packet-dcerpc-lsa.c

   1 /* packet-dcerpc-lsa.c
   2  * Routines for SMB \PIPE\lsarpc packet disassembly
   3  * Copyright 2001,2003 Tim Potter <tpot@samba.org>
   4  *  2002  Added LSA command dissectors  Ronnie Sahlberg
   5  *
   6  * $Id: packet-dcerpc-lsa.c,v 1.80 2003/05/21 10:39:19 sahlberg Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <string.h>
  33
  34 #include <epan/packet.h>
  35 #include "packet-dcerpc.h"
  36 #include "packet-dcerpc-nt.h"
  37 #include "packet-dcerpc-lsa.h"
  38 #include "packet-smb-common.h"
  39 #include "smb.h"
  40
  41 static int proto_dcerpc_lsa = -1;
  42
  43 static int hf_lsa_opnum = -1;
  44 static int hf_lsa_rc = -1;
  45 static int hf_lsa_hnd = -1;
  46 static int hf_lsa_server = -1;
  47 static int hf_lsa_controller = -1;
  48 static int hf_lsa_obj_attr = -1;
  49 static int hf_lsa_obj_attr_len = -1;
  50 static int hf_lsa_obj_attr_name = -1;
  51 static int hf_lsa_access_mask = -1;
  52 static int hf_lsa_info_level = -1;
  53 static int hf_lsa_trusted_info_level = -1;
  54 static int hf_lsa_sd_size = -1;
  55 static int hf_lsa_qos_len = -1;
  56 static int hf_lsa_qos_impersonation_level = -1;
  57 static int hf_lsa_qos_track_context = -1;
  58 static int hf_lsa_qos_effective_only = -1;
  59 static int hf_lsa_pali_percent_full = -1;
  60 static int hf_lsa_pali_log_size = -1;
  61 static int hf_lsa_pali_retention_period = -1;
  62 static int hf_lsa_pali_time_to_shutdown = -1;
  63 static int hf_lsa_pali_shutdown_in_progress = -1;
  64 static int hf_lsa_pali_next_audit_record = -1;
  65 static int hf_lsa_paei_enabled = -1;
  66 static int hf_lsa_paei_settings = -1;
  67 static int hf_lsa_count = -1;
  68 static int hf_lsa_size = -1;
  69 static int hf_lsa_size16 = -1;
  70 static int hf_lsa_size_needed = -1;
  71 static int hf_lsa_max_count = -1;
  72 static int hf_lsa_index = -1;
  73 static int hf_lsa_domain = -1;
  74 static int hf_lsa_domain_sid = -1;
  75 static int hf_lsa_acct = -1;
  76 static int hf_lsa_server_role = -1;
  77 static int hf_lsa_source = -1;
  78 static int hf_lsa_quota_paged_pool = -1;
  79 static int hf_lsa_quota_non_paged_pool = -1;
  80 static int hf_lsa_quota_min_wss = -1;
  81 static int hf_lsa_quota_max_wss = -1;
  82 static int hf_lsa_quota_pagefile = -1;
  83 static int hf_lsa_mod_seq_no = -1;
  84 static int hf_lsa_mod_mtime = -1;
  85 static int hf_lsa_cur_mtime = -1;
  86 static int hf_lsa_old_mtime = -1;
  87 static int hf_lsa_name = -1;
  88 static int hf_lsa_key = -1;
  89 static int hf_lsa_flat_name = -1;
  90 static int hf_lsa_forest = -1;
  91 static int hf_lsa_info_type = -1;
  92 static int hf_lsa_old_pwd = -1;
  93 static int hf_lsa_new_pwd = -1;
  94 static int hf_lsa_sid_type = -1;
  95 static int hf_lsa_rid = -1;
  96 static int hf_lsa_rid_offset = -1;
  97 static int hf_lsa_num_mapped = -1;
  98 static int hf_lsa_policy_information_class = -1;
  99 static int hf_lsa_secret = -1;
 100 static int hf_nt_luid_high = -1;
 101 static int hf_nt_luid_low = -1;
 102 static int hf_lsa_privilege_name = -1;
 103 static int hf_lsa_attr = -1;
 104 static int hf_lsa_resume_handle = -1;
 105 static int hf_lsa_trust_direction = -1;
 106 static int hf_lsa_trust_type = -1;
 107 static int hf_lsa_trust_attr = -1;
 108 static int hf_lsa_trust_attr_non_trans = -1;
 109 static int hf_lsa_trust_attr_uplevel_only = -1;
 110 static int hf_lsa_trust_attr_tree_parent = -1;
 111 static int hf_lsa_trust_attr_tree_root = -1;
 112 static int hf_lsa_auth_update = -1;
 113 static int hf_lsa_auth_type = -1;
 114 static int hf_lsa_auth_len = -1;
 115 static int hf_lsa_auth_blob = -1;
 116 static int hf_lsa_rights = -1;
 117 static int hf_lsa_remove_all = -1;
 118
 119 static int hf_lsa_unknown_hyper = -1;
 120 static int hf_lsa_unknown_long = -1;
 121 static int hf_lsa_unknown_short = -1;
 122 static int hf_lsa_unknown_char = -1;
 123 static int hf_lsa_unknown_string = -1;
 124 #ifdef LSA_UNUSED_HANDLES
 125 static int hf_lsa_unknown_time = -1;
 126 #endif
 127
 128
 129 static gint ett_dcerpc_lsa = -1;
 130 static gint ett_lsa_OBJECT_ATTRIBUTES = -1;
 131 static gint ett_LSA_SECURITY_DESCRIPTOR = -1;
 132 static gint ett_lsa_policy_info = -1;
 133 static gint ett_lsa_policy_audit_log_info = -1;
 134 static gint ett_lsa_policy_audit_events_info = -1;
 135 static gint ett_lsa_policy_primary_domain_info = -1;
 136 static gint ett_lsa_policy_primary_account_info = -1;
 137 static gint ett_lsa_policy_server_role_info = -1;
 138 static gint ett_lsa_policy_replica_source_info = -1;
 139 static gint ett_lsa_policy_default_quota_info = -1;
 140 static gint ett_lsa_policy_modification_info = -1;
 141 static gint ett_lsa_policy_audit_full_set_info = -1;
 142 static gint ett_lsa_policy_audit_full_query_info = -1;
 143 static gint ett_lsa_policy_dns_domain_info = -1;
 144 static gint ett_lsa_translated_names = -1;
 145 static gint ett_lsa_translated_name = -1;
 146 static gint ett_lsa_referenced_domain_list = -1;
 147 static gint ett_lsa_trust_information = -1;
 148 static gint ett_lsa_trust_information_ex = -1;
 149 static gint ett_LUID = -1;
 150 static gint ett_LSA_PRIVILEGES = -1;
 151 static gint ett_LSA_PRIVILEGE = -1;
 152 static gint ett_LSA_LUID_AND_ATTRIBUTES_ARRAY = -1;
 153 static gint ett_LSA_LUID_AND_ATTRIBUTES = -1;
 154 static gint ett_LSA_TRUSTED_DOMAIN_LIST = -1;
 155 static gint ett_LSA_TRUSTED_DOMAIN = -1;
 156 static gint ett_LSA_TRANSLATED_SIDS = -1;
 157 static gint ett_lsa_trusted_domain_info = -1;
 158 static gint ett_lsa_trust_attr = -1;
 159 static gint ett_lsa_trusted_domain_auth_information = -1;
 160 static gint ett_lsa_auth_information = -1;
 161
 162
 163 static int
 164 lsa_dissect_pointer_NTTIME(tvbuff_t *tvb, int offset,
 165                              packet_info *pinfo, proto_tree *tree,
 166                              char *drep)
 167 {
 168         dcerpc_info *di;
 169
 170         di=pinfo->private_data;
 171         if(di->conformant_run){
 172                 /*just a run to handle conformant arrays, nothing to dissect */
 173                 return offset;
 174         }
 175
 176         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 177                 di->hf_index);
 178
 179         return offset;
 180 }
 181
 182 static int
 183 lsa_dissect_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
 184                              packet_info *pinfo, proto_tree *tree,
 185                              char *drep)
 186 {
 187         dcerpc_info *di;
 188
 189         di=pinfo->private_data;
 190         if(di->conformant_run){
 191                 /*just a run to handle conformant arrays, nothing to dissect */
 192                 return offset;
 193         }
 194
 195         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 196                         di->hf_index, 0);
 197         return offset;
 198 }
 199
 200 static int
 201 lsa_dissect_pointer_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
 202                              packet_info *pinfo, proto_tree *tree,
 203                              char *drep)
 204 {
 205         dcerpc_info *di;
 206
 207         di=pinfo->private_data;
 208         if(di->conformant_run){
 209                 /*just a run to handle conformant arrays, nothing to dissect */
 210                 return offset;
 211         }
 212
 213         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 214                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
 215                 "DOMAIN pointer: ", di->hf_index);
 216
 217         return offset;
 218 }
 219
 220 static int
 221 lsa_dissect_pointer_STRING(tvbuff_t *tvb, int offset,
 222                              packet_info *pinfo, proto_tree *tree,
 223                              char *drep)
 224 {
 225         dcerpc_info *di;
 226
 227         di=pinfo->private_data;
 228         if(di->conformant_run){
 229                 /*just a run to handle conformant arrays, nothing to dissect */
 230                 return offset;
 231         }
 232
 233         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 234                         di->hf_index, 0);
 235         return offset;
 236 }
 237
 238
 239 static int
 240 lsa_dissect_LSA_SECRET_data(tvbuff_t *tvb, int offset,
 241                              packet_info *pinfo, proto_tree *tree,
 242                              char *drep)
 243 {
 244         guint32 len;
 245         dcerpc_info *di;
 246
 247         di=pinfo->private_data;
 248         if(di->conformant_run){
 249                 /*just a run to handle conformant arrays, nothing to dissect */
 250                 return offset;
 251         }
 252
 253         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 254                                      hf_lsa_sd_size, &len);
 255         proto_tree_add_item(tree, hf_lsa_secret, tvb, offset, len, FALSE);
 256         offset += len;
 257
 258         return offset;
 259 }
 260 int
 261 lsa_dissect_LSA_SECRET(tvbuff_t *tvb, int offset,
 262                         packet_info *pinfo, proto_tree *parent_tree,
 263                         char *drep)
 264 {
 265         proto_item *item=NULL;
 266         proto_tree *tree=NULL;
 267         int old_offset=offset;
 268
 269         if(parent_tree){
 270                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 271                         "LSA_SECRET:");
 272                 tree = proto_item_add_subtree(item, ett_LSA_SECURITY_DESCRIPTOR);
 273         }
 274
 275         /* XXX need to figure this one out */
 276         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 277                                      hf_lsa_sd_size, NULL);
 278         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 279                         lsa_dissect_LSA_SECRET_data, NDR_POINTER_UNIQUE,
 280                         "LSA SECRET data:", -1);
 281
 282         proto_item_set_len(item, offset-old_offset);
 283         return offset;
 284 }
 285
 286 static int
 287 lsa_dissect_LSA_SECRET_pointer(tvbuff_t *tvb, int offset,
 288                         packet_info *pinfo, proto_tree *tree,
 289                         char *drep)
 290 {
 291         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 292                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
 293                 "LSA_SECRET pointer: data", -1);
 294
 295         return offset;
 296 }
 297
 298 /* Dissect LSA specific access rights */
 299
 300 static gint hf_view_local_info = -1;
 301 static gint hf_view_audit_info = -1;
 302 static gint hf_get_private_info = -1;
 303 static gint hf_trust_admin = -1;
 304 static gint hf_create_account = -1;
 305 static gint hf_create_secret = -1;
 306 static gint hf_create_priv = -1;
 307 static gint hf_set_default_quota_limits = -1;
 308 static gint hf_set_audit_requirements = -1;
 309 static gint hf_server_admin = -1;
 310 static gint hf_lookup_names = -1;
 311
 312 static void
 313 lsa_specific_rights(tvbuff_t *tvb, gint offset, proto_tree *tree,
 314                     guint32 access)
 315 {
 316         proto_tree_add_boolean(
 317                 tree, hf_lookup_names, tvb, offset, 4, access);
 318
 319         proto_tree_add_boolean(
 320                 tree, hf_server_admin, tvb, offset, 4, access);
 321
 322         proto_tree_add_boolean(
 323                 tree, hf_set_audit_requirements, tvb, offset, 4, access);
 324
 325         proto_tree_add_boolean(
 326                 tree, hf_set_default_quota_limits, tvb, offset, 4, access);
 327
 328         proto_tree_add_boolean(
 329                 tree, hf_create_priv, tvb, offset, 4, access);
 330
 331         proto_tree_add_boolean(
 332                 tree, hf_create_secret, tvb, offset, 4, access);
 333
 334         proto_tree_add_boolean(
 335                 tree, hf_create_account, tvb, offset, 4, access);
 336
 337         proto_tree_add_boolean(
 338                 tree, hf_trust_admin, tvb, offset, 4, access);
 339
 340         proto_tree_add_boolean(
 341                 tree, hf_get_private_info, tvb, offset, 4, access);
 342
 343         proto_tree_add_boolean(
 344                 tree, hf_view_audit_info, tvb, offset, 4, access);
 345
 346         proto_tree_add_boolean(
 347                 tree, hf_view_local_info, tvb, offset, 4, access);
 348 }
 349
 350 struct access_mask_info lsa_access_mask_info = {
 351         "LSA",                  /* Name of specific rights */
 352         lsa_specific_rights,    /* Dissection function */
 353         NULL,                   /* Generic mapping table */
 354         NULL                    /* Standard mapping table */
 355 };
 356
 357 int
 358 lsa_dissect_LSA_SECURITY_DESCRIPTOR_data(tvbuff_t *tvb, int offset,
 359                              packet_info *pinfo, proto_tree *tree,
 360                              char *drep)
 361 {
 362         guint32 len;
 363         dcerpc_info *di;
 364
 365         di=pinfo->private_data;
 366         if(di->conformant_run){
 367                 /*just a run to handle conformant arrays, nothing to dissect */
 368                 return offset;
 369         }
 370
 371         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 372                                      hf_lsa_sd_size, &len);
 373
 374         dissect_nt_sec_desc(
 375                 tvb, offset, pinfo, tree, drep, len, &lsa_access_mask_info);
 376
 377         offset += len;
 378
 379         return offset;
 380 }
 381 int
 382 lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvbuff_t *tvb, int offset,
 383                         packet_info *pinfo, proto_tree *parent_tree,
 384                         char *drep)
 385 {
 386         proto_item *item=NULL;
 387         proto_tree *tree=NULL;
 388         int old_offset=offset;
 389
 390         if(parent_tree){
 391                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 392                         "LSA_SECURITY_DESCRIPTOR:");
 393                 tree = proto_item_add_subtree(item, ett_LSA_SECURITY_DESCRIPTOR);
 394         }
 395
 396         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 397                                     hf_lsa_sd_size, NULL);
 398
 399         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 400                         lsa_dissect_LSA_SECURITY_DESCRIPTOR_data, NDR_POINTER_UNIQUE,
 401                         "LSA SECURITY DESCRIPTOR data:", -1);
 402
 403         proto_item_set_len(item, offset-old_offset);
 404         return offset;
 405 }
 406
 407 static int
 408 lsa_dissect_LPSTR(tvbuff_t *tvb, int offset,
 409         packet_info *pinfo, proto_tree *tree, char *drep)
 410 {
 411         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 412                         hf_lsa_unknown_char, NULL);
 413
 414         return offset;
 415 }
 416
 417 static const value_string lsa_impersonation_level_vals[] = {
 418         {0,     "Anonymous"},
 419         {1,     "Identification"},
 420         {2,     "Impersonation"},
 421         {3,     "Delegation"},
 422         {0, NULL}
 423 };
 424
 425
 426 static int
 427 lsa_dissect_SECURITY_QUALITY_OF_SERVICE(tvbuff_t *tvb, int offset,
 428         packet_info *pinfo, proto_tree *tree, char *drep)
 429 {
 430         /* Length */
 431         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 432                         hf_lsa_qos_len, NULL);
 433
 434         /* impersonation level */
 435         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 436                         hf_lsa_qos_impersonation_level, NULL);
 437
 438         /* context tracking mode */
 439         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 440                         hf_lsa_qos_track_context, NULL);
 441
 442         /* effective only */
 443         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 444                         hf_lsa_qos_effective_only, NULL);
 445
 446         return offset;
 447 }
 448
 449 static int
 450 lsa_dissect_ACCESS_MASK(tvbuff_t *tvb, int offset,
 451         packet_info *pinfo, proto_tree *tree, char *drep)
 452 {
 453         offset = dissect_nt_access_mask(
 454                 tvb, offset, pinfo, tree, drep, hf_lsa_access_mask,
 455                 &lsa_access_mask_info);
 456
 457         return offset;
 458 }
 459
 460 static int
 461 lsa_dissect_LSA_HANDLE(tvbuff_t *tvb, int offset,
 462         packet_info *pinfo, proto_tree *tree, char *drep)
 463 {
 464         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 465                         hf_lsa_hnd, NULL, FALSE, FALSE);
 466
 467         return offset;
 468 }
 469
 470 static int
 471 lsa_dissect_LSA_HANDLE_open(tvbuff_t *tvb, int offset,
 472         packet_info *pinfo, proto_tree *tree, char *drep)
 473 {
 474         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 475                         hf_lsa_hnd, NULL, TRUE, FALSE);
 476
 477         return offset;
 478 }
 479
 480 static int
 481 lsa_dissect_LSA_HANDLE_close(tvbuff_t *tvb, int offset,
 482         packet_info *pinfo, proto_tree *tree, char *drep)
 483 {
 484         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 485                         hf_lsa_hnd, NULL, FALSE, TRUE);
 486
 487         return offset;
 488 }
 489
 490
 491 static int
 492 lsa_dissect_LSA_OBJECT_ATTRIBUTES(tvbuff_t *tvb, int offset,
 493         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 494 {
 495         int old_offset=offset;
 496         proto_item *item = NULL;
 497         proto_tree *tree = NULL;
 498
 499         if(parent_tree){
 500                 item = proto_tree_add_text(parent_tree, tvb, offset, -1, "Object Attributes");
 501                 tree = proto_item_add_subtree(item, ett_lsa_OBJECT_ATTRIBUTES);
 502         }
 503
 504         /* Length */
 505         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 506                         hf_lsa_obj_attr_len, NULL);
 507
 508         /* LPSTR */
 509         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 510                 lsa_dissect_LPSTR, NDR_POINTER_UNIQUE,
 511                 "LSPTR pointer: ", -1);
 512
 513         /* attribute name */
 514         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 515                 lsa_dissect_pointer_STRING, NDR_POINTER_UNIQUE,
 516                 "NAME pointer: ", hf_lsa_obj_attr_name);
 517
 518         /* Attr */
 519         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 520                         hf_lsa_obj_attr, NULL);
 521
 522         /* security descriptor */
 523         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 524                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
 525                 "LSA_SECURITY_DESCRIPTOR pointer: ", -1);
 526
 527         /* security quality of service */
 528         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 529                 lsa_dissect_SECURITY_QUALITY_OF_SERVICE, NDR_POINTER_UNIQUE,
 530                 "LSA_SECURITY_QUALITY_OF_SERVICE pointer: ", -1);
 531
 532         proto_item_set_len(item, offset-old_offset);
 533         return offset;
 534 }
 535
 536 static int
 537 lsa_dissect_lsaclose_rqst(tvbuff_t *tvb, int offset,
 538         packet_info *pinfo, proto_tree *tree, char *drep)
 539 {
 540         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 541                 lsa_dissect_LSA_HANDLE_close, NDR_POINTER_REF,
 542                 "LSA_HANDLE", -1);
 543         return offset;
 544 }
 545
 546
 547 static int
 548 lsa_dissect_lsaclose_reply(tvbuff_t *tvb, int offset,
 549         packet_info *pinfo, proto_tree *tree, char *drep)
 550 {
 551         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 552                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
 553                 "LSA_HANDLE", -1);
 554
 555         offset = dissect_ntstatus(
 556                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
 557
 558         return offset;
 559 }
 560
 561 /* A bug in the NT IDL for lsa openpolicy only stores the first (wide)
 562    character of the server name which is always '\'.  This is fixed in lsa
 563    openpolicy2 but the function remains for backwards compatibility. */
 564
 565 static int dissect_lsa_openpolicy_server(tvbuff_t *tvb, int offset,
 566                                              packet_info *pinfo,
 567                                              proto_tree *tree, char *drep)
 568 {
 569         return dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 570                                   hf_lsa_server, NULL);
 571 }
 572
 573 static int
 574 lsa_dissect_lsaopenpolicy_rqst(tvbuff_t *tvb, int offset,
 575         packet_info *pinfo, proto_tree *tree, char *drep)
 576 {
 577         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 578                 dissect_lsa_openpolicy_server, NDR_POINTER_UNIQUE,
 579                 "Server:", hf_lsa_server);
 580
 581         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 582                 lsa_dissect_LSA_OBJECT_ATTRIBUTES, NDR_POINTER_REF,
 583                 "OBJECT_ATTRIBUTES", -1);
 584
 585         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
 586                 pinfo, tree, drep);
 587         return offset;
 588 }
 589
 590 static int
 591 lsa_dissect_lsaopenpolicy_reply(tvbuff_t *tvb, int offset,
 592         packet_info *pinfo, proto_tree *tree, char *drep)
 593 {
 594         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 595                 lsa_dissect_LSA_HANDLE_open, NDR_POINTER_REF,
 596                 "LSA_HANDLE", -1);
 597
 598         offset = dissect_ntstatus(
 599                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
 600
 601         return offset;
 602 }
 603
 604 static int
 605 lsa_dissect_lsaopenpolicy2_rqst(tvbuff_t *tvb, int offset,
 606         packet_info *pinfo, proto_tree *tree, char *drep)
 607 {
 608         offset = dissect_ndr_pointer_cb(tvb, offset, pinfo, tree, drep,
 609                 dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "Server",
 610                 hf_lsa_server, cb_wstr_postprocess,
 611                 GINT_TO_POINTER(CB_STR_COL_INFO | CB_STR_SAVE | 1));
 612
 613         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 614                 lsa_dissect_LSA_OBJECT_ATTRIBUTES, NDR_POINTER_REF,
 615                 "OBJECT_ATTRIBUTES", -1);
 616
 617         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
 618                 pinfo, tree, drep);
 619         return offset;
 620 }
 621
 622
 623 static int
 624 lsa_dissect_lsaopenpolicy2_reply(tvbuff_t *tvb, int offset,
 625         packet_info *pinfo, proto_tree *tree, char *drep)
 626 {
 627         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 628                 lsa_dissect_LSA_HANDLE_open, NDR_POINTER_REF,
 629                 "LSA_HANDLE", -1);
 630
 631         offset = dissect_ntstatus(
 632                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
 633
 634         return offset;
 635 }
 636
 637 static const value_string policy_information_class_vals[] = {
 638         {1,     "Audit Log Information"},
 639         {2,     "Audit Events Information"},
 640         {3,     "Primary Domain Information"},
 641         {4,     "Pd Account Information"},
 642         {5,     "Account Domain Information"},
 643         {6,     "Server Role Information"},
 644         {7,     "Replica Source Information"},
 645         {8,     "Default Quota Information"},
 646         {9,     "Modification Information"},
 647         {10,    "Audit Full Set Information"},
 648         {11,    "Audit Full Query Information"},
 649         {12,    "DNS Domain Information"},
 650         {0, NULL}
 651 };
 652
 653 static int
 654 lsa_dissect_lsaqueryinformationpolicy_rqst(tvbuff_t *tvb, int offset,
 655         packet_info *pinfo, proto_tree *tree, char *drep)
 656 {
 657         guint16 level;
 658
 659         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 660                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
 661                 "LSA_HANDLE", -1);
 662
 663         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 664                 hf_lsa_policy_information_class, &level);
 665
 666         if (check_col(pinfo->cinfo, COL_INFO))
 667                 col_append_fstr(
 668                         pinfo->cinfo, COL_INFO, ", %s",
 669                         val_to_str(level, policy_information_class_vals,
 670                                    "Unknown (%d)"));
 671
 672         return offset;
 673 }
 674
 675 static int
 676 lsa_dissect_POLICY_AUDIT_LOG_INFO(tvbuff_t *tvb, int offset,
 677         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 678 {
 679         proto_item *item=NULL;
 680         proto_tree *tree=NULL;
 681         int old_offset=offset;
 682
 683         if(parent_tree){
 684                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 685                         "POLICY_AUDIT_LOG_INFO:");
 686                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_log_info);
 687         }
 688
 689         /* percent full */
 690         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 691                                      hf_lsa_pali_percent_full, NULL);
 692
 693         /* log size */
 694         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 695                                      hf_lsa_pali_log_size, NULL);
 696
 697         /* retention period */
 698         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 699                                 hf_lsa_pali_retention_period);
 700
 701         /* shutdown in progress */
 702         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 703                                      hf_lsa_pali_shutdown_in_progress, NULL);
 704
 705         /* time to shutdown */
 706         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 707                                 hf_lsa_pali_time_to_shutdown);
 708
 709         /* next audit record */
 710         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 711                                      hf_lsa_pali_next_audit_record, NULL);
 712
 713         proto_item_set_len(item, offset-old_offset);
 714         return offset;
 715 }
 716
 717 static int
 718 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings(tvbuff_t *tvb, int offset,
 719         packet_info *pinfo, proto_tree *tree, char *drep)
 720 {
 721         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 722                                      hf_lsa_paei_settings, NULL);
 723         return offset;
 724 }
 725
 726 static int
 727 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings_array(tvbuff_t *tvb, int offset,
 728         packet_info *pinfo, proto_tree *tree, char *drep)
 729 {
 730         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 731                 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings);
 732
 733         return offset;
 734 }
 735
 736 static int
 737 lsa_dissect_POLICY_AUDIT_EVENTS_INFO(tvbuff_t *tvb, int offset,
 738         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 739 {
 740         proto_item *item=NULL;
 741         proto_tree *tree=NULL;
 742         int old_offset=offset;
 743
 744         if(parent_tree){
 745                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 746                         "POLICY_AUDIT_EVENTS_INFO:");
 747                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_events_info);
 748         }
 749
 750         /* enabled */
 751         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 752                                      hf_lsa_paei_enabled, NULL);
 753
 754         /* settings */
 755         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 756                 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings_array, NDR_POINTER_UNIQUE,
 757                 "Settings", -1);
 758
 759         /* count */
 760         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 761                                      hf_lsa_count, NULL);
 762
 763         proto_item_set_len(item, offset-old_offset);
 764         return offset;
 765 }
 766
 767
 768 static int
 769 lsa_dissect_POLICY_PRIMARY_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 770         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 771 {
 772         proto_item *item=NULL;
 773         proto_tree *tree=NULL;
 774         int old_offset=offset;
 775
 776         if(parent_tree){
 777                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 778                         "POLICY_PRIMARY_DOMAIN_INFO:");
 779                 tree = proto_item_add_subtree(item, ett_lsa_policy_primary_domain_info);
 780         }
 781
 782         /* domain */
 783         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 784                 hf_lsa_domain, 0);
 785
 786         /* sid */
 787         offset = dissect_ndr_nt_PSID(tvb, offset,
 788                 pinfo, tree, drep, hf_lsa_domain_sid);
 789
 790         proto_item_set_len(item, offset-old_offset);
 791         return offset;
 792 }
 793
 794
 795 static int
 796 lsa_dissect_POLICY_ACCOUNT_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 797         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 798 {
 799         proto_item *item=NULL;
 800         proto_tree *tree=NULL;
 801         int old_offset=offset;
 802
 803         if(parent_tree){
 804                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 805                         "POLICY_ACCOUNT_DOMAIN_INFO:");
 806                 tree = proto_item_add_subtree(item, ett_lsa_policy_primary_account_info);
 807         }
 808
 809         /* account */
 810         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 811                 hf_lsa_acct, 0);
 812
 813         /* sid */
 814         offset = dissect_ndr_nt_PSID(tvb, offset,
 815                 pinfo, tree, drep, -1);
 816
 817         proto_item_set_len(item, offset-old_offset);
 818         return offset;
 819 }
 820
 821
 822 static const value_string server_role_vals[] = {
 823         {0,     "Standalone"},
 824         {1,     "Domain Member"},
 825         {2,     "Backup"},
 826         {3,     "Primary"},
 827         {0, NULL}
 828 };
 829 static int
 830 lsa_dissect_POLICY_SERVER_ROLE_INFO(tvbuff_t *tvb, int offset,
 831         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 832 {
 833         proto_item *item=NULL;
 834         proto_tree *tree=NULL;
 835         int old_offset=offset;
 836
 837         if(parent_tree){
 838                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 839                         "POLICY_SERVER_ROLE_INFO:");
 840                 tree = proto_item_add_subtree(item, ett_lsa_policy_server_role_info);
 841         }
 842
 843         /* server role */
 844         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 845                                      hf_lsa_server_role, NULL);
 846
 847         proto_item_set_len(item, offset-old_offset);
 848         return offset;
 849 }
 850
 851 static int
 852 lsa_dissect_POLICY_REPLICA_SOURCE_INFO(tvbuff_t *tvb, int offset,
 853         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 854 {
 855         proto_item *item=NULL;
 856         proto_tree *tree=NULL;
 857         int old_offset=offset;
 858
 859         if(parent_tree){
 860                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 861                         "POLICY_REPLICA_SOURCE_INFO:");
 862                 tree = proto_item_add_subtree(item, ett_lsa_policy_replica_source_info);
 863         }
 864
 865         /* source */
 866         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 867                 hf_lsa_source, 0);
 868
 869         /* account */
 870         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 871                 hf_lsa_acct, 0);
 872
 873         proto_item_set_len(item, offset-old_offset);
 874         return offset;
 875 }
 876
 877
 878 static int
 879 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO(tvbuff_t *tvb, int offset,
 880         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 881 {
 882         proto_item *item=NULL;
 883         proto_tree *tree=NULL;
 884         int old_offset=offset;
 885
 886         if(parent_tree){
 887                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 888                         "POLICY_DEFAULT_QUOTA_INFO:");
 889                 tree = proto_item_add_subtree(item, ett_lsa_policy_default_quota_info);
 890         }
 891
 892         /* paged pool */
 893         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 894                                      hf_lsa_quota_paged_pool, NULL);
 895
 896         /* non paged pool */
 897         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 898                                      hf_lsa_quota_non_paged_pool, NULL);
 899
 900         /* min wss */
 901         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 902                                      hf_lsa_quota_min_wss, NULL);
 903
 904         /* max wss */
 905         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 906                                      hf_lsa_quota_max_wss, NULL);
 907
 908         /* pagefile */
 909         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 910                                      hf_lsa_quota_pagefile, NULL);
 911
 912         /*  */
 913         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
 914                                      hf_lsa_unknown_hyper, NULL);
 915
 916         proto_item_set_len(item, offset-old_offset);
 917         return offset;
 918 }
 919
 920
 921 static int
 922 lsa_dissect_POLICY_MODIFICATION_INFO(tvbuff_t *tvb, int offset,
 923         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 924 {
 925         proto_item *item=NULL;
 926         proto_tree *tree=NULL;
 927         int old_offset=offset;
 928
 929         if(parent_tree){
 930                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 931                         "POLICY_MODIFICATION_INFO:");
 932                 tree = proto_item_add_subtree(item, ett_lsa_policy_modification_info);
 933         }
 934
 935         /* seq no */
 936         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
 937                                      hf_lsa_mod_seq_no, NULL);
 938
 939         /* mtime */
 940         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 941                                 hf_lsa_mod_mtime);
 942
 943         proto_item_set_len(item, offset-old_offset);
 944         return offset;
 945 }
 946
 947
 948 static int
 949 lsa_dissect_POLICY_AUDIT_FULL_SET_INFO(tvbuff_t *tvb, int offset,
 950         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 951 {
 952         proto_item *item=NULL;
 953         proto_tree *tree=NULL;
 954         int old_offset=offset;
 955
 956         if(parent_tree){
 957                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 958                         "POLICY_AUDIT_FULL_SET_INFO:");
 959                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_full_set_info);
 960         }
 961
 962         /* unknown */
 963         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 964                         hf_lsa_unknown_char, NULL);
 965
 966         proto_item_set_len(item, offset-old_offset);
 967         return offset;
 968 }
 969
 970
 971 static int
 972 lsa_dissect_POLICY_AUDIT_FULL_QUERY_INFO(tvbuff_t *tvb, int offset,
 973         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 974 {
 975         proto_item *item=NULL;
 976         proto_tree *tree=NULL;
 977         int old_offset=offset;
 978
 979         if(parent_tree){
 980                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 981                         "POLICY_AUDIT_FULL_QUERY_INFO:");
 982                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_full_query_info);
 983         }
 984
 985         /* unknown */
 986         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 987                         hf_lsa_unknown_char, NULL);
 988
 989         /* unknown */
 990         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 991                         hf_lsa_unknown_char, NULL);
 992
 993         proto_item_set_len(item, offset-old_offset);
 994         return offset;
 995 }
 996
 997
 998 int
 999 lsa_dissect_POLICY_DNS_DOMAIN_INFO(tvbuff_t *tvb, int offset,
1000         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1001 {
1002         proto_item *item=NULL;
1003         proto_tree *tree=NULL;
1004         int old_offset=offset;
1005
1006         if(parent_tree){
1007                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1008                         "POLICY_DNS_DOMAIN_INFO:");
1009                 tree = proto_item_add_subtree(item, ett_lsa_policy_dns_domain_info);
1010         }
1011
1012         /* name */
1013         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1014                 hf_lsa_name, 0);
1015
1016         /* domain */
1017         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1018                 hf_lsa_domain, 0);
1019
1020         /* forest */
1021         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1022                 hf_lsa_forest, 0);
1023
1024         /* GUID */
1025         offset = dissect_nt_GUID(tvb, offset,
1026                 pinfo, tree, drep);
1027
1028         /* SID pointer */
1029         offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep, -1);
1030
1031         proto_item_set_len(item, offset-old_offset);
1032         return offset;
1033 }
1034
1035 static int
1036 lsa_dissect_POLICY_INFORMATION(tvbuff_t *tvb, int offset,
1037         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1038 {
1039         proto_item *item=NULL;
1040         proto_tree *tree=NULL;
1041         int old_offset=offset;
1042         guint16 level;
1043
1044         if(parent_tree){
1045                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1046                         "POLICY_INFO:");
1047                 tree = proto_item_add_subtree(item, ett_lsa_policy_info);
1048         }
1049
1050         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1051                                      hf_lsa_info_level, &level);
1052
1053         ALIGN_TO_4_BYTES;  /* all union arms aligned to 4 bytes, case 7 and 9 need this  */
1054         switch(level){
1055         case 1:
1056                 offset = lsa_dissect_POLICY_AUDIT_LOG_INFO(
1057                                 tvb, offset, pinfo, tree, drep);
1058                 break;
1059         case 2:
1060                 offset = lsa_dissect_POLICY_AUDIT_EVENTS_INFO(
1061                                 tvb, offset, pinfo, tree, drep);
1062                 break;
1063         case 3:
1064                 offset = lsa_dissect_POLICY_PRIMARY_DOMAIN_INFO(
1065                                 tvb, offset, pinfo, tree, drep);
1066                 break;
1067         case 4:
1068                 offset = dissect_ndr_counted_string(tvb, offset, pinfo,
1069                         tree, drep, hf_lsa_acct, 0);
1070                 break;
1071         case 5:
1072                 offset = lsa_dissect_POLICY_ACCOUNT_DOMAIN_INFO(
1073                                 tvb, offset, pinfo, tree, drep);
1074                 break;
1075         case 6:
1076                 offset = lsa_dissect_POLICY_SERVER_ROLE_INFO(
1077                                 tvb, offset, pinfo, tree, drep);
1078                 break;
1079         case 7:
1080                 offset = lsa_dissect_POLICY_REPLICA_SOURCE_INFO(
1081                                 tvb, offset, pinfo, tree, drep);
1082                 break;
1083         case 8:
1084                 offset = lsa_dissect_POLICY_DEFAULT_QUOTA_INFO(
1085                                 tvb, offset, pinfo, tree, drep);
1086                 break;
1087         case 9:
1088                 offset = lsa_dissect_POLICY_MODIFICATION_INFO(
1089                                 tvb, offset, pinfo, tree, drep);
1090                 break;
1091         case 10:
1092                 offset = lsa_dissect_POLICY_AUDIT_FULL_SET_INFO(
1093                                 tvb, offset, pinfo, tree, drep);
1094                 break;
1095         case 11:
1096                 offset = lsa_dissect_POLICY_AUDIT_FULL_QUERY_INFO(
1097                                 tvb, offset, pinfo, tree, drep);
1098                 break;
1099         case 12:
1100                 offset = lsa_dissect_POLICY_DNS_DOMAIN_INFO(
1101                                 tvb, offset, pinfo, tree, drep);
1102                 break;
1103         }
1104
1105         proto_item_set_len(item, offset-old_offset);
1106         return offset;
1107 }
1108
1109 static int
1110 lsa_dissect_lsaqueryinformationpolicy_reply(tvbuff_t *tvb, int offset,
1111         packet_info *pinfo, proto_tree *tree, char *drep)
1112 {
1113         /* This is really a pointer to a pointer though the first level is REF
1114           so we just ignore that one */
1115         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1116                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_UNIQUE,
1117                 "POLICY_INFORMATION pointer: info", -1);
1118
1119         offset = dissect_ntstatus(
1120                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1121
1122         return offset;
1123 }
1124
1125 static int
1126 lsa_dissect_lsadelete_rqst(tvbuff_t *tvb, int offset,
1127         packet_info *pinfo, proto_tree *tree, char *drep)
1128 {
1129         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1130                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
1131                 "LSA_HANDLE", -1);
1132
1133         return offset;
1134 }
1135
1136 static int
1137 lsa_dissect_lsadelete_reply(tvbuff_t *tvb, int offset,
1138         packet_info *pinfo, proto_tree *tree, char *drep)
1139 {
1140         offset = dissect_ntstatus(
1141                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1142
1143         return offset;
1144 }
1145
1146
1147 static int
1148 lsa_dissect_lsaquerysecurityobject_rqst(tvbuff_t *tvb, int offset,
1149         packet_info *pinfo, proto_tree *tree, char *drep)
1150 {
1151         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1152                 pinfo, tree, drep);
1153
1154         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1155                 hf_lsa_info_type, NULL);
1156
1157         return offset;
1158 }
1159
1160
1161 static int
1162 lsa_dissect_lsaquerysecurityobject_reply(tvbuff_t *tvb, int offset,
1163         packet_info *pinfo, proto_tree *tree, char *drep)
1164 {
1165         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1166                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
1167                 "LSA_SECURITY_DESCRIPTOR pointer: sec_info", -1);
1168
1169         offset = dissect_ntstatus(
1170                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1171
1172         return offset;
1173 }
1174
1175
1176 static int
1177 lsa_dissect_lsasetsecurityobject_rqst(tvbuff_t *tvb, int offset,
1178         packet_info *pinfo, proto_tree *tree, char *drep)
1179 {
1180         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1181                 pinfo, tree, drep);
1182
1183         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1184                 hf_lsa_info_type, NULL);
1185
1186         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1187                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
1188                 "LSA_SECURITY_DESCRIPTOR: sec_info", -1);
1189
1190         return offset;
1191 }
1192
1193 static int
1194 lsa_dissect_lsasetsecurityobject_reply(tvbuff_t *tvb, int offset,
1195         packet_info *pinfo, proto_tree *tree, char *drep)
1196 {
1197         offset = dissect_ntstatus(
1198                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1199
1200         return offset;
1201 }
1202
1203
1204 static int
1205 lsa_dissect_lsachangepassword_rqst(tvbuff_t *tvb, int offset,
1206         packet_info *pinfo, proto_tree *tree, char *drep)
1207 {
1208         /* server */
1209         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1210                 hf_lsa_server, 0);
1211
1212         /* domain */
1213         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1214                 hf_lsa_domain, 0);
1215
1216         /* account */
1217         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1218                 hf_lsa_acct, 0);
1219
1220         /* old password */
1221         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1222                 hf_lsa_old_pwd, 0);
1223
1224         /* new password */
1225         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1226                 hf_lsa_new_pwd, 0);
1227
1228         return offset;
1229 }
1230
1231 static int
1232 lsa_dissect_lsachangepassword_reply(tvbuff_t *tvb, int offset,
1233         packet_info *pinfo, proto_tree *tree, char *drep)
1234 {
1235         offset = dissect_ntstatus(
1236                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1237
1238         return offset;
1239 }
1240
1241 static const value_string sid_type_vals[] = {
1242         {1,     "User"},
1243         {2,     "Group"},
1244         {3,     "Domain"},
1245         {4,     "Alias"},
1246         {5,     "Well Known Group"},
1247         {6,     "Deleted Account"},
1248         {7,     "Invalid"},
1249         {8,     "Unknown"},
1250         {9,     "Computer"},
1251         {0, NULL}
1252 };
1253 static int
1254 lsa_dissect_LSA_TRANSLATED_NAME(tvbuff_t *tvb, int offset,
1255         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1256 {
1257         proto_item *item=NULL;
1258         proto_tree *tree=NULL;
1259         int old_offset=offset;
1260
1261         if(parent_tree){
1262                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1263                         "LSA_TRANSLATED_NAME:");
1264                 tree = proto_item_add_subtree(item, ett_lsa_translated_name);
1265         }
1266
1267         /* sid type */
1268         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1269                         hf_lsa_sid_type, NULL);
1270
1271         /* name */
1272         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1273                 hf_lsa_name, 0);
1274
1275         /* index */
1276         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1277                                      hf_lsa_index, NULL);
1278
1279         proto_item_set_len(item, offset-old_offset);
1280         return offset;
1281 }
1282
1283 static int
1284 lsa_dissect_LSA_TRANSLATED_NAME_array(tvbuff_t *tvb, int offset,
1285         packet_info *pinfo, proto_tree *tree, char *drep)
1286 {
1287         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1288                 lsa_dissect_LSA_TRANSLATED_NAME);
1289
1290         return offset;
1291 }
1292
1293 static int
1294 lsa_dissect_LSA_TRANSLATED_NAMES(tvbuff_t *tvb, int offset,
1295         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1296 {
1297         proto_item *item=NULL;
1298         proto_tree *tree=NULL;
1299         int old_offset=offset;
1300
1301         if(parent_tree){
1302                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1303                         "LSA_TRANSLATED_NAMES:");
1304                 tree = proto_item_add_subtree(item, ett_lsa_translated_names);
1305         }
1306
1307         /* count */
1308         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1309                                      hf_lsa_count, NULL);
1310
1311         /* settings */
1312         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1313                 lsa_dissect_LSA_TRANSLATED_NAME_array, NDR_POINTER_UNIQUE,
1314                 "TRANSLATED_NAME_ARRAY", -1);
1315
1316         proto_item_set_len(item, offset-old_offset);
1317         return offset;
1318 }
1319
1320
1321 static int
1322 lsa_dissect_lsalookupsids_rqst(tvbuff_t *tvb, int offset,
1323         packet_info *pinfo, proto_tree *tree, char *drep)
1324 {
1325         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1326                 pinfo, tree, drep);
1327
1328         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1329                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
1330                         "PSID_ARRAY", -1);
1331
1332         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1333                 lsa_dissect_LSA_TRANSLATED_NAMES, NDR_POINTER_REF,
1334                 "LSA_TRANSLATED_NAMES pointer: names", -1);
1335
1336         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1337                 hf_lsa_info_level, NULL);
1338
1339         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1340                 hf_lsa_num_mapped, NULL);
1341
1342         return offset;
1343 }
1344
1345 static int
1346 lsa_dissect_LSA_TRUST_INFORMATION(tvbuff_t *tvb, int offset,
1347         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1348 {
1349         proto_item *item=NULL;
1350         proto_tree *tree=NULL;
1351         int old_offset=offset;
1352
1353         if(parent_tree){
1354                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1355                         "TRUST INFORMATION:");
1356                 tree = proto_item_add_subtree(item, ett_lsa_trust_information);
1357         }
1358
1359         /* name */
1360         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1361                 hf_lsa_name, 0);
1362
1363         /* sid */
1364         offset = dissect_ndr_nt_PSID(tvb, offset,
1365                 pinfo, tree, drep, -1);
1366
1367         proto_item_set_len(item, offset-old_offset);
1368         return offset;
1369 }
1370
1371 static const value_string trusted_direction_vals[] = {
1372         {0,     "Trust disabled"},
1373         {1,     "Inbound trust"},
1374         {2,     "Outbound trust"},
1375         {0,     NULL}
1376 };
1377
1378 static const value_string trusted_type_vals[] = {
1379         {1,     "Downlevel"},
1380         {2,     "Uplevel"},
1381         {3,     "MIT"},
1382         {4,     "DCE"},
1383         {0,     NULL}
1384 };
1385
1386 static const true_false_string tfs_trust_attr_non_trans = {
1387         "NON TRANSITIVE is set",
1388         "Non transitive is NOT set"
1389 };
1390 static const true_false_string tfs_trust_attr_uplevel_only = {
1391         "UPLEVEL ONLY is set",
1392         "Uplevel only is NOT set"
1393 };
1394 static const true_false_string tfs_trust_attr_tree_parent = {
1395         "TREE PARENT is set",
1396         "Tree parent is NOT set"
1397 };
1398 static const true_false_string tfs_trust_attr_tree_root = {
1399         "TREE ROOT is set",
1400         "Tree root is NOT set"
1401 };
1402 static int
1403 lsa_dissect_trust_attr(tvbuff_t *tvb, int offset, packet_info *pinfo,
1404                         proto_tree *parent_tree, char *drep)
1405 {
1406         guint32 mask;
1407         proto_item *item = NULL;
1408         proto_tree *tree = NULL;
1409
1410         offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
1411                         hf_lsa_trust_attr, &mask);
1412
1413         if(parent_tree){
1414                 item = proto_tree_add_uint(parent_tree, hf_lsa_trust_attr,
1415                         tvb, offset-4, 4, mask);
1416                 tree = proto_item_add_subtree(item, ett_lsa_trust_attr);
1417         }
1418
1419         proto_tree_add_boolean(tree, hf_lsa_trust_attr_tree_root,
1420                 tvb, offset-4, 4, mask);
1421         proto_tree_add_boolean(tree, hf_lsa_trust_attr_tree_parent,
1422                 tvb, offset-4, 4, mask);
1423         proto_tree_add_boolean(tree, hf_lsa_trust_attr_uplevel_only,
1424                 tvb, offset-4, 4, mask);
1425         proto_tree_add_boolean(tree, hf_lsa_trust_attr_non_trans,
1426                 tvb, offset-4, 4, mask);
1427
1428         return offset;
1429 }
1430
1431 static int
1432 lsa_dissect_LSA_TRUST_INFORMATION_EX(tvbuff_t *tvb, int offset,
1433         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1434 {
1435         proto_item *item=NULL;
1436         proto_tree *tree=NULL;
1437         int old_offset=offset;
1438
1439         if(parent_tree){
1440                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1441                         "TRUST INFORMATION EX:");
1442                 tree = proto_item_add_subtree(item, ett_lsa_trust_information_ex);
1443         }
1444
1445         /* name */
1446         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1447                 hf_lsa_name, 0);
1448
1449         /* flat name */
1450         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1451                 hf_lsa_flat_name, 0);
1452
1453         /* sid */
1454         offset = dissect_ndr_nt_PSID(tvb, offset,
1455                 pinfo, tree, drep, -1);
1456
1457         /* direction */
1458         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1459                                      hf_lsa_trust_direction, NULL);
1460
1461         /* type */
1462         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1463                                      hf_lsa_trust_type, NULL);
1464
1465         /* attributes */
1466         offset = lsa_dissect_trust_attr(tvb, offset, pinfo, tree, drep);
1467
1468         proto_item_set_len(item, offset-old_offset);
1469         return offset;
1470 }
1471
1472 static int
1473 lsa_dissect_auth_info_blob(tvbuff_t *tvb, int offset,
1474         packet_info *pinfo, proto_tree *tree, char *drep)
1475 {
1476         dcerpc_info *di;
1477         guint32 len;
1478
1479         di=pinfo->private_data;
1480         if(di->conformant_run){
1481                 /*just a run to handle conformant arrays, nothing to dissect */
1482                 return offset;
1483         }
1484
1485         /* len */
1486         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1487                                      hf_lsa_auth_len, &len);
1488
1489         proto_tree_add_item(tree, hf_lsa_auth_blob, tvb, offset, len, FALSE);
1490         offset += len;
1491
1492         return offset;
1493 }
1494
1495 static int
1496 lsa_dissect_auth_info(tvbuff_t *tvb, int offset,
1497         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1498 {
1499         proto_item *item=NULL;
1500         proto_tree *tree=NULL;
1501         int old_offset=offset;
1502
1503         if(parent_tree){
1504                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1505                         "AUTH INFORMATION:");
1506                 tree = proto_item_add_subtree(item, ett_lsa_auth_information);
1507         }
1508
1509         /* update */
1510         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
1511                                      hf_lsa_auth_update, NULL);
1512
1513         /* type */
1514         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1515                                      hf_lsa_auth_type, NULL);
1516
1517         /* len */
1518         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1519                                      hf_lsa_auth_len, NULL);
1520
1521         /* auth info blob */
1522         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1523                         lsa_dissect_auth_info_blob, NDR_POINTER_UNIQUE,
1524                         "AUTH INFO blob:", -1);
1525
1526         proto_item_set_len(item, offset-old_offset);
1527         return offset;
1528 }
1529
1530 static int
1531 lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvbuff_t *tvb, int offset,
1532         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1533 {
1534         proto_item *item=NULL;
1535         proto_tree *tree=NULL;
1536         int old_offset=offset;
1537
1538         if(parent_tree){
1539                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1540                         "TRUSTED DOMAIN AUTH INFORMATION:");
1541                 tree = proto_item_add_subtree(item, ett_lsa_trusted_domain_auth_information);
1542         }
1543
1544         /* unknown */
1545         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1546                                      hf_lsa_unknown_long, NULL);
1547
1548         /* unknown */
1549         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1550
1551         /* unknown */
1552         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1553
1554         /* unknown */
1555         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1556                                      hf_lsa_unknown_long, NULL);
1557
1558         /* unknown */
1559         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1560
1561         /* unknown */
1562         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1563
1564         proto_item_set_len(item, offset-old_offset);
1565         return offset;
1566 }
1567
1568
1569 static int
1570 lsa_dissect_LSA_TRUST_INFORMATION_array(tvbuff_t *tvb, int offset,
1571         packet_info *pinfo, proto_tree *tree, char *drep)
1572 {
1573         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1574                 lsa_dissect_LSA_TRUST_INFORMATION);
1575
1576         return offset;
1577 }
1578
1579 static int
1580 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST(tvbuff_t *tvb, int offset,
1581         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1582 {
1583         proto_item *item=NULL;
1584         proto_tree *tree=NULL;
1585         int old_offset=offset;
1586
1587         if(parent_tree){
1588                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1589                         "LSA_REFERENCED_DOMAIN_LIST:");
1590                 tree = proto_item_add_subtree(item, ett_lsa_referenced_domain_list);
1591         }
1592
1593         /* count */
1594         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1595                                      hf_lsa_count, NULL);
1596
1597         /* trust information */
1598         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1599                 lsa_dissect_LSA_TRUST_INFORMATION_array, NDR_POINTER_UNIQUE,
1600                 "TRUST INFORMATION array:", -1);
1601
1602         /* max count */
1603         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1604                                      hf_lsa_max_count, NULL);
1605
1606         proto_item_set_len(item, offset-old_offset);
1607         return offset;
1608 }
1609
1610 static int
1611 lsa_dissect_lsalookupsids_reply(tvbuff_t *tvb, int offset,
1612         packet_info *pinfo, proto_tree *tree, char *drep)
1613 {
1614         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1615                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
1616                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
1617
1618         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1619                 lsa_dissect_LSA_TRANSLATED_NAMES, NDR_POINTER_REF,
1620                 "LSA_TRANSLATED_NAMES pointer: names", -1);
1621
1622         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1623                 hf_lsa_num_mapped, NULL);
1624
1625         offset = dissect_ntstatus(
1626                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1627
1628         return offset;
1629 }
1630
1631
1632 static int
1633 lsa_dissect_lsasetquotasforaccount_rqst(tvbuff_t *tvb, int offset,
1634         packet_info *pinfo, proto_tree *tree, char *drep)
1635 {
1636         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1637                 pinfo, tree, drep);
1638
1639         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1640                 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO, NDR_POINTER_REF,
1641                 "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1);
1642
1643         return offset;
1644 }
1645
1646
1647 static int
1648 lsa_dissect_lsasetquotasforaccount_reply(tvbuff_t *tvb, int offset,
1649         packet_info *pinfo, proto_tree *tree, char *drep)
1650 {
1651         offset = dissect_ntstatus(
1652                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1653
1654         return offset;
1655 }
1656
1657
1658 static int
1659 lsa_dissect_lsagetquotasforaccount_rqst(tvbuff_t *tvb, int offset,
1660         packet_info *pinfo, proto_tree *tree, char *drep)
1661 {
1662         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1663                 pinfo, tree, drep);
1664
1665         return offset;
1666 }
1667
1668
1669 static int
1670 lsa_dissect_lsagetquotasforaccount_reply(tvbuff_t *tvb, int offset,
1671         packet_info *pinfo, proto_tree *tree, char *drep)
1672 {
1673         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1674                 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO, NDR_POINTER_REF,
1675                 "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1);
1676
1677         offset = dissect_ntstatus(
1678                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1679
1680         return offset;
1681 }
1682
1683
1684 static int
1685 lsa_dissect_lsasetinformationpolicy_rqst(tvbuff_t *tvb, int offset,
1686         packet_info *pinfo, proto_tree *tree, char *drep)
1687 {
1688         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1689                 pinfo, tree, drep);
1690
1691         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1692                 hf_lsa_policy_information_class, NULL);
1693
1694         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1695                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
1696                 "POLICY_INFORMATION pointer: info", -1);
1697
1698         return offset;
1699 }
1700
1701
1702 static int
1703 lsa_dissect_lsasetinformationpolicy_reply(tvbuff_t *tvb, int offset,
1704         packet_info *pinfo, proto_tree *tree, char *drep)
1705 {
1706         offset = dissect_ntstatus(
1707                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1708
1709         return offset;
1710 }
1711
1712
1713 static int
1714 lsa_dissect_lsaclearauditlog_rqst(tvbuff_t *tvb, int offset,
1715         packet_info *pinfo, proto_tree *tree, char *drep)
1716 {
1717         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1718                 pinfo, tree, drep);
1719
1720         offset = dissect_ndr_nt_SID(tvb, offset,
1721                 pinfo, tree, drep, -1);
1722
1723         /* unknown */
1724         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1725                                      hf_lsa_unknown_long, NULL);
1726
1727         return offset;
1728 }
1729
1730
1731 static int
1732 lsa_dissect_lsaclearauditlog_reply(tvbuff_t *tvb, int offset,
1733         packet_info *pinfo, proto_tree *tree, char *drep)
1734 {
1735         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1736                 pinfo, tree, drep);
1737
1738         offset = dissect_ntstatus(
1739                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1740
1741         return offset;
1742 }
1743
1744 static int
1745 lsa_dissect_lsagetsystemaccessaccount_rqst(tvbuff_t *tvb, int offset,
1746         packet_info *pinfo, proto_tree *tree, char *drep)
1747 {
1748         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1749                 pinfo, tree, drep);
1750
1751         return offset;
1752 }
1753
1754
1755 static int
1756 lsa_dissect_lsagetsystemaccessaccount_reply(tvbuff_t *tvb, int offset,
1757         packet_info *pinfo, proto_tree *tree, char *drep)
1758 {
1759         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1760                                      hf_lsa_rid, NULL);
1761
1762         offset = dissect_ntstatus(
1763                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1764
1765         return offset;
1766 }
1767
1768
1769 static int
1770 lsa_dissect_lsasetsystemaccessaccount_rqst(tvbuff_t *tvb, int offset,
1771         packet_info *pinfo, proto_tree *tree, char *drep)
1772 {
1773         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1774                 pinfo, tree, drep);
1775
1776         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1777                 hf_lsa_rid, NULL);
1778
1779         return offset;
1780 }
1781
1782
1783 static int
1784 lsa_dissect_lsasetsystemaccessaccount_reply(tvbuff_t *tvb, int offset,
1785         packet_info *pinfo, proto_tree *tree, char *drep)
1786 {
1787         offset = dissect_ntstatus(
1788                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1789
1790         return offset;
1791 }
1792
1793
1794 static int
1795 lsa_dissect_lsaopentrusteddomain_rqst(tvbuff_t *tvb, int offset,
1796         packet_info *pinfo, proto_tree *tree, char *drep)
1797 {
1798         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1799                 pinfo, tree, drep);
1800
1801         offset = dissect_ndr_nt_SID(tvb, offset,
1802                 pinfo, tree, drep, -1);
1803
1804         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
1805                 pinfo, tree, drep);
1806
1807         return offset;
1808 }
1809
1810
1811 static int
1812 lsa_dissect_lsaopentrusteddomain_reply(tvbuff_t *tvb, int offset,
1813         packet_info *pinfo, proto_tree *tree, char *drep)
1814 {
1815         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1816                 pinfo, tree, drep);
1817
1818         offset = dissect_ntstatus(
1819                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1820
1821         return offset;
1822 }
1823
1824
1825 static int
1826 lsa_dissect_lsadeletetrusteddomain_rqst(tvbuff_t *tvb, int offset,
1827         packet_info *pinfo, proto_tree *tree, char *drep)
1828 {
1829         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1830                 pinfo, tree, drep);
1831
1832         offset = dissect_ndr_nt_SID(tvb, offset,
1833                 pinfo, tree, drep, -1);
1834
1835         return offset;
1836 }
1837
1838
1839 static int
1840 lsa_dissect_lsadeletetrusteddomain_reply(tvbuff_t *tvb, int offset,
1841         packet_info *pinfo, proto_tree *tree, char *drep)
1842 {
1843         offset = dissect_ntstatus(
1844                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1845
1846         return offset;
1847 }
1848
1849 int
1850 dissect_nt_LUID(tvbuff_t *tvb, int offset,
1851         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1852 {
1853         proto_item *item=NULL;
1854         proto_tree *tree=NULL;
1855         int old_offset=offset;
1856
1857         if(parent_tree){
1858                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1859                         "LUID:");
1860                 tree = proto_item_add_subtree(item, ett_LUID);
1861         }
1862
1863         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1864                 hf_nt_luid_low, NULL);
1865
1866         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1867                 hf_nt_luid_high, NULL);
1868
1869         proto_item_set_len(item, offset-old_offset);
1870         return offset;
1871 }
1872
1873 static int
1874 lsa_dissect_LSA_PRIVILEGE(tvbuff_t *tvb, int offset,
1875         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1876 {
1877         proto_item *item=NULL;
1878         proto_tree *tree=NULL;
1879         int old_offset=offset;
1880
1881         if(parent_tree){
1882                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1883                         "LSA_PRIVILEGE:");
1884                 tree = proto_item_add_subtree(item, ett_LSA_PRIVILEGE);
1885         }
1886
1887         /* privilege name */
1888         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1889                         hf_lsa_privilege_name, 0);
1890
1891         /* LUID */
1892         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
1893
1894         proto_item_set_len(item, offset-old_offset);
1895         return offset;
1896 }
1897
1898 static int
1899 lsa_dissect_LSA_PRIVILEGE_array(tvbuff_t *tvb, int offset,
1900         packet_info *pinfo, proto_tree *tree, char *drep)
1901 {
1902         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1903                 lsa_dissect_LSA_PRIVILEGE);
1904
1905         return offset;
1906 }
1907
1908 static int
1909 lsa_dissect_LSA_PRIVILEGES(tvbuff_t *tvb, int offset,
1910         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1911 {
1912         proto_item *item=NULL;
1913         proto_tree *tree=NULL;
1914         int old_offset=offset;
1915
1916         if(parent_tree){
1917                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1918                         "LSA_PRIVILEGES:");
1919                 tree = proto_item_add_subtree(item, ett_LSA_PRIVILEGES);
1920         }
1921
1922         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1923                 hf_lsa_count, NULL);
1924
1925         /* privileges */
1926         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1927                 lsa_dissect_LSA_PRIVILEGE_array, NDR_POINTER_UNIQUE,
1928                 "LSA_PRIVILEGE array:", -1);
1929
1930         proto_item_set_len(item, offset-old_offset);
1931         return offset;
1932 }
1933
1934 static int
1935 lsa_dissect_lsaenumerateprivileges_rqst(tvbuff_t *tvb, int offset,
1936         packet_info *pinfo, proto_tree *tree, char *drep)
1937 {
1938         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1939                 pinfo, tree, drep);
1940
1941         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1942                 hf_lsa_count, NULL);
1943
1944         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1945                 hf_lsa_size, NULL);
1946
1947         return offset;
1948 }
1949
1950 static int
1951 lsa_dissect_lsaenumerateprivileges_reply(tvbuff_t *tvb, int offset,
1952         packet_info *pinfo, proto_tree *tree, char *drep)
1953 {
1954         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1955                 hf_lsa_count, NULL);
1956
1957         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1958                 lsa_dissect_LSA_PRIVILEGES, NDR_POINTER_REF,
1959                 "LSA_PRIVILEGES pointer: privs", -1);
1960
1961         offset = dissect_ntstatus(
1962                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1963
1964         return offset;
1965 }
1966
1967 static int
1968 lsa_dissect_lsalookupprivilegevalue_rqst(tvbuff_t *tvb, int offset,
1969         packet_info *pinfo, proto_tree *tree, char *drep)
1970 {
1971         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1972                 pinfo, tree, drep);
1973
1974         /* privilege name */
1975         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1976                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
1977                 "NAME pointer: ", hf_lsa_privilege_name);
1978
1979         return offset;
1980 }
1981
1982
1983 static int
1984 lsa_dissect_lsalookupprivilegevalue_reply(tvbuff_t *tvb, int offset,
1985         packet_info *pinfo, proto_tree *tree, char *drep)
1986 {
1987
1988         /* LUID */
1989         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
1990
1991         offset = dissect_ntstatus(
1992                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1993
1994         return offset;
1995 }
1996
1997
1998 static int
1999 lsa_dissect_lsalookupprivilegename_rqst(tvbuff_t *tvb, int offset,
2000         packet_info *pinfo, proto_tree *tree, char *drep)
2001 {
2002         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2003                 pinfo, tree, drep);
2004
2005         /* LUID */
2006         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2007                 dissect_nt_LUID, NDR_POINTER_REF,
2008                 "LUID pointer: value", -1);
2009
2010         return offset;
2011 }
2012
2013
2014 static int
2015 lsa_dissect_lsalookupprivilegename_reply(tvbuff_t *tvb, int offset,
2016         packet_info *pinfo, proto_tree *tree, char *drep)
2017 {
2018         /* [out, ref] LSA_UNICODE_STRING **name */
2019         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2020                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
2021                 "PRIVILEGE NAME pointer:", hf_lsa_privilege_name);
2022
2023         offset = dissect_ntstatus(
2024                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2025
2026         return offset;
2027 }
2028
2029
2030 static int
2031 lsa_dissect_lsaenumerateprivilegesaccount_rqst(tvbuff_t *tvb, int offset,
2032         packet_info *pinfo, proto_tree *tree, char *drep)
2033 {
2034         /* [in] LSA_HANDLE hnd */
2035         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2036                 pinfo, tree, drep);
2037
2038         return offset;
2039 }
2040
2041
2042 static int
2043 lsa_dissect_LUID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
2044         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2045 {
2046         proto_item *item=NULL;
2047         proto_tree *tree=NULL;
2048         int old_offset=offset;
2049
2050         if(parent_tree){
2051                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2052                         "LUID_AND_ATTRIBUTES:");
2053                 tree = proto_item_add_subtree(item, ett_LSA_LUID_AND_ATTRIBUTES);
2054         }
2055
2056         /* LUID */
2057         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
2058
2059         /* attr */
2060         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
2061                                      hf_lsa_attr, NULL);
2062
2063         proto_item_set_len(item, offset-old_offset);
2064         return offset;
2065 }
2066
2067 static int
2068 lsa_dissect_LUID_AND_ATTRIBUTES_array(tvbuff_t *tvb, int offset,
2069         packet_info *pinfo, proto_tree *tree, char *drep)
2070 {
2071         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2072                 lsa_dissect_LUID_AND_ATTRIBUTES);
2073
2074         return offset;
2075 }
2076
2077 static int
2078 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
2079         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2080 {
2081         proto_item *item=NULL;
2082         proto_tree *tree=NULL;
2083         int old_offset=offset;
2084
2085         if(parent_tree){
2086                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2087                         "LUID_AND_ATTRIBUTES_ARRAY:");
2088                 tree = proto_item_add_subtree(item, ett_LSA_LUID_AND_ATTRIBUTES_ARRAY);
2089         }
2090
2091         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2092                 hf_lsa_count, NULL);
2093
2094         /* luid and attributes */
2095         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2096                 lsa_dissect_LUID_AND_ATTRIBUTES_array, NDR_POINTER_UNIQUE,
2097                 "LUID_AND_ATTRIBUTES array:", -1);
2098
2099         proto_item_set_len(item, offset-old_offset);
2100         return offset;
2101 }
2102
2103 static int
2104 lsa_dissect_lsaenumerateprivilegesaccount_reply(tvbuff_t *tvb, int offset,
2105         packet_info *pinfo, proto_tree *tree, char *drep)
2106 {
2107         /* [out, ref] LUID_AND_ATTRIBUTES_ARRAY * *privs */
2108         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2109                 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
2110                 "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1);
2111
2112         offset = dissect_ntstatus(
2113                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2114
2115         return offset;
2116 }
2117
2118 static int
2119 lsa_dissect_lsaaddprivilegestoaccount_rqst(tvbuff_t *tvb, int offset,
2120         packet_info *pinfo, proto_tree *tree, char *drep)
2121 {
2122         /* [in] LSA_HANDLE hnd */
2123         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2124                 pinfo, tree, drep);
2125
2126         /* [in, ref] LUID_AND_ATTRIBUTES_ARRAY *privs */
2127         offset = lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY(tvb, offset,
2128                 pinfo, tree, drep);
2129
2130         return offset;
2131 }
2132
2133
2134 static int
2135 lsa_dissect_lsaaddprivilegestoaccount_reply(tvbuff_t *tvb, int offset,
2136         packet_info *pinfo, proto_tree *tree, char *drep)
2137 {
2138         offset = dissect_ntstatus(
2139                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2140
2141         return offset;
2142 }
2143
2144 static int
2145 lsa_dissect_lsaremoveprivilegesfromaccount_rqst(tvbuff_t *tvb, int offset,
2146         packet_info *pinfo, proto_tree *tree, char *drep)
2147 {
2148         /* [in] LSA_HANDLE hnd */
2149         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2150                 pinfo, tree, drep);
2151
2152         /* [in] char unknown */
2153         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
2154                         hf_lsa_unknown_char, NULL);
2155
2156         /* [in, unique] LUID_AND_ATTRIBUTES_ARRAY *privs */
2157         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2158                 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
2159                 "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1);
2160
2161         return offset;
2162 }
2163
2164
2165 static int
2166 lsa_dissect_lsaremoveprivilegesfromaccount_reply(tvbuff_t *tvb, int offset,
2167         packet_info *pinfo, proto_tree *tree, char *drep)
2168 {
2169         offset = dissect_ntstatus(
2170                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2171
2172         return offset;
2173 }
2174
2175 static int
2176 lsa_dissect_lsaenumerateaccounts_rqst(tvbuff_t *tvb, int offset,
2177         packet_info *pinfo, proto_tree *tree, char *drep)
2178 {
2179         /* [in] LSA_HANDLE hnd */
2180         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2181                 pinfo, tree, drep);
2182
2183         /* [in,out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2184         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2185                 hf_lsa_resume_handle, NULL);
2186
2187         /* [in] ULONG pref_maxlen */
2188         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2189                 hf_lsa_max_count, NULL);
2190
2191         return offset;
2192 }
2193
2194 static int
2195 lsa_dissect_lsaenumerateaccounts_reply(tvbuff_t *tvb, int offset,
2196         packet_info *pinfo, proto_tree *tree, char *drep)
2197 {
2198         /* [in,out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2199         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2200                 hf_lsa_resume_handle, NULL);
2201
2202         /* [out, ref] PSID_ARRAY **accounts */
2203         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2204                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
2205                         "PSID_ARRAY", -1);
2206
2207         offset = dissect_ntstatus(
2208                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2209
2210         return offset;
2211 }
2212
2213 static int
2214 lsa_dissect_lsacreatetrusteddomain_rqst(tvbuff_t *tvb, int offset,
2215         packet_info *pinfo, proto_tree *tree, char *drep)
2216 {
2217         /* [in] LSA_HANDLE hnd_pol */
2218         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2219                 pinfo, tree, drep);
2220
2221         /* [in, ref] LSA_TRUST_INFORMATION *domain */
2222         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2223                 lsa_dissect_LSA_TRUST_INFORMATION, NDR_POINTER_REF,
2224                 "LSA_TRUST_INFORMATION pointer: domain", -1);
2225
2226         /* [in] ACCESS_MASK access */
2227         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2228                 pinfo, tree, drep);
2229
2230         return offset;
2231 }
2232
2233 static int
2234 lsa_dissect_lsacreatetrusteddomain_reply(tvbuff_t *tvb, int offset,
2235         packet_info *pinfo, proto_tree *tree, char *drep)
2236 {
2237         /* [out] LSA_HANDLE *hnd */
2238         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2239                 pinfo, tree, drep);
2240
2241         offset = dissect_ntstatus(
2242                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2243
2244         return offset;
2245 }
2246
2247 static int
2248 lsa_dissect_lsaenumeratetrusteddomains_rqst(tvbuff_t *tvb, int offset,
2249         packet_info *pinfo, proto_tree *tree, char *drep)
2250 {
2251         /* [in] LSA_HANDLE hnd */
2252         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2253                 pinfo, tree, drep);
2254
2255         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2256         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2257                 hf_lsa_resume_handle, NULL);
2258
2259         /* [in] ULONG pref_maxlen */
2260         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2261                 hf_lsa_max_count, NULL);
2262
2263         return offset;
2264 }
2265
2266 static int
2267 lsa_dissect_LSA_TRUSTED_DOMAIN(tvbuff_t *tvb, int offset,
2268         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2269 {
2270         proto_item *item=NULL;
2271         proto_tree *tree=NULL;
2272         int old_offset=offset;
2273
2274         if(parent_tree){
2275                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2276                         "TRUSTED_DOMAIN:");
2277                 tree = proto_item_add_subtree(item, ett_LSA_TRUSTED_DOMAIN);
2278         }
2279
2280         /* domain */
2281         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2282                 hf_lsa_domain, 0);
2283
2284         /* sid */
2285         offset = dissect_ndr_nt_PSID(tvb, offset,
2286                 pinfo, tree, drep, -1);
2287
2288         proto_item_set_len(item, offset-old_offset);
2289         return offset;
2290 }
2291
2292 static int
2293 lsa_dissect_LSA_TRUSTED_DOMAIN_array(tvbuff_t *tvb, int offset,
2294         packet_info *pinfo, proto_tree *tree, char *drep)
2295 {
2296         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2297                 lsa_dissect_LSA_TRUSTED_DOMAIN);
2298
2299         return offset;
2300 }
2301
2302 static int
2303 lsa_dissect_LSA_TRUSTED_DOMAIN_LIST(tvbuff_t *tvb, int offset,
2304         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2305 {
2306         proto_item *item=NULL;
2307         proto_tree *tree=NULL;
2308         int old_offset=offset;
2309
2310         if(parent_tree){
2311                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2312                         "TRUSTED_DOMAIN_LIST:");
2313                 tree = proto_item_add_subtree(item, ett_LSA_TRUSTED_DOMAIN_LIST);
2314         }
2315
2316         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2317                 hf_lsa_count, NULL);
2318
2319         /* privileges */
2320         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2321                 lsa_dissect_LSA_TRUSTED_DOMAIN_array, NDR_POINTER_UNIQUE,
2322                 "TRUSTED_DOMAIN array:", -1);
2323
2324         proto_item_set_len(item, offset-old_offset);
2325         return offset;
2326 }
2327
2328 static int
2329 lsa_dissect_lsaenumeratetrusteddomains_reply(tvbuff_t *tvb, int offset,
2330         packet_info *pinfo, proto_tree *tree, char *drep)
2331 {
2332         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2333         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2334                 hf_lsa_resume_handle, NULL);
2335
2336         /* [out, ref] LSA_REFERENCED_DOMAIN_LIST *domains */
2337         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2338                 lsa_dissect_LSA_TRUSTED_DOMAIN_LIST, NDR_POINTER_REF,
2339                 "LSA_TRUSTED_DOMAIN_LIST pointer: domains", -1);
2340
2341         offset = dissect_ntstatus(
2342                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2343
2344         return offset;
2345 }
2346
2347
2348 static int
2349 lsa_dissect_LSA_UNICODE_STRING_item(tvbuff_t *tvb, int offset,
2350         packet_info *pinfo, proto_tree *tree, char *drep)
2351 {
2352         dcerpc_info *di;
2353
2354         di=pinfo->private_data;
2355         if(di->conformant_run){
2356                 /*just a run to handle conformant arrays, nothing to dissect */
2357                 return offset;
2358         }
2359
2360         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2361                         di->hf_index, 0);
2362
2363         return offset;
2364 }
2365
2366 static int
2367 lsa_dissect_LSA_UNICODE_STRING_array(tvbuff_t *tvb, int offset,
2368         packet_info *pinfo, proto_tree *tree, char *drep)
2369 {
2370         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2371                 lsa_dissect_LSA_UNICODE_STRING_item);
2372
2373         return offset;
2374 }
2375
2376 static int
2377 lsa_dissect_LSA_UNICODE_STRING_ARRAY(tvbuff_t *tvb, int offset,
2378         packet_info *pinfo, proto_tree *tree, char *drep)
2379 {
2380         dcerpc_info *di;
2381
2382         di=pinfo->private_data;
2383
2384         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2385                 hf_lsa_count, NULL);
2386         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2387                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_UNIQUE,
2388                 "UNICODE_STRING pointer: ", di->hf_index);
2389
2390         return offset;
2391 }
2392
2393 static int
2394 lsa_dissect_LSA_TRANSLATED_SID(tvbuff_t *tvb, int offset,
2395         packet_info *pinfo, proto_tree *tree, char *drep)
2396 {
2397         /* sid type */
2398         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2399                         hf_lsa_sid_type, NULL);
2400
2401         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2402                                      hf_lsa_rid, NULL);
2403
2404         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2405                                      hf_lsa_index, NULL);
2406
2407         return offset;
2408 }
2409
2410 static int
2411 lsa_dissect_LSA_TRANSLATED_SIDS_array(tvbuff_t *tvb, int offset,
2412         packet_info *pinfo, proto_tree *tree, char *drep)
2413 {
2414         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2415                 lsa_dissect_LSA_TRANSLATED_SID);
2416
2417         return offset;
2418 }
2419
2420 static int
2421 lsa_dissect_LSA_TRANSLATED_SIDS(tvbuff_t *tvb, int offset,
2422         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2423 {
2424         proto_item *item=NULL;
2425         proto_tree *tree=NULL;
2426         int old_offset=offset;
2427
2428         if(parent_tree){
2429                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2430                         "LSA_TRANSLATED_SIDS:");
2431                 tree = proto_item_add_subtree(item, ett_LSA_TRANSLATED_SIDS);
2432         }
2433
2434         /* count */
2435         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2436                                      hf_lsa_count, NULL);
2437
2438         /* settings */
2439         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2440                 lsa_dissect_LSA_TRANSLATED_SIDS_array, NDR_POINTER_UNIQUE,
2441                 "Translated SIDS", -1);
2442
2443         proto_item_set_len(item, offset-old_offset);
2444         return offset;
2445 }
2446
2447 static int
2448 lsa_dissect_lsalookupnames_rqst(tvbuff_t *tvb, int offset,
2449         packet_info *pinfo, proto_tree *tree, char *drep)
2450 {
2451         /* [in] LSA_HANDLE hnd */
2452         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2453                 pinfo, tree, drep);
2454
2455         /* [in] ULONG count */
2456         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2457                 hf_lsa_count, NULL);
2458
2459         /* [in, size_is(count), ref] LSA_UNICODE_STRING *names */
2460         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2461                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_REF,
2462                 "Account pointer: names", hf_lsa_acct);
2463
2464         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
2465         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2466                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
2467                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
2468
2469         /* [in] USHORT level */
2470         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2471                 hf_lsa_info_level, NULL);
2472
2473         /* [in, out, ref] ULONG *num_mapped */
2474         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2475                 hf_lsa_num_mapped, NULL);
2476
2477         return offset;
2478 }
2479
2480
2481 static int
2482 lsa_dissect_lsalookupnames_reply(tvbuff_t *tvb, int offset,
2483         packet_info *pinfo, proto_tree *tree, char *drep)
2484 {
2485         /* [out] LSA_REFERENCED_DOMAIN_LIST *domains */
2486         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2487                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
2488                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
2489
2490         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
2491         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2492                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
2493                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
2494
2495         /* [in, out, ref] ULONG *num_mapped */
2496         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2497                 hf_lsa_num_mapped, NULL);
2498
2499         offset = dissect_ntstatus(
2500                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2501
2502         return offset;
2503 }
2504
2505 static int
2506 lsa_dissect_lsacreatesecret_rqst(tvbuff_t *tvb, int offset,
2507         packet_info *pinfo, proto_tree *tree, char *drep)
2508 {
2509         /* [in] LSA_HANDLE hnd_pol */
2510         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2511                 pinfo, tree, drep);
2512
2513         /* [in, ref] LSA_UNICODE_STRING *name */
2514         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2515                 hf_lsa_name, 0);
2516
2517         /* [in] ACCESS_MASK access */
2518         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2519                 pinfo, tree, drep);
2520
2521         return offset;
2522 }
2523
2524 static int
2525 lsa_dissect_lsacreatesecret_reply(tvbuff_t *tvb, int offset,
2526         packet_info *pinfo, proto_tree *tree, char *drep)
2527 {
2528
2529         /* [out] LSA_HANDLE *hnd */
2530         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2531                 pinfo, tree, drep);
2532
2533         offset = dissect_ntstatus(
2534                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2535
2536         return offset;
2537 }
2538
2539 static int
2540 lsa_dissect_lsaopenaccount_rqst(tvbuff_t *tvb, int offset,
2541         packet_info *pinfo, proto_tree *tree, char *drep)
2542 {
2543         /* [in] LSA_HANDLE hnd_pol */
2544         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2545                 pinfo, tree, drep);
2546
2547         /* [in, ref] SID *account */
2548         offset = dissect_ndr_nt_SID(tvb, offset,
2549                 pinfo, tree, drep, -1);
2550
2551         /* [in] ACCESS_MASK access */
2552         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2553                 pinfo, tree, drep);
2554
2555         return offset;
2556 }
2557
2558
2559 static int
2560 lsa_dissect_lsaopenaccount_reply(tvbuff_t *tvb, int offset,
2561         packet_info *pinfo, proto_tree *tree, char *drep)
2562 {
2563         /* [out] LSA_HANDLE *hnd */
2564         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2565                 pinfo, tree, drep);
2566
2567         offset = dissect_ntstatus(
2568                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2569
2570         return offset;
2571 }
2572
2573 static const value_string trusted_info_level_vals[] = {
2574         {1,     "Domain Name Information"},
2575         {2,     "Controllers Information"},
2576         {3,     "Posix Offset Information"},
2577         {4,     "Password Information"},
2578         {5,     "Domain Information Basic"},
2579         {6,     "Domain Information Ex"},
2580         {7,     "Domain Auth Information"},
2581         {8,     "Domain Full Information"},
2582         {9,     "Domain Security Descriptor"},
2583         {10,    "Domain Private Information"},
2584         {0,     NULL}
2585 };
2586
2587 static int
2588 lsa_dissect_TRUSTED_DOMAIN_INFORMATION(tvbuff_t *tvb, int offset,
2589         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2590 {
2591         proto_item *item=NULL;
2592         proto_tree *tree=NULL;
2593         int old_offset=offset;
2594         guint16 level;
2595
2596         if(parent_tree){
2597                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2598                         "TRUSTED_DOMAIN_INFO:");
2599                 tree = proto_item_add_subtree(item, ett_lsa_trusted_domain_info);
2600         }
2601
2602         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2603                                      hf_lsa_trusted_info_level, &level);
2604
2605         ALIGN_TO_4_BYTES;  /* all union arms aligned to 4 bytes, case 7 and 9 need this  */
2606         switch(level){
2607         case 1:
2608                 offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2609                         hf_lsa_domain, 0);
2610                 break;
2611         case 2:
2612                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2613                         hf_lsa_count, NULL);
2614                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2615                         lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_UNIQUE,
2616                         "Controllers pointer: ", hf_lsa_controller);
2617                 break;
2618         case 3:
2619                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2620                         hf_lsa_rid_offset, NULL);
2621                 break;
2622         case 4:
2623                 offset = lsa_dissect_LSA_SECRET(tvb, offset, pinfo, tree, drep);
2624                 offset = lsa_dissect_LSA_SECRET(tvb, offset, pinfo, tree, drep);
2625                 break;
2626         case 5:
2627                 offset = lsa_dissect_LSA_TRUST_INFORMATION(tvb, offset,
2628                         pinfo, tree, drep);
2629                 break;
2630         case 6:
2631                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2632                         pinfo, tree, drep);
2633                 break;
2634         case 7:
2635                 offset = lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvb, offset, pinfo, tree, drep);
2636                 break;
2637         case 8:
2638                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2639                         pinfo, tree, drep);
2640                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2641                         hf_lsa_rid_offset, NULL);
2642                 offset = lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvb, offset, pinfo, tree, drep);
2643                 break;
2644         case 9:
2645                 offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset, pinfo, tree, drep);
2646                 break;
2647         case 10:
2648                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2649                         pinfo, tree, drep);
2650                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2651                         hf_lsa_rid_offset, NULL);
2652                 offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset, pinfo, tree, drep);
2653                 break;
2654         }
2655
2656         proto_item_set_len(item, offset-old_offset);
2657         return offset;
2658 }
2659
2660 static int
2661 lsa_dissect_lsaqueryinfotrusteddomain_rqst(tvbuff_t *tvb, int offset,
2662         packet_info *pinfo, proto_tree *tree, char *drep)
2663 {
2664         /* [in] LSA_HANDLE hnd */
2665         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2666                 pinfo, tree, drep);
2667
2668         /* [in] TRUSTED_INFORMATION_CLASS level */
2669         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2670                 hf_lsa_trusted_info_level, NULL);
2671
2672         return offset;
2673 }
2674
2675
2676 static int
2677 lsa_dissect_lsaqueryinfotrusteddomain_reply(tvbuff_t *tvb, int offset,
2678         packet_info *pinfo, proto_tree *tree, char *drep)
2679 {
2680         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info */
2681         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2682                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
2683                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
2684
2685         offset = dissect_ntstatus(
2686                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2687
2688         return offset;
2689 }
2690
2691 static int
2692 lsa_dissect_lsasetinformationtrusteddomain_rqst(tvbuff_t *tvb, int offset,
2693         packet_info *pinfo, proto_tree *tree, char *drep)
2694 {
2695         /* [in] LSA_HANDLE hnd */
2696         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2697                 pinfo, tree, drep);
2698
2699         /* [in] TRUSTED_INFORMATION_CLASS level */
2700         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2701                 hf_lsa_trusted_info_level, NULL);
2702
2703         /* [in, ref] TRUSTED_DOMAIN_INFORMATION *info */
2704         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2705                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
2706                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
2707
2708         return offset;
2709 }
2710
2711
2712 static int
2713 lsa_dissect_lsasetinformationtrusteddomain_reply(tvbuff_t *tvb, int offset,
2714         packet_info *pinfo, proto_tree *tree, char *drep)
2715 {
2716         offset = dissect_ntstatus(
2717                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2718
2719         return offset;
2720 }
2721
2722 static int
2723 lsa_dissect_lsaopensecret_rqst(tvbuff_t *tvb, int offset,
2724         packet_info *pinfo, proto_tree *tree, char *drep)
2725 {
2726         /* [in] LSA_HANDLE hnd_pol */
2727         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2728                 pinfo, tree, drep);
2729
2730         /* [in, ref] LSA_UNICODE_STRING *name */
2731         offset = dissect_ndr_counted_string_cb(
2732                 tvb, offset, pinfo, tree, drep, hf_lsa_name,
2733                 cb_wstr_postprocess,
2734                 GINT_TO_POINTER(CB_STR_COL_INFO | 1));
2735
2736         /* [in] ACCESS_MASK access */
2737         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2738                 pinfo, tree, drep);
2739
2740         return offset;
2741 }
2742
2743
2744 static int
2745 lsa_dissect_lsaopensecret_reply(tvbuff_t *tvb, int offset,
2746         packet_info *pinfo, proto_tree *tree, char *drep)
2747 {
2748         /* [out] LSA_HANDLE *hnd */
2749         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2750                 pinfo, tree, drep);
2751
2752         offset = dissect_ntstatus(
2753                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2754
2755         return offset;
2756 }
2757
2758 static int
2759 lsa_dissect_lsasetsecret_rqst(tvbuff_t *tvb, int offset,
2760         packet_info *pinfo, proto_tree *tree, char *drep)
2761 {
2762         /* [in] LSA_HANDLE hnd */
2763         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2764                 pinfo, tree, drep);
2765
2766         /* [in, unique] LSA_SECRET *new_val */
2767         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2768                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2769                 "LSA_SECRET pointer: new_val", -1);
2770
2771         /* [in, unique] LSA_SECRET *old_val */
2772         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2773                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2774                 "LSA_SECRET pointer: old_val", -1);
2775
2776         return offset;
2777 }
2778
2779
2780 static int
2781 lsa_dissect_lsasetsecret_reply(tvbuff_t *tvb, int offset,
2782         packet_info *pinfo, proto_tree *tree, char *drep)
2783 {
2784         offset = dissect_ntstatus(
2785                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2786
2787         return offset;
2788 }
2789
2790 static int
2791 lsa_dissect_lsaquerysecret_rqst(tvbuff_t *tvb, int offset,
2792         packet_info *pinfo, proto_tree *tree, char *drep)
2793 {
2794         /* [in] LSA_HANDLE hnd */
2795         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2796                 pinfo, tree, drep);
2797
2798         /* [in, out, unique] LSA_SECRET **curr_val */
2799         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2800                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2801                 "LSA_SECRET pointer: curr_val", -1);
2802
2803         /* [in, out, unique] LARGE_INTEGER *curr_mtime */
2804         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2805                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2806                 "NTIME pointer: old_mtime", hf_lsa_cur_mtime);
2807
2808         /* [in, out, unique] LSA_SECRET **old_val */
2809         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2810                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2811                 "LSA_SECRET pointer: old_val", -1);
2812
2813         /* [in, out, unique] LARGE_INTEGER *old_mtime */
2814         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2815                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2816                 "NTIME pointer: old_mtime", hf_lsa_old_mtime);
2817
2818         return offset;
2819 }
2820
2821
2822 static int
2823 lsa_dissect_lsaquerysecret_reply(tvbuff_t *tvb, int offset,
2824         packet_info *pinfo, proto_tree *tree, char *drep)
2825 {
2826         /* [in, out, unique] LSA_SECRET **curr_val */
2827         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2828                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2829                 "LSA_SECRET pointer: curr_val", -1);
2830
2831         /* [in, out, unique] LARGE_INTEGER *curr_mtime */
2832         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2833                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2834                 "NTIME pointer: old_mtime", hf_lsa_cur_mtime);
2835
2836         /* [in, out, unique] LSA_SECRET **old_val */
2837         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2838                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2839                 "LSA_SECRET pointer: old_val", -1);
2840
2841         /* [in, out, unique] LARGE_INTEGER *old_mtime */
2842         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2843                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2844                 "NTIME pointer: old_mtime", hf_lsa_old_mtime);
2845
2846         return offset;
2847 }
2848
2849 static int
2850 lsa_dissect_lsadeleteobject_rqst(tvbuff_t *tvb, int offset,
2851         packet_info *pinfo, proto_tree *tree, char *drep)
2852 {
2853         /* [in] LSA_HANDLE hnd */
2854         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2855                 pinfo, tree, drep);
2856
2857         return offset;
2858 }
2859
2860
2861 static int
2862 lsa_dissect_lsadeleteobject_reply(tvbuff_t *tvb, int offset,
2863         packet_info *pinfo, proto_tree *tree, char *drep)
2864 {
2865         offset = dissect_ntstatus(
2866                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2867
2868         return offset;
2869 }
2870
2871 static int
2872 lsa_dissect_lsaenumerateaccountswithuserright_rqst(tvbuff_t *tvb, int offset,
2873         packet_info *pinfo, proto_tree *tree, char *drep)
2874 {
2875         /* [in] LSA_HANDLE hnd */
2876         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2877                 pinfo, tree, drep);
2878
2879         /* [in, unique] LSA_UNICODE_STRING *rights */
2880         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2881                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
2882                 "LSA_UNICODE_STRING pointer: rights", hf_lsa_rights);
2883
2884         return offset;
2885 }
2886
2887 static int
2888 lsa_dissect_lsaenumerateaccountswithuserright_reply(tvbuff_t *tvb, int offset,
2889         packet_info *pinfo, proto_tree *tree, char *drep)
2890 {
2891         /* [out, ref] LSA_UNICODE_STRING_ARRAY *accounts */
2892         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2893                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2894                 "Account pointer: names", hf_lsa_acct);
2895
2896         offset = dissect_ntstatus(
2897                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2898
2899         return offset;
2900 }
2901
2902 static int
2903 lsa_dissect_lsaenumerateaccountrights_rqst(tvbuff_t *tvb, int offset,
2904         packet_info *pinfo, proto_tree *tree, char *drep)
2905 {
2906         /* [in] LSA_HANDLE hnd */
2907         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2908                 pinfo, tree, drep);
2909
2910         /* [in, ref] SID *account */
2911         offset = dissect_ndr_nt_SID(tvb, offset,
2912                 pinfo, tree, drep, -1);
2913
2914         return offset;
2915 }
2916
2917
2918 static int
2919 lsa_dissect_lsaenumerateaccountrights_reply(tvbuff_t *tvb, int offset,
2920         packet_info *pinfo, proto_tree *tree, char *drep)
2921 {
2922         /* [out, ref] LSA_UNICODE_STRING_ARRAY *rights */
2923         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2924                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2925                 "Account pointer: rights", hf_lsa_rights);
2926
2927         offset = dissect_ntstatus(
2928                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2929
2930         return offset;
2931 }
2932
2933 static int
2934 lsa_dissect_lsaaddaccountrights_rqst(tvbuff_t *tvb, int offset,
2935         packet_info *pinfo, proto_tree *tree, char *drep)
2936 {
2937         /* [in] LSA_HANDLE hnd */
2938         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2939                 pinfo, tree, drep);
2940
2941         /* [in, ref] SID *account */
2942         offset = dissect_ndr_nt_SID(tvb, offset,
2943                 pinfo, tree, drep, -1);
2944
2945         /* [in, ref] LSA_UNICODE_STRING_ARRAY *rights */
2946         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2947                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2948                 "Account pointer: rights", hf_lsa_rights);
2949
2950         return offset;
2951 }
2952
2953
2954 static int
2955 lsa_dissect_lsaaddaccountrights_reply(tvbuff_t *tvb, int offset,
2956         packet_info *pinfo, proto_tree *tree, char *drep)
2957 {
2958         offset = dissect_ntstatus(
2959                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2960
2961         return offset;
2962 }
2963
2964 static int
2965 lsa_dissect_lsaremoveaccountrights_rqst(tvbuff_t *tvb, int offset,
2966         packet_info *pinfo, proto_tree *tree, char *drep)
2967 {
2968         /* [in] LSA_HANDLE hnd */
2969         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2970                 pinfo, tree, drep);
2971
2972         /* [in, ref] SID *account */
2973         offset = dissect_ndr_nt_SID(tvb, offset,
2974                 pinfo, tree, drep, -1);
2975
2976         /* remove all */
2977         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
2978                         hf_lsa_remove_all, NULL);
2979
2980         /* [in, ref] LSA_UNICODE_STRING_ARRAY *rights */
2981         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2982                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2983                 "Account pointer: rights", hf_lsa_rights);
2984
2985         return offset;
2986 }
2987
2988
2989 static int
2990 lsa_dissect_lsaremoveaccountrights_reply(tvbuff_t *tvb, int offset,
2991         packet_info *pinfo, proto_tree *tree, char *drep)
2992 {
2993         offset = dissect_ntstatus(
2994                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2995
2996         return offset;
2997 }
2998
2999
3000 static int
3001 lsa_dissect_lsaquerytrusteddomaininfobyname_rqst(tvbuff_t *tvb, int offset,
3002         packet_info *pinfo, proto_tree *tree, char *drep)
3003 {
3004         /* [in] LSA_HANDLE handle */
3005         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3006                 pinfo, tree, drep);
3007
3008         /* [in, ref] LSA_UNICODE_STRING *name */
3009         /* domain */
3010         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3011                 hf_lsa_domain, 0);
3012
3013         /* [in] TRUSTED_INFORMATION_CLASS level */
3014         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3015                                      hf_lsa_trusted_info_level, NULL);
3016
3017         return offset;
3018 }
3019
3020
3021 static int
3022 lsa_dissect_lsaquerytrusteddomaininfobyname_reply(tvbuff_t *tvb, int offset,
3023         packet_info *pinfo, proto_tree *tree, char *drep)
3024 {
3025         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3026         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3027                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3028                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3029
3030         offset = dissect_ntstatus(
3031                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3032
3033         return offset;
3034 }
3035
3036
3037 static int
3038 lsa_dissect_lsasettrusteddomaininfobyname_rqst(tvbuff_t *tvb, int offset,
3039         packet_info *pinfo, proto_tree *tree, char *drep)
3040 {
3041         /* [in] LSA_HANDLE handle */
3042         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3043                 pinfo, tree, drep);
3044
3045         /* [in, ref] LSA_UNICODE_STRING *name */
3046         /* domain */
3047         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3048                 hf_lsa_domain, 0);
3049
3050         /* [in] TRUSTED_INFORMATION_CLASS level */
3051         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3052                                      hf_lsa_trusted_info_level, NULL);
3053
3054         /* [in, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3055         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3056                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3057                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3058
3059         return offset;
3060 }
3061
3062
3063 static int
3064 lsa_dissect_lsasettrusteddomaininfobyname_reply(tvbuff_t *tvb, int offset,
3065         packet_info *pinfo, proto_tree *tree, char *drep)
3066 {
3067         offset = dissect_ntstatus(
3068                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3069
3070         return offset;
3071 }
3072
3073 static int
3074 lsa_dissect_lsaquerytrusteddomaininfo_rqst(tvbuff_t *tvb, int offset,
3075         packet_info *pinfo, proto_tree *tree, char *drep)
3076 {
3077         /* [in] LSA_HANDLE handle */
3078         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3079                 pinfo, tree, drep);
3080
3081         /* [in, ref] SID *sid */
3082         offset = dissect_ndr_nt_SID(tvb, offset,
3083                 pinfo, tree, drep, -1);
3084
3085         /* [in] TRUSTED_INFORMATION_CLASS level */
3086         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3087                                      hf_lsa_trusted_info_level, NULL);
3088
3089         return offset;
3090 }
3091
3092 static int
3093 lsa_dissect_lsaopentrusteddomainbyname_rqst(tvbuff_t *tvb, int offset,
3094         packet_info *pinfo, proto_tree *tree, char *drep)
3095 {
3096         /* [in] LSA_HANDLE handle */
3097         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3098                 pinfo, tree, drep);
3099
3100         /* [in, ref] LSA_UNICODE_STRING *name */
3101         /* domain */
3102         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3103                 hf_lsa_domain, 0);
3104
3105         /* [in] ACCESS_MASK access */
3106         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3107                 pinfo, tree, drep);
3108
3109         return offset;
3110 }
3111
3112
3113 static int
3114 lsa_dissect_lsaopentrusteddomainbyname_reply(tvbuff_t *tvb, int offset,
3115         packet_info *pinfo, proto_tree *tree, char *drep)
3116 {
3117         /* [out] LSA_HANDLE handle */
3118         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3119                 pinfo, tree, drep);
3120
3121         offset = dissect_ntstatus(
3122                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3123
3124         return offset;
3125 }
3126
3127
3128
3129 static int
3130 lsa_dissect_lsaquerytrusteddomaininfo_reply(tvbuff_t *tvb, int offset,
3131         packet_info *pinfo, proto_tree *tree, char *drep)
3132 {
3133         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3134         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3135                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3136                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3137
3138         offset = dissect_ntstatus(
3139                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3140
3141         return offset;
3142 }
3143
3144 static int
3145 lsa_dissect_lsasettrusteddomaininfo_rqst(tvbuff_t *tvb, int offset,
3146         packet_info *pinfo, proto_tree *tree, char *drep)
3147 {
3148         /* [in] LSA_HANDLE handle */
3149         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3150                 pinfo, tree, drep);
3151
3152         /* [in, ref] SID *sid */
3153         offset = dissect_ndr_nt_SID(tvb, offset,
3154                 pinfo, tree, drep, -1);
3155
3156         /* [in] TRUSTED_INFORMATION_CLASS level */
3157         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3158                                      hf_lsa_trusted_info_level, NULL);
3159
3160         /* [ref, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3161         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3162                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3163                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3164
3165         return offset;
3166 }
3167
3168
3169 static int
3170 lsa_dissect_lsasettrusteddomaininfo_reply(tvbuff_t *tvb, int offset,
3171         packet_info *pinfo, proto_tree *tree, char *drep)
3172 {
3173         offset = dissect_ntstatus(
3174                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3175
3176         return offset;
3177 }
3178
3179 static int
3180 lsa_dissect_lsaqueryinformationpolicy2_rqst(tvbuff_t *tvb, int offset,
3181         packet_info *pinfo, proto_tree *tree, char *drep)
3182 {
3183         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3184                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
3185                 "LSA_HANDLE", -1);
3186
3187         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3188                 hf_lsa_policy_information_class, NULL);
3189
3190         return offset;
3191 }
3192
3193 static int
3194 lsa_dissect_lsaqueryinformationpolicy2_reply(tvbuff_t *tvb, int offset,
3195         packet_info *pinfo, proto_tree *tree, char *drep)
3196 {
3197         /* This is really a pointer to a pointer though the first level is REF
3198           so we just ignore that one */
3199         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3200                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_UNIQUE,
3201                 "POLICY_INFORMATION pointer: info", -1);
3202
3203         offset = dissect_ntstatus(
3204                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3205
3206         return offset;
3207 }
3208
3209 static int
3210 lsa_dissect_lsasetinformationpolicy2_rqst(tvbuff_t *tvb, int offset,
3211         packet_info *pinfo, proto_tree *tree, char *drep)
3212 {
3213         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3214                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
3215                 "LSA_HANDLE", -1);
3216
3217         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3218                 hf_lsa_policy_information_class, NULL);
3219
3220         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3221                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3222                 "POLICY_INFORMATION pointer: info", -1);
3223
3224         return offset;
3225 }
3226
3227 static int
3228 lsa_dissect_lsasetinformationpolicy2_reply(tvbuff_t *tvb, int offset,
3229         packet_info *pinfo, proto_tree *tree, char *drep)
3230 {
3231         offset = dissect_ntstatus(
3232                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3233
3234         return offset;
3235 }
3236
3237 static int
3238 lsa_dissect_lsaquerydomaininformationpolicy_rqst(tvbuff_t *tvb, int offset,
3239         packet_info *pinfo, proto_tree *tree, char *drep)
3240 {
3241         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3242                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
3243                 "LSA_HANDLE", -1);
3244
3245         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3246                 hf_lsa_policy_information_class, NULL);
3247
3248         return offset;
3249 }
3250
3251 static int
3252 lsa_dissect_lsaquerydomaininformationpolicy_reply(tvbuff_t *tvb, int offset,
3253         packet_info *pinfo, proto_tree *tree, char *drep)
3254 {
3255         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3256                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3257                 "POLICY_INFORMATION pointer: info", -1);
3258
3259         offset = dissect_ntstatus(
3260                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3261
3262         return offset;
3263 }
3264
3265 static int
3266 lsa_dissect_lsasetdomaininformationpolicy_rqst(tvbuff_t *tvb, int offset,
3267         packet_info *pinfo, proto_tree *tree, char *drep)
3268 {
3269         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3270                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
3271                 "LSA_HANDLE", -1);
3272
3273         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3274                 hf_lsa_policy_information_class, NULL);
3275
3276         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3277                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3278                 "POLICY_INFORMATION pointer: info", -1);
3279
3280         return offset;
3281 }
3282
3283 static int
3284 lsa_dissect_lsasetdomaininformationpolicy_reply(tvbuff_t *tvb, int offset,
3285         packet_info *pinfo, proto_tree *tree, char *drep)
3286 {
3287         offset = dissect_ntstatus(
3288                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3289
3290         return offset;
3291 }
3292
3293 static int
3294 lsa_dissect_lsalookupnames2_rqst(tvbuff_t *tvb, int offset,
3295         packet_info *pinfo, proto_tree *tree, char *drep)
3296 {
3297         /* [in] LSA_HANDLE hnd */
3298         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3299                 pinfo, tree, drep);
3300
3301         /* [in] ULONG count */
3302         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3303                 hf_lsa_count, NULL);
3304
3305         /* [in, size_is(count), ref] LSA_UNICODE_STRING *names */
3306         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3307                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_REF,
3308                 "Account pointer: names", hf_lsa_acct);
3309
3310         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
3311         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3312                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
3313                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
3314
3315         /* [in] USHORT level */
3316         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3317                 hf_lsa_info_level, NULL);
3318
3319         /* [in, out, ref] ULONG *num_mapped */
3320         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3321                 hf_lsa_num_mapped, NULL);
3322
3323         /* unknown */
3324         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3325                                      hf_lsa_unknown_long, NULL);
3326
3327         /* unknown */
3328         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3329                                      hf_lsa_unknown_long, NULL);
3330
3331         return offset;
3332 }
3333
3334
3335 static int
3336 lsa_dissect_lsalookupnames2_reply(tvbuff_t *tvb, int offset,
3337         packet_info *pinfo, proto_tree *tree, char *drep)
3338 {
3339         /* [out] LSA_REFERENCED_DOMAIN_LIST *domains */
3340         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3341                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
3342                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
3343
3344         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
3345         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3346                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
3347                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
3348
3349         /* [in, out, ref] ULONG *num_mapped */
3350         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3351                 hf_lsa_num_mapped, NULL);
3352
3353         offset = dissect_ntstatus(
3354                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3355
3356         return offset;
3357 }
3358
3359
3360 static int
3361 lsa_dissect_lsacreateaccount_rqst(tvbuff_t *tvb, int offset,
3362         packet_info *pinfo, proto_tree *tree, char *drep)
3363 {
3364         /* [in] LSA_HANDLE hnd */
3365         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3366                 pinfo, tree, drep);
3367
3368         offset = dissect_ndr_nt_SID(tvb, offset,
3369                 pinfo, tree, drep, -1);
3370
3371         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3372                 pinfo, tree, drep);
3373
3374         return offset;
3375 }
3376
3377 static int
3378 lsa_dissect_lsacreateaccount_reply(tvbuff_t *tvb, int offset,
3379         packet_info *pinfo, proto_tree *tree, char *drep)
3380 {
3381         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3382                 pinfo, tree, drep);
3383
3384         offset = dissect_ntstatus(
3385                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3386
3387         return offset;
3388 }
3389
3390 static int
3391 lsa_dissect_lsalookupprivilegedisplayname_rqst(tvbuff_t *tvb, int offset,
3392         packet_info *pinfo, proto_tree *tree, char *drep)
3393 {
3394         /* [in] LSA_HANDLE hnd */
3395         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3396                 pinfo, tree, drep);
3397
3398         /* [in, ref] LSA_UNICODE_STRING *name */
3399         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3400                 hf_lsa_name, 0);
3401
3402         /* [in] USHORT unknown */
3403         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3404                 hf_lsa_unknown_short, NULL);
3405
3406         /* [in] USHORT size */
3407         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3408                 hf_lsa_size16, NULL);
3409
3410         return offset;
3411 }
3412
3413
3414 static int
3415 lsa_dissect_lsalookupprivilegedisplayname_reply(tvbuff_t *tvb, int offset,
3416         packet_info *pinfo, proto_tree *tree, char *drep)
3417 {
3418         /* [out, ref] LSA_UNICODE_STRING **disp_name */
3419         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3420                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3421                 "NAME pointer: ", hf_lsa_privilege_name);
3422
3423         /* [out, ref] USHORT *size_needed */
3424         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3425                 hf_lsa_size_needed, NULL);
3426
3427         offset = dissect_ntstatus(
3428                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3429
3430         return offset;
3431 }
3432
3433 static int
3434 lsa_dissect_lsastoreprivatedata_rqst(tvbuff_t *tvb, int offset,
3435         packet_info *pinfo, proto_tree *tree, char *drep)
3436 {
3437         /* [in] LSA_HANDLE hnd */
3438         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3439                 pinfo, tree, drep);
3440
3441         /* [in, ref] LSA_UNICODE_STRING *key */
3442         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3443                 hf_lsa_key, 0);
3444
3445         /* [in, unique] LSA_SECRET **data */
3446         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3447                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
3448                 "LSA_SECRET* pointer: data", -1);
3449
3450         return offset;
3451 }
3452
3453
3454 static int
3455 lsa_dissect_lsastoreprivatedata_reply(tvbuff_t *tvb, int offset,
3456         packet_info *pinfo, proto_tree *tree, char *drep)
3457 {
3458         offset = dissect_ntstatus(
3459                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3460
3461         return offset;
3462 }
3463
3464 static int
3465 lsa_dissect_lsaretrieveprivatedata_rqst(tvbuff_t *tvb, int offset,
3466         packet_info *pinfo, proto_tree *tree, char *drep)
3467 {
3468         /* [in] LSA_HANDLE hnd */
3469         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3470                 pinfo, tree, drep);
3471
3472         /* [in, ref] LSA_UNICODE_STRING *key */
3473         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3474                 hf_lsa_key, 0);
3475
3476         /* [in, out, ref] LSA_SECRET **data */
3477         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3478                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_REF,
3479                 "LSA_SECRET* pointer: data", -1);
3480
3481         return offset;
3482 }
3483
3484
3485 static int
3486 lsa_dissect_lsaretrieveprivatedata_reply(tvbuff_t *tvb, int offset,
3487         packet_info *pinfo, proto_tree *tree, char *drep)
3488 {
3489         /* [in, out, ref] LSA_SECRET **data */
3490         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3491                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_REF,
3492                 "LSA_SECRET* pointer: data", -1);
3493
3494         offset = dissect_ntstatus(
3495                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3496
3497         return offset;
3498 }
3499
3500 static int
3501 lsa_dissect_lsaclosetrusteddomainex_rqst(tvbuff_t *tvb, int offset,
3502         packet_info *pinfo, proto_tree *tree, char *drep)
3503 {
3504
3505         /* [in, out] LSA_HANDLE *tdHnd */
3506         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3507                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
3508                 "LSA_HANDLE", -1);
3509
3510         return offset;
3511 }
3512
3513
3514 static int
3515 lsa_dissect_lsaclosetrusteddomainex_reply(tvbuff_t *tvb, int offset,
3516         packet_info *pinfo, proto_tree *tree, char *drep)
3517 {
3518
3519         /* [in, out] LSA_HANDLE *tdHnd */
3520         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3521                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
3522                 "LSA_HANDLE", -1);
3523
3524         offset = dissect_ntstatus(
3525                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3526
3527         return offset;
3528 }
3529
3530 static int
3531 lsa_dissect_LSA_TRANSLATED_NAME_EX(tvbuff_t *tvb, int offset,
3532         packet_info *pinfo, proto_tree *parent_tree, char *drep)
3533 {
3534         proto_item *item=NULL;
3535         proto_tree *tree=NULL;
3536         int old_offset=offset;
3537
3538         if(parent_tree){
3539                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3540                         "LSA_TRANSLATED_NAME:");
3541                 tree = proto_item_add_subtree(item, ett_lsa_translated_name);
3542         }
3543
3544         /* sid type */
3545         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3546                         hf_lsa_sid_type, NULL);
3547
3548         /* name */
3549         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3550                 hf_lsa_name, 0);
3551
3552         /* index */
3553         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3554                                      hf_lsa_index, NULL);
3555
3556         /* unknown */
3557         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3558                                      hf_lsa_unknown_long, NULL);
3559
3560         proto_item_set_len(item, offset-old_offset);
3561         return offset;
3562 }
3563
3564 static int
3565 lsa_dissect_LSA_TRANSLATED_NAME_EX_array(tvbuff_t *tvb, int offset,
3566         packet_info *pinfo, proto_tree *tree, char *drep)
3567 {
3568         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3569                 lsa_dissect_LSA_TRANSLATED_NAME_EX);
3570
3571         return offset;
3572 }
3573 static int
3574 lsa_dissect_LSA_TRANSLATED_NAMES_EX(tvbuff_t *tvb, int offset,
3575         packet_info *pinfo, proto_tree *tree, char *drep)
3576 {
3577         /* count */
3578         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3579                                      hf_lsa_count, NULL);
3580
3581         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3582                         lsa_dissect_LSA_TRANSLATED_NAME_EX_array, NDR_POINTER_UNIQUE,
3583                         "LSA_TRANSLATED_NAME_EX: pointer", -1);
3584
3585         return offset;
3586 }
3587
3588
3589 static int
3590 lsa_dissect_lsalookupsids2_rqst(tvbuff_t *tvb, int offset,
3591         packet_info *pinfo, proto_tree *tree, char *drep)
3592 {
3593         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3594                 pinfo, tree, drep);
3595
3596         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3597                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
3598                         "PSID_ARRAY", -1);
3599
3600         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3601                 lsa_dissect_LSA_TRANSLATED_NAMES_EX, NDR_POINTER_REF,
3602                 "LSA_TRANSLATED_NAMES_EX pointer: names", -1);
3603
3604         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3605                 hf_lsa_info_level, NULL);
3606
3607         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3608                 hf_lsa_num_mapped, NULL);
3609
3610         /* unknown */
3611         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3612                                      hf_lsa_unknown_long, NULL);
3613
3614         /* unknown */
3615         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3616                                      hf_lsa_unknown_long, NULL);
3617
3618         return offset;
3619 }
3620
3621 static int
3622 lsa_dissect_lsalookupsids2_reply(tvbuff_t *tvb, int offset,
3623         packet_info *pinfo, proto_tree *tree, char *drep)
3624 {
3625         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3626                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
3627                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
3628
3629         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3630                 lsa_dissect_LSA_TRANSLATED_NAMES_EX, NDR_POINTER_REF,
3631                 "LSA_TRANSLATED_NAMES_EX pointer: names", -1);
3632
3633         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3634                 hf_lsa_num_mapped, NULL);
3635
3636         offset = dissect_ntstatus(
3637                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3638
3639         return offset;
3640 }
3641
3642 static int
3643 lsa_dissect_lsagetusername_rqst(tvbuff_t *tvb, int offset,
3644         packet_info *pinfo, proto_tree *tree, char *drep)
3645 {
3646
3647         /* [in, unique, string] WCHAR *server */
3648         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3649                 dissect_lsa_openpolicy_server, NDR_POINTER_UNIQUE,
3650                 "Server:", hf_lsa_server);
3651
3652         /* [in, out, ref] LSA_UNICODE_STRING **user */
3653         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3654                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3655                 "ACCOUNT pointer: ", hf_lsa_acct);
3656
3657         /* [in, out, unique] LSA_UNICODE_STRING **domain */
3658         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3659                 lsa_dissect_pointer_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3660                 "DOMAIN pointer: ", hf_lsa_domain);
3661
3662         return offset;
3663 }
3664
3665
3666 static int
3667 lsa_dissect_lsagetusername_reply(tvbuff_t *tvb, int offset,
3668         packet_info *pinfo, proto_tree *tree, char *drep)
3669 {
3670         /* [in, out, ref] LSA_UNICODE_STRING **user */
3671         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3672                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3673                 "ACCOUNT pointer: ", hf_lsa_acct);
3674
3675         /* [in, out, unique] LSA_UNICODE_STRING **domain */
3676         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3677                 lsa_dissect_pointer_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3678                 "DOMAIN pointer: ", hf_lsa_domain);
3679
3680         offset = dissect_ntstatus(
3681                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3682
3683         return offset;
3684 }
3685
3686 static int
3687 lsa_dissect_lsacreatetrusteddomainex_rqst(tvbuff_t *tvb, int offset,
3688         packet_info *pinfo, proto_tree *tree, char *drep)
3689 {
3690         /* [in] LSA_HANDLE hnd */
3691         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3692                 pinfo, tree, drep);
3693
3694         /* [in, ref] TRUSTED_DOMAIN_INFORMATION_EX *info */
3695         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3696                 lsa_dissect_LSA_TRUST_INFORMATION_EX, NDR_POINTER_REF,
3697                 "TRUSTED_DOMAIN_INFORMATION_EX pointer: info", -1);
3698
3699         /* [in, ref] TRUSTED_DOMAIN_AUTH_INFORMATION *auth */
3700         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3701                 lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION, NDR_POINTER_REF,
3702                 "TRUSTED_DOMAIN_AUTH_INFORMATION pointer: auth", -1);
3703
3704         /* [in] ACCESS_MASK mask */
3705         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3706                 pinfo, tree, drep);
3707
3708         return offset;
3709 }
3710
3711
3712 static int
3713 lsa_dissect_lsacreatetrusteddomainex_reply(tvbuff_t *tvb, int offset,
3714         packet_info *pinfo, proto_tree *tree, char *drep)
3715 {
3716         /* [out] LSA_HANDLE *tdHnd) */
3717         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3718                 pinfo, tree, drep);
3719
3720         offset = dissect_ntstatus(
3721                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3722
3723         return offset;
3724 }
3725
3726 static int
3727 lsa_dissect_lsaenumeratetrusteddomainsex_rqst(tvbuff_t *tvb, int offset,
3728         packet_info *pinfo, proto_tree *tree, char *drep)
3729 {
3730         /* [in] LSA_HANDLE hnd */
3731         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3732                 pinfo, tree, drep);
3733
3734         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
3735         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3736                 hf_lsa_resume_handle, NULL);
3737
3738         /* [in] ULONG pref_maxlen */
3739         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3740                 hf_lsa_max_count, NULL);
3741
3742         return offset;
3743 }
3744
3745
3746 static int
3747 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_EX_array(tvbuff_t *tvb, int offset,
3748         packet_info *pinfo, proto_tree *tree, char *drep)
3749 {
3750         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3751                 lsa_dissect_LSA_TRUST_INFORMATION_EX);
3752
3753         return offset;
3754 }
3755
3756 static int
3757 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_LIST_EX(tvbuff_t *tvb, int offset,
3758         packet_info *pinfo, proto_tree *tree, char *drep)
3759 {
3760         /* count */
3761         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3762                                      hf_lsa_count, NULL);
3763
3764         /* trust information */
3765         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3766                 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_EX_array, NDR_POINTER_UNIQUE,
3767                 "TRUST INFORMATION array:", -1);
3768
3769         /* max count */
3770         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3771                                      hf_lsa_max_count, NULL);
3772
3773
3774         return offset;
3775 }
3776
3777 static int
3778 lsa_dissect_lsaenumeratetrusteddomainsex_reply(tvbuff_t *tvb, int offset,
3779         packet_info *pinfo, proto_tree *tree, char *drep)
3780 {
3781         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
3782         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3783                 hf_lsa_resume_handle, NULL);
3784
3785         /* [out, ref] TRUSTED_DOMAIN_INFORMATION_LIST_EX *domains */
3786         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3787                 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_LIST_EX, NDR_POINTER_REF,
3788                 "TRUSTED_DOMAIN_INFORMATION_LIST_EX pointer: domains", -1);
3789
3790         offset = dissect_ntstatus(
3791                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3792
3793         return offset;
3794 }
3795
3796 static int
3797 lsa_dissect_lsafunction_38_rqst(tvbuff_t *tvb, int offset,
3798         packet_info *pinfo, proto_tree *tree, char *drep)
3799 {
3800         /* [in] LSA_HANDLE handle */
3801         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3802                 pinfo, tree, drep);
3803
3804         /* [in] USHORT flag */
3805         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3806                 hf_lsa_unknown_short, NULL);
3807
3808         /* [in, ref] LSA_SECURITY_DESCRIPTOR *sd */
3809         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3810                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
3811                 "LSA_SECURITY_DESCRIPTOR pointer: sd", -1);
3812
3813         return offset;
3814 }
3815
3816
3817 static int
3818 lsa_dissect_lsafunction_38_reply(tvbuff_t *tvb, int offset,
3819         packet_info *pinfo, proto_tree *tree, char *drep)
3820 {
3821         /* [out, ref] LSA_SECURITY_DESCRIPTOR **psd) */
3822         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3823                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
3824                 "LSA_SECURITY_DESCRIPTOR pointer: psd)", -1);
3825
3826         return offset;
3827 }
3828
3829 static int
3830 lsa_dissect_lsafunction_3b_rqst(tvbuff_t *tvb, int offset,
3831         packet_info *pinfo, proto_tree *tree, char *drep)
3832 {
3833         /* [in] LSA_HANDLE hnd */
3834         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3835                 pinfo, tree, drep);
3836
3837         /* [in, ref] TRUSTED_DOMAIN_INFORMATION_EX *info */
3838         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3839                 lsa_dissect_LSA_TRUST_INFORMATION_EX, NDR_POINTER_REF,
3840                 "TRUSTED_DOMAIN_INFORMATION_EX pointer: info", -1);
3841
3842         /* [in, ref] LSA_SECURITY_DESCRIPTOR *sd */
3843         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3844                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
3845                 "LSA_SECURITY_DESCRIPTOR pointer: sd", -1);
3846
3847         /* [in] ULONG unknown */
3848         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3849                 hf_lsa_unknown_long, NULL);
3850
3851         return offset;
3852 }
3853
3854
3855 static int
3856 lsa_dissect_lsafunction_3b_reply(tvbuff_t *tvb, int offset,
3857         packet_info *pinfo, proto_tree *tree, char *drep)
3858 {
3859         /* [out] LSA_HANDLE *h2) */
3860         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3861                 pinfo, tree, drep);
3862
3863         offset = dissect_ntstatus(
3864                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3865
3866         return offset;
3867 }
3868
3869
3870 static dcerpc_sub_dissector dcerpc_lsa_dissectors[] = {
3871         { LSA_LSACLOSE, "Close",
3872                 lsa_dissect_lsaclose_rqst,
3873                 lsa_dissect_lsaclose_reply },
3874         { LSA_LSADELETE, "Delete",
3875                 lsa_dissect_lsadelete_rqst,
3876                 lsa_dissect_lsadelete_reply },
3877         { LSA_LSAENUMERATEPRIVILEGES, "EnumPrivs",
3878                 lsa_dissect_lsaenumerateprivileges_rqst,
3879                 lsa_dissect_lsaenumerateprivileges_reply },
3880         { LSA_LSAQUERYSECURITYOBJECT, "QuerySecObject",
3881                 lsa_dissect_lsaquerysecurityobject_rqst,
3882                 lsa_dissect_lsaquerysecurityobject_reply },
3883         { LSA_LSASETSECURITYOBJECT, "SetSecObject",
3884                 lsa_dissect_lsasetsecurityobject_rqst,
3885                 lsa_dissect_lsasetsecurityobject_reply },
3886         { LSA_LSACHANGEPASSWORD, "ChangePassword",
3887                 lsa_dissect_lsachangepassword_rqst,
3888                 lsa_dissect_lsachangepassword_reply },
3889         { LSA_LSAOPENPOLICY, "OpenPolicy",
3890                 lsa_dissect_lsaopenpolicy_rqst,
3891                 lsa_dissect_lsaopenpolicy_reply },
3892         { LSA_LSAQUERYINFORMATIONPOLICY, "QueryInfoPolicy",
3893                 lsa_dissect_lsaqueryinformationpolicy_rqst,
3894                 lsa_dissect_lsaqueryinformationpolicy_reply },
3895         { LSA_LSASETINFORMATIONPOLICY, "SetInfoPolicy",
3896                 lsa_dissect_lsasetinformationpolicy_rqst,
3897                 lsa_dissect_lsasetinformationpolicy_reply },
3898         { LSA_LSACLEARAUDITLOG, "ClearAuditLog",
3899                 lsa_dissect_lsaclearauditlog_rqst,
3900                 lsa_dissect_lsaclearauditlog_reply },
3901         { LSA_LSACREATEACCOUNT, "CreateAccount",
3902                 lsa_dissect_lsacreateaccount_rqst,
3903                 lsa_dissect_lsacreateaccount_reply },
3904         { LSA_LSAENUMERATEACCOUNTS, "EnumAccounts",
3905                 lsa_dissect_lsaenumerateaccounts_rqst,
3906                 lsa_dissect_lsaenumerateaccounts_reply },
3907         { LSA_LSACREATETRUSTEDDOMAIN, "CreateTrustedDomain",
3908                 lsa_dissect_lsacreatetrusteddomain_rqst,
3909                 lsa_dissect_lsacreatetrusteddomain_reply },
3910         { LSA_LSAENUMERATETRUSTEDDOMAINS, "EnumTrustedDomains",
3911                 lsa_dissect_lsaenumeratetrusteddomains_rqst,
3912                 lsa_dissect_lsaenumeratetrusteddomains_reply },
3913         { LSA_LSALOOKUPNAMES, "LookupNames",
3914                 lsa_dissect_lsalookupnames_rqst,
3915                 lsa_dissect_lsalookupnames_reply },
3916         { LSA_LSALOOKUPSIDS, "LookupSIDs",
3917                 lsa_dissect_lsalookupsids_rqst,
3918                 lsa_dissect_lsalookupsids_reply },
3919         { LSA_LSACREATESECRET, "CreateSecret",
3920                 lsa_dissect_lsacreatesecret_rqst,
3921                 lsa_dissect_lsacreatesecret_reply },
3922         { LSA_LSAOPENACCOUNT, "OpenAccount",
3923                 lsa_dissect_lsaopenaccount_rqst,
3924                 lsa_dissect_lsaopenaccount_reply },
3925         { LSA_LSAENUMERATEPRIVILEGESACCOUNT, "EnumPrivsAccount",
3926                 lsa_dissect_lsaenumerateprivilegesaccount_rqst,
3927                 lsa_dissect_lsaenumerateprivilegesaccount_reply },
3928         { LSA_LSAADDPRIVILEGESTOACCOUNT, "AddPrivsToAccount",
3929                 lsa_dissect_lsaaddprivilegestoaccount_rqst,
3930                 lsa_dissect_lsaaddprivilegestoaccount_reply },
3931         { LSA_LSAREMOVEPRIVILEGESFROMACCOUNT, "MovePrivsFromAccount",
3932                 lsa_dissect_lsaremoveprivilegesfromaccount_rqst,
3933                 lsa_dissect_lsaremoveprivilegesfromaccount_reply },
3934         { LSA_LSAGETQUOTASFORACCOUNT, "GetQuotasForAccount",
3935                 lsa_dissect_lsagetquotasforaccount_rqst,
3936                 lsa_dissect_lsagetquotasforaccount_reply },
3937         { LSA_LSASETQUOTASFORACCOUNT, "SetQuotasForAccount",
3938                 lsa_dissect_lsasetquotasforaccount_rqst,
3939                 lsa_dissect_lsasetquotasforaccount_reply },
3940         { LSA_LSAGETSYSTEMACCESSACCOUNT, "GetSystemAccessAccount",
3941                 lsa_dissect_lsagetsystemaccessaccount_rqst,
3942                 lsa_dissect_lsagetsystemaccessaccount_reply },
3943         { LSA_LSASETSYSTEMACCESSACCOUNT, "SetSystemAccessAccount",
3944                 lsa_dissect_lsasetsystemaccessaccount_rqst,
3945                 lsa_dissect_lsasetsystemaccessaccount_reply },
3946         { LSA_LSAOPENTRUSTEDDOMAIN, "OpenTrustedDomain",
3947                 lsa_dissect_lsaopentrusteddomain_rqst,
3948                 lsa_dissect_lsaopentrusteddomain_reply },
3949         { LSA_LSAQUERYINFOTRUSTEDDOMAIN, "QueryInfoTrustedDomain",
3950                 lsa_dissect_lsaqueryinfotrusteddomain_rqst,
3951                 lsa_dissect_lsaqueryinfotrusteddomain_reply },
3952         { LSA_LSASETINFORMATIONTRUSTEDDOMAIN, "SetInfoTrustedDomain",
3953                 lsa_dissect_lsasetinformationtrusteddomain_rqst,
3954                 lsa_dissect_lsasetinformationtrusteddomain_reply },
3955         { LSA_LSAOPENSECRET, "OpenSecret",
3956                 lsa_dissect_lsaopensecret_rqst,
3957                 lsa_dissect_lsaopensecret_reply },
3958         { LSA_LSASETSECRET, "SetSecret",
3959                 lsa_dissect_lsasetsecret_rqst,
3960                 lsa_dissect_lsasetsecret_reply },
3961         { LSA_LSAQUERYSECRET, "QuerySecret",
3962                 lsa_dissect_lsaquerysecret_rqst,
3963                 lsa_dissect_lsaquerysecret_reply },
3964         { LSA_LSALOOKUPPRIVILEGEVALUE, "LookupPrivValue",
3965                 lsa_dissect_lsalookupprivilegevalue_rqst,
3966                 lsa_dissect_lsalookupprivilegevalue_reply },
3967         { LSA_LSALOOKUPPRIVILEGENAME, "LookupPrivName",
3968                 lsa_dissect_lsalookupprivilegename_rqst,
3969                 lsa_dissect_lsalookupprivilegename_reply },
3970         { LSA_LSALOOKUPPRIVILEGEDISPLAYNAME, "LookupPrivDispName",
3971                 lsa_dissect_lsalookupprivilegedisplayname_rqst,
3972                 lsa_dissect_lsalookupprivilegedisplayname_reply },
3973         { LSA_LSADELETEOBJECT, "DeleteObject",
3974                 lsa_dissect_lsadeleteobject_rqst,
3975                 lsa_dissect_lsadeleteobject_reply },
3976         { LSA_LSAENUMERATEACCOUNTSWITHUSERRIGHT, "EnumAccountsWithUserRight",
3977                 lsa_dissect_lsaenumerateaccountswithuserright_rqst,
3978                 lsa_dissect_lsaenumerateaccountswithuserright_reply },
3979         { LSA_LSAENUMERATEACCOUNTRIGHTS, "EnumAccountRights",
3980                 lsa_dissect_lsaenumerateaccountrights_rqst,
3981                 lsa_dissect_lsaenumerateaccountrights_reply },
3982         { LSA_LSAADDACCOUNTRIGHTS, "AddAccountRights",
3983                 lsa_dissect_lsaaddaccountrights_rqst,
3984                 lsa_dissect_lsaaddaccountrights_reply },
3985         { LSA_LSAREMOVEACCOUNTRIGHTS, "RemoveAccountRights",
3986                 lsa_dissect_lsaremoveaccountrights_rqst,
3987                 lsa_dissect_lsaremoveaccountrights_reply },
3988         { LSA_LSAQUERYTRUSTEDDOMAININFO, "QueryTrustedDomainInfo",
3989                 lsa_dissect_lsaquerytrusteddomaininfo_rqst,
3990                 lsa_dissect_lsaquerytrusteddomaininfo_reply },
3991         { LSA_LSASETTRUSTEDDOMAININFO, "SetTrustedDomainInfo",
3992                 lsa_dissect_lsasettrusteddomaininfo_rqst,
3993                 lsa_dissect_lsasettrusteddomaininfo_reply },
3994         { LSA_LSADELETETRUSTEDDOMAIN, "DeleteTrsutedDomain",
3995                 lsa_dissect_lsadeletetrusteddomain_rqst,
3996                 lsa_dissect_lsadeletetrusteddomain_reply },
3997         { LSA_LSASTOREPRIVATEDATA, "StorePrivateData",
3998                 lsa_dissect_lsastoreprivatedata_rqst,
3999                 lsa_dissect_lsastoreprivatedata_reply },
4000         { LSA_LSARETRIEVEPRIVATEDATA, "RetrievePrivateData",
4001                 lsa_dissect_lsaretrieveprivatedata_rqst,
4002                 lsa_dissect_lsaretrieveprivatedata_reply },
4003         { LSA_LSAOPENPOLICY2, "OpenPolicy2",
4004                 lsa_dissect_lsaopenpolicy2_rqst,
4005                 lsa_dissect_lsaopenpolicy2_reply },
4006         { LSA_LSAGETUSERNAME, "GetUsername",
4007                 lsa_dissect_lsagetusername_rqst,
4008                 lsa_dissect_lsagetusername_reply },
4009         { LSA_LSAQUERYINFORMATIONPOLICY2, "QueryInformationPolicy2",
4010                 lsa_dissect_lsaqueryinformationpolicy2_rqst,
4011                 lsa_dissect_lsaqueryinformationpolicy2_reply },
4012         { LSA_LSASETINFORMATIONPOLICY2, "SetInformationPolicy2",
4013                 lsa_dissect_lsasetinformationpolicy2_rqst,
4014                 lsa_dissect_lsasetinformationpolicy2_reply },
4015         { LSA_LSAQUERYTRUSTEDDOMAININFOBYNAME, "QueryTrustedDomainInfoByName",
4016                 lsa_dissect_lsaquerytrusteddomaininfobyname_rqst,
4017                 lsa_dissect_lsaquerytrusteddomaininfobyname_reply },
4018         { LSA_LSASETTRUSTEDDOMAININFOBYNAME, "SetTrustedDomainInfoByName",
4019                 lsa_dissect_lsasettrusteddomaininfobyname_rqst,
4020                 lsa_dissect_lsasettrusteddomaininfobyname_reply },
4021         { LSA_LSAENUMERATETRUSTEDDOMAINSEX, "EnumTrustedDomainsEx",
4022                 lsa_dissect_lsaenumeratetrusteddomainsex_rqst,
4023                 lsa_dissect_lsaenumeratetrusteddomainsex_reply },
4024         { LSA_LSACREATETRUSTEDDOMAINEX, "CreateTrustedDomainEx",
4025                 lsa_dissect_lsacreatetrusteddomainex_rqst,
4026                 lsa_dissect_lsacreatetrusteddomainex_reply },
4027         { LSA_LSACLOSETRUSTEDDOMAINEX, "CloseTrustedDomainEx",
4028                 lsa_dissect_lsaclosetrusteddomainex_rqst,
4029                 lsa_dissect_lsaclosetrusteddomainex_reply },
4030         { LSA_LSAQUERYDOMAININFORMATIONPOLICY, "QueryDomainInfoPolicy",
4031                 lsa_dissect_lsaquerydomaininformationpolicy_rqst,
4032                 lsa_dissect_lsaquerydomaininformationpolicy_reply },
4033         { LSA_LSASETDOMAININFORMATIONPOLICY, "SetDomainInfoPolicy",
4034                 lsa_dissect_lsasetdomaininformationpolicy_rqst,
4035                 lsa_dissect_lsasetdomaininformationpolicy_reply },
4036         { LSA_LSAOPENTRUSTEDDOMAINBYNAME, "OpenTrustedDomainByName",
4037                 lsa_dissect_lsaopentrusteddomainbyname_rqst,
4038                 lsa_dissect_lsaopentrusteddomainbyname_reply },
4039         { LSA_LSAFUNCTION_38, "LSAFUNCTION_38",
4040                 lsa_dissect_lsafunction_38_rqst,
4041                 lsa_dissect_lsafunction_38_reply },
4042         { LSA_LSALOOKUPSIDS2, "LookupSIDs2",
4043                 lsa_dissect_lsalookupsids2_rqst,
4044                 lsa_dissect_lsalookupsids2_reply },
4045         { LSA_LSALOOKUPNAMES2, "LookupNames2",
4046                 lsa_dissect_lsalookupnames2_rqst,
4047                 lsa_dissect_lsalookupnames2_reply },
4048         { LSA_LSAFUNCTION_3B, "LSAFUNCTION_3B",
4049                 lsa_dissect_lsafunction_3b_rqst,
4050                 lsa_dissect_lsafunction_3b_reply },
4051         {0, NULL, NULL, NULL}
4052 };
4053
4054 static const value_string lsa_opnum_vals[] = {
4055         { LSA_LSACLOSE, "Close" },
4056         { LSA_LSADELETE, "Delete" },
4057         { LSA_LSAENUMERATEPRIVILEGES, "EnumPrivs" },
4058         { LSA_LSAQUERYSECURITYOBJECT, "QuerySecObject" },
4059         { LSA_LSASETSECURITYOBJECT, "SetSecObject" },
4060         { LSA_LSACHANGEPASSWORD, "ChangePassword" },
4061         { LSA_LSAOPENPOLICY, "OpenPolicy" },
4062         { LSA_LSAQUERYINFORMATIONPOLICY, "QueryInfoPolicy" },
4063         { LSA_LSASETINFORMATIONPOLICY, "SetInfoPolicy" },
4064         { LSA_LSACLEARAUDITLOG, "ClearAuditLog" },
4065         { LSA_LSACREATEACCOUNT, "CreateAccount" },
4066         { LSA_LSAENUMERATEACCOUNTS, "EnumAccounts" },
4067         { LSA_LSACREATETRUSTEDDOMAIN, "CreateTrustedDomain" },
4068         { LSA_LSAENUMERATETRUSTEDDOMAINS, "EnumTrustedDomains" },
4069         { LSA_LSALOOKUPNAMES, "LookupNames" },
4070         { LSA_LSALOOKUPSIDS, "LookupSIDs" },
4071         { LSA_LSACREATESECRET, "CreateSecret" },
4072         { LSA_LSAOPENACCOUNT, "OpenAccount" },
4073         { LSA_LSAENUMERATEPRIVILEGESACCOUNT, "EnumPrivsAccount" },
4074         { LSA_LSAADDPRIVILEGESTOACCOUNT, "AddPrivsToAccount" },
4075         { LSA_LSAREMOVEPRIVILEGESFROMACCOUNT, "MovePrivsFromAccount" },
4076         { LSA_LSAGETQUOTASFORACCOUNT, "GetQuotasForAccount" },
4077         { LSA_LSASETQUOTASFORACCOUNT, "SetQuotasForAccount" },
4078         { LSA_LSAGETSYSTEMACCESSACCOUNT, "GetSystemAccessAccount" },
4079         { LSA_LSASETSYSTEMACCESSACCOUNT, "SetSystemAccessAccount" },
4080         { LSA_LSAOPENTRUSTEDDOMAIN, "OpenTrustedDomain" },
4081         { LSA_LSAQUERYINFOTRUSTEDDOMAIN, "QueryInfoTrustedDomain" },
4082         { LSA_LSASETINFORMATIONTRUSTEDDOMAIN, "SetInfoTrustedDomain" },
4083         { LSA_LSAOPENSECRET, "OpenSecret" },
4084         { LSA_LSASETSECRET, "SetSecret" },
4085         { LSA_LSAQUERYSECRET, "QuerySecret" },
4086         { LSA_LSALOOKUPPRIVILEGEVALUE, "LookupPrivValue" },
4087         { LSA_LSALOOKUPPRIVILEGENAME, "LookupPrivName" },
4088         { LSA_LSALOOKUPPRIVILEGEDISPLAYNAME, "LookupPrivDispName" },
4089         { LSA_LSADELETEOBJECT, "DeleteObject" },
4090         { LSA_LSAENUMERATEACCOUNTSWITHUSERRIGHT, "EnumAccountsWithUserRight" },
4091         { LSA_LSAENUMERATEACCOUNTRIGHTS, "EnumAccountRights" },
4092         { LSA_LSAADDACCOUNTRIGHTS, "AddAccountRights" },
4093         { LSA_LSAREMOVEACCOUNTRIGHTS, "RemoveAccountRights" },
4094         { LSA_LSAQUERYTRUSTEDDOMAININFO, "QueryTrustedDomainInfo" },
4095         { LSA_LSASETTRUSTEDDOMAININFO, "SetTrustedDomainInfo" },
4096         { LSA_LSADELETETRUSTEDDOMAIN, "DeleteTrsutedDomain" },
4097         { LSA_LSASTOREPRIVATEDATA, "StorePrivateData" },
4098         { LSA_LSARETRIEVEPRIVATEDATA, "RetrievePrivateData" },
4099         { LSA_LSAOPENPOLICY2, "OpenPolicy2" },
4100         { LSA_LSAGETUSERNAME, "GetUsername" },
4101         { LSA_LSAQUERYINFORMATIONPOLICY2, "QueryInformationPolicy2" },
4102         { LSA_LSASETINFORMATIONPOLICY2, "SetInformationPolicy2" },
4103         { LSA_LSAQUERYTRUSTEDDOMAININFOBYNAME, "QueryTrustedDomainInfoByName" },
4104         { LSA_LSASETTRUSTEDDOMAININFOBYNAME, "SetTrustedDomainInfoByName" },
4105         { LSA_LSAENUMERATETRUSTEDDOMAINSEX, "EnumTrustedDomainsEx" },
4106         { LSA_LSACREATETRUSTEDDOMAINEX, "CreateTrustedDomainEx" },
4107         { LSA_LSACLOSETRUSTEDDOMAINEX, "CloseTrustedDomainEx" },
4108         { LSA_LSAQUERYDOMAININFORMATIONPOLICY, "QueryDomainInfoPolicy" },
4109         { LSA_LSASETDOMAININFORMATIONPOLICY, "SetDomainInfoPolicy" },
4110         { LSA_LSAOPENTRUSTEDDOMAINBYNAME, "OpenTrustedDomainByName" },
4111         { LSA_LSAFUNCTION_38, "LSAFUNCTION_38" },
4112         { LSA_LSALOOKUPSIDS2, "LookupSIDs2" },
4113         { LSA_LSALOOKUPNAMES2, "LookupNames2" },
4114         { LSA_LSAFUNCTION_3B, "LSAFUNCTION_3B" },
4115         { 0, NULL }
4116 };
4117
4118 void
4119 proto_register_dcerpc_lsa(void)
4120 {
4121         static hf_register_info hf[] = {
4122
4123         { &hf_lsa_opnum,
4124           { "Operation", "lsa.opnum", FT_UINT16, BASE_DEC,
4125             VALS(lsa_opnum_vals), 0x0, "Operation", HFILL }},
4126
4127         { &hf_lsa_unknown_string,
4128                 { "Unknown string", "lsa.unknown_string", FT_STRING, BASE_NONE,
4129                 NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
4130
4131         { &hf_lsa_hnd,
4132                 { "Context Handle", "lsa.hnd", FT_BYTES, BASE_NONE,
4133                 NULL, 0x0, "LSA policy handle", HFILL }},
4134
4135         { &hf_lsa_server,
4136                 { "Server", "lsa.server", FT_STRING, BASE_NONE,
4137                 NULL, 0, "Name of Server", HFILL }},
4138
4139         { &hf_lsa_controller,
4140                 { "Controller", "lsa.controller", FT_STRING, BASE_NONE,
4141                 NULL, 0, "Name of Domain Controller", HFILL }},
4142
4143         { &hf_lsa_unknown_hyper,
4144                 { "Unknown hyper", "lsa.unknown.hyper", FT_UINT64, BASE_HEX,
4145                 NULL, 0x0, "Unknown hyper. If you know what this is, contact ethereal developers.", HFILL }},
4146
4147         { &hf_lsa_unknown_long,
4148                 { "Unknown long", "lsa.unknown.long", FT_UINT32, BASE_HEX,
4149                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
4150
4151         { &hf_lsa_unknown_short,
4152                 { "Unknown short", "lsa.unknown.short", FT_UINT16, BASE_HEX,
4153                 NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
4154
4155         { &hf_lsa_unknown_char,
4156                 { "Unknown char", "lsa.unknown.char", FT_UINT8, BASE_HEX,
4157                 NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
4158
4159         { &hf_lsa_rc,
4160                 { "Return code", "lsa.rc", FT_UINT32, BASE_HEX,
4161                 VALS (NT_errors), 0x0, "LSA return status code", HFILL }},
4162
4163         { &hf_lsa_obj_attr,
4164                 { "Attributes", "lsa.obj_attr", FT_UINT32, BASE_HEX,
4165                 NULL, 0x0, "LSA Attributes", HFILL }},
4166
4167         { &hf_lsa_obj_attr_len,
4168                 { "Length", "lsa.obj_attr.len", FT_UINT32, BASE_DEC,
4169                 NULL, 0x0, "Length of object attribute structure", HFILL }},
4170
4171         { &hf_lsa_obj_attr_name,
4172                 { "Name", "lsa.obj_attr.name", FT_STRING, BASE_NONE,
4173                 NULL, 0x0, "Name of object attribute", HFILL }},
4174
4175         { &hf_lsa_access_mask,
4176                 { "Access Mask", "lsa.access_mask", FT_UINT32, BASE_HEX,
4177                 NULL, 0x0, "LSA Access Mask", HFILL }},
4178
4179         { &hf_lsa_info_level,
4180                 { "Level", "lsa.info.level", FT_UINT16, BASE_DEC,
4181                 NULL, 0x0, "Information level of requested data", HFILL }},
4182
4183         { &hf_lsa_trusted_info_level,
4184                 { "Info Level", "lsa.trusted.info_level", FT_UINT16, BASE_DEC,
4185                 VALS(trusted_info_level_vals), 0x0, "Information level of requested Trusted Domain Information", HFILL }},
4186
4187         { &hf_lsa_sd_size,
4188                 { "Size", "lsa.sd_size", FT_UINT32, BASE_DEC,
4189                 NULL, 0x0, "Size of lsa security descriptor", HFILL }},
4190
4191         { &hf_lsa_qos_len,
4192                 { "Length", "lsa.qos.len", FT_UINT32, BASE_DEC,
4193                 NULL, 0x0, "Length of quality of service structure", HFILL }},
4194
4195         { &hf_lsa_qos_impersonation_level,
4196                 { "Impersonation level", "lsa.qos.imp_lev", FT_UINT16, BASE_DEC,
4197                 VALS(lsa_impersonation_level_vals), 0x0, "QOS Impersonation Level", HFILL }},
4198
4199         { &hf_lsa_qos_track_context,
4200                 { "Context Tracking", "lsa.qos.track_ctx", FT_UINT8, BASE_DEC,
4201                 NULL, 0x0, "QOS Context Tracking Mode", HFILL }},
4202
4203         { &hf_lsa_qos_effective_only,
4204                 { "Effective only", "lsa.qos.effective_only", FT_UINT8, BASE_DEC,
4205                 NULL, 0x0, "QOS Flag whether this is Effective Only or not", HFILL }},
4206
4207         { &hf_lsa_pali_percent_full,
4208                 { "Percent Full", "lsa.pali.percent_full", FT_UINT32, BASE_DEC,
4209                 NULL, 0x0, "How full audit log is in percentage", HFILL }},
4210
4211         { &hf_lsa_pali_log_size,
4212                 { "Log Size", "lsa.pali.log_size", FT_UINT32, BASE_DEC,
4213                 NULL, 0x0, "Size of audit log", HFILL }},
4214
4215         { &hf_lsa_pali_retention_period,
4216                 { "Retention Period", "lsa.pali.retention_period", FT_RELATIVE_TIME, BASE_NONE,
4217                 NULL, 0x0, "", HFILL }},
4218
4219         { &hf_lsa_pali_time_to_shutdown,
4220                 { "Time to shutdown", "lsa.pali.time_to_shutdown", FT_RELATIVE_TIME, BASE_NONE,
4221                 NULL, 0x0, "Time to shutdown", HFILL }},
4222
4223         { &hf_lsa_pali_shutdown_in_progress,
4224                 { "Shutdown in progress", "lsa.pali.shutdown_in_progress", FT_UINT8, BASE_DEC,
4225                 NULL, 0x0, "Flag whether shutdown is in progress or not", HFILL }},
4226
4227         { &hf_lsa_pali_next_audit_record,
4228                 { "Next Audit Record", "lsa.pali.next_audit_record", FT_UINT32, BASE_HEX,
4229                 NULL, 0x0, "Next audit record", HFILL }},
4230
4231         { &hf_lsa_paei_enabled,
4232                 { "Enabled", "lsa.paei.enabled", FT_UINT8, BASE_DEC,
4233                 NULL, 0x0, "If Audit Events Information is Enabled or not", HFILL }},
4234
4235         { &hf_lsa_paei_settings,
4236                 { "Settings", "lsa.paei.settings", FT_UINT32, BASE_HEX,
4237                 NULL, 0x0, "Audit Events Information settings", HFILL }},
4238
4239         { &hf_lsa_count,
4240                 { "Count", "lsa.count", FT_UINT32, BASE_DEC,
4241                 NULL, 0x0, "Count of objects", HFILL }},
4242
4243         { &hf_lsa_max_count,
4244                 { "Max Count", "lsa.max_count", FT_UINT32, BASE_DEC,
4245                 NULL, 0x0, "", HFILL }},
4246
4247         { &hf_lsa_domain,
4248                 { "Domain", "lsa.domain", FT_STRING, BASE_NONE,
4249                 NULL, 0x0, "Domain", HFILL }},
4250
4251         { &hf_lsa_domain_sid,
4252                 { "Domain SID", "lsa.domain_sid", FT_STRING, BASE_NONE,
4253                 NULL, 0x0, "The Domain SID", HFILL }},
4254
4255         { &hf_lsa_acct,
4256                 { "Account", "lsa.acct", FT_STRING, BASE_NONE,
4257                 NULL, 0x0, "Account", HFILL }},
4258
4259         { &hf_lsa_source,
4260                 { "Source", "lsa.source", FT_STRING, BASE_NONE,
4261                 NULL, 0x0, "Replica Source", HFILL }},
4262
4263         { &hf_lsa_server_role,
4264                 { "Role", "lsa.server_role", FT_UINT16, BASE_DEC,
4265                 VALS(server_role_vals), 0x0, "LSA Server Role", HFILL }},
4266
4267         { &hf_lsa_quota_paged_pool,
4268                 { "Paged Pool", "lsa.quota.paged_pool", FT_UINT32, BASE_DEC,
4269                 NULL, 0x0, "Size of Quota Paged Pool", HFILL }},
4270
4271         { &hf_lsa_quota_non_paged_pool,
4272                 { "Non Paged Pool", "lsa.quota.non_paged_pool", FT_UINT32, BASE_DEC,
4273                 NULL, 0x0, "Size of Quota non-Paged Pool", HFILL }},
4274
4275         { &hf_lsa_quota_min_wss,
4276                 { "Min WSS", "lsa.quota.min_wss", FT_UINT32, BASE_DEC,
4277                 NULL, 0x0, "Size of Quota Min WSS", HFILL }},
4278
4279         { &hf_lsa_quota_max_wss,
4280                 { "Max WSS", "lsa.quota.max_wss", FT_UINT32, BASE_DEC,
4281                 NULL, 0x0, "Size of Quota Max WSS", HFILL }},
4282
4283         { &hf_lsa_quota_pagefile,
4284                 { "Pagefile", "lsa.quota.pagefile", FT_UINT32, BASE_DEC,
4285                 NULL, 0x0, "Size of quota pagefile usage", HFILL }},
4286
4287         { &hf_lsa_mod_seq_no,
4288                 { "Seq No", "lsa.mod.seq_no", FT_UINT64, BASE_DEC,
4289                 NULL, 0x0, "Sequence number for this modification", HFILL }},
4290
4291         { &hf_lsa_mod_mtime,
4292                 { "MTime", "lsa.mod.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4293                 NULL, 0x0, "Time when this modification occured", HFILL }},
4294
4295         { &hf_lsa_cur_mtime,
4296                 { "Current MTime", "lsa.cur.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4297                 NULL, 0x0, "Current MTime to set", HFILL }},
4298
4299         { &hf_lsa_old_mtime,
4300                 { "Old MTime", "lsa.old.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4301                 NULL, 0x0, "Old MTime for this object", HFILL }},
4302
4303         { &hf_lsa_name,
4304                 { "Name", "lsa.name", FT_STRING, BASE_NONE,
4305                 NULL, 0x0, "", HFILL }},
4306
4307         { &hf_lsa_key,
4308                 { "Key", "lsa.key", FT_STRING, BASE_NONE,
4309                 NULL, 0x0, "", HFILL }},
4310
4311         { &hf_lsa_flat_name,
4312                 { "Flat Name", "lsa.flat_name", FT_STRING, BASE_NONE,
4313                 NULL, 0x0, "", HFILL }},
4314
4315         { &hf_lsa_forest,
4316                 { "Forest", "lsa.forest", FT_STRING, BASE_NONE,
4317                 NULL, 0x0, "", HFILL }},
4318
4319         { &hf_lsa_info_type,
4320                 { "Info Type", "lsa.info_type", FT_UINT32, BASE_DEC,
4321                 NULL, 0x0, "", HFILL }},
4322
4323         { &hf_lsa_new_pwd,
4324                 { "New Password", "lsa.new_pwd", FT_BYTES, BASE_HEX,
4325                 NULL, 0x0, "New password", HFILL }},
4326
4327         { &hf_lsa_old_pwd,
4328                 { "Old Password", "lsa.old_pwd", FT_BYTES, BASE_HEX,
4329                 NULL, 0x0, "Old password", HFILL }},
4330
4331         { &hf_lsa_sid_type,
4332                 { "SID Type", "lsa.sid_type", FT_UINT16, BASE_DEC,
4333                 VALS(sid_type_vals), 0x0, "Type of SID", HFILL }},
4334
4335         { &hf_lsa_rid,
4336                 { "RID", "lsa.rid", FT_UINT32, BASE_HEX,
4337                 NULL, 0x0, "RID", HFILL }},
4338
4339         { &hf_lsa_rid_offset,
4340                 { "RID Offset", "lsa.rid.offset", FT_UINT32, BASE_HEX,
4341                 NULL, 0x0, "RID Offset", HFILL }},
4342
4343         { &hf_lsa_index,
4344                 { "Index", "lsa.index", FT_UINT32, BASE_DEC,
4345                 NULL, 0x0, "", HFILL }},
4346
4347         { &hf_lsa_num_mapped,
4348                 { "Num Mapped", "lsa.num_mapped", FT_UINT32, BASE_DEC,
4349                 NULL, 0x0, "", HFILL }},
4350
4351         { &hf_lsa_policy_information_class,
4352                 { "Info Class", "lsa.policy.info", FT_UINT16, BASE_DEC,
4353                 VALS(policy_information_class_vals), 0x0, "Policy information class", HFILL }},
4354
4355         { &hf_lsa_secret,
4356                 { "LSA Secret", "lsa.secret", FT_BYTES, BASE_HEX,
4357                 NULL, 0, "", HFILL }},
4358
4359         { &hf_lsa_auth_blob,
4360                 { "Auth blob", "lsa.auth.blob", FT_BYTES, BASE_HEX,
4361                 NULL, 0, "", HFILL }},
4362
4363         { &hf_nt_luid_high,
4364                 { "High", "nt.luid.high", FT_UINT32, BASE_HEX,
4365                 NULL, 0x0, "LUID High component", HFILL }},
4366
4367         { &hf_nt_luid_low,
4368                 { "Low", "nt.luid.low", FT_UINT32, BASE_HEX,
4369                 NULL, 0x0, "LUID Low component", HFILL }},
4370
4371         { &hf_lsa_size,
4372                 { "Size", "lsa.size", FT_UINT32, BASE_DEC,
4373                 NULL, 0x0, "", HFILL }},
4374
4375         { &hf_lsa_size16,
4376                 { "Size", "lsa.size", FT_UINT16, BASE_DEC,
4377                 NULL, 0x0, "", HFILL }},
4378
4379         { &hf_lsa_size_needed,
4380                 { "Size Needed", "lsa.size_needed", FT_UINT16, BASE_DEC,
4381                 NULL, 0x0, "", HFILL }},
4382
4383         { &hf_lsa_privilege_name,
4384                 { "Name", "lsa.privilege.name", FT_STRING, BASE_NONE,
4385                 NULL, 0x0, "LSA Privilege Name", HFILL }},
4386
4387         { &hf_lsa_rights,
4388                 { "Rights", "lsa.rights", FT_STRING, BASE_NONE,
4389                 NULL, 0x0, "Account Rights", HFILL }},
4390
4391         { &hf_lsa_attr,
4392                 { "Attr", "lsa.attr", FT_UINT64, BASE_HEX,
4393                 NULL, 0x0, "LSA Attributes", HFILL }},
4394
4395         { &hf_lsa_auth_update,
4396                 { "Update", "lsa.auth.update", FT_UINT64, BASE_HEX,
4397                 NULL, 0x0, "LSA Auth Info update", HFILL }},
4398
4399         { &hf_lsa_resume_handle,
4400                 { "Resume Handle", "lsa.resume_handle", FT_UINT32, BASE_DEC,
4401                 NULL, 0x0, "Resume Handle", HFILL }},
4402
4403         { &hf_lsa_trust_direction,
4404                 { "Trust Direction", "lsa.trust.direction", FT_UINT32, BASE_DEC,
4405                 VALS(trusted_direction_vals), 0x0, "Trust direction", HFILL }},
4406
4407         { &hf_lsa_trust_type,
4408                 { "Trust Type", "lsa.trust.type", FT_UINT32, BASE_DEC,
4409                 VALS(trusted_type_vals), 0x0, "Trust type", HFILL }},
4410
4411         { &hf_lsa_trust_attr,
4412                 { "Trust Attr", "lsa.trust.attr", FT_UINT32, BASE_HEX,
4413                 NULL, 0x0, "Trust attributes", HFILL }},
4414
4415         { &hf_lsa_trust_attr_non_trans,
4416                 { "Non Transitive", "lsa.trust.attr.non_trans", FT_BOOLEAN, 32,
4417                 TFS(&tfs_trust_attr_non_trans), 0x00000001, "Non Transitive trust", HFILL }},
4418
4419         { &hf_lsa_trust_attr_uplevel_only,
4420                 { "Upleve only", "lsa.trust.attr.uplevel_only", FT_BOOLEAN, 32,
4421                 TFS(&tfs_trust_attr_uplevel_only), 0x00000002, "Uplevel only trust", HFILL }},
4422
4423         { &hf_lsa_trust_attr_tree_parent,
4424                 { "Tree Parent", "lsa.trust.attr.tree_parent", FT_BOOLEAN, 32,
4425                 TFS(&tfs_trust_attr_tree_parent), 0x00400000, "Tree Parent trust", HFILL }},
4426
4427         { &hf_lsa_trust_attr_tree_root,
4428                 { "Tree Root", "lsa.trust.attr.tree_root", FT_BOOLEAN, 32,
4429                 TFS(&tfs_trust_attr_tree_root), 0x00800000, "Tree Root trust", HFILL }},
4430
4431         { &hf_lsa_auth_type,
4432                 { "Auth Type", "lsa.auth.type", FT_UINT32, BASE_DEC,
4433                 NULL, 0x0, "Auth Info type", HFILL }},
4434
4435         { &hf_lsa_auth_len,
4436                 { "Auth Len", "lsa.auth.len", FT_UINT32, BASE_DEC,
4437                 NULL, 0x0, "Auth Info len", HFILL }},
4438
4439         { &hf_lsa_remove_all,
4440                 { "Remove All", "lsa.remove_all", FT_UINT8, BASE_DEC,
4441                 NULL, 0x0, "Flag whether all rights should be removed or only the specified ones", HFILL }},
4442
4443         { &hf_view_local_info,
4444                 { "View local info", "lsa.access_mask.view_local_info",
4445                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_VIEW_LOCAL_INFORMATION,
4446                   "View local info", HFILL }},
4447
4448         { &hf_view_audit_info,
4449                 { "View audit info", "lsa.access_mask.view_audit_info",
4450                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_VIEW_AUDIT_INFORMATION,
4451                   "View audit info", HFILL }},
4452
4453         { &hf_get_private_info,
4454                 { "Get private info", "lsa.access_mask.get_privateinfo",
4455                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_GET_PRIVATE_INFORMATION,
4456                   "Get private info", HFILL }},
4457
4458         { &hf_trust_admin,
4459                 { "Trust admin", "lsa.access_mask.trust_admin",
4460                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_TRUST_ADMIN,
4461                   "Trust admin", HFILL }},
4462
4463         { &hf_create_account,
4464                 { "Create account", "lsa.access_mask.create_account",
4465                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_ACCOUNT,
4466                   "Create account", HFILL }},
4467
4468         { &hf_create_secret,
4469                 { "Create secret", "lsa.access_mask.create_secret",
4470                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_SECRET,
4471                   "Create secret", HFILL }},
4472
4473         { &hf_create_priv,
4474                 { "Create privilege", "lsa.access_mask.create_priv",
4475                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_PRIVILEGE,
4476                   "Create privilege", HFILL }},
4477
4478         { &hf_set_default_quota_limits,
4479                 { "Set default quota limits", "lsa.access_mask.set_default_quota_limits",
4480                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SET_DEFAULT_QUOTA_LIMITS,
4481                   "Set default quota limits", HFILL }},
4482
4483         { &hf_set_audit_requirements,
4484                 { "Set audit requirements", "lsa.access_mask.set_audit_requirements",
4485                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SET_AUDIT_REQUIREMENTS,
4486                   "Set audit requirements", HFILL }},
4487
4488         { &hf_server_admin,
4489                 { "Server admin", "lsa.access_mask.server_admin",
4490                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SERVER_ADMIN,
4491                   "Server admin", HFILL }},
4492
4493         { &hf_lookup_names,
4494                 { "Lookup names", "lsa.access_mask.lookup_names",
4495                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_LOOKUP_NAMES,
4496                   "Lookup names", HFILL }}
4497 };
4498
4499         static gint *ett[] = {
4500                 &ett_dcerpc_lsa,
4501                 &ett_lsa_OBJECT_ATTRIBUTES,
4502                 &ett_LSA_SECURITY_DESCRIPTOR,
4503                 &ett_lsa_policy_info,
4504                 &ett_lsa_policy_audit_log_info,
4505                 &ett_lsa_policy_audit_events_info,
4506                 &ett_lsa_policy_primary_domain_info,
4507                 &ett_lsa_policy_primary_account_info,
4508                 &ett_lsa_policy_server_role_info,
4509                 &ett_lsa_policy_replica_source_info,
4510                 &ett_lsa_policy_default_quota_info,
4511                 &ett_lsa_policy_modification_info,
4512                 &ett_lsa_policy_audit_full_set_info,
4513                 &ett_lsa_policy_audit_full_query_info,
4514                 &ett_lsa_policy_dns_domain_info,
4515                 &ett_lsa_translated_names,
4516                 &ett_lsa_translated_name,
4517                 &ett_lsa_referenced_domain_list,
4518                 &ett_lsa_trust_information,
4519                 &ett_lsa_trust_information_ex,
4520                 &ett_LUID,
4521                 &ett_LSA_PRIVILEGES,
4522                 &ett_LSA_PRIVILEGE,
4523                 &ett_LSA_LUID_AND_ATTRIBUTES_ARRAY,
4524                 &ett_LSA_LUID_AND_ATTRIBUTES,
4525                 &ett_LSA_TRUSTED_DOMAIN_LIST,
4526                 &ett_LSA_TRUSTED_DOMAIN,
4527                 &ett_LSA_TRANSLATED_SIDS,
4528                 &ett_lsa_trusted_domain_info,
4529                 &ett_lsa_trust_attr,
4530                 &ett_lsa_trusted_domain_auth_information,
4531                 &ett_lsa_auth_information
4532         };
4533
4534         proto_dcerpc_lsa = proto_register_protocol(
4535                 "Microsoft Local Security Architecture", "LSA", "lsa");
4536
4537         proto_register_field_array (proto_dcerpc_lsa, hf, array_length (hf));
4538         proto_register_subtree_array(ett, array_length(ett));
4539 }
4540
4541 /* Protocol handoff */
4542
4543 static e_uuid_t uuid_dcerpc_lsa = {
4544         0x12345778, 0x1234, 0xabcd,
4545         { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab}
4546 };
4547
4548 static guint16 ver_dcerpc_lsa = 0;
4549
4550 void
4551 proto_reg_handoff_dcerpc_lsa(void)
4552 {
4553         /* Register protocol as dcerpc */
4554
4555         dcerpc_init_uuid(proto_dcerpc_lsa, ett_dcerpc_lsa, &uuid_dcerpc_lsa,
4556                          ver_dcerpc_lsa, dcerpc_lsa_dissectors, hf_lsa_opnum);
4557 }