packet-dcerpc-lsa.c

   1 /* packet-dcerpc-lsa.c
   2  * Routines for SMB \PIPE\lsarpc packet disassembly
   3  * Copyright 2001, Tim Potter <tpot@samba.org>
   4  *  2002  Added LSA command dissectors  Ronnie Sahlberg
   5  *
   6  * $Id: packet-dcerpc-lsa.c,v 1.30 2002/04/29 06:15:31 sahlberg Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <string.h>
  33
  34 #include <epan/packet.h>
  35 #include "packet-dcerpc.h"
  36 #include "packet-dcerpc-nt.h"
  37 #include "packet-dcerpc-lsa.h"
  38 #include "packet-smb-common.h"
  39 #include "smb.h"
  40
  41 static int proto_dcerpc_lsa = -1;
  42
  43 static int hf_lsa_rc = -1;
  44 static int hf_lsa_hnd = -1;
  45 static int hf_lsa_server = -1;
  46 static int hf_lsa_controller = -1;
  47 static int hf_lsa_obj_attr = -1;
  48 static int hf_lsa_obj_attr_len = -1;
  49 static int hf_lsa_obj_attr_name = -1;
  50 static int hf_lsa_access_mask = -1;
  51 static int hf_lsa_info_level = -1;
  52 static int hf_lsa_trusted_info_level = -1;
  53 static int hf_lsa_sd_size = -1;
  54 static int hf_lsa_qos_len = -1;
  55 static int hf_lsa_qos_impersonation_level = -1;
  56 static int hf_lsa_qos_track_context = -1;
  57 static int hf_lsa_qos_effective_only = -1;
  58 static int hf_lsa_pali_percent_full = -1;
  59 static int hf_lsa_pali_log_size = -1;
  60 static int hf_lsa_pali_retention_period = -1;
  61 static int hf_lsa_pali_time_to_shutdown = -1;
  62 static int hf_lsa_pali_shutdown_in_progress = -1;
  63 static int hf_lsa_pali_next_audit_record = -1;
  64 static int hf_lsa_paei_enabled = -1;
  65 static int hf_lsa_paei_settings = -1;
  66 static int hf_lsa_count = -1;
  67 static int hf_lsa_size = -1;
  68 static int hf_lsa_max_count = -1;
  69 static int hf_lsa_index = -1;
  70 static int hf_lsa_domain = -1;
  71 static int hf_lsa_acct = -1;
  72 static int hf_lsa_server_role = -1;
  73 static int hf_lsa_source = -1;
  74 static int hf_lsa_quota_paged_pool = -1;
  75 static int hf_lsa_quota_non_paged_pool = -1;
  76 static int hf_lsa_quota_min_wss = -1;
  77 static int hf_lsa_quota_max_wss = -1;
  78 static int hf_lsa_quota_pagefile = -1;
  79 static int hf_lsa_mod_seq_no = -1;
  80 static int hf_lsa_mod_mtime = -1;
  81 static int hf_lsa_cur_mtime = -1;
  82 static int hf_lsa_old_mtime = -1;
  83 static int hf_lsa_name = -1;
  84 static int hf_lsa_flat_name = -1;
  85 static int hf_lsa_forest = -1;
  86 static int hf_lsa_info_type = -1;
  87 static int hf_lsa_old_pwd = -1;
  88 static int hf_lsa_new_pwd = -1;
  89 static int hf_lsa_sid_type = -1;
  90 static int hf_lsa_rid = -1;
  91 static int hf_lsa_rid_offset = -1;
  92 static int hf_lsa_num_mapped = -1;
  93 static int hf_lsa_policy_information_class = -1;
  94 static int hf_lsa_secret = -1;
  95 static int hf_nt_luid_high = -1;
  96 static int hf_nt_luid_low = -1;
  97 static int hf_lsa_privilege_name = -1;
  98 static int hf_lsa_attr = -1;
  99 static int hf_lsa_resume_handle = -1;
 100 static int hf_lsa_trust_direction = -1;
 101 static int hf_lsa_trust_type = -1;
 102 static int hf_lsa_trust_attr = -1;
 103 static int hf_lsa_trust_attr_non_trans = -1;
 104 static int hf_lsa_trust_attr_uplevel_only = -1;
 105 static int hf_lsa_trust_attr_tree_parent = -1;
 106 static int hf_lsa_trust_attr_tree_root = -1;
 107 static int hf_lsa_auth_update = -1;
 108 static int hf_lsa_auth_type = -1;
 109 static int hf_lsa_auth_len = -1;
 110 static int hf_lsa_auth_blob = -1;
 111 static int hf_lsa_rights = -1;
 112
 113 static int hf_lsa_unknown_hyper = -1;
 114 static int hf_lsa_unknown_long = -1;
 115 static int hf_lsa_unknown_short = -1;
 116 static int hf_lsa_unknown_char = -1;
 117 static int hf_lsa_unknown_string = -1;
 118 static int hf_lsa_unknown_time = -1;
 119
 120
 121 static gint ett_dcerpc_lsa = -1;
 122 static gint ett_lsa_OBJECT_ATTRIBUTES = -1;
 123 static gint ett_LSA_SECURITY_DESCRIPTOR = -1;
 124 static gint ett_lsa_policy_info = -1;
 125 static gint ett_lsa_policy_audit_log_info = -1;
 126 static gint ett_lsa_policy_audit_events_info = -1;
 127 static gint ett_lsa_policy_primary_domain_info = -1;
 128 static gint ett_lsa_policy_primary_account_info = -1;
 129 static gint ett_lsa_policy_server_role_info = -1;
 130 static gint ett_lsa_policy_replica_source_info = -1;
 131 static gint ett_lsa_policy_default_quota_info = -1;
 132 static gint ett_lsa_policy_modification_info = -1;
 133 static gint ett_lsa_policy_audit_full_set_info = -1;
 134 static gint ett_lsa_policy_audit_full_query_info = -1;
 135 static gint ett_lsa_policy_dns_domain_info = -1;
 136 static gint ett_lsa_translated_names = -1;
 137 static gint ett_lsa_translated_name = -1;
 138 static gint ett_lsa_referenced_domain_list = -1;
 139 static gint ett_lsa_trust_information = -1;
 140 static gint ett_lsa_trust_information_ex = -1;
 141 static gint ett_LUID = -1;
 142 static gint ett_LSA_PRIVILEGES = -1;
 143 static gint ett_LSA_PRIVILEGE = -1;
 144 static gint ett_LSA_LUID_AND_ATTRIBUTES_ARRAY = -1;
 145 static gint ett_LSA_LUID_AND_ATTRIBUTES = -1;
 146 static gint ett_LSA_TRUSTED_DOMAIN_LIST = -1;
 147 static gint ett_LSA_TRUSTED_DOMAIN = -1;
 148 static gint ett_LSA_TRANSLATED_SIDS = -1;
 149 static gint ett_lsa_trusted_domain_info = -1;
 150 static gint ett_lsa_trust_attr = -1;
 151 static gint ett_lsa_trusted_domain_auth_information = -1;
 152 static gint ett_lsa_auth_information = -1;
 153
 154
 155 static int
 156 lsa_dissect_pointer_NTTIME(tvbuff_t *tvb, int offset,
 157                              packet_info *pinfo, proto_tree *tree,
 158                              char *drep)
 159 {
 160         dcerpc_info *di;
 161
 162         di=pinfo->private_data;
 163         if(di->conformant_run){
 164                 /*just a run to handle conformant arrays, nothing to dissect */
 165                 return offset;
 166         }
 167
 168         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 169                 di->hf_index);
 170
 171         return offset;
 172 }
 173
 174 static int
 175 lsa_dissect_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
 176                              packet_info *pinfo, proto_tree *tree,
 177                              char *drep)
 178 {
 179         dcerpc_info *di;
 180
 181         di=pinfo->private_data;
 182         if(di->conformant_run){
 183                 /*just a run to handle conformant arrays, nothing to dissect */
 184                 return offset;
 185         }
 186
 187         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 188                         di->hf_index, di->levels);
 189         return offset;
 190 }
 191
 192 static int
 193 lsa_dissect_pointer_STRING(tvbuff_t *tvb, int offset,
 194                              packet_info *pinfo, proto_tree *tree,
 195                              char *drep)
 196 {
 197         dcerpc_info *di;
 198
 199         di=pinfo->private_data;
 200         if(di->conformant_run){
 201                 /*just a run to handle conformant arrays, nothing to dissect */
 202                 return offset;
 203         }
 204
 205         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 206                         di->hf_index, di->levels);
 207         return offset;
 208 }
 209
 210
 211 static int
 212 lsa_dissect_LSA_SECRET_data(tvbuff_t *tvb, int offset,
 213                              packet_info *pinfo, proto_tree *tree,
 214                              char *drep)
 215 {
 216         guint32 len;
 217         dcerpc_info *di;
 218
 219         di=pinfo->private_data;
 220         if(di->conformant_run){
 221                 /*just a run to handle conformant arrays, nothing to dissect */
 222                 return offset;
 223         }
 224
 225         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 226                                      hf_lsa_sd_size, &len);
 227         proto_tree_add_item(tree, hf_lsa_secret, tvb, offset, len, FALSE);
 228         offset += len;
 229
 230         return offset;
 231 }
 232 int
 233 lsa_dissect_LSA_SECRET(tvbuff_t *tvb, int offset,
 234                         packet_info *pinfo, proto_tree *parent_tree,
 235                         char *drep)
 236 {
 237         proto_item *item=NULL;
 238         proto_tree *tree=NULL;
 239         int old_offset=offset;
 240
 241         if(parent_tree){
 242                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 243                         "LSA_SECRET:");
 244                 tree = proto_item_add_subtree(item, ett_LSA_SECURITY_DESCRIPTOR);
 245         }
 246
 247         /* XXX need to figure this one out */
 248         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 249                                      hf_lsa_sd_size, NULL);
 250         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 251                         lsa_dissect_LSA_SECRET_data, NDR_POINTER_UNIQUE,
 252                         "LSA SECRET data:", -1, 0);
 253
 254         proto_item_set_len(item, offset-old_offset);
 255         return offset;
 256 }
 257
 258 static int
 259 lsa_dissect_LSA_SECURITY_DESCRIPTOR_data(tvbuff_t *tvb, int offset,
 260                              packet_info *pinfo, proto_tree *tree,
 261                              char *drep)
 262 {
 263         guint32 len;
 264         dcerpc_info *di;
 265
 266         di=pinfo->private_data;
 267         if(di->conformant_run){
 268                 /*just a run to handle conformant arrays, nothing to dissect */
 269                 return offset;
 270         }
 271
 272         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 273                                      hf_lsa_sd_size, &len);
 274
 275         dissect_nt_sec_desc(tvb, pinfo, offset, tree, len);
 276         offset += len;
 277
 278         return offset;
 279 }
 280 int
 281 lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvbuff_t *tvb, int offset,
 282                         packet_info *pinfo, proto_tree *parent_tree,
 283                         char *drep)
 284 {
 285         proto_item *item=NULL;
 286         proto_tree *tree=NULL;
 287         int old_offset=offset;
 288
 289         if(parent_tree){
 290                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 291                         "LSA_SECURITY_DESCRIPTOR:");
 292                 tree = proto_item_add_subtree(item, ett_LSA_SECURITY_DESCRIPTOR);
 293         }
 294
 295         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 296                                     hf_lsa_sd_size, NULL);
 297
 298         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 299                         lsa_dissect_LSA_SECURITY_DESCRIPTOR_data, NDR_POINTER_UNIQUE,
 300                         "LSA SECURITY DESCRIPTOR data:", -1, 0);
 301
 302         proto_item_set_len(item, offset-old_offset);
 303         return offset;
 304 }
 305
 306 static int
 307 lsa_dissect_LPSTR(tvbuff_t *tvb, int offset,
 308         packet_info *pinfo, proto_tree *tree, char *drep)
 309 {
 310         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 311                         hf_lsa_unknown_char, NULL);
 312
 313         return offset;
 314 }
 315
 316 static const value_string lsa_impersonation_level_vals[] = {
 317         {0,     "Anonymous"},
 318         {1,     "Identification"},
 319         {2,     "Impersonation"},
 320         {3,     "Delegation"},
 321         {0, NULL}
 322 };
 323
 324
 325 static int
 326 lsa_dissect_SECURITY_QUALITY_OF_SERVICE(tvbuff_t *tvb, int offset,
 327         packet_info *pinfo, proto_tree *tree, char *drep)
 328 {
 329         /* Length */
 330         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 331                         hf_lsa_qos_len, NULL);
 332
 333         /* impersonation level */
 334         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 335                         hf_lsa_qos_impersonation_level, NULL);
 336
 337         /* context tracking mode */
 338         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 339                         hf_lsa_qos_track_context, NULL);
 340
 341         /* effective only */
 342         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 343                         hf_lsa_qos_effective_only, NULL);
 344
 345         return offset;
 346 }
 347
 348 static int
 349 lsa_dissect_ACCESS_MASK(tvbuff_t *tvb, int offset,
 350         packet_info *pinfo, proto_tree *tree, char *drep)
 351 {
 352         /* XXX is this some bitmask ?*/
 353         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 354                         hf_lsa_access_mask, NULL);
 355
 356         return offset;
 357 }
 358
 359 static int
 360 lsa_dissect_LSA_HANDLE(tvbuff_t *tvb, int offset,
 361         packet_info *pinfo, proto_tree *tree, char *drep)
 362 {
 363         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 364                         hf_lsa_hnd, NULL);
 365
 366         return offset;
 367 }
 368
 369
 370 static int
 371 lsa_dissect_LSA_OBJECT_ATTRIBUTES(tvbuff_t *tvb, int offset,
 372         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 373 {
 374         int old_offset=offset;
 375         proto_item *item = NULL;
 376         proto_tree *tree = NULL;
 377
 378         if(parent_tree){
 379                 item = proto_tree_add_text(parent_tree, tvb, offset, -1, "Object Attributes");
 380                 tree = proto_item_add_subtree(item, ett_lsa_OBJECT_ATTRIBUTES);
 381         }
 382
 383         /* Length */
 384         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 385                         hf_lsa_obj_attr_len, NULL);
 386
 387         /* LPSTR */
 388         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 389                 lsa_dissect_LPSTR, NDR_POINTER_UNIQUE,
 390                 "LSPTR pointer: ", -1, 0);
 391
 392         /* attribute name */
 393         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 394                 lsa_dissect_pointer_STRING, NDR_POINTER_UNIQUE,
 395                 "NAME pointer: ", hf_lsa_obj_attr_name, 0);
 396
 397         /* Attr */
 398         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 399                         hf_lsa_obj_attr, NULL);
 400
 401         /* security descriptor */
 402         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 403                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
 404                 "LSA_SECURITY_DESCRIPTOR pointer: ", -1, 0);
 405
 406         /* security quality of service */
 407         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 408                 lsa_dissect_SECURITY_QUALITY_OF_SERVICE, NDR_POINTER_UNIQUE,
 409                 "LSA_SECURITY_QUALITY_OF_SERVICE pointer: ", -1, 0);
 410
 411         proto_item_set_len(item, offset-old_offset);
 412         return offset;
 413 }
 414
 415 static int
 416 lsa_dissect_lsaclose_rqst(tvbuff_t *tvb, int offset,
 417         packet_info *pinfo, proto_tree *tree, char *drep)
 418 {
 419         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 420                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
 421                 "LSA_HANDLE pointer: hnd", -1, 0);
 422         return offset;
 423 }
 424
 425
 426 static int
 427 lsa_dissect_lsaclose_reply(tvbuff_t *tvb, int offset,
 428         packet_info *pinfo, proto_tree *tree, char *drep)
 429 {
 430         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 431                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
 432                 "LSA_HANDLE pointer: hnd", -1, 0);
 433         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 434                 hf_lsa_rc, NULL);
 435
 436         return offset;
 437 }
 438
 439 /* A bug in the NT IDL for lsa openpolicy only stores the first (wide)
 440    character of the server name which is always '\'.  This is fixed in lsa
 441    openpolicy2 but the function remains for backwards compatibility. */
 442
 443 static int dissect_lsa_openpolicy_server(tvbuff_t *tvb, int offset,
 444                                              packet_info *pinfo,
 445                                              proto_tree *tree, char *drep)
 446 {
 447         return dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 448                                   hf_lsa_server, NULL);
 449 }
 450
 451 static int
 452 lsa_dissect_lsaopenpolicy_rqst(tvbuff_t *tvb, int offset,
 453         packet_info *pinfo, proto_tree *tree, char *drep)
 454 {
 455         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 456                 dissect_lsa_openpolicy_server, NDR_POINTER_UNIQUE,
 457                 "Server:", hf_lsa_server, 0);
 458
 459         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 460                 lsa_dissect_LSA_OBJECT_ATTRIBUTES, NDR_POINTER_REF,
 461                 "", -1, 0);
 462
 463         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
 464                 pinfo, tree, drep);
 465         return offset;
 466 }
 467
 468
 469 static int
 470 lsa_dissect_lsaopenpolicy_reply(tvbuff_t *tvb, int offset,
 471         packet_info *pinfo, proto_tree *tree, char *drep)
 472 {
 473         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 474                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
 475                 "LSA_HANDLE pointer: hnd", -1, 0);
 476         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 477                 hf_lsa_rc, NULL);
 478
 479         return offset;
 480 }
 481
 482 static int
 483 lsa_dissect_lsaopenpolicy2_rqst(tvbuff_t *tvb, int offset,
 484         packet_info *pinfo, proto_tree *tree, char *drep)
 485 {
 486         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 487                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 488                 "Server", hf_lsa_server, 0);
 489
 490         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 491                 lsa_dissect_LSA_OBJECT_ATTRIBUTES, NDR_POINTER_REF,
 492                 "", -1, 0);
 493
 494         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
 495                 pinfo, tree, drep);
 496         return offset;
 497 }
 498
 499
 500 static int
 501 lsa_dissect_lsaopenpolicy2_reply(tvbuff_t *tvb, int offset,
 502         packet_info *pinfo, proto_tree *tree, char *drep)
 503 {
 504         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 505                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
 506                 "LSA_HANDLE pointer: hnd", -1, 0);
 507         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 508                 hf_lsa_rc, NULL);
 509
 510         return offset;
 511 }
 512
 513 static const value_string policy_information_class_vals[] = {
 514         {1,     "Audit Log Information"},
 515         {2,     "Audit Events Information"},
 516         {3,     "Primary Domain Information"},
 517         {4,     "Pd Account Information"},
 518         {5,     "Account Domain Information"},
 519         {6,     "Server Role Information"},
 520         {7,     "Replica Source Information"},
 521         {8,     "Default Quota Information"},
 522         {9,     "Modification Information"},
 523         {10,    "Audit Full Set Information"},
 524         {11,    "Audit Full Query Information"},
 525         {12,    "DNS Domain Information"},
 526         {0, NULL}
 527 };
 528
 529 static int
 530 lsa_dissect_lsaqueryinformationpolicy_rqst(tvbuff_t *tvb, int offset,
 531         packet_info *pinfo, proto_tree *tree, char *drep)
 532 {
 533         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 534                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
 535                 "LSA_HANDLE pointer: hnd", -1, 0);
 536
 537         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 538                 hf_lsa_policy_information_class, NULL);
 539
 540         return offset;
 541 }
 542
 543 static int
 544 lsa_dissect_POLICY_AUDIT_LOG_INFO(tvbuff_t *tvb, int offset,
 545         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 546 {
 547         proto_item *item=NULL;
 548         proto_tree *tree=NULL;
 549         int old_offset=offset;
 550
 551         if(parent_tree){
 552                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 553                         "POLICY_AUDIT_LOG_INFO:");
 554                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_log_info);
 555         }
 556
 557         /* percent full */
 558         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 559                                      hf_lsa_pali_percent_full, NULL);
 560
 561         /* log size */
 562         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 563                                      hf_lsa_pali_log_size, NULL);
 564
 565         /* retention period */
 566         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 567                                 hf_lsa_pali_retention_period);
 568
 569         /* shutdown in progress */
 570         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 571                                      hf_lsa_pali_shutdown_in_progress, NULL);
 572
 573         /* time to shutdown */
 574         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 575                                 hf_lsa_pali_time_to_shutdown);
 576
 577         /* next audit record */
 578         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 579                                      hf_lsa_pali_next_audit_record, NULL);
 580
 581         proto_item_set_len(item, offset-old_offset);
 582         return offset;
 583 }
 584
 585 static int
 586 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings(tvbuff_t *tvb, int offset,
 587         packet_info *pinfo, proto_tree *tree, char *drep)
 588 {
 589         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 590                                      hf_lsa_paei_settings, NULL);
 591         return offset;
 592 }
 593
 594 static int
 595 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings_array(tvbuff_t *tvb, int offset,
 596         packet_info *pinfo, proto_tree *tree, char *drep)
 597 {
 598         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 599                 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings);
 600
 601         return offset;
 602 }
 603
 604 static int
 605 lsa_dissect_POLICY_AUDIT_EVENTS_INFO(tvbuff_t *tvb, int offset,
 606         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 607 {
 608         proto_item *item=NULL;
 609         proto_tree *tree=NULL;
 610         int old_offset=offset;
 611
 612         if(parent_tree){
 613                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 614                         "POLICY_AUDIT_EVENTS_INFO:");
 615                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_events_info);
 616         }
 617
 618         /* enabled */
 619         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 620                                      hf_lsa_paei_enabled, NULL);
 621
 622         /* settings */
 623         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 624                 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings_array, NDR_POINTER_UNIQUE,
 625                 "Settings", -1, 0);
 626
 627         /* count */
 628         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 629                                      hf_lsa_count, NULL);
 630
 631         proto_item_set_len(item, offset-old_offset);
 632         return offset;
 633 }
 634
 635
 636 static int
 637 lsa_dissect_POLICY_PRIMARY_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 638         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 639 {
 640         proto_item *item=NULL;
 641         proto_tree *tree=NULL;
 642         int old_offset=offset;
 643
 644         if(parent_tree){
 645                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 646                         "POLICY_PRIMARY_DOMAIN_INFO:");
 647                 tree = proto_item_add_subtree(item, ett_lsa_policy_primary_domain_info);
 648         }
 649
 650         /* domain */
 651         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 652                 hf_lsa_domain, 0);
 653
 654         /* sid */
 655         offset = dissect_ndr_nt_PSID(tvb, offset,
 656                 pinfo, tree, drep);
 657
 658         proto_item_set_len(item, offset-old_offset);
 659         return offset;
 660 }
 661
 662
 663 static int
 664 lsa_dissect_POLICY_ACCOUNT_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 665         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 666 {
 667         proto_item *item=NULL;
 668         proto_tree *tree=NULL;
 669         int old_offset=offset;
 670
 671         if(parent_tree){
 672                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 673                         "POLICY_ACCOUNT_DOMAIN_INFO:");
 674                 tree = proto_item_add_subtree(item, ett_lsa_policy_primary_account_info);
 675         }
 676
 677         /* account */
 678         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 679                 hf_lsa_acct, 0);
 680
 681         /* sid */
 682         offset = dissect_ndr_nt_PSID(tvb, offset,
 683                 pinfo, tree, drep);
 684
 685         proto_item_set_len(item, offset-old_offset);
 686         return offset;
 687 }
 688
 689
 690 static const value_string server_role_vals[] = {
 691         {0,     "Standalone"},
 692         {1,     "Domain Member"},
 693         {2,     "Backup"},
 694         {3,     "Primary"},
 695         {0, NULL}
 696 };
 697 static int
 698 lsa_dissect_POLICY_SERVER_ROLE_INFO(tvbuff_t *tvb, int offset,
 699         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 700 {
 701         proto_item *item=NULL;
 702         proto_tree *tree=NULL;
 703         int old_offset=offset;
 704
 705         if(parent_tree){
 706                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 707                         "POLICY_SERVER_ROLE_INFO:");
 708                 tree = proto_item_add_subtree(item, ett_lsa_policy_server_role_info);
 709         }
 710
 711         /* server role */
 712         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 713                                      hf_lsa_server_role, NULL);
 714
 715         proto_item_set_len(item, offset-old_offset);
 716         return offset;
 717 }
 718
 719 static int
 720 lsa_dissect_POLICY_REPLICA_SOURCE_INFO(tvbuff_t *tvb, int offset,
 721         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 722 {
 723         proto_item *item=NULL;
 724         proto_tree *tree=NULL;
 725         int old_offset=offset;
 726
 727         if(parent_tree){
 728                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 729                         "POLICY_REPLICA_SOURCE_INFO:");
 730                 tree = proto_item_add_subtree(item, ett_lsa_policy_replica_source_info);
 731         }
 732
 733         /* source */
 734         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 735                 hf_lsa_source, 0);
 736
 737         /* account */
 738         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 739                 hf_lsa_acct, 0);
 740
 741         proto_item_set_len(item, offset-old_offset);
 742         return offset;
 743 }
 744
 745
 746 static int
 747 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO(tvbuff_t *tvb, int offset,
 748         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 749 {
 750         proto_item *item=NULL;
 751         proto_tree *tree=NULL;
 752         int old_offset=offset;
 753
 754         if(parent_tree){
 755                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 756                         "POLICY_DEFAULT_QUOTA_INFO:");
 757                 tree = proto_item_add_subtree(item, ett_lsa_policy_default_quota_info);
 758         }
 759
 760         /* paged pool */
 761         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 762                                      hf_lsa_quota_paged_pool, NULL);
 763
 764         /* non paged pool */
 765         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 766                                      hf_lsa_quota_non_paged_pool, NULL);
 767
 768         /* min wss */
 769         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 770                                      hf_lsa_quota_min_wss, NULL);
 771
 772         /* max wss */
 773         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 774                                      hf_lsa_quota_max_wss, NULL);
 775
 776         /* pagefile */
 777         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 778                                      hf_lsa_quota_pagefile, NULL);
 779
 780         /*  */
 781         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
 782                                      hf_lsa_unknown_hyper, NULL);
 783
 784         proto_item_set_len(item, offset-old_offset);
 785         return offset;
 786 }
 787
 788
 789 static int
 790 lsa_dissect_POLICY_MODIFICATION_INFO(tvbuff_t *tvb, int offset,
 791         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 792 {
 793         proto_item *item=NULL;
 794         proto_tree *tree=NULL;
 795         int old_offset=offset;
 796
 797         if(parent_tree){
 798                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 799                         "POLICY_MODIFICATION_INFO:");
 800                 tree = proto_item_add_subtree(item, ett_lsa_policy_modification_info);
 801         }
 802
 803         /* seq no */
 804         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
 805                                      hf_lsa_mod_seq_no, NULL);
 806
 807         /* mtime */
 808         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 809                                 hf_lsa_mod_mtime);
 810
 811         proto_item_set_len(item, offset-old_offset);
 812         return offset;
 813 }
 814
 815
 816 static int
 817 lsa_dissect_POLICY_AUDIT_FULL_SET_INFO(tvbuff_t *tvb, int offset,
 818         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 819 {
 820         proto_item *item=NULL;
 821         proto_tree *tree=NULL;
 822         int old_offset=offset;
 823
 824         if(parent_tree){
 825                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 826                         "POLICY_AUDIT_FULL_SET_INFO:");
 827                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_full_set_info);
 828         }
 829
 830         /* unknown */
 831         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 832                         hf_lsa_unknown_char, NULL);
 833
 834         proto_item_set_len(item, offset-old_offset);
 835         return offset;
 836 }
 837
 838
 839 static int
 840 lsa_dissect_POLICY_AUDIT_FULL_QUERY_INFO(tvbuff_t *tvb, int offset,
 841         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 842 {
 843         proto_item *item=NULL;
 844         proto_tree *tree=NULL;
 845         int old_offset=offset;
 846
 847         if(parent_tree){
 848                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 849                         "POLICY_AUDIT_FULL_QUERY_INFO:");
 850                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_full_query_info);
 851         }
 852
 853         /* unknown */
 854         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 855                         hf_lsa_unknown_char, NULL);
 856
 857         /* unknown */
 858         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 859                         hf_lsa_unknown_char, NULL);
 860
 861         proto_item_set_len(item, offset-old_offset);
 862         return offset;
 863 }
 864
 865
 866 static int
 867 lsa_dissect_POLICY_DNS_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 868         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 869 {
 870         proto_item *item=NULL;
 871         proto_tree *tree=NULL;
 872         int old_offset=offset;
 873
 874         if(parent_tree){
 875                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 876                         "POLICY_DNS_DOMAIN_INFO:");
 877                 tree = proto_item_add_subtree(item, ett_lsa_policy_dns_domain_info);
 878         }
 879
 880         /* name */
 881         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 882                 hf_lsa_name, 0);
 883
 884         /* domain */
 885         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 886                 hf_lsa_domain, 0);
 887
 888         /* forest */
 889         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 890                 hf_lsa_forest, 0);
 891
 892         /* GUID */
 893         offset = dissect_nt_GUID(tvb, offset,
 894                 pinfo, tree, drep);
 895
 896         /* SID pointer */
 897         offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
 898
 899         proto_item_set_len(item, offset-old_offset);
 900         return offset;
 901 }
 902
 903 static int
 904 lsa_dissect_POLICY_INFORMATION(tvbuff_t *tvb, int offset,
 905         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 906 {
 907         proto_item *item=NULL;
 908         proto_tree *tree=NULL;
 909         int old_offset=offset;
 910         guint16 level;
 911
 912         if(parent_tree){
 913                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 914                         "POLICY_INFO:");
 915                 tree = proto_item_add_subtree(item, ett_lsa_policy_info);
 916         }
 917
 918         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 919                                      hf_lsa_info_level, &level);
 920
 921         ALIGN_TO_4_BYTES;  /* all union arms aligned to 4 bytes, case 7 and 9 need this  */
 922         switch(level){
 923         case 1:
 924                 offset = lsa_dissect_POLICY_AUDIT_LOG_INFO(
 925                                 tvb, offset, pinfo, tree, drep);
 926                 break;
 927         case 2:
 928                 offset = lsa_dissect_POLICY_AUDIT_EVENTS_INFO(
 929                                 tvb, offset, pinfo, tree, drep);
 930                 break;
 931         case 3:
 932                 offset = lsa_dissect_POLICY_PRIMARY_DOMAIN_INFO(
 933                                 tvb, offset, pinfo, tree, drep);
 934                 break;
 935         case 4:
 936                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 937                         hf_lsa_acct, 0);
 938                 break;
 939         case 5:
 940                 offset = lsa_dissect_POLICY_ACCOUNT_DOMAIN_INFO(
 941                                 tvb, offset, pinfo, tree, drep);
 942                 break;
 943         case 6:
 944                 offset = lsa_dissect_POLICY_SERVER_ROLE_INFO(
 945                                 tvb, offset, pinfo, tree, drep);
 946                 break;
 947         case 7:
 948                 offset = lsa_dissect_POLICY_REPLICA_SOURCE_INFO(
 949                                 tvb, offset, pinfo, tree, drep);
 950                 break;
 951         case 8:
 952                 offset = lsa_dissect_POLICY_DEFAULT_QUOTA_INFO(
 953                                 tvb, offset, pinfo, tree, drep);
 954                 break;
 955         case 9:
 956                 offset = lsa_dissect_POLICY_MODIFICATION_INFO(
 957                                 tvb, offset, pinfo, tree, drep);
 958                 break;
 959         case 10:
 960                 offset = lsa_dissect_POLICY_AUDIT_FULL_SET_INFO(
 961                                 tvb, offset, pinfo, tree, drep);
 962                 break;
 963         case 11:
 964                 offset = lsa_dissect_POLICY_AUDIT_FULL_QUERY_INFO(
 965                                 tvb, offset, pinfo, tree, drep);
 966                 break;
 967         case 12:
 968                 offset = lsa_dissect_POLICY_DNS_DOMAIN_INFO(
 969                                 tvb, offset, pinfo, tree, drep);
 970                 break;
 971         }
 972
 973         proto_item_set_len(item, offset-old_offset);
 974         return offset;
 975 }
 976
 977 static int
 978 lsa_dissect_lsaqueryinformationpolicy_reply(tvbuff_t *tvb, int offset,
 979         packet_info *pinfo, proto_tree *tree, char *drep)
 980 {
 981         /* This is really a pointer to a pointer though the first level is REF
 982           so we just ignore that one */
 983         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 984                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_UNIQUE,
 985                 "POLICY_INFORMATION pointer: info", -1, 0);
 986         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 987                 hf_lsa_rc, NULL);
 988
 989         return offset;
 990 }
 991
 992 static int
 993 lsa_dissect_lsadelete_rqst(tvbuff_t *tvb, int offset,
 994         packet_info *pinfo, proto_tree *tree, char *drep)
 995 {
 996         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 997                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
 998                 "LSA_HANDLE pointer: hnd", -1, 0);
 999
1000         return offset;
1001 }
1002
1003 static int
1004 lsa_dissect_lsadelete_reply(tvbuff_t *tvb, int offset,
1005         packet_info *pinfo, proto_tree *tree, char *drep)
1006 {
1007         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1008                 hf_lsa_rc, NULL);
1009
1010         return offset;
1011 }
1012
1013
1014 static int
1015 lsa_dissect_lsaquerysecurityobject_rqst(tvbuff_t *tvb, int offset,
1016         packet_info *pinfo, proto_tree *tree, char *drep)
1017 {
1018         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1019                 pinfo, tree, drep);
1020
1021         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1022                 hf_lsa_info_type, NULL);
1023
1024         return offset;
1025 }
1026
1027
1028 static int
1029 lsa_dissect_lsaquerysecurityobject_reply(tvbuff_t *tvb, int offset,
1030         packet_info *pinfo, proto_tree *tree, char *drep)
1031 {
1032         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1033                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
1034                 "LSA_SECURITY_DESCRIPTOR pointer: sec_info", -1, 0);
1035
1036         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1037                 hf_lsa_rc, NULL);
1038
1039         return offset;
1040 }
1041
1042
1043 static int
1044 lsa_dissect_lsasetsecurityobject_rqst(tvbuff_t *tvb, int offset,
1045         packet_info *pinfo, proto_tree *tree, char *drep)
1046 {
1047         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1048                 pinfo, tree, drep);
1049
1050         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1051                 hf_lsa_info_type, NULL);
1052
1053         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1054                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
1055                 "LSA_SECURITY_DESCRIPTOR: sec_info", -1, 0);
1056
1057         return offset;
1058 }
1059
1060 static int
1061 lsa_dissect_lsasetsecurityobject_reply(tvbuff_t *tvb, int offset,
1062         packet_info *pinfo, proto_tree *tree, char *drep)
1063 {
1064         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1065                 hf_lsa_rc, NULL);
1066
1067         return offset;
1068 }
1069
1070
1071 static int
1072 lsa_dissect_lsachangepassword_rqst(tvbuff_t *tvb, int offset,
1073         packet_info *pinfo, proto_tree *tree, char *drep)
1074 {
1075         /* server */
1076         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1077                 hf_lsa_server, 0);
1078
1079         /* domain */
1080         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1081                 hf_lsa_domain, 0);
1082
1083         /* account */
1084         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1085                 hf_lsa_acct, 0);
1086
1087         /* old password */
1088         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1089                 hf_lsa_old_pwd, 0);
1090
1091         /* new password */
1092         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1093                 hf_lsa_new_pwd, 0);
1094
1095         return offset;
1096 }
1097
1098 static int
1099 lsa_dissect_lsachangepassword_reply(tvbuff_t *tvb, int offset,
1100         packet_info *pinfo, proto_tree *tree, char *drep)
1101 {
1102         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1103                 hf_lsa_rc, NULL);
1104
1105         return offset;
1106 }
1107
1108 static const value_string sid_type_vals[] = {
1109         {1,     "User"},
1110         {2,     "Group"},
1111         {3,     "Domain"},
1112         {4,     "Alias"},
1113         {5,     "Well Known Group"},
1114         {6,     "Deleted Account"},
1115         {7,     "Invalid"},
1116         {8,     "Unknown"},
1117         {9,     "Computer"},
1118         {0, NULL}
1119 };
1120 static int
1121 lsa_dissect_LSA_TRANSLATED_NAME(tvbuff_t *tvb, int offset,
1122         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1123 {
1124         proto_item *item=NULL;
1125         proto_tree *tree=NULL;
1126         int old_offset=offset;
1127
1128         if(parent_tree){
1129                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1130                         "LSA_TRANSLATED_NAME:");
1131                 tree = proto_item_add_subtree(item, ett_lsa_translated_name);
1132         }
1133
1134         /* sid type */
1135         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1136                         hf_lsa_sid_type, NULL);
1137
1138         /* name */
1139         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1140                 hf_lsa_name, 0);
1141
1142         /* index */
1143         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1144                                      hf_lsa_index, NULL);
1145
1146         proto_item_set_len(item, offset-old_offset);
1147         return offset;
1148 }
1149
1150 static int
1151 lsa_dissect_LSA_TRANSLATED_NAME_array(tvbuff_t *tvb, int offset,
1152         packet_info *pinfo, proto_tree *tree, char *drep)
1153 {
1154         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1155                 lsa_dissect_LSA_TRANSLATED_NAME);
1156
1157         return offset;
1158 }
1159
1160 static int
1161 lsa_dissect_LSA_TRANSLATED_NAMES(tvbuff_t *tvb, int offset,
1162         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1163 {
1164         proto_item *item=NULL;
1165         proto_tree *tree=NULL;
1166         int old_offset=offset;
1167
1168         if(parent_tree){
1169                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1170                         "LSA_TRANSLATED_NAMES:");
1171                 tree = proto_item_add_subtree(item, ett_lsa_translated_names);
1172         }
1173
1174         /* count */
1175         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1176                                      hf_lsa_count, NULL);
1177
1178         /* settings */
1179         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1180                 lsa_dissect_LSA_TRANSLATED_NAME_array, NDR_POINTER_UNIQUE,
1181                 "TRANSLATED_NAME_ARRAY", -1, 0);
1182
1183         proto_item_set_len(item, offset-old_offset);
1184         return offset;
1185 }
1186
1187
1188 static int
1189 lsa_dissect_lsalookupsids_rqst(tvbuff_t *tvb, int offset,
1190         packet_info *pinfo, proto_tree *tree, char *drep)
1191 {
1192         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1193                 pinfo, tree, drep);
1194
1195         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1196                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
1197                         "", -1, 0);
1198
1199         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1200                 lsa_dissect_LSA_TRANSLATED_NAMES, NDR_POINTER_REF,
1201                 "LSA_TRANSLATED_NAMES pointer: names", -1, 0);
1202
1203         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1204                 hf_lsa_info_level, NULL);
1205
1206         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1207                 hf_lsa_num_mapped, NULL);
1208
1209         return offset;
1210 }
1211
1212 static int
1213 lsa_dissect_LSA_TRUST_INFORMATION(tvbuff_t *tvb, int offset,
1214         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1215 {
1216         proto_item *item=NULL;
1217         proto_tree *tree=NULL;
1218         int old_offset=offset;
1219
1220         if(parent_tree){
1221                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1222                         "TRUST INFORMATION:");
1223                 tree = proto_item_add_subtree(item, ett_lsa_trust_information);
1224         }
1225
1226         /* name */
1227         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1228                 hf_lsa_name, 0);
1229
1230         /* sid */
1231         offset = dissect_ndr_nt_PSID(tvb, offset,
1232                 pinfo, tree, drep);
1233
1234         proto_item_set_len(item, offset-old_offset);
1235         return offset;
1236 }
1237
1238 static const value_string trusted_direction_vals[] = {
1239         {0,     "Trust disabled"},
1240         {1,     "Inbound trust"},
1241         {2,     "Outbound trust"},
1242         {0,     NULL}
1243 };
1244
1245 static const value_string trusted_type_vals[] = {
1246         {1,     "Downlevel"},
1247         {2,     "Uplevel"},
1248         {3,     "MIT"},
1249         {4,     "DCE"},
1250         {0,     NULL}
1251 };
1252
1253 static const true_false_string tfs_trust_attr_non_trans = {
1254         "NON TRANSITIVE is set",
1255         "Non transitive is NOT set"
1256 };
1257 static const true_false_string tfs_trust_attr_uplevel_only = {
1258         "UPLEVEL ONLY is set",
1259         "Uplevel only is NOT set"
1260 };
1261 static const true_false_string tfs_trust_attr_tree_parent = {
1262         "TREE PARENT is set",
1263         "Tree parent is NOT set"
1264 };
1265 static const true_false_string tfs_trust_attr_tree_root = {
1266         "TREE ROOT is set",
1267         "Tree root is NOT set"
1268 };
1269 static int
1270 lsa_dissect_trust_attr(tvbuff_t *tvb, int offset, packet_info *pinfo,
1271                         proto_tree *parent_tree, char *drep)
1272 {
1273         guint32 mask;
1274         proto_item *item = NULL;
1275         proto_tree *tree = NULL;
1276
1277         offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
1278                         hf_lsa_trust_attr, &mask);
1279
1280         if(parent_tree){
1281                 item = proto_tree_add_uint(parent_tree, hf_lsa_trust_attr,
1282                         tvb, offset-4, 4, mask);
1283                 tree = proto_item_add_subtree(item, ett_lsa_trust_attr);
1284         }
1285
1286         proto_tree_add_boolean(tree, hf_lsa_trust_attr_tree_root,
1287                 tvb, offset-4, 4, mask);
1288         proto_tree_add_boolean(tree, hf_lsa_trust_attr_tree_parent,
1289                 tvb, offset-4, 4, mask);
1290         proto_tree_add_boolean(tree, hf_lsa_trust_attr_uplevel_only,
1291                 tvb, offset-4, 4, mask);
1292         proto_tree_add_boolean(tree, hf_lsa_trust_attr_non_trans,
1293                 tvb, offset-4, 4, mask);
1294
1295         return offset;
1296 }
1297
1298 static int
1299 lsa_dissect_LSA_TRUST_INFORMATION_EX(tvbuff_t *tvb, int offset,
1300         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1301 {
1302         proto_item *item=NULL;
1303         proto_tree *tree=NULL;
1304         int old_offset=offset;
1305
1306         if(parent_tree){
1307                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1308                         "TRUST INFORMATION EX:");
1309                 tree = proto_item_add_subtree(item, ett_lsa_trust_information_ex);
1310         }
1311
1312         /* name */
1313         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1314                 hf_lsa_name, 0);
1315
1316         /* flat name */
1317         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1318                 hf_lsa_flat_name, 0);
1319
1320         /* sid */
1321         offset = dissect_ndr_nt_PSID(tvb, offset,
1322                 pinfo, tree, drep);
1323
1324         /* direction */
1325         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1326                                      hf_lsa_trust_direction, NULL);
1327
1328         /* type */
1329         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1330                                      hf_lsa_trust_type, NULL);
1331
1332         /* attributes */
1333         offset = lsa_dissect_trust_attr(tvb, offset, pinfo, tree, drep);
1334
1335         proto_item_set_len(item, offset-old_offset);
1336         return offset;
1337 }
1338
1339 static int
1340 lsa_dissect_auth_info_blob(tvbuff_t *tvb, int offset,
1341         packet_info *pinfo, proto_tree *tree, char *drep)
1342 {
1343         dcerpc_info *di;
1344         guint32 len;
1345
1346         di=pinfo->private_data;
1347         if(di->conformant_run){
1348                 /*just a run to handle conformant arrays, nothing to dissect */
1349                 return offset;
1350         }
1351
1352         /* len */
1353         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1354                                      hf_lsa_auth_len, &len);
1355
1356         proto_tree_add_item(tree, hf_lsa_auth_blob, tvb, offset, len, FALSE);
1357         offset += len;
1358
1359         return offset;
1360 }
1361
1362 static int
1363 lsa_dissect_auth_info(tvbuff_t *tvb, int offset,
1364         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1365 {
1366         proto_item *item=NULL;
1367         proto_tree *tree=NULL;
1368         int old_offset=offset;
1369
1370         if(parent_tree){
1371                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1372                         "AUTH INFORMATION:");
1373                 tree = proto_item_add_subtree(item, ett_lsa_auth_information);
1374         }
1375
1376         /* update */
1377         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
1378                                      hf_lsa_auth_update, NULL);
1379
1380         /* type */
1381         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1382                                      hf_lsa_auth_type, NULL);
1383
1384         /* len */
1385         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1386                                      hf_lsa_auth_len, NULL);
1387
1388         /* auth info blob */
1389         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1390                         lsa_dissect_auth_info_blob, NDR_POINTER_UNIQUE,
1391                         "AUTH INFO blob:", -1, 0);
1392
1393         proto_item_set_len(item, offset-old_offset);
1394         return offset;
1395 }
1396
1397 static int
1398 lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvbuff_t *tvb, int offset,
1399         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1400 {
1401         proto_item *item=NULL;
1402         proto_tree *tree=NULL;
1403         int old_offset=offset;
1404
1405         if(parent_tree){
1406                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1407                         "TRUSTED DOMAIN AUTH INFORMATION:");
1408                 tree = proto_item_add_subtree(item, ett_lsa_trusted_domain_auth_information);
1409         }
1410
1411         /* unknown */
1412         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1413                                      hf_lsa_unknown_long, NULL);
1414
1415         /* unknown */
1416         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1417
1418         /* unknown */
1419         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1420
1421         /* unknown */
1422         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1423                                      hf_lsa_unknown_long, NULL);
1424
1425         /* unknown */
1426         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1427
1428         /* unknown */
1429         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1430
1431         proto_item_set_len(item, offset-old_offset);
1432         return offset;
1433 }
1434
1435
1436 static int
1437 lsa_dissect_LSA_TRUST_INFORMATION_array(tvbuff_t *tvb, int offset,
1438         packet_info *pinfo, proto_tree *tree, char *drep)
1439 {
1440         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1441                 lsa_dissect_LSA_TRUST_INFORMATION);
1442
1443         return offset;
1444 }
1445
1446 static int
1447 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST(tvbuff_t *tvb, int offset,
1448         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1449 {
1450         proto_item *item=NULL;
1451         proto_tree *tree=NULL;
1452         int old_offset=offset;
1453
1454         if(parent_tree){
1455                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1456                         "LSA_REFERENCED_DOMAIN_LIST:");
1457                 tree = proto_item_add_subtree(item, ett_lsa_referenced_domain_list);
1458         }
1459
1460         /* count */
1461         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1462                                      hf_lsa_count, NULL);
1463
1464         /* trust information */
1465         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1466                 lsa_dissect_LSA_TRUST_INFORMATION_array, NDR_POINTER_UNIQUE,
1467                 "TRUST INFORMATION array:", -1, 0);
1468
1469         /* max count */
1470         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1471                                      hf_lsa_max_count, NULL);
1472
1473         proto_item_set_len(item, offset-old_offset);
1474         return offset;
1475 }
1476
1477 static int
1478 lsa_dissect_lsalookupsids_reply(tvbuff_t *tvb, int offset,
1479         packet_info *pinfo, proto_tree *tree, char *drep)
1480 {
1481         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1482                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
1483                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1, 0);
1484
1485         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1486                 lsa_dissect_LSA_TRANSLATED_NAMES, NDR_POINTER_REF,
1487                 "LSA_TRANSLATED_NAMES pointer: names", -1, 0);
1488
1489         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1490                 hf_lsa_num_mapped, NULL);
1491
1492         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1493                 hf_lsa_rc, NULL);
1494
1495         return offset;
1496 }
1497
1498
1499 static int
1500 lsa_dissect_lsasetquotasforaccount_rqst(tvbuff_t *tvb, int offset,
1501         packet_info *pinfo, proto_tree *tree, char *drep)
1502 {
1503         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1504                 pinfo, tree, drep);
1505
1506         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1507                 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO, NDR_POINTER_REF,
1508                 "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1, 0);
1509
1510         return offset;
1511 }
1512
1513
1514 static int
1515 lsa_dissect_lsasetquotasforaccount_reply(tvbuff_t *tvb, int offset,
1516         packet_info *pinfo, proto_tree *tree, char *drep)
1517 {
1518         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1519                 hf_lsa_rc, NULL);
1520
1521         return offset;
1522 }
1523
1524
1525 static int
1526 lsa_dissect_lsagetquotasforaccount_rqst(tvbuff_t *tvb, int offset,
1527         packet_info *pinfo, proto_tree *tree, char *drep)
1528 {
1529         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1530                 pinfo, tree, drep);
1531
1532         return offset;
1533 }
1534
1535
1536 static int
1537 lsa_dissect_lsagetquotasforaccount_reply(tvbuff_t *tvb, int offset,
1538         packet_info *pinfo, proto_tree *tree, char *drep)
1539 {
1540         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1541                 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO, NDR_POINTER_REF,
1542                 "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1, 0);
1543
1544         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1545                 hf_lsa_rc, NULL);
1546
1547         return offset;
1548 }
1549
1550
1551 static int
1552 lsa_dissect_lsasetinformationpolicy_rqst(tvbuff_t *tvb, int offset,
1553         packet_info *pinfo, proto_tree *tree, char *drep)
1554 {
1555         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1556                 pinfo, tree, drep);
1557
1558         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1559                 hf_lsa_policy_information_class, NULL);
1560
1561         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1562                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
1563                 "POLICY_INFORMATION pointer: info", -1, 0);
1564
1565         return offset;
1566 }
1567
1568
1569 static int
1570 lsa_dissect_lsasetinformationpolicy_reply(tvbuff_t *tvb, int offset,
1571         packet_info *pinfo, proto_tree *tree, char *drep)
1572 {
1573         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1574                 hf_lsa_rc, NULL);
1575
1576         return offset;
1577 }
1578
1579
1580 static int
1581 lsa_dissect_lsaclearauditlog_rqst(tvbuff_t *tvb, int offset,
1582         packet_info *pinfo, proto_tree *tree, char *drep)
1583 {
1584         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1585                 pinfo, tree, drep);
1586
1587         offset = dissect_ndr_nt_SID(tvb, offset,
1588                 pinfo, tree, drep);
1589
1590         /* unknown */
1591         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1592                                      hf_lsa_unknown_long, NULL);
1593
1594         return offset;
1595 }
1596
1597
1598 static int
1599 lsa_dissect_lsaclearauditlog_reply(tvbuff_t *tvb, int offset,
1600         packet_info *pinfo, proto_tree *tree, char *drep)
1601 {
1602         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1603                 pinfo, tree, drep);
1604
1605         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1606                 hf_lsa_rc, NULL);
1607
1608         return offset;
1609 }
1610
1611 static int
1612 lsa_dissect_lsagetsystemaccessaccount_rqst(tvbuff_t *tvb, int offset,
1613         packet_info *pinfo, proto_tree *tree, char *drep)
1614 {
1615         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1616                 pinfo, tree, drep);
1617
1618         return offset;
1619 }
1620
1621
1622 static int
1623 lsa_dissect_lsagetsystemaccessaccount_reply(tvbuff_t *tvb, int offset,
1624         packet_info *pinfo, proto_tree *tree, char *drep)
1625 {
1626         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1627                                      hf_lsa_rid, NULL);
1628
1629         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1630                 hf_lsa_rc, NULL);
1631
1632         return offset;
1633 }
1634
1635
1636 static int
1637 lsa_dissect_lsasetsystemaccessaccount_rqst(tvbuff_t *tvb, int offset,
1638         packet_info *pinfo, proto_tree *tree, char *drep)
1639 {
1640         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1641                 pinfo, tree, drep);
1642
1643         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1644                 hf_lsa_rid, NULL);
1645
1646         return offset;
1647 }
1648
1649
1650 static int
1651 lsa_dissect_lsasetsystemaccessaccount_reply(tvbuff_t *tvb, int offset,
1652         packet_info *pinfo, proto_tree *tree, char *drep)
1653 {
1654         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1655                 hf_lsa_rc, NULL);
1656
1657         return offset;
1658 }
1659
1660
1661 static int
1662 lsa_dissect_lsaopentrusteddomain_rqst(tvbuff_t *tvb, int offset,
1663         packet_info *pinfo, proto_tree *tree, char *drep)
1664 {
1665         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1666                 pinfo, tree, drep);
1667
1668         offset = dissect_ndr_nt_SID(tvb, offset,
1669                 pinfo, tree, drep);
1670
1671         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
1672                 pinfo, tree, drep);
1673
1674         return offset;
1675 }
1676
1677
1678 static int
1679 lsa_dissect_lsaopentrusteddomain_reply(tvbuff_t *tvb, int offset,
1680         packet_info *pinfo, proto_tree *tree, char *drep)
1681 {
1682         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1683                 pinfo, tree, drep);
1684
1685         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1686                 hf_lsa_rc, NULL);
1687
1688         return offset;
1689 }
1690
1691
1692 static int
1693 lsa_dissect_lsadeletetrusteddomain_rqst(tvbuff_t *tvb, int offset,
1694         packet_info *pinfo, proto_tree *tree, char *drep)
1695 {
1696         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1697                 pinfo, tree, drep);
1698
1699         offset = dissect_ndr_nt_SID(tvb, offset,
1700                 pinfo, tree, drep);
1701
1702         return offset;
1703 }
1704
1705
1706 static int
1707 lsa_dissect_lsadeletetrusteddomain_reply(tvbuff_t *tvb, int offset,
1708         packet_info *pinfo, proto_tree *tree, char *drep)
1709 {
1710         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1711                 hf_lsa_rc, NULL);
1712
1713         return offset;
1714 }
1715
1716 int
1717 dissect_nt_LUID(tvbuff_t *tvb, int offset,
1718         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1719 {
1720         proto_item *item=NULL;
1721         proto_tree *tree=NULL;
1722         int old_offset=offset;
1723
1724         if(parent_tree){
1725                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1726                         "LUID:");
1727                 tree = proto_item_add_subtree(item, ett_LUID);
1728         }
1729
1730         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1731                 hf_nt_luid_low, NULL);
1732
1733         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1734                 hf_nt_luid_high, NULL);
1735
1736         proto_item_set_len(item, offset-old_offset);
1737         return offset;
1738 }
1739
1740 static int
1741 lsa_dissect_LSA_PRIVILEGE(tvbuff_t *tvb, int offset,
1742         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1743 {
1744         proto_item *item=NULL;
1745         proto_tree *tree=NULL;
1746         int old_offset=offset;
1747
1748         if(parent_tree){
1749                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1750                         "LSA_PRIVILEGE:");
1751                 tree = proto_item_add_subtree(item, ett_LSA_PRIVILEGE);
1752         }
1753
1754         /* privilege name */
1755         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1756                         hf_lsa_privilege_name, 0);
1757
1758         /* LUID */
1759         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
1760
1761         proto_item_set_len(item, offset-old_offset);
1762         return offset;
1763 }
1764
1765 static int
1766 lsa_dissect_LSA_PRIVILEGE_array(tvbuff_t *tvb, int offset,
1767         packet_info *pinfo, proto_tree *tree, char *drep)
1768 {
1769         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1770                 lsa_dissect_LSA_PRIVILEGE);
1771
1772         return offset;
1773 }
1774
1775 static int
1776 lsa_dissect_LSA_PRIVILEGES(tvbuff_t *tvb, int offset,
1777         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1778 {
1779         proto_item *item=NULL;
1780         proto_tree *tree=NULL;
1781         int old_offset=offset;
1782
1783         if(parent_tree){
1784                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1785                         "LSA_PRIVILEGES:");
1786                 tree = proto_item_add_subtree(item, ett_LSA_PRIVILEGES);
1787         }
1788
1789         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1790                 hf_lsa_count, NULL);
1791
1792         /* privileges */
1793         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1794                 lsa_dissect_LSA_PRIVILEGE_array, NDR_POINTER_UNIQUE,
1795                 "LSA_PRIVILEGE array:", -1, 0);
1796
1797         proto_item_set_len(item, offset-old_offset);
1798         return offset;
1799 }
1800
1801 static int
1802 lsa_dissect_lsaenumerateprivileges_rqst(tvbuff_t *tvb, int offset,
1803         packet_info *pinfo, proto_tree *tree, char *drep)
1804 {
1805         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1806                 pinfo, tree, drep);
1807
1808         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1809                 hf_lsa_count, NULL);
1810
1811         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1812                 hf_lsa_size, NULL);
1813
1814         return offset;
1815 }
1816
1817 static int
1818 lsa_dissect_lsaenumerateprivileges_reply(tvbuff_t *tvb, int offset,
1819         packet_info *pinfo, proto_tree *tree, char *drep)
1820 {
1821         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1822                 hf_lsa_count, NULL);
1823
1824         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1825                 lsa_dissect_LSA_PRIVILEGES, NDR_POINTER_REF,
1826                 "LSA_PRIVILEGES pointer: privs", -1, 0);
1827
1828         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1829                 hf_lsa_rc, NULL);
1830
1831         return offset;
1832 }
1833
1834 static int
1835 lsa_dissect_lsalookupprivilegevalue_rqst(tvbuff_t *tvb, int offset,
1836         packet_info *pinfo, proto_tree *tree, char *drep)
1837 {
1838         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1839                 pinfo, tree, drep);
1840
1841         /* privilege name */
1842         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1843                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
1844                 "NAME pointer: ", hf_lsa_privilege_name, 0);
1845
1846         return offset;
1847 }
1848
1849
1850 static int
1851 lsa_dissect_lsalookupprivilegevalue_reply(tvbuff_t *tvb, int offset,
1852         packet_info *pinfo, proto_tree *tree, char *drep)
1853 {
1854
1855         /* LUID */
1856         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
1857
1858         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1859                 hf_lsa_rc, NULL);
1860
1861         return offset;
1862 }
1863
1864
1865 static int
1866 lsa_dissect_lsalookupprivilegename_rqst(tvbuff_t *tvb, int offset,
1867         packet_info *pinfo, proto_tree *tree, char *drep)
1868 {
1869         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1870                 pinfo, tree, drep);
1871
1872         /* LUID */
1873         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1874                 dissect_nt_LUID, NDR_POINTER_REF,
1875                 "LUID pointer: value", -1, 0);
1876
1877         return offset;
1878 }
1879
1880
1881 static int
1882 lsa_dissect_lsalookupprivilegename_reply(tvbuff_t *tvb, int offset,
1883         packet_info *pinfo, proto_tree *tree, char *drep)
1884 {
1885         /* [out, ref] LSA_UNICODE_STRING **name */
1886         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1887                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
1888                 "PRIVILEGE NAME pointer:", hf_lsa_privilege_name, 0);
1889
1890         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1891                 hf_lsa_rc, NULL);
1892
1893         return offset;
1894 }
1895
1896
1897 static int
1898 lsa_dissect_lsaenumerateprivilegesaccount_rqst(tvbuff_t *tvb, int offset,
1899         packet_info *pinfo, proto_tree *tree, char *drep)
1900 {
1901         /* [in] LSA_HANDLE hnd */
1902         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1903                 pinfo, tree, drep);
1904
1905         return offset;
1906 }
1907
1908
1909 static int
1910 lsa_dissect_LUID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
1911         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1912 {
1913         proto_item *item=NULL;
1914         proto_tree *tree=NULL;
1915         int old_offset=offset;
1916
1917         if(parent_tree){
1918                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1919                         "LUID_AND_ATTRIBUTES:");
1920                 tree = proto_item_add_subtree(item, ett_LSA_LUID_AND_ATTRIBUTES);
1921         }
1922
1923         /* LUID */
1924         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
1925
1926         /* attr */
1927         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
1928                                      hf_lsa_attr, NULL);
1929
1930         proto_item_set_len(item, offset-old_offset);
1931         return offset;
1932 }
1933
1934 static int
1935 lsa_dissect_LUID_AND_ATTRIBUTES_array(tvbuff_t *tvb, int offset,
1936         packet_info *pinfo, proto_tree *tree, char *drep)
1937 {
1938         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1939                 lsa_dissect_LUID_AND_ATTRIBUTES);
1940
1941         return offset;
1942 }
1943
1944 static int
1945 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
1946         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1947 {
1948         proto_item *item=NULL;
1949         proto_tree *tree=NULL;
1950         int old_offset=offset;
1951
1952         if(parent_tree){
1953                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1954                         "LUID_AND_ATTRIBUTES_ARRAY:");
1955                 tree = proto_item_add_subtree(item, ett_LSA_LUID_AND_ATTRIBUTES_ARRAY);
1956         }
1957
1958         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1959                 hf_lsa_count, NULL);
1960
1961         /* luid and attributes */
1962         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1963                 lsa_dissect_LUID_AND_ATTRIBUTES_array, NDR_POINTER_UNIQUE,
1964                 "LUID_AND_ATTRIBUTES array:", -1, 0);
1965
1966         proto_item_set_len(item, offset-old_offset);
1967         return offset;
1968 }
1969
1970 static int
1971 lsa_dissect_lsaenumerateprivilegesaccount_reply(tvbuff_t *tvb, int offset,
1972         packet_info *pinfo, proto_tree *tree, char *drep)
1973 {
1974         /* [out, ref] LUID_AND_ATTRIBUTES_ARRAY * *privs */
1975         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1976                 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
1977                 "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1, 0);
1978
1979         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1980                 hf_lsa_rc, NULL);
1981
1982         return offset;
1983 }
1984
1985 static int
1986 lsa_dissect_lsaaddprivilegestoaccount_rqst(tvbuff_t *tvb, int offset,
1987         packet_info *pinfo, proto_tree *tree, char *drep)
1988 {
1989         /* [in] LSA_HANDLE hnd */
1990         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1991                 pinfo, tree, drep);
1992
1993         /* [in, ref] LUID_AND_ATTRIBUTES_ARRAY *privs */
1994         offset = lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY(tvb, offset,
1995                 pinfo, tree, drep);
1996
1997         return offset;
1998 }
1999
2000
2001 static int
2002 lsa_dissect_lsaaddprivilegestoaccount_reply(tvbuff_t *tvb, int offset,
2003         packet_info *pinfo, proto_tree *tree, char *drep)
2004 {
2005         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2006                 hf_lsa_rc, NULL);
2007
2008         return offset;
2009 }
2010
2011 static int
2012 lsa_dissect_lsaremoveprivilegesfromaccount_rqst(tvbuff_t *tvb, int offset,
2013         packet_info *pinfo, proto_tree *tree, char *drep)
2014 {
2015         /* [in] LSA_HANDLE hnd */
2016         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2017                 pinfo, tree, drep);
2018
2019         /* [in] char unknown */
2020         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
2021                         hf_lsa_unknown_char, NULL);
2022
2023         /* [in, unique] LUID_AND_ATTRIBUTES_ARRAY *privs */
2024         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2025                 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
2026                 "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1, 0);
2027
2028         return offset;
2029 }
2030
2031
2032 static int
2033 lsa_dissect_lsaremoveprivilegesfromaccount_reply(tvbuff_t *tvb, int offset,
2034         packet_info *pinfo, proto_tree *tree, char *drep)
2035 {
2036         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2037                 hf_lsa_rc, NULL);
2038
2039         return offset;
2040 }
2041
2042 static int
2043 lsa_dissect_lsaenumerateaccounts_rqst(tvbuff_t *tvb, int offset,
2044         packet_info *pinfo, proto_tree *tree, char *drep)
2045 {
2046         /* [in] LSA_HANDLE hnd */
2047         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2048                 pinfo, tree, drep);
2049
2050         /* [in,out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2051         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2052                 hf_lsa_resume_handle, NULL);
2053
2054         /* [in] ULONG pref_maxlen */
2055         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2056                 hf_lsa_max_count, NULL);
2057
2058         return offset;
2059 }
2060
2061 static int
2062 lsa_dissect_lsaenumerateaccounts_reply(tvbuff_t *tvb, int offset,
2063         packet_info *pinfo, proto_tree *tree, char *drep)
2064 {
2065         /* [in,out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2066         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2067                 hf_lsa_resume_handle, NULL);
2068
2069         /* [out, ref] PSID_ARRAY **accounts */
2070         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2071                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
2072                         "", -1, 0);
2073
2074         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2075                 hf_lsa_rc, NULL);
2076
2077         return offset;
2078 }
2079
2080 static int
2081 lsa_dissect_lsacreatetrusteddomain_rqst(tvbuff_t *tvb, int offset,
2082         packet_info *pinfo, proto_tree *tree, char *drep)
2083 {
2084         /* [in] LSA_HANDLE hnd_pol */
2085         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2086                 pinfo, tree, drep);
2087
2088         /* [in, ref] LSA_TRUST_INFORMATION *domain */
2089         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2090                 lsa_dissect_LSA_TRUST_INFORMATION, NDR_POINTER_REF,
2091                 "LSA_TRUST_INFORMATION pointer: domain", -1, 0);
2092
2093         /* [in] ACCESS_MASK access */
2094         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2095                 pinfo, tree, drep);
2096
2097         return offset;
2098 }
2099
2100 static int
2101 lsa_dissect_lsacreatetrusteddomain_reply(tvbuff_t *tvb, int offset,
2102         packet_info *pinfo, proto_tree *tree, char *drep)
2103 {
2104         /* [out] LSA_HANDLE *hnd */
2105         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2106                 pinfo, tree, drep);
2107
2108         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2109                 hf_lsa_rc, NULL);
2110
2111         return offset;
2112 }
2113
2114 static int
2115 lsa_dissect_lsaenumeratetrusteddomains_rqst(tvbuff_t *tvb, int offset,
2116         packet_info *pinfo, proto_tree *tree, char *drep)
2117 {
2118         /* [in] LSA_HANDLE hnd */
2119         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2120                 pinfo, tree, drep);
2121
2122         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2123         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2124                 hf_lsa_resume_handle, NULL);
2125
2126         /* [in] ULONG pref_maxlen */
2127         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2128                 hf_lsa_max_count, NULL);
2129
2130         return offset;
2131 }
2132
2133 static int
2134 lsa_dissect_LSA_TRUSTED_DOMAIN(tvbuff_t *tvb, int offset,
2135         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2136 {
2137         proto_item *item=NULL;
2138         proto_tree *tree=NULL;
2139         int old_offset=offset;
2140
2141         if(parent_tree){
2142                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2143                         "TRUSTED_DOMAIN:");
2144                 tree = proto_item_add_subtree(item, ett_LSA_TRUSTED_DOMAIN);
2145         }
2146
2147         /* domain */
2148         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2149                 hf_lsa_domain, 0);
2150
2151         /* sid */
2152         offset = dissect_ndr_nt_PSID(tvb, offset,
2153                 pinfo, tree, drep);
2154
2155         proto_item_set_len(item, offset-old_offset);
2156         return offset;
2157 }
2158
2159 static int
2160 lsa_dissect_LSA_TRUSTED_DOMAIN_array(tvbuff_t *tvb, int offset,
2161         packet_info *pinfo, proto_tree *tree, char *drep)
2162 {
2163         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2164                 lsa_dissect_LSA_TRUSTED_DOMAIN);
2165
2166         return offset;
2167 }
2168
2169 static int
2170 lsa_dissect_LSA_TRUSTED_DOMAIN_LIST(tvbuff_t *tvb, int offset,
2171         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2172 {
2173         proto_item *item=NULL;
2174         proto_tree *tree=NULL;
2175         int old_offset=offset;
2176
2177         if(parent_tree){
2178                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2179                         "TRUSTED_DOMAIN_LIST:");
2180                 tree = proto_item_add_subtree(item, ett_LSA_TRUSTED_DOMAIN_LIST);
2181         }
2182
2183         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2184                 hf_lsa_count, NULL);
2185
2186         /* privileges */
2187         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2188                 lsa_dissect_LSA_TRUSTED_DOMAIN_array, NDR_POINTER_UNIQUE,
2189                 "TRUSTED_DOMAIN array:", -1, 0);
2190
2191         proto_item_set_len(item, offset-old_offset);
2192         return offset;
2193 }
2194
2195 static int
2196 lsa_dissect_lsaenumeratetrusteddomains_reply(tvbuff_t *tvb, int offset,
2197         packet_info *pinfo, proto_tree *tree, char *drep)
2198 {
2199         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2200         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2201                 hf_lsa_resume_handle, NULL);
2202
2203         /* [out, ref] LSA_REFERENCED_DOMAIN_LIST *domains */
2204         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2205                 lsa_dissect_LSA_TRUSTED_DOMAIN_LIST, NDR_POINTER_REF,
2206                 "LSA_TRUSTED_DOMAIN_LIST pointer: domains", -1, 0);
2207
2208         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2209                 hf_lsa_rc, NULL);
2210
2211         return offset;
2212 }
2213
2214
2215 static int
2216 lsa_dissect_LSA_UNICODE_STRING_item(tvbuff_t *tvb, int offset,
2217         packet_info *pinfo, proto_tree *tree, char *drep)
2218 {
2219         dcerpc_info *di;
2220
2221         di=pinfo->private_data;
2222         if(di->conformant_run){
2223                 /*just a run to handle conformant arrays, nothing to dissect */
2224                 return offset;
2225         }
2226
2227         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2228                         di->hf_index, di->levels);
2229
2230         return offset;
2231 }
2232
2233 static int
2234 lsa_dissect_LSA_UNICODE_STRING_array(tvbuff_t *tvb, int offset,
2235         packet_info *pinfo, proto_tree *tree, char *drep)
2236 {
2237         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2238                 lsa_dissect_LSA_UNICODE_STRING_item);
2239
2240         return offset;
2241 }
2242
2243 static int
2244 lsa_dissect_LSA_UNICODE_STRING_ARRAY(tvbuff_t *tvb, int offset,
2245         packet_info *pinfo, proto_tree *tree, char *drep)
2246 {
2247         dcerpc_info *di;
2248
2249         di=pinfo->private_data;
2250
2251         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2252                 hf_lsa_count, NULL);
2253         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2254                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_UNIQUE,
2255                 "UNICODE_STRING pointer: ", di->hf_index, 0);
2256
2257         return offset;
2258 }
2259
2260 static int
2261 lsa_dissect_LSA_TRANSLATED_SID(tvbuff_t *tvb, int offset,
2262         packet_info *pinfo, proto_tree *tree, char *drep)
2263 {
2264         /* sid type */
2265         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2266                         hf_lsa_sid_type, NULL);
2267
2268         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2269                                      hf_lsa_rid, NULL);
2270
2271         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2272                                      hf_lsa_index, NULL);
2273
2274         return offset;
2275 }
2276
2277 static int
2278 lsa_dissect_LSA_TRANSLATED_SIDS_array(tvbuff_t *tvb, int offset,
2279         packet_info *pinfo, proto_tree *tree, char *drep)
2280 {
2281         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2282                 lsa_dissect_LSA_TRANSLATED_SID);
2283
2284         return offset;
2285 }
2286
2287 static int
2288 lsa_dissect_LSA_TRANSLATED_SIDS(tvbuff_t *tvb, int offset,
2289         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2290 {
2291         proto_item *item=NULL;
2292         proto_tree *tree=NULL;
2293         int old_offset=offset;
2294
2295         if(parent_tree){
2296                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2297                         "LSA_TRANSLATED_SIDS:");
2298                 tree = proto_item_add_subtree(item, ett_LSA_TRANSLATED_SIDS);
2299         }
2300
2301         /* count */
2302         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2303                                      hf_lsa_count, NULL);
2304
2305         /* settings */
2306         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2307                 lsa_dissect_LSA_TRANSLATED_SIDS_array, NDR_POINTER_UNIQUE,
2308                 "Translated SIDS", -1, 0);
2309
2310         proto_item_set_len(item, offset-old_offset);
2311         return offset;
2312 }
2313
2314 static int
2315 lsa_dissect_lsalookupnames_rqst(tvbuff_t *tvb, int offset,
2316         packet_info *pinfo, proto_tree *tree, char *drep)
2317 {
2318         /* [in] LSA_HANDLE hnd */
2319         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2320                 pinfo, tree, drep);
2321
2322         /* [in] ULONG count */
2323         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2324                 hf_lsa_count, NULL);
2325
2326         /* [in, size_is(count), ref] LSA_UNICODE_STRING *names */
2327         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2328                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_REF,
2329                 "Account pointer: names", hf_lsa_acct, 0);
2330
2331         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
2332         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2333                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
2334                 "LSA_TRANSLATED_SIDS pointer: rids", -1, 0);
2335
2336         /* [in] USHORT level */
2337         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2338                 hf_lsa_info_level, NULL);
2339
2340         /* [in, out, ref] ULONG *num_mapped */
2341         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2342                 hf_lsa_num_mapped, NULL);
2343
2344         return offset;
2345 }
2346
2347
2348 static int
2349 lsa_dissect_lsalookupnames_reply(tvbuff_t *tvb, int offset,
2350         packet_info *pinfo, proto_tree *tree, char *drep)
2351 {
2352         /* [out] LSA_REFERENCED_DOMAIN_LIST *domains */
2353         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2354                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
2355                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1, 0);
2356
2357         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
2358         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2359                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
2360                 "LSA_TRANSLATED_SIDS pointer: rids", -1, 0);
2361
2362         /* [in, out, ref] ULONG *num_mapped */
2363         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2364                 hf_lsa_num_mapped, NULL);
2365
2366         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2367                 hf_lsa_rc, NULL);
2368
2369         return offset;
2370 }
2371
2372 static int
2373 lsa_dissect_lsacreatesecret_rqst(tvbuff_t *tvb, int offset,
2374         packet_info *pinfo, proto_tree *tree, char *drep)
2375 {
2376         /* [in] LSA_HANDLE hnd_pol */
2377         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2378                 pinfo, tree, drep);
2379
2380         /* [in, ref] LSA_UNICODE_STRING *name */
2381         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2382                 hf_lsa_name, 0);
2383
2384         /* [in] ACCESS_MASK access */
2385         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2386                 pinfo, tree, drep);
2387
2388         return offset;
2389 }
2390
2391 static int
2392 lsa_dissect_lsacreatesecret_reply(tvbuff_t *tvb, int offset,
2393         packet_info *pinfo, proto_tree *tree, char *drep)
2394 {
2395
2396         /* [out] LSA_HANDLE *hnd */
2397         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2398                 pinfo, tree, drep);
2399
2400         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2401                 hf_lsa_rc, NULL);
2402
2403         return offset;
2404 }
2405
2406 static int
2407 lsa_dissect_lsaopenaccount_rqst(tvbuff_t *tvb, int offset,
2408         packet_info *pinfo, proto_tree *tree, char *drep)
2409 {
2410         /* [in] LSA_HANDLE hnd_pol */
2411         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2412                 pinfo, tree, drep);
2413
2414         /* [in, ref] SID *account */
2415         offset = dissect_ndr_nt_SID(tvb, offset,
2416                 pinfo, tree, drep);
2417
2418         /* [in] ACCESS_MASK access */
2419         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2420                 pinfo, tree, drep);
2421
2422         return offset;
2423 }
2424
2425
2426 static int
2427 lsa_dissect_lsaopenaccount_reply(tvbuff_t *tvb, int offset,
2428         packet_info *pinfo, proto_tree *tree, char *drep)
2429 {
2430         /* [out] LSA_HANDLE *hnd */
2431         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2432                 pinfo, tree, drep);
2433
2434         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2435                 hf_lsa_rc, NULL);
2436
2437         return offset;
2438 }
2439
2440 static const value_string trusted_info_level_vals[] = {
2441         {1,     "Domain Name Information"},
2442         {2,     "Controllers Information"},
2443         {3,     "Posix Offset Information"},
2444         {4,     "Password Information"},
2445         {5,     "Domain Information Basic"},
2446         {6,     "Domain Information Ex"},
2447         {7,     "Domain Auth Information"},
2448         {8,     "Domain Full Information"},
2449         {9,     "Domain Security Descriptor"},
2450         {10,    "Domain Private Information"},
2451         {0,     NULL}
2452 };
2453
2454 static int
2455 lsa_dissect_TRUSTED_DOMAIN_INFORMATION(tvbuff_t *tvb, int offset,
2456         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2457 {
2458         proto_item *item=NULL;
2459         proto_tree *tree=NULL;
2460         int old_offset=offset;
2461         guint16 level;
2462
2463         if(parent_tree){
2464                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2465                         "TRUSTED_DOMAIN_INFO:");
2466                 tree = proto_item_add_subtree(item, ett_lsa_trusted_domain_info);
2467         }
2468
2469         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2470                                      hf_lsa_trusted_info_level, &level);
2471
2472         ALIGN_TO_4_BYTES;  /* all union arms aligned to 4 bytes, case 7 and 9 need this  */
2473         switch(level){
2474         case 1:
2475                 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2476                         hf_lsa_domain, 0);
2477                 break;
2478         case 2:
2479                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2480                         hf_lsa_count, NULL);
2481                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2482                         lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_UNIQUE,
2483                         "Controllers pointer: ", hf_lsa_controller, 0);
2484                 break;
2485         case 3:
2486                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2487                         hf_lsa_rid_offset, NULL);
2488                 break;
2489         case 4:
2490                 offset = lsa_dissect_LSA_SECRET(tvb, offset, pinfo, tree, drep);
2491                 offset = lsa_dissect_LSA_SECRET(tvb, offset, pinfo, tree, drep);
2492                 break;
2493         case 5:
2494                 offset = lsa_dissect_LSA_TRUST_INFORMATION(tvb, offset,
2495                         pinfo, tree, drep);
2496                 break;
2497         case 6:
2498                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2499                         pinfo, tree, drep);
2500                 break;
2501         case 7:
2502                 offset = lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvb, offset, pinfo, tree, drep);
2503                 break;
2504         case 8:
2505                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2506                         pinfo, tree, drep);
2507                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2508                         hf_lsa_rid_offset, NULL);
2509                 offset = lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvb, offset, pinfo, tree, drep);
2510                 break;
2511         case 9:
2512                 offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset, pinfo, tree, drep);
2513                 break;
2514         case 10:
2515                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2516                         pinfo, tree, drep);
2517                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2518                         hf_lsa_rid_offset, NULL);
2519                 offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset, pinfo, tree, drep);
2520                 break;
2521         }
2522
2523         proto_item_set_len(item, offset-old_offset);
2524         return offset;
2525 }
2526
2527 static int
2528 lsa_dissect_lsaqueryinfotrusteddomain_rqst(tvbuff_t *tvb, int offset,
2529         packet_info *pinfo, proto_tree *tree, char *drep)
2530 {
2531         /* [in] LSA_HANDLE hnd */
2532         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2533                 pinfo, tree, drep);
2534
2535         /* [in] TRUSTED_INFORMATION_CLASS level */
2536         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2537                 hf_lsa_trusted_info_level, NULL);
2538
2539         return offset;
2540 }
2541
2542
2543 static int
2544 lsa_dissect_lsaqueryinfotrusteddomain_reply(tvbuff_t *tvb, int offset,
2545         packet_info *pinfo, proto_tree *tree, char *drep)
2546 {
2547         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info */
2548         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2549                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
2550                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1, 0);
2551
2552         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2553                 hf_lsa_rc, NULL);
2554
2555         return offset;
2556 }
2557
2558 static int
2559 lsa_dissect_lsasetinformationtrusteddomain_rqst(tvbuff_t *tvb, int offset,
2560         packet_info *pinfo, proto_tree *tree, char *drep)
2561 {
2562         /* [in] LSA_HANDLE hnd */
2563         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2564                 pinfo, tree, drep);
2565
2566         /* [in] TRUSTED_INFORMATION_CLASS level */
2567         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2568                 hf_lsa_trusted_info_level, NULL);
2569
2570         /* [in, ref] TRUSTED_DOMAIN_INFORMATION *info */
2571         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2572                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
2573                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1, 0);
2574
2575         return offset;
2576 }
2577
2578
2579 static int
2580 lsa_dissect_lsasetinformationtrusteddomain_reply(tvbuff_t *tvb, int offset,
2581         packet_info *pinfo, proto_tree *tree, char *drep)
2582 {
2583         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2584                 hf_lsa_rc, NULL);
2585
2586         return offset;
2587 }
2588
2589 static int
2590 lsa_dissect_lsaopensecret_rqst(tvbuff_t *tvb, int offset,
2591         packet_info *pinfo, proto_tree *tree, char *drep)
2592 {
2593         /* [in] LSA_HANDLE hnd_pol */
2594         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2595                 pinfo, tree, drep);
2596
2597         /* [in, ref] LSA_UNICODE_STRING *name */
2598         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2599                 hf_lsa_name, 0);
2600
2601         /* [in] ACCESS_MASK access */
2602         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2603                 pinfo, tree, drep);
2604
2605         return offset;
2606 }
2607
2608
2609 static int
2610 lsa_dissect_lsaopensecret_reply(tvbuff_t *tvb, int offset,
2611         packet_info *pinfo, proto_tree *tree, char *drep)
2612 {
2613         /* [out] LSA_HANDLE *hnd */
2614         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2615                 pinfo, tree, drep);
2616
2617         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2618                 hf_lsa_rc, NULL);
2619
2620         return offset;
2621 }
2622
2623 static int
2624 lsa_dissect_lsasetsecret_rqst(tvbuff_t *tvb, int offset,
2625         packet_info *pinfo, proto_tree *tree, char *drep)
2626 {
2627         /* [in] LSA_HANDLE hnd */
2628         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2629                 pinfo, tree, drep);
2630
2631         /* [in, unique] LSA_SECRET *new_val */
2632         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2633                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2634                 "LSA_SECRET pointer: new_val", -1, 0);
2635
2636         /* [in, unique] LSA_SECRET *old_val */
2637         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2638                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2639                 "LSA_SECRET pointer: old_val", -1, 0);
2640
2641         return offset;
2642 }
2643
2644
2645 static int
2646 lsa_dissect_lsasetsecret_reply(tvbuff_t *tvb, int offset,
2647         packet_info *pinfo, proto_tree *tree, char *drep)
2648 {
2649         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2650                 hf_lsa_rc, NULL);
2651
2652         return offset;
2653 }
2654
2655 static int
2656 lsa_dissect_lsaquerysecret_rqst(tvbuff_t *tvb, int offset,
2657         packet_info *pinfo, proto_tree *tree, char *drep)
2658 {
2659         /* [in] LSA_HANDLE hnd */
2660         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2661                 pinfo, tree, drep);
2662
2663         /* [in, out, unique] LSA_SECRET **curr_val */
2664         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2665                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2666                 "LSA_SECRET pointer: curr_val", -1, 0);
2667
2668         /* [in, out, unique] LARGE_INTEGER *curr_mtime */
2669         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2670                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2671                 "NTIME pointer: old_mtime", hf_lsa_cur_mtime, 0);
2672
2673         /* [in, out, unique] LSA_SECRET **old_val */
2674         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2675                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2676                 "LSA_SECRET pointer: old_val", -1, 0);
2677
2678         /* [in, out, unique] LARGE_INTEGER *old_mtime */
2679         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2680                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2681                 "NTIME pointer: old_mtime", hf_lsa_old_mtime, 0);
2682
2683         return offset;
2684 }
2685
2686
2687 static int
2688 lsa_dissect_lsaquerysecret_reply(tvbuff_t *tvb, int offset,
2689         packet_info *pinfo, proto_tree *tree, char *drep)
2690 {
2691         /* [in, out, unique] LSA_SECRET **curr_val */
2692         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2693                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2694                 "LSA_SECRET pointer: curr_val", -1, 0);
2695
2696         /* [in, out, unique] LARGE_INTEGER *curr_mtime */
2697         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2698                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2699                 "NTIME pointer: old_mtime", hf_lsa_cur_mtime, 0);
2700
2701         /* [in, out, unique] LSA_SECRET **old_val */
2702         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2703                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2704                 "LSA_SECRET pointer: old_val", -1, 0);
2705
2706         /* [in, out, unique] LARGE_INTEGER *old_mtime */
2707         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2708                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2709                 "NTIME pointer: old_mtime", hf_lsa_old_mtime, 0);
2710
2711         return offset;
2712 }
2713
2714 static int
2715 lsa_dissect_lsadeleteobject_rqst(tvbuff_t *tvb, int offset,
2716         packet_info *pinfo, proto_tree *tree, char *drep)
2717 {
2718         /* [in] LSA_HANDLE hnd */
2719         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2720                 pinfo, tree, drep);
2721
2722         return offset;
2723 }
2724
2725
2726 static int
2727 lsa_dissect_lsadeleteobject_reply(tvbuff_t *tvb, int offset,
2728         packet_info *pinfo, proto_tree *tree, char *drep)
2729 {
2730         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2731                 hf_lsa_rc, NULL);
2732
2733         return offset;
2734 }
2735
2736 static int
2737 lsa_dissect_lsaenumerateaccountswithuserright_rqst(tvbuff_t *tvb, int offset,
2738         packet_info *pinfo, proto_tree *tree, char *drep)
2739 {
2740         /* [in] LSA_HANDLE hnd */
2741         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2742                 pinfo, tree, drep);
2743
2744         /* [in, unique] LSA_UNICODE_STRING *rights */
2745         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2746                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
2747                 "LSA_UNICODE_STRING pointer: rights", hf_lsa_rights, 0);
2748
2749         return offset;
2750 }
2751
2752 static int
2753 lsa_dissect_lsaenumerateaccountswithuserright_reply(tvbuff_t *tvb, int offset,
2754         packet_info *pinfo, proto_tree *tree, char *drep)
2755 {
2756         /* [out, ref] LSA_UNICODE_STRING_ARRAY *accounts */
2757         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2758                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2759                 "Account pointer: names", hf_lsa_acct, 0);
2760
2761         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2762                 hf_lsa_rc, NULL);
2763
2764         return offset;
2765 }
2766
2767 static int
2768 lsa_dissect_lsaenumerateaccountrights_rqst(tvbuff_t *tvb, int offset,
2769         packet_info *pinfo, proto_tree *tree, char *drep)
2770 {
2771         /* [in] LSA_HANDLE hnd */
2772         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2773                 pinfo, tree, drep);
2774
2775         /* [in, ref] SID *account */
2776         offset = dissect_ndr_nt_SID(tvb, offset,
2777                 pinfo, tree, drep);
2778
2779         return offset;
2780 }
2781
2782
2783 static int
2784 lsa_dissect_lsaenumerateaccountrights_reply(tvbuff_t *tvb, int offset,
2785         packet_info *pinfo, proto_tree *tree, char *drep)
2786 {
2787         /* [out, ref] LSA_UNICODE_STRING_ARRAY *rights */
2788         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2789                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2790                 "Account pointer: rights", hf_lsa_rights, 0);
2791
2792         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2793                 hf_lsa_rc, NULL);
2794
2795         return offset;
2796 }
2797
2798
2799
2800 static dcerpc_sub_dissector dcerpc_lsa_dissectors[] = {
2801         { LSA_LSACLOSE, "LSACLOSE",
2802                 lsa_dissect_lsaclose_rqst,
2803                 lsa_dissect_lsaclose_reply },
2804         { LSA_LSADELETE, "LSADELETE",
2805                 lsa_dissect_lsadelete_rqst,
2806                 lsa_dissect_lsadelete_reply },
2807         { LSA_LSAENUMERATEPRIVILEGES, "LSAENUMERATEPRIVILEGES",
2808                 lsa_dissect_lsaenumerateprivileges_rqst,
2809                 lsa_dissect_lsaenumerateprivileges_reply },
2810         { LSA_LSAQUERYSECURITYOBJECT, "LSAQUERYSECURITYOBJECT",
2811                 lsa_dissect_lsaquerysecurityobject_rqst,
2812                 lsa_dissect_lsaquerysecurityobject_reply },
2813         { LSA_LSASETSECURITYOBJECT, "LSASETSECURITYOBJECT",
2814                 lsa_dissect_lsasetsecurityobject_rqst,
2815                 lsa_dissect_lsasetsecurityobject_reply },
2816         { LSA_LSACHANGEPASSWORD, "LSACHANGEPASSWORD",
2817                 lsa_dissect_lsachangepassword_rqst,
2818                 lsa_dissect_lsachangepassword_reply },
2819         { LSA_LSAOPENPOLICY, "LSAOPENPOLICY",
2820                 lsa_dissect_lsaopenpolicy_rqst,
2821                 lsa_dissect_lsaopenpolicy_reply },
2822         { LSA_LSAQUERYINFORMATIONPOLICY, "LSAQUERYINFORMATIONPOLICY",
2823                 lsa_dissect_lsaqueryinformationpolicy_rqst,
2824                 lsa_dissect_lsaqueryinformationpolicy_reply },
2825         { LSA_LSASETINFORMATIONPOLICY, "LSASETINFORMATIONPOLICY",
2826                 lsa_dissect_lsasetinformationpolicy_rqst,
2827                 lsa_dissect_lsasetinformationpolicy_reply },
2828         { LSA_LSACLEARAUDITLOG, "LSACLEARAUDITLOG",
2829                 lsa_dissect_lsaclearauditlog_rqst,
2830                 lsa_dissect_lsaclearauditlog_reply },
2831         { LSA_LSACREATEACCOUNT, "LSACREATEACCOUNT",
2832                 NULL, NULL },  /* 0x0a */
2833 #ifdef REMOVED
2834                 lsa_dissect_lsacreateaccount_rqst,
2835                 lsa_dissect_lsacreateaccount_reply },
2836 #endif
2837         { LSA_LSAENUMERATEACCOUNTS, "LSAENUMERATEACCOUNTS",
2838                 lsa_dissect_lsaenumerateaccounts_rqst,
2839                 lsa_dissect_lsaenumerateaccounts_reply },
2840         { LSA_LSACREATETRUSTEDDOMAIN, "LSACREATETRUSTEDDOMAIN",
2841                 lsa_dissect_lsacreatetrusteddomain_rqst,
2842                 lsa_dissect_lsacreatetrusteddomain_reply },
2843         { LSA_LSAENUMERATETRUSTEDDOMAINS, "LSAENUMERATETRUSTEDDOMAINS",
2844                 lsa_dissect_lsaenumeratetrusteddomains_rqst,
2845                 lsa_dissect_lsaenumeratetrusteddomains_reply },
2846         { LSA_LSALOOKUPNAMES, "LSALOOKUPNAMES",
2847                 lsa_dissect_lsalookupnames_rqst,
2848                 lsa_dissect_lsalookupnames_reply },
2849         { LSA_LSALOOKUPSIDS, "LSALOOKUPSIDS",
2850                 lsa_dissect_lsalookupsids_rqst,
2851                 lsa_dissect_lsalookupsids_reply },
2852         { LSA_LSACREATESECRET, "LSACREATESECRET",  /*0x10*/
2853                 lsa_dissect_lsacreatesecret_rqst,
2854                 lsa_dissect_lsacreatesecret_reply },
2855         { LSA_LSAOPENACCOUNT, "LSAOPENACCOUNT",
2856                 lsa_dissect_lsaopenaccount_rqst,
2857                 lsa_dissect_lsaopenaccount_reply },
2858         { LSA_LSAENUMERATEPRIVILEGESACCOUNT, "LSAENUMERATEPRIVILEGESACCOUNT",
2859                 lsa_dissect_lsaenumerateprivilegesaccount_rqst,
2860                 lsa_dissect_lsaenumerateprivilegesaccount_reply },
2861         { LSA_LSAADDPRIVILEGESTOACCOUNT, "LSAADDPRIVILEGESTOACCOUNT",
2862                 lsa_dissect_lsaaddprivilegestoaccount_rqst,
2863                 lsa_dissect_lsaaddprivilegestoaccount_reply },
2864         { LSA_LSAREMOVEPRIVILEGESFROMACCOUNT, "LSAREMOVEPRIVILEGESFROMACCOUNT",
2865                 lsa_dissect_lsaremoveprivilegesfromaccount_rqst,
2866                 lsa_dissect_lsaremoveprivilegesfromaccount_reply },
2867         { LSA_LSAGETQUOTASFORACCOUNT, "LSAGETQUOTASFORACCOUNT",
2868                 lsa_dissect_lsagetquotasforaccount_rqst,
2869                 lsa_dissect_lsagetquotasforaccount_reply },
2870         { LSA_LSASETQUOTASFORACCOUNT, "LSASETQUOTASFORACCOUNT",
2871                 lsa_dissect_lsasetquotasforaccount_rqst,
2872                 lsa_dissect_lsasetquotasforaccount_reply },
2873         { LSA_LSAGETSYSTEMACCESSACCOUNT, "LSAGETSYSTEMACCESSACCOUNT",
2874                 lsa_dissect_lsagetsystemaccessaccount_rqst,
2875                 lsa_dissect_lsagetsystemaccessaccount_reply },
2876         { LSA_LSASETSYSTEMACCESSACCOUNT, "LSASETSYSTEMACCESSACCOUNT",
2877                 lsa_dissect_lsasetsystemaccessaccount_rqst,
2878                 lsa_dissect_lsasetsystemaccessaccount_reply },
2879         { LSA_LSAOPENTRUSTEDDOMAIN, "LSAOPENTRUSTEDDOMAIN",
2880                 lsa_dissect_lsaopentrusteddomain_rqst,
2881                 lsa_dissect_lsaopentrusteddomain_reply },
2882         { LSA_LSAQUERYINFOTRUSTEDDOMAIN, "LSAQUERYINFOTRUSTEDDOMAIN",
2883                 lsa_dissect_lsaqueryinfotrusteddomain_rqst,
2884                 lsa_dissect_lsaqueryinfotrusteddomain_reply },
2885         { LSA_LSASETINFORMATIONTRUSTEDDOMAIN, "LSASETINFORMATIONTRUSTEDDOMAIN",
2886                 lsa_dissect_lsasetinformationtrusteddomain_rqst,
2887                 lsa_dissect_lsasetinformationtrusteddomain_reply },
2888         { LSA_LSAOPENSECRET, "LSAOPENSECRET",
2889                 lsa_dissect_lsaopensecret_rqst,
2890                 lsa_dissect_lsaopensecret_reply },
2891         { LSA_LSASETSECRET, "LSASETSECRET",
2892                 lsa_dissect_lsasetsecret_rqst,
2893                 lsa_dissect_lsasetsecret_reply },
2894         { LSA_LSAQUERYSECRET, "LSAQUERYSECRET",
2895                 lsa_dissect_lsaquerysecret_rqst,
2896                 lsa_dissect_lsaquerysecret_reply },
2897         { LSA_LSALOOKUPPRIVILEGEVALUE, "LSALOOKUPPRIVILEGEVALUE",
2898                 lsa_dissect_lsalookupprivilegevalue_rqst,
2899                 lsa_dissect_lsalookupprivilegevalue_reply },
2900         { LSA_LSALOOKUPPRIVILEGENAME, "LSALOOKUPPRIVILEGENAME",
2901                 lsa_dissect_lsalookupprivilegename_rqst,
2902                 lsa_dissect_lsalookupprivilegename_reply },
2903         { LSA_LSALOOKUPPRIVILEGEDISPLAYNAME, "LSALOOKUPPRIVILEGEDISPLAYNAME",
2904                 NULL, NULL },
2905 #ifdef REMOVED
2906                 lsa_dissect_lsalookupprivilegedisplayname_rqst,
2907                 lsa_dissect_lsalookupprivilegedisplayname_reply },
2908 #endif
2909         { LSA_LSADELETEOBJECT, "LSADELETEOBJECT",
2910                 lsa_dissect_lsadeleteobject_rqst,
2911                 lsa_dissect_lsadeleteobject_reply },
2912         { LSA_LSAENUMERATEACCOUNTSWITHUSERRIGHT, "LSAENUMERATEACCOUNTSWITHUSERRIGHT",
2913                 lsa_dissect_lsaenumerateaccountswithuserright_rqst,
2914                 lsa_dissect_lsaenumerateaccountswithuserright_reply },
2915         { LSA_LSAENUMERATEACCOUNTRIGHTS, "LSAENUMERATEACCOUNTRIGHTS",
2916                 lsa_dissect_lsaenumerateaccountrights_rqst,
2917                 lsa_dissect_lsaenumerateaccountrights_reply },
2918         { LSA_LSAADDACCOUNTRIGHTS, "LSAADDACCOUNTRIGHTS",
2919                 NULL, NULL },
2920 #ifdef REMOVED
2921                 lsa_dissect_lsaaddaccountrights_rqst,
2922                 lsa_dissect_lsaaddaccountrights_reply },
2923 #endif
2924         { LSA_LSAREMOVEACCOUNTRIGHTS, "LSAREMOVEACCOUNTRIGHTS",
2925                 NULL, NULL },
2926 #ifdef REMOVED
2927                 lsa_dissect_lsaremoveaccountrights_rqst,
2928                 lsa_dissect_lsaremoveaccountrights_reply },
2929 #endif
2930         { LSA_LSAQUERYTRUSTEDDOMAININFO, "LSAQUERYTRUSTEDDOMAININFO",
2931                 NULL, NULL },
2932 #ifdef REMOVED
2933                 lsa_dissect_lsaquerytrusteddomaininfo_rqst,
2934                 lsa_dissect_lsaquerytrusteddomaininfo_reply },
2935 #endif
2936         { LSA_LSASETTRUSTEDDOMAININFO, "LSASETTRUSTEDDOMAININFO",
2937                 NULL, NULL },
2938 #ifdef REMOVED
2939                 lsa_dissect_lsasettrusteddomaininfo_rqst,
2940                 lsa_dissect_lsasettrusteddomaininfo_reply },
2941 #endif
2942         { LSA_LSADELETETRUSTEDDOMAIN, "LSADELETETRUSTEDDOMAIN",
2943                 lsa_dissect_lsadeletetrusteddomain_rqst,
2944                 lsa_dissect_lsadeletetrusteddomain_reply },
2945         { LSA_LSASTOREPRIVATEDATA, "LSASTOREPRIVATEDATA",
2946                 NULL, NULL },
2947 #ifdef REMOVED
2948                 lsa_dissect_lsastoreprivatedata_rqst,
2949                 lsa_dissect_lsastoreprivatedata_reply },
2950 #endif
2951         { LSA_LSARETRIEVEPRIVATEDATA, "LSARETRIEVEPRIVATEDATA",
2952                 NULL, NULL },
2953 #ifdef REMOVED
2954                 lsa_dissect_lsaretrieveprivatedata_rqst,
2955                 lsa_dissect_lsaretrieveprivatedata_reply },
2956 #endif
2957         { LSA_LSAOPENPOLICY2, "LSAOPENPOLICY2",
2958                 lsa_dissect_lsaopenpolicy2_rqst,
2959                 lsa_dissect_lsaopenpolicy2_reply },
2960         { LSA_LSAGETUSERNAME, "LSAGETUSERNAME",
2961                 NULL, NULL },
2962 #ifdef REMOVED
2963                 lsa_dissect_lsagetusername_rqst,
2964                 lsa_dissect_lsagetusername_reply },
2965 #endif
2966         { LSA_LSAFUNCTION_2E, "LSAFUNCTION_2E",
2967                 NULL, NULL },
2968 #ifdef REMOVED
2969                 lsa_dissect_lsafunction_2e_rqst,
2970                 lsa_dissect_lsafunction_2e_reply },
2971 #endif
2972         { LSA_LSAFUNCTION_2F, "LSAFUNCTION_2F",
2973                 NULL, NULL },
2974 #ifdef REMOVED
2975                 lsa_dissect_lsafunction_2f_rqst,
2976                 lsa_dissect_lsafunction_2f_reply },
2977 #endif
2978         { LSA_LSAQUERYTRUSTEDDOMAININFOBYNAME, "LSAQUERYTRUSTEDDOMAININFOBYNAME",
2979                 NULL, NULL },
2980 #ifdef REMOVED
2981                 lsa_dissect_lsaquerytrusteddomaininfobyname_rqst,
2982                 lsa_dissect_lsaquerytrusteddomaininfobyname_reply },
2983 #endif
2984         { LSA_LSASETTRUSTEDDOMAININFOBYNAME, "LSASETTRUSTEDDOMAININFOBYNAME",
2985                 NULL, NULL },
2986 #ifdef REMOVED
2987                 lsa_dissect_lsasettrusteddomaininfobyname_rqst,
2988                 lsa_dissect_lsasettrusteddomaininfobyname_reply },
2989 #endif
2990         { LSA_LSAENUMERATETRUSTEDDOMAINSEX, "LSAENUMERATETRUSTEDDOMAINSEX",
2991                 NULL, NULL },
2992 #ifdef REMOVED
2993                 lsa_dissect_lsaenumeratetrusteddomainsex_rqst,
2994                 lsa_dissect_lsaenumeratetrusteddomainsex_reply },
2995 #endif
2996         { LSA_LSACREATETRUSTEDDOMAINEX, "LSACREATETRUSTEDDOMAINEX",
2997                 NULL, NULL },
2998 #ifdef REMOVED
2999                 lsa_dissect_lsacreatetrusteddomainex_rqst,
3000                 lsa_dissect_lsacreatetrusteddomainex_reply },
3001 #endif
3002         { LSA_LSACLOSETRUSTEDDOMAINEX, "LSACLOSETRUSTEDDOMAINEX",
3003                 NULL, NULL },
3004 #ifdef REMOVED
3005                 lsa_dissect_lsaclosetrusteddomainex_rqst,
3006                 lsa_dissect_lsaclosetrusteddomainex_reply },
3007 #endif
3008         { LSA_LSAQUERYDOMAININFORMATIONPOLICY, "LSAQUERYDOMAININFORMATIONPOLICY",
3009                 NULL, NULL },
3010 #ifdef REMOVED
3011                 lsa_dissect_lsaquerydomaininformationpolicy_rqst,
3012                 lsa_dissect_lsaquerydomaininformationpolicy_reply },
3013 #endif
3014         { LSA_LSASETDOMAININFORMATIONPOLICY, "LSASETDOMAININFORMATIONPOLICY",
3015                 NULL, NULL },
3016 #ifdef REMOVED
3017                 lsa_dissect_lsasetdomaininformationpolicy_rqst,
3018                 lsa_dissect_lsasetdomaininformationpolicy_reply },
3019 #endif
3020         { LSA_LSAOPENTRUSTEDDOMAINBYNAME, "LSAOPENTRUSTEDDOMAINBYNAME",
3021                 NULL, NULL },
3022 #ifdef REMOVED
3023                 lsa_dissect_lsaopentrusteddomainbyname_rqst,
3024                 lsa_dissect_lsaopentrusteddomainbyname_reply },
3025 #endif
3026         { LSA_LSAFUNCTION_38, "LSAFUNCTION_38",
3027                 NULL, NULL },
3028 #ifdef REMOVED
3029                 lsa_dissect_lsafunction_38_rqst,
3030                 lsa_dissect_lsafunction_38_reply },
3031 #endif
3032         { LSA_LSALOOKUPSIDS2, "LSALOOKUPSIDS2",
3033                 NULL, NULL },
3034 #ifdef REMOVED
3035                 lsa_dissect_lsalookupsids2_rqst,
3036                 lsa_dissect_lsalookupsids2_reply },
3037 #endif
3038         { LSA_LSALOOKUPNAMES2, "LSALOOKUPNAMES2",
3039                 NULL, NULL },
3040 #ifdef REMOVED
3041                 lsa_dissect_lsalookupnames2_rqst,
3042                 lsa_dissect_lsalookupnames2_reply },
3043 #endif
3044         { LSA_LSAFUNCTION_3B, "LSAFUNCTION_3B",
3045                 NULL, NULL },
3046 #ifdef REMOVED
3047                 lsa_dissect_lsafunction_3b_rqst,
3048                 lsa_dissect_lsafunction_3b_reply },
3049 #endif
3050         {0, NULL, NULL, NULL},
3051 };
3052
3053 void
3054 proto_register_dcerpc_lsa(void)
3055 {
3056         static hf_register_info hf[] = {
3057         { &hf_lsa_unknown_string,
3058                 { "Unknown string", "lsa.unknown_string", FT_STRING, BASE_NONE,
3059                 NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
3060
3061         { &hf_lsa_hnd,
3062                 { "Context Handle", "lsa.hnd", FT_BYTES, BASE_NONE,
3063                 NULL, 0x0, "LSA policy handle", HFILL }},
3064
3065         { &hf_lsa_server,
3066                 { "Server", "lsa.server", FT_STRING, BASE_NONE,
3067                 NULL, 0, "Name of Server", HFILL }},
3068
3069         { &hf_lsa_controller,
3070                 { "Controller", "lsa.controller", FT_STRING, BASE_NONE,
3071                 NULL, 0, "Name of Domain Controller", HFILL }},
3072
3073         { &hf_lsa_unknown_hyper,
3074                 { "Unknown hyper", "lsa.unknown.hyper", FT_UINT64, BASE_HEX,
3075                 NULL, 0x0, "Unknown hyper. If you know what this is, contact ethereal developers.", HFILL }},
3076
3077         { &hf_lsa_unknown_long,
3078                 { "Unknown long", "lsa.unknown.long", FT_UINT32, BASE_HEX,
3079                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
3080
3081         { &hf_lsa_unknown_short,
3082                 { "Unknown short", "lsa.unknown.short", FT_UINT16, BASE_HEX,
3083                 NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
3084
3085         { &hf_lsa_unknown_char,
3086                 { "Unknown char", "lsa.unknown.char", FT_UINT8, BASE_HEX,
3087                 NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
3088
3089         { &hf_lsa_rc,
3090                 { "Return code", "lsa.rc", FT_UINT32, BASE_HEX,
3091                 VALS (NT_errors), 0x0, "LSA return status code", HFILL }},
3092
3093         { &hf_lsa_obj_attr,
3094                 { "Attributes", "lsa.obj_attr", FT_UINT32, BASE_HEX,
3095                 NULL, 0x0, "LSA Attributes", HFILL }},
3096
3097         { &hf_lsa_obj_attr_len,
3098                 { "Length", "lsa.obj_attr.len", FT_UINT32, BASE_DEC,
3099                 NULL, 0x0, "Length of object attribute structure", HFILL }},
3100
3101         { &hf_lsa_obj_attr_name,
3102                 { "Name", "lsa.obj_attr.name", FT_STRING, BASE_NONE,
3103                 NULL, 0x0, "Name of object attribute", HFILL }},
3104
3105         { &hf_lsa_access_mask,
3106                 { "Access Mask", "lsa.access_mask", FT_UINT32, BASE_HEX,
3107                 NULL, 0x0, "LSA Access Mask", HFILL }},
3108
3109         { &hf_lsa_info_level,
3110                 { "Level", "lsa.info.level", FT_UINT16, BASE_DEC,
3111                 NULL, 0x0, "Information level of requested data", HFILL }},
3112
3113         { &hf_lsa_trusted_info_level,
3114                 { "Info Level", "lsa.trusted.info_level", FT_UINT16, BASE_DEC,
3115                 VALS(trusted_info_level_vals), 0x0, "Information level of requested Trusted Domain Information", HFILL }},
3116
3117         { &hf_lsa_sd_size,
3118                 { "Size", "lsa.sd_size", FT_UINT32, BASE_DEC,
3119                 NULL, 0x0, "Size of lsa security descriptor", HFILL }},
3120
3121         { &hf_lsa_qos_len,
3122                 { "Length", "lsa.qos.len", FT_UINT32, BASE_DEC,
3123                 NULL, 0x0, "Length of quality of service structure", HFILL }},
3124
3125         { &hf_lsa_qos_impersonation_level,
3126                 { "Impersonation level", "lsa.qos.imp_lev", FT_UINT16, BASE_DEC,
3127                 VALS(lsa_impersonation_level_vals), 0x0, "QOS Impersonation Level", HFILL }},
3128
3129         { &hf_lsa_qos_track_context,
3130                 { "Context Tracking", "lsa.qos.track_ctx", FT_UINT8, BASE_DEC,
3131                 NULL, 0x0, "QOS Context Tracking Mode", HFILL }},
3132
3133         { &hf_lsa_qos_effective_only,
3134                 { "Effective only", "lsa.qos.effective_only", FT_UINT8, BASE_DEC,
3135                 NULL, 0x0, "QOS Flag whether this is Effective Only or not", HFILL }},
3136
3137         { &hf_lsa_pali_percent_full,
3138                 { "Percent Full", "lsa.pali.percent_full", FT_UINT32, BASE_DEC,
3139                 NULL, 0x0, "How full audit log is in percentage", HFILL }},
3140
3141         { &hf_lsa_pali_log_size,
3142                 { "Log Size", "lsa.pali.log_size", FT_UINT32, BASE_DEC,
3143                 NULL, 0x0, "Size of audit log", HFILL }},
3144
3145         { &hf_lsa_pali_retention_period,
3146                 { "Retention Period", "lsa.pali.retention_period", FT_RELATIVE_TIME, BASE_NONE,
3147                 NULL, 0x0, "", HFILL }},
3148
3149         { &hf_lsa_pali_time_to_shutdown,
3150                 { "Time to shutdown", "lsa.pali.time_to_shutdown", FT_RELATIVE_TIME, BASE_NONE,
3151                 NULL, 0x0, "Time to shutdown", HFILL }},
3152
3153         { &hf_lsa_pali_shutdown_in_progress,
3154                 { "Shutdown in progress", "lsa.pali.shutdown_in_progress", FT_UINT8, BASE_DEC,
3155                 NULL, 0x0, "Flag whether shutdown is in progress or not", HFILL }},
3156
3157         { &hf_lsa_pali_next_audit_record,
3158                 { "Next Audit Record", "lsa.pali.next_audit_record", FT_UINT32, BASE_HEX,
3159                 NULL, 0x0, "Next audit record", HFILL }},
3160
3161         { &hf_lsa_paei_enabled,
3162                 { "Enabled", "lsa.paei.enabled", FT_UINT8, BASE_DEC,
3163                 NULL, 0x0, "If Audit Events Information is Enabled or not", HFILL }},
3164
3165         { &hf_lsa_paei_settings,
3166                 { "Settings", "lsa.paei.settings", FT_UINT32, BASE_HEX,
3167                 NULL, 0x0, "Audit Events Information settings", HFILL }},
3168
3169         { &hf_lsa_count,
3170                 { "Count", "lsa.count", FT_UINT32, BASE_DEC,
3171                 NULL, 0x0, "Count of objects", HFILL }},
3172
3173         { &hf_lsa_max_count,
3174                 { "Max Count", "lsa.max_count", FT_UINT32, BASE_DEC,
3175                 NULL, 0x0, "", HFILL }},
3176
3177         { &hf_lsa_domain,
3178                 { "Domain", "lsa.domain", FT_STRING, BASE_NONE,
3179                 NULL, 0x0, "Domain", HFILL }},
3180
3181         { &hf_lsa_acct,
3182                 { "Account", "lsa.acct", FT_STRING, BASE_NONE,
3183                 NULL, 0x0, "Account", HFILL }},
3184
3185         { &hf_lsa_source,
3186                 { "Source", "lsa.source", FT_STRING, BASE_NONE,
3187                 NULL, 0x0, "Replica Source", HFILL }},
3188
3189         { &hf_lsa_server_role,
3190                 { "Role", "lsa.server_role", FT_UINT16, BASE_DEC,
3191                 VALS(server_role_vals), 0x0, "LSA Server Role", HFILL }},
3192
3193         { &hf_lsa_quota_paged_pool,
3194                 { "Paged Pool", "lsa.quota.paged_pool", FT_UINT32, BASE_DEC,
3195                 NULL, 0x0, "Size of Quota Paged Pool", HFILL }},
3196
3197         { &hf_lsa_quota_non_paged_pool,
3198                 { "Non Paged Pool", "lsa.quota.non_paged_pool", FT_UINT32, BASE_DEC,
3199                 NULL, 0x0, "Size of Quota non-Paged Pool", HFILL }},
3200
3201         { &hf_lsa_quota_min_wss,
3202                 { "Min WSS", "lsa.quota.min_wss", FT_UINT32, BASE_DEC,
3203                 NULL, 0x0, "Size of Quota Min WSS", HFILL }},
3204
3205         { &hf_lsa_quota_max_wss,
3206                 { "Max WSS", "lsa.quota.max_wss", FT_UINT32, BASE_DEC,
3207                 NULL, 0x0, "Size of Quota Max WSS", HFILL }},
3208
3209         { &hf_lsa_quota_pagefile,
3210                 { "Pagefile", "lsa.quota.pagefile", FT_UINT32, BASE_DEC,
3211                 NULL, 0x0, "Size of quota pagefile usage", HFILL }},
3212
3213         { &hf_lsa_mod_seq_no,
3214                 { "Seq No", "lsa.mod.seq_no", FT_UINT64, BASE_DEC,
3215                 NULL, 0x0, "Sequence number for this modification", HFILL }},
3216
3217         { &hf_lsa_mod_mtime,
3218                 { "MTime", "lsa.mod.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
3219                 NULL, 0x0, "Time when this modification occured", HFILL }},
3220
3221         { &hf_lsa_cur_mtime,
3222                 { "Current MTime", "lsa.cur.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
3223                 NULL, 0x0, "Current MTime to set", HFILL }},
3224
3225         { &hf_lsa_old_mtime,
3226                 { "Old MTime", "lsa.old.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
3227                 NULL, 0x0, "Old MTime for this object", HFILL }},
3228
3229         { &hf_lsa_name,
3230                 { "Name", "lsa.name", FT_STRING, BASE_NONE,
3231                 NULL, 0x0, "", HFILL }},
3232
3233         { &hf_lsa_flat_name,
3234                 { "Flat Name", "lsa.flat_name", FT_STRING, BASE_NONE,
3235                 NULL, 0x0, "", HFILL }},
3236
3237         { &hf_lsa_forest,
3238                 { "Forest", "lsa.forest", FT_STRING, BASE_NONE,
3239                 NULL, 0x0, "", HFILL }},
3240
3241         { &hf_lsa_info_type,
3242                 { "Info Type", "lsa.info_type", FT_UINT32, BASE_DEC,
3243                 NULL, 0x0, "", HFILL }},
3244
3245         { &hf_lsa_new_pwd,
3246                 { "New Password", "lsa.new_pwd", FT_BYTES, BASE_HEX,
3247                 NULL, 0x0, "New password", HFILL }},
3248
3249         { &hf_lsa_old_pwd,
3250                 { "Old Password", "lsa.old_pwd", FT_BYTES, BASE_HEX,
3251                 NULL, 0x0, "Old password", HFILL }},
3252
3253         { &hf_lsa_sid_type,
3254                 { "SID Type", "lsa.sid_type", FT_UINT16, BASE_DEC,
3255                 VALS(sid_type_vals), 0x0, "Type of SID", HFILL }},
3256
3257         { &hf_lsa_rid,
3258                 { "RID", "lsa.rid", FT_UINT32, BASE_HEX,
3259                 NULL, 0x0, "RID", HFILL }},
3260
3261         { &hf_lsa_rid_offset,
3262                 { "RID Offset", "lsa.rid.offset", FT_UINT32, BASE_HEX,
3263                 NULL, 0x0, "RID Offset", HFILL }},
3264
3265         { &hf_lsa_index,
3266                 { "Index", "lsa.index", FT_UINT32, BASE_DEC,
3267                 NULL, 0x0, "", HFILL }},
3268
3269         { &hf_lsa_num_mapped,
3270                 { "Num Mapped", "lsa.num_mapped", FT_UINT32, BASE_DEC,
3271                 NULL, 0x0, "", HFILL }},
3272
3273         { &hf_lsa_policy_information_class,
3274                 { "Info Class", "lsa.policy.info", FT_UINT16, BASE_DEC,
3275                 VALS(policy_information_class_vals), 0x0, "Policy information class", HFILL }},
3276
3277         { &hf_lsa_secret,
3278                 { "LSA Secret", "lsa.secret", FT_BYTES, BASE_HEX,
3279                 NULL, 0, "", HFILL }},
3280
3281         { &hf_lsa_auth_blob,
3282                 { "Auth blob", "lsa.auth.blob", FT_BYTES, BASE_HEX,
3283                 NULL, 0, "", HFILL }},
3284
3285         { &hf_nt_luid_high,
3286                 { "High", "nt.luid.high", FT_UINT32, BASE_HEX,
3287                 NULL, 0x0, "LUID High component", HFILL }},
3288
3289         { &hf_nt_luid_low,
3290                 { "Low", "nt.luid.low", FT_UINT32, BASE_HEX,
3291                 NULL, 0x0, "LUID Low component", HFILL }},
3292
3293         { &hf_lsa_size,
3294                 { "Size", "lsa.size", FT_UINT32, BASE_DEC,
3295                 NULL, 0x0, "", HFILL }},
3296
3297         { &hf_lsa_privilege_name,
3298                 { "Name", "lsa.privilege.name", FT_STRING, BASE_NONE,
3299                 NULL, 0x0, "LSA Privilege Name", HFILL }},
3300
3301         { &hf_lsa_rights,
3302                 { "Rights", "lsa.rights", FT_STRING, BASE_NONE,
3303                 NULL, 0x0, "Account Rights", HFILL }},
3304
3305         { &hf_lsa_attr,
3306                 { "Attr", "lsa.attr", FT_UINT64, BASE_HEX,
3307                 NULL, 0x0, "LSA Attributes", HFILL }},
3308
3309         { &hf_lsa_auth_update,
3310                 { "Update", "lsa.auth.update", FT_UINT64, BASE_HEX,
3311                 NULL, 0x0, "LSA Auth Info update", HFILL }},
3312
3313         { &hf_lsa_resume_handle,
3314                 { "Resume Handle", "lsa.resume_handle", FT_UINT32, BASE_DEC,
3315                 NULL, 0x0, "Resume Handle", HFILL }},
3316
3317         { &hf_lsa_trust_direction,
3318                 { "Trust Direction", "lsa.trust.direction", FT_UINT32, BASE_DEC,
3319                 VALS(trusted_direction_vals), 0x0, "Trust direction", HFILL }},
3320
3321         { &hf_lsa_trust_type,
3322                 { "Trust Type", "lsa.trust.type", FT_UINT32, BASE_DEC,
3323                 VALS(trusted_type_vals), 0x0, "Trust type", HFILL }},
3324
3325         { &hf_lsa_trust_attr,
3326                 { "Trust Attr", "lsa.trust.attr", FT_UINT32, BASE_HEX,
3327                 NULL, 0x0, "Trust attributes", HFILL }},
3328
3329         { &hf_lsa_trust_attr_non_trans,
3330                 { "Non Transitive", "lsa.trust.attr.non_trans", FT_BOOLEAN, 32,
3331                 TFS(&tfs_trust_attr_non_trans), 0x00000001, "Non Transitive trust", HFILL }},
3332
3333         { &hf_lsa_trust_attr_uplevel_only,
3334                 { "Upleve only", "lsa.trust.attr.uplevel_only", FT_BOOLEAN, 32,
3335                 TFS(&tfs_trust_attr_uplevel_only), 0x00000002, "Uplevel only trust", HFILL }},
3336
3337         { &hf_lsa_trust_attr_tree_parent,
3338                 { "Tree Parent", "lsa.trust.attr.tree_parent", FT_BOOLEAN, 32,
3339                 TFS(&tfs_trust_attr_tree_parent), 0x00400000, "Tree Parent trust", HFILL }},
3340
3341         { &hf_lsa_trust_attr_tree_root,
3342                 { "Tree Root", "lsa.trust.attr.tree_root", FT_BOOLEAN, 32,
3343                 TFS(&tfs_trust_attr_tree_root), 0x00800000, "Tree Root trust", HFILL }},
3344
3345         { &hf_lsa_auth_type,
3346                 { "Auth Type", "lsa.auth.type", FT_UINT32, BASE_DEC,
3347                 NULL, 0x0, "Auth Info type", HFILL }},
3348
3349         { &hf_lsa_auth_len,
3350                 { "Auth Len", "lsa.auth.len", FT_UINT32, BASE_DEC,
3351                 NULL, 0x0, "Auth Info len", HFILL }},
3352
3353
3354         };
3355
3356         static gint *ett[] = {
3357                 &ett_dcerpc_lsa,
3358                 &ett_lsa_OBJECT_ATTRIBUTES,
3359                 &ett_LSA_SECURITY_DESCRIPTOR,
3360                 &ett_lsa_policy_info,
3361                 &ett_lsa_policy_audit_log_info,
3362                 &ett_lsa_policy_audit_events_info,
3363                 &ett_lsa_policy_primary_domain_info,
3364                 &ett_lsa_policy_primary_account_info,
3365                 &ett_lsa_policy_server_role_info,
3366                 &ett_lsa_policy_replica_source_info,
3367                 &ett_lsa_policy_default_quota_info,
3368                 &ett_lsa_policy_modification_info,
3369                 &ett_lsa_policy_audit_full_set_info,
3370                 &ett_lsa_policy_audit_full_query_info,
3371                 &ett_lsa_policy_dns_domain_info,
3372                 &ett_lsa_translated_names,
3373                 &ett_lsa_translated_name,
3374                 &ett_lsa_referenced_domain_list,
3375                 &ett_lsa_trust_information,
3376                 &ett_lsa_trust_information_ex,
3377                 &ett_LUID,
3378                 &ett_LSA_PRIVILEGES,
3379                 &ett_LSA_PRIVILEGE,
3380                 &ett_LSA_LUID_AND_ATTRIBUTES_ARRAY,
3381                 &ett_LSA_LUID_AND_ATTRIBUTES,
3382                 &ett_LSA_TRUSTED_DOMAIN_LIST,
3383                 &ett_LSA_TRUSTED_DOMAIN,
3384                 &ett_LSA_TRANSLATED_SIDS,
3385                 &ett_lsa_trusted_domain_info,
3386                 &ett_lsa_trust_attr,
3387                 &ett_lsa_trusted_domain_auth_information,
3388                 &ett_lsa_auth_information,
3389         };
3390
3391         proto_dcerpc_lsa = proto_register_protocol(
3392                 "Microsoft Local Security Architecture", "LSA", "lsa");
3393
3394         proto_register_field_array (proto_dcerpc_lsa, hf, array_length (hf));
3395         proto_register_subtree_array(ett, array_length(ett));
3396 }
3397
3398 /* Protocol handoff */
3399
3400 static e_uuid_t uuid_dcerpc_lsa = {
3401         0x12345778, 0x1234, 0xabcd,
3402         { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab}
3403 };
3404
3405 static guint16 ver_dcerpc_lsa = 0;
3406
3407 void
3408 proto_reg_handoff_dcerpc_lsa(void)
3409 {
3410         /* Register protocol as dcerpc */
3411
3412         dcerpc_init_uuid(proto_dcerpc_lsa, ett_dcerpc_lsa, &uuid_dcerpc_lsa,
3413                          ver_dcerpc_lsa, dcerpc_lsa_dissectors);
3414 }