packet-dcerpc-lsa.c

   1 /* packet-dcerpc-lsa.c
   2  * Routines for SMB \PIPE\lsarpc packet disassembly
   3  * Copyright 2001,2003 Tim Potter <tpot@samba.org>
   4  *  2002  Added LSA command dissectors  Ronnie Sahlberg
   5  *
   6  * $Id: packet-dcerpc-lsa.c,v 1.79 2003/05/21 10:06:29 sahlberg Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <string.h>
  33
  34 #include <epan/packet.h>
  35 #include "packet-dcerpc.h"
  36 #include "packet-dcerpc-nt.h"
  37 #include "packet-dcerpc-lsa.h"
  38 #include "packet-smb-common.h"
  39 #include "smb.h"
  40
  41 static int proto_dcerpc_lsa = -1;
  42
  43 static int hf_lsa_opnum = -1;
  44 static int hf_lsa_rc = -1;
  45 static int hf_lsa_hnd = -1;
  46 static int hf_lsa_server = -1;
  47 static int hf_lsa_controller = -1;
  48 static int hf_lsa_obj_attr = -1;
  49 static int hf_lsa_obj_attr_len = -1;
  50 static int hf_lsa_obj_attr_name = -1;
  51 static int hf_lsa_access_mask = -1;
  52 static int hf_lsa_info_level = -1;
  53 static int hf_lsa_trusted_info_level = -1;
  54 static int hf_lsa_sd_size = -1;
  55 static int hf_lsa_qos_len = -1;
  56 static int hf_lsa_qos_impersonation_level = -1;
  57 static int hf_lsa_qos_track_context = -1;
  58 static int hf_lsa_qos_effective_only = -1;
  59 static int hf_lsa_pali_percent_full = -1;
  60 static int hf_lsa_pali_log_size = -1;
  61 static int hf_lsa_pali_retention_period = -1;
  62 static int hf_lsa_pali_time_to_shutdown = -1;
  63 static int hf_lsa_pali_shutdown_in_progress = -1;
  64 static int hf_lsa_pali_next_audit_record = -1;
  65 static int hf_lsa_paei_enabled = -1;
  66 static int hf_lsa_paei_settings = -1;
  67 static int hf_lsa_count = -1;
  68 static int hf_lsa_size = -1;
  69 static int hf_lsa_size16 = -1;
  70 static int hf_lsa_size_needed = -1;
  71 static int hf_lsa_max_count = -1;
  72 static int hf_lsa_index = -1;
  73 static int hf_lsa_domain = -1;
  74 static int hf_lsa_acct = -1;
  75 static int hf_lsa_server_role = -1;
  76 static int hf_lsa_source = -1;
  77 static int hf_lsa_quota_paged_pool = -1;
  78 static int hf_lsa_quota_non_paged_pool = -1;
  79 static int hf_lsa_quota_min_wss = -1;
  80 static int hf_lsa_quota_max_wss = -1;
  81 static int hf_lsa_quota_pagefile = -1;
  82 static int hf_lsa_mod_seq_no = -1;
  83 static int hf_lsa_mod_mtime = -1;
  84 static int hf_lsa_cur_mtime = -1;
  85 static int hf_lsa_old_mtime = -1;
  86 static int hf_lsa_name = -1;
  87 static int hf_lsa_key = -1;
  88 static int hf_lsa_flat_name = -1;
  89 static int hf_lsa_forest = -1;
  90 static int hf_lsa_info_type = -1;
  91 static int hf_lsa_old_pwd = -1;
  92 static int hf_lsa_new_pwd = -1;
  93 static int hf_lsa_sid_type = -1;
  94 static int hf_lsa_rid = -1;
  95 static int hf_lsa_rid_offset = -1;
  96 static int hf_lsa_num_mapped = -1;
  97 static int hf_lsa_policy_information_class = -1;
  98 static int hf_lsa_secret = -1;
  99 static int hf_nt_luid_high = -1;
 100 static int hf_nt_luid_low = -1;
 101 static int hf_lsa_privilege_name = -1;
 102 static int hf_lsa_attr = -1;
 103 static int hf_lsa_resume_handle = -1;
 104 static int hf_lsa_trust_direction = -1;
 105 static int hf_lsa_trust_type = -1;
 106 static int hf_lsa_trust_attr = -1;
 107 static int hf_lsa_trust_attr_non_trans = -1;
 108 static int hf_lsa_trust_attr_uplevel_only = -1;
 109 static int hf_lsa_trust_attr_tree_parent = -1;
 110 static int hf_lsa_trust_attr_tree_root = -1;
 111 static int hf_lsa_auth_update = -1;
 112 static int hf_lsa_auth_type = -1;
 113 static int hf_lsa_auth_len = -1;
 114 static int hf_lsa_auth_blob = -1;
 115 static int hf_lsa_rights = -1;
 116 static int hf_lsa_remove_all = -1;
 117
 118 static int hf_lsa_unknown_hyper = -1;
 119 static int hf_lsa_unknown_long = -1;
 120 static int hf_lsa_unknown_short = -1;
 121 static int hf_lsa_unknown_char = -1;
 122 static int hf_lsa_unknown_string = -1;
 123 #ifdef LSA_UNUSED_HANDLES
 124 static int hf_lsa_unknown_time = -1;
 125 #endif
 126
 127
 128 static gint ett_dcerpc_lsa = -1;
 129 static gint ett_lsa_OBJECT_ATTRIBUTES = -1;
 130 static gint ett_LSA_SECURITY_DESCRIPTOR = -1;
 131 static gint ett_lsa_policy_info = -1;
 132 static gint ett_lsa_policy_audit_log_info = -1;
 133 static gint ett_lsa_policy_audit_events_info = -1;
 134 static gint ett_lsa_policy_primary_domain_info = -1;
 135 static gint ett_lsa_policy_primary_account_info = -1;
 136 static gint ett_lsa_policy_server_role_info = -1;
 137 static gint ett_lsa_policy_replica_source_info = -1;
 138 static gint ett_lsa_policy_default_quota_info = -1;
 139 static gint ett_lsa_policy_modification_info = -1;
 140 static gint ett_lsa_policy_audit_full_set_info = -1;
 141 static gint ett_lsa_policy_audit_full_query_info = -1;
 142 static gint ett_lsa_policy_dns_domain_info = -1;
 143 static gint ett_lsa_translated_names = -1;
 144 static gint ett_lsa_translated_name = -1;
 145 static gint ett_lsa_referenced_domain_list = -1;
 146 static gint ett_lsa_trust_information = -1;
 147 static gint ett_lsa_trust_information_ex = -1;
 148 static gint ett_LUID = -1;
 149 static gint ett_LSA_PRIVILEGES = -1;
 150 static gint ett_LSA_PRIVILEGE = -1;
 151 static gint ett_LSA_LUID_AND_ATTRIBUTES_ARRAY = -1;
 152 static gint ett_LSA_LUID_AND_ATTRIBUTES = -1;
 153 static gint ett_LSA_TRUSTED_DOMAIN_LIST = -1;
 154 static gint ett_LSA_TRUSTED_DOMAIN = -1;
 155 static gint ett_LSA_TRANSLATED_SIDS = -1;
 156 static gint ett_lsa_trusted_domain_info = -1;
 157 static gint ett_lsa_trust_attr = -1;
 158 static gint ett_lsa_trusted_domain_auth_information = -1;
 159 static gint ett_lsa_auth_information = -1;
 160
 161
 162 static int
 163 lsa_dissect_pointer_NTTIME(tvbuff_t *tvb, int offset,
 164                              packet_info *pinfo, proto_tree *tree,
 165                              char *drep)
 166 {
 167         dcerpc_info *di;
 168
 169         di=pinfo->private_data;
 170         if(di->conformant_run){
 171                 /*just a run to handle conformant arrays, nothing to dissect */
 172                 return offset;
 173         }
 174
 175         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 176                 di->hf_index);
 177
 178         return offset;
 179 }
 180
 181 static int
 182 lsa_dissect_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
 183                              packet_info *pinfo, proto_tree *tree,
 184                              char *drep)
 185 {
 186         dcerpc_info *di;
 187
 188         di=pinfo->private_data;
 189         if(di->conformant_run){
 190                 /*just a run to handle conformant arrays, nothing to dissect */
 191                 return offset;
 192         }
 193
 194         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 195                         di->hf_index, 0);
 196         return offset;
 197 }
 198
 199 static int
 200 lsa_dissect_pointer_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
 201                              packet_info *pinfo, proto_tree *tree,
 202                              char *drep)
 203 {
 204         dcerpc_info *di;
 205
 206         di=pinfo->private_data;
 207         if(di->conformant_run){
 208                 /*just a run to handle conformant arrays, nothing to dissect */
 209                 return offset;
 210         }
 211
 212         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 213                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
 214                 "DOMAIN pointer: ", di->hf_index);
 215
 216         return offset;
 217 }
 218
 219 static int
 220 lsa_dissect_pointer_STRING(tvbuff_t *tvb, int offset,
 221                              packet_info *pinfo, proto_tree *tree,
 222                              char *drep)
 223 {
 224         dcerpc_info *di;
 225
 226         di=pinfo->private_data;
 227         if(di->conformant_run){
 228                 /*just a run to handle conformant arrays, nothing to dissect */
 229                 return offset;
 230         }
 231
 232         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 233                         di->hf_index, 0);
 234         return offset;
 235 }
 236
 237
 238 static int
 239 lsa_dissect_LSA_SECRET_data(tvbuff_t *tvb, int offset,
 240                              packet_info *pinfo, proto_tree *tree,
 241                              char *drep)
 242 {
 243         guint32 len;
 244         dcerpc_info *di;
 245
 246         di=pinfo->private_data;
 247         if(di->conformant_run){
 248                 /*just a run to handle conformant arrays, nothing to dissect */
 249                 return offset;
 250         }
 251
 252         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 253                                      hf_lsa_sd_size, &len);
 254         proto_tree_add_item(tree, hf_lsa_secret, tvb, offset, len, FALSE);
 255         offset += len;
 256
 257         return offset;
 258 }
 259 int
 260 lsa_dissect_LSA_SECRET(tvbuff_t *tvb, int offset,
 261                         packet_info *pinfo, proto_tree *parent_tree,
 262                         char *drep)
 263 {
 264         proto_item *item=NULL;
 265         proto_tree *tree=NULL;
 266         int old_offset=offset;
 267
 268         if(parent_tree){
 269                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 270                         "LSA_SECRET:");
 271                 tree = proto_item_add_subtree(item, ett_LSA_SECURITY_DESCRIPTOR);
 272         }
 273
 274         /* XXX need to figure this one out */
 275         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 276                                      hf_lsa_sd_size, NULL);
 277         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 278                         lsa_dissect_LSA_SECRET_data, NDR_POINTER_UNIQUE,
 279                         "LSA SECRET data:", -1);
 280
 281         proto_item_set_len(item, offset-old_offset);
 282         return offset;
 283 }
 284
 285 static int
 286 lsa_dissect_LSA_SECRET_pointer(tvbuff_t *tvb, int offset,
 287                         packet_info *pinfo, proto_tree *tree,
 288                         char *drep)
 289 {
 290         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 291                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
 292                 "LSA_SECRET pointer: data", -1);
 293
 294         return offset;
 295 }
 296
 297 /* Dissect LSA specific access rights */
 298
 299 static gint hf_view_local_info = -1;
 300 static gint hf_view_audit_info = -1;
 301 static gint hf_get_private_info = -1;
 302 static gint hf_trust_admin = -1;
 303 static gint hf_create_account = -1;
 304 static gint hf_create_secret = -1;
 305 static gint hf_create_priv = -1;
 306 static gint hf_set_default_quota_limits = -1;
 307 static gint hf_set_audit_requirements = -1;
 308 static gint hf_server_admin = -1;
 309 static gint hf_lookup_names = -1;
 310
 311 static void
 312 lsa_specific_rights(tvbuff_t *tvb, gint offset, proto_tree *tree,
 313                     guint32 access)
 314 {
 315         proto_tree_add_boolean(
 316                 tree, hf_lookup_names, tvb, offset, 4, access);
 317
 318         proto_tree_add_boolean(
 319                 tree, hf_server_admin, tvb, offset, 4, access);
 320
 321         proto_tree_add_boolean(
 322                 tree, hf_set_audit_requirements, tvb, offset, 4, access);
 323
 324         proto_tree_add_boolean(
 325                 tree, hf_set_default_quota_limits, tvb, offset, 4, access);
 326
 327         proto_tree_add_boolean(
 328                 tree, hf_create_priv, tvb, offset, 4, access);
 329
 330         proto_tree_add_boolean(
 331                 tree, hf_create_secret, tvb, offset, 4, access);
 332
 333         proto_tree_add_boolean(
 334                 tree, hf_create_account, tvb, offset, 4, access);
 335
 336         proto_tree_add_boolean(
 337                 tree, hf_trust_admin, tvb, offset, 4, access);
 338
 339         proto_tree_add_boolean(
 340                 tree, hf_get_private_info, tvb, offset, 4, access);
 341
 342         proto_tree_add_boolean(
 343                 tree, hf_view_audit_info, tvb, offset, 4, access);
 344
 345         proto_tree_add_boolean(
 346                 tree, hf_view_local_info, tvb, offset, 4, access);
 347 }
 348
 349 struct access_mask_info lsa_access_mask_info = {
 350         "LSA",                  /* Name of specific rights */
 351         lsa_specific_rights,    /* Dissection function */
 352         NULL,                   /* Generic mapping table */
 353         NULL                    /* Standard mapping table */
 354 };
 355
 356 int
 357 lsa_dissect_LSA_SECURITY_DESCRIPTOR_data(tvbuff_t *tvb, int offset,
 358                              packet_info *pinfo, proto_tree *tree,
 359                              char *drep)
 360 {
 361         guint32 len;
 362         dcerpc_info *di;
 363
 364         di=pinfo->private_data;
 365         if(di->conformant_run){
 366                 /*just a run to handle conformant arrays, nothing to dissect */
 367                 return offset;
 368         }
 369
 370         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 371                                      hf_lsa_sd_size, &len);
 372
 373         dissect_nt_sec_desc(
 374                 tvb, offset, pinfo, tree, drep, len, &lsa_access_mask_info);
 375
 376         offset += len;
 377
 378         return offset;
 379 }
 380 int
 381 lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvbuff_t *tvb, int offset,
 382                         packet_info *pinfo, proto_tree *parent_tree,
 383                         char *drep)
 384 {
 385         proto_item *item=NULL;
 386         proto_tree *tree=NULL;
 387         int old_offset=offset;
 388
 389         if(parent_tree){
 390                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 391                         "LSA_SECURITY_DESCRIPTOR:");
 392                 tree = proto_item_add_subtree(item, ett_LSA_SECURITY_DESCRIPTOR);
 393         }
 394
 395         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 396                                     hf_lsa_sd_size, NULL);
 397
 398         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 399                         lsa_dissect_LSA_SECURITY_DESCRIPTOR_data, NDR_POINTER_UNIQUE,
 400                         "LSA SECURITY DESCRIPTOR data:", -1);
 401
 402         proto_item_set_len(item, offset-old_offset);
 403         return offset;
 404 }
 405
 406 static int
 407 lsa_dissect_LPSTR(tvbuff_t *tvb, int offset,
 408         packet_info *pinfo, proto_tree *tree, char *drep)
 409 {
 410         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 411                         hf_lsa_unknown_char, NULL);
 412
 413         return offset;
 414 }
 415
 416 static const value_string lsa_impersonation_level_vals[] = {
 417         {0,     "Anonymous"},
 418         {1,     "Identification"},
 419         {2,     "Impersonation"},
 420         {3,     "Delegation"},
 421         {0, NULL}
 422 };
 423
 424
 425 static int
 426 lsa_dissect_SECURITY_QUALITY_OF_SERVICE(tvbuff_t *tvb, int offset,
 427         packet_info *pinfo, proto_tree *tree, char *drep)
 428 {
 429         /* Length */
 430         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 431                         hf_lsa_qos_len, NULL);
 432
 433         /* impersonation level */
 434         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 435                         hf_lsa_qos_impersonation_level, NULL);
 436
 437         /* context tracking mode */
 438         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 439                         hf_lsa_qos_track_context, NULL);
 440
 441         /* effective only */
 442         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 443                         hf_lsa_qos_effective_only, NULL);
 444
 445         return offset;
 446 }
 447
 448 static int
 449 lsa_dissect_ACCESS_MASK(tvbuff_t *tvb, int offset,
 450         packet_info *pinfo, proto_tree *tree, char *drep)
 451 {
 452         offset = dissect_nt_access_mask(
 453                 tvb, offset, pinfo, tree, drep, hf_lsa_access_mask,
 454                 &lsa_access_mask_info);
 455
 456         return offset;
 457 }
 458
 459 static int
 460 lsa_dissect_LSA_HANDLE(tvbuff_t *tvb, int offset,
 461         packet_info *pinfo, proto_tree *tree, char *drep)
 462 {
 463         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 464                         hf_lsa_hnd, NULL, FALSE, FALSE);
 465
 466         return offset;
 467 }
 468
 469 static int
 470 lsa_dissect_LSA_HANDLE_open(tvbuff_t *tvb, int offset,
 471         packet_info *pinfo, proto_tree *tree, char *drep)
 472 {
 473         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 474                         hf_lsa_hnd, NULL, TRUE, FALSE);
 475
 476         return offset;
 477 }
 478
 479 static int
 480 lsa_dissect_LSA_HANDLE_close(tvbuff_t *tvb, int offset,
 481         packet_info *pinfo, proto_tree *tree, char *drep)
 482 {
 483         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 484                         hf_lsa_hnd, NULL, FALSE, TRUE);
 485
 486         return offset;
 487 }
 488
 489
 490 static int
 491 lsa_dissect_LSA_OBJECT_ATTRIBUTES(tvbuff_t *tvb, int offset,
 492         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 493 {
 494         int old_offset=offset;
 495         proto_item *item = NULL;
 496         proto_tree *tree = NULL;
 497
 498         if(parent_tree){
 499                 item = proto_tree_add_text(parent_tree, tvb, offset, -1, "Object Attributes");
 500                 tree = proto_item_add_subtree(item, ett_lsa_OBJECT_ATTRIBUTES);
 501         }
 502
 503         /* Length */
 504         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 505                         hf_lsa_obj_attr_len, NULL);
 506
 507         /* LPSTR */
 508         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 509                 lsa_dissect_LPSTR, NDR_POINTER_UNIQUE,
 510                 "LSPTR pointer: ", -1);
 511
 512         /* attribute name */
 513         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 514                 lsa_dissect_pointer_STRING, NDR_POINTER_UNIQUE,
 515                 "NAME pointer: ", hf_lsa_obj_attr_name);
 516
 517         /* Attr */
 518         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 519                         hf_lsa_obj_attr, NULL);
 520
 521         /* security descriptor */
 522         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 523                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
 524                 "LSA_SECURITY_DESCRIPTOR pointer: ", -1);
 525
 526         /* security quality of service */
 527         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 528                 lsa_dissect_SECURITY_QUALITY_OF_SERVICE, NDR_POINTER_UNIQUE,
 529                 "LSA_SECURITY_QUALITY_OF_SERVICE pointer: ", -1);
 530
 531         proto_item_set_len(item, offset-old_offset);
 532         return offset;
 533 }
 534
 535 static int
 536 lsa_dissect_lsaclose_rqst(tvbuff_t *tvb, int offset,
 537         packet_info *pinfo, proto_tree *tree, char *drep)
 538 {
 539         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 540                 lsa_dissect_LSA_HANDLE_close, NDR_POINTER_REF,
 541                 "LSA_HANDLE", -1);
 542         return offset;
 543 }
 544
 545
 546 static int
 547 lsa_dissect_lsaclose_reply(tvbuff_t *tvb, int offset,
 548         packet_info *pinfo, proto_tree *tree, char *drep)
 549 {
 550         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 551                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
 552                 "LSA_HANDLE", -1);
 553
 554         offset = dissect_ntstatus(
 555                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
 556
 557         return offset;
 558 }
 559
 560 /* A bug in the NT IDL for lsa openpolicy only stores the first (wide)
 561    character of the server name which is always '\'.  This is fixed in lsa
 562    openpolicy2 but the function remains for backwards compatibility. */
 563
 564 static int dissect_lsa_openpolicy_server(tvbuff_t *tvb, int offset,
 565                                              packet_info *pinfo,
 566                                              proto_tree *tree, char *drep)
 567 {
 568         return dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 569                                   hf_lsa_server, NULL);
 570 }
 571
 572 static int
 573 lsa_dissect_lsaopenpolicy_rqst(tvbuff_t *tvb, int offset,
 574         packet_info *pinfo, proto_tree *tree, char *drep)
 575 {
 576         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 577                 dissect_lsa_openpolicy_server, NDR_POINTER_UNIQUE,
 578                 "Server:", hf_lsa_server);
 579
 580         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 581                 lsa_dissect_LSA_OBJECT_ATTRIBUTES, NDR_POINTER_REF,
 582                 "OBJECT_ATTRIBUTES", -1);
 583
 584         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
 585                 pinfo, tree, drep);
 586         return offset;
 587 }
 588
 589 static int
 590 lsa_dissect_lsaopenpolicy_reply(tvbuff_t *tvb, int offset,
 591         packet_info *pinfo, proto_tree *tree, char *drep)
 592 {
 593         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 594                 lsa_dissect_LSA_HANDLE_open, NDR_POINTER_REF,
 595                 "LSA_HANDLE", -1);
 596
 597         offset = dissect_ntstatus(
 598                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
 599
 600         return offset;
 601 }
 602
 603 static int
 604 lsa_dissect_lsaopenpolicy2_rqst(tvbuff_t *tvb, int offset,
 605         packet_info *pinfo, proto_tree *tree, char *drep)
 606 {
 607         offset = dissect_ndr_pointer_cb(tvb, offset, pinfo, tree, drep,
 608                 dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "Server",
 609                 hf_lsa_server, cb_wstr_postprocess,
 610                 GINT_TO_POINTER(CB_STR_COL_INFO | CB_STR_SAVE | 1));
 611
 612         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 613                 lsa_dissect_LSA_OBJECT_ATTRIBUTES, NDR_POINTER_REF,
 614                 "OBJECT_ATTRIBUTES", -1);
 615
 616         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
 617                 pinfo, tree, drep);
 618         return offset;
 619 }
 620
 621
 622 static int
 623 lsa_dissect_lsaopenpolicy2_reply(tvbuff_t *tvb, int offset,
 624         packet_info *pinfo, proto_tree *tree, char *drep)
 625 {
 626         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 627                 lsa_dissect_LSA_HANDLE_open, NDR_POINTER_REF,
 628                 "LSA_HANDLE", -1);
 629
 630         offset = dissect_ntstatus(
 631                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
 632
 633         return offset;
 634 }
 635
 636 static const value_string policy_information_class_vals[] = {
 637         {1,     "Audit Log Information"},
 638         {2,     "Audit Events Information"},
 639         {3,     "Primary Domain Information"},
 640         {4,     "Pd Account Information"},
 641         {5,     "Account Domain Information"},
 642         {6,     "Server Role Information"},
 643         {7,     "Replica Source Information"},
 644         {8,     "Default Quota Information"},
 645         {9,     "Modification Information"},
 646         {10,    "Audit Full Set Information"},
 647         {11,    "Audit Full Query Information"},
 648         {12,    "DNS Domain Information"},
 649         {0, NULL}
 650 };
 651
 652 static int
 653 lsa_dissect_lsaqueryinformationpolicy_rqst(tvbuff_t *tvb, int offset,
 654         packet_info *pinfo, proto_tree *tree, char *drep)
 655 {
 656         guint16 level;
 657
 658         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 659                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
 660                 "LSA_HANDLE", -1);
 661
 662         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 663                 hf_lsa_policy_information_class, &level);
 664
 665         if (check_col(pinfo->cinfo, COL_INFO))
 666                 col_append_fstr(
 667                         pinfo->cinfo, COL_INFO, ", %s",
 668                         val_to_str(level, policy_information_class_vals,
 669                                    "Unknown (%d)"));
 670
 671         return offset;
 672 }
 673
 674 static int
 675 lsa_dissect_POLICY_AUDIT_LOG_INFO(tvbuff_t *tvb, int offset,
 676         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 677 {
 678         proto_item *item=NULL;
 679         proto_tree *tree=NULL;
 680         int old_offset=offset;
 681
 682         if(parent_tree){
 683                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 684                         "POLICY_AUDIT_LOG_INFO:");
 685                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_log_info);
 686         }
 687
 688         /* percent full */
 689         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 690                                      hf_lsa_pali_percent_full, NULL);
 691
 692         /* log size */
 693         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 694                                      hf_lsa_pali_log_size, NULL);
 695
 696         /* retention period */
 697         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 698                                 hf_lsa_pali_retention_period);
 699
 700         /* shutdown in progress */
 701         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 702                                      hf_lsa_pali_shutdown_in_progress, NULL);
 703
 704         /* time to shutdown */
 705         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 706                                 hf_lsa_pali_time_to_shutdown);
 707
 708         /* next audit record */
 709         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 710                                      hf_lsa_pali_next_audit_record, NULL);
 711
 712         proto_item_set_len(item, offset-old_offset);
 713         return offset;
 714 }
 715
 716 static int
 717 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings(tvbuff_t *tvb, int offset,
 718         packet_info *pinfo, proto_tree *tree, char *drep)
 719 {
 720         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 721                                      hf_lsa_paei_settings, NULL);
 722         return offset;
 723 }
 724
 725 static int
 726 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings_array(tvbuff_t *tvb, int offset,
 727         packet_info *pinfo, proto_tree *tree, char *drep)
 728 {
 729         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 730                 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings);
 731
 732         return offset;
 733 }
 734
 735 static int
 736 lsa_dissect_POLICY_AUDIT_EVENTS_INFO(tvbuff_t *tvb, int offset,
 737         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 738 {
 739         proto_item *item=NULL;
 740         proto_tree *tree=NULL;
 741         int old_offset=offset;
 742
 743         if(parent_tree){
 744                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 745                         "POLICY_AUDIT_EVENTS_INFO:");
 746                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_events_info);
 747         }
 748
 749         /* enabled */
 750         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 751                                      hf_lsa_paei_enabled, NULL);
 752
 753         /* settings */
 754         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 755                 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings_array, NDR_POINTER_UNIQUE,
 756                 "Settings", -1);
 757
 758         /* count */
 759         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 760                                      hf_lsa_count, NULL);
 761
 762         proto_item_set_len(item, offset-old_offset);
 763         return offset;
 764 }
 765
 766
 767 static int
 768 lsa_dissect_POLICY_PRIMARY_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 769         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 770 {
 771         proto_item *item=NULL;
 772         proto_tree *tree=NULL;
 773         int old_offset=offset;
 774
 775         if(parent_tree){
 776                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 777                         "POLICY_PRIMARY_DOMAIN_INFO:");
 778                 tree = proto_item_add_subtree(item, ett_lsa_policy_primary_domain_info);
 779         }
 780
 781         /* domain */
 782         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 783                 hf_lsa_domain, 0);
 784
 785         /* sid */
 786         offset = dissect_ndr_nt_PSID(tvb, offset,
 787                 pinfo, tree, drep, -1);
 788
 789         proto_item_set_len(item, offset-old_offset);
 790         return offset;
 791 }
 792
 793
 794 static int
 795 lsa_dissect_POLICY_ACCOUNT_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 796         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 797 {
 798         proto_item *item=NULL;
 799         proto_tree *tree=NULL;
 800         int old_offset=offset;
 801
 802         if(parent_tree){
 803                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 804                         "POLICY_ACCOUNT_DOMAIN_INFO:");
 805                 tree = proto_item_add_subtree(item, ett_lsa_policy_primary_account_info);
 806         }
 807
 808         /* account */
 809         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 810                 hf_lsa_acct, 0);
 811
 812         /* sid */
 813         offset = dissect_ndr_nt_PSID(tvb, offset,
 814                 pinfo, tree, drep, -1);
 815
 816         proto_item_set_len(item, offset-old_offset);
 817         return offset;
 818 }
 819
 820
 821 static const value_string server_role_vals[] = {
 822         {0,     "Standalone"},
 823         {1,     "Domain Member"},
 824         {2,     "Backup"},
 825         {3,     "Primary"},
 826         {0, NULL}
 827 };
 828 static int
 829 lsa_dissect_POLICY_SERVER_ROLE_INFO(tvbuff_t *tvb, int offset,
 830         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 831 {
 832         proto_item *item=NULL;
 833         proto_tree *tree=NULL;
 834         int old_offset=offset;
 835
 836         if(parent_tree){
 837                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 838                         "POLICY_SERVER_ROLE_INFO:");
 839                 tree = proto_item_add_subtree(item, ett_lsa_policy_server_role_info);
 840         }
 841
 842         /* server role */
 843         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 844                                      hf_lsa_server_role, NULL);
 845
 846         proto_item_set_len(item, offset-old_offset);
 847         return offset;
 848 }
 849
 850 static int
 851 lsa_dissect_POLICY_REPLICA_SOURCE_INFO(tvbuff_t *tvb, int offset,
 852         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 853 {
 854         proto_item *item=NULL;
 855         proto_tree *tree=NULL;
 856         int old_offset=offset;
 857
 858         if(parent_tree){
 859                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 860                         "POLICY_REPLICA_SOURCE_INFO:");
 861                 tree = proto_item_add_subtree(item, ett_lsa_policy_replica_source_info);
 862         }
 863
 864         /* source */
 865         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 866                 hf_lsa_source, 0);
 867
 868         /* account */
 869         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 870                 hf_lsa_acct, 0);
 871
 872         proto_item_set_len(item, offset-old_offset);
 873         return offset;
 874 }
 875
 876
 877 static int
 878 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO(tvbuff_t *tvb, int offset,
 879         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 880 {
 881         proto_item *item=NULL;
 882         proto_tree *tree=NULL;
 883         int old_offset=offset;
 884
 885         if(parent_tree){
 886                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 887                         "POLICY_DEFAULT_QUOTA_INFO:");
 888                 tree = proto_item_add_subtree(item, ett_lsa_policy_default_quota_info);
 889         }
 890
 891         /* paged pool */
 892         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 893                                      hf_lsa_quota_paged_pool, NULL);
 894
 895         /* non paged pool */
 896         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 897                                      hf_lsa_quota_non_paged_pool, NULL);
 898
 899         /* min wss */
 900         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 901                                      hf_lsa_quota_min_wss, NULL);
 902
 903         /* max wss */
 904         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 905                                      hf_lsa_quota_max_wss, NULL);
 906
 907         /* pagefile */
 908         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 909                                      hf_lsa_quota_pagefile, NULL);
 910
 911         /*  */
 912         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
 913                                      hf_lsa_unknown_hyper, NULL);
 914
 915         proto_item_set_len(item, offset-old_offset);
 916         return offset;
 917 }
 918
 919
 920 static int
 921 lsa_dissect_POLICY_MODIFICATION_INFO(tvbuff_t *tvb, int offset,
 922         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 923 {
 924         proto_item *item=NULL;
 925         proto_tree *tree=NULL;
 926         int old_offset=offset;
 927
 928         if(parent_tree){
 929                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 930                         "POLICY_MODIFICATION_INFO:");
 931                 tree = proto_item_add_subtree(item, ett_lsa_policy_modification_info);
 932         }
 933
 934         /* seq no */
 935         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
 936                                      hf_lsa_mod_seq_no, NULL);
 937
 938         /* mtime */
 939         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 940                                 hf_lsa_mod_mtime);
 941
 942         proto_item_set_len(item, offset-old_offset);
 943         return offset;
 944 }
 945
 946
 947 static int
 948 lsa_dissect_POLICY_AUDIT_FULL_SET_INFO(tvbuff_t *tvb, int offset,
 949         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 950 {
 951         proto_item *item=NULL;
 952         proto_tree *tree=NULL;
 953         int old_offset=offset;
 954
 955         if(parent_tree){
 956                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 957                         "POLICY_AUDIT_FULL_SET_INFO:");
 958                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_full_set_info);
 959         }
 960
 961         /* unknown */
 962         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 963                         hf_lsa_unknown_char, NULL);
 964
 965         proto_item_set_len(item, offset-old_offset);
 966         return offset;
 967 }
 968
 969
 970 static int
 971 lsa_dissect_POLICY_AUDIT_FULL_QUERY_INFO(tvbuff_t *tvb, int offset,
 972         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 973 {
 974         proto_item *item=NULL;
 975         proto_tree *tree=NULL;
 976         int old_offset=offset;
 977
 978         if(parent_tree){
 979                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 980                         "POLICY_AUDIT_FULL_QUERY_INFO:");
 981                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_full_query_info);
 982         }
 983
 984         /* unknown */
 985         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 986                         hf_lsa_unknown_char, NULL);
 987
 988         /* unknown */
 989         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 990                         hf_lsa_unknown_char, NULL);
 991
 992         proto_item_set_len(item, offset-old_offset);
 993         return offset;
 994 }
 995
 996
 997 int
 998 lsa_dissect_POLICY_DNS_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 999         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1000 {
1001         proto_item *item=NULL;
1002         proto_tree *tree=NULL;
1003         int old_offset=offset;
1004
1005         if(parent_tree){
1006                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1007                         "POLICY_DNS_DOMAIN_INFO:");
1008                 tree = proto_item_add_subtree(item, ett_lsa_policy_dns_domain_info);
1009         }
1010
1011         /* name */
1012         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1013                 hf_lsa_name, 0);
1014
1015         /* domain */
1016         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1017                 hf_lsa_domain, 0);
1018
1019         /* forest */
1020         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1021                 hf_lsa_forest, 0);
1022
1023         /* GUID */
1024         offset = dissect_nt_GUID(tvb, offset,
1025                 pinfo, tree, drep);
1026
1027         /* SID pointer */
1028         offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep, -1);
1029
1030         proto_item_set_len(item, offset-old_offset);
1031         return offset;
1032 }
1033
1034 static int
1035 lsa_dissect_POLICY_INFORMATION(tvbuff_t *tvb, int offset,
1036         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1037 {
1038         proto_item *item=NULL;
1039         proto_tree *tree=NULL;
1040         int old_offset=offset;
1041         guint16 level;
1042
1043         if(parent_tree){
1044                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1045                         "POLICY_INFO:");
1046                 tree = proto_item_add_subtree(item, ett_lsa_policy_info);
1047         }
1048
1049         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1050                                      hf_lsa_info_level, &level);
1051
1052         ALIGN_TO_4_BYTES;  /* all union arms aligned to 4 bytes, case 7 and 9 need this  */
1053         switch(level){
1054         case 1:
1055                 offset = lsa_dissect_POLICY_AUDIT_LOG_INFO(
1056                                 tvb, offset, pinfo, tree, drep);
1057                 break;
1058         case 2:
1059                 offset = lsa_dissect_POLICY_AUDIT_EVENTS_INFO(
1060                                 tvb, offset, pinfo, tree, drep);
1061                 break;
1062         case 3:
1063                 offset = lsa_dissect_POLICY_PRIMARY_DOMAIN_INFO(
1064                                 tvb, offset, pinfo, tree, drep);
1065                 break;
1066         case 4:
1067                 offset = dissect_ndr_counted_string(tvb, offset, pinfo,
1068                         tree, drep, hf_lsa_acct, 0);
1069                 break;
1070         case 5:
1071                 offset = lsa_dissect_POLICY_ACCOUNT_DOMAIN_INFO(
1072                                 tvb, offset, pinfo, tree, drep);
1073                 break;
1074         case 6:
1075                 offset = lsa_dissect_POLICY_SERVER_ROLE_INFO(
1076                                 tvb, offset, pinfo, tree, drep);
1077                 break;
1078         case 7:
1079                 offset = lsa_dissect_POLICY_REPLICA_SOURCE_INFO(
1080                                 tvb, offset, pinfo, tree, drep);
1081                 break;
1082         case 8:
1083                 offset = lsa_dissect_POLICY_DEFAULT_QUOTA_INFO(
1084                                 tvb, offset, pinfo, tree, drep);
1085                 break;
1086         case 9:
1087                 offset = lsa_dissect_POLICY_MODIFICATION_INFO(
1088                                 tvb, offset, pinfo, tree, drep);
1089                 break;
1090         case 10:
1091                 offset = lsa_dissect_POLICY_AUDIT_FULL_SET_INFO(
1092                                 tvb, offset, pinfo, tree, drep);
1093                 break;
1094         case 11:
1095                 offset = lsa_dissect_POLICY_AUDIT_FULL_QUERY_INFO(
1096                                 tvb, offset, pinfo, tree, drep);
1097                 break;
1098         case 12:
1099                 offset = lsa_dissect_POLICY_DNS_DOMAIN_INFO(
1100                                 tvb, offset, pinfo, tree, drep);
1101                 break;
1102         }
1103
1104         proto_item_set_len(item, offset-old_offset);
1105         return offset;
1106 }
1107
1108 static int
1109 lsa_dissect_lsaqueryinformationpolicy_reply(tvbuff_t *tvb, int offset,
1110         packet_info *pinfo, proto_tree *tree, char *drep)
1111 {
1112         /* This is really a pointer to a pointer though the first level is REF
1113           so we just ignore that one */
1114         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1115                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_UNIQUE,
1116                 "POLICY_INFORMATION pointer: info", -1);
1117
1118         offset = dissect_ntstatus(
1119                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1120
1121         return offset;
1122 }
1123
1124 static int
1125 lsa_dissect_lsadelete_rqst(tvbuff_t *tvb, int offset,
1126         packet_info *pinfo, proto_tree *tree, char *drep)
1127 {
1128         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1129                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
1130                 "LSA_HANDLE", -1);
1131
1132         return offset;
1133 }
1134
1135 static int
1136 lsa_dissect_lsadelete_reply(tvbuff_t *tvb, int offset,
1137         packet_info *pinfo, proto_tree *tree, char *drep)
1138 {
1139         offset = dissect_ntstatus(
1140                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1141
1142         return offset;
1143 }
1144
1145
1146 static int
1147 lsa_dissect_lsaquerysecurityobject_rqst(tvbuff_t *tvb, int offset,
1148         packet_info *pinfo, proto_tree *tree, char *drep)
1149 {
1150         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1151                 pinfo, tree, drep);
1152
1153         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1154                 hf_lsa_info_type, NULL);
1155
1156         return offset;
1157 }
1158
1159
1160 static int
1161 lsa_dissect_lsaquerysecurityobject_reply(tvbuff_t *tvb, int offset,
1162         packet_info *pinfo, proto_tree *tree, char *drep)
1163 {
1164         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1165                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
1166                 "LSA_SECURITY_DESCRIPTOR pointer: sec_info", -1);
1167
1168         offset = dissect_ntstatus(
1169                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1170
1171         return offset;
1172 }
1173
1174
1175 static int
1176 lsa_dissect_lsasetsecurityobject_rqst(tvbuff_t *tvb, int offset,
1177         packet_info *pinfo, proto_tree *tree, char *drep)
1178 {
1179         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1180                 pinfo, tree, drep);
1181
1182         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1183                 hf_lsa_info_type, NULL);
1184
1185         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1186                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
1187                 "LSA_SECURITY_DESCRIPTOR: sec_info", -1);
1188
1189         return offset;
1190 }
1191
1192 static int
1193 lsa_dissect_lsasetsecurityobject_reply(tvbuff_t *tvb, int offset,
1194         packet_info *pinfo, proto_tree *tree, char *drep)
1195 {
1196         offset = dissect_ntstatus(
1197                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1198
1199         return offset;
1200 }
1201
1202
1203 static int
1204 lsa_dissect_lsachangepassword_rqst(tvbuff_t *tvb, int offset,
1205         packet_info *pinfo, proto_tree *tree, char *drep)
1206 {
1207         /* server */
1208         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1209                 hf_lsa_server, 0);
1210
1211         /* domain */
1212         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1213                 hf_lsa_domain, 0);
1214
1215         /* account */
1216         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1217                 hf_lsa_acct, 0);
1218
1219         /* old password */
1220         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1221                 hf_lsa_old_pwd, 0);
1222
1223         /* new password */
1224         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1225                 hf_lsa_new_pwd, 0);
1226
1227         return offset;
1228 }
1229
1230 static int
1231 lsa_dissect_lsachangepassword_reply(tvbuff_t *tvb, int offset,
1232         packet_info *pinfo, proto_tree *tree, char *drep)
1233 {
1234         offset = dissect_ntstatus(
1235                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1236
1237         return offset;
1238 }
1239
1240 static const value_string sid_type_vals[] = {
1241         {1,     "User"},
1242         {2,     "Group"},
1243         {3,     "Domain"},
1244         {4,     "Alias"},
1245         {5,     "Well Known Group"},
1246         {6,     "Deleted Account"},
1247         {7,     "Invalid"},
1248         {8,     "Unknown"},
1249         {9,     "Computer"},
1250         {0, NULL}
1251 };
1252 static int
1253 lsa_dissect_LSA_TRANSLATED_NAME(tvbuff_t *tvb, int offset,
1254         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1255 {
1256         proto_item *item=NULL;
1257         proto_tree *tree=NULL;
1258         int old_offset=offset;
1259
1260         if(parent_tree){
1261                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1262                         "LSA_TRANSLATED_NAME:");
1263                 tree = proto_item_add_subtree(item, ett_lsa_translated_name);
1264         }
1265
1266         /* sid type */
1267         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1268                         hf_lsa_sid_type, NULL);
1269
1270         /* name */
1271         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1272                 hf_lsa_name, 0);
1273
1274         /* index */
1275         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1276                                      hf_lsa_index, NULL);
1277
1278         proto_item_set_len(item, offset-old_offset);
1279         return offset;
1280 }
1281
1282 static int
1283 lsa_dissect_LSA_TRANSLATED_NAME_array(tvbuff_t *tvb, int offset,
1284         packet_info *pinfo, proto_tree *tree, char *drep)
1285 {
1286         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1287                 lsa_dissect_LSA_TRANSLATED_NAME);
1288
1289         return offset;
1290 }
1291
1292 static int
1293 lsa_dissect_LSA_TRANSLATED_NAMES(tvbuff_t *tvb, int offset,
1294         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1295 {
1296         proto_item *item=NULL;
1297         proto_tree *tree=NULL;
1298         int old_offset=offset;
1299
1300         if(parent_tree){
1301                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1302                         "LSA_TRANSLATED_NAMES:");
1303                 tree = proto_item_add_subtree(item, ett_lsa_translated_names);
1304         }
1305
1306         /* count */
1307         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1308                                      hf_lsa_count, NULL);
1309
1310         /* settings */
1311         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1312                 lsa_dissect_LSA_TRANSLATED_NAME_array, NDR_POINTER_UNIQUE,
1313                 "TRANSLATED_NAME_ARRAY", -1);
1314
1315         proto_item_set_len(item, offset-old_offset);
1316         return offset;
1317 }
1318
1319
1320 static int
1321 lsa_dissect_lsalookupsids_rqst(tvbuff_t *tvb, int offset,
1322         packet_info *pinfo, proto_tree *tree, char *drep)
1323 {
1324         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1325                 pinfo, tree, drep);
1326
1327         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1328                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
1329                         "PSID_ARRAY", -1);
1330
1331         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1332                 lsa_dissect_LSA_TRANSLATED_NAMES, NDR_POINTER_REF,
1333                 "LSA_TRANSLATED_NAMES pointer: names", -1);
1334
1335         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1336                 hf_lsa_info_level, NULL);
1337
1338         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1339                 hf_lsa_num_mapped, NULL);
1340
1341         return offset;
1342 }
1343
1344 static int
1345 lsa_dissect_LSA_TRUST_INFORMATION(tvbuff_t *tvb, int offset,
1346         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1347 {
1348         proto_item *item=NULL;
1349         proto_tree *tree=NULL;
1350         int old_offset=offset;
1351
1352         if(parent_tree){
1353                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1354                         "TRUST INFORMATION:");
1355                 tree = proto_item_add_subtree(item, ett_lsa_trust_information);
1356         }
1357
1358         /* name */
1359         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1360                 hf_lsa_name, 0);
1361
1362         /* sid */
1363         offset = dissect_ndr_nt_PSID(tvb, offset,
1364                 pinfo, tree, drep, -1);
1365
1366         proto_item_set_len(item, offset-old_offset);
1367         return offset;
1368 }
1369
1370 static const value_string trusted_direction_vals[] = {
1371         {0,     "Trust disabled"},
1372         {1,     "Inbound trust"},
1373         {2,     "Outbound trust"},
1374         {0,     NULL}
1375 };
1376
1377 static const value_string trusted_type_vals[] = {
1378         {1,     "Downlevel"},
1379         {2,     "Uplevel"},
1380         {3,     "MIT"},
1381         {4,     "DCE"},
1382         {0,     NULL}
1383 };
1384
1385 static const true_false_string tfs_trust_attr_non_trans = {
1386         "NON TRANSITIVE is set",
1387         "Non transitive is NOT set"
1388 };
1389 static const true_false_string tfs_trust_attr_uplevel_only = {
1390         "UPLEVEL ONLY is set",
1391         "Uplevel only is NOT set"
1392 };
1393 static const true_false_string tfs_trust_attr_tree_parent = {
1394         "TREE PARENT is set",
1395         "Tree parent is NOT set"
1396 };
1397 static const true_false_string tfs_trust_attr_tree_root = {
1398         "TREE ROOT is set",
1399         "Tree root is NOT set"
1400 };
1401 static int
1402 lsa_dissect_trust_attr(tvbuff_t *tvb, int offset, packet_info *pinfo,
1403                         proto_tree *parent_tree, char *drep)
1404 {
1405         guint32 mask;
1406         proto_item *item = NULL;
1407         proto_tree *tree = NULL;
1408
1409         offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
1410                         hf_lsa_trust_attr, &mask);
1411
1412         if(parent_tree){
1413                 item = proto_tree_add_uint(parent_tree, hf_lsa_trust_attr,
1414                         tvb, offset-4, 4, mask);
1415                 tree = proto_item_add_subtree(item, ett_lsa_trust_attr);
1416         }
1417
1418         proto_tree_add_boolean(tree, hf_lsa_trust_attr_tree_root,
1419                 tvb, offset-4, 4, mask);
1420         proto_tree_add_boolean(tree, hf_lsa_trust_attr_tree_parent,
1421                 tvb, offset-4, 4, mask);
1422         proto_tree_add_boolean(tree, hf_lsa_trust_attr_uplevel_only,
1423                 tvb, offset-4, 4, mask);
1424         proto_tree_add_boolean(tree, hf_lsa_trust_attr_non_trans,
1425                 tvb, offset-4, 4, mask);
1426
1427         return offset;
1428 }
1429
1430 static int
1431 lsa_dissect_LSA_TRUST_INFORMATION_EX(tvbuff_t *tvb, int offset,
1432         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1433 {
1434         proto_item *item=NULL;
1435         proto_tree *tree=NULL;
1436         int old_offset=offset;
1437
1438         if(parent_tree){
1439                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1440                         "TRUST INFORMATION EX:");
1441                 tree = proto_item_add_subtree(item, ett_lsa_trust_information_ex);
1442         }
1443
1444         /* name */
1445         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1446                 hf_lsa_name, 0);
1447
1448         /* flat name */
1449         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1450                 hf_lsa_flat_name, 0);
1451
1452         /* sid */
1453         offset = dissect_ndr_nt_PSID(tvb, offset,
1454                 pinfo, tree, drep, -1);
1455
1456         /* direction */
1457         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1458                                      hf_lsa_trust_direction, NULL);
1459
1460         /* type */
1461         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1462                                      hf_lsa_trust_type, NULL);
1463
1464         /* attributes */
1465         offset = lsa_dissect_trust_attr(tvb, offset, pinfo, tree, drep);
1466
1467         proto_item_set_len(item, offset-old_offset);
1468         return offset;
1469 }
1470
1471 static int
1472 lsa_dissect_auth_info_blob(tvbuff_t *tvb, int offset,
1473         packet_info *pinfo, proto_tree *tree, char *drep)
1474 {
1475         dcerpc_info *di;
1476         guint32 len;
1477
1478         di=pinfo->private_data;
1479         if(di->conformant_run){
1480                 /*just a run to handle conformant arrays, nothing to dissect */
1481                 return offset;
1482         }
1483
1484         /* len */
1485         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1486                                      hf_lsa_auth_len, &len);
1487
1488         proto_tree_add_item(tree, hf_lsa_auth_blob, tvb, offset, len, FALSE);
1489         offset += len;
1490
1491         return offset;
1492 }
1493
1494 static int
1495 lsa_dissect_auth_info(tvbuff_t *tvb, int offset,
1496         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1497 {
1498         proto_item *item=NULL;
1499         proto_tree *tree=NULL;
1500         int old_offset=offset;
1501
1502         if(parent_tree){
1503                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1504                         "AUTH INFORMATION:");
1505                 tree = proto_item_add_subtree(item, ett_lsa_auth_information);
1506         }
1507
1508         /* update */
1509         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
1510                                      hf_lsa_auth_update, NULL);
1511
1512         /* type */
1513         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1514                                      hf_lsa_auth_type, NULL);
1515
1516         /* len */
1517         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1518                                      hf_lsa_auth_len, NULL);
1519
1520         /* auth info blob */
1521         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1522                         lsa_dissect_auth_info_blob, NDR_POINTER_UNIQUE,
1523                         "AUTH INFO blob:", -1);
1524
1525         proto_item_set_len(item, offset-old_offset);
1526         return offset;
1527 }
1528
1529 static int
1530 lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvbuff_t *tvb, int offset,
1531         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1532 {
1533         proto_item *item=NULL;
1534         proto_tree *tree=NULL;
1535         int old_offset=offset;
1536
1537         if(parent_tree){
1538                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1539                         "TRUSTED DOMAIN AUTH INFORMATION:");
1540                 tree = proto_item_add_subtree(item, ett_lsa_trusted_domain_auth_information);
1541         }
1542
1543         /* unknown */
1544         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1545                                      hf_lsa_unknown_long, NULL);
1546
1547         /* unknown */
1548         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1549
1550         /* unknown */
1551         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1552
1553         /* unknown */
1554         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1555                                      hf_lsa_unknown_long, NULL);
1556
1557         /* unknown */
1558         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1559
1560         /* unknown */
1561         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1562
1563         proto_item_set_len(item, offset-old_offset);
1564         return offset;
1565 }
1566
1567
1568 static int
1569 lsa_dissect_LSA_TRUST_INFORMATION_array(tvbuff_t *tvb, int offset,
1570         packet_info *pinfo, proto_tree *tree, char *drep)
1571 {
1572         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1573                 lsa_dissect_LSA_TRUST_INFORMATION);
1574
1575         return offset;
1576 }
1577
1578 static int
1579 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST(tvbuff_t *tvb, int offset,
1580         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1581 {
1582         proto_item *item=NULL;
1583         proto_tree *tree=NULL;
1584         int old_offset=offset;
1585
1586         if(parent_tree){
1587                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1588                         "LSA_REFERENCED_DOMAIN_LIST:");
1589                 tree = proto_item_add_subtree(item, ett_lsa_referenced_domain_list);
1590         }
1591
1592         /* count */
1593         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1594                                      hf_lsa_count, NULL);
1595
1596         /* trust information */
1597         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1598                 lsa_dissect_LSA_TRUST_INFORMATION_array, NDR_POINTER_UNIQUE,
1599                 "TRUST INFORMATION array:", -1);
1600
1601         /* max count */
1602         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1603                                      hf_lsa_max_count, NULL);
1604
1605         proto_item_set_len(item, offset-old_offset);
1606         return offset;
1607 }
1608
1609 static int
1610 lsa_dissect_lsalookupsids_reply(tvbuff_t *tvb, int offset,
1611         packet_info *pinfo, proto_tree *tree, char *drep)
1612 {
1613         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1614                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
1615                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
1616
1617         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1618                 lsa_dissect_LSA_TRANSLATED_NAMES, NDR_POINTER_REF,
1619                 "LSA_TRANSLATED_NAMES pointer: names", -1);
1620
1621         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1622                 hf_lsa_num_mapped, NULL);
1623
1624         offset = dissect_ntstatus(
1625                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1626
1627         return offset;
1628 }
1629
1630
1631 static int
1632 lsa_dissect_lsasetquotasforaccount_rqst(tvbuff_t *tvb, int offset,
1633         packet_info *pinfo, proto_tree *tree, char *drep)
1634 {
1635         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1636                 pinfo, tree, drep);
1637
1638         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1639                 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO, NDR_POINTER_REF,
1640                 "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1);
1641
1642         return offset;
1643 }
1644
1645
1646 static int
1647 lsa_dissect_lsasetquotasforaccount_reply(tvbuff_t *tvb, int offset,
1648         packet_info *pinfo, proto_tree *tree, char *drep)
1649 {
1650         offset = dissect_ntstatus(
1651                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1652
1653         return offset;
1654 }
1655
1656
1657 static int
1658 lsa_dissect_lsagetquotasforaccount_rqst(tvbuff_t *tvb, int offset,
1659         packet_info *pinfo, proto_tree *tree, char *drep)
1660 {
1661         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1662                 pinfo, tree, drep);
1663
1664         return offset;
1665 }
1666
1667
1668 static int
1669 lsa_dissect_lsagetquotasforaccount_reply(tvbuff_t *tvb, int offset,
1670         packet_info *pinfo, proto_tree *tree, char *drep)
1671 {
1672         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1673                 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO, NDR_POINTER_REF,
1674                 "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1);
1675
1676         offset = dissect_ntstatus(
1677                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1678
1679         return offset;
1680 }
1681
1682
1683 static int
1684 lsa_dissect_lsasetinformationpolicy_rqst(tvbuff_t *tvb, int offset,
1685         packet_info *pinfo, proto_tree *tree, char *drep)
1686 {
1687         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1688                 pinfo, tree, drep);
1689
1690         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1691                 hf_lsa_policy_information_class, NULL);
1692
1693         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1694                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
1695                 "POLICY_INFORMATION pointer: info", -1);
1696
1697         return offset;
1698 }
1699
1700
1701 static int
1702 lsa_dissect_lsasetinformationpolicy_reply(tvbuff_t *tvb, int offset,
1703         packet_info *pinfo, proto_tree *tree, char *drep)
1704 {
1705         offset = dissect_ntstatus(
1706                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1707
1708         return offset;
1709 }
1710
1711
1712 static int
1713 lsa_dissect_lsaclearauditlog_rqst(tvbuff_t *tvb, int offset,
1714         packet_info *pinfo, proto_tree *tree, char *drep)
1715 {
1716         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1717                 pinfo, tree, drep);
1718
1719         offset = dissect_ndr_nt_SID(tvb, offset,
1720                 pinfo, tree, drep, -1);
1721
1722         /* unknown */
1723         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1724                                      hf_lsa_unknown_long, NULL);
1725
1726         return offset;
1727 }
1728
1729
1730 static int
1731 lsa_dissect_lsaclearauditlog_reply(tvbuff_t *tvb, int offset,
1732         packet_info *pinfo, proto_tree *tree, char *drep)
1733 {
1734         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1735                 pinfo, tree, drep);
1736
1737         offset = dissect_ntstatus(
1738                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1739
1740         return offset;
1741 }
1742
1743 static int
1744 lsa_dissect_lsagetsystemaccessaccount_rqst(tvbuff_t *tvb, int offset,
1745         packet_info *pinfo, proto_tree *tree, char *drep)
1746 {
1747         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1748                 pinfo, tree, drep);
1749
1750         return offset;
1751 }
1752
1753
1754 static int
1755 lsa_dissect_lsagetsystemaccessaccount_reply(tvbuff_t *tvb, int offset,
1756         packet_info *pinfo, proto_tree *tree, char *drep)
1757 {
1758         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1759                                      hf_lsa_rid, NULL);
1760
1761         offset = dissect_ntstatus(
1762                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1763
1764         return offset;
1765 }
1766
1767
1768 static int
1769 lsa_dissect_lsasetsystemaccessaccount_rqst(tvbuff_t *tvb, int offset,
1770         packet_info *pinfo, proto_tree *tree, char *drep)
1771 {
1772         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1773                 pinfo, tree, drep);
1774
1775         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1776                 hf_lsa_rid, NULL);
1777
1778         return offset;
1779 }
1780
1781
1782 static int
1783 lsa_dissect_lsasetsystemaccessaccount_reply(tvbuff_t *tvb, int offset,
1784         packet_info *pinfo, proto_tree *tree, char *drep)
1785 {
1786         offset = dissect_ntstatus(
1787                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1788
1789         return offset;
1790 }
1791
1792
1793 static int
1794 lsa_dissect_lsaopentrusteddomain_rqst(tvbuff_t *tvb, int offset,
1795         packet_info *pinfo, proto_tree *tree, char *drep)
1796 {
1797         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1798                 pinfo, tree, drep);
1799
1800         offset = dissect_ndr_nt_SID(tvb, offset,
1801                 pinfo, tree, drep, -1);
1802
1803         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
1804                 pinfo, tree, drep);
1805
1806         return offset;
1807 }
1808
1809
1810 static int
1811 lsa_dissect_lsaopentrusteddomain_reply(tvbuff_t *tvb, int offset,
1812         packet_info *pinfo, proto_tree *tree, char *drep)
1813 {
1814         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1815                 pinfo, tree, drep);
1816
1817         offset = dissect_ntstatus(
1818                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1819
1820         return offset;
1821 }
1822
1823
1824 static int
1825 lsa_dissect_lsadeletetrusteddomain_rqst(tvbuff_t *tvb, int offset,
1826         packet_info *pinfo, proto_tree *tree, char *drep)
1827 {
1828         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1829                 pinfo, tree, drep);
1830
1831         offset = dissect_ndr_nt_SID(tvb, offset,
1832                 pinfo, tree, drep, -1);
1833
1834         return offset;
1835 }
1836
1837
1838 static int
1839 lsa_dissect_lsadeletetrusteddomain_reply(tvbuff_t *tvb, int offset,
1840         packet_info *pinfo, proto_tree *tree, char *drep)
1841 {
1842         offset = dissect_ntstatus(
1843                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1844
1845         return offset;
1846 }
1847
1848 int
1849 dissect_nt_LUID(tvbuff_t *tvb, int offset,
1850         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1851 {
1852         proto_item *item=NULL;
1853         proto_tree *tree=NULL;
1854         int old_offset=offset;
1855
1856         if(parent_tree){
1857                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1858                         "LUID:");
1859                 tree = proto_item_add_subtree(item, ett_LUID);
1860         }
1861
1862         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1863                 hf_nt_luid_low, NULL);
1864
1865         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1866                 hf_nt_luid_high, NULL);
1867
1868         proto_item_set_len(item, offset-old_offset);
1869         return offset;
1870 }
1871
1872 static int
1873 lsa_dissect_LSA_PRIVILEGE(tvbuff_t *tvb, int offset,
1874         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1875 {
1876         proto_item *item=NULL;
1877         proto_tree *tree=NULL;
1878         int old_offset=offset;
1879
1880         if(parent_tree){
1881                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1882                         "LSA_PRIVILEGE:");
1883                 tree = proto_item_add_subtree(item, ett_LSA_PRIVILEGE);
1884         }
1885
1886         /* privilege name */
1887         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1888                         hf_lsa_privilege_name, 0);
1889
1890         /* LUID */
1891         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
1892
1893         proto_item_set_len(item, offset-old_offset);
1894         return offset;
1895 }
1896
1897 static int
1898 lsa_dissect_LSA_PRIVILEGE_array(tvbuff_t *tvb, int offset,
1899         packet_info *pinfo, proto_tree *tree, char *drep)
1900 {
1901         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1902                 lsa_dissect_LSA_PRIVILEGE);
1903
1904         return offset;
1905 }
1906
1907 static int
1908 lsa_dissect_LSA_PRIVILEGES(tvbuff_t *tvb, int offset,
1909         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1910 {
1911         proto_item *item=NULL;
1912         proto_tree *tree=NULL;
1913         int old_offset=offset;
1914
1915         if(parent_tree){
1916                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1917                         "LSA_PRIVILEGES:");
1918                 tree = proto_item_add_subtree(item, ett_LSA_PRIVILEGES);
1919         }
1920
1921         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1922                 hf_lsa_count, NULL);
1923
1924         /* privileges */
1925         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1926                 lsa_dissect_LSA_PRIVILEGE_array, NDR_POINTER_UNIQUE,
1927                 "LSA_PRIVILEGE array:", -1);
1928
1929         proto_item_set_len(item, offset-old_offset);
1930         return offset;
1931 }
1932
1933 static int
1934 lsa_dissect_lsaenumerateprivileges_rqst(tvbuff_t *tvb, int offset,
1935         packet_info *pinfo, proto_tree *tree, char *drep)
1936 {
1937         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1938                 pinfo, tree, drep);
1939
1940         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1941                 hf_lsa_count, NULL);
1942
1943         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1944                 hf_lsa_size, NULL);
1945
1946         return offset;
1947 }
1948
1949 static int
1950 lsa_dissect_lsaenumerateprivileges_reply(tvbuff_t *tvb, int offset,
1951         packet_info *pinfo, proto_tree *tree, char *drep)
1952 {
1953         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1954                 hf_lsa_count, NULL);
1955
1956         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1957                 lsa_dissect_LSA_PRIVILEGES, NDR_POINTER_REF,
1958                 "LSA_PRIVILEGES pointer: privs", -1);
1959
1960         offset = dissect_ntstatus(
1961                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1962
1963         return offset;
1964 }
1965
1966 static int
1967 lsa_dissect_lsalookupprivilegevalue_rqst(tvbuff_t *tvb, int offset,
1968         packet_info *pinfo, proto_tree *tree, char *drep)
1969 {
1970         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
1971                 pinfo, tree, drep);
1972
1973         /* privilege name */
1974         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1975                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
1976                 "NAME pointer: ", hf_lsa_privilege_name);
1977
1978         return offset;
1979 }
1980
1981
1982 static int
1983 lsa_dissect_lsalookupprivilegevalue_reply(tvbuff_t *tvb, int offset,
1984         packet_info *pinfo, proto_tree *tree, char *drep)
1985 {
1986
1987         /* LUID */
1988         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
1989
1990         offset = dissect_ntstatus(
1991                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1992
1993         return offset;
1994 }
1995
1996
1997 static int
1998 lsa_dissect_lsalookupprivilegename_rqst(tvbuff_t *tvb, int offset,
1999         packet_info *pinfo, proto_tree *tree, char *drep)
2000 {
2001         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2002                 pinfo, tree, drep);
2003
2004         /* LUID */
2005         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2006                 dissect_nt_LUID, NDR_POINTER_REF,
2007                 "LUID pointer: value", -1);
2008
2009         return offset;
2010 }
2011
2012
2013 static int
2014 lsa_dissect_lsalookupprivilegename_reply(tvbuff_t *tvb, int offset,
2015         packet_info *pinfo, proto_tree *tree, char *drep)
2016 {
2017         /* [out, ref] LSA_UNICODE_STRING **name */
2018         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2019                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
2020                 "PRIVILEGE NAME pointer:", hf_lsa_privilege_name);
2021
2022         offset = dissect_ntstatus(
2023                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2024
2025         return offset;
2026 }
2027
2028
2029 static int
2030 lsa_dissect_lsaenumerateprivilegesaccount_rqst(tvbuff_t *tvb, int offset,
2031         packet_info *pinfo, proto_tree *tree, char *drep)
2032 {
2033         /* [in] LSA_HANDLE hnd */
2034         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2035                 pinfo, tree, drep);
2036
2037         return offset;
2038 }
2039
2040
2041 static int
2042 lsa_dissect_LUID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
2043         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2044 {
2045         proto_item *item=NULL;
2046         proto_tree *tree=NULL;
2047         int old_offset=offset;
2048
2049         if(parent_tree){
2050                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2051                         "LUID_AND_ATTRIBUTES:");
2052                 tree = proto_item_add_subtree(item, ett_LSA_LUID_AND_ATTRIBUTES);
2053         }
2054
2055         /* LUID */
2056         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
2057
2058         /* attr */
2059         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
2060                                      hf_lsa_attr, NULL);
2061
2062         proto_item_set_len(item, offset-old_offset);
2063         return offset;
2064 }
2065
2066 static int
2067 lsa_dissect_LUID_AND_ATTRIBUTES_array(tvbuff_t *tvb, int offset,
2068         packet_info *pinfo, proto_tree *tree, char *drep)
2069 {
2070         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2071                 lsa_dissect_LUID_AND_ATTRIBUTES);
2072
2073         return offset;
2074 }
2075
2076 static int
2077 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
2078         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2079 {
2080         proto_item *item=NULL;
2081         proto_tree *tree=NULL;
2082         int old_offset=offset;
2083
2084         if(parent_tree){
2085                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2086                         "LUID_AND_ATTRIBUTES_ARRAY:");
2087                 tree = proto_item_add_subtree(item, ett_LSA_LUID_AND_ATTRIBUTES_ARRAY);
2088         }
2089
2090         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2091                 hf_lsa_count, NULL);
2092
2093         /* luid and attributes */
2094         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2095                 lsa_dissect_LUID_AND_ATTRIBUTES_array, NDR_POINTER_UNIQUE,
2096                 "LUID_AND_ATTRIBUTES array:", -1);
2097
2098         proto_item_set_len(item, offset-old_offset);
2099         return offset;
2100 }
2101
2102 static int
2103 lsa_dissect_lsaenumerateprivilegesaccount_reply(tvbuff_t *tvb, int offset,
2104         packet_info *pinfo, proto_tree *tree, char *drep)
2105 {
2106         /* [out, ref] LUID_AND_ATTRIBUTES_ARRAY * *privs */
2107         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2108                 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
2109                 "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1);
2110
2111         offset = dissect_ntstatus(
2112                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2113
2114         return offset;
2115 }
2116
2117 static int
2118 lsa_dissect_lsaaddprivilegestoaccount_rqst(tvbuff_t *tvb, int offset,
2119         packet_info *pinfo, proto_tree *tree, char *drep)
2120 {
2121         /* [in] LSA_HANDLE hnd */
2122         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2123                 pinfo, tree, drep);
2124
2125         /* [in, ref] LUID_AND_ATTRIBUTES_ARRAY *privs */
2126         offset = lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY(tvb, offset,
2127                 pinfo, tree, drep);
2128
2129         return offset;
2130 }
2131
2132
2133 static int
2134 lsa_dissect_lsaaddprivilegestoaccount_reply(tvbuff_t *tvb, int offset,
2135         packet_info *pinfo, proto_tree *tree, char *drep)
2136 {
2137         offset = dissect_ntstatus(
2138                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2139
2140         return offset;
2141 }
2142
2143 static int
2144 lsa_dissect_lsaremoveprivilegesfromaccount_rqst(tvbuff_t *tvb, int offset,
2145         packet_info *pinfo, proto_tree *tree, char *drep)
2146 {
2147         /* [in] LSA_HANDLE hnd */
2148         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2149                 pinfo, tree, drep);
2150
2151         /* [in] char unknown */
2152         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
2153                         hf_lsa_unknown_char, NULL);
2154
2155         /* [in, unique] LUID_AND_ATTRIBUTES_ARRAY *privs */
2156         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2157                 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
2158                 "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1);
2159
2160         return offset;
2161 }
2162
2163
2164 static int
2165 lsa_dissect_lsaremoveprivilegesfromaccount_reply(tvbuff_t *tvb, int offset,
2166         packet_info *pinfo, proto_tree *tree, char *drep)
2167 {
2168         offset = dissect_ntstatus(
2169                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2170
2171         return offset;
2172 }
2173
2174 static int
2175 lsa_dissect_lsaenumerateaccounts_rqst(tvbuff_t *tvb, int offset,
2176         packet_info *pinfo, proto_tree *tree, char *drep)
2177 {
2178         /* [in] LSA_HANDLE hnd */
2179         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2180                 pinfo, tree, drep);
2181
2182         /* [in,out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2183         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2184                 hf_lsa_resume_handle, NULL);
2185
2186         /* [in] ULONG pref_maxlen */
2187         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2188                 hf_lsa_max_count, NULL);
2189
2190         return offset;
2191 }
2192
2193 static int
2194 lsa_dissect_lsaenumerateaccounts_reply(tvbuff_t *tvb, int offset,
2195         packet_info *pinfo, proto_tree *tree, char *drep)
2196 {
2197         /* [in,out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2198         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2199                 hf_lsa_resume_handle, NULL);
2200
2201         /* [out, ref] PSID_ARRAY **accounts */
2202         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2203                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
2204                         "PSID_ARRAY", -1);
2205
2206         offset = dissect_ntstatus(
2207                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2208
2209         return offset;
2210 }
2211
2212 static int
2213 lsa_dissect_lsacreatetrusteddomain_rqst(tvbuff_t *tvb, int offset,
2214         packet_info *pinfo, proto_tree *tree, char *drep)
2215 {
2216         /* [in] LSA_HANDLE hnd_pol */
2217         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2218                 pinfo, tree, drep);
2219
2220         /* [in, ref] LSA_TRUST_INFORMATION *domain */
2221         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2222                 lsa_dissect_LSA_TRUST_INFORMATION, NDR_POINTER_REF,
2223                 "LSA_TRUST_INFORMATION pointer: domain", -1);
2224
2225         /* [in] ACCESS_MASK access */
2226         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2227                 pinfo, tree, drep);
2228
2229         return offset;
2230 }
2231
2232 static int
2233 lsa_dissect_lsacreatetrusteddomain_reply(tvbuff_t *tvb, int offset,
2234         packet_info *pinfo, proto_tree *tree, char *drep)
2235 {
2236         /* [out] LSA_HANDLE *hnd */
2237         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2238                 pinfo, tree, drep);
2239
2240         offset = dissect_ntstatus(
2241                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2242
2243         return offset;
2244 }
2245
2246 static int
2247 lsa_dissect_lsaenumeratetrusteddomains_rqst(tvbuff_t *tvb, int offset,
2248         packet_info *pinfo, proto_tree *tree, char *drep)
2249 {
2250         /* [in] LSA_HANDLE hnd */
2251         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2252                 pinfo, tree, drep);
2253
2254         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2255         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2256                 hf_lsa_resume_handle, NULL);
2257
2258         /* [in] ULONG pref_maxlen */
2259         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2260                 hf_lsa_max_count, NULL);
2261
2262         return offset;
2263 }
2264
2265 static int
2266 lsa_dissect_LSA_TRUSTED_DOMAIN(tvbuff_t *tvb, int offset,
2267         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2268 {
2269         proto_item *item=NULL;
2270         proto_tree *tree=NULL;
2271         int old_offset=offset;
2272
2273         if(parent_tree){
2274                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2275                         "TRUSTED_DOMAIN:");
2276                 tree = proto_item_add_subtree(item, ett_LSA_TRUSTED_DOMAIN);
2277         }
2278
2279         /* domain */
2280         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2281                 hf_lsa_domain, 0);
2282
2283         /* sid */
2284         offset = dissect_ndr_nt_PSID(tvb, offset,
2285                 pinfo, tree, drep, -1);
2286
2287         proto_item_set_len(item, offset-old_offset);
2288         return offset;
2289 }
2290
2291 static int
2292 lsa_dissect_LSA_TRUSTED_DOMAIN_array(tvbuff_t *tvb, int offset,
2293         packet_info *pinfo, proto_tree *tree, char *drep)
2294 {
2295         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2296                 lsa_dissect_LSA_TRUSTED_DOMAIN);
2297
2298         return offset;
2299 }
2300
2301 static int
2302 lsa_dissect_LSA_TRUSTED_DOMAIN_LIST(tvbuff_t *tvb, int offset,
2303         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2304 {
2305         proto_item *item=NULL;
2306         proto_tree *tree=NULL;
2307         int old_offset=offset;
2308
2309         if(parent_tree){
2310                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2311                         "TRUSTED_DOMAIN_LIST:");
2312                 tree = proto_item_add_subtree(item, ett_LSA_TRUSTED_DOMAIN_LIST);
2313         }
2314
2315         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2316                 hf_lsa_count, NULL);
2317
2318         /* privileges */
2319         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2320                 lsa_dissect_LSA_TRUSTED_DOMAIN_array, NDR_POINTER_UNIQUE,
2321                 "TRUSTED_DOMAIN array:", -1);
2322
2323         proto_item_set_len(item, offset-old_offset);
2324         return offset;
2325 }
2326
2327 static int
2328 lsa_dissect_lsaenumeratetrusteddomains_reply(tvbuff_t *tvb, int offset,
2329         packet_info *pinfo, proto_tree *tree, char *drep)
2330 {
2331         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2332         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2333                 hf_lsa_resume_handle, NULL);
2334
2335         /* [out, ref] LSA_REFERENCED_DOMAIN_LIST *domains */
2336         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2337                 lsa_dissect_LSA_TRUSTED_DOMAIN_LIST, NDR_POINTER_REF,
2338                 "LSA_TRUSTED_DOMAIN_LIST pointer: domains", -1);
2339
2340         offset = dissect_ntstatus(
2341                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2342
2343         return offset;
2344 }
2345
2346
2347 static int
2348 lsa_dissect_LSA_UNICODE_STRING_item(tvbuff_t *tvb, int offset,
2349         packet_info *pinfo, proto_tree *tree, char *drep)
2350 {
2351         dcerpc_info *di;
2352
2353         di=pinfo->private_data;
2354         if(di->conformant_run){
2355                 /*just a run to handle conformant arrays, nothing to dissect */
2356                 return offset;
2357         }
2358
2359         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2360                         di->hf_index, 0);
2361
2362         return offset;
2363 }
2364
2365 static int
2366 lsa_dissect_LSA_UNICODE_STRING_array(tvbuff_t *tvb, int offset,
2367         packet_info *pinfo, proto_tree *tree, char *drep)
2368 {
2369         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2370                 lsa_dissect_LSA_UNICODE_STRING_item);
2371
2372         return offset;
2373 }
2374
2375 static int
2376 lsa_dissect_LSA_UNICODE_STRING_ARRAY(tvbuff_t *tvb, int offset,
2377         packet_info *pinfo, proto_tree *tree, char *drep)
2378 {
2379         dcerpc_info *di;
2380
2381         di=pinfo->private_data;
2382
2383         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2384                 hf_lsa_count, NULL);
2385         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2386                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_UNIQUE,
2387                 "UNICODE_STRING pointer: ", di->hf_index);
2388
2389         return offset;
2390 }
2391
2392 static int
2393 lsa_dissect_LSA_TRANSLATED_SID(tvbuff_t *tvb, int offset,
2394         packet_info *pinfo, proto_tree *tree, char *drep)
2395 {
2396         /* sid type */
2397         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2398                         hf_lsa_sid_type, NULL);
2399
2400         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2401                                      hf_lsa_rid, NULL);
2402
2403         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2404                                      hf_lsa_index, NULL);
2405
2406         return offset;
2407 }
2408
2409 static int
2410 lsa_dissect_LSA_TRANSLATED_SIDS_array(tvbuff_t *tvb, int offset,
2411         packet_info *pinfo, proto_tree *tree, char *drep)
2412 {
2413         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2414                 lsa_dissect_LSA_TRANSLATED_SID);
2415
2416         return offset;
2417 }
2418
2419 static int
2420 lsa_dissect_LSA_TRANSLATED_SIDS(tvbuff_t *tvb, int offset,
2421         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2422 {
2423         proto_item *item=NULL;
2424         proto_tree *tree=NULL;
2425         int old_offset=offset;
2426
2427         if(parent_tree){
2428                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2429                         "LSA_TRANSLATED_SIDS:");
2430                 tree = proto_item_add_subtree(item, ett_LSA_TRANSLATED_SIDS);
2431         }
2432
2433         /* count */
2434         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2435                                      hf_lsa_count, NULL);
2436
2437         /* settings */
2438         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2439                 lsa_dissect_LSA_TRANSLATED_SIDS_array, NDR_POINTER_UNIQUE,
2440                 "Translated SIDS", -1);
2441
2442         proto_item_set_len(item, offset-old_offset);
2443         return offset;
2444 }
2445
2446 static int
2447 lsa_dissect_lsalookupnames_rqst(tvbuff_t *tvb, int offset,
2448         packet_info *pinfo, proto_tree *tree, char *drep)
2449 {
2450         /* [in] LSA_HANDLE hnd */
2451         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2452                 pinfo, tree, drep);
2453
2454         /* [in] ULONG count */
2455         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2456                 hf_lsa_count, NULL);
2457
2458         /* [in, size_is(count), ref] LSA_UNICODE_STRING *names */
2459         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2460                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_REF,
2461                 "Account pointer: names", hf_lsa_acct);
2462
2463         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
2464         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2465                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
2466                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
2467
2468         /* [in] USHORT level */
2469         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2470                 hf_lsa_info_level, NULL);
2471
2472         /* [in, out, ref] ULONG *num_mapped */
2473         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2474                 hf_lsa_num_mapped, NULL);
2475
2476         return offset;
2477 }
2478
2479
2480 static int
2481 lsa_dissect_lsalookupnames_reply(tvbuff_t *tvb, int offset,
2482         packet_info *pinfo, proto_tree *tree, char *drep)
2483 {
2484         /* [out] LSA_REFERENCED_DOMAIN_LIST *domains */
2485         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2486                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
2487                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
2488
2489         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
2490         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2491                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
2492                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
2493
2494         /* [in, out, ref] ULONG *num_mapped */
2495         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2496                 hf_lsa_num_mapped, NULL);
2497
2498         offset = dissect_ntstatus(
2499                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2500
2501         return offset;
2502 }
2503
2504 static int
2505 lsa_dissect_lsacreatesecret_rqst(tvbuff_t *tvb, int offset,
2506         packet_info *pinfo, proto_tree *tree, char *drep)
2507 {
2508         /* [in] LSA_HANDLE hnd_pol */
2509         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2510                 pinfo, tree, drep);
2511
2512         /* [in, ref] LSA_UNICODE_STRING *name */
2513         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2514                 hf_lsa_name, 0);
2515
2516         /* [in] ACCESS_MASK access */
2517         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2518                 pinfo, tree, drep);
2519
2520         return offset;
2521 }
2522
2523 static int
2524 lsa_dissect_lsacreatesecret_reply(tvbuff_t *tvb, int offset,
2525         packet_info *pinfo, proto_tree *tree, char *drep)
2526 {
2527
2528         /* [out] LSA_HANDLE *hnd */
2529         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2530                 pinfo, tree, drep);
2531
2532         offset = dissect_ntstatus(
2533                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2534
2535         return offset;
2536 }
2537
2538 static int
2539 lsa_dissect_lsaopenaccount_rqst(tvbuff_t *tvb, int offset,
2540         packet_info *pinfo, proto_tree *tree, char *drep)
2541 {
2542         /* [in] LSA_HANDLE hnd_pol */
2543         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2544                 pinfo, tree, drep);
2545
2546         /* [in, ref] SID *account */
2547         offset = dissect_ndr_nt_SID(tvb, offset,
2548                 pinfo, tree, drep, -1);
2549
2550         /* [in] ACCESS_MASK access */
2551         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2552                 pinfo, tree, drep);
2553
2554         return offset;
2555 }
2556
2557
2558 static int
2559 lsa_dissect_lsaopenaccount_reply(tvbuff_t *tvb, int offset,
2560         packet_info *pinfo, proto_tree *tree, char *drep)
2561 {
2562         /* [out] LSA_HANDLE *hnd */
2563         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2564                 pinfo, tree, drep);
2565
2566         offset = dissect_ntstatus(
2567                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2568
2569         return offset;
2570 }
2571
2572 static const value_string trusted_info_level_vals[] = {
2573         {1,     "Domain Name Information"},
2574         {2,     "Controllers Information"},
2575         {3,     "Posix Offset Information"},
2576         {4,     "Password Information"},
2577         {5,     "Domain Information Basic"},
2578         {6,     "Domain Information Ex"},
2579         {7,     "Domain Auth Information"},
2580         {8,     "Domain Full Information"},
2581         {9,     "Domain Security Descriptor"},
2582         {10,    "Domain Private Information"},
2583         {0,     NULL}
2584 };
2585
2586 static int
2587 lsa_dissect_TRUSTED_DOMAIN_INFORMATION(tvbuff_t *tvb, int offset,
2588         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2589 {
2590         proto_item *item=NULL;
2591         proto_tree *tree=NULL;
2592         int old_offset=offset;
2593         guint16 level;
2594
2595         if(parent_tree){
2596                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2597                         "TRUSTED_DOMAIN_INFO:");
2598                 tree = proto_item_add_subtree(item, ett_lsa_trusted_domain_info);
2599         }
2600
2601         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2602                                      hf_lsa_trusted_info_level, &level);
2603
2604         ALIGN_TO_4_BYTES;  /* all union arms aligned to 4 bytes, case 7 and 9 need this  */
2605         switch(level){
2606         case 1:
2607                 offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2608                         hf_lsa_domain, 0);
2609                 break;
2610         case 2:
2611                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2612                         hf_lsa_count, NULL);
2613                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2614                         lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_UNIQUE,
2615                         "Controllers pointer: ", hf_lsa_controller);
2616                 break;
2617         case 3:
2618                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2619                         hf_lsa_rid_offset, NULL);
2620                 break;
2621         case 4:
2622                 offset = lsa_dissect_LSA_SECRET(tvb, offset, pinfo, tree, drep);
2623                 offset = lsa_dissect_LSA_SECRET(tvb, offset, pinfo, tree, drep);
2624                 break;
2625         case 5:
2626                 offset = lsa_dissect_LSA_TRUST_INFORMATION(tvb, offset,
2627                         pinfo, tree, drep);
2628                 break;
2629         case 6:
2630                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2631                         pinfo, tree, drep);
2632                 break;
2633         case 7:
2634                 offset = lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvb, offset, pinfo, tree, drep);
2635                 break;
2636         case 8:
2637                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2638                         pinfo, tree, drep);
2639                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2640                         hf_lsa_rid_offset, NULL);
2641                 offset = lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvb, offset, pinfo, tree, drep);
2642                 break;
2643         case 9:
2644                 offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset, pinfo, tree, drep);
2645                 break;
2646         case 10:
2647                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2648                         pinfo, tree, drep);
2649                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2650                         hf_lsa_rid_offset, NULL);
2651                 offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset, pinfo, tree, drep);
2652                 break;
2653         }
2654
2655         proto_item_set_len(item, offset-old_offset);
2656         return offset;
2657 }
2658
2659 static int
2660 lsa_dissect_lsaqueryinfotrusteddomain_rqst(tvbuff_t *tvb, int offset,
2661         packet_info *pinfo, proto_tree *tree, char *drep)
2662 {
2663         /* [in] LSA_HANDLE hnd */
2664         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2665                 pinfo, tree, drep);
2666
2667         /* [in] TRUSTED_INFORMATION_CLASS level */
2668         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2669                 hf_lsa_trusted_info_level, NULL);
2670
2671         return offset;
2672 }
2673
2674
2675 static int
2676 lsa_dissect_lsaqueryinfotrusteddomain_reply(tvbuff_t *tvb, int offset,
2677         packet_info *pinfo, proto_tree *tree, char *drep)
2678 {
2679         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info */
2680         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2681                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
2682                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
2683
2684         offset = dissect_ntstatus(
2685                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2686
2687         return offset;
2688 }
2689
2690 static int
2691 lsa_dissect_lsasetinformationtrusteddomain_rqst(tvbuff_t *tvb, int offset,
2692         packet_info *pinfo, proto_tree *tree, char *drep)
2693 {
2694         /* [in] LSA_HANDLE hnd */
2695         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2696                 pinfo, tree, drep);
2697
2698         /* [in] TRUSTED_INFORMATION_CLASS level */
2699         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2700                 hf_lsa_trusted_info_level, NULL);
2701
2702         /* [in, ref] TRUSTED_DOMAIN_INFORMATION *info */
2703         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2704                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
2705                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
2706
2707         return offset;
2708 }
2709
2710
2711 static int
2712 lsa_dissect_lsasetinformationtrusteddomain_reply(tvbuff_t *tvb, int offset,
2713         packet_info *pinfo, proto_tree *tree, char *drep)
2714 {
2715         offset = dissect_ntstatus(
2716                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2717
2718         return offset;
2719 }
2720
2721 static int
2722 lsa_dissect_lsaopensecret_rqst(tvbuff_t *tvb, int offset,
2723         packet_info *pinfo, proto_tree *tree, char *drep)
2724 {
2725         /* [in] LSA_HANDLE hnd_pol */
2726         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2727                 pinfo, tree, drep);
2728
2729         /* [in, ref] LSA_UNICODE_STRING *name */
2730         offset = dissect_ndr_counted_string_cb(
2731                 tvb, offset, pinfo, tree, drep, hf_lsa_name,
2732                 cb_wstr_postprocess,
2733                 GINT_TO_POINTER(CB_STR_COL_INFO | 1));
2734
2735         /* [in] ACCESS_MASK access */
2736         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2737                 pinfo, tree, drep);
2738
2739         return offset;
2740 }
2741
2742
2743 static int
2744 lsa_dissect_lsaopensecret_reply(tvbuff_t *tvb, int offset,
2745         packet_info *pinfo, proto_tree *tree, char *drep)
2746 {
2747         /* [out] LSA_HANDLE *hnd */
2748         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2749                 pinfo, tree, drep);
2750
2751         offset = dissect_ntstatus(
2752                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2753
2754         return offset;
2755 }
2756
2757 static int
2758 lsa_dissect_lsasetsecret_rqst(tvbuff_t *tvb, int offset,
2759         packet_info *pinfo, proto_tree *tree, char *drep)
2760 {
2761         /* [in] LSA_HANDLE hnd */
2762         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2763                 pinfo, tree, drep);
2764
2765         /* [in, unique] LSA_SECRET *new_val */
2766         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2767                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2768                 "LSA_SECRET pointer: new_val", -1);
2769
2770         /* [in, unique] LSA_SECRET *old_val */
2771         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2772                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2773                 "LSA_SECRET pointer: old_val", -1);
2774
2775         return offset;
2776 }
2777
2778
2779 static int
2780 lsa_dissect_lsasetsecret_reply(tvbuff_t *tvb, int offset,
2781         packet_info *pinfo, proto_tree *tree, char *drep)
2782 {
2783         offset = dissect_ntstatus(
2784                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2785
2786         return offset;
2787 }
2788
2789 static int
2790 lsa_dissect_lsaquerysecret_rqst(tvbuff_t *tvb, int offset,
2791         packet_info *pinfo, proto_tree *tree, char *drep)
2792 {
2793         /* [in] LSA_HANDLE hnd */
2794         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2795                 pinfo, tree, drep);
2796
2797         /* [in, out, unique] LSA_SECRET **curr_val */
2798         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2799                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2800                 "LSA_SECRET pointer: curr_val", -1);
2801
2802         /* [in, out, unique] LARGE_INTEGER *curr_mtime */
2803         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2804                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2805                 "NTIME pointer: old_mtime", hf_lsa_cur_mtime);
2806
2807         /* [in, out, unique] LSA_SECRET **old_val */
2808         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2809                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2810                 "LSA_SECRET pointer: old_val", -1);
2811
2812         /* [in, out, unique] LARGE_INTEGER *old_mtime */
2813         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2814                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2815                 "NTIME pointer: old_mtime", hf_lsa_old_mtime);
2816
2817         return offset;
2818 }
2819
2820
2821 static int
2822 lsa_dissect_lsaquerysecret_reply(tvbuff_t *tvb, int offset,
2823         packet_info *pinfo, proto_tree *tree, char *drep)
2824 {
2825         /* [in, out, unique] LSA_SECRET **curr_val */
2826         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2827                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2828                 "LSA_SECRET pointer: curr_val", -1);
2829
2830         /* [in, out, unique] LARGE_INTEGER *curr_mtime */
2831         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2832                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2833                 "NTIME pointer: old_mtime", hf_lsa_cur_mtime);
2834
2835         /* [in, out, unique] LSA_SECRET **old_val */
2836         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2837                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2838                 "LSA_SECRET pointer: old_val", -1);
2839
2840         /* [in, out, unique] LARGE_INTEGER *old_mtime */
2841         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2842                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2843                 "NTIME pointer: old_mtime", hf_lsa_old_mtime);
2844
2845         return offset;
2846 }
2847
2848 static int
2849 lsa_dissect_lsadeleteobject_rqst(tvbuff_t *tvb, int offset,
2850         packet_info *pinfo, proto_tree *tree, char *drep)
2851 {
2852         /* [in] LSA_HANDLE hnd */
2853         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2854                 pinfo, tree, drep);
2855
2856         return offset;
2857 }
2858
2859
2860 static int
2861 lsa_dissect_lsadeleteobject_reply(tvbuff_t *tvb, int offset,
2862         packet_info *pinfo, proto_tree *tree, char *drep)
2863 {
2864         offset = dissect_ntstatus(
2865                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2866
2867         return offset;
2868 }
2869
2870 static int
2871 lsa_dissect_lsaenumerateaccountswithuserright_rqst(tvbuff_t *tvb, int offset,
2872         packet_info *pinfo, proto_tree *tree, char *drep)
2873 {
2874         /* [in] LSA_HANDLE hnd */
2875         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2876                 pinfo, tree, drep);
2877
2878         /* [in, unique] LSA_UNICODE_STRING *rights */
2879         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2880                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
2881                 "LSA_UNICODE_STRING pointer: rights", hf_lsa_rights);
2882
2883         return offset;
2884 }
2885
2886 static int
2887 lsa_dissect_lsaenumerateaccountswithuserright_reply(tvbuff_t *tvb, int offset,
2888         packet_info *pinfo, proto_tree *tree, char *drep)
2889 {
2890         /* [out, ref] LSA_UNICODE_STRING_ARRAY *accounts */
2891         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2892                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2893                 "Account pointer: names", hf_lsa_acct);
2894
2895         offset = dissect_ntstatus(
2896                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2897
2898         return offset;
2899 }
2900
2901 static int
2902 lsa_dissect_lsaenumerateaccountrights_rqst(tvbuff_t *tvb, int offset,
2903         packet_info *pinfo, proto_tree *tree, char *drep)
2904 {
2905         /* [in] LSA_HANDLE hnd */
2906         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2907                 pinfo, tree, drep);
2908
2909         /* [in, ref] SID *account */
2910         offset = dissect_ndr_nt_SID(tvb, offset,
2911                 pinfo, tree, drep, -1);
2912
2913         return offset;
2914 }
2915
2916
2917 static int
2918 lsa_dissect_lsaenumerateaccountrights_reply(tvbuff_t *tvb, int offset,
2919         packet_info *pinfo, proto_tree *tree, char *drep)
2920 {
2921         /* [out, ref] LSA_UNICODE_STRING_ARRAY *rights */
2922         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2923                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2924                 "Account pointer: rights", hf_lsa_rights);
2925
2926         offset = dissect_ntstatus(
2927                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2928
2929         return offset;
2930 }
2931
2932 static int
2933 lsa_dissect_lsaaddaccountrights_rqst(tvbuff_t *tvb, int offset,
2934         packet_info *pinfo, proto_tree *tree, char *drep)
2935 {
2936         /* [in] LSA_HANDLE hnd */
2937         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2938                 pinfo, tree, drep);
2939
2940         /* [in, ref] SID *account */
2941         offset = dissect_ndr_nt_SID(tvb, offset,
2942                 pinfo, tree, drep, -1);
2943
2944         /* [in, ref] LSA_UNICODE_STRING_ARRAY *rights */
2945         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2946                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2947                 "Account pointer: rights", hf_lsa_rights);
2948
2949         return offset;
2950 }
2951
2952
2953 static int
2954 lsa_dissect_lsaaddaccountrights_reply(tvbuff_t *tvb, int offset,
2955         packet_info *pinfo, proto_tree *tree, char *drep)
2956 {
2957         offset = dissect_ntstatus(
2958                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2959
2960         return offset;
2961 }
2962
2963 static int
2964 lsa_dissect_lsaremoveaccountrights_rqst(tvbuff_t *tvb, int offset,
2965         packet_info *pinfo, proto_tree *tree, char *drep)
2966 {
2967         /* [in] LSA_HANDLE hnd */
2968         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
2969                 pinfo, tree, drep);
2970
2971         /* [in, ref] SID *account */
2972         offset = dissect_ndr_nt_SID(tvb, offset,
2973                 pinfo, tree, drep, -1);
2974
2975         /* remove all */
2976         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
2977                         hf_lsa_remove_all, NULL);
2978
2979         /* [in, ref] LSA_UNICODE_STRING_ARRAY *rights */
2980         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2981                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2982                 "Account pointer: rights", hf_lsa_rights);
2983
2984         return offset;
2985 }
2986
2987
2988 static int
2989 lsa_dissect_lsaremoveaccountrights_reply(tvbuff_t *tvb, int offset,
2990         packet_info *pinfo, proto_tree *tree, char *drep)
2991 {
2992         offset = dissect_ntstatus(
2993                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2994
2995         return offset;
2996 }
2997
2998
2999 static int
3000 lsa_dissect_lsaquerytrusteddomaininfobyname_rqst(tvbuff_t *tvb, int offset,
3001         packet_info *pinfo, proto_tree *tree, char *drep)
3002 {
3003         /* [in] LSA_HANDLE handle */
3004         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3005                 pinfo, tree, drep);
3006
3007         /* [in, ref] LSA_UNICODE_STRING *name */
3008         /* domain */
3009         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3010                 hf_lsa_domain, 0);
3011
3012         /* [in] TRUSTED_INFORMATION_CLASS level */
3013         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3014                                      hf_lsa_trusted_info_level, NULL);
3015
3016         return offset;
3017 }
3018
3019
3020 static int
3021 lsa_dissect_lsaquerytrusteddomaininfobyname_reply(tvbuff_t *tvb, int offset,
3022         packet_info *pinfo, proto_tree *tree, char *drep)
3023 {
3024         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3025         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3026                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3027                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3028
3029         offset = dissect_ntstatus(
3030                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3031
3032         return offset;
3033 }
3034
3035
3036 static int
3037 lsa_dissect_lsasettrusteddomaininfobyname_rqst(tvbuff_t *tvb, int offset,
3038         packet_info *pinfo, proto_tree *tree, char *drep)
3039 {
3040         /* [in] LSA_HANDLE handle */
3041         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3042                 pinfo, tree, drep);
3043
3044         /* [in, ref] LSA_UNICODE_STRING *name */
3045         /* domain */
3046         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3047                 hf_lsa_domain, 0);
3048
3049         /* [in] TRUSTED_INFORMATION_CLASS level */
3050         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3051                                      hf_lsa_trusted_info_level, NULL);
3052
3053         /* [in, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3054         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3055                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3056                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3057
3058         return offset;
3059 }
3060
3061
3062 static int
3063 lsa_dissect_lsasettrusteddomaininfobyname_reply(tvbuff_t *tvb, int offset,
3064         packet_info *pinfo, proto_tree *tree, char *drep)
3065 {
3066         offset = dissect_ntstatus(
3067                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3068
3069         return offset;
3070 }
3071
3072 static int
3073 lsa_dissect_lsaquerytrusteddomaininfo_rqst(tvbuff_t *tvb, int offset,
3074         packet_info *pinfo, proto_tree *tree, char *drep)
3075 {
3076         /* [in] LSA_HANDLE handle */
3077         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3078                 pinfo, tree, drep);
3079
3080         /* [in, ref] SID *sid */
3081         offset = dissect_ndr_nt_SID(tvb, offset,
3082                 pinfo, tree, drep, -1);
3083
3084         /* [in] TRUSTED_INFORMATION_CLASS level */
3085         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3086                                      hf_lsa_trusted_info_level, NULL);
3087
3088         return offset;
3089 }
3090
3091 static int
3092 lsa_dissect_lsaopentrusteddomainbyname_rqst(tvbuff_t *tvb, int offset,
3093         packet_info *pinfo, proto_tree *tree, char *drep)
3094 {
3095         /* [in] LSA_HANDLE handle */
3096         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3097                 pinfo, tree, drep);
3098
3099         /* [in, ref] LSA_UNICODE_STRING *name */
3100         /* domain */
3101         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3102                 hf_lsa_domain, 0);
3103
3104         /* [in] ACCESS_MASK access */
3105         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3106                 pinfo, tree, drep);
3107
3108         return offset;
3109 }
3110
3111
3112 static int
3113 lsa_dissect_lsaopentrusteddomainbyname_reply(tvbuff_t *tvb, int offset,
3114         packet_info *pinfo, proto_tree *tree, char *drep)
3115 {
3116         /* [out] LSA_HANDLE handle */
3117         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3118                 pinfo, tree, drep);
3119
3120         offset = dissect_ntstatus(
3121                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3122
3123         return offset;
3124 }
3125
3126
3127
3128 static int
3129 lsa_dissect_lsaquerytrusteddomaininfo_reply(tvbuff_t *tvb, int offset,
3130         packet_info *pinfo, proto_tree *tree, char *drep)
3131 {
3132         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3133         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3134                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3135                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3136
3137         offset = dissect_ntstatus(
3138                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3139
3140         return offset;
3141 }
3142
3143 static int
3144 lsa_dissect_lsasettrusteddomaininfo_rqst(tvbuff_t *tvb, int offset,
3145         packet_info *pinfo, proto_tree *tree, char *drep)
3146 {
3147         /* [in] LSA_HANDLE handle */
3148         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3149                 pinfo, tree, drep);
3150
3151         /* [in, ref] SID *sid */
3152         offset = dissect_ndr_nt_SID(tvb, offset,
3153                 pinfo, tree, drep, -1);
3154
3155         /* [in] TRUSTED_INFORMATION_CLASS level */
3156         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3157                                      hf_lsa_trusted_info_level, NULL);
3158
3159         /* [ref, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3160         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3161                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3162                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3163
3164         return offset;
3165 }
3166
3167
3168 static int
3169 lsa_dissect_lsasettrusteddomaininfo_reply(tvbuff_t *tvb, int offset,
3170         packet_info *pinfo, proto_tree *tree, char *drep)
3171 {
3172         offset = dissect_ntstatus(
3173                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3174
3175         return offset;
3176 }
3177
3178 static int
3179 lsa_dissect_lsaqueryinformationpolicy2_rqst(tvbuff_t *tvb, int offset,
3180         packet_info *pinfo, proto_tree *tree, char *drep)
3181 {
3182         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3183                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
3184                 "LSA_HANDLE", -1);
3185
3186         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3187                 hf_lsa_policy_information_class, NULL);
3188
3189         return offset;
3190 }
3191
3192 static int
3193 lsa_dissect_lsaqueryinformationpolicy2_reply(tvbuff_t *tvb, int offset,
3194         packet_info *pinfo, proto_tree *tree, char *drep)
3195 {
3196         /* This is really a pointer to a pointer though the first level is REF
3197           so we just ignore that one */
3198         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3199                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_UNIQUE,
3200                 "POLICY_INFORMATION pointer: info", -1);
3201
3202         offset = dissect_ntstatus(
3203                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3204
3205         return offset;
3206 }
3207
3208 static int
3209 lsa_dissect_lsasetinformationpolicy2_rqst(tvbuff_t *tvb, int offset,
3210         packet_info *pinfo, proto_tree *tree, char *drep)
3211 {
3212         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3213                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
3214                 "LSA_HANDLE", -1);
3215
3216         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3217                 hf_lsa_policy_information_class, NULL);
3218
3219         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3220                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3221                 "POLICY_INFORMATION pointer: info", -1);
3222
3223         return offset;
3224 }
3225
3226 static int
3227 lsa_dissect_lsasetinformationpolicy2_reply(tvbuff_t *tvb, int offset,
3228         packet_info *pinfo, proto_tree *tree, char *drep)
3229 {
3230         offset = dissect_ntstatus(
3231                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3232
3233         return offset;
3234 }
3235
3236 static int
3237 lsa_dissect_lsaquerydomaininformationpolicy_rqst(tvbuff_t *tvb, int offset,
3238         packet_info *pinfo, proto_tree *tree, char *drep)
3239 {
3240         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3241                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
3242                 "LSA_HANDLE", -1);
3243
3244         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3245                 hf_lsa_policy_information_class, NULL);
3246
3247         return offset;
3248 }
3249
3250 static int
3251 lsa_dissect_lsaquerydomaininformationpolicy_reply(tvbuff_t *tvb, int offset,
3252         packet_info *pinfo, proto_tree *tree, char *drep)
3253 {
3254         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3255                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3256                 "POLICY_INFORMATION pointer: info", -1);
3257
3258         offset = dissect_ntstatus(
3259                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3260
3261         return offset;
3262 }
3263
3264 static int
3265 lsa_dissect_lsasetdomaininformationpolicy_rqst(tvbuff_t *tvb, int offset,
3266         packet_info *pinfo, proto_tree *tree, char *drep)
3267 {
3268         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3269                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
3270                 "LSA_HANDLE", -1);
3271
3272         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3273                 hf_lsa_policy_information_class, NULL);
3274
3275         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3276                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3277                 "POLICY_INFORMATION pointer: info", -1);
3278
3279         return offset;
3280 }
3281
3282 static int
3283 lsa_dissect_lsasetdomaininformationpolicy_reply(tvbuff_t *tvb, int offset,
3284         packet_info *pinfo, proto_tree *tree, char *drep)
3285 {
3286         offset = dissect_ntstatus(
3287                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3288
3289         return offset;
3290 }
3291
3292 static int
3293 lsa_dissect_lsalookupnames2_rqst(tvbuff_t *tvb, int offset,
3294         packet_info *pinfo, proto_tree *tree, char *drep)
3295 {
3296         /* [in] LSA_HANDLE hnd */
3297         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3298                 pinfo, tree, drep);
3299
3300         /* [in] ULONG count */
3301         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3302                 hf_lsa_count, NULL);
3303
3304         /* [in, size_is(count), ref] LSA_UNICODE_STRING *names */
3305         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3306                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_REF,
3307                 "Account pointer: names", hf_lsa_acct);
3308
3309         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
3310         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3311                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
3312                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
3313
3314         /* [in] USHORT level */
3315         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3316                 hf_lsa_info_level, NULL);
3317
3318         /* [in, out, ref] ULONG *num_mapped */
3319         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3320                 hf_lsa_num_mapped, NULL);
3321
3322         /* unknown */
3323         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3324                                      hf_lsa_unknown_long, NULL);
3325
3326         /* unknown */
3327         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3328                                      hf_lsa_unknown_long, NULL);
3329
3330         return offset;
3331 }
3332
3333
3334 static int
3335 lsa_dissect_lsalookupnames2_reply(tvbuff_t *tvb, int offset,
3336         packet_info *pinfo, proto_tree *tree, char *drep)
3337 {
3338         /* [out] LSA_REFERENCED_DOMAIN_LIST *domains */
3339         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3340                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
3341                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
3342
3343         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
3344         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3345                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
3346                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
3347
3348         /* [in, out, ref] ULONG *num_mapped */
3349         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3350                 hf_lsa_num_mapped, NULL);
3351
3352         offset = dissect_ntstatus(
3353                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3354
3355         return offset;
3356 }
3357
3358
3359 static int
3360 lsa_dissect_lsacreateaccount_rqst(tvbuff_t *tvb, int offset,
3361         packet_info *pinfo, proto_tree *tree, char *drep)
3362 {
3363         /* [in] LSA_HANDLE hnd */
3364         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3365                 pinfo, tree, drep);
3366
3367         offset = dissect_ndr_nt_SID(tvb, offset,
3368                 pinfo, tree, drep, -1);
3369
3370         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3371                 pinfo, tree, drep);
3372
3373         return offset;
3374 }
3375
3376 static int
3377 lsa_dissect_lsacreateaccount_reply(tvbuff_t *tvb, int offset,
3378         packet_info *pinfo, proto_tree *tree, char *drep)
3379 {
3380         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3381                 pinfo, tree, drep);
3382
3383         offset = dissect_ntstatus(
3384                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3385
3386         return offset;
3387 }
3388
3389 static int
3390 lsa_dissect_lsalookupprivilegedisplayname_rqst(tvbuff_t *tvb, int offset,
3391         packet_info *pinfo, proto_tree *tree, char *drep)
3392 {
3393         /* [in] LSA_HANDLE hnd */
3394         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3395                 pinfo, tree, drep);
3396
3397         /* [in, ref] LSA_UNICODE_STRING *name */
3398         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3399                 hf_lsa_name, 0);
3400
3401         /* [in] USHORT unknown */
3402         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3403                 hf_lsa_unknown_short, NULL);
3404
3405         /* [in] USHORT size */
3406         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3407                 hf_lsa_size16, NULL);
3408
3409         return offset;
3410 }
3411
3412
3413 static int
3414 lsa_dissect_lsalookupprivilegedisplayname_reply(tvbuff_t *tvb, int offset,
3415         packet_info *pinfo, proto_tree *tree, char *drep)
3416 {
3417         /* [out, ref] LSA_UNICODE_STRING **disp_name */
3418         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3419                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3420                 "NAME pointer: ", hf_lsa_privilege_name);
3421
3422         /* [out, ref] USHORT *size_needed */
3423         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3424                 hf_lsa_size_needed, NULL);
3425
3426         offset = dissect_ntstatus(
3427                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3428
3429         return offset;
3430 }
3431
3432 static int
3433 lsa_dissect_lsastoreprivatedata_rqst(tvbuff_t *tvb, int offset,
3434         packet_info *pinfo, proto_tree *tree, char *drep)
3435 {
3436         /* [in] LSA_HANDLE hnd */
3437         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3438                 pinfo, tree, drep);
3439
3440         /* [in, ref] LSA_UNICODE_STRING *key */
3441         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3442                 hf_lsa_key, 0);
3443
3444         /* [in, unique] LSA_SECRET **data */
3445         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3446                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
3447                 "LSA_SECRET* pointer: data", -1);
3448
3449         return offset;
3450 }
3451
3452
3453 static int
3454 lsa_dissect_lsastoreprivatedata_reply(tvbuff_t *tvb, int offset,
3455         packet_info *pinfo, proto_tree *tree, char *drep)
3456 {
3457         offset = dissect_ntstatus(
3458                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3459
3460         return offset;
3461 }
3462
3463 static int
3464 lsa_dissect_lsaretrieveprivatedata_rqst(tvbuff_t *tvb, int offset,
3465         packet_info *pinfo, proto_tree *tree, char *drep)
3466 {
3467         /* [in] LSA_HANDLE hnd */
3468         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3469                 pinfo, tree, drep);
3470
3471         /* [in, ref] LSA_UNICODE_STRING *key */
3472         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3473                 hf_lsa_key, 0);
3474
3475         /* [in, out, ref] LSA_SECRET **data */
3476         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3477                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_REF,
3478                 "LSA_SECRET* pointer: data", -1);
3479
3480         return offset;
3481 }
3482
3483
3484 static int
3485 lsa_dissect_lsaretrieveprivatedata_reply(tvbuff_t *tvb, int offset,
3486         packet_info *pinfo, proto_tree *tree, char *drep)
3487 {
3488         /* [in, out, ref] LSA_SECRET **data */
3489         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3490                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_REF,
3491                 "LSA_SECRET* pointer: data", -1);
3492
3493         offset = dissect_ntstatus(
3494                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3495
3496         return offset;
3497 }
3498
3499 static int
3500 lsa_dissect_lsaclosetrusteddomainex_rqst(tvbuff_t *tvb, int offset,
3501         packet_info *pinfo, proto_tree *tree, char *drep)
3502 {
3503
3504         /* [in, out] LSA_HANDLE *tdHnd */
3505         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3506                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
3507                 "LSA_HANDLE", -1);
3508
3509         return offset;
3510 }
3511
3512
3513 static int
3514 lsa_dissect_lsaclosetrusteddomainex_reply(tvbuff_t *tvb, int offset,
3515         packet_info *pinfo, proto_tree *tree, char *drep)
3516 {
3517
3518         /* [in, out] LSA_HANDLE *tdHnd */
3519         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3520                 lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
3521                 "LSA_HANDLE", -1);
3522
3523         offset = dissect_ntstatus(
3524                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3525
3526         return offset;
3527 }
3528
3529 static int
3530 lsa_dissect_LSA_TRANSLATED_NAME_EX(tvbuff_t *tvb, int offset,
3531         packet_info *pinfo, proto_tree *parent_tree, char *drep)
3532 {
3533         proto_item *item=NULL;
3534         proto_tree *tree=NULL;
3535         int old_offset=offset;
3536
3537         if(parent_tree){
3538                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3539                         "LSA_TRANSLATED_NAME:");
3540                 tree = proto_item_add_subtree(item, ett_lsa_translated_name);
3541         }
3542
3543         /* sid type */
3544         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3545                         hf_lsa_sid_type, NULL);
3546
3547         /* name */
3548         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3549                 hf_lsa_name, 0);
3550
3551         /* index */
3552         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3553                                      hf_lsa_index, NULL);
3554
3555         /* unknown */
3556         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3557                                      hf_lsa_unknown_long, NULL);
3558
3559         proto_item_set_len(item, offset-old_offset);
3560         return offset;
3561 }
3562
3563 static int
3564 lsa_dissect_LSA_TRANSLATED_NAME_EX_array(tvbuff_t *tvb, int offset,
3565         packet_info *pinfo, proto_tree *tree, char *drep)
3566 {
3567         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3568                 lsa_dissect_LSA_TRANSLATED_NAME_EX);
3569
3570         return offset;
3571 }
3572 static int
3573 lsa_dissect_LSA_TRANSLATED_NAMES_EX(tvbuff_t *tvb, int offset,
3574         packet_info *pinfo, proto_tree *tree, char *drep)
3575 {
3576         /* count */
3577         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3578                                      hf_lsa_count, NULL);
3579
3580         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3581                         lsa_dissect_LSA_TRANSLATED_NAME_EX_array, NDR_POINTER_UNIQUE,
3582                         "LSA_TRANSLATED_NAME_EX: pointer", -1);
3583
3584         return offset;
3585 }
3586
3587
3588 static int
3589 lsa_dissect_lsalookupsids2_rqst(tvbuff_t *tvb, int offset,
3590         packet_info *pinfo, proto_tree *tree, char *drep)
3591 {
3592         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3593                 pinfo, tree, drep);
3594
3595         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3596                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
3597                         "PSID_ARRAY", -1);
3598
3599         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3600                 lsa_dissect_LSA_TRANSLATED_NAMES_EX, NDR_POINTER_REF,
3601                 "LSA_TRANSLATED_NAMES_EX pointer: names", -1);
3602
3603         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3604                 hf_lsa_info_level, NULL);
3605
3606         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3607                 hf_lsa_num_mapped, NULL);
3608
3609         /* unknown */
3610         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3611                                      hf_lsa_unknown_long, NULL);
3612
3613         /* unknown */
3614         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3615                                      hf_lsa_unknown_long, NULL);
3616
3617         return offset;
3618 }
3619
3620 static int
3621 lsa_dissect_lsalookupsids2_reply(tvbuff_t *tvb, int offset,
3622         packet_info *pinfo, proto_tree *tree, char *drep)
3623 {
3624         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3625                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
3626                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
3627
3628         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3629                 lsa_dissect_LSA_TRANSLATED_NAMES_EX, NDR_POINTER_REF,
3630                 "LSA_TRANSLATED_NAMES_EX pointer: names", -1);
3631
3632         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3633                 hf_lsa_num_mapped, NULL);
3634
3635         offset = dissect_ntstatus(
3636                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3637
3638         return offset;
3639 }
3640
3641 static int
3642 lsa_dissect_lsagetusername_rqst(tvbuff_t *tvb, int offset,
3643         packet_info *pinfo, proto_tree *tree, char *drep)
3644 {
3645
3646         /* [in, unique, string] WCHAR *server */
3647         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3648                 dissect_lsa_openpolicy_server, NDR_POINTER_UNIQUE,
3649                 "Server:", hf_lsa_server);
3650
3651         /* [in, out, ref] LSA_UNICODE_STRING **user */
3652         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3653                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3654                 "ACCOUNT pointer: ", hf_lsa_acct);
3655
3656         /* [in, out, unique] LSA_UNICODE_STRING **domain */
3657         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3658                 lsa_dissect_pointer_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3659                 "DOMAIN pointer: ", hf_lsa_domain);
3660
3661         return offset;
3662 }
3663
3664
3665 static int
3666 lsa_dissect_lsagetusername_reply(tvbuff_t *tvb, int offset,
3667         packet_info *pinfo, proto_tree *tree, char *drep)
3668 {
3669         /* [in, out, ref] LSA_UNICODE_STRING **user */
3670         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3671                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3672                 "ACCOUNT pointer: ", hf_lsa_acct);
3673
3674         /* [in, out, unique] LSA_UNICODE_STRING **domain */
3675         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3676                 lsa_dissect_pointer_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3677                 "DOMAIN pointer: ", hf_lsa_domain);
3678
3679         offset = dissect_ntstatus(
3680                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3681
3682         return offset;
3683 }
3684
3685 static int
3686 lsa_dissect_lsacreatetrusteddomainex_rqst(tvbuff_t *tvb, int offset,
3687         packet_info *pinfo, proto_tree *tree, char *drep)
3688 {
3689         /* [in] LSA_HANDLE hnd */
3690         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3691                 pinfo, tree, drep);
3692
3693         /* [in, ref] TRUSTED_DOMAIN_INFORMATION_EX *info */
3694         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3695                 lsa_dissect_LSA_TRUST_INFORMATION_EX, NDR_POINTER_REF,
3696                 "TRUSTED_DOMAIN_INFORMATION_EX pointer: info", -1);
3697
3698         /* [in, ref] TRUSTED_DOMAIN_AUTH_INFORMATION *auth */
3699         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3700                 lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION, NDR_POINTER_REF,
3701                 "TRUSTED_DOMAIN_AUTH_INFORMATION pointer: auth", -1);
3702
3703         /* [in] ACCESS_MASK mask */
3704         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3705                 pinfo, tree, drep);
3706
3707         return offset;
3708 }
3709
3710
3711 static int
3712 lsa_dissect_lsacreatetrusteddomainex_reply(tvbuff_t *tvb, int offset,
3713         packet_info *pinfo, proto_tree *tree, char *drep)
3714 {
3715         /* [out] LSA_HANDLE *tdHnd) */
3716         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3717                 pinfo, tree, drep);
3718
3719         offset = dissect_ntstatus(
3720                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3721
3722         return offset;
3723 }
3724
3725 static int
3726 lsa_dissect_lsaenumeratetrusteddomainsex_rqst(tvbuff_t *tvb, int offset,
3727         packet_info *pinfo, proto_tree *tree, char *drep)
3728 {
3729         /* [in] LSA_HANDLE hnd */
3730         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3731                 pinfo, tree, drep);
3732
3733         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
3734         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3735                 hf_lsa_resume_handle, NULL);
3736
3737         /* [in] ULONG pref_maxlen */
3738         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3739                 hf_lsa_max_count, NULL);
3740
3741         return offset;
3742 }
3743
3744
3745 static int
3746 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_EX_array(tvbuff_t *tvb, int offset,
3747         packet_info *pinfo, proto_tree *tree, char *drep)
3748 {
3749         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3750                 lsa_dissect_LSA_TRUST_INFORMATION_EX);
3751
3752         return offset;
3753 }
3754
3755 static int
3756 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_LIST_EX(tvbuff_t *tvb, int offset,
3757         packet_info *pinfo, proto_tree *tree, char *drep)
3758 {
3759         /* count */
3760         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3761                                      hf_lsa_count, NULL);
3762
3763         /* trust information */
3764         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3765                 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_EX_array, NDR_POINTER_UNIQUE,
3766                 "TRUST INFORMATION array:", -1);
3767
3768         /* max count */
3769         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3770                                      hf_lsa_max_count, NULL);
3771
3772
3773         return offset;
3774 }
3775
3776 static int
3777 lsa_dissect_lsaenumeratetrusteddomainsex_reply(tvbuff_t *tvb, int offset,
3778         packet_info *pinfo, proto_tree *tree, char *drep)
3779 {
3780         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
3781         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3782                 hf_lsa_resume_handle, NULL);
3783
3784         /* [out, ref] TRUSTED_DOMAIN_INFORMATION_LIST_EX *domains */
3785         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3786                 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_LIST_EX, NDR_POINTER_REF,
3787                 "TRUSTED_DOMAIN_INFORMATION_LIST_EX pointer: domains", -1);
3788
3789         offset = dissect_ntstatus(
3790                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3791
3792         return offset;
3793 }
3794
3795 static int
3796 lsa_dissect_lsafunction_38_rqst(tvbuff_t *tvb, int offset,
3797         packet_info *pinfo, proto_tree *tree, char *drep)
3798 {
3799         /* [in] LSA_HANDLE handle */
3800         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3801                 pinfo, tree, drep);
3802
3803         /* [in] USHORT flag */
3804         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3805                 hf_lsa_unknown_short, NULL);
3806
3807         /* [in, ref] LSA_SECURITY_DESCRIPTOR *sd */
3808         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3809                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
3810                 "LSA_SECURITY_DESCRIPTOR pointer: sd", -1);
3811
3812         return offset;
3813 }
3814
3815
3816 static int
3817 lsa_dissect_lsafunction_38_reply(tvbuff_t *tvb, int offset,
3818         packet_info *pinfo, proto_tree *tree, char *drep)
3819 {
3820         /* [out, ref] LSA_SECURITY_DESCRIPTOR **psd) */
3821         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3822                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
3823                 "LSA_SECURITY_DESCRIPTOR pointer: psd)", -1);
3824
3825         return offset;
3826 }
3827
3828 static int
3829 lsa_dissect_lsafunction_3b_rqst(tvbuff_t *tvb, int offset,
3830         packet_info *pinfo, proto_tree *tree, char *drep)
3831 {
3832         /* [in] LSA_HANDLE hnd */
3833         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3834                 pinfo, tree, drep);
3835
3836         /* [in, ref] TRUSTED_DOMAIN_INFORMATION_EX *info */
3837         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3838                 lsa_dissect_LSA_TRUST_INFORMATION_EX, NDR_POINTER_REF,
3839                 "TRUSTED_DOMAIN_INFORMATION_EX pointer: info", -1);
3840
3841         /* [in, ref] LSA_SECURITY_DESCRIPTOR *sd */
3842         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3843                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
3844                 "LSA_SECURITY_DESCRIPTOR pointer: sd", -1);
3845
3846         /* [in] ULONG unknown */
3847         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3848                 hf_lsa_unknown_long, NULL);
3849
3850         return offset;
3851 }
3852
3853
3854 static int
3855 lsa_dissect_lsafunction_3b_reply(tvbuff_t *tvb, int offset,
3856         packet_info *pinfo, proto_tree *tree, char *drep)
3857 {
3858         /* [out] LSA_HANDLE *h2) */
3859         offset = lsa_dissect_LSA_HANDLE(tvb, offset,
3860                 pinfo, tree, drep);
3861
3862         offset = dissect_ntstatus(
3863                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3864
3865         return offset;
3866 }
3867
3868
3869 static dcerpc_sub_dissector dcerpc_lsa_dissectors[] = {
3870         { LSA_LSACLOSE, "Close",
3871                 lsa_dissect_lsaclose_rqst,
3872                 lsa_dissect_lsaclose_reply },
3873         { LSA_LSADELETE, "Delete",
3874                 lsa_dissect_lsadelete_rqst,
3875                 lsa_dissect_lsadelete_reply },
3876         { LSA_LSAENUMERATEPRIVILEGES, "EnumPrivs",
3877                 lsa_dissect_lsaenumerateprivileges_rqst,
3878                 lsa_dissect_lsaenumerateprivileges_reply },
3879         { LSA_LSAQUERYSECURITYOBJECT, "QuerySecObject",
3880                 lsa_dissect_lsaquerysecurityobject_rqst,
3881                 lsa_dissect_lsaquerysecurityobject_reply },
3882         { LSA_LSASETSECURITYOBJECT, "SetSecObject",
3883                 lsa_dissect_lsasetsecurityobject_rqst,
3884                 lsa_dissect_lsasetsecurityobject_reply },
3885         { LSA_LSACHANGEPASSWORD, "ChangePassword",
3886                 lsa_dissect_lsachangepassword_rqst,
3887                 lsa_dissect_lsachangepassword_reply },
3888         { LSA_LSAOPENPOLICY, "OpenPolicy",
3889                 lsa_dissect_lsaopenpolicy_rqst,
3890                 lsa_dissect_lsaopenpolicy_reply },
3891         { LSA_LSAQUERYINFORMATIONPOLICY, "QueryInfoPolicy",
3892                 lsa_dissect_lsaqueryinformationpolicy_rqst,
3893                 lsa_dissect_lsaqueryinformationpolicy_reply },
3894         { LSA_LSASETINFORMATIONPOLICY, "SetInfoPolicy",
3895                 lsa_dissect_lsasetinformationpolicy_rqst,
3896                 lsa_dissect_lsasetinformationpolicy_reply },
3897         { LSA_LSACLEARAUDITLOG, "ClearAuditLog",
3898                 lsa_dissect_lsaclearauditlog_rqst,
3899                 lsa_dissect_lsaclearauditlog_reply },
3900         { LSA_LSACREATEACCOUNT, "CreateAccount",
3901                 lsa_dissect_lsacreateaccount_rqst,
3902                 lsa_dissect_lsacreateaccount_reply },
3903         { LSA_LSAENUMERATEACCOUNTS, "EnumAccounts",
3904                 lsa_dissect_lsaenumerateaccounts_rqst,
3905                 lsa_dissect_lsaenumerateaccounts_reply },
3906         { LSA_LSACREATETRUSTEDDOMAIN, "CreateTrustedDomain",
3907                 lsa_dissect_lsacreatetrusteddomain_rqst,
3908                 lsa_dissect_lsacreatetrusteddomain_reply },
3909         { LSA_LSAENUMERATETRUSTEDDOMAINS, "EnumTrustedDomains",
3910                 lsa_dissect_lsaenumeratetrusteddomains_rqst,
3911                 lsa_dissect_lsaenumeratetrusteddomains_reply },
3912         { LSA_LSALOOKUPNAMES, "LookupNames",
3913                 lsa_dissect_lsalookupnames_rqst,
3914                 lsa_dissect_lsalookupnames_reply },
3915         { LSA_LSALOOKUPSIDS, "LookupSIDs",
3916                 lsa_dissect_lsalookupsids_rqst,
3917                 lsa_dissect_lsalookupsids_reply },
3918         { LSA_LSACREATESECRET, "CreateSecret",
3919                 lsa_dissect_lsacreatesecret_rqst,
3920                 lsa_dissect_lsacreatesecret_reply },
3921         { LSA_LSAOPENACCOUNT, "OpenAccount",
3922                 lsa_dissect_lsaopenaccount_rqst,
3923                 lsa_dissect_lsaopenaccount_reply },
3924         { LSA_LSAENUMERATEPRIVILEGESACCOUNT, "EnumPrivsAccount",
3925                 lsa_dissect_lsaenumerateprivilegesaccount_rqst,
3926                 lsa_dissect_lsaenumerateprivilegesaccount_reply },
3927         { LSA_LSAADDPRIVILEGESTOACCOUNT, "AddPrivsToAccount",
3928                 lsa_dissect_lsaaddprivilegestoaccount_rqst,
3929                 lsa_dissect_lsaaddprivilegestoaccount_reply },
3930         { LSA_LSAREMOVEPRIVILEGESFROMACCOUNT, "MovePrivsFromAccount",
3931                 lsa_dissect_lsaremoveprivilegesfromaccount_rqst,
3932                 lsa_dissect_lsaremoveprivilegesfromaccount_reply },
3933         { LSA_LSAGETQUOTASFORACCOUNT, "GetQuotasForAccount",
3934                 lsa_dissect_lsagetquotasforaccount_rqst,
3935                 lsa_dissect_lsagetquotasforaccount_reply },
3936         { LSA_LSASETQUOTASFORACCOUNT, "SetQuotasForAccount",
3937                 lsa_dissect_lsasetquotasforaccount_rqst,
3938                 lsa_dissect_lsasetquotasforaccount_reply },
3939         { LSA_LSAGETSYSTEMACCESSACCOUNT, "GetSystemAccessAccount",
3940                 lsa_dissect_lsagetsystemaccessaccount_rqst,
3941                 lsa_dissect_lsagetsystemaccessaccount_reply },
3942         { LSA_LSASETSYSTEMACCESSACCOUNT, "SetSystemAccessAccount",
3943                 lsa_dissect_lsasetsystemaccessaccount_rqst,
3944                 lsa_dissect_lsasetsystemaccessaccount_reply },
3945         { LSA_LSAOPENTRUSTEDDOMAIN, "OpenTrustedDomain",
3946                 lsa_dissect_lsaopentrusteddomain_rqst,
3947                 lsa_dissect_lsaopentrusteddomain_reply },
3948         { LSA_LSAQUERYINFOTRUSTEDDOMAIN, "QueryInfoTrustedDomain",
3949                 lsa_dissect_lsaqueryinfotrusteddomain_rqst,
3950                 lsa_dissect_lsaqueryinfotrusteddomain_reply },
3951         { LSA_LSASETINFORMATIONTRUSTEDDOMAIN, "SetInfoTrustedDomain",
3952                 lsa_dissect_lsasetinformationtrusteddomain_rqst,
3953                 lsa_dissect_lsasetinformationtrusteddomain_reply },
3954         { LSA_LSAOPENSECRET, "OpenSecret",
3955                 lsa_dissect_lsaopensecret_rqst,
3956                 lsa_dissect_lsaopensecret_reply },
3957         { LSA_LSASETSECRET, "SetSecret",
3958                 lsa_dissect_lsasetsecret_rqst,
3959                 lsa_dissect_lsasetsecret_reply },
3960         { LSA_LSAQUERYSECRET, "QuerySecret",
3961                 lsa_dissect_lsaquerysecret_rqst,
3962                 lsa_dissect_lsaquerysecret_reply },
3963         { LSA_LSALOOKUPPRIVILEGEVALUE, "LookupPrivValue",
3964                 lsa_dissect_lsalookupprivilegevalue_rqst,
3965                 lsa_dissect_lsalookupprivilegevalue_reply },
3966         { LSA_LSALOOKUPPRIVILEGENAME, "LookupPrivName",
3967                 lsa_dissect_lsalookupprivilegename_rqst,
3968                 lsa_dissect_lsalookupprivilegename_reply },
3969         { LSA_LSALOOKUPPRIVILEGEDISPLAYNAME, "LookupPrivDispName",
3970                 lsa_dissect_lsalookupprivilegedisplayname_rqst,
3971                 lsa_dissect_lsalookupprivilegedisplayname_reply },
3972         { LSA_LSADELETEOBJECT, "DeleteObject",
3973                 lsa_dissect_lsadeleteobject_rqst,
3974                 lsa_dissect_lsadeleteobject_reply },
3975         { LSA_LSAENUMERATEACCOUNTSWITHUSERRIGHT, "EnumAccountsWithUserRight",
3976                 lsa_dissect_lsaenumerateaccountswithuserright_rqst,
3977                 lsa_dissect_lsaenumerateaccountswithuserright_reply },
3978         { LSA_LSAENUMERATEACCOUNTRIGHTS, "EnumAccountRights",
3979                 lsa_dissect_lsaenumerateaccountrights_rqst,
3980                 lsa_dissect_lsaenumerateaccountrights_reply },
3981         { LSA_LSAADDACCOUNTRIGHTS, "AddAccountRights",
3982                 lsa_dissect_lsaaddaccountrights_rqst,
3983                 lsa_dissect_lsaaddaccountrights_reply },
3984         { LSA_LSAREMOVEACCOUNTRIGHTS, "RemoveAccountRights",
3985                 lsa_dissect_lsaremoveaccountrights_rqst,
3986                 lsa_dissect_lsaremoveaccountrights_reply },
3987         { LSA_LSAQUERYTRUSTEDDOMAININFO, "QueryTrustedDomainInfo",
3988                 lsa_dissect_lsaquerytrusteddomaininfo_rqst,
3989                 lsa_dissect_lsaquerytrusteddomaininfo_reply },
3990         { LSA_LSASETTRUSTEDDOMAININFO, "SetTrustedDomainInfo",
3991                 lsa_dissect_lsasettrusteddomaininfo_rqst,
3992                 lsa_dissect_lsasettrusteddomaininfo_reply },
3993         { LSA_LSADELETETRUSTEDDOMAIN, "DeleteTrsutedDomain",
3994                 lsa_dissect_lsadeletetrusteddomain_rqst,
3995                 lsa_dissect_lsadeletetrusteddomain_reply },
3996         { LSA_LSASTOREPRIVATEDATA, "StorePrivateData",
3997                 lsa_dissect_lsastoreprivatedata_rqst,
3998                 lsa_dissect_lsastoreprivatedata_reply },
3999         { LSA_LSARETRIEVEPRIVATEDATA, "RetrievePrivateData",
4000                 lsa_dissect_lsaretrieveprivatedata_rqst,
4001                 lsa_dissect_lsaretrieveprivatedata_reply },
4002         { LSA_LSAOPENPOLICY2, "OpenPolicy2",
4003                 lsa_dissect_lsaopenpolicy2_rqst,
4004                 lsa_dissect_lsaopenpolicy2_reply },
4005         { LSA_LSAGETUSERNAME, "GetUsername",
4006                 lsa_dissect_lsagetusername_rqst,
4007                 lsa_dissect_lsagetusername_reply },
4008         { LSA_LSAQUERYINFORMATIONPOLICY2, "QueryInformationPolicy2",
4009                 lsa_dissect_lsaqueryinformationpolicy2_rqst,
4010                 lsa_dissect_lsaqueryinformationpolicy2_reply },
4011         { LSA_LSASETINFORMATIONPOLICY2, "SetInformationPolicy2",
4012                 lsa_dissect_lsasetinformationpolicy2_rqst,
4013                 lsa_dissect_lsasetinformationpolicy2_reply },
4014         { LSA_LSAQUERYTRUSTEDDOMAININFOBYNAME, "QueryTrustedDomainInfoByName",
4015                 lsa_dissect_lsaquerytrusteddomaininfobyname_rqst,
4016                 lsa_dissect_lsaquerytrusteddomaininfobyname_reply },
4017         { LSA_LSASETTRUSTEDDOMAININFOBYNAME, "SetTrustedDomainInfoByName",
4018                 lsa_dissect_lsasettrusteddomaininfobyname_rqst,
4019                 lsa_dissect_lsasettrusteddomaininfobyname_reply },
4020         { LSA_LSAENUMERATETRUSTEDDOMAINSEX, "EnumTrustedDomainsEx",
4021                 lsa_dissect_lsaenumeratetrusteddomainsex_rqst,
4022                 lsa_dissect_lsaenumeratetrusteddomainsex_reply },
4023         { LSA_LSACREATETRUSTEDDOMAINEX, "CreateTrustedDomainEx",
4024                 lsa_dissect_lsacreatetrusteddomainex_rqst,
4025                 lsa_dissect_lsacreatetrusteddomainex_reply },
4026         { LSA_LSACLOSETRUSTEDDOMAINEX, "CloseTrustedDomainEx",
4027                 lsa_dissect_lsaclosetrusteddomainex_rqst,
4028                 lsa_dissect_lsaclosetrusteddomainex_reply },
4029         { LSA_LSAQUERYDOMAININFORMATIONPOLICY, "QueryDomainInfoPolicy",
4030                 lsa_dissect_lsaquerydomaininformationpolicy_rqst,
4031                 lsa_dissect_lsaquerydomaininformationpolicy_reply },
4032         { LSA_LSASETDOMAININFORMATIONPOLICY, "SetDomainInfoPolicy",
4033                 lsa_dissect_lsasetdomaininformationpolicy_rqst,
4034                 lsa_dissect_lsasetdomaininformationpolicy_reply },
4035         { LSA_LSAOPENTRUSTEDDOMAINBYNAME, "OpenTrustedDomainByName",
4036                 lsa_dissect_lsaopentrusteddomainbyname_rqst,
4037                 lsa_dissect_lsaopentrusteddomainbyname_reply },
4038         { LSA_LSAFUNCTION_38, "LSAFUNCTION_38",
4039                 lsa_dissect_lsafunction_38_rqst,
4040                 lsa_dissect_lsafunction_38_reply },
4041         { LSA_LSALOOKUPSIDS2, "LookupSIDs2",
4042                 lsa_dissect_lsalookupsids2_rqst,
4043                 lsa_dissect_lsalookupsids2_reply },
4044         { LSA_LSALOOKUPNAMES2, "LookupNames2",
4045                 lsa_dissect_lsalookupnames2_rqst,
4046                 lsa_dissect_lsalookupnames2_reply },
4047         { LSA_LSAFUNCTION_3B, "LSAFUNCTION_3B",
4048                 lsa_dissect_lsafunction_3b_rqst,
4049                 lsa_dissect_lsafunction_3b_reply },
4050         {0, NULL, NULL, NULL}
4051 };
4052
4053 static const value_string lsa_opnum_vals[] = {
4054         { LSA_LSACLOSE, "Close" },
4055         { LSA_LSADELETE, "Delete" },
4056         { LSA_LSAENUMERATEPRIVILEGES, "EnumPrivs" },
4057         { LSA_LSAQUERYSECURITYOBJECT, "QuerySecObject" },
4058         { LSA_LSASETSECURITYOBJECT, "SetSecObject" },
4059         { LSA_LSACHANGEPASSWORD, "ChangePassword" },
4060         { LSA_LSAOPENPOLICY, "OpenPolicy" },
4061         { LSA_LSAQUERYINFORMATIONPOLICY, "QueryInfoPolicy" },
4062         { LSA_LSASETINFORMATIONPOLICY, "SetInfoPolicy" },
4063         { LSA_LSACLEARAUDITLOG, "ClearAuditLog" },
4064         { LSA_LSACREATEACCOUNT, "CreateAccount" },
4065         { LSA_LSAENUMERATEACCOUNTS, "EnumAccounts" },
4066         { LSA_LSACREATETRUSTEDDOMAIN, "CreateTrustedDomain" },
4067         { LSA_LSAENUMERATETRUSTEDDOMAINS, "EnumTrustedDomains" },
4068         { LSA_LSALOOKUPNAMES, "LookupNames" },
4069         { LSA_LSALOOKUPSIDS, "LookupSIDs" },
4070         { LSA_LSACREATESECRET, "CreateSecret" },
4071         { LSA_LSAOPENACCOUNT, "OpenAccount" },
4072         { LSA_LSAENUMERATEPRIVILEGESACCOUNT, "EnumPrivsAccount" },
4073         { LSA_LSAADDPRIVILEGESTOACCOUNT, "AddPrivsToAccount" },
4074         { LSA_LSAREMOVEPRIVILEGESFROMACCOUNT, "MovePrivsFromAccount" },
4075         { LSA_LSAGETQUOTASFORACCOUNT, "GetQuotasForAccount" },
4076         { LSA_LSASETQUOTASFORACCOUNT, "SetQuotasForAccount" },
4077         { LSA_LSAGETSYSTEMACCESSACCOUNT, "GetSystemAccessAccount" },
4078         { LSA_LSASETSYSTEMACCESSACCOUNT, "SetSystemAccessAccount" },
4079         { LSA_LSAOPENTRUSTEDDOMAIN, "OpenTrustedDomain" },
4080         { LSA_LSAQUERYINFOTRUSTEDDOMAIN, "QueryInfoTrustedDomain" },
4081         { LSA_LSASETINFORMATIONTRUSTEDDOMAIN, "SetInfoTrustedDomain" },
4082         { LSA_LSAOPENSECRET, "OpenSecret" },
4083         { LSA_LSASETSECRET, "SetSecret" },
4084         { LSA_LSAQUERYSECRET, "QuerySecret" },
4085         { LSA_LSALOOKUPPRIVILEGEVALUE, "LookupPrivValue" },
4086         { LSA_LSALOOKUPPRIVILEGENAME, "LookupPrivName" },
4087         { LSA_LSALOOKUPPRIVILEGEDISPLAYNAME, "LookupPrivDispName" },
4088         { LSA_LSADELETEOBJECT, "DeleteObject" },
4089         { LSA_LSAENUMERATEACCOUNTSWITHUSERRIGHT, "EnumAccountsWithUserRight" },
4090         { LSA_LSAENUMERATEACCOUNTRIGHTS, "EnumAccountRights" },
4091         { LSA_LSAADDACCOUNTRIGHTS, "AddAccountRights" },
4092         { LSA_LSAREMOVEACCOUNTRIGHTS, "RemoveAccountRights" },
4093         { LSA_LSAQUERYTRUSTEDDOMAININFO, "QueryTrustedDomainInfo" },
4094         { LSA_LSASETTRUSTEDDOMAININFO, "SetTrustedDomainInfo" },
4095         { LSA_LSADELETETRUSTEDDOMAIN, "DeleteTrsutedDomain" },
4096         { LSA_LSASTOREPRIVATEDATA, "StorePrivateData" },
4097         { LSA_LSARETRIEVEPRIVATEDATA, "RetrievePrivateData" },
4098         { LSA_LSAOPENPOLICY2, "OpenPolicy2" },
4099         { LSA_LSAGETUSERNAME, "GetUsername" },
4100         { LSA_LSAQUERYINFORMATIONPOLICY2, "QueryInformationPolicy2" },
4101         { LSA_LSASETINFORMATIONPOLICY2, "SetInformationPolicy2" },
4102         { LSA_LSAQUERYTRUSTEDDOMAININFOBYNAME, "QueryTrustedDomainInfoByName" },
4103         { LSA_LSASETTRUSTEDDOMAININFOBYNAME, "SetTrustedDomainInfoByName" },
4104         { LSA_LSAENUMERATETRUSTEDDOMAINSEX, "EnumTrustedDomainsEx" },
4105         { LSA_LSACREATETRUSTEDDOMAINEX, "CreateTrustedDomainEx" },
4106         { LSA_LSACLOSETRUSTEDDOMAINEX, "CloseTrustedDomainEx" },
4107         { LSA_LSAQUERYDOMAININFORMATIONPOLICY, "QueryDomainInfoPolicy" },
4108         { LSA_LSASETDOMAININFORMATIONPOLICY, "SetDomainInfoPolicy" },
4109         { LSA_LSAOPENTRUSTEDDOMAINBYNAME, "OpenTrustedDomainByName" },
4110         { LSA_LSAFUNCTION_38, "LSAFUNCTION_38" },
4111         { LSA_LSALOOKUPSIDS2, "LookupSIDs2" },
4112         { LSA_LSALOOKUPNAMES2, "LookupNames2" },
4113         { LSA_LSAFUNCTION_3B, "LSAFUNCTION_3B" },
4114         { 0, NULL }
4115 };
4116
4117 void
4118 proto_register_dcerpc_lsa(void)
4119 {
4120         static hf_register_info hf[] = {
4121
4122         { &hf_lsa_opnum,
4123           { "Operation", "lsa.opnum", FT_UINT16, BASE_DEC,
4124             VALS(lsa_opnum_vals), 0x0, "Operation", HFILL }},
4125
4126         { &hf_lsa_unknown_string,
4127                 { "Unknown string", "lsa.unknown_string", FT_STRING, BASE_NONE,
4128                 NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
4129
4130         { &hf_lsa_hnd,
4131                 { "Context Handle", "lsa.hnd", FT_BYTES, BASE_NONE,
4132                 NULL, 0x0, "LSA policy handle", HFILL }},
4133
4134         { &hf_lsa_server,
4135                 { "Server", "lsa.server", FT_STRING, BASE_NONE,
4136                 NULL, 0, "Name of Server", HFILL }},
4137
4138         { &hf_lsa_controller,
4139                 { "Controller", "lsa.controller", FT_STRING, BASE_NONE,
4140                 NULL, 0, "Name of Domain Controller", HFILL }},
4141
4142         { &hf_lsa_unknown_hyper,
4143                 { "Unknown hyper", "lsa.unknown.hyper", FT_UINT64, BASE_HEX,
4144                 NULL, 0x0, "Unknown hyper. If you know what this is, contact ethereal developers.", HFILL }},
4145
4146         { &hf_lsa_unknown_long,
4147                 { "Unknown long", "lsa.unknown.long", FT_UINT32, BASE_HEX,
4148                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
4149
4150         { &hf_lsa_unknown_short,
4151                 { "Unknown short", "lsa.unknown.short", FT_UINT16, BASE_HEX,
4152                 NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
4153
4154         { &hf_lsa_unknown_char,
4155                 { "Unknown char", "lsa.unknown.char", FT_UINT8, BASE_HEX,
4156                 NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
4157
4158         { &hf_lsa_rc,
4159                 { "Return code", "lsa.rc", FT_UINT32, BASE_HEX,
4160                 VALS (NT_errors), 0x0, "LSA return status code", HFILL }},
4161
4162         { &hf_lsa_obj_attr,
4163                 { "Attributes", "lsa.obj_attr", FT_UINT32, BASE_HEX,
4164                 NULL, 0x0, "LSA Attributes", HFILL }},
4165
4166         { &hf_lsa_obj_attr_len,
4167                 { "Length", "lsa.obj_attr.len", FT_UINT32, BASE_DEC,
4168                 NULL, 0x0, "Length of object attribute structure", HFILL }},
4169
4170         { &hf_lsa_obj_attr_name,
4171                 { "Name", "lsa.obj_attr.name", FT_STRING, BASE_NONE,
4172                 NULL, 0x0, "Name of object attribute", HFILL }},
4173
4174         { &hf_lsa_access_mask,
4175                 { "Access Mask", "lsa.access_mask", FT_UINT32, BASE_HEX,
4176                 NULL, 0x0, "LSA Access Mask", HFILL }},
4177
4178         { &hf_lsa_info_level,
4179                 { "Level", "lsa.info.level", FT_UINT16, BASE_DEC,
4180                 NULL, 0x0, "Information level of requested data", HFILL }},
4181
4182         { &hf_lsa_trusted_info_level,
4183                 { "Info Level", "lsa.trusted.info_level", FT_UINT16, BASE_DEC,
4184                 VALS(trusted_info_level_vals), 0x0, "Information level of requested Trusted Domain Information", HFILL }},
4185
4186         { &hf_lsa_sd_size,
4187                 { "Size", "lsa.sd_size", FT_UINT32, BASE_DEC,
4188                 NULL, 0x0, "Size of lsa security descriptor", HFILL }},
4189
4190         { &hf_lsa_qos_len,
4191                 { "Length", "lsa.qos.len", FT_UINT32, BASE_DEC,
4192                 NULL, 0x0, "Length of quality of service structure", HFILL }},
4193
4194         { &hf_lsa_qos_impersonation_level,
4195                 { "Impersonation level", "lsa.qos.imp_lev", FT_UINT16, BASE_DEC,
4196                 VALS(lsa_impersonation_level_vals), 0x0, "QOS Impersonation Level", HFILL }},
4197
4198         { &hf_lsa_qos_track_context,
4199                 { "Context Tracking", "lsa.qos.track_ctx", FT_UINT8, BASE_DEC,
4200                 NULL, 0x0, "QOS Context Tracking Mode", HFILL }},
4201
4202         { &hf_lsa_qos_effective_only,
4203                 { "Effective only", "lsa.qos.effective_only", FT_UINT8, BASE_DEC,
4204                 NULL, 0x0, "QOS Flag whether this is Effective Only or not", HFILL }},
4205
4206         { &hf_lsa_pali_percent_full,
4207                 { "Percent Full", "lsa.pali.percent_full", FT_UINT32, BASE_DEC,
4208                 NULL, 0x0, "How full audit log is in percentage", HFILL }},
4209
4210         { &hf_lsa_pali_log_size,
4211                 { "Log Size", "lsa.pali.log_size", FT_UINT32, BASE_DEC,
4212                 NULL, 0x0, "Size of audit log", HFILL }},
4213
4214         { &hf_lsa_pali_retention_period,
4215                 { "Retention Period", "lsa.pali.retention_period", FT_RELATIVE_TIME, BASE_NONE,
4216                 NULL, 0x0, "", HFILL }},
4217
4218         { &hf_lsa_pali_time_to_shutdown,
4219                 { "Time to shutdown", "lsa.pali.time_to_shutdown", FT_RELATIVE_TIME, BASE_NONE,
4220                 NULL, 0x0, "Time to shutdown", HFILL }},
4221
4222         { &hf_lsa_pali_shutdown_in_progress,
4223                 { "Shutdown in progress", "lsa.pali.shutdown_in_progress", FT_UINT8, BASE_DEC,
4224                 NULL, 0x0, "Flag whether shutdown is in progress or not", HFILL }},
4225
4226         { &hf_lsa_pali_next_audit_record,
4227                 { "Next Audit Record", "lsa.pali.next_audit_record", FT_UINT32, BASE_HEX,
4228                 NULL, 0x0, "Next audit record", HFILL }},
4229
4230         { &hf_lsa_paei_enabled,
4231                 { "Enabled", "lsa.paei.enabled", FT_UINT8, BASE_DEC,
4232                 NULL, 0x0, "If Audit Events Information is Enabled or not", HFILL }},
4233
4234         { &hf_lsa_paei_settings,
4235                 { "Settings", "lsa.paei.settings", FT_UINT32, BASE_HEX,
4236                 NULL, 0x0, "Audit Events Information settings", HFILL }},
4237
4238         { &hf_lsa_count,
4239                 { "Count", "lsa.count", FT_UINT32, BASE_DEC,
4240                 NULL, 0x0, "Count of objects", HFILL }},
4241
4242         { &hf_lsa_max_count,
4243                 { "Max Count", "lsa.max_count", FT_UINT32, BASE_DEC,
4244                 NULL, 0x0, "", HFILL }},
4245
4246         { &hf_lsa_domain,
4247                 { "Domain", "lsa.domain", FT_STRING, BASE_NONE,
4248                 NULL, 0x0, "Domain", HFILL }},
4249
4250         { &hf_lsa_acct,
4251                 { "Account", "lsa.acct", FT_STRING, BASE_NONE,
4252                 NULL, 0x0, "Account", HFILL }},
4253
4254         { &hf_lsa_source,
4255                 { "Source", "lsa.source", FT_STRING, BASE_NONE,
4256                 NULL, 0x0, "Replica Source", HFILL }},
4257
4258         { &hf_lsa_server_role,
4259                 { "Role", "lsa.server_role", FT_UINT16, BASE_DEC,
4260                 VALS(server_role_vals), 0x0, "LSA Server Role", HFILL }},
4261
4262         { &hf_lsa_quota_paged_pool,
4263                 { "Paged Pool", "lsa.quota.paged_pool", FT_UINT32, BASE_DEC,
4264                 NULL, 0x0, "Size of Quota Paged Pool", HFILL }},
4265
4266         { &hf_lsa_quota_non_paged_pool,
4267                 { "Non Paged Pool", "lsa.quota.non_paged_pool", FT_UINT32, BASE_DEC,
4268                 NULL, 0x0, "Size of Quota non-Paged Pool", HFILL }},
4269
4270         { &hf_lsa_quota_min_wss,
4271                 { "Min WSS", "lsa.quota.min_wss", FT_UINT32, BASE_DEC,
4272                 NULL, 0x0, "Size of Quota Min WSS", HFILL }},
4273
4274         { &hf_lsa_quota_max_wss,
4275                 { "Max WSS", "lsa.quota.max_wss", FT_UINT32, BASE_DEC,
4276                 NULL, 0x0, "Size of Quota Max WSS", HFILL }},
4277
4278         { &hf_lsa_quota_pagefile,
4279                 { "Pagefile", "lsa.quota.pagefile", FT_UINT32, BASE_DEC,
4280                 NULL, 0x0, "Size of quota pagefile usage", HFILL }},
4281
4282         { &hf_lsa_mod_seq_no,
4283                 { "Seq No", "lsa.mod.seq_no", FT_UINT64, BASE_DEC,
4284                 NULL, 0x0, "Sequence number for this modification", HFILL }},
4285
4286         { &hf_lsa_mod_mtime,
4287                 { "MTime", "lsa.mod.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4288                 NULL, 0x0, "Time when this modification occured", HFILL }},
4289
4290         { &hf_lsa_cur_mtime,
4291                 { "Current MTime", "lsa.cur.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4292                 NULL, 0x0, "Current MTime to set", HFILL }},
4293
4294         { &hf_lsa_old_mtime,
4295                 { "Old MTime", "lsa.old.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4296                 NULL, 0x0, "Old MTime for this object", HFILL }},
4297
4298         { &hf_lsa_name,
4299                 { "Name", "lsa.name", FT_STRING, BASE_NONE,
4300                 NULL, 0x0, "", HFILL }},
4301
4302         { &hf_lsa_key,
4303                 { "Key", "lsa.key", FT_STRING, BASE_NONE,
4304                 NULL, 0x0, "", HFILL }},
4305
4306         { &hf_lsa_flat_name,
4307                 { "Flat Name", "lsa.flat_name", FT_STRING, BASE_NONE,
4308                 NULL, 0x0, "", HFILL }},
4309
4310         { &hf_lsa_forest,
4311                 { "Forest", "lsa.forest", FT_STRING, BASE_NONE,
4312                 NULL, 0x0, "", HFILL }},
4313
4314         { &hf_lsa_info_type,
4315                 { "Info Type", "lsa.info_type", FT_UINT32, BASE_DEC,
4316                 NULL, 0x0, "", HFILL }},
4317
4318         { &hf_lsa_new_pwd,
4319                 { "New Password", "lsa.new_pwd", FT_BYTES, BASE_HEX,
4320                 NULL, 0x0, "New password", HFILL }},
4321
4322         { &hf_lsa_old_pwd,
4323                 { "Old Password", "lsa.old_pwd", FT_BYTES, BASE_HEX,
4324                 NULL, 0x0, "Old password", HFILL }},
4325
4326         { &hf_lsa_sid_type,
4327                 { "SID Type", "lsa.sid_type", FT_UINT16, BASE_DEC,
4328                 VALS(sid_type_vals), 0x0, "Type of SID", HFILL }},
4329
4330         { &hf_lsa_rid,
4331                 { "RID", "lsa.rid", FT_UINT32, BASE_HEX,
4332                 NULL, 0x0, "RID", HFILL }},
4333
4334         { &hf_lsa_rid_offset,
4335                 { "RID Offset", "lsa.rid.offset", FT_UINT32, BASE_HEX,
4336                 NULL, 0x0, "RID Offset", HFILL }},
4337
4338         { &hf_lsa_index,
4339                 { "Index", "lsa.index", FT_UINT32, BASE_DEC,
4340                 NULL, 0x0, "", HFILL }},
4341
4342         { &hf_lsa_num_mapped,
4343                 { "Num Mapped", "lsa.num_mapped", FT_UINT32, BASE_DEC,
4344                 NULL, 0x0, "", HFILL }},
4345
4346         { &hf_lsa_policy_information_class,
4347                 { "Info Class", "lsa.policy.info", FT_UINT16, BASE_DEC,
4348                 VALS(policy_information_class_vals), 0x0, "Policy information class", HFILL }},
4349
4350         { &hf_lsa_secret,
4351                 { "LSA Secret", "lsa.secret", FT_BYTES, BASE_HEX,
4352                 NULL, 0, "", HFILL }},
4353
4354         { &hf_lsa_auth_blob,
4355                 { "Auth blob", "lsa.auth.blob", FT_BYTES, BASE_HEX,
4356                 NULL, 0, "", HFILL }},
4357
4358         { &hf_nt_luid_high,
4359                 { "High", "nt.luid.high", FT_UINT32, BASE_HEX,
4360                 NULL, 0x0, "LUID High component", HFILL }},
4361
4362         { &hf_nt_luid_low,
4363                 { "Low", "nt.luid.low", FT_UINT32, BASE_HEX,
4364                 NULL, 0x0, "LUID Low component", HFILL }},
4365
4366         { &hf_lsa_size,
4367                 { "Size", "lsa.size", FT_UINT32, BASE_DEC,
4368                 NULL, 0x0, "", HFILL }},
4369
4370         { &hf_lsa_size16,
4371                 { "Size", "lsa.size", FT_UINT16, BASE_DEC,
4372                 NULL, 0x0, "", HFILL }},
4373
4374         { &hf_lsa_size_needed,
4375                 { "Size Needed", "lsa.size_needed", FT_UINT16, BASE_DEC,
4376                 NULL, 0x0, "", HFILL }},
4377
4378         { &hf_lsa_privilege_name,
4379                 { "Name", "lsa.privilege.name", FT_STRING, BASE_NONE,
4380                 NULL, 0x0, "LSA Privilege Name", HFILL }},
4381
4382         { &hf_lsa_rights,
4383                 { "Rights", "lsa.rights", FT_STRING, BASE_NONE,
4384                 NULL, 0x0, "Account Rights", HFILL }},
4385
4386         { &hf_lsa_attr,
4387                 { "Attr", "lsa.attr", FT_UINT64, BASE_HEX,
4388                 NULL, 0x0, "LSA Attributes", HFILL }},
4389
4390         { &hf_lsa_auth_update,
4391                 { "Update", "lsa.auth.update", FT_UINT64, BASE_HEX,
4392                 NULL, 0x0, "LSA Auth Info update", HFILL }},
4393
4394         { &hf_lsa_resume_handle,
4395                 { "Resume Handle", "lsa.resume_handle", FT_UINT32, BASE_DEC,
4396                 NULL, 0x0, "Resume Handle", HFILL }},
4397
4398         { &hf_lsa_trust_direction,
4399                 { "Trust Direction", "lsa.trust.direction", FT_UINT32, BASE_DEC,
4400                 VALS(trusted_direction_vals), 0x0, "Trust direction", HFILL }},
4401
4402         { &hf_lsa_trust_type,
4403                 { "Trust Type", "lsa.trust.type", FT_UINT32, BASE_DEC,
4404                 VALS(trusted_type_vals), 0x0, "Trust type", HFILL }},
4405
4406         { &hf_lsa_trust_attr,
4407                 { "Trust Attr", "lsa.trust.attr", FT_UINT32, BASE_HEX,
4408                 NULL, 0x0, "Trust attributes", HFILL }},
4409
4410         { &hf_lsa_trust_attr_non_trans,
4411                 { "Non Transitive", "lsa.trust.attr.non_trans", FT_BOOLEAN, 32,
4412                 TFS(&tfs_trust_attr_non_trans), 0x00000001, "Non Transitive trust", HFILL }},
4413
4414         { &hf_lsa_trust_attr_uplevel_only,
4415                 { "Upleve only", "lsa.trust.attr.uplevel_only", FT_BOOLEAN, 32,
4416                 TFS(&tfs_trust_attr_uplevel_only), 0x00000002, "Uplevel only trust", HFILL }},
4417
4418         { &hf_lsa_trust_attr_tree_parent,
4419                 { "Tree Parent", "lsa.trust.attr.tree_parent", FT_BOOLEAN, 32,
4420                 TFS(&tfs_trust_attr_tree_parent), 0x00400000, "Tree Parent trust", HFILL }},
4421
4422         { &hf_lsa_trust_attr_tree_root,
4423                 { "Tree Root", "lsa.trust.attr.tree_root", FT_BOOLEAN, 32,
4424                 TFS(&tfs_trust_attr_tree_root), 0x00800000, "Tree Root trust", HFILL }},
4425
4426         { &hf_lsa_auth_type,
4427                 { "Auth Type", "lsa.auth.type", FT_UINT32, BASE_DEC,
4428                 NULL, 0x0, "Auth Info type", HFILL }},
4429
4430         { &hf_lsa_auth_len,
4431                 { "Auth Len", "lsa.auth.len", FT_UINT32, BASE_DEC,
4432                 NULL, 0x0, "Auth Info len", HFILL }},
4433
4434         { &hf_lsa_remove_all,
4435                 { "Remove All", "lsa.remove_all", FT_UINT8, BASE_DEC,
4436                 NULL, 0x0, "Flag whether all rights should be removed or only the specified ones", HFILL }},
4437
4438         { &hf_view_local_info,
4439                 { "View local info", "lsa.access_mask.view_local_info",
4440                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_VIEW_LOCAL_INFORMATION,
4441                   "View local info", HFILL }},
4442
4443         { &hf_view_audit_info,
4444                 { "View audit info", "lsa.access_mask.view_audit_info",
4445                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_VIEW_AUDIT_INFORMATION,
4446                   "View audit info", HFILL }},
4447
4448         { &hf_get_private_info,
4449                 { "Get private info", "lsa.access_mask.get_privateinfo",
4450                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_GET_PRIVATE_INFORMATION,
4451                   "Get private info", HFILL }},
4452
4453         { &hf_trust_admin,
4454                 { "Trust admin", "lsa.access_mask.trust_admin",
4455                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_TRUST_ADMIN,
4456                   "Trust admin", HFILL }},
4457
4458         { &hf_create_account,
4459                 { "Create account", "lsa.access_mask.create_account",
4460                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_ACCOUNT,
4461                   "Create account", HFILL }},
4462
4463         { &hf_create_secret,
4464                 { "Create secret", "lsa.access_mask.create_secret",
4465                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_SECRET,
4466                   "Create secret", HFILL }},
4467
4468         { &hf_create_priv,
4469                 { "Create privilege", "lsa.access_mask.create_priv",
4470                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_PRIVILEGE,
4471                   "Create privilege", HFILL }},
4472
4473         { &hf_set_default_quota_limits,
4474                 { "Set default quota limits", "lsa.access_mask.set_default_quota_limits",
4475                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SET_DEFAULT_QUOTA_LIMITS,
4476                   "Set default quota limits", HFILL }},
4477
4478         { &hf_set_audit_requirements,
4479                 { "Set audit requirements", "lsa.access_mask.set_audit_requirements",
4480                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SET_AUDIT_REQUIREMENTS,
4481                   "Set audit requirements", HFILL }},
4482
4483         { &hf_server_admin,
4484                 { "Server admin", "lsa.access_mask.server_admin",
4485                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SERVER_ADMIN,
4486                   "Server admin", HFILL }},
4487
4488         { &hf_lookup_names,
4489                 { "Lookup names", "lsa.access_mask.lookup_names",
4490                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_LOOKUP_NAMES,
4491                   "Lookup names", HFILL }}
4492 };
4493
4494         static gint *ett[] = {
4495                 &ett_dcerpc_lsa,
4496                 &ett_lsa_OBJECT_ATTRIBUTES,
4497                 &ett_LSA_SECURITY_DESCRIPTOR,
4498                 &ett_lsa_policy_info,
4499                 &ett_lsa_policy_audit_log_info,
4500                 &ett_lsa_policy_audit_events_info,
4501                 &ett_lsa_policy_primary_domain_info,
4502                 &ett_lsa_policy_primary_account_info,
4503                 &ett_lsa_policy_server_role_info,
4504                 &ett_lsa_policy_replica_source_info,
4505                 &ett_lsa_policy_default_quota_info,
4506                 &ett_lsa_policy_modification_info,
4507                 &ett_lsa_policy_audit_full_set_info,
4508                 &ett_lsa_policy_audit_full_query_info,
4509                 &ett_lsa_policy_dns_domain_info,
4510                 &ett_lsa_translated_names,
4511                 &ett_lsa_translated_name,
4512                 &ett_lsa_referenced_domain_list,
4513                 &ett_lsa_trust_information,
4514                 &ett_lsa_trust_information_ex,
4515                 &ett_LUID,
4516                 &ett_LSA_PRIVILEGES,
4517                 &ett_LSA_PRIVILEGE,
4518                 &ett_LSA_LUID_AND_ATTRIBUTES_ARRAY,
4519                 &ett_LSA_LUID_AND_ATTRIBUTES,
4520                 &ett_LSA_TRUSTED_DOMAIN_LIST,
4521                 &ett_LSA_TRUSTED_DOMAIN,
4522                 &ett_LSA_TRANSLATED_SIDS,
4523                 &ett_lsa_trusted_domain_info,
4524                 &ett_lsa_trust_attr,
4525                 &ett_lsa_trusted_domain_auth_information,
4526                 &ett_lsa_auth_information
4527         };
4528
4529         proto_dcerpc_lsa = proto_register_protocol(
4530                 "Microsoft Local Security Architecture", "LSA", "lsa");
4531
4532         proto_register_field_array (proto_dcerpc_lsa, hf, array_length (hf));
4533         proto_register_subtree_array(ett, array_length(ett));
4534 }
4535
4536 /* Protocol handoff */
4537
4538 static e_uuid_t uuid_dcerpc_lsa = {
4539         0x12345778, 0x1234, 0xabcd,
4540         { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab}
4541 };
4542
4543 static guint16 ver_dcerpc_lsa = 0;
4544
4545 void
4546 proto_reg_handoff_dcerpc_lsa(void)
4547 {
4548         /* Register protocol as dcerpc */
4549
4550         dcerpc_init_uuid(proto_dcerpc_lsa, ett_dcerpc_lsa, &uuid_dcerpc_lsa,
4551                          ver_dcerpc_lsa, dcerpc_lsa_dissectors, hf_lsa_opnum);
4552 }