packet-dcerpc-netlogon.c

   1 /* packet-dcerpc-netlogon.c
   2  * Routines for SMB \\PIPE\\NETLOGON packet disassembly
   3  * Copyright 2001, Tim Potter <tpot@samba.org>
   4  *  2002 structure and command dissectors by Ronnie Sahlberg
   5  *
   6  * $Id: packet-dcerpc-netlogon.c,v 1.61 2002/11/04 11:52:36 sahlberg Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <epan/packet.h>
  33 #include "packet-dcerpc.h"
  34 #include "packet-dcerpc-nt.h"
  35 #include "packet-dcerpc-netlogon.h"
  36 #include "smb.h"        /* for "NT_errors[]" */
  37 #include "packet-smb-common.h"
  38 #include "packet-dcerpc-lsa.h"
  39
  40 static int proto_dcerpc_netlogon = -1;
  41 static int hf_netlogon_opnum = -1;
  42 static int hf_netlogon_guid = -1;
  43 static int hf_netlogon_rc = -1;
  44 static int hf_netlogon_len = -1;
  45 static int hf_netlogon_sensitive_data_flag = -1;
  46 static int hf_netlogon_sensitive_data_len = -1;
  47 static int hf_netlogon_sensitive_data = -1;
  48 static int hf_netlogon_security_information = -1;
  49 static int hf_netlogon_dummy = -1;
  50 static int hf_netlogon_neg_flags = -1;
  51 static int hf_netlogon_minworkingsetsize = -1;
  52 static int hf_netlogon_maxworkingsetsize = -1;
  53 static int hf_netlogon_pagedpoollimit = -1;
  54 static int hf_netlogon_pagefilelimit = -1;
  55 static int hf_netlogon_timelimit = -1;
  56 static int hf_netlogon_nonpagedpoollimit = -1;
  57 static int hf_netlogon_pac_size = -1;
  58 static int hf_netlogon_pac_data = -1;
  59 static int hf_netlogon_auth_size = -1;
  60 static int hf_netlogon_auth_data = -1;
  61 static int hf_netlogon_cipher_len = -1;
  62 static int hf_netlogon_cipher_maxlen = -1;
  63 static int hf_netlogon_cipher_current_data = -1;
  64 static int hf_netlogon_cipher_current_set_time = -1;
  65 static int hf_netlogon_cipher_old_data = -1;
  66 static int hf_netlogon_cipher_old_set_time = -1;
  67 static int hf_netlogon_priv = -1;
  68 static int hf_netlogon_privilege_entries = -1;
  69 static int hf_netlogon_privilege_control = -1;
  70 static int hf_netlogon_privilege_name = -1;
  71 static int hf_netlogon_systemflags = -1;
  72 static int hf_netlogon_pdc_connection_status = -1;
  73 static int hf_netlogon_tc_connection_status = -1;
  74 static int hf_netlogon_restart_state = -1;
  75 static int hf_netlogon_attrs = -1;
  76 static int hf_netlogon_count = -1;
  77 static int hf_netlogon_entries = -1;
  78 static int hf_netlogon_minpasswdlen = -1;
  79 static int hf_netlogon_passwdhistorylen = -1;
  80 static int hf_netlogon_level16 = -1;
  81 static int hf_netlogon_validation_level = -1;
  82 static int hf_netlogon_reference = -1;
  83 static int hf_netlogon_next_reference = -1;
  84 static int hf_netlogon_timestamp = -1;
  85 static int hf_netlogon_level = -1;
  86 static int hf_netlogon_challenge = -1;
  87 static int hf_netlogon_reserved = -1;
  88 static int hf_netlogon_audit_retention_period = -1;
  89 static int hf_netlogon_auditing_mode = -1;
  90 static int hf_netlogon_max_audit_event_count = -1;
  91 static int hf_netlogon_event_audit_option = -1;
  92 static int hf_netlogon_unknown_string = -1;
  93 static int hf_netlogon_unknown_long = -1;
  94 static int hf_netlogon_unknown_short = -1;
  95 static int hf_netlogon_unknown_char = -1;
  96 static int hf_netlogon_logon_time = -1;
  97 static int hf_netlogon_logoff_time = -1;
  98 static int hf_netlogon_kickoff_time = -1;
  99 static int hf_netlogon_pwd_last_set_time = -1;
 100 static int hf_netlogon_pwd_can_change_time = -1;
 101 static int hf_netlogon_pwd_must_change_time = -1;
 102 static int hf_netlogon_nt_chal_resp = -1;
 103 static int hf_netlogon_lm_chal_resp = -1;
 104 static int hf_netlogon_credential = -1;
 105 static int hf_netlogon_acct_name = -1;
 106 static int hf_netlogon_acct_desc = -1;
 107 static int hf_netlogon_group_desc = -1;
 108 static int hf_netlogon_full_name = -1;
 109 static int hf_netlogon_comment = -1;
 110 static int hf_netlogon_parameters = -1;
 111 static int hf_netlogon_logon_script = -1;
 112 static int hf_netlogon_profile_path = -1;
 113 static int hf_netlogon_home_dir = -1;
 114 static int hf_netlogon_dir_drive = -1;
 115 static int hf_netlogon_logon_count = -1;
 116 static int hf_netlogon_logon_count16 = -1;
 117 static int hf_netlogon_bad_pw_count = -1;
 118 static int hf_netlogon_bad_pw_count16 = -1;
 119 static int hf_netlogon_user_rid = -1;
 120 static int hf_netlogon_alias_rid = -1;
 121 static int hf_netlogon_group_rid = -1;
 122 static int hf_netlogon_logon_srv = -1;
 123 static int hf_netlogon_principal = -1;
 124 static int hf_netlogon_logon_dom = -1;
 125 static int hf_netlogon_downlevel_domain_name = -1;
 126 static int hf_netlogon_dns_domain_name = -1;
 127 static int hf_netlogon_domain_name = -1;
 128 static int hf_netlogon_domain_create_time = -1;
 129 static int hf_netlogon_domain_modify_time = -1;
 130 static int hf_netlogon_modify_count = -1;
 131 static int hf_netlogon_db_modify_time = -1;
 132 static int hf_netlogon_db_create_time = -1;
 133 static int hf_netlogon_oem_info = -1;
 134 static int hf_netlogon_serial_number = -1;
 135 static int hf_netlogon_num_rids = -1;
 136 static int hf_netlogon_num_controllers = -1;
 137 static int hf_netlogon_num_other_groups = -1;
 138 static int hf_netlogon_computer_name = -1;
 139 static int hf_netlogon_site_name = -1;
 140 static int hf_netlogon_trusted_dc_name = -1;
 141 static int hf_netlogon_dc_name = -1;
 142 static int hf_netlogon_dc_site_name = -1;
 143 static int hf_netlogon_dns_forest_name = -1;
 144 static int hf_netlogon_dc_address = -1;
 145 static int hf_netlogon_dc_address_type = -1;
 146 static int hf_netlogon_client_site_name = -1;
 147 static int hf_netlogon_workstation = -1;
 148 static int hf_netlogon_workstation_site_name = -1;
 149 static int hf_netlogon_workstation_os = -1;
 150 static int hf_netlogon_workstations = -1;
 151 static int hf_netlogon_workstation_fqdn = -1;
 152 static int hf_netlogon_group_name = -1;
 153 static int hf_netlogon_alias_name = -1;
 154 static int hf_netlogon_country = -1;
 155 static int hf_netlogon_codepage = -1;
 156 static int hf_netlogon_flags = -1;
 157 static int hf_netlogon_user_flags = -1;
 158 static int hf_netlogon_auth_flags = -1;
 159 static int hf_netlogon_pwd_expired = -1;
 160 static int hf_netlogon_nt_pwd_present = -1;
 161 static int hf_netlogon_lm_pwd_present = -1;
 162 static int hf_netlogon_code = -1;
 163 static int hf_netlogon_database_id = -1;
 164 static int hf_netlogon_sync_context = -1;
 165 static int hf_netlogon_max_size = -1;
 166 static int hf_netlogon_max_log_size = -1;
 167 static int hf_netlogon_dns_host = -1;
 168 static int hf_netlogon_acct_expiry_time = -1;
 169 static int hf_netlogon_encrypted_lm_owf_password = -1;
 170 static int hf_netlogon_lm_owf_password = -1;
 171 static int hf_netlogon_nt_owf_password = -1;
 172 static int hf_netlogon_param_ctrl = -1;
 173 static int hf_netlogon_logon_id = -1;
 174 static int hf_netlogon_num_deltas = -1;
 175 static int hf_netlogon_user_session_key = -1;
 176 static int hf_netlogon_blob_size = -1;
 177 static int hf_netlogon_blob = -1;
 178 static int hf_netlogon_logon_attempts = -1;
 179 static int hf_netlogon_authoritative = -1;
 180 static int hf_netlogon_secure_channel_type = -1;
 181 static int hf_netlogon_logonsrv_handle = -1;
 182 static int hf_netlogon_delta_type = -1;
 183
 184 static gint ett_dcerpc_netlogon = -1;
 185 static gint ett_QUOTA_LIMITS = -1;
 186 static gint ett_IDENTITY_INFO = -1;
 187 static gint ett_DELTA_ENUM = -1;
 188 static gint ett_CYPHER_VALUE = -1;
 189 static gint ett_UNICODE_MULTI = -1;
 190 static gint ett_DOMAIN_CONTROLLER_INFO = -1;
 191 static gint ett_UNICODE_STRING_512 = -1;
 192 static gint ett_TYPE_50 = -1;
 193 static gint ett_TYPE_52 = -1;
 194 static gint ett_DELTA_ID_UNION = -1;
 195 static gint ett_TYPE_44 = -1;
 196 static gint ett_DELTA_UNION = -1;
 197 static gint ett_LM_OWF_PASSWORD = -1;
 198 static gint ett_NT_OWF_PASSWORD = -1;
 199 static gint ett_GROUP_MEMBERSHIP = -1;
 200 static gint ett_BLOB = -1;
 201 static gint ett_DSROLE_DOMAIN_INFO_EX = -1;
 202
 203 static e_uuid_t uuid_dcerpc_netlogon = {
 204         0x12345678, 0x1234, 0xabcd,
 205         { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0xcf, 0xfb }
 206 };
 207
 208 static guint16 ver_dcerpc_netlogon = 1;
 209
 210
 211
 212 static int
 213 netlogon_dissect_LOGONSRV_HANDLE(tvbuff_t *tvb, int offset,
 214                         packet_info *pinfo, proto_tree *tree,
 215                         char *drep)
 216 {
 217         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 218                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 219                 "Server Handle", hf_netlogon_logonsrv_handle, 0);
 220
 221         return offset;
 222 }
 223
 224 /*
 225  * IDL typedef struct {
 226  * IDL    [unique][string] wchar_t *effective_name;
 227  * IDL    long priv;
 228  * IDL    long auth_flags;
 229  * IDL    long logon_count;
 230  * IDL    long bad_pw_count;
 231  * IDL    long last_logon;
 232  * IDL    long last_logoff;
 233  * IDL    long logoff_time;
 234  * IDL    long kickoff_time;
 235  * IDL    long password_age;
 236  * IDL    long pw_can_change;
 237  * IDL    long pw_must_change;
 238  * IDL    [unique][string] wchar_t *computer;
 239  * IDL    [unique][string] wchar_t *domain;
 240  * IDL    [unique][string] wchar_t *script_path;
 241  * IDL    long reserved;
 242  */
 243 static int
 244 netlogon_dissect_VALIDATION_UAS_INFO(tvbuff_t *tvb, int offset,
 245                         packet_info *pinfo, proto_tree *tree,
 246                         char *drep)
 247 {
 248         dcerpc_info *di;
 249
 250         di=pinfo->private_data;
 251         if(di->conformant_run){
 252                 /*just a run to handle conformant arrays, nothing to dissect */
 253                 return offset;
 254         }
 255
 256         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 257                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 258                 "Effective Account", hf_netlogon_acct_name, 0);
 259
 260         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 261                 hf_netlogon_priv, NULL);
 262
 263         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 264                 hf_netlogon_auth_flags, NULL);
 265
 266         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 267                 hf_netlogon_logon_count, NULL);
 268
 269         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 270                 hf_netlogon_bad_pw_count, NULL);
 271
 272         /* XXX - are these all UNIX "time_t"s, like the time stamps in
 273            credentials?
 274
 275            Or are they, as per some RAP-based operations, UTIMEs? */
 276         proto_tree_add_text(tree, tvb, offset, 4, "Last Logon: unknown time format");
 277         offset+= 4;
 278
 279         proto_tree_add_text(tree, tvb, offset, 4, "Last Logoff: unknown time format");
 280         offset+= 4;
 281
 282         proto_tree_add_text(tree, tvb, offset, 4, "Logoff Time: unknown time format");
 283         offset+= 4;
 284
 285         proto_tree_add_text(tree, tvb, offset, 4, "Kickoff Time: unknown time format");
 286         offset+= 4;
 287
 288         proto_tree_add_text(tree, tvb, offset, 4, "Password Age: unknown time format");
 289         offset+= 4;
 290
 291         proto_tree_add_text(tree, tvb, offset, 4, "PW Can Change: unknown time format");
 292         offset+= 4;
 293
 294         proto_tree_add_text(tree, tvb, offset, 4, "PW Must Change: unknown time format");
 295         offset+= 4;
 296
 297         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 298                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 299                 "Computer", hf_netlogon_computer_name, 0);
 300
 301         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 302                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 303                 "Domain", hf_netlogon_domain_name, 0);
 304
 305         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 306                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 307                 "Script", hf_netlogon_logon_script, 0);
 308
 309         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 310                 hf_netlogon_reserved, NULL);
 311
 312         return offset;
 313 }
 314
 315 /*
 316  * IDL long NetLogonUasLogon(
 317  * IDL      [in][unique][string] wchar_t *ServerName,
 318  * IDL      [in][ref][string] wchar_t *UserName,
 319  * IDL      [in][ref][string] wchar_t *Workstation,
 320  * IDL      [out][unique] VALIDATION_UAS_INFO *info
 321  * IDL );
 322  */
 323 static int
 324 netlogon_dissect_netlogonuaslogon_rqst(tvbuff_t *tvb, int offset,
 325         packet_info *pinfo, proto_tree *tree, char *drep)
 326 {
 327         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
 328                 pinfo, tree, drep);
 329
 330         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 331                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
 332                 "Account", hf_netlogon_acct_name, 0);
 333
 334         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 335                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
 336                 "Workstation", hf_netlogon_workstation, 0);
 337
 338         return offset;
 339 }
 340
 341
 342 static int
 343 netlogon_dissect_netlogonuaslogon_reply(tvbuff_t *tvb, int offset,
 344         packet_info *pinfo, proto_tree *tree, char *drep)
 345 {
 346         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 347                 netlogon_dissect_VALIDATION_UAS_INFO, NDR_POINTER_UNIQUE,
 348                 "VALIDATION_UAS_INFO", -1, 0);
 349
 350         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
 351                                   hf_netlogon_rc, NULL);
 352
 353         return offset;
 354 }
 355
 356 /*
 357  * IDL typedef struct {
 358  * IDL   long duration;
 359  * IDL   short logon_count;
 360  * IDL } LOGOFF_UAS_INFO;
 361  */
 362 static int
 363 netlogon_dissect_LOGOFF_UAS_INFO(tvbuff_t *tvb, int offset,
 364                         packet_info *pinfo, proto_tree *tree,
 365                         char *drep)
 366 {
 367         dcerpc_info *di;
 368
 369         di=pinfo->private_data;
 370         if(di->conformant_run){
 371                 /*just a run to handle conformant arrays, nothing to dissect */
 372                 return offset;
 373         }
 374
 375         proto_tree_add_text(tree, tvb, offset, 4, "Duration: unknown time format");
 376         offset+= 4;
 377
 378         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 379                 hf_netlogon_logon_count16, NULL);
 380
 381         return offset;
 382 }
 383
 384 /*
 385  * IDL long NetLogonUasLogoff(
 386  * IDL      [in][unique][string] wchar_t *ServerName,
 387  * IDL      [in][ref][string] wchar_t *UserName,
 388  * IDL      [in][ref][string] wchar_t *Workstation,
 389  * IDL      [out][ref] LOGOFF_UAS_INFO *info
 390  * IDL );
 391  */
 392 static int
 393 netlogon_dissect_netlogonuaslogoff_rqst(tvbuff_t *tvb, int offset,
 394         packet_info *pinfo, proto_tree *tree, char *drep)
 395 {
 396         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
 397                 pinfo, tree, drep);
 398
 399         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 400                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
 401                 "Account", hf_netlogon_acct_name, 0);
 402
 403         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 404                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
 405                 "Workstation", hf_netlogon_workstation, 0);
 406
 407         return offset;
 408 }
 409
 410
 411 static int
 412 netlogon_dissect_netlogonuaslogoff_reply(tvbuff_t *tvb, int offset,
 413         packet_info *pinfo, proto_tree *tree, char *drep)
 414 {
 415         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 416                 netlogon_dissect_LOGOFF_UAS_INFO, NDR_POINTER_REF,
 417                 "LOGOFF_UAS_INFO", -1, 0);
 418
 419         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
 420                                   hf_netlogon_rc, NULL);
 421
 422         return offset;
 423 }
 424
 425
 426
 427
 428 /*
 429  * IDL typedef struct {
 430  * IDL   UNICODESTRING LogonDomainName;
 431  * IDL   long ParameterControl;
 432  * IDL   uint64 LogonID;
 433  * IDL   UNICODESTRING UserName;
 434  * IDL   UNICODESTRING Workstation;
 435  * IDL } LOGON_IDENTITY_INFO;
 436  */
 437 static int
 438 netlogon_dissect_LOGON_IDENTITY_INFO(tvbuff_t *tvb, int offset,
 439                         packet_info *pinfo, proto_tree *parent_tree,
 440                         char *drep)
 441 {
 442         proto_item *item=NULL;
 443         proto_tree *tree=NULL;
 444         int old_offset=offset;
 445
 446         if(parent_tree){
 447                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 448                         "IDENTITY_INFO:");
 449                 tree = proto_item_add_subtree(item, ett_IDENTITY_INFO);
 450         }
 451
 452         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 453                 hf_netlogon_logon_dom, 0);
 454
 455         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 456                 hf_netlogon_param_ctrl, NULL);
 457
 458         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 459                 hf_netlogon_logon_id, NULL);
 460
 461         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 462                 hf_netlogon_acct_name, 0);
 463
 464         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 465                 hf_netlogon_workstation, 0);
 466
 467 #ifdef REMOVED
 468         /* NetMon does not recognize these bytes. Ill comment them out until someone complains */
 469         /* XXX 8 extra bytes here */
 470         /* there were 8 extra bytes, either here or in NETWORK_INFO that does not match
 471            the idl file. Could be a bug in either the NETLOGON implementation or in the
 472            idl file.
 473         */
 474         offset = netlogon_dissect_8_unknown_bytes(tvb, offset, pinfo, tree, drep);
 475 #endif
 476
 477         proto_item_set_len(item, offset-old_offset);
 478         return offset;
 479 }
 480
 481
 482 /*
 483  * IDL typedef struct {
 484  * IDL   char password[16];
 485  * IDL } LM_OWF_PASSWORD;
 486  */
 487 static int
 488 netlogon_dissect_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 489                         packet_info *pinfo, proto_tree *parent_tree,
 490                         char *drep _U_)
 491 {
 492         proto_item *item=NULL;
 493         proto_tree *tree=NULL;
 494         dcerpc_info *di;
 495
 496         di=pinfo->private_data;
 497         if(di->conformant_run){
 498                 /*just a run to handle conformant arrays, nothing to dissect.*/
 499                 return offset;
 500         }
 501
 502         if(parent_tree){
 503                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 504                         "LM_OWF_PASSWORD:");
 505                 tree = proto_item_add_subtree(item, ett_LM_OWF_PASSWORD);
 506         }
 507
 508         proto_tree_add_item(tree, hf_netlogon_lm_owf_password, tvb, offset, 16,
 509                 FALSE);
 510         offset += 16;
 511
 512         return offset;
 513 }
 514
 515 /*
 516  * IDL typedef struct {
 517  * IDL   char password[16];
 518  * IDL } NT_OWF_PASSWORD;
 519  */
 520 static int
 521 netlogon_dissect_NT_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 522                         packet_info *pinfo, proto_tree *parent_tree,
 523                         char *drep _U_)
 524 {
 525         proto_item *item=NULL;
 526         proto_tree *tree=NULL;
 527         dcerpc_info *di;
 528
 529         di=pinfo->private_data;
 530         if(di->conformant_run){
 531                 /*just a run to handle conformant arrays, nothing to dissect.*/
 532                 return offset;
 533         }
 534
 535         if(parent_tree){
 536                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 537                         "NT_OWF_PASSWORD:");
 538                 tree = proto_item_add_subtree(item, ett_NT_OWF_PASSWORD);
 539         }
 540
 541         proto_tree_add_item(tree, hf_netlogon_nt_owf_password, tvb, offset, 16,
 542                 FALSE);
 543         offset += 16;
 544
 545         return offset;
 546 }
 547
 548
 549 /*
 550  * IDL typedef struct {
 551  * IDL   LOGON_IDENTITY_INFO identity_info;
 552  * IDL   LM_OWF_PASSWORD lmpassword;
 553  * IDL   NT_OWF_PASSWORD ntpassword;
 554  * IDL } INTERACTIVE_INFO;
 555  */
 556 static int
 557 netlogon_dissect_INTERACTIVE_INFO(tvbuff_t *tvb, int offset,
 558                         packet_info *pinfo, proto_tree *tree,
 559                         char *drep)
 560 {
 561         offset = netlogon_dissect_LOGON_IDENTITY_INFO(tvb, offset,
 562                 pinfo, tree, drep);
 563
 564         offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
 565                 pinfo, tree, drep);
 566
 567         offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
 568                 pinfo, tree, drep);
 569
 570         return offset;
 571 }
 572
 573 /*
 574  * IDL typedef struct {
 575  * IDL   char chl[8];
 576  * IDL } CHALLENGE;
 577  */
 578 static int
 579 netlogon_dissect_CHALLENGE(tvbuff_t *tvb, int offset,
 580                         packet_info *pinfo, proto_tree *tree,
 581                         char *drep _U_)
 582 {
 583         dcerpc_info *di;
 584
 585         di=pinfo->private_data;
 586         if(di->conformant_run){
 587                 /*just a run to handle conformant arrays, nothing to dissect.*/
 588                 return offset;
 589         }
 590
 591         proto_tree_add_item(tree, hf_netlogon_challenge, tvb, offset, 8,
 592                 FALSE);
 593         offset += 8;
 594
 595         return offset;
 596 }
 597
 598 /*
 599  * IDL typedef struct {
 600  * IDL   LOGON_IDENTITY_INFO logon_info;
 601  * IDL   CHALLENGE chal;
 602  * IDL   STRING ntchallengeresponse;
 603  * IDL   STRING lmchallengeresponse;
 604  * IDL } NETWORK_INFO;
 605  */
 606 static int
 607 netlogon_dissect_NETWORK_INFO(tvbuff_t *tvb, int offset,
 608                 packet_info *pinfo, proto_tree *tree,
 609                 char *drep)
 610 {
 611         offset = netlogon_dissect_LOGON_IDENTITY_INFO(tvb, offset,
 612                 pinfo, tree, drep);
 613
 614         offset = netlogon_dissect_CHALLENGE(tvb, offset,
 615                 pinfo, tree, drep);
 616
 617         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 618                 hf_netlogon_nt_chal_resp, 0);
 619
 620         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 621                 hf_netlogon_lm_chal_resp, 0);
 622
 623         return offset;
 624 }
 625
 626 /*
 627  * IDL typedef struct {
 628  * IDL   LOGON_IDENTITY_INFO logon_info;
 629  * IDL   LM_OWF_PASSWORD lmpassword;
 630  * IDL   NT_OWF_PASSWORD ntpassword;
 631  * IDL } SERVICE_INFO;
 632  */
 633 static int
 634 netlogon_dissect_SERVICE_INFO(tvbuff_t *tvb, int offset,
 635                 packet_info *pinfo, proto_tree *tree,
 636                 char *drep)
 637 {
 638         offset = netlogon_dissect_LOGON_IDENTITY_INFO(tvb, offset,
 639                 pinfo, tree, drep);
 640
 641         offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
 642                 pinfo, tree, drep);
 643
 644         offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
 645                 pinfo, tree, drep);
 646
 647         return offset;
 648 }
 649
 650 /*
 651  * IDL typedef [switch_type(short)] union {
 652  * IDL    [case(1)][unique] INTERACTIVE_INFO *iinfo;
 653  * IDL    [case(2)][unique] NETWORK_INFO *ninfo;
 654  * IDL    [case(3)][unique] SERVICE_INFO *sinfo;
 655  * IDL } LEVEL;
 656  */
 657 static int
 658 netlogon_dissect_LEVEL(tvbuff_t *tvb, int offset,
 659                         packet_info *pinfo, proto_tree *tree,
 660                         char *drep)
 661 {
 662         guint16 level;
 663
 664         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 665                 hf_netlogon_level16, &level);
 666
 667         ALIGN_TO_4_BYTES;
 668         switch(level){
 669         case 1:
 670                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 671                         netlogon_dissect_INTERACTIVE_INFO, NDR_POINTER_UNIQUE,
 672                         "INTERACTIVE_INFO:", -1, 0);
 673                 break;
 674         case 2:
 675                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 676                         netlogon_dissect_NETWORK_INFO, NDR_POINTER_UNIQUE,
 677                         "NETWORK_INFO:", -1, 0);
 678                 break;
 679         case 3:
 680                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 681                         netlogon_dissect_SERVICE_INFO, NDR_POINTER_UNIQUE,
 682                         "SERVICE_INFO:", -1, 0);
 683                 break;
 684         }
 685
 686         return offset;
 687 }
 688
 689 /*
 690  * IDL typedef struct {
 691  * IDL   char cred[8];
 692  * IDL } CREDENTIAL;
 693  */
 694 static int
 695 netlogon_dissect_CREDENTIAL(tvbuff_t *tvb, int offset,
 696                         packet_info *pinfo, proto_tree *tree,
 697                         char *drep _U_)
 698 {
 699         dcerpc_info *di;
 700
 701         di=pinfo->private_data;
 702         if(di->conformant_run){
 703                 /*just a run to handle conformant arrays, nothing to dissect.*/
 704                 return offset;
 705         }
 706
 707         proto_tree_add_item(tree, hf_netlogon_credential, tvb, offset, 8,
 708                 FALSE);
 709         offset += 8;
 710
 711         return offset;
 712 }
 713
 714
 715 /*
 716  * IDL typedef struct {
 717  * IDL   CREDENTIAL cred;
 718  * IDL   long timestamp;
 719  * IDL } AUTHENTICATOR;
 720  */
 721 static int
 722 netlogon_dissect_AUTHENTICATOR(tvbuff_t *tvb, int offset,
 723                         packet_info *pinfo, proto_tree *tree,
 724                         char *drep)
 725 {
 726         dcerpc_info *di;
 727         nstime_t ts;
 728
 729         di=pinfo->private_data;
 730         if(di->conformant_run){
 731                 /*just a run to handle conformant arrays, nothing to dissect */
 732                 return offset;
 733         }
 734
 735         offset = netlogon_dissect_CREDENTIAL(tvb, offset,
 736                 pinfo, tree, drep);
 737
 738         /*
 739          * XXX - this appears to be a UNIX time_t in some credentials, but
 740          * appears to be random junk in other credentials.
 741          * For example, it looks like a UNIX time_t in "credential"
 742          * AUTHENTICATORs, but like random junk in "return_authenticator"
 743          * AUTHENTICATORs.
 744          */
 745         ALIGN_TO_4_BYTES;
 746         ts.secs = tvb_get_letohl(tvb, offset);
 747         ts.nsecs = 0;
 748         proto_tree_add_time(tree, hf_netlogon_timestamp, tvb, offset, 4, &ts);
 749         offset+= 4;
 750
 751         return offset;
 752 }
 753
 754
 755 /*
 756  * IDL typedef struct {
 757  * IDL   long user_id;
 758  * IDL   long attributes;
 759  * IDL } GROUP_MEMBERSHIP;
 760  */
 761 static int
 762 netlogon_dissect_GROUP_MEMBERSHIP(tvbuff_t *tvb, int offset,
 763                         packet_info *pinfo, proto_tree *parent_tree,
 764                         char *drep)
 765 {
 766         proto_item *item=NULL;
 767         proto_tree *tree=NULL;
 768
 769         if(parent_tree){
 770                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 771                         "GROUP_MEMBERSHIP:");
 772                 tree = proto_item_add_subtree(item, ett_GROUP_MEMBERSHIP);
 773         }
 774
 775         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 776                 hf_netlogon_user_rid, NULL);
 777
 778         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 779                 hf_netlogon_attrs, NULL);
 780
 781         return offset;
 782 }
 783
 784 static int
 785 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY(tvbuff_t *tvb, int offset,
 786                         packet_info *pinfo, proto_tree *tree,
 787                         char *drep)
 788 {
 789         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 790                 netlogon_dissect_GROUP_MEMBERSHIP);
 791
 792         return offset;
 793 }
 794
 795 /*
 796  * IDL typedef struct {
 797  * IDL   char user_session_key[16];
 798  * IDL } USER_SESSION_KEY;
 799  */
 800 static int
 801 netlogon_dissect_USER_SESSION_KEY(tvbuff_t *tvb, int offset,
 802                         packet_info *pinfo, proto_tree *tree,
 803                         char *drep _U_)
 804 {
 805         dcerpc_info *di;
 806
 807         di=pinfo->private_data;
 808         if(di->conformant_run){
 809                 /*just a run to handle conformant arrays, nothing to dissect.*/
 810                 return offset;
 811         }
 812
 813         proto_tree_add_item(tree, hf_netlogon_user_session_key, tvb, offset, 16,
 814                 FALSE);
 815         offset += 16;
 816
 817         return offset;
 818 }
 819
 820 /*
 821  * IDL typedef struct {
 822  * IDL   uint64 LogonTime;
 823  * IDL   uint64 LogoffTime;
 824  * IDL   uint64 KickOffTime;
 825  * IDL   uint64 PasswdLastSet;
 826  * IDL   uint64 PasswdCanChange;
 827  * IDL   uint64 PasswdMustChange;
 828  * IDL   unicodestring effectivename;
 829  * IDL   unicodestring fullname;
 830  * IDL   unicodestring logonscript;
 831  * IDL   unicodestring profilepath;
 832  * IDL   unicodestring homedirectory;
 833  * IDL   unicodestring homedirectorydrive;
 834  * IDL   short LogonCount;
 835  * IDL   short BadPasswdCount;
 836  * IDL   long userid;
 837  * IDL   long primarygroup;
 838  * IDL   long groupcount;
 839  * IDL   [unique][size_is(groupcount)] GROUP_MEMBERSHIP *groupids;
 840  * IDL   long userflags;
 841  * IDL   USER_SESSION_KEY key;
 842  * IDL   unicodestring logonserver;
 843  * IDL   unicodestring domainname;
 844  * IDL   [unique] SID logondomainid;
 845  * IDL   long expansionroom[10];
 846  * IDL } VALIDATION_SAM_INFO;
 847  */
 848 static int
 849 netlogon_dissect_VALIDATION_SAM_INFO(tvbuff_t *tvb, int offset,
 850                 packet_info *pinfo, proto_tree *tree,
 851                 char *drep)
 852 {
 853         int i;
 854
 855         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 856                 hf_netlogon_logon_time);
 857
 858         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 859                 hf_netlogon_logoff_time);
 860
 861         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 862                 hf_netlogon_kickoff_time);
 863
 864         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 865                 hf_netlogon_pwd_last_set_time);
 866
 867         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 868                 hf_netlogon_pwd_can_change_time);
 869
 870         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 871                 hf_netlogon_pwd_must_change_time);
 872
 873         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 874                 hf_netlogon_acct_name, 0);
 875
 876         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 877                 hf_netlogon_full_name, 0);
 878
 879         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 880                 hf_netlogon_logon_script, 0);
 881
 882         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 883                 hf_netlogon_profile_path, 0);
 884
 885         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 886                 hf_netlogon_home_dir, 0);
 887
 888         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 889                 hf_netlogon_dir_drive, 0);
 890
 891         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 892                 hf_netlogon_logon_count16, NULL);
 893
 894         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 895                 hf_netlogon_bad_pw_count16, NULL);
 896
 897         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 898                 hf_netlogon_user_rid, NULL);
 899
 900         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 901                 hf_netlogon_group_rid, NULL);
 902
 903         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 904                 hf_netlogon_num_rids, NULL);
 905
 906         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 907                 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE,
 908                 "GROUP_MEMBERSHIP_ARRAY", -1, 0);
 909
 910         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 911                 hf_netlogon_user_flags, NULL);
 912
 913         offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
 914                 pinfo, tree, drep);
 915
 916         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 917                 hf_netlogon_logon_srv, 0);
 918
 919         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 920                 hf_netlogon_logon_dom, 0);
 921
 922         offset = dissect_ndr_nt_PSID(tvb, offset,
 923                 pinfo, tree, drep);
 924
 925         for(i=0;i<10;i++){
 926                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 927                         hf_netlogon_reserved, NULL);
 928         }
 929
 930         return offset;
 931 }
 932
 933
 934
 935 /*
 936  * IDL typedef struct {
 937  * IDL   uint64 LogonTime;
 938  * IDL   uint64 LogoffTime;
 939  * IDL   uint64 KickOffTime;
 940  * IDL   uint64 PasswdLastSet;
 941  * IDL   uint64 PasswdCanChange;
 942  * IDL   uint64 PasswdMustChange;
 943  * IDL   unicodestring effectivename;
 944  * IDL   unicodestring fullname;
 945  * IDL   unicodestring logonscript;
 946  * IDL   unicodestring profilepath;
 947  * IDL   unicodestring homedirectory;
 948  * IDL   unicodestring homedirectorydrive;
 949  * IDL   short LogonCount;
 950  * IDL   short BadPasswdCount;
 951  * IDL   long userid;
 952  * IDL   long primarygroup;
 953  * IDL   long groupcount;
 954  * IDL   [unique] GROUP_MEMBERSHIP *groupids;
 955  * IDL   long userflags;
 956  * IDL   USER_SESSION_KEY key;
 957  * IDL   unicodestring logonserver;
 958  * IDL   unicodestring domainname;
 959  * IDL   [unique] SID logondomainid;
 960  * IDL   long expansionroom[10];
 961  * IDL   long sidcount;
 962  * IDL   [unique] SID_AND_ATTRIBS;
 963  * IDL } VALIDATION_SAM_INFO2;
 964  */
 965 static int
 966 netlogon_dissect_VALIDATION_SAM_INFO2(tvbuff_t *tvb, int offset,
 967                         packet_info *pinfo, proto_tree *tree,
 968                         char *drep)
 969 {
 970         int i;
 971
 972         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 973                 hf_netlogon_logon_time);
 974
 975         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 976                 hf_netlogon_logoff_time);
 977
 978         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 979                 hf_netlogon_kickoff_time);
 980
 981         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 982                 hf_netlogon_pwd_last_set_time);
 983
 984         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 985                 hf_netlogon_pwd_can_change_time);
 986
 987         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 988                 hf_netlogon_pwd_must_change_time);
 989
 990         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 991                 hf_netlogon_acct_name, 0);
 992
 993         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 994                 hf_netlogon_full_name, 0);
 995
 996         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 997                 hf_netlogon_logon_script, 0);
 998
 999         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1000                 hf_netlogon_profile_path, 0);
1001
1002         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1003                 hf_netlogon_home_dir, 0);
1004
1005         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1006                 hf_netlogon_dir_drive, 0);
1007
1008         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1009                 hf_netlogon_logon_count16, NULL);
1010
1011         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1012                 hf_netlogon_bad_pw_count16, NULL);
1013
1014         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1015                 hf_netlogon_user_rid, NULL);
1016
1017         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1018                 hf_netlogon_group_rid, NULL);
1019
1020         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1021                 hf_netlogon_num_rids, NULL);
1022
1023         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1024                 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE,
1025                 "GROUP_MEMBERSHIP_ARRAY", -1, 0);
1026
1027         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1028                 hf_netlogon_user_flags, NULL);
1029
1030         offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
1031                 pinfo, tree, drep);
1032
1033         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1034                 hf_netlogon_logon_srv, 0);
1035
1036         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1037                 hf_netlogon_logon_dom, 0);
1038
1039         offset = dissect_ndr_nt_PSID(tvb, offset,
1040                 pinfo, tree, drep);
1041
1042         for(i=0;i<10;i++){
1043                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1044                         hf_netlogon_unknown_long, NULL);
1045         }
1046
1047         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1048                 hf_netlogon_num_other_groups, NULL);
1049
1050         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1051                 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
1052                 "SID_AND_ATTRIBUTES_ARRAY:", -1, 0);
1053
1054         return offset;
1055 }
1056
1057
1058
1059 static int
1060 netlogon_dissect_PAC(tvbuff_t *tvb, int offset,
1061                         packet_info *pinfo, proto_tree *tree,
1062                         char *drep _U_)
1063 {
1064         dcerpc_info *di;
1065         guint32 pac_size;
1066
1067         di=pinfo->private_data;
1068         if(di->conformant_run){
1069                 /*just a run to handle conformant arrays, nothing to dissect */
1070                 return offset;
1071         }
1072
1073         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1074                 hf_netlogon_pac_size, &pac_size);
1075
1076         proto_tree_add_item(tree, hf_netlogon_pac_data, tvb, offset, pac_size,
1077                 FALSE);
1078         offset += pac_size;
1079
1080         return offset;
1081 }
1082
1083 static int
1084 netlogon_dissect_AUTH(tvbuff_t *tvb, int offset,
1085                         packet_info *pinfo, proto_tree *tree,
1086                         char *drep _U_)
1087 {
1088         dcerpc_info *di;
1089         guint32 auth_size;
1090
1091         di=pinfo->private_data;
1092         if(di->conformant_run){
1093                 /*just a run to handle conformant arrays, nothing to dissect */
1094                 return offset;
1095         }
1096
1097         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1098                 hf_netlogon_auth_size, &auth_size);
1099
1100         proto_tree_add_item(tree, hf_netlogon_auth_data, tvb, offset, auth_size,
1101                 FALSE);
1102         offset += auth_size;
1103
1104         return offset;
1105 }
1106
1107
1108 /*
1109  * IDL typedef struct {
1110  * IDL   long pac_size
1111  * IDL   [unique][size_is(pac_size)] char *pac;
1112  * IDL   UNICODESTRING logondomain;
1113  * IDL   UNICODESTRING logonserver;
1114  * IDL   UNICODESTRING principalname;
1115  * IDL   long auth_size;
1116  * IDL   [unique][size_is(auth_size)] char *auth;
1117  * IDL   USER_SESSION_KEY user_session_key;
1118  * IDL   long expansionroom[10];
1119  * IDL   UNICODESTRING dummy1;
1120  * IDL   UNICODESTRING dummy2;
1121  * IDL   UNICODESTRING dummy3;
1122  * IDL   UNICODESTRING dummy4;
1123  * IDL } VALIDATION_PAC_INFO;
1124  */
1125 static int
1126 netlogon_dissect_VALIDATION_PAC_INFO(tvbuff_t *tvb, int offset,
1127                         packet_info *pinfo, proto_tree *tree,
1128                         char *drep)
1129 {
1130         int i;
1131
1132         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1133                 hf_netlogon_pac_size, NULL);
1134
1135         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1136                 netlogon_dissect_PAC, NDR_POINTER_UNIQUE,
1137                 "PAC:", -1, 0);
1138
1139         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1140                 hf_netlogon_logon_dom, 0);
1141
1142         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1143                 hf_netlogon_logon_srv, 0);
1144
1145         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1146                 hf_netlogon_principal, 0);
1147
1148         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1149                 hf_netlogon_auth_size, NULL);
1150
1151         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1152                 netlogon_dissect_AUTH, NDR_POINTER_UNIQUE,
1153                 "AUTH:", -1, 0);
1154
1155         offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
1156                 pinfo, tree, drep);
1157
1158         for(i=0;i<10;i++){
1159                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1160                         hf_netlogon_unknown_long, NULL);
1161         }
1162
1163         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1164                 hf_netlogon_dummy, 0);
1165
1166         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1167                 hf_netlogon_dummy, 0);
1168
1169         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1170                 hf_netlogon_dummy, 0);
1171
1172         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1173                 hf_netlogon_dummy, 0);
1174
1175         return offset;
1176 }
1177
1178
1179 /*
1180  * IDL typedef [switch_type(short)] union {
1181  * IDL    [case(2)][unique] VALIDATION_SAM_INFO *sam;
1182  * IDL    [case(3)][unique] VALIDATION_SAM_INFO2 *sam2;
1183  * IDL    [case(4)][unique] VALIDATION_PAC_INFO *pac;
1184  * IDL    [case(5)][unique] VALIDATION_PAC_INFO *pac2;
1185  * IDL } VALIDATION;
1186  */
1187 static int
1188 netlogon_dissect_VALIDATION(tvbuff_t *tvb, int offset,
1189                         packet_info *pinfo, proto_tree *tree,
1190                         char *drep)
1191 {
1192         guint16 level;
1193
1194         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1195                 hf_netlogon_validation_level, &level);
1196
1197         ALIGN_TO_4_BYTES;
1198         switch(level){
1199         case 2:
1200                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1201                         netlogon_dissect_VALIDATION_SAM_INFO, NDR_POINTER_UNIQUE,
1202                         "VALIDATION_SAM_INFO:", -1, 0);
1203                 break;
1204         case 3:
1205                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1206                         netlogon_dissect_VALIDATION_SAM_INFO2, NDR_POINTER_UNIQUE,
1207                         "VALIDATION_SAM_INFO2:", -1, 0);
1208                 break;
1209         case 4:
1210                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1211                         netlogon_dissect_VALIDATION_PAC_INFO, NDR_POINTER_UNIQUE,
1212                         "VALIDATION_PAC_INFO:", -1, 0);
1213                 break;
1214         case 5:
1215                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1216                         netlogon_dissect_VALIDATION_PAC_INFO, NDR_POINTER_UNIQUE,
1217                         "VALIDATION_PAC_INFO:", -1, 0);
1218                 break;
1219         }
1220
1221         return offset;
1222 }
1223
1224
1225 /*
1226  * IDL long NetLogonSamLogon(
1227  * IDL      [in][unique][string] wchar_t *ServerName,
1228  * IDL      [in][unique][string] wchar_t *Workstation,
1229  * IDL      [in][unique] AUTHENTICATOR *credential,
1230  * IDL      [in][out][unique] AUTHENTICATOR *returnauthenticator,
1231  * IDL      [in] short LogonLevel,
1232  * IDL      [in][ref] LOGON_LEVEL *logonlevel,
1233  * IDL      [in] short ValidationLevel,
1234  * IDL      [out][ref] VALIDATION *validation,
1235  * IDL      [out][ref] boolean Authorative
1236  * IDL );
1237  */
1238 static int
1239 netlogon_dissect_netlogonsamlogon_rqst(tvbuff_t *tvb, int offset,
1240         packet_info *pinfo, proto_tree *tree, char *drep)
1241 {
1242         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
1243                 pinfo, tree, drep);
1244
1245         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1246                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
1247                 "Computer Name", hf_netlogon_computer_name, 0);
1248
1249         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1250                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
1251                 "AUTHENTICATOR: credential", -1, 0);
1252
1253         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1254                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
1255                 "AUTHENTICATOR: return_authenticator", -1, 0);
1256
1257         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1258                 hf_netlogon_level16, NULL);
1259
1260         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1261                 netlogon_dissect_LEVEL, NDR_POINTER_REF,
1262                 "LEVEL: LogonLevel", -1, 0);
1263
1264         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1265                 hf_netlogon_validation_level, NULL);
1266
1267         return offset;
1268 }
1269
1270 static int
1271 netlogon_dissect_netlogonsamlogon_reply(tvbuff_t *tvb, int offset,
1272         packet_info *pinfo, proto_tree *tree, char *drep)
1273 {
1274         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1275                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
1276                 "AUTHENTICATOR: return_authenticator", -1, 0);
1277
1278         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1279                 netlogon_dissect_VALIDATION, NDR_POINTER_REF,
1280                 "VALIDATION:", -1, 0);
1281
1282         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1283                 hf_netlogon_authoritative, NULL);
1284
1285         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1286                                   hf_netlogon_rc, NULL);
1287
1288         return offset;
1289 }
1290
1291
1292 /*
1293  * IDL long NetLogonSamLogoff(
1294  * IDL      [in][unique][string] wchar_t *ServerName,
1295  * IDL      [in][unique][string] wchar_t *ComputerName,
1296  * IDL      [in][unique] AUTHENTICATOR credential,
1297  * IDL      [in][unique] AUTHENTICATOR return_authenticator,
1298  * IDL      [in] short logon_level,
1299  * IDL      [in][ref] LEVEL logoninformation
1300  * IDL );
1301  */
1302 static int
1303 netlogon_dissect_netlogonsamlogoff_rqst(tvbuff_t *tvb, int offset,
1304         packet_info *pinfo, proto_tree *tree, char *drep)
1305 {
1306         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
1307                 pinfo, tree, drep);
1308
1309         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1310                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
1311                 "Computer Name", hf_netlogon_computer_name, 0);
1312
1313         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1314                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
1315                 "AUTHENTICATOR: credential", -1, 0);
1316
1317         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1318                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
1319                 "AUTHENTICATOR: return_authenticator", -1, 0);
1320
1321         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1322                 hf_netlogon_level16, NULL);
1323
1324         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1325                 netlogon_dissect_LEVEL, NDR_POINTER_REF,
1326                 "LEVEL: logoninformation", -1, 0);
1327
1328         return offset;
1329 }
1330 static int
1331 netlogon_dissect_netlogonsamlogoff_reply(tvbuff_t *tvb, int offset,
1332         packet_info *pinfo, proto_tree *tree, char *drep)
1333 {
1334
1335         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1336                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
1337                 "AUTHENTICATOR: return_authenticator", -1, 0);
1338
1339         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1340                                   hf_netlogon_rc, NULL);
1341
1342         return offset;
1343 }
1344
1345
1346 /*
1347  * IDL long NetServerReqChallenge(
1348  * IDL      [in][unique][string] wchar_t *ServerName,
1349  * IDL      [in][ref][string] wchar_t *ComputerName,
1350  * IDL      [in][ref] CREDENTIAL client_credential,
1351  * IDL      [out][ref] CREDENTIAL server_credential
1352  * IDL );
1353  */
1354 static int
1355 netlogon_dissect_netserverreqchallenge_rqst(tvbuff_t *tvb, int offset,
1356         packet_info *pinfo, proto_tree *tree, char *drep)
1357 {
1358         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
1359                 pinfo, tree, drep);
1360
1361         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1362                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
1363                 "Computer Name", hf_netlogon_computer_name, 0);
1364
1365         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1366                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
1367                 "CREDENTIAL: client challenge", -1, 0);
1368
1369         return offset;
1370 }
1371 static int
1372 netlogon_dissect_netserverreqchallenge_reply(tvbuff_t *tvb, int offset,
1373         packet_info *pinfo, proto_tree *tree, char *drep)
1374 {
1375         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1376                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
1377                 "CREDENTIAL: server credential", -1, 0);
1378
1379         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1380                                   hf_netlogon_rc, NULL);
1381
1382         return offset;
1383 }
1384
1385
1386 static int
1387 netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvbuff_t *tvb, int offset,
1388                         packet_info *pinfo, proto_tree *tree,
1389                         char *drep)
1390 {
1391         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1392                         hf_netlogon_secure_channel_type, NULL);
1393
1394         return offset;
1395 }
1396
1397
1398 /*
1399  * IDL long NetServerAuthenticate(
1400  * IDL      [in][unique][string] wchar_t *ServerName,
1401  * IDL      [in][ref][string] wchar_t *UserName,
1402  * IDL      [in] short secure_challenge_type,
1403  * IDL      [in][ref][string] wchar_t *ComputerName,
1404  * IDL      [in][ref] CREDENTIAL client_challenge,
1405  * IDL      [out][ref] CREDENTIAL server_challenge
1406  * IDL );
1407  */
1408 static int
1409 netlogon_dissect_netserverauthenticate_rqst(tvbuff_t *tvb, int offset,
1410         packet_info *pinfo, proto_tree *tree, char *drep)
1411 {
1412         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
1413                 pinfo, tree, drep);
1414
1415         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1416                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
1417                 "User Name", hf_netlogon_acct_name, 0);
1418
1419         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
1420                 pinfo, tree, drep);
1421
1422         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1423                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
1424                 "Computer Name", hf_netlogon_computer_name, 0);
1425
1426         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1427                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
1428                 "CREDENTIAL: client challenge", -1, 0);
1429
1430         return offset;
1431 }
1432 static int
1433 netlogon_dissect_netserverauthenticate_reply(tvbuff_t *tvb, int offset,
1434         packet_info *pinfo, proto_tree *tree, char *drep)
1435 {
1436         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1437                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
1438                 "CREDENTIAL: server challenge", -1, 0);
1439
1440         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1441                                   hf_netlogon_rc, NULL);
1442
1443         return offset;
1444 }
1445
1446
1447
1448 /*
1449  * IDL typedef struct {
1450  * IDL   char encrypted_password[16];
1451  * IDL } ENCRYPTED_LM_OWF_PASSWORD;
1452  */
1453 static int
1454 netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
1455                         packet_info *pinfo, proto_tree *tree,
1456                         char *drep _U_)
1457 {
1458         dcerpc_info *di;
1459
1460         di=pinfo->private_data;
1461         if(di->conformant_run){
1462                 /*just a run to handle conformant arrays, nothing to dissect.*/
1463                 return offset;
1464         }
1465
1466         proto_tree_add_item(tree, hf_netlogon_encrypted_lm_owf_password, tvb, offset, 16,
1467                 FALSE);
1468         offset += 16;
1469
1470         return offset;
1471 }
1472
1473 /*
1474  * IDL long NetServerPasswordSet(
1475  * IDL      [in][unique][string] wchar_t *ServerName,
1476  * IDL      [in][ref][string] wchar_t *UserName,
1477  * IDL      [in] short secure_challenge_type,
1478  * IDL      [in][ref][string] wchar_t *ComputerName,
1479  * IDL      [in][ref] AUTHENTICATOR credential,
1480  * IDL      [in][ref] LM_OWF_PASSWORD UasNewPassword,
1481  * IDL      [out][ref] AUTHENTICATOR return_authenticator
1482  * IDL );
1483  */
1484 static int
1485 netlogon_dissect_netserverpasswordset_rqst(tvbuff_t *tvb, int offset,
1486         packet_info *pinfo, proto_tree *tree, char *drep)
1487 {
1488         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
1489                 pinfo, tree, drep);
1490
1491         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1492                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
1493                 "User Name", hf_netlogon_acct_name, 0);
1494
1495         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
1496                 pinfo, tree, drep);
1497
1498         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1499                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
1500                 "Computer Name", hf_netlogon_computer_name, 0);
1501
1502         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1503                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
1504                 "AUTHENTICATOR: credential", -1, 0);
1505
1506         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1507                 netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD, NDR_POINTER_REF,
1508                 "ENCRYPTED_LM_OWF_PASSWORD: hashed_pwd", -1, 0);
1509
1510         return offset;
1511 }
1512 static int
1513 netlogon_dissect_netserverpasswordset_reply(tvbuff_t *tvb, int offset,
1514         packet_info *pinfo, proto_tree *tree, char *drep)
1515 {
1516         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1517                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
1518                 "AUTHENTICATOR: return_authenticator", -1, 0);
1519
1520         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1521                                   hf_netlogon_rc, NULL);
1522
1523         return offset;
1524 }
1525
1526
1527 /*
1528  * IDL typedef struct {
1529  * IDL   [unique][string] wchar_t *UserName;
1530  * IDL   UNICODESTRING dummy1;
1531  * IDL   UNICODESTRING dummy2;
1532  * IDL   UNICODESTRING dummy3;
1533  * IDL   UNICODESTRING dummy4;
1534  * IDL   long dummy5;
1535  * IDL   long dummy6;
1536  * IDL   long dummy7;
1537  * IDL   long dummy8;
1538  * IDL } DELTA_DELETE_USER;
1539  */
1540 static int
1541 netlogon_dissect_DELTA_DELETE_USER(tvbuff_t *tvb, int offset,
1542                         packet_info *pinfo, proto_tree *tree,
1543                         char *drep)
1544 {
1545         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1546                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
1547                 "Account Name", hf_netlogon_acct_name, -1);
1548
1549         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1550                 hf_netlogon_dummy, 0);
1551
1552         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1553                 hf_netlogon_dummy, 0);
1554
1555         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1556                 hf_netlogon_dummy, 0);
1557
1558         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1559                 hf_netlogon_dummy, 0);
1560
1561         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1562                 hf_netlogon_reserved, NULL);
1563
1564         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1565                 hf_netlogon_reserved, NULL);
1566
1567         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1568                 hf_netlogon_reserved, NULL);
1569
1570         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1571                 hf_netlogon_reserved, NULL);
1572
1573         return offset;
1574 }
1575
1576
1577 /*
1578  * IDL typedef struct {
1579  * IDL   bool SensitiveDataFlag;
1580  * IDL   long DataLength;
1581  * IDL   [unique][size_is(DataLength)] char *SensitiveData;
1582  * IDL } USER_PRIVATE_INFO;
1583  */
1584 static int
1585 netlogon_dissect_SENSITIVE_DATA(tvbuff_t *tvb, int offset,
1586                         packet_info *pinfo, proto_tree *tree,
1587                         char *drep)
1588 {
1589         dcerpc_info *di;
1590         guint32 data_len;
1591
1592         di=pinfo->private_data;
1593         if(di->conformant_run){
1594                 /*just a run to handle conformant arrays, nothing to dissect */
1595                 return offset;
1596         }
1597
1598         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1599                 hf_netlogon_sensitive_data_len, &data_len);
1600
1601         proto_tree_add_item(tree, hf_netlogon_sensitive_data, tvb, offset,
1602                 data_len, FALSE);
1603         offset += data_len;
1604
1605         return offset;
1606 }
1607 static int
1608 netlogon_dissect_USER_PRIVATE_INFO(tvbuff_t *tvb, int offset,
1609                         packet_info *pinfo, proto_tree *tree,
1610                         char *drep)
1611 {
1612         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1613                 hf_netlogon_sensitive_data_flag, NULL);
1614
1615         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1616                 hf_netlogon_sensitive_data_len, NULL);
1617
1618         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1619                 netlogon_dissect_SENSITIVE_DATA, NDR_POINTER_UNIQUE,
1620                 "SENSITIVE_DATA", -1, 0);
1621
1622         return offset;
1623 }
1624
1625 /*
1626  * IDL typedef struct {
1627  * IDL   UNICODESTRING UserName;
1628  * IDL   UNICODESTRING FullName;
1629  * IDL   long UserID;
1630  * IDL   long PrimaryGroupID;
1631  * IDL   UNICODESTRING HomeDir;
1632  * IDL   UNICODESTRING HomeDirDrive;
1633  * IDL   UNICODESTRING LogonScript;
1634  * IDL   UNICODESTRING Comment;
1635  * IDL   UNICODESTRING Workstations;
1636  * IDL   NTTIME LastLogon;
1637  * IDL   NTTIME LastLogoff;
1638  * IDL   LOGON_HOURS logonhours;
1639  * IDL   short BadPwCount;
1640  * IDL   short LogonCount;
1641  * IDL   NTTIME PwLastSet;
1642  * IDL   NTTIME AccountExpires;
1643  * IDL   long AccountControl;
1644  * IDL   LM_OWF_PASSWORD lmpw;
1645  * IDL   NT_OWF_PASSWORD ntpw;
1646  * IDL   bool NTPwPresent;
1647  * IDL   bool LMPwPresent;
1648  * IDL   bool PwExpired;
1649  * IDL   UNICODESTRING UserComment;
1650  * IDL   UNICODESTRING Parameters;
1651  * IDL   short CountryCode;
1652  * IDL   short CodePage;
1653  * IDL   USER_PRIVATE_INFO user_private_info;
1654  * IDL   long SecurityInformation;
1655  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
1656  * IDL   UNICODESTRING dummy1;
1657  * IDL   UNICODESTRING dummy2;
1658  * IDL   UNICODESTRING dummy3;
1659  * IDL   UNICODESTRING dummy4;
1660  * IDL   long dummy5;
1661  * IDL   long dummy6;
1662  * IDL   long dummy7;
1663  * IDL   long dummy8;
1664  * IDL } DELTA_USER;
1665  */
1666 static int
1667 netlogon_dissect_DELTA_USER(tvbuff_t *tvb, int offset,
1668                         packet_info *pinfo, proto_tree *tree,
1669                         char *drep)
1670 {
1671         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1672                 hf_netlogon_acct_name, 0);
1673
1674         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1675                 hf_netlogon_full_name, 0);
1676
1677         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1678                 hf_netlogon_user_rid, NULL);
1679
1680         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1681                 hf_netlogon_group_rid, NULL);
1682
1683         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1684                 hf_netlogon_home_dir, 0);
1685
1686         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1687                 hf_netlogon_dir_drive, 0);
1688
1689         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1690                 hf_netlogon_logon_script, 0);
1691
1692         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1693                 hf_netlogon_acct_desc, 0);
1694
1695         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1696                 hf_netlogon_workstations, 0);
1697
1698         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1699                 hf_netlogon_logon_time);
1700
1701         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1702                 hf_netlogon_logoff_time);
1703
1704         offset = dissect_ndr_nt_LOGON_HOURS(tvb, offset, pinfo, tree, drep);
1705
1706         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1707                 hf_netlogon_bad_pw_count16, NULL);
1708
1709         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1710                 hf_netlogon_logon_count16, NULL);
1711
1712         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1713                 hf_netlogon_pwd_last_set_time);
1714
1715         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1716                 hf_netlogon_acct_expiry_time);
1717
1718         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
1719
1720         offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
1721                 pinfo, tree, drep);
1722
1723         offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
1724                 pinfo, tree, drep);
1725
1726         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1727                 hf_netlogon_nt_pwd_present, NULL);
1728
1729         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1730                 hf_netlogon_lm_pwd_present, NULL);
1731
1732         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1733                 hf_netlogon_pwd_expired, NULL);
1734
1735         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1736                 hf_netlogon_comment, 0);
1737
1738         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1739                 hf_netlogon_parameters, 0);
1740
1741         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1742                 hf_netlogon_country, NULL);
1743
1744         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1745                 hf_netlogon_codepage, NULL);
1746
1747         offset = netlogon_dissect_USER_PRIVATE_INFO(tvb, offset, pinfo, tree,
1748                 drep);
1749
1750         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1751                 hf_netlogon_security_information, NULL);
1752
1753         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
1754                 pinfo, tree, drep);
1755
1756         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1757                 hf_netlogon_dummy, 0);
1758
1759         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1760                 hf_netlogon_dummy, 0);
1761
1762         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1763                 hf_netlogon_dummy, 0);
1764
1765         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1766                 hf_netlogon_dummy, 0);
1767
1768         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1769                 hf_netlogon_reserved, NULL);
1770
1771         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1772                 hf_netlogon_reserved, NULL);
1773
1774         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1775                 hf_netlogon_reserved, NULL);
1776
1777         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1778                 hf_netlogon_reserved, NULL);
1779
1780         return offset;
1781 }
1782
1783
1784 /*
1785  * IDL typedef struct {
1786  * IDL   UNICODESTRING DomainName;
1787  * IDL   UNICODESTRING OEMInfo;
1788  * IDL   NTTIME forcedlogoff;
1789  * IDL   short minpasswdlen;
1790  * IDL   short passwdhistorylen;
1791  * IDL   NTTIME pwd_must_change_time;
1792  * IDL   NTTIME pwd_can_change_time;
1793  * IDL   NTTIME domain_modify_time;
1794  * IDL   NTTIME domain_create_time;
1795  * IDL   long SecurityInformation;
1796  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
1797  * IDL   UNICODESTRING dummy1;
1798  * IDL   UNICODESTRING dummy2;
1799  * IDL   UNICODESTRING dummy3;
1800  * IDL   UNICODESTRING dummy4;
1801  * IDL   long dummy5;
1802  * IDL   long dummy6;
1803  * IDL   long dummy7;
1804  * IDL   long dummy8;
1805  * IDL } DELTA_DOMAIN;
1806  */
1807 static int
1808 netlogon_dissect_DELTA_DOMAIN(tvbuff_t *tvb, int offset,
1809                         packet_info *pinfo, proto_tree *tree,
1810                         char *drep)
1811 {
1812         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1813                 hf_netlogon_domain_name, 1);
1814
1815         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1816                 hf_netlogon_oem_info, 0);
1817
1818         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1819                 hf_netlogon_kickoff_time);
1820
1821         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1822                 hf_netlogon_minpasswdlen, NULL);
1823
1824         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1825                 hf_netlogon_passwdhistorylen, NULL);
1826
1827         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1828                 hf_netlogon_pwd_must_change_time);
1829
1830         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1831                 hf_netlogon_pwd_can_change_time);
1832
1833         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1834                 hf_netlogon_domain_modify_time);
1835
1836         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1837                 hf_netlogon_domain_create_time);
1838
1839         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1840                 hf_netlogon_security_information, NULL);
1841
1842         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
1843                 pinfo, tree, drep);
1844
1845         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1846                 hf_netlogon_dummy, 0);
1847
1848         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1849                 hf_netlogon_dummy, 0);
1850
1851         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1852                 hf_netlogon_dummy, 0);
1853
1854         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1855                 hf_netlogon_dummy, 0);
1856
1857         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1858                 hf_netlogon_reserved, NULL);
1859
1860         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1861                 hf_netlogon_reserved, NULL);
1862
1863         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1864                 hf_netlogon_reserved, NULL);
1865
1866         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1867                 hf_netlogon_reserved, NULL);
1868
1869         return offset;
1870 }
1871
1872
1873 /*
1874  * IDL typedef struct {
1875  * IDL   UNICODESTRING groupname;
1876  * IDL   GROUP_MEMBERSHIP group_membership;
1877  * IDL   UNICODESTRING comment;
1878  * IDL   long SecurityInformation;
1879  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
1880  * IDL   UNICODESTRING dummy1;
1881  * IDL   UNICODESTRING dummy2;
1882  * IDL   UNICODESTRING dummy3;
1883  * IDL   UNICODESTRING dummy4;
1884  * IDL   long dummy5;
1885  * IDL   long dummy6;
1886  * IDL   long dummy7;
1887  * IDL   long dummy8;
1888  * IDL } DELTA_GROUP;
1889  */
1890 static int
1891 netlogon_dissect_DELTA_GROUP(tvbuff_t *tvb, int offset,
1892                         packet_info *pinfo, proto_tree *tree,
1893                         char *drep)
1894 {
1895         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1896                 hf_netlogon_group_name, 1);
1897
1898         offset = netlogon_dissect_GROUP_MEMBERSHIP(tvb, offset,
1899                 pinfo, tree, drep);
1900
1901         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1902                 hf_netlogon_group_desc, 0);
1903
1904         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1905                 hf_netlogon_security_information, NULL);
1906
1907         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
1908                 pinfo, tree, drep);
1909
1910         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1911                 hf_netlogon_dummy, 0);
1912
1913         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1914                 hf_netlogon_dummy, 0);
1915
1916         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1917                 hf_netlogon_dummy, 0);
1918
1919         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1920                 hf_netlogon_dummy, 0);
1921
1922         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1923                 hf_netlogon_reserved, NULL);
1924
1925         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1926                 hf_netlogon_reserved, NULL);
1927
1928         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1929                 hf_netlogon_reserved, NULL);
1930
1931         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1932                 hf_netlogon_reserved, NULL);
1933
1934         return offset;
1935 }
1936
1937
1938 /*
1939  * IDL typedef struct {
1940  * IDL   UNICODESTRING OldName;
1941  * IDL   UNICODESTRING NewName;
1942  * IDL   UNICODESTRING dummy1;
1943  * IDL   UNICODESTRING dummy2;
1944  * IDL   UNICODESTRING dummy3;
1945  * IDL   UNICODESTRING dummy4;
1946  * IDL   long dummy5;
1947  * IDL   long dummy6;
1948  * IDL   long dummy7;
1949  * IDL   long dummy8;
1950  * IDL } DELTA_RENAME;
1951  */
1952 static int
1953 netlogon_dissect_DELTA_RENAME(tvbuff_t *tvb, int offset,
1954                         packet_info *pinfo, proto_tree *tree,
1955                         char *drep)
1956 {
1957         dcerpc_info *di;
1958
1959         di=pinfo->private_data;
1960
1961         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1962                 di->hf_index, 1);
1963
1964         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1965                 di->hf_index, 1);
1966
1967         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1968                 hf_netlogon_dummy, 0);
1969
1970         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1971                 hf_netlogon_dummy, 0);
1972
1973         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1974                 hf_netlogon_dummy, 0);
1975
1976         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1977                 hf_netlogon_dummy, 0);
1978
1979         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1980                 hf_netlogon_reserved, NULL);
1981
1982         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1983                 hf_netlogon_reserved, NULL);
1984
1985         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1986                 hf_netlogon_reserved, NULL);
1987
1988         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1989                 hf_netlogon_reserved, NULL);
1990
1991         return offset;
1992 }
1993
1994
1995 static int
1996 netlogon_dissect_RID(tvbuff_t *tvb, int offset,
1997                         packet_info *pinfo, proto_tree *tree,
1998                         char *drep)
1999 {
2000         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2001                                 hf_netlogon_user_rid, NULL);
2002
2003         return offset;
2004 }
2005
2006 static int
2007 netlogon_dissect_RID_array(tvbuff_t *tvb, int offset,
2008                         packet_info *pinfo, proto_tree *tree,
2009                         char *drep)
2010 {
2011         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2012                         netlogon_dissect_RID);
2013
2014         return offset;
2015 }
2016
2017 static int
2018 netlogon_dissect_ATTRIB(tvbuff_t *tvb, int offset,
2019                         packet_info *pinfo, proto_tree *tree,
2020                         char *drep)
2021 {
2022         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2023                 hf_netlogon_attrs, NULL);
2024
2025         return offset;
2026 }
2027
2028 static int
2029 netlogon_dissect_ATTRIB_array(tvbuff_t *tvb, int offset,
2030                         packet_info *pinfo, proto_tree *tree,
2031                         char *drep)
2032 {
2033         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2034                         netlogon_dissect_ATTRIB);
2035
2036         return offset;
2037 }
2038
2039 /*
2040  * IDL typedef struct {
2041  * IDL   [unique][size_is(num_rids)] long *rids;
2042  * IDL   [unique][size_is(num_rids)] long *attribs;
2043  * IDL   long num_rids;
2044  * IDL   long dummy1;
2045  * IDL   long dummy2;
2046  * IDL   long dummy3;
2047  * IDL   long dummy4;
2048  * IDL } DELTA_GROUP_MEMBER;
2049  */
2050 static int
2051 netlogon_dissect_DELTA_GROUP_MEMBER(tvbuff_t *tvb, int offset,
2052                         packet_info *pinfo, proto_tree *tree,
2053                         char *drep)
2054 {
2055         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2056                 netlogon_dissect_RID_array, NDR_POINTER_UNIQUE,
2057                 "RIDs:", -1, 0);
2058
2059         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2060                 netlogon_dissect_ATTRIB_array, NDR_POINTER_UNIQUE,
2061                 "Attribs:", -1, 0);
2062
2063         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2064                 hf_netlogon_num_rids, NULL);
2065
2066         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2067                 hf_netlogon_reserved, NULL);
2068
2069         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2070                 hf_netlogon_reserved, NULL);
2071
2072         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2073                 hf_netlogon_reserved, NULL);
2074
2075         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2076                 hf_netlogon_reserved, NULL);
2077
2078         return offset;
2079 }
2080
2081
2082 /*
2083  * IDL typedef struct {
2084  * IDL   UNICODESTRING alias_name;
2085  * IDL   long rid;
2086  * IDL   long SecurityInformation;
2087  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
2088  * IDL   UNICODESTRING dummy1;
2089  * IDL   UNICODESTRING dummy2;
2090  * IDL   UNICODESTRING dummy3;
2091  * IDL   UNICODESTRING dummy4;
2092  * IDL   long dummy5;
2093  * IDL   long dummy6;
2094  * IDL   long dummy7;
2095  * IDL   long dummy8;
2096  * IDL } DELTA_ALIAS;
2097  */
2098 static int
2099 netlogon_dissect_DELTA_ALIAS(tvbuff_t *tvb, int offset,
2100                         packet_info *pinfo, proto_tree *tree,
2101                         char *drep)
2102 {
2103         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2104                 hf_netlogon_alias_name, 1);
2105
2106         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2107                 hf_netlogon_alias_rid, NULL);
2108
2109         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2110                 hf_netlogon_security_information, NULL);
2111
2112         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
2113                 pinfo, tree, drep);
2114
2115         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2116                 hf_netlogon_dummy, 0);
2117
2118         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2119                 hf_netlogon_dummy, 0);
2120
2121         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2122                 hf_netlogon_dummy, 0);
2123
2124         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2125                 hf_netlogon_dummy, 0);
2126
2127         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2128                 hf_netlogon_reserved, NULL);
2129
2130         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2131                 hf_netlogon_reserved, NULL);
2132
2133         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2134                 hf_netlogon_reserved, NULL);
2135
2136         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2137                 hf_netlogon_reserved, NULL);
2138
2139         return offset;
2140 }
2141
2142
2143 /*
2144  * IDL typedef struct {
2145  * IDL   [unique] SID_ARRAY sids;
2146  * IDL   long dummy1;
2147  * IDL   long dummy2;
2148  * IDL   long dummy3;
2149  * IDL   long dummy4;
2150  * IDL } DELTA_ALIAS_MEMBER;
2151  */
2152 static int
2153 netlogon_dissect_DELTA_ALIAS_MEMBER(tvbuff_t *tvb, int offset,
2154                         packet_info *pinfo, proto_tree *tree,
2155                         char *drep)
2156 {
2157         offset = dissect_ndr_nt_PSID_ARRAY(tvb, offset, pinfo, tree, drep);
2158
2159         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2160                 hf_netlogon_reserved, NULL);
2161
2162         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2163                 hf_netlogon_reserved, NULL);
2164
2165         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2166                 hf_netlogon_reserved, NULL);
2167
2168         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2169                 hf_netlogon_reserved, NULL);
2170
2171         return offset;
2172 }
2173
2174
2175 static int
2176 netlogon_dissect_EVENT_AUDIT_OPTION(tvbuff_t *tvb, int offset,
2177                         packet_info *pinfo, proto_tree *tree,
2178                         char *drep)
2179 {
2180         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2181                 hf_netlogon_event_audit_option, NULL);
2182
2183         return offset;
2184 }
2185
2186 static int
2187 netlogon_dissect_EVENT_AUDIT_OPTIONS_ARRAY(tvbuff_t *tvb, int offset,
2188                         packet_info *pinfo, proto_tree *tree,
2189                         char *drep)
2190 {
2191         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2192                 netlogon_dissect_EVENT_AUDIT_OPTION);
2193
2194         return offset;
2195 }
2196
2197
2198 /*
2199  * IDL typedef struct {
2200  * IDL   long pagedpoollimit;
2201  * IDL   long nonpagedpoollimit;
2202  * IDL   long minimumworkingsetsize;
2203  * IDL   long maximumworkingsetsize;
2204  * IDL   long pagefilelimit;
2205  * IDL   NTTIME timelimit;
2206  * IDL } QUOTA_LIMITS;
2207  */
2208 static int
2209 netlogon_dissect_QUOTA_LIMITS(tvbuff_t *tvb, int offset,
2210                         packet_info *pinfo, proto_tree *parent_tree,
2211                         char *drep)
2212 {
2213         proto_item *item=NULL;
2214         proto_tree *tree=NULL;
2215         int old_offset=offset;
2216
2217         if(parent_tree){
2218                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2219                         "QUOTA_LIMTS:");
2220                 tree = proto_item_add_subtree(item, ett_QUOTA_LIMITS);
2221         }
2222
2223         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2224                 hf_netlogon_pagedpoollimit, NULL);
2225
2226         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2227                 hf_netlogon_nonpagedpoollimit, NULL);
2228
2229         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2230                 hf_netlogon_minworkingsetsize, NULL);
2231
2232         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2233                 hf_netlogon_maxworkingsetsize, NULL);
2234
2235         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2236                 hf_netlogon_pagefilelimit, NULL);
2237
2238         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2239                 hf_netlogon_timelimit);
2240
2241         proto_item_set_len(item, offset-old_offset);
2242         return offset;
2243 }
2244
2245
2246 /*
2247  * IDL typedef struct {
2248  * IDL   long maxlogsize;
2249  * IDL   NTTIME auditretentionperiod;
2250  * IDL   bool auditingmode;
2251  * IDL   long maxauditeventcount;
2252  * IDL   [unique][size_is(maxauditeventcount)] long *eventauditoptions;
2253  * IDL   UNICODESTRING primarydomainname;
2254  * IDL   [unique] SID *sid;
2255  * IDL   QUOTA_LIMITS quota_limits;
2256  * IDL   NTTIME db_modify_time;
2257  * IDL   NTTIME db_create_time;
2258  * IDL   long SecurityInformation;
2259  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
2260  * IDL   UNICODESTRING dummy1;
2261  * IDL   UNICODESTRING dummy2;
2262  * IDL   UNICODESTRING dummy3;
2263  * IDL   UNICODESTRING dummy4;
2264  * IDL   long dummy5;
2265  * IDL   long dummy6;
2266  * IDL   long dummy7;
2267  * IDL   long dummy8;
2268  * IDL } DELTA_POLICY;
2269  */
2270 static int
2271 netlogon_dissect_DELTA_POLICY(tvbuff_t *tvb, int offset,
2272                         packet_info *pinfo, proto_tree *tree,
2273                         char *drep)
2274 {
2275         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2276                 hf_netlogon_max_log_size, NULL);
2277
2278         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2279                 hf_netlogon_audit_retention_period);
2280
2281         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2282                 hf_netlogon_auditing_mode, NULL);
2283
2284         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2285                 hf_netlogon_max_audit_event_count, NULL);
2286
2287         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2288                 netlogon_dissect_EVENT_AUDIT_OPTIONS_ARRAY, NDR_POINTER_UNIQUE,
2289                 "Event Audit Options:", -1, 0);
2290
2291         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2292                 hf_netlogon_domain_name, 0);
2293
2294         offset = dissect_ndr_nt_PSID(tvb, offset,
2295                 pinfo, tree, drep);
2296
2297         offset = netlogon_dissect_QUOTA_LIMITS(tvb, offset,
2298                 pinfo, tree, drep);
2299
2300         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2301                 hf_netlogon_db_modify_time);
2302
2303         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2304                 hf_netlogon_db_create_time);
2305
2306         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2307                 hf_netlogon_security_information, NULL);
2308
2309         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
2310                 pinfo, tree, drep);
2311
2312         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2313                 hf_netlogon_dummy, 0);
2314
2315         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2316                 hf_netlogon_dummy, 0);
2317
2318         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2319                 hf_netlogon_dummy, 0);
2320
2321         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2322                 hf_netlogon_dummy, 0);
2323
2324         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2325                 hf_netlogon_reserved, NULL);
2326
2327         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2328                 hf_netlogon_reserved, NULL);
2329
2330         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2331                 hf_netlogon_reserved, NULL);
2332
2333         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2334                 hf_netlogon_reserved, NULL);
2335
2336         return offset;
2337 }
2338
2339
2340 static int
2341 netlogon_dissect_CONTROLLER(tvbuff_t *tvb, int offset,
2342                         packet_info *pinfo, proto_tree *tree,
2343                         char *drep)
2344 {
2345         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2346                 hf_netlogon_dc_name, 1);
2347
2348         return offset;
2349 }
2350
2351 static int
2352 netlogon_dissect_CONTROLLER_ARRAY(tvbuff_t *tvb, int offset,
2353                         packet_info *pinfo, proto_tree *tree,
2354                         char *drep)
2355 {
2356         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2357                 netlogon_dissect_CONTROLLER);
2358
2359         return offset;
2360 }
2361
2362
2363 /*
2364  * IDL typedef struct {
2365  * IDL   UNICODESTRING DomainName;
2366  * IDL   long num_controllers;
2367  * IDL   [unique][size_is(num_controllers)] UNICODESTRING *controller_names;
2368  * IDL   long SecurityInformation;
2369  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
2370  * IDL   UNICODESTRING dummy1;
2371  * IDL   UNICODESTRING dummy2;
2372  * IDL   UNICODESTRING dummy3;
2373  * IDL   UNICODESTRING dummy4;
2374  * IDL   long dummy5;
2375  * IDL   long dummy6;
2376  * IDL   long dummy7;
2377  * IDL   long dummy8;
2378  * IDL } DELTA_TRUSTED_DOMAINS;
2379  */
2380 static int
2381 netlogon_dissect_DELTA_TRUSTED_DOMAINS(tvbuff_t *tvb, int offset,
2382                         packet_info *pinfo, proto_tree *tree,
2383                         char *drep)
2384 {
2385         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2386                 hf_netlogon_domain_name, 0);
2387
2388         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2389                 hf_netlogon_num_controllers, NULL);
2390
2391         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2392                 netlogon_dissect_CONTROLLER_ARRAY, NDR_POINTER_UNIQUE,
2393                 "Domain Controllers:", -1, 0);
2394
2395         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2396                 hf_netlogon_security_information, NULL);
2397
2398         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
2399                 pinfo, tree, drep);
2400
2401         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2402                 hf_netlogon_dummy, 0);
2403
2404         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2405                 hf_netlogon_dummy, 0);
2406
2407         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2408                 hf_netlogon_dummy, 0);
2409
2410         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2411                 hf_netlogon_dummy, 0);
2412
2413         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2414                 hf_netlogon_reserved, NULL);
2415
2416         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2417                 hf_netlogon_reserved, NULL);
2418
2419         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2420                 hf_netlogon_reserved, NULL);
2421
2422         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2423                 hf_netlogon_reserved, NULL);
2424
2425         return offset;
2426 }
2427
2428
2429 static int
2430 netlogon_dissect_PRIV_ATTR(tvbuff_t *tvb, int offset,
2431                         packet_info *pinfo, proto_tree *tree,
2432                         char *drep)
2433 {
2434         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2435                 hf_netlogon_attrs, NULL);
2436
2437         return offset;
2438 }
2439
2440 static int
2441 netlogon_dissect_PRIV_ATTR_ARRAY(tvbuff_t *tvb, int offset,
2442                         packet_info *pinfo, proto_tree *tree,
2443                         char *drep)
2444 {
2445         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2446                 netlogon_dissect_PRIV_ATTR);
2447
2448         return offset;
2449 }
2450
2451 static int
2452 netlogon_dissect_PRIV_NAME(tvbuff_t *tvb, int offset,
2453                         packet_info *pinfo, proto_tree *tree,
2454                         char *drep)
2455 {
2456         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2457                 hf_netlogon_privilege_name, 1);
2458
2459         return offset;
2460 }
2461
2462 static int
2463 netlogon_dissect_PRIV_NAME_ARRAY(tvbuff_t *tvb, int offset,
2464                         packet_info *pinfo, proto_tree *tree,
2465                         char *drep)
2466 {
2467         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2468                 netlogon_dissect_PRIV_NAME);
2469
2470         return offset;
2471 }
2472
2473
2474
2475 /*
2476  * IDL typedef struct {
2477  * IDL   long privilegeentries;
2478  * IDL   long provolegecontrol;
2479  * IDL   [unique][size_is(privilege_entries)] long *privilege_attrib;
2480  * IDL   [unique][size_is(privilege_entries)] UNICODESTRING *privilege_name;
2481  * IDL   QUOTALIMITS quotalimits;
2482  * IDL   long SecurityInformation;
2483  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
2484  * IDL   UNICODESTRING dummy1;
2485  * IDL   UNICODESTRING dummy2;
2486  * IDL   UNICODESTRING dummy3;
2487  * IDL   UNICODESTRING dummy4;
2488  * IDL   long dummy5;
2489  * IDL   long dummy6;
2490  * IDL   long dummy7;
2491  * IDL   long dummy8;
2492  * IDL } DELTA_ACCOUNTS;
2493  */
2494 static int
2495 netlogon_dissect_DELTA_ACCOUNTS(tvbuff_t *tvb, int offset,
2496                         packet_info *pinfo, proto_tree *tree,
2497                         char *drep)
2498 {
2499         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2500                 hf_netlogon_privilege_entries, NULL);
2501
2502         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2503                 hf_netlogon_privilege_control, NULL);
2504
2505         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2506                 netlogon_dissect_PRIV_ATTR_ARRAY, NDR_POINTER_UNIQUE,
2507                 "PRIV_ATTR_ARRAY:", -1, 0);
2508
2509         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2510                 netlogon_dissect_PRIV_NAME_ARRAY, NDR_POINTER_UNIQUE,
2511                 "PRIV_NAME_ARRAY:", -1, 0);
2512
2513         offset = netlogon_dissect_QUOTA_LIMITS(tvb, offset,
2514                 pinfo, tree, drep);
2515
2516         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2517                 hf_netlogon_systemflags, NULL);
2518
2519         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2520                 hf_netlogon_security_information, NULL);
2521
2522         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
2523                 pinfo, tree, drep);
2524
2525         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2526                 hf_netlogon_dummy, 0);
2527
2528         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2529                 hf_netlogon_dummy, 0);
2530
2531         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2532                 hf_netlogon_dummy, 0);
2533
2534         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2535                 hf_netlogon_dummy, 0);
2536
2537         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2538                 hf_netlogon_reserved, NULL);
2539
2540         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2541                 hf_netlogon_reserved, NULL);
2542
2543         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2544                 hf_netlogon_reserved, NULL);
2545
2546         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2547                 hf_netlogon_reserved, NULL);
2548
2549         return offset;
2550 }
2551
2552 /*
2553  * IDL typedef struct {
2554  * IDL   long len;
2555  * IDL   long maxlen;
2556  * IDL   [unique][size_is(maxlen)][length_is(len)] char *cipher_data;
2557  * IDL } CIPHER_VALUE;
2558  */
2559 static int
2560 netlogon_dissect_CIPHER_VALUE_DATA(tvbuff_t *tvb, int offset,
2561                         packet_info *pinfo, proto_tree *tree,
2562                         char *drep)
2563 {
2564         dcerpc_info *di;
2565         guint32 data_len;
2566
2567         di=pinfo->private_data;
2568         if(di->conformant_run){
2569                 /*just a run to handle conformant arrays, nothing to dissect */
2570                 return offset;
2571         }
2572
2573         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2574                 hf_netlogon_cipher_maxlen, NULL);
2575
2576         /* skip offset */
2577         offset += 4;
2578
2579         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2580                 hf_netlogon_cipher_len, &data_len);
2581
2582         proto_tree_add_item(tree, di->hf_index, tvb, offset,
2583                 data_len, FALSE);
2584         offset += data_len;
2585
2586         return offset;
2587 }
2588 static int
2589 netlogon_dissect_CIPHER_VALUE(tvbuff_t *tvb, int offset,
2590                         packet_info *pinfo, proto_tree *parent_tree,
2591                         char *drep, char *name, int hf_index)
2592 {
2593         proto_item *item=NULL;
2594         proto_tree *tree=NULL;
2595         int old_offset=offset;
2596
2597         if(parent_tree){
2598                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2599                         name);
2600                 tree = proto_item_add_subtree(item, ett_CYPHER_VALUE);
2601         }
2602
2603         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2604                 hf_netlogon_cipher_len, NULL);
2605
2606         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2607                 hf_netlogon_cipher_maxlen, NULL);
2608
2609         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2610                 netlogon_dissect_CIPHER_VALUE_DATA, NDR_POINTER_UNIQUE,
2611                 name, hf_index, 0);
2612
2613         proto_item_set_len(item, offset-old_offset);
2614         return offset;
2615 }
2616
2617 /*
2618  * IDL typedef struct {
2619  * IDL   CIPHER_VALUE current_cipher;
2620  * IDL   NTTIME current_cipher_set_time;
2621  * IDL   CIPHER_VALUE old_cipher;
2622  * IDL   NTTIME old_cipher_set_time;
2623  * IDL   long SecurityInformation;
2624  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
2625  * IDL   UNICODESTRING dummy1;
2626  * IDL   UNICODESTRING dummy2;
2627  * IDL   UNICODESTRING dummy3;
2628  * IDL   UNICODESTRING dummy4;
2629  * IDL   long dummy5;
2630  * IDL   long dummy6;
2631  * IDL   long dummy7;
2632  * IDL   long dummy8;
2633  * IDL } DELTA_SECRET;
2634  */
2635 static int
2636 netlogon_dissect_DELTA_SECRET(tvbuff_t *tvb, int offset,
2637                         packet_info *pinfo, proto_tree *tree,
2638                         char *drep)
2639 {
2640         offset = netlogon_dissect_CIPHER_VALUE(tvb, offset,
2641                 pinfo, tree, drep,
2642                 "CIPHER_VALUE: current cipher value",
2643                 hf_netlogon_cipher_current_data);
2644
2645         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2646                 hf_netlogon_cipher_current_set_time);
2647
2648         offset = netlogon_dissect_CIPHER_VALUE(tvb, offset,
2649                 pinfo, tree, drep,
2650                 "CIPHER_VALUE: old cipher value",
2651                 hf_netlogon_cipher_old_data);
2652
2653         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2654                 hf_netlogon_cipher_old_set_time);
2655
2656         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2657                 hf_netlogon_security_information, NULL);
2658
2659         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
2660                 pinfo, tree, drep);
2661
2662         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2663                 hf_netlogon_dummy, 0);
2664
2665         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2666                 hf_netlogon_dummy, 0);
2667
2668         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2669                 hf_netlogon_dummy, 0);
2670
2671         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2672                 hf_netlogon_dummy, 0);
2673
2674         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2675                 hf_netlogon_reserved, NULL);
2676
2677         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2678                 hf_netlogon_reserved, NULL);
2679
2680         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2681                 hf_netlogon_reserved, NULL);
2682
2683         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2684                 hf_netlogon_reserved, NULL);
2685
2686         return offset;
2687 }
2688
2689 /*
2690  * IDL typedef struct {
2691  * IDL   long low_value;
2692  * IDL   long high_value;
2693  * } MODIFIED_COUNT;
2694  */
2695 static int
2696 netlogon_dissect_MODIFIED_COUNT(tvbuff_t *tvb, int offset,
2697                         packet_info *pinfo, proto_tree *tree,
2698                         char *drep)
2699 {
2700         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
2701                 hf_netlogon_modify_count, NULL);
2702
2703         return offset;
2704 }
2705
2706
2707 #define DT_DELTA_DOMAIN                 1
2708 #define DT_DELTA_GROUP                  2
2709 #define DT_DELTA_RENAME_GROUP           4
2710 #define DT_DELTA_USER                   5
2711 #define DT_DELTA_RENAME_USER            7
2712 #define DT_DELTA_GROUP_MEMBER           8
2713 #define DT_DELTA_ALIAS                  9
2714 #define DT_DELTA_RENAME_ALIAS           11
2715 #define DT_DELTA_ALIAS_MEMBER           12
2716 #define DT_DELTA_POLICY                 13
2717 #define DT_DELTA_TRUSTED_DOMAINS        14
2718 #define DT_DELTA_ACCOUNTS               16
2719 #define DT_DELTA_SECRET                 18
2720 #define DT_DELTA_DELETE_GROUP           20
2721 #define DT_DELTA_DELETE_USER            21
2722 #define DT_MODIFIED_COUNT               22
2723 static const value_string delta_type_vals[] = {
2724         { DT_DELTA_DOMAIN,              "Domain" },
2725         { DT_DELTA_GROUP,               "Group" },
2726         { DT_DELTA_RENAME_GROUP,        "Rename Group" },
2727         { DT_DELTA_USER,                "User" },
2728         { DT_DELTA_RENAME_USER,         "Rename User" },
2729         { DT_DELTA_GROUP_MEMBER,        "Group Member" },
2730         { DT_DELTA_ALIAS,               "Alias" },
2731         { DT_DELTA_RENAME_ALIAS,        "Rename Alias" },
2732         { DT_DELTA_ALIAS_MEMBER,        "Alias Member" },
2733         { DT_DELTA_POLICY,              "Policy" },
2734         { DT_DELTA_TRUSTED_DOMAINS,     "Trusted Domains" },
2735         { DT_DELTA_ACCOUNTS,            "Accounts" },
2736         { DT_DELTA_SECRET,              "Secret" },
2737         { DT_DELTA_DELETE_GROUP,        "Delete Group" },
2738         { DT_DELTA_DELETE_USER,         "Delete User" },
2739         { DT_MODIFIED_COUNT,            "Modified Count" },
2740         { 0, NULL }
2741 };
2742 /*
2743  * IDL typedef [switch_type(short)] union {
2744  * IDL   [case(1)][unique] DELTA_DOMAIN *domain;
2745  * IDL   [case(2)][unique] DELTA_GROUP *group;
2746  * IDL   [case(4)][unique] DELTA_RENAME_GROUP *rename_group;
2747  * IDL   [case(5)][unique] DELTA_USER *user;
2748  * IDL   [case(7)][unique] DELTA_RENAME_USER *rename_user;
2749  * IDL   [case(8)][unique] DELTA_GROUP_MEMBER *group_member;
2750  * IDL   [case(9)][unique] DELTA_ALIAS *alias;
2751  * IDL   [case(11)][unique] DELTA_RENAME_ALIAS *rename_alias;
2752  * IDL   [case(12)][unique] DELTA_ALIAS_MEMBER *alias_member;
2753  * IDL   [case(13)][unique] DELTA_POLICY *policy;
2754  * IDL   [case(14)][unique] DELTA_TRUSTED_DOMAINS *trusted_domains;
2755  * IDL   [case(16)][unique] DELTA_ACCOUNTS *accounts;
2756  * IDL   [case(18)][unique] DELTA_SECRET *secret;
2757  * IDL   [case(20)][unique] DELTA_DELETE_USER *delete_group;
2758  * IDL   [case(21)][unique] DELTA_DELETE_USER *delete_user;
2759  * IDL   [case(22)][unique] MODIFIED_COUNT *modified_count;
2760  * IDL } DELTA_UNION;
2761  */
2762 static int
2763 netlogon_dissect_DELTA_UNION(tvbuff_t *tvb, int offset,
2764                         packet_info *pinfo, proto_tree *parent_tree,
2765                         char *drep)
2766 {
2767         proto_item *item=NULL;
2768         proto_tree *tree=NULL;
2769         int old_offset=offset;
2770         guint16 level;
2771
2772         if(parent_tree){
2773                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2774                         "DELTA_UNION:");
2775                 tree = proto_item_add_subtree(item, ett_DELTA_UNION);
2776         }
2777
2778         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2779                 hf_netlogon_delta_type, &level);
2780
2781         ALIGN_TO_4_BYTES;
2782         switch(level){
2783         case 1:
2784                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2785                         netlogon_dissect_DELTA_DOMAIN, NDR_POINTER_UNIQUE,
2786                         "DELTA_DOMAIN:", -1, 0);
2787                 break;
2788         case 2:
2789                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2790                         netlogon_dissect_DELTA_GROUP, NDR_POINTER_UNIQUE,
2791                         "DELTA_GROUP:", -1, 0);
2792                 break;
2793         case 4:
2794                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2795                         netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
2796                         "DELTA_RENAME_GROUP:", hf_netlogon_group_name, 0);
2797                 break;
2798         case 5:
2799                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2800                         netlogon_dissect_DELTA_USER, NDR_POINTER_UNIQUE,
2801                         "DELTA_USER:", -1, 0);
2802                 break;
2803         case 7:
2804                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2805                         netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
2806                         "DELTA_RENAME_USER:", hf_netlogon_acct_name, 0);
2807                 break;
2808         case 8:
2809                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2810                         netlogon_dissect_DELTA_GROUP_MEMBER, NDR_POINTER_UNIQUE,
2811                         "DELTA_GROUP_MEMBER:", -1, 0);
2812                 break;
2813         case 9:
2814                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2815                         netlogon_dissect_DELTA_ALIAS, NDR_POINTER_UNIQUE,
2816                         "DELTA_ALIAS:", -1, 0);
2817                 break;
2818         case 11:
2819                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2820                         netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
2821                         "DELTA_RENAME_ALIAS:", hf_netlogon_alias_name, 0);
2822                 break;
2823         case 12:
2824                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2825                         netlogon_dissect_DELTA_ALIAS_MEMBER, NDR_POINTER_UNIQUE,
2826                         "DELTA_ALIAS_MEMBER:", -1, 0);
2827                 break;
2828         case 13:
2829                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2830                         netlogon_dissect_DELTA_POLICY, NDR_POINTER_UNIQUE,
2831                         "DELTA_POLICY:", -1, 0);
2832                 break;
2833         case 14:
2834                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2835                         netlogon_dissect_DELTA_TRUSTED_DOMAINS, NDR_POINTER_UNIQUE,
2836                         "DELTA_TRUSTED_DOMAINS:", -1, 0);
2837                 break;
2838         case 16:
2839                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2840                         netlogon_dissect_DELTA_ACCOUNTS, NDR_POINTER_UNIQUE,
2841                         "DELTA_ACCOUNTS:", -1, 0);
2842                 break;
2843         case 18:
2844                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2845                         netlogon_dissect_DELTA_SECRET, NDR_POINTER_UNIQUE,
2846                         "DELTA_SECRET:", -1, 0);
2847                 break;
2848         case 20:
2849                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2850                         netlogon_dissect_DELTA_DELETE_USER, NDR_POINTER_UNIQUE,
2851                         "DELTA_DELETE_GROUP:", -1, 0);
2852                 break;
2853         case 21:
2854                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2855                         netlogon_dissect_DELTA_DELETE_USER, NDR_POINTER_UNIQUE,
2856                         "DELTA_DELETE_USER:", -1, 0);
2857                 break;
2858         case 22:
2859                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2860                         netlogon_dissect_MODIFIED_COUNT, NDR_POINTER_UNIQUE,
2861                         "MODIFIED_COUNT:", -1, 0);
2862                 break;
2863         }
2864
2865         proto_item_set_len(item, offset-old_offset);
2866         return offset;
2867 }
2868
2869
2870
2871 /* IDL XXX must verify this one, especially 13-19
2872  * IDL typedef [switch_type(short)] union {
2873  * IDL   [case(1)] long rid;
2874  * IDL   [case(2)] long rid;
2875  * IDL   [case(3)] long rid;
2876  * IDL   [case(4)] long rid;
2877  * IDL   [case(5)] long rid;
2878  * IDL   [case(6)] long rid;
2879  * IDL   [case(7)] long rid;
2880  * IDL   [case(8)] long rid;
2881  * IDL   [case(9)] long rid;
2882  * IDL   [case(10)] long rid;
2883  * IDL   [case(11)] long rid;
2884  * IDL   [case(12)] long rid;
2885  * IDL   [case(13)] [unique] SID *sid;
2886  * IDL   [case(14)] [unique] SID *sid;
2887  * IDL   [case(15)] [unique] SID *sid;
2888  * IDL   [case(16)] [unique] SID *sid;
2889  * IDL   [case(17)] [unique] SID *sid;
2890  * IDL   [case(18)] [unique][string] wchar_t *Name ;
2891  * IDL   [case(19)] [unique][string] wchar_t *Name ;
2892  * IDL   [case(20)] long rid;
2893  * IDL   [case(21)] long rid;
2894  * IDL } DELTA_ID_UNION;
2895  */
2896 static int
2897 netlogon_dissect_DELTA_ID_UNION(tvbuff_t *tvb, int offset,
2898                         packet_info *pinfo, proto_tree *parent_tree,
2899                         char *drep)
2900 {
2901         proto_item *item=NULL;
2902         proto_tree *tree=NULL;
2903         int old_offset=offset;
2904         guint16 level;
2905
2906         if(parent_tree){
2907                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2908                         "DELTA_ID_UNION:");
2909                 tree = proto_item_add_subtree(item, ett_DELTA_ID_UNION);
2910         }
2911
2912         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2913                 hf_netlogon_level16, &level);
2914
2915         ALIGN_TO_4_BYTES;
2916         switch(level){
2917         case 1:
2918                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2919                         hf_netlogon_user_rid, NULL);
2920                 break;
2921         case 2:
2922                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2923                         hf_netlogon_user_rid, NULL);
2924                 break;
2925         case 3:
2926                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2927                         hf_netlogon_user_rid, NULL);
2928                 break;
2929         case 4:
2930                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2931                         hf_netlogon_user_rid, NULL);
2932                 break;
2933         case 5:
2934                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2935                         hf_netlogon_user_rid, NULL);
2936                 break;
2937         case 6:
2938                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2939                         hf_netlogon_user_rid, NULL);
2940                 break;
2941         case 7:
2942                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2943                         hf_netlogon_user_rid, NULL);
2944                 break;
2945         case 8:
2946                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2947                         hf_netlogon_user_rid, NULL);
2948                 break;
2949         case 9:
2950                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2951                         hf_netlogon_user_rid, NULL);
2952                 break;
2953         case 10:
2954                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2955                         hf_netlogon_user_rid, NULL);
2956                 break;
2957         case 11:
2958                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2959                         hf_netlogon_user_rid, NULL);
2960                 break;
2961         case 12:
2962                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2963                         hf_netlogon_user_rid, NULL);
2964                 break;
2965         case 13:
2966                 offset = dissect_ndr_nt_PSID(tvb, offset,
2967                         pinfo, tree, drep);
2968                 break;
2969         case 14:
2970                 offset = dissect_ndr_nt_PSID(tvb, offset,
2971                         pinfo, tree, drep);
2972                 break;
2973         case 15:
2974                 offset = dissect_ndr_nt_PSID(tvb, offset,
2975                         pinfo, tree, drep);
2976                 break;
2977         case 16:
2978                 offset = dissect_ndr_nt_PSID(tvb, offset,
2979                         pinfo, tree, drep);
2980                 break;
2981         case 17:
2982                 offset = dissect_ndr_nt_PSID(tvb, offset,
2983                         pinfo, tree, drep);
2984                 break;
2985         case 18:
2986                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2987                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
2988                         "unknown", hf_netlogon_unknown_string, -1);
2989                 break;
2990         case 19:
2991                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2992                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
2993                         "unknown", hf_netlogon_unknown_string, -1);
2994                 break;
2995         case 20:
2996                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2997                         hf_netlogon_user_rid, NULL);
2998                 break;
2999         case 21:
3000                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3001                         hf_netlogon_user_rid, NULL);
3002                 break;
3003         }
3004
3005         proto_item_set_len(item, offset-old_offset);
3006         return offset;
3007 }
3008
3009 /*
3010  * IDL typedef struct {
3011  * IDL   short delta_type;
3012  * IDL   DELTA_ID_UNION delta_id_union;
3013  * IDL   DELTA_UNION delta_union;
3014  * IDL } DELTA_ENUM;
3015  */
3016 static int
3017 netlogon_dissect_DELTA_ENUM(tvbuff_t *tvb, int offset,
3018                         packet_info *pinfo, proto_tree *parent_tree,
3019                         char *drep)
3020 {
3021         proto_item *item=NULL;
3022         proto_tree *tree=NULL;
3023         int old_offset=offset;
3024
3025         if(parent_tree){
3026                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3027                         "DELTA_ENUM:");
3028                 tree = proto_item_add_subtree(item, ett_DELTA_ENUM);
3029         }
3030
3031         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3032                 hf_netlogon_delta_type, NULL);
3033
3034         offset = netlogon_dissect_DELTA_ID_UNION(tvb, offset,
3035                 pinfo, tree, drep);
3036
3037         offset = netlogon_dissect_DELTA_UNION(tvb, offset,
3038                 pinfo, tree, drep);
3039
3040         proto_item_set_len(item, offset-old_offset);
3041         return offset;
3042 }
3043
3044 static int
3045 netlogon_dissect_DELTA_ENUM_array(tvbuff_t *tvb, int offset,
3046                         packet_info *pinfo, proto_tree *tree,
3047                         char *drep)
3048 {
3049         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3050                 netlogon_dissect_DELTA_ENUM);
3051
3052         return offset;
3053 }
3054
3055 /*
3056  * IDL typedef struct {
3057  * IDL   long num_deltas;
3058  * IDL   [unique][size_is(num_deltas)] DELTA_ENUM *delta_enum;
3059  * IDL } DELTA_ENUM_ARRAY;
3060  */
3061 static int
3062 netlogon_dissect_DELTA_ENUM_ARRAY(tvbuff_t *tvb, int offset,
3063                         packet_info *pinfo, proto_tree *tree,
3064                         char *drep)
3065 {
3066         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3067                 hf_netlogon_num_deltas, NULL);
3068
3069         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3070                 netlogon_dissect_DELTA_ENUM_array, NDR_POINTER_UNIQUE,
3071                 "DELTA_ENUM: deltas", -1, 0);
3072
3073         return offset;
3074 }
3075
3076
3077 /*
3078  * IDL long NetDatabaseDeltas(
3079  * IDL      [in][string][ref] wchar_t *logonserver, # REF!!!
3080  * IDL      [in][string][ref] wchar_t *computername,
3081  * IDL      [in][ref] AUTHENTICATOR credential,
3082  * IDL      [in][out][ref] AUTHENTICATOR return_authenticator,
3083  * IDL      [in] long database_id,
3084  * IDL      [in][out][ref] MODIFIED_COUNT domain_modify_count,
3085  * IDL      [in] long preferredmaximumlength,
3086  * IDL      [out][unique] DELTA_ENUM_ARRAY *delta_enum_array
3087  * IDL );
3088  */
3089 static int
3090 netlogon_dissect_netsamdeltas_rqst(tvbuff_t *tvb, int offset,
3091         packet_info *pinfo, proto_tree *tree, char *drep)
3092 {
3093         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3094                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3095                 "Server Handle", hf_netlogon_logonsrv_handle, 0);
3096
3097         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3098                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3099                 "Computer Name", hf_netlogon_computer_name, 0);
3100
3101         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3102                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3103                 "AUTHENTICATOR: credential", -1, 0);
3104
3105         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3106                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3107                 "AUTHENTICATOR: return_authenticator", -1, 0);
3108
3109         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3110                 hf_netlogon_database_id, NULL);
3111
3112         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3113                 netlogon_dissect_MODIFIED_COUNT, NDR_POINTER_REF,
3114                 "MODIFIED_COUNT: domain modified count", -1, 0);
3115
3116         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3117                 hf_netlogon_max_size, NULL);
3118
3119         return offset;
3120 }
3121 static int
3122 netlogon_dissect_netsamdeltas_reply(tvbuff_t *tvb, int offset,
3123         packet_info *pinfo, proto_tree *tree, char *drep)
3124 {
3125         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3126                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3127                 "AUTHENTICATOR: return_authenticator", -1, 0);
3128
3129         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3130                 netlogon_dissect_MODIFIED_COUNT, NDR_POINTER_REF,
3131                 "MODIFIED_COUNT: domain modified count", -1, 0);
3132
3133         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3134                 netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE,
3135                 "DELTA_ENUM_ARRAY: deltas", -1, 0);
3136
3137         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3138                                   hf_netlogon_rc, NULL);
3139
3140         return offset;
3141 }
3142
3143
3144 /*
3145  * IDL long NetDatabaseSync(
3146  * IDL      [in][string][ref] wchar_t *logonserver, # REF!!!
3147  * IDL      [in][string][ref] wchar_t *computername,
3148  * IDL      [in][ref] AUTHENTICATOR credential,
3149  * IDL      [in][out][ref] AUTHENTICATOR return_authenticator,
3150  * IDL      [in] long database_id,
3151  * IDL      [in][out][ref] long sync_context,
3152  * IDL      [in] long preferredmaximumlength,
3153  * IDL      [out][unique] DELTA_ENUM_ARRAY *delta_enum_array
3154  * IDL );
3155  */
3156 static int
3157 netlogon_dissect_netlogondatabasesync_rqst(tvbuff_t *tvb, int offset,
3158         packet_info *pinfo, proto_tree *tree, char *drep)
3159 {
3160         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3161                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3162                 "Server Handle", hf_netlogon_logonsrv_handle, 0);
3163
3164         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3165                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3166                 "Computer Name", hf_netlogon_computer_name, 0);
3167
3168         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3169                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3170                 "AUTHENTICATOR: credential", -1, 0);
3171
3172         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3173                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3174                 "AUTHENTICATOR: return_authenticator", -1, 0);
3175
3176         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3177                 hf_netlogon_database_id, NULL);
3178
3179         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3180                 hf_netlogon_sync_context, NULL);
3181
3182         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3183                 hf_netlogon_max_size, NULL);
3184
3185         return offset;
3186 }
3187
3188
3189 static int
3190 netlogon_dissect_netlogondatabasesync_reply(tvbuff_t *tvb, int offset,
3191         packet_info *pinfo, proto_tree *tree, char *drep)
3192 {
3193         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3194                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3195                 "AUTHENTICATOR: return_authenticator", -1, 0);
3196
3197         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3198                 hf_netlogon_sync_context, NULL);
3199
3200         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3201                 netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE,
3202                 "DELTA_ENUM_ARRAY: deltas", -1, 0);
3203
3204         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3205                                   hf_netlogon_rc, NULL);
3206
3207         return offset;
3208 }
3209
3210 /*
3211  * IDL typedef struct {
3212  * IDL   char computer_name[16];
3213  * IDL   long timecreated;
3214  * IDL   long serial_number;
3215  * IDL } UAS_INFO_0;
3216  */
3217 static int
3218 netlogon_dissect_UAS_INFO_0(tvbuff_t *tvb, int offset,
3219                         packet_info *pinfo, proto_tree *tree,
3220                         char *drep)
3221 {
3222         dcerpc_info *di;
3223
3224         di=pinfo->private_data;
3225         if(di->conformant_run){
3226                 /*just a run to handle conformant arrays, nothing to dissect */
3227                 return offset;
3228         }
3229
3230         proto_tree_add_item(tree, hf_netlogon_computer_name, tvb, offset, 16, FALSE);
3231         offset += 16;
3232
3233         proto_tree_add_text(tree, tvb, offset, 4, "Time Created: unknown time format");
3234         offset+= 4;
3235
3236         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3237                 hf_netlogon_serial_number, NULL);
3238
3239         return offset;
3240 }
3241
3242
3243 static int
3244 netlogon_dissect_BYTE_byte(tvbuff_t *tvb, int offset,
3245                         packet_info *pinfo, proto_tree *tree,
3246                         char *drep)
3247 {
3248                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
3249                         hf_netlogon_unknown_char, NULL);
3250
3251         return offset;
3252 }
3253
3254 static int
3255 netlogon_dissect_BYTE_array(tvbuff_t *tvb, int offset,
3256                         packet_info *pinfo, proto_tree *tree,
3257                         char *drep)
3258 {
3259         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3260                 netlogon_dissect_BYTE_byte);
3261
3262         return offset;
3263 }
3264
3265 /*
3266  * IDL long NetAccountDelta(
3267  * IDL      [in][string][unique] wchar_t *logonserver,
3268  * IDL      [in][string][ref] wchar_t *computername,
3269  * IDL      [in][ref] AUTHENTICATOR credential,
3270  * IDL      [in][out][ref] AUTHENTICATOR return_authenticator,
3271  * IDL      [out][ref][size_is(count_returned)] char *Buffer,
3272  * IDL      [out][ref] long count_returned,
3273  * IDL      [out][ref] long total_entries,
3274  * IDL      [in][out][ref] UAS_INFO_0 recordid,
3275  * IDL      [in][long] count,
3276  * IDL      [in][long] level,
3277  * IDL      [in][long] buffersize,
3278  * IDL );
3279  */
3280 static int
3281 netlogon_dissect_netlogonaccountdeltas_rqst(tvbuff_t *tvb, int offset,
3282         packet_info *pinfo, proto_tree *tree, char *drep)
3283 {
3284         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3285                 pinfo, tree, drep);
3286
3287         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3288                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3289                 "Computer Name", hf_netlogon_computer_name, 0);
3290
3291         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3292                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3293                 "AUTHENTICATOR: credential", -1, 0);
3294
3295         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3296                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3297                 "AUTHENTICATOR: return_authenticator", -1, 0);
3298
3299         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3300                 netlogon_dissect_UAS_INFO_0, NDR_POINTER_REF,
3301                 "UAS_INFO_0: RecordID", -1, 0);
3302
3303         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3304                 hf_netlogon_count, NULL);
3305
3306         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3307                 hf_netlogon_level, NULL);
3308
3309         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3310                 hf_netlogon_max_size, NULL);
3311
3312         return offset;
3313 }
3314 static int
3315 netlogon_dissect_netlogonaccountdeltas_reply(tvbuff_t *tvb, int offset,
3316         packet_info *pinfo, proto_tree *tree, char *drep)
3317 {
3318         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3319                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3320                 "AUTHENTICATOR: return_authenticator", -1, 0);
3321
3322         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3323                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3324                 "BYTE_array: Buffer", -1, 0);
3325
3326         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3327                 hf_netlogon_count, NULL);
3328
3329         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3330                 hf_netlogon_entries, NULL);
3331
3332         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3333                 netlogon_dissect_UAS_INFO_0, NDR_POINTER_REF,
3334                 "UAS_INFO_0: RecordID", -1, 0);
3335
3336         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3337                                   hf_netlogon_rc, NULL);
3338
3339         return offset;
3340 }
3341
3342
3343 /*
3344  * IDL long NetAccountDelta(
3345  * IDL      [in][string][unique] wchar_t *logonserver,
3346  * IDL      [in][string][ref] wchar_t *computername,
3347  * IDL      [in][ref] AUTHENTICATOR credential,
3348  * IDL      [in][out][ref] AUTHENTICATOR return_authenticator,
3349  * IDL      [out][ref][size_is(count_returned)] char *Buffer,
3350  * IDL      [out][ref] long count_returned,
3351  * IDL      [out][ref] long total_entries,
3352  * IDL      [out][ref] long next_reference,
3353  * IDL      [in][long] reference,
3354  * IDL      [in][long] level,
3355  * IDL      [in][long] buffersize,
3356  * IDL      [in][out][ref] UAS_INFO_0 recordid,
3357  * IDL );
3358  */
3359 static int
3360 netlogon_dissect_netlogonaccountsync_rqst(tvbuff_t *tvb, int offset,
3361         packet_info *pinfo, proto_tree *tree, char *drep)
3362 {
3363         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3364                 pinfo, tree, drep);
3365
3366         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3367                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3368                 "Computer Name", hf_netlogon_computer_name, 0);
3369
3370         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3371                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3372                 "AUTHENTICATOR: credential", -1, 0);
3373
3374         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3375                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3376                 "AUTHENTICATOR: return_authenticator", -1, 0);
3377
3378         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3379                 hf_netlogon_reference, NULL);
3380
3381         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3382                 hf_netlogon_level, NULL);
3383
3384         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3385                 hf_netlogon_max_size, NULL);
3386
3387         return offset;
3388 }
3389 static int
3390 netlogon_dissect_netlogonaccountsync_reply(tvbuff_t *tvb, int offset,
3391         packet_info *pinfo, proto_tree *tree, char *drep)
3392 {
3393         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3394                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3395                 "AUTHENTICATOR: return_authenticator", -1, 0);
3396
3397         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3398                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3399                 "BYTE_array: Buffer", -1, 0);
3400
3401         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3402                 hf_netlogon_count, NULL);
3403
3404         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3405                 hf_netlogon_entries, NULL);
3406
3407         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3408                 hf_netlogon_next_reference, NULL);
3409
3410         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3411                 netlogon_dissect_UAS_INFO_0, NDR_POINTER_REF,
3412                 "UAS_INFO_0: RecordID", -1, 0);
3413
3414         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3415                                   hf_netlogon_rc, NULL);
3416
3417         return offset;
3418 }
3419
3420
3421 /*
3422  * IDL long NetGetDCName(
3423  * IDL    [in][ref][string] wchar_t *logon_server,
3424  * IDL    [in][unique][string] wchar_t *domainname,
3425  * IDL    [out][unique][string] wchar_t *dcname,
3426  * IDL };
3427  */
3428 static int
3429 netlogon_dissect_netlogongetdcname_rqst(tvbuff_t *tvb, int offset,
3430         packet_info *pinfo, proto_tree *tree, char *drep)
3431 {
3432         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3433                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3434                 "Server Handle", hf_netlogon_logonsrv_handle, 0);
3435
3436         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3437                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3438                 "Domain", hf_netlogon_domain_name, 0);
3439
3440         return offset;
3441 }
3442 static int
3443 netlogon_dissect_netlogongetdcname_reply(tvbuff_t *tvb, int offset,
3444         packet_info *pinfo, proto_tree *tree, char *drep)
3445 {
3446         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3447                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3448                 "Domain", hf_netlogon_dc_name, 0);
3449
3450         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3451                                   hf_netlogon_rc, NULL);
3452
3453         return offset;
3454 }
3455
3456
3457
3458 /*
3459  * IDL typedef struct {
3460  * IDL   long flags;
3461  * IDL   long pdc_connection_status;
3462  * IDL } NETLOGON_INFO_1;
3463  */
3464 static int
3465 netlogon_dissect_NETLOGON_INFO_1(tvbuff_t *tvb, int offset,
3466                         packet_info *pinfo, proto_tree *tree,
3467                         char *drep)
3468 {
3469         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3470                 hf_netlogon_flags, NULL);
3471
3472         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3473                 hf_netlogon_pdc_connection_status, NULL);
3474
3475         return offset;
3476 }
3477
3478
3479 /*
3480  * IDL typedef struct {
3481  * IDL   long flags;
3482  * IDL   long pdc_connection_status;
3483  * IDL   [unique][string] wchar_t trusted_dc_name;
3484  * IDL   long tc_connection_status;
3485  * IDL } NETLOGON_INFO_2;
3486  */
3487 static int
3488 netlogon_dissect_NETLOGON_INFO_2(tvbuff_t *tvb, int offset,
3489                         packet_info *pinfo, proto_tree *tree,
3490                         char *drep)
3491 {
3492         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3493                 hf_netlogon_flags, NULL);
3494
3495         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3496                 hf_netlogon_pdc_connection_status, NULL);
3497
3498         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3499                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3500                 "Trusted DC Name", hf_netlogon_trusted_dc_name, 0);
3501
3502         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3503                 hf_netlogon_tc_connection_status, NULL);
3504
3505         return offset;
3506 }
3507
3508
3509 /*
3510  * IDL typedef struct {
3511  * IDL   long flags;
3512  * IDL   long logon_attempts;
3513  * IDL   long reserved;
3514  * IDL   long reserved;
3515  * IDL   long reserved;
3516  * IDL   long reserved;
3517  * IDL   long reserved;
3518  * IDL } NETLOGON_INFO_3;
3519  */
3520 static int
3521 netlogon_dissect_NETLOGON_INFO_3(tvbuff_t *tvb, int offset,
3522                         packet_info *pinfo, proto_tree *tree,
3523                         char *drep)
3524 {
3525         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3526                 hf_netlogon_flags, NULL);
3527
3528         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3529                 hf_netlogon_logon_attempts, NULL);
3530
3531         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3532                 hf_netlogon_reserved, NULL);
3533
3534         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3535                 hf_netlogon_reserved, NULL);
3536
3537         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3538                 hf_netlogon_reserved, NULL);
3539
3540         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3541                 hf_netlogon_reserved, NULL);
3542
3543         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3544                 hf_netlogon_reserved, NULL);
3545
3546         return offset;
3547 }
3548
3549
3550 /*
3551  * IDL typedef [switch_type(long)] union {
3552  * IDL   [case(1)] [unique] NETLOGON_INFO_1 *i1;
3553  * IDL   [case(2)] [unique] NETLOGON_INFO_2 *i2;
3554  * IDL   [case(3)] [unique] NETLOGON_INFO_3 *i3;
3555  * IDL } CONTROL_QUERY_INFORMATION;
3556  */
3557 static int
3558 netlogon_dissect_CONTROL_QUERY_INFORMATION(tvbuff_t *tvb, int offset,
3559                         packet_info *pinfo, proto_tree *tree,
3560                         char *drep)
3561 {
3562         guint32 level;
3563
3564         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3565                 hf_netlogon_level, &level);
3566
3567         ALIGN_TO_4_BYTES;
3568         switch(level){
3569         case 1:
3570                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3571                         netlogon_dissect_NETLOGON_INFO_1, NDR_POINTER_UNIQUE,
3572                         "NETLOGON_INFO_1:", -1, 0);
3573                 break;
3574         case 2:
3575                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3576                         netlogon_dissect_NETLOGON_INFO_2, NDR_POINTER_UNIQUE,
3577                         "NETLOGON_INFO_2:", -1, 0);
3578                 break;
3579         case 3:
3580                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3581                         netlogon_dissect_NETLOGON_INFO_3, NDR_POINTER_UNIQUE,
3582                         "NETLOGON_INFO_3:", -1, 0);
3583                 break;
3584         }
3585
3586         return offset;
3587 }
3588
3589
3590 /*
3591  * IDL long NetLogonControl(
3592  * IDL      [in][string][unique] wchar_t *logonserver,
3593  * IDL      [in] long function_code,
3594  * IDL      [in] long level,
3595  * IDL      [out][ref] CONTROL_QUERY_INFORMATION
3596  * IDL );
3597  */
3598 static int
3599 netlogon_dissect_netlogoncontrol_rqst(tvbuff_t *tvb, int offset,
3600         packet_info *pinfo, proto_tree *tree, char *drep)
3601 {
3602         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3603                 pinfo, tree, drep);
3604
3605         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3606                 hf_netlogon_code, NULL);
3607
3608         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3609                 hf_netlogon_level, NULL);
3610
3611         return offset;
3612 }
3613 static int
3614 netlogon_dissect_netlogoncontrol_reply(tvbuff_t *tvb, int offset,
3615         packet_info *pinfo, proto_tree *tree, char *drep)
3616 {
3617         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3618                 netlogon_dissect_CONTROL_QUERY_INFORMATION, NDR_POINTER_REF,
3619                 "CONTROL_QUERY_INFORMATION:", -1, 0);
3620
3621         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3622                                   hf_netlogon_rc, NULL);
3623
3624         return offset;
3625 }
3626
3627
3628 /*
3629  * IDL long NetGetDCName(
3630  * IDL    [in][unique][string] wchar_t *logon_server,
3631  * IDL    [in][unique][string] wchar_t *domainname,
3632  * IDL    [out][unique][string] wchar_t *dcname,
3633  * IDL };
3634  */
3635 static int
3636 netlogon_dissect_netlogongetanydcname_rqst(tvbuff_t *tvb, int offset,
3637         packet_info *pinfo, proto_tree *tree, char *drep)
3638 {
3639         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3640                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3641                 "Server Handle", hf_netlogon_logonsrv_handle, 0);
3642
3643         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3644                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3645                 "Domain", hf_netlogon_domain_name, 0);
3646
3647         return offset;
3648 }
3649 static int
3650 netlogon_dissect_netlogongetanydcname_reply(tvbuff_t *tvb, int offset,
3651         packet_info *pinfo, proto_tree *tree, char *drep)
3652 {
3653         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3654                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3655                 "Domain", hf_netlogon_dc_name, 0);
3656
3657         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3658                                   hf_netlogon_rc, NULL);
3659
3660         return offset;
3661 }
3662
3663
3664 /*
3665  * IDL typedef [switch_type(long)] union {
3666  * IDL   [case(5)] [unique][string] wchar_t *unknown;
3667  * IDL   [case(6)] [unique][string] wchar_t *unknown;
3668  * IDL   [case(0xfffe)] long unknown;
3669  * IDL   [case(7)] [unique][string] wchar_t *unknown;
3670  * IDL } CONTROL_DATA_INFORMATION;
3671  */
3672 /* XXX
3673  * According to muddle this is what CONTROL_DATA_INFORMATION is supposed
3674  * to look like. However NetMon does not recognize any such informationlevels.
3675  *
3676  * Ill leave it as CONTROL_DATA_INFORMATION with no informationlevels
3677  * until someone has any source of better authority to call upon.
3678  */
3679 static int
3680 netlogon_dissect_CONTROL_DATA_INFORMATION(tvbuff_t *tvb, int offset,
3681                         packet_info *pinfo, proto_tree *tree,
3682                         char *drep)
3683 {
3684         guint32 level;
3685
3686         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3687                 hf_netlogon_level, &level);
3688
3689         ALIGN_TO_4_BYTES;
3690         switch(level){
3691         case 5:
3692                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3693                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3694                         "unknown", hf_netlogon_unknown_string, -1);
3695                 break;
3696         case 6:
3697                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3698                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3699                         "unknown", hf_netlogon_unknown_string, -1);
3700                 break;
3701         case 0xfffe:
3702                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3703                         hf_netlogon_unknown_long, NULL);
3704                 break;
3705         case 8:
3706                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3707                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3708                         "unknown", hf_netlogon_unknown_string, -1);
3709                 break;
3710         }
3711
3712         return offset;
3713 }
3714
3715
3716 /*
3717  * IDL long NetLogonControl2(
3718  * IDL      [in][string][unique] wchar_t *logonserver,
3719  * IDL      [in] long function_code,
3720  * IDL      [in] long level,
3721  * IDL      [in][ref] CONTROL_DATA_INFORMATION *data,
3722  * IDL      [out][ref] CONTROL_QUERY_INFORMATION *query
3723  * IDL );
3724  */
3725 static int
3726 netlogon_dissect_netlogoncontrol2_rqst(tvbuff_t *tvb, int offset,
3727         packet_info *pinfo, proto_tree *tree, char *drep)
3728 {
3729         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3730                 pinfo, tree, drep);
3731
3732         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3733                 hf_netlogon_code, NULL);
3734
3735         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3736                 hf_netlogon_level, NULL);
3737
3738         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3739                 netlogon_dissect_CONTROL_DATA_INFORMATION, NDR_POINTER_REF,
3740                 "CONTROL_DATA_INFORMATION: ", -1, 0);
3741
3742         return offset;
3743 }
3744
3745 static int
3746 netlogon_dissect_netlogoncontrol2_reply(tvbuff_t *tvb, int offset,
3747         packet_info *pinfo, proto_tree *tree, char *drep)
3748 {
3749         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3750                 netlogon_dissect_CONTROL_QUERY_INFORMATION, NDR_POINTER_REF,
3751                 "CONTROL_QUERY_INFORMATION:", -1, 0);
3752
3753         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3754                                   hf_netlogon_rc, NULL);
3755
3756         return offset;
3757 }
3758
3759
3760 /*
3761  * IDL long NetServerAuthenticate2(
3762  * IDL      [in][string][unique] wchar_t *logonserver,
3763  * IDL      [in][ref][string] wchar_t *username,
3764  * IDL      [in] short secure_channel_type,
3765  * IDL      [in][ref][string] wchar_t *computername,
3766  * IDL      [in][ref] CREDENTIAL *client_chal,
3767  * IDL      [out][ref] CREDENTIAL *server_chal,
3768  * IDL      [in][out][ref] long *negotiate_flags,
3769  * IDL );
3770  */
3771 static int
3772 netlogon_dissect_netserverauthenticate2_rqst(tvbuff_t *tvb, int offset,
3773         packet_info *pinfo, proto_tree *tree, char *drep)
3774 {
3775         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3776                 pinfo, tree, drep);
3777
3778         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3779                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3780                 "User Name", hf_netlogon_acct_name, 0);
3781
3782         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
3783                 pinfo, tree, drep);
3784
3785         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3786                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3787                 "Computer Name", hf_netlogon_computer_name, 0);
3788
3789         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3790                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
3791                 "CREDENTIAL: client_chal", -1, 0);
3792
3793         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3794                 hf_netlogon_neg_flags, NULL);
3795
3796         return offset;
3797 }
3798
3799 static int
3800 netlogon_dissect_netserverauthenticate2_reply(tvbuff_t *tvb, int offset,
3801         packet_info *pinfo, proto_tree *tree, char *drep)
3802 {
3803         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3804                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
3805                 "CREDENTIAL: server_chal", -1, 0);
3806
3807         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3808                 hf_netlogon_neg_flags, NULL);
3809
3810         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3811                                   hf_netlogon_rc, NULL);
3812
3813         return offset;
3814 }
3815
3816
3817 /*
3818  * IDL long NetDatabaseSync2(
3819  * IDL      [in][string][ref] wchar_t *logonserver, # REF!!!
3820  * IDL      [in][string][ref] wchar_t *computername,
3821  * IDL      [in][ref] AUTHENTICATOR credential,
3822  * IDL      [in][out][ref] AUTHENTICATOR return_authenticator,
3823  * IDL      [in] long database_id,
3824  * IDL      [in] short restart_state,
3825  * IDL      [in][out][ref] long *sync_context,
3826  * IDL      [in] long preferredmaximumlength,
3827  * IDL      [out][unique] DELTA_ENUM_ARRAY *delta_enum_array
3828  * IDL );
3829  */
3830 static int
3831 netlogon_dissect_netdatabasesync2_rqst(tvbuff_t *tvb, int offset,
3832         packet_info *pinfo, proto_tree *tree, char *drep)
3833 {
3834         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3835                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3836                 "Server Handle", hf_netlogon_logonsrv_handle, 0);
3837
3838         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3839                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3840                 "Computer Name", hf_netlogon_computer_name, 0);
3841
3842         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3843                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3844                 "AUTHENTICATOR: credential", -1, 0);
3845
3846         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3847                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3848                 "AUTHENTICATOR: return_authenticator", -1, 0);
3849
3850         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3851                 hf_netlogon_database_id, NULL);
3852
3853         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3854                 hf_netlogon_restart_state, NULL);
3855
3856         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3857                 hf_netlogon_sync_context, NULL);
3858
3859         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3860                 hf_netlogon_max_size, NULL);
3861
3862         return offset;
3863 }
3864
3865 static int
3866 netlogon_dissect_netdatabasesync2_reply(tvbuff_t *tvb, int offset,
3867         packet_info *pinfo, proto_tree *tree, char *drep)
3868 {
3869         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3870                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3871                 "AUTHENTICATOR: return_authenticator", -1, 0);
3872
3873         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3874                 hf_netlogon_sync_context, NULL);
3875
3876         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3877                 netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE,
3878                 "DELTA_ENUM_ARRAY: deltas", -1, 0);
3879
3880         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3881                                   hf_netlogon_rc, NULL);
3882
3883         return offset;
3884 }
3885
3886
3887 /*
3888  * IDL long NetDatabaseRedo(
3889  * IDL      [in][string][ref] wchar_t *logonserver, # REF!!!
3890  * IDL      [in][string][ref] wchar_t *computername,
3891  * IDL      [in][ref] AUTHENTICATOR credential,
3892  * IDL      [in][out][ref] AUTHENTICATOR return_authenticator,
3893  * IDL      [in][ref][size_is(change_log_entry_size)] char *change_log_entry,
3894  * IDL      [in] long change_log_entry_size,
3895  * IDL      [out][unique] DELTA_ENUM_ARRAY *delta_enum_array
3896  * IDL );
3897  */
3898 static int
3899 netlogon_dissect_netlogondatabaseredo_rqst(tvbuff_t *tvb, int offset,
3900         packet_info *pinfo, proto_tree *tree, char *drep)
3901 {
3902         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3903                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3904                 "Server Handle", hf_netlogon_logonsrv_handle, 0);
3905
3906         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3907                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3908                 "Computer Name", hf_netlogon_computer_name, 0);
3909
3910         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3911                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3912                 "AUTHENTICATOR: credential", -1, 0);
3913
3914         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3915                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3916                 "AUTHENTICATOR: return_authenticator", -1, 0);
3917
3918         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3919                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3920                 "Change log entry: ", -1, 0);
3921
3922         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3923                 hf_netlogon_max_log_size, NULL);
3924
3925         return offset;
3926 }
3927
3928 static int
3929 netlogon_dissect_netlogondatabaseredo_reply(tvbuff_t *tvb, int offset,
3930         packet_info *pinfo, proto_tree *tree, char *drep)
3931 {
3932         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3933                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3934                 "AUTHENTICATOR: return_authenticator", -1, 0);
3935
3936         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3937                 netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE,
3938                 "DELTA_ENUM_ARRAY: deltas", -1, 0);
3939
3940         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3941                                   hf_netlogon_rc, NULL);
3942
3943         return offset;
3944 }
3945
3946
3947 /* XXX NetMon does not recognize this as a valid function. Muddle however
3948  * tells us what parameters it takes but not their names.
3949  * It looks similar to logoncontrol2.  perhaps it is logoncontrol3?
3950  */
3951 /*
3952  * IDL long NetFunction_12(
3953  * IDL      [in][string][unique] wchar_t *logonserver,
3954  * IDL      [in] long function_code,
3955  * IDL      [in] long level,
3956  * IDL      [in][ref] CONTROL_DATA_INFORMATION *data,
3957  * IDL      [out][ref] CONTROL_QUERY_INFORMATION *query
3958  * IDL );
3959  */
3960 static int
3961 netlogon_dissect_function_12_rqst(tvbuff_t *tvb, int offset,
3962         packet_info *pinfo, proto_tree *tree, char *drep)
3963 {
3964         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3965                 pinfo, tree, drep);
3966
3967         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3968                 hf_netlogon_code, NULL);
3969
3970         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3971                 hf_netlogon_level, NULL);
3972
3973         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3974                 netlogon_dissect_CONTROL_DATA_INFORMATION, NDR_POINTER_REF,
3975                 "CONTROL_DATA_INFORMATION: ", -1, 0);
3976
3977         return offset;
3978 }
3979 static int
3980 netlogon_dissect_function_12_reply(tvbuff_t *tvb, int offset,
3981         packet_info *pinfo, proto_tree *tree, char *drep)
3982 {
3983         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3984                 netlogon_dissect_CONTROL_QUERY_INFORMATION, NDR_POINTER_REF,
3985                 "CONTROL_QUERY_INFORMATION:", -1, 0);
3986
3987         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3988                                   hf_netlogon_rc, NULL);
3989
3990         return offset;
3991 }
3992
3993
3994
3995
3996 /*qqq*/
3997 /* Updated above this line */
3998
3999
4000
4001
4002
4003
4004 static int
4005 netlogon_dissect_pointer_long(tvbuff_t *tvb, int offset,
4006                              packet_info *pinfo, proto_tree *tree,
4007                              char *drep)
4008 {
4009         dcerpc_info *di;
4010
4011         di=pinfo->private_data;
4012         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
4013                                      di->hf_index, NULL);
4014         return offset;
4015 }
4016
4017 static int
4018 netlogon_dissect_pointer_char(tvbuff_t *tvb, int offset,
4019                              packet_info *pinfo, proto_tree *tree,
4020                              char *drep)
4021 {
4022         dcerpc_info *di;
4023
4024         di=pinfo->private_data;
4025         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4026                                      di->hf_index, NULL);
4027         return offset;
4028 }
4029
4030 static int
4031 netlogon_dissect_UNICODE_STRING(tvbuff_t *tvb, int offset,
4032                         packet_info *pinfo, proto_tree *parent_tree,
4033                         char *drep, int type, int hf_index, int levels)
4034 {
4035         proto_item *item=NULL;
4036         proto_tree *tree=NULL;
4037         int old_offset=offset;
4038         dcerpc_info *di;
4039         char *name;
4040
4041         di=pinfo->private_data;
4042         if(di->conformant_run){
4043                 /*just a run to handle conformant arrays, nothing to dissect */
4044                 return offset;
4045         }
4046
4047         name = proto_registrar_get_name(hf_index);
4048         if(parent_tree){
4049                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
4050                         "%s", name);
4051                 tree = proto_item_add_subtree(item, ett_nt_unicode_string);
4052         }
4053
4054         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4055                         dissect_ndr_nt_UNICODE_STRING_str, type,
4056                         name, hf_index, levels);
4057
4058         proto_item_set_len(item, offset-old_offset);
4059         return offset;
4060 }
4061
4062
4063 static int
4064 netlogon_dissect_UNICODE_MULTI_byte(tvbuff_t *tvb, int offset,
4065                         packet_info *pinfo, proto_tree *tree,
4066                         char *drep)
4067 {
4068                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4069                         hf_netlogon_unknown_char, NULL);
4070
4071         return offset;
4072 }
4073
4074 static int
4075 netlogon_dissect_UNICODE_MULTI_array(tvbuff_t *tvb, int offset,
4076                         packet_info *pinfo, proto_tree *tree,
4077                         char *drep)
4078 {
4079         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
4080                 netlogon_dissect_UNICODE_MULTI_byte);
4081
4082         return offset;
4083 }
4084
4085 static int
4086 netlogon_dissect_UNICODE_MULTI(tvbuff_t *tvb, int offset,
4087                         packet_info *pinfo, proto_tree *parent_tree,
4088                         char *drep)
4089 {
4090         proto_item *item=NULL;
4091         proto_tree *tree=NULL;
4092         int old_offset=offset;
4093
4094         if(parent_tree){
4095                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4096                         "UNICODE_MULTI:");
4097                 tree = proto_item_add_subtree(item, ett_UNICODE_MULTI);
4098         }
4099
4100         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4101                 hf_netlogon_len, NULL);
4102
4103         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4104                 netlogon_dissect_UNICODE_MULTI_array, NDR_POINTER_UNIQUE,
4105                 "unknown", hf_netlogon_unknown_string, 0);
4106
4107         proto_item_set_len(item, offset-old_offset);
4108         return offset;
4109 }
4110
4111 int
4112 dissect_nt_GUID(tvbuff_t *tvb, int offset,
4113                         packet_info *pinfo, proto_tree *tree,
4114                         char *drep)
4115 {
4116         offset=dissect_ndr_uuid_t(tvb, offset, pinfo, tree, drep, hf_netlogon_guid, NULL);
4117
4118         return offset;
4119 }
4120
4121 static int
4122 netlogon_dissect_DOMAIN_CONTROLLER_INFO(tvbuff_t *tvb, int offset,
4123                         packet_info *pinfo, proto_tree *parent_tree,
4124                         char *drep)
4125 {
4126         proto_item *item=NULL;
4127         proto_tree *tree=NULL;
4128         int old_offset=offset;
4129
4130         if(parent_tree){
4131                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4132                         "DOMAIN_CONTROLLER_INFO:");
4133                 tree = proto_item_add_subtree(item, ett_DOMAIN_CONTROLLER_INFO);
4134         }
4135
4136         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4137                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4138                 "DC Name", hf_netlogon_dc_name, 0);
4139
4140         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4141                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4142                 "DC Address", hf_netlogon_dc_address, 0);
4143
4144         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4145                 hf_netlogon_dc_address_type, NULL);
4146
4147         offset = dissect_nt_GUID(tvb, offset,
4148                 pinfo, tree, drep);
4149
4150         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4151                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4152                 "Logon Domain", hf_netlogon_logon_dom, 0);
4153
4154         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4155                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4156                 "DNS Forest", hf_netlogon_dns_forest_name, 0);
4157
4158         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4159                 hf_netlogon_flags, NULL);
4160
4161         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4162                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4163                 "DC Site", hf_netlogon_dc_site_name, 0);
4164
4165         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4166                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4167                 "Client Site", hf_netlogon_client_site_name, 0);
4168
4169         proto_item_set_len(item, offset-old_offset);
4170         return offset;
4171 }
4172
4173 static int
4174 netlogon_dissect_BLOB_array(tvbuff_t *tvb, int offset,
4175                         packet_info *pinfo, proto_tree *tree,
4176                         char *drep)
4177 {
4178         guint32 len;
4179         dcerpc_info *di;
4180
4181         di=pinfo->private_data;
4182         if(di->conformant_run){
4183                 /*just a run to handle conformant arrays, nothing to dissect.*/
4184                 return offset;
4185         }
4186
4187         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4188                 hf_netlogon_blob_size, &len);
4189
4190         proto_tree_add_item(tree, hf_netlogon_blob, tvb, offset, len,
4191                 FALSE);
4192         offset += len;
4193
4194         return offset;
4195 }
4196
4197 static int
4198 netlogon_dissect_BLOB(tvbuff_t *tvb, int offset,
4199                         packet_info *pinfo, proto_tree *parent_tree,
4200                         char *drep)
4201 {
4202         proto_item *item=NULL;
4203         proto_tree *tree=NULL;
4204
4205         if(parent_tree){
4206                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4207                         "BLOB:");
4208                 tree = proto_item_add_subtree(item, ett_BLOB);
4209         }
4210
4211         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4212                 hf_netlogon_blob_size, NULL);
4213
4214         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4215                 netlogon_dissect_BLOB_array, NDR_POINTER_UNIQUE,
4216                 "BLOB:", -1, 0);
4217
4218         return offset;
4219 }
4220
4221 static int
4222 netlogon_dissect_DOMAIN_TRUST_INFO(tvbuff_t *tvb, int offset,
4223                         packet_info *pinfo, proto_tree *tree,
4224                         char *drep)
4225 {
4226         offset = lsa_dissect_POLICY_DNS_DOMAIN_INFO(tvb, offset, pinfo, tree, drep);
4227
4228         /* Guesses at best. */
4229         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4230                 hf_netlogon_unknown_string, 0);
4231
4232         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4233                 hf_netlogon_unknown_string, 0);
4234
4235         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4236                 hf_netlogon_unknown_string, 0);
4237
4238         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4239                 hf_netlogon_unknown_string, 0);
4240
4241         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4242                 hf_netlogon_unknown_long, NULL);
4243
4244         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4245                 hf_netlogon_unknown_long, NULL);
4246
4247         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4248                 hf_netlogon_unknown_long, NULL);
4249
4250         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4251                 hf_netlogon_unknown_long, NULL);
4252
4253         return offset;
4254 }
4255
4256 static int
4257 netlogon_dissect_DOMAIN_TRUST_INFO_ptr(tvbuff_t *tvb, int offset,
4258                         packet_info *pinfo, proto_tree *tree,
4259                         char *drep)
4260 {
4261         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4262                 netlogon_dissect_DOMAIN_TRUST_INFO, NDR_POINTER_UNIQUE,
4263                 "DOMAIN_TRUST_INFO pointer:", -1, 0);
4264
4265         return offset;
4266 }
4267
4268 static int
4269 netlogon_dissect_DOMAIN_TRUST_INFO_ptr_ptr(tvbuff_t *tvb, int offset,
4270                         packet_info *pinfo, proto_tree *tree,
4271                         char *drep)
4272 {
4273         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4274                 netlogon_dissect_DOMAIN_TRUST_INFO_ptr, NDR_POINTER_UNIQUE,
4275                 "DOMAIN_TRUST_INFO pointer pointer:", -1, 0);
4276
4277         return offset;
4278 }
4279
4280 /* Could this be an array? Ronnie? */
4281 static int
4282 netlogon_dissect_DOMAIN_TRUST_INFO_CTR(tvbuff_t *tvb, int offset,
4283                         packet_info *pinfo, proto_tree *tree,
4284                         char *drep)
4285 {
4286         guint32 level;
4287
4288         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4289                 hf_netlogon_level, &level);
4290
4291         ALIGN_TO_4_BYTES;
4292         switch(level){
4293         case 1:
4294                 offset = netlogon_dissect_DOMAIN_TRUST_INFO_ptr_ptr(tvb, offset, pinfo, tree, drep);
4295                 break;
4296         }
4297
4298         return offset;
4299 }
4300
4301 static int
4302 netlogon_dissect_DOMAIN_QUERY_1(tvbuff_t *tvb, int offset,
4303                         packet_info *pinfo, proto_tree *tree,
4304                         char *drep)
4305 {
4306         offset = netlogon_dissect_BLOB(tvb, offset,
4307                 pinfo, tree, drep);
4308
4309         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4310                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4311                 "Workstation FQDN", hf_netlogon_workstation_fqdn, 0);
4312
4313         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4314                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4315                 "unknown", hf_netlogon_unknown_string, -1);
4316
4317         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4318                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4319                 "unknown", hf_netlogon_unknown_string, -1);
4320
4321         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4322                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4323                 "unknown", hf_netlogon_unknown_string, -1);
4324
4325         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4326                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4327                 "unknown", hf_netlogon_unknown_string, -1);
4328
4329         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4330                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4331                 "unknown", hf_netlogon_unknown_string, -1);
4332
4333         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4334                 hf_netlogon_unknown_string, 0);
4335
4336         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4337                 hf_netlogon_workstation_os, 0);
4338
4339         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4340                 hf_netlogon_unknown_string, 0);
4341
4342         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4343                 hf_netlogon_unknown_string, 0);
4344
4345         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4346                 hf_netlogon_unknown_long, NULL);
4347
4348         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4349                 hf_netlogon_unknown_long, NULL);
4350
4351         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4352                 hf_netlogon_unknown_long, NULL);
4353
4354         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4355                 hf_netlogon_unknown_long, NULL);
4356
4357         return offset;
4358 }
4359
4360 static int
4361 netlogon_dissect_DOMAIN_INFO(tvbuff_t *tvb, int offset,
4362                         packet_info *pinfo, proto_tree *tree,
4363                         char *drep)
4364 {
4365         offset = netlogon_dissect_DOMAIN_TRUST_INFO(tvb, offset, pinfo, tree, drep);
4366
4367         offset = netlogon_dissect_DOMAIN_TRUST_INFO_CTR(tvb, offset, pinfo, tree, drep);
4368
4369         offset = netlogon_dissect_BLOB(tvb, offset, pinfo, tree, drep);
4370
4371         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4372                 hf_netlogon_dns_domain_name, 0);
4373
4374         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4375                 hf_netlogon_unknown_string, 0);
4376
4377         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4378                 hf_netlogon_unknown_string, 0);
4379
4380         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4381                 hf_netlogon_unknown_string, 0);
4382
4383         /* These four integers appear to mirror the last four in the query. */
4384         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4385                 hf_netlogon_unknown_long, NULL);
4386
4387         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4388                 hf_netlogon_unknown_long, NULL);
4389
4390         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4391                 hf_netlogon_unknown_long, NULL);
4392
4393         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4394                 hf_netlogon_unknown_long, NULL);
4395
4396         return offset;
4397 }
4398
4399 static int
4400 netlogon_dissect_UNICODE_STRING_512(tvbuff_t *tvb, int offset,
4401                         packet_info *pinfo, proto_tree *parent_tree,
4402                         char *drep)
4403 {
4404         proto_item *item=NULL;
4405         proto_tree *tree=NULL;
4406         int old_offset=offset;
4407         int i;
4408
4409         if(parent_tree){
4410                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4411                         "UNICODE_STRING_512:");
4412                 tree = proto_item_add_subtree(item, ett_UNICODE_STRING_512);
4413         }
4414
4415         for(i=0;i<512;i++){
4416                 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4417                         hf_netlogon_unknown_short, NULL);
4418         }
4419
4420         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4421                 hf_netlogon_unknown_long, NULL);
4422
4423         proto_item_set_len(item, offset-old_offset);
4424         return offset;
4425 }
4426
4427 static int
4428 netlogon_dissect_element_844_byte(tvbuff_t *tvb, int offset,
4429                         packet_info *pinfo, proto_tree *tree,
4430                         char *drep)
4431 {
4432                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4433                         hf_netlogon_unknown_char, NULL);
4434
4435         return offset;
4436 }
4437
4438 static int
4439 netlogon_dissect_element_844_array(tvbuff_t *tvb, int offset,
4440                         packet_info *pinfo, proto_tree *tree,
4441                         char *drep)
4442 {
4443         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
4444                 netlogon_dissect_element_844_byte);
4445
4446         return offset;
4447 }
4448
4449 static int
4450 netlogon_dissect_TYPE_50(tvbuff_t *tvb, int offset,
4451                         packet_info *pinfo, proto_tree *parent_tree,
4452                         char *drep)
4453 {
4454         proto_item *item=NULL;
4455         proto_tree *tree=NULL;
4456         int old_offset=offset;
4457
4458         if(parent_tree){
4459                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4460                         "TYPE_50:");
4461                 tree = proto_item_add_subtree(item, ett_TYPE_50);
4462         }
4463
4464         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4465                 hf_netlogon_unknown_long, NULL);
4466
4467         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4468                 netlogon_dissect_element_844_array, NDR_POINTER_UNIQUE,
4469                 "unknown", hf_netlogon_unknown_string, 0);
4470
4471         proto_item_set_len(item, offset-old_offset);
4472         return offset;
4473 }
4474
4475 static int
4476 netlogon_dissect_TYPE_50_ptr(tvbuff_t *tvb, int offset,
4477                         packet_info *pinfo, proto_tree *tree,
4478                         char *drep)
4479 {
4480         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4481                 netlogon_dissect_TYPE_50, NDR_POINTER_UNIQUE,
4482                 "TYPE_50 pointer: unknown_TYPE_50", -1, 0);
4483
4484         return offset;
4485 }
4486
4487 static int
4488 netlogon_dissect_DSROLE_PRIMARY_DOMAIN_INFO_EX(tvbuff_t *tvb, int offset,
4489         packet_info *pinfo, proto_tree *parent_tree, char *drep)
4490 {
4491         guint32 tmp;
4492         proto_item *item=NULL;
4493         proto_tree *tree=NULL;
4494         int old_offset=offset;
4495
4496         if(parent_tree){
4497                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4498                         "DSROLE_DOMAIN_INFO_EX");
4499                 tree = proto_item_add_subtree(item, ett_DSROLE_DOMAIN_INFO_EX);
4500         }
4501
4502         /* name */
4503         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4504                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4505                 "NetBIOS Name", hf_netlogon_downlevel_domain_name, 1);
4506
4507         /* domain */
4508         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4509                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4510                 "DNS Domain Name", hf_netlogon_dns_domain_name, 1);
4511
4512         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4513                 hf_netlogon_unknown_long, &tmp);
4514
4515         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4516                 hf_netlogon_unknown_long, &tmp);
4517
4518         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4519                 hf_netlogon_unknown_long, &tmp);
4520
4521         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4522                 hf_netlogon_unknown_long, &tmp);
4523
4524         /* SID pointer */
4525         offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
4526
4527         /* GUID */
4528         offset = dissect_nt_GUID(tvb, offset, pinfo, tree, drep);
4529
4530         proto_item_set_len(item, offset-old_offset);
4531         return offset;
4532 }
4533
4534 static int
4535 netlogon_dissect_DSROLE_PRIMARY_DOMAIN_INFO_EX_ARRAY(tvbuff_t *tvb, int offset,
4536                         packet_info *pinfo, proto_tree *tree,
4537                         char *drep)
4538 {
4539         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
4540                 netlogon_dissect_DSROLE_PRIMARY_DOMAIN_INFO_EX);
4541
4542         return offset;
4543 }
4544
4545 static int
4546 netlogon_dissect_element_865_byte(tvbuff_t *tvb, int offset,
4547                         packet_info *pinfo, proto_tree *tree,
4548                         char *drep)
4549 {
4550                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4551                         hf_netlogon_unknown_char, NULL);
4552
4553         return offset;
4554 }
4555
4556 static int
4557 netlogon_dissect_element_865_array(tvbuff_t *tvb, int offset,
4558                         packet_info *pinfo, proto_tree *tree,
4559                         char *drep)
4560 {
4561         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
4562                 netlogon_dissect_element_865_byte);
4563
4564         return offset;
4565 }
4566
4567 static int
4568 netlogon_dissect_element_866_byte(tvbuff_t *tvb, int offset,
4569                         packet_info *pinfo, proto_tree *tree,
4570                         char *drep)
4571 {
4572                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4573                         hf_netlogon_unknown_char, NULL);
4574
4575         return offset;
4576 }
4577
4578 static int
4579 netlogon_dissect_element_866_array(tvbuff_t *tvb, int offset,
4580                         packet_info *pinfo, proto_tree *tree,
4581                         char *drep)
4582 {
4583         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
4584                 netlogon_dissect_element_866_byte);
4585
4586         return offset;
4587 }
4588
4589 static int
4590 netlogon_dissect_TYPE_52(tvbuff_t *tvb, int offset,
4591                         packet_info *pinfo, proto_tree *parent_tree,
4592                         char *drep)
4593 {
4594         proto_item *item=NULL;
4595         proto_tree *tree=NULL;
4596         int old_offset=offset;
4597
4598         if(parent_tree){
4599                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4600                         "TYPE_52:");
4601                 tree = proto_item_add_subtree(item, ett_TYPE_52);
4602         }
4603
4604         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4605                 hf_netlogon_unknown_long, NULL);
4606
4607         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4608                 netlogon_dissect_element_865_array, NDR_POINTER_UNIQUE,
4609                 "unknown", hf_netlogon_unknown_string, 0);
4610
4611         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4612                 netlogon_dissect_element_866_array, NDR_POINTER_UNIQUE,
4613                 "unknown", hf_netlogon_unknown_string, 0);
4614
4615         proto_item_set_len(item, offset-old_offset);
4616         return offset;
4617 }
4618
4619 static int
4620 netlogon_dissect_TYPE_52_ptr(tvbuff_t *tvb, int offset,
4621                         packet_info *pinfo, proto_tree *tree,
4622                         char *drep)
4623 {
4624         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4625                 netlogon_dissect_TYPE_52, NDR_POINTER_UNIQUE,
4626                 "TYPE_52 pointer: unknown_TYPE_52", -1, 0);
4627         return offset;
4628 }
4629
4630
4631 static int
4632 netlogon_dissect_TYPE_44(tvbuff_t *tvb, int offset,
4633                         packet_info *pinfo, proto_tree *parent_tree,
4634                         char *drep)
4635 {
4636         proto_item *item=NULL;
4637         proto_tree *tree=NULL;
4638         int old_offset=offset;
4639         guint32 level;
4640
4641         if(parent_tree){
4642                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4643                         "TYPE_44:");
4644                 tree = proto_item_add_subtree(item, ett_TYPE_44);
4645         }
4646
4647         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4648                 hf_netlogon_level, &level);
4649
4650         ALIGN_TO_4_BYTES;
4651         switch(level){
4652         case 1:
4653                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4654                         hf_netlogon_unknown_long, NULL);
4655                 break;
4656         }
4657
4658         proto_item_set_len(item, offset-old_offset);
4659         return offset;
4660 }
4661
4662 static int
4663 netlogon_dissect_DOMAIN_QUERY(tvbuff_t *tvb, int offset,
4664                         packet_info *pinfo, proto_tree *tree,
4665                         char *drep)
4666 {
4667         guint32 level;
4668
4669         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4670                 hf_netlogon_level, &level);
4671
4672         ALIGN_TO_4_BYTES;
4673         switch(level){
4674         case 1:
4675                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4676                         netlogon_dissect_DOMAIN_QUERY_1, NDR_POINTER_UNIQUE,
4677                         "DOMAIN_QUERY_1:", -1, 0);
4678                 break;
4679         case 2:
4680                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4681                         netlogon_dissect_DOMAIN_QUERY_1, NDR_POINTER_UNIQUE,
4682                         "DOMAIN_QUERY_1:", -1, 0);
4683                 break;
4684         }
4685
4686         return offset;
4687 }
4688
4689 static int
4690 netlogon_dissect_nettrusteddomainlist_rqst(tvbuff_t *tvb, int offset,
4691         packet_info *pinfo, proto_tree *tree, char *drep)
4692 {
4693         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4694                 pinfo, tree, drep);
4695
4696         return offset;
4697 }
4698
4699
4700 static int
4701 netlogon_dissect_nettrusteddomainlist_reply(tvbuff_t *tvb, int offset,
4702         packet_info *pinfo, proto_tree *tree, char *drep)
4703 {
4704         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4705                 netlogon_dissect_UNICODE_MULTI, NDR_POINTER_REF,
4706                 "UNICODE_MULTI pointer: trust_dom_name_list", -1, 0);
4707
4708         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4709                                   hf_netlogon_rc, NULL);
4710
4711         return offset;
4712 }
4713
4714 static int
4715 netlogon_dissect_dsrgetdcname2_rqst(tvbuff_t *tvb, int offset,
4716         packet_info *pinfo, proto_tree *tree, char *drep)
4717 {
4718         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4719                 pinfo, tree, drep);
4720
4721         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4722                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4723                 "Domain", hf_netlogon_logon_dom, 0);
4724
4725         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4726                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4727                 "GUID pointer: domain_guid", -1, 0);
4728
4729         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4730                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4731                 "GUID pointer: site_guid", -1, 0);
4732
4733         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4734                 hf_netlogon_flags, NULL);
4735
4736         return offset;
4737 }
4738
4739
4740 static int
4741 netlogon_dissect_dsrgetdcname2_reply(tvbuff_t *tvb, int offset,
4742         packet_info *pinfo, proto_tree *tree, char *drep)
4743 {
4744         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4745                 netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_UNIQUE,
4746                 "DOMAIN_CONTROLLER_INFO:", -1, 0);
4747
4748         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4749                                   hf_netlogon_rc, NULL);
4750
4751         return offset;
4752 }
4753
4754 static int
4755 netlogon_dissect_function_15_rqst(tvbuff_t *tvb, int offset,
4756         packet_info *pinfo, proto_tree *tree, char *drep)
4757 {
4758         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4759                 pinfo, tree, drep);
4760
4761         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4762                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4763                 "unknown string", hf_netlogon_unknown_string, 0);
4764
4765         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4766                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
4767                 "AUTHENTICATOR: credential", -1, 0);
4768
4769         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4770                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
4771                 "AUTHENTICATOR: return_authenticator", -1, 0);
4772
4773         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4774                 hf_netlogon_unknown_long, NULL);
4775
4776         return offset;
4777 }
4778
4779
4780 static int
4781 netlogon_dissect_function_15_reply(tvbuff_t *tvb, int offset,
4782         packet_info *pinfo, proto_tree *tree, char *drep)
4783 {
4784         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4785                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
4786                 "AUTHENTICATOR: return_authenticator", -1, 0);
4787
4788         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4789                 netlogon_dissect_TYPE_44, NDR_POINTER_UNIQUE,
4790                 "TYPE_44 pointer: unknown_TYPE_44", -1, 0);
4791
4792         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4793                                   hf_netlogon_rc, NULL);
4794
4795         return offset;
4796 }
4797
4798 static int
4799 netlogon_dissect_function_16_rqst(tvbuff_t *tvb, int offset,
4800         packet_info *pinfo, proto_tree *tree, char *drep)
4801 {
4802         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4803                 pinfo, tree, drep);
4804
4805         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4806                 hf_netlogon_unknown_long, NULL);
4807
4808         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4809                 hf_netlogon_unknown_long, NULL);
4810
4811         return offset;
4812 }
4813
4814
4815 static int
4816 netlogon_dissect_function_16_reply(tvbuff_t *tvb, int offset,
4817         packet_info *pinfo, proto_tree *tree, char *drep)
4818 {
4819         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4820                                   hf_netlogon_rc, NULL);
4821
4822         return offset;
4823 }
4824
4825 static int
4826 netlogon_dissect_function_17_rqst(tvbuff_t *tvb, int offset,
4827         packet_info *pinfo, proto_tree *tree, char *drep)
4828 {
4829         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4830                 pinfo, tree, drep);
4831
4832         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4833                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4834                 "unknown string", hf_netlogon_unknown_string, 0);
4835
4836         return offset;
4837 }
4838
4839
4840 static int
4841 netlogon_dissect_function_17_reply(tvbuff_t *tvb, int offset,
4842         packet_info *pinfo, proto_tree *tree, char *drep)
4843 {
4844         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4845                 netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE,
4846                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4847
4848         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4849                                   hf_netlogon_rc, NULL);
4850
4851         return offset;
4852 }
4853
4854 static int
4855 netlogon_dissect_function_18_rqst(tvbuff_t *tvb, int offset,
4856         packet_info *pinfo, proto_tree *tree, char *drep)
4857 {
4858         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4859                 pinfo, tree, drep);
4860
4861         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4862                 hf_netlogon_unknown_long, NULL);
4863
4864         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4865                 netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
4866                 "BYTE pointer: unknown_BYTE", -1, 0);
4867
4868         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4869                 hf_netlogon_unknown_long, NULL);
4870
4871         return offset;
4872 }
4873
4874 static int
4875 netlogon_dissect_BYTE_16_array(tvbuff_t *tvb, int offset,
4876         packet_info *pinfo, proto_tree *tree, char *drep)
4877 {
4878         int i;
4879
4880         for(i=0;i<16;i++){
4881                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4882                         hf_netlogon_unknown_char, NULL);
4883         }
4884
4885         return offset;
4886 }
4887
4888 static int
4889 netlogon_dissect_function_18_reply(tvbuff_t *tvb, int offset,
4890         packet_info *pinfo, proto_tree *tree, char *drep)
4891 {
4892         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4893                 netlogon_dissect_BYTE_16_array, NDR_POINTER_UNIQUE,
4894                 "BYTE pointer: unknown_BYTE", -1, 0);
4895
4896         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4897                                   hf_netlogon_rc, NULL);
4898
4899         return offset;
4900 }
4901
4902 static int
4903 netlogon_dissect_function_19_rqst(tvbuff_t *tvb, int offset,
4904         packet_info *pinfo, proto_tree *tree, char *drep)
4905 {
4906         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4907                 pinfo, tree, drep);
4908
4909         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4910                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4911                 "unknown string", hf_netlogon_unknown_string, 0);
4912
4913         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4914                 netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
4915                 "BYTE pointer: unknown_BYTE", -1, 0);
4916
4917         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4918                 hf_netlogon_unknown_long, NULL);
4919
4920         return offset;
4921 }
4922
4923
4924 static int
4925 netlogon_dissect_function_19_reply(tvbuff_t *tvb, int offset,
4926         packet_info *pinfo, proto_tree *tree, char *drep)
4927 {
4928         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4929                 netlogon_dissect_BYTE_16_array, NDR_POINTER_UNIQUE,
4930                 "BYTE pointer: unknown_BYTE", -1, 0);
4931
4932         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4933                                   hf_netlogon_rc, NULL);
4934
4935         return offset;
4936 }
4937
4938 static int
4939 netlogon_dissect_netserverauthenticate3_rqst(tvbuff_t *tvb, int offset,
4940         packet_info *pinfo, proto_tree *tree, char *drep)
4941 {
4942         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4943                 pinfo, tree, drep);
4944
4945         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4946                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
4947                 "Acct Name", hf_netlogon_acct_name, 0);
4948
4949         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
4950                 pinfo, tree, drep);
4951
4952         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4953                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
4954                 "Computer Name", hf_netlogon_computer_name, 0);
4955
4956         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4957                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
4958                 "CREDENTIAL: authenticator", -1, 0);
4959
4960         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4961                 hf_netlogon_neg_flags, NULL);
4962
4963         return offset;
4964 }
4965
4966
4967 static int
4968 netlogon_dissect_netserverauthenticate3_reply(tvbuff_t *tvb, int offset,
4969         packet_info *pinfo, proto_tree *tree, char *drep)
4970 {
4971         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4972                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
4973                 "CREDENTIAL pointer: unknown_NETLOGON_CREDENTIAL", -1, 0);
4974
4975         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4976                 hf_netlogon_neg_flags, NULL);
4977
4978         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4979                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4980                 "ULONG: unknown_ULONG", hf_netlogon_unknown_long, 0);
4981
4982         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4983                                   hf_netlogon_rc, NULL);
4984
4985         return offset;
4986 }
4987
4988 static int
4989 netlogon_dissect_dsrgetdcname_rqst(tvbuff_t *tvb, int offset,
4990         packet_info *pinfo, proto_tree *tree, char *drep)
4991 {
4992         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4993                 pinfo, tree, drep);
4994
4995         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4996                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4997                 "Domain", hf_netlogon_logon_dom, 0);
4998
4999         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5000                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
5001                 "GUID pointer: domain_guid", -1, 0);
5002
5003         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5004                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5005                 "Site Name", hf_netlogon_site_name, 0);
5006
5007         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5008                 hf_netlogon_flags, NULL);
5009
5010         return offset;
5011 }
5012
5013
5014 static int
5015 netlogon_dissect_dsrgetdcname_reply(tvbuff_t *tvb, int offset,
5016         packet_info *pinfo, proto_tree *tree, char *drep)
5017 {
5018         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5019                 netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_UNIQUE,
5020                 "DOMAIN_CONTROLLER_INFO:", -1, 0);
5021
5022         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5023                                   hf_netlogon_rc, NULL);
5024
5025         return offset;
5026 }
5027
5028 static int
5029 netlogon_dissect_dsrgetsitename_rqst(tvbuff_t *tvb, int offset,
5030         packet_info *pinfo, proto_tree *tree, char *drep)
5031 {
5032         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5033                 pinfo, tree, drep);
5034
5035         return offset;
5036 }
5037
5038
5039 static int
5040 netlogon_dissect_dsrgetsitename_reply(tvbuff_t *tvb, int offset,
5041         packet_info *pinfo, proto_tree *tree, char *drep)
5042 {
5043
5044         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
5045                 NDR_POINTER_REF, hf_netlogon_site_name, 0);
5046
5047         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5048                                   hf_netlogon_rc, NULL);
5049
5050         return offset;
5051 }
5052
5053 static int
5054 netlogon_dissect_netrlogongetdomaininfo_rqst(tvbuff_t *tvb, int offset,
5055         packet_info *pinfo, proto_tree *tree, char *drep)
5056 {
5057        /* Unlike the other NETLOGON RPCs, this is not a unique pointer. */
5058        offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5059                dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
5060                "Server Handle", hf_netlogon_computer_name, 0);
5061
5062         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5063                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5064                 "Computer Name", hf_netlogon_computer_name, 0);
5065
5066         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5067                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
5068                 "AUTHENTICATOR: credential", -1, 0);
5069
5070         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5071                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
5072                 "AUTHENTICATOR: return_authenticator", -1, 0);
5073
5074         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5075                 netlogon_dissect_DOMAIN_QUERY, NDR_POINTER_REF,
5076                 "DOMAIN_QUERY: ", -1, 0);
5077
5078         return offset;
5079 }
5080
5081
5082 static int
5083 netlogon_dissect_netrlogongetdomaininfo_reply(tvbuff_t *tvb, int offset,
5084         packet_info *pinfo, proto_tree *tree, char *drep)
5085 {
5086         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5087                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
5088                 "AUTHENTICATOR: return_authenticator", -1, 0);
5089
5090         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5091                 netlogon_dissect_DOMAIN_INFO, NDR_POINTER_UNIQUE,
5092                 "DOMAIN_INFO: ", -1, 0);
5093
5094         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5095                                   hf_netlogon_rc, NULL);
5096
5097         return offset;
5098 }
5099
5100 static int
5101 netlogon_dissect_function_1e_rqst(tvbuff_t *tvb, int offset,
5102         packet_info *pinfo, proto_tree *tree, char *drep)
5103 {
5104         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5105                 pinfo, tree, drep);
5106
5107         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5108                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5109                 "unknown string", hf_netlogon_unknown_string, 0);
5110
5111         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
5112                 hf_netlogon_unknown_short, NULL);
5113
5114         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5115                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5116                 "unknown string", hf_netlogon_unknown_string, 0);
5117
5118         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5119                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
5120                 "AUTHENTICATOR: credential", -1, 0);
5121
5122         offset = netlogon_dissect_UNICODE_STRING_512(tvb, offset,
5123                 pinfo, tree, drep);
5124
5125         return offset;
5126 }
5127
5128
5129 static int
5130 netlogon_dissect_function_1e_reply(tvbuff_t *tvb, int offset,
5131         packet_info *pinfo, proto_tree *tree, char *drep)
5132 {
5133         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5134                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
5135                 "AUTHENTICATOR: return_authenticator", -1, 0);
5136
5137         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5138                                   hf_netlogon_rc, NULL);
5139
5140         return offset;
5141 }
5142
5143 static int
5144 netlogon_dissect_netserverpasswordset2_rqst(tvbuff_t *tvb, int offset,
5145         packet_info *pinfo, proto_tree *tree, char *drep)
5146 {
5147         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5148                 pinfo, tree, drep);
5149
5150         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5151                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5152                 "Acct Name", hf_netlogon_acct_name, 0);
5153
5154         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
5155                 pinfo, tree, drep);
5156
5157         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5158                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5159                 "Computer Name", hf_netlogon_computer_name, 0);
5160
5161         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5162                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
5163                 "AUTHENTICATOR: credential", -1, 0);
5164
5165         return offset;
5166 }
5167
5168
5169 static int
5170 netlogon_dissect_netserverpasswordset2_reply(tvbuff_t *tvb, int offset,
5171         packet_info *pinfo, proto_tree *tree, char *drep)
5172 {
5173         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5174                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
5175                 "AUTHENTICATOR: return_authenticator", -1, 0);
5176
5177         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5178                 netlogon_dissect_LM_OWF_PASSWORD, NDR_POINTER_REF,
5179                 "LM_OWF_PASSWORD pointer: server_pwd", -1, 0);
5180
5181         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5182                                   hf_netlogon_rc, NULL);
5183
5184         return offset;
5185 }
5186
5187 static int
5188 netlogon_dissect_function_20_rqst(tvbuff_t *tvb, int offset,
5189         packet_info *pinfo, proto_tree *tree, char *drep)
5190 {
5191         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5192                 pinfo, tree, drep);
5193
5194         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5195                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5196                 "unknown string", hf_netlogon_unknown_string, -1);
5197
5198         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5199                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
5200                 "AUTHENTICATOR: credential", -1, 0);
5201
5202         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5203                 netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
5204                 "BYTE pointer: unknown_BYTE", -1, 0);
5205
5206         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5207                 hf_netlogon_unknown_long, NULL);
5208
5209         return offset;
5210 }
5211
5212
5213 static int
5214 netlogon_dissect_function_20_reply(tvbuff_t *tvb, int offset,
5215         packet_info *pinfo, proto_tree *tree, char *drep)
5216 {
5217         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5218                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
5219                 "AUTHENTICATOR: return_authenticator", -1, 0);
5220
5221         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5222                                   hf_netlogon_rc, NULL);
5223
5224         return offset;
5225 }
5226
5227 static int
5228 netlogon_dissect_function_21_rqst(tvbuff_t *tvb, int offset,
5229         packet_info *pinfo, proto_tree *tree, char *drep)
5230 {
5231         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5232                 pinfo, tree, drep);
5233
5234         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5235                 hf_netlogon_unknown_long, NULL);
5236
5237         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5238                 netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
5239                 "BYTE pointer: unknown_BYTE", -1, 0);
5240
5241         return offset;
5242 }
5243
5244
5245 static int
5246 netlogon_dissect_function_21_reply(tvbuff_t *tvb, int offset,
5247         packet_info *pinfo, proto_tree *tree, char *drep)
5248 {
5249         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5250                 netlogon_dissect_TYPE_50_ptr, NDR_POINTER_UNIQUE,
5251                 "TYPE_50** pointer: unknown_TYPE_50", -1, 0);
5252
5253         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5254                                   hf_netlogon_rc, NULL);
5255
5256         return offset;
5257 }
5258
5259 static int
5260 netlogon_dissect_function_22_rqst(tvbuff_t *tvb, int offset,
5261         packet_info *pinfo, proto_tree *tree, char *drep)
5262 {
5263         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5264                 pinfo, tree, drep);
5265
5266         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5267                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5268                 "unknown string", hf_netlogon_unknown_string, 0);
5269
5270         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5271                 hf_netlogon_unknown_long, NULL);
5272
5273         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5274                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5275                 "unknown string", hf_netlogon_unknown_string, 0);
5276
5277         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5278                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
5279                 "GUID pointer: unknown_GUID", -1, 0);
5280
5281         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5282                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5283                 "unknown string", hf_netlogon_unknown_string, 0);
5284
5285         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5286                 hf_netlogon_unknown_long, NULL);
5287
5288         return offset;
5289 }
5290
5291
5292 static int
5293 netlogon_dissect_function_22_reply(tvbuff_t *tvb, int offset,
5294         packet_info *pinfo, proto_tree *tree, char *drep)
5295 {
5296         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5297                 netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_UNIQUE,
5298                 "DOMAIN_CONTROLLER_INFO:", -1, 0);
5299
5300         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5301                                   hf_netlogon_rc, NULL);
5302
5303         return offset;
5304 }
5305
5306 static int
5307 netlogon_dissect_function_23_rqst(tvbuff_t *tvb, int offset,
5308         packet_info *pinfo, proto_tree *tree, char *drep)
5309 {
5310         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5311                 pinfo, tree, drep);
5312
5313         return offset;
5314 }
5315
5316
5317 static int
5318 netlogon_dissect_function_23_reply(tvbuff_t *tvb, int offset,
5319         packet_info *pinfo, proto_tree *tree, char *drep)
5320 {
5321         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5322                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5323                 "unknown string", hf_netlogon_unknown_string, -1);
5324
5325         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5326                 netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE,
5327                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
5328
5329         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5330                                   hf_netlogon_rc, NULL);
5331
5332         return offset;
5333 }
5334
5335 static int
5336 netlogon_dissect_function_24_rqst(tvbuff_t *tvb, int offset,
5337         packet_info *pinfo, proto_tree *tree, char *drep)
5338 {
5339         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5340                 pinfo, tree, drep);
5341
5342         return offset;
5343 }
5344
5345 static int
5346 netlogon_dissect_function_24_reply(tvbuff_t *tvb, int offset,
5347         packet_info *pinfo, proto_tree *tree, char *drep)
5348 {
5349         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5350                 hf_netlogon_entries, NULL);
5351
5352         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5353                 netlogon_dissect_DSROLE_PRIMARY_DOMAIN_INFO_EX_ARRAY, NDR_POINTER_UNIQUE,
5354                 "DSROLE_PRIMARY_DOMAIN_INFO_EX_ARRAY:", -1, 0);
5355
5356         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5357                                   hf_netlogon_rc, NULL);
5358
5359         return offset;
5360 }
5361
5362 static int
5363 netlogon_dissect_function_25_rqst(tvbuff_t *tvb, int offset,
5364         packet_info *pinfo, proto_tree *tree, char *drep)
5365 {
5366         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5367                 pinfo, tree, drep);
5368
5369         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5370                 hf_netlogon_unknown_long, NULL);
5371
5372         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5373                 netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
5374                 "BYTE pointer: unknown_BYTE", -1, 0);
5375
5376         return offset;
5377 }
5378
5379
5380 static int
5381 netlogon_dissect_function_25_reply(tvbuff_t *tvb, int offset,
5382         packet_info *pinfo, proto_tree *tree, char *drep)
5383 {
5384         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5385                 netlogon_dissect_TYPE_52_ptr, NDR_POINTER_UNIQUE,
5386                 "TYPE_52 pointer: unknown_TYPE_52", -1, 0);
5387
5388         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5389                                   hf_netlogon_rc, NULL);
5390
5391         return offset;
5392 }
5393
5394
5395 static int
5396 netlogon_dissect_function_26_rqst(tvbuff_t *tvb, int offset,
5397         packet_info *pinfo, proto_tree *tree, char *drep)
5398 {
5399         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5400                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5401                 "unknown string", hf_netlogon_unknown_string, 0);
5402
5403         return offset;
5404 }
5405
5406
5407 static int
5408 netlogon_dissect_function_26_reply(tvbuff_t *tvb, int offset,
5409         packet_info *pinfo, proto_tree *tree, char *drep)
5410 {
5411         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5412                 netlogon_dissect_TYPE_50_ptr, NDR_POINTER_UNIQUE,
5413                 "TYPE_50** pointer: unknown_TYPE_50", -1, 0);
5414
5415         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5416                                   hf_netlogon_rc, NULL);
5417
5418         return offset;
5419 }
5420
5421 static int
5422 netlogon_dissect_logonsamlogonex_rqst(tvbuff_t *tvb, int offset,
5423         packet_info *pinfo, proto_tree *tree, char *drep)
5424 {
5425         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5426                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5427                 "unknown string", hf_netlogon_unknown_string, 0);
5428
5429         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5430                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5431                 "unknown string", hf_netlogon_unknown_string, 0);
5432
5433         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
5434                 hf_netlogon_unknown_short, NULL);
5435
5436         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5437                 netlogon_dissect_LEVEL, NDR_POINTER_UNIQUE,
5438                 "LEVEL pointer: unknown_NETLOGON_LEVEL", -1, 0);
5439
5440         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
5441                 hf_netlogon_unknown_short, NULL);
5442
5443         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5444                 netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE,
5445                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
5446         return offset;
5447 }
5448
5449
5450 static int
5451 netlogon_dissect_logonsamlogonex_reply(tvbuff_t *tvb, int offset,
5452         packet_info *pinfo, proto_tree *tree, char *drep)
5453 {
5454         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5455                 netlogon_dissect_VALIDATION, NDR_POINTER_UNIQUE,
5456                 "VALIDATION: unknown_NETLOGON_VALIDATION", -1, 0);
5457
5458         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5459                 netlogon_dissect_pointer_char, NDR_POINTER_UNIQUE,
5460                 "BOOLEAN pointer: unknown_BOOLEAN", hf_netlogon_unknown_char, 0);
5461
5462         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5463                 netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE,
5464                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
5465
5466         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5467                                   hf_netlogon_rc, NULL);
5468
5469         return offset;
5470 }
5471
5472 static int
5473 netlogon_dissect_dsrrolegetprimarydomaininformation_rqst(tvbuff_t *tvb, int offset,
5474         packet_info *pinfo, proto_tree *tree, char *drep)
5475 {
5476         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5477                 pinfo, tree, drep);
5478
5479         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5480                 hf_netlogon_unknown_long, NULL);
5481
5482         return offset;
5483 }
5484
5485
5486 static int
5487 netlogon_dissect_dsrrolegetprimarydomaininformation_reply(tvbuff_t *tvb, int offset,
5488         packet_info *pinfo, proto_tree *tree, char *drep)
5489 {
5490         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5491                 hf_netlogon_entries, NULL);
5492
5493         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5494                 netlogon_dissect_DSROLE_PRIMARY_DOMAIN_INFO_EX_ARRAY, NDR_POINTER_UNIQUE,
5495                 "DSROLE_PRIMARY_DOMAIN_INFO_EX_ARRAY:", -1, 0);
5496
5497         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5498                                   hf_netlogon_rc, NULL);
5499
5500         return offset;
5501 }
5502
5503 static int
5504 netlogon_dissect_dsrderegisterdnshostrecords_rqst(tvbuff_t *tvb, int offset,
5505         packet_info *pinfo, proto_tree *tree, char *drep)
5506 {
5507         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5508                 pinfo, tree, drep);
5509
5510         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5511                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5512                 "Domain", hf_netlogon_logon_dom, 0);
5513
5514         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5515                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
5516                 "GUID pointer: domain_guid", -1, 0);
5517
5518         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5519                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
5520                 "GUID pointer: dsa_guid", -1, 0);
5521
5522         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5523                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5524                 "dns_host", hf_netlogon_dns_host, -1);
5525
5526         return offset;
5527 }
5528
5529
5530 static int
5531 netlogon_dissect_dsrderegisterdnshostrecords_reply(tvbuff_t *tvb, int offset,
5532         packet_info *pinfo, proto_tree *tree, char *drep)
5533 {
5534         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5535                                   hf_netlogon_rc, NULL);
5536
5537         return offset;
5538 }
5539
5540
5541
5542 static dcerpc_sub_dissector dcerpc_netlogon_dissectors[] = {
5543         { NETLOGON_UASLOGON, "UasLogon",
5544                 netlogon_dissect_netlogonuaslogon_rqst,
5545                 netlogon_dissect_netlogonuaslogon_reply },
5546         { NETLOGON_UASLOGOFF, "UasLogoff",
5547                 netlogon_dissect_netlogonuaslogoff_rqst,
5548                 netlogon_dissect_netlogonuaslogoff_reply },
5549         { NETLOGON_NETLOGONSAMLOGON, "SamLogon",
5550                 netlogon_dissect_netlogonsamlogon_rqst,
5551                 netlogon_dissect_netlogonsamlogon_reply },
5552         { NETLOGON_NETLOGONSAMLOGOFF, "SamLogoff",
5553                 netlogon_dissect_netlogonsamlogoff_rqst,
5554                 netlogon_dissect_netlogonsamlogoff_reply },
5555         { NETLOGON_NETSERVERREQCHALLENGE, "ServerReqChallenge",
5556                 netlogon_dissect_netserverreqchallenge_rqst,
5557                 netlogon_dissect_netserverreqchallenge_reply },
5558         { NETLOGON_NETSERVERAUTHENTICATE, "ServerAuthenticate",
5559                 netlogon_dissect_netserverauthenticate_rqst,
5560                 netlogon_dissect_netserverauthenticate_reply },
5561         { NETLOGON_NETSERVERPASSWORDSET, "ServerPasswdSet",
5562                 netlogon_dissect_netserverpasswordset_rqst,
5563                 netlogon_dissect_netserverpasswordset_reply },
5564         { NETLOGON_NETSAMDELTAS, "DatabaseDeltas",
5565                 netlogon_dissect_netsamdeltas_rqst,
5566                 netlogon_dissect_netsamdeltas_reply },
5567         { NETLOGON_DATABASESYNC, "DatabaseSync",
5568                 netlogon_dissect_netlogondatabasesync_rqst,
5569                 netlogon_dissect_netlogondatabasesync_reply },
5570         { NETLOGON_ACCOUNTDELTAS, "AccountDeltas",
5571                 netlogon_dissect_netlogonaccountdeltas_rqst,
5572                 netlogon_dissect_netlogonaccountdeltas_reply },
5573         { NETLOGON_ACCOUNTSYNC, "AccountSync",
5574                 netlogon_dissect_netlogonaccountsync_rqst,
5575                 netlogon_dissect_netlogonaccountsync_reply },
5576         { NETLOGON_GETDCNAME, "GetDCName",
5577                 netlogon_dissect_netlogongetdcname_rqst,
5578                 netlogon_dissect_netlogongetdcname_reply },
5579         { NETLOGON_NETLOGONCONTROL, "LogonControl",
5580                 netlogon_dissect_netlogoncontrol_rqst,
5581                 netlogon_dissect_netlogoncontrol_reply },
5582         { NETLOGON_GETANYDCNAME, "GetAnyDCName",
5583                 netlogon_dissect_netlogongetanydcname_rqst,
5584                 netlogon_dissect_netlogongetanydcname_reply },
5585         { NETLOGON_NETLOGONCONTROL2, "LogonControl2",
5586                 netlogon_dissect_netlogoncontrol2_rqst,
5587                 netlogon_dissect_netlogoncontrol2_reply },
5588         { NETLOGON_NETSERVERAUTHENTICATE2, "ServerAuthenticate2",
5589                 netlogon_dissect_netserverauthenticate2_rqst,
5590                 netlogon_dissect_netserverauthenticate2_reply },
5591         { NETLOGON_NETDATABASESYNC2, "DatabaseSync2",
5592                 netlogon_dissect_netdatabasesync2_rqst,
5593                 netlogon_dissect_netdatabasesync2_reply },
5594         { NETLOGON_DATABASEREDO, "DatabaseRedo",
5595                 netlogon_dissect_netlogondatabaseredo_rqst,
5596                 netlogon_dissect_netlogondatabaseredo_reply },
5597         { NETLOGON_FUNCTION_12, "Function_0x12",
5598                 netlogon_dissect_function_12_rqst,
5599                 netlogon_dissect_function_12_reply },
5600         { NETLOGON_NETTRUSTEDDOMAINLIST, "TrustedDomainList",
5601                 netlogon_dissect_nettrusteddomainlist_rqst,
5602                 netlogon_dissect_nettrusteddomainlist_reply },
5603         { NETLOGON_DSRGETDCNAME2, "DsrGetDCName2",
5604                 netlogon_dissect_dsrgetdcname2_rqst,
5605                 netlogon_dissect_dsrgetdcname2_reply },
5606         { NETLOGON_FUNCTION_15, "Function 0x15",
5607                 netlogon_dissect_function_15_rqst,
5608                 netlogon_dissect_function_15_reply },
5609         { NETLOGON_FUNCTION_16, "Function 0x16",
5610                 netlogon_dissect_function_16_rqst,
5611                 netlogon_dissect_function_16_reply },
5612         { NETLOGON_FUNCTION_17, "Function 0x17",
5613                 netlogon_dissect_function_17_rqst,
5614                 netlogon_dissect_function_17_reply },
5615         { NETLOGON_FUNCTION_18, "Function 0x18",
5616                 netlogon_dissect_function_18_rqst,
5617                 netlogon_dissect_function_18_reply },
5618         { NETLOGON_FUNCTION_19, "Function 0x19",
5619                 netlogon_dissect_function_19_rqst,
5620                 netlogon_dissect_function_19_reply },
5621         { NETLOGON_NETSERVERAUTHENTICATE3, "ServerAuthenticate3",
5622                 netlogon_dissect_netserverauthenticate3_rqst,
5623                 netlogon_dissect_netserverauthenticate3_reply },
5624         { NETLOGON_DSRGETDCNAME, "DsrGetDCName",
5625                 netlogon_dissect_dsrgetdcname_rqst,
5626                 netlogon_dissect_dsrgetdcname_reply },
5627         { NETLOGON_DSRGETSITENAME, "DsrGetSiteName",
5628                 netlogon_dissect_dsrgetsitename_rqst,
5629                 netlogon_dissect_dsrgetsitename_reply },
5630         { NETLOGON_NETRLOGONGETDOMAININFO, "NetrLogonGetDomainInfo",
5631                 netlogon_dissect_netrlogongetdomaininfo_rqst,
5632                 netlogon_dissect_netrlogongetdomaininfo_reply },
5633         { NETLOGON_FUNCTION_1E, "Function_0x1E",
5634                 netlogon_dissect_function_1e_rqst,
5635                 netlogon_dissect_function_1e_reply },
5636         { NETLOGON_NETSERVERPASSWORDSET2, "ServerPasswordSet2",
5637                 netlogon_dissect_netserverpasswordset2_rqst,
5638                 netlogon_dissect_netserverpasswordset2_reply },
5639         { NETLOGON_FUNCTION_20, "Function_0x20",
5640                 netlogon_dissect_function_20_rqst,
5641                 netlogon_dissect_function_20_reply },
5642         { NETLOGON_FUNCTION_21, "Function_0x21",
5643                 netlogon_dissect_function_21_rqst,
5644                 netlogon_dissect_function_21_reply },
5645         { NETLOGON_FUNCTION_22, "Function_0x22",
5646                 netlogon_dissect_function_22_rqst,
5647                 netlogon_dissect_function_22_reply },
5648         { NETLOGON_FUNCTION_23, "Function_0x23",
5649                 netlogon_dissect_function_23_rqst,
5650                 netlogon_dissect_function_23_reply },
5651         { NETLOGON_FUNCTION_24, "Function_0x24",
5652                 netlogon_dissect_function_24_rqst,
5653                 netlogon_dissect_function_24_reply },
5654         { NETLOGON_FUNCTION_25, "Function_0x25",
5655                 netlogon_dissect_function_25_rqst,
5656                 netlogon_dissect_function_25_reply },
5657         { NETLOGON_FUNCTION_26, "Function_0x26",
5658                 netlogon_dissect_function_26_rqst,
5659                 netlogon_dissect_function_26_reply },
5660         { NETLOGON_LOGONSAMLOGONEX, "LogonSamLogonEx",
5661                 netlogon_dissect_logonsamlogonex_rqst,
5662                 netlogon_dissect_logonsamlogonex_reply },
5663         { NETLOGON_DSRROLEGETPRIMARYDOMAININFORMATION, "DsrRoleGetPrimaryDomainInformation",
5664                 netlogon_dissect_dsrrolegetprimarydomaininformation_rqst,
5665                 netlogon_dissect_dsrrolegetprimarydomaininformation_reply },
5666         { NETLOGON_DSRDEREGISTERDNSHOSTRECORDS, "DsrDeregisterDNSHostRecords",
5667                 netlogon_dissect_dsrderegisterdnshostrecords_rqst,
5668                 netlogon_dissect_dsrderegisterdnshostrecords_reply },
5669         {0, NULL, NULL,  NULL }
5670 };
5671
5672 static const value_string netlogon_opnum_vals[] = {
5673         { NETLOGON_UASLOGON, "UasLogon" },
5674         { NETLOGON_UASLOGOFF, "UasLogoff" },
5675         { NETLOGON_NETLOGONSAMLOGON, "SamLogon" },
5676         { NETLOGON_NETLOGONSAMLOGOFF, "SamLogoff" },
5677         { NETLOGON_NETSERVERREQCHALLENGE, "ServerReqChallenge" },
5678         { NETLOGON_NETSERVERAUTHENTICATE, "ServerAuthenticate" },
5679         { NETLOGON_NETSERVERPASSWORDSET, "ServerPasswdSet" },
5680         { NETLOGON_NETSAMDELTAS, "DatabaseDeltas" },
5681         { NETLOGON_DATABASESYNC, "DatabaseSync" },
5682         { NETLOGON_ACCOUNTDELTAS, "AccountDeltas" },
5683         { NETLOGON_ACCOUNTSYNC, "AccountSync" },
5684         { NETLOGON_GETDCNAME, "GetDCName" },
5685         { NETLOGON_NETLOGONCONTROL, "LogonControl" },
5686         { NETLOGON_GETANYDCNAME, "GetAnyDCName" },
5687         { NETLOGON_NETLOGONCONTROL2, "LogonControl2" },
5688         { NETLOGON_NETSERVERAUTHENTICATE2, "ServerAuthenticate2" },
5689         { NETLOGON_NETDATABASESYNC2, "DatabaseSync2" },
5690         { NETLOGON_DATABASEREDO, "DatabaseRedo" },
5691         { NETLOGON_FUNCTION_12, "Function_0x12" },
5692         { NETLOGON_NETTRUSTEDDOMAINLIST, "TrustedDomainList" },
5693         { NETLOGON_DSRGETDCNAME2, "DsrGetDCName2" },
5694         { NETLOGON_FUNCTION_15, "Function_0x15" },
5695         { NETLOGON_FUNCTION_16, "Function_0x16" },
5696         { NETLOGON_FUNCTION_17, "Function_0x17" },
5697         { NETLOGON_FUNCTION_18, "Function_0x18" },
5698         { NETLOGON_FUNCTION_19, "Function_0x19" },
5699         { NETLOGON_NETSERVERAUTHENTICATE3, "ServerAuthenticate3" },
5700         { NETLOGON_DSRGETDCNAME, "DsrGetDCName" },
5701         { NETLOGON_DSRGETSITENAME, "DsrGetSiteName" },
5702         { NETLOGON_NETRLOGONGETDOMAININFO, "NetrLogonGetDomainInfo" },
5703         { NETLOGON_FUNCTION_1E, "Function_0x1E" },
5704         { NETLOGON_NETSERVERPASSWORDSET2, "ServerPasswordSet2" },
5705         { NETLOGON_FUNCTION_20, "Function_0x20" },
5706         { NETLOGON_FUNCTION_21, "Function_0x21" },
5707         { NETLOGON_FUNCTION_22, "Function_0x22" },
5708         { NETLOGON_FUNCTION_23, "Function_0x23" },
5709         { NETLOGON_FUNCTION_24, "Function_0x24" },
5710         { NETLOGON_FUNCTION_25, "Function_0x25" },
5711         { NETLOGON_FUNCTION_26, "Function_0x26" },
5712         { NETLOGON_LOGONSAMLOGONEX, "LogonSamLogonEx" },
5713         { NETLOGON_DSRROLEGETPRIMARYDOMAININFORMATION, "DsrRoleGetPrimaryDomainInformation" },
5714         { NETLOGON_DSRDEREGISTERDNSHOSTRECORDS, "DsrDeregisterDNSHostRecords" },
5715         { 0, NULL }
5716 };
5717
5718 void
5719 proto_register_dcerpc_netlogon(void)
5720 {
5721
5722 static hf_register_info hf[] = {
5723         { &hf_netlogon_opnum,
5724           { "Operation", "netlogon.opnum", FT_UINT16, BASE_DEC,
5725             VALS(netlogon_opnum_vals), 0x0, "Operation", HFILL }},
5726
5727         { &hf_netlogon_rc, {
5728                 "Return code", "netlogon.rc", FT_UINT32, BASE_HEX,
5729                 VALS(NT_errors), 0x0, "Netlogon return code", HFILL }},
5730
5731         { &hf_netlogon_param_ctrl, {
5732                 "Param Ctrl", "netlogon.param_ctrl", FT_UINT32, BASE_HEX,
5733                 NULL, 0x0, "Param ctrl", HFILL }},
5734
5735         { &hf_netlogon_logon_id, {
5736                 "Logon ID", "netlogon.logon_id", FT_UINT64, BASE_DEC,
5737                 NULL, 0x0, "Logon ID", HFILL }},
5738
5739         { &hf_netlogon_modify_count, {
5740                 "Modify Count", "netlogon.modify_count", FT_UINT64, BASE_DEC,
5741                 NULL, 0x0, "How many times the object has been modified", HFILL }},
5742
5743         { &hf_netlogon_security_information, {
5744                 "Security Information", "netlogon.security_information", FT_UINT32, BASE_DEC,
5745                 NULL, 0x0, "Security Information", HFILL }},
5746
5747         { &hf_netlogon_count, {
5748                 "Count", "netlogon.count", FT_UINT32, BASE_DEC,
5749                 NULL, 0x0, "", HFILL }},
5750
5751         { &hf_netlogon_entries, {
5752                 "Entries", "netlogon.entries", FT_UINT32, BASE_DEC,
5753                 NULL, 0x0, "", HFILL }},
5754
5755         { &hf_netlogon_credential, {
5756                 "Credential", "netlogon.credential", FT_BYTES, BASE_HEX,
5757                 NULL, 0x0, "Netlogon credential", HFILL }},
5758
5759         { &hf_netlogon_challenge, {
5760                 "Challenge", "netlogon.challenge", FT_BYTES, BASE_HEX,
5761                 NULL, 0x0, "Netlogon challenge", HFILL }},
5762
5763         { &hf_netlogon_lm_owf_password, {
5764                 "LM Pwd", "netlogon.lm_owf_pwd", FT_BYTES, BASE_HEX,
5765                 NULL, 0x0, "LanManager OWF Password", HFILL }},
5766
5767         { &hf_netlogon_user_session_key, {
5768                 "User Session Key", "netlogon.user_session_key", FT_BYTES, BASE_HEX,
5769                 NULL, 0x0, "User Session Key", HFILL }},
5770
5771         { &hf_netlogon_encrypted_lm_owf_password, {
5772                 "Encrypted LM Pwd", "netlogon.lm_owf_pwd.encrypted", FT_BYTES, BASE_HEX,
5773                 NULL, 0x0, "Encrypted LanManager OWF Password", HFILL }},
5774
5775         { &hf_netlogon_nt_owf_password, {
5776                 "NT Pwd", "netlogon.nt_owf_pwd", FT_BYTES, BASE_HEX,
5777                 NULL, 0x0, "NT OWF Password", HFILL }},
5778
5779         { &hf_netlogon_blob, {
5780                 "BLOB", "netlogon.blob", FT_BYTES, BASE_HEX,
5781                 NULL, 0x0, "BLOB", HFILL }},
5782
5783         { &hf_netlogon_len, {
5784                 "Len", "netlogon.len", FT_UINT32, BASE_DEC,
5785                 NULL, 0, "Length", HFILL }},
5786
5787         { &hf_netlogon_priv, {
5788                 "Priv", "netlogon.priv", FT_UINT32, BASE_DEC,
5789                 NULL, 0, "", HFILL }},
5790
5791         { &hf_netlogon_privilege_entries, {
5792                 "Privilege Entries", "netlogon.privilege_entries", FT_UINT32, BASE_DEC,
5793                 NULL, 0, "", HFILL }},
5794
5795         { &hf_netlogon_privilege_control, {
5796                 "Privilege Control", "netlogon.privilege_control", FT_UINT32, BASE_HEX,
5797                 NULL, 0, "", HFILL }},
5798
5799         { &hf_netlogon_privilege_name, {
5800                 "Privilege Name", "netlogon.privilege_name", FT_STRING, BASE_HEX,
5801                 NULL, 0, "", HFILL }},
5802
5803         { &hf_netlogon_pdc_connection_status, {
5804                 "PDC Connection Status", "netlogon.pdc_connection_status", FT_UINT32, BASE_DEC,
5805                 NULL, 0, "PDC Connection Status", HFILL }},
5806
5807         { &hf_netlogon_tc_connection_status, {
5808                 "TC Connection Status", "netlogon.tc_connection_status", FT_UINT32, BASE_DEC,
5809                 NULL, 0, "TC Connection Status", HFILL }},
5810
5811         { &hf_netlogon_attrs, {
5812                 "Attributes", "netlogon.attrs", FT_UINT32, BASE_HEX,
5813                 NULL, 0, "Attributes", HFILL }},
5814
5815         { &hf_netlogon_unknown_string,
5816                 { "Unknown string", "netlogon.unknown_string", FT_STRING, BASE_NONE,
5817                 NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
5818         { &hf_netlogon_unknown_long,
5819                 { "Unknown long", "netlogon.unknown.long", FT_UINT32, BASE_HEX,
5820                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
5821         { &hf_netlogon_reserved,
5822                 { "Reserved", "netlogon.reserved", FT_UINT32, BASE_HEX,
5823                 NULL, 0x0, "Reserved", HFILL }},
5824         { &hf_netlogon_unknown_short,
5825                 { "Unknown short", "netlogon.unknown.short", FT_UINT16, BASE_HEX,
5826                 NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
5827
5828         { &hf_netlogon_unknown_char,
5829                 { "Unknown char", "netlogon.unknown.char", FT_UINT8, BASE_HEX,
5830                 NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
5831
5832         { &hf_netlogon_acct_expiry_time,
5833                 { "Acct Expiry Time", "netlogon.acct.expiry_time", FT_ABSOLUTE_TIME, BASE_NONE,
5834                 NULL, 0x0, "When this account will expire", HFILL }},
5835
5836         { &hf_netlogon_nt_pwd_present,
5837                 { "NT PWD Present", "netlogon.nt_pwd_present", FT_UINT8, BASE_HEX,
5838                 NULL, 0x0, "Is NT password present for this account?", HFILL }},
5839
5840         { &hf_netlogon_lm_pwd_present,
5841                 { "LM PWD Present", "netlogon.lm_pwd_present", FT_UINT8, BASE_HEX,
5842                 NULL, 0x0, "Is LanManager password present for this account?", HFILL }},
5843
5844         { &hf_netlogon_pwd_expired,
5845                 { "PWD Expired", "netlogon.pwd_expired", FT_UINT8, BASE_HEX,
5846                 NULL, 0x0, "Whether this password has expired or not", HFILL }},
5847
5848         { &hf_netlogon_authoritative,
5849                 { "Authoritative", "netlogon.authoritative", FT_UINT8, BASE_DEC,
5850                 NULL, 0x0, "", HFILL }},
5851
5852         { &hf_netlogon_sensitive_data_flag,
5853                 { "Sensitive Data", "netlogon.sensitive_data_flag", FT_UINT8, BASE_DEC,
5854                 NULL, 0x0, "Sensitive data flag", HFILL }},
5855
5856         { &hf_netlogon_auditing_mode,
5857                 { "Auditing Mode", "netlogon.auditing_mode", FT_UINT8, BASE_DEC,
5858                 NULL, 0x0, "Auditing Mode", HFILL }},
5859
5860         { &hf_netlogon_max_audit_event_count,
5861                 { "Max Audit Event Count", "netlogon.max_audit_event_count", FT_UINT32, BASE_DEC,
5862                 NULL, 0x0, "Max audit event count", HFILL }},
5863
5864         { &hf_netlogon_event_audit_option,
5865                 { "Event Audit Option", "netlogon.event_audit_option", FT_UINT32, BASE_HEX,
5866                 NULL, 0x0, "Event audit option", HFILL }},
5867
5868         { &hf_netlogon_sensitive_data_len,
5869                 { "Length", "netlogon.sensitive_data_len", FT_UINT32, BASE_DEC,
5870                 NULL, 0x0, "Length of sensitive data", HFILL }},
5871
5872         { &hf_netlogon_nt_chal_resp,
5873                 { "NT Chal resp", "netlogon.nt_chal_resp", FT_BYTES, BASE_HEX,
5874                 NULL, 0, "Challenge response for NT authentication", HFILL }},
5875
5876         { &hf_netlogon_lm_chal_resp,
5877                 { "LM Chal resp", "netlogon.lm_chal_resp", FT_BYTES, BASE_HEX,
5878                 NULL, 0, "Challenge response for LM authentication", HFILL }},
5879
5880         { &hf_netlogon_cipher_len,
5881                 { "Cipher Len", "netlogon.cipher_len", FT_UINT32, BASE_DEC,
5882                 NULL, 0, "", HFILL }},
5883
5884         { &hf_netlogon_cipher_maxlen,
5885                 { "Cipher Max Len", "netlogon.cipher_maxlen", FT_UINT32, BASE_DEC,
5886                 NULL, 0, "", HFILL }},
5887
5888         { &hf_netlogon_pac_data,
5889                 { "Pac Data", "netlogon.pac.data", FT_BYTES, BASE_HEX,
5890                 NULL, 0, "Pac Data", HFILL }},
5891
5892         { &hf_netlogon_sensitive_data,
5893                 { "Data", "netlogon.sensitive_data", FT_BYTES, BASE_HEX,
5894                 NULL, 0, "Sensitive Data", HFILL }},
5895
5896         { &hf_netlogon_auth_data,
5897                 { "Auth Data", "netlogon.auth.data", FT_BYTES, BASE_HEX,
5898                 NULL, 0, "Auth Data", HFILL }},
5899
5900         { &hf_netlogon_cipher_current_data,
5901                 { "Cipher Current Data", "netlogon.cipher_current_data", FT_BYTES, BASE_HEX,
5902                 NULL, 0, "", HFILL }},
5903
5904         { &hf_netlogon_cipher_old_data,
5905                 { "Cipher Old Data", "netlogon.cipher_old_data", FT_BYTES, BASE_HEX,
5906                 NULL, 0, "", HFILL }},
5907
5908         { &hf_netlogon_acct_name,
5909                 { "Acct Name", "netlogon.acct_name", FT_STRING, BASE_NONE,
5910                 NULL, 0, "Account Name", HFILL }},
5911
5912         { &hf_netlogon_acct_desc,
5913                 { "Acct Desc", "netlogon.acct_desc", FT_STRING, BASE_NONE,
5914                 NULL, 0, "Account Description", HFILL }},
5915
5916         { &hf_netlogon_group_desc,
5917                 { "Group Desc", "netlogon.group_desc", FT_STRING, BASE_NONE,
5918                 NULL, 0, "Group Description", HFILL }},
5919
5920         { &hf_netlogon_full_name,
5921                 { "Full Name", "netlogon.full_name", FT_STRING, BASE_NONE,
5922                 NULL, 0, "Full Name", HFILL }},
5923
5924         { &hf_netlogon_comment,
5925                 { "Comment", "netlogon.comment", FT_STRING, BASE_NONE,
5926                 NULL, 0, "Comment", HFILL }},
5927
5928         { &hf_netlogon_parameters,
5929                 { "Parameters", "netlogon.parameters", FT_STRING, BASE_NONE,
5930                 NULL, 0, "Parameters", HFILL }},
5931
5932         { &hf_netlogon_logon_script,
5933                 { "Logon Script", "netlogon.logon_script", FT_STRING, BASE_NONE,
5934                 NULL, 0, "Logon Script", HFILL }},
5935
5936         { &hf_netlogon_profile_path,
5937                 { "Profile Path", "netlogon.profile_path", FT_STRING, BASE_NONE,
5938                 NULL, 0, "Profile Path", HFILL }},
5939
5940         { &hf_netlogon_home_dir,
5941                 { "Home Dir", "netlogon.home_dir", FT_STRING, BASE_NONE,
5942                 NULL, 0, "Home Directory", HFILL }},
5943
5944         { &hf_netlogon_dir_drive,
5945                 { "Dir Drive", "netlogon.dir_drive", FT_STRING, BASE_NONE,
5946                 NULL, 0, "Drive letter for home directory", HFILL }},
5947
5948         { &hf_netlogon_logon_srv,
5949                 { "Server", "netlogon.server", FT_STRING, BASE_NONE,
5950                 NULL, 0, "Server", HFILL }},
5951
5952         { &hf_netlogon_principal,
5953                 { "Principal", "netlogon.principal", FT_STRING, BASE_NONE,
5954                 NULL, 0, "Principal", HFILL }},
5955
5956         { &hf_netlogon_logon_dom,
5957                 { "Domain", "netlogon.domain", FT_STRING, BASE_NONE,
5958                 NULL, 0, "Domain", HFILL }},
5959
5960         { &hf_netlogon_computer_name,
5961                 { "Computer Name", "netlogon.computer_name", FT_STRING, BASE_NONE,
5962                 NULL, 0, "Computer Name", HFILL }},
5963
5964         { &hf_netlogon_site_name,
5965                 { "Site Name", "netlogon.site_name", FT_STRING, BASE_NONE,
5966                 NULL, 0, "Site Name", HFILL }},
5967
5968         { &hf_netlogon_dc_name,
5969                 { "DC Name", "netlogon.dc.name", FT_STRING, BASE_NONE,
5970                 NULL, 0, "DC Name", HFILL }},
5971
5972         { &hf_netlogon_dc_site_name,
5973                 { "DC Site Name", "netlogon.dc.site_name", FT_STRING, BASE_NONE,
5974                 NULL, 0, "DC Site Name", HFILL }},
5975
5976         { &hf_netlogon_dns_forest_name,
5977                 { "DNS Forest Name", "netlogon.dns.forest_name", FT_STRING, BASE_NONE,
5978                 NULL, 0, "DNS Forest Name", HFILL }},
5979
5980         { &hf_netlogon_dc_address,
5981                 { "DC Address", "netlogon.dc.address", FT_STRING, BASE_NONE,
5982                 NULL, 0, "DC Address", HFILL }},
5983
5984         { &hf_netlogon_dc_address_type,
5985                 { "DC Address Type", "netlogon.dc.address_type", FT_UINT32, BASE_DEC,
5986                 NULL, 0, "DC Address Type", HFILL }},
5987
5988         { &hf_netlogon_client_site_name,
5989                 { "Client Site Name", "netlogon.client.site_name", FT_STRING, BASE_NONE,
5990                 NULL, 0, "Client Site Name", HFILL }},
5991
5992         { &hf_netlogon_workstation_site_name,
5993                 { "Wkst Site Name", "netlogon.wkst.site_name", FT_STRING, BASE_NONE,
5994                 NULL, 0, "Workstation Site Name", HFILL }},
5995
5996         { &hf_netlogon_workstation,
5997                 { "Wkst Name", "netlogon.wkst.name", FT_STRING, BASE_NONE,
5998                 NULL, 0, "Workstation Name", HFILL }},
5999
6000         { &hf_netlogon_workstation_os,
6001                 { "Wkst OS", "netlogon.wkst.os", FT_STRING, BASE_NONE,
6002                 NULL, 0, "Workstation OS", HFILL }},
6003
6004         { &hf_netlogon_workstations,
6005                 { "Workstations", "netlogon.wksts", FT_STRING, BASE_NONE,
6006                 NULL, 0, "Workstations", HFILL }},
6007
6008         { &hf_netlogon_workstation_fqdn,
6009                 { "Wkst FQDN", "netlogon.wkst.fqdn", FT_STRING, BASE_NONE,
6010                 NULL, 0, "Workstation FQDN", HFILL }},
6011
6012         { &hf_netlogon_group_name,
6013                 { "Group Name", "netlogon.group_name", FT_STRING, BASE_NONE,
6014                 NULL, 0, "Group Name", HFILL }},
6015
6016         { &hf_netlogon_alias_name,
6017                 { "Alias Name", "netlogon.alias_name", FT_STRING, BASE_NONE,
6018                 NULL, 0, "Alias Name", HFILL }},
6019
6020         { &hf_netlogon_dns_host,
6021                 { "DNS Host", "netlogon.dns_host", FT_STRING, BASE_NONE,
6022                 NULL, 0, "DNS Host", HFILL }},
6023
6024         { &hf_netlogon_downlevel_domain_name,
6025                 { "Downlevel Domain", "netlogon.downlevel_domain", FT_STRING, BASE_NONE,
6026                 NULL, 0, "Downlevel Domain Name", HFILL }},
6027
6028         { &hf_netlogon_dns_domain_name,
6029                 { "DNS Domain", "netlogon.dns_domain", FT_STRING, BASE_NONE,
6030                 NULL, 0, "DNS Domain Name", HFILL }},
6031
6032         { &hf_netlogon_domain_name,
6033                 { "Domain", "netlogon.domain", FT_STRING, BASE_NONE,
6034                 NULL, 0, "Domain Name", HFILL }},
6035
6036         { &hf_netlogon_oem_info,
6037                 { "OEM Info", "netlogon.oem_info", FT_STRING, BASE_NONE,
6038                 NULL, 0, "OEM Info", HFILL }},
6039
6040         { &hf_netlogon_trusted_dc_name,
6041                 { "Trusted DC", "netlogon.trusted_dc", FT_STRING, BASE_NONE,
6042                 NULL, 0, "Trusted DC", HFILL }},
6043
6044         { &hf_netlogon_logonsrv_handle,
6045                 { "Handle", "netlogon.handle", FT_STRING, BASE_NONE,
6046                 NULL, 0, "Logon Srv Handle", HFILL }},
6047
6048         { &hf_netlogon_dummy,
6049                 { "Dummy", "netlogon.dummy", FT_STRING, BASE_NONE,
6050                 NULL, 0, "Dummy string", HFILL }},
6051
6052         { &hf_netlogon_logon_count16,
6053                 { "Logon Count", "netlogon.logon_count16", FT_UINT16, BASE_DEC,
6054                 NULL, 0x0, "Number of successful logins", HFILL }},
6055
6056         { &hf_netlogon_logon_count,
6057                 { "Logon Count", "netlogon.logon_count", FT_UINT32, BASE_DEC,
6058                 NULL, 0x0, "Number of successful logins", HFILL }},
6059
6060         { &hf_netlogon_bad_pw_count16,
6061                 { "Bad PW Count", "netlogon.bad_pw_count16", FT_UINT16, BASE_DEC,
6062                 NULL, 0x0, "Number of failed logins", HFILL }},
6063
6064         { &hf_netlogon_bad_pw_count,
6065                 { "Bad PW Count", "netlogon.bad_pw_count", FT_UINT32, BASE_DEC,
6066                 NULL, 0x0, "Number of failed logins", HFILL }},
6067
6068         { &hf_netlogon_country,
6069                 { "Country", "netlogon.country", FT_UINT16, BASE_DEC,
6070                 VALS(ms_country_codes), 0x0, "Country setting for this account", HFILL }},
6071
6072         { &hf_netlogon_codepage,
6073                 { "Codepage", "netlogon.codepage", FT_UINT16, BASE_DEC,
6074                 NULL, 0x0, "Codepage setting for this account", HFILL }},
6075
6076         { &hf_netlogon_level16,
6077                 { "Level", "netlogon.level16", FT_UINT16, BASE_DEC,
6078                 NULL, 0x0, "Which option of the union is represented here", HFILL }},
6079
6080         { &hf_netlogon_validation_level,
6081                 { "Validation Level", "netlogon.validation_level", FT_UINT16, BASE_DEC,
6082                 NULL, 0x0, "Requested level of validation", HFILL }},
6083
6084         { &hf_netlogon_minpasswdlen,
6085                 { "Min Password Len", "netlogon.min_passwd_len", FT_UINT16, BASE_DEC,
6086                 NULL, 0x0, "Minimum length of password", HFILL }},
6087
6088         { &hf_netlogon_passwdhistorylen,
6089                 { "Passwd History Len", "netlogon.passwd_history_len", FT_UINT16, BASE_DEC,
6090                 NULL, 0x0, "Length of password history", HFILL }},
6091
6092         { &hf_netlogon_secure_channel_type,
6093                 { "Sec Chn Type", "netlogon.sec_chn_type", FT_UINT16, BASE_DEC,
6094                 NULL, 0x0, "Secure Channel Type", HFILL }},
6095
6096         { &hf_netlogon_restart_state,
6097                 { "Restart State", "netlogon.restart_state", FT_UINT16, BASE_DEC,
6098                 NULL, 0x0, "Restart State", HFILL }},
6099
6100         { &hf_netlogon_delta_type,
6101                 { "Delta Type", "netlogon.delta_type", FT_UINT16, BASE_DEC,
6102                 VALS(delta_type_vals), 0x0, "Delta Type", HFILL }},
6103
6104         { &hf_netlogon_blob_size,
6105                 { "Size", "netlogon.blob.size", FT_UINT32, BASE_DEC,
6106                 NULL, 0x0, "Size in bytes of BLOB", HFILL }},
6107
6108         { &hf_netlogon_code,
6109                 { "Code", "netlogon.code", FT_UINT32, BASE_HEX,
6110                 NULL, 0x0, "Code", HFILL }},
6111
6112         { &hf_netlogon_level,
6113                 { "Level", "netlogon.level", FT_UINT32, BASE_DEC,
6114                 NULL, 0x0, "Which option of the union is represented here", HFILL }},
6115
6116         { &hf_netlogon_reference,
6117                 { "Reference", "netlogon.reference", FT_UINT32, BASE_DEC,
6118                 NULL, 0x0, "", HFILL }},
6119
6120         { &hf_netlogon_next_reference,
6121                 { "Next Reference", "netlogon.next_reference", FT_UINT32, BASE_DEC,
6122                 NULL, 0x0, "", HFILL }},
6123
6124         { &hf_netlogon_timestamp,
6125                 { "Timestamp", "netlogon.timestamp", FT_ABSOLUTE_TIME, BASE_NONE,
6126                 NULL, 0, "", HFILL }},
6127
6128         { &hf_netlogon_user_rid,
6129                 { "User RID", "netlogon.rid", FT_UINT32, BASE_DEC,
6130                 NULL, 0x0, "", HFILL }},
6131
6132         { &hf_netlogon_alias_rid,
6133                 { "Alias RID", "netlogon.alias_rid", FT_UINT32, BASE_DEC,
6134                 NULL, 0x0, "", HFILL }},
6135
6136         { &hf_netlogon_group_rid,
6137                 { "Group RID", "netlogon.group_rid", FT_UINT32, BASE_DEC,
6138                 NULL, 0x0, "", HFILL }},
6139
6140         { &hf_netlogon_num_rids,
6141                 { "Num RIDs", "netlogon.num_rids", FT_UINT32, BASE_DEC,
6142                 NULL, 0x0, "Number of RIDs", HFILL }},
6143
6144         { &hf_netlogon_num_controllers,
6145                 { "Num DCs", "netlogon.num_dc", FT_UINT32, BASE_DEC,
6146                 NULL, 0x0, "Number of domain controllers", HFILL }},
6147
6148         { &hf_netlogon_num_other_groups,
6149                 { "Num Other Groups", "netlogon.num_other_groups", FT_UINT32, BASE_DEC,
6150                 NULL, 0x0, "", HFILL }},
6151
6152         { &hf_netlogon_flags,
6153                 { "Flags", "netlogon.flags", FT_UINT32, BASE_HEX,
6154                 NULL, 0x0, "", HFILL }},
6155
6156         { &hf_netlogon_user_flags,
6157                 { "User Flags", "netlogon.user_flags", FT_UINT32, BASE_HEX,
6158                 NULL, 0x0, "", HFILL }},
6159
6160         { &hf_netlogon_auth_flags,
6161                 { "Auth Flags", "netlogon.auth_flags", FT_UINT32, BASE_HEX,
6162                 NULL, 0x0, "", HFILL }},
6163
6164         { &hf_netlogon_systemflags,
6165                 { "System Flags", "netlogon.system_flags", FT_UINT32, BASE_HEX,
6166                 NULL, 0x0, "", HFILL }},
6167
6168         { &hf_netlogon_database_id,
6169                 { "Database Id", "netlogon.database_id", FT_UINT32, BASE_DEC,
6170                 NULL, 0x0, "Database Id", HFILL }},
6171
6172         { &hf_netlogon_sync_context,
6173                 { "Sync Context", "netlogon.sync_context", FT_UINT32, BASE_DEC,
6174                 NULL, 0x0, "Sync Context", HFILL }},
6175
6176         { &hf_netlogon_max_size,
6177                 { "Max Size", "netlogon.max_size", FT_UINT32, BASE_DEC,
6178                 NULL, 0x0, "Max Size of database", HFILL }},
6179
6180         { &hf_netlogon_max_log_size,
6181                 { "Max Log Size", "netlogon.max_log_size", FT_UINT32, BASE_DEC,
6182                 NULL, 0x0, "Max Size of log", HFILL }},
6183
6184         { &hf_netlogon_pac_size,
6185                 { "Pac Size", "netlogon.pac.size", FT_UINT32, BASE_DEC,
6186                 NULL, 0x0, "Size of PacData in bytes", HFILL }},
6187
6188         { &hf_netlogon_auth_size,
6189                 { "Auth Size", "netlogon.auth.size", FT_UINT32, BASE_DEC,
6190                 NULL, 0x0, "Size of AuthData in bytes", HFILL }},
6191
6192         { &hf_netlogon_num_deltas,
6193                 { "Num Deltas", "netlogon.num_deltas", FT_UINT32, BASE_DEC,
6194                 NULL, 0x0, "Number of SAM Deltas in array", HFILL }},
6195
6196         { &hf_netlogon_logon_attempts,
6197                 { "Logon Attempts", "netlogon.logon_attempts", FT_UINT32, BASE_DEC,
6198                 NULL, 0x0, "Number of logon attempts", HFILL }},
6199
6200         { &hf_netlogon_pagefilelimit,
6201                 { "Page File Limit", "netlogon.page_file_limit", FT_UINT32, BASE_DEC,
6202                 NULL, 0x0, "", HFILL }},
6203
6204         { &hf_netlogon_pagedpoollimit,
6205                 { "Paged Pool Limit", "netlogon.paged_pool_limit", FT_UINT32, BASE_DEC,
6206                 NULL, 0x0, "", HFILL }},
6207
6208         { &hf_netlogon_nonpagedpoollimit,
6209                 { "Non-Paged Pool Limit", "netlogon.nonpaged_pool_limit", FT_UINT32, BASE_DEC,
6210                 NULL, 0x0, "", HFILL }},
6211
6212         { &hf_netlogon_minworkingsetsize,
6213                 { "Min Working Set Size", "netlogon.min_working_set_size", FT_UINT32, BASE_DEC,
6214                 NULL, 0x0, "", HFILL }},
6215
6216         { &hf_netlogon_maxworkingsetsize,
6217                 { "Max Working Set Size", "netlogon.max_working_set_size", FT_UINT32, BASE_DEC,
6218                 NULL, 0x0, "", HFILL }},
6219
6220         { &hf_netlogon_serial_number,
6221                 { "Serial Number", "netlogon.serial_number", FT_UINT32, BASE_DEC,
6222                 NULL, 0x0, "", HFILL }},
6223
6224         { &hf_netlogon_neg_flags,
6225                 { "Neg Flags", "netlogon.neg_flags", FT_UINT32, BASE_HEX,
6226                 NULL, 0x0, "Negotiation Flags", HFILL }},
6227
6228         { &hf_netlogon_logon_time,
6229                 { "Logon Time", "netlogon.logon_time", FT_ABSOLUTE_TIME, BASE_NONE,
6230                 NULL, 0, "Time for last time this user logged on", HFILL }},
6231
6232         { &hf_netlogon_kickoff_time,
6233                 { "Kickoff Time", "netlogon.kickoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
6234                 NULL, 0, "Time when this user will be kicked off", HFILL }},
6235
6236         { &hf_netlogon_logoff_time,
6237                 { "Logoff Time", "netlogon.logoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
6238                 NULL, 0, "Time for last time this user logged off", HFILL }},
6239
6240         { &hf_netlogon_pwd_last_set_time,
6241                 { "PWD Last Set", "netlogon.pwd_last_set_time", FT_ABSOLUTE_TIME, BASE_NONE,
6242                 NULL, 0, "Last time this users password was changed", HFILL }},
6243
6244         { &hf_netlogon_pwd_can_change_time,
6245                 { "PWD Can Change", "netlogon.pwd_can_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
6246                 NULL, 0, "When this users password may be changed", HFILL }},
6247
6248         { &hf_netlogon_pwd_must_change_time,
6249                 { "PWD Must Change", "netlogon.pwd_must_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
6250                 NULL, 0, "When this users password must be changed", HFILL }},
6251
6252         { &hf_netlogon_domain_create_time,
6253                 { "Domain Create Time", "netlogon.domain_create_time", FT_ABSOLUTE_TIME, BASE_NONE,
6254                 NULL, 0, "Time when this domain was created", HFILL }},
6255
6256         { &hf_netlogon_domain_modify_time,
6257                 { "Domain Modify Time", "netlogon.domain_modify_time", FT_ABSOLUTE_TIME, BASE_NONE,
6258                 NULL, 0, "Time when this domain was last modified", HFILL }},
6259
6260         { &hf_netlogon_db_modify_time,
6261                 { "DB Modify Time", "netlogon.db_modify_time", FT_ABSOLUTE_TIME, BASE_NONE,
6262                 NULL, 0, "Time when last modified", HFILL }},
6263
6264         { &hf_netlogon_db_create_time,
6265                 { "DB Create Time", "netlogon.db_create_time", FT_ABSOLUTE_TIME, BASE_NONE,
6266                 NULL, 0, "Time when created", HFILL }},
6267
6268         { &hf_netlogon_cipher_current_set_time,
6269                 { "Cipher Current Set Time", "netlogon.cipher_current_set_time", FT_ABSOLUTE_TIME, BASE_NONE,
6270                 NULL, 0, "Time when current cipher was initiated", HFILL }},
6271
6272         { &hf_netlogon_cipher_old_set_time,
6273                 { "Cipher Old Set Time", "netlogon.cipher_old_set_time", FT_ABSOLUTE_TIME, BASE_NONE,
6274                 NULL, 0, "Time when previous cipher was initiated", HFILL }},
6275
6276         { &hf_netlogon_audit_retention_period,
6277                 { "Audit Retention Period", "netlogon.audit_retention_period", FT_RELATIVE_TIME, BASE_NONE,
6278                 NULL, 0, "Audit retention period", HFILL }},
6279
6280         { &hf_netlogon_guid,
6281                 { "GUID", "netlogon.guid", FT_STRING, BASE_NONE,
6282                 NULL, 0x0, "GUID (uuid for groups?)", HFILL }},
6283
6284         { &hf_netlogon_timelimit,
6285                 { "Time Limit", "netlogon.time_limit", FT_RELATIVE_TIME, BASE_NONE,
6286                 NULL, 0, "", HFILL }}
6287
6288         };
6289
6290         static gint *ett[] = {
6291                 &ett_dcerpc_netlogon,
6292                 &ett_CYPHER_VALUE,
6293                 &ett_QUOTA_LIMITS,
6294                 &ett_IDENTITY_INFO,
6295                 &ett_DELTA_ENUM,
6296                 &ett_UNICODE_MULTI,
6297                 &ett_DOMAIN_CONTROLLER_INFO,
6298                 &ett_UNICODE_STRING_512,
6299                 &ett_TYPE_50,
6300                 &ett_TYPE_52,
6301                 &ett_DELTA_ID_UNION,
6302                 &ett_TYPE_44,
6303                 &ett_DELTA_UNION,
6304                 &ett_LM_OWF_PASSWORD,
6305                 &ett_NT_OWF_PASSWORD,
6306                 &ett_GROUP_MEMBERSHIP,
6307                 &ett_DSROLE_DOMAIN_INFO_EX,
6308                 &ett_BLOB
6309         };
6310
6311         proto_dcerpc_netlogon = proto_register_protocol(
6312                 "Microsoft Network Logon", "RPC_NETLOGON", "rpc_netlogon");
6313
6314         proto_register_field_array(proto_dcerpc_netlogon, hf,
6315                                    array_length(hf));
6316         proto_register_subtree_array(ett, array_length(ett));
6317 }
6318
6319 void
6320 proto_reg_handoff_dcerpc_netlogon(void)
6321 {
6322         /* Register protocol as dcerpc */
6323
6324         dcerpc_init_uuid(proto_dcerpc_netlogon, ett_dcerpc_netlogon,
6325                          &uuid_dcerpc_netlogon, ver_dcerpc_netlogon,
6326                          dcerpc_netlogon_dissectors, hf_netlogon_opnum);
6327 }