_display_enumeration_index2_reply(tvbuff_t *tvb, int offset,
1609                              packet_info *pinfo, proto_tree *tree,
1610                              char *drep)
1611 {
1612         if (check_col(pinfo->cinfo, COL_INFO))
1613                 col_set_str(pinfo->cinfo, COL_INFO,
1614                             "GetDispEnumIndex2 response");
1615
1616         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1617                                      hf_samr_index, NULL);
1618
1619         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1620                                   hf_samr_rc, NULL);
1621         return offset;
1622 }
1623
1624 static int
1625 samr_dissect_change_password_user_rqst(tvbuff_t *tvb, int offset,
1626                                        packet_info *pinfo, proto_tree *tree,
1627                                        char *drep)
1628 {
1629         if (check_col(pinfo->cinfo, COL_INFO))
1630                 col_set_str(pinfo->cinfo, COL_INFO, "ChangePassword request");
1631
1632         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1633                                        hf_samr_hnd, NULL);
1634
1635         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
1636                         hf_samr_unknown_char, NULL);
1637         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1638                         samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE,
1639                         "Hash", -1, 0);
1640         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1641                         samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE,
1642                         "Hash", -1, 0);
1643         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
1644                         hf_samr_unknown_char, NULL);
1645         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1646                         samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE,
1647                         "Hash", -1, 0);
1648         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1649                         samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE,
1650                         "Hash", -1, 0);
1651         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
1652                         hf_samr_unknown_char, NULL);
1653         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1654                         samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE,
1655                         "Hash", -1, 0);
1656         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
1657                         hf_samr_unknown_char, NULL);
1658         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1659                         samr_dissect_CRYPT_HASH, NDR_POINTER_UNIQUE,
1660                         "Hash", -1, 0);
1661
1662         return offset;
1663 }
1664
1665 static int
1666 samr_dissect_change_password_user_reply(tvbuff_t *tvb, int offset,
1667                                         packet_info *pinfo, proto_tree *tree,
1668                                         char *drep)
1669 {
1670         if (check_col(pinfo->cinfo, COL_INFO))
1671                 col_set_str(pinfo->cinfo, COL_INFO, "ChangePassword response");
1672
1673         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1674                                   hf_samr_rc, NULL);
1675
1676         return offset;
1677 }
1678
1679 static int
1680 samr_dissect_set_member_attributes_of_group_rqst(tvbuff_t *tvb, int offset,
1681                                                  packet_info *pinfo,
1682                                                  proto_tree *tree, char *drep)
1683 {
1684         if (check_col(pinfo->cinfo, COL_INFO))
1685                 col_set_str(pinfo->cinfo, COL_INFO, "SetGroupAttr request");
1686
1687         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1688                                        hf_samr_hnd, NULL);
1689
1690         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1691                                      hf_samr_attrib, NULL);
1692         return offset;
1693 }
1694
1695 static int
1696 samr_dissect_set_member_attributes_of_group_reply(tvbuff_t *tvb, int offset,
1697                              packet_info *pinfo, proto_tree *tree,
1698                              char *drep)
1699 {
1700         if (check_col(pinfo->cinfo, COL_INFO))
1701                 col_set_str(pinfo->cinfo, COL_INFO, "SetGroupAttr response");
1702
1703         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1704                                   hf_samr_rc, NULL);
1705
1706         return offset;
1707 }
1708
1709 static int
1710 samr_dissect_GROUP_INFO_1 (tvbuff_t *tvb, int offset,
1711                              packet_info *pinfo, proto_tree *tree,
1712                              char *drep)
1713 {
1714         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo,
1715                 tree, drep,
1716                 hf_samr_acct_name, 0);
1717         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1718                                      hf_samr_rid, NULL);
1719         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1720                                         hf_samr_attrib, NULL);
1721         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo,
1722                 tree, drep,
1723                 hf_samr_acct_desc, 0);
1724         return offset;
1725 }
1726
1727 static int
1728 samr_dissect_GROUP_INFO(tvbuff_t *tvb, int offset,
1729                         packet_info *pinfo, proto_tree *parent_tree,
1730                         char *drep)
1731 {
1732         proto_item *item=NULL;
1733         proto_tree *tree=NULL;
1734         int old_offset=offset;
1735         guint16 level;
1736
1737         if(parent_tree){
1738                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1739                         "GROUP_INFO:");
1740                 tree = proto_item_add_subtree(item, ett_samr_group_info);
1741         }
1742
1743         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1744                                      hf_samr_level, &level);
1745         switch(level){
1746         case 1:
1747                 offset = samr_dissect_GROUP_INFO_1(
1748                                 tvb, offset, pinfo, tree, drep);
1749                 break;
1750         case 2:
1751                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo,
1752                         tree, drep,
1753                         hf_samr_acct_name, 0);
1754                 break;
1755         case 3:
1756                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1757                         hf_samr_attrib, NULL);
1758                 break;
1759         case 4:
1760                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo,
1761                         tree, drep,
1762                         hf_samr_acct_desc, 0);
1763                 break;
1764         }
1765
1766         proto_item_set_len(item, offset-old_offset);
1767         return offset;
1768 }
1769
1770 static int
1771 samr_dissect_GROUP_INFO_ptr(tvbuff_t *tvb, int offset,
1772                         packet_info *pinfo, proto_tree *tree,
1773                         char *drep)
1774 {
1775         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1776                         samr_dissect_GROUP_INFO, NDR_POINTER_UNIQUE,
1777                         "GROUP_INFO", -1, 0);
1778         return offset;
1779 }
1780
1781 static int
1782 samr_dissect_query_information_group_rqst(tvbuff_t *tvb, int offset,
1783                                           packet_info *pinfo,
1784                                           proto_tree *tree, char *drep)
1785 {
1786         if (check_col(pinfo->cinfo, COL_INFO))
1787                 col_set_str(pinfo->cinfo, COL_INFO, "QueryGroupInfo request");
1788
1789         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1790                                        hf_samr_hnd, NULL);
1791
1792         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1793                                      hf_samr_level, NULL);
1794
1795         return offset;
1796 }
1797
1798 static int
1799 samr_dissect_query_information_group_reply(tvbuff_t *tvb, int offset,
1800                         packet_info *pinfo, proto_tree *tree,
1801                         char *drep)
1802 {
1803         if (check_col(pinfo->cinfo, COL_INFO))
1804                 col_set_str(pinfo->cinfo, COL_INFO, "QueryGroupInfo response");
1805
1806         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1807                         samr_dissect_GROUP_INFO_ptr, NDR_POINTER_REF,
1808                         "", -1, 0);
1809
1810         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1811                                   hf_samr_rc, NULL);
1812         return offset;
1813 }
1814
1815 static int
1816 samr_dissect_set_information_group_rqst(tvbuff_t *tvb, int offset,
1817                                         packet_info *pinfo, proto_tree *tree,
1818                                         char *drep)
1819 {
1820         if (check_col(pinfo->cinfo, COL_INFO))
1821                 col_set_str(pinfo->cinfo, COL_INFO, "SetGroupInfo request");
1822
1823         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1824                                        hf_samr_hnd, NULL);
1825
1826         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1827                                      hf_samr_level, NULL);
1828         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1829                         samr_dissect_GROUP_INFO, NDR_POINTER_REF,
1830                         "", -1, 0);
1831         return offset;
1832 }
1833
1834 static int
1835 samr_dissect_set_information_group_reply(tvbuff_t *tvb, int offset,
1836                              packet_info *pinfo, proto_tree *tree,
1837                              char *drep)
1838 {
1839         if (check_col(pinfo->cinfo, COL_INFO))
1840                 col_set_str(pinfo->cinfo, COL_INFO, "SetGroupInfo response");
1841
1842         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1843                                   hf_samr_rc, NULL);
1844
1845         return offset;
1846 }
1847
1848
1849 static int
1850 samr_dissect_get_domain_password_information_rqst(tvbuff_t *tvb, int offset,
1851                                                   packet_info *pinfo,
1852                                                   proto_tree *tree,
1853                                                   char *drep)
1854 {
1855         if (check_col(pinfo->cinfo, COL_INFO))
1856                 col_set_str(pinfo->cinfo, COL_INFO,
1857                             "GetPasswordInfo request");
1858
1859         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1860                                        hf_samr_hnd, NULL);
1861
1862         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1863                         samr_dissect_pointer_STRING, NDR_POINTER_UNIQUE,
1864                         "Domain", hf_samr_domain, 0);
1865         return offset;
1866 }
1867
1868 static int
1869 samr_dissect_get_domain_password_information_reply(tvbuff_t *tvb, int offset,
1870                                                    packet_info *pinfo,
1871                                                    proto_tree *tree,
1872                                                    char *drep)
1873 {
1874         if (check_col(pinfo->cinfo, COL_INFO))
1875                 col_set_str(pinfo->cinfo, COL_INFO,
1876                             "GetPasswordInfo response");
1877
1878         /*
1879          * XXX - really?  Not the same as
1880          * "samr_dissect_get_usrdom_pwinfo_reply()"?
1881          */
1882         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1883                                        hf_samr_hnd, NULL);
1884
1885         return offset;
1886 }
1887
1888 static int
1889 samr_dissect_DOMAIN_INFO_1(tvbuff_t *tvb, int offset,
1890                              packet_info *pinfo, proto_tree *parent_tree,
1891                              char *drep)
1892 {
1893         proto_item *item=NULL;
1894         proto_tree *tree=NULL;
1895         int old_offset=offset;
1896
1897         ALIGN_TO_4_BYTES;  /* strcture starts with short, but is aligned for longs */
1898
1899         if(parent_tree){
1900                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1901                         "DOMAIN_INFO_1:");
1902                 tree = proto_item_add_subtree(item, ett_samr_domain_info_1);
1903         }
1904
1905         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1906                                         hf_samr_min_pwd_len, NULL);
1907         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1908                                         hf_samr_pwd_history_len, NULL);
1909         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1910                                         hf_samr_unknown_long, NULL);
1911         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1912                                         hf_samr_max_pwd_age);
1913         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1914                                         hf_samr_min_pwd_age);
1915         proto_item_set_len(item, offset-old_offset);
1916         return offset;
1917 }
1918
1919 static int
1920 samr_dissect_DOMAIN_INFO_2(tvbuff_t *tvb, int offset,
1921                         packet_info *pinfo, proto_tree *parent_tree,
1922                         char *drep)
1923 {
1924         proto_item *item=NULL;
1925         proto_tree *tree=NULL;
1926         int old_offset=offset;
1927
1928         if(parent_tree){
1929                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1930                         "DOMAIN_INFO_2:");
1931                 tree = proto_item_add_subtree(item, ett_samr_domain_info_2);
1932         }
1933
1934         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1935                         hf_samr_unknown_time);
1936         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1937                         hf_samr_unknown_string, 0);
1938         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1939                         hf_samr_domain, 0);
1940         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1941                         hf_samr_controller, 0);
1942         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1943                         hf_samr_unknown_time);
1944         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1945                         hf_samr_unknown_long, NULL);
1946         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1947                         hf_samr_unknown_long, NULL);
1948         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
1949                         hf_samr_unknown_char, NULL);
1950         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1951                         hf_samr_num_users, NULL);
1952         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1953                         hf_samr_num_groups, NULL);
1954         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1955                         hf_samr_num_aliases, NULL);
1956
1957         proto_item_set_len(item, offset-old_offset);
1958         return offset;
1959 }
1960
1961 static int
1962 samr_dissect_DOMAIN_INFO_8(tvbuff_t *tvb, int offset,
1963                              packet_info *pinfo, proto_tree *parent_tree,
1964                              char *drep)
1965 {
1966         proto_item *item=NULL;
1967         proto_tree *tree=NULL;
1968         int old_offset=offset;
1969
1970         if(parent_tree){
1971                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1972                         "DOMAIN_INFO_8:");
1973                 tree = proto_item_add_subtree(item, ett_samr_domain_info_8);
1974         }
1975
1976         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1977                                         hf_samr_max_pwd_age);
1978         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1979                                         hf_samr_min_pwd_age);
1980
1981         proto_item_set_len(item, offset-old_offset);
1982         return offset;
1983 }
1984
1985 static int
1986 samr_dissect_REPLICATION_STATUS(tvbuff_t *tvb, int offset,
1987                         packet_info *pinfo, proto_tree *parent_tree,
1988                         char *drep)
1989 {
1990         proto_item *item=NULL;
1991         proto_tree *tree=NULL;
1992         int old_offset=offset;
1993
1994         if(parent_tree){
1995                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1996                         "REPLICATION_STATUS:");
1997                 tree = proto_item_add_subtree(item, ett_samr_replication_status);
1998         }
1999
2000         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
2001                         hf_samr_unknown_hyper, NULL);
2002         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
2003                         hf_samr_unknown_hyper, NULL);
2004         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2005                         hf_samr_unknown_short, NULL);
2006
2007         proto_item_set_len(item, offset-old_offset);
2008         return offset;
2009 }
2010
2011 static int
2012 samr_dissect_DOMAIN_INFO_11(tvbuff_t *tvb, int offset,
2013                              packet_info *pinfo, proto_tree *parent_tree,
2014                              char *drep)
2015 {
2016         proto_item *item=NULL;
2017         proto_tree *tree=NULL;
2018         int old_offset=offset;
2019
2020         if(parent_tree){
2021                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2022                         "DOMAIN_INFO_11:");
2023                 tree = proto_item_add_subtree(item, ett_samr_domain_info_11);
2024         }
2025
2026         offset = samr_dissect_DOMAIN_INFO_2(
2027                         tvb, offset, pinfo, tree, drep);
2028         offset = samr_dissect_REPLICATION_STATUS(
2029                         tvb, offset, pinfo, tree, drep);
2030
2031         proto_item_set_len(item, offset-old_offset);
2032         return offset;
2033 }
2034
2035 static int
2036 samr_dissect_DOMAIN_INFO_13(tvbuff_t *tvb, int offset,
2037                              packet_info *pinfo, proto_tree *parent_tree,
2038                              char *drep)
2039 {
2040         proto_item *item=NULL;
2041         proto_tree *tree=NULL;
2042         int old_offset=offset;
2043
2044         if(parent_tree){
2045                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2046                         "DOMAIN_INFO_13:");
2047                 tree = proto_item_add_subtree(item, ett_samr_domain_info_13);
2048         }
2049
2050         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2051                                         hf_samr_unknown_time);
2052         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2053                                         hf_samr_unknown_time);
2054         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2055                                         hf_samr_unknown_time);
2056
2057         proto_item_set_len(item, offset-old_offset);
2058         return offset;
2059 }
2060
2061
2062 static int
2063 samr_dissect_DOMAIN_INFO(tvbuff_t *tvb, int offset,
2064                         packet_info *pinfo, proto_tree *parent_tree,
2065                         char *drep)
2066 {
2067         proto_item *item=NULL;
2068         proto_tree *tree=NULL;
2069         int old_offset=offset;
2070         guint16 level;
2071
2072         if(parent_tree){
2073                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2074                         "DOMAIN_INFO:");
2075                 tree = proto_item_add_subtree(item, ett_samr_domain_info);
2076         }
2077
2078         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2079                                      hf_samr_level, &level);
2080
2081         ALIGN_TO_4_BYTES;  /* all union arms aligned to 4 bytes, case 7 and 9 need this  */
2082         switch(level){
2083         case 1:
2084                 offset = samr_dissect_DOMAIN_INFO_1(
2085                                 tvb, offset, pinfo, tree, drep);
2086                 break;
2087         case 2:
2088                 offset = samr_dissect_DOMAIN_INFO_2(
2089                                 tvb, offset, pinfo, tree, drep);
2090                 break;
2091
2092         case 3:
2093                 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2094                                 hf_samr_unknown_time);
2095                 break;
2096         case 4:
2097                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo,
2098                         tree, drep, hf_samr_unknown_string, 0);
2099                 break;
2100
2101         case 5:
2102                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo,
2103                         tree, drep, hf_samr_domain, 0);
2104                 break;
2105
2106         case 6:
2107                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo,
2108                         tree, drep, hf_samr_controller, 0);
2109                 break;
2110
2111         case 7:
2112                 offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2113                         hf_samr_unknown_short, NULL);
2114                 break;
2115         case 8:
2116                 offset = samr_dissect_DOMAIN_INFO_8(
2117                                 tvb, offset, pinfo, tree, drep);
2118                 break;
2119         case 9:
2120                 offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2121                         hf_samr_unknown_short, NULL);
2122                 break;
2123         case 11:
2124                 offset = samr_dissect_DOMAIN_INFO_11(
2125                                 tvb, offset, pinfo, tree, drep);
2126                 break;
2127         case 12:
2128                 offset = samr_dissect_REPLICATION_STATUS(
2129                                 tvb, offset, pinfo, tree, drep);
2130                 break;
2131         case 13:
2132                 offset = samr_dissect_DOMAIN_INFO_13(
2133                                 tvb, offset, pinfo, tree, drep);
2134                 break;
2135         }
2136
2137         proto_item_set_len(item, offset-old_offset);
2138         return offset;
2139 }
2140
2141 static int
2142 samr_dissect_DOMAIN_INFO_ptr(tvbuff_t *tvb, int offset,
2143                         packet_info *pinfo, proto_tree *tree,
2144                         char *drep)
2145 {
2146         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2147                         samr_dissect_DOMAIN_INFO, NDR_POINTER_UNIQUE,
2148                         "DOMAIN_INFO pointer", hf_samr_domain, 0);
2149         return offset;
2150 }
2151
2152 static int
2153 samr_dissect_set_information_domain_rqst(tvbuff_t *tvb, int offset,
2154                                          packet_info *pinfo, proto_tree *tree,
2155                                          char *drep)
2156 {
2157         if (check_col(pinfo->cinfo, COL_INFO))
2158                 col_set_str(pinfo->cinfo, COL_INFO, "SetDomainInfo request");
2159
2160         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2161                                        hf_samr_hnd, NULL);
2162
2163         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2164                                      hf_samr_level, NULL);
2165         offset = samr_dissect_DOMAIN_INFO(tvb, offset, pinfo, tree, drep);
2166
2167         return offset;
2168 }
2169
2170 static int
2171 samr_dissect_set_information_domain_reply(tvbuff_t *tvb, int offset,
2172                                           packet_info *pinfo,
2173                                           proto_tree *tree, char *drep)
2174 {
2175         if (check_col(pinfo->cinfo, COL_INFO))
2176                 col_set_str(pinfo->cinfo, COL_INFO, "SetDomainInfo response");
2177
2178         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
2179                                   hf_samr_rc, NULL);
2180
2181         return offset;
2182 }
2183
2184 static int
2185 samr_dissect_lookup_domain_rqst(tvbuff_t *tvb, int offset,
2186                                 packet_info *pinfo, proto_tree *tree,
2187                                 char *drep)
2188 {
2189         if (check_col(pinfo->cinfo, COL_INFO))
2190                 col_set_str(pinfo->cinfo, COL_INFO, "QueryDomainInfo request");
2191
2192         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2193                                        hf_samr_hnd, NULL);
2194
2195         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2196                         samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF,
2197                         "", hf_samr_domain, 0);
2198
2199         return offset;
2200 }
2201
2202 static int
2203 samr_dissect_lookup_domain_reply(tvbuff_t *tvb, int offset,
2204                              packet_info *pinfo, proto_tree *tree,
2205                              char *drep)
2206 {
2207         if (check_col(pinfo->cinfo, COL_INFO))
2208                 col_set_str(pinfo->cinfo, COL_INFO, "QueryDomainInfo reponse");
2209
2210         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2211                         dissect_ndr_nt_SID_ptr, NDR_POINTER_REF,
2212                         "", -1, 0);
2213
2214         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
2215                                   hf_samr_rc, NULL);
2216         return offset;
2217 }
2218
2219 int
2220 dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset,
2221                              packet_info *pinfo, proto_tree *parent_tree,
2222                              char *drep)
2223 {
2224         proto_item *item=NULL;
2225         proto_tree *tree=NULL;
2226         int old_offset=offset;
2227
2228         if(parent_tree){
2229                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2230                         "SID pointer:");
2231                 tree = proto_item_add_subtree(item, ett_samr_sid_pointer);
2232         }
2233
2234         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2235                         dissect_ndr_nt_SID, NDR_POINTER_UNIQUE,
2236                         "SID", -1, 0);
2237
2238         proto_item_set_len(item, offset-old_offset);
2239         return offset;
2240 }
2241
2242
2243 static int
2244 dissect_ndr_nt_PSID_ARRAY_sids (tvbuff_t *tvb, int offset,
2245                              packet_info *pinfo, proto_tree *tree,
2246                              char *drep)
2247 {
2248         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2249                         dissect_ndr_nt_PSID);
2250
2251         return offset;
2252 }
2253
2254
2255 int
2256 dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset,
2257                         packet_info *pinfo, proto_tree *parent_tree,
2258                         char *drep)
2259 {
2260         guint32 count;
2261         proto_item *item=NULL;
2262         proto_tree *tree=NULL;
2263         int old_offset=offset;
2264
2265         if(parent_tree){
2266                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2267                         "SID array:");
2268                 tree = proto_item_add_subtree(item, ett_samr_sid_array);
2269         }
2270
2271         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2272                         hf_samr_count, &count);
2273         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2274                         dissect_ndr_nt_PSID_ARRAY_sids, NDR_POINTER_UNIQUE,
2275                         "PSID_ARRAY", -1, 0);
2276
2277         proto_item_set_len(item, offset-old_offset);
2278         return offset;
2279 }
2280
2281 /* called from NETLOGON but placed here since where are where the hf_fields are defined */
2282 int
2283 dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
2284                         packet_info *pinfo, proto_tree *parent_tree,
2285                         char *drep)
2286 {
2287         proto_item *item=NULL;
2288         proto_tree *tree=NULL;
2289
2290         if(parent_tree){
2291                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2292                         "SID_AND_ATTRIBUTES:");
2293                 tree = proto_item_add_subtree(item, ett_samr_sid_and_attributes);
2294         }
2295
2296         offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
2297
2298         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2299                                      hf_samr_attrib, NULL);
2300
2301         return offset;
2302 }
2303
2304 int
2305 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
2306                         packet_info *pinfo, proto_tree *parent_tree,
2307                         char *drep)
2308 {
2309         guint32 count;
2310         proto_item *item=NULL;
2311         proto_tree *tree=NULL;
2312         int old_offset=offset;
2313
2314         if(parent_tree){
2315                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2316                         "SID_AND_ATTRIBUTES array:");
2317                 tree = proto_item_add_subtree(item, ett_samr_sid_and_attributes_array);
2318         }
2319
2320         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2321                         hf_samr_count, &count);
2322         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2323                         dissect_ndr_nt_SID_AND_ATTRIBUTES);
2324
2325         proto_item_set_len(item, offset-old_offset);
2326         return offset;
2327 }
2328
2329
2330 static int
2331 samr_dissect_index(tvbuff_t *tvb, int offset,
2332                              packet_info *pinfo, proto_tree *tree,
2333                              char *drep)
2334 {
2335         dcerpc_info *di;
2336
2337         di=pinfo->private_data;
2338
2339         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2340                         di->hf_index, NULL);
2341
2342         return offset;
2343 }
2344
2345
2346 static int
2347 samr_dissect_INDEX_ARRAY_value (tvbuff_t *tvb, int offset,
2348                              packet_info *pinfo, proto_tree *tree,
2349                              char *drep)
2350 {
2351         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2352                         samr_dissect_index);
2353
2354         return offset;
2355 }
2356
2357 static char *
2358 plural_ending(const char *string)
2359 {
2360         size_t string_len;
2361
2362         string_len = strlen(string);
2363         if (string_len > 0 && string[string_len - 1] == 's') {
2364                 /* String ends with "s" - pluralize by adding "es" */
2365                 return "es";
2366         } else {
2367                 /* Field name doesn't end with "s" - pluralize by adding "s" */
2368                 return "s";
2369         }
2370 }
2371
2372 static int
2373 samr_dissect_INDEX_ARRAY(tvbuff_t *tvb, int offset,
2374                         packet_info *pinfo, proto_tree *parent_tree,
2375                         char *drep)
2376 {
2377         char *field_name;
2378         guint32 count;
2379         proto_item *item=NULL;
2380         proto_tree *tree=NULL;
2381         int old_offset=offset;
2382         dcerpc_info *di;
2383         char str[256];
2384
2385         di=pinfo->private_data;
2386
2387         field_name = proto_registrar_get_name(di->hf_index);
2388         snprintf(str, 255, "INDEX_ARRAY: %s%s:", field_name,
2389             plural_ending(field_name));
2390         if(parent_tree){
2391                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2392                         "%s", str);
2393                 tree = proto_item_add_subtree(item, ett_samr_index_array);
2394         }
2395
2396         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2397                         hf_samr_count, &count);
2398         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2399                         samr_dissect_INDEX_ARRAY_value, NDR_POINTER_UNIQUE,
2400                         str, di->hf_index, 0);
2401
2402         proto_item_set_len(item, offset-old_offset);
2403         return offset;
2404 }
2405
2406 static int
2407 samr_dissect_get_alias_membership_rqst(tvbuff_t *tvb, int offset,
2408                                        packet_info *pinfo, proto_tree *tree,
2409                                        char *drep)
2410 {
2411         if (check_col(pinfo->cinfo, COL_INFO))
2412                 col_set_str(pinfo->cinfo, COL_INFO, "GetAliasMem request");
2413
2414         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2415                                        hf_samr_hnd, NULL);
2416
2417         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2418                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
2419                         "", -1, 0);
2420
2421         return offset;
2422 }
2423
2424 static int
2425 samr_dissect_get_alias_membership_response(tvbuff_t *tvb, int offset,
2426                                            packet_info *pinfo,
2427                                            proto_tree *tree, char *drep)
2428 {
2429         if (check_col(pinfo->cinfo, COL_INFO))
2430                 col_set_str(pinfo->cinfo, COL_INFO, "GetAliasMem response");
2431
2432         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
2433                                   hf_samr_rc, NULL);
2434
2435         return offset;
2436 }
2437
2438 static int
2439 samr_dissect_get_alias_membership_reply(tvbuff_t *tvb, int offset,
2440                              packet_info *pinfo, proto_tree *tree,
2441                              char *drep)
2442 {
2443         if (check_col(pinfo->cinfo, COL_INFO))
2444                 col_set_str(pinfo->cinfo, COL_INFO, "GetAliasMem response");
2445
2446         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2447                         samr_dissect_INDEX_ARRAY, NDR_POINTER_REF,
2448                         "", hf_samr_alias, 0);
2449
2450         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2451                         hf_samr_rc, NULL);
2452
2453         return offset;
2454 }
2455
2456 static int
2457 samr_dissect_IDX_AND_NAME(tvbuff_t *tvb, int offset,
2458                              packet_info *pinfo, proto_tree *parent_tree,
2459                              char *drep)
2460 {
2461         proto_item *item=NULL;
2462         proto_tree *tree=NULL;
2463         int old_offset=offset;
2464         char str[256];
2465         dcerpc_info *di;
2466
2467         di=pinfo->private_data;
2468
2469         snprintf(str, 255, "IDX_AND_NAME: %s:",proto_registrar_get_name(di->hf_index));
2470         if(parent_tree){
2471                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2472                                 "%s",str);
2473                 tree = proto_item_add_subtree(item, ett_samr_idx_and_name);
2474         }
2475
2476         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2477                         hf_samr_index, NULL);
2478         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo,
2479                         tree, drep, di->hf_index, 4);
2480
2481         proto_item_set_len(item, offset-old_offset);
2482         return offset;
2483 }
2484
2485 static int
2486 samr_dissect_IDX_AND_NAME_entry (tvbuff_t *tvb, int offset,
2487                              packet_info *pinfo, proto_tree *tree,
2488                              char *drep)
2489 {
2490         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2491                         samr_dissect_IDX_AND_NAME);
2492
2493         return offset;
2494 }
2495
2496
2497 static int
2498 samr_dissect_IDX_AND_NAME_ARRAY(tvbuff_t *tvb, int offset,
2499                         packet_info *pinfo, proto_tree *parent_tree,
2500                         char *drep)
2501 {
2502         char *field_name;
2503         guint32 count;
2504         proto_item *item=NULL;
2505         proto_tree *tree=NULL;
2506         int old_offset=offset;
2507         dcerpc_info *di;
2508         char str[256];
2509
2510         di=pinfo->private_data;
2511
2512         field_name = proto_registrar_get_name(di->hf_index);
2513
2514         if(parent_tree){
2515                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2516                         "IDX_AND_NAME_ARRAY: %s%s:", field_name,
2517                         plural_ending(field_name));
2518                 tree = proto_item_add_subtree(item, ett_samr_idx_and_name_array);
2519         }
2520
2521
2522         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2523                         hf_samr_count, &count);
2524         snprintf(str, 255, "IDX_AND_NAME pointer: %s%s:", field_name,
2525             plural_ending(field_name));
2526         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2527                         samr_dissect_IDX_AND_NAME_entry, NDR_POINTER_UNIQUE,
2528                         str, di->hf_index, 0);
2529
2530         proto_item_set_len(item, offset-old_offset);
2531         return offset;
2532 }
2533
2534 static int
2535 samr_dissect_IDX_AND_NAME_ARRAY_ptr(tvbuff_t *tvb, int offset,
2536                         packet_info *pinfo, proto_tree *tree,
2537                         char *drep)
2538 {
2539         char *field_name;
2540         char str[256];
2541         dcerpc_info *di;
2542
2543         di=pinfo->private_data;
2544
2545         field_name = proto_registrar_get_name(di->hf_index);
2546         snprintf(str, 255, "IDX_AND_NAME_ARRAY pointer: %s%s:", field_name,
2547             plural_ending(field_name));
2548         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2549                         samr_dissect_IDX_AND_NAME_ARRAY, NDR_POINTER_UNIQUE,
2550                         str, di->hf_index, 0);
2551         return offset;
2552 }
2553
2554 static int
2555 samr_dissect_enum_domains_rqst(tvbuff_t *tvb, int offset,
2556                                packet_info *pinfo, proto_tree *tree,
2557                                char *drep)
2558 {
2559         if (check_col(pinfo->cinfo, COL_INFO))
2560                 col_set_str(pinfo->cinfo, COL_INFO, "EnumDomains request");
2561
2562         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2563                                        hf_samr_hnd, NULL);
2564
2565         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2566                         samr_dissect_pointer_long, NDR_POINTER_REF,
2567                         "", hf_samr_resume_hnd, 0);
2568
2569         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2570                         hf_samr_pref_maxsize, NULL);
2571
2572         return offset;
2573 }
2574
2575 static int
2576 samr_dissect_enum_domains_reply(tvbuff_t *tvb, int offset,
2577                              packet_info *pinfo, proto_tree *tree,
2578                              char *drep)
2579 {
2580         if (check_col(pinfo->cinfo, COL_INFO))
2581                 col_set_str(pinfo->cinfo, COL_INFO, "EnumDomains response");
2582
2583         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2584                         samr_dissect_pointer_long, NDR_POINTER_REF,
2585                         "", hf_samr_resume_hnd, 0);
2586         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2587                         samr_dissect_IDX_AND_NAME_ARRAY_ptr, NDR_POINTER_REF,
2588                         "", hf_samr_domain, 0);
2589         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2590                         samr_dissect_pointer_long, NDR_POINTER_REF,
2591                         "", hf_samr_entries, 0);
2592
2593         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
2594                                   hf_samr_rc, NULL);
2595
2596         return offset;
2597 }
2598
2599 static int
2600 samr_dissect_enum_dom_groups_rqst(tvbuff_t *tvb, int offset,
2601                                   packet_info *pinfo, proto_tree *tree,
2602                                   char *drep)
2603 {
2604         if (check_col(pinfo->cinfo, COL_INFO))
2605                 col_set_str(pinfo->cinfo, COL_INFO, "EnumDomGroups request");
2606
2607         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2608                                        hf_samr_hnd, NULL);
2609
2610         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2611                         samr_dissect_pointer_long, NDR_POINTER_REF,
2612                         "", hf_samr_resume_hnd, 0);
2613         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2614                         hf_samr_mask, NULL);
2615         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2616                         hf_samr_pref_maxsize, NULL);
2617
2618         return offset;
2619 }
2620
2621 static int
2622 samr_dissect_enum_dom_groups_reply(tvbuff_t *tvb, int offset,
2623                              packet_info *pinfo, proto_tree *tree,
2624                              char *drep)
2625 {
2626         if (check_col(pinfo->cinfo, COL_INFO))
2627                 col_set_str(pinfo->cinfo, COL_INFO, "EnumDomGroups response");
2628
2629         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2630                         samr_dissect_pointer_long, NDR_POINTER_REF,
2631                         "", hf_samr_resume_hnd, 0);
2632         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2633                         samr_dissect_IDX_AND_NAME_ARRAY_ptr, NDR_POINTER_REF,
2634                         "", hf_samr_group_name, 0);
2635         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2636                         samr_dissect_pointer_long, NDR_POINTER_REF,
2637                         "", hf_samr_entries, 0);
2638
2639         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
2640                                   hf_samr_rc, NULL);
2641
2642         return offset;
2643 }
2644
2645 static int
2646 samr_dissect_enum_dom_aliases_rqst(tvbuff_t *tvb, int offset,
2647                                  packet_info *pinfo, proto_tree *tree,
2648                                  char *drep)
2649 {
2650         if (check_col(pinfo->cinfo, COL_INFO))
2651                 col_set_str(pinfo->cinfo, COL_INFO, "EnumDomAliases request");
2652
2653         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2654                                        hf_samr_hnd, NULL);
2655
2656         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2657                         samr_dissect_pointer_long, NDR_POINTER_REF,
2658                         "", hf_samr_resume_hnd, 0);
2659
2660         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2661                         hf_samr_mask, NULL);
2662
2663         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2664                         hf_samr_pref_maxsize, NULL);
2665
2666         return offset;
2667 }
2668
2669 static int
2670 samr_dissect_enum_dom_aliases_reply(tvbuff_t *tvb, int offset,
2671                              packet_info *pinfo, proto_tree *tree,
2672                              char *drep)
2673 {
2674         if (check_col(pinfo->cinfo, COL_INFO))
2675                 col_set_str(pinfo->cinfo, COL_INFO, "EnumDomAliases response");
2676
2677         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2678                         samr_dissect_pointer_long, NDR_POINTER_REF,
2679                         "", hf_samr_resume_hnd, 0);
2680
2681         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2682                         samr_dissect_IDX_AND_NAME_ARRAY_ptr, NDR_POINTER_REF,
2683                         "", hf_samr_alias_name, 0);
2684
2685         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2686                         samr_dissect_pointer_long, NDR_POINTER_REF,
2687                         "", hf_samr_entries, 0);
2688
2689         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
2690                                   hf_samr_rc, NULL);
2691
2692         return offset;
2693 }
2694
2695 static int
2696 samr_dissect_get_members_in_alias_rqst(tvbuff_t *tvb, int offset,
2697                                        packet_info *pinfo, proto_tree *tree,
2698                                        char *drep)
2699 {
2700         if (check_col(pinfo->cinfo, COL_INFO))
2701                 col_set_str(pinfo->cinfo, COL_INFO, "GetAliasMem request");
2702
2703         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2704                                        hf_samr_hnd, NULL);
2705
2706         return offset;
2707 }
2708
2709 static int
2710 samr_dissect_get_members_in_alias_reply(tvbuff_t *tvb, int offset,
2711                         packet_info *pinfo, proto_tree *tree,
2712                         char *drep)
2713 {
2714         if (check_col(pinfo->cinfo, COL_INFO))
2715                 col_set_str(pinfo->cinfo, COL_INFO, "GetAliasMem response");
2716
2717         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2718                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
2719                         "", -1, 0);
2720
2721         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
2722                                   hf_samr_rc, NULL);
2723
2724         return offset;
2725 }
2726
2727 static int
2728 samr_dissect_LOGON_HOURS_entry(tvbuff_t *tvb, int offset,
2729                              packet_info *pinfo, proto_tree *tree,
2730                              char *drep)
2731 {
2732         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2733                         hf_samr_unknown_char, NULL);
2734         return offset;
2735 }
2736
2737 static int
2738 samr_dissect_LOGON_HOURS_hours(tvbuff_t *tvb, int offset,
2739                              packet_info *pinfo, proto_tree *parent_tree,
2740                              char *drep)
2741 {
2742         proto_item *item=NULL;
2743         proto_tree *tree=NULL;
2744         int old_offset=offset;
2745
2746         if(parent_tree){
2747                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2748                         "LOGON_HOURS:");
2749                 tree = proto_item_add_subtree(item, ett_samr_logon_hours_hours);
2750         }
2751
2752         offset = dissect_ndr_ucvarray(tvb, offset, pinfo, tree, drep,
2753                         samr_dissect_LOGON_HOURS_entry);
2754
2755         proto_item_set_len(item, offset-old_offset);
2756         return offset;
2757
2758         return offset;
2759 }
2760
2761 int
2762 dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset,
2763                         packet_info *pinfo, proto_tree *parent_tree,
2764                         char *drep)
2765 {
2766         proto_item *item=NULL;
2767         proto_tree *tree=NULL;
2768         int old_offset=offset;
2769
2770         ALIGN_TO_4_BYTES;  /* strcture starts with short, but is aligned for longs */
2771
2772         if(parent_tree){
2773                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2774                         "LOGON_HOURS:");
2775                 tree = proto_item_add_subtree(item, ett_samr_logon_hours);
2776         }
2777
2778         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2779                                 hf_samr_divisions, NULL);
2780         /* XXX - is this a bitmask like the "logon hours" field in the
2781            Remote API call "NetUserGetInfo()" with an information level
2782            of 11? */
2783         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2784                         samr_dissect_LOGON_HOURS_hours, NDR_POINTER_UNIQUE,
2785                         "LOGON_HOURS", -1, 0);
2786
2787         proto_item_set_len(item, offset-old_offset);
2788         return offset;
2789 }
2790
2791
2792 static int
2793 samr_dissect_USER_INFO_1(tvbuff_t *tvb, int offset,
2794                         packet_info *pinfo, proto_tree *parent_tree,
2795                         char *drep)
2796 {
2797         proto_item *item=NULL;
2798         proto_tree *tree=NULL;
2799         int old_offset=offset;
2800
2801         if(parent_tree){
2802                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2803                         "USER_INFO_1:");
2804                 tree = proto_item_add_subtree(item, ett_samr_user_info_1);
2805         }
2806
2807         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2808                                 hf_samr_acct_name, 0);
2809         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2810                                 hf_samr_full_name, 0);
2811         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
2812         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2813                                 hf_samr_home, 0);
2814         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2815                                 hf_samr_script, 0);
2816
2817         proto_item_set_len(item, offset-old_offset);
2818         return offset;
2819 }
2820
2821 static int
2822 samr_dissect_USER_INFO_2(tvbuff_t *tvb, int offset,
2823                         packet_info *pinfo, proto_tree *parent_tree,
2824                         char *drep)
2825 {
2826         proto_item *item=NULL;
2827         proto_tree *tree=NULL;
2828         int old_offset=offset;
2829
2830         if(parent_tree){
2831                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2832                         "USER_INFO_2:");
2833                 tree = proto_item_add_subtree(item, ett_samr_user_info_2);
2834         }
2835
2836         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2837                                 hf_samr_acct_name, 0);
2838         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2839                                 hf_samr_full_name, 0);
2840         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2841                                 hf_samr_bad_pwd_count, NULL);
2842         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2843                                 hf_samr_logon_count, NULL);
2844
2845         proto_item_set_len(item, offset-old_offset);
2846         return offset;
2847 }
2848
2849 static int
2850 samr_dissect_USER_INFO_3(tvbuff_t *tvb, int offset,
2851                         packet_info *pinfo, proto_tree *parent_tree,
2852                         char *drep)
2853 {
2854         proto_item *item=NULL;
2855         proto_tree *tree=NULL;
2856         int old_offset=offset;
2857
2858         if(parent_tree){
2859                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2860                         "USER_INFO_3:");
2861                 tree = proto_item_add_subtree(item, ett_samr_user_info_3);
2862         }
2863
2864         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2865                                 hf_samr_acct_name, 0);
2866         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2867                                 hf_samr_full_name, 0);
2868         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2869                                 hf_samr_rid, NULL);
2870         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2871                                 hf_samr_group, NULL);
2872         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2873                                 hf_samr_home, 0);
2874         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2875                                 hf_samr_home_drive, 0);
2876         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2877                                 hf_samr_script, 0);
2878         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2879                                 hf_samr_acct_desc, 0);
2880         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2881                                 hf_samr_workstations, 0);
2882         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2883                                 hf_samr_logon_time);
2884         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2885                                 hf_samr_logoff_time);
2886         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2887                                 hf_samr_pwd_last_set_time);
2888         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2889                                 hf_samr_pwd_can_change_time);
2890         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2891                                 hf_samr_pwd_must_change_time);
2892         offset = dissect_ndr_nt_LOGON_HOURS(tvb, offset, pinfo, tree, drep);
2893         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2894                                 hf_samr_logon_count, NULL);
2895         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2896                                 hf_samr_bad_pwd_count, NULL);
2897         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
2898
2899         proto_item_set_len(item, offset-old_offset);
2900         return offset;
2901 }
2902
2903 static int
2904 samr_dissect_USER_INFO_5(tvbuff_t *tvb, int offset,
2905                         packet_info *pinfo, proto_tree *parent_tree,
2906                         char *drep)
2907 {
2908         proto_item *item=NULL;
2909         proto_tree *tree=NULL;
2910         int old_offset=offset;
2911
2912         if(parent_tree){
2913                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2914                         "USER_INFO_5:");
2915                 tree = proto_item_add_subtree(item, ett_samr_user_info_5);
2916         }
2917
2918         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2919                                 hf_samr_acct_name, 0);
2920         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2921                                 hf_samr_full_name, 0);
2922         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2923                                 hf_samr_rid, NULL);
2924         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2925                                 hf_samr_group, NULL);
2926         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2927                                 hf_samr_country, NULL);
2928         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2929                                 hf_samr_codepage, NULL);
2930         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2931                                 hf_samr_home, 0);
2932         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2933                                 hf_samr_home_drive, 0);
2934         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2935                                 hf_samr_script, 0);
2936         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2937                                 hf_samr_acct_desc, 0);
2938         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2939                                 hf_samr_workstations, 0);
2940         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2941                                 hf_samr_logon_time);
2942         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2943                                 hf_samr_logoff_time);
2944         offset = dissect_ndr_nt_LOGON_HOURS(tvb, offset, pinfo, tree, drep);
2945         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2946                                 hf_samr_bad_pwd_count, NULL);
2947         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2948                                 hf_samr_logon_count, NULL);
2949         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2950                                 hf_samr_pwd_last_set_time);
2951         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2952                                 hf_samr_acct_expiry_time);
2953         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
2954
2955         proto_item_set_len(item, offset-old_offset);
2956         return offset;
2957 }
2958
2959 static int
2960 samr_dissect_USER_INFO_6(tvbuff_t *tvb, int offset,
2961                         packet_info *pinfo, proto_tree *parent_tree,
2962                         char *drep)
2963 {
2964         proto_item *item=NULL;
2965         proto_tree *tree=NULL;
2966         int old_offset=offset;
2967
2968         if(parent_tree){
2969                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2970                         "USER_INFO_6:");
2971                 tree = proto_item_add_subtree(item, ett_samr_user_info_6);
2972         }
2973
2974         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2975                                 hf_samr_acct_name, 0);
2976         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2977                                 hf_samr_full_name, 0);
2978
2979         proto_item_set_len(item, offset-old_offset);
2980         return offset;
2981 }
2982
2983 static int
2984 samr_dissect_USER_INFO_18(tvbuff_t *tvb, int offset,
2985                         packet_info *pinfo, proto_tree *parent_tree,
2986                         char *drep)
2987 {
2988         proto_item *item=NULL;
2989         proto_tree *tree=NULL;
2990         int old_offset=offset;
2991
2992         if(parent_tree){
2993                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2994                         "USER_INFO_18:");
2995                 tree = proto_item_add_subtree(item, ett_samr_user_info_18);
2996         }
2997
2998         offset = samr_dissect_CRYPT_HASH(tvb, offset, pinfo, tree, drep);
2999         offset = samr_dissect_CRYPT_HASH(tvb, offset, pinfo, tree, drep);
3000         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
3001                         hf_samr_unknown_char, NULL);
3002         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
3003                         hf_samr_unknown_char, NULL);
3004         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
3005                         hf_samr_unknown_char, NULL);
3006
3007         proto_item_set_len(item, offset-old_offset);
3008         return offset;
3009 }
3010
3011 static int
3012 samr_dissect_USER_INFO_19(tvbuff_t *tvb, int offset,
3013                         packet_info *pinfo, proto_tree *parent_tree,
3014                         char *drep)
3015 {
3016         proto_item *item=NULL;
3017         proto_tree *tree=NULL;
3018         int old_offset=offset;
3019
3020         if(parent_tree){
3021                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3022                         "USER_INFO_19:");
3023                 tree = proto_item_add_subtree(item, ett_samr_user_info_19);
3024         }
3025
3026         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
3027         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
3028                                 hf_samr_logon_time);
3029         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
3030                                 hf_samr_logoff_time);
3031         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3032                                 hf_samr_bad_pwd_count, NULL);
3033         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3034                                 hf_samr_logon_count, NULL);
3035
3036         proto_item_set_len(item, offset-old_offset);
3037         return offset;
3038 }
3039
3040 static int
3041 samr_dissect_BUFFER_entry(tvbuff_t *tvb, int offset,
3042                              packet_info *pinfo, proto_tree *tree,
3043                              char *drep)
3044 {
3045         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
3046                         hf_samr_unknown_char, NULL);
3047         return offset;
3048 }
3049
3050
3051 static int
3052 samr_dissect_BUFFER_buffer(tvbuff_t *tvb, int offset,
3053                              packet_info *pinfo, proto_tree *parent_tree,
3054                              char *drep)
3055 {
3056         proto_item *item=NULL;
3057         proto_tree *tree=NULL;
3058         int old_offset=offset;
3059
3060         if(parent_tree){
3061                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3062                         "BUFFER:");
3063                 tree = proto_item_add_subtree(item, ett_samr_buffer_buffer);
3064         }
3065
3066         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3067                         samr_dissect_BUFFER_entry);
3068
3069         proto_item_set_len(item, offset-old_offset);
3070         return offset;
3071
3072         return offset;
3073 }
3074
3075 static int
3076 samr_dissect_BUFFER(tvbuff_t *tvb, int offset,
3077                         packet_info *pinfo, proto_tree *parent_tree,
3078                         char *drep)
3079 {
3080         proto_item *item=NULL;
3081         proto_tree *tree=NULL;
3082         int old_offset=offset;
3083
3084         if(parent_tree){
3085                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3086                         "BUFFER:");
3087                 tree = proto_item_add_subtree(item, ett_samr_buffer);
3088         }
3089         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3090                                 hf_samr_count, NULL);
3091         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3092                         samr_dissect_BUFFER_buffer, NDR_POINTER_UNIQUE,
3093                         "BUFFER", -1, 0);
3094
3095         proto_item_set_len(item, offset-old_offset);
3096         return offset;
3097 }
3098
3099 static int
3100 samr_dissect_BUFFER_ptr(tvbuff_t *tvb, int offset,
3101                         packet_info *pinfo, proto_tree *tree,
3102                         char *drep)
3103 {
3104         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3105                         samr_dissect_BUFFER, NDR_POINTER_UNIQUE,
3106                         "BUFFER", -1, 0);
3107         return offset;
3108 }
3109
3110 static int
3111 samr_dissect_USER_INFO_21(tvbuff_t *tvb, int offset,
3112                         packet_info *pinfo, proto_tree *parent_tree,
3113                         char *drep)
3114 {
3115         proto_item *item=NULL;
3116         proto_tree *tree=NULL;
3117         int old_offset=offset;
3118
3119         if(parent_tree){
3120                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3121                         "USER_INFO_21:");
3122                 tree = proto_item_add_subtree(item, ett_samr_user_info_21);
3123         }
3124
3125         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
3126                                 hf_samr_logon_time);
3127         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
3128                                 hf_samr_logoff_time);
3129         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
3130                                 hf_samr_kickoff_time);
3131         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
3132                                 hf_samr_pwd_last_set_time);
3133         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
3134                                 hf_samr_pwd_can_change_time);
3135         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
3136                                 hf_samr_pwd_must_change_time);
3137         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3138                                 hf_samr_acct_name, 2);
3139         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3140                                 hf_samr_full_name, 0);
3141         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3142                                 hf_samr_home, 0);
3143         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3144                                 hf_samr_home_drive, 0);
3145         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3146                                 hf_samr_script, 0);
3147         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3148                                 hf_samr_profile, 0);
3149         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3150                                 hf_samr_acct_desc, 0);
3151         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3152                                 hf_samr_workstations, 0);
3153         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3154                                 hf_samr_comment, 0);
3155         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3156                                 hf_samr_parameters, 0);
3157         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3158                                 hf_samr_unknown_string, 0);
3159         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3160                                 hf_samr_unknown_string, 0);
3161         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3162                                 hf_samr_unknown_string, 0);
3163         offset = samr_dissect_BUFFER(tvb, offset, pinfo, tree, drep);
3164         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3165                                 hf_samr_rid, NULL);
3166         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3167                                 hf_samr_group, NULL);
3168         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
3169         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3170                                 hf_samr_unknown_long, NULL);
3171         offset = dissect_ndr_nt_LOGON_HOURS(tvb, offset, pinfo, tree, drep);
3172         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3173                                 hf_samr_bad_pwd_count, NULL);
3174         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3175                                 hf_samr_logon_count, NULL);
3176         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3177                                 hf_samr_country, NULL);
3178         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3179                                 hf_samr_codepage, NULL);
3180         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
3181                                 hf_samr_nt_pwd_set, NULL);
3182         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
3183                                 hf_samr_lm_pwd_set, NULL);
3184         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
3185                                 hf_samr_pwd_expired, NULL);
3186         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
3187                                 hf_samr_unknown_char, NULL);
3188
3189         proto_item_set_len(item, offset-old_offset);
3190         return offset;
3191 }
3192
3193 static int
3194 samr_dissect_USER_INFO_22(tvbuff_t *tvb, int offset,
3195                         packet_info *pinfo, proto_tree *parent_tree,
3196                         char *drep)
3197 {
3198         proto_item *item=NULL;
3199         proto_tree *tree=NULL;
3200         int old_offset=offset;
3201
3202         if(parent_tree){
3203                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3204                         "USER_INFO_22:");
3205                 tree = proto_item_add_subtree(item, ett_samr_user_info_22);
3206         }
3207
3208         offset = samr_dissect_USER_INFO_21(tvb, offset, pinfo, tree, drep);
3209         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
3210                         hf_samr_revision, NULL);
3211
3212         proto_item_set_len(item, offset-old_offset);
3213         return offset;
3214 }
3215
3216 static int
3217 samr_dissect_USER_INFO_23(tvbuff_t *tvb, int offset,
3218                         packet_info *pinfo, proto_tree *parent_tree,
3219                         char *drep)
3220 {
3221         proto_item *item=NULL;
3222         proto_tree *tree=NULL;
3223         int old_offset=offset;
3224
3225         if(parent_tree){
3226                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3227                         "USER_INFO_23:");
3228                 tree = proto_item_add_subtree(item, ett_samr_user_info_23);
3229         }
3230
3231         offset = samr_dissect_USER_INFO_21(tvb, offset, pinfo, tree, drep);
3232         offset = samr_dissect_CRYPT_PASSWORD(tvb, offset, pinfo, tree, drep);
3233
3234         proto_item_set_len(item, offset-old_offset);
3235         return offset;
3236 }
3237
3238 static int
3239 samr_dissect_USER_INFO_24(tvbuff_t *tvb, int offset,
3240                         packet_info *pinfo, proto_tree *parent_tree,
3241                         char *drep)
3242 {
3243         proto_item *item=NULL;
3244         proto_tree *tree=NULL;
3245         int old_offset=offset;
3246
3247         if(parent_tree){
3248                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3249                         "USER_INFO_24:");
3250                 tree = proto_item_add_subtree(item, ett_samr_user_info_24);
3251         }
3252
3253         offset = samr_dissect_CRYPT_PASSWORD(tvb, offset, pinfo, tree, drep);
3254         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
3255                                 hf_samr_unknown_char, NULL);
3256
3257         proto_item_set_len(item, offset-old_offset);
3258         return offset;
3259 }
3260
3261 static int
3262 samr_dissect_USER_INFO (tvbuff_t *tvb, int offset,
3263                              packet_info *pinfo, proto_tree *parent_tree,
3264                              char *drep)
3265 {
3266         proto_item *item=NULL;
3267         proto_tree *tree=NULL;
3268         int old_offset=offset;
3269         guint16 level;
3270
3271         if(parent_tree){
3272                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3273                         "USER_INFO:");
3274                 tree = proto_item_add_subtree(item, ett_samr_user_info);
3275         }
3276         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3277                                      hf_samr_level, &level);
3278
3279         switch(level){
3280         case 1:
3281                 offset = samr_dissect_USER_INFO_1(
3282                                 tvb, offset, pinfo, tree, drep);
3283                 break;
3284         case 2:
3285                 offset = samr_dissect_USER_INFO_2(
3286                                 tvb, offset, pinfo, tree, drep);
3287                 break;
3288         case 3:
3289                 offset = samr_dissect_USER_INFO_3(
3290                                 tvb, offset, pinfo, tree, drep);
3291                 break;
3292         case 4:
3293                 offset = dissect_ndr_nt_LOGON_HOURS(
3294                                 tvb, offset, pinfo, tree, drep);
3295                 break;
3296         case 5:
3297                 offset = samr_dissect_USER_INFO_5(
3298                                 tvb, offset, pinfo, tree, drep);
3299                 break;
3300         case 6:
3301                 offset = samr_dissect_USER_INFO_6(
3302                                 tvb, offset, pinfo, tree, drep);
3303                 break;
3304         case 7:
3305                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3306                                 hf_samr_full_name, 0);
3307                 break;
3308         case 8:
3309                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3310                                 hf_samr_acct_desc, 0);
3311                 break;
3312         case 9:
3313                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3314                                              hf_samr_unknown_long, NULL);
3315                 break;
3316         case 10:
3317                 offset = samr_dissect_USER_INFO_6(
3318                                 tvb, offset, pinfo, tree, drep);
3319                 break;
3320         case 11:
3321                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3322                                 hf_samr_home, 0);
3323                 break;
3324         case 12:
3325                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3326                                 hf_samr_home_drive, 0);
3327                 break;
3328         case 13:
3329                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3330                                 hf_samr_script, 0);
3331                 break;
3332         case 14:
3333                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3334                                 hf_samr_workstations, 0);
3335                 break;
3336         case 16:
3337                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3338                                              hf_samr_unknown_long, NULL);
3339                 break;
3340         case 17:
3341                 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
3342                                         hf_samr_unknown_time);
3343                 break;
3344         case 18:
3345                 offset = samr_dissect_USER_INFO_18(
3346                                 tvb, offset, pinfo, tree, drep);
3347                 break;
3348         case 19:
3349                 offset = samr_dissect_USER_INFO_19(
3350                                 tvb, offset, pinfo, tree, drep);
3351                 break;
3352         case 20:
3353                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3354                                 hf_samr_profile, 0);
3355                 break;
3356         case 21:
3357                 offset = samr_dissect_USER_INFO_21(
3358                                 tvb, offset, pinfo, tree, drep);
3359                 break;
3360         case 22:
3361                 offset = samr_dissect_USER_INFO_22(
3362                                 tvb, offset, pinfo, tree, drep);
3363                 break;
3364         case 23:
3365                 offset = samr_dissect_USER_INFO_23(
3366                                 tvb, offset, pinfo, tree, drep);
3367                 break;
3368         case 24:
3369                 offset = samr_dissect_USER_INFO_24(
3370                                 tvb, offset, pinfo, tree, drep);
3371                 break;
3372         }
3373
3374         proto_item_set_len(item, offset-old_offset);
3375         return offset;
3376 }
3377
3378 static int
3379 samr_dissect_USER_INFO_ptr(tvbuff_t *tvb, int offset,
3380                         packet_info *pinfo, proto_tree *tree,
3381                         char *drep)
3382 {
3383         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3384                         samr_dissect_USER_INFO, NDR_POINTER_UNIQUE,
3385                         "USER_INFO pointer", -1, 0);
3386         return offset;
3387 }
3388
3389 static int
3390 samr_dissect_set_information_user2_rqst(tvbuff_t *tvb, int offset,
3391                                         packet_info *pinfo, proto_tree *tree,
3392                                         char *drep)
3393 {
3394         if (check_col(pinfo->cinfo, COL_INFO))
3395                 col_set_str(pinfo->cinfo, COL_INFO, "SetUserInfo request");
3396
3397         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3398                                        hf_samr_hnd, NULL);
3399
3400         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3401                         hf_samr_level, NULL);
3402
3403         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3404                         samr_dissect_USER_INFO, NDR_POINTER_REF,
3405                         "", -1, 0);
3406
3407         return offset;
3408 }
3409
3410 static int
3411 samr_dissect_set_information_user2_reply(tvbuff_t *tvb, int offset,
3412                                          packet_info *pinfo, proto_tree *tree,
3413                                          char *drep)
3414 {
3415         if (check_col(pinfo->cinfo, COL_INFO))
3416                 col_set_str(pinfo->cinfo, COL_INFO, "SetUserInfo response");
3417
3418         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3419                                   hf_samr_rc, NULL);
3420
3421         return offset;
3422 }
3423
3424 static int
3425 samr_dissect_unknown_2f_rqst(tvbuff_t *tvb, int offset,
3426                                  packet_info *pinfo, proto_tree *tree,
3427                                  char *drep)
3428 {
3429         if (check_col(pinfo->cinfo, COL_INFO))
3430                 col_set_str(pinfo->cinfo, COL_INFO, "Unknown 0x2f request");
3431
3432         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3433                                        hf_samr_hnd, NULL);
3434
3435         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3436                         hf_samr_level, NULL);
3437
3438         return offset;
3439 }
3440
3441 static int
3442 samr_dissect_unknown_2f_reply(tvbuff_t *tvb, int offset,
3443                         packet_info *pinfo, proto_tree *tree,
3444                         char *drep)
3445 {
3446         if (check_col(pinfo->cinfo, COL_INFO))
3447                 col_set_str(pinfo->cinfo, COL_INFO, "Unknown 0x2f response");
3448
3449         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3450                         samr_dissect_USER_INFO_ptr, NDR_POINTER_REF,
3451                         "", -1, 0);
3452
3453         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3454                         hf_samr_rc, NULL);
3455
3456         return offset;
3457 }
3458
3459 static int
3460 samr_dissect_MEMBER_ARRAY_type(tvbuff_t *tvb, int offset,
3461                         packet_info *pinfo, proto_tree *tree,
3462                         char *drep)
3463 {
3464         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3465                                 hf_samr_type, NULL);
3466
3467         return offset;
3468 }
3469
3470
3471 static int
3472 samr_dissect_MEMBER_ARRAY_types(tvbuff_t *tvb, int offset,
3473                         packet_info *pinfo, proto_tree *parent_tree,
3474                         char *drep)
3475 {
3476         proto_item *item=NULL;
3477         proto_tree *tree=NULL;
3478         int old_offset=offset;
3479
3480         if(parent_tree){
3481                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3482                         "MEMBER_ARRAY_types:");
3483                 tree = proto_item_add_subtree(item, ett_samr_member_array_types);
3484         }
3485
3486         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3487                         samr_dissect_MEMBER_ARRAY_type);
3488
3489         proto_item_set_len(item, offset-old_offset);
3490         return offset;
3491
3492         return offset;
3493 }
3494
3495 static int
3496 samr_dissect_MEMBER_ARRAY_rid(tvbuff_t *tvb, int offset,
3497                         packet_info *pinfo, proto_tree *tree,
3498                         char *drep)
3499 {
3500         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3501                                 hf_samr_rid, NULL);
3502
3503         return offset;
3504 }
3505
3506
3507 static int
3508 samr_dissect_MEMBER_ARRAY_rids(tvbuff_t *tvb, int offset,
3509                         packet_info *pinfo, proto_tree *parent_tree,
3510                         char *drep)
3511 {
3512         proto_item *item=NULL;
3513         proto_tree *tree=NULL;
3514         int old_offset=offset;
3515
3516         if(parent_tree){
3517                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3518                         "MEMBER_ARRAY_rids:");
3519                 tree = proto_item_add_subtree(item, ett_samr_member_array_rids);
3520         }
3521
3522         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3523                         samr_dissect_MEMBER_ARRAY_rid);
3524
3525         proto_item_set_len(item, offset-old_offset);
3526         return offset;
3527
3528         return offset;
3529 }
3530
3531 static int
3532 samr_dissect_MEMBER_ARRAY(tvbuff_t *tvb, int offset,
3533                         packet_info *pinfo, proto_tree *parent_tree,
3534                         char *drep)
3535 {
3536         guint32 count;
3537         proto_item *item=NULL;
3538         proto_tree *tree=NULL;
3539         int old_offset=offset;
3540
3541         if(parent_tree){
3542                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3543                         "MEMBER_ARRAY:");
3544                 tree = proto_item_add_subtree(item, ett_samr_member_array);
3545         }
3546
3547         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3548                         hf_samr_count, &count);
3549         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3550                         samr_dissect_MEMBER_ARRAY_rids, NDR_POINTER_UNIQUE,
3551                         "RIDs", -1, 0);
3552         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3553                         samr_dissect_MEMBER_ARRAY_types, NDR_POINTER_UNIQUE,
3554                         "Types", -1, 0);
3555
3556         proto_item_set_len(item, offset-old_offset);
3557         return offset;
3558 }
3559
3560 static int
3561 samr_dissect_MEMBER_ARRAY_ptr(tvbuff_t *tvb, int offset,
3562                         packet_info *pinfo, proto_tree *tree,
3563                         char *drep)
3564 {
3565         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3566                         samr_dissect_MEMBER_ARRAY, NDR_POINTER_UNIQUE,
3567                         "MEMBER_ARRAY", -1, 0);
3568         return offset;
3569 }
3570
3571 static int
3572 samr_dissect_query_groupmem_rqst(tvbuff_t *tvb, int offset,
3573                                  packet_info *pinfo, proto_tree *tree,
3574                                  char *drep)
3575 {
3576         if (check_col(pinfo->cinfo, COL_INFO))
3577                 col_set_str(pinfo->cinfo, COL_INFO, "QueryGroupMem request");
3578
3579         offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
3580                                       hf_samr_hnd, NULL);
3581         return offset;
3582 }
3583
3584 static int
3585 samr_dissect_query_groupmem_reply(tvbuff_t *tvb, int offset,
3586                         packet_info *pinfo, proto_tree *tree,
3587                         char *drep)
3588 {
3589         if (check_col(pinfo->cinfo, COL_INFO))
3590                 col_set_str(pinfo->cinfo, COL_INFO, "QueryGroupMem response");
3591
3592         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3593                         samr_dissect_MEMBER_ARRAY_ptr, NDR_POINTER_REF,
3594                         "", -1, 0);
3595
3596         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3597                                   hf_samr_rc, NULL);
3598
3599         return offset;
3600 }
3601
3602 static int
3603 samr_dissect_set_sec_object_rqst(tvbuff_t *tvb, int offset,
3604                                  packet_info *pinfo, proto_tree *tree,
3605                                  char *drep)
3606 {
3607         if (check_col(pinfo->cinfo, COL_INFO))
3608                 col_set_str(pinfo->cinfo, COL_INFO, "SetSecObject request");
3609
3610         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3611                                        hf_samr_hnd, NULL);
3612
3613         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3614                         hf_samr_info_type, NULL);
3615
3616         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3617                         samr_dissect_BUFFER, NDR_POINTER_REF,
3618                         "", -1, 0);
3619
3620         return offset;
3621 }
3622
3623 static int
3624 samr_dissect_set_sec_object_reply(tvbuff_t *tvb, int offset,
3625                                   packet_info *pinfo, proto_tree *tree,
3626                                   char *drep)
3627 {
3628         if (check_col(pinfo->cinfo, COL_INFO))
3629                 col_set_str(pinfo->cinfo, COL_INFO, "SetSecObject response");
3630
3631         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3632                                   hf_samr_rc, NULL);
3633
3634         return offset;
3635 }
3636
3637 static int
3638 samr_dissect_query_sec_object_rqst(tvbuff_t *tvb, int offset,
3639                                    packet_info *pinfo, proto_tree *tree,
3640                                    char *drep)
3641 {
3642         if (check_col(pinfo->cinfo, COL_INFO))
3643                 col_set_str(pinfo->cinfo, COL_INFO, "QuerySecObject request");
3644
3645         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3646                                        hf_samr_hnd, NULL);
3647
3648         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3649                         hf_samr_info_type, NULL);
3650
3651         return offset;
3652 }
3653
3654 static int
3655 samr_dissect_query_sec_object_reply(tvbuff_t *tvb, int offset,
3656                         packet_info *pinfo, proto_tree *tree,
3657                         char *drep)
3658 {
3659         if (check_col(pinfo->cinfo, COL_INFO))
3660                 col_set_str(pinfo->cinfo, COL_INFO, "QuerySecObject response");
3661
3662         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3663                         samr_dissect_BUFFER_ptr, NDR_POINTER_REF,
3664                         "", -1, 0);
3665
3666         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3667                                   hf_samr_rc, NULL);
3668
3669         return offset;
3670 }
3671
3672 static int
3673 samr_dissect_LOOKUP_NAMES_name(tvbuff_t *tvb, int offset,
3674                         packet_info *pinfo, proto_tree *tree,
3675                         char *drep)
3676 {
3677         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3678                                 hf_samr_acct_name, 1);
3679         return offset;
3680 }
3681
3682 static int
3683 samr_dissect_LOOKUP_NAMES(tvbuff_t *tvb, int offset,
3684                         packet_info *pinfo, proto_tree *parent_tree,
3685                         char *drep)
3686 {
3687         proto_item *item=NULL;
3688         proto_tree *tree=NULL;
3689         int old_offset=offset;
3690
3691         if(parent_tree){
3692                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3693                         "NAMES:");
3694                 tree = proto_item_add_subtree(item, ett_samr_names);
3695         }
3696
3697         offset = dissect_ndr_ucvarray(tvb, offset, pinfo, tree, drep,
3698                         samr_dissect_LOOKUP_NAMES_name);
3699
3700         proto_item_set_len(item, offset-old_offset);
3701         return offset;
3702 }
3703
3704
3705 static int
3706 samr_dissect_lookup_names_rqst(tvbuff_t *tvb, int offset,
3707                                packet_info *pinfo, proto_tree *tree,
3708                                char *drep)
3709 {
3710         if (check_col(pinfo->cinfo, COL_INFO))
3711                 col_set_str(pinfo->cinfo, COL_INFO, "LookupNames request");
3712
3713         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3714                                        hf_samr_hnd, NULL);
3715
3716         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3717                         hf_samr_count, NULL);
3718
3719         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3720                         samr_dissect_LOOKUP_NAMES, NDR_POINTER_REF,
3721                         "", -1, 0);
3722
3723         return offset;
3724 }
3725
3726 static int
3727 samr_dissect_lookup_names_reply(tvbuff_t *tvb, int offset,
3728                         packet_info *pinfo, proto_tree *tree,
3729                         char *drep)
3730 {
3731         if (check_col(pinfo->cinfo, COL_INFO))
3732                 col_set_str(pinfo->cinfo, COL_INFO, "LookupNames response");
3733
3734         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3735                         samr_dissect_INDEX_ARRAY, NDR_POINTER_REF,
3736                         "", hf_samr_rid, 0);
3737         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3738                         samr_dissect_INDEX_ARRAY, NDR_POINTER_REF,
3739                         "", hf_samr_type, 0);
3740
3741         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3742                                   hf_samr_rc, NULL);
3743
3744         return offset;
3745 }
3746
3747 static int
3748 samr_dissect_LOOKUP_RIDS_rid(tvbuff_t *tvb, int offset,
3749                         packet_info *pinfo, proto_tree *tree,
3750                         char *drep)
3751 {
3752         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3753                                 hf_samr_rid, NULL);
3754
3755         return offset;
3756 }
3757
3758 static int
3759 samr_dissect_LOOKUP_RIDS(tvbuff_t *tvb, int offset,
3760                         packet_info *pinfo, proto_tree *parent_tree,
3761                         char *drep)
3762 {
3763         proto_item *item=NULL;
3764         proto_tree *tree=NULL;
3765         int old_offset=offset;
3766
3767         if(parent_tree){
3768                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3769                         "RIDS:");
3770                 tree = proto_item_add_subtree(item, ett_samr_rids);
3771         }
3772
3773         offset = dissect_ndr_ucvarray(tvb, offset, pinfo, tree, drep,
3774                         samr_dissect_LOOKUP_RIDS_rid);
3775
3776         proto_item_set_len(item, offset-old_offset);
3777         return offset;
3778 }
3779
3780
3781 static int
3782 samr_dissect_lookup_rids_rqst(tvbuff_t *tvb, int offset,
3783                               packet_info *pinfo, proto_tree *tree,
3784                               char *drep)
3785 {
3786         if (check_col(pinfo->cinfo, COL_INFO))
3787                 col_set_str(pinfo->cinfo, COL_INFO, "LookupRids request");
3788
3789         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3790                                        hf_samr_hnd, NULL);
3791
3792         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3793                         hf_samr_count, NULL);
3794
3795         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3796                         samr_dissect_LOOKUP_RIDS, NDR_POINTER_REF,
3797                         "", -1, 0);
3798
3799         return offset;
3800 }
3801
3802 static int
3803 samr_dissect_UNICODE_STRING_ARRAY_name(tvbuff_t *tvb, int offset,
3804                         packet_info *pinfo, proto_tree *tree,
3805                         char *drep)
3806 {
3807         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3808                                 hf_samr_acct_name, 0);
3809         return offset;
3810 }
3811
3812 static int
3813 samr_dissect_UNICODE_STRING_ARRAY_names(tvbuff_t *tvb, int offset,
3814                         packet_info *pinfo, proto_tree *tree,
3815                         char *drep)
3816 {
3817         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3818                         samr_dissect_UNICODE_STRING_ARRAY_name);
3819         return offset;
3820 }
3821
3822 static int
3823 samr_dissect_UNICODE_STRING_ARRAY(tvbuff_t *tvb, int offset,
3824                         packet_info *pinfo, proto_tree *parent_tree,
3825                         char *drep)
3826 {
3827         proto_item *item=NULL;
3828         proto_tree *tree=NULL;
3829         int old_offset=offset;
3830
3831         if(parent_tree){
3832                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3833                         "NAMES:");
3834                 tree = proto_item_add_subtree(item, ett_samr_names);
3835         }
3836
3837         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3838                         hf_samr_count, NULL);
3839
3840         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3841                         samr_dissect_UNICODE_STRING_ARRAY_names, NDR_POINTER_UNIQUE,
3842                         "Strings", -1, 0);
3843
3844         proto_item_set_len(item, offset-old_offset);
3845         return offset;
3846
3847         return offset;
3848 }
3849
3850
3851 static int
3852 samr_dissect_lookup_rids_reply(tvbuff_t *tvb, int offset,
3853                         packet_info *pinfo, proto_tree *tree,
3854                         char *drep)
3855 {
3856         if (check_col(pinfo->cinfo, COL_INFO))
3857                 col_set_str(pinfo->cinfo, COL_INFO, "LookupRids response");
3858
3859         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3860                         samr_dissect_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
3861                         "", hf_samr_rid, 0);
3862         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3863                         samr_dissect_INDEX_ARRAY, NDR_POINTER_REF,
3864                         "", hf_samr_type, 0);
3865
3866         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3867                                   hf_samr_rc, NULL);
3868
3869         return offset;
3870 }
3871
3872 static int
3873 samr_dissect_close_hnd_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo,
3874                             proto_tree *tree, char *drep)
3875 {
3876         if (check_col(pinfo->cinfo, COL_INFO))
3877                 col_set_str(pinfo->cinfo, COL_INFO, "Close request");
3878
3879         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3880                                        hf_samr_hnd, NULL);
3881
3882         return offset;
3883 }
3884
3885 static int
3886 samr_dissect_close_hnd_reply(tvbuff_t *tvb, int offset, packet_info *pinfo,
3887                              proto_tree *tree, char *drep)
3888 {
3889         if (check_col(pinfo->cinfo, COL_INFO))
3890                 col_set_str(pinfo->cinfo, COL_INFO, "Close response");
3891
3892         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3893                                        hf_samr_hnd, NULL);
3894
3895         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3896                         hf_samr_rc, NULL);
3897
3898         return offset;
3899 }
3900
3901 static int
3902 samr_dissect_shutdown_sam_server_rqst(tvbuff_t *tvb, int offset,
3903                                       packet_info *pinfo, proto_tree *tree,
3904                                       char *drep)
3905 {
3906         if (check_col(pinfo->cinfo, COL_INFO))
3907                 col_set_str(pinfo->cinfo, COL_INFO, "SamShutdown request");
3908
3909         offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
3910                                       hf_samr_hnd, NULL);
3911
3912         return offset;
3913 }
3914
3915 static int
3916 samr_dissect_shutdown_sam_server_reply(tvbuff_t *tvb, int offset,
3917                                       packet_info *pinfo, proto_tree *tree,
3918                                       char *drep)
3919 {
3920         if (check_col(pinfo->cinfo, COL_INFO))
3921                 col_set_str(pinfo->cinfo, COL_INFO, "SamShutdown response");
3922
3923         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3924                                   hf_samr_rc, NULL);
3925
3926         return offset;
3927 }
3928
3929 static int
3930 samr_dissect_delete_dom_group_rqst(tvbuff_t *tvb, int offset,
3931                                    packet_info *pinfo, proto_tree *tree,
3932                                    char *drep)
3933 {
3934         if (check_col(pinfo->cinfo, COL_INFO))
3935                 col_set_str(pinfo->cinfo, COL_INFO, "DeleteGroup request");
3936
3937         offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
3938                                       hf_samr_hnd, NULL);
3939
3940         return offset;
3941 }
3942
3943 static int
3944 samr_dissect_delete_dom_group_reply(tvbuff_t *tvb, int offset,
3945                                     packet_info *pinfo, proto_tree *tree,
3946                                     char *drep)
3947 {
3948         if (check_col(pinfo->cinfo, COL_INFO))
3949                 col_set_str(pinfo->cinfo, COL_INFO, "DeleteGroup response");
3950
3951         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3952                                   hf_samr_rc, NULL);
3953
3954         return offset;
3955 }
3956
3957 static int
3958 samr_dissect_remove_member_from_group_rqst(tvbuff_t *tvb, int offset,
3959                                            packet_info *pinfo,
3960                                            proto_tree *tree, char *drep)
3961 {
3962         if (check_col(pinfo->cinfo, COL_INFO))
3963                 col_set_str(pinfo->cinfo, COL_INFO, "DeleteGroupMem request");
3964
3965         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3966                                        hf_samr_hnd, NULL);
3967
3968         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3969                                      hf_samr_group, NULL);
3970
3971         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3972                                      hf_samr_rid, NULL);
3973
3974         return offset;
3975 }
3976
3977 static int
3978 samr_dissect_remove_member_from_group_reply(tvbuff_t *tvb, int offset,
3979                                             packet_info *pinfo,
3980                                             proto_tree *tree, char *drep)
3981 {
3982         if (check_col(pinfo->cinfo, COL_INFO))
3983                 col_set_str(pinfo->cinfo, COL_INFO, "DeleteGroupMem response");
3984
3985         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3986                                   hf_samr_rc, NULL);
3987
3988         return offset;
3989 }
3990
3991 static int
3992 samr_dissect_delete_dom_alias_rqst(tvbuff_t *tvb, int offset,
3993                                    packet_info *pinfo, proto_tree *tree,
3994                                    char *drep)
3995 {
3996         if (check_col(pinfo->cinfo, COL_INFO))
3997                 col_set_str(pinfo->cinfo, COL_INFO, "DeleteAlias request");
3998
3999         offset = dissect_ndr_ctx_hnd (tvb, offset, pinfo, tree, drep,
4000                                       hf_samr_hnd, NULL);
4001
4002         return offset;
4003 }
4004
4005 static int
4006 samr_dissect_delete_dom_alias_reply(tvbuff_t *tvb, int offset,
4007                                     packet_info *pinfo, proto_tree *tree,
4008                                     char *drep)
4009 {
4010         if (check_col(pinfo->cinfo, COL_INFO))
4011                 col_set_str(pinfo->cinfo, COL_INFO, "DeleteAlias response");
4012
4013         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4014                                   hf_samr_rc, NULL);
4015
4016         return offset;
4017 }
4018
4019 static int
4020 samr_dissect_add_alias_member_rqst(tvbuff_t *tvb, int offset,
4021                                    packet_info *pinfo, proto_tree *tree,
4022                                    char *drep)
4023 {
4024         if (check_col(pinfo->cinfo, COL_INFO))
4025                 col_set_str(pinfo->cinfo, COL_INFO, "AddAliasMem request");
4026
4027         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4028                                        hf_samr_hnd, NULL);
4029
4030         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4031                         dissect_ndr_nt_SID, NDR_POINTER_REF,
4032                         "SID", -1, 0);
4033         return offset;
4034 }
4035
4036 static int
4037 samr_dissect_add_alias_member_reply(tvbuff_t *tvb, int offset,
4038                                     packet_info *pinfo, proto_tree *tree,
4039                                     char *drep)
4040 {
4041         if (check_col(pinfo->cinfo, COL_INFO))
4042                 col_set_str(pinfo->cinfo, COL_INFO, "AddAliasMem response");
4043
4044         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4045                                   hf_samr_rc, NULL);
4046
4047         return offset;
4048 }
4049
4050 static int
4051 samr_dissect_remove_alias_member_rqst(tvbuff_t *tvb, int offset,
4052                                       packet_info *pinfo, proto_tree *tree,
4053                                       char *drep)
4054 {
4055         if (check_col(pinfo->cinfo, COL_INFO))
4056                 col_set_str(pinfo->cinfo, COL_INFO, "RemoveAliasMem request");
4057
4058         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4059                                        hf_samr_hnd, NULL);
4060
4061         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4062                         dissect_ndr_nt_SID, NDR_POINTER_REF,
4063                         "SID", -1, 0);
4064         return offset;
4065 }
4066
4067 static int
4068 samr_dissect_remove_alias_member_reply(tvbuff_t *tvb, int offset,
4069                                        packet_info *pinfo, proto_tree *tree,
4070                                        char *drep)
4071 {
4072         if (check_col(pinfo->cinfo, COL_INFO))
4073                 col_set_str(pinfo->cinfo, COL_INFO, "RemoveAliasMem response");
4074
4075         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4076                                   hf_samr_rc, NULL);
4077
4078         return offset;
4079 }
4080
4081 static int
4082 samr_dissect_delete_dom_user_rqst(tvbuff_t *tvb, int offset,
4083                                   packet_info *pinfo, proto_tree *tree,
4084                                   char *drep)
4085 {
4086         if (check_col(pinfo->cinfo, COL_INFO))
4087                 col_set_str(pinfo->cinfo, COL_INFO, "DeleteDomUser request");
4088
4089         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4090                                        hf_samr_hnd, NULL);
4091
4092         return offset;
4093 }
4094
4095 static int
4096 samr_dissect_delete_dom_user_reply(tvbuff_t *tvb, int offset,
4097                                    packet_info *pinfo, proto_tree *tree,
4098                                    char *drep)
4099 {
4100         if (check_col(pinfo->cinfo, COL_INFO))
4101                 col_set_str(pinfo->cinfo, COL_INFO, "DeleteDomUser response");
4102
4103         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4104                                   hf_samr_rc, NULL);
4105
4106         return offset;
4107 }
4108
4109 static int
4110 samr_dissect_test_private_fns_domain_rqst(tvbuff_t *tvb, int offset,
4111                                           packet_info *pinfo, proto_tree *tree,
4112                                           char *drep)
4113 {
4114         if (check_col(pinfo->cinfo, COL_INFO))
4115                 col_set_str(pinfo->cinfo, COL_INFO,
4116                             "TestPrivateFnsDomain request");
4117
4118         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4119                                        hf_samr_hnd, NULL);
4120
4121         return offset;
4122 }
4123
4124 static int
4125 samr_dissect_test_private_fns_domain_reply(tvbuff_t *tvb, int offset,
4126                                            packet_info *pinfo,
4127                                            proto_tree *tree, char *drep)
4128 {
4129         if (check_col(pinfo->cinfo, COL_INFO))
4130                 col_set_str(pinfo->cinfo, COL_INFO,
4131                             "TestPrivateFnsDomain response");
4132
4133         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4134                                   hf_samr_rc, NULL);
4135
4136         return offset;
4137 }
4138
4139 static int
4140 samr_dissect_test_private_fns_user_rqst(tvbuff_t *tvb, int offset,
4141                                         packet_info *pinfo, proto_tree *tree,
4142                                         char *drep)
4143 {
4144         if (check_col(pinfo->cinfo, COL_INFO))
4145                 col_set_str(pinfo->cinfo, COL_INFO,
4146                             "TestPrivateFnsUser request");
4147
4148         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4149                                        hf_samr_hnd, NULL);
4150
4151         return offset;
4152 }
4153
4154 static int
4155 samr_dissect_test_private_fns_user_reply(tvbuff_t *tvb, int offset,
4156                                          packet_info *pinfo,
4157                                          proto_tree *tree, char *drep)
4158 {
4159         if (check_col(pinfo->cinfo, COL_INFO))
4160                 col_set_str(pinfo->cinfo, COL_INFO,
4161                             "TestPrivateFnsUser response");
4162
4163         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4164                                   hf_samr_rc, NULL);
4165
4166         return offset;
4167 }
4168
4169 static int
4170 samr_dissect_remove_member_from_foreign_domain_rqst(tvbuff_t *tvb, int offset,
4171                                                     packet_info *pinfo,
4172                                                     proto_tree *tree,
4173                                                     char *drep)
4174 {
4175         if (check_col(pinfo->cinfo, COL_INFO))
4176                 col_set_str(pinfo->cinfo, COL_INFO,
4177                             "RemoveForeignMember request");
4178
4179         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4180                                        hf_samr_hnd, NULL);
4181
4182         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4183                         dissect_ndr_nt_SID, NDR_POINTER_REF,
4184                         "SID", -1, 0);
4185         return offset;
4186 }
4187
4188 static int
4189 samr_dissect_remove_member_from_foreign_domain_reply(tvbuff_t *tvb, int offset,
4190                                                      packet_info *pinfo,
4191                                                      proto_tree *tree,
4192                                                      char *drep)
4193 {
4194         if (check_col(pinfo->cinfo, COL_INFO))
4195                 col_set_str(pinfo->cinfo, COL_INFO,
4196                             "RemoveForeignMember response");
4197
4198         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4199                                   hf_samr_rc, NULL);
4200
4201         return offset;
4202 }
4203
4204 static int
4205 samr_dissect_remove_multiple_members_from_alias_rqst(tvbuff_t *tvb,
4206                                                      int offset,
4207                                                      packet_info *pinfo,
4208                                                      proto_tree *tree,
4209                                                      char *drep)
4210 {
4211         if (check_col(pinfo->cinfo, COL_INFO))
4212                 col_set_str(pinfo->cinfo, COL_INFO,
4213                             "RemoveMultipleMembersFromAlias request");
4214
4215         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4216                                        hf_samr_hnd, NULL);
4217
4218         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4219                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
4220                         "", -1, 0);
4221
4222         return offset;
4223 }
4224
4225 static int
4226 samr_dissect_remove_multiple_members_from_alias_reply(tvbuff_t *tvb,
4227                                                       int offset,
4228                                                       packet_info *pinfo,
4229                                                       proto_tree *tree,
4230                                                       char *drep)
4231 {
4232         if (check_col(pinfo->cinfo, COL_INFO))
4233                 col_set_str(pinfo->cinfo, COL_INFO,
4234                             "RemoveMultipleMembersFromAlias response");
4235
4236         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4237                                   hf_samr_rc, NULL);
4238
4239         return offset;
4240 }
4241
4242 static int
4243 samr_dissect_open_group_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo,
4244                             proto_tree *tree, char *drep)
4245 {
4246         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
4247         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
4248         guint32 rid;
4249
4250         if (check_col(pinfo->cinfo, COL_INFO))
4251                 col_set_str(pinfo->cinfo, COL_INFO, "OpenGroup request");
4252
4253         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4254                                        hf_samr_hnd, NULL);
4255
4256         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
4257                         hf_samr_access, NULL);
4258
4259         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
4260                         hf_samr_rid, &rid);
4261
4262         if (check_col(pinfo->cinfo, COL_INFO))
4263                 col_append_fstr(pinfo->cinfo, COL_INFO, ", rid 0x%x", rid);
4264
4265         dcv->private_data = (void *)rid;
4266
4267         return offset;
4268 }
4269
4270 static int
4271 samr_dissect_open_group_reply(tvbuff_t *tvb, int offset,
4272                               packet_info *pinfo, proto_tree *tree,
4273                               char *drep)
4274 {
4275         if (check_col(pinfo->cinfo, COL_INFO))
4276                 col_set_str(pinfo->cinfo, COL_INFO, "OpenGroup response");
4277
4278         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4279                                        hf_samr_hnd, NULL);
4280
4281         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4282                         hf_samr_rc, NULL);
4283
4284         return offset;
4285 }
4286
4287 static int
4288 samr_dissect_open_alias_rqst(tvbuff_t *tvb, int offset, packet_info *pinfo,
4289                              proto_tree *tree, char *drep)
4290 {
4291         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
4292         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
4293         guint32 rid;
4294
4295         if (check_col(pinfo->cinfo, COL_INFO))
4296                 col_set_str(pinfo->cinfo, COL_INFO, "OpenAlias request");
4297
4298         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4299                                        hf_samr_hnd, NULL);
4300
4301         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
4302                         hf_samr_access, NULL);
4303
4304         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
4305                         hf_samr_rid, &rid);
4306
4307         if (check_col(pinfo->cinfo, COL_INFO))
4308                 col_append_fstr(pinfo->cinfo, COL_INFO, ", rid 0x%x", rid);
4309
4310         dcv->private_data = (void *)rid;
4311
4312         return offset;
4313 }
4314
4315 static int
4316 samr_dissect_open_alias_reply(tvbuff_t *tvb, int offset,
4317                               packet_info *pinfo, proto_tree *tree,
4318                               char *drep)
4319 {
4320         if (check_col(pinfo->cinfo, COL_INFO))
4321                 col_set_str(pinfo->cinfo, COL_INFO, "OpenAlias response");
4322
4323         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4324                                        hf_samr_hnd, NULL);
4325
4326         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4327                         hf_samr_rc, NULL);
4328
4329         return offset;
4330 }
4331
4332 static int
4333 samr_dissect_add_multiple_members_to_alias_rqst(tvbuff_t *tvb, int offset,
4334                                                 packet_info *pinfo,
4335                                                 proto_tree *tree, char *drep)
4336 {
4337         if (check_col(pinfo->cinfo, COL_INFO))
4338                 col_set_str(pinfo->cinfo, COL_INFO,
4339                             "AddMultipleMembersToAlias request");
4340
4341         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4342                                        hf_samr_hnd, NULL);
4343
4344         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4345                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
4346                         "", -1, 0);
4347
4348         return offset;
4349 }
4350
4351 static int
4352 samr_dissect_add_multiple_members_to_alias_reply(tvbuff_t *tvb, int offset,
4353                                                  packet_info *pinfo,
4354                                                  proto_tree *tree, char *drep)
4355 {
4356         if (check_col(pinfo->cinfo, COL_INFO))
4357                 col_set_str(pinfo->cinfo, COL_INFO,
4358                             "AddMultipleMembersToAlias response");
4359
4360         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4361                                   hf_samr_rc, NULL);
4362
4363         return offset;
4364 }
4365
4366 static int
4367 samr_dissect_create_group_in_domain_rqst(tvbuff_t *tvb, int offset,
4368                                          packet_info *pinfo, proto_tree *tree,
4369                                          char *drep)
4370 {
4371         if (check_col(pinfo->cinfo, COL_INFO))
4372                 col_set_str(pinfo->cinfo, COL_INFO, "CreateGroup request");
4373
4374         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4375                                        hf_samr_hnd, NULL);
4376
4377         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4378                         samr_dissect_pointer_UNICODE_STRING, NDR_POINTER_REF,
4379                         "Account Name", hf_samr_acct_name, 0);
4380
4381         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
4382                                      hf_samr_access, NULL);
4383
4384         return offset;
4385 }
4386
4387 static int
4388 samr_dissect_create_group_in_domain_reply(tvbuff_t *tvb, int offset,
4389                                           packet_info *pinfo, proto_tree *tree,
4390                                           char *drep)
4391 {
4392         if (check_col(pinfo->cinfo, COL_INFO))
4393                 col_set_str(pinfo->cinfo, COL_INFO, "CreateGroup response");
4394
4395         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4396                                        hf_samr_hnd, NULL);
4397
4398         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
4399                                      hf_samr_rid, NULL);
4400
4401         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4402                                   hf_samr_rc, NULL);
4403
4404         return offset;
4405 }
4406
4407 static int
4408 samr_dissect_query_information_domain_rqst(tvbuff_t *tvb, int offset,
4409                                            packet_info *pinfo,
4410                                            proto_tree *tree, char *drep)
4411 {
4412         if (check_col(pinfo->cinfo, COL_INFO))
4413                 col_set_str(pinfo->cinfo, COL_INFO, "QueryDomInfo request");
4414
4415         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4416                                        hf_samr_hnd, NULL);
4417
4418         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
4419                         hf_samr_level, NULL);
4420
4421         return offset;
4422 }
4423
4424 static int
4425 samr_dissect_query_information_domain_reply(tvbuff_t *tvb, int offset,
4426                         packet_info *pinfo, proto_tree *tree,
4427                         char *drep)
4428 {
4429         if (check_col(pinfo->cinfo, COL_INFO))
4430                 col_set_str(pinfo->cinfo, COL_INFO, "QueryDomInfo response");
4431
4432         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4433                         samr_dissect_DOMAIN_INFO_ptr, NDR_POINTER_REF,
4434                         "", hf_samr_domain, 0);
4435
4436         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
4437                                      hf_samr_rc, NULL);
4438
4439         return offset;
4440 }
4441
4442 static int
4443 samr_dissect_query_information_user_rqst(tvbuff_t *tvb, int offset,
4444                                           packet_info *pinfo,
4445                                           proto_tree *tree, char *drep)
4446 {
4447         if (check_col(pinfo->cinfo, COL_INFO))
4448                 col_set_str(pinfo->cinfo, COL_INFO, "QueryUserInfo request");
4449
4450         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
4451                                        hf_samr_hnd, NULL);
4452
4453         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
4454                         hf_samr_level, NULL);
4455
4456         return offset;
4457 }
4458
4459 static int
4460 samr_dissect_query_information_user_reply(tvbuff_t *tvb, int offset,
4461                                            packet_info *pinfo,
4462                                            proto_tree *tree, char *drep)
4463 {
4464         if (check_col(pinfo->cinfo, COL_INFO))
4465                 col_set_str(pinfo->cinfo, COL_INFO, "QueryUserInfo response");
4466
4467         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4468                         samr_dissect_USER_INFO_ptr, NDR_POINTER_REF,
4469                         "", -1, 0);
4470
4471         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4472                                   hf_samr_rc, NULL);
4473
4474         return offset;
4475 }
4476
4477 static dcerpc_sub_dissector dcerpc_samr_dissectors[] = {
4478         { SAMR_CONNECT_ANON, "CONNECT_ANON",
4479                 samr_dissect_connect_anon_rqst,
4480                 samr_dissect_connect_anon_reply },
4481         { SAMR_CLOSE_HND, "CLOSE_HND",
4482                 samr_dissect_close_hnd_rqst,
4483                 samr_dissect_close_hnd_reply },
4484         { SAMR_SET_SEC_OBJECT, "SET_SEC_OBJECT",
4485                 samr_dissect_set_sec_object_rqst,
4486                 samr_dissect_set_sec_object_reply },
4487         { SAMR_QUERY_SEC_OBJECT, "QUERY_SEC_OBJECT",
4488                 samr_dissect_query_sec_object_rqst,
4489                 samr_dissect_query_sec_object_reply },
4490         { SAMR_SHUTDOWN_SAM_SERVER, "SHUTDOWN_SAM_SERVER",
4491                 samr_dissect_shutdown_sam_server_rqst,
4492                 samr_dissect_shutdown_sam_server_reply },
4493         { SAMR_LOOKUP_DOMAIN, "LOOKUP_DOMAIN",
4494                 samr_dissect_lookup_domain_rqst,
4495                 samr_dissect_lookup_domain_reply },
4496         { SAMR_ENUM_DOMAINS, "ENUM_DOMAINS",
4497                 samr_dissect_enum_domains_rqst,
4498                 samr_dissect_enum_domains_reply },
4499         { SAMR_OPEN_DOMAIN, "OPEN_DOMAIN",
4500                 samr_dissect_open_domain_rqst,
4501                 samr_dissect_open_domain_reply },
4502         { SAMR_QUERY_DOMAIN_INFO, "QUERY_INFORMATION_DOMAIN",
4503                 samr_dissect_query_information_alias_rqst,
4504                 samr_dissect_query_information_domain_reply },
4505         { SAMR_SET_DOMAIN_INFO, "SET_INFORMATION_DOMAIN",
4506                 samr_dissect_set_information_domain_rqst,
4507                 samr_dissect_set_information_domain_reply },
4508         { SAMR_CREATE_DOM_GROUP, "CREATE_GROUP_IN_DOMAIN",
4509                 samr_dissect_create_alias_in_domain_rqst,
4510                 samr_dissect_create_alias_in_domain_reply },
4511         { SAMR_ENUM_DOM_GROUPS, "ENUM_DOM_GROUPS",
4512                 samr_dissect_enum_dom_groups_rqst,
4513                 samr_dissect_enum_dom_groups_reply },
4514         { SAMR_CREATE_USER_IN_DOMAIN, "CREATE_USER_IN_DOMAIN",
4515                 samr_dissect_create_group_in_domain_rqst,
4516                 samr_dissect_create_group_in_domain_reply },
4517         { SAMR_ENUM_DOM_USERS, "ENUM_DOM_USERS",
4518                 samr_dissect_enum_dom_groups_rqst,
4519                 samr_dissect_enum_dom_groups_reply },
4520         { SAMR_CREATE_DOM_ALIAS, "CREATE_ALIAS_IN_DOMAIN",
4521                 samr_dissect_create_alias_in_domain_rqst,
4522                 samr_dissect_create_alias_in_domain_reply },
4523         { SAMR_ENUM_DOM_ALIASES, "ENUM_DOM_ALIASES",
4524                 samr_dissect_enum_dom_aliases_rqst,
4525                 samr_dissect_enum_dom_aliases_reply },
4526         { SAMR_GET_ALIAS_MEMBERSHIP, "GET_ALIAS_MEMBERSHIP",
4527                 samr_dissect_get_alias_membership_rqst,
4528                 samr_dissect_get_alias_membership_reply },
4529         { SAMR_LOOKUP_NAMES, "LOOKUP_NAMES",
4530                 samr_dissect_lookup_names_rqst,
4531                 samr_dissect_lookup_names_reply },
4532         { SAMR_LOOKUP_RIDS, "LOOKUP_RIDS",
4533                 samr_dissect_lookup_rids_rqst,
4534                 samr_dissect_lookup_rids_reply },
4535         { SAMR_OPEN_GROUP, "OPEN_GROUP",
4536                 samr_dissect_open_group_rqst,
4537                 samr_dissect_open_group_reply },
4538         { SAMR_QUERY_GROUPINFO, "QUERY_INFORMATION_GROUP",
4539                 samr_dissect_query_information_group_rqst,
4540                 samr_dissect_query_information_group_reply },
4541         { SAMR_SET_GROUPINFO, "SET_INFORMATION_GROUP",
4542                 samr_dissect_set_information_group_rqst,
4543                 samr_dissect_set_information_group_reply },
4544         { SAMR_ADD_GROUPMEM, "ADD_MEMBER_TO_GROUP",
4545                 samr_dissect_add_member_to_group_rqst,
4546                 samr_dissect_add_member_to_group_reply },
4547         { SAMR_DELETE_DOM_GROUP, "DELETE_DOM_GROUP",
4548                 samr_dissect_delete_dom_group_rqst,
4549                 samr_dissect_delete_dom_group_reply },
4550         { SAMR_DEL_GROUPMEM, "REMOVE_MEMBER_FROM_GROUP",
4551                 samr_dissect_remove_member_from_group_rqst,
4552                 samr_dissect_remove_member_from_group_reply },
4553         { SAMR_QUERY_GROUPMEM, "QUERY_GROUPMEM",
4554                 samr_dissect_query_groupmem_rqst,
4555                 samr_dissect_query_groupmem_reply },
4556         { SAMR_SET_MEMBER_ATTRIBUTES_OF_GROUP, "SET_MEMBER_ATTRIBUTES_OF_GROUP",
4557                 samr_dissect_set_member_attributes_of_group_rqst,
4558                 samr_dissect_set_member_attributes_of_group_reply },
4559         { SAMR_OPEN_ALIAS, "OPEN_ALIAS",
4560                 samr_dissect_open_alias_rqst,
4561                 samr_dissect_open_alias_reply },
4562         { SAMR_QUERY_ALIASINFO, "QUERY_INFORMATION_ALIAS",
4563                 samr_dissect_query_information_alias_rqst,
4564                 samr_dissect_query_information_alias_reply },
4565         { SAMR_SET_ALIASINFO, "SET_INFORMATION_ALIAS",
4566                 samr_dissect_set_information_alias_rqst,
4567                 samr_dissect_set_information_alias_reply },
4568         { SAMR_DELETE_DOM_ALIAS, "DELETE_DOM_ALIAS",
4569                 samr_dissect_delete_dom_alias_rqst,
4570                 samr_dissect_delete_dom_alias_reply },
4571         { SAMR_ADD_ALIASMEM, "ADD_MEMBER_TO_ALIAS",
4572                 samr_dissect_add_alias_member_rqst,
4573                 samr_dissect_add_alias_member_reply },
4574         { SAMR_DEL_ALIASMEM, "REMOVE_MEMBER_FROM_ALIAS",
4575                 samr_dissect_remove_alias_member_rqst,
4576                 samr_dissect_remove_alias_member_reply },
4577         { SAMR_GET_MEMBERS_IN_ALIAS, "GET_MEMBERS_IN_ALIAS",
4578                 samr_dissect_get_members_in_alias_rqst,
4579                 samr_dissect_get_members_in_alias_reply },
4580         { SAMR_OPEN_USER, "OPEN_USER",
4581                 samr_dissect_open_user_rqst,
4582                 samr_dissect_open_user_reply },
4583         { SAMR_DELETE_DOM_USER, "DELETE_DOM_USER",
4584                 samr_dissect_delete_dom_user_rqst,
4585                 samr_dissect_delete_dom_user_reply },
4586         { SAMR_QUERY_USERINFO, "QUERY_USERINFO",
4587                 samr_dissect_query_information_user_rqst,
4588                 samr_dissect_query_information_user_reply },
4589         { SAMR_SET_USERINFO2, "SET_USERINFO2",
4590                 samr_dissect_set_information_user2_rqst,
4591                 samr_dissect_set_information_user2_reply },
4592         { SAMR_CHANGE_PASSWORD_USER, "CHANGE_PASSWORD_USER",
4593                 samr_dissect_change_password_user_rqst,
4594                 samr_dissect_change_password_user_reply },
4595         { SAMR_GET_GROUPS_FOR_USER, "GET_GROUPS_FOR_USER",
4596                 samr_dissect_get_groups_for_user_rqst,
4597                 samr_dissect_get_groups_for_user_reply },
4598         { SAMR_QUERY_DISPINFO, "QUERY_DISPINFO",
4599                 samr_dissect_query_dispinfo_rqst,
4600                 samr_dissect_query_dispinfo_reply },
4601         { SAMR_GET_DISPLAY_ENUMERATION_INDEX, "GET_DISPLAY_ENUMERATION_INDEX",
4602                 samr_dissect_get_display_enumeration_index_rqst,
4603                 samr_dissect_get_display_enumeration_index_reply },
4604         { SAMR_TEST_PRIVATE_FUNCTIONS_DOMAIN, "TEST_PRIVATE_FUNCTIONS_DOMAIN",
4605                 samr_dissect_test_private_fns_domain_rqst,
4606                 samr_dissect_test_private_fns_domain_reply },
4607         { SAMR_TEST_PRIVATE_FUNCTIONS_USER, "TEST_PRIVATE_FUNCTIONS_USER",
4608                 samr_dissect_test_private_fns_user_rqst,
4609                 samr_dissect_test_private_fns_user_reply },
4610         { SAMR_GET_USRDOM_PWINFO, "GET_USRDOM_PWINFO",
4611                 samr_dissect_get_usrdom_pwinfo_rqst,
4612                 samr_dissect_get_usrdom_pwinfo_reply },
4613         { SAMR_REMOVE_MEMBER_FROM_FOREIGN_DOMAIN, "REMOVE_MEMBER_FROM_FOREIGN_DOMAIN",
4614                 samr_dissect_remove_member_from_foreign_domain_rqst,
4615                 samr_dissect_remove_member_from_foreign_domain_reply },
4616         { SAMR_QUERY_INFORMATION_DOMAIN2, "QUERY_INFORMATION_DOMAIN2",
4617                 samr_dissect_query_information_domain_rqst,
4618                 samr_dissect_query_information_domain_reply },
4619         { SAMR_UNKNOWN_2f, "UNKNOWN_2f",
4620                 samr_dissect_unknown_2f_rqst,
4621                 samr_dissect_unknown_2f_reply },
4622         { SAMR_QUERY_DISPINFO2, "QUERY_INFORMATION_DISPLAY2",
4623                 samr_dissect_query_dispinfo_rqst,
4624                 samr_dissect_query_dispinfo_reply },
4625         { SAMR_GET_DISPLAY_ENUMERATION_INDEX2, "GET_DISPLAY_ENUMERATION_INDEX2",
4626                 samr_dissect_get_display_enumeration_index2_rqst,
4627                 samr_dissect_get_display_enumeration_index2_reply },
4628         { SAMR_CREATE_USER2_IN_DOMAIN, "CREATE_USER2_IN_DOMAIN",
4629                 samr_dissect_create_user2_in_domain_rqst,
4630                 samr_dissect_create_user2_in_domain_reply },
4631         { SAMR_QUERY_DISPINFO3, "QUERY_INFORMATION_DISPLAY3",
4632                 samr_dissect_query_dispinfo_rqst,
4633                 samr_dissect_query_dispinfo_reply },
4634         { SAMR_ADD_MULTIPLE_MEMBERS_TO_ALIAS, "ADD_MULTIPLE_MEMBERS_TO_ALIAS",
4635                 samr_dissect_add_multiple_members_to_alias_rqst,
4636                 samr_dissect_add_multiple_members_to_alias_reply },
4637         { SAMR_REMOVE_MULTIPLE_MEMBERS_FROM_ALIAS, "REMOVE_MULTIPLE_MEMBERS_FROM_ALIAS",
4638                 samr_dissect_remove_multiple_members_from_alias_rqst,
4639                 samr_dissect_remove_multiple_members_from_alias_reply },
4640         { SAMR_OEM_CHANGE_PASSWORD_USER2, "OEM_CHANGE_PASSWORD_USER2",
4641                 samr_dissect_oem_change_password_user2_rqst,
4642                 samr_dissect_oem_change_password_user2_reply },
4643         { SAMR_UNICODE_CHANGE_PASSWORD_USER2, "UNICODE_CHANGE_PASSWORD_USER2",
4644                 samr_dissect_unicode_change_password_user2_rqst,
4645                 samr_dissect_unicode_change_password_user2_reply },
4646         { SAMR_GET_DOM_PWINFO, "GET_DOMAIN_PASSWORD_INFORMATION",
4647                 samr_dissect_get_domain_password_information_rqst,
4648                 samr_dissect_get_domain_password_information_reply },
4649         { SAMR_CONNECT2, "CONNECT2",
4650                 samr_dissect_connect2_rqst,
4651                 samr_dissect_connect2_reply },
4652         { SAMR_SET_USERINFO, "SET_USERINFO",
4653                 samr_dissect_set_information_user2_rqst,
4654                 samr_dissect_set_information_user2_reply },
4655         { SAMR_UNKNOWN_3B, "UNKNOWN_3B",
4656                 samr_dissect_unknown_3b_rqst,
4657                 samr_dissect_unknown_3b_reply },
4658         { SAMR_UNKNOWN_3C, "UNKNOWN_3C",
4659                 samr_dissect_unknown_3c_rqst,
4660                 samr_dissect_unknown_3c_reply },
4661         {0, NULL, NULL,  NULL },
4662 };
4663
4664 void
4665 proto_register_dcerpc_samr(void)
4666 {
4667         static hf_register_info hf[] = {
4668                 { &hf_samr_hnd,
4669                   { "Context Handle", "samr.hnd", FT_BYTES, BASE_NONE, NULL, 0x0, "", HFILL }},
4670                 { &hf_samr_group,
4671                   { "Group", "samr.group", FT_UINT32, BASE_DEC, NULL, 0x0, "Group", HFILL }},
4672                 { &hf_samr_rid,
4673                   { "Rid", "samr.rid", FT_UINT32, BASE_DEC, NULL, 0x0, "RID", HFILL }},
4674                 { &hf_samr_type,
4675                   { "Type", "samr.type", FT_UINT32, BASE_HEX, NULL, 0x0, "Type", HFILL }},
4676                 { &hf_samr_alias,
4677                   { "Alias", "samr.alias", FT_UINT32, BASE_HEX, NULL, 0x0, "Alias", HFILL }},
4678                 { &hf_samr_rid_attrib,
4679                   { "Rid Attrib", "samr.rid.attrib", FT_UINT32, BASE_HEX, NULL, 0x0, "", HFILL }},
4680                 { &hf_samr_attrib,
4681                   { "Attributes", "samr.attr", FT_UINT32, BASE_HEX, NULL, 0x0, "", HFILL }},
4682                 { &hf_samr_rc,
4683                   { "Return code", "samr.rc", FT_UINT32, BASE_HEX, VALS (NT_errors), 0x0, "", HFILL }},
4684
4685         { &hf_samr_level,
4686                 { "Level", "samr.level", FT_UINT16, BASE_DEC,
4687                 NULL, 0x0, "Level requested/returned for Information", HFILL }},
4688         { &hf_samr_start_idx,
4689                 { "Start Idx", "samr.start_idx", FT_UINT32, BASE_DEC,
4690                 NULL, 0x0, "Start Index for returned Information", HFILL }},
4691
4692         { &hf_samr_entries,
4693                 { "Entries", "samr.entries", FT_UINT32, BASE_DEC,
4694                 NULL, 0x0, "Number of entries to return", HFILL }},
4695
4696         { &hf_samr_max_entries,
4697                 { "Max Entries", "samr.max_entries", FT_UINT32, BASE_DEC,
4698                 NULL, 0x0, "Maximum number of entries", HFILL }},
4699
4700         { &hf_samr_pref_maxsize,
4701                 { "Pref MaxSize", "samr.pref_maxsize", FT_UINT32, BASE_DEC,
4702                 NULL, 0x0, "Maximum Size of data to return", HFILL }},
4703
4704         { &hf_samr_total_size,
4705                 { "Total Size", "samr.total_size", FT_UINT32, BASE_DEC,
4706                 NULL, 0x0, "Total size of data", HFILL }},
4707
4708         { &hf_samr_bad_pwd_count,
4709                 { "Bad Pwd Count", "samr.bad_pwd_count", FT_UINT16, BASE_DEC,
4710                 NULL, 0x0, "Number of bad pwd entries for this user", HFILL }},
4711
4712         { &hf_samr_logon_count,
4713                 { "Logon Count", "samr.logon_count", FT_UINT16, BASE_DEC,
4714                 NULL, 0x0, "Number of logons for this user", HFILL }},
4715
4716         { &hf_samr_ret_size,
4717                 { "Returned Size", "samr.ret_size", FT_UINT32, BASE_DEC,
4718                 NULL, 0x0, "Number of returned objects in this PDU", HFILL }},
4719
4720         { &hf_samr_index,
4721                 { "Index", "samr.index", FT_UINT32, BASE_DEC,
4722                 NULL, 0x0, "Index", HFILL }},
4723
4724         { &hf_samr_count,
4725           { "Count", "samr.count", FT_UINT32, BASE_DEC, NULL, 0x0, "Number of elements in following array", HFILL }},
4726
4727         { &hf_samr_alias_name,
4728                 { "Alias Name", "samr.alias_name", FT_STRING, BASE_NONE,
4729                 NULL, 0, "Name of Alias", HFILL }},
4730
4731         { &hf_samr_group_name,
4732                 { "Group Name", "samr.group_name", FT_STRING, BASE_NONE,
4733                 NULL, 0, "Name of Group", HFILL }},
4734
4735         { &hf_samr_acct_name,
4736                 { "Account Name", "samr.acct_name", FT_STRING, BASE_NONE,
4737                 NULL, 0, "Name of Account", HFILL }},
4738
4739         { &hf_samr_server,
4740                 { "Server", "samr.server", FT_STRING, BASE_NONE,
4741                 NULL, 0, "Name of Server", HFILL }},
4742
4743         { &hf_samr_domain,
4744                 { "Domain", "samr.domain", FT_STRING, BASE_NONE,
4745                 NULL, 0, "Name of Domain", HFILL }},
4746
4747         { &hf_samr_controller,
4748                 { "DC", "samr.dc", FT_STRING, BASE_NONE,
4749                 NULL, 0, "Name of Domain Controller", HFILL }},
4750
4751         { &hf_samr_full_name,
4752                 { "Full Name", "samr.full_name", FT_STRING, BASE_NONE,
4753                 NULL, 0, "Full Name of Account", HFILL }},
4754
4755         { &hf_samr_home,
4756                 { "Home", "samr.home", FT_STRING, BASE_NONE,
4757                 NULL, 0, "Home directory for this user", HFILL }},
4758
4759         { &hf_samr_home_drive,
4760                 { "Home Drive", "samr.home_drive", FT_STRING, BASE_NONE,
4761                 NULL, 0, "Home drive for this user", HFILL }},
4762
4763         { &hf_samr_script,
4764                 { "Script", "samr.script", FT_STRING, BASE_NONE,
4765                 NULL, 0, "Login script for this user", HFILL }},
4766
4767         { &hf_samr_workstations,
4768                 { "Workstations", "samr.workstations", FT_STRING, BASE_NONE,
4769                 NULL, 0, "", HFILL }},
4770
4771         { &hf_samr_profile,
4772                 { "Profile", "samr.profile", FT_STRING, BASE_NONE,
4773                 NULL, 0, "Profile for this user", HFILL }},
4774
4775         { &hf_samr_acct_desc,
4776                 { "Account Desc", "samr.acct_desc", FT_STRING, BASE_NONE,
4777                 NULL, 0, "Account Description", HFILL }},
4778
4779         { &hf_samr_comment,
4780                 { "Comment", "samr.comment", FT_STRING, BASE_NONE,
4781                 NULL, 0, "Comment", HFILL }},
4782
4783         { &hf_samr_parameters,
4784                 { "Parameters", "samr.parameters", FT_STRING, BASE_NONE,
4785                 NULL, 0, "Parameters", HFILL }},
4786
4787         { &hf_samr_unknown_string,
4788                 { "Unknown string", "samr.unknown_string", FT_STRING, BASE_NONE,
4789                 NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
4790
4791         { &hf_samr_unknown_hyper,
4792                 { "Unknown hyper", "samr.unknown.hyper", FT_UINT64, BASE_HEX,
4793                 NULL, 0x0, "Unknown hyper. If you know what this is, contact ethereal developers.", HFILL }},
4794         { &hf_samr_unknown_long,
4795                 { "Unknown long", "samr.unknown.long", FT_UINT32, BASE_HEX,
4796                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
4797
4798         { &hf_samr_unknown_short,
4799                 { "Unknown short", "samr.unknown.short", FT_UINT16, BASE_HEX,
4800                 NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
4801
4802         { &hf_samr_unknown_char,
4803                 { "Unknown char", "samr.unknown.char", FT_UINT8, BASE_HEX,
4804                 NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
4805
4806         { &hf_samr_revision,
4807                 { "Revision", "samr.revision", FT_UINT64, BASE_HEX,
4808                 NULL, 0x0, "Revision number for this structure", HFILL }},
4809
4810         { &hf_samr_nt_pwd_set,
4811                 { "NT Pwd Set", "samr.nt_pwd_set", FT_UINT8, BASE_HEX,
4812                 NULL, 0x0, "Flag indicating whether the NT password has been set", HFILL }},
4813
4814         { &hf_samr_lm_pwd_set,
4815                 { "LM Pwd Set", "samr.lm_pwd_set", FT_UINT8, BASE_HEX,
4816                 NULL, 0x0, "Flag indicating whether the LanManager password has been set", HFILL }},
4817
4818         { &hf_samr_pwd_expired,
4819                 { "Expired flag", "samr.pwd_Expired", FT_UINT8, BASE_HEX,
4820                 NULL, 0x0, "Flag indicating if the password for this account has expired or not", HFILL }},
4821
4822         /* XXX - is this a standard NT access mask? */
4823         { &hf_samr_access,
4824                 { "Access Mask", "samr.access", FT_UINT32, BASE_HEX,
4825                 NULL, 0x0, "Access", HFILL }},
4826
4827         { &hf_samr_mask,
4828                 { "Mask", "samr.mask", FT_UINT32, BASE_HEX,
4829                 NULL, 0x0, "Mask", HFILL }},
4830
4831         { &hf_samr_crypt_password, {
4832                 "Password", "samr.crypt_password", FT_BYTES, BASE_HEX,
4833                 NULL, 0, "Encrypted Password", HFILL }},
4834
4835         { &hf_samr_crypt_hash, {
4836                 "Hash", "samr.crypt_hash", FT_BYTES, BASE_HEX,
4837                 NULL, 0, "Encrypted Hash", HFILL }},
4838
4839         { &hf_samr_lm_change, {
4840                 "LM Change", "samr.lm_change", FT_UINT8, BASE_HEX,
4841                 NULL, 0, "LM Change value", HFILL }},
4842
4843         { &hf_samr_max_pwd_age,
4844                 { "Max Pwd Age", "samr.max_pwd_age", FT_RELATIVE_TIME, BASE_NONE,
4845                 NULL, 0, "Maximum Password Age before it expires", HFILL }},
4846
4847         { &hf_samr_min_pwd_age,
4848                 { "Min Pwd Age", "samr.min_pwd_age", FT_RELATIVE_TIME, BASE_NONE,
4849                 NULL, 0, "Minimum Password Age before it can be changed", HFILL }},
4850         { &hf_samr_unknown_time,
4851                 { "Unknown time", "samr.unknown_time", FT_ABSOLUTE_TIME, BASE_NONE,
4852                 NULL, 0, "Unknown NT TIME, contact ethereal developers if you know what this is", HFILL }},
4853         { &hf_samr_logon_time,
4854                 { "Logon Time", "samr.logon_time", FT_ABSOLUTE_TIME, BASE_NONE,
4855                 NULL, 0, "Time for last time this user logged on", HFILL }},
4856         { &hf_samr_kickoff_time,
4857                 { "Kickoff Time", "samr.kickoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
4858                 NULL, 0, "Time when this user will be kicked off", HFILL }},
4859         { &hf_samr_logoff_time,
4860                 { "Logoff Time", "samr.logoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
4861                 NULL, 0, "Time for last time this user logged off", HFILL }},
4862         { &hf_samr_pwd_last_set_time,
4863                 { "PWD Last Set", "samr.pwd_last_set_time", FT_ABSOLUTE_TIME, BASE_NONE,
4864                 NULL, 0, "Last time this users password was changed", HFILL }},
4865         { &hf_samr_pwd_can_change_time,
4866                 { "PWD Can Change", "samr.pwd_can_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
4867                 NULL, 0, "When this users password may be changed", HFILL }},
4868         { &hf_samr_pwd_must_change_time,
4869                 { "PWD Must Change", "samr.pwd_must_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
4870                 NULL, 0, "When this users password must be changed", HFILL }},
4871         { &hf_samr_acct_expiry_time,
4872                 { "Acct Expiry", "samr.acct_expiry_time", FT_ABSOLUTE_TIME, BASE_NONE,
4873                 NULL, 0, "When this user account expires", HFILL }},
4874
4875         { &hf_samr_min_pwd_len, {
4876                 "Min Pwd Len", "samr.min_pwd_len", FT_UINT16, BASE_DEC,
4877                 NULL, 0, "Minimum Password Length", HFILL }},
4878         { &hf_samr_pwd_history_len, {
4879                 "Pwd History Len", "samr.pwd_history_len", FT_UINT16, BASE_DEC,
4880                 NULL, 0, "Password History Length", HFILL }},
4881         { &hf_samr_num_users, {
4882                 "Num Users", "samr.num_users", FT_UINT32, BASE_DEC,
4883                 NULL, 0, "Number of users in this domain", HFILL }},
4884         { &hf_samr_num_groups, {
4885                 "Num Groups", "samr.num_groups", FT_UINT32, BASE_DEC,
4886                 NULL, 0, "Number of groups in this domain", HFILL }},
4887         { &hf_samr_num_aliases, {
4888                 "Num Aliases", "samr.num_aliases", FT_UINT32, BASE_DEC,
4889                 NULL, 0, "Number of aliases in this domain", HFILL }},
4890         { &hf_samr_info_type, {
4891                 "Info Type", "samr.info_type", FT_UINT32, BASE_DEC,
4892                 NULL, 0, "Information Type", HFILL }},
4893         { &hf_samr_resume_hnd, {
4894                 "Resume Hnd", "samr.resume_hnd", FT_UINT32, BASE_DEC,
4895                 NULL, 0, "Resume handle", HFILL }},
4896         { &hf_samr_country, {
4897                 "Country", "samr.country", FT_UINT16, BASE_DEC,
4898                 VALS(ms_country_codes), 0, "Country setting for this user", HFILL }},
4899         { &hf_samr_codepage, {
4900                 "Codepage", "samr.codepage", FT_UINT16, BASE_DEC,
4901                 NULL, 0, "Codepage setting for this user", HFILL }},
4902         { &hf_samr_divisions, {
4903                 "Divisions", "samr.divisions", FT_UINT16, BASE_DEC,
4904                 NULL, 0, "Number of divisions for LOGON_HOURS", HFILL }},
4905
4906         /* these are used by packet-dcerpc-nt.c */
4907         { &hf_nt_string_length,
4908                 { "Length", "nt.string.length", FT_UINT16, BASE_DEC,
4909                 NULL, 0x0, "Length of string in bytes", HFILL }},
4910
4911         { &hf_nt_string_size,
4912                 { "Size", "nt.string.size", FT_UINT16, BASE_DEC,
4913                 NULL, 0x0, "Size of string in bytes", HFILL }},
4914
4915         { &hf_nt_str_len,
4916                 { "Length", "nt.str.len", FT_UINT32, BASE_DEC,
4917                 NULL, 0x0, "Length of string in short integers", HFILL }},
4918
4919         { &hf_nt_str_off,
4920                 { "Offset", "nt.str.offset", FT_UINT32, BASE_DEC,
4921                 NULL, 0x0, "Offset into string in short integers", HFILL }},
4922
4923         { &hf_nt_str_max_len,
4924                 { "Max Length", "nt.str.max_len", FT_UINT32, BASE_DEC,
4925                 NULL, 0x0, "Max Length of string in short integers", HFILL }},
4926
4927         { &hf_nt_acct_ctrl,
4928                 { "Acct Ctrl", "nt.acct_ctrl", FT_UINT32, BASE_HEX,
4929                 NULL, 0x0, "Acct CTRL", HFILL }},
4930
4931         { &hf_nt_acb_disabled, {
4932                 "", "nt.acb.disabled", FT_BOOLEAN, 32,
4933                 TFS(&tfs_nt_acb_disabled), 0x0001, "If this account is enabled or disabled", HFILL }},
4934
4935         { &hf_nt_acb_homedirreq, {
4936                 "", "nt.acb.homedirreq", FT_BOOLEAN, 32,
4937                 TFS(&tfs_nt_acb_homedirreq), 0x0002, "Is hom,edirs required for this account?", HFILL }},
4938
4939         { &hf_nt_acb_pwnotreq, {
4940                 "", "nt.acb.pwnotreq", FT_BOOLEAN, 32,
4941                 TFS(&tfs_nt_acb_pwnotreq), 0x0004, "If a password is required for this account?", HFILL }},
4942
4943         { &hf_nt_acb_tempdup, {
4944                 "", "nt.acb.tempdup", FT_BOOLEAN, 32,
4945                 TFS(&tfs_nt_acb_tempdup), 0x0008, "If this is a temporary duplicate account", HFILL }},
4946
4947         { &hf_nt_acb_normal, {
4948                 "", "nt.acb.normal", FT_BOOLEAN, 32,
4949                 TFS(&tfs_nt_acb_normal), 0x0010, "If this is a normal user account", HFILL }},
4950
4951         { &hf_nt_acb_mns, {
4952                 "", "nt.acb.mns", FT_BOOLEAN, 32,
4953                 TFS(&tfs_nt_acb_mns), 0x0020, "MNS logon user account", HFILL }},
4954
4955         { &hf_nt_acb_domtrust, {
4956                 "", "nt.acb.domtrust", FT_BOOLEAN, 32,
4957                 TFS(&tfs_nt_acb_domtrust), 0x0040, "Interdomain trust account", HFILL }},
4958
4959         { &hf_nt_acb_wstrust, {
4960                 "", "nt.acb.wstrust", FT_BOOLEAN, 32,
4961                 TFS(&tfs_nt_acb_wstrust), 0x0080, "Workstation trust account", HFILL }},
4962
4963         { &hf_nt_acb_svrtrust, {
4964                 "", "nt.acb.svrtrust", FT_BOOLEAN, 32,
4965                 TFS(&tfs_nt_acb_svrtrust), 0x0100, "Server trust account", HFILL }},
4966
4967         { &hf_nt_acb_pwnoexp, {
4968                 "", "nt.acb.pwnoexp", FT_BOOLEAN, 32,
4969                 TFS(&tfs_nt_acb_pwnoexp), 0x0200, "If this account expires or not", HFILL }},
4970
4971         { &hf_nt_acb_autolock, {
4972                 "", "nt.acb.autolock", FT_BOOLEAN, 32,
4973                 TFS(&tfs_nt_acb_autolock), 0x0400, "If this account has been autolocked", HFILL }},
4974         };
4975         static gint *ett[] = {
4976                 &ett_dcerpc_samr,
4977                 &ett_samr_user_dispinfo_1,
4978                 &ett_samr_user_dispinfo_1_array,
4979                 &ett_samr_user_dispinfo_2,
4980                 &ett_samr_user_dispinfo_2_array,
4981                 &ett_samr_group_dispinfo,
4982                 &ett_samr_group_dispinfo_array,
4983                 &ett_samr_ascii_dispinfo,
4984                 &ett_samr_ascii_dispinfo_array,
4985                 &ett_samr_display_info,
4986                 &ett_samr_password_info,
4987                 &ett_samr_server,
4988                 &ett_samr_user_group,
4989                 &ett_samr_user_group_array,
4990                 &ett_samr_alias_info,
4991                 &ett_samr_group_info,
4992                 &ett_samr_domain_info_1,
4993                 &ett_samr_domain_info_2,
4994                 &ett_samr_domain_info_8,
4995                 &ett_samr_replication_status,
4996                 &ett_samr_domain_info_11,
4997                 &ett_samr_domain_info_13,
4998                 &ett_samr_domain_info,
4999                 &ett_samr_sid_pointer,
5000                 &ett_samr_sid_array,
5001                 &ett_samr_index_array,
5002                 &ett_samr_idx_and_name,
5003                 &ett_samr_idx_and_name_array,
5004                 &ett_samr_logon_hours,
5005                 &ett_samr_logon_hours_hours,
5006                 &ett_samr_user_info_1,
5007                 &ett_samr_user_info_2,
5008                 &ett_samr_user_info_3,
5009                 &ett_samr_user_info_5,
5010                 &ett_samr_user_info_6,
5011                 &ett_samr_user_info_18,
5012                 &ett_samr_user_info_19,
5013                 &ett_samr_buffer_buffer,
5014                 &ett_samr_buffer,
5015                 &ett_samr_user_info_21,
5016                 &ett_samr_user_info_22,
5017                 &ett_samr_user_info_23,
5018                 &ett_samr_user_info_24,
5019                 &ett_samr_user_info,
5020                 &ett_samr_member_array_types,
5021                 &ett_samr_member_array_rids,
5022                 &ett_samr_member_array,
5023                 &ett_samr_names,
5024                 &ett_samr_rids,
5025                 &ett_samr_sid_and_attributes_array,
5026                 &ett_samr_sid_and_attributes,
5027                 &ett_nt_acct_ctrl,
5028         };
5029
5030         proto_dcerpc_samr = proto_register_protocol(
5031                 "Microsoft Security Account Manager", "SAMR", "samr");
5032
5033         proto_register_field_array (proto_dcerpc_samr, hf, array_length (hf));
5034         proto_register_subtree_array(ett, array_length(ett));
5035 }
5036
5037 void
5038 proto_reg_handoff_dcerpc_samr(void)
5039 {
5040         /* Register protocol as dcerpc */
5041
5042         dcerpc_init_uuid(proto_dcerpc_samr, ett_dcerpc_samr, &uuid_dcerpc_samr,
5043                          ver_dcerpc_samr, dcerpc_samr_dissectors);
5044 }