epan/dissectors/packet-dtpt.c

   1 /* packet-dtpt.c
   2  * Routines for Microsoft ActiveSync Desktop Pass-Through (DTPT) packet
   3  * dissection
   4  *
   5  * Uwe Girlich <uwe@planetquake.com>
   6  *      http://www.synce.org/moin/ProtocolDocumentation/DesktopPassThrough
   7  *
   8  * $Id$
   9  *
  10  * Wireshark - Network traffic analyzer
  11  * By Gerald Combs <gerald@wireshark.org>
  12  * Copyright 1998 Gerald Combs
  13  *
  14  * Copied from packet-quake.c
  15  *
  16  * This program is free software; you can redistribute it and/or
  17  * modify it under the terms of the GNU General Public License
  18  * as published by the Free Software Foundation; either version 2
  19  * of the License, or (at your option) any later version.
  20  *
  21  * This program is distributed in the hope that it will be useful,
  22  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24  * GNU General Public License for more details.
  25  *
  26  * You should have received a copy of the GNU General Public License
  27  * along with this program; if not, write to the Free Software
  28  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  29  */
  30
  31 #ifdef HAVE_CONFIG_H
  32 # include "config.h"
  33 #endif
  34
  35 #include <string.h>
  36
  37 #include <glib.h>
  38 #include <epan/packet.h>
  39 #include <epan/conversation.h>
  40 #include <epan/prefs.h>
  41 #include <epan/aftypes.h>
  42 #include <epan/ipproto.h>
  43
  44 static int proto_dtpt = -1;
  45
  46 static int hf_dtpt_version = -1;
  47 static int hf_dtpt_message_type = -1;
  48 static int hf_dtpt_flags = -1;
  49 static int hf_dtpt_flags_deep = -1;
  50 static int hf_dtpt_flags_containers = -1;
  51 static int hf_dtpt_flags_nocontainers = -1;
  52 static int hf_dtpt_flags_nearest = -1;
  53 static int hf_dtpt_flags_return_name = -1;
  54 static int hf_dtpt_flags_return_type = -1;
  55 static int hf_dtpt_flags_return_version = -1;
  56 static int hf_dtpt_flags_return_comment = -1;
  57 static int hf_dtpt_flags_return_addr = -1;
  58 static int hf_dtpt_flags_return_blob = -1;
  59 static int hf_dtpt_flags_return_aliases = -1;
  60 static int hf_dtpt_flags_return_query_string = -1;
  61 static int hf_dtpt_flags_flushcache = -1;
  62 static int hf_dtpt_flags_flushprevious = -1;
  63 static int hf_dtpt_flags_res_service = -1;
  64 static int hf_dtpt_payload_size = -1;
  65 static int hf_dtpt_handle = -1;
  66 static int hf_dtpt_error = -1;
  67 static int hf_dtpt_buffer_size = -1;
  68 static int hf_dtpt_data_size = -1;
  69 static int hf_dtpt_queryset_rawsize = -1;
  70 static int hf_dtpt_queryset_size = -1;
  71 static int hf_dtpt_queryset_service_instance_name_pointer = -1;
  72 static int hf_dtpt_queryset_service_class_id_pointer = -1;
  73 static int hf_dtpt_queryset_version = -1;
  74 static int hf_dtpt_queryset_comment_pointer = -1;
  75 static int hf_dtpt_queryset_namespace = -1;
  76 static int hf_dtpt_queryset_provider_id_pointer = -1;
  77 static int hf_dtpt_queryset_context_pointer = -1;
  78 static int hf_dtpt_queryset_protocols_number = -1;
  79 static int hf_dtpt_queryset_protocols_pointer = -1;
  80 static int hf_dtpt_queryset_query_string_pointer = -1;
  81 static int hf_dtpt_queryset_cs_addrs_number = -1;
  82 static int hf_dtpt_queryset_cs_addrs_pointer = -1;
  83 static int hf_dtpt_queryset_output_flags = -1;
  84 static int hf_dtpt_queryset_blob_pointer = -1;
  85 static int hf_dtpt_wstring_length = -1;
  86 static int hf_dtpt_wstring_data = -1;
  87 static int hf_dtpt_guid_length = -1;
  88 static int hf_dtpt_guid_data = -1;
  89 static int hf_dtpt_service_instance_name = -1;
  90 static int hf_dtpt_service_class_id = -1;
  91 static int hf_dtpt_comment = -1;
  92 static int hf_dtpt_ns_provider_id = -1;
  93 static int hf_dtpt_context = -1;
  94 static int hf_dtpt_protocols_number = -1;
  95 static int hf_dtpt_protocols_length = -1;
  96 static int hf_dtpt_protocol_family = -1;
  97 static int hf_dtpt_protocol_protocol = -1;
  98 static int hf_dtpt_query_string = -1;
  99 static int hf_dtpt_cs_addrs_number = -1;
 100 static int hf_dtpt_cs_addrs_length1 = -1;
 101 static int hf_dtpt_cs_addr_socket_type = -1;
 102 static int hf_dtpt_cs_addr_protocol = -1;
 103 static int hf_dtpt_cs_addr_local_pointer = -1;
 104 static int hf_dtpt_cs_addr_local_length = -1;
 105 static int hf_dtpt_cs_addr_local = -1;
 106 static int hf_dtpt_cs_addr_remote_pointer = -1;
 107 static int hf_dtpt_cs_addr_remote_length = -1;
 108 static int hf_dtpt_cs_addr_remote = -1;
 109 static int hf_dtpt_sockaddr_length = -1;
 110 static int hf_dtpt_sockaddr_family = -1;
 111 static int hf_dtpt_sockaddr_port = -1;
 112 static int hf_dtpt_sockaddr_address = -1;
 113 static int hf_dtpt_blob_rawsize = -1;
 114 static int hf_dtpt_blob_size = -1;
 115 static int hf_dtpt_blob_data_pointer = -1;
 116 static int hf_dtpt_blob_data_length = -1;
 117 static int hf_dtpt_blob_data = -1;
 118 static int hf_dtpt_connect_addr = -1;
 119
 120 static gint ett_dtpt = -1;
 121 static gint ett_dtpt_flags = -1;
 122 static gint ett_dtpt_queryset = -1;
 123 static gint ett_dtpt_wstring = -1;
 124 static gint ett_dtpt_guid = -1;
 125 static gint ett_dtpt_protocols = -1;
 126 static gint ett_dtpt_protocol = -1;
 127 static gint ett_dtpt_cs_addrs = -1;
 128 static gint ett_dtpt_cs_addr1 = -1;
 129 static gint ett_dtpt_cs_addr2 = -1;
 130 static gint ett_dtpt_sockaddr = -1;
 131 static gint ett_dtpt_blobraw = -1;
 132 static gint ett_dtpt_blob = -1;
 133
 134
 135
 136 static dissector_handle_t       dtpt_conversation_handle;
 137 /** static dissector_handle_t   dtpt_data_handle;  **/
 138 static dissector_handle_t       data_handle;
 139
 140
 141 /* Server port */
 142 static unsigned int gbl_dtptServerPort=5721;
 143
 144 static const value_string names_message_type[] = {
 145 #define LookupBeginRequest 9
 146         {       LookupBeginRequest, "LookupBeginRequest" },
 147 #define LookupBeginResponse 10
 148         {       LookupBeginResponse, "LookupBeginResponse" },
 149 #define LookupNextRequest 11
 150         {       LookupNextRequest, "LookupNextRequest" },
 151 #define LookupNextResponse 12
 152         {       LookupNextResponse, "LookupNextResponse" },
 153 #define LookupEndRequest 13
 154         {       LookupEndRequest, "LookupEndRequest" },
 155 #define ConnectRequest 1
 156         {       ConnectRequest, "ConnectRequest" },
 157 #define ConnectResponseOK 0x5A
 158         {       ConnectResponseOK, "ConnectResponseOK" },
 159 #define ConnectResponseERR 0x5B
 160         {       ConnectResponseERR, "ConnectResponseERR" },
 161         { 0, NULL }
 162 };
 163
 164 static const value_string names_error[] = {
 165         {       0, "OK" },
 166         {       10014, "WSAEFAULT" },
 167         {       10060, "WSAETIMEDOUT" },
 168         {       10108, "WSASERVICE_NOT_FOUND" },
 169         {       11001, "WSAHOST_NOT_FOUND" },
 170         {       0, NULL }
 171 };
 172
 173 static const value_string names_family[] = {
 174         {       WINSOCK_AF_INET,        "AF_INET"       },
 175         {       0, NULL }
 176 };
 177
 178 /*
 179  * Winsock's SOCK_ values.  These are probably the same as they are on
 180  * other OSes, as they probably all come from 4.2BSD, but it's still
 181  * best to define them ourselves (to avoid problems if other OSes
 182  * define them differently, and to avoid having to include system
 183  * header files that might require a bunch of other includes).
 184  */
 185 #define WINSOCK_SOCK_STREAM     1
 186 #define WINSOCK_SOCK_DGRAM      2
 187 #define WINSOCK_SOCK_RAW        3
 188
 189 static const value_string names_socket_type[] = {
 190         {       WINSOCK_SOCK_STREAM,    "SOCK_STREAM"   },
 191         {       WINSOCK_SOCK_DGRAM,     "SOCK_DGRAM"    },
 192         {       WINSOCK_SOCK_RAW,       "SOCK_RAW"      },
 193         {       0, NULL }
 194 };
 195
 196 static const value_string names_protocol[] = {
 197         {       IP_PROTO_IP,    "IPPROTO_IP"    },
 198         {       IP_PROTO_TCP,   "IPPROTO_TCP"   },
 199         {       IP_PROTO_UDP,   "IPPROTP_UDP"   },
 200         {       0, NULL }
 201 };
 202
 203 #define LUP_DEEP                0x0001
 204 #define LUP_CONTAINERS          0x0002
 205 #define LUP_NOCONTAINERS        0x0004
 206 #define LUP_NEAREST             0x0008
 207 #define LUP_RETURN_NAME         0x0010
 208 #define LUP_RETURN_TYPE         0x0020
 209 #define LUP_RETURN_VERSION      0x0040
 210 #define LUP_RETURN_COMMENT      0x0080
 211 #define LUP_RETURN_ADDR         0x0100
 212 #define LUP_RETURN_BLOB         0x0200
 213 #define LUP_RETURN_ALIASES      0x0400
 214 #define LUP_RETURN_QUERY_STRING 0x0800
 215 #define LUP_FLUSHCACHE          0x1000
 216 #define LUP_FLUSHPREVIOUS       0x2000
 217 #define LUP_RES_SERVICE         0x8000
 218
 219 #define SOCKADDR_WITH_LEN       1
 220 #define SOCKADDR_CONNECT        2
 221
 222 static int
 223 dissect_dtpt_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
 224 static int
 225 dissect_dtpt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
 226
 227
 228 static int
 229 dissect_dtpt_wstring(tvbuff_t *tvb, guint offset, proto_tree *tree, int hfindex)
 230 {
 231         guint32 wstring_length;
 232         guint32 wstring_size;
 233         char    *wstring_data = NULL;
 234         guint32 wstring_padding = 0;
 235
 236         wstring_length = tvb_get_letohl(tvb, offset);
 237         wstring_data = tvb_get_ephemeral_faked_unicode(tvb, offset+4, wstring_length, 1);
 238         wstring_size = wstring_length;
 239         if (wstring_size%4) {
 240                 wstring_padding = (4-wstring_size%4);
 241                 wstring_size += wstring_padding;
 242         }
 243         if (tree) {
 244                 proto_item      *dtpt_wstring_item = NULL;
 245                 proto_tree      *dtpt_wstring_tree = NULL;
 246                 dtpt_wstring_item = proto_tree_add_string(tree, hfindex,
 247                         tvb, offset+0, 4+wstring_size, wstring_data);
 248                 if (dtpt_wstring_item)
 249                         dtpt_wstring_tree = proto_item_add_subtree(dtpt_wstring_item, ett_dtpt_wstring);
 250                 if (dtpt_wstring_tree) {
 251                         proto_tree_add_uint(dtpt_wstring_tree, hf_dtpt_wstring_length,
 252                                 tvb, offset+0, 4, wstring_length);
 253                         if (wstring_length)
 254                                 proto_tree_add_string(dtpt_wstring_tree, hf_dtpt_wstring_data,
 255                                         tvb, offset+4, wstring_length, wstring_data);
 256                         if (wstring_padding)
 257                                 proto_tree_add_text(dtpt_wstring_tree, tvb,
 258                                         offset+4+wstring_length,wstring_padding, "Padding");
 259                 }
 260         }
 261         offset += 4+wstring_size;
 262         return offset;
 263 }
 264
 265 static int
 266 dissect_dtpt_guid(tvbuff_t *tvb, guint offset, proto_tree *tree, int hfindex)
 267 {
 268         guint32 guid_length;
 269
 270         guid_length = tvb_get_letohl(tvb, offset);
 271         if (tree) {
 272                 e_guid_t        guid;
 273                 proto_item      *dtpt_guid_item = NULL;
 274                 proto_tree      *dtpt_guid_tree = NULL;
 275                 const gchar     *guid_name = NULL;
 276
 277                 if (guid_length) {
 278                         tvb_get_guid(tvb, offset+4, &guid, 1);
 279                 }
 280                 else {
 281                         memset(&guid, 0, sizeof(guid));
 282                 }
 283                 dtpt_guid_item = proto_tree_add_guid(tree, hfindex, tvb, offset, 4 + guid_length, &guid);
 284                 if (dtpt_guid_item) {
 285                         guid_name = guids_get_guid_name(&guid);
 286                         if (guid_name != NULL)
 287                                 proto_item_set_text(dtpt_guid_item, "%s: %s (%s)",
 288                                 proto_registrar_get_name(hfindex), guid_name, guid_to_str(&guid));
 289                         dtpt_guid_tree = proto_item_add_subtree(dtpt_guid_item, ett_dtpt_guid);
 290                 }
 291                 if (dtpt_guid_tree) {
 292                         proto_item      *dtpt_guid_data_item = NULL;
 293
 294                         proto_tree_add_uint(dtpt_guid_tree, hf_dtpt_guid_length,
 295                                 tvb, offset, 4, guid_length);
 296                         if (guid_length) {
 297                                 dtpt_guid_data_item = proto_tree_add_guid(dtpt_guid_tree, hf_dtpt_guid_data,
 298                                         tvb, offset+4, guid_length, &guid);
 299                                 if (guid_name != NULL && dtpt_guid_data_item != NULL) {
 300                                         proto_item_set_text(dtpt_guid_data_item, "%s: %s (%s)",
 301                                         proto_registrar_get_name(hf_dtpt_guid_data),
 302                                         guid_name, guid_to_str(&guid));
 303                                 }
 304                         }
 305                 }
 306         }
 307         offset+=4;
 308         offset+=guid_length;
 309
 310         return offset;
 311 }
 312
 313 static int
 314 dissect_dtpt_sockaddr(tvbuff_t *tvb, guint offset, proto_tree *tree, int hfindex, int sockaddr_type)
 315 {
 316         guint32 sockaddr_length = 0;
 317         proto_item      *sockaddr_item = NULL;
 318         proto_tree      *sockaddr_tree = NULL;
 319         guint32         sockaddr_len1 = 0;
 320         guint32         sockaddr_len2 = 0;
 321
 322         switch (sockaddr_type) {
 323                 case SOCKADDR_WITH_LEN:
 324                         sockaddr_len1=4;
 325                         sockaddr_len2=16;
 326                 break;
 327                 case SOCKADDR_CONNECT:
 328                         sockaddr_len1=0;
 329                         sockaddr_len2=30;
 330                 break;
 331         }
 332
 333         if (sockaddr_type == SOCKADDR_WITH_LEN)
 334                 sockaddr_length = tvb_get_letohl(tvb, offset + 0);
 335
 336         if (tree) {
 337                 sockaddr_item = proto_tree_add_text(tree,
 338                         tvb, offset, sockaddr_len1+sockaddr_len2, "%s", proto_registrar_get_name(hfindex));
 339
 340                 if (sockaddr_item)
 341                         sockaddr_tree = proto_item_add_subtree(sockaddr_item, ett_dtpt_sockaddr);
 342                 if (sockaddr_tree) {
 343                         if (sockaddr_type == SOCKADDR_WITH_LEN)
 344                                 proto_tree_add_uint(sockaddr_tree, hf_dtpt_sockaddr_length,
 345                                                 tvb, offset+0, 4, sockaddr_length);
 346                 }
 347         }
 348
 349         offset += sockaddr_len1;
 350
 351         if (sockaddr_tree) {
 352                 switch (sockaddr_type) {
 353                         case SOCKADDR_WITH_LEN: {
 354                                 guint16 family;
 355
 356                                 family = tvb_get_letohs(tvb, offset);
 357                                 proto_tree_add_uint(sockaddr_tree, hf_dtpt_sockaddr_family,
 358                                                 tvb, offset, 2, family);
 359                                 switch (family) {
 360                                         case WINSOCK_AF_INET: {
 361                                                 guint16 port;
 362                                                 guint32 addr;
 363
 364                                                 port = tvb_get_ntohs(tvb,offset+2);
 365                                                 proto_tree_add_uint(sockaddr_tree, hf_dtpt_sockaddr_port,
 366                                                 tvb, offset+2,2,port);
 367                                                 addr = tvb_get_ipv4(tvb,offset+4);
 368                                                 proto_tree_add_ipv4(sockaddr_tree, hf_dtpt_sockaddr_address,
 369                                                 tvb, offset+4,4,addr);
 370                                                 proto_tree_add_text(sockaddr_tree, tvb, offset+8, 8, "Padding");
 371                                                         proto_item_append_text(sockaddr_item, ": %s:%d", ip_to_str((guint8*)&addr), port);
 372                                         }
 373                                         break;
 374                                 }
 375                         }
 376                         break;
 377                         case SOCKADDR_CONNECT: {
 378                                 guint32 family;
 379
 380                                 family = tvb_get_letohl(tvb, offset+0);
 381                                 proto_tree_add_uint(sockaddr_tree, hf_dtpt_sockaddr_family,
 382                                                 tvb, offset+0, 4, family);
 383                                 switch (family) {
 384                                         case WINSOCK_AF_INET: {
 385                                                 guint16 port;
 386                                                 guint32 addr;
 387
 388                                                 proto_tree_add_text(sockaddr_tree, tvb, offset+4, 4, "Padding");
 389                                                 port = tvb_get_ntohs(tvb,offset+8);
 390                                                 proto_tree_add_uint(sockaddr_tree, hf_dtpt_sockaddr_port,
 391                                                         tvb, offset+8,2,port);
 392                                                 addr = tvb_get_ipv4(tvb,offset+10);
 393                                                 proto_tree_add_ipv4(sockaddr_tree, hf_dtpt_sockaddr_address,
 394                                                         tvb, offset+10,4,addr);
 395                                                 proto_tree_add_text(sockaddr_tree, tvb, offset+14, 16, "Padding");
 396                                                 proto_item_append_text(sockaddr_item, ": %s:%d", ip_to_str((guint8*)&addr), port);
 397                                         }
 398                                         break;
 399                                 }
 400                         }
 401                         break;
 402                 }
 403
 404         }
 405         offset += sockaddr_len2;
 406         return offset;
 407 }
 408
 409 static int
 410 dissect_dtpt_conversation(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 411 {
 412         guint           offset = 0;
 413         guint           rest_length;
 414
 415         /* First try to decode it as "normal" DTPT packets. */
 416         offset = dissect_dtpt(tvb, pinfo, tree);
 417
 418         if (offset == 0) {
 419                 /* No, maybe it was a DTPT data packet. */
 420                 offset = dissect_dtpt_data(tvb, pinfo, tree);
 421         }
 422
 423         /* Handle the rest ... */
 424         rest_length = tvb_reported_length(tvb) - offset;
 425         if (rest_length > 0) {
 426                 tvbuff_t        *next_tvb;
 427                 /* ... as data. */
 428                 call_dissector(data_handle,
 429                         tvb_new_subset_remaining(tvb, offset), pinfo, tree);
 430                 next_tvb = tvb_new_subset(tvb, offset, rest_length, rest_length);
 431         }
 432         return tvb_reported_length(tvb);
 433 }
 434
 435
 436 static int
 437 dissect_dtpt_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 438 {
 439         proto_item      *dtpt_item = NULL;
 440         proto_tree      *dtpt_tree = NULL;
 441         proto_item      *dtpt_queryset_item = NULL;
 442         proto_tree      *dtpt_queryset_tree = NULL;
 443         guint           offset = 0;
 444         guint32         queryset_rawsize;
 445         guint32         queryset_size;
 446         guint32         num_protocols;
 447         guint32         protocols_length = 0;
 448         guint32         addrs_start;
 449         guint32         num_addrs;
 450         guint32         addrs_length1 = 0;
 451         proto_item      *dtpt_addrs_item = NULL;
 452         proto_tree      *dtpt_addrs_tree = NULL;
 453         guint32         blob_rawsize = 0;
 454         guint32         blob_size = 0;
 455         guint32         blob_data_length = 0;
 456
 457         queryset_rawsize = tvb_get_letohl(tvb, offset + 0);
 458         if (queryset_rawsize != 60) return 0;
 459         queryset_size = tvb_get_letohl(tvb, offset + 4);
 460         if (queryset_size != 60) return 0;
 461
 462         col_set_str(pinfo->cinfo, COL_PROTOCOL, "DTPT");
 463         col_set_str(pinfo->cinfo, COL_INFO, "QuerySet");
 464
 465         if (tree) {
 466                 dtpt_item = proto_tree_add_item(tree, proto_dtpt,
 467                                 tvb, 0, -1, FALSE);
 468                 if (dtpt_item)
 469                         dtpt_tree = proto_item_add_subtree(dtpt_item, ett_dtpt);
 470         }
 471
 472         if (dtpt_tree) {
 473                 proto_tree_add_uint(dtpt_tree, hf_dtpt_queryset_rawsize,
 474                         tvb, 0, 4, queryset_rawsize);
 475
 476                 dtpt_queryset_item = proto_tree_add_text(dtpt_tree,
 477                         tvb, 4, 60, "QuerySet raw");
 478                 if (dtpt_queryset_item)
 479                         dtpt_queryset_tree = proto_item_add_subtree(dtpt_queryset_item, ett_dtpt_queryset);
 480
 481                 if (dtpt_queryset_tree) {
 482                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_size,
 483                                 tvb, offset+4+0,  4, queryset_size);
 484                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_service_instance_name_pointer,
 485                                 tvb, offset+4+4,  4, tvb_get_letohl(tvb, offset+4+ 4));
 486                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_service_class_id_pointer,
 487                                 tvb, offset+4+8,  4, tvb_get_letohl(tvb, offset+4+ 8));
 488                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_version,
 489                                 tvb, offset+4+12, 4, tvb_get_letohl(tvb, offset+4+12));
 490                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_comment_pointer,
 491                                 tvb, offset+4+16, 4, tvb_get_letohl(tvb, offset+4+16));
 492                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_namespace,
 493                                 tvb, offset+4+20, 4, tvb_get_letohl(tvb, offset+4+20));
 494                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_provider_id_pointer,
 495                                 tvb, offset+4+24, 4, tvb_get_letohl(tvb, offset+4+24));
 496                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_context_pointer,
 497                                 tvb, offset+4+28, 4, tvb_get_letohl(tvb, offset+4+28));
 498                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_protocols_number,
 499                                 tvb, offset+4+32, 4, tvb_get_letohl(tvb, offset+4+32));
 500                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_protocols_pointer,
 501                                 tvb, offset+4+36, 4, tvb_get_letohl(tvb, offset+4+36));
 502                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_query_string_pointer,
 503                                 tvb, offset+4+40, 4, tvb_get_letohl(tvb, offset+4+40));
 504                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_cs_addrs_number,
 505                                 tvb, offset+4+44, 4, tvb_get_letohl(tvb, offset+4+44));
 506                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_cs_addrs_pointer,
 507                                 tvb, offset+4+48, 4, tvb_get_letohl(tvb, offset+4+48));
 508                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_output_flags,
 509                                 tvb, offset+4+52, 4, tvb_get_letohl(tvb, offset+4+52));
 510                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_blob_pointer,
 511                                 tvb, offset+4+56, 4, tvb_get_letohl(tvb, offset+4+56));
 512                 }
 513         }
 514
 515         offset += 4;
 516         offset += 60;
 517
 518         offset = dissect_dtpt_wstring(tvb, offset, dtpt_tree, hf_dtpt_service_instance_name);
 519         offset = dissect_dtpt_guid   (tvb, offset, dtpt_tree, hf_dtpt_service_class_id     );
 520         offset = dissect_dtpt_wstring(tvb, offset, dtpt_tree, hf_dtpt_comment              );
 521         offset = dissect_dtpt_guid   (tvb, offset, dtpt_tree, hf_dtpt_ns_provider_id       );
 522         offset = dissect_dtpt_wstring(tvb, offset, dtpt_tree, hf_dtpt_context              );
 523         num_protocols = tvb_get_letohl(tvb, offset);
 524         if (num_protocols>0) {
 525                 protocols_length = tvb_get_letohl(tvb, offset+4);
 526         }
 527         if (dtpt_tree) {
 528                 proto_item      *dtpt_protocols_item = NULL;
 529                 proto_tree      *dtpt_protocols_tree = NULL;
 530                 guint32         i;
 531
 532                 dtpt_protocols_item = proto_tree_add_text(dtpt_tree,
 533                                 tvb, offset, 4+(num_protocols>0?4:0)+num_protocols*8,
 534                                 "Protocols: %d", num_protocols);
 535                 if (dtpt_protocols_item)
 536                         dtpt_protocols_tree = proto_item_add_subtree(dtpt_protocols_item, ett_dtpt_protocols);
 537                 if (dtpt_protocols_tree) {
 538                         proto_tree_add_uint(dtpt_protocols_tree, hf_dtpt_protocols_number,
 539                                         tvb, offset, 4, num_protocols);
 540                         if (num_protocols>0)
 541                                 proto_tree_add_uint(dtpt_protocols_tree, hf_dtpt_protocols_length,
 542                                                 tvb, offset+4, 4, protocols_length);
 543                         for (i=0;i<num_protocols;i++) {
 544                                 proto_item      *dtpt_protocol_item = NULL;
 545                                 proto_tree      *dtpt_protocol_tree = NULL;
 546
 547                                 dtpt_protocol_item = proto_tree_add_text(dtpt_protocols_tree,
 548                                                 tvb, offset+4+4+i*8, 8, "Protocol[%d]", i+1);
 549                                 if (dtpt_protocol_item)
 550                                         dtpt_protocol_tree = proto_item_add_subtree(dtpt_protocol_item, ett_dtpt_protocol);
 551                                 if (dtpt_protocol_tree) {
 552                                         proto_tree_add_uint(dtpt_protocol_tree, hf_dtpt_protocol_family,
 553                                         tvb, offset+4+4+i*8, 4, tvb_get_letohl(tvb, offset+4+4+i*8));
 554                                         proto_tree_add_uint(dtpt_protocol_tree, hf_dtpt_protocol_protocol,
 555                                         tvb, offset+4+4+i*8+4, 4, tvb_get_letohl(tvb, offset+4+4+i*8+4));
 556                                 }
 557                         }
 558                 }
 559         }
 560         offset += 4 + (num_protocols>0?4:0) + num_protocols*8;
 561         offset = dissect_dtpt_wstring(tvb, offset, dtpt_tree, hf_dtpt_query_string         );
 562
 563         addrs_start = offset;
 564         num_addrs = tvb_get_letohl(tvb, offset);
 565         if (num_addrs>0) {
 566                 addrs_length1 = tvb_get_letohl(tvb, offset+4);
 567         }
 568         if (dtpt_tree) {
 569                 dtpt_addrs_item = proto_tree_add_text(dtpt_tree,
 570                         tvb, offset, -1, "Addresses");
 571                 if (dtpt_addrs_item)
 572                         dtpt_addrs_tree = proto_item_add_subtree(dtpt_addrs_item, ett_dtpt_cs_addrs);
 573                 if (dtpt_addrs_tree) {
 574                         proto_tree_add_uint(dtpt_addrs_tree, hf_dtpt_cs_addrs_number,
 575                                 tvb, offset, 4, num_addrs);
 576                         if (num_addrs>0)
 577                                 proto_tree_add_uint(dtpt_addrs_tree, hf_dtpt_cs_addrs_length1,
 578                                         tvb, offset+4, 4, addrs_length1);
 579                 }
 580         }
 581         offset += 4 + (num_addrs>0?4:0);
 582
 583         if (num_addrs>0) {
 584                 guint32 i;
 585                 guint32 offset2;
 586
 587                 offset2 = offset + 24*num_addrs;
 588
 589                 for (i=0;i<num_addrs;i++,offset+=24) {
 590                         proto_item      *dtpt_addr1_item = NULL;
 591                         proto_tree      *dtpt_addr1_tree = NULL;
 592                         proto_item      *dtpt_addr2_item = NULL;
 593                         proto_tree      *dtpt_addr2_tree = NULL;
 594                         guint32         offset2_start;
 595
 596                         if (dtpt_addrs_tree) {
 597                                 dtpt_addr1_item = proto_tree_add_text(dtpt_addrs_tree,
 598                                         tvb, offset, 24, "Address[%u] Part 1", i+1);
 599                                 if (dtpt_addr1_item)
 600                                         dtpt_addr1_tree = proto_item_add_subtree(dtpt_addr1_item,
 601                                                 ett_dtpt_cs_addr1);
 602                                 if (dtpt_addr1_tree) {
 603                                         proto_tree_add_uint(dtpt_addr1_tree, hf_dtpt_cs_addr_local_pointer,
 604                                                 tvb, offset+ 0, 4, tvb_get_letohl(tvb, offset+ 0));
 605                                         proto_tree_add_uint(dtpt_addr1_tree, hf_dtpt_cs_addr_local_length,
 606                                                 tvb, offset+ 4, 4, tvb_get_letohl(tvb, offset+ 4));
 607                                         proto_tree_add_uint(dtpt_addr1_tree, hf_dtpt_cs_addr_remote_pointer,
 608                                                 tvb, offset+ 8, 4, tvb_get_letohl(tvb, offset+ 8));
 609                                         proto_tree_add_uint(dtpt_addr1_tree, hf_dtpt_cs_addr_remote_length,
 610                                                 tvb, offset+12, 4, tvb_get_letohl(tvb, offset+12));
 611                                         proto_tree_add_uint(dtpt_addr1_tree, hf_dtpt_cs_addr_socket_type,
 612                                                 tvb, offset+16, 4, tvb_get_letohl(tvb, offset+16));
 613                                         proto_tree_add_uint(dtpt_addr1_tree, hf_dtpt_cs_addr_protocol,
 614                                                 tvb, offset+20, 4, tvb_get_letohl(tvb, offset+20));
 615                                 }
 616
 617                                 dtpt_addr2_item = proto_tree_add_text(dtpt_addrs_tree,
 618                                         tvb, offset2, -1, "Address[%u] Part 2", i+1);
 619                                 if (dtpt_addr2_item)
 620                                         dtpt_addr2_tree = proto_item_add_subtree(dtpt_addr2_item,
 621                                                 ett_dtpt_cs_addr2);
 622                         }
 623
 624                         offset2_start = offset2;
 625
 626                         offset2 = dissect_dtpt_sockaddr(tvb, offset2, dtpt_addr2_tree, hf_dtpt_cs_addr_local, SOCKADDR_WITH_LEN);
 627                         offset2 = dissect_dtpt_sockaddr(tvb, offset2, dtpt_addr2_tree, hf_dtpt_cs_addr_remote, SOCKADDR_WITH_LEN);
 628
 629                         if (dtpt_addr2_item)
 630                                 proto_item_set_len(dtpt_addr2_item,
 631                                         offset2 - offset2_start);
 632                 }
 633                 offset = offset2;
 634         }
 635
 636         if (dtpt_addrs_item)
 637                 proto_item_set_len(dtpt_addrs_item, offset - addrs_start);
 638
 639         if (dtpt_item)
 640                 proto_item_set_len(dtpt_item, offset);
 641
 642         blob_rawsize = tvb_get_letohl(tvb, offset);
 643         if (blob_rawsize>=4) {
 644                 blob_size = tvb_get_letohl(tvb,offset+4+0);
 645         }
 646         if (dtpt_tree) {
 647                 proto_item      *dtpt_blobraw_item = NULL;
 648                 proto_tree      *dtpt_blobraw_tree = NULL;
 649
 650                 proto_tree_add_uint(dtpt_tree, hf_dtpt_blob_rawsize,
 651                                 tvb, offset+0, 4, blob_rawsize);
 652                 if (blob_rawsize>0) {
 653                         dtpt_blobraw_item = proto_tree_add_text(dtpt_tree,
 654                                 tvb, offset+4, blob_rawsize, "Blob raw");
 655                         if (dtpt_blobraw_item)
 656                                 dtpt_blobraw_tree = proto_item_add_subtree(dtpt_blobraw_item,
 657                                         ett_dtpt_blobraw);
 658                         if (dtpt_blobraw_tree) {
 659                                 proto_tree_add_uint(dtpt_blobraw_tree, hf_dtpt_blob_size,
 660                                         tvb, offset+4+0, 4, blob_size);
 661                                 proto_tree_add_uint(dtpt_blobraw_tree, hf_dtpt_blob_data_pointer,
 662                                         tvb, offset+4+4, 4, tvb_get_letohl(tvb,offset+4+4));
 663                         }
 664                 }
 665         }
 666
 667         offset += 4+blob_rawsize;
 668
 669         if (dtpt_item)
 670                 proto_item_set_len(dtpt_item, offset);
 671
 672         if (blob_size>0) {
 673                 proto_item      *dtpt_blob_item = NULL;
 674                 proto_tree      *dtpt_blob_tree = NULL;
 675
 676                 blob_data_length = tvb_get_letohl(tvb,offset);
 677
 678                 if (dtpt_tree) {
 679                         dtpt_blob_item = proto_tree_add_text(dtpt_tree,
 680                                 tvb, offset, 4+blob_data_length, "Blob");
 681                         if (dtpt_blob_item)
 682                                 dtpt_blob_tree = proto_item_add_subtree(dtpt_blob_item,
 683                                         ett_dtpt_blob);
 684                         if (dtpt_blob_tree) {
 685                                 proto_tree_add_uint(dtpt_blob_tree, hf_dtpt_blob_data_length,
 686                                         tvb, offset+0, 4, blob_data_length);
 687                                 proto_tree_add_bytes(dtpt_blob_tree, hf_dtpt_blob_data,
 688                                         tvb, offset+4, blob_data_length,
 689                                         tvb_get_ptr(tvb, offset+4, blob_data_length));
 690                         }
 691                 }
 692                 offset += 4+blob_data_length;
 693                 if (dtpt_item)
 694                         proto_item_set_len(dtpt_item, offset);
 695         }
 696
 697         return offset;
 698 }
 699
 700 static int
 701 dissect_dtpt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 702 {
 703         proto_tree      *dtpt_tree = NULL;
 704         proto_item      *dtpt_item = NULL;
 705         guint8          version;
 706         guint8          message_type;
 707         guint32         flags;
 708         guint32         payload_size;
 709
 710         version = tvb_get_guint8(tvb, 0);
 711         if (version != 1) return 0;
 712         message_type = tvb_get_guint8(tvb, 1);
 713         switch (message_type) {
 714                 case LookupBeginRequest:
 715                 case LookupBeginResponse:
 716                 case LookupNextRequest:
 717                 case LookupNextResponse:
 718                 case LookupEndRequest:
 719                         if (tvb_reported_length(tvb) != 20) return 0;
 720                 break;
 721                 case ConnectRequest:
 722                 case ConnectResponseOK:
 723                 case ConnectResponseERR:
 724                         if (tvb_reported_length(tvb) != 36) return 0;
 725                 break;
 726                 default:
 727                         return 0;
 728         }
 729
 730         col_set_str(pinfo->cinfo, COL_PROTOCOL, "DTPT");
 731         if (check_col(pinfo->cinfo, COL_INFO))
 732                 col_add_str(pinfo->cinfo, COL_INFO, val_to_str(message_type, names_message_type, "Unknown (%d)"));
 733
 734         if (message_type == LookupBeginRequest) {
 735                 conversation_t *c;
 736                 c = find_or_create_conversation(pinfo);
 737                 conversation_set_dissector(c, dtpt_conversation_handle);
 738         }
 739
 740         if (tree) {
 741                 dtpt_item = proto_tree_add_item(tree, proto_dtpt,
 742                                 tvb, 0, -1, FALSE);
 743                 if (dtpt_item)
 744                         dtpt_tree = proto_item_add_subtree(dtpt_item, ett_dtpt);
 745         }
 746
 747         if (dtpt_tree) {
 748                 proto_tree_add_uint(dtpt_tree, hf_dtpt_version,
 749                         tvb, 0, 1, version);
 750                 proto_tree_add_uint(dtpt_tree, hf_dtpt_message_type,
 751                         tvb, 1, 1, message_type);
 752
 753                 switch (message_type) {
 754                         case LookupBeginRequest: {
 755                                 proto_item* flags_item = NULL;
 756                                 proto_tree*     flags_tree = NULL;
 757
 758                                 flags = tvb_get_letohl(tvb, 12);
 759
 760                                 flags_item = proto_tree_add_uint(dtpt_tree, hf_dtpt_flags,
 761                                         tvb, 12, 4, flags);
 762                                 if (flags_item) {
 763                                         flags_tree = proto_item_add_subtree(flags_item, ett_dtpt_flags);
 764                                 }
 765                                 if (flags_tree) {
 766                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_res_service,   tvb, 12, 4, flags);
 767                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_flushprevious, tvb, 12, 4, flags);
 768                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_flushcache,    tvb, 12, 4, flags);
 769                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_query_string, tvb, 12, 4, flags);
 770                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_aliases, tvb, 12, 4, flags);
 771                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_blob, tvb, 12, 4, flags);
 772                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_addr, tvb, 12, 4, flags);
 773                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_comment, tvb, 12, 4, flags);
 774                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_version, tvb, 12, 4, flags);
 775                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_type, tvb, 12, 4, flags);
 776                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_name, tvb, 12, 4, flags);
 777                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_nearest, tvb, 12, 4, flags);
 778                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_nocontainers, tvb, 12, 4, flags);
 779                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_containers, tvb, 12, 4, flags);
 780                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_deep, tvb, 12, 4, flags);
 781                                 }
 782                                 payload_size = tvb_get_letohl(tvb, 16);
 783                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_payload_size,
 784                                         tvb, 16, 4, payload_size);
 785                         }
 786                         break;
 787                         case LookupBeginResponse: {
 788                                 proto_tree_add_uint64(dtpt_tree, hf_dtpt_handle,
 789                                         tvb, 4, 8, tvb_get_letoh64(tvb, 4));
 790                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_error,
 791                                         tvb, 12, 4, tvb_get_letohl(tvb, 12));
 792                         }
 793                         break;
 794                         case LookupNextRequest: {
 795                                 proto_tree_add_uint64(dtpt_tree, hf_dtpt_handle,
 796                                         tvb, 4, 8, tvb_get_letoh64(tvb, 4));
 797                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_buffer_size,
 798                                         tvb, 16, 4, tvb_get_letohl(tvb, 16));
 799                         }
 800                         break;
 801                         case LookupNextResponse: {
 802                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_error,
 803                                         tvb, 12, 4, tvb_get_letohl(tvb, 12));
 804                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_data_size,
 805                                         tvb, 16, 4, tvb_get_letohl(tvb, 16));
 806                         }
 807                         break;
 808                         case LookupEndRequest: {
 809                                 proto_tree_add_uint64(dtpt_tree, hf_dtpt_handle,
 810                                         tvb, 4, 8, tvb_get_letoh64(tvb, 4));
 811                         }
 812                         break;
 813                         case ConnectRequest: {
 814                                 dissect_dtpt_sockaddr(tvb, 2, dtpt_tree, hf_dtpt_connect_addr, SOCKADDR_CONNECT);
 815                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_error,
 816                                         tvb, 32, 4, tvb_get_letohl(tvb, 32));
 817                         }
 818                         break;
 819                         case ConnectResponseOK: {
 820                                 dissect_dtpt_sockaddr(tvb, 2, dtpt_tree, hf_dtpt_connect_addr, SOCKADDR_CONNECT);
 821                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_error,
 822                                         tvb, 32, 4, tvb_get_letohl(tvb, 32));
 823                         }
 824                         break;
 825                         case ConnectResponseERR: {
 826                                 dissect_dtpt_sockaddr(tvb, 2, dtpt_tree, hf_dtpt_connect_addr, SOCKADDR_CONNECT);
 827                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_error,
 828                                         tvb, 32, 4, tvb_get_letohl(tvb, 32));
 829                         }
 830                         break;
 831                 }
 832         }
 833
 834         return tvb_length(tvb);
 835 }
 836
 837 void proto_reg_handoff_dtpt(void);
 838
 839 void
 840 proto_register_dtpt(void)
 841 {
 842   static hf_register_info hf[] = {
 843     { &hf_dtpt_version,
 844       { "Version", "dtpt.version",
 845         FT_UINT8, BASE_DEC, NULL, 0x0,
 846         "Protocol Version", HFILL }},
 847     { &hf_dtpt_message_type,
 848       { "Message Type", "dtpt.message_type",
 849         FT_UINT8, BASE_DEC, VALS(names_message_type), 0x0,
 850         "Packet Message Type", HFILL }},
 851     { &hf_dtpt_flags,
 852       { "ControlFlags", "dtpt.flags",
 853         FT_UINT32, BASE_HEX, NULL, 0x0,
 854         "ControlFlags as documented for WSALookupServiceBegin", HFILL }},
 855     { &hf_dtpt_flags_deep,
 856       { "DEEP", "dtpt.flags.deep",
 857         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_DEEP,
 858         NULL, HFILL }},
 859     { &hf_dtpt_flags_containers,
 860       { "CONTAINERS", "dtpt.flags.containers",
 861         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_CONTAINERS,
 862         NULL, HFILL }},
 863     { &hf_dtpt_flags_nocontainers,
 864       { "NOCONTAINERS", "dtpt.flags.nocontainers",
 865         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_NOCONTAINERS,
 866         NULL, HFILL }},
 867     { &hf_dtpt_flags_nearest,
 868       { "NEAREST", "dtpt.flags.nearest",
 869         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_NEAREST,
 870         NULL, HFILL }},
 871     { &hf_dtpt_flags_return_name,
 872       { "RETURN_NAME", "dtpt.flags.return_name",
 873         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_NAME,
 874         NULL, HFILL }},
 875     { &hf_dtpt_flags_return_type,
 876       { "RETURN_TYPE", "dtpt.flags.return_type",
 877         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_TYPE,
 878         NULL, HFILL }},
 879     { &hf_dtpt_flags_return_version,
 880       { "RETURN_VERSION", "dtpt.flags.return_version",
 881         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_VERSION,
 882         NULL, HFILL }},
 883     { &hf_dtpt_flags_return_comment,
 884       { "RETURN_COMMENT", "dtpt.flags.return_comment",
 885         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_COMMENT,
 886         NULL, HFILL }},
 887     { &hf_dtpt_flags_return_addr,
 888       { "RETURN_ADDR", "dtpt.flags.return_addr",
 889         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_ADDR,
 890         NULL, HFILL }},
 891     { &hf_dtpt_flags_return_blob,
 892       { "RETURN_BLOB", "dtpt.flags.return_blob",
 893         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_BLOB,
 894         NULL, HFILL }},
 895     { &hf_dtpt_flags_return_aliases,
 896       { "RETURN_ALIASES", "dtpt.flags.return_aliases",
 897         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_ALIASES,
 898         NULL, HFILL }},
 899     { &hf_dtpt_flags_return_query_string,
 900       { "RETURN_QUERY_STRING", "dtpt.flags.return_query_string",
 901         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_QUERY_STRING,
 902         NULL, HFILL }},
 903     { &hf_dtpt_flags_flushcache,
 904       { "FLUSHCACHE", "dtpt.flags.flushcache",
 905         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_FLUSHCACHE,
 906         NULL, HFILL }},
 907     { &hf_dtpt_flags_flushprevious,
 908       { "FLUSHPREVIOUS", "dtpt.flags.flushprevious",
 909         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_FLUSHPREVIOUS,
 910         NULL, HFILL }},
 911     { &hf_dtpt_flags_res_service,
 912       { "RES_SERVICE", "dtpt.flags.res_service",
 913         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RES_SERVICE,
 914         NULL, HFILL }},
 915     { &hf_dtpt_payload_size,
 916       { "Payload Size", "dtpt.payload_size",
 917         FT_UINT32, BASE_DEC, NULL, 0x0,
 918         "Payload Size of the following packet containing a serialized WSAQUERYSET", HFILL }},
 919     { &hf_dtpt_handle,
 920       { "Handle", "dtpt.handle",
 921         FT_UINT64, BASE_HEX, NULL, 0x0,
 922         "Lookup handle", HFILL }},
 923     { &hf_dtpt_error,
 924       { "Last Error", "dtpt.error",
 925         FT_UINT32, BASE_DEC, VALS(names_error), 0x0,
 926         NULL, HFILL }},
 927     { &hf_dtpt_buffer_size,
 928       { "Buffer Size", "dtpt.buffer_size",
 929         FT_UINT32, BASE_DEC, NULL, 0x0,
 930         NULL, HFILL }},
 931     { &hf_dtpt_data_size,
 932       { "Data Size", "dtpt.data_size",
 933         FT_UINT32, BASE_DEC, NULL, 0x0,
 934         NULL, HFILL }},
 935     { &hf_dtpt_queryset_rawsize,
 936       { "QuerySet Size", "dtpt.queryset_size",
 937         FT_UINT32, BASE_DEC, NULL, 0x0,
 938         "Size of the binary WSAQUERYSET", HFILL }},
 939     { &hf_dtpt_queryset_size,
 940       { "dwSize", "dtpt.queryset.dwSize",
 941         FT_UINT32, BASE_DEC, NULL, 0x0,
 942         "dwSize field in WSAQUERYSET", HFILL }},
 943     { &hf_dtpt_queryset_service_instance_name_pointer,
 944       { "lpszServiceInstanceName", "dtpt.queryset.lpszServiceInstanceName",
 945         FT_UINT32, BASE_HEX, NULL, 0x0,
 946         "lpszServiceInstanceName field in WSAQUERYSET", HFILL }},
 947     { &hf_dtpt_queryset_service_class_id_pointer,
 948       { "lpServiceClassId", "dtpt.queryset.lpServiceClassId",
 949         FT_UINT32, BASE_HEX, NULL, 0x0,
 950         "lpServiceClassId in the WSAQUERYSET", HFILL }},
 951     { &hf_dtpt_queryset_version,
 952       { "lpVersion", "dtpt.queryset.lpVersion",
 953         FT_UINT32, BASE_DEC, NULL, 0x0,
 954         "lpVersion in WSAQUERYSET", HFILL }},
 955     { &hf_dtpt_queryset_comment_pointer,
 956       { "lpszComment", "dtpt.lpszComment",
 957         FT_UINT32, BASE_HEX, NULL, 0x0,
 958         "lpszComment field in WSAQUERYSET", HFILL }},
 959     { &hf_dtpt_queryset_namespace,
 960       { "dwNameSpace", "dtpt.queryset.dwNameSpace",
 961         FT_UINT32, BASE_DEC, NULL, 0x0,
 962         "dwNameSpace field in WSAQUERYSE", HFILL }},
 963     { &hf_dtpt_queryset_provider_id_pointer,
 964       { "lpNSProviderId", "dtpt.queryset.lpNSProviderId",
 965         FT_UINT32, BASE_HEX, NULL, 0x0,
 966         "lpNSProviderId field in WSAQUERYSET", HFILL }},
 967     { &hf_dtpt_queryset_context_pointer,
 968       { "lpszContext", "dtpt.queryset.lpszContext",
 969         FT_UINT32, BASE_HEX, NULL, 0x0,
 970         "lpszContext field in WSAQUERYSET", HFILL }},
 971     { &hf_dtpt_queryset_protocols_number,
 972       { "dwNumberOfProtocols", "dtpt.queryset.dwNumberOfProtocols",
 973         FT_UINT32, BASE_DEC, NULL, 0x0,
 974         "dwNumberOfProtocols field in WSAQUERYSET", HFILL }},
 975     { &hf_dtpt_queryset_protocols_pointer,
 976       { "lpafpProtocols", "dtpt.queryset.lpafpProtocols",
 977         FT_UINT32, BASE_HEX, NULL, 0x0,
 978         "lpafpProtocols field in WSAQUERYSET", HFILL }},
 979     { &hf_dtpt_queryset_query_string_pointer,
 980       { "lpszQueryString", "dtpt.queryset.lpszQueryString",
 981         FT_UINT32, BASE_HEX, NULL, 0x0,
 982         "lpszQueryString field in WSAQUERYSET", HFILL }},
 983     { &hf_dtpt_queryset_cs_addrs_number,
 984       { "dwNumberOfCsAddrs", "dtpt.queryset.dwNumberOfCsAddrs",
 985         FT_UINT32, BASE_DEC, NULL, 0x0,
 986         "dwNumberOfCsAddrs field in WSAQUERYSET", HFILL }},
 987     { &hf_dtpt_queryset_cs_addrs_pointer,
 988       { "lpcsaBuffer", "dtpt.queryset.lpcsaBuffer",
 989         FT_UINT32, BASE_HEX, NULL, 0x0,
 990         "lpcsaBuffer field in WSAQUERYSET", HFILL }},
 991     { &hf_dtpt_queryset_output_flags,
 992       { "dwOutputFlags", "dtpt.queryset.dwOutputFlags",
 993         FT_UINT32, BASE_HEX, NULL, 0x0,
 994         "dwOutputFlags field in WSAQUERYSET", HFILL }},
 995     { &hf_dtpt_queryset_blob_pointer,
 996       { "lpBlob", "dtpt.queryset.lpBlob",
 997         FT_UINT32, BASE_HEX, NULL, 0x0,
 998         "lpBlob field in WSAQUERYSET", HFILL }},
 999     { &hf_dtpt_wstring_length,
1000       { "Length", "dtpt.wstring.length",
1001         FT_UINT32, BASE_DEC, NULL, 0x0,
1002         "String Length", HFILL }},
1003     { &hf_dtpt_wstring_data,
1004       { "Data", "dtpt.wstring.data",
1005         FT_STRING, BASE_NONE, NULL, 0x0,
1006         "String Data", HFILL }},
1007     { &hf_dtpt_guid_length,
1008       { "Length", "dtpt.guid.length",
1009         FT_UINT32, BASE_DEC, NULL, 0x0,
1010         "GUID Length", HFILL }},
1011     { &hf_dtpt_guid_data,
1012       { "Data", "dtpt.guid.data",
1013         FT_GUID, BASE_NONE, NULL, 0x0,
1014         "GUID Data", HFILL }},
1015     { &hf_dtpt_service_instance_name,
1016       { "Service Instance Name", "dtpt.service_instance_name",
1017         FT_STRINGZ, BASE_NONE, NULL, 0x0,
1018         NULL, HFILL }},
1019     { &hf_dtpt_service_class_id,
1020       { "Service Class ID", "dtpt.service_class_id",
1021         FT_GUID, BASE_NONE, NULL, 0x0,
1022         NULL, HFILL }},
1023     { &hf_dtpt_comment,
1024       { "Comment", "dtpt.comment",
1025         FT_STRINGZ, BASE_NONE, NULL, 0x0,
1026         NULL, HFILL }},
1027     { &hf_dtpt_ns_provider_id,
1028       { "NS Provider ID", "dtpt.ns_provider_id",
1029         FT_GUID, BASE_NONE, NULL, 0x0,
1030         NULL, HFILL }},
1031     { &hf_dtpt_context,
1032       { "Context", "dtpt.context",
1033         FT_STRINGZ, BASE_NONE, NULL, 0x0,
1034         NULL, HFILL }},
1035     { &hf_dtpt_protocols_number,
1036       { "Number of Protocols", "dtpt.protocols.number",
1037         FT_UINT32, BASE_DEC, NULL, 0x0,
1038         NULL, HFILL }},
1039     { &hf_dtpt_protocols_length,
1040       { "Length of Protocols", "dtpt.protocols.length",
1041         FT_UINT32, BASE_DEC, NULL, 0x0,
1042         NULL, HFILL }},
1043     { &hf_dtpt_protocol_family,
1044       { "Family", "dtpt.protocol.family",
1045         FT_UINT32, BASE_DEC, VALS(names_family), 0x0,
1046         "Protocol Family", HFILL }},
1047     { &hf_dtpt_protocol_protocol,
1048       { "Protocol", "dtpt.protocol.protocol",
1049         FT_UINT32, BASE_DEC, VALS(names_protocol), 0x0,
1050         "Protocol Protocol", HFILL }},
1051     { &hf_dtpt_query_string,
1052       { "Query String", "dtpt.query_string",
1053         FT_STRINGZ, BASE_NONE, NULL, 0x0,
1054         NULL, HFILL }},
1055     { &hf_dtpt_cs_addrs_number,
1056       { "Number of CS Addresses", "dtpt.cs_addrs.number",
1057         FT_UINT32, BASE_DEC, NULL, 0x0,
1058         NULL, HFILL }},
1059     { &hf_dtpt_cs_addrs_length1,
1060       { "Length of CS Addresses Part 1", "dtpt.cs_addrs.length1",
1061         FT_UINT32, BASE_DEC, NULL, 0x0,
1062         NULL, HFILL }},
1063     { &hf_dtpt_cs_addr_socket_type,
1064       { "Socket Type", "dtpt.cs_addrs.socket_type",
1065         FT_UINT32, BASE_DEC, VALS(names_socket_type), 0x0,
1066         NULL, HFILL }},
1067     { &hf_dtpt_cs_addr_protocol,
1068       { "Protocol", "dtpt.cs_addrs.protocol",
1069         FT_UINT32, BASE_DEC, VALS(names_protocol), 0x0,
1070         NULL, HFILL }},
1071     { &hf_dtpt_cs_addr_local_pointer,
1072       { "Local Address Pointer", "dtpt.cs_addr.local_pointer",
1073         FT_UINT32, BASE_HEX, NULL, 0x0,
1074         NULL, HFILL }},
1075     { &hf_dtpt_cs_addr_local_length,
1076       { "Local Address Length", "dtpt.cs_addr.local_length",
1077         FT_UINT32, BASE_DEC, NULL, 0x0,
1078         "Local Address Pointer", HFILL }},
1079     { &hf_dtpt_cs_addr_local,
1080       { "Local Address", "dtpt.cs_addr.local",
1081         FT_UINT32, BASE_DEC, NULL, 0x0,
1082         NULL, HFILL }},
1083     { &hf_dtpt_cs_addr_remote_pointer,
1084       { "Remote Address Pointer", "dtpt.cs_addr.remote_pointer",
1085         FT_UINT32, BASE_HEX, NULL, 0x0,
1086         NULL, HFILL }},
1087     { &hf_dtpt_cs_addr_remote_length,
1088       { "Remote Address Length", "dtpt.cs_addr.remote_length",
1089         FT_UINT32, BASE_DEC, NULL, 0x0,
1090         "Remote Address Pointer", HFILL }},
1091     { &hf_dtpt_cs_addr_remote,
1092       { "Remote Address", "dtpt.cs_addr.remote",
1093         FT_UINT32, BASE_DEC, NULL, 0x0,
1094         NULL, HFILL }},
1095     { &hf_dtpt_sockaddr_length,
1096       { "Length", "dtpt.sockaddr.length",
1097         FT_UINT16, BASE_DEC, NULL, 0x0,
1098         "Socket Address Length", HFILL }},
1099     { &hf_dtpt_sockaddr_family,
1100       { "Family", "dtpt.sockaddr.family",
1101         FT_UINT16, BASE_DEC, VALS(names_family), 0x0,
1102         "Socket Address Family", HFILL }},
1103     { &hf_dtpt_sockaddr_port,
1104       { "Port", "dtpt.sockaddr.port",
1105         FT_UINT16, BASE_DEC, NULL, 0x0,
1106         "Socket Address Port", HFILL }},
1107     { &hf_dtpt_sockaddr_address,
1108       { "Address", "dtpt.sockaddr.address",
1109         FT_IPv4, BASE_NONE, NULL, 0x0,
1110         "Socket Address Address", HFILL }},
1111     { &hf_dtpt_blob_rawsize,
1112       { "Blob Size", "dtpt.blob_size",
1113         FT_UINT32, BASE_DEC, NULL, 0x0,
1114         "Size of the binary BLOB", HFILL }},
1115     { &hf_dtpt_blob_size,
1116       { "cbSize", "dtpt.blob.cbSize",
1117         FT_UINT32, BASE_DEC, NULL, 0x0,
1118         "cbSize field in BLOB", HFILL }},
1119     { &hf_dtpt_blob_data_pointer,
1120       { "pBlobData", "dtpt.blob.pBlobData",
1121         FT_UINT32, BASE_HEX, NULL, 0x0,
1122         "pBlobData field in BLOB", HFILL }},
1123     { &hf_dtpt_blob_data_length,
1124       { "Length", "dtpt.blob.data_length",
1125         FT_UINT32, BASE_DEC, NULL, 0x0,
1126         "Length of the Blob Data Block", HFILL }},
1127     { &hf_dtpt_blob_data,
1128       { "Data", "dtpt.blob.data",
1129         FT_BYTES, BASE_NONE, NULL, 0x0,
1130         "Blob Data Block", HFILL }},
1131     { &hf_dtpt_connect_addr,
1132       { "Address", "dtpt.blob.data",
1133         FT_UINT32, BASE_DEC, NULL, 0x0,
1134         "Connect to Address", HFILL }},
1135   };
1136         static gint *ett[] = {
1137                 &ett_dtpt,
1138                 &ett_dtpt_flags,
1139                 &ett_dtpt_queryset,
1140                 &ett_dtpt_wstring,
1141                 &ett_dtpt_guid,
1142                 &ett_dtpt_protocols,
1143                 &ett_dtpt_protocol,
1144                 &ett_dtpt_cs_addrs,
1145                 &ett_dtpt_cs_addr1,
1146                 &ett_dtpt_cs_addr2,
1147                 &ett_dtpt_sockaddr,
1148                 &ett_dtpt_blobraw,
1149                 &ett_dtpt_blob,
1150         };
1151         module_t *dtpt_module;
1152         e_guid_t guid_svcid_inet_hostaddrbyname       = {0x0002A803, 0x0000, 0x0000, {0xC0,0,0,0,0,0,0,0x46}};
1153         e_guid_t guid_svcid_inet_hostaddrbyinetstring = {0x0002A801, 0x0000, 0x0000, {0xC0,0,0,0,0,0,0,0x46}};
1154         guids_add_guid(&guid_svcid_inet_hostaddrbyname,       "SVCID_INET_HOSTADDRBYNAME");
1155         guids_add_guid(&guid_svcid_inet_hostaddrbyinetstring, "SVCID_INET_HOSTADDRBYINETSTRING");
1156
1157         proto_dtpt = proto_register_protocol("DeskTop PassThrough Protocol",
1158                                         "DTPT", "dtpt");
1159         proto_register_field_array(proto_dtpt, hf, array_length(hf));
1160         proto_register_subtree_array(ett, array_length(ett));
1161
1162         /* Register a configuration option for port */
1163         dtpt_module = prefs_register_protocol(proto_dtpt,
1164                 proto_reg_handoff_dtpt);
1165         prefs_register_uint_preference(dtpt_module, "tcp.port",
1166                                         "DTPT Server TCP Port",
1167                                         "Set the TDP port for the DTPT Server",
1168                                         10, &gbl_dtptServerPort);
1169 }
1170
1171
1172 void
1173 proto_reg_handoff_dtpt(void)
1174 {
1175         static dissector_handle_t       dtpt_handle;
1176         static gboolean Initialized=FALSE;
1177         static int ServerPort;
1178
1179         if (!Initialized) {
1180                 dtpt_handle = new_create_dissector_handle(dissect_dtpt, proto_dtpt);
1181                 dtpt_conversation_handle = new_create_dissector_handle(dissect_dtpt_conversation, proto_dtpt);
1182 /**             dtpt_data_handle = new_create_dissector_handle(dissect_dtpt_data, proto_dtpt); **/
1183
1184                 data_handle = find_dissector("data");
1185                 Initialized=TRUE;
1186         } else {
1187                 dissector_delete_uint("tcp.port", ServerPort, dtpt_handle);
1188         }
1189
1190         /* set port for future deletes */
1191         ServerPort=gbl_dtptServerPort;
1192
1193         dissector_add_uint("tcp.port", gbl_dtptServerPort, dtpt_handle);
1194 }
1195
1196