epan/dissectors/packet-ncp2222.inc

   1 #define FAKE_TREE_IS_VISIBLE 1
   2 /* fake that the tree is visible so that proto.c will not try to
   3  "fake" generation of finfo values/nodes.
   4   Thus this means netware dissector is slower than it has to, but it wont crash.
   5   once the dissector is refactored to avoid calling fvalue_ functions directly this faking of whether the tree is visible or not can be removed.
   6 */
   7
   8
   9 /* packet-ncp2222.inc
  10  *
  11  * Routines for NetWare Core Protocol. This C code gets #include'd
  12  * into packet-ncp2222.c, which is generated from ncp2222.py. It's
  13  * #include'd instead of being in a separate compilation unit so
  14  * that all the data tables in packet-ncp2222.c can remain static.
  15  *
  16  * Gilbert Ramirez <gram@alumni.rice.edu>
  17  * Modified to decode NDS packets by Greg Morris <gmorris@novell.com>
  18  *
  19  * Portions Copyright (c) Gilbert Ramirez 2000-2002
  20  * Portions Copyright (c) Novell, Inc. 2000-2003
  21  *
  22  * $Id$
  23  *
  24  * Wireshark - Network traffic analyzer
  25  * By Gerald Combs <gerald@wireshark.org>
  26  * Copyright 2000 Gerald Combs
  27  *
  28  * This program is free software; you can redistribute it and/or
  29  * modify it under the terms of the GNU General Public License
  30  * as published by the Free Software Foundation; either version 2
  31  * of the License, or (at your option) any later version.
  32  *
  33  * This program is distributed in the hope that it will be useful,
  34  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  35  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  36  * GNU General Public License for more details.
  37  *
  38  * You should have received a copy of the GNU General Public License
  39  * along with this program; if not, write to the Free Software
  40  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  41  */
  42
  43 #define PROTO_LENGTH_UNTIL_END -1
  44
  45 gboolean    nds_defragment  = TRUE;
  46 gboolean    nds_echo_eid    = TRUE;
  47 gboolean    ncp_echo_err    = TRUE;
  48 gboolean    ncp_echo_conn   = FALSE;
  49 gboolean    ncp_echo_server = TRUE;
  50 gboolean    ncp_echo_file   = FALSE;
  51 gboolean    ncp_newstyle    = TRUE;
  52
  53 extern dissector_handle_t nds_data_handle;
  54 typedef struct {
  55     guint32     nds_frag_verb;
  56     guint32     nds_frag_version;
  57     guint32     nds_frag_flags;
  58     guint32     nds_frag_prot_flags;
  59     guint32     nds_length;
  60     guint32     nds_frag;
  61     gboolean    nds_fragmented;
  62     guint8      sequence;
  63 } frag_info;
  64
  65 static frag_info           frags[100];
  66 static char    mv_resolve_name_string[128];
  67
  68 static const fragment_items nds_frag_items = {
  69     &ett_nds_segment,
  70     &ett_nds_segments,
  71     &hf_nds_segments,
  72     &hf_nds_segment,
  73     &hf_nds_segment_overlap,
  74     &hf_nds_segment_overlap_conflict,
  75     &hf_nds_segment_multiple_tails,
  76     &hf_nds_segment_too_long_segment,
  77     &hf_nds_segment_error,
  78     NULL,
  79     &hf_nds_reassembled_length,
  80     "segments"
  81 };
  82
  83 #define NDS_TAG_NO_SUCH_ENTRY           0x00000000
  84 #define NDS_TAG_LOCAL_ENTRY             0x00000001
  85 #define NDS_TAG_REMOTE_ENTRY            0x00000002
  86 #define NDS_TAG_ALIAS_ENTRY             0x00000003
  87 #define NDS_TAG_REFERRAL_INFORMATION    0x00000004
  88 #define NDS_TAG_ENTRY_AND_REFERRALS     0x00000006
  89
  90 /* Search objects */
  91 #define NDS_SEARCH_ENTRY                         0
  92 #define NDS_SEARCH_SUBORDINATES                  1
  93 #define NDS_SEARCH_SUBTREE                       2
  94 #define NDS_SEARCH_PARTITION                     3
  95
  96 /* Search Referral Types */
  97 #define NDS_ALIAS_REFERRAL                       0
  98 #define NDS_PARTITION_REFERRAL                   1
  99
 100 /* Search Filter Types */
 101 #define NDS_SEARCH_ITEM                          0
 102 #define NDS_SEARCH_OR                            1
 103 #define NDS_SEARCH_AND                           2
 104 #define NDS_SEARCH_NOT                           3
 105
 106 /* Search Operators */
 107 #define NDS_SEARCH_EQUAL                         7
 108 #define NDS_SEARCH_GREATER_OR_EQUAL              8
 109 #define NDS_SEARCH_LESS_OR_EQUAL                 9
 110 #define NDS_SEARCH_APPROX                       10
 111 #define NDS_SEARCH_PRESENT                      15
 112 #define NDS_SEARCH_RDN                          16
 113 #define NDS_SEARCH_BASE_CLASS                   17
 114 #define NDS_SEARCH_MODIFICATION_GE              18  /* Deprecated, use DS_SEARCH_ENTRY_MTS_GE */
 115 #define NDS_SEARCH_VALUE_TIME_GE                19  /* Deprecated, use DS_SEARCH_VALUE_MTS_GE */
 116 #define NDS_SEARCH_REFERENCES                   20
 117 #define NDS_SEARCH_DN_IN_VALUE                  21
 118 #define NDS_SEARCH_SCHEMA_IN_VALUE              22
 119 #define NDS_SEARCH_ENTRY_FLAGS                  23
 120 #define NDS_SEARCH_ENTRY_HAS_FLAG               24
 121 #define NDS_SEARCH_VALUE_FLAGS                  25
 122 #define NDS_SEARCH_VALUE_HAS_FLAG               26
 123 #define NDS_SEARCH_ATTR_FLAGS                   27
 124 #define NDS_SEARCH_ATTR_HAS_FLAG                28
 125 #define NDS_SEARCH_EID                          29
 126
 127 #define NDS_SEARCH_ENTRY_MTS_GE                 18
 128 #define NDS_SEARCH_ENTRY_MTS_G                  30
 129 #define NDS_SEARCH_ENTRY_MTS_LE                 31
 130 #define NDS_SEARCH_ENTRY_MTS_L                  32
 131 #define NDS_SEARCH_ENTRY_MTS_EQ                 33
 132 #define NDS_SEARCH_ENTRY_MTS_EQ_APPROX          34
 133 #define NDS_SEARCH_VALUE_MTS_GE                 19
 134 #define NDS_SEARCH_VALUE_MTS_G                  35
 135 #define NDS_SEARCH_VALUE_MTS_LE                 36
 136 #define NDS_SEARCH_VALUE_MTS_L                  37
 137 #define NDS_SEARCH_VALUE_MTS_EQ                 38
 138 #define NDS_SEARCH_VALUE_MTS_EQ_APPROX          39
 139
 140 #define NDS_SEARCH_ENTRY_CTS_GE                 40
 141 #define NDS_SEARCH_ENTRY_CTS_G                  41
 142 #define NDS_SEARCH_ENTRY_CTS_LE                 42
 143 #define NDS_SEARCH_ENTRY_CTS_L                  43
 144 #define NDS_SEARCH_ENTRY_CTS_EQ                 44
 145 #define NDS_SEARCH_ENTRY_CTS_EQ_APPROX          45
 146 #define NDS_SEARCH_VALUE_CTS_GE                 46
 147 #define NDS_SEARCH_VALUE_CTS_G                  47
 148 #define NDS_SEARCH_VALUE_CTS_LE                 48
 149 #define NDS_SEARCH_VALUE_CTS_L                  49
 150 #define NDS_SEARCH_VALUE_CTS_EQ                 50
 151 #define NDS_SEARCH_VALUE_CTS_EQ_APPROX          51
 152 #define NDS_SEARCH_EXTENSIBLE                   52
 153 #define NDS_SEARCH_ENTRY_SUBCOUNT_GE            53
 154 #define NDS_SEARCH_ENTRY_SUBCOUNT_G             54
 155 #define NDS_SEARCH_ENTRY_SUBCOUNT_LE            55
 156 #define NDS_SEARCH_ENTRY_SUBCOUNT_L             56
 157 #define NDS_SEARCH_ENTRY_SUBCOUNT_EQ            57
 158
 159 #define DCS_OPS                         0x10000000L
 160 #define DCS_MOD_GE_WITH_ATTR            DCS_OPS + NDS_SEARCH_MODIFICATION_GE
 161 #define DCS_VALUE_GE_WITH_ATTR          DCS_OPS + NDS_SEARCH_VALUE_TIME_GE
 162 #define DCS_MASK                        ~DCS_OPS
 163
 164 /* Iterator verbs */
 165 #define IT_CLEAR                                 1
 166 #define IT_COPY                                  2
 167 #define IT_COUNT                                 3
 168 #define IT_CREATE                                4
 169 #define IT_CURRENT                               5
 170 #define IT_DESTROY                               6
 171 #define IT_DONE                                  7
 172 #define IT_FIRST                                 8
 173 #define IT_GETPOSITION                           9
 174 #define IT_LAST                                 10
 175 #define IT_NEXT                                 11
 176 #define IT_PREV                                 12
 177 #define IT_POSITION                             13
 178 #define IT_POSITION_IT                          14
 179 #define IT_SETINDEX                             15
 180 #define IT_SETFILTER                            16
 181 #define IT_SKIP                                 17
 182 #define IT_TYPEDOWN                             18
 183 #define IT_ATFIRST                              19
 184 #define IT_ATEOF                                20
 185 #define IT_GETINDEX                             21
 186 #define IT_ISPOSITIONABLE                       22
 187 #define IT_ATBOF                                23
 188 #define IT_ATLAST                               24
 189
 190 /* Iteration information flags */
 191 #define DSI_OUTPUT_FIELDS               0x00000001L
 192 #define DSI_ENTRY_ID                    0x00000002L
 193 #define DSI_ENTRY_FLAGS                 0x00000004L
 194 #define DSI_SUBORDINATE_COUNT           0x00000008L
 195 #define DSI_MODIFICATION_TIME           0x00000010L
 196 #define DSI_MODIFICATION_TIMESTAMP      0x00000020L
 197 #define DSI_CREATION_TIMESTAMP          0x00000040L
 198 #define DSI_PARTITION_ROOT_ID           0x00000080L
 199 #define DSI_PARENT_ID                   0x00000100L
 200 #define DSI_REVISION_COUNT              0x00000200L
 201 #define DSI_REPLICA_TYPE                0x00000400L
 202 #define DSI_BASE_CLASS                  0x00000800L
 203 #define DSI_ENTRY_RDN                   0x00001000L
 204 #define DSI_ENTRY_DN                    0x00002000L
 205 #define DSI_PARTITION_ROOT_DN           0x00004000L
 206 #define DSI_PARENT_DN                   0x00008000L
 207 #define DSI_PURGE_TIME                  0x00010000L
 208 #define DSI_DEREFERENCED_BASE_CLASS     0x00020000L
 209 #define DSI_REPLICA_NUMBER              0x00040000L
 210 #define DSI_REPLICA_STATE               0x00080000L
 211 #define DSI_FEDERATION_BOUNDARY         0x00100000L
 212 #define DSI_SCHEMA_BOUNDARY             0x00200000L
 213 #define DSI_FEDERATION_BOUNDARY_ID      0x00400000L
 214 #define DSI_SCHEMA_BOUNDARY_ID          0x00800000L
 215 #define DSI_CUR_SUBCOUNT                0x01000000L
 216 #define DSI_LOCAL_ENTRY_FLAGS           0x02000000L
 217
 218 static const value_string zensearchenum[] = {
 219     { 0, "[Root]" },
 220     { 1, "Object Container" },
 221     { 2, "Associated Container" },
 222     { 3, "Selected Container" },
 223     {0, NULL }
 224 };
 225
 226 static const value_string itersearchenum[] = {
 227     { NDS_SEARCH_ITEM, "Search Item" },
 228     { NDS_SEARCH_OR, "OR" },
 229     { NDS_SEARCH_AND, "AND" },
 230     { NDS_SEARCH_NOT, "NOT" },
 231     { NDS_SEARCH_EQUAL, "Equals" },
 232     { NDS_SEARCH_GREATER_OR_EQUAL, "Greater or Equals" },
 233     { NDS_SEARCH_LESS_OR_EQUAL, "Less or Equals" },
 234     { NDS_SEARCH_APPROX, "Approximately" },
 235     { NDS_SEARCH_PRESENT, "Present" },
 236     { NDS_SEARCH_RDN, "Relative Distinguished Name" },
 237     { NDS_SEARCH_BASE_CLASS, "Base Class" },
 238     { NDS_SEARCH_MODIFICATION_GE, "Modification Greater or Equal" },
 239     { NDS_SEARCH_VALUE_TIME_GE, "Time Value Greater or Equal" },
 240     { NDS_SEARCH_REFERENCES, "References" },
 241     { NDS_SEARCH_DN_IN_VALUE, "Designated Name in Value" },
 242     { NDS_SEARCH_SCHEMA_IN_VALUE, "Schema in Value" },
 243     { NDS_SEARCH_ENTRY_FLAGS, "Entry Flags" },
 244     { NDS_SEARCH_ENTRY_HAS_FLAG, "Entry has Flags" },
 245     { NDS_SEARCH_VALUE_FLAGS, "Value Flags" },
 246     { NDS_SEARCH_VALUE_HAS_FLAG, "Value has Flags" },
 247     { NDS_SEARCH_ATTR_FLAGS, "Attribute Flags" },
 248     { NDS_SEARCH_ATTR_HAS_FLAG, "Attribute has Flags" },
 249     { NDS_SEARCH_EID, "Entry ID" },
 250     { NDS_SEARCH_ENTRY_MTS_GE, "Entry Modification Timestamp Greater or Equal" },
 251     { NDS_SEARCH_ENTRY_MTS_G, "Entry Modification Timestamp Greater" },
 252     { NDS_SEARCH_ENTRY_MTS_LE, "Entry Modification Timestamp Less or Equals" },
 253     { NDS_SEARCH_ENTRY_MTS_L, "Entry Modification Timestamp Less" },
 254     { NDS_SEARCH_ENTRY_MTS_EQ, "Entry Modification Timestamp Equals" },
 255     { NDS_SEARCH_ENTRY_MTS_EQ_APPROX, "Entry Modification Timestamp Equals Approximately" },
 256     { NDS_SEARCH_VALUE_MTS_GE, "Value Modification Timestamp Greater or Equal" },
 257     { NDS_SEARCH_VALUE_MTS_G, "Value Modification Timestamp Greater" },
 258     { NDS_SEARCH_VALUE_MTS_LE, "Value Modification Timestamp Less or Equals" },
 259     { NDS_SEARCH_VALUE_MTS_L, "Value Modification Timestamp Less" },
 260     { NDS_SEARCH_VALUE_MTS_EQ, "Value Modification Timestamp Equals" },
 261     { NDS_SEARCH_VALUE_MTS_EQ_APPROX, "Value Modification Timestamp Equals Approximately" },
 262     { NDS_SEARCH_ENTRY_CTS_GE, "Entry Creation Timestamp Greater or Equals" },
 263     { NDS_SEARCH_ENTRY_CTS_G, "Entry Creation Timestamp Greater" },
 264     { NDS_SEARCH_ENTRY_CTS_LE, "Entry Creation Timestamp Less or Equals" },
 265     { NDS_SEARCH_ENTRY_CTS_L, "Entry Creation Timestamp Less" },
 266     { NDS_SEARCH_ENTRY_CTS_EQ, "Entry Creation Timestamp Equals" },
 267     { NDS_SEARCH_ENTRY_CTS_EQ_APPROX, "Entry Creation Timestamp Equals Approximately" },
 268     { NDS_SEARCH_VALUE_CTS_GE, "Value Creation Timestamp Greater or Equals" },
 269     { NDS_SEARCH_VALUE_CTS_G, "Value Creation Timestamp Greater" },
 270     { NDS_SEARCH_VALUE_CTS_LE, "Value Creation Timestamp Less or Equals" },
 271     { NDS_SEARCH_VALUE_CTS_L, "Value Creation Timestamp Less" },
 272     { NDS_SEARCH_VALUE_CTS_EQ, "Value Creation Timestamp Equals" },
 273     { NDS_SEARCH_VALUE_CTS_EQ_APPROX, "Value Creation Timestamp Equals Approximately" },
 274     { NDS_SEARCH_EXTENSIBLE, "Extensible" },
 275     { NDS_SEARCH_ENTRY_SUBCOUNT_GE, "Entry SubCount Greater or Equals" },
 276     { NDS_SEARCH_ENTRY_SUBCOUNT_G, "Entry SubCount Greater" },
 277     { NDS_SEARCH_ENTRY_SUBCOUNT_LE, "Entry SubCount Less or Equals" },
 278     { NDS_SEARCH_ENTRY_SUBCOUNT_L, "Entry SubCount Less" },
 279     { NDS_SEARCH_ENTRY_SUBCOUNT_EQ, "Entry SubCount Equals" },
 280     {0, NULL }
 281 };
 282
 283 static const value_string iterator_subverbs[] = {
 284     { IT_CLEAR, "Clear" },
 285     { IT_COPY, "Copy" },
 286     { IT_COUNT, "Count" },
 287     { IT_CREATE, "Create" },
 288     { IT_CURRENT, "Current" },
 289     { IT_DESTROY, "Destroy" },
 290     { IT_DONE, "Done" },
 291     { IT_FIRST, "First" },
 292     { IT_GETPOSITION, "Get Position" },
 293     { IT_LAST, "Last" },
 294     { IT_NEXT, "Next" },
 295     { IT_PREV, "Previous" },
 296     { IT_POSITION, "Position" },
 297     { IT_POSITION_IT, "Position Iterator" },
 298     { IT_SETINDEX, "Set Index" },
 299     { IT_SETFILTER, "Set Filter" },
 300     { IT_SKIP, "Skip" },
 301     { IT_TYPEDOWN, "Type Down" },
 302     { IT_ATFIRST, "At First" },
 303     { IT_ATEOF, "At End of File" },
 304     { IT_GETINDEX, "Get Index" },
 305     { IT_ISPOSITIONABLE, "Is Positionable" },
 306     { IT_ATBOF, "At Beginning of File" },
 307     { IT_ATLAST, "At Last" },
 308     { 0, NULL }
 309 };
 310
 311
 312 static const value_string nds_tuned_tags[] = {
 313     { 0, "RDN Hint" },
 314     { 1, "RDN History" },
 315     {0, NULL }
 316 };
 317
 318 static const value_string nds_scope_vals[] = {
 319     { 0, "Search Scope: 0x0000 - Examine base object only" },
 320     { 1, "Search Scope: 0x0001 - Search the immediate subordinates of the base object" },
 321     { 2, "Search Scope: 0x0002 - Search the base object and all of its subordinates" },
 322     { 3, "Search Scope: 0x0003 - Search the base objects and all objects in its partition (NDS version 8 or higher)" },
 323     {0, NULL }
 324 };
 325
 326 static const value_string nds_tuned_item_tags[] = {
 327     { 0, "Single Item" },
 328     { 1, "Multiple Items" },
 329     {0, NULL }
 330 };
 331
 332 static const value_string nds_tags[] = {
 333     { NDS_TAG_NO_SUCH_ENTRY,        "No Such Entry" },
 334     { NDS_TAG_LOCAL_ENTRY,          "Local Entry" },
 335     { NDS_TAG_REMOTE_ENTRY,         "Remote Entry" },
 336     { NDS_TAG_ALIAS_ENTRY,          "Alias Entry" },
 337     { NDS_TAG_REFERRAL_INFORMATION, "Referral Information" },
 338     { NDS_TAG_ENTRY_AND_REFERRALS,  "Entry and Referrals" },
 339     { 0, NULL }
 340 };
 341
 342 static const value_string nds_info_type[] = {
 343     { 0x00000000, "Attribute Names Only / " },
 344     { 0x00000001, "Attribute Name & Value / " },
 345     { 0x00000002, "Effective Privileges / " },
 346     { 0x00000003, "Value Information / " },
 347     { 0x00000004, "Abbreviated Value / " },
 348     { 0, NULL }
 349 };
 350
 351 static const value_string nds_kind_of_changes[] = {
 352     { 0x00000000, "Add Attribute" },
 353     { 0x00000001, "Remove Attribute" },
 354     { 0x00000002, "Add Value" },
 355     { 0x00000003, "Remove Value" },
 356     { 0x00000004, "Add Additional Value" },
 357     { 0x00000005, "Overwrite Value" },
 358     { 0x00000006, "Clear Attribute" },
 359     { 0x00000007, "Clear Value" },
 360     { 0, NULL }
 361 };
 362
 363 static const value_string es_type[] = {
 364     { 0x00000000, "No type is specified" },
 365     { 0x00000001, "Unicode string" },
 366     { 0x00000002, "Partial name" },
 367     { 0x00000003, "Referrals" },
 368     { 0x00000004, "Tuned name" },
 369     { 0x00000005, "GUID attribute" },
 370     { 0x00000006, "Local entry ID" },
 371     { 0x00000007, "Number of defined entry specifiers" },
 372     { 0, NULL }
 373 };
 374
 375 static const value_string ncp_rights_vals[] = {
 376     { 0x00, "No Rights"},
 377     { 0x01, "Read"},
 378     { 0x02, "Write"},
 379     { 0x03, "Read, Write"},
 380     { 0x04, "Deny Read"},
 381     { 0x05, "Read, Deny Read"},
 382     { 0x06, "Write, Deny Read"},
 383     { 0x07, "Read, Write, Deny Read"},
 384     { 0x08, "Deny Write"},
 385     { 0x09, "Read, Deny Write"},
 386     { 0x0a, "Write, Deny Write"},
 387     { 0x0b, "Read, Write, Deny Write"},
 388     { 0x0c, "Deny Read, Deny Write"},
 389     { 0x0d, "Read, Deny Read, Deny Write"},
 390     { 0x0e, "Write, Deny Read, Deny Write"},
 391     { 0x0f, "Read, Write, Deny Read, Deny Write"},
 392     { 0x10, "Compatibility"},
 393     { 0x11, "Read, Compatibility"},
 394     { 0x12, "Write, Compatibility"},
 395     { 0x13, "Read, Write, Compatibility"},
 396     { 0x14, "Deny Read, Compatibility"},
 397     { 0x15, "Read, Deny Read, Compatibility"},
 398     { 0x16, "Write, Deny Read, Compatibility"},
 399     { 0x17, "Read, Write, Deny Read, Compatibility"},
 400     { 0x18, "Deny Write, Compatibility"},
 401     { 0x19, "Read, Deny Write, Compatibility"},
 402     { 0x1a, "Write, Deny Write, Compatibility"},
 403     { 0x1b, "Read, Write, Deny Write, Compatibility"},
 404     { 0x1c, "Deny Read, Deny Write, Compatibility"},
 405     { 0x1d, "Read, Deny Read, Deny Write, Compatibility"},
 406     { 0x1e, "Write, Deny Read, Deny Write, Compatibility"},
 407     { 0x1f, "Read, Write, Deny Read, Deny Write, Compatibility"},
 408     { 0x40, "File Write Through"},
 409     { 0x41, "Read, File Write Through"},
 410     { 0x42, "Write, File Write Through"},
 411     { 0x43, "Read, Write, File Write Through"},
 412     { 0x44, "Deny Read, File Write Through"},
 413     { 0x45, "Read, Deny Read, File Write Through"},
 414     { 0x46, "Write, Deny Read, File Write Through"},
 415     { 0x47, "Read, Write, Deny Read, File Write Through"},
 416     { 0x48, "Deny Write, File Write Through"},
 417     { 0x49, "Read, Deny Write, File Write Through"},
 418     { 0x4a, "Write, Deny Write, File Write Through"},
 419     { 0x4b, "Read, Write, Deny Write, File Write Through"},
 420     { 0x4c, "Deny Read, Deny Write, File Write Through"},
 421     { 0x4d, "Read, Deny Read, Deny Write, File Write Through"},
 422     { 0x4e, "Write, Deny Read, Deny Write, File Write Through"},
 423     { 0x4f, "Read, Write, Deny Read, Deny Write, File Write Through"},
 424     { 0x50, "Compatibility, File Write Through"},
 425     { 0x51, "Read, Compatibility, File Write Through"},
 426     { 0x52, "Write, Compatibility, File Write Through"},
 427     { 0x53, "Read, Write, Compatibility, File Write Through"},
 428     { 0x54, "Deny Read, Compatibility, File Write Through"},
 429     { 0x55, "Read, Deny Read, Compatibility, File Write Through"},
 430     { 0x56, "Write, Deny Read, Compatibility, File Write Through"},
 431     { 0x57, "Read, Write, Deny Read, Compatibility, File Write Through"},
 432     { 0x58, "Deny Write, Compatibility, File Write Through"},
 433     { 0x59, "Read, Deny Write, Compatibility, File Write Through"},
 434     { 0x5a, "Write, Deny Write, Compatibility, File Write Through"},
 435     { 0x5b, "Read, Write, Deny Write, Compatibility, File Write Through"},
 436     { 0x5c, "Deny Read, Deny Write, Compatibility, File Write Through"},
 437     { 0x5d, "Read, Deny Read, Deny Write, Compatibility, File Write Through"},
 438     { 0x5e, "Write, Deny Read, Deny Write, Compatibility, File Write Through"},
 439     { 0x5f, "Read, Write, Deny Read, Deny Write, Compatibility, File Write Through"},
 440     { 0,    NULL }
 441 };
 442
 443 static const value_string open_create_mode_vals[] = {
 444     { 0x01, "Open"},
 445     { 0x02, "Replace"},
 446     { 0x03, "Open, Replace"},
 447     { 0x08, "Create"},
 448     { 0x09, "Open, Create"},
 449     { 0x0a, "Replace, Create"},
 450     { 0x0b, "Open, Replace, Create"},
 451     { 0x20, "64-bit"},
 452     { 0x21, "Open, 64-bit"},
 453     { 0x22, "Replace, 64-bit"},
 454     { 0x23, "Open, Replace, 64-bit"},
 455     { 0x28, "Create, 64-bit"},
 456     { 0x29, "Open, Create, 64-bit"},
 457     { 0x2a, "Replace, Create, 64-bit"},
 458     { 0x2b, "Open, Replace, Create, 64-bit"},
 459     { 0x40, "Read Only"},
 460     { 0x41, "Open, Read Only"},
 461     { 0x42, "Replace, Read Only"},
 462     { 0x43, "Open, Replace, Read Only"},
 463     { 0x48, "Create, Read Only"},
 464     { 0x49, "Open, Create, Read Only"},
 465     { 0x4a, "Replace, Create, Read Only"},
 466     { 0x4b, "Open, Replace, Create, Read Only"},
 467     { 0x60, "64-bit, Read Only"},
 468     { 0x61, "Open, 64-bit, Read Only"},
 469     { 0x62, "Replace, 64-bit, Read Only"},
 470     { 0x63, "Open, Replace, 64-bit, Read Only"},
 471     { 0x68, "Create, 64-bit, Read Only"},
 472     { 0x69, "Open, Create, 64-bit, Read Only"},
 473     { 0x6a, "Replace, Create, 64-bit, Read Only"},
 474     { 0x6b, "Open, Replace, Create, 64-bit, Read Only"},
 475     { 0x80, "Op-Lock"},
 476     { 0x81, "Open, Op-Lock"},
 477     { 0x82, "Replace, Op-Lock"},
 478     { 0x83, "Open, Replace, Op-Lock"},
 479     { 0x88, "Create, Op-Lock"},
 480     { 0x89, "Open, Create, Op-Lock"},
 481     { 0x8a, "Replace, Create, Op-Lock"},
 482     { 0x8b, "Open, Replace, Create, Op-Lock"},
 483     { 0xa0, "64-bit, Op-Lock"},
 484     { 0xa1, "Open, 64-bit, Op-Lock"},
 485     { 0xa2, "Replace, 64-bit, Op-Lock"},
 486     { 0xa3, "Open, Replace, 64-bit, Op-Lock"},
 487     { 0xa8, "Create, 64-bit, Op-Lock"},
 488     { 0xa9, "Open, Create, 64-bit, Op-Lock"},
 489     { 0xaa, "Replace, Create, 64-bit, Op-Lock"},
 490     { 0xab, "Open, Replace, Create, 64-bit, Op-Lock"},
 491     { 0xc0, "Read Only, Op-Lock"},
 492     { 0xc1, "Open, Read Only, Op-Lock"},
 493     { 0xc2, "Replace, Read Only, Op-Lock"},
 494     { 0xc3, "Open, Replace, Read Only, Op-Lock"},
 495     { 0xc8, "Create, Read Only, Op-Lock"},
 496     { 0xc9, "Open, Create, Read Only, Op-Lock"},
 497     { 0xca, "Replace, Create, Read Only, Op-Lock"},
 498     { 0xcb, "Open, Replace, Create, Read Only, Op-Lock"},
 499     { 0xe0, "64-bit, Read Only, Op-Lock"},
 500     { 0xe1, "Open, 64-bit, Read Only, Op-Lock"},
 501     { 0xe2, "Replace, 64-bit, Read Only, Op-Lock"},
 502     { 0xe3, "Open, Replace, 64-bit, Read Only, Op-Lock"},
 503     { 0xe8, "Create, 64-bit, Read Only, Op-Lock"},
 504     { 0xe9, "Open, Create, 64-bit, Read Only, Op-Lock"},
 505     { 0xea, "Replace, Create, 64-bit, Read Only, Op-Lock"},
 506     { 0xeb, "Open, Replace, Create, 64-bit, Read Only, Op-Lock"},
 507     { 0,    NULL }
 508 };
 509
 510 static const value_string open_create_action_vals[] = {
 511     { 0x01, "Opened"},
 512     { 0x02, "Created"},
 513     { 0x03, "Opened, Created"},
 514     { 0x04, "Replaced"},
 515     { 0x05, "Opened, Replaced"},
 516     { 0x06, "Created, Replaced"},
 517     { 0x07, "Opened, Created, Replaced"},
 518     { 0x08, "Compressed"},
 519     { 0x09, "Opened, Compressed"},
 520     { 0x0a, "Created, Compressed"},
 521     { 0x0b, "Opened, Created, Compressed"},
 522     { 0x0c, "Replaced, Compressed"},
 523     { 0x0d, "Opened, Replaced, Compressed"},
 524     { 0x0e, "Created, Replaced, Compressed"},
 525     { 0x0f, "Opened, Created, Replaced, Compressed"},
 526     { 0x80, "Read Only"},
 527     { 0x81, "Opened, Read Only"},
 528     { 0x82, "Created, Read Only"},
 529     { 0x83, "Opened, Created, Read Only"},
 530     { 0x84, "Replaced, Read Only"},
 531     { 0x85, "Opened, Replaced, Read Only"},
 532     { 0x86, "Created, Replaced, Read Only"},
 533     { 0x87, "Opened, Created, Replaced, Read Only"},
 534     { 0x88, "Compressed, Read Only"},
 535     { 0x89, "Opened, Compressed, Read Only"},
 536     { 0x8a, "Created, Compressed, Read Only"},
 537     { 0x8b, "Opened, Created, Compressed, Read Only"},
 538     { 0x8c, "Replaced, Compressed, Read Only"},
 539     { 0x8d, "Opened, Replaced, Compressed, Read Only"},
 540     { 0x8e, "Created, Replaced, Compressed, Read Only"},
 541     { 0x8f, "Opened, Created, Replaced, Compressed, Read Only"},
 542     { 0,    NULL }
 543 };
 544
 545 static const value_string access_rights_vals[] = {
 546     { 0x0000, "No Rights"},
 547     { 0x0001, "Read"},
 548     { 0x0002, "Write"},
 549     { 0x0003, "Read, Write"},
 550     { 0x0004, "Open"},
 551     { 0x0005, "Read, Open"},
 552     { 0x0006, "Write, Open"},
 553     { 0x0007, "Read, Write, Open"},
 554     { 0x0008, "Create"},
 555     { 0x0009, "Read, Create"},
 556     { 0x000a, "Write, Create"},
 557     { 0x000b, "Read, Write, Create"},
 558     { 0x000c, "Open, Create"},
 559     { 0x000d, "Read, Open, Create"},
 560     { 0x000e, "Write, Open, Create"},
 561     { 0x000f, "Read, Write, Open, Create"},
 562     { 0x0010, "Delete"},
 563     { 0x0011, "Read, Delete"},
 564     { 0x0012, "Write, Delete"},
 565     { 0x0013, "Read, Write, Delete"},
 566     { 0x0014, "Open, Delete"},
 567     { 0x0015, "Read, Open, Delete"},
 568     { 0x0016, "Write, Open, Delete"},
 569     { 0x0017, "Read, Write, Open, Delete"},
 570     { 0x0018, "Create, Delete"},
 571     { 0x0019, "Read, Create, Delete"},
 572     { 0x001a, "Write, Create, Delete"},
 573     { 0x001b, "Read, Write, Create, Delete"},
 574     { 0x001c, "Open, Create, Delete"},
 575     { 0x001d, "Read, Open, Create, Delete"},
 576     { 0x001e, "Write, Open, Create, Delete"},
 577     { 0x001f, "Read, Write, Open, Create, Delete"},
 578     { 0x0020, "Parental"},
 579     { 0x0021, "Read, Parental"},
 580     { 0x0022, "Write, Parental"},
 581     { 0x0023, "Read, Write, Parental"},
 582     { 0x0024, "Open, Parental"},
 583     { 0x0025, "Read, Open, Parental"},
 584     { 0x0026, "Write, Open, Parental"},
 585     { 0x0027, "Read, Write, Open, Parental"},
 586     { 0x0028, "Create, Parental"},
 587     { 0x0029, "Read, Create, Parental"},
 588     { 0x002a, "Write, Create, Parental"},
 589     { 0x002b, "Read, Write, Create, Parental"},
 590     { 0x002c, "Open, Create, Parental"},
 591     { 0x002d, "Read, Open, Create, Parental"},
 592     { 0x002e, "Write, Open, Create, Parental"},
 593     { 0x002f, "Read, Write, Open, Create, Parental"},
 594     { 0x0030, "Delete, Parental"},
 595     { 0x0031, "Read, Delete, Parental"},
 596     { 0x0032, "Write, Delete, Parental"},
 597     { 0x0033, "Read, Write, Delete, Parental"},
 598     { 0x0034, "Open, Delete, Parental"},
 599     { 0x0035, "Read, Open, Delete, Parental"},
 600     { 0x0036, "Write, Open, Delete, Parental"},
 601     { 0x0037, "Read, Write, Open, Delete, Parental"},
 602     { 0x0038, "Create, Delete, Parental"},
 603     { 0x0039, "Read, Create, Delete, Parental"},
 604     { 0x003a, "Write, Create, Delete, Parental"},
 605     { 0x003b, "Read, Write, Create, Delete, Parental"},
 606     { 0x003c, "Open, Create, Delete, Parental"},
 607     { 0x003d, "Read, Open, Create, Delete, Parental"},
 608     { 0x003e, "Write, Open, Create, Delete, Parental"},
 609     { 0x003f, "Read, Write, Open, Create, Delete, Parental"},
 610     { 0x0040, "Search"},
 611     { 0x0041, "Read, Search"},
 612     { 0x0042, "Write, Search"},
 613     { 0x0043, "Read, Write, Search"},
 614     { 0x0044, "Open, Search"},
 615     { 0x0045, "Read, Open, Search"},
 616     { 0x0046, "Write, Open, Search"},
 617     { 0x0047, "Read, Write, Open, Search"},
 618     { 0x0048, "Create, Search"},
 619     { 0x0049, "Read, Create, Search"},
 620     { 0x004a, "Write, Create, Search"},
 621     { 0x004b, "Read, Write, Create, Search"},
 622     { 0x004c, "Open, Create, Search"},
 623     { 0x004d, "Read, Open, Create, Search"},
 624     { 0x004e, "Write, Open, Create, Search"},
 625     { 0x004f, "Read, Write, Open, Create, Search"},
 626     { 0x0050, "Delete, Search"},
 627     { 0x0051, "Read, Delete, Search"},
 628     { 0x0052, "Write, Delete, Search"},
 629     { 0x0053, "Read, Write, Delete, Search"},
 630     { 0x0054, "Open, Delete, Search"},
 631     { 0x0055, "Read, Open, Delete, Search"},
 632     { 0x0056, "Write, Open, Delete, Search"},
 633     { 0x0057, "Read, Write, Open, Delete, Search"},
 634     { 0x0058, "Create, Delete, Search"},
 635     { 0x0059, "Read, Create, Delete, Search"},
 636     { 0x005a, "Write, Create, Delete, Search"},
 637     { 0x005b, "Read, Write, Create, Delete, Search"},
 638     { 0x005c, "Open, Create, Delete, Search"},
 639     { 0x005d, "Read, Open, Create, Delete, Search"},
 640     { 0x005e, "Write, Open, Create, Delete, Search"},
 641     { 0x005f, "Read, Write, Open, Create, Delete, Search"},
 642     { 0x0060, "Parental, Search"},
 643     { 0x0061, "Read, Parental, Search"},
 644     { 0x0062, "Write, Parental, Search"},
 645     { 0x0063, "Read, Write, Parental, Search"},
 646     { 0x0064, "Open, Parental, Search"},
 647     { 0x0065, "Read, Open, Parental, Search"},
 648     { 0x0066, "Write, Open, Parental, Search"},
 649     { 0x0067, "Read, Write, Open, Parental, Search"},
 650     { 0x0068, "Create, Parental, Search"},
 651     { 0x0069, "Read, Create, Parental, Search"},
 652     { 0x006a, "Write, Create, Parental, Search"},
 653     { 0x006b, "Read, Write, Create, Parental, Search"},
 654     { 0x006c, "Open, Create, Parental, Search"},
 655     { 0x006d, "Read, Open, Create, Parental, Search"},
 656     { 0x006e, "Write, Open, Create, Parental, Search"},
 657     { 0x006f, "Read, Write, Open, Create, Parental, Search"},
 658     { 0x0070, "Delete, Parental, Search"},
 659     { 0x0071, "Read, Delete, Parental, Search"},
 660     { 0x0072, "Write, Delete, Parental, Search"},
 661     { 0x0073, "Read, Write, Delete, Parental, Search"},
 662     { 0x0074, "Open, Delete, Parental, Search"},
 663     { 0x0075, "Read, Open, Delete, Parental, Search"},
 664     { 0x0076, "Write, Open, Delete, Parental, Search"},
 665     { 0x0077, "Read, Write, Open, Delete, Parental, Search"},
 666     { 0x0078, "Create, Delete, Parental, Search"},
 667     { 0x0079, "Read, Create, Delete, Parental, Search"},
 668     { 0x007a, "Write, Create, Delete, Parental, Search"},
 669     { 0x007b, "Read, Write, Create, Delete, Parental, Search"},
 670     { 0x007c, "Open, Create, Delete, Parental, Search"},
 671     { 0x007d, "Read, Open, Create, Delete, Parental, Search"},
 672     { 0x007e, "Write, Open, Create, Delete, Parental, Search"},
 673     { 0x007f, "Read, Write, Open, Create, Delete, Parental, Search"},
 674     { 0x0080, "Modify"},
 675     { 0x0081, "Read, Modify"},
 676     { 0x0082, "Write, Modify"},
 677     { 0x0083, "Read, Write, Modify"},
 678     { 0x0084, "Open, Modify"},
 679     { 0x0085, "Read, Open, Modify"},
 680     { 0x0086, "Write, Open, Modify"},
 681     { 0x0087, "Read, Write, Open, Modify"},
 682     { 0x0088, "Create, Modify"},
 683     { 0x0089, "Read, Create, Modify"},
 684     { 0x008a, "Write, Create, Modify"},
 685     { 0x008b, "Read, Write, Create, Modify"},
 686     { 0x008c, "Open, Create, Modify"},
 687     { 0x008d, "Read, Open, Create, Modify"},
 688     { 0x008e, "Write, Open, Create, Modify"},
 689     { 0x008f, "Read, Write, Open, Create, Modify"},
 690     { 0x0090, "Delete, Modify"},
 691     { 0x0091, "Read, Delete, Modify"},
 692     { 0x0092, "Write, Delete, Modify"},
 693     { 0x0093, "Read, Write, Delete, Modify"},
 694     { 0x0094, "Open, Delete, Modify"},
 695     { 0x0095, "Read, Open, Delete, Modify"},
 696     { 0x0096, "Write, Open, Delete, Modify"},
 697     { 0x0097, "Read, Write, Open, Delete, Modify"},
 698     { 0x0098, "Create, Delete, Modify"},
 699     { 0x0099, "Read, Create, Delete, Modify"},
 700     { 0x009a, "Write, Create, Delete, Modify"},
 701     { 0x009b, "Read, Write, Create, Delete, Modify"},
 702     { 0x009c, "Open, Create, Delete, Modify"},
 703     { 0x009d, "Read, Open, Create, Delete, Modify"},
 704     { 0x009e, "Write, Open, Create, Delete, Modify"},
 705     { 0x009f, "Read, Write, Open, Create, Delete, Modify"},
 706     { 0x00a0, "Parental, Modify"},
 707     { 0x00a1, "Read, Parental, Modify"},
 708     { 0x00a2, "Write, Parental, Modify"},
 709     { 0x00a3, "Read, Write, Parental, Modify"},
 710     { 0x00a4, "Open, Parental, Modify"},
 711     { 0x00a5, "Read, Open, Parental, Modify"},
 712     { 0x00a6, "Write, Open, Parental, Modify"},
 713     { 0x00a7, "Read, Write, Open, Parental, Modify"},
 714     { 0x00a8, "Create, Parental, Modify"},
 715     { 0x00a9, "Read, Create, Parental, Modify"},
 716     { 0x00aa, "Write, Create, Parental, Modify"},
 717     { 0x00ab, "Read, Write, Create, Parental, Modify"},
 718     { 0x00ac, "Open, Create, Parental, Modify"},
 719     { 0x00ad, "Read, Open, Create, Parental, Modify"},
 720     { 0x00ae, "Write, Open, Create, Parental, Modify"},
 721     { 0x00af, "Read, Write, Open, Create, Parental, Modify"},
 722     { 0x00b0, "Delete, Parental, Modify"},
 723     { 0x00b1, "Read, Delete, Parental, Modify"},
 724     { 0x00b2, "Write, Delete, Parental, Modify"},
 725     { 0x00b3, "Read, Write, Delete, Parental, Modify"},
 726     { 0x00b4, "Open, Delete, Parental, Modify"},
 727     { 0x00b5, "Read, Open, Delete, Parental, Modify"},
 728     { 0x00b6, "Write, Open, Delete, Parental, Modify"},
 729     { 0x00b7, "Read, Write, Open, Delete, Parental, Modify"},
 730     { 0x00b8, "Create, Delete, Parental, Modify"},
 731     { 0x00b9, "Read, Create, Delete, Parental, Modify"},
 732     { 0x00ba, "Write, Create, Delete, Parental, Modify"},
 733     { 0x00bb, "Read, Write, Create, Delete, Parental, Modify"},
 734     { 0x00bc, "Open, Create, Delete, Parental, Modify"},
 735     { 0x00bd, "Read, Open, Create, Delete, Parental, Modify"},
 736     { 0x00be, "Write, Open, Create, Delete, Parental, Modify"},
 737     { 0x00bf, "Read, Write, Open, Create, Delete, Parental, Modify"},
 738     { 0x00c0, "Search, Modify"},
 739     { 0x00c1, "Read, Search, Modify"},
 740     { 0x00c2, "Write, Search, Modify"},
 741     { 0x00c3, "Read, Write, Search, Modify"},
 742     { 0x00c4, "Open, Search, Modify"},
 743     { 0x00c5, "Read, Open, Search, Modify"},
 744     { 0x00c6, "Write, Open, Search, Modify"},
 745     { 0x00c7, "Read, Write, Open, Search, Modify"},
 746     { 0x00c8, "Create, Search, Modify"},
 747     { 0x00c9, "Read, Create, Search, Modify"},
 748     { 0x00ca, "Write, Create, Search, Modify"},
 749     { 0x00cb, "Read, Write, Create, Search, Modify"},
 750     { 0x00cc, "Open, Create, Search, Modify"},
 751     { 0x00cd, "Read, Open, Create, Search, Modify"},
 752     { 0x00ce, "Write, Open, Create, Search, Modify"},
 753     { 0x00cf, "Read, Write, Open, Create, Search, Modify"},
 754     { 0x00d0, "Delete, Search, Modify"},
 755     { 0x00d1, "Read, Delete, Search, Modify"},
 756     { 0x00d2, "Write, Delete, Search, Modify"},
 757     { 0x00d3, "Read, Write, Delete, Search, Modify"},
 758     { 0x00d4, "Open, Delete, Search, Modify"},
 759     { 0x00d5, "Read, Open, Delete, Search, Modify"},
 760     { 0x00d6, "Write, Open, Delete, Search, Modify"},
 761     { 0x00d7, "Read, Write, Open, Delete, Search, Modify"},
 762     { 0x00d8, "Create, Delete, Search, Modify"},
 763     { 0x00d9, "Read, Create, Delete, Search, Modify"},
 764     { 0x00da, "Write, Create, Delete, Search, Modify"},
 765     { 0x00db, "Read, Write, Create, Delete, Search, Modify"},
 766     { 0x00dc, "Open, Create, Delete, Search, Modify"},
 767     { 0x00dd, "Read, Open, Create, Delete, Search, Modify"},
 768     { 0x00de, "Write, Open, Create, Delete, Search, Modify"},
 769     { 0x00df, "Read, Write, Open, Create, Delete, Search, Modify"},
 770     { 0x00e0, "Parental, Search, Modify"},
 771     { 0x00e1, "Read, Parental, Search, Modify"},
 772     { 0x00e2, "Write, Parental, Search, Modify"},
 773     { 0x00e3, "Read, Write, Parental, Search, Modify"},
 774     { 0x00e4, "Open, Parental, Search, Modify"},
 775     { 0x00e5, "Read, Open, Parental, Search, Modify"},
 776     { 0x00e6, "Write, Open, Parental, Search, Modify"},
 777     { 0x00e7, "Read, Write, Open, Parental, Search, Modify"},
 778     { 0x00e8, "Create, Parental, Search, Modify"},
 779     { 0x00e9, "Read, Create, Parental, Search, Modify"},
 780     { 0x00ea, "Write, Create, Parental, Search, Modify"},
 781     { 0x00eb, "Read, Write, Create, Parental, Search, Modify"},
 782     { 0x00ec, "Open, Create, Parental, Search, Modify"},
 783     { 0x00ed, "Read, Open, Create, Parental, Search, Modify"},
 784     { 0x00ee, "Write, Open, Create, Parental, Search, Modify"},
 785     { 0x00ef, "Read, Write, Open, Create, Parental, Search, Modify"},
 786     { 0x00f0, "Delete, Parental, Search, Modify"},
 787     { 0x00f1, "Read, Delete, Parental, Search, Modify"},
 788     { 0x00f2, "Write, Delete, Parental, Search, Modify"},
 789     { 0x00f3, "Read, Write, Delete, Parental, Search, Modify"},
 790     { 0x00f4, "Open, Delete, Parental, Search, Modify"},
 791     { 0x00f5, "Read, Open, Delete, Parental, Search, Modify"},
 792     { 0x00f6, "Write, Open, Delete, Parental, Search, Modify"},
 793     { 0x00f7, "Read, Write, Open, Delete, Parental, Search, Modify"},
 794     { 0x00f8, "Create, Delete, Parental, Search, Modify"},
 795     { 0x00f9, "Read, Create, Delete, Parental, Search, Modify"},
 796     { 0x00fa, "Write, Create, Delete, Parental, Search, Modify"},
 797     { 0x00fb, "Read, Write, Create, Delete, Parental, Search, Modify"},
 798     { 0x00fc, "Open, Create, Delete, Parental, Search, Modify"},
 799     { 0x00fd, "Read, Open, Create, Delete, Parental, Search, Modify"},
 800     { 0x00fe, "Write, Open, Create, Delete, Parental, Search, Modify"},
 801     { 0x00ff, "Read, Write, Open, Create, Delete, Parental, Search, Modify"},
 802     { 0x0100, "Supervisor"},
 803     { 0x0101, "Read, Supervisor"},
 804     { 0x0102, "Write, Supervisor"},
 805     { 0x0103, "Read, Write, Supervisor"},
 806     { 0x0104, "Open, Supervisor"},
 807     { 0x0105, "Read, Open, Supervisor"},
 808     { 0x0106, "Write, Open, Supervisor"},
 809     { 0x0107, "Read, Write, Open, Supervisor"},
 810     { 0x0108, "Create, Supervisor"},
 811     { 0x0109, "Read, Create, Supervisor"},
 812     { 0x010a, "Write, Create, Supervisor"},
 813     { 0x010b, "Read, Write, Create, Supervisor"},
 814     { 0x010c, "Open, Create, Supervisor"},
 815     { 0x010d, "Read, Open, Create, Supervisor"},
 816     { 0x010e, "Write, Open, Create, Supervisor"},
 817     { 0x010f, "Read, Write, Open, Create, Supervisor"},
 818     { 0x0110, "Delete, Supervisor"},
 819     { 0x0111, "Read, Delete, Supervisor"},
 820     { 0x0112, "Write, Delete, Supervisor"},
 821     { 0x0113, "Read, Write, Delete, Supervisor"},
 822     { 0x0114, "Open, Delete, Supervisor"},
 823     { 0x0115, "Read, Open, Delete, Supervisor"},
 824     { 0x0116, "Write, Open, Delete, Supervisor"},
 825     { 0x0117, "Read, Write, Open, Delete, Supervisor"},
 826     { 0x0118, "Create, Delete, Supervisor"},
 827     { 0x0119, "Read, Create, Delete, Supervisor"},
 828     { 0x011a, "Write, Create, Delete, Supervisor"},
 829     { 0x011b, "Read, Write, Create, Delete, Supervisor"},
 830     { 0x011c, "Open, Create, Delete, Supervisor"},
 831     { 0x011d, "Read, Open, Create, Delete, Supervisor"},
 832     { 0x011e, "Write, Open, Create, Delete, Supervisor"},
 833     { 0x011f, "Read, Write, Open, Create, Delete, Supervisor"},
 834     { 0x0120, "Parental, Supervisor"},
 835     { 0x0121, "Read, Parental, Supervisor"},
 836     { 0x0122, "Write, Parental, Supervisor"},
 837     { 0x0123, "Read, Write, Parental, Supervisor"},
 838     { 0x0124, "Open, Parental, Supervisor"},
 839     { 0x0125, "Read, Open, Parental, Supervisor"},
 840     { 0x0126, "Write, Open, Parental, Supervisor"},
 841     { 0x0127, "Read, Write, Open, Parental, Supervisor"},
 842     { 0x0128, "Create, Parental, Supervisor"},
 843     { 0x0129, "Read, Create, Parental, Supervisor"},
 844     { 0x012a, "Write, Create, Parental, Supervisor"},
 845     { 0x012b, "Read, Write, Create, Parental, Supervisor"},
 846     { 0x012c, "Open, Create, Parental, Supervisor"},
 847     { 0x012d, "Read, Open, Create, Parental, Supervisor"},
 848     { 0x012e, "Write, Open, Create, Parental, Supervisor"},
 849     { 0x012f, "Read, Write, Open, Create, Parental, Supervisor"},
 850     { 0x0130, "Delete, Parental, Supervisor"},
 851     { 0x0131, "Read, Delete, Parental, Supervisor"},
 852     { 0x0132, "Write, Delete, Parental, Supervisor"},
 853     { 0x0133, "Read, Write, Delete, Parental, Supervisor"},
 854     { 0x0134, "Open, Delete, Parental, Supervisor"},
 855     { 0x0135, "Read, Open, Delete, Parental, Supervisor"},
 856     { 0x0136, "Write, Open, Delete, Parental, Supervisor"},
 857     { 0x0137, "Read, Write, Open, Delete, Parental, Supervisor"},
 858     { 0x0138, "Create, Delete, Parental, Supervisor"},
 859     { 0x0139, "Read, Create, Delete, Parental, Supervisor"},
 860     { 0x013a, "Write, Create, Delete, Parental, Supervisor"},
 861     { 0x013b, "Read, Write, Create, Delete, Parental, Supervisor"},
 862     { 0x013c, "Open, Create, Delete, Parental, Supervisor"},
 863     { 0x013d, "Read, Open, Create, Delete, Parental, Supervisor"},
 864     { 0x013e, "Write, Open, Create, Delete, Parental, Supervisor"},
 865     { 0x013f, "Read, Write, Open, Create, Delete, Parental, Supervisor"},
 866     { 0x0140, "Search, Supervisor"},
 867     { 0x0141, "Read, Search, Supervisor"},
 868     { 0x0142, "Write, Search, Supervisor"},
 869     { 0x0143, "Read, Write, Search, Supervisor"},
 870     { 0x0144, "Open, Search, Supervisor"},
 871     { 0x0145, "Read, Open, Search, Supervisor"},
 872     { 0x0146, "Write, Open, Search, Supervisor"},
 873     { 0x0147, "Read, Write, Open, Search, Supervisor"},
 874     { 0x0148, "Create, Search, Supervisor"},
 875     { 0x0149, "Read, Create, Search, Supervisor"},
 876     { 0x014a, "Write, Create, Search, Supervisor"},
 877     { 0x014b, "Read, Write, Create, Search, Supervisor"},
 878     { 0x014c, "Open, Create, Search, Supervisor"},
 879     { 0x014d, "Read, Open, Create, Search, Supervisor"},
 880     { 0x014e, "Write, Open, Create, Search, Supervisor"},
 881     { 0x014f, "Read, Write, Open, Create, Search, Supervisor"},
 882     { 0x0150, "Delete, Search, Supervisor"},
 883     { 0x0151, "Read, Delete, Search, Supervisor"},
 884     { 0x0152, "Write, Delete, Search, Supervisor"},
 885     { 0x0153, "Read, Write, Delete, Search, Supervisor"},
 886     { 0x0154, "Open, Delete, Search, Supervisor"},
 887     { 0x0155, "Read, Open, Delete, Search, Supervisor"},
 888     { 0x0156, "Write, Open, Delete, Search, Supervisor"},
 889     { 0x0157, "Read, Write, Open, Delete, Search, Supervisor"},
 890     { 0x0158, "Create, Delete, Search, Supervisor"},
 891     { 0x0159, "Read, Create, Delete, Search, Supervisor"},
 892     { 0x015a, "Write, Create, Delete, Search, Supervisor"},
 893     { 0x015b, "Read, Write, Create, Delete, Search, Supervisor"},
 894     { 0x015c, "Open, Create, Delete, Search, Supervisor"},
 895     { 0x015d, "Read, Open, Create, Delete, Search, Supervisor"},
 896     { 0x015e, "Write, Open, Create, Delete, Search, Supervisor"},
 897     { 0x015f, "Read, Write, Open, Create, Delete, Search, Supervisor"},
 898     { 0x0160, "Parental, Search, Supervisor"},
 899     { 0x0161, "Read, Parental, Search, Supervisor"},
 900     { 0x0162, "Write, Parental, Search, Supervisor"},
 901     { 0x0163, "Read, Write, Parental, Search, Supervisor"},
 902     { 0x0164, "Open, Parental, Search, Supervisor"},
 903     { 0x0165, "Read, Open, Parental, Search, Supervisor"},
 904     { 0x0166, "Write, Open, Parental, Search, Supervisor"},
 905     { 0x0167, "Read, Write, Open, Parental, Search, Supervisor"},
 906     { 0x0168, "Create, Parental, Search, Supervisor"},
 907     { 0x0169, "Read, Create, Parental, Search, Supervisor"},
 908     { 0x016a, "Write, Create, Parental, Search, Supervisor"},
 909     { 0x016b, "Read, Write, Create, Parental, Search, Supervisor"},
 910     { 0x016c, "Open, Create, Parental, Search, Supervisor"},
 911     { 0x016d, "Read, Open, Create, Parental, Search, Supervisor"},
 912     { 0x016e, "Write, Open, Create, Parental, Search, Supervisor"},
 913     { 0x016f, "Read, Write, Open, Create, Parental, Search, Supervisor"},
 914     { 0x0170, "Delete, Parental, Search, Supervisor"},
 915     { 0x0171, "Read, Delete, Parental, Search, Supervisor"},
 916     { 0x0172, "Write, Delete, Parental, Search, Supervisor"},
 917     { 0x0173, "Read, Write, Delete, Parental, Search, Supervisor"},
 918     { 0x0174, "Open, Delete, Parental, Search, Supervisor"},
 919     { 0x0175, "Read, Open, Delete, Parental, Search, Supervisor"},
 920     { 0x0176, "Write, Open, Delete, Parental, Search, Supervisor"},
 921     { 0x0177, "Read, Write, Open, Delete, Parental, Search, Supervisor"},
 922     { 0x0178, "Create, Delete, Parental, Search, Supervisor"},
 923     { 0x0179, "Read, Create, Delete, Parental, Search, Supervisor"},
 924     { 0x017a, "Write, Create, Delete, Parental, Search, Supervisor"},
 925     { 0x017b, "Read, Write, Create, Delete, Parental, Search, Supervisor"},
 926     { 0x017c, "Open, Create, Delete, Parental, Search, Supervisor"},
 927     { 0x017d, "Read, Open, Create, Delete, Parental, Search, Supervisor"},
 928     { 0x017e, "Write, Open, Create, Delete, Parental, Search, Supervisor"},
 929     { 0x017f, "Read, Write, Open, Create, Delete, Parental, Search, Supervisor"},
 930     { 0x0180, "Modify, Supervisor"},
 931     { 0x0181, "Read, Modify, Supervisor"},
 932     { 0x0182, "Write, Modify, Supervisor"},
 933     { 0x0183, "Read, Write, Modify, Supervisor"},
 934     { 0x0184, "Open, Modify, Supervisor"},
 935     { 0x0185, "Read, Open, Modify, Supervisor"},
 936     { 0x0186, "Write, Open, Modify, Supervisor"},
 937     { 0x0187, "Read, Write, Open, Modify, Supervisor"},
 938     { 0x0188, "Create, Modify, Supervisor"},
 939     { 0x0189, "Read, Create, Modify, Supervisor"},
 940     { 0x018a, "Write, Create, Modify, Supervisor"},
 941     { 0x018b, "Read, Write, Create, Modify, Supervisor"},
 942     { 0x018c, "Open, Create, Modify, Supervisor"},
 943     { 0x018d, "Read, Open, Create, Modify, Supervisor"},
 944     { 0x018e, "Write, Open, Create, Modify, Supervisor"},
 945     { 0x018f, "Read, Write, Open, Create, Modify, Supervisor"},
 946     { 0x0190, "Delete, Modify, Supervisor"},
 947     { 0x0191, "Read, Delete, Modify, Supervisor"},
 948     { 0x0192, "Write, Delete, Modify, Supervisor"},
 949     { 0x0193, "Read, Write, Delete, Modify, Supervisor"},
 950     { 0x0194, "Open, Delete, Modify, Supervisor"},
 951     { 0x0195, "Read, Open, Delete, Modify, Supervisor"},
 952     { 0x0196, "Write, Open, Delete, Modify, Supervisor"},
 953     { 0x0197, "Read, Write, Open, Delete, Modify, Supervisor"},
 954     { 0x0198, "Create, Delete, Modify, Supervisor"},
 955     { 0x0199, "Read, Create, Delete, Modify, Supervisor"},
 956     { 0x019a, "Write, Create, Delete, Modify, Supervisor"},
 957     { 0x019b, "Read, Write, Create, Delete, Modify, Supervisor"},
 958     { 0x019c, "Open, Create, Delete, Modify, Supervisor"},
 959     { 0x019d, "Read, Open, Create, Delete, Modify, Supervisor"},
 960     { 0x019e, "Write, Open, Create, Delete, Modify, Supervisor"},
 961     { 0x019f, "Read, Write, Open, Create, Delete, Modify, Supervisor"},
 962     { 0x01a0, "Parental, Modify, Supervisor"},
 963     { 0x01a1, "Read, Parental, Modify, Supervisor"},
 964     { 0x01a2, "Write, Parental, Modify, Supervisor"},
 965     { 0x01a3, "Read, Write, Parental, Modify, Supervisor"},
 966     { 0x01a4, "Open, Parental, Modify, Supervisor"},
 967     { 0x01a5, "Read, Open, Parental, Modify, Supervisor"},
 968     { 0x01a6, "Write, Open, Parental, Modify, Supervisor"},
 969     { 0x01a7, "Read, Write, Open, Parental, Modify, Supervisor"},
 970     { 0x01a8, "Create, Parental, Modify, Supervisor"},
 971     { 0x01a9, "Read, Create, Parental, Modify, Supervisor"},
 972     { 0x01aa, "Write, Create, Parental, Modify, Supervisor"},
 973     { 0x01ab, "Read, Write, Create, Parental, Modify, Supervisor"},
 974     { 0x01ac, "Open, Create, Parental, Modify, Supervisor"},
 975     { 0x01ad, "Read, Open, Create, Parental, Modify, Supervisor"},
 976     { 0x01ae, "Write, Open, Create, Parental, Modify, Supervisor"},
 977     { 0x01af, "Read, Write, Open, Create, Parental, Modify, Supervisor"},
 978     { 0x01b0, "Delete, Parental, Modify, Supervisor"},
 979     { 0x01b1, "Read, Delete, Parental, Modify, Supervisor"},
 980     { 0x01b2, "Write, Delete, Parental, Modify, Supervisor"},
 981     { 0x01b3, "Read, Write, Delete, Parental, Modify, Supervisor"},
 982     { 0x01b4, "Open, Delete, Parental, Modify, Supervisor"},
 983     { 0x01b5, "Read, Open, Delete, Parental, Modify, Supervisor"},
 984     { 0x01b6, "Write, Open, Delete, Parental, Modify, Supervisor"},
 985     { 0x01b7, "Read, Write, Open, Delete, Parental, Modify, Supervisor"},
 986     { 0x01b8, "Create, Delete, Parental, Modify, Supervisor"},
 987     { 0x01b9, "Read, Create, Delete, Parental, Modify, Supervisor"},
 988     { 0x01ba, "Write, Create, Delete, Parental, Modify, Supervisor"},
 989     { 0x01bb, "Read, Write, Create, Delete, Parental, Modify, Supervisor"},
 990     { 0x01bc, "Open, Create, Delete, Parental, Modify, Supervisor"},
 991     { 0x01bd, "Read, Open, Create, Delete, Parental, Modify, Supervisor"},
 992     { 0x01be, "Write, Open, Create, Delete, Parental, Modify, Supervisor"},
 993     { 0x01bf, "Read, Write, Open, Create, Delete, Parental, Modify, Supervisor"},
 994     { 0x01c0, "Search, Modify, Supervisor"},
 995     { 0x01c1, "Read, Search, Modify, Supervisor"},
 996     { 0x01c2, "Write, Search, Modify, Supervisor"},
 997     { 0x01c3, "Read, Write, Search, Modify, Supervisor"},
 998     { 0x01c4, "Open, Search, Modify, Supervisor"},
 999     { 0x01c5, "Read, Open, Search, Modify, Supervisor"},
1000     { 0x01c6, "Write, Open, Search, Modify, Supervisor"},
1001     { 0x01c7, "Read, Write, Open, Search, Modify, Supervisor"},
1002     { 0x01c8, "Create, Search, Modify, Supervisor"},
1003     { 0x01c9, "Read, Create, Search, Modify, Supervisor"},
1004     { 0x01ca, "Write, Create, Search, Modify, Supervisor"},
1005     { 0x01cb, "Read, Write, Create, Search, Modify, Supervisor"},
1006     { 0x01cc, "Open, Create, Search, Modify, Supervisor"},
1007     { 0x01cd, "Read, Open, Create, Search, Modify, Supervisor"},
1008     { 0x01ce, "Write, Open, Create, Search, Modify, Supervisor"},
1009     { 0x01cf, "Read, Write, Open, Create, Search, Modify, Supervisor"},
1010     { 0x01d0, "Delete, Search, Modify, Supervisor"},
1011     { 0x01d1, "Read, Delete, Search, Modify, Supervisor"},
1012     { 0x01d2, "Write, Delete, Search, Modify, Supervisor"},
1013     { 0x01d3, "Read, Write, Delete, Search, Modify, Supervisor"},
1014     { 0x01d4, "Open, Delete, Search, Modify, Supervisor"},
1015     { 0x01d5, "Read, Open, Delete, Search, Modify, Supervisor"},
1016     { 0x01d6, "Write, Open, Delete, Search, Modify, Supervisor"},
1017     { 0x01d7, "Read, Write, Open, Delete, Search, Modify, Supervisor"},
1018     { 0x01d8, "Create, Delete, Search, Modify, Supervisor"},
1019     { 0x01d9, "Read, Create, Delete, Search, Modify, Supervisor"},
1020     { 0x01da, "Write, Create, Delete, Search, Modify, Supervisor"},
1021     { 0x01db, "Read, Write, Create, Delete, Search, Modify, Supervisor"},
1022     { 0x01dc, "Open, Create, Delete, Search, Modify, Supervisor"},
1023     { 0x01dd, "Read, Open, Create, Delete, Search, Modify, Supervisor"},
1024     { 0x01de, "Write, Open, Create, Delete, Search, Modify, Supervisor"},
1025     { 0x01df, "Read, Write, Open, Create, Delete, Search, Modify, Supervisor"},
1026     { 0x01e0, "Parental, Search, Modify, Supervisor"},
1027     { 0x01e1, "Read, Parental, Search, Modify, Supervisor"},
1028     { 0x01e2, "Write, Parental, Search, Modify, Supervisor"},
1029     { 0x01e3, "Read, Write, Parental, Search, Modify, Supervisor"},
1030     { 0x01e4, "Open, Parental, Search, Modify, Supervisor"},
1031     { 0x01e5, "Read, Open, Parental, Search, Modify, Supervisor"},
1032     { 0x01e6, "Write, Open, Parental, Search, Modify, Supervisor"},
1033     { 0x01e7, "Read, Write, Open, Parental, Search, Modify, Supervisor"},
1034     { 0x01e8, "Create, Parental, Search, Modify, Supervisor"},
1035     { 0x01e9, "Read, Create, Parental, Search, Modify, Supervisor"},
1036     { 0x01ea, "Write, Create, Parental, Search, Modify, Supervisor"},
1037     { 0x01eb, "Read, Write, Create, Parental, Search, Modify, Supervisor"},
1038     { 0x01ec, "Open, Create, Parental, Search, Modify, Supervisor"},
1039     { 0x01ed, "Read, Open, Create, Parental, Search, Modify, Supervisor"},
1040     { 0x01ee, "Write, Open, Create, Parental, Search, Modify, Supervisor"},
1041     { 0x01ef, "Read, Write, Open, Create, Parental, Search, Modify, Supervisor"},
1042     { 0x01f0, "Delete, Parental, Search, Modify, Supervisor"},
1043     { 0x01f1, "Read, Delete, Parental, Search, Modify, Supervisor"},
1044     { 0x01f2, "Write, Delete, Parental, Search, Modify, Supervisor"},
1045     { 0x01f3, "Read, Write, Delete, Parental, Search, Modify, Supervisor"},
1046     { 0x01f4, "Open, Delete, Parental, Search, Modify, Supervisor"},
1047     { 0x01f5, "Read, Open, Delete, Parental, Search, Modify, Supervisor"},
1048     { 0x01f6, "Write, Open, Delete, Parental, Search, Modify, Supervisor"},
1049     { 0x01f7, "Read, Write, Open, Delete, Parental, Search, Modify, Supervisor"},
1050     { 0x01f8, "Create, Delete, Parental, Search, Modify, Supervisor"},
1051     { 0x01f9, "Read, Create, Delete, Parental, Search, Modify, Supervisor"},
1052     { 0x01fa, "Write, Create, Delete, Parental, Search, Modify, Supervisor"},
1053     { 0x01fb, "Read, Write, Create, Delete, Parental, Search, Modify, Supervisor"},
1054     { 0x01fc, "Open, Create, Delete, Parental, Search, Modify, Supervisor"},
1055     { 0x01fd, "Read, Open, Create, Delete, Parental, Search, Modify, Supervisor"},
1056     { 0x01fe, "Write, Open, Create, Delete, Parental, Search, Modify, Supervisor"},
1057     { 0x01ff, "Read, Write, Open, Create, Delete, Parental, Search, Modify, Supervisor"},
1058     { 0,    NULL }
1059 };
1060
1061
1062 static const value_string nds_reply_errors[] = {
1063     { 0xffffffff, "(-1) Insufficient Space" },
1064     { 0xffffff89, "(-119) Buffer too Small" },
1065     { 0xffffff88, "(-120) RR Volume Flag Not Set" },
1066     { 0xffffff87, "(-121) No Items Found" },
1067     { 0xffffff86, "(-122) Connection Already Temporary" },
1068     { 0xffffff85, "(-123) Connection Already Logged In" },
1069     { 0xffffff84, "(-124) Connection Not Authenticated" },
1070     { 0xffffff83, "(-125) Connection Not Logged In" },
1071     { 0xffffff82, "(-126) NCP Boundary Check Failed" },
1072     { 0xffffff81, "(-127) Lock Waiting" },
1073     { 0xffffff80, "(-128) Lock Fail" },
1074     { 0xffffff7f, "(-129) Out of Handles" },
1075     { 0xffffff7e, "(-130) No Open Privilege" },
1076     { 0xffffff7d, "(-131) Hard IO Error" },
1077     { 0xffffff7c, "(-132) No Create Privilege" },
1078     { 0xffffff7b, "(-133) No Create Delete Privilege" },
1079     { 0xffffff7a, "(-134) Create Duplicate When Read Only" },
1080     { 0xffffff79, "(-135) Create File with Invalid Name" },
1081     { 0xffffff78, "(-136) Invalid File Handle" },
1082     { 0xffffff77, "(-137) No Search Privilege"   },
1083     { 0xffffff76, "(-138) No Delete Privilege" },
1084     { 0xffffff75, "(-139) No Rename Privilege" },
1085     { 0xffffff74, "(-140) No Set Privilege" },
1086     { 0xffffff73, "(-141) Some File in Use" },
1087     { 0xffffff72, "(-142) All File in Use" },
1088     { 0xffffff71, "(-143) Some Read Only" },
1089     { 0xffffff70, "(-144) All Read Only" },
1090     { 0xffffff6f, "(-145) Some names Exist" },
1091     { 0xffffff6e, "(-146) All Names Exist" },
1092     { 0xffffff6d, "(-147) No Read Privilege" },
1093     { 0xffffff6c, "(-148) No Write Privilege" },
1094     { 0xffffff6b, "(-149) File Detached" },
1095     { 0xffffff6a, "(-150) No Alloc Space/Target Not a Subdirectory/Insuffficient Memory" },
1096     { 0xffffff69, "(-151) No Spool Space" },
1097     { 0xffffff68, "(-152) Invalid Volume" },
1098     { 0xffffff67, "(-153) Directory Full" },
1099     { 0xffffff66, "(-154) Rename Across Volume" },
1100     { 0xffffff65, "(-155) Bad Directory Handle" },
1101     { 0xffffff64, "(-156) Invalid Path/No Such Extension" },
1102     { 0xffffff63, "(-157) No Directory Handles" },
1103     { 0xffffff62, "(-158) Bad File Name" },
1104     { 0xffffff61, "(-159) Directory Active" },
1105     { 0xffffff60, "(-160) Directory Not Empty" },
1106     { 0xffffff5f, "(-161) Directory IO Error" },
1107     { 0xffffff5e, "(-162) IO Locked" },
1108     { 0xffffff5d, "(-163) Transaction Restarted" },
1109     { 0xffffff5c, "(-164) Rename Directory Invalid" },
1110     { 0xffffff5b, "(-165) Invalid Open/Create Mode" },
1111     { 0xffffff5a, "(-166) Already in Use" },
1112     { 0xffffff59, "(-167) Invalid Resource Tag" },
1113     { 0xffffff58, "(-168) Access Denied" },
1114     { 0xffffff44, "(-188) Login Signing Required" },
1115     { 0xffffff43, "(-189) Login Encryption Required" },
1116     { 0xffffff42, "(-190) Invalid Data Stream" },
1117     { 0xffffff41, "(-191) Invalid Name Space" },
1118     { 0xffffff40, "(-192) No Accounting Privileges" },
1119     { 0xffffff3f, "(-193) No Account Balance" },
1120     { 0xffffff3e, "(-194) Credit Limit Exceeded" },
1121     { 0xffffff3d, "(-195) Too Many Holds" },
1122     { 0xffffff3c, "(-196) Accounting Disabled" },
1123     { 0xffffff3b, "(-197) Intruder Login Lockout" },
1124     { 0xffffff3a, "(-198) No Console Rights" },
1125     { 0xffffff30, "(-208) Queue IO Failure" },
1126     { 0xffffff2f, "(-209) No Queue" },
1127     { 0xffffff2e, "(-210) No Queue Server" },
1128     { 0xffffff2d, "(-211) No Queue Rights" },
1129     { 0xffffff2c, "(-212) Queue Full" },
1130     { 0xffffff2b, "(-213) No Queue Job" },
1131     { 0xffffff2a, "(-214) No Queue Job Rights/Unencrypted Not Allowed" },
1132     { 0xffffff29, "(-215) Queue In Service/Duplicate Password" },
1133     { 0xffffff28, "(-216) Queue Not Active/Password Too Short" },
1134     { 0xffffff27, "(-217) Queue Station Not Server/Maximum Logins Exceeded" },
1135     { 0xffffff26, "(-218) Queue Halted/Bad Login Time" },
1136     { 0xffffff25, "(-219) Queue Maximum Servers/Node Address Violation" },
1137     { 0xffffff24, "(-220) Login Account Expired" },
1138     { 0xffffff22, "(-222) Bad Password" },
1139     { 0xffffff21, "(-223) Password Expired" },
1140     { 0xffffff20, "(-224) No Login Connection Available" },
1141     { 0xffffff18, "(-232) Write to Group Property" },
1142     { 0xffffff17, "(-233) Member Already Exists" },
1143     { 0xffffff16, "(-234) No Such Member" },
1144     { 0xffffff15, "(-235) Property Not Group" },
1145     { 0xffffff14, "(-236) No Such Value Set" },
1146     { 0xffffff13, "(-237) Property Already Exists" },
1147     { 0xffffff12, "(-238) Object Already Exists" },
1148     { 0xffffff11, "(-239) Illegal Name" },
1149     { 0xffffff10, "(-240) Illegal Wildcard" },
1150     { 0xffffff0f, "(-241) Bindery Security" },
1151     { 0xffffff0e, "(-242) No Object Read Rights" },
1152     { 0xffffff0d, "(-243) No Object Rename Rights" },
1153     { 0xffffff0c, "(-244) No Object Delete Rights" },
1154     { 0xffffff0b, "(-245) No Object Create Rights" },
1155     { 0xffffff0a, "(-246) No Property Delete Rights" },
1156     { 0xffffff09, "(-247) No Property Create Rigths" },
1157     { 0xffffff08, "(-248) No Property Write Rights" },
1158     { 0xffffff07, "(-249) No Propery Read Rights" },
1159     { 0xffffff06, "(-250) Temp Remap" },
1160     { 0xffffff05, "(-251) Unknown Request/No Such Property" },
1161     { 0xffffff04, "(-252) Message Queue Full/Target Already Has Message/No Such Object" },
1162     { 0xffffff03, "(-253) Bad Station Number" },
1163     { 0xffffff02, "(-254) Bindery Locked/Directory Locked/Spool Delete/Trustee not Found/Timeout" },
1164     { 0xffffff01, "(-255) Hard Failure" },
1165     { 0xfffffed3, "(-301) Not Enough Memory" },
1166     { 0xfffffed2, "(-302) Bad Key" },
1167     { 0xfffffed1, "(-303) Bad Context" },
1168     { 0xfffffed0, "(-304) Buffer Full" },
1169     { 0xfffffecf, "(-305) List Empty" },
1170     { 0xfffffece, "(-306) Bad Syntax"   },
1171     { 0xfffffecd, "(-307) Buffer Empty" },
1172     { 0xfffffecc, "(-308) Bad Verb" },
1173     { 0xfffffecb, "(-309) Expected Identifier" },
1174     { 0xfffffeca, "(-310) Expected Equals" },
1175     { 0xfffffec9, "(-311) Attribute Type Expected" },
1176     { 0xfffffec8, "(-312) Attribute Type Not Expected" },
1177     { 0xfffffec7, "(-313) Filter Tree Empty" },
1178     { 0xfffffec6, "(-314) Invalid Object Name" },
1179     { 0xfffffec5, "(-315) Expected RDN Delimiter" },
1180     { 0xfffffec4, "(-316) Too Many Tokens" },
1181     { 0xfffffec3, "(-317) Inconsistent MultiAVA" },
1182     { 0xfffffec2, "(-318) Country Name Too Long" },
1183     { 0xfffffec1, "(-319) Internal Error" },
1184     { 0xfffffec0, "(-320) Can't Add Root" },
1185     { 0xfffffebf, "(-321) Unable to Attach" },
1186     { 0xfffffebe, "(-322) Invalid Iteration Handle" },
1187     { 0xfffffebd, "(-323) Buffer Zero Length" },
1188     { 0xfffffebc, "(-324) Invalid Replica Type" },
1189     { 0xfffffebb, "(-325) Invalid Attribute Syntax" },
1190     { 0xfffffeba, "(-326) Invalid Filter Syntax" },
1191     { 0xfffffeb8, "(-328) Unicode Error during Context Creation" },
1192     { 0xfffffeb7, "(-329) Invalid Union Tag" },
1193     { 0xfffffeb6, "(-330) Invalid Server Response" },
1194     { 0xfffffeb5, "(-331) Null Pointer" },
1195     { 0xfffffeb4, "(-332) No Server Found" },
1196     { 0xfffffeb3, "(-333) No Connection" },
1197     { 0xfffffeb2, "(-334) RDN Too Long" },
1198     { 0xfffffeb1, "(-335) Duplicate Type" },
1199     { 0xfffffeb0, "(-336) Data Store Failure" },
1200     { 0xfffffeaf, "(-337) Not Logged In" },
1201     { 0xfffffeae, "(-338) Invalid Password Characters" },
1202     { 0xfffffead, "(-339) Failed Server Authentication" },
1203     { 0xfffffeac, "(-340) Transport Failed" },
1204     { 0xfffffeab, "(-341) No Such Syntax" },
1205     { 0xfffffeaa, "(-342) Invalid DS Name" },
1206     { 0xfffffea9, "(-343) Attribute Name Too Long" },
1207     { 0xfffffea8, "(-344) Invalid TDS" },
1208     { 0xfffffea7, "(-345) Invalid DS Version" },
1209     { 0xfffffea6, "(-346) Unicode Translation" },
1210     { 0xfffffea5, "(-347) Schema Name Too Long" },
1211     { 0xfffffea4, "(-348) Unicode File Not Found" },
1212     { 0xfffffea3, "(-349) Unicode Already Loaded" },
1213     { 0xfffffea2, "(-350) Not Context Owner" },
1214     { 0xfffffea1, "(-351) Attempt to Authenticate" },
1215     { 0xfffffea0, "(-352) No Writable Replicas" },
1216     { 0xfffffe9f, "(-353) DN Too Long" },
1217     { 0xfffffe9e, "(-354) Rename Not Allowed" },
1218     { 0xfffffe9d, "(-355) Not NDS for NT" },
1219     { 0xfffffe9c, "(-356) NDS for NT - No Domain" },
1220     { 0xfffffe9b, "(-357) NDS for NT - Sync Disabled" },
1221     { 0xfffffe9a, "(-358) Iterator Invalid Handle" },
1222     { 0xfffffe99, "(-359) Iterator Invalid Position" },
1223     { 0xfffffe98, "(-360) Iterator Invalid Search Data" },
1224     { 0xfffffe97, "(-361) Iterator Invalid Scope" },
1225     { 0xfffffda7, "(-601) No Such Entry" },
1226     { 0xfffffda6, "(-602) No Such Value" },
1227     { 0xfffffda5, "(-603) No Such Attribute" },
1228     { 0xfffffda4, "(-604) No Such Class" },
1229     { 0xfffffda3, "(-605) No Such Partition" },
1230     { 0xfffffda2, "(-606) Entry Already Exists" },
1231     { 0xfffffda1, "(-607) Not Effective Class" },
1232     { 0xfffffda0, "(-608) Illegal Attribute" },
1233     { 0xfffffd9f, "(-609) Missing Mandatory" },
1234     { 0xfffffd9e, "(-610) Illegal DS Name" },
1235     { 0xfffffd9d, "(-611) Illegal Containment" },
1236     { 0xfffffd9c, "(-612) Can't Have Multiple Values" },
1237     { 0xfffffd9b, "(-613) Syntax Violation" },
1238     { 0xfffffd9a, "(-614) Duplicate Value" },
1239     { 0xfffffd99, "(-615) Attribute Already Exists" },
1240     { 0xfffffd98, "(-616) Maximum Entries Exist" },
1241     { 0xfffffd97, "(-617) Database Format" },
1242     { 0xfffffd96, "(-618) Inconsistent Database" },
1243     { 0xfffffd95, "(-619) Invalid Comparison" },
1244     { 0xfffffd94, "(-620) Comparison Failed" },
1245     { 0xfffffd93, "(-621) Transaction Tracking Disabled" },
1246     { 0xfffffd92, "(-622) Invalid Transport" },
1247     { 0xfffffd91, "(-623) Syntax Invalid in Name" },
1248     { 0xfffffd90, "(-624) Replica Already Exists" },
1249     { 0xfffffd8f, "(-625) Transport Failure" },
1250     { 0xfffffd8e, "(-626) All Referrals Failed" },
1251     { 0xfffffd8d, "(-627) Can't Remove Naming Value" },
1252     { 0xfffffd8c, "(-628) Object Class Violation" },
1253     { 0xfffffd8b, "(-629) Entry is Not Leaf" },
1254     { 0xfffffd8a, "(-630) Different Tree" },
1255     { 0xfffffd89, "(-631) Illegal Replica Type" },
1256     { 0xfffffd88, "(-632) System Failure" },
1257     { 0xfffffd87, "(-633) Invalid Entry for Root" },
1258     { 0xfffffd86, "(-634) No Referrals" },
1259     { 0xfffffd85, "(-635) Remote Failure" },
1260     { 0xfffffd84, "(-636) Unreachable Server" },
1261     { 0xfffffd83, "(-637) Previous Move in Progress" },
1262     { 0xfffffd82, "(-638) No Character Mapping" },
1263     { 0xfffffd81, "(-639) Incomplete Authentication" },
1264     { 0xfffffd80, "(-640) Invalid Certificate" },
1265     { 0xfffffd7f, "(-641) Invalid Request" },
1266     { 0xfffffd7e, "(-642) Invalid Iteration" },
1267     { 0xfffffd7d, "(-643) Schema is Non-removable" },
1268     { 0xfffffd7c, "(-644) Schema is in Use" },
1269     { 0xfffffd7b, "(-645) Class Already Exists" },
1270     { 0xfffffd7a, "(-646) Bad Naming Attributes" },
1271     { 0xfffffd79, "(-647) Not Root Partition" },
1272     { 0xfffffd78, "(-648) Insufficient Stack" },
1273     { 0xfffffd77, "(-649) Insufficient Buffer" },
1274     { 0xfffffd76, "(-650) Ambiguous Containment" },
1275     { 0xfffffd75, "(-651) Ambiguous Naming" },
1276     { 0xfffffd74, "(-652) Duplicate Mandatory" },
1277     { 0xfffffd73, "(-653) Duplicate Optional" },
1278     { 0xfffffd72, "(-654) Partition Busy" },
1279     { 0xfffffd71, "(-655) Multiple Replicas" },
1280     { 0xfffffd70, "(-656) Crucial Replica" },
1281     { 0xfffffd6f, "(-657) Schema Sync in Progress" },
1282     { 0xfffffd6e, "(-658) Skulk in Progress" },
1283     { 0xfffffd6d, "(-659) Time Not Synchronized" },
1284     { 0xfffffd6c, "(-660) Record in Use" },
1285     { 0xfffffd6b, "(-661) DS Volume Not Mounted" },
1286     { 0xfffffd6a, "(-662) DS Volume IO Failure" },
1287     { 0xfffffd69, "(-663) DS Locked" },
1288     { 0xfffffd68, "(-664) Old Epoch" },
1289     { 0xfffffd67, "(-665) New Epoch" },
1290     { 0xfffffd66, "(-666) Incompatible DS Version" },
1291     { 0xfffffd65, "(-667) Partition Root" },
1292     { 0xfffffd64, "(-668) Entry Not Container" },
1293     { 0xfffffd63, "(-669) Failed Authentication" },
1294     { 0xfffffd62, "(-670) Invalid Context" },
1295     { 0xfffffd61, "(-671) No Such Parent" },
1296     { 0xfffffd60, "(-672) No Access" },
1297     { 0xfffffd5f, "(-673) Replica Not On" },
1298     { 0xfffffd5e, "(-674) Invalid Name Service" },
1299     { 0xfffffd5d, "(-675) Invalid Task" },
1300     { 0xfffffd5c, "(-676) Invalide Connection Handle" },
1301     { 0xfffffd5b, "(-677) Invalid Identity" },
1302     { 0xfffffd5a, "(-678) Duplicate ACL" },
1303     { 0xfffffd59, "(-679) Partition Already Exists" },
1304     { 0xfffffd58, "(-680) Transport Modified" },
1305     { 0xfffffd57, "(-681) Alias of an Alias" },
1306     { 0xfffffd56, "(-682) Auditing Failed" },
1307     { 0xfffffd55, "(-683) Invalid API Version" },
1308     { 0xfffffd54, "(-684) Secure NCP Violation" },
1309     { 0xfffffd53, "(-685) Move in Progress" },
1310     { 0xfffffd52, "(-686) Not a Leaf Partition" },
1311     { 0xfffffd51, "(-687) Cannot Abort" },
1312     { 0xfffffd50, "(-688) Cache Overflow" },
1313     { 0xfffffd4f, "(-689) Invalid Subordinate Count" },
1314     { 0xfffffd4e, "(-690) Invalid RDN" },
1315     { 0xfffffd4d, "(-691) Modification Time Not Current" },
1316     { 0xfffffd4c, "(-692) Incorrect Base Class" },
1317     { 0xfffffd4b, "(-693) Missing Reference" },
1318     { 0xfffffd4a, "(-694) Lost Entry" },
1319     { 0xfffffd49, "(-695) Agent Already Registered" },
1320     { 0xfffffd48, "(-696) DS Loader Busy" },
1321     { 0xfffffd47, "(-697) DS Cannot Reload" },
1322     { 0xfffffd46, "(-698) Replica in Skulk" },
1323     { 0xfffffd45, "(-699) Fatal" },
1324     { 0xfffffd44, "(-700) Obsolete API" },
1325     { 0xfffffd43, "(-701) Synchronization Disabled" },
1326     { 0xfffffd42, "(-702) Invalid Parameter" },
1327     { 0xfffffd41, "(-703) Duplicate Template" },
1328     { 0xfffffd40, "(-704) No Master Replica" },
1329     { 0xfffffd3f, "(-705) Duplicate Containment" },
1330     { 0xfffffd3e, "(-706) Not a Sibling" },
1331     { 0xfffffd3d, "(-707) Invalid Signature" },
1332     { 0xfffffd3c, "(-708) Invalid Response" },
1333     { 0xfffffd3b, "(-709) Insufficient Sockets" },
1334     { 0xfffffd3a, "(-710) Database Read Fail" },
1335     { 0xfffffd39, "(-711) Invalid Code Page" },
1336     { 0xfffffd38, "(-712) Invalid Escape Character" },
1337     { 0xfffffd37, "(-713) Invalide Delimiters" },
1338     { 0xfffffd36, "(-714) Not Implemented" },
1339     { 0xfffffd35, "(-715) Checksum Failure" },
1340     { 0xfffffd34, "(-716) Checksumming Not Supported" },
1341     { 0xfffffd33, "(-717) CRC Failure" },
1342     { 0xfffffd32, "(-718) Invalid Entry Handle" },
1343     { 0xfffffd31, "(-719) Invalid Value Handle" },
1344     { 0xfffffd30, "(-720) Connection Denied" },
1345     { 0xfffffd2f, "(-721) No Such Federation Link" },
1346     { 0xfffffd2e, "(-722) Operetational Schema Mismatch" },
1347     { 0xfffffd2d, "(-723) Stream Not Found" },
1348     { 0xfffffd2c, "(-724) DClient Unavailable" },
1349     { 0xfffffd2b, "(-725) MASV No Access" },
1350     { 0xfffffd2a, "(-726) MASV Invalid Request" },
1351     { 0xfffffd29, "(-727) MASV Failure" },
1352     { 0xfffffd28, "(-728) MASV Already Exists" },
1353     { 0xfffffd27, "(-729) MASV Not Found" },
1354     { 0xfffffd26, "(-730) MASV Bad Range" },
1355     { 0xfffffd25, "(-731) Value Data" },
1356     { 0xfffffd24, "(-732) Database Locked" },
1357     { 0xfffffd21, "(-735) Nothing to Abort" },
1358     { 0xfffffd20, "(-736) End of Stream" },
1359     { 0xfffffd1f, "(-737) No Such Template" },
1360     { 0xfffffd1e, "(-738) SAS Locked" },
1361     { 0xfffffd1d, "(-739) Invalid SAS Version" },
1362     { 0xfffffd1c, "(-740) SAS Already Registered" },
1363     { 0xfffffd1b, "(-741) Name Type Not Supported" },
1364     { 0xfffffd1a, "(-742) Wrong DS Version" },
1365     { 0xfffffd19, "(-743) Invalid Control Function" },
1366     { 0xfffffd18, "(-744) Invalid Control State" },
1367     { 0xfffffd17, "(-745) Cache in Use" },
1368     { 0xfffffd16, "(-746) Zero Creation Time" },
1369     { 0xfffffd15, "(-747) Would Block" },
1370     { 0xfffffd14, "(-748) Connection Timeout" },
1371     { 0xfffffd13, "(-749) Too Many Referrals" },
1372     { 0xfffffd12, "(-750) Operation Cancelled" },
1373     { 0xfffffd11, "(-751) Unknown Target" },
1374     { 0xfffffd10, "(-752) GUID Failure" },
1375     { 0xfffffd0f, "(-753) Incompatible OS" },
1376     { 0xfffffd0e, "(-754) Callback Cancel" },
1377     { 0xfffffd0d, "(-755) Invalid Synchronization Data" },
1378     { 0xfffffd0c, "(-756) Stream Exists" },
1379     { 0xfffffd0b, "(-757) Auxiliary Has Containment" },
1380     { 0xfffffd0a, "(-758) Auxiliary Not Container" },
1381     { 0xfffffd09, "(-759) Auxiliary Not Effective" },
1382     { 0xfffffd08, "(-760) Auxiliary On Alias" },
1383     { 0xfffffd07, "(-761) Have Seen State" },
1384     { 0xfffffd06, "(-762) Verb Locked" },
1385     { 0xfffffd05, "(-763) Verb Exceeds Table Length" },
1386     { 0xfffffd04, "(-764) BOF Hit" },
1387     { 0xfffffd03, "(-765) EOF Hit" },
1388     { 0xfffffd02, "(-766) Incompatible Replica Version" },
1389     { 0xfffffd01, "(-767) Query Timeout" },
1390     { 0xfffffd00, "(-768) Query Maximum Count" },
1391     { 0xfffffcff, "(-769) Duplicate Naming" },
1392     { 0xfffffcfe, "(-770) No Transaction Active" },
1393     { 0xfffffcfd, "(-771) Transaction Active" },
1394     { 0xfffffcfc, "(-772) Illegal Transaction Operation" },
1395     { 0xfffffcfb, "(-773) Iterator Syntax" },
1396     { 0xfffffcfa, "(-774) Repairing DIB" },
1397     { 0xfffffcf9, "(-775) Invalid OID Format" },
1398     { 0xfffffcf8, "(-776) Attempted to perform an NDS operation, and the DS agent on this server is closing" },
1399     { 0xfffffcf7, "(-777) Attempted to modify an object's attribute that is not stored on the sparse replica" },
1400     { 0xfffffcf6, "(-778) VpVector and VpvUser which must be correlated, are out of sync" },
1401     { 0xfffffcf5, "(-779) Error Cannot Go Remote" },
1402     { 0xfffffcf4, "(-780) Request not Supported" },
1403     { 0xfffffcf3, "(-781) Entry Not Local" },
1404     { 0xfffffcf2, "(-782) Root Unreachable" },
1405     { 0xfffffcf1, "(-783) VRDIM Not Initialized" },
1406     { 0xfffffcf0, "(-784) Wait Timeout" },
1407     { 0xfffffcef, "(-785) DIB Error" },
1408     { 0xfffffcee, "(-786) DIB IO Failure" },
1409     { 0xfffffced, "(-787) Illegal Schema Attribute" },
1410     { 0xfffffcec, "(-788) Error Schema Partition" },
1411     { 0xfffffceb, "(-789) Invalid Template" },
1412     { 0xfffffcea, "(-790) Error Opening File" },
1413     { 0xfffffce9, "(-791) Error Direct Opening File" },
1414     { 0xfffffce8, "(-792) Error Creating File" },
1415     { 0xfffffce7, "(-793) Error Direct Creating File" },
1416     { 0xfffffce6, "(-794) Error Reading File" },
1417     { 0xfffffce5, "(-795) Error Direct Reading File" },
1418     { 0xfffffce4, "(-796) Error Writing File" },
1419     { 0xfffffce3, "(-797) Error Direct Writing File" },
1420     { 0xfffffce2, "(-798) Error Positioning in File" },
1421     { 0xfffffce1, "(-799) Error Getting File Size" },
1422     { 0xffffe88f, "(-6001) Error Truncating File" },
1423     { 0xffffe88e, "(-6002) Error Parsing File Name" },
1424     { 0xffffe88d, "(-6003) Error Closing File" },
1425     { 0xffffe88c, "(-6004) Error Getting File Info" },
1426     { 0xffffe88b, "(-6005) Error Expanding File" },
1427     { 0xffffe88a, "(-6006) Error Getting Free Blocks" },
1428     { 0xffffe889, "(-6007) Error Checking File Existence" },
1429     { 0xffffe888, "(-6008) Error Deleting File" },
1430     { 0xffffe887, "(-6009) Error Renaming File" },
1431     { 0xffffe886, "(-6010) Error Initializing IO System" },
1432     { 0xffffe885, "(-6011) Error Flushing File" },
1433     { 0xffffe884, "(-6012) Error Setting Up for Read" },
1434     { 0xffffe883, "(-6013) Error Setting up for Write" },
1435     { 0xffffe882, "(-6014) Error Old View" },
1436     { 0xffffe881, "(-6015) Server in Skulk" },
1437     { 0xffffe880, "(-6016) Error Returning Partial Results" },
1438     { 0xffffe87f, "(-6017) No Such Schema" },
1439     { 0xffffe87e, "(-6018) Serial Number Mismatch" },
1440     { 0xffffe87d, "(-6019) Bad Referal Database Serial Number" },
1441     { 0xffffe87c, "(-6020) Bad Referal Serial Number" },
1442     { 0xffffe87b, "(-6021) Invalid File Sequence" },
1443     { 0xffffe87a, "(-6022) Error Referal Trans Gap" },
1444     { 0xffffe879, "(-6023) Bad Referal File Number" },
1445     { 0xffffe878, "(-6024) Referal File Not Found" },
1446     { 0xffffe877, "(-6025) Error Backup Active" },
1447     { 0xffffe876, "(-6026) Referal Device Full" },
1448     { 0xffffe875, "(-6027) Unsupported Version" },
1449     { 0xffffe874, "(-6028) Error Must Wait Checkpoint" },
1450     { 0xffffe873, "(-6029) Attribute Maintenance in Progress" },
1451     { 0xffffe872, "(-6030) Error Abort Transaction" },
1452     { 0xffff0000, "Ok" },
1453     { 0x0000, "Ok" },
1454     { 0, NULL }
1455 };
1456
1457 #define NDS_PTYPE_IPX           0x00000000
1458 #define NDS_PTYPE_IP            0x00000001
1459 #define NDS_PTYPE_SDLC          0x00000002
1460 #define NDS_PTYPE_TR_ON_ETH     0x00000003
1461 #define NDS_PTYPE_OSI           0x00000004
1462 #define NDS_PTYPE_APPLETALK     0x00000005
1463 #define NDS_PTYPE_NETBEUI       0x00000006
1464 #define NDS_PTYPE_SOCKETADDRESS 0x00000007
1465 #define NDS_PTYPE_UDP           0x00000008
1466 #define NDS_PTYPE_TCP           0x00000009
1467 #define NDS_PTYPE_UDPv6         0x0000000a
1468 #define NDS_PTYPE_TCPv6         0x0000000b
1469 #define NDS_PTYPE_INTERNAL      0x0000000c
1470 #define NDS_PTYPE_URL           0x0000000d
1471 #define NDS_PTYPE_DNS           0x0000000e
1472 #define NDS_PTYPE_CNT           0x0000000f
1473
1474 static const value_string nds_protocol_type[] = {
1475     { NDS_PTYPE_IPX,           "(IPX Protocol)" },
1476     { NDS_PTYPE_IP,            "(IP Protocol)" },
1477     { NDS_PTYPE_SDLC,          "(SDLC Protocol)" },
1478     { NDS_PTYPE_TR_ON_ETH,     "(TokenRing on Ethernet Protocol)" },
1479     { NDS_PTYPE_OSI,           "(OSI Protocol)" },
1480     { NDS_PTYPE_APPLETALK,     "(AppleTalk Protocol)" },
1481     { NDS_PTYPE_NETBEUI,       "(NetBEUI Protocol)" },
1482     { NDS_PTYPE_SOCKETADDRESS, "(Socket Address Protocol)" },
1483     { NDS_PTYPE_UDP,           "(UDP Protocol)" },
1484     { NDS_PTYPE_TCP,           "(TCP Protocol)" },
1485     { NDS_PTYPE_UDPv6,         "(UDP v6 Protocol)" },
1486     { NDS_PTYPE_TCPv6,         "(TCP v6 Protocol)" },
1487     { NDS_PTYPE_INTERNAL,      "(Internal Protocol)" },
1488     { NDS_PTYPE_URL,           "(URL Protocol)" },
1489     { NDS_PTYPE_DNS,           "(DNS Protocol)" },
1490     { NDS_PTYPE_CNT,           "(Number of protocol types defined)" },
1491     { 0, NULL }
1492 };
1493
1494
1495 static const value_string nds_syntax[] = {
1496     { 0x00000000, "Unknown Syntax" },
1497     { 0x00000001, "Distinguished Name" },
1498     { 0x00000002, "Case Sensitive Unicode String" },
1499     { 0x00000003, "Non Case Sensitive Unicode String" },
1500     { 0x00000004, "Printable String" },
1501     { 0x00000005, "Numeric String" },
1502     { 0x00000006, "Case Insensitive List" },
1503     { 0x00000007, "Boolean" },
1504     { 0x00000008, "Signed Integer" },
1505     { 0x00000009, "Binary String" },
1506     { 0x0000000a, "Telephone Number" },
1507     { 0x0000000b, "Fax Number" },
1508     { 0x0000000c, "Network Address" },
1509     { 0x0000000d, "Binary String List" },
1510     { 0x0000000e, "Email Address" },
1511     { 0x0000000f, "File System Path" },
1512     { 0x00000010, "Replica Pointer" },
1513     { 0x00000011, "Object ACL" },
1514     { 0x00000012, "Postal Address" },
1515     { 0x00000013, "Time Stamp" },
1516     { 0x00000014, "Class Name" },
1517     { 0x00000015, "Stream" },
1518     { 0x00000016, "Counter" },
1519     { 0x00000017, "Back Link" },
1520     { 0x00000018, "Time" },
1521     { 0x00000019, "Typed Name" },
1522     { 0x0000001a, "Hold" },
1523     { 0x0000001b, "Interval" },
1524     { 0, NULL }
1525 };
1526
1527 static const value_string name_space_type[] = {
1528     { 0x00000000, "DOS Name Space" },
1529     { 0x00000001, "MAC Name Space" },
1530     { 0x00000002, "NFS Name Space" },
1531     { 0x00000003, "FTAM Name Space" },
1532     { 0x00000004, "OS/2, Long Name Space" },
1533     { 0, NULL }
1534 };
1535
1536
1537 static const value_string nds_replica_state[] = {
1538     { 0x0000, "On" },
1539     { 0x0001, "New" },
1540     { 0x0002, "Dying" },
1541     { 0x0003, "Locked" },
1542     { 0x0004, "Create Master State 0" },
1543     { 0x0005, "Create Master State 1" },
1544     { 0x0006, "Transition On" },
1545     { 0x0007, "Dead Replica" },
1546     { 0x0008, "Begin Add" },
1547     { 0x000b, "Master Start" },
1548     { 0x000c, "Master Done" },
1549     { 0x0017, "Federated" },
1550     { 0x0030, "Split State 0" },
1551     { 0x0031, "Split State 1" },
1552     { 0x0040, "Join State 0" },
1553     { 0x0041, "Join State 1" },
1554     { 0x0042, "Join State 2" },
1555     { 0x0050, "Move Subtree State 0" },
1556     { 0x0051, "Move Subtree State 1" },
1557     { 0, NULL }
1558 };
1559
1560 static const value_string nds_replica_type[] = {
1561     { 0x0000, "Master" },
1562     { 0x0001, "Secondary" },
1563     { 0x0002, "Read Only" },
1564     { 0x0003, "Sub Ref" },
1565     { 0, NULL }
1566 };
1567
1568 static const value_string class_def_type[] = {
1569     { 0x0000, "Return Class Name" },
1570     { 0x0001, "Return Class Name, Flag, and Definition" },
1571     { 0x0002, "Return Class Name, Flag, Definition, and Super Class" },
1572     { 0x0003, "Return Class Name, Flag, and ASN.1 identifier" },
1573     { 0x0004, "Return Class Name, Flag, Definition, Super Class, and ACL" },
1574     { 0x0005, "Return Class Name, Flag, Creation Timestamp, Modification Timestamp, Definition, and ACL" },
1575     { 0, NULL }
1576 };
1577
1578 static const value_string nds_search_scope[] = {
1579     { 0x0000, "Examine the base object only" },
1580     { 0x0001, "Search the immediate subordinates of the base object" },
1581     { 0x0002, "Search the base object and all its subordinates" },
1582     { 0x0003, "Search the base objects and all objects in its partition (Implemented in NDS 8)" },
1583     { 0, NULL }
1584 };
1585
1586 static const value_string nds_verb2b_flag_vals[] = {
1587     { 0, "Request Flags (0x0000) - Retain old object name" },
1588     { 1, "Request Flags (0x0001) - Delete old object name" },
1589     { 0,  NULL }
1590 };
1591
1592 static void
1593 process_ptvc_record(ptvcursor_t *ptvc, const ptvc_record *rec,
1594                     gboolean *req_cond_results, gboolean really_decode,
1595                     const ncp_record *ncp_rec);
1596
1597 /* NCP packets come in request/reply pairs. The request packets tell the type
1598  * of NCP request and give a sequence ID. The response, unfortunately, only
1599  * identifies itself via the sequence ID; you have to know what type of NCP
1600  * request the request packet contained in order to successfully parse the NCP
1601  * response. A global method for doing this does not exist in wireshark yet
1602  * (NFS also requires it), so for now the NCP section will keep its own hash
1603  * table keeping track of NCP packet types.
1604  *
1605  * We construct a conversation specified by the client and server
1606  * addresses and the connection number; the key representing the unique
1607  * NCP request then is composed of the pointer to the conversation
1608  * structure, cast to a "guint" (which may throw away the upper 32
1609  * bits of the pointer on a P64 platform, but the low-order 32 bits
1610  * are more likely to differ between conversations than the upper 32 bits),
1611  * and the sequence number.
1612  *
1613  * The value stored in the hash table is the ncp_req_hash_value pointer. This
1614  * struct tells us the NCP type and gives the ncp2222_record pointer, if
1615  * ncp_type == 0x2222.
1616  */
1617 typedef struct {
1618     conversation_t  *conversation;
1619     guint8           nw_sequence;
1620 } ncp_req_hash_key;
1621
1622
1623 typedef struct {
1624     guint32          nw_eid;
1625 } ncp_req_eid_hash_key;
1626
1627 typedef struct {
1628     ncp_req_eid_hash_key    *nds_eid;
1629     char                    object_name[256];
1630 } ncp_req_eid_hash_value;
1631
1632 static GHashTable *ncp_req_hash = NULL;
1633 static GHashTable *ncp_req_eid_hash = NULL;
1634
1635 /* Hash Functions */
1636 static gboolean
1637 ncp_equal(gconstpointer v, gconstpointer v2)
1638 {
1639     const ncp_req_hash_key *val1 = (const ncp_req_hash_key*)v;
1640     const ncp_req_hash_key *val2 = (const ncp_req_hash_key*)v2;
1641
1642     if (val1->conversation == val2->conversation &&
1643         val1->nw_sequence  == val2->nw_sequence ) {
1644         return TRUE;
1645     }
1646     return FALSE;
1647 }
1648
1649 static gboolean
1650 ncp_eid_equal(gconstpointer v, gconstpointer v2)
1651 {
1652     const ncp_req_eid_hash_key *val1 = (const ncp_req_eid_hash_key*)v;
1653     const ncp_req_eid_hash_key *val2 = (const ncp_req_eid_hash_key*)v2;
1654
1655     if (val1->nw_eid == val2->nw_eid ) {
1656         return TRUE;
1657     }
1658     return FALSE;
1659 }
1660
1661 static guint
1662 ncp_hash(gconstpointer v)
1663 {
1664     const ncp_req_hash_key *ncp_key = (const ncp_req_hash_key*)v;
1665     return GPOINTER_TO_UINT(ncp_key->conversation) + ncp_key->nw_sequence;
1666 }
1667
1668 static guint
1669 ncp_eid_hash(gconstpointer v)
1670 {
1671     const ncp_req_eid_hash_key *ncp_eid_key = (const ncp_req_eid_hash_key*)v;
1672     return GPOINTER_TO_UINT(ncp_eid_key->nw_eid);
1673 }
1674
1675 /* Initializes the hash table and the mem_chunk area each time a new
1676  * file is loaded or re-loaded in wireshark */
1677 static void
1678 ncp_init_protocol(void)
1679 {
1680     int i;
1681
1682     /* fragment */
1683     fragment_table_init(&nds_fragment_table);
1684     reassembled_table_init(&nds_reassembled_table);
1685
1686     for (i = 0; i < 99; i++) {
1687         frags[i].nds_frag = 0xfffffff0;
1688     }
1689
1690     if (ncp_req_hash) {
1691         g_hash_table_destroy(ncp_req_hash);
1692     }
1693     if (ncp_req_eid_hash) {
1694         g_hash_table_destroy(ncp_req_eid_hash);
1695     }
1696
1697     ncp_req_hash = g_hash_table_new(ncp_hash, ncp_equal);
1698     ncp_req_eid_hash = g_hash_table_new(ncp_eid_hash, ncp_eid_equal);
1699 }
1700
1701 /* After the sequential run, we don't need the ncp_request hash and keys
1702  * anymore; the lookups have already been done and the vital info
1703  * saved in the reply-packets' private_data in the frame_data struct. */
1704 static void
1705 ncp_postseq_cleanup(void)
1706 {
1707 #if 0 /* XXX: ?? */
1708     if (ncp_req_hash) {
1709         /* Destroy the hash, but don't clean up request_condition data. */
1710         g_hash_table_destroy(ncp_req_hash);
1711         ncp_req_hash = NULL;
1712     }
1713 #endif
1714     /* Don't free the ncp_req_hash_values or EID_hash_table, as they're
1715      * needed during random-access processing of the proto_tree.*/
1716 }
1717
1718 static ncp_req_hash_value*
1719 ncp_hash_insert(conversation_t *conversation, guint8 nw_sequence,
1720                 const ncp_record *ncp_rec)
1721 {
1722     ncp_req_hash_key    *request_key;
1723     ncp_req_hash_value  *request_value;
1724
1725     /* Now remember the request, so we can find it if we later
1726        a reply to it. */
1727     request_key = se_alloc(sizeof(ncp_req_hash_key));
1728     request_key->conversation = conversation;
1729     request_key->nw_sequence = nw_sequence;
1730
1731     request_value = se_alloc(sizeof(ncp_req_hash_value));
1732     request_value->ncp_rec = ncp_rec;
1733     request_value->req_cond_results = NULL;
1734     request_value->req_nds_flags = 0;
1735     request_value->nds_request_verb = 0;
1736     request_value->nds_version = 0;
1737     g_strlcpy(request_value->object_name, " ", 256);
1738     request_value->nds_frag = TRUE;
1739
1740     g_hash_table_insert(ncp_req_hash, request_key, request_value);
1741
1742     return request_value;
1743 }
1744
1745 static ncp_req_eid_hash_value*
1746 ncp_eid_hash_insert(guint32 nw_eid)
1747 {
1748     ncp_req_eid_hash_key    *request_eid_key;
1749     ncp_req_eid_hash_value  *request_eid_value;
1750
1751     /* Now remember the request, so we can find it if we later
1752        a reply to it. */
1753     request_eid_key = se_alloc(sizeof(ncp_req_eid_hash_key));
1754     request_eid_key->nw_eid = nw_eid;
1755
1756     request_eid_value = se_alloc(sizeof(ncp_req_eid_hash_value));
1757     g_strlcpy(request_eid_value->object_name, " ", 256);
1758
1759     g_hash_table_insert(ncp_req_eid_hash, request_eid_key, request_eid_value);
1760
1761     return request_eid_value;
1762 }
1763
1764 /* Returns the ncp_rec*, or NULL if not found. */
1765 static ncp_req_hash_value*
1766 ncp_hash_lookup(conversation_t *conversation, guint8 nw_sequence)
1767 {
1768     ncp_req_hash_key  request_key;
1769
1770     request_key.conversation = conversation;
1771     request_key.nw_sequence = nw_sequence;
1772
1773     return g_hash_table_lookup(ncp_req_hash, &request_key);
1774 }
1775
1776 /* Returns the value_rec* for needed EID, or NULL if not found. */
1777 static ncp_req_eid_hash_value*
1778 ncp_eid_hash_lookup(conversation_t *conversation _U_, guint32 nw_eid)
1779 {
1780     ncp_req_eid_hash_key  request_eid_key;
1781
1782     request_eid_key.nw_eid = nw_eid;
1783
1784     return g_hash_table_lookup(ncp_req_eid_hash, &request_eid_key);
1785 }
1786
1787 /* Does NCP func require a subfunction code? */
1788 static gboolean
1789 ncp_requires_subfunc(guint8 func)
1790 {
1791     const guint8 *ncp_func_requirement = ncp_func_requires_subfunc;
1792
1793     while (*ncp_func_requirement != 0) {
1794         if (*ncp_func_requirement == func) {
1795             return TRUE;
1796         }
1797         ncp_func_requirement++;
1798     }
1799     return FALSE;
1800 }
1801
1802 /* Does the NCP func have a length parameter? */
1803 static gboolean
1804 ncp_has_length_parameter(guint8 func)
1805 {
1806     const guint8 *ncp_func_requirement = ncp_func_has_no_length_parameter;
1807
1808     while (*ncp_func_requirement != 0) {
1809         if (*ncp_func_requirement == func) {
1810             return FALSE;
1811         }
1812         ncp_func_requirement++;
1813     }
1814     return TRUE;
1815 }
1816
1817
1818 /* Return a ncp_record* based on func and possibly subfunc */
1819 static const ncp_record *
1820 ncp_record_find(guint8 func, guint8 subfunc)
1821 {
1822     const ncp_record *ncp_rec = ncp_packets;
1823
1824     while(ncp_rec->func != 0 || ncp_rec->subfunc != 0 ||
1825           ncp_rec->name != NULL ) {
1826         if (ncp_rec->func == func) {
1827             if (ncp_rec->has_subfunc) {
1828                 if (ncp_rec->subfunc == subfunc) {
1829                     return ncp_rec;
1830                 }
1831             }
1832             else {
1833                 return ncp_rec;
1834             }
1835         }
1836         ncp_rec++;
1837     }
1838     return NULL;
1839 }
1840
1841
1842 /* Given a proto_item*, assume it contains an integer value
1843  * and return a guint from it. */
1844 static guint
1845 get_finfo_value_integer(field_info *finfo)
1846 {
1847     /* XXX the fvalue functions are no longer safe to call directly
1848        since we sometimes fake the entries to speed things up.
1849        this dissector should not call fvalue_ functions directly.
1850     */
1851     if(!finfo->value.ftype->get_value_uinteger){
1852         return 0;
1853     }
1854     return fvalue_get_uinteger(&finfo->value);
1855 }
1856 static guint
1857 get_item_value(proto_item *item)
1858 {
1859     return get_finfo_value_integer(PITEM_FINFO(item));
1860 }
1861
1862
1863 static guint
1864 get_finfo_length(field_info *finfo)
1865 {
1866     return fvalue_length(&finfo->value);
1867 }
1868
1869
1870 static char *
1871 get_finfo_value_string(field_info *finfo)
1872 {
1873     return fvalue_get(&finfo->value);
1874 }
1875 #if 0
1876 static char *
1877 get_item_string(proto_item *item)
1878 {
1879     return get_finfo_value_string(PITEM_FINFO(item));
1880 }
1881 #endif
1882
1883 static const char *
1884 get_item_name(proto_item *item)
1885 {
1886     return PITEM_FINFO(item)->hfinfo->name;
1887 }
1888
1889
1890 typedef proto_item* (*padd_func_t)(ptvcursor_t*, const ptvc_record*);
1891
1892 /*
1893  * XXX - are these just DOS-format dates and times?
1894  *
1895  * Should we put code to understand various date and time formats (UNIX,
1896  * DOS, SMB weird mutant UNIX, NT, Mac, etc. into libwireshark, and have
1897  * the "display" member of an HF_ABSOLUTE_TIME field specify whether
1898  * it's DOS date/DOS time, DOS time/DOS date, NT time, UNIX time_t,
1899  * UNIX "struct timeval", NFSv3/NFSv4 seconds/nanoseconds, Mac, etc.?
1900  *
1901  * What about hijacking the "bitmask" field to specify the precision of
1902  * the time stamp, or putting a combination of precision and format
1903  * into the "display" member?
1904  *
1905  * What about relative times?  Should they have units (seconds, milliseconds,
1906  * microseconds, nanoseconds, etc.), precision, and format in there?
1907  */
1908 typedef struct {
1909     guint       year;
1910     guint       month;
1911     guint       day;
1912 } nw_date_t;
1913
1914 typedef struct {
1915     guint       hour;
1916     guint       minute;
1917     guint       second;
1918 } nw_time_t;
1919
1920 #define NW_UNI_MAX 1024
1921
1922 #define VTYPE_NONE                       0  /* no value */
1923 #define VTYPE_UINT8                      1
1924 #define VTYPE_UINT16                     2
1925 #define VTYPE_UINT32                     3
1926 #define VTYPE_STRING                     4
1927 #define VTYPE_BITFIELD                   5
1928 #define VTYPE_MULTIVALUE_UINT32          6
1929 #define VTYPE_BYTES                      7
1930 #define VTYPE_BOOLEAN                    8
1931 #define VTYPE_ITEM                       9
1932
1933 #define MVTYPE_ATTR_REQUEST              1
1934 #define MVTYPE_ATTR_REPLY                2
1935 #define MVTYPE_ATTR_REQUEST2             3
1936 #define MVTYPE_READ_CLASS_REQ            4
1937 #define MVTYPE_READ_REPLICAS             5
1938 #define MVTYPE_MODIFY_ATTR_REQUEST       6
1939 #define MVTYPE_ADDR_REFERRAL_REQUEST     7
1940 #define MVTYPE_ADDR_REFERRAL_REPLY       8
1941 #define MVTYPE_LOC_ADDR_REFERRAL_REPLY   9
1942 #define MVTYPE_PROC_ENTRY_SPECIFIERS    10
1943 #define MVTYPE_PRINT_TIMESTAMP          11
1944 #define MVTYPE_LIST_PARTITIONS          12
1945 #define MVTYPE_CLASS_NAMES              13
1946 #define MVTYPE_MODIFY_CLASS             14
1947 #define MVTYPE_ADD_ATTR_REQUEST         15
1948 #define MVTYPE_PROCESS_TAGS             16
1949 #define MVTYPE_PROCESS_ITERATOR         17
1950
1951 typedef struct {
1952     guint8          vtype;
1953     guint32         vvalue;
1954     const char*     vstring;
1955     const char*     vdesc;
1956     guint32         vlength;
1957     guint32         voffset;
1958     guint32         hfname;
1959     const char*     bit1;
1960     guint32         bit1hfname;
1961     const char*     bit2;
1962     guint32         bit2hfname;
1963     const char*     bit3;
1964     guint32         bit3hfname;
1965     const char*     bit4;
1966     guint32         bit4hfname;
1967     const char*     bit5;
1968     guint32         bit5hfname;
1969     const char*     bit6;
1970     guint32         bit6hfname;
1971     const char*     bit7;
1972     guint32         bit7hfname;
1973     const char*     bit8;
1974     guint32         bit8hfname;
1975     const char*     bit9;
1976     guint32         bit9hfname;
1977     const char*     bit10;
1978     guint32         bit10hfname;
1979     const char*     bit11;
1980     guint32         bit11hfname;
1981     const char*     bit12;
1982     guint32         bit12hfname;
1983     const char*     bit13;
1984     guint32         bit13hfname;
1985     const char*     bit14;
1986     guint32         bit14hfname;
1987     const char*     bit15;
1988     guint32         bit15hfname;
1989     const char*     bit16;
1990     guint32         bit16hfname;
1991     guint8          mvtype;
1992     guint32         vflags;
1993     guint32         nds_version;
1994     guint32         pflags; /* NDS Protocol Flags */
1995 } nds_val;
1996
1997
1998 /* Given an integer, fill in a nw_date_t struct. */
1999 static void
2000 uint_to_nwdate(guint data, nw_date_t *nwdate)
2001 {
2002     nwdate->day   =  data & 0x001f;
2003     nwdate->month = (data & 0x01e0) >> 5;
2004     nwdate->year  = ((data & 0xfe00) >> 9) + 1980;
2005 }
2006
2007 /* Given an integer, fill in a nw_time_t struct. */
2008 static void
2009 uint_to_nwtime(guint data, nw_time_t *nwtime)
2010 {
2011     /* 2-second resolution */
2012     nwtime->second = (data & 0x001f) * 2;
2013     nwtime->minute = ((data & 0x07e0) >> 5);
2014     nwtime->hour   = ((data & 0xf800) >> 11);
2015 }
2016
2017 static proto_item*
2018 padd_normal(ptvcursor_t *ptvc, const ptvc_record *rec)
2019 {
2020     return
2021         ptvcursor_add(ptvc, *rec->hf_ptr,
2022                       rec->length, rec->endianness);
2023 }
2024
2025 static proto_item*
2026 padd_date(ptvcursor_t *ptvc, const ptvc_record *rec)
2027 {
2028     proto_item  *item;
2029     nw_date_t   nw_date;
2030     gint        offset;
2031
2032     offset = ptvcursor_current_offset(ptvc);
2033
2034     item = ptvcursor_add(ptvc, *rec->hf_ptr,
2035                          rec->length, rec->endianness);
2036
2037     if (item) {
2038         uint_to_nwdate(get_item_value(item), &nw_date);
2039
2040         proto_item_set_text(item, "%s", get_item_name(item));
2041         proto_item_append_text(item, ": %04u/%02u/%02u",
2042                                nw_date.year, nw_date.month, nw_date.day);
2043     }
2044     return item;
2045 }
2046
2047 static proto_item*
2048 padd_time(ptvcursor_t *ptvc, const ptvc_record *rec)
2049 {
2050     proto_item  *item;
2051     nw_time_t   nw_time;
2052     gint        offset;
2053
2054     offset = ptvcursor_current_offset(ptvc);
2055
2056     item = ptvcursor_add(ptvc, *rec->hf_ptr,
2057                          rec->length, rec->endianness);
2058
2059     if (item) {
2060         uint_to_nwtime(get_item_value(item), &nw_time);
2061
2062         proto_item_set_text(item, "%s", get_item_name(item));
2063         proto_item_append_text(item, ": %02u:%02u:%02u",
2064                                nw_time.hour, nw_time.minute, nw_time.second);
2065     }
2066     return item;
2067 }
2068
2069
2070 /* Convert a string from little-endian unicode to ascii.  At the moment we
2071    fake it by taking every odd byte.  )-:  The caller must free the
2072    result returned. */
2073 /* XXX This prints the proto_item name, but not its value. */
2074 static proto_item*
2075 padd_uni(ptvcursor_t *ptvc, const ptvc_record *rec)
2076 {
2077     proto_item      *item;
2078     /* nw_uni_t        nw_uni; */
2079     guint            offset;
2080
2081     /* nw_uni.buffer[0] = '\0'; */
2082     offset = ptvcursor_current_offset(ptvc);
2083
2084     item = ptvcursor_add(ptvc, *rec->hf_ptr,
2085                          rec->length, rec->endianness);
2086
2087     if (item) {
2088         proto_item_set_text(item, "%s", get_item_name(item));
2089         /* proto_item_append_text(item, " %s",
2090            nw_uni.buffer); */
2091     }
2092
2093     return item;
2094 }
2095
2096 /* Add a value for a ptvc_record, and process the sub-ptvc_record
2097  * that it points to. */
2098 static void
2099 process_bitfield_sub_ptvc_record(ptvcursor_t *ptvc, const ptvc_record *rec,
2100                                  gboolean really_decode)
2101 {
2102     proto_item          *item;
2103     proto_tree          *sub_tree;
2104     const ptvc_record   *sub_rec;
2105     int                 current_offset;
2106     gint                ett;
2107     ptvcursor_t         *sub_ptvc;
2108
2109     if (really_decode) {
2110         /* Save the current offset */
2111         current_offset = ptvcursor_current_offset(ptvc);
2112
2113         /* Add the item */
2114         item = ptvcursor_add(ptvc, *rec->hf_ptr, rec->length,
2115                              rec->endianness);
2116
2117         ett = *rec->sub_ptvc_rec->ett;
2118
2119         /* Make a new protocol sub-tree */
2120         sub_tree = proto_item_add_subtree(item, ett);
2121
2122         /* Make a new ptvcursor */
2123         sub_ptvc = ptvcursor_new(sub_tree, ptvcursor_tvbuff(ptvc),
2124                                  current_offset);
2125
2126         /* Use it */
2127         sub_rec = rec->sub_ptvc_rec->ptvc_rec;
2128         while(sub_rec->hf_ptr != NULL) {
2129             DISSECTOR_ASSERT(!sub_rec->sub_ptvc_rec);
2130             ptvcursor_add_no_advance(sub_ptvc, *sub_rec->hf_ptr,
2131                                      sub_rec->length, sub_rec->endianness);
2132             sub_rec++;
2133         }
2134
2135         /* Free it. */
2136         ptvcursor_free(sub_ptvc);
2137     }
2138     else {
2139         DISSECTOR_ASSERT(rec->length > 0 &&
2140                          proto_registrar_get_nth(*rec->hf_ptr)->type != FT_UINT_STRING);
2141         ptvcursor_advance(ptvc, rec->length);
2142     }
2143 }
2144
2145 /* Process a sub-ptvc_record that points to a "struct" ptvc_record. */
2146 static void
2147 process_struct_sub_ptvc_record(ptvcursor_t *ptvc, const ptvc_record *rec,
2148                                gboolean *req_cond_results, gboolean really_decode,
2149                                const ncp_record *ncp_rec)
2150 {
2151     const ptvc_record   *sub_rec;
2152     gint                ett;
2153     proto_tree          *old_tree=NULL, *new_tree;
2154     proto_item          *item=NULL;
2155     gint                offset=0;
2156
2157     /* Create a sub-proto_tree? */
2158     if (rec->sub_ptvc_rec->descr) {
2159         ett = *rec->sub_ptvc_rec->ett;
2160         old_tree = ptvcursor_tree(ptvc);
2161         offset = ptvcursor_current_offset(ptvc);
2162         item = proto_tree_add_text(old_tree, ptvcursor_tvbuff(ptvc),
2163                                    offset, PROTO_LENGTH_UNTIL_END, "%s",
2164                                    rec->sub_ptvc_rec->descr);
2165         new_tree = proto_item_add_subtree(item, ett);
2166         ptvcursor_set_tree(ptvc, new_tree);
2167     }
2168
2169     /* Get the ptvc_record for the struct and call our caller
2170      * to process it. */
2171     sub_rec = rec->sub_ptvc_rec->ptvc_rec;
2172     process_ptvc_record(ptvc, sub_rec, req_cond_results, really_decode, ncp_rec);
2173
2174     /* Re-set the tree */
2175     if (rec->sub_ptvc_rec->descr) {
2176         if (ptvcursor_current_offset(ptvc) <= offset)
2177             THROW(ReportedBoundsError);
2178
2179         proto_item_set_len(item, ptvcursor_current_offset(ptvc) - offset);
2180         ptvcursor_set_tree(ptvc, old_tree);
2181     }
2182 }
2183
2184 /* Run through the table of ptvc_record's and add info to the tree. This
2185  * is the work-horse of process_ptvc_record(). */
2186 static void
2187 _process_ptvc_record(ptvcursor_t *ptvc, const ptvc_record *rec,
2188                      gboolean *req_cond_results, gboolean really_decode,
2189                      const ncp_record *ncp_rec)
2190 {
2191     proto_item  *item;
2192     guint       i, repeat_count;
2193     padd_func_t func = NULL;
2194
2195     if (rec->sub_ptvc_rec) {
2196         /* Repeat this? */
2197         if (rec->repeat_index == NO_REPEAT) {
2198             if (rec->hf_ptr == PTVC_STRUCT) {
2199                 process_struct_sub_ptvc_record(ptvc, rec,
2200                                                req_cond_results, really_decode,
2201                                                ncp_rec);
2202             }
2203             else {
2204                 process_bitfield_sub_ptvc_record(ptvc, rec,
2205                                                  really_decode);
2206             }
2207         }
2208         else {
2209             repeat_count = repeat_vars[rec->repeat_index];
2210             for (i = 0; i < repeat_count; i++ ) {
2211                 if (rec->hf_ptr == PTVC_STRUCT) {
2212                     process_struct_sub_ptvc_record(ptvc, rec,
2213                                                    req_cond_results, really_decode,
2214                                                    ncp_rec);
2215                 }
2216                 else {
2217                     process_bitfield_sub_ptvc_record(ptvc, rec,
2218                                                      really_decode);
2219                 }
2220             }
2221         }
2222     }
2223     else {
2224         /* If we can't repeat this field, we might use it
2225          * to set a 'var'. */
2226         if (rec->repeat_index == NO_REPEAT) {
2227             if (really_decode) {
2228                 /* Handle any special formatting. */
2229                 switch(rec->special_fmt) {
2230                 case NCP_FMT_NONE:
2231                     func = padd_normal;
2232                     break;
2233                 case NCP_FMT_NW_DATE:
2234                     func = padd_date;
2235                     break;
2236                 case NCP_FMT_NW_TIME:
2237                     func = padd_time;
2238                     break;
2239                 case NCP_FMT_UNICODE:
2240                     func = padd_uni;
2241                     break;
2242                 default:
2243                     DISSECTOR_ASSERT_NOT_REACHED();
2244                 }
2245                 item = func(ptvc, rec);
2246
2247                 /* Set the value as a 'var' ? */
2248                 if (rec->var_index != NO_VAR) {
2249                     repeat_vars[rec->var_index] = get_item_value(item);
2250                 }
2251             }
2252             else {
2253                 /* If we don't decode the field, we
2254                  * better not use the value to set a var.
2255                  * Actually, we could, as long as we don't
2256                  * *use* that var; for now keep this assert in
2257                  * place. */
2258                 DISSECTOR_ASSERT(rec->var_index == NO_VAR);
2259
2260                 /* This had better not be variable-length,
2261                  * either. */
2262                 DISSECTOR_ASSERT(rec->length > 0 &&
2263                                  proto_registrar_get_nth(*rec->hf_ptr)->type != FT_UINT_STRING);
2264                 ptvcursor_advance(ptvc, rec->length);
2265             }
2266         }
2267         else {
2268             /* We do repeat this field. */
2269             repeat_count = repeat_vars[rec->repeat_index];
2270             if (really_decode) {
2271                 /* Handle any special formatting. */
2272                 switch(rec->special_fmt) {
2273                 case NCP_FMT_NONE:
2274                     func = padd_normal;
2275                     break;
2276                 case NCP_FMT_NW_DATE:
2277                     func = padd_date;
2278                     break;
2279                 case NCP_FMT_NW_TIME:
2280                     func = padd_time;
2281                     break;
2282                 case NCP_FMT_UNICODE:
2283                     func = padd_uni;
2284                     break;
2285                 default:
2286                     DISSECTOR_ASSERT_NOT_REACHED();
2287                 }
2288                 for (i = 0; i < repeat_count; i++ ) {
2289                     func(ptvc, rec);
2290                 }
2291             }
2292             else {
2293                 for (i = 0; i < repeat_count; i++ ) {
2294                     DISSECTOR_ASSERT(rec->length > 0 &&
2295                                      proto_registrar_get_nth(*rec->hf_ptr)->type != FT_UINT_STRING);
2296                     ptvcursor_advance(ptvc, rec->length);
2297                 }
2298             }
2299         }
2300     }
2301 }
2302
2303 /* Run through the table of ptvc_record's and add info to the tree.
2304  * Honor a request condition result. */
2305 static void
2306 process_ptvc_record(ptvcursor_t *ptvc, const ptvc_record *rec,
2307                     gboolean *req_cond_results, gboolean really_decode,
2308                     const ncp_record *ncp_rec)
2309 {
2310     gboolean decode;
2311
2312     while(rec->hf_ptr != NULL) {
2313         decode = really_decode;
2314         /* If we're supposed to decode, check the request condition
2315          * results to see if we should override this and *not* decode. */
2316         if (decode && req_cond_results) {
2317             if (rec->req_cond_index != NO_REQ_COND) {
2318                 if (req_cond_results[rec->req_cond_index] == FALSE) {
2319                     decode = FALSE;
2320                 }
2321             }
2322         }
2323         if (decode || ncp_rec->req_cond_size_type == REQ_COND_SIZE_CONSTANT) {
2324             _process_ptvc_record(ptvc, rec, req_cond_results, decode, ncp_rec);
2325         }
2326         rec++;
2327     }
2328 }
2329
2330
2331
2332 /* Clear the repeat_vars array. */
2333 static void
2334 clear_repeat_vars(void)
2335 {
2336     guint i;
2337
2338     for (i = 0 ; i < NUM_REPEAT_VARS; i++ ) {
2339         repeat_vars[i] = 0;
2340     }
2341 }
2342
2343
2344 /* Given an error_equivalency table and a completion code, return
2345  * the string representing the error. */
2346 static const char*
2347 ncp_error_string(const error_equivalency *errors, guint8 completion_code)
2348 {
2349
2350     while (errors->ncp_error_index != -1) {
2351         if (errors->error_in_packet == completion_code) {
2352             return ncp_errors[errors->ncp_error_index];
2353         }
2354         errors++;
2355     }
2356
2357     return "Unknown Error Code";
2358 }
2359
2360 static const ncp_record ncp1111_request =
2361 { 0x1, 0x00, NO_SUBFUNC, "Create Connection Service", NCP_GROUP_CONNECTION,
2362   NULL, NULL, ncp_0x2_errors, NULL, NO_REQ_COND_SIZE, NULL };
2363
2364 static const ncp_record ncp5555_request =
2365 { 0x5, 0x00, NO_SUBFUNC, "Destroy Connection Service", NCP_GROUP_CONNECTION,
2366   NULL, NULL, ncp_0x2_errors, NULL, NO_REQ_COND_SIZE, NULL };
2367
2368 static const ncp_record ncpbbbb_request =
2369 { 0xb, 0x00, NO_SUBFUNC, "Server Broadcast Message", NCP_GROUP_CONNECTION,
2370   NULL, NULL, ncp_0x2_errors, NULL, NO_REQ_COND_SIZE, NULL };
2371
2372 static const ncp_record ncplip_echo =
2373 { 0x1f, 0x00, NO_SUBFUNC, "LIP Echo Packet", NCP_GROUP_CONNECTION,
2374   NULL, NULL, ncp_0x2_errors, NULL, NO_REQ_COND_SIZE, NULL };
2375
2376 /* Wrapper around proto_tree_free() */
2377 static void free_proto_tree(void *tree)
2378 {
2379     if (tree) {
2380         proto_tree_free((proto_tree*) tree);
2381     }
2382 }
2383
2384 static guint32
2385 align_4(tvbuff_t *tvb, guint32 aoffset)
2386 {
2387     if(tvb_length_remaining(tvb, aoffset) > 4 )
2388     {
2389         return (aoffset%4);
2390     }
2391     return 0;
2392 }
2393
2394 static const char *
2395 get_string(tvbuff_t* tvb, guint offset, guint str_length)
2396 {
2397     char *dest_buf;
2398     gint i;
2399     guint16 c_char;
2400     gint length_remaining = 0;
2401     gint max_length = (str_length < NW_UNI_MAX) ? str_length : NW_UNI_MAX;
2402
2403     length_remaining = tvb_length_remaining(tvb, offset);
2404     if((gint)str_length > length_remaining)
2405     {
2406         THROW(ReportedBoundsError);
2407     }
2408
2409     if(str_length == 0)
2410     {
2411         return "";
2412     }
2413
2414     dest_buf = ep_alloc(max_length + 1);
2415     dest_buf[0] = '\0';
2416
2417     for ( i = 0; i < (gint)str_length; i++ )
2418     {
2419         c_char = tvb_get_guint8(tvb, offset );
2420         if (c_char<0x20 || c_char>0x7e)
2421         {
2422             if (c_char != 0x00)
2423             {
2424                 c_char = '.';
2425                 dest_buf[i] = c_char & 0xff;
2426             }
2427             else
2428             {
2429                 i--;
2430                 str_length--;
2431             }
2432         }
2433         else
2434         {
2435             dest_buf[i] = c_char & 0xff;
2436         }
2437         offset++;
2438         length_remaining--;
2439
2440         if(length_remaining==1)
2441         {
2442             dest_buf[i+1] = '\0';
2443             return dest_buf;
2444         }
2445         if (i >= 1023) { /* Don't process beyond the size of our variable */
2446             break;       /* If string is too long just return the first 1K. */
2447         }
2448     }
2449     if (i < 0) {
2450         i = 0;
2451     }
2452     dest_buf[i] = '\0';
2453     return dest_buf;
2454 }
2455
2456 static void
2457 uni_to_string(char * data, guint32 str_length, char *dest_buf)
2458 {
2459     gint i;
2460     guint16 c_char;
2461     gint length_remaining = 0;
2462
2463     length_remaining = str_length;
2464     dest_buf[0] = '\0';
2465     if(str_length == 0)
2466     {
2467         return;
2468     }
2469     for ( i = 0; i < (gint) str_length; i++ )
2470     {
2471         c_char = data[i];
2472         if (c_char<0x20 || c_char>0x7e)
2473         {
2474             if (c_char != 0x00)
2475             {
2476                 c_char = '.';
2477                 dest_buf[i] = c_char & 0xff;
2478             }
2479             else
2480             {
2481                 i--;
2482                 str_length--;
2483             }
2484         }
2485         else
2486         {
2487             dest_buf[i] = c_char & 0xff;
2488         }
2489         length_remaining--;
2490
2491         if(length_remaining==0)
2492         {
2493             dest_buf[i+1] = '\0';
2494             return;
2495         }
2496     }
2497     if (i < 0) {
2498         i = 0;
2499     }
2500     dest_buf[i] = '\0';
2501     return;
2502 }
2503
2504 /*************************************
2505  * Return based on % format in request
2506  * %d = integer in decimal format = 0
2507  * %x = integer in hex format = 1
2508  * %s = string = 2
2509  **************************************/
2510 static int
2511 get_info_type(const gchar* check_string)
2512 {
2513     guint length;
2514     guint i;
2515     char char_val;
2516
2517     length =  (guint) strlen(check_string);
2518
2519     for (i = 0 ; i < length-1 ; i++ ) {
2520         char_val = check_string[i+1];
2521         if (check_string[i] == 0x25 && check_string[i+1] == 0x64) {   /* %d Digits*/
2522             return 0;
2523         }
2524         if ( check_string[i] == 0x78 && check_string[i+1] == 0x25 && check_string[i+2] == 0x73) {  /* x%s Bytes*/
2525             return 1;
2526         }
2527     }
2528     return 2; /* Normal String */
2529 }
2530
2531 static void
2532 process_bitfield(proto_tree *ncp_tree, tvbuff_t *tvb, nds_val *values)
2533 {
2534     gchar        flags_str[512];
2535     const gchar *sep;
2536     proto_item  *tinew;
2537     proto_tree  *flags_tree;
2538     guint32      i;
2539     guint32      bvalue = 0;
2540
2541     bvalue = 0x00000001;
2542     flags_str[0]='\0';
2543     sep="";
2544     for (i = 0 ; i < (values->vlength*8); i++ ) {
2545         if (values->vvalue & bvalue)
2546         {
2547             g_strlcat(flags_str, sep, 512);
2548             switch(bvalue){
2549             case 0x00000001:
2550                 g_strlcat(flags_str, values->bit1, 512);
2551                 break;
2552             case 0x00000002:
2553                 g_strlcat(flags_str, values->bit2, 512);
2554                 break;
2555             case 0x00000004:
2556                 g_strlcat(flags_str, values->bit3, 512);
2557                 break;
2558             case 0x00000008:
2559                 g_strlcat(flags_str, values->bit4, 512);
2560                 break;
2561             case 0x00000010:
2562                 g_strlcat(flags_str, values->bit5, 512);
2563                 break;
2564             case 0x00000020:
2565                 g_strlcat(flags_str, values->bit6, 512);
2566                 break;
2567             case 0x00000040:
2568                 g_strlcat(flags_str, values->bit7, 512);
2569                 break;
2570             case 0x00000080:
2571                 g_strlcat(flags_str, values->bit8, 512);
2572                 break;
2573             case 0x00000100:
2574                 g_strlcat(flags_str, values->bit9, 512);
2575                 break;
2576             case 0x00000200:
2577                 g_strlcat(flags_str, values->bit10, 512);
2578                 break;
2579             case 0x00000400:
2580                 g_strlcat(flags_str, values->bit11, 512);
2581                 break;
2582             case 0x00000800:
2583                 g_strlcat(flags_str, values->bit12, 512);
2584                 break;
2585             case 0x00001000:
2586                 g_strlcat(flags_str, values->bit13, 512);
2587                 break;
2588             case 0x00002000:
2589                 g_strlcat(flags_str, values->bit14, 512);
2590                 break;
2591             case 0x00004000:
2592                 g_strlcat(flags_str, values->bit15, 512);
2593                 break;
2594             case 0x00008000:
2595                 g_strlcat(flags_str, values->bit16, 512);
2596                 break;
2597             default:
2598                 break;
2599             }
2600             sep = ", ";
2601         }
2602         bvalue = bvalue*2;
2603     }
2604     if(values->vlength==4)
2605     {
2606         tinew = proto_tree_add_uint_format(ncp_tree, values->hfname,
2607                                            tvb, values->voffset, values->vlength, values->vvalue, "%s 0x%08x",
2608                                            values->vdesc, values->vvalue);
2609     }
2610     else
2611     {
2612         tinew = proto_tree_add_uint_format(ncp_tree, values->hfname,
2613                                            tvb, values->voffset, values->vlength, values->vvalue, "%s 0x%04x",
2614                                            values->vdesc, values->vvalue);
2615     }
2616     if (flags_str[0] != '\0')
2617         proto_item_append_text(tinew, " - (%s)", flags_str);
2618
2619     flags_tree = proto_item_add_subtree(tinew, ett_nds);
2620
2621     bvalue = 0x00000001;
2622
2623     for (i = 0 ; i < (values->vlength*8); i++ ) {
2624         if (values->vvalue & bvalue)
2625         {
2626             switch(bvalue)
2627             {
2628             case 0x00000001:
2629                 proto_tree_add_item(flags_tree, values->bit1hfname, tvb, values->voffset, values->vlength, TRUE);
2630                 break;
2631             case 0x00000002:
2632                 proto_tree_add_item(flags_tree, values->bit2hfname, tvb, values->voffset, values->vlength, TRUE);
2633                 break;
2634             case 0x00000004:
2635                 proto_tree_add_item(flags_tree, values->bit3hfname, tvb, values->voffset, values->vlength, TRUE);
2636                 break;
2637             case 0x00000008:
2638                 proto_tree_add_item(flags_tree, values->bit4hfname, tvb, values->voffset, values->vlength, TRUE);
2639                 break;
2640             case 0x00000010:
2641                 proto_tree_add_item(flags_tree, values->bit5hfname, tvb, values->voffset, values->vlength, TRUE);
2642                 break;
2643             case 0x00000020:
2644                 proto_tree_add_item(flags_tree, values->bit6hfname, tvb, values->voffset, values->vlength, TRUE);
2645                 break;
2646             case 0x00000040:
2647                 proto_tree_add_item(flags_tree, values->bit7hfname, tvb, values->voffset, values->vlength, TRUE);
2648                 break;
2649             case 0x00000080:
2650                 proto_tree_add_item(flags_tree, values->bit8hfname, tvb, values->voffset, values->vlength, TRUE);
2651                 break;
2652             case 0x00000100:
2653                 proto_tree_add_item(flags_tree, values->bit9hfname, tvb, values->voffset, values->vlength, TRUE);
2654                 break;
2655             case 0x00000200:
2656                 proto_tree_add_item(flags_tree, values->bit10hfname, tvb, values->voffset, values->vlength, TRUE);
2657                 break;
2658             case 0x00000400:
2659                 proto_tree_add_item(flags_tree, values->bit11hfname, tvb, values->voffset, values->vlength, TRUE);
2660                 break;
2661             case 0x00000800:
2662                 proto_tree_add_item(flags_tree, values->bit12hfname, tvb, values->voffset, values->vlength, TRUE);
2663                 break;
2664             case 0x00001000:
2665                 proto_tree_add_item(flags_tree, values->bit13hfname, tvb, values->voffset, values->vlength, TRUE);
2666                 break;
2667             case 0x00002000:
2668                 proto_tree_add_item(flags_tree, values->bit14hfname, tvb, values->voffset, values->vlength, TRUE);
2669                 break;
2670             case 0x00004000:
2671                 proto_tree_add_item(flags_tree, values->bit15hfname, tvb, values->voffset, values->vlength, TRUE);
2672                 break;
2673             case 0x00008000:
2674                 proto_tree_add_item(flags_tree, values->bit16hfname, tvb, values->voffset, values->vlength, TRUE);
2675                 break;
2676             default:
2677                 break;
2678             }
2679         }
2680         bvalue = bvalue*2;
2681     }
2682 }
2683
2684 /* NCP data from python code can't be accessed directly. Parse the ncp tree and find the items
2685  * and their associated values. Store results in passed buffer.
2686  */
2687 static void
2688 build_expert_data(proto_tree *ncp_tree, const char *hf_name, char *buffer,
2689                   size_t buffer_size, int repeat_lookup,
2690                   gboolean search_structs)
2691 {
2692     proto_tree     *tree_pointer;
2693     proto_tree     *tree_loc;
2694     proto_tree     *struct_tree_pointer = NULL;
2695     char            temp_buffer[256]="\0";
2696     gboolean        in_struct=FALSE;
2697
2698     tree_loc = ncp_tree->first_child;
2699     for (tree_pointer=tree_loc; tree_pointer!=NULL; tree_pointer=tree_pointer->next)
2700     {
2701         /* We currently only go one structure deep in our search for values */
2702         if (tree_pointer->first_child && !in_struct && search_structs) {
2703             struct_tree_pointer = tree_pointer;
2704             tree_pointer = tree_pointer->first_child;
2705             in_struct=TRUE;
2706         }
2707         if (strcmp(PTREE_FINFO(tree_pointer)->hfinfo->abbrev, hf_name)==0)
2708         {
2709             switch (PTREE_FINFO(tree_pointer)->hfinfo->type)
2710             {
2711             case 3:                /* uint8 */
2712             case 4:                /* uint16 */
2713                 g_snprintf(buffer, (gulong) buffer_size, "%u", get_finfo_value_integer(PTREE_FINFO(tree_pointer)));
2714                 break;
2715
2716             case 6:             /* uint32 */
2717                 g_snprintf(buffer, (gulong) buffer_size, "%08x", get_finfo_value_integer(PTREE_FINFO(tree_pointer)));
2718                 break;
2719             case 17:
2720             case 18:
2721             case 19:
2722             case 20:            /* string */
2723                 /* XXX: Should we verify: buffer_size is as large as value returned by get_finfo_length(...)  ???      */
2724                 uni_to_string(get_finfo_value_string(PTREE_FINFO(tree_pointer)), get_finfo_length(PTREE_FINFO(tree_pointer)), buffer);
2725                 if (repeat_lookup > 0) {
2726                     if (strlen(temp_buffer) + strlen(buffer) < 250) {
2727                         g_strlcat(temp_buffer, buffer, 256);
2728                         repeat_lookup--;
2729                         if (repeat_lookup == 0) {
2730                             g_strlcpy(buffer, temp_buffer, buffer_size);
2731                             break;
2732                         }
2733                         else
2734                         {
2735                             g_strlcat(temp_buffer, "/", 256);
2736                             break;
2737                         }
2738                     }
2739                     else
2740                     {
2741                         return;
2742                     }
2743                 }
2744                 else
2745                 {
2746                     break;
2747                 }
2748             case 21:
2749             case 22:             /* Bytes */
2750                 g_snprintf(buffer, (gulong) buffer_size, "%s", bytes_to_str(get_finfo_value_string(PTREE_FINFO(tree_pointer)), get_finfo_length(PTREE_FINFO(tree_pointer))));
2751                 break;
2752             default:             /* Dont currently handle. Only need string, integers, and bytes */
2753                 g_snprintf(buffer, (gulong) buffer_size, "Unsupported Expert Type");
2754                 return;
2755             }
2756             if (repeat_lookup ==0) {
2757                 break;
2758             }
2759         }
2760         if (tree_pointer->next==NULL && in_struct && search_structs) {
2761                 tree_pointer = struct_tree_pointer;
2762                 in_struct=FALSE;
2763         }
2764     }
2765     if (strlen(buffer)==0) {
2766         g_snprintf(buffer, (gulong) buffer_size, "No Value");
2767     }
2768     return;
2769 }
2770
2771 /* Some NCP data may be desirable to echo to the expert table.
2772  * But to extract we must have visability to the tree
2773  * This means that to extract the data we can only perform
2774  * this code path on the first dissection or a redissect.
2775  *
2776  * Should the dissector store this info in memory so that
2777  * the data can be reported wihout a complete redissection?
2778  */
2779 static void
2780 trap_for_expert_event(proto_tree *ncp_tree, packet_info *pinfo, const ncp_record *ncp_rec, int request_reply)
2781 {
2782     if (ncp_rec == NULL)
2783         return;
2784     /* Request == 0, Reply == 1 */
2785     if (request_reply==0) {
2786         if (ncp_echo_file) {
2787             /* The following allows for Update file handle rights echoed to expert tap. */
2788             if (ncp_rec->func == 66) {
2789                 char p_filehandle[15]="\0";
2790
2791                 build_expert_data(ncp_tree, "ncp.file_handle", p_filehandle,
2792                                   sizeof p_filehandle, 0, FALSE);
2793
2794                 expert_add_info_format(pinfo, NULL, PI_REQUEST_CODE, PI_CHAT, "Close file handle %s", p_filehandle);
2795             }
2796             /* The following allows for oplock level 1 file opens echoed to expert tap. */
2797             if ((ncp_rec->func == 89 || ncp_rec->func == 87) && (ncp_rec->subfunc == 1 || ncp_rec->subfunc == 30 || ncp_rec->subfunc == 32 || ncp_rec->subfunc == 33)) {
2798                 char oaction[3]="\0";
2799                 char p_filename[256]="\0";
2800                 char p_rights[3]="\0";
2801                 char p_path_count[3]="\0";
2802
2803                 build_expert_data(ncp_tree, "ncp.open_create_mode", oaction,
2804                                   sizeof oaction, 0, FALSE);
2805                 build_expert_data(ncp_tree, "ncp.desired_access_rights",
2806                                   p_rights, sizeof p_rights, 0, FALSE);
2807                 build_expert_data(ncp_tree, "ncp.path_count", p_path_count,
2808                                   sizeof p_path_count, 0, FALSE);
2809
2810                 if (ncp_rec->func == 87) {
2811                     build_expert_data(ncp_tree, "ncp.path", p_filename,
2812                                       sizeof p_filename,  atoi(p_path_count),
2813                                       FALSE);
2814                 }
2815                 else
2816                 {
2817                     build_expert_data(ncp_tree, "ncp.path16", p_filename,
2818                                       sizeof p_filename,  atoi(p_path_count),
2819                                       FALSE);
2820                 }
2821
2822                 expert_add_info_format(pinfo, NULL, PI_REQUEST_CODE, PI_CHAT, "%s: %s, Rights:(%s)", match_strval((atoi(oaction) & 0xeb), open_create_mode_vals), p_filename, match_strval((atoi(p_rights) & 0x5f), ncp_rights_vals));
2823             }
2824             /* The following allows for oplock ack's and level 2 request echoed to expert tap. */
2825             if (ncp_rec->func == 87 && ncp_rec->subfunc == 34) {
2826                 char cc_function[3]="\0";
2827                 char p_filehandle[15]="\0";
2828
2829                 build_expert_data(ncp_tree, "ncp.cc_file_handle",
2830                                   p_filehandle, sizeof p_filehandle, 0, FALSE);
2831                 build_expert_data(ncp_tree, "ncp.cc_function",
2832                                   cc_function, sizeof cc_function, 0, FALSE);
2833
2834                 expert_add_info_format(pinfo, NULL, PI_REQUEST_CODE, PI_CHAT, "Op-lock on handle %s - %s", p_filehandle, match_strval(atoi(cc_function), ncp_cc_function_vals));
2835             }
2836             /* The following allows for Update file handle rights echoed to expert tap. */
2837             if (ncp_rec->func == 87 && ncp_rec->subfunc == 44) {
2838                 char p_rights[20]="\0";
2839                 char n_rights[20]="\0";
2840                 char p_filehandle[15]="\0";
2841
2842                 build_expert_data(ncp_tree, "ncp.file_handle",
2843                                   p_filehandle, sizeof p_filehandle, 0, FALSE);
2844                 build_expert_data(ncp_tree, "ncp.access_rights_mask_word",
2845                                   p_rights, sizeof p_rights, 0, FALSE);
2846                 build_expert_data(ncp_tree, "ncp.new_access_rights_mask",
2847                                   n_rights, sizeof n_rights, 0, FALSE);
2848                 expert_add_info_format(pinfo, NULL, PI_REQUEST_CODE, PI_CHAT, "Change handle %s rights from:(%s) to:(%s)", p_filehandle, match_strval((atoi(p_rights) & 0x1ff), access_rights_vals), match_strval((atoi(n_rights) & 0x1ff), access_rights_vals));
2849             }
2850         }
2851     }
2852     else
2853     {
2854
2855         if (ncp_echo_file) { /* Echo File System Data */
2856             /* The following allows for oplock level 1 file opens echoed to expert tap. */
2857             if ((ncp_rec->func == 89 || ncp_rec->func == 87) && (ncp_rec->subfunc == 32 || ncp_rec->subfunc == 1)) {
2858                 char oaction[3]="\0";
2859                 char oplockflg[3]="\0";
2860                 char p_filehandle[15]="\0";
2861
2862                 build_expert_data(ncp_tree, "ncp.open_create_action",
2863                                   oaction, sizeof oaction, 0, FALSE);
2864                 build_expert_data(ncp_tree, "ncp.file_handle",
2865                                   p_filehandle, sizeof p_filehandle, 0, FALSE);
2866
2867                 if (ncp_rec->subfunc == 1) {
2868                     expert_add_info_format(pinfo, NULL, PI_RESPONSE_CODE, PI_CHAT, "%s - File handle %s", match_strval((atoi(oaction) & 0x8f), open_create_action_vals), p_filehandle);
2869                 }
2870                 else
2871                 {
2872                     build_expert_data(ncp_tree, "ncp.o_c_ret_flags",
2873                                       oplockflg, sizeof oplockflg, 0, FALSE);
2874                     expert_add_info_format(pinfo, NULL, PI_RESPONSE_CODE, PI_CHAT, "%s - File handle %s, %s", match_strval((atoi(oaction) & 0x8f), open_create_action_vals), p_filehandle, match_strval(atoi(oplockflg), ncp_o_c_ret_flags_vals));
2875                 }
2876             }
2877             /* The following allows for Update file handle rights echoed to expert tap. */
2878             if (ncp_rec->func == 87 && ncp_rec->subfunc == 44) {
2879                 char p_rights[20]="\0";
2880                 char p_filehandle[15]="\0";
2881
2882                 build_expert_data(ncp_tree, "ncp.file_handle",
2883                                   p_filehandle, sizeof p_filehandle, 0, FALSE);
2884                 build_expert_data(ncp_tree, "ncp.effective_rights",
2885                                   p_rights, sizeof p_rights, 0, FALSE);
2886                 expert_add_info_format(pinfo, NULL, PI_RESPONSE_CODE, PI_CHAT, "Handle %s effective rights:(%s)", p_filehandle, match_strval((atoi(p_rights) & 0x1ff), access_rights_vals));
2887             }
2888         }
2889         /* The following allows for specific NCP server info to be echoed to the expert tap. */
2890         if (ncp_rec->func == 23 && ncp_rec->subfunc == 17 && ncp_echo_server) {
2891             char fsname[50]="\0";
2892             char p_maj_ver[3]="\0";
2893             char p_min_ver[3]="\0";
2894             char p_rev[3]="\0";
2895             char p_lang[3]="\0";
2896
2897             /* Get Server name and version info */
2898             build_expert_data(ncp_tree, "ncp.server_name",
2899                               fsname, sizeof fsname, 0, FALSE);
2900             build_expert_data(ncp_tree, "ncp.product_major_version",
2901                               p_maj_ver, sizeof p_maj_ver, 0, FALSE);
2902             build_expert_data(ncp_tree, "ncp.product_minor_version",
2903                               p_min_ver, sizeof p_min_ver, 0, FALSE);
2904             build_expert_data(ncp_tree, "ncp.product_revision_version",
2905                               p_rev, sizeof p_rev, 0, FALSE);
2906             build_expert_data(ncp_tree, "ncp.os_language_id",
2907                               p_lang, sizeof p_lang, 0, FALSE);
2908             expert_add_info_format(pinfo, NULL, PI_RESPONSE_CODE, PI_CHAT, "Server %s, version %s.%s, support pack %s, language %s", fsname,
2909                                    p_maj_ver, p_min_ver, p_rev, p_lang);
2910         }
2911     }
2912 }
2913
2914
2915 static void
2916 print_nds_values(proto_tree *vtree, tvbuff_t *tvb, guint32 syntax_type, nds_val *vvalues)
2917 {
2918     guint32         value1 = 0;
2919     guint32         value2 = 0;
2920     guint32         value3 = 0;
2921     guint32         value4 = 0;
2922     guint32         value5 = 0;
2923     guint32         voffset = 0, oldvoffset;
2924     guint32         icounter;
2925     guint32         number_of_values = 0;
2926     guint32         number_of_items = 0;
2927     guint32         r;
2928     proto_item      *vitem;
2929     proto_tree      *nvtree;
2930     proto_item      *aditem;
2931     proto_tree      *adtree;
2932     const char      *valuestr = NULL;
2933     guint16         rtype = 0;
2934     guint16         rstate = 0;
2935     guint16         rnum = 0;
2936     guint16         revent = 0;
2937     gint            length_remaining;
2938     nstime_t        ns;
2939     gboolean        entry_rights = FALSE;
2940     nds_val         temp_values;
2941
2942     voffset = vvalues->voffset;
2943 #if 0
2944     if(tvb_get_guint8(tvb, voffset) == 0x00)
2945     {
2946         voffset = voffset+2;
2947     }
2948 #endif
2949
2950     number_of_values = tvb_get_letohl(tvb, voffset);
2951
2952     vitem = proto_tree_add_uint_format(vtree, hf_nds_uint32value, tvb, voffset,
2953                                        4, number_of_values, "Number of Values: %u", number_of_values);
2954
2955     nvtree = proto_item_add_subtree(vitem, ett_nds);
2956
2957     oldvoffset = voffset;
2958     voffset = voffset + 4;
2959
2960     for (icounter = 1 ; icounter <= number_of_values; icounter++ )
2961     {
2962         if (oldvoffset >= voffset) {
2963             proto_tree_add_text(nvtree, tvb, 0, 0, "[ Invalid offset: %u ]", voffset);
2964             THROW(ReportedBoundsError);
2965         }
2966         oldvoffset = voffset;
2967         switch(syntax_type)
2968         {
2969         case 0x00000006:        /* Case Insensitive List */
2970         case 0x00000012:        /* Postal Address */
2971             voffset += align_4(tvb, voffset);
2972             voffset = voffset+4;
2973             number_of_items = tvb_get_letohl(tvb, voffset);
2974             voffset = voffset+4;
2975             for (r=1; r<=number_of_items; r++)
2976             {
2977                 value1 = tvb_get_letohl(tvb, voffset);
2978                 voffset = voffset + 4;
2979                 vvalues->vstring = get_string(tvb, voffset, value1);
2980                 proto_tree_add_string(nvtree, hf_value_string, tvb, voffset,
2981                                       value1, vvalues->vstring);
2982                 voffset = voffset + value1;
2983                 voffset += align_4(tvb, voffset);
2984             }
2985             break;
2986         case 0x00000007:        /* Boolean */
2987             voffset+=4;                            /* this is always just a parameter count of 1, so ignore */
2988             value1 = tvb_get_guint8(tvb, voffset); /* Boolean value */
2989             if (value1==0)
2990             {
2991                 vvalues->vstring = "False";
2992             }
2993             else
2994             {
2995                 vvalues->vstring = "True";
2996             }
2997             tvb_ensure_bytes_exist(tvb, voffset, 1);
2998             proto_tree_add_string(nvtree, hf_value_string, tvb, voffset,
2999                                   1, vvalues->vstring);
3000             voffset=voffset+1;
3001             voffset += align_4(tvb, voffset);
3002             break;
3003         case 0x00000009:        /* Binary String */
3004             value1 = tvb_get_letohl(tvb, voffset); /* length of field */
3005             length_remaining = tvb_length_remaining(tvb, voffset);
3006             if(length_remaining == -1 || value1 > (guint32) length_remaining)
3007             {
3008                 break;
3009             }
3010             voffset += 4;
3011             tvb_ensure_bytes_exist(tvb, voffset, value1);
3012             proto_tree_add_bytes(nvtree, hf_value_bytes, tvb, voffset, value1, tvb_get_ptr(tvb, voffset, value1));
3013             voffset += value1;
3014             voffset += (value1%2);
3015             break;
3016         case 0x0000000d:        /* Binary String List */
3017             value1 = tvb_get_letohl(tvb, voffset); /* Overall length of field list */
3018             length_remaining = tvb_length_remaining(tvb, voffset);
3019             if(length_remaining == -1 || value1 > (guint32) length_remaining)
3020             {
3021                 break;
3022             }
3023             voffset += 4;
3024             tvb_ensure_bytes_exist(tvb, voffset, value1);
3025             number_of_items = tvb_get_letohl(tvb, voffset);
3026             voffset = voffset+4;
3027             for (r=1; r<=number_of_items; r++)
3028             {
3029                 value1 = tvb_get_letohl(tvb, voffset); /* length of field */
3030                 length_remaining = tvb_length_remaining(tvb, voffset);
3031                 if(length_remaining == -1 || value1 > (guint32) length_remaining)
3032                 {
3033                     break;
3034                 }
3035                 voffset += 4;
3036                 tvb_ensure_bytes_exist(tvb, voffset, value1);
3037                 proto_tree_add_bytes(nvtree, hf_value_bytes, tvb, voffset, value1, tvb_get_ptr(tvb, voffset, value1));
3038                 voffset += value1;
3039                 voffset += (value1%2);
3040             }
3041             break;
3042         case 0x00000015:        /* Stream */
3043             value1 = tvb_get_letohl(tvb, voffset); /* length of field */
3044             length_remaining = tvb_length_remaining(tvb, voffset);
3045             if(length_remaining == -1 || value1 > (guint32) length_remaining)
3046             {
3047                 break;
3048             }
3049             proto_tree_add_text(nvtree, tvb, voffset, 4, "No value, Open stream file for data.");
3050             voffset += 4;
3051             voffset += value1;
3052             voffset += (value1%2);
3053             break;
3054         case 0x00000008:        /* Signed Integer */
3055         case 0x00000016:        /* Counter */
3056         case 0x0000001b:        /* Interval */
3057             value1 = tvb_get_letohl(tvb, voffset); /* length of field */
3058             voffset = voffset+4;
3059             value2 = tvb_get_letohl(tvb, voffset); /* Value */
3060             tvb_ensure_bytes_exist(tvb, voffset, value1);
3061             if (strcmp(vvalues->vstring, "zendmSearchType")==0) {
3062                 proto_tree_add_uint_format(nvtree, hf_nds_uint32value, tvb, voffset,
3063                                            value1, value2,
3064                                            "Value (%d) = %s", value2, match_strval(value2, zensearchenum));
3065             }
3066             else
3067             {
3068                 proto_tree_add_uint_format(nvtree, hf_nds_uint32value, tvb, voffset,
3069                                            value1, value2, "Value %d", value2);
3070             }
3071             voffset = voffset+4;
3072             break;
3073         case 0x0000000b:        /* Fax Number */
3074             value1 = tvb_get_letohl(tvb, voffset); /* length of field */
3075             voffset = voffset+4;
3076             vvalues->vstring = get_string(tvb, voffset, value1);
3077             proto_tree_add_string(nvtree, hf_value_string, tvb, voffset,
3078                                   value1, vvalues->vstring);
3079             voffset = voffset + value1;
3080             voffset += align_4(tvb, voffset);
3081             break;
3082         case 0x0000000c:        /* Network Address */
3083             value1 = tvb_get_letohl(tvb, voffset); /* length of field */
3084             voffset = voffset + 4;
3085             value2 = tvb_get_letohl(tvb, voffset); /* type of Protocol */
3086             valuestr = match_strval(value2, nds_protocol_type);
3087             if (valuestr == NULL)
3088             {
3089                 valuestr="(Undefined Protocol)";
3090             }
3091             tvb_ensure_bytes_exist(tvb, voffset, value1);
3092             proto_tree_add_uint_format(nvtree, hf_nds_uint32value, tvb, voffset,
3093                                        value1, value2, valuestr, value2);
3094             voffset = voffset+4;
3095             value3 = tvb_get_letohl(tvb, voffset); /* length of address */
3096             voffset = voffset+4;
3097             switch (value2)
3098             {
3099             case NDS_PTYPE_IPX:
3100                 proto_tree_add_item(nvtree, hf_nds_net, tvb, voffset, 4, FALSE);
3101                 proto_tree_add_item(nvtree, hf_nds_node, tvb, voffset+4, 6, FALSE);
3102                 proto_tree_add_item(nvtree, hf_nds_socket, tvb, voffset+10, 2, FALSE);
3103                 break;
3104             case NDS_PTYPE_IP:
3105                 if (value3 > 4) {
3106                     proto_tree_add_item(nvtree, hf_nds_port, tvb, voffset, 2, FALSE);
3107                     voffset += 2;
3108                 }
3109                 proto_tree_add_item(nvtree, hf_add_ref_ip, tvb, voffset, 4, FALSE);
3110                 break;
3111             case NDS_PTYPE_UDP:
3112                 if (value3 > 4) {
3113                     proto_tree_add_item(nvtree, hf_nds_port, tvb, voffset, 2, FALSE);
3114                     voffset += 2;
3115                 }
3116                 proto_tree_add_item(nvtree, hf_add_ref_udp, tvb, voffset, 4, FALSE);
3117                 break;
3118             case NDS_PTYPE_TCP:
3119                 proto_tree_add_item(nvtree, hf_nds_port, tvb, voffset, 2, FALSE);
3120                 proto_tree_add_item(nvtree, hf_add_ref_tcp, tvb, voffset+2, 4, FALSE);
3121                 break;
3122             case NDS_PTYPE_URL:
3123             case NDS_PTYPE_DNS:
3124                 vvalues->vstring = get_string(tvb, voffset, value3);
3125                 proto_tree_add_string(nvtree, hf_value_string, tvb, voffset,
3126                                       value3, vvalues->vstring);
3127                 break;
3128             default:
3129                 break;
3130             }
3131             voffset = voffset + value3;
3132             voffset += align_4(tvb, voffset);
3133             break;
3134         case 0x0000000f:        /* File System Path */
3135             value1 = tvb_get_letohl(tvb, voffset); /* length of field */
3136             voffset = voffset + 4;
3137             value2 = tvb_get_letohl(tvb, voffset); /* Name Space */
3138             valuestr = match_strval(value2, name_space_type);
3139             if (valuestr == NULL)
3140             {
3141                 valuestr = "Unknown Name Space";
3142             }
3143             proto_tree_add_string(nvtree, hf_value_string, tvb, voffset,
3144                                   4, valuestr);
3145             voffset = voffset+4;
3146             value3 = tvb_get_letohl(tvb, voffset); /* Length of Volume name */
3147             voffset = voffset+4;
3148             vvalues->vstring = get_string(tvb, voffset, value3);
3149             proto_tree_add_string(nvtree, hf_value_string, tvb, voffset,
3150                                   value3, vvalues->vstring);
3151             voffset = voffset+value3;
3152             voffset += align_4(tvb, voffset);
3153             value4 = tvb_get_letohl(tvb, voffset); /* Length of Path name */
3154             voffset = voffset+4;
3155             vvalues->vstring = get_string(tvb, voffset, value4);
3156             proto_tree_add_string(nvtree, hf_value_string, tvb, voffset,
3157                                   value4, vvalues->vstring);
3158             voffset = voffset+value4;
3159             voffset += align_4(tvb, voffset);
3160             break;
3161         case 0x00000010:        /* Replica Pointer */
3162             value1 = tvb_get_letohl(tvb, voffset); /* length of field */
3163             voffset = voffset + 4;
3164             value2 = tvb_get_letohl(tvb, voffset); /* Length of Server name */
3165             voffset = voffset+4;
3166             vvalues->vstring = get_string(tvb, voffset, value2);
3167             proto_tree_add_string(nvtree, hf_value_string, tvb, voffset,
3168                                   value2, vvalues->vstring);
3169             voffset = voffset+value2;
3170             voffset += align_4(tvb, voffset);
3171             rtype = tvb_get_letohs(tvb, voffset); /* replica type */
3172             valuestr = match_strval(rtype, nds_replica_type);
3173             if (valuestr == NULL)
3174             {
3175                 valuestr="(Unknown Replica Type)";
3176             }
3177             proto_tree_add_string(nvtree, hf_replica_type, tvb, voffset,
3178                                   2, valuestr);
3179             voffset = voffset+2;
3180             rstate = tvb_get_letohs(tvb, voffset); /* replica state */
3181             valuestr = match_strval(rstate, nds_replica_state);
3182             if (valuestr == NULL)
3183             {
3184                 valuestr="(Unknown Replica State)";
3185             }
3186             proto_tree_add_string(nvtree, hf_replica_state, tvb, voffset,
3187                                   2, valuestr);
3188             voffset = voffset+2;
3189             value3 = tvb_get_letohl(tvb, voffset); /* Replica number */
3190             proto_tree_add_uint_format(nvtree, hf_replica_number, tvb, voffset,
3191                                        4, value3, "Replica Number %d", value3);
3192             voffset = voffset+4;
3193             if(vvalues->pflags & 0x8000)
3194             {
3195                 /* If this request flag is set then this is a server. Server structures
3196                  * include the RootID as part of the replica data. */
3197                 proto_tree_add_item(nvtree, hf_nds_partition_root_id, tvb, voffset, 4, FALSE);
3198                 voffset += 4;
3199             }
3200             number_of_items = tvb_get_letohl(tvb, voffset);  /* Number of Addresses */
3201             aditem = proto_tree_add_uint_format(nvtree, hf_nds_uint32value, tvb, voffset,
3202                                                 4, number_of_items, "Number of Addresses: %u", number_of_items);
3203
3204             adtree = proto_item_add_subtree(aditem, ett_nds);
3205             voffset = voffset+4;
3206             for (r=1; r <= number_of_items; r++)
3207             {
3208                 /* Trap for end of packet */
3209                 if(tvb_length_remaining(tvb, voffset)<12)
3210                 {
3211                     THROW(ReportedBoundsError);
3212                 }
3213                 voffset += align_4(tvb, voffset);
3214                 value4 = tvb_get_letohl(tvb, voffset); /* type of Protocol */
3215                 valuestr = match_strval(value4, nds_protocol_type);
3216                 if (valuestr == NULL)
3217                 {
3218                     valuestr="(Undefined Protocol)";
3219                 }
3220                 proto_tree_add_uint_format(adtree, hf_nds_uint32value, tvb, voffset,
3221                                            4, value4, valuestr, value4);
3222                 voffset = voffset+4;
3223                 value5 = tvb_get_letohl(tvb, voffset); /* length of address */
3224                 voffset = voffset+4;
3225                 switch (value4)
3226                 {
3227                 case NDS_PTYPE_IPX:
3228                     proto_tree_add_item(adtree, hf_nds_net, tvb, voffset, 4, FALSE);
3229                     proto_tree_add_item(adtree, hf_nds_node, tvb, voffset+4, 6, FALSE);
3230                     proto_tree_add_item(adtree, hf_nds_socket, tvb, voffset+10, 2, FALSE);
3231                     break;
3232                 case NDS_PTYPE_IP:
3233                     proto_tree_add_item(adtree, hf_nds_port, tvb, voffset, 2, FALSE);
3234                     proto_tree_add_item(adtree, hf_add_ref_ip, tvb, voffset+2, 4, FALSE);
3235                     break;
3236                 case NDS_PTYPE_UDP:
3237                     proto_tree_add_item(adtree, hf_nds_port, tvb, voffset, 2, FALSE);
3238                     proto_tree_add_item(adtree, hf_add_ref_udp, tvb, voffset+2, 4, FALSE);
3239                     break;
3240                 case NDS_PTYPE_TCP:
3241                     proto_tree_add_item(adtree, hf_nds_port, tvb, voffset, 2, FALSE);
3242                     proto_tree_add_item(adtree, hf_add_ref_tcp, tvb, voffset+2, 4, FALSE);
3243                     break;
3244                 case NDS_PTYPE_URL:
3245                 case NDS_PTYPE_DNS:
3246                     vvalues->vstring = get_string(tvb, voffset, value5);
3247                     proto_tree_add_string(adtree, hf_value_string, tvb, voffset,
3248                                           value5, vvalues->vstring);
3249                     break;
3250                 default:
3251                     break;
3252                 }
3253                 voffset = voffset + value5;
3254             }
3255             voffset += align_4(tvb, voffset);
3256             break;
3257         case 0x00000011:        /* Object ACL */
3258             value1 = tvb_get_letohl(tvb, voffset); /* Length of Field */
3259             voffset = voffset + 4;
3260             value2 = tvb_get_letohl(tvb, voffset);
3261             voffset = voffset + 4;
3262             vvalues->vstring = get_string(tvb, voffset, value2); /* Unicode String */
3263             proto_tree_add_string(nvtree, hf_value_string, tvb, voffset,
3264                                   value2, vvalues->vstring);
3265             if (strcmp(vvalues->vstring, "[Entry Rights]")) {
3266                 entry_rights=TRUE;
3267             }
3268             else
3269             {
3270                 entry_rights=FALSE;
3271             }
3272             voffset = voffset + value2;
3273             voffset += align_4(tvb, voffset);
3274             value3 = tvb_get_letohl(tvb, voffset);
3275             voffset = voffset + 4;
3276             vvalues->vstring = get_string(tvb, voffset, value3); /* Unicode Subject Name */
3277             proto_tree_add_string(nvtree, hf_value_string, tvb, voffset,
3278                                   value3, vvalues->vstring);
3279             voffset = voffset + value3;
3280             voffset += align_4(tvb, voffset);
3281             temp_values.vvalue = tvb_get_letohl(tvb, voffset); /* Entry or Attribute Privileges */
3282             temp_values.vlength = 2;
3283             temp_values.hfname = hf_nds_vflags;
3284             temp_values.voffset = voffset;
3285             temp_values.vdesc = "Privileges";
3286             if (entry_rights) {
3287                 /* if Entries then use these bits */
3288                 temp_values.bit1 = "Compare Attributes";
3289                 temp_values.bit1hfname = hf_nds_compare_attributes;
3290                 temp_values.bit2 = "Read Attribute";
3291                 temp_values.bit2hfname = hf_nds_read_attribute;
3292                 temp_values.bit3 = "Write, Add, Delete Attribute";
3293                 temp_values.bit3hfname = hf_nds_write_add_delete_attribute;
3294                 temp_values.bit4 = "Add/Delete Self";
3295                 temp_values.bit4hfname = hf_nds_add_delete_self;
3296                 temp_values.bit5 = "Attribute Privilege Not Defined";
3297                 temp_values.bit5hfname = hf_nds_privilege_not_defined;
3298                 temp_values.bit6 = "Supervisor";
3299                 temp_values.bit6hfname = hf_nds_supervisor;
3300                 temp_values.bit7 = "Inheritance Control";
3301                 temp_values.bit7hfname = hf_nds_inheritance_control;
3302                 temp_values.bit8 = "Not Defined";
3303                 temp_values.bit8hfname = hf_bit8vflags;
3304                 temp_values.bit9 = "Not Defined";
3305                 temp_values.bit9hfname = hf_bit9vflags;
3306                 temp_values.bit10 = "Not Defined";
3307                 temp_values.bit10hfname = hf_bit10vflags;
3308                 temp_values.bit11 = "Not Defined";
3309                 temp_values.bit11hfname = hf_bit11vflags;
3310                 temp_values.bit12 = "Not Defined";
3311                 temp_values.bit12hfname = hf_bit12vflags;
3312                 temp_values.bit13 = "Not Defined";
3313                 temp_values.bit13hfname = hf_bit13vflags;
3314                 temp_values.bit14 = "Not Defined";
3315                 temp_values.bit14hfname = hf_bit14vflags;
3316                 temp_values.bit15 = "Not Defined";
3317                 temp_values.bit15hfname = hf_bit15vflags;
3318                 temp_values.bit16 = "Not Defined";
3319                 temp_values.bit16hfname = hf_bit16vflags;
3320             }
3321             else
3322             {
3323                 /* if attribute rights then do these bits */
3324                 temp_values.bit1 = "Browse";
3325                 temp_values.bit1hfname = hf_nds_browse_entry;
3326                 temp_values.bit2 = "Add";
3327                 temp_values.bit2hfname = hf_nds_add_entry;
3328                 temp_values.bit3 = "Delete";
3329                 temp_values.bit3hfname = hf_nds_delete_entry;
3330                 temp_values.bit4 = "Rename";
3331                 temp_values.bit4hfname = hf_nds_rename_entry;
3332                 temp_values.bit5 = "Supervisor";
3333                 temp_values.bit5hfname = hf_nds_supervisor_entry;
3334                 temp_values.bit6 = "Entry Privilege Not Defined";
3335                 temp_values.bit6hfname = hf_nds_entry_privilege_not_defined;
3336                 temp_values.bit7 = "Inheritance Control";
3337                 temp_values.bit7hfname = hf_nds_inheritance_control;
3338                 temp_values.bit8 = "Not Defined";
3339                 temp_values.bit8hfname = hf_bit8vflags;
3340                 temp_values.bit9 = "Not Defined";
3341                 temp_values.bit9hfname = hf_bit9vflags;
3342                 temp_values.bit10 = "Not Defined";
3343                 temp_values.bit10hfname = hf_bit10vflags;
3344                 temp_values.bit11 = "Not Defined";
3345                 temp_values.bit11hfname = hf_bit11vflags;
3346                 temp_values.bit12 = "Not Defined";
3347                 temp_values.bit12hfname = hf_bit12vflags;
3348                 temp_values.bit13 = "Not Defined";
3349                 temp_values.bit13hfname = hf_bit13vflags;
3350                 temp_values.bit14 = "Not Defined";
3351                 temp_values.bit14hfname = hf_bit14vflags;
3352                 temp_values.bit15 = "Not Defined";
3353                 temp_values.bit15hfname = hf_bit15vflags;
3354                 temp_values.bit16 = "Not Defined";
3355                 temp_values.bit16hfname = hf_bit16vflags;
3356             }
3357             process_bitfield(nvtree, tvb, &temp_values);
3358             voffset = voffset+4;
3359             voffset += align_4(tvb, voffset);
3360             break;
3361         case 0x00000013:        /* Time Stamp */
3362             value1 = tvb_get_letohl(tvb, voffset);         /* Seconds */
3363             proto_tree_add_uint_format(nvtree, hf_nds_uint32value, tvb, voffset,
3364                                        4, value1, "Length of Record: %u", value1);
3365             voffset = voffset+4;
3366             ns.secs = tvb_get_letohl(tvb, voffset);
3367             ns.nsecs = 0;
3368             proto_tree_add_time_format(nvtree, hf_nds_ds_time, tvb, voffset, 4, &ns, "Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
3369             voffset = voffset + 4;
3370             rnum = tvb_get_letohs(tvb, voffset); /* replica number */
3371             proto_tree_add_uint_format(nvtree, hf_nds_rnum, tvb, voffset,
3372                                        2, rnum, "Replica Number: %d", rnum);
3373             voffset = voffset+2;
3374             revent = tvb_get_letohs(tvb, voffset); /* Event */
3375             proto_tree_add_uint_format(nvtree, hf_nds_revent, tvb, voffset,
3376                                        2, revent, "Event: %d", revent);
3377             voffset = voffset+2;
3378             voffset += align_4(tvb, voffset);
3379             break;
3380         case 0x00000017:        /* Back Link */
3381             value1 = tvb_get_letohl(tvb, voffset);         /* Length */
3382             proto_tree_add_uint_format(nvtree, hf_nds_uint32value, tvb, voffset,
3383                                        4, value1, "Length of Record %08x", value1);
3384             voffset = voffset+4;
3385             value2 = tvb_get_letohl(tvb, voffset);         /* Remote ID */
3386             proto_tree_add_uint_format(nvtree, hf_nds_uint32value, tvb, voffset,
3387                                        4, value2, "Remote ID %08x", value2);
3388             voffset = voffset+4;
3389             value3 = tvb_get_letohl(tvb, voffset);         /* Length of string */
3390             voffset = voffset+4;
3391             vvalues->vstring = get_string(tvb, voffset, value3);
3392             proto_tree_add_string_format(nvtree, hf_value_string, tvb, voffset,
3393                                          value3, vvalues->vstring,
3394                                          "Server Distinguished Name - %s", vvalues->vstring);
3395             voffset = voffset+value3;
3396             voffset += align_4(tvb, voffset);
3397             break;
3398         case 0x00000018:        /* Time */
3399             voffset += 4; /* This is the length of the time data no need to decode, always 4 bytes */
3400             ns.secs = tvb_get_letohl(tvb, voffset);
3401             ns.nsecs = 0;
3402             proto_tree_add_time_format(nvtree, hf_nds_ds_time, tvb, voffset, 4, &ns, "Time: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
3403             voffset = voffset + 4;
3404             break;
3405         case 0x00000019:        /* Typed Name */
3406             value1 = tvb_get_letohl(tvb, voffset);         /* Length */
3407             proto_tree_add_uint_format(nvtree, hf_nds_uint32value, tvb, voffset,
3408                                        4, value1, "Length of Record %08x", value1);
3409             voffset = voffset+4;
3410             value2 = tvb_get_letohl(tvb, voffset);         /* Level */
3411             proto_tree_add_uint_format(nvtree, hf_nds_uint32value, tvb, voffset,
3412                                        4, value2, "Level %d", value2);
3413             voffset = voffset+4;
3414             value3 = tvb_get_letohl(tvb, voffset);         /* Interval */
3415             proto_tree_add_uint_format(nvtree, hf_nds_uint32value, tvb, voffset,
3416                                        4, value3, "Interval %d", value3);
3417             voffset = voffset+4;
3418             value4 = tvb_get_letohl(tvb, voffset);         /* Distinguished Name */
3419             voffset = voffset+4;
3420             vvalues->vstring = get_string(tvb, voffset, value4);
3421             proto_tree_add_string_format(nvtree, hf_value_string, tvb, voffset,
3422                                          value4, vvalues->vstring,
3423                                          "Distinguished Name - %s", vvalues->vstring);
3424             voffset = voffset+value4;
3425             voffset += align_4(tvb, voffset);
3426             break;
3427         case 0x0000001a:        /* Hold */
3428             value1 = tvb_get_letohl(tvb, voffset);         /* Length */
3429             proto_tree_add_uint_format(nvtree, hf_nds_uint32value, tvb, voffset,
3430                                        4, value1, "Length of Record %08x", value1);
3431             voffset = voffset+4;
3432             value2 = tvb_get_letohl(tvb, voffset);         /* Amount */
3433             proto_tree_add_uint_format(nvtree, hf_nds_uint32value, tvb, voffset,
3434                                        4, value2, "Amount %d", value2);
3435             voffset = voffset+4;
3436             value3 = tvb_get_letohl(tvb, voffset);         /* Subject */
3437             voffset = voffset+4;
3438             vvalues->vstring = get_string(tvb, voffset, value3);
3439             proto_tree_add_string_format(nvtree, hf_value_string, tvb, voffset,
3440                                          value3, vvalues->vstring,
3441                                          "Subject - %s", vvalues->vstring);
3442             voffset = voffset+value3;
3443             voffset += align_4(tvb, voffset);
3444             break;
3445         case 0x00000001:        /* Distinguished Name */
3446         case 0x00000002:        /* Case Sensitive Unicode String */
3447         case 0x00000003:        /* Non Case Sensitive Unicode String */
3448         case 0x00000004:        /* Printable String */
3449         case 0x00000005:        /* Numeric String */
3450         case 0x0000000a:        /* Telephone Number */
3451         case 0x0000000e:        /* Email Address */
3452         case 0x00000014:        /* Class Name */
3453         default:
3454             value1 = tvb_get_letohl(tvb, voffset);
3455             voffset = voffset + 4;
3456             if (strcmp(vvalues->vstring, "zendmSearchOrder")==0) {
3457                 vvalues->vstring = get_string(tvb, voffset, value1);
3458                 if (strcmp(vvalues->vstring, "0")==0) {
3459                     vvalues->vstring = "Value (0) = Object";
3460                 }
3461                 else if (strcmp(vvalues->vstring, "1")==0) {
3462                     vvalues->vstring = "Value (1) = Group";
3463                 }
3464                 else if (strcmp(vvalues->vstring, "2")==0) {
3465                     vvalues->vstring = "Value (2) = Container";
3466                 }
3467                 else if (strcmp(vvalues->vstring, "01")==0) {
3468                     vvalues->vstring = "Value (01) = Object, Group";
3469                 }
3470                 else if (strcmp(vvalues->vstring, "02")==0) {
3471                     vvalues->vstring = "Value (02) = Object, Container";
3472                 }
3473                 else if (strcmp(vvalues->vstring, "10")==0) {
3474                     vvalues->vstring = "Value (10) = Group, Object";
3475                 }
3476                 else if (strcmp(vvalues->vstring, "12")==0) {
3477                     vvalues->vstring = "Value (12) = Group, Container";
3478                 }
3479                 else if (strcmp(vvalues->vstring, "20")==0) {
3480                     vvalues->vstring = "Value (20) = Container, Object";
3481                 }
3482                 else if (strcmp(vvalues->vstring, "21")==0) {
3483                     vvalues->vstring = "Value (21) = Container, Group";
3484                 }
3485                 else if (strcmp(vvalues->vstring, "012")==0) {
3486                     vvalues->vstring = "Value (012) = Object, Group, Container";
3487                 }
3488                 else if (strcmp(vvalues->vstring, "021")==0) {
3489                     vvalues->vstring = "Value (021) = Object, Container, Group";
3490                 }
3491                 else if (strcmp(vvalues->vstring, "102")==0) {
3492                     vvalues->vstring = "Value (102) = Group, Object, Container";
3493                 }
3494                 else if (strcmp(vvalues->vstring, "120")==0) {
3495                     vvalues->vstring = "Value (120) = Group, Container, Object";
3496                 }
3497                 else if (strcmp(vvalues->vstring, "201")==0) {
3498                     vvalues->vstring = "Value (201) = Container, Object, Group";
3499                 }
3500                 else if (strcmp(vvalues->vstring, "210")==0) {
3501                     vvalues->vstring = "Value (210) = Container, Group, Object";
3502                 }
3503             }
3504             else
3505             {
3506                 vvalues->vstring = get_string(tvb, voffset, value1);
3507             }
3508             proto_tree_add_string(nvtree, hf_value_string, tvb, voffset,
3509                                   value1, vvalues->vstring);
3510             voffset = voffset + value1;
3511             voffset += align_4(tvb, voffset);
3512             break;
3513         }
3514         voffset += align_4(tvb, voffset);
3515     }
3516     vvalues->voffset=voffset;
3517     return;
3518 }
3519
3520 static guint32
3521 print_es_type(proto_tree *estree, tvbuff_t *tvb, nds_val *values, guint32 vtype, guint32 ioffset)
3522 {
3523     guint32         value1;
3524     guint32         value2;
3525     guint32         value3;
3526     guint32         value4;
3527     guint32         value5;
3528     guint32         number_of_referrals;
3529     guint32         r;
3530     guint32         i;
3531     guint16         replica_num;
3532     guint16         event_num;
3533     proto_tree      *nestree;
3534     proto_item      *nesitem;
3535     proto_tree      *sub1tree;
3536     proto_item      *sub1item;
3537     proto_tree      *sub2tree;
3538     proto_item      *sub2item;
3539     const char      *vstring="";
3540     nstime_t        ns;
3541
3542     switch (vtype)
3543     {
3544     case 0: /* No Specifier Type */
3545         value1 = tvb_get_letohl(tvb, ioffset);   /* ES Type */
3546         proto_tree_add_item(estree, hf_es_value, tvb, ioffset,
3547                             4, value1);
3548         ioffset = ioffset + 4;
3549         break;
3550     case 1: /* Unicode String */
3551         value1 = tvb_get_letohl(tvb, ioffset);   /* Delimiter Set */
3552         ioffset = ioffset + 4;
3553         values->vstring = get_string(tvb, ioffset, value1);
3554         proto_tree_add_string_format(estree, hf_mv_string, tvb, ioffset,
3555                                      value1, values->vstring, "Delimiter ->%s", values->vstring);
3556         ioffset=ioffset + value1;
3557         ioffset += align_4(tvb, ioffset);
3558         value2 = tvb_get_letohl(tvb, ioffset);
3559         ioffset = ioffset + 4;
3560         values->vstring = get_string(tvb, ioffset, value2);
3561         proto_tree_add_string(estree, hf_mv_string, tvb, ioffset,
3562                               value2, values->vstring);
3563         values->voffset=ioffset + value2;
3564         ioffset = values->voffset;
3565         ioffset += align_4(tvb, ioffset);
3566         break;
3567     case 2: /* Based */
3568         value1 = tvb_get_letohl(tvb, ioffset);   /* ES Type */
3569         vstring = match_strval(value1, es_type);
3570         if (vstring == NULL)
3571         {
3572             vstring = "No ES Type Found";
3573         }
3574         nesitem = proto_tree_add_string_format(estree, hf_es_type, tvb, ioffset,
3575                                                4, vstring, "Base Context Type - %s", vstring);
3576         nestree = proto_item_add_subtree(nesitem, ett_nds);
3577         ioffset = ioffset + 4;
3578         switch (value1)
3579         {
3580         case 0: /* No Specifier Type */
3581             value2 = tvb_get_letohl(tvb, ioffset);   /* ES Type */
3582             proto_tree_add_item(nestree, hf_es_value, tvb, ioffset,
3583                                 4, value2);
3584             ioffset = ioffset + 4;
3585             break;
3586         case 1: /* Unicode String */
3587             value2 = tvb_get_letohl(tvb, ioffset);   /* Delimiter Set */
3588             ioffset = ioffset + 4;
3589             values->vstring = get_string(tvb, ioffset, value2);
3590             proto_tree_add_string_format(nestree, hf_mv_string, tvb, ioffset,
3591                                          value2, values->vstring, "Delimiter ->%s", values->vstring);
3592             ioffset=ioffset + value2;
3593             ioffset += align_4(tvb, ioffset);
3594             value3 = tvb_get_letohl(tvb, ioffset);
3595             ioffset = ioffset + 4;
3596             values->vstring = get_string(tvb, ioffset, value3);
3597             proto_tree_add_string(nestree, hf_mv_string, tvb, ioffset,
3598                                   value3, values->vstring);
3599             values->voffset=ioffset + value3;
3600             ioffset = values->voffset;
3601             ioffset += align_4(tvb, ioffset);
3602             break;
3603         case 2: /* Based */
3604             break;
3605         case 3: /* Hinted */
3606             break;
3607         case 4: /* Tuned */
3608             value2 = tvb_get_letohl(tvb, ioffset);   /* Count */
3609             proto_tree_add_item(nestree, hf_es_rdn_count, tvb, ioffset,
3610                                 4, value2);
3611             ioffset = ioffset + 4;
3612             for (r = 1 ; r <= value2; r++ )
3613             {
3614                 ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
3615                 ns.nsecs = 0;
3616                 proto_tree_add_time_format(nestree, hf_es_seconds, tvb, ioffset,
3617                                            4, &ns, "Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
3618                 ioffset = ioffset + 4;
3619                 replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
3620                 proto_tree_add_item(nestree, hf_nds_replica_num, tvb, ioffset,
3621                                     2, replica_num);
3622                 ioffset = ioffset + 2;
3623                 event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
3624                 proto_tree_add_item(nestree, hf_nds_event_num, tvb, ioffset,
3625                                     2, event_num);
3626                 ioffset = ioffset + 2;
3627             }
3628             value4 = tvb_get_letohl(tvb, ioffset);   /* Delimiter Set */
3629             ioffset = ioffset + 4;
3630             values->vstring = get_string(tvb, ioffset, value4);
3631             proto_tree_add_string(nestree, hf_mv_string, tvb, ioffset,
3632                                   value4, values->vstring);
3633             ioffset=ioffset + value4;
3634             ioffset += align_4(tvb, ioffset);
3635             value5 = tvb_get_letohl(tvb, ioffset);   /* RDN */
3636             ioffset = ioffset + 4;
3637             values->vstring = get_string(tvb, ioffset, value5);
3638             proto_tree_add_string(nestree, hf_rdn_string, tvb, ioffset,
3639                                   value5, values->vstring);
3640             ioffset=ioffset + value5;
3641             ioffset += align_4(tvb, ioffset);
3642             break;
3643         case 5: /* GUID */
3644         case 6: /* ID32 */
3645         case 7: /* Count */
3646         default:
3647             value1 = tvb_get_letohl(tvb, ioffset);   /* ES Type */
3648             proto_tree_add_item(estree, hf_es_value, tvb, ioffset,
3649                                 4, value1);
3650             ioffset = ioffset + 4;
3651             break;
3652         }
3653         value1 = tvb_get_letohl(tvb, ioffset);   /* ES Type */
3654         vstring = match_strval(value1, es_type);
3655         if (vstring == NULL)
3656         {
3657             vstring = "No ES Type Found";
3658         }
3659         nesitem = proto_tree_add_string_format(estree, hf_es_type, tvb, ioffset,
3660                                                4, vstring, "Object Name Type - %s", vstring);
3661         nestree = proto_item_add_subtree(nesitem, ett_nds);
3662         ioffset = ioffset + 4;
3663         switch (value1)
3664         {
3665         case 0: /* No Specifier Type */
3666             value2 = tvb_get_letohl(tvb, ioffset);   /* ES Type */
3667             proto_tree_add_item(estree, hf_es_value, tvb, ioffset,
3668                                 4, value2);
3669             ioffset = ioffset + 4;
3670             break;
3671         case 1: /* Unicode String */
3672             value2 = tvb_get_letohl(tvb, ioffset);   /* Delimiter Set */
3673             ioffset = ioffset + 4;
3674             values->vstring = get_string(tvb, ioffset, value2);
3675             proto_tree_add_string_format(estree, hf_mv_string, tvb, ioffset,
3676                                          value2, values->vstring, "Delimiter ->%s", values->vstring);
3677             ioffset=ioffset + value2;
3678             ioffset += align_4(tvb, ioffset);
3679             value3 = tvb_get_letohl(tvb, ioffset);
3680             ioffset = ioffset + 4;
3681             values->vstring = get_string(tvb, ioffset, value3);
3682             proto_tree_add_string(estree, hf_mv_string, tvb, ioffset,
3683                                   value3, values->vstring);
3684             values->voffset=ioffset + value3;
3685             ioffset = values->voffset;
3686             ioffset += align_4(tvb, ioffset);
3687             break;
3688         case 2: /* Based */
3689             break;
3690         case 3: /* Hinted */
3691             break;
3692         case 4: /* Tuned */
3693             value2 = tvb_get_letohl(tvb, ioffset);   /* Count */
3694             proto_tree_add_item(estree, hf_es_rdn_count, tvb, ioffset,
3695                                 4, value2);
3696             ioffset = ioffset + 4;
3697             for (r = 1 ; r <= value2; r++ )
3698             {
3699                 ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
3700                 ns.nsecs = 0;
3701                 proto_tree_add_time_format(estree, hf_es_seconds, tvb, ioffset,
3702                                            4, &ns, "Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
3703                 ioffset = ioffset + 4;
3704                 replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
3705                 proto_tree_add_item(estree, hf_nds_replica_num, tvb, ioffset,
3706                                     2, replica_num);
3707                 ioffset = ioffset + 2;
3708                 event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
3709                 proto_tree_add_item(estree, hf_nds_event_num, tvb, ioffset,
3710                                     2, event_num);
3711                 ioffset = ioffset + 2;
3712             }
3713             value4 = tvb_get_letohl(tvb, ioffset);   /* Delimiter Set */
3714             ioffset = ioffset + 4;
3715             values->vstring = get_string(tvb, ioffset, value4);
3716             proto_tree_add_string(estree, hf_mv_string, tvb, ioffset,
3717                                   value4, values->vstring);
3718             ioffset=ioffset + value4;
3719             ioffset += align_4(tvb, ioffset);
3720             value5 = tvb_get_letohl(tvb, ioffset);   /* RDN */
3721             ioffset = ioffset + 4;
3722             values->vstring = get_string(tvb, ioffset, value5);
3723             proto_tree_add_string(estree, hf_rdn_string, tvb, ioffset,
3724                                   value5, values->vstring);
3725             ioffset=ioffset + value5;
3726             ioffset += align_4(tvb, ioffset);
3727             break;
3728         case 5: /* GUID */
3729         case 6: /* ID32 */
3730         case 7: /* Count */
3731         default:
3732             value1 = tvb_get_letohl(tvb, ioffset);   /* ES Type */
3733             proto_tree_add_item(estree, hf_es_value, tvb, ioffset,
3734                                 4, value1);
3735             ioffset = ioffset + 4;
3736             break;
3737         }
3738         break;
3739     case 3: /* Hinted */
3740         number_of_referrals = tvb_get_letohl(tvb, ioffset);
3741
3742         for (r = 1 ; r <= number_of_referrals; r++ )
3743         {
3744             sub1item = proto_tree_add_uint_format(estree, hf_referral_record, tvb, 6, 0,
3745                                                   r, "NDS Referral Record #%u", r);
3746             sub1tree = proto_item_add_subtree(sub1item, ett_nds);
3747
3748             value1 = tvb_get_letohl(tvb, ioffset);
3749
3750             proto_tree_add_uint_format(sub1tree, hf_referral_addcount, tvb, ioffset, 4,
3751                                        value1, "Number of Addresses in Referral - %u", value1);
3752
3753             ioffset = ioffset + 4;
3754             for (i = 1 ; i <= value1; i++ )
3755             {
3756                 value2 = tvb_get_letohl(tvb, ioffset);
3757                 values->vstring = match_strval(value2, nds_protocol_type);
3758                 if (values->vstring == NULL)
3759                 {
3760                     values->vstring="(Undefined Protocol)";
3761                 }
3762                 proto_tree_add_uint_format(sub1tree, hf_nds_uint32value, tvb, ioffset,
3763                                            4, value2, vstring, value2);
3764                 ioffset = ioffset+4;
3765                 value3 = tvb_get_letohl(tvb, ioffset);
3766                 ioffset = ioffset+4;
3767                 switch (value2)
3768                 {
3769                 case NDS_PTYPE_IPX:
3770                     proto_tree_add_item(sub1tree, hf_nds_net, tvb, ioffset, 4, FALSE);
3771                     proto_tree_add_item(sub1tree, hf_nds_node, tvb, ioffset+4, 6, FALSE);
3772                     proto_tree_add_item(sub1tree, hf_nds_socket, tvb, ioffset+10, 2, FALSE);
3773                     break;
3774                 case NDS_PTYPE_IP:
3775                     proto_tree_add_item(sub1tree, hf_nds_port, tvb, ioffset, 2, FALSE);
3776                     proto_tree_add_item(sub1tree, hf_add_ref_ip, tvb, ioffset+2, 4, FALSE);
3777                     break;
3778                 case NDS_PTYPE_UDP:
3779                     proto_tree_add_item(sub1tree, hf_nds_port, tvb, ioffset, 2, FALSE);
3780                     proto_tree_add_item(sub1tree, hf_add_ref_udp, tvb, ioffset+2, 4, FALSE);
3781                     break;
3782                 case NDS_PTYPE_TCP:
3783                     proto_tree_add_item(sub1tree, hf_nds_port, tvb, ioffset, 2, FALSE);
3784                     proto_tree_add_item(sub1tree, hf_add_ref_tcp, tvb, ioffset+2, 4, FALSE);
3785                     break;
3786                 case NDS_PTYPE_URL:
3787                 case NDS_PTYPE_DNS:
3788                     values->vstring = get_string(tvb, ioffset, value3);
3789                     proto_tree_add_string(sub1tree, hf_value_string, tvb, ioffset,
3790                                           value3, values->vstring);
3791                     break;
3792                 default:
3793                     break;
3794                 }
3795                 ioffset = ioffset + value3;
3796                 ioffset += align_4(tvb, ioffset);
3797             }
3798
3799         }
3800         value1 = tvb_get_letohl(tvb, ioffset);   /* ES Type */
3801         vstring = match_strval(value1, es_type);
3802         if (vstring == NULL)
3803         {
3804             vstring = "No ES Type Found";
3805         }
3806         nesitem = proto_tree_add_string_format(estree, hf_es_type, tvb, ioffset,
3807                                                4, vstring, "Object Name Type - %s", vstring);
3808         nestree = proto_item_add_subtree(nesitem, ett_nds);
3809         ioffset = ioffset + 4;
3810         switch (value1)
3811         {
3812         case 0: /* No Specifier Type */
3813             value2 = tvb_get_letohl(tvb, ioffset);   /* ES Type */
3814             proto_tree_add_item(estree, hf_es_value, tvb, ioffset,
3815                                 4, value2);
3816             ioffset = ioffset + 4;
3817             break;
3818         case 1: /* Unicode String */
3819             value2 = tvb_get_letohl(tvb, ioffset);   /* Delimiter Set */
3820             ioffset = ioffset + 4;
3821             values->vstring = get_string(tvb, ioffset, value2);
3822             proto_tree_add_string_format(estree, hf_mv_string, tvb, ioffset,
3823                                          value2, values->vstring, "Delimiter ->%s", values->vstring);
3824             ioffset=ioffset + value2;
3825             ioffset += align_4(tvb, ioffset);
3826             value3 = tvb_get_letohl(tvb, ioffset);
3827             ioffset = ioffset + 4;
3828             values->vstring = get_string(tvb, ioffset, value3);
3829             proto_tree_add_string(estree, hf_mv_string, tvb, ioffset,
3830                                   value3, values->vstring);
3831             values->voffset=ioffset + value3;
3832             ioffset = values->voffset;
3833             ioffset += align_4(tvb, ioffset);
3834             break;
3835         case 2: /* Based */
3836             break;
3837         case 3: /* Hinted */
3838             break;
3839         case 4: /* Tuned */
3840             value2 = tvb_get_letohl(tvb, ioffset);   /* Count */
3841             proto_tree_add_item(estree, hf_es_rdn_count, tvb, ioffset,
3842                                 4, value2);
3843             ioffset = ioffset + 4;
3844             for (r = 1 ; r <= value2; r++ )
3845             {
3846                 ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
3847                 ns.nsecs = 0;
3848                 proto_tree_add_time_format(estree, hf_es_seconds, tvb, ioffset,
3849                                            4, &ns, "Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
3850                 ioffset = ioffset + 4;
3851                 replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
3852                 proto_tree_add_item(estree, hf_nds_replica_num, tvb, ioffset,
3853                                     2, replica_num);
3854                 ioffset = ioffset + 2;
3855                 event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
3856                 proto_tree_add_item(estree, hf_nds_event_num, tvb, ioffset,
3857                                     2, event_num);
3858                 ioffset = ioffset + 2;
3859             }
3860             value4 = tvb_get_letohl(tvb, ioffset);   /* Delimiter Set */
3861             ioffset = ioffset + 4;
3862             values->vstring = get_string(tvb, ioffset, value4);
3863             proto_tree_add_string(estree, hf_mv_string, tvb, ioffset,
3864                                   value4, values->vstring);
3865             ioffset=ioffset + value4;
3866             ioffset += align_4(tvb, ioffset);
3867             value5 = tvb_get_letohl(tvb, ioffset);   /* RDN */
3868             ioffset = ioffset + 4;
3869             values->vstring = get_string(tvb, ioffset, value5);
3870             proto_tree_add_string(estree, hf_rdn_string, tvb, ioffset,
3871                                   value5, values->vstring);
3872             ioffset=ioffset + value5;
3873             ioffset += align_4(tvb, ioffset);
3874             break;
3875         case 5: /* GUID */
3876         case 6: /* ID32 */
3877         case 7: /* Count */
3878         default:
3879             value1 = tvb_get_letohl(tvb, ioffset);   /* ES Type */
3880             proto_tree_add_item(estree, hf_es_value, tvb, ioffset,
3881                                 4, value1);
3882             ioffset = ioffset + 4;
3883             break;
3884         }
3885         break;
3886     case 4: /* Tuned */
3887         value1 = tvb_get_letohl(tvb, ioffset);
3888         sub1item = proto_tree_add_uint_format(estree, hf_es_rdn_count, tvb, ioffset,
3889                                               4, value1, "Number of RDN Items %u", value1);
3890         sub1tree = proto_item_add_subtree(sub1item, ett_nds);
3891         ioffset = ioffset + 4;
3892         for (r = 1 ; r <= value1; r++ )
3893         {
3894             sub2item = proto_tree_add_text(sub1tree, tvb, ioffset, 0, "Item %u", r);
3895             sub2tree = proto_item_add_subtree(sub2item, ett_nds);
3896
3897             ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
3898             ns.nsecs = 0;
3899             proto_tree_add_time_format(sub2tree, hf_es_seconds, tvb, ioffset,
3900                                        4, &ns, "Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
3901             ioffset = ioffset + 4;
3902             replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
3903             proto_tree_add_item(sub2tree, hf_nds_replica_num, tvb, ioffset,
3904                                 2, replica_num);
3905             ioffset = ioffset + 2;
3906             event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
3907             proto_tree_add_item(sub2tree, hf_nds_event_num, tvb, ioffset,
3908                                 2, event_num);
3909             ioffset = ioffset + 2;
3910         }
3911         value3 = tvb_get_letohl(tvb, ioffset);   /* Delimiter Set */
3912         ioffset = ioffset + 4;
3913         values->vstring = get_string(tvb, ioffset, value3);
3914         proto_tree_add_string(sub1tree, hf_mv_string, tvb, ioffset,
3915                               value3, values->vstring);
3916         ioffset=ioffset + value3;
3917         ioffset += align_4(tvb, ioffset);
3918         value4 = tvb_get_letohl(tvb, ioffset);   /* RDN */
3919         ioffset = ioffset + 4;
3920         values->vstring = get_string(tvb, ioffset, value4);
3921         proto_tree_add_string(sub1tree, hf_rdn_string, tvb, ioffset,
3922                               value4, values->vstring);
3923         ioffset=ioffset + value4;
3924         ioffset += align_4(tvb, ioffset);
3925         break;
3926     case 5: /* GUID */
3927     case 6: /* ID32 */
3928     case 7: /* Count */
3929     default:
3930         value1 = tvb_get_letohl(tvb, ioffset);   /* ES Type */
3931         proto_tree_add_item(estree, hf_es_value, tvb, ioffset,
3932                             4, value1);
3933         ioffset = ioffset + 4;
3934         break;
3935     }
3936     return ioffset;
3937 }
3938
3939
3940 static void process_set_filter(proto_tree* , tvbuff_t*, packet_info*, nds_val*);
3941
3942 static void
3943 process_search_expression(proto_tree *it_tree, tvbuff_t *tvb, nds_val *values)
3944 {
3945     guint32     search_tag, ioffset;
3946     const char *search_string;
3947
3948     ioffset = values->voffset;
3949     search_tag = tvb_get_letohl(tvb, ioffset); /* Get next search operation tag */
3950     search_string = match_strval(search_tag, itersearchenum);
3951     if(search_string == NULL)
3952     {
3953         search_string = "(No Search Operation Type Found!)";
3954     }
3955     proto_tree_add_uint_format(it_tree, hf_iter_search, tvb, ioffset, 4,
3956                                search_tag, "Search Operation Type: %d, (0x%04x), %s",
3957                                search_tag, search_tag, search_string);
3958     ioffset += 4;
3959     switch (search_tag)
3960     {
3961     case NDS_SEARCH_EQUAL:
3962     case NDS_SEARCH_GREATER_OR_EQUAL:
3963     case NDS_SEARCH_LESS_OR_EQUAL:
3964     case NDS_SEARCH_APPROX:
3965     case NDS_SEARCH_ATTR_FLAGS:
3966     case NDS_SEARCH_ATTR_HAS_FLAG:
3967         /* start of DCWPutAttribute */
3968         values->vvalue = tvb_get_letohl(tvb, ioffset);
3969         ioffset = ioffset + 4;
3970         values->vstring = get_string(tvb, ioffset, values->vvalue);
3971         proto_tree_add_string(it_tree, hf_mv_string, tvb, ioffset,
3972                               values->vvalue, values->vstring);
3973         ioffset += values->vvalue;
3974         /* end of DCWPutAttribute */
3975
3976         ioffset += align_4(tvb, ioffset);
3977
3978         /* start of DCWPutValue */
3979         values->vvalue = tvb_get_letohl(tvb, ioffset);
3980         values->vstring = match_strval(values->vvalue, nds_syntax);
3981         if (values->vstring == NULL)
3982         {
3983             values->vstring = "No Syntax Found";
3984         }
3985         proto_tree_add_string(it_tree, hf_nds_syntax, tvb, ioffset,
3986                                   4, values->vstring);
3987         ioffset = ioffset + 4;
3988         values->vvalue = tvb_get_letohl(tvb, ioffset);
3989         ioffset = ioffset + 4;
3990         values->vstring = get_string(tvb, ioffset, values->vvalue);
3991         proto_tree_add_string(it_tree, hf_mv_string, tvb, ioffset,
3992                               values->vvalue, values->vstring);
3993         ioffset += values->vvalue;
3994         /* end of DCWPutValue */
3995
3996         break;
3997     case NDS_SEARCH_PRESENT:
3998         /* start of DCWPutAttribute */
3999         values->vvalue = tvb_get_letohl(tvb, ioffset);
4000         ioffset = ioffset + 4;
4001         values->vstring = get_string(tvb, ioffset, values->vvalue);
4002         proto_tree_add_string(it_tree, hf_mv_string, tvb, ioffset,
4003                               values->vvalue, values->vstring);
4004         ioffset = ioffset + values->vvalue;
4005         /* end of DCWPutAttribute */
4006         break;
4007
4008     case NDS_SEARCH_RDN:
4009         /* print the relative distinguished name. This includes context info... */
4010 #if 0
4011         if (err = DCWPutRDN(context, cur, limit, item->data))
4012             return err;
4013 #endif
4014
4015         values->vvalue = tvb_get_letohl(tvb, ioffset);
4016         ioffset = ioffset + 4;
4017         values->vstring = get_string(tvb, ioffset, values->vvalue);
4018         proto_tree_add_string(it_tree, hf_mv_string, tvb, ioffset,
4019                               values->vvalue, values->vstring);
4020         ioffset += values->vvalue;
4021         break;
4022     case NDS_SEARCH_BASE_CLASS:
4023     case NDS_SEARCH_ENTRY_FLAGS:
4024     case NDS_SEARCH_ENTRY_HAS_FLAG:
4025     case NDS_SEARCH_VALUE_FLAGS:
4026     case NDS_SEARCH_VALUE_HAS_FLAG:
4027         /* start of DCWPutValue */
4028 #if 0
4029         values->vvalue = tvb_get_letohl(tvb, ioffset);
4030         values->vstring = match_strval(values->vvalue, nds_syntax);
4031         if (values->vstring == NULL)
4032         {
4033             values->vstring = "No Syntax Found";
4034         }
4035         proto_tree_add_string(it_tree, hf_nds_syntax, tvb, ioffset,
4036                               4, values->vstring);
4037         ioffset = ioffset + 4;
4038 #endif
4039         values->vvalue = tvb_get_letohl(tvb, ioffset);
4040         ioffset = ioffset + 4;
4041         values->vstring = get_string(tvb, ioffset, values->vvalue);
4042         proto_tree_add_string(it_tree, hf_mv_string, tvb, ioffset,
4043                               values->vvalue, values->vstring);
4044         ioffset += values->vvalue;
4045         /* end of DCWPutValue */
4046         break;
4047     case DCS_VALUE_GE_WITH_ATTR:        /* Deprecated, use DS_SEARCH_VALUE_MTS_GE */
4048     case NDS_SEARCH_VALUE_MTS_GE:
4049     case NDS_SEARCH_VALUE_MTS_G:
4050     case NDS_SEARCH_VALUE_MTS_LE:
4051     case NDS_SEARCH_VALUE_MTS_L:
4052     case NDS_SEARCH_VALUE_MTS_EQ:
4053     case NDS_SEARCH_VALUE_MTS_EQ_APPROX:
4054     case NDS_SEARCH_VALUE_CTS_GE:
4055     case NDS_SEARCH_VALUE_CTS_G:
4056     case NDS_SEARCH_VALUE_CTS_LE:
4057     case NDS_SEARCH_VALUE_CTS_L:
4058     case NDS_SEARCH_VALUE_CTS_EQ:
4059     case NDS_SEARCH_VALUE_CTS_EQ_APPROX:
4060         /* start of DCWPutAttribute */
4061         values->vvalue = tvb_get_letohl(tvb, ioffset);
4062         ioffset = ioffset + 4;
4063         values->vstring = get_string(tvb, ioffset, values->vvalue);
4064         proto_tree_add_string(it_tree, hf_mv_string, tvb, ioffset,
4065                               values->vvalue, values->vstring);
4066         ioffset += values->vvalue;
4067         /* end of DCWPutAttribute */
4068
4069         ioffset += align_4(tvb, ioffset);
4070
4071         /* start of DCWPutValue */
4072         values->vvalue = tvb_get_letohl(tvb, ioffset);
4073         values->vstring = match_strval(values->vvalue, nds_syntax);
4074         if (values->vstring == NULL)
4075             {
4076                 values->vstring = "No Syntax Found";
4077             }
4078         proto_tree_add_string(it_tree, hf_nds_syntax, tvb, ioffset,
4079                               4, values->vstring);
4080         ioffset = ioffset + 4;
4081         values->vvalue = tvb_get_letohl(tvb, ioffset);
4082         ioffset = ioffset + 4;
4083         values->vstring = get_string(tvb, ioffset, values->vvalue);
4084         proto_tree_add_string(it_tree, hf_mv_string, tvb, ioffset,
4085                               values->vvalue, values->vstring);
4086         ioffset += values->vvalue;
4087         /* end of DCWPutValue */
4088         break;
4089     case DCS_MOD_GE_WITH_ATTR:        /* Deprecated, use DS_SEARCH_ENTRY_MTS */
4090     case NDS_SEARCH_ENTRY_MTS_GE:
4091     case NDS_SEARCH_ENTRY_MTS_G:
4092     case NDS_SEARCH_ENTRY_MTS_LE:
4093     case NDS_SEARCH_ENTRY_MTS_L:
4094     case NDS_SEARCH_ENTRY_MTS_EQ:
4095     case NDS_SEARCH_ENTRY_MTS_EQ_APPROX:
4096     case NDS_SEARCH_ENTRY_CTS_GE:
4097     case NDS_SEARCH_ENTRY_CTS_G:
4098     case NDS_SEARCH_ENTRY_CTS_LE:
4099     case NDS_SEARCH_ENTRY_CTS_L:
4100     case NDS_SEARCH_ENTRY_CTS_EQ:
4101     case NDS_SEARCH_ENTRY_CTS_EQ_APPROX:
4102         /* start of DCWPutAttribute */
4103         values->vvalue = tvb_get_letohl(tvb, ioffset);
4104         ioffset = ioffset + 4;
4105         values->vstring = get_string(tvb, ioffset, values->vvalue);
4106         proto_tree_add_string(it_tree, hf_mv_string, tvb, ioffset,
4107                               values->vvalue, values->vstring);
4108         ioffset += values->vvalue;
4109         /* end of DCWPutAttribute */
4110
4111         ioffset += align_4(tvb, ioffset);
4112
4113         /* start of DCWPutValue */
4114         values->vvalue = tvb_get_letohl(tvb, ioffset);
4115         values->vstring = match_strval(values->vvalue, nds_syntax);
4116         if (values->vstring == NULL)
4117         {
4118             values->vstring = "No Syntax Found";
4119         }
4120         proto_tree_add_string(it_tree, hf_nds_syntax, tvb, ioffset,
4121                               4, values->vstring);
4122         ioffset = ioffset + 4;
4123         values->vvalue = tvb_get_letohl(tvb, ioffset);
4124         ioffset = ioffset + 4;
4125         values->vstring = get_string(tvb, ioffset, values->vvalue);
4126         proto_tree_add_string(it_tree, hf_mv_string, tvb, ioffset,
4127                               values->vvalue, values->vstring);
4128         ioffset += values->vvalue;
4129         /* end of DCWPutValue */
4130
4131         break;
4132     case NDS_SEARCH_EID:
4133     case NDS_SEARCH_ENTRY_SUBCOUNT_GE:
4134     case NDS_SEARCH_ENTRY_SUBCOUNT_G:
4135     case NDS_SEARCH_ENTRY_SUBCOUNT_LE:
4136     case NDS_SEARCH_ENTRY_SUBCOUNT_L:
4137     case NDS_SEARCH_ENTRY_SUBCOUNT_EQ:
4138         /* start of DCWPutValue */
4139         values->vvalue = tvb_get_letohl(tvb, ioffset);
4140         values->vstring = match_strval(values->vvalue, nds_syntax);
4141         if (values->vstring == NULL)
4142         {
4143             values->vstring = "No Syntax Found";
4144         }
4145         proto_tree_add_string(it_tree, hf_nds_syntax, tvb, ioffset,
4146                               4, values->vstring);
4147         ioffset = ioffset + 4;
4148         values->vvalue = tvb_get_letohl(tvb, ioffset);
4149         ioffset = ioffset + 4;
4150         values->vstring = get_string(tvb, ioffset, values->vvalue);
4151         proto_tree_add_string(it_tree, hf_mv_string, tvb, ioffset,
4152                               values->vvalue, values->vstring);
4153         ioffset += values->vvalue;
4154         /* end of DCWPutValue */
4155
4156         break;
4157
4158     default: /* Unknown Iteration search Item type */
4159         if (tvb_length_remaining(tvb, ioffset) < 4) {
4160                 THROW(ReportedBoundsError);
4161         }
4162         break;
4163     }
4164     ioffset += align_4(tvb, ioffset);
4165     values->voffset = ioffset;
4166     return;
4167 }
4168
4169 static void
4170 process_search_subexpression(proto_tree *it_tree, tvbuff_t *tvb, packet_info *pinfo, nds_val *values)
4171 {
4172     proto_tree  *it_subtree, *it_subtree1;
4173     proto_item  *it_subitem, *it_subitem1;
4174     guint32     i, ioffset, number_of_items;
4175
4176     ioffset = values->voffset;
4177     if (values->vvalue != NDS_SEARCH_NOT) {
4178         number_of_items = tvb_get_letohl(tvb, ioffset);
4179         it_subitem = proto_tree_add_item(it_tree, hf_this_count, tvb, ioffset, 4, TRUE);
4180         it_subtree = proto_item_add_subtree(it_subitem, ett_nds);
4181         ioffset += 4;
4182         for (i = 0; i < number_of_items; i++)
4183         {
4184             it_subitem1 = proto_tree_add_text(it_subtree, tvb, ioffset, -1, "Item #: %u", i+1);
4185             it_subtree1 = proto_item_add_subtree(it_subitem1, ett_nds);
4186
4187             values->voffset = ioffset;
4188             process_set_filter(it_subtree1, tvb, pinfo, values);
4189             ioffset = values->voffset;
4190
4191             if (tvb_length_remaining(tvb, ioffset) < 4) {
4192                 THROW(ReportedBoundsError);
4193                 break;
4194             }
4195
4196         }
4197     }
4198     values->voffset = ioffset;
4199     return;
4200 }
4201
4202 static void
4203 process_search_match(proto_tree *it_tree, tvbuff_t *tvb, nds_val *values)
4204 {
4205     guint32     ioffset;
4206
4207     ioffset = values->voffset;
4208
4209     values->vvalue = tvb_get_letohl(tvb, ioffset);
4210     ioffset += 4;
4211     proto_tree_add_item(it_tree, hf_nds_oid, tvb, ioffset, values->vvalue, TRUE);
4212     ioffset += values->vvalue;
4213
4214     ioffset += align_4(tvb, ioffset);
4215
4216     proto_tree_add_item(it_tree, hf_iter_ans, tvb, ioffset, 4, TRUE);
4217     ioffset += 4;
4218
4219     ioffset += align_4(tvb, ioffset);
4220
4221     /* start of DCWPutAttribute */
4222     values->vvalue = tvb_get_letohl(tvb, ioffset);
4223     ioffset = ioffset + 4;
4224     values->vstring = get_string(tvb, ioffset, values->vvalue);
4225     proto_tree_add_string(it_tree, hf_mv_string, tvb, ioffset,
4226             values->vvalue, values->vstring);
4227     ioffset = ioffset + values->vvalue;
4228     /* end of DCWPutAttribute */
4229
4230     ioffset += align_4(tvb, ioffset);
4231
4232     /* start of DCWPutValue */
4233     values->vvalue = tvb_get_letohl(tvb, ioffset);
4234     values->vstring = match_strval(values->vvalue, nds_syntax);
4235     if (values->vstring == NULL)
4236     {
4237         values->vstring = "No Syntax Found";
4238     }
4239     proto_tree_add_string(it_tree, hf_nds_syntax, tvb, ioffset,
4240     4, values->vstring);
4241     ioffset = ioffset + 4;
4242     values->vvalue = tvb_get_letohl(tvb, ioffset);
4243     ioffset = ioffset + 4;
4244     values->vstring = get_string(tvb, ioffset, values->vvalue);
4245     proto_tree_add_string(it_tree, hf_mv_string, tvb, ioffset,
4246                           values->vvalue, values->vstring);
4247     ioffset += values->vvalue;
4248     /* end of DCWPutValue */
4249
4250     ioffset += align_4(tvb, ioffset);
4251
4252     values->voffset = ioffset;
4253     return;
4254 }
4255
4256 static void
4257 process_set_filter(proto_tree *it_tree, tvbuff_t *tvb, packet_info *pinfo, nds_val *values)
4258 {
4259     guint32     search_tag, ioffset = values->voffset;
4260     const char *search_string;
4261
4262     search_tag = tvb_get_letohl(tvb, ioffset);
4263     search_string = match_strval(search_tag, itersearchenum);
4264     if(search_string == NULL)
4265     {
4266         search_string = "(No Search Tag Found)";
4267     }
4268     proto_tree_add_uint_format(it_tree, hf_iter_search, tvb, ioffset, 4,
4269         search_tag, "Type of Search: Tag = %d, (0x%04x), %s",
4270         search_tag, search_tag, search_string);
4271     ioffset += 4;
4272     values->voffset = ioffset;
4273
4274     switch (search_tag)
4275     {
4276     case NDS_SEARCH_ITEM:
4277         /* DCWPutSearchExp */
4278         process_search_expression(it_tree, tvb, values);
4279         break;
4280
4281     case NDS_SEARCH_EXTENSIBLE:
4282 #if 0
4283         err = DCWPutSearchExtMatch(context, syncFormat, cur, limit, sexp->u.extMatch);
4284 #endif
4285         process_search_match(it_tree, tvb, values);
4286         break;
4287
4288     case NDS_SEARCH_OR:
4289     case NDS_SEARCH_AND:
4290     case NDS_SEARCH_NOT:
4291         /* DCWPutSearchSubExp = process_search_subexpression */
4292         process_search_subexpression(it_tree, tvb, pinfo, values);
4293         break;
4294     default: /* Unknown Iteration search type */
4295         if (tvb_length_remaining(tvb, ioffset) < 4) {
4296             THROW(ReportedBoundsError);
4297         }
4298         break;
4299     }
4300     ioffset = values->voffset;
4301     return;
4302 }
4303
4304 static void
4305 process_entry_info(proto_tree *it_tree, tvbuff_t *tvb, nds_val *values)
4306 {
4307     guint32     iter_flags, ioffset = values->voffset;
4308     guint16     replica_num, event_num;
4309     nstime_t    ns;
4310
4311     values->vstring = NULL;
4312     ioffset += align_4(tvb, ioffset);
4313     iter_flags = tvb_get_letohl(tvb, ioffset);
4314
4315
4316     if (iter_flags & DSI_OUTPUT_FIELDS) { /* Output Flags */
4317         values->vvalue = tvb_get_letohs(tvb, ioffset);
4318         values->vdesc = "Return Information Flags (low) Byte:";
4319         values->vlength = 2;
4320         values->hfname = hf_nds_rflags;
4321         values->voffset = ioffset;
4322         values->bit1 = "Output Flags";
4323         values->bit1hfname = hf_bit1infoflagsl;
4324         values->bit2 = "Entry ID";
4325         values->bit2hfname = hf_bit2infoflagsl;
4326         values->bit3 = "Entry Flags";
4327         values->bit3hfname = hf_bit3infoflagsl;
4328         values->bit4 = "Subordinate Count";
4329         values->bit4hfname = hf_bit4infoflagsl;
4330         values->bit5 = "Modification Time";
4331         values->bit5hfname = hf_bit5infoflagsl;
4332         values->bit6 = "Modification Timestamp";
4333         values->bit6hfname = hf_bit6infoflagsl;
4334         values->bit7 = "Creation Timestamp";
4335         values->bit7hfname = hf_bit7infoflagsl;
4336         values->bit8 = "Partition Root ID";
4337         values->bit8hfname = hf_bit8infoflagsl;
4338         values->bit9 = "Parent ID";
4339         values->bit9hfname = hf_bit9infoflagsl;
4340         values->bit10 = "Revision Count";
4341         values->bit10hfname = hf_bit10infoflagsl;
4342         values->bit11 = "Replica Type";
4343         values->bit11hfname = hf_bit11infoflagsl;
4344         values->bit12 = "Base Class";
4345         values->bit12hfname = hf_bit12infoflagsl;
4346         values->bit13 = "Relative Distinguished Name";
4347         values->bit13hfname = hf_bit13infoflagsl;
4348         values->bit14 = "Distinguished Name";
4349         values->bit14hfname = hf_bit14infoflagsl;
4350         values->bit15 = "Root Distinguished Name";
4351         values->bit15hfname = hf_bit15infoflagsl;
4352         values->bit16 = "Parent Distinguished Name";
4353         values->bit16hfname = hf_bit16infoflagsl;
4354         process_bitfield(it_tree, tvb, values);
4355         ioffset = ioffset+2;
4356
4357         values->vvalue = tvb_get_letohs(tvb, ioffset);
4358         values->vtype = VTYPE_BITFIELD;
4359         values->vdesc = "Return Information Flags (high) Byte:";
4360         values->vlength = 2;
4361         values->hfname= hf_nds_rflags;
4362         values->voffset = ioffset;
4363         values->bit1 = "Purge Time";
4364         values->bit1hfname = hf_bit1infoflagsh;
4365         values->bit2 = "Dereference Base Class";
4366         values->bit2hfname = hf_bit2infoflagsh;
4367         values->bit3 = "Replica Number";
4368         values->bit3hfname = hf_bit3infoflagsh;
4369         values->bit4 = "Replica State";
4370         values->bit4hfname = hf_bit4infoflagsh;
4371         values->bit5 = "Federation Boundary";
4372         values->bit5hfname = hf_bit5infoflagsh;
4373         values->bit6 = "Schema Boundary";
4374         values->bit6hfname = hf_bit6infoflagsh;
4375         values->bit7 = "Federation Boundary ID";
4376         values->bit7hfname = hf_bit7infoflagsh;
4377         values->bit8 = "Schema Boundary ID";
4378         values->bit8hfname = hf_bit8infoflagsh;
4379         values->bit9 = "Current Subcount";
4380         values->bit9hfname = hf_bit9infoflagsh;
4381         values->bit10 = "Local Entry Flags";
4382         values->bit10hfname = hf_bit10infoflagsh;
4383         values->bit11 = "Not Defined";
4384         values->bit11hfname = hf_bit11infoflagsh;
4385         values->bit12 = "Not Defined";
4386         values->bit12hfname = hf_bit12infoflagsh;
4387         values->bit13 = "Not Defined";
4388         values->bit13hfname = hf_bit13infoflagsh;
4389         values->bit14 = "Not Defined";
4390         values->bit14hfname = hf_bit14infoflagsh;
4391         values->bit15 = "Not Defined";
4392         values->bit15hfname = hf_bit15infoflagsh;
4393         values->bit16 = "Not Defined";
4394         values->bit16hfname = hf_bit16infoflagsh;
4395         process_bitfield(it_tree, tvb, values);
4396         ioffset = ioffset+2;
4397     }
4398     if (iter_flags & DSI_ENTRY_ID) { /* Entry ID */
4399         values->vvalue = tvb_get_letohl(tvb, ioffset);
4400         proto_tree_add_uint_format(it_tree, hf_nds_eid, tvb, ioffset,
4401                 4, values->vvalue, "Entry ID 0x%08x", values->vvalue);
4402         ioffset = ioffset + 4;
4403     }
4404     if (iter_flags & DSI_ENTRY_FLAGS) { /* Entry Flags */
4405         values->vvalue = tvb_get_letohl(tvb, ioffset);
4406         values->vtype = VTYPE_BITFIELD;
4407         values->vdesc = "Entry Flags:";
4408         values->vlength = 2;
4409         values->hfname= hf_nds_eflags;
4410         values->voffset = ioffset;
4411         values->bit1 = "Alias Entry";
4412         values->bit1hfname = hf_bit1eflags;
4413         values->bit2 = "Partition Root";
4414         values->bit2hfname = hf_bit2eflags;
4415         values->bit3 = "Container Entry";
4416         values->bit3hfname = hf_bit3eflags;
4417         values->bit4 = "Container Alias";
4418         values->bit4hfname = hf_bit4eflags;
4419         values->bit5 = "Matches List Filter";
4420         values->bit5hfname = hf_bit5eflags;
4421         values->bit6 = "Reference Entry";
4422         values->bit6hfname = hf_bit6eflags;
4423         values->bit7 = "40x Reference Entry";
4424         values->bit7hfname = hf_bit7eflags;
4425         values->bit8 = "Back Linked";
4426         values->bit8hfname = hf_bit8eflags;
4427         values->bit9 = "New Entry";
4428         values->bit9hfname = hf_bit9eflags;
4429         values->bit10 = "Temporary Reference";
4430         values->bit10hfname = hf_bit10eflags;
4431         values->bit11 = "Audited";
4432         values->bit11hfname = hf_bit11eflags;
4433         values->bit12 = "Entry Not Present";
4434         values->bit12hfname = hf_bit12eflags;
4435         values->bit13 = "Entry Verify CTS";
4436         values->bit13hfname = hf_bit13eflags;
4437         values->bit14 = "Entry Damaged";
4438         values->bit14hfname = hf_bit14eflags;
4439         values->bit15 = "Not Defined";
4440         values->bit15hfname = hf_bit15eflags;
4441         values->bit16 = "Not Defined";
4442         values->bit16hfname = hf_bit16eflags;
4443         process_bitfield(it_tree, tvb, values);
4444         ioffset = ioffset+4;
4445     }
4446     if (iter_flags & DSI_SUBORDINATE_COUNT) { /* Subordinate Count */
4447         proto_tree_add_item(it_tree, hf_sub_count, tvb, ioffset, 4, TRUE);
4448         ioffset += 4;
4449     }
4450     if (iter_flags & DSI_MODIFICATION_TIME) { /* Modification Time */
4451         ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
4452         ns.nsecs = 0;
4453         proto_tree_add_time_format(it_tree, hf_es_seconds, tvb, ioffset,
4454                 4, &ns, "Modification Time: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
4455         ioffset = ioffset + 4;
4456     }
4457     if (iter_flags & DSI_MODIFICATION_TIMESTAMP) { /* Modification Timestamp */
4458         ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
4459         ns.nsecs = 0;
4460         proto_tree_add_time_format(it_tree, hf_es_seconds, tvb, ioffset,
4461                 4, &ns, "Modification Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
4462         ioffset = ioffset + 4;
4463         replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
4464         proto_tree_add_item(it_tree, hf_nds_replica_num, tvb, ioffset,
4465                 2, replica_num);
4466         ioffset = ioffset + 2;
4467         event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
4468         proto_tree_add_item(it_tree, hf_nds_event_num, tvb, ioffset,
4469                 2, event_num);
4470         ioffset = ioffset + 2;
4471     }
4472     if (iter_flags & DSI_CREATION_TIMESTAMP) { /* Creation Timestamp */
4473         ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
4474         ns.nsecs = 0;
4475         proto_tree_add_time_format(it_tree, hf_es_seconds, tvb, ioffset,
4476                 4, &ns, "Creation Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
4477         ioffset = ioffset + 4;
4478         replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
4479         proto_tree_add_item(it_tree, hf_nds_replica_num, tvb, ioffset,
4480                 2, replica_num);
4481         ioffset = ioffset + 2;
4482         event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
4483         proto_tree_add_item(it_tree, hf_nds_event_num, tvb, ioffset,
4484                 2, event_num);
4485         ioffset = ioffset + 2;
4486     }
4487     if (iter_flags & DSI_PARTITION_ROOT_ID) { /* Partition Root ID */
4488         values->vvalue = tvb_get_letohl(tvb, ioffset);
4489         proto_tree_add_uint_format(it_tree, hf_nds_local_partition, tvb, ioffset,
4490                 4, values->vvalue, "Partition Root ID %08x", values->vvalue);
4491         ioffset = ioffset + 4;
4492     }
4493     if (iter_flags & DSI_PARENT_ID) { /* Parent ID */
4494         values->vvalue = tvb_get_letohl(tvb, ioffset);
4495         proto_tree_add_uint_format(it_tree, hf_nds_local_partition, tvb, ioffset,
4496                 4, values->vvalue, "Parent ID %08x", values->vvalue);
4497         ioffset = ioffset + 4;
4498     }
4499     if (iter_flags & DSI_REVISION_COUNT) { /* Revision Count */
4500         values->vvalue = tvb_get_letohl(tvb, ioffset);
4501         proto_tree_add_uint_format(it_tree, hf_nds_local_partition, tvb, ioffset,
4502                 4, values->vvalue, "Revision count %08x", values->vvalue);
4503         ioffset = ioffset + 4;
4504     }
4505     if (iter_flags & DSI_REPLICA_TYPE) { /* Replica Type */
4506         values->vvalue = tvb_get_letohl(tvb, ioffset) & 0x00ff;
4507         values->vstring = match_strval(values->vvalue, nds_replica_type);
4508         if (values->vstring == NULL)
4509         {
4510             values->vstring = "No Replica Type Found";
4511         }
4512         proto_tree_add_string(it_tree, hf_replica_type, tvb, ioffset,
4513         4, values->vstring);
4514         values->vvalue = tvb_get_letohl(tvb, ioffset) & 0xff00;
4515         values->vstring = match_strval(values->vvalue, nds_replica_state);
4516         if (values->vstring == NULL)
4517         {
4518             values->vstring = "No Replica State Found";
4519         }
4520         proto_tree_add_string(it_tree, hf_replica_state, tvb, ioffset,
4521         4, values->vstring);
4522         ioffset = ioffset + 4;
4523     }
4524     if (iter_flags & DSI_BASE_CLASS) { /* Base Class */
4525         values->vvalue = tvb_get_letohl(tvb, ioffset);         /* Length of string */
4526         ioffset = ioffset+4;
4527         values->vstring = get_string(tvb, ioffset, values->vvalue);
4528         proto_tree_add_string_format(it_tree, hf_value_string, tvb, ioffset,
4529                 values->vvalue, values->vstring,
4530                 "Base Class: - %s", values->vstring);
4531         ioffset = ioffset+values->vvalue;
4532         ioffset += align_4(tvb, ioffset);
4533     }
4534     if (iter_flags & DSI_ENTRY_RDN) { /* Relative Distiguished Name */
4535         values->vvalue = tvb_get_letohl(tvb, ioffset);         /* Length of string */
4536         ioffset = ioffset+4;
4537         values->vstring = get_string(tvb, ioffset, values->vvalue);
4538         proto_tree_add_string_format(it_tree, hf_value_string, tvb, ioffset,
4539                  values->vvalue, values->vstring,
4540                  "Relative Distinguished Name - %s", values->vstring);
4541         ioffset = ioffset+values->vvalue;
4542         ioffset += align_4(tvb, ioffset);
4543     }
4544     if (iter_flags & DSI_ENTRY_DN) { /* Distinguished Name */
4545         values->vvalue = tvb_get_letohl(tvb, ioffset);         /* Length of string */
4546         ioffset = ioffset+4;
4547         values->vstring = get_string(tvb, ioffset, values->vvalue);
4548         proto_tree_add_string_format(it_tree, hf_value_string, tvb, ioffset,
4549                  values->vvalue, values->vstring,
4550                  "Distinguished Name - %s", values->vstring);
4551         ioffset = ioffset+values->vvalue;
4552         ioffset += align_4(tvb, ioffset);
4553     }
4554     if (iter_flags & DSI_PARTITION_ROOT_DN) { /* Root Distinguished Name */
4555         values->vvalue = tvb_get_letohl(tvb, ioffset);         /* Length of string */
4556         ioffset = ioffset+4;
4557         values->vstring = get_string(tvb, ioffset, values->vvalue);
4558         proto_tree_add_string_format(it_tree, hf_value_string, tvb, ioffset,
4559                  values->vvalue, values->vstring,
4560                  "Root Distinguished Name - %s", values->vstring);
4561         ioffset = ioffset+values->vvalue;
4562         ioffset += align_4(tvb, ioffset);
4563     }
4564     if (iter_flags & DSI_PARENT_DN) { /* Parent Distinguished Name */
4565         values->vvalue = tvb_get_letohl(tvb, ioffset);         /* Length of string */
4566         ioffset = ioffset+4;
4567         values->vstring = get_string(tvb, ioffset, values->vvalue);
4568         proto_tree_add_string_format(it_tree, hf_value_string, tvb, ioffset,
4569                  values->vvalue, values->vstring,
4570                  "Parent Distinguished Name - %s", values->vstring);
4571         ioffset = ioffset+values->vvalue;
4572         ioffset += align_4(tvb, ioffset);
4573     }
4574     if (iter_flags & DSI_PURGE_TIME) { /* Purge Time */
4575         ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
4576         ns.nsecs = 0;
4577         proto_tree_add_time_format(it_tree, hf_nds_purge, tvb, ioffset,
4578                 4, &ns, "Purge Time: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
4579         ioffset = ioffset + 4;
4580     }
4581     if (iter_flags & DSI_DEREFERENCED_BASE_CLASS) { /* Dereference Base Class */
4582         values->vvalue = tvb_get_letohl(tvb, ioffset);
4583         ioffset = ioffset + 4;
4584         values->vstring = get_string(tvb, ioffset, values->vvalue);
4585         proto_tree_add_string(it_tree, hf_deref_base, tvb, ioffset,
4586                 values->vvalue, values->vstring);
4587         ioffset = ioffset + values->vvalue;
4588     }
4589     if (iter_flags & DSI_REPLICA_NUMBER) { /* Replica Number */
4590         values->vvalue = tvb_get_letohl(tvb, ioffset); /* Replica number */
4591         proto_tree_add_uint_format(it_tree, hf_replica_number, tvb, ioffset,
4592                  4, values->vvalue, "Replica Number %d", values->vvalue);
4593         ioffset = ioffset+4;
4594     }
4595     if (iter_flags & DSI_REPLICA_STATE) { /* Replica State */
4596         values->vvalue = tvb_get_letohl(tvb, ioffset) & 0xff00;
4597         values->vstring = match_strval(values->vvalue, nds_replica_state);
4598         if (values->vstring == NULL)
4599         {
4600             values->vstring = "No Replica State Found";
4601         }
4602         proto_tree_add_string(it_tree, hf_replica_state, tvb, ioffset,
4603         4, values->vstring);
4604         ioffset = ioffset + 2;
4605     }
4606     if (iter_flags & DSI_FEDERATION_BOUNDARY) { /* Federation Boundary */
4607         values->vvalue = tvb_get_letohl(tvb, ioffset);
4608         proto_tree_add_uint_format(it_tree, hf_nds_uint32value, tvb, ioffset,
4609                 4, values->vvalue, "Federation Boundary %d", values->vvalue);
4610         ioffset = ioffset+4;
4611     }
4612     if (iter_flags & DSI_SCHEMA_BOUNDARY) { /* Schema Boundary */
4613         values->vvalue = tvb_get_letohl(tvb, ioffset);
4614         proto_tree_add_uint_format(it_tree, hf_nds_uint32value, tvb, ioffset,
4615                 4, values->vvalue, "Schema Boundary %d", values->vvalue);
4616         ioffset = ioffset+4;
4617     }
4618     if (iter_flags & DSI_FEDERATION_BOUNDARY_ID) { /* Federation Boundary ID */
4619         values->vvalue = tvb_get_letohl(tvb, ioffset);
4620         proto_tree_add_uint_format(it_tree, hf_nds_uint32value, tvb, ioffset,
4621                 4, values->vvalue, "Federation Boundary ID %d", values->vvalue);
4622         ioffset = ioffset+4;
4623     }
4624     if (iter_flags & DSI_SCHEMA_BOUNDARY_ID) { /* Schema Boundary ID*/
4625         values->vvalue = tvb_get_letohl(tvb, ioffset);
4626         proto_tree_add_uint_format(it_tree, hf_nds_uint32value, tvb, ioffset,
4627                 4, values->vvalue, "Schema Boundary ID %d", values->vvalue);
4628         ioffset = ioffset+4;
4629     }
4630     if (iter_flags & DSI_CUR_SUBCOUNT) { /* Current Subcount */
4631         values->vvalue = tvb_get_letohl(tvb, ioffset);
4632         proto_tree_add_uint_format(it_tree, hf_nds_uint32value, tvb, ioffset,
4633                 4, values->vvalue, "Current Subcount %d", values->vvalue);
4634         ioffset = ioffset+4;
4635     }
4636     if (iter_flags & DSI_LOCAL_ENTRY_FLAGS) { /* Local Entry Flags */
4637         values->vvalue = tvb_get_letohl(tvb, ioffset);
4638         values->vtype = VTYPE_BITFIELD;
4639         values->vdesc = "Local Entry Flags:";
4640         values->vlength = 2;
4641         values->hfname= hf_nds_eflags;
4642         values->voffset = ioffset;
4643         values->bit1 = "Alias Entry";
4644         values->bit1hfname = hf_bit1eflags;
4645         values->bit2 = "Partition Root";
4646         values->bit2hfname = hf_bit2eflags;
4647         values->bit3 = "Container Entry";
4648         values->bit3hfname = hf_bit3eflags;
4649         values->bit4 = "Container Alias";
4650         values->bit4hfname = hf_bit4eflags;
4651         values->bit5 = "Matches List Filter";
4652         values->bit5hfname = hf_bit5eflags;
4653         values->bit6 = "Reference Entry";
4654         values->bit6hfname = hf_bit6eflags;
4655         values->bit7 = "40x Reference Entry";
4656         values->bit7hfname = hf_bit7eflags;
4657         values->bit8 = "Back Linked";
4658         values->bit8hfname = hf_bit8eflags;
4659         values->bit9 = "New Entry";
4660         values->bit9hfname = hf_bit9eflags;
4661         values->bit10 = "Temporary Reference";
4662         values->bit10hfname = hf_bit10eflags;
4663         values->bit11 = "Audited";
4664         values->bit11hfname = hf_bit11eflags;
4665         values->bit12 = "Entry Not Present";
4666         values->bit12hfname = hf_bit12eflags;
4667         values->bit13 = "Entry Verify CTS";
4668         values->bit13hfname = hf_bit13eflags;
4669         values->bit14 = "Entry Damaged";
4670         values->bit14hfname = hf_bit14eflags;
4671         values->bit15 = "Not Defined";
4672         values->bit15hfname = hf_bit15eflags;
4673         values->bit16 = "Not Defined";
4674         values->bit16hfname = hf_bit16eflags;
4675         process_bitfield(it_tree, tvb, values);
4676         ioffset = ioffset+4;
4677     }
4678     values->voffset = ioffset;
4679     return;
4680 }
4681
4682 static void
4683 dissect_nds_iterator(proto_tree *it_tree, tvbuff_t *tvb, packet_info *pinfo, guint32 it_verb, guint32 request_flags, guint32 ioffset, gboolean request_reply)
4684 {
4685     guint32     rcode, i, number_of_items, number_to_get;
4686     const char  *error_string, *verb_string;
4687     nds_val     values;
4688     proto_tree  *it_subtree, *it_subtree1;
4689     proto_item  *it_subitem, *it_subitem1;
4690     proto_item  *expert_item;
4691
4692     values.vtype = 0;
4693     values.vvalue = 0;
4694     values.vlength = 0;
4695     values.voffset = 0;
4696     values.hfname = 0;
4697     values.vdesc = "";
4698     values.vstring = NULL;
4699     values.mvtype = 0;
4700     values.vflags = 0;
4701
4702
4703     while (TRUE) {
4704         verb_string = match_strval(it_verb, iterator_subverbs);
4705         if(verb_string == NULL)
4706         {
4707             verb_string = "(No Iteration Verb Found)";
4708         }
4709         it_subitem = proto_tree_add_uint_format(it_tree, hf_ncp_nds_iterverb, tvb, ioffset-4, 4,
4710             it_verb, "Iterator Verb: %d, (0x%04x), %s",
4711             it_verb, it_verb, verb_string);
4712
4713         it_subtree = proto_item_add_subtree(it_subitem, ett_nds);
4714
4715         if (request_reply) { /* Request packets */
4716             switch (it_verb) {
4717             case IT_ATFIRST:
4718             case IT_ATEOF:
4719             case IT_ATLAST:
4720             case IT_ATBOF:
4721             case IT_CLEAR:
4722             case IT_COPY:
4723                 break;
4724             case IT_COUNT:
4725                 proto_tree_add_item(it_subtree, hf_timelimit, tvb, ioffset, 4, TRUE);
4726                 ioffset += 4;
4727                 proto_tree_add_item(it_subtree, hf_max_entries, tvb, ioffset, 4, TRUE);
4728                 ioffset += 4;
4729                 proto_tree_add_item(it_subtree, hf_move_position, tvb, ioffset, 4, TRUE);
4730                 ioffset += 4;
4731                 break;
4732             case IT_CREATE:
4733             case IT_CURRENT:
4734             case IT_DESTROY:
4735             case IT_DONE:
4736                 break;
4737             case IT_FIRST:
4738                 proto_tree_add_item(it_subtree, hf_timelimit, tvb, ioffset, 4, TRUE);
4739                 ioffset += 4;
4740                 break;
4741             case IT_GETPOSITION:
4742             case IT_ISPOSITIONABLE:
4743                 break;
4744             case IT_LAST:
4745                 proto_tree_add_item(it_subtree, hf_timelimit, tvb, ioffset, 4, TRUE);
4746                 ioffset += 4;
4747                 break;
4748             case IT_NEXT:
4749             case IT_PREV:
4750                 proto_tree_add_item(it_subtree, hf_timelimit, tvb, ioffset, 4, TRUE);
4751                 ioffset += 4;
4752                 proto_tree_add_item(it_subtree, hf_num_to_get, tvb, ioffset, 4, TRUE);
4753                 ioffset += 4;
4754                 break;
4755             case IT_POSITION:
4756                 proto_tree_add_item(it_subtree, hf_iter_position, tvb, ioffset, 4, TRUE);
4757                 ioffset += 4;
4758                 proto_tree_add_item(it_subtree, hf_timelimit, tvb, ioffset, 4, TRUE);
4759                 ioffset += 4;
4760                 break;
4761             case IT_POSITION_IT:
4762                 proto_tree_add_item(it_subtree, hf_iter_other, tvb, ioffset, 4, TRUE);
4763                 ioffset += 4;
4764                 break;
4765             case IT_SETINDEX:
4766                 proto_tree_add_item(it_subtree, hf_nds_number_of_items, tvb, ioffset, 4, TRUE);
4767                 number_of_items = tvb_get_letohl(tvb, ioffset);
4768                 ioffset += 4;
4769                 for (i=0; i < number_of_items; i++) {
4770                     /* Process the attribute tag */
4771 #if 0
4772                     values.vvalue = tvb_get_letohl(tvb, ioffset);
4773                     values.vstring = match_strval(values.vvalue, nds_tags);
4774                     if(values.vstring == NULL)
4775                     {
4776                         values.vstring = "No Tags Set";
4777                     }
4778                     proto_tree_add_string(it_subtree, hf_nds_tag_string, tvb, ioffset, 4, values.vstring);
4779 #endif
4780                     proto_tree_add_item(it_subtree, hf_iter_index, tvb, ioffset, 4, TRUE);
4781                     ioffset = ioffset + 4;
4782
4783                     /* start of DCWPutAttribute */
4784 #if 0
4785                     values.vvalue = tvb_get_letohl(tvb, ioffset);
4786                     ioffset = ioffset + 4;
4787                     values.vstring = get_string(tvb, ioffset, values.vvalue);
4788                     proto_tree_add_string(it_subtree, hf_mv_string, tvb, ioffset,
4789                             values.vvalue, values.vstring);
4790                     ioffset = ioffset + values.vvalue;
4791 #endif
4792                     /* end of DCWPutAttribute */
4793
4794 #if 0
4795                     ioffset += align_4(tvb, ioffset);
4796 #endif
4797                     if (tvb_length_remaining(tvb, ioffset) < 4) {
4798                         THROW(ReportedBoundsError);
4799                         return;
4800                     }
4801                 }
4802                 break;
4803             case IT_SETFILTER:
4804
4805                 values.voffset = ioffset;
4806
4807                 /* DCWPutSearchExp  = process_set_filter() */
4808                 process_set_filter(it_subtree, tvb, pinfo, &values);
4809
4810                 ioffset = values.voffset;
4811                 ioffset += align_4(tvb, ioffset);
4812                 break;
4813             case IT_SKIP:
4814                 proto_tree_add_item(it_subtree, hf_timelimit, tvb, ioffset, 4, TRUE);
4815                 ioffset += 4;
4816                 proto_tree_add_item(it_subtree, hf_num_to_skip, tvb, ioffset, 4, TRUE);
4817                 ioffset += 4;
4818                 break;
4819             case IT_TYPEDOWN:
4820                 proto_tree_add_item(it_subtree, hf_num_to_get, tvb, ioffset, 4, TRUE);
4821                 number_to_get = tvb_get_letohl(tvb, ioffset);
4822                 ioffset += 4;
4823                 if (number_to_get == 0) {
4824                     values.vvalue = tvb_get_letohl(tvb, ioffset);
4825                     values.vstring = match_strval(values.vvalue, nds_tags);
4826                     if(values.vstring == NULL)
4827                     {
4828                         values.vstring = "No Tags Set";
4829                     }
4830                     proto_tree_add_string(it_tree, hf_nds_tag_string, tvb, ioffset, 4, values.vstring);
4831                     ioffset = ioffset + 4;
4832
4833                 }
4834                 values.vvalue = tvb_get_letohl(tvb, ioffset);
4835                 ioffset = ioffset + 4;
4836                 values.vstring = get_string(tvb, ioffset, values.vvalue);
4837                 proto_tree_add_string(it_subtree, hf_mv_string, tvb, ioffset,
4838                         values.vvalue, values.vstring);
4839                 ioffset = ioffset + values.vvalue;
4840                 ioffset += align_4(tvb, ioffset);
4841                 break;
4842             default:
4843                 if (tvb_length_remaining(tvb, ioffset) < 4) {
4844                     THROW(ReportedBoundsError);
4845                 }
4846                 return;
4847             }
4848         }
4849         else    /* Reply Packets */
4850         {                                           /* All replies include a completion code first */
4851             rcode = tvb_get_letohl(tvb, ioffset);
4852             error_string = match_strval(rcode, nds_reply_errors);
4853             if (error_string == NULL) {
4854                 error_string = "Unknown Interation Verb Completion Code";
4855             }
4856             expert_item = proto_tree_add_uint_format(it_subtree, hf_iter_verb_completion_code, tvb, ioffset,
4857                     4, rcode, "Completion Code: 0x%08x, %s",
4858                     rcode, error_string );
4859
4860             if (rcode != 0 && ncp_echo_err) {
4861                 expert_add_info_format(pinfo, expert_item, PI_RESPONSE_CODE, PI_ERROR, "Iteration Verb Error: 0x%08x %s", rcode, error_string);
4862             }
4863             ioffset += 4;
4864
4865             switch (it_verb) {
4866             case IT_ATFIRST:
4867             case IT_ATEOF:
4868             case IT_ATLAST:
4869             case IT_ATBOF:
4870                 proto_tree_add_item(it_subtree, hf_iter_ans, tvb, ioffset, 4, TRUE);
4871                 ioffset += 4;
4872                 break;
4873             case IT_CLEAR:
4874                 break;
4875             case IT_COPY:
4876                 proto_tree_add_item(it_subtree, hf_iter_copy, tvb, ioffset, 4, TRUE);
4877                 ioffset += 4;
4878                 break;
4879             case IT_COUNT:
4880                 proto_tree_add_item(it_subtree, hf_this_count, tvb, ioffset, 4, TRUE);
4881                 ioffset += 4;
4882                 break;
4883             case IT_CREATE:
4884                 proto_tree_add_item(it_subtree, hf_nds_iterator, tvb, ioffset, 4, TRUE);
4885                 ioffset += 4;
4886                 break;
4887             case IT_CURRENT:
4888             case IT_NEXT:
4889             case IT_PREV:
4890             case IT_FIRST:
4891             case IT_LAST:
4892                 values.vvalue = tvb_get_letohl(tvb, ioffset);
4893                 values.vstring = match_strval(values.vvalue, nds_info_type);
4894                 if(values.vstring == NULL)
4895                 {
4896                     values.vstring = "No Info Type Set";
4897                 }
4898                 proto_tree_add_string(it_subtree, hf_nds_info_type, tvb, ioffset, 4, values.vstring);
4899                 ioffset = ioffset + 4;
4900                 proto_tree_add_item(it_subtree, hf_data_size, tvb, ioffset, 4, TRUE);
4901                 ioffset += 4;
4902                 number_of_items = tvb_get_letohl(tvb, ioffset);
4903                 proto_tree_add_item(it_subtree, hf_this_count, tvb, ioffset, 4, TRUE);
4904                 ioffset += 4;
4905                 for (i = 0; i < number_of_items; i++)
4906                 {
4907                     it_subitem1 = proto_tree_add_text(it_subtree, tvb, ioffset, -1, "Item #: %u", i+1);
4908                     it_subtree1 = proto_item_add_subtree(it_subitem1, ett_nds);
4909
4910                     ioffset += align_4(tvb, ioffset);
4911
4912                     /* Start WGetAndBufferEntryInfo = process_entry_info() */
4913                     values.voffset = ioffset;
4914                     values.vflags = request_flags;
4915                     process_entry_info(it_subtree1, tvb, &values);
4916                     ioffset = values.voffset;
4917                     /* End WGetAndBufferEntryInfo */
4918
4919                     ioffset += align_4(tvb, ioffset);
4920
4921                     /* WGetReadBuffer - This seems to be a count and then size field (2 * guint32) */
4922                     /* For now we will just skip this offset. NEED TO ADD LOGIC TO HANDLE */
4923                     ioffset += 8;
4924
4925                     if (tvb_length_remaining(tvb, ioffset) < 4) {
4926                         break;
4927                     }
4928                 }
4929                 break;
4930             case IT_DESTROY:
4931             case IT_DONE:
4932                 break;
4933             case IT_GETPOSITION:
4934                 proto_tree_add_item(it_subtree, hf_iter_position, tvb, ioffset, 4, TRUE);
4935                 ioffset += 4;
4936                 break;
4937             case IT_ISPOSITIONABLE:
4938                 proto_tree_add_item(it_subtree, hf_positionable, tvb, ioffset, 4, TRUE);
4939                 ioffset += 4;
4940                 break;
4941             case IT_POSITION:
4942             case IT_POSITION_IT:
4943             case IT_SETFILTER:
4944             case IT_TYPEDOWN:
4945                 break;
4946             case IT_SETINDEX:
4947                 proto_tree_add_item(it_subtree, hf_iter_index, tvb, ioffset, 4, TRUE);
4948                 ioffset += 4;
4949                 break;
4950             case IT_SKIP:
4951                 proto_tree_add_item(it_subtree, hf_num_skipped, tvb, ioffset, 4, TRUE);
4952                 ioffset += 4;
4953                 break;
4954             default:
4955                 if (tvb_length_remaining(tvb, ioffset) < 4) {
4956                     THROW(ReportedBoundsError);
4957                 }
4958                 return;
4959             }
4960         }
4961         it_verb = tvb_get_letohl(tvb, ioffset);
4962         ioffset += 4;
4963         if (it_verb == IT_DONE || tvb_length_remaining(tvb, ioffset) < 4) {
4964             verb_string = match_strval(it_verb, iterator_subverbs);
4965             if(verb_string == NULL)
4966             {
4967                 verb_string = "Internal error processing NDS iteration verbs";
4968             }
4969             it_subitem = proto_tree_add_uint_format(it_tree, hf_ncp_nds_iterverb, tvb, ioffset-4, 4,
4970                 it_verb, "Iterator Verb: %d, (0x%04x), %s",
4971                 it_verb, it_verb, verb_string);
4972             break;
4973         }
4974     }
4975     return;
4976 }
4977
4978
4979 static void
4980 process_multivalues(proto_tree *ncp_tree, tvbuff_t *tvb, packet_info *pinfo, nds_val *values)
4981 {
4982     guint32         i;
4983     guint32         r;
4984     guint32         ioffset = 0, oldioffset;
4985     guint32         value1 = 0;
4986     guint32         value2 = 0;
4987     guint8          value3 = 0;
4988     guint32         value4 = 0;
4989     gint            value5 = 0;
4990     guint32         value6 = 0;
4991     guint32         value7 = 0;
4992     const char      *valuestr = "";
4993     proto_tree      *ntree;
4994     proto_tree      *atree;
4995     proto_item      *nitem;
4996     proto_item      *aitem;
4997     guint32         number_of_referrals = 0;
4998     proto_tree      *estree;
4999     proto_item      *esitem;
5000     guint16         replica_num = 0;
5001     guint16         event_num = 0;
5002     guint32         bvalue=0;
5003     nds_val         temp_values;
5004     proto_tree      *sub1tree;
5005     proto_item      *sub1item;
5006     proto_tree      *sub2tree;
5007     proto_item      *sub2item;
5008     gint            length_remaining;
5009     nstime_t        ns;
5010
5011     mv_resolve_name_string[0] = '\0';
5012     values->vstring = "";
5013
5014     /* Is the value passed a string or UINT32? */
5015     if(values->mvtype != MVTYPE_LIST_PARTITIONS && values->mvtype != MVTYPE_PROCESS_TAGS)
5016     {
5017         nitem = proto_tree_add_uint_format(ncp_tree, values->hfname, tvb, values->voffset+ioffset,
5018                                            values->vlength, values->vvalue, values->vdesc, values->vvalue);
5019     }
5020     else
5021     {
5022         nitem = proto_tree_add_string_format(ncp_tree, values->hfname, tvb, values->voffset+ioffset,
5023                                              values->vlength, values->vdesc, "%s", values->vdesc);
5024     }
5025     ioffset = (values->voffset+4);
5026
5027     ntree = proto_item_add_subtree(nitem, ett_nds);
5028
5029     switch (values->mvtype)
5030     {
5031     case MVTYPE_ATTR_REQUEST:   /* Attribute Request */
5032         for (i = 1 ; i <= values->vvalue; i++ )
5033         {
5034             ioffset += align_4(tvb, ioffset);
5035             value1 = tvb_get_letohl(tvb, ioffset);
5036             ioffset = ioffset + 4;
5037             values->vstring = get_string(tvb, ioffset, value1);
5038             proto_tree_add_string(ntree, hf_mv_string, tvb, ioffset,
5039                                   value1, values->vstring);
5040             ioffset = ioffset + value1;
5041         }
5042         break;
5043
5044     case MVTYPE_ATTR_REPLY:     /* Attribute Reply */
5045         switch(values->vflags)
5046         {
5047         case 0:
5048             for (i = 1 ; i <= values->vvalue; i++ )
5049             {
5050                 ioffset += align_4(tvb, ioffset);
5051                 value1 = tvb_get_letohl(tvb, ioffset);
5052                 ioffset = ioffset + 4;
5053                 values->vstring = get_string(tvb, ioffset, value1);
5054                 proto_tree_add_string(ntree, hf_mv_string, tvb, ioffset,
5055                                       value1, values->vstring);
5056                 ioffset = ioffset + value1;
5057             }
5058             break;
5059         case 1:
5060             for (i = 1 ; i <= values->vvalue; i++ )
5061             {
5062                 value1 = tvb_get_letohl(tvb, ioffset);
5063                 values->vstring = match_strval(value1, nds_syntax);
5064                 if (values->vstring == NULL)
5065                 {
5066                     values->vstring = "No Syntax Found";
5067                 }
5068                 proto_tree_add_string(ntree, hf_nds_syntax, tvb, ioffset,
5069                                       4, values->vstring);
5070                 ioffset = ioffset + 4;
5071                 value2 = tvb_get_letohl(tvb, ioffset);
5072                 ioffset = ioffset + 4;
5073                 values->vstring = get_string(tvb, ioffset, value2);
5074                 proto_tree_add_string(ntree, hf_mv_string, tvb, ioffset,
5075                                       value2, values->vstring);
5076                 ioffset += value2;
5077                 ioffset += align_4(tvb, ioffset);
5078                 values->voffset = ioffset;
5079
5080                 print_nds_values(ntree, tvb, value1, values);
5081                 ioffset = values->voffset;
5082             }
5083             break;
5084         case 2:
5085             for (i = 1 ; i <= values->vvalue; i++ )
5086             {
5087                 value1 = tvb_get_letohl(tvb, ioffset);
5088                 values->vstring = match_strval(value1, nds_syntax);
5089                 if (values->vstring == NULL)
5090                 {
5091                     values->vstring = "No Syntax Found";
5092                 }
5093                 proto_tree_add_string(ntree, hf_nds_syntax, tvb, ioffset,
5094                                       4, values->vstring);
5095                 ioffset = ioffset + 4;
5096                 value2 = tvb_get_letohl(tvb, ioffset);
5097                 ioffset = ioffset + 4;
5098                 values->vstring = get_string(tvb, ioffset, value2);
5099                 proto_tree_add_string(ntree, hf_mv_string, tvb, ioffset,
5100                                       value2, values->vstring);
5101                 values->voffset=ioffset + value2;
5102                 ioffset += value2;
5103                 ioffset += align_4(tvb, ioffset);
5104                 value3 = tvb_get_letohl(tvb, ioffset);
5105
5106                 proto_tree_add_uint_format(ntree, hf_nds_uint32value, tvb, ioffset, 4,
5107                                            value3, "Number of Values - %u", value3);
5108
5109                 ioffset = ioffset + 4;
5110                 for (r = 1 ; r <= value3; r++ )
5111                 {
5112                     ioffset += 4;   /* Length = 4 */
5113                     value4 = tvb_get_letohl(tvb, ioffset);
5114                     tvb_ensure_bytes_exist(tvb, ioffset, values->vlength);
5115                     proto_tree_add_uint(ntree, hf_nds_privileges, tvb, ioffset,
5116                                         values->vlength, value4);
5117
5118                     ioffset = ioffset+4;
5119                 }
5120             }
5121             break;
5122         case 3:
5123             for (i = 1 ; i <= values->vvalue; i++ )
5124             {
5125                 value1 = tvb_get_letohl(tvb, ioffset);
5126                 values->vstring = match_strval(value1, nds_syntax);
5127                 if (values->vstring == NULL)
5128                 {
5129                     values->vstring = "No Syntax Found";
5130                 }
5131                 proto_tree_add_string(ntree, hf_nds_syntax, tvb, ioffset,
5132                                       4, values->vstring);
5133                 ioffset = ioffset + 4;
5134                 value2 = tvb_get_letohl(tvb, ioffset);
5135                 ioffset = ioffset + 4;
5136                 values->vstring = get_string(tvb, ioffset, value2);
5137                 proto_tree_add_string(ntree, hf_mv_string, tvb, ioffset,
5138                                       value2, values->vstring);
5139                 ioffset = ioffset + value2;
5140                 ioffset += align_4(tvb, ioffset);
5141                 value3 = tvb_get_letohl(tvb, ioffset);
5142
5143                 aitem = proto_tree_add_uint_format(ntree, hf_nds_uint32value, tvb, ioffset, 4,
5144                                                    value3, "Number of Values - %u", value3);
5145
5146                 atree = proto_item_add_subtree(aitem, ett_nds);
5147
5148                 ioffset = ioffset + 4;
5149                 for (r = 1 ; r <= value3; r++ )
5150                 {
5151                     ioffset += align_4(tvb, ioffset);
5152                     temp_values.vvalue = tvb_get_letohl(tvb, ioffset);
5153                     temp_values.vlength = 2;
5154                     temp_values.hfname = hf_nds_vflags;
5155                     temp_values.voffset = ioffset;
5156                     temp_values.vdesc = "Value Flags";
5157                     temp_values.bit1 = "Naming";
5158                     temp_values.bit1hfname = hf_bit1vflags;
5159                     temp_values.bit2 = "Base Class";
5160                     temp_values.bit2hfname = hf_bit2vflags;
5161                     temp_values.bit3 = "Present";
5162                     temp_values.bit3hfname = hf_bit3vflags;
5163                     temp_values.bit4 = "Value Damaged";
5164                     temp_values.bit4hfname = hf_bit4vflags;
5165                     temp_values.bit5 = "Not Defined";
5166                     temp_values.bit5hfname = hf_bit5vflags;
5167                     temp_values.bit6 = "Not Defined";
5168                     temp_values.bit6hfname = hf_bit6vflags;
5169                     temp_values.bit7 = "Not Defined";
5170                     temp_values.bit7hfname = hf_bit7vflags;
5171                     temp_values.bit8 = "Not Defined";
5172                     temp_values.bit8hfname = hf_bit8vflags;
5173                     temp_values.bit9 = "Not Defined";
5174                     temp_values.bit9hfname = hf_bit9vflags;
5175                     temp_values.bit10 = "Not Defined";
5176                     temp_values.bit10hfname = hf_bit10vflags;
5177                     temp_values.bit11 = "Not Defined";
5178                     temp_values.bit11hfname = hf_bit11vflags;
5179                     temp_values.bit12 = "Not Defined";
5180                     temp_values.bit12hfname = hf_bit12vflags;
5181                     temp_values.bit13 = "Not Defined";
5182                     temp_values.bit13hfname = hf_bit13vflags;
5183                     temp_values.bit14 = "Not Defined";
5184                     temp_values.bit14hfname = hf_bit14vflags;
5185                     temp_values.bit15 = "Not Defined";
5186                     temp_values.bit15hfname = hf_bit15vflags;
5187                     temp_values.bit16 = "Not Defined";
5188                     temp_values.bit16hfname = hf_bit16vflags;
5189                     process_bitfield(atree, tvb, &temp_values);
5190                     ioffset = ioffset + 4;
5191                     ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
5192                     ns.nsecs = 0;
5193                     proto_tree_add_time_format(atree, hf_es_seconds, tvb, ioffset,
5194                                                4, &ns, "Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
5195                     ioffset = ioffset + 4;
5196                     replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
5197                     proto_tree_add_item(atree, hf_nds_replica_num, tvb, ioffset,
5198                                         2, replica_num);
5199                     ioffset = ioffset + 2;
5200                     event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
5201                     proto_tree_add_item(atree, hf_nds_event_num, tvb, ioffset,
5202                                         2, event_num);
5203                     ioffset = ioffset + 2;
5204                     value5 = tvb_get_letohl(tvb, ioffset); /* length of field */
5205                     if(value5 > tvb_length_remaining(tvb, ioffset))
5206                     {
5207                         break;
5208                     }
5209                     ioffset += 4;
5210                     tvb_ensure_bytes_exist(tvb, ioffset, value5);
5211                     proto_tree_add_bytes(atree, hf_value_bytes, tvb, ioffset, value5, tvb_get_ptr(tvb, ioffset, value5));
5212                     ioffset += value5;
5213                     ioffset += (value5%2);
5214                 }
5215             }
5216             break;
5217         case 4:
5218             for (i = 1 ; i <= values->vvalue; i++ )
5219             {
5220                 value1 = tvb_get_letohl(tvb, ioffset);
5221                 values->vstring = match_strval(value1, nds_syntax);
5222                 if (values->vstring == NULL)
5223                 {
5224                     values->vstring = "No Syntax Found";
5225                 }
5226                 proto_tree_add_string(ntree, hf_nds_syntax, tvb, ioffset,
5227                                       4, values->vstring);
5228                 ioffset = ioffset + 4;
5229                 value2 = tvb_get_letohl(tvb, ioffset);
5230                 ioffset = ioffset + 4;
5231                 values->vstring = get_string(tvb, ioffset, value2);
5232                 proto_tree_add_string(ntree, hf_mv_string, tvb, ioffset,
5233                                       value2, values->vstring);
5234                 ioffset = ioffset + value2;
5235                 value3 = tvb_get_letohl(tvb, ioffset);
5236
5237                 proto_tree_add_uint_format(ntree, hf_nds_uint32value, tvb, ioffset, 4,
5238                                            value3, "Number of Values - %u", value3);
5239
5240                 ioffset = ioffset + 4;
5241                 for (r = 1 ; r <= value3; r++ )
5242                 {
5243                     ioffset += align_4(tvb, ioffset);
5244                     temp_values.vvalue = tvb_get_letohl(tvb, ioffset);
5245                     temp_values.vlength = 2;
5246                     temp_values.hfname = hf_nds_vflags;
5247                     temp_values.voffset = ioffset;
5248                     temp_values.vdesc = "Value Flags";
5249                     temp_values.bit1 = "Naming";
5250                     temp_values.bit1hfname = hf_bit1vflags;
5251                     temp_values.bit2 = "Base Class";
5252                     temp_values.bit2hfname = hf_bit2vflags;
5253                     temp_values.bit3 = "Present";
5254                     temp_values.bit3hfname = hf_bit3vflags;
5255                     temp_values.bit4 = "Value Damaged";
5256                     temp_values.bit4hfname = hf_bit4vflags;
5257                     temp_values.bit5 = "Not Defined";
5258                     temp_values.bit5hfname = hf_bit5vflags;
5259                     temp_values.bit6 = "Not Defined";
5260                     temp_values.bit6hfname = hf_bit6vflags;
5261                     temp_values.bit7 = "Not Defined";
5262                     temp_values.bit7hfname = hf_bit7vflags;
5263                     temp_values.bit8 = "Not Defined";
5264                     temp_values.bit8hfname = hf_bit8vflags;
5265                     temp_values.bit9 = "Not Defined";
5266                     temp_values.bit9hfname = hf_bit9vflags;
5267                     temp_values.bit10 = "Not Defined";
5268                     temp_values.bit10hfname = hf_bit10vflags;
5269                     temp_values.bit11 = "Not Defined";
5270                     temp_values.bit11hfname = hf_bit11vflags;
5271                     temp_values.bit12 = "Not Defined";
5272                     temp_values.bit12hfname = hf_bit12vflags;
5273                     temp_values.bit13 = "Not Defined";
5274                     temp_values.bit13hfname = hf_bit13vflags;
5275                     temp_values.bit14 = "Not Defined";
5276                     temp_values.bit14hfname = hf_bit14vflags;
5277                     temp_values.bit15 = "Not Defined";
5278                     temp_values.bit15hfname = hf_bit15vflags;
5279                     temp_values.bit16 = "Not Defined";
5280                     temp_values.bit16hfname = hf_bit16vflags;
5281                     process_bitfield(ntree, tvb, &temp_values);
5282                     ioffset = ioffset + 4;
5283                     ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
5284                     ns.nsecs = 0;
5285                     proto_tree_add_time_format(ntree, hf_es_seconds, tvb, ioffset,
5286                                                4, &ns, "Creation Time: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
5287                     ioffset = ioffset + 4;
5288                     replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
5289                     proto_tree_add_item(ntree, hf_nds_replica_num, tvb, ioffset,
5290                                         2, replica_num);
5291                     ioffset = ioffset + 2;
5292                     event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
5293                     proto_tree_add_item(ntree, hf_nds_event_num, tvb, ioffset,
5294                                         2, event_num);
5295                     ioffset = ioffset + 2;
5296                     value1 = tvb_get_letohl(tvb, ioffset);
5297                     proto_tree_add_uint(ntree, hf_nds_value_len, tvb, ioffset,
5298                                         4, value1);
5299                     ioffset = ioffset + 4;
5300                 }
5301             }
5302             break;
5303         default:
5304             break;
5305         }
5306         break;
5307
5308     case MVTYPE_ATTR_REQUEST2:    /* Attribute Request */
5309         oldioffset = 0;
5310         for (i = 1 ; i <= values->vvalue; i++ )
5311         {
5312             if (oldioffset >= ioffset) {
5313                 proto_tree_add_text(ntree, tvb, 0, 0, "[ Invalid offset: %u ]", ioffset);
5314                 THROW(ReportedBoundsError);
5315             }
5316             oldioffset = ioffset;
5317             ioffset += align_4(tvb, ioffset);
5318             value1 = tvb_get_letohl(tvb, ioffset);
5319             proto_tree_add_uint_format(ntree, hf_nds_uint32value, tvb, ioffset,
5320                                        4, value1, "Value %d", value1);
5321             ioffset = ioffset + value1;
5322         }
5323         break;
5324
5325     case MVTYPE_ADD_ATTR_REQUEST: /* Add Attribute Request */
5326         for (i = 1 ; i <= values->vvalue; i++ )
5327         {
5328             value1 = tvb_get_letohl(tvb, ioffset);
5329             ioffset = ioffset + 4;
5330             values->vstring = get_string(tvb, ioffset, value1);
5331             proto_tree_add_string(ntree, hf_mv_string, tvb, ioffset,
5332                                   value1, values->vstring);
5333             ioffset = ioffset + value1;
5334             ioffset += align_4(tvb, ioffset);
5335             values->voffset = ioffset;
5336             print_nds_values(ntree, tvb, 9, values);
5337             ioffset = values->voffset;
5338         }
5339         break;
5340
5341     case MVTYPE_READ_CLASS_REQ:   /* Read Class Request */
5342         for (i = 1 ; i <= values->vvalue; i++ )
5343         {
5344             ioffset += align_4(tvb, ioffset);
5345             value1 = tvb_get_letohl(tvb, ioffset);
5346             ioffset = ioffset + 4;
5347             values->vstring = get_string(tvb, ioffset, value1);
5348             proto_tree_add_string(ntree, hf_nds_base, tvb, ioffset,
5349                                   value1, values->vstring);
5350             values->mvtype = MVTYPE_ATTR_REQUEST;
5351             ioffset = ioffset + value1;
5352         }
5353         break;
5354
5355     case MVTYPE_READ_REPLICAS:    /* Read Replicas */
5356         for (i = 1 ; i <= values->vvalue; i++ )
5357         {
5358             bvalue = 0x00000001;
5359
5360             for (r = 0 ; r < 9; r++ )
5361             {
5362                 if (values->vflags & bvalue)
5363                 {
5364                     switch(bvalue)
5365                     {
5366                     case 0x00000001:                /*p3values.bit1 = "Output Flags"*/
5367                         temp_values.vvalue = tvb_get_letohl(tvb, ioffset);
5368                         temp_values.vlength = 2;
5369                         temp_values.hfname = hf_nds_rflags;
5370                         temp_values.voffset = ioffset;
5371                         temp_values.vdesc = "Output Flags";
5372                         temp_values.bit1 = values->bit1;
5373                         temp_values.bit1hfname = hf_bit1outflags;
5374                         temp_values.bit2 = values->bit2;
5375                         temp_values.bit2hfname = hf_bit2outflags;
5376                         temp_values.bit3 = values->bit3;
5377                         temp_values.bit3hfname = hf_bit3outflags;
5378                         temp_values.bit4 = values->bit4;
5379                         temp_values.bit4hfname = hf_bit4outflags;
5380                         temp_values.bit5 = values->bit5;
5381                         temp_values.bit5hfname = hf_bit5outflags;
5382                         temp_values.bit6 = values->bit6;
5383                         temp_values.bit6hfname = hf_bit6outflags;
5384                         temp_values.bit7 = values->bit7;
5385                         temp_values.bit7hfname = hf_bit7outflags;
5386                         temp_values.bit8 = values->bit8;
5387                         temp_values.bit8hfname = hf_bit8outflags;
5388                         temp_values.bit9 = values->bit9;
5389                         temp_values.bit9hfname = hf_bit9outflags;
5390                         temp_values.bit10 = "Not Defined";
5391                         temp_values.bit10hfname = hf_bit10outflags;
5392                         temp_values.bit11 = "Not Defined";
5393                         temp_values.bit11hfname = hf_bit11outflags;
5394                         temp_values.bit12 = "Not Defined";
5395                         temp_values.bit12hfname = hf_bit12outflags;
5396                         temp_values.bit13 = "Not Defined";
5397                         temp_values.bit13hfname = hf_bit13outflags;
5398                         temp_values.bit14 = "Not Defined";
5399                         temp_values.bit14hfname = hf_bit14outflags;
5400                         temp_values.bit15 = "Not Defined";
5401                         temp_values.bit15hfname = hf_bit15outflags;
5402                         temp_values.bit16 = "Not Defined";
5403                         temp_values.bit16hfname = hf_bit16outflags;
5404                         process_bitfield(ntree, tvb, &temp_values);
5405                         ioffset = ioffset + 4;
5406                         break;
5407                     case 0x00000002:                /*p3values.bit2 = "Entry ID"*/
5408                         value1 = tvb_get_letohl(tvb, ioffset);
5409                         proto_tree_add_uint_format(ntree, hf_nds_eid, tvb, ioffset,
5410                                                    4, value1, "Entry ID %08x", value1);
5411                         ioffset = ioffset + 4;
5412                         break;
5413                     case 0x00000004:                /*p3values.bit3 = "Replica State"*/
5414                         value1 = tvb_get_letohl(tvb, ioffset);
5415                         temp_values.vstring = match_strval(value1, nds_replica_state);
5416                         if (temp_values.vstring == NULL)
5417                         {
5418                             temp_values.vstring = "No Replica State Found";
5419                         }
5420                         proto_tree_add_string(ntree, hf_replica_state, tvb, ioffset,
5421                                               4, temp_values.vstring);
5422                         ioffset = ioffset + 4;
5423                         break;
5424                     case 0x0000008:                 /*p3values.bit4 = "Modification Timestamp"*/
5425                         ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
5426                         ns.nsecs = 0;
5427                         proto_tree_add_time_format(ntree, hf_es_seconds, tvb, ioffset,
5428                                                    4, &ns, "Modification Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
5429                         ioffset = ioffset + 4;
5430                         replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
5431                         proto_tree_add_item(ntree, hf_nds_replica_num, tvb, ioffset,
5432                                             2, replica_num);
5433                         ioffset = ioffset + 2;
5434                         event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
5435                         proto_tree_add_item(ntree, hf_nds_event_num, tvb, ioffset,
5436                                             2, event_num);
5437                         ioffset = ioffset + 2;
5438                         break;
5439                     case 0x00000010:                /*p3values.bit5 = "Purge Time"*/
5440                         ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
5441                         ns.nsecs = 0;
5442                         proto_tree_add_time_format(ntree, hf_nds_purge, tvb, ioffset,
5443                                                    4, &ns, "Purge Time: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
5444                         ioffset = ioffset + 4;
5445                         break;
5446                     case 0x00000020:                /*p3values.bit6 = "Local Partition ID"*/
5447                         value1 = tvb_get_letohl(tvb, ioffset);
5448                         proto_tree_add_uint_format(ntree, hf_nds_local_partition, tvb, ioffset,
5449                                                    4, value1, "Local Partition ID %08x", value1);
5450                         ioffset = ioffset + 4;
5451                         break;
5452                     case 0x00000040:                /*p3values.bit7 = "Distinguished Name"*/
5453                         value1 = tvb_get_letohl(tvb, ioffset);
5454                         ioffset = ioffset + 4;
5455                         temp_values.vstring = get_string(tvb, ioffset, value1);
5456                         proto_tree_add_string(ntree, hf_nds_name, tvb, ioffset,
5457                                               value1, temp_values.vstring);
5458                         ioffset = ioffset + value1;
5459                         break;
5460                     case 0x00000080:                /*p3values.bit8 = "Replica Type & State"*/
5461                         value1 = tvb_get_letohl(tvb, ioffset);
5462                         value2 = value1 & 0x00ff;
5463                         temp_values.vstring = match_strval(value2, nds_replica_type);
5464                         if (temp_values.vstring == NULL)
5465                         {
5466                             temp_values.vstring = "No Replica Type Found";
5467                         }
5468                         proto_tree_add_string(ntree, hf_replica_type, tvb, ioffset,
5469                                               4, temp_values.vstring);
5470                         value3 = value1 & 0xff00;
5471                         temp_values.vstring = match_strval(value3, nds_replica_state);
5472                         if (temp_values.vstring == NULL)
5473                         {
5474                             temp_values.vstring = "No Replica State Found";
5475                         }
5476                         proto_tree_add_string(ntree, hf_replica_state, tvb, ioffset,
5477                                               4, temp_values.vstring);
5478                         ioffset = ioffset + 4;
5479                         break;
5480                     case 0x00000100:                /*p3values.bit9 = "Partition Busy"*/
5481                         value1 = tvb_get_letohs(tvb, ioffset);
5482                         proto_tree_add_boolean(ntree, hf_partition_busy, tvb, ioffset, 4, value1);
5483                         ioffset += 4;
5484                         break;
5485                     default:
5486                         break;
5487                     }
5488                 }
5489                 bvalue = bvalue*2;
5490                 ioffset += align_4(tvb, ioffset);
5491                 if(tvb_length_remaining(tvb, ioffset) < 4 )
5492                 {
5493                     break;
5494                 }
5495             }
5496             if(tvb_length_remaining(tvb, ioffset) < 4 )
5497             {
5498                 break;
5499             }
5500         }
5501         break;
5502
5503     case MVTYPE_MODIFY_ATTR_REQUEST: /* Modify Attribute Request */
5504         for (i = 0 ; i < values->vvalue; i++ )
5505         {
5506             ioffset += align_4(tvb, ioffset);
5507             value1 = tvb_get_letohl(tvb, ioffset);
5508             valuestr = match_strval(value1, nds_kind_of_changes);
5509             if (valuestr == NULL)
5510             {
5511                 valuestr="(Kind Change Not Found)";
5512             }
5513             tvb_ensure_bytes_exist(tvb, ioffset, values->vlength);
5514             proto_tree_add_uint_format(ntree, hf_nds_uint32value, tvb, ioffset,
5515                                        values->vlength, value1, valuestr, value1);
5516             ioffset = ioffset+4;
5517             value2 = tvb_get_letohl(tvb, ioffset);
5518             ioffset = ioffset + 4;
5519             temp_values.vstring = get_string(tvb, ioffset, value2);   /* Name of Attribute */
5520             proto_tree_add_string(ntree, hf_mv_string, tvb, ioffset,
5521                                   value2, temp_values.vstring);
5522             ioffset = ioffset + value2;
5523             ioffset += align_4(tvb, ioffset);
5524             if(value1 != 1 && value1 != 6)
5525             {
5526                 values->voffset = ioffset;
5527                 /* XX: Is values.vstring set properly at this point ?? */
5528                 print_nds_values(ntree, tvb, 9, values);
5529                 ioffset = values->voffset;
5530             }
5531         }
5532         break;
5533
5534     case MVTYPE_ADDR_REFERRAL_REQUEST: /* Address Referral Request */
5535         for (i = 0 ; i < values->vvalue; i++ )
5536         {
5537             value1 = tvb_get_letohl(tvb, ioffset);
5538             valuestr = match_strval(value1, nds_protocol_type);
5539             if (valuestr == NULL)
5540             {
5541                 valuestr="(Undefined Protocol)";
5542             }
5543             tvb_ensure_bytes_exist(tvb, ioffset, values->vlength);
5544             proto_tree_add_uint_format(ntree, hf_nds_uint32value, tvb, ioffset,
5545                                        values->vlength, value1, valuestr, value1);
5546             ioffset = ioffset+4;
5547         }
5548         break;
5549
5550     case MVTYPE_ADDR_REFERRAL_REPLY: /* Address Referral Reply */
5551         number_of_referrals = values->vvalue;
5552
5553         for (r = 1 ; r <= number_of_referrals; r++ )
5554         {
5555             aitem = proto_tree_add_uint_format(ntree, hf_referral_record, tvb, 6, 0,
5556                                                r, "NDS Referral Record #%u", r);
5557             atree = proto_item_add_subtree(aitem, ett_nds);
5558
5559             value1 = tvb_get_letohl(tvb, ioffset);
5560
5561             proto_tree_add_uint_format(atree, hf_referral_addcount, tvb, ioffset, 4,
5562                                        value1, "Number of Addresses in Referral - %u", value1);
5563
5564             ioffset = ioffset + 4;
5565             for (i = 1 ; i <= value1; i++ )
5566             {
5567                 value2 = tvb_get_letohl(tvb, ioffset);
5568                 valuestr = match_strval(value2, nds_protocol_type);
5569                 if (valuestr == NULL)
5570                 {
5571                     valuestr="(Undefined Protocol)";
5572                 }
5573                 tvb_ensure_bytes_exist(tvb, ioffset, values->vlength);
5574                 proto_tree_add_uint_format(atree, hf_nds_uint32value, tvb, ioffset,
5575                                            values->vlength, value2, valuestr, value2);
5576                 ioffset = ioffset+4;
5577                 value3 = tvb_get_letohl(tvb, ioffset);
5578                 ioffset = ioffset+4;
5579                 switch (value2)
5580                 {
5581                 case NDS_PTYPE_IPX:
5582                     proto_tree_add_item(atree, hf_nds_net, tvb, ioffset, 4, FALSE);
5583                     proto_tree_add_item(atree, hf_nds_node, tvb, ioffset+4, 6, FALSE);
5584                     proto_tree_add_item(atree, hf_nds_socket, tvb, ioffset+10, 2, FALSE);
5585                     break;
5586                 case NDS_PTYPE_IP:
5587                     proto_tree_add_item(atree, hf_nds_port, tvb, ioffset, 2, FALSE);
5588                     proto_tree_add_item(atree, hf_add_ref_ip, tvb, ioffset+2, 4, FALSE);
5589                     break;
5590                 case NDS_PTYPE_UDP:
5591                     proto_tree_add_item(atree, hf_nds_port, tvb, ioffset, 2, FALSE);
5592                     proto_tree_add_item(atree, hf_add_ref_udp, tvb, ioffset+2, 4, FALSE);
5593                     break;
5594                 case NDS_PTYPE_TCP:
5595                     proto_tree_add_item(atree, hf_nds_port, tvb, ioffset, 2, FALSE);
5596                     proto_tree_add_item(atree, hf_add_ref_tcp, tvb, ioffset+2, 4, FALSE);
5597                     break;
5598                 case NDS_PTYPE_URL:
5599                 case NDS_PTYPE_DNS:
5600                     values->vstring = get_string(tvb, ioffset, value3);
5601                     proto_tree_add_string(atree, hf_value_string, tvb, ioffset,
5602                                           value3, values->vstring);
5603                     break;
5604                 default:
5605                     break;
5606                 }
5607                 ioffset = ioffset + value3;
5608                 ioffset += align_4(tvb, ioffset);
5609             }
5610
5611         }
5612         break;
5613
5614     case MVTYPE_LOC_ADDR_REFERRAL_REPLY: /* Local Address Referral Reply */
5615         number_of_referrals = values->vvalue;
5616
5617         for (r = 1 ; r <= number_of_referrals; r++ )
5618         {
5619             aitem = proto_tree_add_uint_format(ntree, hf_referral_record, tvb, 6, 0,
5620                                                r, "NDS Referral Record #%u", r);
5621             atree = proto_item_add_subtree(aitem, ett_nds);
5622
5623             value2 = tvb_get_letohl(tvb, ioffset);
5624             valuestr = match_strval(value2, nds_protocol_type);
5625             if (valuestr == NULL)
5626             {
5627                 valuestr="(Undefined Protocol)";
5628             }
5629             tvb_ensure_bytes_exist(tvb, ioffset, values->vlength);
5630             proto_tree_add_uint_format(atree, hf_nds_uint32value, tvb, ioffset,
5631                                        values->vlength, value2, valuestr, value2);
5632             ioffset = ioffset+4;
5633             value3 = tvb_get_letohl(tvb, ioffset);
5634             ioffset = ioffset+4;
5635
5636             switch (value2)
5637             {
5638             case NDS_PTYPE_IPX:
5639                 proto_tree_add_item(atree, hf_nds_net, tvb, ioffset, 4, FALSE);
5640                 proto_tree_add_item(atree, hf_nds_node, tvb, ioffset+4, 6, FALSE);
5641                 proto_tree_add_item(atree, hf_nds_socket, tvb, ioffset+10, 2, FALSE);
5642                 break;
5643             case NDS_PTYPE_IP:
5644                 proto_tree_add_item(atree, hf_nds_port, tvb, ioffset, 2, FALSE);
5645                 proto_tree_add_item(atree, hf_add_ref_ip, tvb, ioffset+2, 4, FALSE);
5646                 break;
5647             case NDS_PTYPE_UDP:
5648                 proto_tree_add_item(atree, hf_nds_port, tvb, ioffset, 2, FALSE);
5649                 proto_tree_add_item(atree, hf_add_ref_udp, tvb, ioffset+2, 4, FALSE);
5650                 break;
5651             case NDS_PTYPE_TCP:
5652                 proto_tree_add_item(atree, hf_nds_port, tvb, ioffset, 2, FALSE);
5653                 proto_tree_add_item(atree, hf_add_ref_tcp, tvb, ioffset+2, 4, FALSE);
5654                 break;
5655             case NDS_PTYPE_URL:
5656             case NDS_PTYPE_DNS:
5657                 values->vstring = get_string(tvb, ioffset, value3);
5658                 proto_tree_add_string(atree, hf_value_string, tvb, ioffset,
5659                                       value3, values->vstring);
5660                 break;
5661             default:
5662                 break;
5663             }
5664             ioffset = ioffset + value3;
5665             ioffset += align_4(tvb, ioffset);
5666         }
5667         break;
5668
5669     case MVTYPE_PROC_ENTRY_SPECIFIERS: /* Process Entry Specifiers */
5670         value2 = tvb_get_letohl(tvb, ioffset);   /* ES Type */
5671         values->vstring = match_strval(value2, es_type);
5672         if (values->vstring == NULL)
5673         {
5674             values->vstring = "No ES Type Found";
5675         }
5676         esitem = proto_tree_add_string_format(ntree, hf_es_type, tvb, ioffset,
5677                                               4, values->vstring, "Output Entry Specifier - %s", values->vstring);
5678         estree = proto_item_add_subtree(esitem, ett_nds);
5679         ioffset = ioffset + 4;
5680         ioffset = print_es_type(estree, tvb, values, value2, ioffset);
5681         value3 = tvb_get_letohl(tvb, ioffset);   /* ES Type */
5682         values->vstring = match_strval(value3, es_type);
5683         if (values->vstring == NULL)
5684         {
5685             values->vstring = "No ES Type Found";
5686         }
5687         esitem = proto_tree_add_string_format(ntree, hf_es_type, tvb, ioffset,
5688                                               4, values->vstring, "Input Entry Specifier - %s", values->vstring);
5689         estree = proto_item_add_subtree(esitem, ett_nds);
5690         ioffset = ioffset + 4;
5691         ioffset = print_es_type(estree, tvb, values, value3, ioffset);
5692         /* values.vstring is being overwritten. So store the resolve name to a global value */
5693         g_strlcpy(mv_resolve_name_string, values->vstring, 128);
5694         value4 = tvb_get_letohl(tvb, ioffset);
5695         aitem = proto_tree_add_uint_format(ntree, hf_referral_record, tvb, ioffset, 4,
5696                                            value4, "Referral Protocols - %u", value4);
5697         atree = proto_item_add_subtree(aitem, ett_nds);
5698         ioffset += 4;
5699         for (i = 0 ; i < value4; i++ )
5700         {
5701             value5 = tvb_get_letohl(tvb, ioffset);
5702             valuestr = match_strval(value5, nds_protocol_type);
5703             if (valuestr == NULL)
5704             {
5705                 valuestr="(Undefined Protocol)";
5706             }
5707             proto_tree_add_string_format(atree, hf_value_string, tvb, ioffset,
5708                                          4, valuestr, "Protocol -> %s", valuestr);
5709             ioffset = ioffset+4;
5710         }
5711         value6 = tvb_get_letohl(tvb, ioffset);
5712         aitem = proto_tree_add_uint_format(ntree, hf_referral_record, tvb, ioffset, 4,
5713                                            value6, "Tree Walking Protocols - %u", value6);
5714         atree = proto_item_add_subtree(aitem, ett_nds);
5715         ioffset += 4;
5716         for (i = 0 ; i < value6; i++ )
5717         {
5718             value7 = tvb_get_letohl(tvb, ioffset);
5719             valuestr = match_strval(value7, nds_protocol_type);
5720             if (valuestr == NULL)
5721             {
5722                 valuestr="(Undefined Protocol)";
5723             }
5724             proto_tree_add_string_format(atree, hf_value_string, tvb, ioffset,
5725                                          4, valuestr, "Protocol -> %s", valuestr);
5726             ioffset = ioffset+4;
5727         }
5728         values->vstring = " ";
5729         break;
5730
5731     case MVTYPE_PRINT_TIMESTAMP:  /* Print Timestamp */
5732         replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
5733         proto_tree_add_item(ncp_tree, hf_nds_replica_num, tvb, ioffset,
5734                             2, replica_num);
5735         ioffset = ioffset + 2;
5736         event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
5737         proto_tree_add_item(ncp_tree, hf_nds_event_num, tvb, ioffset,
5738                             2, event_num);
5739         ioffset = ioffset + 2;
5740         /* fall through */
5741
5742     case MVTYPE_LIST_PARTITIONS:  /* List Partitions */
5743         number_of_referrals = values->vvalue;
5744         /* A bad packet could put us in a tight loop so trap for anything
5745          * over 256 referrals.
5746          */
5747         if (number_of_referrals > 256) {
5748             proto_tree_add_text(ntree, tvb, 0, 0, "[ Bad referal at offset: %u ]", ioffset);
5749             THROW(ReportedBoundsError);
5750             break;
5751         }
5752         for (i = 0; i < number_of_referrals; i++)
5753         {
5754             bvalue = 0x00000001;
5755
5756             for (r = 0 ; r < 32; r++ )
5757             {
5758                 oldioffset = ioffset;
5759                 if (values->vflags & bvalue)
5760                 {
5761                     switch(bvalue)
5762                     {
5763                     case 0x00000001:                /* Information Flags */
5764                         temp_values.vvalue = tvb_get_letohs(tvb, ioffset);
5765                         temp_values.vtype = VTYPE_BITFIELD;
5766                         temp_values.vdesc = "Information Flags (low) Byte:";
5767                         temp_values.vlength = 2;
5768                         temp_values.hfname= hf_nds_rflags;
5769                         temp_values.voffset = ioffset;
5770                         temp_values.bit1 = "Output Flags";
5771                         temp_values.bit1hfname = hf_bit1infoflagsl;
5772                         temp_values.bit2 = "Entry ID";
5773                         temp_values.bit2hfname = hf_bit2infoflagsl;
5774                         temp_values.bit3 = "Entry Flags";
5775                         temp_values.bit3hfname = hf_bit3infoflagsl;
5776                         temp_values.bit4 = "Subordinate Count";
5777                         temp_values.bit4hfname = hf_bit4infoflagsl;
5778                         temp_values.bit5 = "Modification Time";
5779                         temp_values.bit5hfname = hf_bit5infoflagsl;
5780                         temp_values.bit6 = "Modification Timestamp";
5781                         temp_values.bit6hfname = hf_bit6infoflagsl;
5782                         temp_values.bit7 = "Creation Timestamp";
5783                         temp_values.bit7hfname = hf_bit7infoflagsl;
5784                         temp_values.bit8 = "Partition Root ID";
5785                         temp_values.bit8hfname = hf_bit8infoflagsl;
5786                         temp_values.bit9 = "Parent ID";
5787                         temp_values.bit9hfname = hf_bit9infoflagsl;
5788                         temp_values.bit10 = "Revision Count";
5789                         temp_values.bit10hfname = hf_bit10infoflagsl;
5790                         temp_values.bit11 = "Replica Type";
5791                         temp_values.bit11hfname = hf_bit11infoflagsl;
5792                         temp_values.bit12 = "Base Class";
5793                         temp_values.bit12hfname = hf_bit12infoflagsl;
5794                         temp_values.bit13 = "Relative Distinguished Name";
5795                         temp_values.bit13hfname = hf_bit13infoflagsl;
5796                         temp_values.bit14 = "Distinguished Name";
5797                         temp_values.bit14hfname = hf_bit14infoflagsl;
5798                         temp_values.bit15 = "Root Distinguished Name";
5799                         temp_values.bit15hfname = hf_bit15infoflagsl;
5800                         temp_values.bit16 = "Parent Distinguished Name";
5801                         temp_values.bit16hfname = hf_bit16infoflagsl;
5802                         process_bitfield(ntree, tvb, &temp_values);
5803                         ioffset = ioffset+2;
5804                         temp_values.vvalue = tvb_get_letohs(tvb, ioffset);
5805                         temp_values.vtype = VTYPE_BITFIELD;
5806                         temp_values.vdesc = "Information Flags (high) Byte:";
5807                         temp_values.vlength = 2;
5808                         temp_values.hfname= hf_nds_rflags;
5809                         temp_values.voffset = ioffset;
5810                         temp_values.bit1 = "Purge Time";
5811                         temp_values.bit1hfname = hf_bit1infoflagsh;
5812                         temp_values.bit2 = "Dereference Base Class";
5813                         temp_values.bit2hfname = hf_bit2infoflagsh;
5814                         temp_values.bit3 = "Not Defined";
5815                         temp_values.bit3hfname = hf_bit3infoflagsh;
5816                         temp_values.bit4 = "Not Defined";
5817                         temp_values.bit4hfname = hf_bit4infoflagsh;
5818                         temp_values.bit5 = "Not Defined";
5819                         temp_values.bit5hfname = hf_bit5infoflagsh;
5820                         temp_values.bit6 = "Not Defined";
5821                         temp_values.bit6hfname = hf_bit6infoflagsh;
5822                         temp_values.bit7 = "Not Defined";
5823                         temp_values.bit7hfname = hf_bit7infoflagsh;
5824                         temp_values.bit8 = "Not Defined";
5825                         temp_values.bit8hfname = hf_bit8infoflagsh;
5826                         temp_values.bit9 = "Not Defined";
5827                         temp_values.bit9hfname = hf_bit9infoflagsh;
5828                         temp_values.bit10 = "Not Defined";
5829                         temp_values.bit10hfname = hf_bit10infoflagsh;
5830                         temp_values.bit11 = "Not Defined";
5831                         temp_values.bit11hfname = hf_bit11infoflagsh;
5832                         temp_values.bit12 = "Not Defined";
5833                         temp_values.bit12hfname = hf_bit12infoflagsh;
5834                         temp_values.bit13 = "Not Defined";
5835                         temp_values.bit13hfname = hf_bit13infoflagsh;
5836                         temp_values.bit14 = "Not Defined";
5837                         temp_values.bit14hfname = hf_bit14infoflagsh;
5838                         temp_values.bit15 = "Not Defined";
5839                         temp_values.bit15hfname = hf_bit15infoflagsh;
5840                         temp_values.bit16 = "Not Defined";
5841                         temp_values.bit16hfname = hf_bit16infoflagsh;
5842                         process_bitfield(ntree, tvb, &temp_values);
5843                         ioffset = ioffset+2;
5844                         break;
5845                     case 0x00000002:                /* Entry ID */
5846                         value1 = tvb_get_letohl(tvb, ioffset);
5847                         proto_tree_add_uint_format(ntree, hf_nds_eid, tvb, ioffset,
5848                                                    4, value1, "Entry ID %08x", value1);
5849                         ioffset = ioffset + 4;
5850                         break;
5851                     case 0x00000004:                /* Entry Flags */
5852                         temp_values.vvalue = tvb_get_letohl(tvb, ioffset);
5853                         temp_values.vtype = VTYPE_BITFIELD;
5854                         temp_values.vdesc = "Entry Flags:";
5855                         temp_values.vlength = 2;
5856                         temp_values.hfname= hf_nds_eflags;
5857                         temp_values.voffset = ioffset;
5858                         temp_values.bit1 = "Alias Entry";
5859                         temp_values.bit1hfname = hf_bit1eflags;
5860                         temp_values.bit2 = "Partition Root";
5861                         temp_values.bit2hfname = hf_bit2eflags;
5862                         temp_values.bit3 = "Container Entry";
5863                         temp_values.bit3hfname = hf_bit3eflags;
5864                         temp_values.bit4 = "Container Alias";
5865                         temp_values.bit4hfname = hf_bit4eflags;
5866                         temp_values.bit5 = "Matches List Filter";
5867                         temp_values.bit5hfname = hf_bit5eflags;
5868                         temp_values.bit6 = "Reference Entry";
5869                         temp_values.bit6hfname = hf_bit6eflags;
5870                         temp_values.bit7 = "40x Reference Entry";
5871                         temp_values.bit7hfname = hf_bit7eflags;
5872                         temp_values.bit8 = "Back Linked";
5873                         temp_values.bit8hfname = hf_bit8eflags;
5874                         temp_values.bit9 = "New Entry";
5875                         temp_values.bit9hfname = hf_bit9eflags;
5876                         temp_values.bit10 = "Temporary Reference";
5877                         temp_values.bit10hfname = hf_bit10eflags;
5878                         temp_values.bit11 = "Audited";
5879                         temp_values.bit11hfname = hf_bit11eflags;
5880                         temp_values.bit12 = "Entry Not Present";
5881                         temp_values.bit12hfname = hf_bit12eflags;
5882                         temp_values.bit13 = "Entry Verify CTS";
5883                         temp_values.bit13hfname = hf_bit13eflags;
5884                         temp_values.bit14 = "Entry Damaged";
5885                         temp_values.bit14hfname = hf_bit14eflags;
5886                         temp_values.bit15 = "Not Defined";
5887                         temp_values.bit15hfname = hf_bit15eflags;
5888                         temp_values.bit16 = "Not Defined";
5889                         temp_values.bit16hfname = hf_bit16eflags;
5890                         process_bitfield(ntree, tvb, &temp_values);
5891                         ioffset = ioffset+4;
5892                         break;
5893                     case 0x0000008:                 /* Subordinate Count */
5894                         value1 = tvb_get_letohl(tvb, ioffset);
5895                         proto_tree_add_uint_format(ntree, hf_sub_count, tvb, ioffset,
5896                                                    4, value1, "Subordinate Count %u", value1);
5897                         ioffset = ioffset + 4;
5898                         break;
5899                     case 0x0000010:                 /* Modification Time */
5900                         ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
5901                         ns.nsecs = 0;
5902                         proto_tree_add_time_format(ntree, hf_es_seconds, tvb, ioffset,
5903                                                    4, &ns, "Modification Time: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
5904                         ioffset = ioffset + 4;
5905                         break;
5906                     case 0x0000020:                 /* Modification Timestamp */
5907                         ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
5908                         ns.nsecs = 0;
5909                         proto_tree_add_time_format(ntree, hf_es_seconds, tvb, ioffset,
5910                                                    4, &ns, "Modification Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
5911                         ioffset = ioffset + 4;
5912                         replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
5913                         proto_tree_add_item(ntree, hf_nds_replica_num, tvb, ioffset,
5914                                             2, replica_num);
5915                         ioffset = ioffset + 2;
5916                         event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
5917                         proto_tree_add_item(ntree, hf_nds_event_num, tvb, ioffset,
5918                                             2, event_num);
5919                         ioffset = ioffset + 2;
5920                         break;
5921                     case 0x0000040:                 /* Creation Timestamp */
5922                         ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
5923                         ns.nsecs = 0;
5924                         proto_tree_add_time_format(ntree, hf_es_seconds, tvb, ioffset,
5925                                                    4, &ns, "Creation Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
5926                         ioffset = ioffset + 4;
5927                         replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
5928                         proto_tree_add_item(ntree, hf_nds_replica_num, tvb, ioffset,
5929                                             2, replica_num);
5930                         ioffset = ioffset + 2;
5931                         event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
5932                         proto_tree_add_item(ntree, hf_nds_event_num, tvb, ioffset,
5933                                             2, event_num);
5934                         ioffset = ioffset + 2;
5935                         break;
5936                     case 0x00000080:                /* Partition Root ID */
5937                         value1 = tvb_get_letohl(tvb, ioffset);
5938                         proto_tree_add_uint_format(ntree, hf_nds_partition_root_id, tvb, ioffset,
5939                                                    4, value1, "Partition Root ID %08x", value1);
5940                         ioffset = ioffset + 4;
5941                         break;
5942                     case 0x00000100:                /* Parent ID */
5943                         value1 = tvb_get_letohl(tvb, ioffset);
5944                         proto_tree_add_uint_format(ntree, hf_nds_parent, tvb, ioffset,
5945                                                    4, value1, "Parent ID %08x", value1);
5946                         ioffset = ioffset + 4;
5947                         break;
5948                     case 0x00000200:                /* Revision Count */
5949                         value1 = tvb_get_letohl(tvb, ioffset);
5950                         proto_tree_add_uint_format(ntree, hf_nds_revision, tvb, ioffset,
5951                                                    4, value1, "Revision Count %u", value1);
5952                         ioffset = ioffset + 4;
5953                         break;
5954                     case 0x00000400:                /* Replica Type & State */
5955                         value1 = tvb_get_letohl(tvb, ioffset);
5956                         value2 = value1 & 0x00ff;
5957                         temp_values.vstring = match_strval(value2, nds_replica_type);
5958                         if (temp_values.vstring == NULL)
5959                         {
5960                             temp_values.vstring = "No Replica Type Found";
5961                         }
5962                         proto_tree_add_string(ntree, hf_replica_type, tvb, ioffset,
5963                                               4, temp_values.vstring);
5964                         value3 = value1 & 0xff00;
5965                         temp_values.vstring = match_strval(value3, nds_replica_state);
5966                         if (temp_values.vstring == NULL)
5967                         {
5968                             temp_values.vstring = "No Replica State Found";
5969                         }
5970                         proto_tree_add_string(ntree, hf_replica_state, tvb, ioffset,
5971                                               4, temp_values.vstring);
5972                         ioffset = ioffset + 4;
5973                         break;
5974                     case 0x00000800:                /* Base Class */
5975                         value1 = tvb_get_letohl(tvb, ioffset);
5976                         ioffset = ioffset + 4;
5977                         temp_values.vstring = get_string(tvb, ioffset, value1);
5978                         proto_tree_add_string(ntree, hf_nds_base, tvb, ioffset,
5979                                               value1, temp_values.vstring);
5980                         ioffset = ioffset + value1;
5981                         break;
5982                     case 0x00001000:                /* Relative Distinguished Name */
5983                         value1 = tvb_get_letohl(tvb, ioffset);
5984                         ioffset = ioffset + 4;
5985                         temp_values.vstring = get_string(tvb, ioffset, value1);
5986                         proto_tree_add_string(ntree, hf_nds_relative_dn, tvb, ioffset,
5987                                               value1, temp_values.vstring);
5988                         ioffset = ioffset + value1;
5989                         break;
5990                     case 0x00002000:                /* Distinguished Name */
5991                         value1 = tvb_get_letohl(tvb, ioffset);
5992                         ioffset = ioffset + 4;
5993                         temp_values.vstring = get_string(tvb, ioffset, value1);
5994                         proto_tree_add_string(ntree, hf_nds_name, tvb, ioffset,
5995                                               value1, temp_values.vstring);
5996                         ioffset = ioffset + value1;
5997                         break;
5998                     case 0x00004000:                /* Root Distinguished Name */
5999                         value1 = tvb_get_letohl(tvb, ioffset);
6000                         ioffset = ioffset + 4;
6001                         temp_values.vstring = get_string(tvb, ioffset, value1);
6002                         proto_tree_add_string(ntree, hf_nds_name, tvb, ioffset,
6003                                               value1, temp_values.vstring);
6004                         ioffset = ioffset + value1;
6005                         break;
6006                     case 0x00008000:                /* Parent Distinguished Name */
6007                         value1 = tvb_get_letohl(tvb, ioffset);
6008                         ioffset = ioffset + 4;
6009                         temp_values.vstring = get_string(tvb, ioffset, value1);
6010                         proto_tree_add_string(ntree, hf_nds_name, tvb, ioffset,
6011                                               value1, temp_values.vstring);
6012                         ioffset = ioffset + value1;
6013                         break;
6014                     case 0x00010000:                /* Purge Time */
6015                         ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
6016                         ns.nsecs = 0;
6017                         proto_tree_add_time_format(ntree, hf_es_seconds, tvb, ioffset,
6018                                                    4, &ns, "Purge Time: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
6019                         ioffset = ioffset + 4;
6020                         break;
6021                     case 0x00020000:                /* Dereference Base Class */
6022                         value1 = tvb_get_letohl(tvb, ioffset);
6023                         ioffset = ioffset + 4;
6024                         temp_values.vstring = get_string(tvb, ioffset, value1);
6025                         proto_tree_add_string(ntree, hf_deref_base, tvb, ioffset,
6026                                               value1, temp_values.vstring);
6027                         ioffset = ioffset + value1;
6028                         break;
6029                     default:
6030                         break;
6031
6032                     }
6033                     ioffset += align_4(tvb, ioffset);
6034                 }
6035                 bvalue = bvalue*2;
6036                 /* We could loop forever so check to see if bvalue has wrapped to 0.
6037                  * if so then just abort loop.
6038                  */
6039                 if (bvalue==0) {
6040                     break;
6041                 }
6042                 if(tvb_length_remaining(tvb, ioffset) < 4 )
6043                 {
6044                     break;
6045                 }
6046             }
6047             if(tvb_length_remaining(tvb, ioffset) < 4 )
6048             {
6049                 break;
6050             }
6051         }
6052         break;
6053
6054     case MVTYPE_CLASS_NAMES:      /* Class Names */
6055         number_of_referrals = values->vvalue;
6056         for (i = 0; i < number_of_referrals; i++)
6057         {
6058             ioffset += align_4(tvb, ioffset);
6059             value1 = tvb_get_letohl(tvb, ioffset);
6060             ioffset = ioffset + 4;
6061             temp_values.vstring = get_string(tvb, ioffset, value1);
6062             sub1item = proto_tree_add_string(ntree, hf_nds_base_class, tvb, ioffset,
6063                                              value1, temp_values.vstring);
6064             sub1tree = proto_item_add_subtree(sub1item, ett_nds);
6065             ioffset = ioffset + value1;
6066             ioffset += align_4(tvb, ioffset);
6067             if(values->vflags != 0)
6068             {
6069                 temp_values.vvalue = tvb_get_letohl(tvb, ioffset);
6070                 temp_values.vtype = VTYPE_BITFIELD;
6071                 temp_values.vdesc = "Class Flags:";
6072                 temp_values.vlength = 2;
6073                 temp_values.hfname= hf_nds_cflags;
6074                 temp_values.voffset = ioffset;
6075                 temp_values.bit1 = "Container";
6076                 temp_values.bit1hfname = hf_bit1cflags;
6077                 temp_values.bit2 = "Effective";
6078                 temp_values.bit2hfname = hf_bit2cflags;
6079                 temp_values.bit3 = "Class Definition Cannot be Removed";
6080                 temp_values.bit3hfname = hf_bit3cflags;
6081                 temp_values.bit4 = "Ambiguous Naming";
6082                 temp_values.bit4hfname = hf_bit4cflags;
6083                 temp_values.bit5 = "Ambiguous Containment";
6084                 temp_values.bit5hfname = hf_bit5cflags;
6085                 temp_values.bit6 = "Auxiliary";
6086                 temp_values.bit6hfname = hf_bit6cflags;
6087                 temp_values.bit7 = "Operational";
6088                 temp_values.bit7hfname = hf_bit7cflags;
6089                 temp_values.bit8 = "Sparse Required";
6090                 temp_values.bit8hfname = hf_bit8cflags;
6091                 temp_values.bit9 = "Sparse Operational";
6092                 temp_values.bit9hfname = hf_bit9cflags;
6093                 temp_values.bit10 = "Not Defined";
6094                 temp_values.bit10hfname = hf_bit10cflags;
6095                 temp_values.bit11 = "Not Defined";
6096                 temp_values.bit11hfname = hf_bit11cflags;
6097                 temp_values.bit12 = "Not Defined";
6098                 temp_values.bit12hfname = hf_bit12cflags;
6099                 temp_values.bit13 = "Not Defined";
6100                 temp_values.bit13hfname = hf_bit13cflags;
6101                 temp_values.bit14 = "Not Defined";
6102                 temp_values.bit14hfname = hf_bit14cflags;
6103                 temp_values.bit15 = "Not Defined";
6104                 temp_values.bit15hfname = hf_bit15cflags;
6105                 temp_values.bit16 = "Not Defined";
6106                 temp_values.bit16hfname = hf_bit16cflags;
6107                 process_bitfield(sub1tree, tvb, &temp_values);
6108                 ioffset = ioffset+4;
6109                 if(values->vflags != 5)
6110                 {
6111                     value1 = tvb_get_letohl(tvb, ioffset); /* length of field */
6112                     length_remaining = tvb_length_remaining(tvb, ioffset);
6113                     if(length_remaining == -1 || value1 > (guint32) length_remaining)
6114                     {
6115                         break;
6116                     }
6117                     ioffset += 4;
6118                     tvb_ensure_bytes_exist(tvb, ioffset, value1);
6119                     proto_tree_add_bytes(sub1tree, hf_nds_asn1, tvb, ioffset, value1, tvb_get_ptr(tvb, ioffset, value1));
6120                     ioffset += value1;
6121                     ioffset += (value1%2);
6122                 }
6123                 if(values->vflags == 1 || values->vflags == 2 || values->vflags == 4)
6124                 {
6125                     value1 = tvb_get_letohl(tvb, ioffset);  /* Super Classes */
6126                     sub2item = proto_tree_add_uint_format(sub1tree, hf_nds_number_of_items, tvb, ioffset,
6127                                                           4, value1, "Super Classes %u", value1);
6128                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6129                     ioffset = ioffset + 4;
6130                     for (r = 0; r < value1; r++)
6131                     {
6132                         value2 = tvb_get_letohl(tvb, ioffset);
6133                         ioffset = ioffset + 4;
6134                         temp_values.vstring = get_string(tvb, ioffset, value2);
6135                         proto_tree_add_string(sub2tree, hf_nds_super, tvb, ioffset,
6136                                               value2, temp_values.vstring);
6137                         ioffset = ioffset + value2;
6138                         ioffset += align_4(tvb, ioffset);
6139                     }
6140                     value1 = tvb_get_letohl(tvb, ioffset);  /* Containment Classes */
6141                     sub2item = proto_tree_add_uint_format(sub1tree, hf_nds_number_of_items, tvb, ioffset,
6142                                                           4, value1, "Containment Classes %u", value1);
6143                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6144                     ioffset = ioffset + 4;
6145                     for (r = 0; r < value1; r++)
6146                     {
6147                         value2 = tvb_get_letohl(tvb, ioffset);
6148                         ioffset = ioffset + 4;
6149                         temp_values.vstring = get_string(tvb, ioffset, value2);
6150                         proto_tree_add_string(sub2tree, hf_nds_base_class, tvb, ioffset,
6151                                               value2, temp_values.vstring);
6152                         ioffset = ioffset + value2;
6153                         ioffset += align_4(tvb, ioffset);
6154                     }
6155                     value1 = tvb_get_letohl(tvb, ioffset);  /* Naming Attributes */
6156                     sub2item = proto_tree_add_uint_format(sub1tree, hf_nds_number_of_items, tvb, ioffset,
6157                                                           4, value1, "Naming Attributes %u", value1);
6158                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6159                     ioffset = ioffset + 4;
6160                     for (r = 0; r < value1; r++)
6161                     {
6162                         value2 = tvb_get_letohl(tvb, ioffset);
6163                         ioffset = ioffset + 4;
6164                         temp_values.vstring = get_string(tvb, ioffset, value2);
6165                         proto_tree_add_string(sub2tree, hf_mv_string, tvb, ioffset,
6166                                               value2, temp_values.vstring);
6167                         ioffset = ioffset + value2;
6168                         ioffset += align_4(tvb, ioffset);
6169                     }
6170                     value1 = tvb_get_letohl(tvb, ioffset);  /* Mandatory Attributes */
6171                     sub2item = proto_tree_add_uint_format(sub1tree, hf_nds_number_of_items, tvb, ioffset,
6172                                                           4, value1, "Mandatory Attributes %u", value1);
6173                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6174                     ioffset = ioffset + 4;
6175                     for (r = 0; r < value1; r++)
6176                     {
6177                         value2 = tvb_get_letohl(tvb, ioffset);
6178                         ioffset = ioffset + 4;
6179                         temp_values.vstring = get_string(tvb, ioffset, value2);
6180                         proto_tree_add_string(sub2tree, hf_mv_string, tvb, ioffset,
6181                                               value2, temp_values.vstring);
6182                         ioffset = ioffset + value2;
6183                         ioffset += align_4(tvb, ioffset);
6184                     }
6185                     value1 = tvb_get_letohl(tvb, ioffset);  /* Optional Attributes */
6186                     sub2item = proto_tree_add_uint_format(sub1tree, hf_nds_number_of_items, tvb, ioffset,
6187                                                           4, value1, "Optional Attributes %u", value1);
6188                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6189                     ioffset = ioffset + 4;
6190                     for (r = 0; r < value1; r++)
6191                     {
6192                         ioffset += align_4(tvb, ioffset);
6193                         value2 = tvb_get_letohl(tvb, ioffset);
6194                         ioffset = ioffset + 4;
6195                         temp_values.vstring = get_string(tvb, ioffset, value2);
6196                         proto_tree_add_string(sub2tree, hf_mv_string, tvb, ioffset,
6197                                               value2, temp_values.vstring);
6198                         ioffset = ioffset + value2;
6199                         if(tvb_length_remaining(tvb, ioffset) < 4 )
6200                         {
6201                             break;
6202                         }
6203                     }
6204                 }
6205 #if 0
6206                 if(values->vflags == 2 || values->vflags == 4)   /* Class Definitions of Super Classes */
6207 #endif
6208                 if(values->vflags == 4)   /* Class Definitions of Super Classes */
6209                 {
6210                     value1 = tvb_get_letohl(tvb, ioffset);  /* Containment Classes */
6211                     sub2item = proto_tree_add_uint_format(sub1tree, hf_nds_number_of_items, tvb, ioffset,
6212                                                           4, value1, "Containment Classes %u", value1);
6213                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6214                     ioffset = ioffset + 4;
6215                     for (r = 0; r < value1; r++)
6216                     {
6217                         value2 = tvb_get_letohl(tvb, ioffset);
6218                         ioffset = ioffset + 4;
6219                         temp_values.vstring = get_string(tvb, ioffset, value2);
6220                         proto_tree_add_string(sub2tree, hf_nds_base_class, tvb, ioffset,
6221                                               value2, temp_values.vstring);
6222                         ioffset = ioffset + value2;
6223                         ioffset += align_4(tvb, ioffset);
6224                     }
6225                     value1 = tvb_get_letohl(tvb, ioffset);  /* Naming Attributes */
6226                     sub2item = proto_tree_add_uint_format(sub1tree, hf_nds_number_of_items, tvb, ioffset,
6227                                                           4, value1, "Naming Attributes %u", value1);
6228                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6229                     ioffset = ioffset + 4;
6230                     for (r = 0; r < value1; r++)
6231                     {
6232                         value2 = tvb_get_letohl(tvb, ioffset);
6233                         ioffset = ioffset + 4;
6234                         temp_values.vstring = get_string(tvb, ioffset, value2);
6235                         proto_tree_add_string(sub2tree, hf_mv_string, tvb, ioffset,
6236                                               value2, temp_values.vstring);
6237                         ioffset = ioffset + value2;
6238                         ioffset += align_4(tvb, ioffset);
6239                     }
6240                     value1 = tvb_get_letohl(tvb, ioffset);  /* Mandatory Attributes */
6241                     sub2item = proto_tree_add_uint_format(sub1tree, hf_nds_number_of_items, tvb, ioffset,
6242                                                           4, value1, "Mandatory Attributes %u", value1);
6243                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6244                     ioffset = ioffset + 4;
6245                     for (r = 0; r < value1; r++)
6246                     {
6247                         value2 = tvb_get_letohl(tvb, ioffset);
6248                         ioffset = ioffset + 4;
6249                         temp_values.vstring = get_string(tvb, ioffset, value2);
6250                         proto_tree_add_string(sub2tree, hf_mv_string, tvb, ioffset,
6251                                               value2, temp_values.vstring);
6252                         ioffset = ioffset + value2;
6253                         ioffset += align_4(tvb, ioffset);
6254                     }
6255                     value1 = tvb_get_letohl(tvb, ioffset);  /* Optional Attributes */
6256                     sub2item = proto_tree_add_uint_format(sub1tree, hf_nds_number_of_items, tvb, ioffset,
6257                                                           4, value1, "Optional Attributes %u", value1);
6258                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6259                     ioffset = ioffset + 4;
6260                     for (r = 0; r < value1; r++)
6261                     {
6262                         value2 = tvb_get_letohl(tvb, ioffset);
6263                         ioffset = ioffset + 4;
6264                         temp_values.vstring = get_string(tvb, ioffset, value2);
6265                         proto_tree_add_string(sub2tree, hf_mv_string, tvb, ioffset,
6266                                               value2, temp_values.vstring);
6267                         ioffset = ioffset + value2;
6268                         ioffset += align_4(tvb, ioffset);
6269                     }
6270                     value1 = tvb_get_letohl(tvb, ioffset);    /* Default ACL */
6271                     proto_tree_add_uint_format(sub1tree, hf_nds_eid, tvb, ioffset,
6272                                                4, value1, "Default ACL %08x", value1);
6273                     ioffset = ioffset + 4;
6274                     if(tvb_length_remaining(tvb, ioffset) < 4 )
6275                     {
6276                         break;
6277                     }
6278                 }
6279                 if(values->vflags == 5)   /* Base Class Definitions */
6280                 {
6281                     ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
6282                     ns.nsecs = 0;
6283                     proto_tree_add_time_format(sub1tree, hf_es_seconds, tvb, ioffset,
6284                                                4, &ns, "Creation Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
6285                     ioffset = ioffset + 4;
6286                     replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
6287                     proto_tree_add_item(sub1tree, hf_nds_replica_num, tvb, ioffset,
6288                                         2, replica_num);
6289                     ioffset = ioffset + 2;
6290                     event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
6291                     proto_tree_add_item(sub1tree, hf_nds_event_num, tvb, ioffset,
6292                                         2, event_num);
6293                     ioffset = ioffset + 2;
6294                     ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
6295                     ns.nsecs = 0;
6296                     proto_tree_add_time_format(sub1tree, hf_es_seconds, tvb, ioffset,
6297                                                4, &ns, "Modification Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
6298                     ioffset = ioffset + 4;
6299                     replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
6300                     proto_tree_add_item(sub1tree, hf_nds_replica_num, tvb, ioffset,
6301                                         2, replica_num);
6302                     ioffset = ioffset + 2;
6303                     event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
6304                     proto_tree_add_item(sub1tree, hf_nds_event_num, tvb, ioffset,
6305                                         2, event_num);
6306                     ioffset = ioffset + 2;
6307                     /* Class Definition */
6308                     value1 = tvb_get_letohl(tvb, ioffset);  /* Super Classes */
6309                     sub2item = proto_tree_add_uint_format(sub1tree, hf_nds_number_of_items, tvb, ioffset,
6310                                                           4, value1, "Super Classes %u", value1);
6311                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6312                     ioffset = ioffset + 4;
6313                     for (r = 0; r < value1; r++)
6314                     {
6315                         value2 = tvb_get_letohl(tvb, ioffset);
6316                         ioffset = ioffset + 4;
6317                         temp_values.vstring = get_string(tvb, ioffset, value2);
6318                         proto_tree_add_string(sub2tree, hf_nds_super, tvb, ioffset,
6319                                               value2, temp_values.vstring);
6320                         ioffset = ioffset + value2;
6321                         ioffset += align_4(tvb, ioffset);
6322                     }
6323                     value1 = tvb_get_letohl(tvb, ioffset);  /* Containment Classes */
6324                     sub2item = proto_tree_add_uint_format(sub1tree, hf_nds_number_of_items, tvb, ioffset,
6325                                                           4, value1, "Containment Classes %u", value1);
6326                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6327                     ioffset = ioffset + 4;
6328                     for (r = 0; r < value1; r++)
6329                     {
6330                         value2 = tvb_get_letohl(tvb, ioffset);
6331                         ioffset = ioffset + 4;
6332                         temp_values.vstring = get_string(tvb, ioffset, value2);
6333                         proto_tree_add_string(sub2tree, hf_nds_base_class, tvb, ioffset,
6334                                               value2, temp_values.vstring);
6335                         ioffset = ioffset + value2;
6336                         ioffset += align_4(tvb, ioffset);
6337                     }
6338                     value1 = tvb_get_letohl(tvb, ioffset);  /* Naming Attributes */
6339                     sub2item = proto_tree_add_uint_format(sub1tree, hf_nds_number_of_items, tvb, ioffset,
6340                                                           4, value1, "Naming Attributes %u", value1);
6341                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6342                     ioffset = ioffset + 4;
6343                     for (r = 0; r < value1; r++)
6344                     {
6345                         value2 = tvb_get_letohl(tvb, ioffset);
6346                         ioffset = ioffset + 4;
6347                         temp_values.vstring = get_string(tvb, ioffset, value2);
6348                         proto_tree_add_string(sub2tree, hf_mv_string, tvb, ioffset,
6349                                               value2, temp_values.vstring);
6350                         ioffset = ioffset + value2;
6351                         ioffset += align_4(tvb, ioffset);
6352                     }
6353                     value1 = tvb_get_letohl(tvb, ioffset);  /* Mandatory Attributes */
6354                     sub2item = proto_tree_add_uint_format(sub1tree, hf_nds_number_of_items, tvb, ioffset,
6355                                                           4, value1, "Mandatory Attributes %u", value1);
6356                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6357                     ioffset = ioffset + 4;
6358                     for (r = 0; r < value1; r++)
6359                     {
6360                         value2 = tvb_get_letohl(tvb, ioffset);
6361                         ioffset = ioffset + 4;
6362                         temp_values.vstring = get_string(tvb, ioffset, value2);
6363                         proto_tree_add_string(sub2tree, hf_mv_string, tvb, ioffset,
6364                                               value2, temp_values.vstring);
6365                         ioffset = ioffset + value2;
6366                         ioffset += align_4(tvb, ioffset);
6367                     }
6368                     value1 = tvb_get_letohl(tvb, ioffset);  /* Optional Attributes */
6369                     sub2item = proto_tree_add_uint_format(sub1tree, hf_nds_number_of_items, tvb, ioffset,
6370                                                           4, value1, "Optional Attributes %u", value1);
6371                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6372                     ioffset = ioffset + 4;
6373                     for (r = 0; r < value1; r++)
6374                     {
6375                         value2 = tvb_get_letohl(tvb, ioffset);
6376                         ioffset = ioffset + 4;
6377                         temp_values.vstring = get_string(tvb, ioffset, value2);
6378                         proto_tree_add_string(sub2tree, hf_mv_string, tvb, ioffset,
6379                                               value2, temp_values.vstring);
6380                         ioffset = ioffset + value2;
6381                         ioffset += align_4(tvb, ioffset);
6382                     }
6383                     value1 = tvb_get_letohl(tvb, ioffset);    /* Default ACL */
6384                     proto_tree_add_uint_format(sub1tree, hf_nds_eid, tvb, ioffset,
6385                                                4, value1, "Default ACL %08x", value1);
6386                     ioffset = ioffset + 4;
6387                     if(tvb_length_remaining(tvb, ioffset) < 4 )
6388                     {
6389                         break;
6390                     }
6391                 }
6392             }
6393         }
6394         break;
6395
6396     case MVTYPE_MODIFY_CLASS:     /* Modify Class */
6397         for (i = 1 ; i <= values->vvalue; i++ )   /* Attribute Names to add*/
6398         {
6399             ioffset += align_4(tvb, ioffset);
6400             value1 = tvb_get_letohl(tvb, ioffset);
6401             ioffset = ioffset + 4;
6402             values->vstring = get_string(tvb, ioffset, value1);
6403             proto_tree_add_string(ntree, hf_mv_string, tvb, ioffset,
6404                                   value1, values->vstring);
6405             ioffset = ioffset + value1;
6406         }
6407         if(tvb_length_remaining(tvb, ioffset) < 4 )
6408         {
6409             break;
6410         }
6411         ioffset += align_4(tvb, ioffset);
6412         value1 = tvb_get_letohl(tvb, ioffset);
6413         proto_tree_add_uint_format(ntree, hf_nds_att_del, tvb, ioffset,
6414                                    4, value1, "Attribute Names to Delete %u", value1);
6415         ioffset = ioffset + 4;
6416         for (i = 1 ; i <= value1; i++ )   /* Attribute Names to delete*/
6417         {
6418             ioffset += align_4(tvb, ioffset);
6419             value2 = tvb_get_letohl(tvb, ioffset);
6420             ioffset = ioffset + 4;
6421             values->vstring = get_string(tvb, ioffset, value2);
6422             proto_tree_add_string(ntree, hf_mv_string, tvb, ioffset,
6423                                   value2, values->vstring);
6424             ioffset = ioffset + value2;
6425         }
6426         if(tvb_length_remaining(tvb, ioffset) < 4 )
6427         {
6428             break;
6429         }
6430         ioffset += align_4(tvb, ioffset);
6431         value1 = tvb_get_letohl(tvb, ioffset);
6432         proto_tree_add_uint_format(ntree, hf_nds_acl_add, tvb, ioffset,
6433                                    4, value1, "ACL Templates to Add %u", value1);
6434         ioffset = ioffset + 4;
6435         for (i = 1 ; i <= value1; i++ )   /* ACL templates to add*/
6436         {
6437             ioffset += align_4(tvb, ioffset);
6438             value2 = tvb_get_letohl(tvb, ioffset);  /* Attribute Name */
6439             ioffset = ioffset + 4;
6440             values->vstring = get_string(tvb, ioffset, value2);
6441             proto_tree_add_string(ntree, hf_nds_attribute_dn, tvb, ioffset,
6442                                   value2, values->vstring);
6443             ioffset = ioffset + value2;
6444             ioffset += align_4(tvb, ioffset);
6445             value2 = tvb_get_letohl(tvb, ioffset);  /* DN of Trustee */
6446             ioffset = ioffset + 4;
6447             values->vstring = get_string(tvb, ioffset, value2);
6448             proto_tree_add_string(ntree, hf_nds_trustee_dn, tvb, ioffset,
6449                                   value2, values->vstring);
6450             ioffset = ioffset + value2;
6451             ioffset += align_4(tvb, ioffset);
6452             value1 = tvb_get_letohl(tvb, ioffset);
6453             proto_tree_add_uint_format(ntree, hf_nds_privileges, tvb, ioffset,
6454                                        4, value1, "Privileges 0x%08x", value1);
6455             ioffset = ioffset + 4;
6456         }
6457         if(tvb_length_remaining(tvb, ioffset) < 4 )
6458         {
6459             break;
6460         }
6461         ioffset += align_4(tvb, ioffset);
6462         value1 = tvb_get_letohl(tvb, ioffset);
6463         proto_tree_add_uint_format(ntree, hf_nds_acl_del, tvb, ioffset,
6464                                    4, value1, "ACL Templates to Delete %u", value1);
6465         ioffset = ioffset + 4;
6466         for (i = 1 ; i <= value1; i++ )   /* ACL templates to delete*/
6467         {
6468             ioffset += align_4(tvb, ioffset);
6469             value2 = tvb_get_letohl(tvb, ioffset);  /* Attribute Name */
6470             ioffset = ioffset + 4;
6471             values->vstring = get_string(tvb, ioffset, value2);
6472             proto_tree_add_string(ntree, hf_nds_attribute_dn, tvb, ioffset,
6473                                   value2, values->vstring);
6474             ioffset = ioffset + value2;
6475             ioffset += align_4(tvb, ioffset);
6476             value2 = tvb_get_letohl(tvb, ioffset);  /* DN of Trustee */
6477             ioffset = ioffset + 4;
6478             values->vstring = get_string(tvb, ioffset, value2);
6479             proto_tree_add_string(ntree, hf_nds_trustee_dn, tvb, ioffset,
6480                                   value2, values->vstring);
6481             ioffset = ioffset + value2;
6482             ioffset += align_4(tvb, ioffset);
6483             value1 = tvb_get_letohl(tvb, ioffset);  /* Privileges */
6484             proto_tree_add_uint_format(ntree, hf_nds_privileges, tvb, ioffset,
6485                                        4, value1, "Privileges 0x%08x", value1);
6486             ioffset = ioffset + 4;
6487         }
6488         break;
6489
6490     case MVTYPE_PROCESS_TAGS: /* Process tags and paths depending on name type returned. */
6491         switch (values->vflags) {
6492
6493         case 8:  /* Tuned Name */
6494             proto_tree_add_item(ntree, hf_nds_tune_mark, tvb, ioffset, 2, FALSE);
6495             ioffset += 2;
6496             value1 = tvb_get_letohs(tvb, ioffset);
6497             valuestr = match_strval(value1, nds_tuned_tags);
6498             if (valuestr == NULL)
6499             {
6500                 valuestr="(Undefined Tuned Name Tag)";
6501             }
6502             proto_tree_add_string_format(ntree, hf_value_string, tvb, ioffset,
6503                                          2, valuestr, "Tuned Name Tag -> %s", valuestr);
6504             ioffset += 2;
6505             ioffset += align_4(tvb, ioffset);
6506             if (value1 == 0) { /* RDN Hint - really just returns the dist name + timestamp info */
6507                 value2 = tvb_get_letohl(tvb, ioffset);  /* Distinguished Name Len, String[len]*/
6508                 ioffset = ioffset + 4;
6509                 values->vstring = get_string(tvb, ioffset, value2);
6510                 proto_tree_add_string(ntree, hf_mv_string, tvb, ioffset,
6511                                       value2, values->vstring);
6512                 ioffset += value2;
6513                 ioffset += align_4(tvb, ioffset);
6514                 ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
6515                 ns.nsecs = 0;
6516                 proto_tree_add_time_format(ntree, hf_es_seconds, tvb, ioffset,
6517                                            4, &ns, "Creation Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
6518                 ioffset += 4;
6519                 replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
6520                 proto_tree_add_item(ntree, hf_nds_replica_num, tvb, ioffset,
6521                                     2, replica_num);
6522                 ioffset = ioffset + 2;
6523                 event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
6524                 proto_tree_add_item(ntree, hf_nds_event_num, tvb, ioffset,
6525                                     2, event_num);
6526                 ioffset = ioffset + 2;
6527             }
6528             else /* Process the full RDN history including ancestors */
6529             {
6530                 value1 = tvb_get_letohl(tvb, ioffset);
6531                 sub1item = proto_tree_add_uint_format(ntree, hf_nds_acl_del, tvb, ioffset,
6532                                                       4, value1, "Number of RDN Items %u", value1);
6533                 sub1tree = proto_item_add_subtree(sub1item, ett_nds);
6534                 ioffset = ioffset + 4;
6535                 for (i=1; i <= value1; i++) {
6536                     sub2item = proto_tree_add_text(sub1tree, tvb, ioffset, 0, "Item %u", i);
6537                     sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6538                     ioffset += align_4(tvb, ioffset);
6539
6540                     value5 = tvb_get_letohl(tvb, ioffset);
6541                     valuestr = match_strval(value5, nds_tuned_item_tags);
6542                     if (valuestr == NULL)
6543                     {
6544                         valuestr="(Undefined Tuned Name Tag)";
6545                     }
6546                     if (value5 == 0) { /* Items are timestamp + Distinguished name (0 value == one entry)*/
6547                         proto_tree_add_string_format(sub2tree, hf_value_string, tvb, ioffset,
6548                                                      4, valuestr, "Item Tag -> %s", valuestr);
6549                         ioffset += 4;
6550                         ns.secs = tvb_get_letohl(tvb, ioffset);   /* Seconds */
6551                         ns.nsecs = 0;
6552                         proto_tree_add_time_format(sub2tree, hf_es_seconds, tvb, ioffset,
6553                                                    4, &ns, "Timestamp: %s", abs_time_secs_to_str(ns.secs, ABSOLUTE_TIME_LOCAL, TRUE));
6554                         ioffset += 4;
6555                         replica_num = tvb_get_letohs(tvb, ioffset);   /* Replica */
6556                         proto_tree_add_item(sub2tree, hf_nds_replica_num, tvb, ioffset,
6557                                             2, replica_num);
6558                         ioffset = ioffset + 2;
6559                         event_num = tvb_get_letohs(tvb, ioffset);   /* Event */
6560                         proto_tree_add_item(sub2tree, hf_nds_event_num, tvb, ioffset,
6561                                             2, event_num);
6562                         ioffset = ioffset + 2;
6563                         value2 = tvb_get_letohl(tvb, ioffset);  /* Distinguished Name Len, String[len]*/
6564                         ioffset = ioffset + 4;
6565                         values->vstring = get_string(tvb, ioffset, value2);
6566                         proto_tree_add_string(sub2tree, hf_mv_string, tvb, ioffset,
6567                                               value2, values->vstring);
6568                         ioffset += value2;
6569                     }
6570                     /* XXX: What if "multiple items" ?                 */
6571                     /*      What if "Undefined ... " ?                 */
6572                     /*      For now: we'll just keep on walking...     */
6573                     /*      Presumably we'll get a ReportedBoundsError */
6574                     /*       pretty quickly.                           */
6575                     else   /* Undefined or "multiple items" ... */
6576                     {
6577                         ioffset += 4;
6578                     }
6579                 } /* for */
6580             } /* else */
6581             values->voffset=ioffset;
6582             break;
6583         default: /* All other name types are just a string */
6584             values->vstring = get_string(tvb, ioffset, values->vlength);
6585             proto_tree_add_string(ntree, hf_mv_string, tvb, ioffset,
6586                                   values->vlength, values->vstring);
6587             values->voffset=ioffset + values->vlength;
6588             ioffset = values->voffset;
6589             ioffset += align_4(tvb, ioffset);
6590             break;
6591         } /* switch (values->vflags) */
6592         break;
6593
6594     case MVTYPE_PROCESS_ITERATOR: /* Process Iterator subverbs. */
6595         temp_values.vvalue = tvb_get_letohl(tvb, ioffset);
6596
6597         temp_values.vstring = match_strval(temp_values.vvalue, nds_info_type);
6598         if(temp_values.vstring == NULL)
6599         {
6600             temp_values.vstring = "No Info Type Set";
6601         }
6602         /*g_strdup(value)*/
6603         proto_tree_add_string(ntree, hf_nds_info_type, tvb, ioffset, 4, temp_values.vstring);
6604         ioffset = ioffset + 4;
6605         temp_values.vvalue = tvb_get_letohs(tvb, ioffset);
6606         value5 = tvb_get_letohl(tvb, ioffset);
6607         temp_values.vdesc = "Information Flags (low) Byte:";
6608         temp_values.vlength = 2;
6609         temp_values.hfname = hf_nds_rflags;
6610         temp_values.voffset = ioffset;
6611         temp_values.bit1 = "Output Flags";
6612         temp_values.bit1hfname = hf_bit1infoflagsl;
6613         temp_values.bit2 = "Entry ID";
6614         temp_values.bit2hfname = hf_bit2infoflagsl;
6615         temp_values.bit3 = "Entry Flags";
6616         temp_values.bit3hfname = hf_bit3infoflagsl;
6617         temp_values.bit4 = "Subordinate Count";
6618         temp_values.bit4hfname = hf_bit4infoflagsl;
6619         temp_values.bit5 = "Modification Time";
6620         temp_values.bit5hfname = hf_bit5infoflagsl;
6621         temp_values.bit6 = "Modification Timestamp";
6622         temp_values.bit6hfname = hf_bit6infoflagsl;
6623         temp_values.bit7 = "Creation Timestamp";
6624         temp_values.bit7hfname = hf_bit7infoflagsl;
6625         temp_values.bit8 = "Partition Root ID";
6626         temp_values.bit8hfname = hf_bit8infoflagsl;
6627         temp_values.bit9 = "Parent ID";
6628         temp_values.bit9hfname = hf_bit9infoflagsl;
6629         temp_values.bit10 = "Revision Count";
6630         temp_values.bit10hfname = hf_bit10infoflagsl;
6631         temp_values.bit11 = "Replica Type";
6632         temp_values.bit11hfname = hf_bit11infoflagsl;
6633         temp_values.bit12 = "Base Class";
6634         temp_values.bit12hfname = hf_bit12infoflagsl;
6635         temp_values.bit13 = "Relative Distinguished Name";
6636         temp_values.bit13hfname = hf_bit13infoflagsl;
6637         temp_values.bit14 = "Distinguished Name";
6638         temp_values.bit14hfname = hf_bit14infoflagsl;
6639         temp_values.bit15 = "Root Distinguished Name";
6640         temp_values.bit15hfname = hf_bit15infoflagsl;
6641         temp_values.bit16 = "Parent Distinguished Name";
6642         temp_values.bit16hfname = hf_bit16infoflagsl;
6643         process_bitfield(ntree, tvb, &temp_values);
6644         ioffset = ioffset+2;
6645         temp_values.vvalue = tvb_get_letohs(tvb, ioffset);
6646         temp_values.vtype = VTYPE_BITFIELD;
6647         temp_values.vdesc = "Information Flags (high) Byte:";
6648         temp_values.vlength = 2;
6649         temp_values.hfname= hf_nds_rflags;
6650         temp_values.voffset = ioffset;
6651         temp_values.bit1 = "Purge Time";
6652         temp_values.bit1hfname = hf_bit1infoflagsh;
6653         temp_values.bit2 = "Dereference Base Class";
6654         temp_values.bit2hfname = hf_bit2infoflagsh;
6655         temp_values.bit3 = "Replica Number";
6656         temp_values.bit3hfname = hf_bit3infoflagsh;
6657         temp_values.bit4 = "Replica State";
6658         temp_values.bit4hfname = hf_bit4infoflagsh;
6659         temp_values.bit5 = "Federation Boundary";
6660         temp_values.bit5hfname = hf_bit5infoflagsh;
6661         temp_values.bit6 = "Schema Boundary";
6662         temp_values.bit6hfname = hf_bit6infoflagsh;
6663         temp_values.bit7 = "Federation Boundary ID";
6664         temp_values.bit7hfname = hf_bit7infoflagsh;
6665         temp_values.bit8 = "Schema Boundary ID";
6666         temp_values.bit8hfname = hf_bit8infoflagsh;
6667         temp_values.bit9 = "Current Subcount";
6668         temp_values.bit9hfname = hf_bit9infoflagsh;
6669         temp_values.bit10 = "Local Entry Flags";
6670         temp_values.bit10hfname = hf_bit10infoflagsh;
6671         temp_values.bit11 = "Not Defined";
6672         temp_values.bit11hfname = hf_bit11infoflagsh;
6673         temp_values.bit12 = "Not Defined";
6674         temp_values.bit12hfname = hf_bit12infoflagsh;
6675         temp_values.bit13 = "Not Defined";
6676         temp_values.bit13hfname = hf_bit13infoflagsh;
6677         temp_values.bit14 = "Not Defined";
6678         temp_values.bit14hfname = hf_bit14infoflagsh;
6679         temp_values.bit15 = "Not Defined";
6680         temp_values.bit15hfname = hf_bit15infoflagsh;
6681         temp_values.bit16 = "Not Defined";
6682         temp_values.bit16hfname = hf_bit16infoflagsh;
6683         ioffset = ioffset+2;
6684         process_bitfield(ntree, tvb, &temp_values);
6685         ioffset += 4;
6686         proto_tree_add_item(ntree, hf_nds_time_filter, tvb, ioffset, 4, FALSE);
6687         ioffset += 4;
6688         proto_tree_add_item(ntree, hf_nds_all_attr, tvb, ioffset, 4, FALSE);
6689         ioffset += 4;
6690         value2 = tvb_get_letohl(tvb, ioffset);
6691         sub1item = proto_tree_add_uint_format(ntree, hf_nds_number_of_items, tvb, ioffset,
6692                                               4, value2, "Number of Attributes %u", value2);
6693         sub1tree = proto_item_add_subtree(sub1item, ett_nds);
6694         ioffset += 4;
6695         for (i=1; i<=value2; i++) {
6696             sub2item = proto_tree_add_text(sub1tree, tvb, ioffset, 0, "Attribute %u", i);
6697             sub2tree = proto_item_add_subtree(sub2item, ett_nds);
6698             ioffset += align_4(tvb, ioffset);
6699             value3 = tvb_get_letohl(tvb, ioffset);  /* Attribute Name */
6700             ioffset = ioffset + 4;
6701             values->vstring = get_string(tvb, ioffset, value3);
6702             proto_tree_add_string(sub2tree, hf_nds_attribute_dn, tvb, ioffset,
6703                                   value3, values->vstring);
6704             ioffset = ioffset + value3;
6705
6706             if(tvb_length_remaining(tvb, ioffset) < 4 )
6707             {
6708                 break;
6709             }
6710         }
6711         ioffset += align_4(tvb, ioffset);
6712         value4 = tvb_get_letohl(tvb, ioffset);
6713         values->vstring = match_strval(value4, iterator_subverbs);
6714         if(values->vstring == NULL)
6715         {
6716             values->vstring = "(No Iteration Verb Found)";
6717         }
6718         ioffset += 4;
6719         dissect_nds_iterator(ntree, tvb, pinfo, value4, value5, ioffset, TRUE);
6720
6721         values->vstring = ep_strdup_printf("(%s)", values->vstring);
6722         break;
6723
6724     default:
6725         break;
6726     }
6727 }
6728
6729 static void
6730 dissect_ncp_89_6_request(tvbuff_t *tvb, proto_tree *volatile ncp_tree, guint32 offset)
6731 {
6732     guint32 string_len, datatype, count, i;
6733
6734     datatype = tvb_get_letohl(tvb, offset);
6735     proto_tree_add_item(ncp_tree, hf_ncp_data_type_flag, tvb, offset, 1, TRUE);
6736     offset += 1;
6737     proto_tree_add_item(ncp_tree, hf_ncp_reserved5, tvb, offset, 5, TRUE);
6738     offset += 5;
6739     count = tvb_get_guint8(tvb, offset);
6740     proto_tree_add_item(ncp_tree, hf_ncp_path_count, tvb, offset, 1, TRUE);
6741     offset += 1;
6742     for (i=0; i < count; i++) {
6743         if (datatype == 0) {
6744             string_len = (tvb_get_guint8(tvb, offset))+1;
6745             proto_tree_add_item(ncp_tree, hf_ncp_directory_path, tvb, offset+1, string_len-1, TRUE);
6746         }
6747         else
6748         {
6749             string_len = (tvb_get_letohs(tvb, offset))+2;
6750             proto_tree_add_item(ncp_tree, hf_ncp_directory_path, tvb, offset+2, string_len-2, TRUE);
6751         }
6752         offset += string_len;
6753         if(tvb_length_remaining(tvb, offset) < 4 )
6754         {
6755             break;
6756         }
6757     }
6758 }
6759
6760
6761 static void
6762 dissect_ncp_123_11_reply(tvbuff_t *tvb, proto_tree *volatile ncp_tree, ncp_req_hash_value *request_value)
6763 {
6764     int string_len, loffset;
6765
6766     loffset = 76;
6767     if (request_value->length == 7) {
6768         /* Undocumented, if request value length is 7 then the reply is offset by 8 bytes.
6769          * Unknown what these 8 bytes represent */
6770         loffset += 8;
6771     }
6772     string_len = tvb_get_guint8(tvb, loffset);
6773     proto_tree_add_item(ncp_tree, hf_ncp_file_name_12, tvb, loffset+1, string_len, TRUE);
6774     loffset += string_len+1;
6775     string_len = tvb_get_guint8(tvb, loffset);
6776     proto_tree_add_item(ncp_tree, hf_ncp_name12, tvb, loffset+1, string_len, TRUE);
6777     loffset += string_len+1;
6778     string_len = tvb_get_guint8(tvb, loffset);
6779     proto_tree_add_item(ncp_tree, hf_ncp_copyright, tvb, loffset+1, string_len, TRUE);
6780 }
6781
6782 static void
6783 dissect_ncp_123_17_reply(tvbuff_t *tvb, proto_tree *volatile ncp_tree)
6784 {
6785     proto_tree              *atree;
6786     proto_item              *aitem;
6787     guint32 loffset, number_of_items, addr_type;
6788     guint16 x;
6789
6790     number_of_items = tvb_get_letohl(tvb, 36);
6791     proto_tree_add_item(ncp_tree, hf_ncp_items_in_packet, tvb, 36, 4, TRUE);
6792     loffset = 40;
6793     for (x = 1; x <= number_of_items; x++)
6794     {
6795         aitem = proto_tree_add_text(ncp_tree, tvb, loffset, -1, "Network Address - %u", x);
6796         atree = proto_item_add_subtree(aitem, ett_ncp);
6797
6798         addr_type = tvb_get_guint8(tvb, loffset);
6799         proto_tree_add_item(atree, hf_ncp_transport_type, tvb, loffset, 1, TRUE);
6800         /* The address type is one byte of a 4 byte value. The next 4 bytes are
6801          * the length of the address. Since we already know the length based upon
6802          * the type of address, we can skip this value. So set the offset accourdingly */
6803         loffset += 8;
6804
6805         switch (addr_type)
6806         {
6807         case 1:
6808             proto_tree_add_item(atree, hf_nds_net, tvb, loffset, 4, FALSE);
6809             proto_tree_add_item(atree, hf_nds_node, tvb, loffset+4, 6, FALSE);
6810             proto_tree_add_item(atree, hf_nds_socket, tvb, loffset+10, 2, FALSE);
6811             loffset += 12;
6812             break;
6813         case 5:
6814             proto_tree_add_item(atree, hf_nds_port, tvb, loffset, 2, FALSE);
6815             proto_tree_add_item(atree, hf_add_ref_udp, tvb, loffset+2, 4, FALSE);
6816             loffset += 6;
6817             break;
6818         case 6:
6819             proto_tree_add_item(atree, hf_nds_port, tvb, loffset, 2, FALSE);
6820             proto_tree_add_item(atree, hf_add_ref_tcp, tvb, loffset+2, 4, FALSE);
6821             loffset += 6;
6822             break;
6823         default:
6824             proto_tree_add_text(atree, tvb, loffset, -1, "Unknown Address Type");
6825             /* unknown type so read the length field and then
6826              * just skip the record and move on to the next */
6827             loffset += tvb_get_letohl(tvb, loffset - 4);
6828             break;
6829         }
6830         proto_item_set_end(aitem, tvb, loffset);
6831         if(tvb_length_remaining(tvb, loffset) < 4 )
6832         {
6833             break;
6834         }
6835     }
6836 }
6837
6838 static void
6839 dissect_ncp_23_26_reply(tvbuff_t *tvb, proto_tree *volatile ncp_tree)
6840 {
6841     /* For an IP-only server, the 4-byte IP address is placed into the 4-byte NetworkAddress
6842      * field of the NetworkAddressStruct, while the NetworkNodeAddress and NetworkSocket
6843      * fields are left blank. */
6844     if (tvb_get_letohl(tvb, 12)==0) {
6845         /* IP Address */
6846         proto_tree_add_item(ncp_tree, hf_ncp_ip_address, tvb, 8, 4, FALSE);
6847     }
6848     else
6849     {
6850         /* IPX Address */
6851         proto_tree_add_item(ncp_tree, hf_nds_net, tvb, 8, 4, FALSE);
6852         proto_tree_add_item(ncp_tree, hf_nds_node, tvb, 12, 6, FALSE);
6853         proto_tree_add_item(ncp_tree, hf_nds_socket, tvb, 18, 2, FALSE);
6854     }
6855     proto_tree_add_item(ncp_tree, hf_ncp_connection_type, tvb, 20, 1, TRUE);
6856 }
6857
6858 static void
6859 dissect_ncp_8x20reply(tvbuff_t *tvb, proto_tree *volatile ncp_tree,
6860                       const ncp_record *ncp_rec, ncp_req_hash_value *request_value)
6861 {
6862     guint16             x;
6863     guint32             loffset, number_of_items, str_length;
6864     ptvcursor_t         *ptvc = NULL;
6865     proto_tree          *atree, *btree;
6866     proto_item          *aitem, *bitem;
6867
6868     aitem = proto_tree_add_text(ncp_tree, tvb, 8, 9, "Search Sequence:");
6869     atree = proto_item_add_subtree(aitem, ett_ncp);
6870
6871     proto_tree_add_item(atree, hf_ncp_volume_number, tvb, 8, 1, TRUE);
6872     proto_tree_add_item(atree, hf_ncp_directory_entry_number, tvb, 9, 4, TRUE);
6873     proto_tree_add_item(atree, hf_ncp_sequence_number, tvb, 13, 4, TRUE);
6874
6875     proto_tree_add_item(ncp_tree, hf_ncp_more_flag, tvb, 17, 1, TRUE);
6876     number_of_items = tvb_get_letohs(tvb, 18);
6877     proto_tree_add_item(ncp_tree, hf_ncp_info_count, tvb, 18, 2, TRUE);
6878     loffset = 20;
6879     for (x = 1; x <= number_of_items; x++ )
6880     {
6881         aitem = proto_tree_add_text(ncp_tree, tvb, loffset, -1, "Information Item %u", x);
6882         atree = proto_item_add_subtree(aitem, ett_ncp);
6883         /* Data Stream Space Allocated */
6884         if (request_value->req_mask & 0x0002) {
6885             proto_tree_add_item(atree, hf_ncp_data_stream_space_alloc, tvb, loffset, 4, TRUE);
6886             loffset += 4;
6887         }
6888         else
6889         {
6890             if ((request_value->req_mask_ext & 0x8000)==FALSE) {
6891                 loffset += 4;
6892             }
6893         }
6894         /* Attributes */
6895         if (request_value->req_mask & 0x0004) {
6896             bitem = proto_tree_add_text(atree, tvb, loffset, -1, "Attributes");
6897             btree = proto_item_add_subtree(bitem, ett_ncp);
6898             ptvc = ptvcursor_new(btree, tvb, loffset);
6899             process_ptvc_record(ptvc, ptvc_struct_attributes_struct,
6900                     NULL, TRUE, ncp_rec);
6901             ptvcursor_free(ptvc);
6902             loffset += 6;
6903             proto_item_set_end(bitem, tvb, loffset);
6904         }
6905         else
6906         {
6907             if ((request_value->req_mask_ext & 0x8000)==FALSE) {
6908                 loffset += 6;
6909             }
6910         }
6911         /* Data Stream Size */
6912         if (request_value->req_mask & 0x0008) {
6913             bitem = proto_tree_add_text(atree, tvb, loffset, -1, "Data Stream Size");
6914             btree = proto_item_add_subtree(bitem, ett_ncp);
6915             proto_tree_add_item(btree, hf_ncp_data_stream_size, tvb, loffset, 4, TRUE);
6916             loffset += 4;
6917             proto_item_set_end(bitem, tvb, loffset);
6918         }
6919         else
6920         {
6921             if ((request_value->req_mask_ext & 0x8000)==FALSE) {
6922                 loffset += 4;
6923             }
6924         }
6925         /* Total Stream Size */
6926         if (request_value->req_mask & 0x0010) {
6927             bitem = proto_tree_add_text(atree, tvb, loffset, -1, "Total Stream Size");
6928             btree = proto_item_add_subtree(bitem, ett_ncp);
6929             proto_tree_add_item(btree, hf_ncp_ttl_ds_disk_space_alloc, tvb, loffset, 4, TRUE);
6930             proto_tree_add_item(btree, hf_ncp_number_of_data_streams, tvb, loffset+4, 2, TRUE);
6931             loffset += 6;
6932             proto_item_set_end(bitem, tvb, loffset);
6933         }
6934         else
6935         {
6936             if ((request_value->req_mask_ext & 0x8000)==FALSE) {
6937                 loffset += 6;
6938             }
6939         }
6940         /* Extended Attributes new style location*/
6941         if (request_value->req_mask & 0x0020 && ncp_newstyle) {
6942             bitem = proto_tree_add_text(atree, tvb, loffset, -1, "Extended Attributes");
6943             btree = proto_item_add_subtree(bitem, ett_ncp);
6944             ptvc = ptvcursor_new(btree, tvb, loffset);
6945             process_ptvc_record(ptvc, ptvc_struct_ea_info_struct,
6946                     NULL, TRUE, ncp_rec);
6947             ptvcursor_free(ptvc);
6948             loffset += 12;
6949             proto_item_set_end(bitem, tvb, loffset);
6950         }
6951         else
6952         {
6953             if ((request_value->req_mask_ext & 0x8000)==FALSE && ncp_newstyle) {
6954                 loffset += 12;
6955             }
6956         }
6957         /* Creation Information old style location */
6958         if (request_value->req_mask & 0x0100 && !ncp_newstyle) {
6959             bitem = proto_tree_add_text(atree, tvb, loffset, -1, "Creation");
6960             btree = proto_item_add_subtree(bitem, ett_ncp);
6961             ptvc = ptvcursor_new(btree, tvb, loffset);
6962             process_ptvc_record(ptvc, ptvc_struct_creation_info_struct,
6963                     NULL, TRUE, ncp_rec);
6964             ptvcursor_free(ptvc);
6965             loffset += 8;
6966             proto_item_set_end(bitem, tvb, loffset);
6967         }
6968         else
6969         {
6970             if ((request_value->req_mask_ext & 0x8000)==FALSE && !ncp_newstyle) {
6971                 loffset += 8;
6972             }
6973         }
6974         /* Modification Information */
6975         if (request_value->req_mask & 0x0080) {
6976             bitem = proto_tree_add_text(atree, tvb, loffset, -1, "Modification");
6977             btree = proto_item_add_subtree(bitem, ett_ncp);
6978             ptvc = ptvcursor_new(btree, tvb, loffset);
6979             process_ptvc_record(ptvc, ptvc_struct_modify_info_struct,
6980                     NULL, TRUE, ncp_rec);
6981             ptvcursor_free(ptvc);
6982             loffset += 10;
6983             proto_item_set_end(bitem, tvb, loffset);
6984         }
6985         else
6986         {
6987             if ((request_value->req_mask_ext & 0x8000)==FALSE) {
6988                 loffset += 10;
6989             }
6990         }
6991         /* Creation Information new style location */
6992         if (request_value->req_mask & 0x0100 && ncp_newstyle) {
6993             bitem = proto_tree_add_text(atree, tvb, loffset, -1, "Creation");
6994             btree = proto_item_add_subtree(bitem, ett_ncp);
6995             ptvc = ptvcursor_new(btree, tvb, loffset);
6996             process_ptvc_record(ptvc, ptvc_struct_creation_info_struct,
6997                     NULL, TRUE, ncp_rec);
6998             ptvcursor_free(ptvc);
6999             loffset += 8;
7000             proto_item_set_end(bitem, tvb, loffset);
7001         }
7002         else
7003         {
7004             if ((request_value->req_mask_ext & 0x8000)==FALSE && ncp_newstyle) {
7005                 loffset += 8;
7006             }
7007         }
7008         /* Archive Information */
7009         if (request_value->req_mask & 0x0040) {
7010             bitem = proto_tree_add_text(atree, tvb, loffset, -1, "Archive");
7011             btree = proto_item_add_subtree(bitem, ett_ncp);
7012             ptvc = ptvcursor_new(btree, tvb, loffset);
7013             process_ptvc_record(ptvc, ptvc_struct_archive_info_struct,
7014                     NULL, TRUE, ncp_rec);
7015             ptvcursor_free(ptvc);
7016             loffset += 8;
7017             proto_item_set_end(bitem, tvb, loffset);
7018         }
7019         else
7020         {
7021             if ((request_value->req_mask_ext & 0x8000)==FALSE) {
7022                 loffset += 8;
7023             }
7024         }
7025         /* Rights Information */
7026         if (request_value->req_mask & 0x0800) {
7027             ptvc = ptvcursor_new(atree, tvb, loffset);
7028             process_ptvc_record(ptvc, ptvc_struct_rights_info_struct,
7029                     NULL, TRUE, ncp_rec);
7030             ptvcursor_free(ptvc);
7031             loffset += 2;
7032         }
7033         else
7034         {
7035             if ((request_value->req_mask_ext & 0x8000)==FALSE) {
7036                 loffset += 2;
7037             }
7038         }
7039         /* Directory Entry */
7040         if (request_value->req_mask & 0x0400) {
7041             bitem = proto_tree_add_text(atree, tvb, loffset, -1, "Directory Entry");
7042             btree = proto_item_add_subtree(bitem, ett_ncp);
7043             ptvc = ptvcursor_new(btree, tvb, loffset);
7044             process_ptvc_record(ptvc, ptvc_struct_dir_entry_struct,
7045                     NULL, TRUE, ncp_rec);
7046             ptvcursor_free(ptvc);
7047             loffset += 12;
7048             proto_item_set_end(bitem, tvb, loffset);
7049         }
7050         else
7051         {
7052             if ((request_value->req_mask_ext & 0x8000)==FALSE) {
7053                 loffset += 12;
7054             }
7055         }
7056         /* Extended Attributes oldstyle location*/
7057         if (request_value->req_mask & 0x0020 && !ncp_newstyle) {
7058             bitem = proto_tree_add_text(atree, tvb, loffset, -1, "Extended Attributes");
7059             btree = proto_item_add_subtree(bitem, ett_ncp);
7060             ptvc = ptvcursor_new(btree, tvb, loffset);
7061             process_ptvc_record(ptvc, ptvc_struct_ea_info_struct,
7062                     NULL, TRUE, ncp_rec);
7063             ptvcursor_free(ptvc);
7064             loffset += 12;
7065             proto_item_set_end(bitem, tvb, loffset);
7066         }
7067         else
7068         {
7069             if ((request_value->req_mask_ext & 0x8000)==FALSE && !ncp_newstyle) {
7070                 loffset += 12;
7071             }
7072         }
7073         /* Name Space Information */
7074         if (request_value->req_mask & 0x0200) {
7075             proto_tree_add_item(atree, hf_ncp_creator_name_space_number, tvb, loffset, 1, TRUE);
7076             loffset += 4;
7077         }
7078         else
7079         {
7080             if ((request_value->req_mask_ext & 0x8000)==FALSE) {
7081                 loffset += 4;
7082             }
7083         }
7084         if (request_value->req_mask & 0x1000) {
7085             proto_tree_add_item(atree, hf_ncp_curr_ref_id, tvb, loffset, 2, TRUE);
7086             loffset += 2;
7087         }
7088         if (request_value->req_mask & 0x2000) {
7089             proto_tree_add_item(atree, hf_ncp_attr_def_32, tvb, loffset, 1, TRUE);
7090             loffset += 4;
7091         }
7092         if (request_value->req_mask & 0x4000) {
7093             bitem = proto_tree_add_text(atree, tvb, loffset, -1, "Actual");
7094             btree = proto_item_add_subtree(bitem, ett_ncp);
7095             proto_tree_add_item(btree, hf_ncp_data_stream_num_long, tvb, loffset, 4, TRUE);
7096             proto_tree_add_item(btree, hf_ncp_data_stream_fat_blks, tvb, loffset+4, 4, TRUE);
7097             loffset += 8;
7098             proto_item_set_end(bitem, tvb, loffset);
7099         }
7100         if (request_value->req_mask & 0x8000) {
7101             bitem = proto_tree_add_text(atree, tvb, loffset, -1, "Logical");
7102             btree = proto_item_add_subtree(bitem, ett_ncp);
7103             proto_tree_add_item(btree, hf_ncp_data_stream_num_long, tvb, loffset, 4, TRUE);
7104             proto_tree_add_item(btree, hf_ncp_data_stream_size, tvb, loffset+4, 4, TRUE);
7105             loffset += 8;
7106             proto_item_set_end(bitem, tvb, loffset);
7107         }
7108         if (request_value->req_mask_ext & 0x0001 && ncp_newstyle) {
7109             proto_tree_add_item(atree, hf_ncp_sec_rel_to_y2k, tvb, loffset, 4, TRUE);
7110             loffset += 4;
7111         }
7112         if (request_value->req_mask_ext & 0x0002 && ncp_newstyle) {
7113             bitem = proto_tree_add_text(atree, tvb, loffset, -1, "DOS Name");
7114             btree = proto_item_add_subtree(bitem, ett_ncp);
7115             if (ncp_rec->func == 0x57) {
7116                 str_length = tvb_get_guint8(tvb, loffset);
7117                 loffset += 1;
7118             }
7119             else
7120             {
7121                 str_length = tvb_get_letohs(tvb, loffset);
7122                 loffset += 2;
7123             }
7124             proto_tree_add_item(btree, hf_ncp_file_name_12, tvb, loffset, str_length, FALSE);
7125             loffset += str_length;
7126             proto_item_set_end(bitem, tvb, loffset);
7127         }
7128         if (request_value->req_mask_ext & 0x0004 && ncp_newstyle) {
7129             ptvc = ptvcursor_new(atree, tvb, loffset);
7130             process_ptvc_record(ptvc, ptvc_struct_flush_time_struct,
7131                     NULL, TRUE, ncp_rec);
7132             ptvcursor_free(ptvc);
7133             loffset += 4;
7134         }
7135         if (request_value->req_mask_ext & 0x0008 && ncp_newstyle) {
7136             proto_tree_add_item(atree, hf_ncp_parent_base_id, tvb, loffset, 4, TRUE);
7137             loffset += 4;
7138         }
7139         if (request_value->req_mask_ext & 0x0010 && ncp_newstyle) {
7140             proto_tree_add_item(atree, hf_ncp_mac_finder_info, tvb, loffset, 32, TRUE);
7141             loffset += 32;
7142         }
7143         if (request_value->req_mask_ext & 0x0020 && ncp_newstyle) {
7144             proto_tree_add_item(atree, hf_ncp_sibling_count, tvb, loffset, 4, TRUE);
7145             loffset += 4;
7146         }
7147         if (request_value->req_mask_ext & 0x0040 && ncp_newstyle) {
7148             proto_tree_add_item(atree, hf_ncp_effective_rights, tvb, loffset, 1, TRUE);
7149             loffset += 4;
7150         }
7151         if (request_value->req_mask_ext & 0x0080 && ncp_newstyle) {
7152             bitem = proto_tree_add_text(atree, tvb, loffset, -1, "Mac Date");
7153             btree = proto_item_add_subtree(bitem, ett_ncp);
7154             ptvc = ptvcursor_new(btree, tvb, loffset);
7155             process_ptvc_record(ptvc, ptvc_struct_mac_time_struct,
7156                     NULL, TRUE, ncp_rec);
7157             ptvcursor_free(ptvc);
7158             loffset += 8;
7159             proto_item_set_end(bitem, tvb, loffset);
7160         }
7161         if (request_value->req_mask_ext & 0x0100 && ncp_newstyle) {
7162             ptvc = ptvcursor_new(atree, tvb, loffset);
7163             process_ptvc_record(ptvc, ptvc_struct_last_access_time_struct,
7164                     NULL, TRUE, ncp_rec);
7165             ptvcursor_free(ptvc);
7166             loffset += 2;
7167         }
7168         if (request_value->req_mask_ext & 0x0400 && ncp_newstyle) {
7169             proto_tree_add_item(atree, hf_ncp_f_size_64bit, tvb, loffset, 8, TRUE);
7170             loffset += 8;
7171         }
7172         /* We always return the file name */
7173         if (ncp_rec->func == 0x57) {
7174             str_length = tvb_get_guint8(tvb, loffset);
7175             loffset += 1;
7176         }
7177         else
7178         {
7179             str_length = tvb_get_letohs(tvb, loffset);
7180             loffset += 2;
7181         }
7182         proto_tree_add_item(atree, hf_ncp_file_name_12, tvb, loffset, str_length, FALSE);
7183         loffset += str_length;
7184
7185         proto_item_set_end(aitem, tvb, loffset);
7186
7187         if(tvb_length_remaining(tvb, loffset) < 4 )
7188         {
7189                 break;
7190         }
7191     }
7192 }
7193
7194 static void
7195 dissect_ncp_123_62_reply(tvbuff_t *tvb, proto_tree *volatile ncp_tree)
7196 {
7197     char value_format[2]="\0";
7198     char param_string[256]="\0";
7199
7200     build_expert_data(ncp_tree, "ncp.set_cmd_type",
7201                       value_format, sizeof value_format, 0, FALSE);
7202     build_expert_data(ncp_tree, "ncp.set_cmd_name",
7203                       param_string, sizeof param_string, 0, FALSE);
7204     switch (atoi(value_format)) {
7205     case 0:   /* { 0x00, "Numeric Value" }, */
7206     case 2:   /* { 0x02, "Ticks Value" },   */
7207     case 4:   /* { 0x04, "Time Value" },    */
7208     case 6:   /* { 0x06, "Trigger Value" }, */
7209     case 7:   /* { 0x07, "Numeric Value" }, */
7210         proto_tree_add_item(ncp_tree, hf_srvr_param_number, tvb, 37+(gint)strlen(param_string), 4, TRUE);
7211         break;
7212     case 1:   /* { 0x01, "Boolean Value" }, */
7213         proto_tree_add_item(ncp_tree, hf_srvr_param_boolean, tvb, 37+(gint)strlen(param_string), 1, TRUE);
7214         break;
7215     case 5:   /* { 0x05, "String Value" },  */
7216         proto_tree_add_item(ncp_tree, hf_srvr_param_string, tvb, 37+(gint)strlen(param_string), -1, TRUE);
7217         break;
7218     default:
7219         break;
7220     }
7221 }
7222
7223 /*
7224  * Defrag logic
7225  *
7226  * NDS fragment not being set to 0xffffffff indicates we are inside or at the
7227  * beginning of a fragment. But when the end of the fragment
7228  * is encounterd the flag is set to 0xffffffff. So we must mark what the
7229  * frame number is of the end fragment so that we will be
7230  * able to redissect if the user clicks on the packet
7231  * or resorts/filters the trace.
7232  *
7233  * Once we are certain that we are in a fragment sequence
7234  * then we can just process each fragment in this conversation
7235  * until we reach the fragment == 0xffffffff packet.
7236  *
7237  * We will be able to easily determine if a conversation is a fragment
7238  * with the exception of the last packet in the fragment. So remember
7239  * the last fragment packet number.
7240  *
7241  * Also the NDS dissection requires the values of NDS Verb, Version, and Flags.
7242  * Without these values being remembered from the first request packet then
7243  * we will be unable to dissect the reply packet. For this reason we remember
7244  * these values on the first fragment and then populate the values in the final
7245  * fragment. We only do this on the first dissection.
7246  */
7247 void
7248 nds_defrag(tvbuff_t *tvb, packet_info *pinfo, guint32 nw_connection, guint8 sequence, guint16 type, proto_tree *tree, struct novell_tap *ncp_tap)
7249 {
7250     int                 i, frag_count=0;
7251     guint               len=0;
7252     guint32             tid = 1;
7253     tvbuff_t            *frag_tvb = NULL;
7254     fragment_data       *fd_head;
7255     ncp_req_hash_value  *request_value = NULL;
7256     conversation_t      *conversation;
7257     guint32             nds_frag;
7258
7259     for (i = 0; i < 99; i++) {
7260         if (!frags[i].nds_fragmented)
7261         {
7262             frags[i].nds_frag = 0xfffffff0;
7263         }
7264     }
7265     /* Check to see if defragmentation is enabeled in the dissector */
7266     if (!nds_defragment) {
7267         dissect_ncp_reply(tvb, pinfo, nw_connection, sequence, type, tree, ncp_tap);
7268         return;
7269     }
7270     /* Has this already been dissected? */
7271     if (!pinfo->fd->flags.visited) {
7272         /* Find the conversation whence the request would have come. */
7273         conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst,
7274                                          PT_NCP, nw_connection, nw_connection, 0);
7275         if (conversation != NULL) {
7276             /* find the record telling us the request made that caused
7277                this reply */
7278             request_value = ncp_hash_lookup(conversation, sequence);
7279             if (!request_value) {
7280                 dissect_ncp_reply(tvb, pinfo, nw_connection, sequence, type, tree, ncp_tap);
7281                 return;
7282             }
7283             p_add_proto_data(pinfo->fd, proto_ncp, (void*) request_value);
7284         }
7285         /* else... we haven't seen an NCP Request for that conversation and sequence. */
7286         else
7287             {
7288                 dissect_ncp_reply(tvb, pinfo, nw_connection, sequence, type, tree, ncp_tap);
7289                 return;
7290             }
7291     }
7292     else {
7293         request_value = p_get_proto_data(pinfo->fd, proto_ncp);
7294         if (!request_value) {
7295                 dissect_ncp_reply(tvb, pinfo, nw_connection, sequence, type, tree, ncp_tap);
7296                 return;
7297         }
7298     }
7299     /* Validate that this is an NDS packet */
7300     /* If this isn't an NDS packet then just return */
7301     if (!request_value->ncp_rec ||
7302         request_value->ncp_rec->func!=104 || request_value->ncp_rec->subfunc!=2) {
7303         dissect_ncp_reply(tvb, pinfo, nw_connection, sequence, type, tree, ncp_tap);
7304         return;
7305     }
7306     /* Check to see if there is at least enough packet info to get the fragment flag */
7307     if (tvb_reported_length_remaining(tvb, 12) < 4) {
7308         dissect_ncp_reply(tvb, pinfo, nw_connection, sequence, type, tree, ncp_tap);
7309         return;
7310     }
7311     /* Get the fragment flag */
7312     nds_frag = tvb_get_letohl(tvb, 12);
7313
7314     /* Now we need to find if this is a new fragment or already one defined. */
7315     /* We currently limit the maximum number of simultaneous fragments to 100. */
7316     for (i=0; i<100; i++)
7317     {
7318         if (frags[i].nds_frag == nds_frag || frags[i].nds_frag == 0xfffffff0)
7319         {
7320             if (frags[i].nds_frag == 0xfffffff0)
7321                 {
7322                     frags[i].nds_length = 0;
7323                     frags[i].nds_frag = nds_frag;
7324                     frags[i].nds_fragmented = TRUE;
7325                     frags[i].sequence = 0;
7326                 }
7327             break;
7328         }
7329     }
7330     if (i > 99)
7331         return;
7332
7333     frag_count = i;
7334
7335     /* is this the end of an existing fragment or just another reply */
7336     if (nds_frag == 0xffffffff && request_value->nds_frag_num == 0xffffffff)
7337     {
7338         dissect_ncp_reply(tvb, pinfo, nw_connection, sequence, type, tree, ncp_tap);
7339         return;
7340     }
7341
7342     /* Now we process the fragments */
7343     if (request_value->nds_frag || (request_value->nds_end_frag == pinfo->fd->num))
7344     {
7345         /* Check to see of this is a fragment. If so then mark as a fragment. */
7346         if (frags[frag_count].nds_frag==0xffffffff) {
7347             request_value->nds_frag = FALSE;
7348             /* nds_length of 0 means start of fragment */
7349             frags[frag_count].nds_length = 0;
7350         }
7351         else
7352         {
7353             if (frags[frag_count].nds_length == 0)
7354             {
7355                 frags[frag_count].nds_length = tvb_get_letohl(tvb, 0);
7356             }
7357         }
7358         /*
7359          * Fragment
7360          *
7361          */
7362         tid = (pinfo->srcport+pinfo->destport);
7363         len = tvb_reported_length(tvb);
7364         if (len > 0 && tvb_bytes_exist(tvb, 0, len))
7365         {
7366             if (frags[frag_count].nds_length > len)
7367             {
7368                 /* This is the first fragment so remember the verb, version, and flags. */
7369                 frags[frag_count].nds_frag_verb = request_value->nds_request_verb;
7370                 frags[frag_count].nds_frag_version = request_value->nds_version;
7371                 frags[frag_count].nds_frag_flags = request_value->req_nds_flags;
7372                 frags[frag_count].nds_frag_prot_flags = request_value->req_nds_prot_flags;
7373                 fd_head = fragment_add_seq_next(tvb, 0, pinfo, tid, nds_fragment_table, nds_reassembled_table, len, request_value->nds_frag);
7374                 frags[frag_count].sequence = sequence;
7375                 frags[frag_count].nds_length = 1;
7376             }
7377             else
7378             {
7379                 /* Subsequent fragments should be offset by 16 since we do not need */
7380                 /* the additional fragment handle and size fields in our composite data */
7381                 /* Also do not add retransmitted packets, just mark and return */
7382                 if (!pinfo->fd->flags.visited)
7383                 {
7384                     if (sequence != frags[frag_count].sequence) {
7385                         fd_head = fragment_add_seq_next(tvb, 16, pinfo, tid, nds_fragment_table, nds_reassembled_table, len-16, request_value->nds_frag);
7386                         frags[frag_count].sequence = sequence;
7387                     }
7388                     else
7389                     {
7390                         if (check_col(pinfo->cinfo, COL_INFO)) {
7391                             col_add_fstr(pinfo->cinfo, COL_INFO, "[Retransmitted NDS Fragment 0x%08x]", frags[frag_count].nds_frag);
7392                         }
7393                         return;
7394                     }
7395                 }
7396                 else
7397                 {
7398                     fd_head = fragment_add_seq_next(tvb, 16, pinfo, tid, nds_fragment_table, nds_reassembled_table, len-16, request_value->nds_frag);
7399                     frags[frag_count].sequence = sequence;
7400                 }
7401             }
7402             if (fd_head != NULL)
7403             {
7404                 /* Is this the last fragment? nds_frag will indicate */
7405                 if (fd_head->next != NULL && !request_value->nds_frag)
7406                 {
7407                     frag_tvb = tvb_new_child_real_data(tvb, fd_head->data,
7408                                                  fd_head->len, fd_head->len);
7409                     add_new_data_source(pinfo,
7410                                         frag_tvb,
7411                                         "Reassembled NDS");
7412                     /* Show all fragments. */
7413                     if (tree)
7414                     {
7415                         proto_item *frag_tree_item;
7416                         show_fragment_seq_tree(fd_head,
7417                                                &nds_frag_items,
7418                                                tree, pinfo,
7419                                                frag_tvb, &frag_tree_item);
7420                         tid++;
7421                     }
7422
7423                     if (!pinfo->fd->flags.visited)
7424                     {
7425                         /* Now we need to find the original fragment number. */
7426                         /* Get the fragment flag */
7427                         nds_frag = tvb_get_letohl(frag_tvb, 12);
7428                         for (i=0; i<100; i++)
7429                         {
7430                             if (frags[i].nds_frag == nds_frag)
7431                             {
7432                                 break;
7433                             }
7434                         }
7435                         if (i > 99)
7436                             return;
7437                         if (frags[i].nds_frag == 0xffffffff)
7438                         {
7439                             /* Error can't find fragment */
7440                             /*DISSECTOR_ASSERT(0);*/
7441                         }
7442                         frag_count = i;
7443                         /* Remember this fragment information so we can dissect.
7444                          * Only do this on the first dissection. After the first
7445                          * dissection we will just read the memory values.
7446                          */
7447                         request_value->nds_end_frag = pinfo->fd->num;
7448                         request_value->nds_request_verb = frags[frag_count].nds_frag_verb;
7449                         request_value->nds_version = frags[frag_count].nds_frag_version;
7450                         request_value->req_nds_flags = frags[frag_count].nds_frag_flags;
7451                         request_value->req_nds_prot_flags = frags[frag_count].nds_frag_prot_flags;
7452                     }
7453
7454                 }
7455                 else
7456                 {
7457                     /* This is either a beggining or middle fragment on second dissection */
7458                     frag_tvb = tvb_new_subset(tvb, 0, -1, -1);
7459                     if (check_col(pinfo->cinfo, COL_INFO))
7460                     {
7461                       if (request_value->nds_frag)
7462                       {
7463                         col_add_fstr(pinfo->cinfo, COL_INFO, "[NDS Fragment 0x%08x]", frags[frag_count].nds_frag);
7464                       }
7465                     }
7466                 }
7467             }
7468             else
7469             {
7470                 /* Fragment from first pass of dissection */
7471                 if (check_col(pinfo->cinfo, COL_INFO))
7472                 {
7473                   if (request_value->nds_frag)
7474                   {
7475                      col_add_fstr(pinfo->cinfo, COL_INFO, "[NDS Fragment 0x%08x]", frags[frag_count].nds_frag);
7476                   }
7477                 }
7478                 frag_tvb = NULL;
7479             }
7480         }
7481         else
7482         {
7483             /*
7484              * There are no bytes so Dissect this
7485              */
7486             frag_tvb = tvb_new_subset(tvb, 0, -1, -1);
7487         }
7488         if (frag_tvb == NULL)
7489         {
7490             /* This is a fragment packet */
7491             frag_tvb = tvb_new_subset (tvb, 0, -1, -1);
7492             nds_data_handle = find_dissector("data");
7493             call_dissector(nds_data_handle, frag_tvb, pinfo, tree);
7494         }
7495         else
7496         {
7497             /* This is the end fragment so dissect */
7498             if (!request_value->nds_frag) {
7499                 frags[frag_count].nds_length = 0;
7500                 dissect_ncp_reply(frag_tvb, pinfo, nw_connection, sequence, type, tree, ncp_tap);
7501             }
7502         }
7503     }
7504     else
7505     {
7506         /* This is not any fragment packet */
7507         request_value->nds_frag = FALSE;
7508         /* Trap for retransmitted end fragment */
7509         if (request_value->nds_end_frag < pinfo->fd->num) {
7510             if (check_col(pinfo->cinfo, COL_INFO)) {
7511                 col_add_fstr(pinfo->cinfo, COL_INFO, "[Retransmitted end of NDS Fragment 0x%08x, see packet #%d for details.]", request_value->nds_frag_num, request_value->nds_end_frag);
7512             }
7513         }
7514         else
7515         {
7516             dissect_ncp_reply(tvb, pinfo, nw_connection, sequence, type, tree, ncp_tap);
7517         }
7518     }
7519 }
7520
7521 void
7522 dissect_ncp_request(tvbuff_t *tvb, packet_info *pinfo,
7523                 guint32 nw_connection, guint8 sequence,
7524                 guint16 type, proto_tree *volatile ncp_tree)
7525 {
7526     volatile guint8         func=0;
7527     volatile guint8         subfunc = 0;
7528     gboolean                requires_subfunc = FALSE;
7529     gboolean                has_length = FALSE;
7530     ncp_req_hash_value      *volatile request_value = NULL;
7531     const ncp_record        *volatile ncp_rec = NULL;
7532     conversation_t          *conversation;
7533     ptvcursor_t             *volatile ptvc = NULL;
7534     proto_tree              *temp_tree = NULL;
7535     volatile gboolean       run_req_cond = FALSE;
7536     volatile gboolean       run_info_str = FALSE;
7537     guint32                 length_remaining;
7538     guint32                 testvar;
7539     volatile unsigned long  except_code;
7540     const char              *volatile message;
7541
7542
7543     /* Determine which ncp_record to use. */
7544     switch (type) {
7545     case NCP_ALLOCATE_SLOT:
7546         length_remaining = tvb_length_remaining(tvb, 4);
7547         if (length_remaining > 4)
7548         {
7549             testvar = tvb_get_ntohl(tvb, 4);
7550             if( testvar == 0x4c495020)
7551             {
7552                 ncp_rec = &ncplip_echo;
7553             }
7554             else
7555             {
7556                 ncp_rec = &ncp1111_request;
7557                 if (ncp_echo_conn) {
7558                     expert_add_info_format(pinfo, NULL, PI_RESPONSE_CODE, PI_CHAT, "Connection Request");
7559                 }
7560             }
7561         }
7562         else
7563         {
7564             ncp_rec = &ncp1111_request;
7565             if (ncp_echo_conn) {
7566                 expert_add_info_format(pinfo, NULL, PI_RESPONSE_CODE, PI_CHAT, "Connection Request");
7567             }
7568         }
7569         break;
7570     case NCP_SERVICE_REQUEST:
7571         func = tvb_get_guint8(tvb, 6);
7572         requires_subfunc = ncp_requires_subfunc(func);
7573         has_length = ncp_has_length_parameter(func);
7574         if (requires_subfunc) {
7575             if (has_length) {
7576                 subfunc = tvb_get_guint8(tvb, 9);
7577             }
7578             else {
7579                 subfunc = tvb_get_guint8(tvb, 7);
7580             }
7581         }
7582         ncp_rec = ncp_record_find(func, subfunc);
7583         break;
7584     case NCP_DEALLOCATE_SLOT:
7585         ncp_rec = &ncp5555_request;
7586         if (ncp_echo_conn) {
7587             expert_add_info_format(pinfo, NULL, PI_RESPONSE_CODE, PI_CHAT, "Destroy Connection %u Request", nw_connection);
7588         }
7589         break;
7590     case NCP_BROADCAST_SLOT:
7591         ncp_rec = &ncpbbbb_request;
7592         break;
7593     case NCP_LIP_ECHO:
7594         ncp_rec = &ncplip_echo;
7595         break;
7596     default:
7597         ncp_rec = NULL;
7598         break;
7599     }
7600
7601     /* Fill in the INFO column. */
7602     if (check_col(pinfo->cinfo, COL_INFO)) {
7603         if (ncp_rec) {
7604             col_add_fstr(pinfo->cinfo, COL_INFO, "C %s", ncp_rec->name);
7605             if (ncp_rec->req_info_str) {
7606                 /* We want to add more stuff to the Info
7607                    column. */
7608                 run_info_str = TRUE;
7609             }
7610         }
7611         else {
7612             if (requires_subfunc) {
7613                 col_add_fstr(pinfo->cinfo, COL_INFO,
7614                              "C Unknown Function %u %u (0x%02X/0x%02x)",
7615                              func, subfunc, func, subfunc);
7616                 return;
7617             }
7618             else {
7619                 col_add_fstr(pinfo->cinfo, COL_INFO,
7620                              "C Unknown Function %u (0x%02x)",
7621                              func, func);
7622                 return;
7623             }
7624         }
7625     }
7626     if (!pinfo->fd->flags.visited) {
7627         /* This is the first time we've looked at this packet.
7628            Keep track of the address and connection whence the request
7629            came, and the address and connection to which the request
7630            is being sent, so that we can match up calls with replies.
7631            (We don't include the sequence number, as we may want
7632            to have all packets over the same connection treated
7633            as being part of a single conversation so that we can
7634            let the user select that conversation to be displayed.) */
7635         conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst,
7636                                          PT_NCP, nw_connection, nw_connection, 0);
7637
7638         if (conversation == NULL) {
7639             /* It's not part of any conversation - create a new one. */
7640             conversation = conversation_new(pinfo->fd->num, &pinfo->src, &pinfo->dst,
7641                                             PT_NCP, nw_connection, nw_connection, 0);
7642         }
7643         request_value = ncp_hash_insert(conversation, sequence, ncp_rec);
7644         request_value->req_frame_num = pinfo->fd->num;
7645         request_value->req_frame_time = pinfo->fd->abs_ts;
7646
7647         /* If this is the first time we're examining the packet,
7648          * check to see if this NCP type uses a "request condition".
7649          * If so, we have to build a proto_tree because request conditions
7650          * use display filters to work, and without a proto_tree,
7651          * display filters can't possibly work. */
7652         if (ncp_rec) {
7653             if (ncp_rec->req_cond_indexes) {
7654                 run_req_cond = TRUE;
7655             }
7656         }
7657     }
7658
7659     /* If we have to handle a request condition, or have to
7660        add to the Info column, we need to construct a protocol
7661        tree.  If we already have a proto_tree, then wonderful.
7662        If we don't, we need to build one. */
7663     if ((run_info_str || run_req_cond) && !ncp_tree) {
7664         proto_item *ti;
7665
7666         temp_tree = proto_tree_create_root();
7667         proto_tree_set_visible(temp_tree, FALSE);
7668         ti = proto_tree_add_item(temp_tree, proto_ncp, tvb, 0, -1, FALSE);
7669         ncp_tree = proto_item_add_subtree(ti, ett_ncp);
7670     }
7671
7672     if (ncp_tree) {
7673         /* If the dissection throws an exception, be sure to free
7674          * the temporary proto_tree that was created. Because of the
7675          * way the CLEANUP_PUSH macro works, we can't put it in an 'if'
7676          * block; it has to be in the same scope as the terminating
7677          * CLEANUP_POP or CLEANUP_POP_AND_ALLOC. So, we always
7678          * call CLEANUP_POP and friends, but the value of temp_tree is
7679          * NULL if no cleanup is needed, and non-null if cleanup is needed. */
7680         CLEANUP_PUSH(free_proto_tree, temp_tree);
7681
7682 #ifdef FAKE_TREE_IS_VISIBLE
7683         PTREE_DATA(ncp_tree)->visible=1;
7684 #endif
7685
7686         /* Before the dissection, if we're saving data for a request
7687          * condition, we have to prime the proto tree using the
7688          * dfilter information */
7689         if (run_req_cond) {
7690             const int *needed;
7691             dfilter_t *dfilter;
7692
7693             needed = ncp_rec->req_cond_indexes;
7694
7695             while (*needed != -1) {
7696                 dfilter = req_conds[*needed].dfilter;
7697                 /* Prime the proto_tree with "interesting fields". */
7698                 dfilter_prime_proto_tree(dfilter, ncp_tree);
7699                 needed++;
7700             }
7701         }
7702
7703         /* Before the dissection, if we need a field for the info_str,
7704          * prime the tree. */
7705         if (run_info_str) {
7706             proto_tree_prime_hfid(ncp_tree, *ncp_rec->req_info_str->hf_ptr);
7707         }
7708
7709         switch (type) {
7710         case NCP_BROADCAST_SLOT:
7711             ; /* nothing */
7712             break;
7713
7714         case NCP_SERVICE_REQUEST:
7715             proto_tree_add_uint_format(ncp_tree, hf_ncp_func, tvb, 6, 1,
7716                                        func, "Function: %u (0x%02X), %s",
7717                                        func, func, ncp_rec ? ncp_rec->name : "Unknown");
7718             break;
7719
7720         default:
7721             ; /* nothing */
7722             break;
7723         }
7724         if (request_value) {
7725             request_value->length = 0;
7726         }
7727         if (requires_subfunc) {
7728             if (has_length) {
7729                 if (request_value && func==123) {
7730                     request_value->length = tvb_get_ntohs(tvb, 7);
7731                 }
7732                 proto_tree_add_item(ncp_tree, hf_ncp_length, tvb, 7,
7733                                     2, FALSE);
7734                 proto_tree_add_uint_format(ncp_tree, hf_ncp_subfunc, tvb, 9, 1,
7735                                            subfunc, "SubFunction: %u (0x%02x)",
7736                                            subfunc, subfunc);
7737                 ptvc = ptvcursor_new(ncp_tree, tvb, 10);
7738             }
7739             else {
7740                 proto_tree_add_uint_format(ncp_tree, hf_ncp_subfunc, tvb, 7, 1,
7741                                            subfunc, "SubFunction: %u (0x%02x)",
7742                                            subfunc, subfunc);
7743                 ptvc = ptvcursor_new(ncp_tree, tvb, 8);
7744             }
7745         }
7746         else {
7747             ptvc = ptvcursor_new(ncp_tree, tvb, 7);
7748         }
7749
7750         /* The group is not part of the packet, but it's useful
7751          * information to display anyway. Put it in the tree for filtering and tap use*/
7752         if (ncp_rec) {
7753             proto_tree_add_uint_format(ncp_tree, hf_ncp_group, tvb, 0, 0, ncp_rec->group, "Group: %s", ncp_groups[ncp_rec->group]);
7754         }
7755
7756         except_code = 0;
7757         message = NULL;
7758         if (ncp_rec && ncp_rec->request_ptvc) {
7759             clear_repeat_vars();
7760             /*
7761              * We need to remember the results even if we
7762              * throw an exception dissecting this request,
7763              * so that we can properly dissect the reply.
7764              * We catch any exceptions thrown when
7765              * dissecting the request, and re-throw them
7766              * after saving the results of any conditional
7767              * tests.
7768              */
7769             TRY {
7770                 process_ptvc_record(ptvc, ncp_rec->request_ptvc, NULL, TRUE, ncp_rec);
7771             } CATCH_ALL {
7772                 except_code = EXCEPT_CODE;
7773                 message = GET_MESSAGE;
7774             }
7775             ENDTRY;
7776         }
7777         ptvcursor_free(ptvc);
7778         /* SecretStore packets are dessected in packet-ncp-sss.c */
7779         if (func == 0x5c && ncp_tree) {
7780             dissect_sss_request(tvb, pinfo, ncp_tree, request_value);
7781         }
7782         /* NMAS packets are dessected in packet-ncp-nmas.c */
7783         if (func == 0x5e && ncp_tree) {
7784             dissect_nmas_request(tvb, pinfo, ncp_tree, request_value);
7785         }
7786
7787         /* Now that the dissection is done, do we need to run
7788          * some display filters on the resulting tree in order
7789          * to save results for "request conditions" ? */
7790         if (run_req_cond) {
7791             const int   *needed;
7792             gboolean    *results;
7793             dfilter_t   *dfilter;
7794
7795             results = se_alloc0(sizeof(gboolean)*NUM_REQ_CONDS);
7796             needed = ncp_rec->req_cond_indexes;
7797
7798             while (*needed != -1) {
7799                 /* ncp_tree is not a root proto_tree, but
7800                  * dfilters will still work on it. */
7801                 dfilter = req_conds[*needed].dfilter;
7802                 results[*needed] = dfilter_apply(dfilter, ncp_tree);
7803                 needed++;
7804             }
7805
7806             /* Save the results so the reply packet dissection
7807              * get to them. */
7808             request_value->req_cond_results = results;
7809         }
7810         /* Construct the info string if necessary */
7811         if (run_info_str) {
7812             GPtrArray *parray;
7813             char*   byte_string;
7814             char    non_uni_string[1024];
7815             int i, len;
7816             field_info *finfo;
7817             int info_type;
7818
7819             if (!request_value)
7820             {
7821                 conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst,
7822                                                  PT_NCP, nw_connection, nw_connection, 0);
7823                 if (conversation != NULL) {
7824                     /* find the record telling us the request made that caused
7825                        this reply */
7826                     request_value = ncp_hash_lookup(conversation, sequence);
7827                 }
7828                 if (!conversation || !request_value)
7829                 {
7830                     return;
7831                 }
7832             }
7833
7834             parray = proto_get_finfo_ptr_array(ncp_tree,
7835                                                *ncp_rec->req_info_str->hf_ptr);
7836             len = g_ptr_array_len(parray);
7837
7838             if (len > 0) {
7839
7840                 col_set_str(pinfo->cinfo, COL_INFO, "C ");
7841
7842                 finfo = g_ptr_array_index(parray, 0);
7843
7844                 info_type = get_info_type((const gchar*) ncp_rec->req_info_str->first_string);
7845
7846                 if (info_type != 0) {    /* Is this  a string or not? */
7847
7848                     if (info_type == 1) {   /* Is this bytes? */
7849                         byte_string = bytes_to_str(get_finfo_value_string(finfo), get_finfo_length(finfo));
7850                         col_append_fstr(pinfo->cinfo, COL_INFO,
7851                                         (const gchar*) ncp_rec->req_info_str->first_string,
7852                                         byte_string);
7853                     }
7854                     else
7855                     {
7856                         if (info_type == 2) {   /* Is this a String? */
7857                             uni_to_string(get_finfo_value_string(finfo), get_finfo_length(finfo), non_uni_string);
7858                             col_append_fstr(pinfo->cinfo, COL_INFO,
7859                                             (const gchar*) ncp_rec->req_info_str->first_string,
7860                                             non_uni_string);
7861                         }
7862                         else
7863                         {
7864                             col_append_fstr(pinfo->cinfo, COL_INFO,
7865                                             (const gchar*) ncp_rec->req_info_str->first_string,
7866                                             get_finfo_value_string(finfo));
7867                         }
7868                     }
7869                 }
7870                 else
7871                 {
7872                     col_append_fstr(pinfo->cinfo, COL_INFO,
7873                                     (const gchar*) ncp_rec->req_info_str->first_string,
7874                                     get_finfo_value_integer(finfo));
7875                 }
7876             }
7877             if (len > 1) {
7878                 for (i = 1; i < len; i++) {
7879                     non_uni_string[0]='\0';
7880                     finfo = g_ptr_array_index(parray, i);
7881                     info_type = get_info_type((const gchar*) ncp_rec->req_info_str->repeat_string);
7882
7883                     if (info_type != 0) {    /* Is this  a string or not? */
7884                         if (info_type == 1)
7885                         {   /* Is this bytes? */
7886                             byte_string = bytes_to_str(get_finfo_value_string(finfo), get_finfo_length(finfo));
7887                             col_append_fstr(pinfo->cinfo, COL_INFO,
7888                                             (const gchar*) ncp_rec->req_info_str->repeat_string,
7889                                             byte_string);
7890                         }
7891                         else
7892                         {
7893                             if (info_type == 2) {   /* Is this a String? */
7894                                 uni_to_string(get_finfo_value_string(finfo), get_finfo_length(finfo), non_uni_string);
7895                                 col_append_fstr(pinfo->cinfo, COL_INFO,
7896                                                 (const gchar*) ncp_rec->req_info_str->repeat_string,
7897                                                 non_uni_string);
7898                             }
7899                             else
7900                             {
7901                                 col_append_fstr(pinfo->cinfo, COL_INFO,
7902                                                 (const gchar*) ncp_rec->req_info_str->repeat_string,
7903                                                 get_finfo_value_string(finfo));
7904                             }
7905                         }
7906                     }
7907                     else
7908                     {
7909                         col_append_fstr(pinfo->cinfo, COL_INFO,
7910                                         (const gchar*) ncp_rec->req_info_str->repeat_string,
7911                                         get_finfo_value_integer(finfo));
7912                     }
7913                 }
7914             }
7915         }
7916         /* Store NCP request specific flags for manual dissection */
7917         if ((func == 0x57 || func == 0x59) && subfunc == 0x14 && ncp_tree && request_value) {
7918             char ret_info_string[16];
7919             char ret_info_string_ext[16];
7920
7921             build_expert_data(ncp_tree, "ncp.ret_info_mask",
7922                               ret_info_string, sizeof ret_info_string, 0, FALSE);
7923             request_value->req_mask = atoi(ret_info_string);
7924             build_expert_data(ncp_tree, "ncp.ext_info",
7925                               ret_info_string_ext, sizeof ret_info_string_ext,
7926                               0, FALSE);
7927             request_value->req_mask_ext = atoi(ret_info_string_ext);
7928         }
7929         /* NCP function 89/6 passes either ASCII or UTF8 data */
7930         /* Decode manually since it is not possible to SREC the request */
7931         /* packets from the python code */
7932         if (func == 0x59 && subfunc == 0x6) {
7933             dissect_ncp_89_6_request(tvb, ncp_tree, 22);
7934         }
7935         /* Check to see if we need to report to the expert table */
7936         trap_for_expert_event(ncp_tree, pinfo, ncp_rec, 0);
7937         /* Free the temporary proto_tree */
7938         CLEANUP_CALL_AND_POP;
7939
7940         /* Re-throw any exception. */
7941         if (except_code != 0)
7942             THROW_MESSAGE(except_code, message);
7943     }
7944 }
7945
7946 static void
7947 dissect_nds_ping_reply(tvbuff_t *tvb, packet_info *pinfo _U_,
7948                        proto_tree *ncp_tree, ncp_req_hash_value *request_value)
7949 {
7950     const char *reply_buffer;
7951     guint8     ping_version;
7952     guint32    nds_string_len;
7953     guint32    nds_offset;
7954     guint32    bvalue;
7955     guint32    nds_flags;
7956     nds_val    pvalues[9];
7957     int        i;
7958     nstime_t   ns;
7959
7960     ping_version = tvb_get_guint8(tvb, 8);
7961     proto_tree_add_item(ncp_tree, hf_ping_version, tvb, 8, 1, TRUE);
7962     if (ping_version == 9) {
7963         nds_string_len = tvb_get_ntohl(tvb, 9);
7964         nds_offset = nds_string_len+16;
7965         tvb_ensure_bytes_exist(tvb, 16, nds_string_len);
7966         proto_tree_add_item(ncp_tree, hf_nds_tree_name, tvb, 16, nds_string_len, FALSE);
7967         proto_tree_add_item(ncp_tree, hf_nds_reply_depth, tvb, nds_offset, 4, FALSE);
7968         proto_tree_add_item(ncp_tree, hf_nds_reply_rev, tvb, (nds_offset+4), 4, FALSE);
7969         proto_tree_add_item(ncp_tree, hf_nds_reply_flags, tvb, (nds_offset+8), 4, TRUE);
7970     }
7971     else {
7972         nds_offset = 12;
7973         nds_flags = request_value->req_nds_flags;
7974         bvalue = 0x00000001;
7975
7976         for (i = 0 ; i < 32; i++ ) {
7977             if (nds_flags & bvalue)
7978             {
7979                 switch(bvalue)
7980                 {
7981                 case 0x00000001:   /* Supported Fields */
7982                     pvalues[0].vvalue = tvb_get_letohs(tvb, nds_offset);
7983                     pvalues[0].vtype = VTYPE_BITFIELD;
7984                     pvalues[0].vstring = "";
7985                     pvalues[0].vdesc = "Ping (low) Flags:";
7986                     pvalues[0].vlength = 2;
7987                     pvalues[0].hfname= hf_nds_rflags;
7988                     pvalues[0].voffset = nds_offset;
7989                     pvalues[0].bit1 = "Supported Fields";
7990                     pvalues[0].bit1hfname = hf_bit1pingflags1;
7991                     pvalues[0].bit2 = "Depth";
7992                     pvalues[0].bit2hfname = hf_bit2pingflags1;
7993                     pvalues[0].bit3 = "Build Number";
7994                     pvalues[0].bit3hfname = hf_bit3pingflags1;
7995                     pvalues[0].bit4 = "Flags";
7996                     pvalues[0].bit4hfname = hf_bit4pingflags1;
7997                     pvalues[0].bit5 = "Verification Flags";
7998                     pvalues[0].bit5hfname = hf_bit5pingflags1;
7999                     pvalues[0].bit6 = "Letter Version";
8000                     pvalues[0].bit6hfname = hf_bit6pingflags1;
8001                     pvalues[0].bit7 = "OS Version";
8002                     pvalues[0].bit7hfname = hf_bit7pingflags1;
8003                     pvalues[0].bit8 = "License Flags";
8004                     pvalues[0].bit8hfname = hf_bit8pingflags1;
8005                     pvalues[0].bit9 = "DS Time";
8006                     pvalues[0].bit9hfname = hf_bit9pingflags1;
8007                     pvalues[0].bit10 = "Server Time";
8008                     pvalues[0].bit10hfname = hf_bit10pingflags1;
8009                     pvalues[0].bit11 = "Create Time";
8010                     pvalues[0].bit11hfname = hf_bit11pingflags1;
8011                     pvalues[0].bit12 = "Not Defined";
8012                     pvalues[0].bit12hfname = hf_bit12pingflags1;
8013                     pvalues[0].bit13 = "Not Defined";
8014                     pvalues[0].bit13hfname = hf_bit13pingflags1;
8015                     pvalues[0].bit14 = "Not Defined";
8016                     pvalues[0].bit14hfname = hf_bit14pingflags1;
8017                     pvalues[0].bit15 = "Not Defined";
8018                     pvalues[0].bit15hfname = hf_bit15pingflags1;
8019                     pvalues[0].bit16 = "Not Defined";
8020                     pvalues[0].bit16hfname = hf_bit16pingflags1;
8021
8022                     process_bitfield(ncp_tree, tvb, &pvalues[0]);
8023                     nds_offset += 2;
8024
8025                     pvalues[0].vvalue = tvb_get_letohs(tvb, nds_offset);
8026                     pvalues[0].vtype = VTYPE_BITFIELD;
8027                     pvalues[0].vstring = "";
8028                     pvalues[0].vdesc = "Ping (high) Flags:";
8029                     pvalues[0].vlength = 2;
8030                     pvalues[0].hfname= hf_nds_rflags;
8031                     pvalues[0].voffset = nds_offset;
8032                     pvalues[0].bit1 = "Sap Name";
8033                     pvalues[0].bit1hfname = hf_bit1pingflags2;
8034                     pvalues[0].bit2 = "Tree Name";
8035                     pvalues[0].bit2hfname = hf_bit2pingflags2;
8036                     pvalues[0].bit3 = "OS Name";
8037                     pvalues[0].bit3hfname = hf_bit3pingflags2;
8038                     pvalues[0].bit4 = "Hardware Name";
8039                     pvalues[0].bit4hfname = hf_bit4pingflags2;
8040                     pvalues[0].bit5 = "Vendor Name";
8041                     pvalues[0].bit5hfname = hf_bit5pingflags2;
8042                     pvalues[0].bit6 = "Not Defined";
8043                     pvalues[0].bit6hfname = hf_bit6pingflags2;
8044                     pvalues[0].bit7 = "Not Defined";
8045                     pvalues[0].bit7hfname = hf_bit7pingflags2;
8046                     pvalues[0].bit8 = "Not Defined";
8047                     pvalues[0].bit8hfname = hf_bit8pingflags2;
8048                     pvalues[0].bit9 = "Not Defined";
8049                     pvalues[0].bit9hfname = hf_bit9pingflags2;
8050                     pvalues[0].bit10 = "Not Defined";
8051                     pvalues[0].bit10hfname = hf_bit10pingflags2;
8052                     pvalues[0].bit11 = "Not Defined";
8053                     pvalues[0].bit11hfname = hf_bit11pingflags2;
8054                     pvalues[0].bit12 = "Not Defined";
8055                     pvalues[0].bit12hfname = hf_bit12pingflags2;
8056                     pvalues[0].bit13 = "Not Defined";
8057                     pvalues[0].bit13hfname = hf_bit13pingflags2;
8058                     pvalues[0].bit14 = "Not Defined";
8059                     pvalues[0].bit14hfname = hf_bit14pingflags2;
8060                     pvalues[0].bit15 = "Not Defined";
8061                     pvalues[0].bit15hfname = hf_bit15pingflags2;
8062                     pvalues[0].bit16 = "Not Defined";
8063                     pvalues[0].bit16hfname = hf_bit16pingflags2;
8064
8065                     process_bitfield(ncp_tree, tvb, &pvalues[0]);
8066                     nds_offset += 2;
8067                     break;
8068                 case 0x00000002:
8069                     proto_tree_add_item(ncp_tree, hf_nds_reply_depth, tvb, nds_offset, 4, TRUE);
8070                     nds_offset += 4;
8071                     break;
8072                 case 0x00000004:
8073                     proto_tree_add_item(ncp_tree, hf_nds_reply_rev, tvb, nds_offset, 4, TRUE);
8074                     nds_offset += 4;
8075                     break;
8076                 case 0x00000008:
8077                     pvalues[0].vvalue = tvb_get_letohl(tvb, nds_offset);
8078                     pvalues[0].vtype = VTYPE_BITFIELD;
8079                     pvalues[0].vstring = "";
8080                     pvalues[0].vdesc = "Pong Data Flags:";
8081                     pvalues[0].vlength = 4;
8082                     pvalues[0].hfname= hf_nds_rflags;
8083                     pvalues[0].voffset = nds_offset;
8084                     pvalues[0].bit1 = "Root Most Master Replica";
8085                     pvalues[0].bit1hfname = hf_bit1pingpflags1;
8086                     pvalues[0].bit2 = "Time Synchronized?";
8087                     pvalues[0].bit2hfname = hf_bit2pingpflags1;
8088                     pvalues[0].bit3 = "Time Valid?";
8089                     pvalues[0].bit3hfname = hf_bit3pingpflags1;
8090                     pvalues[0].bit4 = "DS Time Synchronized?";
8091                     pvalues[0].bit4hfname = hf_bit4pingpflags1;
8092                     pvalues[0].bit5 = "Agent Has All Replicas?";
8093                     pvalues[0].bit5hfname = hf_bit5pingpflags1;
8094                     pvalues[0].bit6 = "Not Defined";
8095                     pvalues[0].bit6hfname = hf_bit6pingpflags1;
8096                     pvalues[0].bit7 = "Not Defined";
8097                     pvalues[0].bit7hfname = hf_bit7pingpflags1;
8098                     pvalues[0].bit8 = "Not Defined";
8099                     pvalues[0].bit8hfname = hf_bit8pingpflags1;
8100                     pvalues[0].bit9 = "Not Defined";
8101                     pvalues[0].bit9hfname = hf_bit9pingpflags1;
8102                     pvalues[0].bit10 = "Not Defined";
8103                     pvalues[0].bit10hfname = hf_bit10pingpflags1;
8104                     pvalues[0].bit11 = "Not Defined";
8105                     pvalues[0].bit11hfname = hf_bit11pingpflags1;
8106                     pvalues[0].bit12 = "Not Defined";
8107                     pvalues[0].bit12hfname = hf_bit12pingpflags1;
8108                     pvalues[0].bit13 = "Not Defined";
8109                     pvalues[0].bit13hfname = hf_bit13pingpflags1;
8110                     pvalues[0].bit14 = "Not Defined";
8111                     pvalues[0].bit14hfname = hf_bit14pingpflags1;
8112                     pvalues[0].bit15 = "Not Defined";
8113                     pvalues[0].bit15hfname = hf_bit15pingpflags1;
8114                     pvalues[0].bit16 = "Not Defined";
8115                     pvalues[0].bit16hfname = hf_bit16pingpflags1;
8116
8117                     process_bitfield(ncp_tree, tvb, &pvalues[0]);
8118                     nds_offset += 4;
8119                     break;
8120                 case 0x00000010:
8121                     pvalues[0].vvalue = tvb_get_letohl(tvb, nds_offset);
8122                     pvalues[0].vtype = VTYPE_BITFIELD;
8123                     pvalues[0].vstring = "";
8124                     pvalues[0].vdesc = "Verification Flags:";
8125                     pvalues[0].vlength = 4;
8126                     pvalues[0].hfname= hf_nds_rflags;
8127                     pvalues[0].voffset = nds_offset;
8128                     pvalues[0].bit1 = "Checksum Verification";
8129                     pvalues[0].bit1hfname = hf_bit1pingvflags1;
8130                     pvalues[0].bit2 = "CRC32 Verification";
8131                     pvalues[0].bit2hfname = hf_bit2pingvflags1;
8132                     pvalues[0].bit3 = "Server Verification Enforced";
8133                     pvalues[0].bit3hfname = hf_bit3pingvflags1;
8134                     pvalues[0].bit4 = "Not Defined";
8135                     pvalues[0].bit4hfname = hf_bit4pingvflags1;
8136                     pvalues[0].bit5 = "Not Defined";
8137                     pvalues[0].bit5hfname = hf_bit5pingvflags1;
8138                     pvalues[0].bit6 = "Not Defined";
8139                     pvalues[0].bit6hfname = hf_bit6pingvflags1;
8140                     pvalues[0].bit7 = "Not Defined";
8141                     pvalues[0].bit7hfname = hf_bit7pingvflags1;
8142                     pvalues[0].bit8 = "Not Defined";
8143                     pvalues[0].bit8hfname = hf_bit8pingvflags1;
8144                     pvalues[0].bit9 = "Not Defined";
8145                     pvalues[0].bit9hfname = hf_bit9pingvflags1;
8146                     pvalues[0].bit10 = "Not Defined";
8147                     pvalues[0].bit10hfname = hf_bit10pingvflags1;
8148                     pvalues[0].bit11 = "Not Defined";
8149                     pvalues[0].bit11hfname = hf_bit11pingvflags1;
8150                     pvalues[0].bit12 = "Not Defined";
8151                     pvalues[0].bit12hfname = hf_bit12pingvflags1;
8152                     pvalues[0].bit13 = "Not Defined";
8153                     pvalues[0].bit13hfname = hf_bit13pingvflags1;
8154                     pvalues[0].bit14 = "Not Defined";
8155                     pvalues[0].bit14hfname = hf_bit14pingvflags1;
8156                     pvalues[0].bit15 = "Not Defined";
8157                     pvalues[0].bit15hfname = hf_bit15pingvflags1;
8158                     pvalues[0].bit16 = "Not Defined";
8159                     pvalues[0].bit16hfname = hf_bit16pingvflags1;
8160
8161                     process_bitfield(ncp_tree, tvb, &pvalues[0]);
8162                     nds_offset += 4;
8163                     break;
8164                 case 0x00000020:
8165                     proto_tree_add_item(ncp_tree, hf_nds_letter_ver, tvb, nds_offset, 4, TRUE);
8166                     nds_offset += 4;
8167                     break;
8168                 case 0x00000040:
8169                     proto_tree_add_item(ncp_tree, hf_nds_os_majver, tvb, nds_offset, 4, TRUE);
8170                     nds_offset += 4;
8171                     proto_tree_add_item(ncp_tree, hf_nds_os_minver, tvb, nds_offset, 4, TRUE);
8172                     nds_offset += 4;
8173                     proto_tree_add_item(ncp_tree, hf_ncp_os_revision, tvb, nds_offset, 4, TRUE);
8174                     nds_offset += 4;
8175                     break;
8176                 case 0x00000100:
8177                     proto_tree_add_item(ncp_tree, hf_nds_lic_flags, tvb, nds_offset, 4, TRUE);
8178                     nds_offset += 4;
8179                     break;
8180                 case 0x00000200:
8181                     ns.secs = tvb_get_letohl(tvb, nds_offset);
8182                     ns.nsecs = 0;
8183                     proto_tree_add_time(ncp_tree, hf_nds_ds_time, tvb, nds_offset, 4, &ns);
8184                     nds_offset += 4;
8185                     break;
8186                 case 0x00000400:
8187                     ns.secs = tvb_get_letohl(tvb, nds_offset);
8188                     ns.nsecs = 0;
8189                     proto_tree_add_time(ncp_tree, hf_nds_svr_time, tvb, nds_offset, 4, &ns);
8190                     nds_offset += 4;
8191                     break;
8192                 case 0x00000800:
8193                     ns.secs = tvb_get_letohl(tvb, nds_offset);
8194                     ns.nsecs = 0;
8195                     proto_tree_add_time(ncp_tree, hf_nds_crt_time, tvb, nds_offset, 4, &ns);
8196                     nds_offset += 4;
8197                     break;
8198                 case 0x00010000:
8199                     if(tvb_get_guint8(tvb, nds_offset) == 0x00)
8200                     {
8201                         nds_offset += 2;
8202                     }
8203                     nds_string_len = tvb_get_letohl(tvb, nds_offset);
8204                     nds_offset += 4;
8205                     reply_buffer = get_string(tvb, nds_offset, nds_string_len);
8206                     tvb_ensure_bytes_exist(tvb, nds_offset, nds_string_len);
8207                     proto_tree_add_text(ncp_tree, tvb, nds_offset, nds_string_len, "SAP Name: %s", reply_buffer);
8208                     nds_offset += nds_string_len;
8209                     nds_offset += align_4(tvb, nds_offset);
8210                     break;
8211                 case 0x00020000:
8212                     if(tvb_get_guint8(tvb, nds_offset) == 0x00)
8213                     {
8214                         nds_offset += 2;
8215                     }
8216                     nds_string_len = tvb_get_letohl(tvb, nds_offset);
8217                     nds_offset += 4;
8218                     reply_buffer = get_string(tvb, nds_offset, nds_string_len);
8219                     tvb_ensure_bytes_exist(tvb, nds_offset, nds_string_len);
8220                     proto_tree_add_text(ncp_tree, tvb, nds_offset, nds_string_len, "NDS Tree Name: %s", reply_buffer);
8221                     nds_offset += nds_string_len;
8222                     nds_offset += align_4(tvb, nds_offset);
8223                     break;
8224                 case 0x00040000:
8225                     if(tvb_get_guint8(tvb, nds_offset) == 0x00)
8226                     {
8227                         nds_offset += 2;
8228                     }
8229                     nds_string_len = tvb_get_letohl(tvb, nds_offset);
8230                     nds_offset += 4;
8231                     reply_buffer = get_string(tvb, nds_offset, nds_string_len);
8232                     tvb_ensure_bytes_exist(tvb, nds_offset, nds_string_len);
8233                     proto_tree_add_text(ncp_tree, tvb, nds_offset, nds_string_len, "OS Name: %s", reply_buffer);
8234                     nds_offset += nds_string_len;
8235                     nds_offset += align_4(tvb, nds_offset);
8236                     break;
8237                 case 0x00080000:
8238                     if(tvb_get_guint8(tvb, nds_offset) == 0x00)
8239                     {
8240                         nds_offset += 2;
8241                     }
8242                     nds_string_len = tvb_get_letohl(tvb, nds_offset);
8243                     nds_offset += 4;
8244                     reply_buffer = get_string(tvb, nds_offset, nds_string_len);
8245                     tvb_ensure_bytes_exist(tvb, nds_offset, nds_string_len);
8246                     proto_tree_add_text(ncp_tree, tvb, nds_offset, nds_string_len, "Hardware Name: %s", reply_buffer);
8247                     nds_offset += nds_string_len;
8248                     nds_offset += align_4(tvb, nds_offset);
8249                     break;
8250                 case 0x00100000:
8251                     if(tvb_get_guint8(tvb, nds_offset) == 0x00)
8252                     {
8253                         nds_offset += 2;
8254                     }
8255                     nds_string_len = tvb_get_letohl(tvb, nds_offset);
8256                     nds_offset += 4;
8257                     reply_buffer = get_string(tvb, nds_offset, nds_string_len);
8258                     tvb_ensure_bytes_exist(tvb, nds_offset, nds_string_len);
8259                     proto_tree_add_text(ncp_tree, tvb, nds_offset, nds_string_len, "Vendor Name: %s", reply_buffer);
8260                     nds_offset += nds_string_len;
8261                     nds_offset += align_4(tvb, nds_offset);
8262                     break;
8263                 default:
8264                     break;
8265                 }
8266             }
8267             bvalue = bvalue*2;
8268         }
8269     }
8270 }
8271
8272 static void
8273 dissect_nds_reply(tvbuff_t *tvb, packet_info *pinfo,
8274                   proto_tree *ncp_tree, guint32 nds_error_code,
8275                   const char *nds_error_string, ncp_req_hash_value *request_value,
8276                   conversation_t *conversation)
8277 {
8278     guint32                         nds_offset;
8279     guint32                         nds_reply_buffer;
8280     guint32                         nds_frag;
8281     proto_item                      *expert_item;
8282     const char                      *verb_string;
8283     nds_val                         pvalues[9];
8284     gboolean                        resolve_eid=FALSE;
8285     guint32                         global_eid=0;
8286     gboolean                        add_eid = FALSE;
8287     char                            global_object_name[256];
8288     ncp_req_eid_hash_value          *request_eid_value = NULL;
8289     int                             i;
8290
8291     global_object_name[0] = '\0';
8292
8293     nds_offset = 8;
8294
8295     nds_reply_buffer = tvb_get_letohl(tvb, nds_offset);
8296     proto_tree_add_uint(ncp_tree, hf_ncp_fragment_size, tvb, nds_offset,
8297                         4, nds_reply_buffer);
8298     nds_offset += 4;
8299     nds_frag = tvb_get_letohl(tvb, nds_offset);
8300     proto_tree_add_uint(ncp_tree, hf_ncp_fragment_handle, tvb, nds_offset,
8301                         4, nds_frag);
8302     nds_offset += 4;
8303     /*
8304      * Is the possibly-reassembled reply large enough to have a completion
8305      * code?  (We can't check the fragment size as this might just be the
8306      * last fragment.)
8307      */
8308     if (tvb_reported_length_remaining(tvb, nds_offset) >= 4)
8309     {
8310         /* Yes - process the completion code. */
8311         expert_item = proto_tree_add_uint_format(ncp_tree, hf_nds_reply_error, tvb, nds_offset,
8312                                                  4, nds_error_code, "NDS Completion Code: 0x%08x, %s",
8313                                                  nds_error_code, nds_error_string);
8314
8315         if (nds_error_code != 0 && ncp_echo_err) {
8316             expert_add_info_format(pinfo, expert_item, PI_RESPONSE_CODE, PI_ERROR, "NDS Error: 0x%08x %s", nds_error_code, nds_error_string);
8317         }
8318     }
8319     if (request_value && nds_error_code == 0x00000000)
8320     {
8321         nds_offset = 20;
8322         for (i = 0; i < 9; i++) {
8323             pvalues[i].vtype = 0;
8324             pvalues[i].vvalue = 0;
8325             pvalues[i].vlength = 0;
8326             pvalues[i].voffset = 0;
8327             pvalues[i].hfname = 0;
8328             pvalues[i].vdesc = "";
8329             pvalues[i].vstring = NULL;
8330             pvalues[i].mvtype = 0;
8331         }
8332         verb_string = val_to_str(request_value->nds_request_verb,
8333                                  ncp_nds_verb_vals, "Continuation Fragment");
8334         if(request_value->req_nds_prot_flags & 0x4000)
8335         {
8336             /* CRC is included in the NDS header so justify the offset */
8337             proto_tree_add_item(ncp_tree, hf_nds_crc, tvb, nds_offset, 4, TRUE);
8338             nds_offset += 4;
8339         }
8340         switch (request_value->nds_request_verb)
8341         {
8342         case 0x01:
8343             pvalues[0].vvalue = tvb_get_letohl(tvb, nds_offset);
8344             pvalues[0].vstring = match_strval(pvalues[0].vvalue, nds_tags);
8345             if(pvalues[0].vstring == NULL)
8346             {
8347                 pvalues[0].vstring = "No Tags Set";
8348             }
8349             pvalues[0].vtype = VTYPE_STRING;
8350             pvalues[0].vdesc = "Tag: %s";
8351             pvalues[0].vlength = 4;
8352             pvalues[0].voffset = nds_offset;
8353             pvalues[0].hfname = hf_nds_tag_string;
8354             nds_offset = nds_offset+pvalues[0].vlength;
8355             switch(pvalues[0].vvalue)
8356             {
8357             case NDS_TAG_NO_SUCH_ENTRY:
8358                 break;
8359             case NDS_TAG_LOCAL_ENTRY:
8360                 pvalues[1].vvalue = tvb_get_letohl(tvb, nds_offset);
8361                 pvalues[1].vtype = VTYPE_UINT32;
8362                 pvalues[1].vdesc = "Entry ID: 0x%08x";
8363                 add_eid = TRUE;
8364                 resolve_eid = TRUE;
8365                 g_strlcpy(global_object_name, request_value->object_name, 256);
8366                 global_eid = pvalues[1].vvalue;
8367                 pvalues[1].vlength = 4;
8368                 pvalues[1].voffset = nds_offset;
8369                 pvalues[1].hfname = hf_nds_eid;
8370                 nds_offset = nds_offset+pvalues[1].vlength;
8371                 pvalues[2].vvalue = tvb_get_letohl(tvb, nds_offset);
8372                 pvalues[2].vtype = VTYPE_MULTIVALUE_UINT32;
8373                 pvalues[2].vdesc = "Referral Records: %u";
8374                 pvalues[2].vlength = 4;
8375                 pvalues[2].voffset = nds_offset;
8376                 pvalues[2].hfname = hf_nds_referrals;
8377                 pvalues[2].mvtype = MVTYPE_LOC_ADDR_REFERRAL_REPLY;
8378                 break;
8379             case NDS_TAG_REMOTE_ENTRY:
8380                 nds_offset += 4;   /* GUINT32 reserved field */
8381                 pvalues[1].vvalue = tvb_get_letohl(tvb, nds_offset);
8382                 pvalues[1].vtype = VTYPE_UINT32;
8383                 pvalues[1].vdesc = "Entry ID: 0x%08x";
8384                 pvalues[1].vlength = 4;
8385                 pvalues[1].voffset = nds_offset;
8386                 pvalues[1].hfname = hf_nds_eid;
8387                 nds_offset = nds_offset+pvalues[1].vlength;
8388                 pvalues[2].vvalue = tvb_get_letohl(tvb, nds_offset);
8389                 pvalues[2].vtype = VTYPE_MULTIVALUE_UINT32;
8390                 pvalues[2].vdesc = "Referral Records: %u";
8391                 pvalues[2].vlength = 4;
8392                 pvalues[2].voffset = nds_offset;
8393                 pvalues[2].hfname = hf_nds_referrals;
8394                 pvalues[2].mvtype = MVTYPE_LOC_ADDR_REFERRAL_REPLY;
8395                 break;
8396             case NDS_TAG_ALIAS_ENTRY:
8397                 pvalues[1].vtype = VTYPE_STRING;
8398                 pvalues[1].vdesc = "Alias Name: %s";
8399                 pvalues[1].mvtype = MVTYPE_ATTR_REQUEST;
8400                 pvalues[1].vvalue = 0;
8401                 pvalues[1].vlength = 256;
8402                 pvalues[1].vlength = tvb_get_letohl(tvb, nds_offset);
8403                 if (pvalues[1].vlength == 0x00)
8404                 {
8405                     pvalues[1].vtype = VTYPE_NONE;
8406                     break;
8407                 }
8408                 pvalues[1].voffset = nds_offset+4;
8409                 nds_offset += 4;
8410                 pvalues[1].vstring = get_string(tvb, pvalues[1].voffset, pvalues[1].vlength);
8411                 nds_offset += pvalues[1].vlength;
8412                 nds_offset += align_4(tvb, nds_offset);
8413                 pvalues[1].hfname= hf_nds_name;
8414                 break;
8415             case NDS_TAG_REFERRAL_INFORMATION:
8416                 pvalues[1].vvalue = tvb_get_letohl(tvb, nds_offset);
8417                 pvalues[1].vtype = VTYPE_UINT32;
8418                 pvalues[1].vdesc = "Distance Object is From Root: 0x%08x";
8419                 pvalues[1].vlength = 4;
8420                 pvalues[1].voffset = nds_offset;
8421                 pvalues[1].hfname = hf_nds_eid;
8422                 nds_offset = nds_offset+pvalues[1].vlength;
8423                 pvalues[2].vvalue = tvb_get_letohl(tvb, nds_offset);
8424                 pvalues[2].vtype = VTYPE_MULTIVALUE_UINT32;
8425                 pvalues[2].vdesc = "Referral Records: %u";
8426                 pvalues[2].vlength = 4;
8427                 pvalues[2].voffset = nds_offset;
8428                 pvalues[2].hfname = hf_nds_depth;
8429                 pvalues[2].mvtype = MVTYPE_ADDR_REFERRAL_REPLY;
8430                 break;
8431             case NDS_TAG_ENTRY_AND_REFERRALS:
8432                 pvalues[1].vvalue = tvb_get_letohl(tvb, nds_offset);
8433                 pvalues[1].vtype = VTYPE_UINT32;
8434                 pvalues[1].vdesc = "Result Flags: 0x%08x";
8435                 pvalues[1].vlength = 4;
8436                 pvalues[1].voffset = nds_offset;
8437                 pvalues[1].hfname = hf_nds_result_flags;
8438                 nds_offset = nds_offset+pvalues[1].vlength;
8439                 pvalues[2].vvalue = tvb_get_letohl(tvb, nds_offset);
8440                 pvalues[2].vtype = VTYPE_UINT32;
8441                 pvalues[2].vdesc = "Entry ID: 0x%08x";
8442                 add_eid = TRUE;
8443                 resolve_eid = TRUE;
8444                 global_eid = pvalues[2].vvalue;
8445                 g_strlcpy(global_object_name, request_value->object_name, 256);
8446                 pvalues[2].vlength = 4;
8447                 pvalues[2].voffset = nds_offset;
8448                 pvalues[2].hfname = hf_nds_eid;
8449                 nds_offset = nds_offset+pvalues[2].vlength;
8450                 pvalues[3].vvalue = tvb_get_letohl(tvb, nds_offset);
8451                 pvalues[3].vtype = VTYPE_MULTIVALUE_UINT32;
8452                 pvalues[3].vdesc = "Referral Records: %u";
8453                 pvalues[3].vlength = 4;
8454                 pvalues[3].voffset = nds_offset;
8455                 pvalues[3].mvtype = MVTYPE_ADDR_REFERRAL_REPLY;
8456                 pvalues[3].hfname = hf_nds_referrals;
8457                 break;
8458             default:
8459                 break;
8460             }
8461             break;
8462         case 0x02:
8463             nds_offset -= 4;
8464             pvalues[0].vvalue = 1;
8465             pvalues[0].vtype = VTYPE_MULTIVALUE_UINT32;
8466             pvalues[0].vdesc = "Entry Information";
8467             pvalues[0].vlength = 0;
8468             pvalues[0].voffset = nds_offset;
8469             pvalues[0].hfname = hf_nds_name;
8470             pvalues[0].mvtype = MVTYPE_LIST_PARTITIONS;
8471             pvalues[0].vflags = request_value->req_nds_flags;
8472             break;
8473         case 0x03:
8474             pvalues[0].vvalue = tvb_get_letohl(tvb, nds_offset);
8475             pvalues[0].vtype = VTYPE_UINT32;
8476             pvalues[0].vdesc = "Iteration Handle: 0x%08x";
8477             pvalues[0].vlength = 4;
8478             pvalues[0].voffset = nds_offset;
8479             pvalues[0].hfname = hf_nds_iteration;
8480             nds_offset = nds_offset+pvalues[0].vlength;
8481             pvalues[1].vvalue = tvb_get_letohl(tvb, nds_offset);
8482             pvalues[1].vstring = match_strval(pvalues[1].vvalue, nds_info_type);
8483             if(pvalues[1].vstring == NULL)
8484             {
8485                 pvalues[1].vstring = "No Info Type Set";
8486             }
8487             pvalues[1].vtype = VTYPE_STRING;
8488             pvalues[1].vdesc = "Info Type: %s";
8489             pvalues[1].vlength = 4;
8490             pvalues[1].voffset = nds_offset;
8491             pvalues[1].hfname = hf_nds_info_type;
8492             nds_offset = nds_offset+pvalues[1].vlength;
8493             pvalues[2].vvalue = tvb_get_letohl(tvb, nds_offset);
8494             pvalues[2].vtype = VTYPE_MULTIVALUE_UINT32;
8495             pvalues[2].vdesc = "Number of Attributes: %u";
8496             pvalues[2].vlength = 4;
8497             pvalues[2].voffset = nds_offset;
8498             pvalues[2].hfname = hf_nds_attr;
8499             pvalues[2].mvtype = MVTYPE_ATTR_REPLY;
8500             pvalues[2].vflags = request_value->req_nds_flags;
8501             pvalues[2].nds_version = request_value->nds_version;
8502             pvalues[2].pflags = request_value->req_nds_prot_flags;
8503             break;
8504         case 0x04:
8505             pvalues[0].vvalue = tvb_get_guint8(tvb, nds_offset);
8506             if (pvalues[0].vvalue == 0)
8507             {
8508                 pvalues[0].vstring = "Did Not Match";
8509             }
8510             else
8511             {
8512                 pvalues[0].vstring = "Matched";
8513             }
8514             pvalues[0].vtype = VTYPE_STRING;
8515             pvalues[0].vdesc = "Compare Values Returned - %s";
8516             pvalues[0].vlength = 1;
8517             pvalues[0].voffset = nds_offset;
8518             pvalues[0].mvtype = 0;
8519             pvalues[0].hfname= hf_nds_compare_results;
8520             nds_offset += pvalues[0].vlength;
8521             break;
8522         case 0x05:
8523             pvalues[0].vvalue = tvb_get_letohl(tvb, nds_offset);
8524             pvalues[0].vtype = VTYPE_UINT32;
8525             pvalues[0].vdesc = "Iteration Handle: 0x%08x";
8526             pvalues[0].vlength = 4;
8527             pvalues[0].voffset = nds_offset;
8528             pvalues[0].hfname = hf_nds_iteration;
8529             nds_offset = nds_offset+pvalues[0].vlength;
8530             pvalues[1].vvalue = tvb_get_letohl(tvb, nds_offset);
8531             pvalues[1].vtype = VTYPE_MULTIVALUE_UINT32;
8532             pvalues[1].vdesc = "Entry Information";
8533             pvalues[1].vlength = 0;
8534             pvalues[1].voffset = nds_offset;
8535             pvalues[1].hfname = hf_nds_name;
8536             pvalues[1].mvtype = MVTYPE_LIST_PARTITIONS;
8537             pvalues[1].vflags = request_value->req_nds_flags;
8538             break;
8539         case 0x06:
8540             break;
8541         case 0x07:
8542             break;
8543         case 0x08:
8544             break;
8545         case 0x09:
8546             break;
8547         case 0x0a:
8548             break;
8549         case 0x0b:
8550             break;
8551         case 0x0c:
8552             break;
8553         case 0x0d:
8554             break;
8555         case 0x0e:
8556             break;
8557         case 0x0f:
8558             pvalues[0].vvalue = tvb_get_letohl(tvb, nds_offset);
8559             pvalues[0].vtype = VTYPE_UINT32;
8560             pvalues[0].vdesc = "Iteration Handle: 0x%08x";
8561             pvalues[0].vlength = 4;
8562             pvalues[0].voffset = nds_offset;
8563             pvalues[0].hfname = hf_nds_iteration;
8564             nds_offset = nds_offset+pvalues[0].vlength;
8565             pvalues[1].vvalue = tvb_get_letohl(tvb, nds_offset);
8566             pvalues[1].vstring = match_strval(pvalues[1].vvalue, class_def_type);
8567             if(pvalues[1].vstring == NULL)
8568             {
8569                 pvalues[1].vstring = "No Class Definition Type Set";
8570             }
8571             pvalues[1].vtype = VTYPE_STRING;
8572             pvalues[1].vdesc = "Class Definition Type: %s";
8573             pvalues[1].vlength = 4;
8574             pvalues[1].voffset = nds_offset;
8575             pvalues[1].mvtype = 0;
8576             pvalues[1].hfname= hf_nds_class_def_type;
8577             nds_offset = nds_offset + pvalues[1].vlength;
8578             pvalues[2].vvalue = tvb_get_letohl(tvb, nds_offset);;
8579             pvalues[2].vtype = VTYPE_MULTIVALUE_UINT32;
8580             pvalues[2].vdesc = "Class Definitions %u";
8581             pvalues[2].vlength = 0;
8582             pvalues[2].voffset = nds_offset;
8583             pvalues[2].hfname = hf_nds_classes;
8584             pvalues[2].mvtype = MVTYPE_CLASS_NAMES;
8585             pvalues[2].vflags = request_value->req_nds_flags;
8586             break;
8587         case 0x10:
8588             break;
8589         case 0x11:
8590             break;
8591         case 0x12:
8592             pvalues[0].vvalue = tvb_get_letohl(tvb, nds_offset);
8593             pvalues[0].vtype = VTYPE_UINT32;
8594             pvalues[0].vdesc = "Iteration Handle: 0x%08x";
8595             pvalues[0].vlength = 4;
8596             pvalues[0].voffset = nds_offset;
8597             pvalues[0].hfname = hf_nds_iteration;
8598             nds_offset = nds_offset+pvalues[0].vlength;
8599             pvalues[1].vvalue = tvb_get_letohl(tvb, nds_offset);
8600             pvalues[1].vtype = VTYPE_MULTIVALUE_UINT32;
8601             pvalues[1].vdesc = "Classes: %u";
8602             pvalues[1].vlength = 4;
8603             pvalues[1].voffset = nds_offset;
8604             pvalues[1].mvtype = MVTYPE_READ_CLASS_REQ;
8605             pvalues[1].hfname= hf_nds_classes;
8606             break;
8607         case 0x13:
8608             pvalues[0].vvalue = tvb_get_letohl(tvb, nds_offset);
8609             pvalues[0].vtype = VTYPE_UINT32;
8610             pvalues[0].vdesc = "Privileges: 0x%08x";
8611             pvalues[0].vlength = 4;
8612             pvalues[0].voffset = nds_offset;
8613             pvalues[0].hfname = hf_nds_privileges;
8614             nds_offset = nds_offset+pvalues[0].vlength;
8615             break;
8616         case 0x14:
8617             break;
8618         case 0x15:
8619             break;
8620         case 0x16:
8621             pvalues[0].vvalue = tvb_get_letohl(tvb, nds_offset);
8622             pvalues[0].vtype = VTYPE_UINT32;
8623             pvalues[0].vdesc = "Iteration Handle: 0x%08x";
8624             pvalues[0].vlength = 4;
8625             pvalues[0].voffset = nds_offset;
8626             pvalues[0].hfname = hf_nds_iteration;
8627             nds_offset = nds_offset+pvalues[0].vlength;
8628             pvalues[1].vtype = VTYPE_STRING;
8629             pvalues[1].vdesc = "Server Distinguished Name: %s";
8630             pvalues[1].mvtype = MVTYPE_ATTR_REQUEST;
8631             pvalues[1].vvalue = 0;
8632             pvalues[1].vlength = 256;
8633             pvalues[1].vlength = tvb_get_letohl(tvb, nds_offset);
8634             if (pvalues[1].vlength == 0x00)
8635             {
8636                 pvalues[1].vtype = VTYPE_NONE;
8637                 break;
8638             }
8639             pvalues[1].voffset = nds_offset+4;
8640             nds_offset += 4;
8641             pvalues[1].vstring = get_string(tvb, pvalues[1].voffset, pvalues[1].vlength);
8642             nds_offset += pvalues[1].vlength;
8643             nds_offset += align_4(tvb, nds_offset);
8644             pvalues[1].hfname= hf_nds_name;
8645             nds_offset += align_4(tvb, nds_offset);
8646             pvalues[2].vvalue = tvb_get_letohl(tvb, nds_offset);
8647             pvalues[2].vtype = VTYPE_MULTIVALUE_UINT32;
8648             pvalues[2].vdesc = "Replicas: %u";
8649             pvalues[2].vlength = 4;
8650             pvalues[2].voffset = nds_offset;
8651             pvalues[2].hfname = hf_nds_replicas;
8652             pvalues[2].mvtype = MVTYPE_READ_REPLICAS;
8653             pvalues[2].bit1 = "Output Flags";
8654             pvalues[2].bit2 = "Entry ID";
8655             pvalues[2].bit3 = "Replica State";
8656             pvalues[2].bit4 = "Modification Timestamp";
8657             pvalues[2].bit5 = "Purge Time";
8658             pvalues[2].bit6 = "Local Partition ID";
8659             pvalues[2].bit7 = "Distinguished Name";
8660             pvalues[2].bit8 = "Replica Type";
8661             pvalues[2].bit9 = "Partition Busy";
8662             pvalues[2].vflags = request_value->req_nds_flags;
8663             break;
8664         case 0x17:
8665             break;
8666         case 0x18:
8667             break;
8668         case 0x19:
8669             break;
8670         case 0x1a:
8671             break;
8672         case 0x1b:
8673             pvalues[0].vvalue = tvb_get_ntohl(tvb, nds_offset);
8674             pvalues[0].vtype = VTYPE_UINT32;
8675             pvalues[0].vdesc = "File Handle: 0x%08x";
8676             pvalues[0].vlength = 4;
8677             pvalues[0].voffset = nds_offset;
8678             pvalues[0].hfname = hf_nds_file_handle;
8679             nds_offset = nds_offset+pvalues[0].vlength;
8680             pvalues[1].vvalue = tvb_get_letohl(tvb, nds_offset);
8681             pvalues[1].vtype = VTYPE_UINT32;
8682             pvalues[1].vdesc = "File Size: %u";
8683             pvalues[1].vlength = 4;
8684             pvalues[1].voffset = nds_offset;
8685             pvalues[1].hfname = hf_nds_file_size;
8686             nds_offset = nds_offset+pvalues[1].vlength;
8687             break;
8688         case 0x1c:
8689             break;
8690         case 0x1d:
8691             break;
8692         case 0x1e:
8693             break;
8694         case 0x1f:
8695             break;
8696         case 0x20:
8697             break;
8698         case 0x21:
8699             break;
8700         case 0x22:
8701             break;
8702         case 0x23:
8703             break;
8704         case 0x24:
8705             break;
8706         case 0x25:
8707             break;
8708         case 0x26:
8709             break;
8710         case 0x27:
8711             break;
8712         case 0x28:
8713             break;
8714         case 0x29:
8715             break;
8716         case 0x2a:
8717             break;
8718         case 0x2b:
8719             break;
8720         case 0x2c:
8721             break;
8722         case 0x2d:
8723             break;
8724         case 0x2e:
8725             break;
8726         case 0x2f:
8727             break;
8728         case 0x30:
8729             break;
8730         case 0x31:
8731             break;
8732         case 0x32:
8733             break;
8734         case 0x33:
8735             break;
8736         case 0x34:
8737             break;
8738         case 0x35:
8739             pvalues[0].vtype = VTYPE_MULTIVALUE_UINT32;
8740             pvalues[0].vdesc = "Server Name";
8741             pvalues[0].mvtype = MVTYPE_PROCESS_TAGS;
8742             pvalues[0].vflags = request_value->req_nds_flags;
8743             pvalues[0].hfname = hf_nds_svr_dst_name;
8744             pvalues[0].vlength = tvb_get_letohl(tvb, nds_offset);
8745             if (pvalues[0].vlength == 0x00)
8746             {
8747                 pvalues[0].vtype = VTYPE_NONE;
8748                 break;
8749             }
8750             pvalues[0].voffset = nds_offset;
8751             nds_offset += pvalues[0].vlength + 4;
8752             nds_offset += align_4(tvb, nds_offset);
8753             pvalues[1].vvalue = tvb_get_letohl(tvb, nds_offset);
8754             pvalues[1].vtype = VTYPE_MULTIVALUE_UINT32;
8755             pvalues[1].vdesc = "Referral Records: %u";
8756             pvalues[1].vlength = 4;
8757             pvalues[1].voffset = nds_offset;
8758             pvalues[1].hfname = hf_nds_referrals;
8759             pvalues[1].mvtype = MVTYPE_LOC_ADDR_REFERRAL_REPLY;
8760             break;
8761         case 0x36:
8762             break;
8763         case 0x37:
8764             break;
8765         case 0x38:
8766             break;
8767         case 0x39:
8768             pvalues[1].vvalue = tvb_get_letohl(tvb, nds_offset);
8769             pvalues[1].vtype = VTYPE_UINT32;
8770             pvalues[1].vdesc = "Entry ID: 0x%08x";
8771             add_eid = TRUE;
8772             resolve_eid = TRUE;
8773             g_strlcpy(global_object_name, request_value->object_name, 256);
8774             global_eid = pvalues[1].vvalue;
8775             pvalues[1].vlength = 4;
8776             pvalues[1].voffset = nds_offset;
8777             pvalues[1].hfname = hf_nds_eid;
8778             nds_offset = nds_offset+pvalues[1].vlength;
8779             break;
8780         case 0x3a:
8781             break;
8782         case 0x3b:
8783             break;
8784         case 0x3c:
8785             break;
8786         case 0x3d:
8787             break;
8788         case 0x3e:
8789             break;
8790         case 0x3f:
8791             break;
8792         case 0x40:
8793             break;
8794         case 0x41:
8795             break;
8796         case 0x42:
8797             break;
8798         case 0x43:
8799             break;
8800         case 0x44:
8801             break;
8802         case 0x45:
8803             break;
8804         case 0x46:
8805             break;
8806         case 0x47:
8807             break;
8808         case 0x48:
8809             break;
8810         case 0x49:
8811             break;
8812         case 0x4a:
8813             break;
8814         case 0x4b:
8815             break;
8816         case 0x4c:
8817             break;
8818         case 0x4d:
8819             break;
8820         case 0x6e:
8821             pvalues[0].vvalue = tvb_get_letohl(tvb, nds_offset);
8822             pvalues[0].vtype = VTYPE_UINT32;
8823             pvalues[0].vdesc = "Iteration Handle: 0x%08x";
8824             pvalues[0].vlength = 4;
8825             pvalues[0].voffset = nds_offset;
8826             pvalues[0].hfname= hf_nds_iteration;
8827             nds_offset = nds_offset+pvalues[0].vlength;
8828             pvalues[1].vvalue = tvb_get_letohl(tvb, nds_offset);
8829             pvalues[1].vtype = VTYPE_NONE;
8830             pvalues[1].vdesc = "Iteration Completion Code: 0x%08x";
8831             pvalues[1].vlength = 4;
8832             pvalues[1].voffset = nds_offset;
8833             pvalues[1].hfname = hf_iter_completion_code;
8834             expert_item = proto_tree_add_uint_format(ncp_tree, pvalues[1].hfname, tvb, nds_offset,
8835                                                      4, pvalues[1].vvalue, "NDS Iteration Completion Code: 0x%08x, %s",
8836                                                      pvalues[1].vvalue, match_strval(pvalues[1].vvalue, nds_reply_errors));
8837
8838             if (pvalues[1].vvalue != 0 && ncp_echo_err) {
8839                 expert_add_info_format(pinfo, expert_item, PI_RESPONSE_CODE, PI_ERROR, "NDS Iteration Error: 0x%08x %s", pvalues[1].vvalue, match_strval(pvalues[1].vvalue, nds_reply_errors));
8840             }
8841             nds_offset = nds_offset+pvalues[1].vlength;
8842             pvalues[2].vvalue = tvb_get_letohl(tvb, nds_offset);
8843             pvalues[2].vtype = VTYPE_ITEM;
8844             pvalues[2].vlength = 4;
8845             pvalues[2].voffset = nds_offset;
8846             pvalues[2].mvtype = MVTYPE_PROCESS_ITERATOR;
8847             pvalues[2].hfname = hf_ncp_nds_iterverb;
8848             nds_offset = nds_offset + pvalues[2].vlength;
8849             break;
8850         default:
8851             break;
8852         }
8853         if(request_value->nds_request_verb != 0)
8854         {
8855             proto_tree_add_uint_format(ncp_tree,
8856                                        hf_ncp_nds_verb, tvb, 6, 0,
8857                                        request_value->nds_request_verb,
8858                                        "NDS Verb: %d, %s",
8859                                        request_value->nds_request_verb, verb_string);
8860         }
8861         /* NDS Entry ID's (EID) is identified in the reply
8862          * packet of an NDS resolve name. We need to store
8863          * this EID and its associated name into our hash
8864          * so that we can resolve the name for other NDS
8865          * requests. */
8866         if (!pinfo->fd->flags.visited) {
8867             if(add_eid)
8868             {
8869                 request_eid_value = ncp_eid_hash_lookup(conversation, global_eid);
8870                 if (!request_eid_value) {
8871                     request_eid_value = ncp_eid_hash_insert(global_eid);
8872                     g_strlcpy(request_eid_value->object_name, global_object_name, 256);
8873                 }
8874             }
8875         }
8876         /* Echo EID data to expert Chat window */
8877         if (add_eid && nds_echo_eid) {
8878             expert_add_info_format(pinfo, NULL,
8879                                    PI_RESPONSE_CODE, PI_CHAT,
8880                                    "EID (%08x) = %s", global_eid, global_object_name);
8881         }
8882         /* For NDS requests with just an EID, resolve name
8883          * from hash table. */
8884         if(resolve_eid)
8885         {
8886             request_eid_value = ncp_eid_hash_lookup(conversation, global_eid);
8887             if (request_eid_value) {
8888                 g_strlcpy(global_object_name, request_eid_value->object_name, 256);
8889                 proto_tree_add_string_format(ncp_tree,
8890                                              hf_nds_name, tvb, 6, 0,
8891                                              global_object_name,
8892                                              "NDS Name for EID - %s",
8893                                              global_object_name);
8894             }
8895         }
8896         for (i = 0; i < 9; i++) {
8897             switch (pvalues[i].vtype) {
8898
8899             case VTYPE_NONE: /* no value */
8900                 break;
8901
8902             case VTYPE_ITEM:
8903                 if (pvalues[i].mvtype == MVTYPE_PROCESS_ITERATOR)
8904                 {
8905                     dissect_nds_iterator(ncp_tree, tvb, pinfo, pvalues[i].vvalue, 0, nds_offset, FALSE);
8906                 }
8907                 else
8908                 {
8909                     proto_tree_add_item(ncp_tree, pvalues[i].hfname, tvb, pvalues[i].voffset,
8910                                         pvalues[i].vlength, TRUE);
8911                 }
8912                 break;
8913             case VTYPE_UINT8:
8914                 proto_tree_add_uint_format(ncp_tree, pvalues[i].hfname, tvb, pvalues[i].voffset,
8915                                            pvalues[i].vlength, pvalues[i].vtype, "NDS Parameter not defined %u",
8916                                            pvalues[i].vtype);
8917                 break;
8918
8919             case VTYPE_UINT16:
8920                 proto_tree_add_uint_format(ncp_tree, pvalues[i].hfname, tvb, pvalues[i].voffset,
8921                                            pvalues[i].vlength, pvalues[i].vtype, "NDS Parameter not defined %u",
8922                                            pvalues[i].vtype);
8923                 break;
8924
8925             case VTYPE_UINT32:
8926                 proto_tree_add_uint_format(ncp_tree, pvalues[i].hfname, tvb, pvalues[i].voffset,
8927                                            pvalues[i].vlength, pvalues[i].vvalue, pvalues[i].vdesc,
8928                                            pvalues[i].vvalue);
8929                 break;
8930
8931             case VTYPE_STRING:
8932                 proto_tree_add_string_format(ncp_tree, pvalues[i].hfname, tvb, pvalues[i].voffset,
8933                                              pvalues[i].vlength, pvalues[i].vstring, pvalues[i].vdesc,
8934                                              pvalues[i].vstring);
8935                 break;
8936
8937             case VTYPE_BITFIELD:
8938                 process_bitfield(ncp_tree, tvb, &pvalues[i]);
8939                 break;
8940
8941             case VTYPE_MULTIVALUE_UINT32:
8942                 process_multivalues(ncp_tree, tvb, pinfo, &pvalues[i]);
8943                 break;
8944
8945             default:
8946                 proto_tree_add_uint_format(ncp_tree, hf_nds_p1type, tvb, pvalues[i].voffset,
8947                                            pvalues[i].vlength, pvalues[i].vtype, "NDS Parameter not defined %u",
8948                                            pvalues[i].vtype);
8949                 break;
8950             }
8951         }
8952     }
8953 }
8954
8955 void
8956 dissect_ncp_reply(tvbuff_t *tvb, packet_info *pinfo,
8957                   guint32 nw_connection, guint8 sequence, guint16 type,
8958                   proto_tree *ncp_tree, struct novell_tap *ncp_tap)
8959 {
8960     conversation_t      *conversation = NULL;
8961     ncp_req_hash_value  *request_value = NULL;
8962     const ncp_record    *ncp_rec = NULL;
8963     gboolean            *req_cond_results;
8964     guint8               completion_code=0;
8965     ptvcursor_t         *ptvc = NULL;
8966     const char          *error_string;
8967     guint32              nds_offset = 0;
8968     guint32              nds_error_code = 0;
8969     guint32              nds_reply_buffer = 0;
8970     const char          *nds_error_string = NULL;
8971     guint32              nds_frag=0;
8972     proto_item          *expert_item;
8973     guint8               conn_stat;
8974
8975
8976 #ifdef FAKE_TREE_IS_VISIBLE
8977     if (ncp_tree) {
8978         PTREE_DATA(ncp_tree)->visible=1;
8979     }
8980 #endif
8981
8982     if (!pinfo->fd->flags.visited) {
8983         /* Find the conversation whence the request would have come. */
8984         conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst,
8985                                          PT_NCP, nw_connection, nw_connection, 0);
8986         if (conversation != NULL) {
8987             /* find the record telling us the request made that caused
8988                this reply */
8989             request_value = ncp_hash_lookup(conversation, sequence);
8990             if (request_value) {
8991                 ncp_rec = request_value->ncp_rec;
8992             }
8993             p_add_proto_data(pinfo->fd, proto_ncp, (void*) request_value);
8994         }
8995         /* else... we haven't seen an NCP Request for that conversation
8996            and sequence.
8997            Create Service request packets do not contain nw_connection.
8998            The initial value is set to 65535 or 0. The reply packet has the
8999            valid connection. So, we can't find the request packet in
9000            our conversation list. To trap for this we can just perform
9001            the search again with 65535 to see if we can locate the
9002            proper request packet. */
9003         else {
9004             conversation = find_conversation(pinfo->fd->num,
9005                                              &pinfo->src, &pinfo->dst, PT_NCP, 65535, 65535, 0);
9006             if (conversation != NULL) {
9007                 /* find the record telling us the request made
9008                    that caused this reply */
9009                 request_value = ncp_hash_lookup(conversation,
9010                                                 sequence);
9011                 if (request_value) {
9012                     ncp_rec = request_value->ncp_rec;
9013                 }
9014                 p_add_proto_data(pinfo->fd, proto_ncp,
9015                                  (void*) request_value);
9016             }
9017             else {
9018                 conversation = find_conversation(pinfo->fd->num,
9019                                                  &pinfo->src, &pinfo->dst, PT_NCP, 0, 0, 0);
9020                 if (conversation != NULL) {
9021                     /* find the record telling us the request made
9022                        that caused this reply */
9023                     request_value = ncp_hash_lookup(conversation,
9024                                                     sequence);
9025                     if (request_value) {
9026                         ncp_rec = request_value->ncp_rec;
9027                     }
9028                     p_add_proto_data(pinfo->fd, proto_ncp,
9029                                      (void*) request_value);
9030                 }
9031                 /* else... we haven't seen an NCP Request for that
9032                    conversation and sequence. */
9033             }
9034         }
9035     }
9036     else {
9037         request_value = p_get_proto_data(pinfo->fd, proto_ncp);
9038         if (request_value) {
9039             ncp_rec = request_value->ncp_rec;
9040         }
9041     }
9042
9043     /*
9044      * Tap the packet before the dissectors are called so we
9045      * still get the tap listener called even if there is an
9046      * exception.
9047      */
9048     tap_queue_packet(ncp_tap->stat, pinfo, request_value);
9049
9050     if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
9051         if (ncp_rec && ncp_rec->func==0x68 &&
9052             (ncp_rec->subfunc==0x02 || ncp_rec->subfunc==0x01)) {
9053             col_set_str(pinfo->cinfo, COL_PROTOCOL, "NDS");
9054         }
9055     }
9056
9057     /* A completion code of 0 always means OK. Non-zero means failure,
9058      * but each non-zero value has a different meaning. And the same value
9059      * can have different meanings, depending on the ncp.func (and ncp.subfunc)
9060      * value. */
9061     completion_code = tvb_get_guint8(tvb, 6);
9062     if (completion_code == 0) {
9063         if(type == NCP_POSITIVE_ACK)
9064         {
9065             error_string = "Server Busy, Request Being Processed";
9066         }
9067         else
9068         {
9069             error_string = "OK";
9070         }
9071     } else {
9072         if (ncp_rec && ncp_rec->errors) {
9073             error_string = ncp_error_string(ncp_rec->errors, completion_code);
9074         }
9075         else {
9076             error_string = "Original Request Packet not Found";
9077         }
9078     }
9079     if (type == NCP_SERVICE_REPLY && ncp_rec && ncp_rec->func==0x68 &&
9080         ncp_rec->subfunc==0x02 && (tvb_reported_length_remaining(tvb, 8) >= 8))
9081     {
9082         nds_offset = 8;
9083         nds_reply_buffer = tvb_get_letohl(tvb, nds_offset);
9084         nds_offset += 4;
9085         nds_frag = tvb_get_letohl(tvb, nds_offset);
9086         nds_offset += 4;
9087         /*
9088          * Is the possibly-reassembled reply large enough to have
9089          * a completion code?  (We can't check the fragment size
9090          * as this might just be the last fragment.)
9091          */
9092         if (tvb_reported_length_remaining(tvb, nds_offset) >= 4)
9093         {
9094             /* Yes - process the completion code. */
9095             nds_error_code = tvb_get_letohl(tvb, nds_offset);
9096             nds_error_string = match_strval(nds_error_code, nds_reply_errors);
9097             if (nds_error_string == NULL)
9098             {
9099                 nds_error_string = "NDS Error - No Definition Found";
9100             }
9101         }
9102     }
9103     if (check_col(pinfo->cinfo, COL_INFO)) {
9104         col_add_fstr(pinfo->cinfo, COL_INFO, "%s %s",
9105                      type == NCP_SERVICE_REPLY ? "R" : "ACK",
9106                      nds_error_string ? nds_error_string : error_string);
9107     }
9108
9109     if (ncp_tree) {
9110
9111         if (request_value) {
9112             nstime_t ns;
9113
9114             proto_tree_add_uint(ncp_tree, hf_ncp_req_frame_num, tvb, 0, 0,
9115                                 request_value->req_frame_num);
9116             nstime_delta(&ns, &pinfo->fd->abs_ts, &request_value->req_frame_time);
9117             proto_tree_add_time(ncp_tree, hf_ncp_req_frame_time, tvb, 0, 0, &ns);
9118         }
9119
9120         /* Put the func (and maybe subfunc) from the request packet
9121          * in the proto tree, but hidden. That way filters on ncp.func
9122          * or ncp.subfunc will find both the requests and the replies.
9123          */
9124         if (ncp_rec) {
9125             proto_tree_add_uint_format(ncp_tree, hf_ncp_func, tvb, 6, 0,
9126                                        ncp_rec->func, "Function: %u (0x%02X), %s",
9127                                        ncp_rec->func, ncp_rec->func, ncp_rec->name);
9128             if (ncp_requires_subfunc(ncp_rec->func)) {
9129                 proto_tree_add_uint_format(ncp_tree, hf_ncp_subfunc, tvb, 6, 0,
9130                                            ncp_rec->subfunc, "SubFunction: %u (0x%02x)",
9131                                            ncp_rec->subfunc, ncp_rec->subfunc);
9132             }
9133         }
9134     }
9135
9136     expert_item = proto_tree_add_uint_format(ncp_tree, hf_ncp_completion_code, tvb, 6, 1,
9137                                              completion_code, "Completion Code: %d (0x89%02x), %s",
9138                                              completion_code, completion_code, error_string);
9139     if ((completion_code != 0 || type == NCP_POSITIVE_ACK) && ncp_echo_err) {
9140         expert_add_info_format(pinfo, expert_item,
9141                                PI_RESPONSE_CODE, PI_ERROR,
9142                                "Error: %d (0x89%02x) %s", completion_code,
9143                                completion_code, error_string);
9144     }
9145
9146     conn_stat = tvb_get_guint8(tvb, 7);
9147     expert_item = proto_tree_add_item(ncp_tree, hf_ncp_connection_status, tvb,
9148                                       7, 1, FALSE);
9149     if (conn_stat != 0 && conn_stat != 0x40 ) {
9150         col_set_str(pinfo->cinfo, COL_INFO,
9151                     "Error: Bad Connection Status");
9152         if (ncp_echo_err) {
9153             expert_add_info_format(pinfo, expert_item,
9154                                    PI_RESPONSE_CODE, PI_ERROR,
9155                                    "Error: Bad Connection Status");
9156         }
9157         return;
9158     }
9159     /*
9160      * Unless this is a successful reply, that's all there
9161      * is to parse.
9162      */
9163     if (type != NCP_SERVICE_REPLY || completion_code != 0)
9164         return;
9165
9166     if (ncp_rec) {
9167         /* Dissect SSS Reply packets */
9168         if (ncp_rec->func == 0x5c && request_value)
9169         {
9170             dissect_sss_reply(tvb, pinfo, ncp_tree, ncp_rec->subfunc, request_value);
9171         }
9172         /* Dissect NMAS Reply packets */
9173         if (ncp_rec->func == 0x5e && request_value)
9174         {
9175             dissect_nmas_reply(tvb, pinfo, ncp_tree, ncp_rec->func, ncp_rec->subfunc, request_value);
9176         }
9177         /* Dissect NDS Ping packets */
9178         if (ncp_rec->func == 0x68 && ncp_rec->subfunc == 0x01)
9179         {
9180             dissect_nds_ping_reply(tvb, pinfo, ncp_tree,
9181                                    request_value);
9182         }
9183         /* Dissect NDS Reply packets */
9184         if (ncp_rec->func == 0x68 && ncp_rec->subfunc == 0x02)
9185         {
9186             dissect_nds_reply(tvb, pinfo, ncp_tree, nds_error_code,
9187                               nds_error_string, request_value, conversation);
9188         }
9189         /* Due to lack of group repeat fields in reply structure, decode this ncp 87/20 reply manually here. */
9190         if ((ncp_rec->func == 0x57 || ncp_rec->func == 0x59) && ncp_rec->subfunc == 0x14) {
9191             dissect_ncp_8x20reply(tvb, ncp_tree, ncp_rec, request_value);
9192         }
9193         /* Process ncp 23/26 address records manually to format correctly. */
9194         if (ncp_rec->func == 0x17 && ncp_rec->subfunc == 0x1a) {
9195             dissect_ncp_23_26_reply(tvb, ncp_tree);
9196         }
9197         if (ncp_rec->func == 5 && ncp_echo_conn) {
9198             expert_add_info_format(pinfo, NULL, PI_RESPONSE_CODE, PI_CHAT, "Connection Destroyed");
9199         }
9200         if (ncp_rec->reply_ptvc) {
9201             /* If we're not building a protocol tree, quit;
9202              * "process_ptvc_record()" assumes we're building
9203              * a protocol tree, and we don't support putting
9204              * stuff in the Info column in replies, and no
9205              * state information is currently updated for
9206              * replies by "process_ptvc_record()", so we
9207              * can't, and don't have a reason to, dissect
9208              * any further if we're not building a protocol
9209              * tree. */
9210             if (!ncp_tree)
9211                 return;
9212
9213             /* If a non-zero completion code was found, it is
9214              * legal to not have any fields, even if the packet
9215              * type is defined as having fields.
9216              *
9217              * XXX - we already know that the completion code
9218              * is 0, as we checked it above.  Is there any
9219              * reason why we'd want to do a full dissection
9220              * if the completion code isn't 0? */
9221             if (completion_code != 0 && tvb_length(tvb) == 8) {
9222                 return;
9223             }
9224
9225             /* Any request condition results? */
9226             if (request_value) {
9227                 req_cond_results = request_value->req_cond_results;
9228             }
9229             else {
9230                 req_cond_results = NULL;
9231             }
9232             clear_repeat_vars();
9233             ptvc = ptvcursor_new(ncp_tree, tvb, 8);
9234             process_ptvc_record(ptvc, ncp_rec->reply_ptvc,
9235                                 req_cond_results, TRUE, ncp_rec);
9236             ptvcursor_free(ptvc);
9237
9238             /* Echo the NDS EID and name for NCP 22,51 replies to expert tap */
9239             if (!pinfo->fd->flags.visited && ncp_rec->func == 0x16 && ncp_rec->subfunc == 0x33) {
9240
9241                 char    eid_string[10];
9242                 char    global_object_name[256];
9243
9244                 build_expert_data(ncp_tree, "ncp.directory_services_object_id",
9245                                   eid_string, sizeof eid_string,
9246                                   0, TRUE);
9247                 build_expert_data(ncp_tree, "ncp.volume_name_len",
9248                                   global_object_name, sizeof global_object_name,
9249                                   0, FALSE);
9250
9251                 /* Echo EID data to expert Chat window */
9252                 if (nds_echo_eid) {
9253                     expert_add_info_format(pinfo, NULL,
9254                                            PI_RESPONSE_CODE, PI_CHAT,
9255                                            "EID (%s) = %s", eid_string, global_object_name);
9256                 }
9257             }
9258             /* Process ncp 123/17 address records manually to format correctly. */
9259             if (ncp_rec->func == 0x7b && ncp_rec->subfunc == 0x11) {
9260                 dissect_ncp_123_17_reply(tvb, ncp_tree);
9261             }
9262             /* Process ncp 123/11 NLM names manually to format correctly. */
9263             if (ncp_rec->func == 0x7b && ncp_rec->subfunc == 0x0b && request_value) {
9264                 dissect_ncp_123_11_reply(tvb, ncp_tree, request_value);
9265             }
9266             /* Process ncp 123/62 server set parameter values manually to format correctly. */
9267             if (ncp_rec->func == 0x7b && ncp_rec->subfunc == 0x3e) {
9268                 dissect_ncp_123_62_reply(tvb, ncp_tree);
9269             }
9270         }
9271         /* Check to see if we need to report to the expert table */
9272         trap_for_expert_event(ncp_tree, pinfo, ncp_rec, 1);
9273     } else {
9274         if (tvb_length(tvb) > 8) {
9275             expert_item = proto_tree_add_text(ncp_tree, tvb, 8, -1,
9276                                               "No request record found. Parsing is impossible.");
9277             if (ncp_echo_err) {
9278                 expert_add_info_format(pinfo, expert_item, PI_SEQUENCE, PI_NOTE, "No request record found.");
9279             }
9280         }
9281     }
9282 }
9283
9284 void
9285 dissect_nds_request(tvbuff_t *tvb, packet_info *pinfo,
9286                     guint32 nw_connection, guint8 sequence,
9287                     guint16 type, proto_tree *ncp_tree)
9288 {
9289     guint8                   func, subfunc = 0;
9290     ncp_req_hash_value      *request_value = NULL;
9291     ncp_req_eid_hash_value  *request_eid_value = NULL;
9292     const ncp_record        *ncp_rec = NULL;
9293     conversation_t          *conversation;
9294     ptvcursor_t             *ptvc = NULL;
9295     proto_tree              *temp_tree = NULL;
9296     gboolean                 run_req_cond = FALSE;
9297     gboolean                 run_info_str = FALSE;
9298     guint8                   nds_verb = 0;
9299     const char              *verb_string = "";
9300     guint32                  nds_frag = 0;
9301     gboolean                 added_arrow;
9302     nds_val                  pvalues[9], prot_flags[1];
9303     guint8                   nds_version = 0;
9304     guint32                  foffset = 0;
9305     char                     global_object_name[256];
9306     guint32                  global_eid=0;
9307     gboolean                 resolve_eid=FALSE;
9308     guint32                  global_flags=0, nds_prot_flags=0;
9309     int                      i;
9310
9311     for (i = 0; i < 9; i++) {
9312         pvalues[i].vtype = 0;
9313         pvalues[i].vvalue = 0;
9314         pvalues[i].vlength = 0;
9315         pvalues[i].voffset = 0;
9316         pvalues[i].hfname = 0;
9317         pvalues[i].vdesc = "";
9318         pvalues[i].vstring = NULL;
9319         pvalues[i].mvtype = 0;
9320         pvalues[i].vflags = 0;
9321     }
9322
9323     global_object_name[0] = '\0';
9324
9325     func = tvb_get_guint8(tvb, 6);
9326     subfunc = tvb_get_guint8(tvb, 7);
9327
9328     ncp_rec = ncp_record_find(func, subfunc);
9329
9330     /* Check to see if this is a fragment packet */
9331     nds_frag = tvb_get_letohl(tvb, 8);
9332
9333     /* Get NDS Verb */
9334     if (nds_frag == 0xffffffff) {
9335         /* First fragment or only fragment. */
9336         nds_verb = tvb_get_guint8(tvb, 24);
9337         if (nds_verb == 0xfe)
9338         {
9339             nds_version = nds_verb;
9340             nds_verb = tvb_get_guint8(tvb, 32);
9341             foffset = 36;
9342         }
9343         else
9344         {
9345             nds_version = 0;
9346             foffset = 28;
9347         }
9348         if (type == NCP_SERVICE_REQUEST) {
9349             proto_tree_add_item(ncp_tree, hf_nds_buffer_size, tvb, foffset,
9350                                 4, TRUE);
9351         }
9352         foffset = foffset+4;
9353         verb_string = val_to_str(nds_verb, ncp_nds_verb_vals,
9354                                  "Continuation Fragment");
9355         switch(nds_verb) {
9356
9357         case 0x01:
9358             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
9359             pvalues[0].vtype = VTYPE_UINT32;
9360             pvalues[0].vdesc = "Version: %u";
9361             pvalues[0].vlength = 4;
9362             pvalues[0].hfname = hf_nds_ver;
9363             pvalues[0].voffset = foffset;
9364             foffset = foffset+pvalues[0].vlength;
9365             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
9366             pvalues[1].vtype = VTYPE_BITFIELD;
9367             pvalues[1].vdesc = "Flags:";
9368             pvalues[1].vlength = 2;
9369             pvalues[1].hfname= hf_nds_nflags;
9370             pvalues[1].voffset = foffset;
9371             pvalues[1].bit1 = "Entry ID";
9372             pvalues[1].bit1hfname = hf_bit1nflags;
9373             pvalues[1].bit2 = "Readable";
9374             pvalues[1].bit2hfname = hf_bit2nflags;
9375             pvalues[1].bit3 = "Writeable";
9376             pvalues[1].bit3hfname = hf_bit3nflags;
9377             pvalues[1].bit4 = "Master";
9378             pvalues[1].bit4hfname = hf_bit4nflags;
9379             pvalues[1].bit5 = "Create ID";
9380             pvalues[1].bit5hfname = hf_bit5nflags;
9381             pvalues[1].bit6 = "Walk Tree";
9382             pvalues[1].bit6hfname = hf_bit6nflags;
9383             pvalues[1].bit7 = "Dereference Alias";
9384             pvalues[1].bit7hfname = hf_bit7nflags;
9385             pvalues[1].bit8 = "Not Defined";
9386             pvalues[1].bit8hfname = hf_bit8nflags;
9387             pvalues[1].bit9 = "Not Defined";
9388             pvalues[1].bit9hfname = hf_bit9nflags;
9389             pvalues[1].bit10 = "Not Defined";
9390             pvalues[1].bit10hfname = hf_bit10nflags;
9391             pvalues[1].bit11= "Not Defined";
9392             pvalues[1].bit11hfname = hf_bit11nflags;
9393             pvalues[1].bit12 = "Not Defined";
9394             pvalues[1].bit12hfname = hf_bit12nflags;
9395             pvalues[1].bit13 = "Not Defined";
9396             pvalues[1].bit13hfname = hf_bit13nflags;
9397             pvalues[1].bit14 = "Prefer Referrals";
9398             pvalues[1].bit14hfname = hf_bit14nflags;
9399             pvalues[1].bit15 = "Prefer Only Referrals";
9400             pvalues[1].bit15hfname = hf_bit15nflags;
9401             pvalues[1].bit16 = "Not Defined";
9402             pvalues[1].bit16hfname = hf_bit16nflags;
9403             foffset = foffset+4;
9404             if (pvalues[0].vvalue == 0 || pvalues[0].vvalue == 1)
9405             {
9406                 pvalues[2].vtype = VTYPE_UINT32;
9407                 pvalues[2].vdesc = "Scope: %u";
9408                 pvalues[2].vlength = 4;
9409                 pvalues[2].voffset = foffset;
9410                 pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
9411                 pvalues[2].hfname= hf_nds_scope;
9412                 foffset = foffset+pvalues[2].vlength;
9413                 pvalues[3].vtype = VTYPE_STRING;
9414                 pvalues[3].vdesc = "Name: %s";
9415                 pvalues[3].mvtype = MVTYPE_ATTR_REQUEST;
9416                 pvalues[3].vvalue = 0;
9417                 pvalues[3].vlength = 256;
9418                 pvalues[3].vlength = tvb_get_letohl(tvb, foffset);
9419                 if (pvalues[3].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[3].vlength))
9420                 {
9421                     pvalues[3].vtype = VTYPE_NONE;
9422                     break;
9423                 }
9424                 pvalues[3].voffset = foffset+4;
9425                 foffset = foffset + 4;
9426                 pvalues[3].vstring = get_string(tvb, pvalues[3].voffset, pvalues[3].vlength);
9427                 g_strlcpy(global_object_name, pvalues[3].vstring, 256);
9428                 pvalues[3].hfname= hf_nds_name;
9429                 foffset = foffset+pvalues[3].vlength;
9430                 foffset += align_4(tvb, foffset);
9431                 pvalues[4].vvalue = tvb_get_letohl(tvb, foffset);
9432                 pvalues[4].vtype = VTYPE_MULTIVALUE_UINT32;
9433                 pvalues[4].vdesc = "Communications Transports: %u";
9434                 pvalues[4].vlength = 4;
9435                 pvalues[4].hfname= hf_nds_comm_trans;
9436                 pvalues[4].voffset = foffset;
9437                 pvalues[4].mvtype = MVTYPE_ADDR_REFERRAL_REQUEST;
9438                 foffset = foffset + (pvalues[4].vvalue * 4) + 4;
9439                 pvalues[5].vvalue = tvb_get_letohl(tvb, foffset);
9440                 pvalues[5].vtype = VTYPE_MULTIVALUE_UINT32;
9441                 pvalues[5].vdesc = "Tree Walker Transport Type: %u";
9442                 pvalues[5].vlength = 4;
9443                 pvalues[5].mvtype = MVTYPE_ADDR_REFERRAL_REQUEST;
9444                 pvalues[5].hfname= hf_nds_tree_trans;
9445                 pvalues[5].voffset = foffset;
9446             }
9447             else
9448             {
9449                 pvalues[2].vtype = VTYPE_UINT32;
9450                 pvalues[2].vdesc = "Minimum DS Version: %u";
9451                 pvalues[2].vlength = 4;
9452                 pvalues[2].voffset = foffset;
9453                 pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
9454                 pvalues[2].hfname= hf_min_nds_ver;
9455                 foffset = foffset+pvalues[2].vlength;
9456                 pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
9457                 pvalues[3].vtype = VTYPE_MULTIVALUE_UINT32;
9458                 pvalues[3].vdesc = "Number of Versions to Include: %u";
9459                 pvalues[3].vlength = 4;
9460                 pvalues[3].mvtype = MVTYPE_ATTR_REQUEST2;
9461                 pvalues[3].voffset = foffset;
9462                 pvalues[3].hfname= hf_nds_ver_include;
9463                 foffset += (pvalues[3].vvalue * 4) + 4;
9464                 pvalues[4].vvalue = tvb_get_letohl(tvb, foffset);
9465                 pvalues[4].vtype = VTYPE_MULTIVALUE_UINT32;
9466                 pvalues[4].vdesc = "Number of Versions to Exclude: %u";
9467                 pvalues[4].vlength = 4;
9468                 pvalues[4].mvtype = MVTYPE_ATTR_REQUEST2;
9469                 pvalues[4].hfname= hf_nds_ver_exclude;
9470                 pvalues[4].voffset = foffset;
9471                 foffset += 4;
9472                 pvalues[5].vtype = VTYPE_UINT32;
9473                 pvalues[5].vdesc = "DN Output Type: %u";
9474                 pvalues[5].vlength = 4;
9475                 pvalues[5].voffset = foffset;
9476                 pvalues[5].vvalue = tvb_get_letohl(tvb, foffset);
9477                 pvalues[5].hfname= hf_nds_dn_output_type;
9478                 foffset = foffset+pvalues[5].vlength;
9479                 pvalues[6].vtype = VTYPE_UINT32;
9480                 pvalues[6].vdesc = "Nested Output Type: %u";
9481                 pvalues[6].vlength = 4;
9482                 pvalues[6].voffset = foffset;
9483                 pvalues[6].vvalue = tvb_get_letohl(tvb, foffset);
9484                 pvalues[6].hfname= hf_nds_nested_output_type;
9485                 foffset = foffset+pvalues[6].vlength;
9486                 pvalues[7].vtype = VTYPE_STRING;
9487                 pvalues[7].vdesc = "Output Delimiter: %s";
9488                 pvalues[7].mvtype = MVTYPE_ATTR_REQUEST;
9489                 pvalues[7].vvalue = 0;
9490                 pvalues[7].vlength = 256;
9491                 pvalues[7].vlength = tvb_get_letohl(tvb, foffset);
9492                 pvalues[7].voffset = foffset+4;
9493                 foffset = foffset + 4;
9494                 pvalues[7].vstring = get_string(tvb, pvalues[7].voffset, pvalues[7].vlength);
9495                 pvalues[7].hfname= hf_nds_output_delimiter;
9496                 foffset = foffset+pvalues[7].vlength;
9497                 foffset += align_4(tvb, foffset);
9498                 pvalues[8].vvalue = tvb_get_letohl(tvb, foffset);
9499                 pvalues[8].vtype = VTYPE_MULTIVALUE_UINT32;
9500                 pvalues[8].vdesc = "Size of Entry Specifier: %u";
9501                 pvalues[8].vlength = 4;
9502                 pvalues[8].mvtype = MVTYPE_PROC_ENTRY_SPECIFIERS;
9503                 pvalues[8].hfname= hf_nds_output_entry_specifier;
9504                 pvalues[8].voffset = foffset;
9505             }
9506             break;
9507         case 0x02:
9508             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
9509             pvalues[0].vtype = VTYPE_UINT32;
9510             pvalues[0].vdesc = "Version: %u";
9511             pvalues[0].vlength = 4;
9512             pvalues[0].voffset = foffset;
9513             pvalues[0].hfname= hf_nds_ver;
9514             foffset = foffset+pvalues[0].vlength;
9515             switch(pvalues[0].vvalue)
9516             {
9517             case 0:
9518                 pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
9519                 pvalues[1].vtype = VTYPE_UINT32;
9520                 pvalues[1].vdesc = "Entry ID: 0x%08x";
9521                 pvalues[1].vlength = 4;
9522                 resolve_eid = TRUE;
9523                 global_eid = pvalues[1].vvalue;
9524                 pvalues[1].voffset = foffset;
9525                 pvalues[1].hfname = hf_nds_eid;
9526                 foffset = foffset+pvalues[1].vlength;
9527                 break;
9528             case 1:
9529                 pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
9530                 pvalues[1].vtype = VTYPE_BITFIELD;
9531                 pvalues[1].vdesc = "Request Flags:";
9532                 pvalues[1].vlength = 2;
9533                 pvalues[1].hfname= hf_nds_rflags;
9534                 pvalues[1].voffset = foffset;
9535                 pvalues[1].bit1 = "Typeless";
9536                 pvalues[1].bit1hfname = hf_bit1rflags;
9537                 pvalues[1].bit2 = "Slashed";
9538                 pvalues[1].bit2hfname = hf_bit2rflags;
9539                 pvalues[1].bit3 = "Dotted";
9540                 pvalues[1].bit3hfname = hf_bit3rflags;
9541                 pvalues[1].bit4 = "Tuned";
9542                 pvalues[1].bit4hfname = hf_bit4rflags;
9543                 pvalues[1].bit5 = "Not Defined";
9544                 pvalues[1].bit5hfname = hf_bit5rflags;
9545                 pvalues[1].bit6 = "Not Defined";
9546                 pvalues[1].bit6hfname = hf_bit6rflags;
9547                 pvalues[1].bit7 = "Not Defined";
9548                 pvalues[1].bit7hfname = hf_bit7rflags;
9549                 pvalues[1].bit8 = "Not Defined";
9550                 pvalues[1].bit8hfname = hf_bit8rflags;
9551                 pvalues[1].bit9 = "Not Defined";
9552                 pvalues[1].bit9hfname = hf_bit9rflags;
9553                 pvalues[1].bit10 = "Not Defined";
9554                 pvalues[1].bit10hfname = hf_bit10rflags;
9555                 pvalues[1].bit11 = "Not Defined";
9556                 pvalues[1].bit11hfname = hf_bit11rflags;
9557                 pvalues[1].bit12 = "Not Defined";
9558                 pvalues[1].bit12hfname = hf_bit12rflags;
9559                 pvalues[1].bit13 = "Not Defined";
9560                 pvalues[1].bit13hfname = hf_bit13rflags;
9561                 pvalues[1].bit14 = "Not Defined";
9562                 pvalues[1].bit14hfname = hf_bit14rflags;
9563                 pvalues[1].bit15 = "Not Defined";
9564                 pvalues[1].bit15hfname = hf_bit15rflags;
9565                 pvalues[1].bit16 = "Not Defined";
9566                 pvalues[1].bit16hfname = hf_bit16rflags;
9567                 if((pvalues[1].vvalue&&0xf000) == 0xc000)
9568                 {
9569                     pvalues[2].vtype = VTYPE_STRING;
9570                     pvalues[2].vdesc = "Name Type: %s";
9571                     pvalues[2].vstring = "Partial";
9572                     pvalues[2].mvtype = 0;
9573                     pvalues[2].vvalue = 0;
9574                     pvalues[2].vlength = 0;
9575                     pvalues[2].voffset = 0;
9576                     pvalues[2].hfname= hf_nds_name_type;
9577                 }
9578                 else
9579                 {
9580                     pvalues[2].vtype = VTYPE_STRING;
9581                     pvalues[2].vdesc = "Name Type: %s";
9582                     pvalues[2].vstring = "Full";
9583                     pvalues[2].vvalue = 0;
9584                     pvalues[2].mvtype = 0;
9585                     pvalues[2].vlength = 0;
9586                     pvalues[2].voffset = 0;
9587                     pvalues[2].hfname= hf_nds_name_type;
9588                 }
9589                 foffset = foffset+4;
9590                 pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
9591                 pvalues[3].vtype = VTYPE_UINT32;
9592                 pvalues[3].vdesc = "Entry ID: 0x%08x";
9593                 pvalues[3].vlength = 4;
9594                 pvalues[3].voffset = foffset;
9595                 resolve_eid = TRUE;
9596                 global_eid = pvalues[3].vvalue;
9597                 pvalues[3].hfname = hf_nds_eid;
9598                 foffset = foffset+pvalues[3].vlength;
9599                 break;
9600             case 2:
9601                 pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
9602                 pvalues[1].vtype = VTYPE_BITFIELD;
9603                 pvalues[1].vdesc = "Request Flags:";
9604                 pvalues[1].vlength = 2;
9605                 pvalues[1].hfname= hf_nds_rflags;
9606                 pvalues[1].voffset = foffset;
9607                 pvalues[1].bit1 = "Typeless";
9608                 pvalues[1].bit1hfname = hf_bit1rflags;
9609                 pvalues[1].bit2 = "Slashed";
9610                 pvalues[1].bit2hfname = hf_bit2rflags;
9611                 pvalues[1].bit3 = "Dotted";
9612                 pvalues[1].bit3hfname = hf_bit3rflags;
9613                 pvalues[1].bit4 = "Tuned";
9614                 pvalues[1].bit4hfname = hf_bit4rflags;
9615                 pvalues[1].bit5 = "Not Defined";
9616                 pvalues[1].bit5hfname = hf_bit5rflags;
9617                 pvalues[1].bit6 = "Not Defined";
9618                 pvalues[1].bit6hfname = hf_bit6rflags;
9619                 pvalues[1].bit7 = "Not Defined";
9620                 pvalues[1].bit7hfname = hf_bit7rflags;
9621                 pvalues[1].bit8 = "Not Defined";
9622                 pvalues[1].bit8hfname = hf_bit8rflags;
9623                 pvalues[1].bit9 = "Not Defined";
9624                 pvalues[1].bit9hfname = hf_bit9rflags;
9625                 pvalues[1].bit10 = "Not Defined";
9626                 pvalues[1].bit10hfname = hf_bit10rflags;
9627                 pvalues[1].bit11 = "Not Defined";
9628                 pvalues[1].bit11hfname = hf_bit11rflags;
9629                 pvalues[1].bit12 = "Not Defined";
9630                 pvalues[1].bit12hfname = hf_bit12rflags;
9631                 pvalues[1].bit13 = "Not Defined";
9632                 pvalues[1].bit13hfname = hf_bit13rflags;
9633                 pvalues[1].bit14 = "Not Defined";
9634                 pvalues[1].bit14hfname = hf_bit14rflags;
9635                 pvalues[1].bit15 = "Not Defined";
9636                 pvalues[1].bit15hfname = hf_bit15rflags;
9637                 pvalues[1].bit16 = "Not Defined";
9638                 pvalues[1].bit16hfname = hf_bit16rflags;
9639                 if((pvalues[1].vvalue&&0xf000) == 0xc000)
9640                 {
9641                     pvalues[2].vtype = VTYPE_STRING;
9642                     pvalues[2].vdesc = "Name Type: %s";
9643                     pvalues[2].vstring = "Return Partion Name";
9644                     pvalues[2].vvalue = 0;
9645                     pvalues[2].vlength = 4;
9646                     pvalues[2].voffset = pvalues[1].voffset;
9647                     pvalues[2].mvtype = 0;
9648                     pvalues[2].hfname= hf_nds_name_type;
9649                 }
9650                 else
9651                 {
9652                     pvalues[2].vtype = VTYPE_STRING;
9653                     pvalues[2].vdesc = "Name Type: %s";
9654                     pvalues[2].vstring = "Return Full Name";
9655                     pvalues[2].vvalue = 0;
9656                     pvalues[2].vlength = 4;
9657                     pvalues[2].mvtype = 0;
9658                     pvalues[2].voffset = pvalues[1].voffset;
9659                     pvalues[2].hfname= hf_nds_name_type;
9660                 }
9661                 foffset = foffset+4;
9662                 pvalues[3].vvalue = tvb_get_letohs(tvb, foffset);
9663                 global_flags = tvb_get_letohl(tvb, foffset);
9664                 pvalues[3].vtype = VTYPE_BITFIELD;
9665                 pvalues[3].vdesc = "Information Flags (low) Byte:";
9666                 pvalues[3].vlength = 2;
9667                 pvalues[3].hfname= hf_nds_rflags;
9668                 pvalues[3].voffset = foffset;
9669                 pvalues[3].bit1 = "Output Flags";
9670                 pvalues[3].bit1hfname = hf_bit1infoflagsl;
9671                 pvalues[3].bit2 = "Entry ID";
9672                 pvalues[3].bit2hfname = hf_bit2infoflagsl;
9673                 pvalues[3].bit3 = "Entry Flags";
9674                 pvalues[3].bit3hfname = hf_bit3infoflagsl;
9675                 pvalues[3].bit4 = "Subordinate Count";
9676                 pvalues[3].bit4hfname = hf_bit4infoflagsl;
9677                 pvalues[3].bit5 = "Modification Time";
9678                 pvalues[3].bit5hfname = hf_bit5infoflagsl;
9679                 pvalues[3].bit6 = "Modification Timestamp";
9680                 pvalues[3].bit6hfname = hf_bit6infoflagsl;
9681                 pvalues[3].bit7 = "Creation Timestamp";
9682                 pvalues[3].bit7hfname = hf_bit7infoflagsl;
9683                 pvalues[3].bit8 = "Partition Root ID";
9684                 pvalues[3].bit8hfname = hf_bit8infoflagsl;
9685                 pvalues[3].bit9 = "Parent ID";
9686                 pvalues[3].bit9hfname = hf_bit9infoflagsl;
9687                 pvalues[3].bit10 = "Revision Count";
9688                 pvalues[3].bit10hfname = hf_bit10infoflagsl;
9689                 pvalues[3].bit11 = "Replica Type";
9690                 pvalues[3].bit11hfname = hf_bit11infoflagsl;
9691                 pvalues[3].bit12 = "Base Class";
9692                 pvalues[3].bit12hfname = hf_bit12infoflagsl;
9693                 pvalues[3].bit13 = "Relative Distinguished Name";
9694                 pvalues[3].bit13hfname = hf_bit13infoflagsl;
9695                 pvalues[3].bit14 = "Distinguished Name";
9696                 pvalues[3].bit14hfname = hf_bit14infoflagsl;
9697                 pvalues[3].bit15 = "Root Distinguished Name";
9698                 pvalues[3].bit15hfname = hf_bit15infoflagsl;
9699                 pvalues[3].bit16 = "Parent Distinguished Name";
9700                 pvalues[3].bit16hfname = hf_bit16infoflagsl;
9701                 foffset = foffset+2;
9702                 pvalues[4].vvalue = tvb_get_letohs(tvb, foffset);
9703                 pvalues[4].vtype = VTYPE_BITFIELD;
9704                 pvalues[4].vdesc = "Information Flags (high) Byte:";
9705                 pvalues[4].vlength = 2;
9706                 pvalues[4].hfname= hf_nds_rflags;
9707                 pvalues[4].voffset = foffset;
9708                 pvalues[4].bit1 = "Purge Time";
9709                 pvalues[4].bit1hfname = hf_bit1infoflagsh;
9710                 pvalues[4].bit2 = "Dereference Base Class";
9711                 pvalues[4].bit2hfname = hf_bit2infoflagsh;
9712                 pvalues[4].bit3 = "Replica Number";
9713                 pvalues[4].bit3hfname = hf_bit3infoflagsh;
9714                 pvalues[4].bit4 = "Replica State";
9715                 pvalues[4].bit4hfname = hf_bit4infoflagsh;
9716                 pvalues[4].bit5 = "Federation Boundary";
9717                 pvalues[4].bit5hfname = hf_bit5infoflagsh;
9718                 pvalues[4].bit6 = "Schema Boundary";
9719                 pvalues[4].bit6hfname = hf_bit6infoflagsh;
9720                 pvalues[4].bit7 = "Federation Boundary ID";
9721                 pvalues[4].bit7hfname = hf_bit7infoflagsh;
9722                 pvalues[4].bit8 = "Schema Boundary ID";
9723                 pvalues[4].bit8hfname = hf_bit8infoflagsh;
9724                 pvalues[4].bit9 = "Current Subcount";
9725                 pvalues[4].bit9hfname = hf_bit9infoflagsh;
9726                 pvalues[4].bit10 = "Local Entry Flags";
9727                 pvalues[4].bit10hfname = hf_bit10infoflagsh;
9728                 pvalues[4].bit11 = "Not Defined";
9729                 pvalues[4].bit11hfname = hf_bit11infoflagsh;
9730                 pvalues[4].bit12 = "Not Defined";
9731                 pvalues[4].bit12hfname = hf_bit12infoflagsh;
9732                 pvalues[4].bit13 = "Not Defined";
9733                 pvalues[4].bit13hfname = hf_bit13infoflagsh;
9734                 pvalues[4].bit14 = "Not Defined";
9735                 pvalues[4].bit14hfname = hf_bit14infoflagsh;
9736                 pvalues[4].bit15 = "Not Defined";
9737                 pvalues[4].bit15hfname = hf_bit15infoflagsh;
9738                 pvalues[4].bit16 = "Not Defined";
9739                 pvalues[4].bit16hfname = hf_bit16infoflagsh;
9740                 foffset = foffset+2;
9741                 pvalues[5].vvalue = tvb_get_letohl(tvb, foffset);
9742                 pvalues[5].vtype = VTYPE_UINT32;
9743                 pvalues[5].vdesc = "Entry ID: 0x%08x";
9744                 pvalues[5].vlength = 4;
9745                 pvalues[5].voffset = foffset;
9746                 resolve_eid = TRUE;
9747                 global_eid = pvalues[5].vvalue;
9748                 pvalues[5].hfname = hf_nds_eid;
9749                 foffset = foffset+pvalues[5].vlength;
9750                 break;
9751             default:
9752                 break;
9753             }
9754
9755             break;
9756         case 0x03:
9757             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
9758             pvalues[0].vtype = VTYPE_UINT32;
9759             pvalues[0].vdesc = "Version: %u";
9760             pvalues[0].vlength = 4;
9761             pvalues[0].voffset = foffset;
9762             pvalues[0].hfname= hf_nds_ver;
9763             foffset = foffset+pvalues[0].vlength;
9764             if(pvalues[0].vvalue == 0)
9765             {
9766                 pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
9767                 pvalues[1].vtype = VTYPE_UINT32;
9768                 pvalues[1].vdesc = "Iteration Handle: 0x%08x";
9769                 pvalues[1].vlength = 4;
9770                 pvalues[1].voffset = foffset;
9771                 pvalues[1].hfname= hf_nds_iteration;
9772                 foffset = foffset+pvalues[1].vlength;
9773                 pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
9774                 pvalues[2].vtype = VTYPE_UINT32;
9775                 pvalues[2].vdesc = "Entry ID: 0x%08x";
9776                 pvalues[2].vlength = 4;
9777                 resolve_eid = TRUE;
9778                 global_eid = pvalues[2].vvalue;
9779                 pvalues[2].voffset = foffset;
9780                 pvalues[2].hfname= hf_nds_eid;
9781                 foffset = foffset+pvalues[2].vlength;
9782                 pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
9783                 pvalues[3].vstring = match_strval(pvalues[3].vvalue, nds_info_type);
9784                 global_flags = pvalues[3].vvalue;
9785                 if(pvalues[3].vstring == NULL)
9786                 {
9787                     pvalues[3].vstring = "No Info Type Set";
9788                 }
9789                 pvalues[3].vtype = VTYPE_STRING;
9790                 pvalues[3].vdesc = "Info Type: %s";
9791                 pvalues[3].vlength = 4;
9792                 pvalues[3].voffset = foffset;
9793                 pvalues[3].mvtype = MVTYPE_ATTR_REQUEST;
9794                 pvalues[3].hfname= hf_nds_info_type;
9795                 foffset = foffset + pvalues[3].vlength;
9796                 pvalues[4].vvalue = tvb_get_letohl(tvb, foffset);
9797                 pvalues[4].vtype = VTYPE_UINT32;
9798                 pvalues[4].vdesc = "All Attributes: %u";
9799                 pvalues[4].vlength = 4;
9800                 pvalues[4].voffset = foffset;
9801                 pvalues[4].hfname= hf_nds_all_attr;
9802                 foffset = foffset+pvalues[4].vlength;
9803                 pvalues[5].vvalue = tvb_get_letohl(tvb, foffset);
9804                 pvalues[5].vtype = VTYPE_MULTIVALUE_UINT32;
9805                 pvalues[5].vdesc = "Attributes: %u";
9806                 pvalues[5].vlength = 4;
9807                 pvalues[5].voffset = foffset;
9808                 pvalues[5].mvtype = MVTYPE_ATTR_REQUEST;
9809                 pvalues[5].hfname= hf_nds_attr;
9810             }
9811             else
9812             {
9813                 pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
9814                 pvalues[1].vtype = VTYPE_UINT32;
9815                 pvalues[1].vdesc = "Request Flags: 0x%08x";
9816                 pvalues[1].vlength = 4;
9817                 pvalues[1].voffset = foffset;
9818                 pvalues[1].hfname= hf_nds_req_flags;
9819                 foffset = foffset+pvalues[1].vlength;
9820                 pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
9821                 pvalues[2].vtype = VTYPE_UINT32;
9822                 pvalues[2].vdesc = "Iteration Handle: 0x%08x";
9823                 pvalues[2].vlength = 4;
9824                 pvalues[2].voffset = foffset;
9825                 pvalues[2].hfname= hf_nds_iteration;
9826                 foffset = foffset+pvalues[2].vlength;
9827                 pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
9828                 pvalues[3].vtype = VTYPE_UINT32;
9829                 pvalues[3].vdesc = "Entry ID: 0x%08x";
9830                 pvalues[3].vlength = 4;
9831                 resolve_eid = TRUE;
9832                 global_eid = pvalues[3].vvalue;
9833                 pvalues[3].voffset = foffset;
9834                 pvalues[3].hfname= hf_nds_eid;
9835                 foffset = foffset+pvalues[3].vlength;
9836                 pvalues[4].vvalue = tvb_get_letohl(tvb, foffset);
9837                 pvalues[4].vstring = match_strval(pvalues[4].vvalue, nds_info_type);
9838                 global_flags = pvalues[4].vvalue;
9839                 if(pvalues[4].vstring == NULL)
9840                 {
9841                     pvalues[4].vstring = "No Info Type Set";
9842                 }
9843                 pvalues[4].vtype = VTYPE_STRING;
9844                 pvalues[4].vdesc = "Info Type: %s";
9845                 pvalues[4].vlength = 4;
9846                 pvalues[4].voffset = foffset;
9847                 pvalues[4].hfname= hf_nds_info_type;
9848                 pvalues[4].mvtype = MVTYPE_ATTR_REQUEST;
9849                 foffset = foffset+pvalues[4].vlength;
9850                 pvalues[5].vvalue = tvb_get_letohl(tvb, foffset);
9851                 pvalues[5].vtype = VTYPE_UINT32;
9852                 pvalues[5].vdesc = "All Attributes: %u";
9853                 pvalues[5].vlength = 4;
9854                 pvalues[5].voffset = foffset;
9855                 pvalues[5].hfname= hf_nds_all_attr;
9856                 foffset = foffset+pvalues[5].vlength;
9857                 pvalues[6].vvalue = tvb_get_letohl(tvb, foffset);
9858                 pvalues[6].vtype = VTYPE_MULTIVALUE_UINT32;
9859                 pvalues[6].vdesc = "Attributes: %u";
9860                 pvalues[6].vlength = 4;
9861                 pvalues[6].voffset = foffset;
9862                 pvalues[6].mvtype = MVTYPE_ATTR_REQUEST;
9863                 pvalues[6].hfname= hf_nds_attr;
9864             }
9865             break;
9866         case 0x04:
9867             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
9868             pvalues[0].vtype = VTYPE_UINT32;
9869             pvalues[0].vdesc = "Version: %u";
9870             pvalues[0].vlength = 4;
9871             pvalues[0].voffset = foffset;
9872             pvalues[0].hfname= hf_nds_ver;
9873             foffset = foffset+pvalues[0].vlength;
9874             if (pvalues[0].vvalue == 1) {
9875                 /* Version 1 specifies for this offset value to always be a value of 1*/
9876                 /* No need to display to user */
9877                 foffset += 4;
9878             }
9879             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
9880             pvalues[1].vtype = VTYPE_UINT32;
9881             pvalues[1].vdesc = "Entry ID: 0x%08x";
9882             pvalues[1].vlength = 4;
9883             resolve_eid = TRUE;
9884             global_eid = pvalues[1].vvalue;
9885             pvalues[1].voffset = foffset;
9886             pvalues[1].hfname = hf_nds_eid;
9887             foffset = foffset+pvalues[1].vlength;
9888             foffset += 4;       /* Attribute Count = 1 */
9889             pvalues[2].vtype = VTYPE_STRING;
9890             pvalues[2].vdesc = "Attribute Name Being Compared: %s";
9891             pvalues[2].mvtype = MVTYPE_ATTR_REQUEST;
9892             pvalues[2].vvalue = 0;
9893             pvalues[2].vlength = 256;
9894             pvalues[2].vlength = tvb_get_letohl(tvb, foffset);
9895             if (pvalues[2].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[2].vlength))
9896             {
9897                 pvalues[2].vtype = VTYPE_NONE;
9898                 break;
9899             }
9900             pvalues[2].voffset = foffset+4;
9901             foffset = foffset + 4;
9902             pvalues[2].vstring = get_string(tvb, pvalues[2].voffset, pvalues[2].vlength);
9903             g_strlcpy(global_object_name, pvalues[2].vstring, 256);
9904             pvalues[2].hfname= hf_nds_name;
9905             foffset = foffset+pvalues[2].vlength;
9906             foffset += align_4(tvb, foffset);
9907             foffset += 4;       /* Attribute Value Count = 1 */
9908             pvalues[3].vtype = VTYPE_STRING;
9909             pvalues[3].vdesc = "Attribute Value: %s";
9910             pvalues[3].mvtype = MVTYPE_ATTR_REQUEST;
9911             pvalues[3].vvalue = 0;
9912             pvalues[3].vlength = 256;
9913             pvalues[3].vlength = tvb_get_letohl(tvb, foffset);
9914             pvalues[3].voffset = foffset+4;
9915             foffset = foffset + 4;
9916             pvalues[3].vstring = get_string(tvb, pvalues[3].voffset, pvalues[3].vlength);
9917             pvalues[3].hfname= hf_value_string;
9918             foffset = foffset+pvalues[3].vlength;
9919             break;
9920         case 0x05:
9921             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
9922             pvalues[0].vtype = VTYPE_UINT32;
9923             pvalues[0].vdesc = "Version: %u";
9924             pvalues[0].vlength = 4;
9925             pvalues[0].voffset = foffset;
9926             pvalues[0].hfname= hf_nds_ver;
9927             foffset = foffset+pvalues[0].vlength;
9928             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
9929             pvalues[1].vtype = VTYPE_BITFIELD;
9930             pvalues[1].vdesc = "Request Flags:";
9931             pvalues[1].vlength = 2;
9932             pvalues[1].hfname= hf_nds_rflags;
9933             pvalues[1].voffset = foffset;
9934             pvalues[1].bit1 = "List Typeless";
9935             pvalues[1].bit1hfname = hf_bit1lflags;
9936             pvalues[1].bit2 = "List Containers";
9937             pvalues[1].bit2hfname = hf_bit2lflags;
9938             pvalues[1].bit3 = "List Slashed";
9939             pvalues[1].bit3hfname = hf_bit3lflags;
9940             pvalues[1].bit4 = "List Dotted";
9941             pvalues[1].bit4hfname = hf_bit4lflags;
9942             pvalues[1].bit5 = "Dereference Alias";
9943             pvalues[1].bit5hfname = hf_bit5lflags;
9944             pvalues[1].bit6 = "List All Containers";
9945             pvalues[1].bit6hfname = hf_bit6lflags;
9946             pvalues[1].bit7 = "List Obsolete";
9947             pvalues[1].bit7hfname = hf_bit7lflags;
9948             pvalues[1].bit8 = "List Tuned Output";
9949             pvalues[1].bit8hfname = hf_bit8lflags;
9950             pvalues[1].bit9 = "List External Reference";
9951             pvalues[1].bit9hfname = hf_bit9lflags;
9952             pvalues[1].bit10 = "Not Defined";
9953             pvalues[1].bit10hfname = hf_bit10lflags;
9954             pvalues[1].bit11 = "Not Defined";
9955             pvalues[1].bit11hfname = hf_bit11lflags;
9956             pvalues[1].bit12 = "Not Defined";
9957             pvalues[1].bit12hfname = hf_bit12lflags;
9958             pvalues[1].bit13 = "Not Defined";
9959             pvalues[1].bit13hfname = hf_bit13lflags;
9960             pvalues[1].bit14 = "Not Defined";
9961             pvalues[1].bit14hfname = hf_bit14lflags;
9962             pvalues[1].bit15 = "Not Defined";
9963             pvalues[1].bit15hfname = hf_bit15lflags;
9964             pvalues[1].bit16 = "Not Defined";
9965             pvalues[1].bit16hfname = hf_bit16lflags;
9966             foffset = foffset+pvalues[1].vlength;
9967             foffset += 2;
9968             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
9969             pvalues[2].vtype = VTYPE_UINT32;
9970             pvalues[2].vdesc = "Iteration Handle: 0x%08x";
9971             pvalues[2].vlength = 4;
9972             pvalues[2].voffset = foffset;
9973             pvalues[2].hfname= hf_nds_iteration;
9974             foffset = foffset+pvalues[2].vlength;
9975             pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
9976             pvalues[3].vtype = VTYPE_UINT32;
9977             pvalues[3].vdesc = "Parent ID: 0x%08x";
9978             pvalues[3].vlength = 4;
9979             pvalues[3].voffset = foffset;
9980             pvalues[3].hfname= hf_nds_parent;
9981             foffset = foffset+pvalues[3].vlength;
9982             pvalues[4].vvalue = tvb_get_letohs(tvb, foffset);
9983             global_flags = tvb_get_letohl(tvb, foffset);
9984             pvalues[4].vtype = VTYPE_BITFIELD;
9985             pvalues[4].vdesc = "Information Flags (low) Byte:";
9986             pvalues[4].vlength = 2;
9987             pvalues[4].hfname= hf_nds_rflags;
9988             pvalues[4].voffset = foffset;
9989             pvalues[4].bit1 = "Output Flags";
9990             pvalues[4].bit1hfname = hf_bit1infoflagsl;
9991             pvalues[4].bit2 = "Entry ID";
9992             pvalues[4].bit2hfname = hf_bit2infoflagsl;
9993             pvalues[4].bit3 = "Entry Flags";
9994             pvalues[4].bit3hfname = hf_bit3infoflagsl;
9995             pvalues[4].bit4 = "Subordinate Count";
9996             pvalues[4].bit4hfname = hf_bit4infoflagsl;
9997             pvalues[4].bit5 = "Modification Time";
9998             pvalues[4].bit5hfname = hf_bit5infoflagsl;
9999             pvalues[4].bit6 = "Modification Timestamp";
10000             pvalues[4].bit6hfname = hf_bit6infoflagsl;
10001             pvalues[4].bit7 = "Creation Timestamp";
10002             pvalues[4].bit7hfname = hf_bit7infoflagsl;
10003             pvalues[4].bit8 = "Partition Root ID";
10004             pvalues[4].bit8hfname = hf_bit8infoflagsl;
10005             pvalues[4].bit9 = "Parent ID";
10006             pvalues[4].bit9hfname = hf_bit9infoflagsl;
10007             pvalues[4].bit10 = "Revision Count";
10008             pvalues[4].bit10hfname = hf_bit10infoflagsl;
10009             pvalues[4].bit11 = "Replica Type";
10010             pvalues[4].bit11hfname = hf_bit11infoflagsl;
10011             pvalues[4].bit12 = "Base Class";
10012             pvalues[4].bit12hfname = hf_bit12infoflagsl;
10013             pvalues[4].bit13 = "Relative Distinguished Name";
10014             pvalues[4].bit13hfname = hf_bit13infoflagsl;
10015             pvalues[4].bit14 = "Distinguished Name";
10016             pvalues[4].bit14hfname = hf_bit14infoflagsl;
10017             pvalues[4].bit15 = "Root Distinguished Name";
10018             pvalues[4].bit15hfname = hf_bit15infoflagsl;
10019             pvalues[4].bit16 = "Parent Distinguished Name";
10020             pvalues[4].bit16hfname = hf_bit16infoflagsl;
10021             foffset = foffset+2;
10022             pvalues[5].vvalue = tvb_get_letohs(tvb, foffset);
10023             pvalues[5].vtype = VTYPE_BITFIELD;
10024             pvalues[5].vdesc = "Information Flags (high) Byte:";
10025             pvalues[5].vlength = 2;
10026             pvalues[5].hfname= hf_nds_rflags;
10027             pvalues[5].voffset = foffset;
10028             pvalues[5].bit1 = "Purge Time";
10029             pvalues[5].bit1hfname = hf_bit1infoflagsh;
10030             pvalues[5].bit2 = "Dereference Base Class";
10031             pvalues[5].bit2hfname = hf_bit2infoflagsh;
10032             pvalues[5].bit3 = "Not Defined";
10033             pvalues[5].bit3hfname = hf_bit3infoflagsh;
10034             pvalues[5].bit4 = "Not Defined";
10035             pvalues[5].bit4hfname = hf_bit4infoflagsh;
10036             pvalues[5].bit5 = "Not Defined";
10037             pvalues[5].bit5hfname = hf_bit5infoflagsh;
10038             pvalues[5].bit6 = "Not Defined";
10039             pvalues[5].bit6hfname = hf_bit6infoflagsh;
10040             pvalues[5].bit7 = "Not Defined";
10041             pvalues[5].bit7hfname = hf_bit7infoflagsh;
10042             pvalues[5].bit8 = "Not Defined";
10043             pvalues[5].bit8hfname = hf_bit8infoflagsh;
10044             pvalues[5].bit9 = "Not Defined";
10045             pvalues[5].bit9hfname = hf_bit9infoflagsh;
10046             pvalues[5].bit10 = "Not Defined";
10047             pvalues[5].bit10hfname = hf_bit10infoflagsh;
10048             pvalues[5].bit11 = "Not Defined";
10049             pvalues[5].bit11hfname = hf_bit11infoflagsh;
10050             pvalues[5].bit12 = "Not Defined";
10051             pvalues[5].bit12hfname = hf_bit12infoflagsh;
10052             pvalues[5].bit13 = "Not Defined";
10053             pvalues[5].bit13hfname = hf_bit13infoflagsh;
10054             pvalues[5].bit14 = "Not Defined";
10055             pvalues[5].bit14hfname = hf_bit14infoflagsh;
10056             pvalues[5].bit15 = "Not Defined";
10057             pvalues[5].bit15hfname = hf_bit15infoflagsh;
10058             pvalues[5].bit16 = "Not Defined";
10059             pvalues[5].bit16hfname = hf_bit16infoflagsh;
10060             foffset = foffset+2;
10061             pvalues[6].vtype = VTYPE_STRING;
10062             pvalues[6].vdesc = "Name Filter: %s";
10063             pvalues[6].mvtype = MVTYPE_ATTR_REQUEST;
10064             pvalues[6].vvalue = 0;
10065             pvalues[6].vlength = 256;
10066             pvalues[6].vlength = tvb_get_letohl(tvb, foffset);
10067             pvalues[6].voffset = foffset+4;
10068             foffset = foffset + 4;
10069             pvalues[6].vstring = get_string(tvb, pvalues[6].voffset, pvalues[6].vlength);
10070             pvalues[6].hfname= hf_nds_name_filter;
10071             foffset = foffset+pvalues[6].vlength;
10072             if(pvalues[0].vvalue == 0)
10073             {
10074                 break;
10075             }
10076             foffset += align_4(tvb, foffset);
10077             pvalues[7].vtype = VTYPE_STRING;
10078             pvalues[7].vdesc = "Class Filter: %s";
10079             pvalues[7].mvtype = MVTYPE_ATTR_REQUEST;
10080             pvalues[7].vvalue = 0;
10081             pvalues[7].vlength = 256;
10082             pvalues[7].vlength = tvb_get_letohl(tvb, foffset);
10083             pvalues[7].voffset = foffset+4;
10084             foffset = foffset + 4;
10085             pvalues[7].vstring = get_string(tvb, pvalues[7].voffset, pvalues[7].vlength);
10086             pvalues[7].hfname= hf_nds_class_filter;
10087             foffset = foffset+pvalues[7].vlength;
10088             if(pvalues[0].vvalue == 1)
10089             {
10090                 break;
10091             }
10092             foffset += align_4(tvb, foffset);
10093             pvalues[8].vvalue = tvb_get_letohl(tvb, foffset);
10094             pvalues[8].vtype = VTYPE_MULTIVALUE_UINT32;
10095             pvalues[8].vdesc = "Seconds: %u";
10096             pvalues[8].vlength = 4;
10097             pvalues[8].mvtype = MVTYPE_PRINT_TIMESTAMP;
10098             pvalues[8].hfname= hf_nds_time_filter;
10099             pvalues[8].voffset = foffset;
10100             break;
10101         case 0x06:
10102             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
10103             pvalues[0].vstring = "";
10104             pvalues[0].vtype = VTYPE_UINT32;
10105             pvalues[0].vdesc = "Version: %u";
10106             pvalues[0].vlength = 4;
10107             pvalues[0].voffset = foffset;
10108             pvalues[0].hfname= hf_nds_ver;
10109             foffset = foffset+pvalues[0].vlength;
10110             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
10111             pvalues[1].vtype = VTYPE_UINT32;
10112             pvalues[1].vstring = "";
10113             pvalues[1].vdesc = "Request Flags: 0x%08x";
10114             pvalues[1].vlength = 4;
10115             pvalues[1].hfname= hf_nds_rflags;
10116             pvalues[1].voffset = foffset;
10117             foffset = foffset+4;
10118             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
10119             pvalues[2].vtype = VTYPE_UINT32;
10120             pvalues[2].vdesc = "Iteration Handle: 0x%08x";
10121             pvalues[2].vlength = 4;
10122             pvalues[2].voffset = foffset;
10123             pvalues[2].hfname= hf_nds_iteration;
10124             foffset = foffset+pvalues[2].vlength;
10125             pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
10126             pvalues[3].vstring = "";
10127             pvalues[3].vtype = VTYPE_UINT32;
10128             pvalues[3].vdesc = "Base Entry ID: 0x%08x";
10129             pvalues[3].vlength = 4;
10130             resolve_eid = FALSE;
10131             global_eid = pvalues[3].vvalue;
10132             pvalues[3].voffset = foffset;
10133             pvalues[3].hfname= hf_nds_eid;
10134             foffset = foffset+pvalues[3].vlength;
10135             pvalues[4].vvalue = tvb_get_letohl(tvb, foffset);
10136             pvalues[4].vstring = match_strval(pvalues[4].vvalue, nds_search_scope);
10137             if(pvalues[4].vstring == NULL)
10138             {
10139                 pvalues[4].vstring = "No Search Scope Defined";
10140             }
10141             pvalues[4].vtype = VTYPE_STRING;
10142             pvalues[4].vdesc = "Replica Type: %s";
10143             pvalues[4].vlength = 4;
10144             pvalues[4].voffset = foffset;
10145             pvalues[4].mvtype = 0;
10146             pvalues[4].hfname= hf_nds_search_scope;
10147             foffset = foffset + pvalues[4].vlength;
10148             pvalues[5].vvalue = tvb_get_letohl(tvb, foffset);
10149             pvalues[5].vtype = VTYPE_UINT32;
10150             pvalues[5].vdesc = "Number of Objects to Search: 0x%08x";
10151             pvalues[5].vlength = 4;
10152             pvalues[5].voffset = foffset;
10153             pvalues[5].hfname= hf_nds_num_objects;
10154             foffset = foffset+pvalues[5].vlength;
10155             pvalues[6].vvalue = tvb_get_letohl(tvb, foffset);
10156             pvalues[6].vtype = VTYPE_BITFIELD;
10157             pvalues[6].vdesc = "Information Types:";
10158             pvalues[6].vlength = 2;
10159             pvalues[6].hfname= hf_nds_nflags;
10160             pvalues[6].voffset = foffset;
10161             pvalues[6].bit1 = "Names";
10162             pvalues[6].bit1hfname = hf_bit1siflags;
10163             pvalues[6].bit2 = "Names and Values";
10164             pvalues[6].bit2hfname = hf_bit2siflags;
10165             pvalues[6].bit3 = "Effective Privileges";
10166             pvalues[6].bit3hfname = hf_bit3siflags;
10167             pvalues[6].bit4 = "Value Info";
10168             pvalues[6].bit4hfname = hf_bit4siflags;
10169             pvalues[6].bit5 = "Abbreviated Value";
10170             pvalues[6].bit5hfname = hf_bit5siflags;
10171             pvalues[6].bit6 = "Not Defined";
10172             pvalues[6].bit6hfname = hf_bit6siflags;
10173             pvalues[6].bit7 = "Not Defined";
10174             pvalues[6].bit7hfname = hf_bit7siflags;
10175             pvalues[6].bit8 = "Not Defined";
10176             pvalues[6].bit8hfname = hf_bit8siflags;
10177             pvalues[6].bit9 = "Expanded Class";
10178             pvalues[6].bit9hfname = hf_bit9siflags;
10179             pvalues[6].bit10 = "Not Defined";
10180             pvalues[6].bit10hfname = hf_bit10siflags;
10181             pvalues[6].bit11= "Not Defined";
10182             pvalues[6].bit11hfname = hf_bit11siflags;
10183             pvalues[6].bit12 = "Not Defined";
10184             pvalues[6].bit12hfname = hf_bit12siflags;
10185             pvalues[6].bit13 = "Not Defined";
10186             pvalues[6].bit13hfname = hf_bit13siflags;
10187             pvalues[6].bit14 = "Not Defined";
10188             pvalues[6].bit14hfname = hf_bit14siflags;
10189             pvalues[6].bit15 = "Not Defined";
10190             pvalues[6].bit15hfname = hf_bit15siflags;
10191             pvalues[6].bit16 = "Not Defined";
10192             pvalues[6].bit16hfname = hf_bit16siflags;
10193             foffset = foffset+4;
10194             if(pvalues[0].vvalue != 2)
10195             {
10196                 pvalues[7].vvalue = tvb_get_letohs(tvb, foffset);
10197                 global_flags = tvb_get_letohl(tvb, foffset);
10198                 pvalues[7].vtype = VTYPE_BITFIELD;
10199                 pvalues[7].vdesc = "Information Flags (low) Byte:";
10200                 pvalues[7].vlength = 2;
10201                 pvalues[7].hfname= hf_nds_rflags;
10202                 pvalues[7].voffset = foffset;
10203                 pvalues[7].bit1 = "Output Flags";
10204                 pvalues[7].bit1hfname = hf_bit1infoflagsl;
10205                 pvalues[7].bit2 = "Entry ID";
10206                 pvalues[7].bit2hfname = hf_bit2infoflagsl;
10207                 pvalues[7].bit3 = "Entry Flags";
10208                 pvalues[7].bit3hfname = hf_bit3infoflagsl;
10209                 pvalues[7].bit4 = "Subordinate Count";
10210                 pvalues[7].bit4hfname = hf_bit4infoflagsl;
10211                 pvalues[7].bit5 = "Modification Time";
10212                 pvalues[7].bit5hfname = hf_bit5infoflagsl;
10213                 pvalues[7].bit6 = "Modification Timestamp";
10214                 pvalues[7].bit6hfname = hf_bit6infoflagsl;
10215                 pvalues[7].bit7 = "Creation Timestamp";
10216                 pvalues[7].bit7hfname = hf_bit7infoflagsl;
10217                 pvalues[7].bit8 = "Partition Root ID";
10218                 pvalues[7].bit8hfname = hf_bit8infoflagsl;
10219                 pvalues[7].bit9 = "Parent ID";
10220                 pvalues[7].bit9hfname = hf_bit9infoflagsl;
10221                 pvalues[7].bit10 = "Revision Count";
10222                 pvalues[7].bit10hfname = hf_bit10infoflagsl;
10223                 pvalues[7].bit11 = "Replica Type";
10224                 pvalues[7].bit11hfname = hf_bit11infoflagsl;
10225                 pvalues[7].bit12 = "Base Class";
10226                 pvalues[7].bit12hfname = hf_bit12infoflagsl;
10227                 pvalues[7].bit13 = "Relative Distinguished Name";
10228                 pvalues[7].bit13hfname = hf_bit13infoflagsl;
10229                 pvalues[7].bit14 = "Distinguished Name";
10230                 pvalues[7].bit14hfname = hf_bit14infoflagsl;
10231                 pvalues[7].bit15 = "Root Distinguished Name";
10232                 pvalues[7].bit15hfname = hf_bit15infoflagsl;
10233                 pvalues[7].bit16 = "Parent Distinguished Name";
10234                 pvalues[7].bit16hfname = hf_bit16infoflagsl;
10235                 foffset = foffset+2;
10236                 pvalues[8].vvalue = tvb_get_letohs(tvb, foffset);
10237                 pvalues[8].vtype = VTYPE_BITFIELD;
10238                 pvalues[8].vdesc = "Information Flags (high) Byte:";
10239                 pvalues[8].vlength = 2;
10240                 pvalues[8].hfname= hf_nds_rflags;
10241                 pvalues[8].voffset = foffset;
10242                 pvalues[8].bit1 = "Purge Time";
10243                 pvalues[8].bit1hfname = hf_bit1infoflagsh;
10244                 pvalues[8].bit2 = "Dereference Base Class";
10245                 pvalues[8].bit2hfname = hf_bit2infoflagsh;
10246                 pvalues[8].bit3 = "Not Defined";
10247                 pvalues[8].bit3hfname = hf_bit3infoflagsh;
10248                 pvalues[8].bit4 = "Not Defined";
10249                 pvalues[8].bit4hfname = hf_bit4infoflagsh;
10250                 pvalues[8].bit5 = "Not Defined";
10251                 pvalues[8].bit5hfname = hf_bit5infoflagsh;
10252                 pvalues[8].bit6 = "Not Defined";
10253                 pvalues[8].bit6hfname = hf_bit6infoflagsh;
10254                 pvalues[8].bit7 = "Not Defined";
10255                 pvalues[8].bit7hfname = hf_bit7infoflagsh;
10256                 pvalues[8].bit8 = "Not Defined";
10257                 pvalues[8].bit8hfname = hf_bit8infoflagsh;
10258                 pvalues[8].bit9 = "Not Defined";
10259                 pvalues[8].bit9hfname = hf_bit9infoflagsh;
10260                 pvalues[8].bit10 = "Not Defined";
10261                 pvalues[8].bit10hfname = hf_bit10infoflagsh;
10262                 pvalues[8].bit11 = "Not Defined";
10263                 pvalues[8].bit11hfname = hf_bit11infoflagsh;
10264                 pvalues[8].bit12 = "Not Defined";
10265                 pvalues[8].bit12hfname = hf_bit12infoflagsh;
10266                 pvalues[8].bit13 = "Not Defined";
10267                 pvalues[8].bit13hfname = hf_bit13infoflagsh;
10268                 pvalues[8].bit14 = "Not Defined";
10269                 pvalues[8].bit14hfname = hf_bit14infoflagsh;
10270                 pvalues[8].bit15 = "Not Defined";
10271                 pvalues[8].bit15hfname = hf_bit15infoflagsh;
10272                 pvalues[8].bit16 = "Not Defined";
10273                 pvalues[8].bit16hfname = hf_bit16infoflagsh;
10274                 foffset = foffset+2;
10275             }
10276             break;
10277         case 0x07:
10278             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
10279             pvalues[0].vstring = "";
10280             pvalues[0].vtype = VTYPE_UINT32;
10281             pvalues[0].vdesc = "Version: %u";
10282             pvalues[0].vlength = 4;
10283             pvalues[0].voffset = foffset;
10284             pvalues[0].hfname= hf_nds_ver;
10285             foffset = foffset+pvalues[0].vlength;
10286             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
10287             pvalues[1].vtype = VTYPE_UINT32;
10288             pvalues[1].vstring = "";
10289             pvalues[1].vdesc = "Request Flags: 0x%08x";
10290             pvalues[1].vlength = 4;
10291             pvalues[1].hfname= hf_nds_rflags;
10292             pvalues[1].voffset = foffset;
10293             foffset = foffset+4;
10294             if(pvalues[0].vvalue == 0)
10295             {
10296                 pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
10297                 pvalues[2].vstring = "";
10298                 pvalues[2].vtype = VTYPE_UINT32;
10299                 pvalues[2].vdesc = "Parent Entry ID: 0x%08x";
10300                 pvalues[2].vlength = 4;
10301                 resolve_eid = FALSE;
10302                 global_eid = pvalues[2].vvalue;
10303                 pvalues[2].voffset = foffset;
10304                 pvalues[2].hfname= hf_nds_eid;
10305                 foffset = foffset+pvalues[2].vlength;
10306                 pvalues[3].vtype = VTYPE_STRING;
10307                 pvalues[3].vdesc = "Relative Distinguished Name: %s";
10308                 pvalues[3].vstring = "";
10309                 pvalues[3].mvtype = MVTYPE_ATTR_REQUEST;
10310                 pvalues[3].vvalue = 0;
10311                 pvalues[3].vlength = 256;
10312                 pvalues[3].vlength = tvb_get_letohl(tvb, foffset);
10313                 if (pvalues[3].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[3].vlength))
10314                 {
10315                     pvalues[3].vtype = VTYPE_NONE;
10316                     break;
10317                 }
10318                 pvalues[3].voffset = foffset+4;
10319                 foffset = foffset + 4;
10320                 pvalues[3].vstring = get_string(tvb, pvalues[3].voffset, pvalues[3].vlength);
10321                 g_strlcpy(global_object_name, pvalues[3].vstring, 256);
10322                 pvalues[3].hfname= hf_nds_relative_dn;
10323                 foffset = foffset+pvalues[3].vlength;
10324                 foffset += align_4(tvb, foffset);
10325                 pvalues[4].vvalue = tvb_get_letohl(tvb, foffset);
10326                 pvalues[4].vtype = VTYPE_MULTIVALUE_UINT32;
10327                 pvalues[4].vstring = "";
10328                 pvalues[4].vdesc = "Attributes: %u";
10329                 pvalues[4].vlength = 4;
10330                 pvalues[4].voffset = foffset;
10331                 pvalues[4].mvtype = MVTYPE_ADD_ATTR_REQUEST;
10332                 pvalues[4].hfname= hf_nds_attr;
10333             }
10334             else
10335             {
10336                 pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
10337                 pvalues[2].vstring = "";
10338                 pvalues[2].vtype = VTYPE_UINT32;
10339                 pvalues[2].vdesc = "Iteration Handle: 0x%08x";
10340                 pvalues[2].vlength = 4;
10341                 pvalues[2].voffset = foffset;
10342                 pvalues[2].hfname= hf_nds_iteration;
10343                 foffset = foffset+pvalues[2].vlength;
10344                 pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
10345                 pvalues[3].vstring = "";
10346                 pvalues[3].vtype = VTYPE_UINT32;
10347                 pvalues[3].vdesc = "Parent Entry ID: 0x%08x";
10348                 pvalues[3].vlength = 4;
10349                 resolve_eid = FALSE;
10350                 global_eid = pvalues[3].vvalue;
10351                 pvalues[3].voffset = foffset;
10352                 pvalues[3].hfname= hf_nds_eid;
10353                 foffset = foffset+pvalues[3].vlength;
10354                 pvalues[4].vtype = VTYPE_STRING;
10355                 pvalues[4].vdesc = "Relative Distinguished Name: %s";
10356                 pvalues[4].vstring = "";
10357                 pvalues[4].mvtype = MVTYPE_ATTR_REQUEST;
10358                 pvalues[4].vvalue = 0;
10359                 pvalues[4].vlength = 256;
10360                 pvalues[4].vlength = tvb_get_letohl(tvb, foffset);
10361                 if (pvalues[4].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[4].vlength))
10362                 {
10363                     pvalues[4].vtype = VTYPE_NONE;
10364                     break;
10365                 }
10366                 pvalues[4].voffset = foffset+4;
10367                 foffset = foffset + 4;
10368                 pvalues[4].vstring = get_string(tvb, pvalues[4].voffset, pvalues[4].vlength);
10369                 g_strlcpy(global_object_name, pvalues[4].vstring, 256);
10370                 pvalues[4].hfname= hf_nds_relative_dn;
10371                 foffset = foffset+pvalues[4].vlength;
10372                 foffset += align_4(tvb, foffset);
10373                 pvalues[5].vvalue = tvb_get_letohl(tvb, foffset);
10374                 pvalues[5].vtype = VTYPE_MULTIVALUE_UINT32;
10375                 pvalues[5].vstring = "";
10376                 pvalues[5].vdesc = "Attributes: %u";
10377                 pvalues[5].vlength = 4;
10378                 pvalues[5].voffset = foffset;
10379                 pvalues[5].mvtype = MVTYPE_ADD_ATTR_REQUEST;
10380                 pvalues[5].hfname= hf_nds_attr;
10381             }
10382             break;
10383         case 0x08:
10384             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
10385             pvalues[0].vtype = VTYPE_UINT32;
10386             pvalues[0].vdesc = "Version: %u";
10387             pvalues[0].vlength = 4;
10388             pvalues[0].voffset = foffset;
10389             pvalues[0].hfname= hf_nds_ver;
10390             foffset = foffset+pvalues[0].vlength;
10391             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
10392             pvalues[1].vtype = VTYPE_UINT32;
10393             pvalues[1].vdesc = "Entry ID: 0x%08x";
10394             pvalues[1].vlength = 4;
10395             resolve_eid = TRUE;
10396             global_eid = pvalues[1].vvalue;
10397             pvalues[1].voffset = foffset;
10398             pvalues[1].hfname= hf_nds_eid;
10399             foffset = foffset+pvalues[1].vlength;
10400             break;
10401         case 0x09:
10402             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
10403             pvalues[0].vtype = VTYPE_UINT32;
10404             pvalues[0].vdesc = "Version: %u";
10405             pvalues[0].vlength = 4;
10406             pvalues[0].voffset = foffset;
10407             pvalues[0].hfname= hf_nds_ver;
10408             foffset = foffset+pvalues[0].vlength;
10409             if(pvalues[0].vvalue == 0)
10410             {
10411                 pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
10412                 pvalues[1].vtype = VTYPE_UINT32;
10413                 pvalues[1].vstring = "";
10414                 pvalues[1].vdesc = "Iteration Handle: 0x%08x";  /* always 0 */
10415                 pvalues[1].vlength = 4;
10416                 pvalues[1].hfname= hf_nds_iteration;
10417                 pvalues[1].voffset = foffset;
10418                 foffset = foffset+4;
10419                 pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
10420                 pvalues[2].vstring = "";
10421                 pvalues[2].vtype = VTYPE_UINT32;
10422                 pvalues[2].vdesc = "Entry ID: 0x%08x";
10423                 pvalues[2].vlength = 4;
10424                 pvalues[2].voffset = foffset;
10425                 resolve_eid = TRUE;
10426                 global_eid = pvalues[2].vvalue;
10427                 pvalues[2].hfname = hf_nds_eid;
10428                 foffset = foffset+pvalues[2].vlength;
10429                 pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
10430                 pvalues[3].vtype = VTYPE_MULTIVALUE_UINT32;
10431                 pvalues[3].vstring = "";
10432                 pvalues[3].vdesc = "Number of Attributes to Change %u";
10433                 pvalues[3].vlength = 4;
10434                 pvalues[3].mvtype = MVTYPE_MODIFY_ATTR_REQUEST;
10435                 pvalues[3].hfname= hf_nds_number_of_changes;
10436                 pvalues[3].voffset = foffset;
10437             }
10438             else
10439             {
10440                 pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
10441                 pvalues[1].vtype = VTYPE_UINT32;
10442                 pvalues[1].vstring = "";
10443                 pvalues[1].vdesc = "Request Flags: 0x%08x";  /* always 0 */
10444                 pvalues[1].vlength = 4;
10445                 pvalues[1].hfname= hf_nds_rflags;
10446                 pvalues[1].voffset = foffset;
10447                 foffset = foffset+4;
10448                 pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
10449                 pvalues[2].vtype = VTYPE_UINT32;
10450                 pvalues[2].vstring = "";
10451                 pvalues[2].vdesc = "Iteration Handle: 0x%08x";  /* always 0 */
10452                 pvalues[2].vlength = 4;
10453                 pvalues[2].hfname= hf_nds_iteration;
10454                 pvalues[2].voffset = foffset;
10455                 foffset = foffset+4;
10456                 pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
10457                 pvalues[3].vstring = "";
10458                 pvalues[3].vtype = VTYPE_UINT32;
10459                 pvalues[3].vdesc = "Entry ID: 0x%08x";
10460                 pvalues[3].vlength = 4;
10461                 pvalues[3].voffset = foffset;
10462                 resolve_eid = TRUE;
10463                 global_eid = pvalues[3].vvalue;
10464                 pvalues[3].hfname = hf_nds_eid;
10465                 foffset = foffset+pvalues[3].vlength;
10466                 pvalues[4].vvalue = tvb_get_letohl(tvb, foffset);
10467                 pvalues[4].vtype = VTYPE_MULTIVALUE_UINT32;
10468                 pvalues[4].vstring = "";
10469                 pvalues[4].vdesc = "Number of Attributes to Change %u";
10470                 pvalues[4].vlength = 4;
10471                 pvalues[4].mvtype = MVTYPE_MODIFY_ATTR_REQUEST;
10472                 pvalues[4].hfname= hf_nds_number_of_changes;
10473                 pvalues[4].voffset = foffset;
10474             }
10475             break;
10476         case 0x0a:
10477             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
10478             pvalues[0].vtype = VTYPE_UINT32;
10479             pvalues[0].vdesc = "Version: %u";
10480             pvalues[0].vlength = 4;
10481             pvalues[0].voffset = foffset;
10482             pvalues[0].hfname= hf_nds_ver;
10483             foffset = foffset+pvalues[0].vlength;
10484             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
10485             pvalues[1].vtype = VTYPE_UINT32;
10486             pvalues[1].vdesc = "Entry ID: 0x%08x";
10487             pvalues[1].vlength = 4;
10488             resolve_eid = TRUE;
10489             global_eid = pvalues[1].vvalue;
10490             pvalues[1].voffset = foffset;
10491             pvalues[1].hfname = hf_nds_eid;
10492             foffset = foffset+pvalues[1].vlength;
10493             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
10494             pvalues[2].vtype = VTYPE_BOOLEAN;
10495             pvalues[2].vdesc = "Keep Original RDN: %s";
10496             pvalues[2].vlength = 4;
10497             pvalues[2].voffset = foffset;
10498             pvalues[2].mvtype = 0;
10499             pvalues[2].hfname= hf_nds_keep;
10500             foffset = foffset+4;
10501             foffset += align_4(tvb, foffset);
10502             pvalues[3].vtype = VTYPE_STRING;
10503             pvalues[3].vdesc = "New RDN: %s";
10504             pvalues[3].mvtype = 0;
10505             pvalues[3].vvalue = 0;
10506             pvalues[3].vlength = 256;
10507             pvalues[3].vlength = tvb_get_letohl(tvb, foffset);
10508             pvalues[3].voffset = foffset+4;
10509             foffset = foffset + 4;
10510             pvalues[3].vstring = get_string(tvb, pvalues[3].voffset, pvalues[3].vlength);
10511             pvalues[3].hfname= hf_nds_new_rdn;
10512             foffset = foffset+pvalues[3].vlength;
10513             break;
10514         case 0x0b:
10515             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
10516             pvalues[0].vtype = VTYPE_UINT32;
10517             pvalues[0].vdesc = "Version: %u";
10518             pvalues[0].vlength = 4;
10519             pvalues[0].voffset = foffset;
10520             pvalues[0].hfname= hf_nds_ver;
10521             foffset = foffset+pvalues[0].vlength;
10522             pvalues[1].vvalue = tvb_get_letohs(tvb, foffset);
10523             global_flags = tvb_get_letohl(tvb, foffset);
10524             pvalues[1].vtype = VTYPE_BITFIELD;
10525             pvalues[1].vdesc = "Attribute Constraints:";
10526             pvalues[1].vlength = 2;
10527             pvalues[1].hfname= hf_nds_acflags;
10528             pvalues[1].voffset = foffset;
10529             pvalues[1].bit1 = "Single Valued";
10530             pvalues[1].bit1hfname = hf_bit1acflags;
10531             pvalues[1].bit2 = "Sized";
10532             pvalues[1].bit2hfname = hf_bit2acflags;
10533             pvalues[1].bit3 = "Non-Removable";
10534             pvalues[1].bit3hfname = hf_bit3acflags;
10535             pvalues[1].bit4 = "Read Only";
10536             pvalues[1].bit4hfname = hf_bit4acflags;
10537             pvalues[1].bit5 = "Hidden";
10538             pvalues[1].bit5hfname = hf_bit5acflags;
10539             pvalues[1].bit6 = "String";
10540             pvalues[1].bit6hfname = hf_bit6acflags;
10541             pvalues[1].bit7 = "Synchronize Immediate";
10542             pvalues[1].bit7hfname = hf_bit7acflags;
10543             pvalues[1].bit8 = "Public Read";
10544             pvalues[1].bit8hfname = hf_bit8acflags;
10545             pvalues[1].bit9 = "Server Read";
10546             pvalues[1].bit9hfname = hf_bit9acflags;
10547             pvalues[1].bit10 = "Write Managed";
10548             pvalues[1].bit10hfname = hf_bit10acflags;
10549             pvalues[1].bit11 = "Per Replica";
10550             pvalues[1].bit11hfname = hf_bit11acflags;
10551             pvalues[1].bit12 = "Never Schedule Synchronization";
10552             pvalues[1].bit12hfname = hf_bit12acflags;
10553             pvalues[1].bit13 = "Operational";
10554             pvalues[1].bit13hfname = hf_bit13acflags;
10555             pvalues[1].bit14 = "Not Defined";
10556             pvalues[1].bit14hfname = hf_bit14acflags;
10557             pvalues[1].bit15 = "Not Defined";
10558             pvalues[1].bit15hfname = hf_bit15acflags;
10559             pvalues[1].bit16 = "Not Defined";
10560             pvalues[1].bit16hfname = hf_bit16acflags;
10561             foffset = foffset+4;
10562             pvalues[2].vtype = VTYPE_STRING;
10563             pvalues[2].vdesc = "Attribute Name: %s";
10564             pvalues[2].mvtype = MVTYPE_ATTR_REQUEST;
10565             pvalues[2].vvalue = 0;
10566             pvalues[2].vlength = 256;
10567             pvalues[2].vlength = tvb_get_letohl(tvb, foffset);
10568             if (pvalues[2].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[2].vlength))
10569             {
10570                 pvalues[2].vtype = VTYPE_NONE;
10571                 break;
10572             }
10573             pvalues[2].voffset = foffset+4;
10574             foffset = foffset + 4;
10575             pvalues[2].vstring = get_string(tvb, pvalues[2].voffset, pvalues[2].vlength);
10576             g_strlcpy(global_object_name, pvalues[2].vstring, 256);
10577             pvalues[2].hfname= hf_nds_name;
10578             foffset = foffset+pvalues[2].vlength;
10579             foffset += align_4(tvb, foffset);
10580             pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
10581             pvalues[3].vstring = match_strval(pvalues[3].vvalue, nds_syntax);
10582             if(pvalues[3].vstring == NULL)
10583             {
10584                 pvalues[3].vstring = "No Syntax Found";
10585             }
10586             pvalues[3].vtype = VTYPE_STRING;
10587             pvalues[3].vdesc = "Syntax: %s";
10588             pvalues[3].vlength = 4;
10589             pvalues[3].voffset = foffset;
10590             pvalues[3].hfname= hf_nds_syntax;
10591             pvalues[3].mvtype = 0;
10592             foffset = foffset+pvalues[3].vlength;
10593             pvalues[4].vvalue = tvb_get_letohl(tvb, foffset);
10594             pvalues[4].vtype = VTYPE_UINT32;
10595             pvalues[4].vdesc = "Lower Limit Value %u";
10596             pvalues[4].vlength = 4;
10597             pvalues[4].voffset = foffset;
10598             pvalues[4].hfname = hf_nds_lower;
10599             foffset += 4;
10600             pvalues[5].vvalue = tvb_get_letohl(tvb, foffset);
10601             pvalues[5].vtype = VTYPE_UINT32;
10602             pvalues[5].vdesc = "Upper Limit Value %u";
10603             pvalues[5].vlength = 4;
10604             pvalues[5].voffset = foffset;
10605             pvalues[5].hfname = hf_nds_upper;
10606             foffset += 4;
10607             pvalues[6].vvalue = tvb_get_letohl(tvb, foffset); /* Length of bytes field */
10608             foffset += 4;
10609             pvalues[6].vtype = VTYPE_BYTES;
10610             pvalues[6].vdesc = "ASN.1 ID";
10611             pvalues[6].vlength = pvalues[6].vvalue;
10612             pvalues[6].voffset = foffset;
10613             pvalues[6].hfname = hf_nds_asn1;
10614             break;
10615         case 0x0c:
10616             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
10617             break;
10618         case 0x0d:
10619             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
10620             pvalues[0].vtype = VTYPE_UINT32;
10621             pvalues[0].vdesc = "Version: %u";
10622             pvalues[0].vlength = 4;
10623             pvalues[0].voffset = foffset;
10624             pvalues[0].hfname= hf_nds_ver;
10625             foffset = foffset+pvalues[0].vlength;
10626             pvalues[1].vtype = VTYPE_STRING;
10627             pvalues[1].vdesc = "Attribute Name: %s";
10628             pvalues[1].mvtype = MVTYPE_ATTR_REQUEST;
10629             pvalues[1].vvalue = 0;
10630             pvalues[1].vlength = 256;
10631             pvalues[1].vlength = tvb_get_letohl(tvb, foffset);
10632             if (pvalues[1].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[1].vlength))
10633             {
10634                 pvalues[1].vtype = VTYPE_NONE;
10635                 break;
10636             }
10637             pvalues[1].voffset = foffset+4;
10638             foffset = foffset + 4;
10639             pvalues[1].vstring = get_string(tvb, pvalues[1].voffset, pvalues[1].vlength);
10640             g_strlcpy(global_object_name, pvalues[1].vstring, 256);
10641             pvalues[1].hfname= hf_nds_attribute_dn;
10642             break;
10643         case 0x0e:
10644             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
10645             break;
10646         case 0x0f:
10647             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
10648             pvalues[0].vtype = VTYPE_UINT32;
10649             pvalues[0].vdesc = "Version: %u";
10650             pvalues[0].vlength = 4;
10651             pvalues[0].voffset = foffset;
10652             pvalues[0].hfname= hf_nds_ver;
10653             foffset = foffset+pvalues[0].vlength;
10654             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
10655             pvalues[1].vtype = VTYPE_UINT32;
10656             pvalues[1].vdesc = "Iteration Handle: 0x%08x";
10657             pvalues[1].vlength = 4;
10658             pvalues[1].voffset = foffset;
10659             pvalues[1].hfname= hf_nds_iteration;
10660             foffset = foffset+pvalues[1].vlength;
10661             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
10662             global_flags = pvalues[2].vvalue;
10663             pvalues[2].vstring = match_strval(pvalues[2].vvalue, class_def_type);
10664             if(pvalues[2].vstring == NULL)
10665             {
10666                 pvalues[2].vstring = "No Class Definition Type Set";
10667             }
10668             pvalues[2].vtype = VTYPE_STRING;
10669             pvalues[2].vdesc = "Class Definition Type: %s";
10670             pvalues[2].vlength = 4;
10671             pvalues[2].voffset = foffset;
10672             pvalues[2].mvtype = 0;
10673             pvalues[2].hfname= hf_nds_class_def_type;
10674             foffset = foffset + pvalues[2].vlength;
10675             pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
10676             if (pvalues[3].vvalue == 0x00000000)
10677             {
10678                 pvalues[3].vstring = "Do Not Return All Classes";
10679                 pvalues[3].mvtype = 0;
10680             }
10681             else
10682             {
10683                 pvalues[3].vstring = "Return All Classes";
10684                 pvalues[3].mvtype = MVTYPE_ATTR_REQUEST;
10685             }
10686             pvalues[3].vtype = VTYPE_STRING;
10687             pvalues[3].vdesc = "%s";
10688             pvalues[3].vlength = 4;
10689             pvalues[3].voffset = foffset;
10690             pvalues[3].hfname= hf_nds_return_all_classes;
10691             foffset = foffset + pvalues[3].vlength;
10692             foffset += align_4(tvb, foffset);
10693             pvalues[4].vvalue = tvb_get_letohl(tvb, foffset);
10694             pvalues[4].vtype = VTYPE_MULTIVALUE_UINT32;
10695             pvalues[4].vdesc = "Classes: %u";
10696             pvalues[4].vlength = 4;
10697             pvalues[4].voffset = foffset;
10698             pvalues[4].mvtype = MVTYPE_READ_CLASS_REQ;
10699             pvalues[4].hfname= hf_nds_classes;
10700             break;
10701         case 0x10:
10702             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
10703             pvalues[0].vtype = VTYPE_UINT32;
10704             pvalues[0].vdesc = "Version: %u";
10705             pvalues[0].vlength = 4;
10706             pvalues[0].voffset = foffset;
10707             pvalues[0].hfname= hf_nds_ver;
10708             foffset = foffset+pvalues[0].vlength;
10709             pvalues[1].vtype = VTYPE_STRING;
10710             pvalues[1].vdesc = "Class Name: %s";
10711             pvalues[1].mvtype = MVTYPE_ATTR_REQUEST;
10712             pvalues[1].vvalue = 0;
10713             pvalues[1].vlength = 256;
10714             pvalues[1].vlength = tvb_get_letohl(tvb, foffset);
10715             if (pvalues[1].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[1].vlength))
10716             {
10717                 pvalues[1].vtype = VTYPE_NONE;
10718                 break;
10719             }
10720             pvalues[1].voffset = foffset+4;
10721             foffset = foffset + 4;
10722             pvalues[1].vstring = get_string(tvb, pvalues[1].voffset, pvalues[1].vlength);
10723             g_strlcpy(global_object_name, pvalues[1].vstring, 256);
10724             pvalues[1].hfname= hf_nds_base_class;
10725             foffset = foffset+pvalues[1].vlength;
10726             foffset += align_4(tvb, foffset);
10727             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
10728             pvalues[2].vtype = VTYPE_MULTIVALUE_UINT32;
10729             pvalues[2].vdesc = "Number of Attributes to Add: %u";
10730             pvalues[2].vlength = 4;
10731             pvalues[2].voffset = foffset;
10732             pvalues[2].mvtype = MVTYPE_MODIFY_CLASS;
10733             pvalues[2].hfname= hf_nds_att_add;
10734             break;
10735         case 0x11:
10736             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
10737             pvalues[0].vtype = VTYPE_UINT32;
10738             pvalues[0].vdesc = "Version: %u";
10739             pvalues[0].vlength = 4;
10740             pvalues[0].voffset = foffset;
10741             pvalues[0].hfname= hf_nds_ver;
10742             foffset = foffset+pvalues[0].vlength;
10743             pvalues[1].vtype = VTYPE_STRING;
10744             pvalues[1].vdesc = "Class Name: %s";
10745             pvalues[1].mvtype = MVTYPE_ATTR_REQUEST;
10746             pvalues[1].vvalue = 0;
10747             pvalues[1].vlength = 256;
10748             pvalues[1].vlength = tvb_get_letohl(tvb, foffset);
10749             if (pvalues[1].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[1].vlength))
10750             {
10751                 pvalues[1].vtype = VTYPE_NONE;
10752                 break;
10753             }
10754             pvalues[1].voffset = foffset+4;
10755             foffset = foffset + 4;
10756             pvalues[1].vstring = get_string(tvb, pvalues[1].voffset, pvalues[1].vlength);
10757             g_strlcpy(global_object_name, pvalues[1].vstring, 256);
10758             pvalues[1].hfname= hf_nds_base;
10759             break;
10760         case 0x12:
10761             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
10762             pvalues[0].vtype = VTYPE_UINT32;
10763             pvalues[0].vdesc = "Version: %u";
10764             pvalues[0].vlength = 4;
10765             pvalues[0].voffset = foffset;
10766             pvalues[0].hfname= hf_nds_ver;
10767             foffset = foffset+pvalues[0].vlength;
10768             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
10769             pvalues[1].vtype = VTYPE_UINT32;
10770             pvalues[1].vdesc = "Iteration Handle: 0x%08x";
10771             pvalues[1].vlength = 4;
10772             pvalues[1].voffset = foffset;
10773             pvalues[1].hfname= hf_nds_iteration;
10774             foffset = foffset+pvalues[1].vlength;
10775             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
10776             pvalues[2].vtype = VTYPE_UINT32;
10777             pvalues[2].vdesc = "Entry ID: 0x%08x";
10778             pvalues[2].vlength = 4;
10779             resolve_eid = TRUE;
10780             global_eid = pvalues[2].vvalue;
10781             pvalues[2].voffset = foffset;
10782             pvalues[2].hfname= hf_nds_eid;
10783             foffset = foffset+pvalues[2].vlength;
10784             break;
10785         case 0x13:
10786             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
10787             pvalues[0].vtype = VTYPE_UINT32;
10788             pvalues[0].vdesc = "Version: %u";
10789             pvalues[0].vlength = 4;
10790             pvalues[0].voffset = foffset;
10791             pvalues[0].hfname= hf_nds_ver;
10792             foffset = foffset+pvalues[0].vlength;
10793             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
10794             pvalues[1].vtype = VTYPE_UINT32;
10795             pvalues[1].vdesc = "Entry ID: 0x%08x";
10796             pvalues[1].vlength = 4;
10797             resolve_eid = TRUE;
10798             global_eid = pvalues[1].vvalue;
10799             pvalues[1].voffset = foffset;
10800             pvalues[1].hfname= hf_nds_eid;
10801             foffset = foffset+pvalues[1].vlength;
10802             pvalues[2].vtype = VTYPE_STRING;
10803             pvalues[2].vdesc = "Trustee Name: %s";
10804             pvalues[2].mvtype = MVTYPE_ATTR_REQUEST;
10805             pvalues[2].vvalue = 0;
10806             pvalues[2].vlength = 256;
10807             pvalues[2].vlength = tvb_get_letohl(tvb, foffset);
10808             if (pvalues[2].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[2].vlength))
10809             {
10810                 pvalues[2].vtype = VTYPE_NONE;
10811                 break;
10812             }
10813             pvalues[2].voffset = foffset+4;
10814             foffset = foffset + 4;
10815             pvalues[2].vstring = get_string(tvb, pvalues[2].voffset, pvalues[2].vlength);
10816             pvalues[2].hfname= hf_nds_name;
10817             foffset = foffset+pvalues[2].vlength;
10818             foffset += align_4(tvb, foffset);
10819             pvalues[3].vtype = VTYPE_STRING;
10820             pvalues[3].vdesc = "Attribute to be Checked: %s";
10821             pvalues[3].mvtype = 0;
10822             pvalues[3].vvalue = 0;
10823             pvalues[3].vlength = 256;
10824             pvalues[3].vlength = tvb_get_letohl(tvb, foffset);
10825             if (pvalues[3].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[3].vlength))
10826             {
10827                 pvalues[3].vtype = VTYPE_NONE;
10828                 break;
10829             }
10830             pvalues[3].voffset = foffset+4;
10831             foffset = foffset + 4;
10832             pvalues[3].vstring = get_string(tvb, pvalues[3].voffset, pvalues[3].vlength);
10833             pvalues[3].hfname= hf_nds_name;
10834             foffset = foffset+pvalues[3].vlength;
10835             foffset += align_4(tvb, foffset);
10836             if(pvalues[0].vvalue != 0)
10837             {
10838                 pvalues[4].vtype = VTYPE_STRING;
10839                 pvalues[4].vdesc = "Security Equivalence: %s";
10840                 pvalues[4].mvtype = MVTYPE_ATTR_REQUEST;
10841                 pvalues[4].vvalue = 0;
10842                 pvalues[4].vlength = 256;
10843                 pvalues[4].vlength = tvb_get_letohl(tvb, foffset);
10844                 if (pvalues[4].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[4].vlength))
10845                 {
10846                     pvalues[4].vtype = VTYPE_NONE;
10847                     break;
10848                 }
10849                 pvalues[4].voffset = foffset+4;
10850                 foffset = foffset + 4;
10851                 pvalues[4].vstring = get_string(tvb, pvalues[4].voffset, pvalues[4].vlength);
10852                 pvalues[4].hfname= hf_nds_name;
10853                 foffset = foffset+pvalues[4].vlength;
10854                 foffset += align_4(tvb, foffset);
10855             }
10856             break;
10857         case 0x14:
10858             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
10859             break;
10860         case 0x15:
10861             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
10862             break;
10863         case 0x16:
10864             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
10865             pvalues[0].vtype = VTYPE_UINT32;
10866             pvalues[0].vdesc = "Version: %u";
10867             pvalues[0].vlength = 4;
10868             pvalues[0].voffset = foffset;
10869             pvalues[0].hfname= hf_nds_ver;
10870             foffset = foffset+pvalues[0].vlength;
10871             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
10872             pvalues[1].vtype = VTYPE_BITFIELD;
10873             pvalues[1].vdesc = "Request Flags:";
10874             pvalues[1].vlength = 2;
10875             pvalues[1].hfname= hf_nds_rflags;
10876             pvalues[1].voffset = foffset;
10877             pvalues[1].bit1 = "Typeless";
10878             pvalues[1].bit1hfname = hf_nds_bit1;
10879             pvalues[1].bit2 = "All Containers";
10880             pvalues[1].bit2hfname = hf_nds_bit2;
10881             pvalues[1].bit3 = "Slashed";
10882             pvalues[1].bit3hfname = hf_nds_bit3;
10883             pvalues[1].bit4 = "Dotted";
10884             pvalues[1].bit4hfname = hf_nds_bit4;
10885             pvalues[1].bit5 = "Tuned";
10886             pvalues[1].bit5hfname = hf_nds_bit5;
10887             pvalues[1].bit6 = "Not Defined";
10888             pvalues[1].bit6hfname = hf_nds_bit6;
10889             pvalues[1].bit7 = "Not Defined";
10890             pvalues[1].bit7hfname = hf_nds_bit7;
10891             pvalues[1].bit8 = "Not Defined";
10892             pvalues[1].bit8hfname = hf_nds_bit8;
10893             pvalues[1].bit9 = "Not Defined";
10894             pvalues[1].bit9hfname = hf_nds_bit9;
10895             pvalues[1].bit10 = "Not Defined";
10896             pvalues[1].bit10hfname = hf_nds_bit10;
10897             pvalues[1].bit11 = "Not Defined";
10898             pvalues[1].bit11hfname = hf_nds_bit11;
10899             pvalues[1].bit12 = "Not Defined";
10900             pvalues[1].bit12hfname = hf_nds_bit12;
10901             pvalues[1].bit13 = "Not Defined";
10902             pvalues[1].bit13hfname = hf_nds_bit13;
10903             pvalues[1].bit14 = "Not Defined";
10904             pvalues[1].bit14hfname = hf_nds_bit14;
10905             pvalues[1].bit15 = "Not Defined";
10906             pvalues[1].bit15hfname = hf_nds_bit15;
10907             pvalues[1].bit16 = "Not Defined";
10908             pvalues[1].bit16hfname = hf_nds_bit16;
10909             foffset = foffset+pvalues[1].vlength;
10910             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
10911             pvalues[2].vtype = VTYPE_UINT32;
10912             pvalues[2].vdesc = "Iteration Handle: 0x%08x";
10913             pvalues[2].vlength = 4;
10914             pvalues[2].voffset = foffset;
10915             pvalues[2].hfname= hf_nds_iteration;
10916             foffset = foffset+pvalues[2].vlength;
10917             if(pvalues[0].vvalue == 0)
10918             {
10919                 global_flags = 0x000000c0;
10920                 break;
10921             }
10922             pvalues[3].vvalue = tvb_get_letohs(tvb, foffset);
10923             pvalues[3].vtype = VTYPE_BITFIELD;
10924             pvalues[3].vdesc = "Information Flags (low) Byte:";
10925             pvalues[3].vlength = 2;
10926             pvalues[3].hfname= hf_nds_rflags;
10927             pvalues[3].voffset = foffset;
10928             pvalues[3].bit1 = "Output Flags";
10929             pvalues[3].bit1hfname = hf_bit1l1flagsl;
10930             pvalues[3].bit2 = "Entry ID";
10931             pvalues[3].bit2hfname = hf_bit2l1flagsl;
10932             pvalues[3].bit3 = "Replica State";
10933             pvalues[3].bit3hfname = hf_bit3l1flagsl;
10934             pvalues[3].bit4 = "Modification Timestamp";
10935             pvalues[3].bit4hfname = hf_bit4l1flagsl;
10936             pvalues[3].bit5 = "Purge Time";
10937             pvalues[3].bit5hfname = hf_bit5l1flagsl;
10938             pvalues[3].bit6 = "Local Partition ID";
10939             pvalues[3].bit6hfname = hf_bit6l1flagsl;
10940             pvalues[3].bit7 = "Distinguished Name";
10941             pvalues[3].bit7hfname = hf_bit7l1flagsl;
10942             pvalues[3].bit8 = "Replica Type";
10943             pvalues[3].bit8hfname = hf_bit8l1flagsl;
10944             pvalues[3].bit9 = "Partition Busy";
10945             pvalues[3].bit9hfname = hf_bit9l1flagsl;
10946             pvalues[3].bit10 = "Not Defined";
10947             pvalues[3].bit10hfname = hf_bit10l1flagsl;
10948             pvalues[3].bit11 = "Not Defined";
10949             pvalues[3].bit11hfname = hf_bit11l1flagsl;
10950             pvalues[3].bit12 = "Not Defined";
10951             pvalues[3].bit12hfname = hf_bit12l1flagsl;
10952             pvalues[3].bit13 = "Not Defined";
10953             pvalues[3].bit13hfname = hf_bit13l1flagsl;
10954             pvalues[3].bit14 = "Not Defined";
10955             pvalues[3].bit14hfname = hf_bit14l1flagsl;
10956             pvalues[3].bit15 = "Not Defined";
10957             pvalues[3].bit15hfname = hf_bit15l1flagsl;
10958             pvalues[3].bit16 = "Not Defined";
10959             pvalues[3].bit16hfname = hf_bit16l1flagsl;
10960             global_flags = pvalues[3].vvalue;
10961             foffset = foffset+2;
10962             pvalues[4].vvalue = tvb_get_letohs(tvb, foffset);
10963             pvalues[4].vtype = VTYPE_BITFIELD;
10964             pvalues[4].vdesc = "Information Flags (high) Byte:";
10965             pvalues[4].vlength = 2;
10966             pvalues[4].hfname= hf_nds_rflags;
10967             pvalues[4].voffset = foffset;
10968             pvalues[4].bit1 = "Not Defined";
10969             pvalues[4].bit1hfname = hf_bit1l1flagsl;
10970             pvalues[4].bit2 = "Not Defined";
10971             pvalues[4].bit2hfname = hf_bit2l1flagsl;
10972             pvalues[4].bit3 = "Not Defined";
10973             pvalues[4].bit3hfname = hf_bit3l1flagsl;
10974             pvalues[4].bit4 = "Not Defined";
10975             pvalues[4].bit4hfname = hf_bit4l1flagsl;
10976             pvalues[4].bit5 = "Not Defined";
10977             pvalues[4].bit5hfname = hf_bit5l1flagsl;
10978             pvalues[4].bit6 = "Not Defined";
10979             pvalues[4].bit6hfname = hf_bit6l1flagsl;
10980             pvalues[4].bit7 = "Not Defined";
10981             pvalues[4].bit7hfname = hf_bit7l1flagsl;
10982             pvalues[4].bit8 = "Not Defined";
10983             pvalues[4].bit8hfname = hf_bit8l1flagsl;
10984             pvalues[4].bit9 = "Not Defined";
10985             pvalues[4].bit9hfname = hf_bit9l1flagsl;
10986             pvalues[4].bit10 = "Not Defined";
10987             pvalues[4].bit10hfname = hf_bit10l1flagsl;
10988             pvalues[4].bit11 = "Not Defined";
10989             pvalues[4].bit11hfname = hf_bit11l1flagsl;
10990             pvalues[4].bit12 = "Not Defined";
10991             pvalues[4].bit12hfname = hf_bit12l1flagsl;
10992             pvalues[4].bit13 = "Not Defined";
10993             pvalues[4].bit13hfname = hf_bit13l1flagsl;
10994             pvalues[4].bit14 = "Not Defined";
10995             pvalues[4].bit14hfname = hf_bit14l1flagsl;
10996             pvalues[4].bit15 = "Not Defined";
10997             pvalues[4].bit15hfname = hf_bit15l1flagsl;
10998             pvalues[4].bit16 = "Not Defined";
10999             pvalues[4].bit16hfname = hf_bit16l1flagsl;
11000             foffset = foffset+2;
11001             if(pvalues[0].vvalue == 1)
11002             {
11003                 break;
11004             }
11005             pvalues[5].vvalue = tvb_get_letohl(tvb, foffset);
11006             pvalues[5].vtype = VTYPE_UINT32;
11007             pvalues[5].vdesc = "Partition Root ID: 0x%08x";
11008             pvalues[5].vlength = 4;
11009             pvalues[5].voffset = foffset;
11010             pvalues[5].hfname= hf_nds_partition_root_id;
11011             foffset = foffset+pvalues[5].vlength;
11012             break;
11013         case 0x17:
11014             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
11015             pvalues[0].vtype = VTYPE_UINT32;
11016             pvalues[0].vdesc = "Version: %u";
11017             pvalues[0].vlength = 4;
11018             pvalues[0].hfname = hf_nds_ver;
11019             pvalues[0].voffset = foffset;
11020             foffset = foffset+pvalues[0].vlength;
11021             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
11022             pvalues[1].vtype = VTYPE_UINT32;
11023             pvalues[1].vdesc = "Flags: 0x%08x";
11024             pvalues[1].vlength = 4;
11025             pvalues[1].hfname = hf_nds_req_flags;
11026             pvalues[1].voffset = foffset;
11027             foffset = foffset+pvalues[1].vlength;
11028             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
11029             pvalues[2].vtype = VTYPE_UINT32;
11030             pvalues[2].vdesc = "New Partition Root ID: 0x%08x";
11031             pvalues[2].vlength = 4;
11032             pvalues[2].voffset = foffset;
11033             pvalues[2].hfname= hf_nds_new_part_id;
11034             foffset = foffset+pvalues[2].vlength;
11035             break;
11036         case 0x18:
11037             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
11038             pvalues[0].vtype = VTYPE_UINT32;
11039             pvalues[0].vdesc = "Version: %u";
11040             pvalues[0].vlength = 4;
11041             pvalues[0].hfname = hf_nds_ver;
11042             pvalues[0].voffset = foffset;
11043             foffset = foffset+pvalues[0].vlength;
11044             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
11045             pvalues[1].vtype = VTYPE_UINT32;
11046             pvalues[1].vdesc = "Flags: 0x%08x";
11047             pvalues[1].vlength = 4;
11048             pvalues[1].hfname = hf_nds_req_flags;
11049             pvalues[1].voffset = foffset;
11050             foffset = foffset+pvalues[1].vlength;
11051             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
11052             pvalues[2].vtype = VTYPE_UINT32;
11053             pvalues[2].vdesc = "Child Partition Root ID: 0x%08x";
11054             pvalues[2].vlength = 4;
11055             pvalues[2].voffset = foffset;
11056             pvalues[2].hfname= hf_nds_child_part_id;
11057             foffset = foffset+pvalues[2].vlength;
11058             break;
11059         case 0x19:
11060             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
11061             pvalues[0].vtype = VTYPE_UINT32;
11062             pvalues[0].vdesc = "Version: %u";
11063             pvalues[0].vlength = 4;
11064             pvalues[0].hfname = hf_nds_ver;
11065             pvalues[0].voffset = foffset;
11066             foffset = foffset+pvalues[0].vlength;
11067             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
11068             pvalues[1].vtype = VTYPE_UINT32;
11069             pvalues[1].vdesc = "Flags: 0x%08x";
11070             pvalues[1].vlength = 4;
11071             pvalues[1].hfname = hf_nds_req_flags;
11072             pvalues[1].voffset = foffset;
11073             foffset = foffset+pvalues[1].vlength;
11074             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
11075             pvalues[2].vtype = VTYPE_UINT32;
11076             pvalues[2].vdesc = "Master Partition Root ID: 0x%08x";
11077             pvalues[2].vlength = 4;
11078             pvalues[2].voffset = foffset;
11079             pvalues[2].hfname= hf_nds_master_part_id;
11080             foffset = foffset+pvalues[2].vlength;
11081             pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
11082             pvalues[3].vstring = match_strval(pvalues[3].vvalue, nds_replica_type);
11083             if(pvalues[3].vstring == NULL)
11084             {
11085                 pvalues[3].vstring = "No Replica Type Found";
11086             }
11087             pvalues[3].vtype = VTYPE_STRING;
11088             pvalues[3].vdesc = "Replica Type: %s";
11089             pvalues[3].vlength = 4;
11090             pvalues[3].voffset = foffset;
11091             pvalues[3].mvtype = 0;
11092             pvalues[3].hfname= hf_replica_type;
11093             foffset = foffset + pvalues[3].vlength;
11094             pvalues[4].vtype = VTYPE_STRING;
11095             pvalues[4].vdesc = "Target Server Name: %s";
11096             pvalues[4].mvtype = 0;
11097             pvalues[4].vvalue = 0;
11098             pvalues[4].vlength = 256;
11099             pvalues[4].vlength = tvb_get_letohl(tvb, foffset);
11100             if (pvalues[4].vlength == 0x00 && !tvb_bytes_exist(tvb, foffset, pvalues[4].vlength))
11101             {
11102                 pvalues[4].vtype = VTYPE_NONE;
11103                 break;
11104             }
11105             pvalues[4].voffset = foffset+4;
11106             foffset = foffset + 4;
11107             pvalues[4].vstring = get_string(tvb, pvalues[4].voffset, pvalues[4].vlength);
11108             pvalues[4].hfname= hf_nds_target_name;
11109             break;
11110         case 0x1a:
11111             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11112             break;
11113         case 0x1b:
11114             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
11115             pvalues[0].vtype = VTYPE_UINT32;
11116             pvalues[0].vdesc = "Version: %u";
11117             pvalues[0].vlength = 4;
11118             pvalues[0].hfname = hf_nds_ver;
11119             pvalues[0].voffset = foffset;
11120             foffset = foffset+pvalues[0].vlength;
11121             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
11122             pvalues[1].vtype = VTYPE_UINT32;
11123             pvalues[1].vdesc = "Streams Flags: 0x%08x";
11124             pvalues[1].vlength = 4;
11125             pvalues[1].hfname = hf_nds_stream_flags;
11126             pvalues[1].voffset = foffset;
11127             foffset = foffset+pvalues[1].vlength;
11128             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
11129             pvalues[2].vtype = VTYPE_UINT32;
11130             pvalues[2].vdesc = "Entry ID: 0x%08x";
11131             pvalues[2].vlength = 4;
11132             resolve_eid = TRUE;
11133             global_eid = pvalues[2].vvalue;
11134             pvalues[2].voffset = foffset;
11135             pvalues[2].hfname= hf_nds_eid;
11136             foffset = foffset+pvalues[2].vlength;
11137             pvalues[3].vtype = VTYPE_STRING;
11138             pvalues[3].vdesc = "Stream Name: %s";
11139             pvalues[3].mvtype = MVTYPE_ATTR_REQUEST;
11140             pvalues[3].vvalue = 0;
11141             pvalues[3].vlength = 256;
11142             pvalues[3].vlength = tvb_get_letohl(tvb, foffset);
11143             if (pvalues[3].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[3].vlength))
11144             {
11145                 pvalues[3].vtype = VTYPE_NONE;
11146                 break;
11147             }
11148             pvalues[3].voffset = foffset+4;
11149             foffset += 4;
11150             pvalues[3].vstring = get_string(tvb, pvalues[3].voffset, pvalues[3].vlength);
11151             foffset += pvalues[3].vlength;
11152             foffset += align_4(tvb, foffset);
11153             pvalues[3].hfname= hf_nds_stream_name;
11154             break;
11155         case 0x1c:
11156             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11157             break;
11158         case 0x1d:
11159             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11160             break;
11161         case 0x1e:
11162             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11163             break;
11164         case 0x1f:
11165             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11166             break;
11167         case 0x20:
11168             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11169             break;
11170         case 0x21:
11171             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11172             break;
11173         case 0x22:
11174             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11175             break;
11176         case 0x23:
11177             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11178             break;
11179         case 0x24:
11180             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11181             break;
11182         case 0x25:
11183             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11184             break;
11185         case 0x26:
11186             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
11187             pvalues[0].vtype = VTYPE_UINT32;
11188             pvalues[0].vdesc = "Version: %u";
11189             pvalues[0].vlength = 4;
11190             pvalues[0].hfname = hf_nds_ver;
11191             pvalues[0].voffset = foffset;
11192             foffset = foffset+pvalues[0].vlength;
11193             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
11194             pvalues[1].vtype = VTYPE_UINT32;
11195             pvalues[1].vdesc = "Flags: 0x%08x";
11196             pvalues[1].vlength = 4;
11197             pvalues[1].hfname = hf_nds_req_flags;
11198             pvalues[1].voffset = foffset;
11199             foffset = foffset+pvalues[1].vlength;
11200             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
11201             pvalues[2].vtype = VTYPE_UINT32;
11202             pvalues[2].vdesc = "Time Delay in Seconds: %u";
11203             pvalues[2].vlength = 4;
11204             pvalues[2].voffset = foffset;
11205             pvalues[2].hfname= hf_nds_time_delay;
11206             foffset = foffset+pvalues[2].vlength;
11207             if(pvalues[0].vvalue == 0)
11208             {
11209                 pvalues[3].vtype = VTYPE_STRING;
11210                 pvalues[3].vdesc = "Root Most Object Name: %s";
11211                 pvalues[3].mvtype = MVTYPE_ATTR_REQUEST;
11212                 pvalues[3].vvalue = 0;
11213                 pvalues[3].vlength = 256;
11214                 pvalues[3].vlength = tvb_get_letohl(tvb, foffset);
11215                 if (pvalues[3].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[3].vlength))
11216                 {
11217                     pvalues[3].vtype = VTYPE_NONE;
11218                     break;
11219                 }
11220                 pvalues[3].voffset = foffset+4;
11221                 foffset += 4;
11222                 pvalues[3].vstring = get_string(tvb, pvalues[3].voffset, pvalues[3].vlength);
11223                 foffset += pvalues[3].vlength;
11224                 foffset += align_4(tvb, foffset);
11225                 pvalues[3].hfname= hf_nds_root_name;
11226             }
11227             else
11228             {
11229                 pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
11230                 pvalues[3].vtype = VTYPE_UINT32;
11231                 pvalues[3].vdesc = "Entry ID: 0x%08x";
11232                 pvalues[3].vlength = 4;
11233                 resolve_eid = TRUE;
11234                 global_eid = pvalues[3].vvalue;
11235                 pvalues[3].voffset = foffset;
11236                 pvalues[3].hfname= hf_nds_eid;
11237                 foffset = foffset+pvalues[3].vlength;
11238                 resolve_eid = TRUE;
11239                 global_eid = pvalues[3].vvalue;
11240             }
11241             break;
11242         case 0x27:
11243             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11244             break;
11245         case 0x28:
11246             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11247             break;
11248         case 0x29:
11249             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11250             break;
11251         case 0x2a:
11252             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
11253             pvalues[0].vtype = VTYPE_UINT32;
11254             pvalues[0].vdesc = "Version: %u";
11255             pvalues[0].vlength = 4;
11256             pvalues[0].hfname = hf_nds_ver;
11257             pvalues[0].voffset = foffset;
11258             foffset = foffset+pvalues[0].vlength;
11259             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
11260             pvalues[1].vtype = VTYPE_UINT32;
11261             pvalues[1].vdesc = "Flags: 0x%08x";
11262             pvalues[1].vlength = 4;
11263             pvalues[1].hfname = hf_nds_req_flags;
11264             pvalues[1].voffset = foffset;
11265             foffset = foffset+pvalues[1].vlength;
11266             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
11267             pvalues[2].vtype = VTYPE_UINT32;
11268             pvalues[2].vdesc = "Destination Parent Entry ID: 0x%08x";
11269             pvalues[2].vlength = 4;
11270             resolve_eid = TRUE;
11271             global_eid = pvalues[2].vvalue;
11272             pvalues[2].voffset = foffset;
11273             pvalues[2].hfname= hf_nds_eid;
11274             foffset = foffset+pvalues[2].vlength;
11275             resolve_eid = TRUE;
11276             global_eid = pvalues[2].vvalue;
11277             pvalues[3].vtype = VTYPE_STRING;
11278             pvalues[3].vdesc = "New RDN: %s";
11279             pvalues[3].mvtype = 0;
11280             pvalues[3].vvalue = 0;
11281             pvalues[3].vlength = 256;
11282             pvalues[3].vlength = tvb_get_letohl(tvb, foffset);
11283             pvalues[3].voffset = foffset+4;
11284             foffset = foffset + 4;
11285             pvalues[3].vstring = get_string(tvb, pvalues[3].voffset, pvalues[3].vlength);
11286             pvalues[3].hfname= hf_nds_new_rdn;
11287             foffset = foffset+pvalues[3].vlength;
11288             foffset += align_4(tvb, foffset);
11289             pvalues[4].vtype = VTYPE_STRING;
11290             pvalues[4].vdesc = "Source Server Name: %s";
11291             pvalues[4].mvtype = 0;
11292             pvalues[4].vvalue = 0;
11293             pvalues[4].vlength = 256;
11294             pvalues[4].vlength = tvb_get_letohl(tvb, foffset);
11295             if (pvalues[4].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[3].vlength))
11296             {
11297                 pvalues[4].vtype = VTYPE_NONE;
11298                 break;
11299             }
11300             pvalues[4].voffset = foffset+4;
11301             foffset = foffset + 4;
11302             pvalues[4].vstring = get_string(tvb, pvalues[4].voffset, pvalues[4].vlength);
11303             pvalues[4].hfname= hf_nds_target_name;
11304             break;
11305         case 0x2b:
11306             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
11307             pvalues[0].vtype = VTYPE_UINT32;
11308             pvalues[0].vdesc = "Version: %u";
11309             pvalues[0].vlength = 4;
11310             pvalues[0].hfname = hf_nds_ver;
11311             pvalues[0].voffset = foffset;
11312             foffset = foffset+pvalues[0].vlength;
11313             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
11314             pvalues[1].vtype = VTYPE_UINT32;
11315             pvalues[1].vdesc = match_strval(pvalues[1].vvalue, nds_verb2b_flag_vals);
11316             if(pvalues[1].vdesc == NULL)
11317             {
11318                 pvalues[1].vdesc = "No Flag Definition Found";
11319             }
11320             pvalues[1].vlength = 4;
11321             pvalues[1].hfname = hf_nds_verb2b_req_flags;
11322             pvalues[1].voffset = foffset;
11323             foffset = foffset+pvalues[1].vlength;
11324             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
11325             pvalues[2].vtype = VTYPE_UINT32;
11326             pvalues[2].vdesc = "Source Entry ID: 0x%08x";
11327             pvalues[2].vlength = 4;
11328             resolve_eid = TRUE;
11329             global_eid = pvalues[2].vvalue;
11330             pvalues[2].voffset = foffset;
11331             pvalues[2].hfname= hf_nds_eid;
11332             foffset = foffset+pvalues[2].vlength;
11333             pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
11334             pvalues[3].vtype = VTYPE_UINT32;
11335             pvalues[3].vdesc = "Destination Parent Entry ID: 0x%08x";
11336             pvalues[3].vlength = 4;
11337             pvalues[3].voffset = foffset;
11338             pvalues[3].hfname= hf_nds_eid;
11339             foffset = foffset+pvalues[3].vlength;
11340             pvalues[4].vtype = VTYPE_STRING;
11341             pvalues[4].vdesc = "New RDN: %s";
11342             pvalues[4].mvtype = 0;
11343             pvalues[4].vvalue = 0;
11344             pvalues[4].vlength = 256;
11345             pvalues[4].vlength = tvb_get_letohl(tvb, foffset);
11346             pvalues[4].voffset = foffset+4;
11347             foffset = foffset + 4;
11348             pvalues[4].vstring = get_string(tvb, pvalues[4].voffset, pvalues[4].vlength);
11349             pvalues[4].hfname= hf_nds_new_rdn;
11350             foffset = foffset+pvalues[4].vlength;
11351             foffset += align_4(tvb, foffset);
11352             pvalues[5].vtype = VTYPE_STRING;
11353             pvalues[5].vdesc = "Source Server Name: %s";
11354             pvalues[5].mvtype = 0;
11355             pvalues[5].vvalue = 0;
11356             pvalues[5].vlength = 256;
11357             pvalues[5].vlength = tvb_get_letohl(tvb, foffset);
11358             if (pvalues[5].vlength == 0x00 || !tvb_bytes_exist(tvb, foffset, pvalues[3].vlength))
11359             {
11360                 pvalues[5].vtype = VTYPE_NONE;
11361                 break;
11362             }
11363             pvalues[5].voffset = foffset+4;
11364             foffset = foffset + 4;
11365             pvalues[5].vstring = get_string(tvb, pvalues[5].voffset, pvalues[5].vlength);
11366             pvalues[5].hfname= hf_nds_target_name;
11367             break;
11368         case 0x2c:
11369             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11370             break;
11371         case 0x2d:
11372             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11373             break;
11374         case 0x2e:
11375             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11376             break;
11377         case 0x2f:
11378             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11379             break;
11380         case 0x30:
11381             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11382             break;
11383         case 0x31:
11384             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11385             break;
11386         case 0x32:
11387             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
11388             pvalues[0].vtype = VTYPE_UINT32;
11389             pvalues[0].vdesc = "Version: %u";
11390             pvalues[0].vlength = 4;
11391             pvalues[0].hfname = hf_nds_ver;
11392             pvalues[0].voffset = foffset;
11393             foffset = foffset+pvalues[0].vlength;
11394             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
11395             pvalues[2].vtype = VTYPE_UINT32;
11396             pvalues[2].vdesc = "Iteration Handle: 0x%08x";
11397             pvalues[2].vlength = 4;
11398             pvalues[2].voffset = foffset;
11399             pvalues[2].hfname= hf_nds_iteration;
11400             foffset = foffset+pvalues[2].vlength;
11401             pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
11402             pvalues[3].vtype = VTYPE_STRING;
11403             pvalues[3].vdesc = "NDS Verb: %s";
11404             pvalues[3].vstring = match_strval(pvalues[3].vvalue, ncp_nds_verb_vals);
11405             pvalues[3].vlength = 4;
11406             pvalues[3].voffset = foffset;
11407             pvalues[3].hfname= hf_mv_string;
11408             foffset = foffset+pvalues[3].vlength;
11409             break;
11410         case 0x33:
11411             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11412             break;
11413         case 0x34:
11414             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11415             break;
11416         case 0x35:
11417             if (nds_version != 0)
11418             {
11419                 pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
11420                 pvalues[0].vtype = VTYPE_UINT32;
11421                 pvalues[0].vdesc = "Version: %u";
11422                 pvalues[0].vlength = 4;
11423                 pvalues[0].hfname = hf_nds_ver;
11424                 pvalues[0].voffset = foffset;
11425                 foffset = foffset+pvalues[0].vlength;
11426                 pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
11427                 global_flags = pvalues[1].vvalue;
11428                 pvalues[1].vtype = VTYPE_BITFIELD;
11429                 pvalues[1].vdesc = "Request Flags:";
11430                 pvalues[1].vlength = 2;
11431                 pvalues[1].hfname= hf_nds_rflags;
11432                 pvalues[1].voffset = foffset;
11433                 pvalues[1].bit1 = "Typeless";
11434                 pvalues[1].bit1hfname = hf_bit1rflags;
11435                 pvalues[1].bit2 = "Slashed";
11436                 pvalues[1].bit2hfname = hf_bit2rflags;
11437                 pvalues[1].bit3 = "Dotted";
11438                 pvalues[1].bit3hfname = hf_bit3rflags;
11439                 pvalues[1].bit4 = "Tuned";
11440                 pvalues[1].bit4hfname = hf_bit4rflags;
11441                 pvalues[1].bit5 = "Not Defined";
11442                 pvalues[1].bit5hfname = hf_bit5rflags;
11443                 pvalues[1].bit6 = "Not Defined";
11444                 pvalues[1].bit6hfname = hf_bit6rflags;
11445                 pvalues[1].bit7 = "Not Defined";
11446                 pvalues[1].bit7hfname = hf_bit7rflags;
11447                 pvalues[1].bit8 = "Not Defined";
11448                 pvalues[1].bit8hfname = hf_bit8rflags;
11449                 pvalues[1].bit9 = "Not Defined";
11450                 pvalues[1].bit9hfname = hf_bit9rflags;
11451                 pvalues[1].bit10 = "Not Defined";
11452                 pvalues[1].bit10hfname = hf_bit10rflags;
11453                 pvalues[1].bit11 = "Not Defined";
11454                 pvalues[1].bit11hfname = hf_bit11rflags;
11455                 pvalues[1].bit12 = "Not Defined";
11456                 pvalues[1].bit12hfname = hf_bit12rflags;
11457                 pvalues[1].bit13 = "Not Defined";
11458                 pvalues[1].bit13hfname = hf_bit13rflags;
11459                 pvalues[1].bit14 = "Not Defined";
11460                 pvalues[1].bit14hfname = hf_bit14rflags;
11461                 pvalues[1].bit15 = "Not Defined";
11462                 pvalues[1].bit15hfname = hf_bit15rflags;
11463                 pvalues[1].bit16 = "Not Defined";
11464                 pvalues[1].bit16hfname = hf_bit16rflags;
11465             }
11466             break;
11467         case 0x36:
11468             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11469             break;
11470         case 0x37:
11471             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11472             break;
11473         case 0x38:
11474             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11475             break;
11476         case 0x39:
11477             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
11478             pvalues[0].vtype = VTYPE_UINT32;
11479             pvalues[0].vdesc = "Version: %u";
11480             pvalues[0].vlength = 4;
11481             pvalues[0].voffset = foffset;
11482             pvalues[0].hfname= hf_nds_ver;
11483             foffset = foffset+pvalues[0].vlength;
11484             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
11485             pvalues[1].vtype = VTYPE_UINT32;
11486             pvalues[1].vdesc = "Entry ID: 0x%08x";
11487             pvalues[1].vlength = 4;
11488             resolve_eid = TRUE;
11489             global_eid = pvalues[1].vvalue;
11490             pvalues[1].voffset = foffset;
11491             pvalues[1].hfname= hf_nds_eid;
11492             foffset = foffset+pvalues[1].vlength;
11493             break;
11494         case 0x3a:
11495             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
11496             pvalues[0].vtype = VTYPE_UINT32;
11497             pvalues[0].vdesc = "Reply Buffer Size: %u";
11498             pvalues[0].vlength = 4;
11499             pvalues[0].voffset = foffset;
11500             pvalues[0].hfname= hf_nds_buffer_size;
11501             foffset = foffset+pvalues[0].vlength;
11502             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
11503             pvalues[1].vtype = VTYPE_UINT32;
11504             pvalues[1].vdesc = "Version: %u";
11505             pvalues[1].vlength = 4;
11506             pvalues[1].voffset = foffset;
11507             pvalues[1].hfname= hf_nds_ver;
11508             foffset = foffset+pvalues[1].vlength;
11509             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
11510             pvalues[2].vtype = VTYPE_UINT32;
11511             pvalues[2].vdesc = "Entry ID: 0x%08x";
11512             pvalues[2].vlength = 4;
11513             resolve_eid = TRUE;
11514             global_eid = pvalues[2].vvalue;
11515             pvalues[2].voffset = foffset;
11516             pvalues[2].hfname= hf_nds_eid;
11517             foffset = foffset+pvalues[2].vlength;
11518             break;
11519         case 0x3b:
11520             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
11521             pvalues[0].vtype = VTYPE_UINT32;
11522             pvalues[0].vdesc = "Version: %u";
11523             pvalues[0].vlength = 4;
11524             pvalues[0].voffset = foffset;
11525             pvalues[0].hfname= hf_nds_ver;
11526             foffset = foffset+pvalues[0].vlength;
11527             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
11528             pvalues[1].vtype = VTYPE_UINT32;
11529             pvalues[1].vdesc = "Entry ID: 0x%08x";
11530             pvalues[1].vlength = 4;
11531             resolve_eid = TRUE;
11532             global_eid = pvalues[1].vvalue;
11533             pvalues[1].voffset = foffset;
11534             pvalues[1].hfname= hf_nds_eid;
11535             foffset = foffset+pvalues[1].vlength;
11536             break;
11537         case 0x3c:
11538             break;
11539         case 0x3d:
11540             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11541             break;
11542         case 0x3e:
11543             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11544             break;
11545         case 0x3f:
11546             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11547             break;
11548         case 0x40:
11549             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11550             break;
11551         case 0x41:
11552             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11553             break;
11554         case 0x42:
11555             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11556             break;
11557         case 0x43:
11558             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11559             break;
11560         case 0x44:
11561             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11562             break;
11563         case 0x45:
11564             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11565             break;
11566         case 0x46:
11567             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11568             break;
11569         case 0x47:
11570             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11571             break;
11572         case 0x48:
11573             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11574             break;
11575         case 0x49:
11576             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11577             break;
11578         case 0x4a:
11579             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11580             break;
11581         case 0x4b:
11582             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11583             break;
11584         case 0x4c:
11585             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11586             break;
11587         case 0x4d:
11588             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11589             break;
11590         case 0x6e:
11591             pvalues[0].vvalue = tvb_get_letohl(tvb, foffset);
11592             pvalues[0].vtype = VTYPE_UINT32;
11593             pvalues[0].vdesc = "Version: %u";
11594             pvalues[0].vlength = 4;
11595             pvalues[0].hfname = hf_nds_ver;
11596             pvalues[0].voffset = foffset;
11597             foffset = foffset+pvalues[0].vlength;
11598             pvalues[1].vvalue = tvb_get_letohl(tvb, foffset);
11599             global_flags = pvalues[1].vvalue;
11600             pvalues[1].vtype = VTYPE_BITFIELD;
11601             pvalues[1].vdesc = "Request Flags:";
11602             pvalues[1].vlength = 2;
11603             pvalues[1].hfname= hf_nds_rflags;
11604             pvalues[1].voffset = foffset;
11605             pvalues[1].bit1 = "Typeless";
11606             pvalues[1].bit1hfname = hf_bit1rflags;
11607             pvalues[1].bit2 = "Slashed";
11608             pvalues[1].bit2hfname = hf_bit2rflags;
11609             pvalues[1].bit3 = "Dotted";
11610             pvalues[1].bit3hfname = hf_bit3rflags;
11611             pvalues[1].bit4 = "Tuned";
11612             pvalues[1].bit4hfname = hf_bit4rflags;
11613             pvalues[1].bit5 = "Not Defined";
11614             pvalues[1].bit5hfname = hf_bit5rflags;
11615             pvalues[1].bit6 = "Not Defined";
11616             pvalues[1].bit6hfname = hf_bit6rflags;
11617             pvalues[1].bit7 = "Not Defined";
11618             pvalues[1].bit7hfname = hf_bit7rflags;
11619             pvalues[1].bit8 = "Not Defined";
11620             pvalues[1].bit8hfname = hf_bit8rflags;
11621             pvalues[1].bit9 = "Not Defined";
11622             pvalues[1].bit9hfname = hf_bit9rflags;
11623             pvalues[1].bit10 = "Not Defined";
11624             pvalues[1].bit10hfname = hf_bit10rflags;
11625             pvalues[1].bit11 = "Not Defined";
11626             pvalues[1].bit11hfname = hf_bit11rflags;
11627             pvalues[1].bit12 = "Not Defined";
11628             pvalues[1].bit12hfname = hf_bit12rflags;
11629             pvalues[1].bit13 = "Not Defined";
11630             pvalues[1].bit13hfname = hf_bit13rflags;
11631             pvalues[1].bit14 = "Not Defined";
11632             pvalues[1].bit14hfname = hf_bit14rflags;
11633             pvalues[1].bit15 = "Not Defined";
11634             pvalues[1].bit15hfname = hf_bit15rflags;
11635             pvalues[1].bit16 = "Not Defined";
11636             pvalues[1].bit16hfname = hf_bit16rflags;
11637             foffset = foffset+pvalues[1].vlength+2;
11638             pvalues[2].vvalue = tvb_get_letohl(tvb, foffset);
11639             pvalues[2].vtype = VTYPE_UINT32;
11640             pvalues[2].vdesc = "Iteration Handle: 0x%08x";
11641             pvalues[2].vlength = 4;
11642             pvalues[2].voffset = foffset;
11643             pvalues[2].hfname= hf_nds_iteration;
11644             foffset = foffset+pvalues[2].vlength;
11645             pvalues[3].vvalue = tvb_get_letohl(tvb, foffset);
11646             pvalues[3].vtype = VTYPE_UINT32;
11647             pvalues[3].vdesc = "Base Entry ID: 0x%08x";
11648             pvalues[3].vlength = 4;
11649             resolve_eid = TRUE;
11650             global_eid = pvalues[3].vvalue;
11651             pvalues[3].voffset = foffset;
11652             pvalues[3].hfname= hf_nds_eid;
11653             foffset = foffset+pvalues[3].vlength;
11654             pvalues[4].vvalue = tvb_get_letohl(tvb, foffset);
11655             pvalues[4].vtype = VTYPE_UINT32;
11656             pvalues[4].vdesc = match_strval(pvalues[4].vvalue, nds_scope_vals);
11657             if(pvalues[4].vdesc == NULL)
11658             {
11659                 pvalues[4].vdesc = "Unknown Scope Defined";
11660             }
11661             pvalues[4].vlength = 4;
11662             pvalues[4].hfname = hf_nds_scope;
11663             pvalues[4].voffset = foffset;
11664             foffset = foffset+pvalues[4].vlength;
11665             pvalues[5].vvalue = tvb_get_letohl(tvb, foffset);
11666             pvalues[5].vtype = VTYPE_MULTIVALUE_UINT32;
11667             pvalues[5].vdesc = "Iterator: 0x%08x";
11668             pvalues[5].vlength = 4;
11669             pvalues[5].voffset = foffset;
11670             pvalues[5].hfname= hf_nds_iterator;
11671             pvalues[5].mvtype = MVTYPE_PROCESS_ITERATOR;
11672             foffset = foffset+pvalues[5].vlength;
11673             break;
11674         default:
11675             pvalues[0].vtype = VTYPE_NONE; /* Not Defined */
11676             break;
11677         }
11678     }
11679     /* Fill in the INFO column. */
11680     if (check_col(pinfo->cinfo, COL_INFO)) {
11681         if (ncp_rec) {
11682             col_set_str(pinfo->cinfo, COL_PROTOCOL, "NDS");
11683             if (nds_frag != 0xffffffff) {
11684                 col_add_fstr(pinfo->cinfo, COL_INFO, "C Continue NDS Fragment 0x%08x", nds_frag);
11685             }
11686             else {
11687                 col_add_fstr(pinfo->cinfo, COL_INFO, "C NDS %s", verb_string);
11688             }
11689             run_info_str = TRUE;
11690         }
11691         else {
11692             col_add_fstr(pinfo->cinfo, COL_INFO,
11693                          "C Unknown Function %d (0x%02x)",
11694                          func, func);
11695         }
11696
11697     }
11698     /* Keep track of the address and connection whence the request
11699        came, and the address and connection to which the request
11700        is being sent, so that we can match up calls with replies.
11701        (We don't include the sequence number, as we may want
11702        to have all packets over the same connection treated
11703        as being part of a single conversation so that we can
11704        let the user select that conversation to be displayed.) */
11705
11706     conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst,
11707                                      PT_NCP, nw_connection, nw_connection, 0);
11708     if (conversation == NULL) {
11709         /* It's not part of any conversation - create a new one. */
11710         conversation = conversation_new(pinfo->fd->num, &pinfo->src, &pinfo->dst,
11711                                         PT_NCP, nw_connection, nw_connection, 0);
11712     }
11713
11714     if (!pinfo->fd->flags.visited) {
11715         request_value = ncp_hash_insert(conversation, sequence, ncp_rec);
11716         request_value->req_frame_num = pinfo->fd->num;
11717         request_value->req_frame_time=pinfo->fd->abs_ts;
11718
11719         /* If this is the first time we're examining the packet,
11720          * check to see if this NCP type uses a "request condition".
11721          * If so, we have to build a proto_tree because request conditions
11722          * use display filters to work, and without a proto_tree,
11723          * display filters can't possibly work. If we already have
11724          * a proto_tree, then wonderful. If we don't, we need to build
11725          * one. */
11726         if (ncp_rec && !ncp_tree) {
11727             run_req_cond = TRUE;
11728         }
11729         /* Keep track of the Fragment number in the request for defrag logic */
11730         request_value->nds_frag_num = nds_frag;
11731     }
11732
11733     /* If we have to handle a request condition, or have to
11734        add to the Info column, we need to construct a protocol
11735        tree.  If we already have a proto_tree, then wonderful.
11736        If we don't, we need to build one. */
11737     if ((run_info_str || run_req_cond) && !ncp_tree) {
11738         proto_item *ti;
11739
11740         temp_tree = proto_tree_create_root();
11741         proto_tree_set_visible(temp_tree, FALSE);
11742         ti = proto_tree_add_item(temp_tree, proto_ncp, tvb, 0, -1, FALSE);
11743         ncp_tree = proto_item_add_subtree(ti, ett_ncp);
11744     }
11745
11746     if (ncp_tree) {
11747         /* If the dissection throws an exception, be sure to free
11748          * the temporary proto_tree that was created. Because of the
11749          * way the CLEANUP_PUSH macro works, we can't put it in an 'if'
11750          * block; it has to be in the same scope as the terminating
11751          * CLEANUP_POP or CLEANUP_POP_AND_ALLOC. So, we always
11752          * call CLEANUP_POP and friends, but the value of temp_tree is
11753          * NULL if no cleanup is needed, and non-null if cleanup is needed.
11754          */
11755         CLEANUP_PUSH(free_proto_tree, temp_tree);
11756
11757 #ifdef FAKE_TREE_IS_VISIBLE
11758         PTREE_DATA(ncp_tree)->visible=1;
11759 #endif
11760
11761         request_value = ncp_hash_lookup(conversation, sequence);
11762         switch (type) {
11763         case NCP_BROADCAST_SLOT:
11764             ; /* nothing */
11765             break;
11766
11767         case NCP_SERVICE_REQUEST:
11768
11769             ptvc = ptvcursor_new(ncp_tree, tvb, 7);
11770             if (ncp_rec && ncp_rec->request_ptvc)
11771             {
11772                 clear_repeat_vars();
11773                 process_ptvc_record(ptvc, ncp_rec->request_ptvc, NULL, TRUE, ncp_rec);
11774             }
11775             proto_tree_add_uint_format(ncp_tree, hf_ncp_func, tvb, 6, 1,
11776                                        func, "Function: %d (0x%02X), %s",
11777                                        func, func, ncp_rec ? ncp_rec->name : "Unknown");
11778
11779             proto_tree_add_uint_format(ncp_tree, hf_ncp_subfunc, tvb, 7, 1,
11780                                        subfunc, "SubFunction: %d (0x%02x)",
11781                                        subfunc, subfunc);
11782
11783             proto_tree_add_uint(ncp_tree, hf_ncp_fragment_handle, tvb, 8, 4,
11784                                 nds_frag);
11785
11786             if (nds_frag == 0xffffffff) {
11787
11788                 proto_tree_add_item(ncp_tree, hf_ncp_fragment_size, tvb, 12, 4, TRUE);
11789
11790                 proto_tree_add_item(ncp_tree, hf_ncp_message_size, tvb, 16, 4, TRUE);
11791
11792                 nds_prot_flags = tvb_get_letohs(tvb, 22);
11793                 prot_flags[0].vvalue = nds_prot_flags;
11794                 prot_flags[0].vtype = VTYPE_BITFIELD;
11795                 prot_flags[0].vdesc = "NDS Protocol Flags:";
11796                 prot_flags[0].vlength = 2;
11797                 prot_flags[0].hfname= hf_ncp_nds_flag;
11798                 prot_flags[0].voffset = 22;
11799                 prot_flags[0].bit1 = "Not Defined";
11800                 prot_flags[0].bit1hfname = hf_ndsprot1flag;
11801                 prot_flags[0].bit2 = "Not Defined";
11802                 prot_flags[0].bit2hfname = hf_ndsprot2flag;
11803                 prot_flags[0].bit3 = "Not Defined";
11804                 prot_flags[0].bit3hfname = hf_ndsprot3flag;
11805                 prot_flags[0].bit4 = "Not Defined";
11806                 prot_flags[0].bit4hfname = hf_ndsprot4flag;
11807                 prot_flags[0].bit5 = "Not Defined";
11808                 prot_flags[0].bit5hfname = hf_ndsprot5flag;
11809                 prot_flags[0].bit6 = "Not Defined";
11810                 prot_flags[0].bit6hfname = hf_ndsprot6flag;
11811                 prot_flags[0].bit7 = "Not Defined";
11812                 prot_flags[0].bit7hfname = hf_ndsprot7flag;
11813                 prot_flags[0].bit8 = "Not Defined";
11814                 prot_flags[0].bit8hfname = hf_ndsprot8flag;
11815                 prot_flags[0].bit9 = "Not Defined";
11816                 prot_flags[0].bit9hfname = hf_ndsprot9flag;
11817                 prot_flags[0].bit10 = "Not Defined";
11818                 prot_flags[0].bit10hfname = hf_ndsprot10flag;
11819                 prot_flags[0].bit11= "Not Defined";
11820                 prot_flags[0].bit11hfname = hf_ndsprot11flag;
11821                 prot_flags[0].bit12 = "Not Defined";
11822                 prot_flags[0].bit12hfname = hf_ndsprot12flag;
11823                 prot_flags[0].bit13 = "Not Defined";
11824                 prot_flags[0].bit13hfname = hf_ndsprot13flag;
11825                 prot_flags[0].bit14 = "Not Defined";
11826                 prot_flags[0].bit14hfname = hf_ndsprot14flag;
11827                 prot_flags[0].bit15 = "Include CRC in NDS Header";
11828                 prot_flags[0].bit15hfname = hf_ndsprot15flag;
11829                 prot_flags[0].bit16 = "Client is a Server";
11830                 prot_flags[0].bit16hfname = hf_ndsprot16flag;
11831
11832                 process_bitfield(ncp_tree, tvb, &prot_flags[0]);
11833
11834                 if (nds_version == 0) {
11835                     proto_tree_add_uint_format(ncp_tree, hf_ncp_nds_verb, tvb, 24, 4,
11836                                                nds_verb, "NDS Verb: %d, (0x%02x), %s",
11837                                                nds_verb, nds_verb, verb_string);
11838                 }
11839                 else {
11840                     proto_tree_add_uint_format(ncp_tree, hf_ncp_nds_verb, tvb, 32, 4,
11841                                                nds_verb, "NDS Verb: %d, (0x%02x), %s",
11842                                                nds_verb, nds_verb, verb_string);
11843                 }
11844                 added_arrow = FALSE;
11845                 for (i = 0; i < 9; i++) {
11846                     switch (pvalues[i].vtype) {
11847
11848                     case VTYPE_NONE: /* no value */
11849                         break;
11850
11851                     case VTYPE_UINT8:
11852                         proto_tree_add_uint_format(ncp_tree, pvalues[i].hfname, tvb, pvalues[i].voffset,
11853                                                    pvalues[i].vlength, pvalues[i].vtype, "NDS Parameter not defined %u",
11854                                                    pvalues[i].vtype);
11855                         break;
11856
11857                     case VTYPE_UINT16:
11858                         proto_tree_add_uint_format(ncp_tree, pvalues[i].hfname, tvb, pvalues[i].voffset,
11859                                                    pvalues[i].vlength, pvalues[i].vtype, "NDS Parameter not defined %u",
11860                                                    pvalues[i].vtype);
11861                         break;
11862
11863                     case VTYPE_UINT32:
11864                         proto_tree_add_uint_format(ncp_tree, pvalues[i].hfname, tvb, pvalues[i].voffset,
11865                                                    pvalues[i].vlength, pvalues[i].vvalue, pvalues[i].vdesc,
11866                                                    pvalues[i].vvalue);
11867                         break;
11868
11869                     case VTYPE_STRING:
11870                         proto_tree_add_string_format(ncp_tree, pvalues[i].hfname, tvb, pvalues[i].voffset,
11871                                                      pvalues[i].vlength, pvalues[i].vstring, pvalues[i].vdesc, pvalues[i].vstring);
11872                         if (pvalues[i].mvtype == MVTYPE_ATTR_REQUEST) {
11873                             /*
11874                              * The "vstring" value is set to the input ES type
11875                              * for MVTYPE_PROC_ENTRY_SPECIFIERS,
11876                              * to add string to columninfo
11877                              */
11878                             if (check_col(pinfo->cinfo, COL_INFO)) {
11879                                 if (!added_arrow) {
11880                                     col_append_str(pinfo->cinfo, COL_INFO, " -> ");
11881                                     added_arrow = TRUE;
11882                                 }
11883                                 col_append_str(pinfo->cinfo, COL_INFO, pvalues[i].vstring);
11884                             }
11885                         }
11886                         break;
11887
11888                     case VTYPE_BITFIELD:
11889                         process_bitfield(ncp_tree, tvb, &pvalues[i]);
11890                         break;
11891
11892                     case VTYPE_MULTIVALUE_UINT32:
11893                         process_multivalues(ncp_tree, tvb, pinfo, &pvalues[i]);
11894                         if (pvalues[i].mvtype == MVTYPE_PROC_ENTRY_SPECIFIERS) {
11895                             /*
11896                              * The "vstring" value is set to the input ES type
11897                              * by "process_multivalues()".
11898                              */
11899                             g_strlcpy(global_object_name, mv_resolve_name_string, 256);
11900                         }
11901                         if (pvalues[i].mvtype == MVTYPE_ATTR_REQUEST || pvalues[i].mvtype == MVTYPE_PROC_ENTRY_SPECIFIERS || pvalues[i].mvtype == MVTYPE_PROCESS_ITERATOR) {
11902                             /*
11903                              * The "vstring" value is set to the input ES type
11904                              * for MVTYPE_PROC_ENTRY_SPECIFIERS,
11905                              * and the last string for MVTYPE_ATTR_REQUEST,
11906                              * by "process_multivalues()".
11907                              */
11908                             if (check_col(pinfo->cinfo, COL_INFO)) {
11909                                 col_append_str(pinfo->cinfo, COL_INFO, pvalues[i].vstring);
11910                                 if (pvalues[i].mvtype != MVTYPE_PROCESS_ITERATOR) {
11911                                     if (!added_arrow) {
11912                                         col_append_str(pinfo->cinfo, COL_INFO, " -> ");
11913                                         added_arrow = TRUE;
11914                                     }
11915                                     col_append_str(pinfo->cinfo, COL_INFO, mv_resolve_name_string);
11916                                 }
11917                             }
11918                         }
11919                         break;
11920
11921                     case VTYPE_BYTES:
11922                         proto_tree_add_bytes(ncp_tree, pvalues[i].hfname, tvb, pvalues[i].voffset,
11923                                              pvalues[i].vlength, tvb_get_ptr(tvb, pvalues[i].voffset, pvalues[i].vvalue));
11924                         break;
11925
11926                     case VTYPE_BOOLEAN:
11927                         proto_tree_add_item(ncp_tree, pvalues[i].hfname, tvb, pvalues[i].voffset, pvalues[i].vlength, TRUE);
11928                         break;
11929
11930                     default:
11931                         proto_tree_add_uint_format(ncp_tree, hf_nds_p1type, tvb, pvalues[i].voffset,
11932                                                    pvalues[i].vlength, pvalues[i].vtype, "NDS Parameter not defined %u",
11933                                                    pvalues[i].vtype);
11934                         break;
11935                     }
11936                 }
11937                 /* For NDS requests with just an EID, resolve name from hash table. */
11938                 request_eid_value = ncp_eid_hash_lookup(conversation, global_eid);
11939                 if(resolve_eid) {
11940                     if (request_eid_value) {
11941                         g_strlcpy(global_object_name, request_eid_value->object_name, 256);
11942                         if (check_col(pinfo->cinfo, COL_INFO))
11943                         {
11944                             col_append_str(pinfo->cinfo, COL_INFO, ", Object Name - ");
11945                             col_append_str(pinfo->cinfo, COL_INFO, global_object_name);
11946                         }
11947                     }
11948                 }
11949                 if (request_value)
11950                 {
11951                     request_value->nds_request_verb = nds_verb;
11952                     request_value->nds_version = nds_version;
11953                     g_strlcpy(request_value->object_name, global_object_name, 256);
11954                     request_value->req_nds_flags = global_flags;
11955                     request_value->req_nds_prot_flags = nds_prot_flags;
11956                 }
11957             }
11958             break;
11959
11960         default:
11961             ; /* nothing */
11962             break;
11963         }
11964         ptvcursor_free(ptvc);
11965
11966         /* Free the temporary proto_tree */
11967         CLEANUP_CALL_AND_POP;
11968     }
11969 }
11970
11971 /*
11972  * XXX - this duplicates stuff in "dissect_ncp_request()"; could
11973  * "dissect_ncp_request()" not just call "dissect_ping_req()" if
11974  * the operation is an NCP ping, and "dissect_ping_req()" just dissect
11975  * ping portion?
11976  */
11977 void
11978 dissect_ping_req(tvbuff_t *tvb, packet_info *pinfo,
11979                  guint32 nw_connection, guint8 sequence,
11980                  guint16 type, proto_tree *ncp_tree)
11981 {
11982     guint8               func, subfunc = 0;
11983     ncp_req_hash_value  *request_value = NULL;
11984     const ncp_record    *ncp_rec = NULL;
11985     conversation_t      *conversation;
11986     ptvcursor_t         *ptvc = NULL;
11987     proto_tree          *temp_tree = NULL;
11988     gint                 length_remaining = 0;
11989     guint32              nds_flags;
11990     guint32              ping_version;
11991     nds_val              pvalue;
11992
11993 #ifdef FAKE_TREE_IS_VISIBLE
11994     if (ncp_tree) {
11995         PTREE_DATA(ncp_tree)->visible=1;
11996     }
11997 #endif
11998
11999     pvalue.vvalue = 0;
12000     pvalue.vlength = 0;
12001     pvalue.voffset = 0;
12002     pvalue.hfname = 0;
12003     pvalue.vdesc = "";
12004     pvalue.vstring = NULL;
12005     pvalue.mvtype = 0;
12006
12007     func = tvb_get_guint8(tvb, 6);
12008     subfunc = tvb_get_guint8(tvb, 7);
12009
12010     ncp_rec = ncp_record_find(func, subfunc);
12011
12012     /* Fill in the INFO column. */
12013     if (ncp_rec)
12014     {
12015         col_set_str(pinfo->cinfo, COL_PROTOCOL, "NDS");
12016
12017         col_set_str(pinfo->cinfo, COL_INFO, "C Ping for NDS");
12018
12019     }
12020     if (!pinfo->fd->flags.visited)
12021     {
12022
12023         /* This is the first time we've looked at this packet.
12024            Keep track of the address and connection whence the request
12025            came, and the address and connection to which the request
12026            is being sent, so that we can match up calls with replies.
12027            (We don't include the sequence number, as we may want
12028            to have all packets over the same connection treated
12029            as being part of a single conversation so that we can
12030            let the user select that conversation to be displayed.) */
12031
12032         conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst,
12033                                          PT_NCP, nw_connection, nw_connection, 0);
12034
12035         if (conversation == NULL)
12036         {
12037             /* It's not part of any conversation - create a new one. */
12038             conversation = conversation_new(pinfo->fd->num, &pinfo->src, &pinfo->dst,
12039                                             PT_NCP, nw_connection, nw_connection, 0);
12040         }
12041
12042         request_value = ncp_hash_insert(conversation, sequence, ncp_rec);
12043         request_value->req_frame_num = pinfo->fd->num;
12044         request_value->req_frame_time=pinfo->fd->abs_ts;
12045
12046         /* If this is the first time we're examining the packet,
12047          * check to see if this NCP type uses a "request condition".
12048          * If so, we have to build a proto_tree because request conditions
12049          * use display filters to work, and without a proto_tree,
12050          * display filters can't possibly work. If we already have
12051          * a proto_tree, then wonderful. If we don't, we need to build
12052          * one. */
12053         if (ncp_rec && !ncp_tree) {
12054             proto_item *ti;
12055
12056             temp_tree = proto_tree_create_root();
12057             proto_tree_set_visible(temp_tree, FALSE);
12058             ti = proto_tree_add_item(temp_tree, proto_ncp, tvb, 0, -1, FALSE);
12059             ncp_tree = proto_item_add_subtree(ti, ett_ncp);
12060         }
12061     }
12062
12063     if (ncp_tree) {
12064         /* If the dissection throws an exception, be sure to free
12065          * the temporary proto_tree that was created. Because of the
12066          * way the CLEANUP_PUSH macro works, we can't put it in an 'if'
12067          * block; it has to be in the same scope as the terminating
12068          * CLEANUP_POP or CLEANUP_POP_AND_ALLOC. So, we always
12069          * call CLEANUP_POP and friends, but the value of temp_tree is
12070          * NULL if no cleanup is needed, and non-null if cleanup is needed.
12071          */
12072         CLEANUP_PUSH(free_proto_tree, temp_tree);
12073
12074         switch (type) {
12075
12076         case NCP_BROADCAST_SLOT:
12077             ; /* nothing */
12078             break;
12079
12080         case NCP_SERVICE_REQUEST:
12081             proto_tree_add_uint_format(ncp_tree, hf_ncp_func, tvb, 6, 1,
12082                                        func, "Function: %u (0x%02X), %s",
12083                                        func, func, ncp_rec ? ncp_rec->name : "Unknown");
12084
12085             proto_tree_add_uint_format(ncp_tree, hf_ncp_subfunc, tvb, 7, 1,
12086                                        subfunc, "SubFunction: %u (0x%02x)",
12087                                        subfunc, subfunc);
12088
12089             length_remaining = tvb_reported_length_remaining(tvb, 8);
12090
12091             if (length_remaining >= 8) {
12092                 proto_item *pi;
12093
12094                 ping_version = tvb_get_letohl(tvb, 8);
12095                 proto_tree_add_uint(ncp_tree, hf_nds_ping_version, tvb, 8,
12096                                     4, ping_version);
12097                 nds_flags = tvb_get_letohl(tvb, 12);
12098                 if (request_value){
12099                     request_value->nds_request_verb = 0xf0;
12100                     request_value->req_nds_flags = nds_flags;
12101                 }
12102
12103                 pi = proto_tree_add_uint(ncp_tree, hf_ncp_nds_verb, tvb, 0, 0, 240);
12104                 PROTO_ITEM_SET_HIDDEN(pi);
12105
12106                 pvalue.vvalue = tvb_get_letohs(tvb, 12);
12107                 pvalue.vtype = VTYPE_BITFIELD;
12108                 pvalue.vstring = "";
12109                 pvalue.vdesc = "Ping (low) Request Flags:";
12110                 pvalue.vlength = 2;
12111                 pvalue.hfname= hf_nds_rflags;
12112                 pvalue.voffset = 12;
12113                 pvalue.bit1 = "Supported Fields";   /* 0x0001 */
12114                 pvalue.bit1hfname = hf_bit1pingflags1;
12115                 pvalue.bit2 = "Depth";              /* 0x0002 */
12116                 pvalue.bit2hfname = hf_bit2pingflags1;
12117                 pvalue.bit3 = "Build Number";       /* 0x0004 */
12118                 pvalue.bit3hfname = hf_bit3pingflags1;
12119                 pvalue.bit4 = "Flags";              /* 0x0008 */
12120                 pvalue.bit4hfname = hf_bit4pingflags1;
12121                 pvalue.bit5 = "Verification Flags"; /* 0x0010 */
12122                 pvalue.bit5hfname = hf_bit5pingflags1;
12123                 pvalue.bit6 = "Letter Version";     /* 0x0020 */
12124                 pvalue.bit6hfname = hf_bit6pingflags1;
12125                 pvalue.bit7 = "OS Version";         /* 0x0040 */
12126                 pvalue.bit7hfname = hf_bit7pingflags1;
12127                 pvalue.bit8 = "Not Defined";        /* 0x0080 */
12128                 pvalue.bit8hfname = hf_bit8pingflags1;
12129                 pvalue.bit9 = "License Flags";      /* 0x0100 */
12130                 pvalue.bit9hfname = hf_bit9pingflags1;
12131                 pvalue.bit10 = "DS Time";           /* 0x0200 */
12132                 pvalue.bit10hfname = hf_bit10pingflags1;
12133                 pvalue.bit11 = "Server Time";       /* 0x0400 */
12134                 pvalue.bit11hfname = hf_bit11pingflags1;
12135                 pvalue.bit12 = "Create Time";       /* 0x0800 */
12136                 pvalue.bit12hfname = hf_bit12pingflags1;
12137                 pvalue.bit13 = "Not Defined";
12138                 pvalue.bit13hfname = hf_bit13pingflags1;
12139                 pvalue.bit14 = "Not Defined";
12140                 pvalue.bit14hfname = hf_bit14pingflags1;
12141                 pvalue.bit15 = "Not Defined";
12142                 pvalue.bit15hfname = hf_bit15pingflags1;
12143                 pvalue.bit16 = "Not Defined";
12144                 pvalue.bit16hfname = hf_bit16pingflags1;
12145
12146                 process_bitfield(ncp_tree, tvb, &pvalue);
12147
12148                 pvalue.vvalue = tvb_get_letohs(tvb, 14);
12149                 pvalue.vtype = VTYPE_BITFIELD;
12150                 pvalue.vstring = "";
12151                 pvalue.vdesc = "Ping (high) Request Flags:";
12152                 pvalue.vlength = 2;
12153                 pvalue.hfname= hf_nds_rflags;
12154                 pvalue.voffset = 14;
12155                 pvalue.bit1 = "Sap Name";           /* 0x0001 */
12156                 pvalue.bit1hfname = hf_bit1pingflags2;
12157                 pvalue.bit2 = "Tree Name";          /* 0x0002 */
12158                 pvalue.bit2hfname = hf_bit2pingflags2;
12159                 pvalue.bit3 = "OS Name";            /* 0x0004 */
12160                 pvalue.bit3hfname = hf_bit3pingflags2;
12161                 pvalue.bit4 = "Hardware Name";      /* 0x0008 */
12162                 pvalue.bit4hfname = hf_bit4pingflags2;
12163                 pvalue.bit5 = "Vendor Name";        /* 0x0010 */
12164                 pvalue.bit5hfname = hf_bit5pingflags2;
12165                 pvalue.bit6 = "Not Defined";
12166                 pvalue.bit6hfname = hf_bit6pingflags2;
12167                 pvalue.bit7 = "Not Defined";
12168                 pvalue.bit7hfname = hf_bit7pingflags2;
12169                 pvalue.bit8 = "Not Defined";
12170                 pvalue.bit8hfname = hf_bit8pingflags2;
12171                 pvalue.bit9 = "Not Defined";
12172                 pvalue.bit9hfname = hf_bit9pingflags2;
12173                 pvalue.bit10 = "Not Defined";
12174                 pvalue.bit10hfname = hf_bit10pingflags2;
12175                 pvalue.bit11 = "Not Defined";
12176                 pvalue.bit11hfname = hf_bit11pingflags2;
12177                 pvalue.bit12 = "Not Defined";
12178                 pvalue.bit12hfname = hf_bit12pingflags2;
12179                 pvalue.bit13 = "Not Defined";
12180                 pvalue.bit13hfname = hf_bit13pingflags2;
12181                 pvalue.bit14 = "Not Defined";
12182                 pvalue.bit14hfname = hf_bit14pingflags2;
12183                 pvalue.bit15 = "Not Defined";
12184                 pvalue.bit15hfname = hf_bit15pingflags2;
12185                 pvalue.bit16 = "Not Defined";
12186                 pvalue.bit16hfname = hf_bit16pingflags2;
12187
12188                 process_bitfield(ncp_tree, tvb, &pvalue);
12189             }
12190             break;
12191
12192         default:
12193             ; /* nothing */
12194             break;
12195         }
12196         ptvc = ptvcursor_new(ncp_tree, tvb, 7);
12197         if (ncp_rec && ncp_rec->request_ptvc) {
12198             clear_repeat_vars();
12199             process_ptvc_record(ptvc, ncp_rec->request_ptvc, NULL, TRUE, ncp_rec);
12200         }
12201         ptvcursor_free(ptvc);
12202
12203         /* Free the temporary proto_tree */
12204         CLEANUP_CALL_AND_POP;
12205     }
12206 }
12207