packet-dcerpc-lsa.c

   1 /* packet-dcerpc-lsa.c
   2  * Routines for SMB \PIPE\lsarpc packet disassembly
   3  * Copyright 2001,2003 Tim Potter <tpot@samba.org>
   4  *  2002  Added LSA command dissectors  Ronnie Sahlberg
   5  *
   6  * $Id: packet-dcerpc-lsa.c,v 1.88 2003/08/20 00:09:36 sharpe Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <string.h>
  33
  34 #include <epan/packet.h>
  35 #include "packet-dcerpc.h"
  36 #include "packet-dcerpc-nt.h"
  37 #include "packet-dcerpc-lsa.h"
  38 #include "packet-smb-common.h"
  39 #include "smb.h"
  40
  41 static int proto_dcerpc_lsa = -1;
  42
  43 static int hf_lsa_opnum = -1;
  44 static int hf_lsa_rc = -1;
  45 static int hf_lsa_hnd = -1;
  46 static int hf_lsa_policy_information = -1;
  47 static int hf_lsa_server = -1;
  48 static int hf_lsa_controller = -1;
  49 static int hf_lsa_obj_attr = -1;
  50 static int hf_lsa_obj_attr_len = -1;
  51 static int hf_lsa_obj_attr_name = -1;
  52 static int hf_lsa_access_mask = -1;
  53 static int hf_lsa_info_level = -1;
  54 static int hf_lsa_trusted_info_level = -1;
  55 static int hf_lsa_sd_size = -1;
  56 static int hf_lsa_qos_len = -1;
  57 static int hf_lsa_qos_impersonation_level = -1;
  58 static int hf_lsa_qos_track_context = -1;
  59 static int hf_lsa_qos_effective_only = -1;
  60 static int hf_lsa_pali_percent_full = -1;
  61 static int hf_lsa_pali_log_size = -1;
  62 static int hf_lsa_pali_retention_period = -1;
  63 static int hf_lsa_pali_time_to_shutdown = -1;
  64 static int hf_lsa_pali_shutdown_in_progress = -1;
  65 static int hf_lsa_pali_next_audit_record = -1;
  66 static int hf_lsa_paei_enabled = -1;
  67 static int hf_lsa_paei_settings = -1;
  68 static int hf_lsa_count = -1;
  69 static int hf_lsa_size = -1;
  70 static int hf_lsa_size16 = -1;
  71 static int hf_lsa_size_needed = -1;
  72 static int hf_lsa_max_count = -1;
  73 static int hf_lsa_index = -1;
  74 static int hf_lsa_fqdomain = -1;
  75 static int hf_lsa_domain = -1;
  76 static int hf_lsa_domain_sid = -1;
  77 static int hf_lsa_acct = -1;
  78 static int hf_lsa_server_role = -1;
  79 static int hf_lsa_source = -1;
  80 static int hf_lsa_quota_paged_pool = -1;
  81 static int hf_lsa_quota_non_paged_pool = -1;
  82 static int hf_lsa_quota_min_wss = -1;
  83 static int hf_lsa_quota_max_wss = -1;
  84 static int hf_lsa_quota_pagefile = -1;
  85 static int hf_lsa_mod_seq_no = -1;
  86 static int hf_lsa_mod_mtime = -1;
  87 static int hf_lsa_cur_mtime = -1;
  88 static int hf_lsa_old_mtime = -1;
  89 static int hf_lsa_name = -1;
  90 static int hf_lsa_key = -1;
  91 static int hf_lsa_flat_name = -1;
  92 static int hf_lsa_forest = -1;
  93 static int hf_lsa_info_type = -1;
  94 static int hf_lsa_old_pwd = -1;
  95 static int hf_lsa_new_pwd = -1;
  96 static int hf_lsa_sid_type = -1;
  97 static int hf_lsa_rid = -1;
  98 static int hf_lsa_rid_offset = -1;
  99 static int hf_lsa_num_mapped = -1;
 100 static int hf_lsa_policy_information_class = -1;
 101 static int hf_lsa_secret = -1;
 102 static int hf_nt_luid_high = -1;
 103 static int hf_nt_luid_low = -1;
 104 static int hf_lsa_privilege_name = -1;
 105 static int hf_lsa_attr = -1;
 106 static int hf_lsa_resume_handle = -1;
 107 static int hf_lsa_trust_direction = -1;
 108 static int hf_lsa_trust_type = -1;
 109 static int hf_lsa_trust_attr = -1;
 110 static int hf_lsa_trust_attr_non_trans = -1;
 111 static int hf_lsa_trust_attr_uplevel_only = -1;
 112 static int hf_lsa_trust_attr_tree_parent = -1;
 113 static int hf_lsa_trust_attr_tree_root = -1;
 114 static int hf_lsa_auth_update = -1;
 115 static int hf_lsa_auth_type = -1;
 116 static int hf_lsa_auth_len = -1;
 117 static int hf_lsa_auth_blob = -1;
 118 static int hf_lsa_rights = -1;
 119 static int hf_lsa_remove_all = -1;
 120
 121 static int hf_lsa_unknown_hyper = -1;
 122 static int hf_lsa_unknown_long = -1;
 123 static int hf_lsa_unknown_short = -1;
 124 static int hf_lsa_unknown_char = -1;
 125 static int hf_lsa_unknown_string = -1;
 126 #ifdef LSA_UNUSED_HANDLES
 127 static int hf_lsa_unknown_time = -1;
 128 #endif
 129
 130
 131 static gint ett_dcerpc_lsa = -1;
 132 static gint ett_lsa_OBJECT_ATTRIBUTES = -1;
 133 static gint ett_LSA_SECURITY_DESCRIPTOR = -1;
 134 static gint ett_lsa_policy_info = -1;
 135 static gint ett_lsa_policy_audit_log_info = -1;
 136 static gint ett_lsa_policy_audit_events_info = -1;
 137 static gint ett_lsa_policy_primary_domain_info = -1;
 138 static gint ett_lsa_policy_primary_account_info = -1;
 139 static gint ett_lsa_policy_server_role_info = -1;
 140 static gint ett_lsa_policy_replica_source_info = -1;
 141 static gint ett_lsa_policy_default_quota_info = -1;
 142 static gint ett_lsa_policy_modification_info = -1;
 143 static gint ett_lsa_policy_audit_full_set_info = -1;
 144 static gint ett_lsa_policy_audit_full_query_info = -1;
 145 static gint ett_lsa_policy_dns_domain_info = -1;
 146 static gint ett_lsa_translated_names = -1;
 147 static gint ett_lsa_translated_name = -1;
 148 static gint ett_lsa_referenced_domain_list = -1;
 149 static gint ett_lsa_trust_information = -1;
 150 static gint ett_lsa_trust_information_ex = -1;
 151 static gint ett_LUID = -1;
 152 static gint ett_LSA_PRIVILEGES = -1;
 153 static gint ett_LSA_PRIVILEGE = -1;
 154 static gint ett_LSA_LUID_AND_ATTRIBUTES_ARRAY = -1;
 155 static gint ett_LSA_LUID_AND_ATTRIBUTES = -1;
 156 static gint ett_LSA_TRUSTED_DOMAIN_LIST = -1;
 157 static gint ett_LSA_TRUSTED_DOMAIN = -1;
 158 static gint ett_LSA_TRANSLATED_SIDS = -1;
 159 static gint ett_lsa_trusted_domain_info = -1;
 160 static gint ett_lsa_trust_attr = -1;
 161 static gint ett_lsa_trusted_domain_auth_information = -1;
 162 static gint ett_lsa_auth_information = -1;
 163
 164
 165 static int
 166 lsa_dissect_pointer_NTTIME(tvbuff_t *tvb, int offset,
 167                              packet_info *pinfo, proto_tree *tree,
 168                              char *drep)
 169 {
 170         dcerpc_info *di;
 171
 172         di=pinfo->private_data;
 173         if(di->conformant_run){
 174                 /*just a run to handle conformant arrays, nothing to dissect */
 175                 return offset;
 176         }
 177
 178         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 179                 di->hf_index);
 180
 181         return offset;
 182 }
 183
 184 static int
 185 lsa_dissect_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
 186                              packet_info *pinfo, proto_tree *tree,
 187                              char *drep)
 188 {
 189         dcerpc_info *di;
 190
 191         di=pinfo->private_data;
 192         if(di->conformant_run){
 193                 /*just a run to handle conformant arrays, nothing to dissect */
 194                 return offset;
 195         }
 196
 197         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 198                         di->hf_index, 0);
 199         return offset;
 200 }
 201
 202 static int
 203 lsa_dissect_pointer_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
 204                              packet_info *pinfo, proto_tree *tree,
 205                              char *drep)
 206 {
 207         dcerpc_info *di;
 208
 209         di=pinfo->private_data;
 210         if(di->conformant_run){
 211                 /*just a run to handle conformant arrays, nothing to dissect */
 212                 return offset;
 213         }
 214
 215         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 216                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
 217                 "DOMAIN pointer: ", di->hf_index);
 218
 219         return offset;
 220 }
 221
 222 static int
 223 lsa_dissect_pointer_STRING(tvbuff_t *tvb, int offset,
 224                              packet_info *pinfo, proto_tree *tree,
 225                              char *drep)
 226 {
 227         dcerpc_info *di;
 228
 229         di=pinfo->private_data;
 230         if(di->conformant_run){
 231                 /*just a run to handle conformant arrays, nothing to dissect */
 232                 return offset;
 233         }
 234
 235         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 236                         di->hf_index, 0);
 237         return offset;
 238 }
 239
 240
 241 static int
 242 lsa_dissect_LSA_SECRET_data(tvbuff_t *tvb, int offset,
 243                         packet_info *pinfo, proto_tree *tree,
 244                         char *drep)
 245 {
 246         guint32 len;
 247         dcerpc_info *di;
 248
 249         di=pinfo->private_data;
 250         if(di->conformant_run){
 251                 /*just a run to handle conformant arrays, nothing to dissect */
 252                 return offset;
 253         }
 254
 255         /* this is probably a varying and conformant array */
 256         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 257                                      hf_lsa_sd_size, &len);
 258         offset+=4;
 259         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 260                                      hf_lsa_sd_size, &len);
 261         proto_tree_add_item(tree, hf_lsa_secret, tvb, offset, len, FALSE);
 262         offset += len;
 263
 264         return offset;
 265 }
 266
 267 int
 268 lsa_dissect_LSA_SECRET(tvbuff_t *tvb, int offset,
 269                         packet_info *pinfo, proto_tree *parent_tree,
 270                         char *drep)
 271 {
 272         proto_item *item=NULL;
 273         proto_tree *tree=NULL;
 274         int old_offset=offset;
 275
 276         if(parent_tree){
 277                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 278                         "LSA_SECRET:");
 279                 tree = proto_item_add_subtree(item, ett_LSA_SECURITY_DESCRIPTOR);
 280         }
 281
 282         /* XXX need to figure this one out */
 283         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 284                                      hf_lsa_sd_size, NULL);
 285         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 286                                      hf_lsa_sd_size, NULL);
 287         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 288                 lsa_dissect_LSA_SECRET_data, NDR_POINTER_UNIQUE,
 289                 "LSA_SECRET data: pointer", -1);
 290
 291         proto_item_set_len(item, offset-old_offset);
 292         return offset;
 293 }
 294
 295 static int
 296 lsa_dissect_LSA_SECRET_pointer(tvbuff_t *tvb, int offset,
 297                         packet_info *pinfo, proto_tree *tree,
 298                         char *drep)
 299 {
 300         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 301                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
 302                 "LSA_SECRET pointer: data", -1);
 303
 304         return offset;
 305 }
 306
 307 /* Dissect LSA specific access rights */
 308
 309 static gint hf_view_local_info = -1;
 310 static gint hf_view_audit_info = -1;
 311 static gint hf_get_private_info = -1;
 312 static gint hf_trust_admin = -1;
 313 static gint hf_create_account = -1;
 314 static gint hf_create_secret = -1;
 315 static gint hf_create_priv = -1;
 316 static gint hf_set_default_quota_limits = -1;
 317 static gint hf_set_audit_requirements = -1;
 318 static gint hf_server_admin = -1;
 319 static gint hf_lookup_names = -1;
 320
 321 static void
 322 lsa_specific_rights(tvbuff_t *tvb, gint offset, proto_tree *tree,
 323                     guint32 access)
 324 {
 325         proto_tree_add_boolean(
 326                 tree, hf_lookup_names, tvb, offset, 4, access);
 327
 328         proto_tree_add_boolean(
 329                 tree, hf_server_admin, tvb, offset, 4, access);
 330
 331         proto_tree_add_boolean(
 332                 tree, hf_set_audit_requirements, tvb, offset, 4, access);
 333
 334         proto_tree_add_boolean(
 335                 tree, hf_set_default_quota_limits, tvb, offset, 4, access);
 336
 337         proto_tree_add_boolean(
 338                 tree, hf_create_priv, tvb, offset, 4, access);
 339
 340         proto_tree_add_boolean(
 341                 tree, hf_create_secret, tvb, offset, 4, access);
 342
 343         proto_tree_add_boolean(
 344                 tree, hf_create_account, tvb, offset, 4, access);
 345
 346         proto_tree_add_boolean(
 347                 tree, hf_trust_admin, tvb, offset, 4, access);
 348
 349         proto_tree_add_boolean(
 350                 tree, hf_get_private_info, tvb, offset, 4, access);
 351
 352         proto_tree_add_boolean(
 353                 tree, hf_view_audit_info, tvb, offset, 4, access);
 354
 355         proto_tree_add_boolean(
 356                 tree, hf_view_local_info, tvb, offset, 4, access);
 357 }
 358
 359 struct access_mask_info lsa_access_mask_info = {
 360         "LSA",                  /* Name of specific rights */
 361         lsa_specific_rights,    /* Dissection function */
 362         NULL,                   /* Generic mapping table */
 363         NULL                    /* Standard mapping table */
 364 };
 365
 366 int
 367 lsa_dissect_LSA_SECURITY_DESCRIPTOR_data(tvbuff_t *tvb, int offset,
 368                              packet_info *pinfo, proto_tree *tree,
 369                              char *drep)
 370 {
 371         guint32 len;
 372         dcerpc_info *di;
 373
 374         di=pinfo->private_data;
 375         if(di->conformant_run){
 376                 /*just a run to handle conformant arrays, nothing to dissect */
 377                 return offset;
 378         }
 379
 380         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 381                                      hf_lsa_sd_size, &len);
 382
 383         dissect_nt_sec_desc(
 384                 tvb, offset, pinfo, tree, drep, len, &lsa_access_mask_info);
 385
 386         offset += len;
 387
 388         return offset;
 389 }
 390 int
 391 lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvbuff_t *tvb, int offset,
 392                         packet_info *pinfo, proto_tree *parent_tree,
 393                         char *drep)
 394 {
 395         proto_item *item=NULL;
 396         proto_tree *tree=NULL;
 397         int old_offset=offset;
 398
 399         if(parent_tree){
 400                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 401                         "LSA_SECURITY_DESCRIPTOR:");
 402                 tree = proto_item_add_subtree(item, ett_LSA_SECURITY_DESCRIPTOR);
 403         }
 404
 405         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 406                                     hf_lsa_sd_size, NULL);
 407
 408         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 409                         lsa_dissect_LSA_SECURITY_DESCRIPTOR_data, NDR_POINTER_UNIQUE,
 410                         "LSA SECURITY DESCRIPTOR data:", -1);
 411
 412         proto_item_set_len(item, offset-old_offset);
 413         return offset;
 414 }
 415
 416 static int
 417 lsa_dissect_LPSTR(tvbuff_t *tvb, int offset,
 418         packet_info *pinfo, proto_tree *tree, char *drep)
 419 {
 420         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 421                         hf_lsa_unknown_char, NULL);
 422
 423         return offset;
 424 }
 425
 426 static const value_string lsa_impersonation_level_vals[] = {
 427         {0,     "Anonymous"},
 428         {1,     "Identification"},
 429         {2,     "Impersonation"},
 430         {3,     "Delegation"},
 431         {0, NULL}
 432 };
 433
 434
 435 static int
 436 lsa_dissect_SECURITY_QUALITY_OF_SERVICE(tvbuff_t *tvb, int offset,
 437         packet_info *pinfo, proto_tree *tree, char *drep)
 438 {
 439         /* Length */
 440         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 441                         hf_lsa_qos_len, NULL);
 442
 443         /* impersonation level */
 444         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 445                         hf_lsa_qos_impersonation_level, NULL);
 446
 447         /* context tracking mode */
 448         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 449                         hf_lsa_qos_track_context, NULL);
 450
 451         /* effective only */
 452         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 453                         hf_lsa_qos_effective_only, NULL);
 454
 455         return offset;
 456 }
 457
 458 static int
 459 lsa_dissect_ACCESS_MASK(tvbuff_t *tvb, int offset,
 460         packet_info *pinfo, proto_tree *tree, char *drep)
 461 {
 462         offset = dissect_nt_access_mask(
 463                 tvb, offset, pinfo, tree, drep, hf_lsa_access_mask,
 464                 &lsa_access_mask_info);
 465
 466         return offset;
 467 }
 468
 469 static int
 470 lsa_dissect_LSA_OBJECT_ATTRIBUTES(tvbuff_t *tvb, int offset,
 471         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 472 {
 473         int old_offset=offset;
 474         proto_item *item = NULL;
 475         proto_tree *tree = NULL;
 476
 477         if(parent_tree){
 478                 item = proto_tree_add_text(parent_tree, tvb, offset, -1, "Object Attributes");
 479                 tree = proto_item_add_subtree(item, ett_lsa_OBJECT_ATTRIBUTES);
 480         }
 481
 482         /* Length */
 483         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 484                         hf_lsa_obj_attr_len, NULL);
 485
 486         /* LPSTR */
 487         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 488                 lsa_dissect_LPSTR, NDR_POINTER_UNIQUE,
 489                 "LSPTR pointer: ", -1);
 490
 491         /* attribute name */
 492         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 493                 lsa_dissect_pointer_STRING, NDR_POINTER_UNIQUE,
 494                 "NAME pointer: ", hf_lsa_obj_attr_name);
 495
 496         /* Attr */
 497         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 498                         hf_lsa_obj_attr, NULL);
 499
 500         /* security descriptor */
 501         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 502                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
 503                 "LSA_SECURITY_DESCRIPTOR pointer: ", -1);
 504
 505         /* security quality of service */
 506         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 507                 lsa_dissect_SECURITY_QUALITY_OF_SERVICE, NDR_POINTER_UNIQUE,
 508                 "LSA_SECURITY_QUALITY_OF_SERVICE pointer: ", -1);
 509
 510         proto_item_set_len(item, offset-old_offset);
 511         return offset;
 512 }
 513
 514 static int
 515 lsa_dissect_lsaclose_rqst(tvbuff_t *tvb, int offset,
 516         packet_info *pinfo, proto_tree *tree, char *drep)
 517 {
 518         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 519                         hf_lsa_hnd, NULL, NULL, FALSE, TRUE);
 520
 521         return offset;
 522 }
 523
 524 static int
 525 lsa_dissect_lsaclose_reply(tvbuff_t *tvb, int offset,
 526         packet_info *pinfo, proto_tree *tree, char *drep)
 527 {
 528         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 529                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
 530
 531         offset = dissect_ntstatus(
 532                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
 533
 534         return offset;
 535 }
 536
 537 /* A bug in the NT IDL for lsa openpolicy only stores the first (wide)
 538    character of the server name which is always '\'.  This is fixed in lsa
 539    openpolicy2 but the function remains for backwards compatibility. */
 540
 541 static int dissect_lsa_openpolicy_server(tvbuff_t *tvb, int offset,
 542                                              packet_info *pinfo,
 543                                              proto_tree *tree, char *drep)
 544 {
 545         return dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 546                                   hf_lsa_server, NULL);
 547 }
 548
 549 static int
 550 lsa_dissect_lsaopenpolicy_rqst(tvbuff_t *tvb, int offset,
 551         packet_info *pinfo, proto_tree *tree, char *drep)
 552 {
 553         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 554                 dissect_lsa_openpolicy_server, NDR_POINTER_UNIQUE,
 555                 "Server", hf_lsa_server);
 556
 557         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 558                 lsa_dissect_LSA_OBJECT_ATTRIBUTES, NDR_POINTER_REF,
 559                 "OBJECT_ATTRIBUTES", -1);
 560
 561         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
 562                 pinfo, tree, drep);
 563
 564         return offset;
 565 }
 566
 567 static int
 568 lsa_dissect_lsaopenpolicy_reply(tvbuff_t *tvb, int offset,
 569         packet_info *pinfo, proto_tree *tree, char *drep)
 570 {
 571         e_ctx_hnd policy_hnd;
 572         proto_item *hnd_item;
 573         guint32 status;
 574
 575         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 576                         hf_lsa_hnd, &policy_hnd, &hnd_item, TRUE, FALSE);
 577
 578         offset = dissect_ntstatus(
 579                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, &status);
 580
 581         if (status == 0) {
 582                 dcerpc_smb_store_pol_name(&policy_hnd, pinfo,
 583                                           "OpenPolicy handle");
 584
 585                 if (hnd_item != NULL)
 586                         proto_item_append_text(hnd_item, ": OpenPolicy handle");
 587         }
 588
 589         return offset;
 590 }
 591
 592 static int
 593 lsa_dissect_lsaopenpolicy2_rqst(tvbuff_t *tvb, int offset,
 594         packet_info *pinfo, proto_tree *tree, char *drep)
 595 {
 596         offset = dissect_ndr_pointer_cb(tvb, offset, pinfo, tree, drep,
 597                 dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "Server",
 598                 hf_lsa_server, cb_wstr_postprocess,
 599                 GINT_TO_POINTER(CB_STR_COL_INFO | CB_STR_SAVE | 1));
 600
 601         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 602                 lsa_dissect_LSA_OBJECT_ATTRIBUTES, NDR_POINTER_REF,
 603                 "OBJECT_ATTRIBUTES", -1);
 604
 605         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
 606                 pinfo, tree, drep);
 607
 608         return offset;
 609 }
 610
 611
 612 static int
 613 lsa_dissect_lsaopenpolicy2_reply(tvbuff_t *tvb, int offset,
 614         packet_info *pinfo, proto_tree *tree, char *drep)
 615 {
 616         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 617         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 618         e_ctx_hnd policy_hnd;
 619         proto_item *hnd_item;
 620         guint32 status;
 621         char *pol_name;
 622
 623         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 624                         hf_lsa_hnd, &policy_hnd, &hnd_item, TRUE, FALSE);
 625
 626         offset = dissect_ntstatus(
 627                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, &status);
 628
 629         if (status == 0) {
 630                 if (dcv->private_data)
 631                         pol_name = g_strdup_printf(
 632                                 "OpenPolicy2(%s)", (char *)dcv->private_data);
 633                 else
 634                         pol_name = g_strdup("OpenPolicy2 handle");
 635
 636                 dcerpc_smb_store_pol_name(&policy_hnd, pinfo, pol_name);
 637
 638                 if (hnd_item != NULL)
 639                         proto_item_append_text(hnd_item, ": %s", pol_name);
 640
 641                 g_free(pol_name);
 642         }
 643
 644         return offset;
 645 }
 646
 647 static const value_string policy_information_class_vals[] = {
 648         {1,     "Audit Log Information"},
 649         {2,     "Audit Events Information"},
 650         {3,     "Primary Domain Information"},
 651         {4,     "Pd Account Information"},
 652         {5,     "Account Domain Information"},
 653         {6,     "Server Role Information"},
 654         {7,     "Replica Source Information"},
 655         {8,     "Default Quota Information"},
 656         {9,     "Modification Information"},
 657         {10,    "Audit Full Set Information"},
 658         {11,    "Audit Full Query Information"},
 659         {12,    "DNS Domain Information"},
 660         {0, NULL}
 661 };
 662
 663 static int
 664 lsa_dissect_lsaqueryinformationpolicy_rqst(tvbuff_t *tvb, int offset,
 665         packet_info *pinfo, proto_tree *tree, char *drep)
 666 {
 667         guint16 level;
 668
 669         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 670                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
 671
 672         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 673                 hf_lsa_policy_information_class, &level);
 674
 675         if (check_col(pinfo->cinfo, COL_INFO))
 676                 col_append_fstr(
 677                         pinfo->cinfo, COL_INFO, ", %s",
 678                         val_to_str(level, policy_information_class_vals,
 679                                    "Unknown (%d)"));
 680
 681         return offset;
 682 }
 683
 684 static int
 685 lsa_dissect_POLICY_AUDIT_LOG_INFO(tvbuff_t *tvb, int offset,
 686         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 687 {
 688         proto_item *item=NULL;
 689         proto_tree *tree=NULL;
 690         int old_offset=offset;
 691
 692         if(parent_tree){
 693                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 694                         "POLICY_AUDIT_LOG_INFO:");
 695                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_log_info);
 696         }
 697
 698         /* percent full */
 699         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 700                                      hf_lsa_pali_percent_full, NULL);
 701
 702         /* log size */
 703         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 704                                      hf_lsa_pali_log_size, NULL);
 705
 706         /* retention period */
 707         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 708                                 hf_lsa_pali_retention_period);
 709
 710         /* shutdown in progress */
 711         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 712                                      hf_lsa_pali_shutdown_in_progress, NULL);
 713
 714         /* time to shutdown */
 715         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 716                                 hf_lsa_pali_time_to_shutdown);
 717
 718         /* next audit record */
 719         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 720                                      hf_lsa_pali_next_audit_record, NULL);
 721
 722         proto_item_set_len(item, offset-old_offset);
 723         return offset;
 724 }
 725
 726 static int
 727 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings(tvbuff_t *tvb, int offset,
 728         packet_info *pinfo, proto_tree *tree, char *drep)
 729 {
 730         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 731                                      hf_lsa_paei_settings, NULL);
 732         return offset;
 733 }
 734
 735 static int
 736 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings_array(tvbuff_t *tvb, int offset,
 737         packet_info *pinfo, proto_tree *tree, char *drep)
 738 {
 739         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 740                 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings);
 741
 742         return offset;
 743 }
 744
 745 static int
 746 lsa_dissect_POLICY_AUDIT_EVENTS_INFO(tvbuff_t *tvb, int offset,
 747         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 748 {
 749         proto_item *item=NULL;
 750         proto_tree *tree=NULL;
 751         int old_offset=offset;
 752
 753         if(parent_tree){
 754                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 755                         "POLICY_AUDIT_EVENTS_INFO:");
 756                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_events_info);
 757         }
 758
 759         /* enabled */
 760         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 761                                      hf_lsa_paei_enabled, NULL);
 762
 763         /* settings */
 764         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 765                 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings_array, NDR_POINTER_UNIQUE,
 766                 "Settings", -1);
 767
 768         /* count */
 769         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 770                                      hf_lsa_count, NULL);
 771
 772         proto_item_set_len(item, offset-old_offset);
 773         return offset;
 774 }
 775
 776
 777 static int
 778 lsa_dissect_POLICY_PRIMARY_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 779         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 780 {
 781         proto_item *item=NULL;
 782         proto_tree *tree=NULL;
 783         int old_offset=offset;
 784
 785         if(parent_tree){
 786                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 787                         "POLICY_PRIMARY_DOMAIN_INFO:");
 788                 tree = proto_item_add_subtree(item, ett_lsa_policy_primary_domain_info);
 789         }
 790
 791         /* domain */
 792         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 793                 hf_lsa_domain, 0);
 794
 795         /* sid */
 796         offset = dissect_ndr_nt_PSID(tvb, offset,
 797                 pinfo, tree, drep, hf_lsa_domain_sid);
 798
 799         proto_item_set_len(item, offset-old_offset);
 800         return offset;
 801 }
 802
 803
 804 static int
 805 lsa_dissect_POLICY_ACCOUNT_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 806         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 807 {
 808         proto_item *item=NULL;
 809         proto_tree *tree=NULL;
 810         int old_offset=offset;
 811
 812         if(parent_tree){
 813                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 814                         "POLICY_ACCOUNT_DOMAIN_INFO:");
 815                 tree = proto_item_add_subtree(item, ett_lsa_policy_primary_account_info);
 816         }
 817
 818         /* account */
 819         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 820                 hf_lsa_domain, 0);
 821
 822         /* sid */
 823         offset = dissect_ndr_nt_PSID(tvb, offset,
 824                 pinfo, tree, drep, hf_lsa_domain_sid);
 825
 826         proto_item_set_len(item, offset-old_offset);
 827         return offset;
 828 }
 829
 830
 831 static const value_string server_role_vals[] = {
 832         {0,     "Standalone"},
 833         {1,     "Domain Member"},
 834         {2,     "Backup"},
 835         {3,     "Primary"},
 836         {0, NULL}
 837 };
 838 static int
 839 lsa_dissect_POLICY_SERVER_ROLE_INFO(tvbuff_t *tvb, int offset,
 840         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 841 {
 842         proto_item *item=NULL;
 843         proto_tree *tree=NULL;
 844         int old_offset=offset;
 845
 846         if(parent_tree){
 847                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 848                         "POLICY_SERVER_ROLE_INFO:");
 849                 tree = proto_item_add_subtree(item, ett_lsa_policy_server_role_info);
 850         }
 851
 852         /* server role */
 853         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 854                                      hf_lsa_server_role, NULL);
 855
 856         proto_item_set_len(item, offset-old_offset);
 857         return offset;
 858 }
 859
 860 static int
 861 lsa_dissect_POLICY_REPLICA_SOURCE_INFO(tvbuff_t *tvb, int offset,
 862         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 863 {
 864         proto_item *item=NULL;
 865         proto_tree *tree=NULL;
 866         int old_offset=offset;
 867
 868         if(parent_tree){
 869                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 870                         "POLICY_REPLICA_SOURCE_INFO:");
 871                 tree = proto_item_add_subtree(item, ett_lsa_policy_replica_source_info);
 872         }
 873
 874         /* source */
 875         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 876                 hf_lsa_source, 0);
 877
 878         /* account */
 879         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 880                 hf_lsa_acct, 0);
 881
 882         proto_item_set_len(item, offset-old_offset);
 883         return offset;
 884 }
 885
 886
 887 static int
 888 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO(tvbuff_t *tvb, int offset,
 889         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 890 {
 891         proto_item *item=NULL;
 892         proto_tree *tree=NULL;
 893         int old_offset=offset;
 894
 895         if(parent_tree){
 896                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 897                         "POLICY_DEFAULT_QUOTA_INFO:");
 898                 tree = proto_item_add_subtree(item, ett_lsa_policy_default_quota_info);
 899         }
 900
 901         /* paged pool */
 902         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 903                                      hf_lsa_quota_paged_pool, NULL);
 904
 905         /* non paged pool */
 906         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 907                                      hf_lsa_quota_non_paged_pool, NULL);
 908
 909         /* min wss */
 910         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 911                                      hf_lsa_quota_min_wss, NULL);
 912
 913         /* max wss */
 914         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 915                                      hf_lsa_quota_max_wss, NULL);
 916
 917         /* pagefile */
 918         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 919                                      hf_lsa_quota_pagefile, NULL);
 920
 921         /*  */
 922         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
 923                                      hf_lsa_unknown_hyper, NULL);
 924
 925         proto_item_set_len(item, offset-old_offset);
 926         return offset;
 927 }
 928
 929
 930 static int
 931 lsa_dissect_POLICY_MODIFICATION_INFO(tvbuff_t *tvb, int offset,
 932         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 933 {
 934         proto_item *item=NULL;
 935         proto_tree *tree=NULL;
 936         int old_offset=offset;
 937
 938         if(parent_tree){
 939                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 940                         "POLICY_MODIFICATION_INFO:");
 941                 tree = proto_item_add_subtree(item, ett_lsa_policy_modification_info);
 942         }
 943
 944         /* seq no */
 945         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
 946                                      hf_lsa_mod_seq_no, NULL);
 947
 948         /* mtime */
 949         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 950                                 hf_lsa_mod_mtime);
 951
 952         proto_item_set_len(item, offset-old_offset);
 953         return offset;
 954 }
 955
 956
 957 static int
 958 lsa_dissect_POLICY_AUDIT_FULL_SET_INFO(tvbuff_t *tvb, int offset,
 959         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 960 {
 961         proto_item *item=NULL;
 962         proto_tree *tree=NULL;
 963         int old_offset=offset;
 964
 965         if(parent_tree){
 966                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 967                         "POLICY_AUDIT_FULL_SET_INFO:");
 968                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_full_set_info);
 969         }
 970
 971         /* unknown */
 972         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 973                         hf_lsa_unknown_char, NULL);
 974
 975         proto_item_set_len(item, offset-old_offset);
 976         return offset;
 977 }
 978
 979
 980 static int
 981 lsa_dissect_POLICY_AUDIT_FULL_QUERY_INFO(tvbuff_t *tvb, int offset,
 982         packet_info *pinfo, proto_tree *parent_tree, char *drep)
 983 {
 984         proto_item *item=NULL;
 985         proto_tree *tree=NULL;
 986         int old_offset=offset;
 987
 988         if(parent_tree){
 989                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 990                         "POLICY_AUDIT_FULL_QUERY_INFO:");
 991                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_full_query_info);
 992         }
 993
 994         /* unknown */
 995         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 996                         hf_lsa_unknown_char, NULL);
 997
 998         /* unknown */
 999         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
1000                         hf_lsa_unknown_char, NULL);
1001
1002         proto_item_set_len(item, offset-old_offset);
1003         return offset;
1004 }
1005
1006
1007 int
1008 lsa_dissect_POLICY_DNS_DOMAIN_INFO(tvbuff_t *tvb, int offset,
1009         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1010 {
1011         proto_item *item=NULL;
1012         proto_tree *tree=NULL;
1013         int old_offset=offset;
1014
1015         if(parent_tree){
1016                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1017                         "POLICY_DNS_DOMAIN_INFO:");
1018                 tree = proto_item_add_subtree(item, ett_lsa_policy_dns_domain_info);
1019         }
1020
1021         /* name */
1022         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1023                 hf_lsa_domain, 0);
1024
1025         /* domain */
1026         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1027                 hf_lsa_fqdomain, 0);
1028
1029         /* forest */
1030         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1031                 hf_lsa_forest, 0);
1032
1033         /* GUID */
1034         offset = dissect_nt_GUID(tvb, offset,
1035                 pinfo, tree, drep);
1036
1037         /* SID pointer */
1038         offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep, hf_lsa_domain_sid);
1039
1040         proto_item_set_len(item, offset-old_offset);
1041         return offset;
1042 }
1043
1044 static int
1045 lsa_dissect_POLICY_INFORMATION(tvbuff_t *tvb, int offset,
1046         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1047 {
1048         proto_item *item=NULL;
1049         proto_tree *tree=NULL;
1050         int old_offset=offset;
1051         guint16 level;
1052
1053         if(parent_tree){
1054                 item = proto_tree_add_item(parent_tree, hf_lsa_policy_information, tvb, offset, 0, FALSE);
1055
1056                 tree = proto_item_add_subtree(item, ett_lsa_policy_info);
1057         }
1058
1059         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1060                                      hf_lsa_info_level, &level);
1061
1062         ALIGN_TO_4_BYTES;  /* all union arms aligned to 4 bytes, case 7 and 9 need this  */
1063         switch(level){
1064         case 1:
1065                 offset = lsa_dissect_POLICY_AUDIT_LOG_INFO(
1066                                 tvb, offset, pinfo, tree, drep);
1067                 break;
1068         case 2:
1069                 offset = lsa_dissect_POLICY_AUDIT_EVENTS_INFO(
1070                                 tvb, offset, pinfo, tree, drep);
1071                 break;
1072         case 3:
1073                 offset = lsa_dissect_POLICY_PRIMARY_DOMAIN_INFO(
1074                                 tvb, offset, pinfo, tree, drep);
1075                 break;
1076         case 4:
1077                 offset = dissect_ndr_counted_string(tvb, offset, pinfo,
1078                         tree, drep, hf_lsa_acct, 0);
1079                 break;
1080         case 5:
1081                 offset = lsa_dissect_POLICY_ACCOUNT_DOMAIN_INFO(
1082                                 tvb, offset, pinfo, tree, drep);
1083                 break;
1084         case 6:
1085                 offset = lsa_dissect_POLICY_SERVER_ROLE_INFO(
1086                                 tvb, offset, pinfo, tree, drep);
1087                 break;
1088         case 7:
1089                 offset = lsa_dissect_POLICY_REPLICA_SOURCE_INFO(
1090                                 tvb, offset, pinfo, tree, drep);
1091                 break;
1092         case 8:
1093                 offset = lsa_dissect_POLICY_DEFAULT_QUOTA_INFO(
1094                                 tvb, offset, pinfo, tree, drep);
1095                 break;
1096         case 9:
1097                 offset = lsa_dissect_POLICY_MODIFICATION_INFO(
1098                                 tvb, offset, pinfo, tree, drep);
1099                 break;
1100         case 10:
1101                 offset = lsa_dissect_POLICY_AUDIT_FULL_SET_INFO(
1102                                 tvb, offset, pinfo, tree, drep);
1103                 break;
1104         case 11:
1105                 offset = lsa_dissect_POLICY_AUDIT_FULL_QUERY_INFO(
1106                                 tvb, offset, pinfo, tree, drep);
1107                 break;
1108         case 12:
1109                 offset = lsa_dissect_POLICY_DNS_DOMAIN_INFO(
1110                                 tvb, offset, pinfo, tree, drep);
1111                 break;
1112         }
1113
1114         proto_item_set_len(item, offset-old_offset);
1115         return offset;
1116 }
1117
1118 static int
1119 lsa_dissect_lsaqueryinformationpolicy_reply(tvbuff_t *tvb, int offset,
1120         packet_info *pinfo, proto_tree *tree, char *drep)
1121 {
1122         /* This is really a pointer to a pointer though the first level is REF
1123           so we just ignore that one */
1124         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1125                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_UNIQUE,
1126                 "POLICY_INFORMATION pointer: info", -1);
1127
1128         offset = dissect_ntstatus(
1129                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1130
1131         return offset;
1132 }
1133
1134 static int
1135 lsa_dissect_lsadelete_rqst(tvbuff_t *tvb, int offset,
1136         packet_info *pinfo, proto_tree *tree, char *drep)
1137 {
1138         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1139                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1140
1141         return offset;
1142 }
1143
1144 static int
1145 lsa_dissect_lsadelete_reply(tvbuff_t *tvb, int offset,
1146         packet_info *pinfo, proto_tree *tree, char *drep)
1147 {
1148         offset = dissect_ntstatus(
1149                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1150
1151         return offset;
1152 }
1153
1154
1155 static int
1156 lsa_dissect_lsaquerysecurityobject_rqst(tvbuff_t *tvb, int offset,
1157         packet_info *pinfo, proto_tree *tree, char *drep)
1158 {
1159         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1160                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1161
1162         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1163                 hf_lsa_info_type, NULL);
1164
1165         return offset;
1166 }
1167
1168
1169 static int
1170 lsa_dissect_lsaquerysecurityobject_reply(tvbuff_t *tvb, int offset,
1171         packet_info *pinfo, proto_tree *tree, char *drep)
1172 {
1173         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1174                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
1175                 "LSA_SECURITY_DESCRIPTOR pointer: sec_info", -1);
1176
1177         offset = dissect_ntstatus(
1178                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1179
1180         return offset;
1181 }
1182
1183
1184 static int
1185 lsa_dissect_lsasetsecurityobject_rqst(tvbuff_t *tvb, int offset,
1186         packet_info *pinfo, proto_tree *tree, char *drep)
1187 {
1188         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1189                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1190
1191         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1192                 hf_lsa_info_type, NULL);
1193
1194         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1195                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
1196                 "LSA_SECURITY_DESCRIPTOR: sec_info", -1);
1197
1198         return offset;
1199 }
1200
1201 static int
1202 lsa_dissect_lsasetsecurityobject_reply(tvbuff_t *tvb, int offset,
1203         packet_info *pinfo, proto_tree *tree, char *drep)
1204 {
1205         offset = dissect_ntstatus(
1206                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1207
1208         return offset;
1209 }
1210
1211
1212 static int
1213 lsa_dissect_lsachangepassword_rqst(tvbuff_t *tvb, int offset,
1214         packet_info *pinfo, proto_tree *tree, char *drep)
1215 {
1216         /* server */
1217         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1218                 hf_lsa_server, 0);
1219
1220         /* domain */
1221         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1222                 hf_lsa_domain, 0);
1223
1224         /* account */
1225         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1226                 hf_lsa_acct, 0);
1227
1228         /* old password */
1229         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1230                 hf_lsa_old_pwd, 0);
1231
1232         /* new password */
1233         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1234                 hf_lsa_new_pwd, 0);
1235
1236         return offset;
1237 }
1238
1239 static int
1240 lsa_dissect_lsachangepassword_reply(tvbuff_t *tvb, int offset,
1241         packet_info *pinfo, proto_tree *tree, char *drep)
1242 {
1243         offset = dissect_ntstatus(
1244                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1245
1246         return offset;
1247 }
1248
1249 static const value_string sid_type_vals[] = {
1250         {1,     "User"},
1251         {2,     "Group"},
1252         {3,     "Domain"},
1253         {4,     "Alias"},
1254         {5,     "Well Known Group"},
1255         {6,     "Deleted Account"},
1256         {7,     "Invalid"},
1257         {8,     "Unknown"},
1258         {9,     "Computer"},
1259         {0, NULL}
1260 };
1261 static int
1262 lsa_dissect_LSA_TRANSLATED_NAME(tvbuff_t *tvb, int offset,
1263         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1264 {
1265         proto_item *item=NULL;
1266         proto_tree *tree=NULL;
1267         int old_offset=offset;
1268
1269         if(parent_tree){
1270                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1271                         "LSA_TRANSLATED_NAME:");
1272                 tree = proto_item_add_subtree(item, ett_lsa_translated_name);
1273         }
1274
1275         /* sid type */
1276         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1277                         hf_lsa_sid_type, NULL);
1278
1279         /* name */
1280         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1281                 hf_lsa_name, 0);
1282
1283         /* index */
1284         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1285                                      hf_lsa_index, NULL);
1286
1287         proto_item_set_len(item, offset-old_offset);
1288         return offset;
1289 }
1290
1291 static int
1292 lsa_dissect_LSA_TRANSLATED_NAME_array(tvbuff_t *tvb, int offset,
1293         packet_info *pinfo, proto_tree *tree, char *drep)
1294 {
1295         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1296                 lsa_dissect_LSA_TRANSLATED_NAME);
1297
1298         return offset;
1299 }
1300
1301 static int
1302 lsa_dissect_LSA_TRANSLATED_NAMES(tvbuff_t *tvb, int offset,
1303         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1304 {
1305         proto_item *item=NULL;
1306         proto_tree *tree=NULL;
1307         int old_offset=offset;
1308
1309         if(parent_tree){
1310                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1311                         "LSA_TRANSLATED_NAMES:");
1312                 tree = proto_item_add_subtree(item, ett_lsa_translated_names);
1313         }
1314
1315         /* count */
1316         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1317                                      hf_lsa_count, NULL);
1318
1319         /* settings */
1320         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1321                 lsa_dissect_LSA_TRANSLATED_NAME_array, NDR_POINTER_UNIQUE,
1322                 "TRANSLATED_NAME_ARRAY", -1);
1323
1324         proto_item_set_len(item, offset-old_offset);
1325         return offset;
1326 }
1327
1328
1329 static int
1330 lsa_dissect_lsalookupsids_rqst(tvbuff_t *tvb, int offset,
1331         packet_info *pinfo, proto_tree *tree, char *drep)
1332 {
1333         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1334                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1335
1336         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1337                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
1338                         "PSID_ARRAY", -1);
1339
1340         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1341                 lsa_dissect_LSA_TRANSLATED_NAMES, NDR_POINTER_REF,
1342                 "LSA_TRANSLATED_NAMES pointer: names", -1);
1343
1344         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1345                 hf_lsa_info_level, NULL);
1346
1347         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1348                 hf_lsa_num_mapped, NULL);
1349
1350         return offset;
1351 }
1352
1353 static int
1354 lsa_dissect_LSA_TRUST_INFORMATION(tvbuff_t *tvb, int offset,
1355         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1356 {
1357         proto_item *item=NULL;
1358         proto_tree *tree=NULL;
1359         int old_offset=offset;
1360
1361         if(parent_tree){
1362                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1363                         "TRUST INFORMATION:");
1364                 tree = proto_item_add_subtree(item, ett_lsa_trust_information);
1365         }
1366
1367         /* name */
1368         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1369                 hf_lsa_name, 0);
1370
1371         /* sid */
1372         offset = dissect_ndr_nt_PSID(tvb, offset,
1373                 pinfo, tree, drep, -1);
1374
1375         proto_item_set_len(item, offset-old_offset);
1376         return offset;
1377 }
1378
1379 static const value_string trusted_direction_vals[] = {
1380         {0,     "Trust disabled"},
1381         {1,     "Inbound trust"},
1382         {2,     "Outbound trust"},
1383         {0,     NULL}
1384 };
1385
1386 static const value_string trusted_type_vals[] = {
1387         {1,     "Downlevel"},
1388         {2,     "Uplevel"},
1389         {3,     "MIT"},
1390         {4,     "DCE"},
1391         {0,     NULL}
1392 };
1393
1394 static const true_false_string tfs_trust_attr_non_trans = {
1395         "NON TRANSITIVE is set",
1396         "Non transitive is NOT set"
1397 };
1398 static const true_false_string tfs_trust_attr_uplevel_only = {
1399         "UPLEVEL ONLY is set",
1400         "Uplevel only is NOT set"
1401 };
1402 static const true_false_string tfs_trust_attr_tree_parent = {
1403         "TREE PARENT is set",
1404         "Tree parent is NOT set"
1405 };
1406 static const true_false_string tfs_trust_attr_tree_root = {
1407         "TREE ROOT is set",
1408         "Tree root is NOT set"
1409 };
1410 static int
1411 lsa_dissect_trust_attr(tvbuff_t *tvb, int offset, packet_info *pinfo,
1412                         proto_tree *parent_tree, char *drep)
1413 {
1414         guint32 mask;
1415         proto_item *item = NULL;
1416         proto_tree *tree = NULL;
1417
1418         offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
1419                         hf_lsa_trust_attr, &mask);
1420
1421         if(parent_tree){
1422                 item = proto_tree_add_uint(parent_tree, hf_lsa_trust_attr,
1423                         tvb, offset-4, 4, mask);
1424                 tree = proto_item_add_subtree(item, ett_lsa_trust_attr);
1425         }
1426
1427         proto_tree_add_boolean(tree, hf_lsa_trust_attr_tree_root,
1428                 tvb, offset-4, 4, mask);
1429         proto_tree_add_boolean(tree, hf_lsa_trust_attr_tree_parent,
1430                 tvb, offset-4, 4, mask);
1431         proto_tree_add_boolean(tree, hf_lsa_trust_attr_uplevel_only,
1432                 tvb, offset-4, 4, mask);
1433         proto_tree_add_boolean(tree, hf_lsa_trust_attr_non_trans,
1434                 tvb, offset-4, 4, mask);
1435
1436         return offset;
1437 }
1438
1439 static int
1440 lsa_dissect_LSA_TRUST_INFORMATION_EX(tvbuff_t *tvb, int offset,
1441         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1442 {
1443         proto_item *item=NULL;
1444         proto_tree *tree=NULL;
1445         int old_offset=offset;
1446
1447         if(parent_tree){
1448                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1449                         "TRUST INFORMATION EX:");
1450                 tree = proto_item_add_subtree(item, ett_lsa_trust_information_ex);
1451         }
1452
1453         /* name */
1454         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1455                 hf_lsa_name, 0);
1456
1457         /* flat name */
1458         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1459                 hf_lsa_flat_name, 0);
1460
1461         /* sid */
1462         offset = dissect_ndr_nt_PSID(tvb, offset,
1463                 pinfo, tree, drep, -1);
1464
1465         /* direction */
1466         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1467                                      hf_lsa_trust_direction, NULL);
1468
1469         /* type */
1470         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1471                                      hf_lsa_trust_type, NULL);
1472
1473         /* attributes */
1474         offset = lsa_dissect_trust_attr(tvb, offset, pinfo, tree, drep);
1475
1476         proto_item_set_len(item, offset-old_offset);
1477         return offset;
1478 }
1479
1480 static int
1481 lsa_dissect_auth_info_blob(tvbuff_t *tvb, int offset,
1482         packet_info *pinfo, proto_tree *tree, char *drep)
1483 {
1484         dcerpc_info *di;
1485         guint32 len;
1486
1487         di=pinfo->private_data;
1488         if(di->conformant_run){
1489                 /*just a run to handle conformant arrays, nothing to dissect */
1490                 return offset;
1491         }
1492
1493         /* len */
1494         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1495                                      hf_lsa_auth_len, &len);
1496
1497         proto_tree_add_item(tree, hf_lsa_auth_blob, tvb, offset, len, FALSE);
1498         offset += len;
1499
1500         return offset;
1501 }
1502
1503 static int
1504 lsa_dissect_auth_info(tvbuff_t *tvb, int offset,
1505         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1506 {
1507         proto_item *item=NULL;
1508         proto_tree *tree=NULL;
1509         int old_offset=offset;
1510
1511         if(parent_tree){
1512                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1513                         "AUTH INFORMATION:");
1514                 tree = proto_item_add_subtree(item, ett_lsa_auth_information);
1515         }
1516
1517         /* update */
1518         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
1519                                      hf_lsa_auth_update, NULL);
1520
1521         /* type */
1522         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1523                                      hf_lsa_auth_type, NULL);
1524
1525         /* len */
1526         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1527                                      hf_lsa_auth_len, NULL);
1528
1529         /* auth info blob */
1530         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1531                         lsa_dissect_auth_info_blob, NDR_POINTER_UNIQUE,
1532                         "AUTH INFO blob:", -1);
1533
1534         proto_item_set_len(item, offset-old_offset);
1535         return offset;
1536 }
1537
1538 static int
1539 lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvbuff_t *tvb, int offset,
1540         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1541 {
1542         proto_item *item=NULL;
1543         proto_tree *tree=NULL;
1544         int old_offset=offset;
1545
1546         if(parent_tree){
1547                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1548                         "TRUSTED DOMAIN AUTH INFORMATION:");
1549                 tree = proto_item_add_subtree(item, ett_lsa_trusted_domain_auth_information);
1550         }
1551
1552         /* unknown */
1553         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1554                                      hf_lsa_unknown_long, NULL);
1555
1556         /* unknown */
1557         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1558
1559         /* unknown */
1560         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1561
1562         /* unknown */
1563         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1564                                      hf_lsa_unknown_long, NULL);
1565
1566         /* unknown */
1567         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1568
1569         /* unknown */
1570         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1571
1572         proto_item_set_len(item, offset-old_offset);
1573         return offset;
1574 }
1575
1576
1577 static int
1578 lsa_dissect_LSA_TRUST_INFORMATION_array(tvbuff_t *tvb, int offset,
1579         packet_info *pinfo, proto_tree *tree, char *drep)
1580 {
1581         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1582                 lsa_dissect_LSA_TRUST_INFORMATION);
1583
1584         return offset;
1585 }
1586
1587 static int
1588 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST(tvbuff_t *tvb, int offset,
1589         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1590 {
1591         proto_item *item=NULL;
1592         proto_tree *tree=NULL;
1593         int old_offset=offset;
1594
1595         if(parent_tree){
1596                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1597                         "LSA_REFERENCED_DOMAIN_LIST:");
1598                 tree = proto_item_add_subtree(item, ett_lsa_referenced_domain_list);
1599         }
1600
1601         /* count */
1602         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1603                                      hf_lsa_count, NULL);
1604
1605         /* trust information */
1606         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1607                 lsa_dissect_LSA_TRUST_INFORMATION_array, NDR_POINTER_UNIQUE,
1608                 "TRUST INFORMATION array:", -1);
1609
1610         /* max count */
1611         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1612                                      hf_lsa_max_count, NULL);
1613
1614         proto_item_set_len(item, offset-old_offset);
1615         return offset;
1616 }
1617
1618 static int
1619 lsa_dissect_lsalookupsids_reply(tvbuff_t *tvb, int offset,
1620         packet_info *pinfo, proto_tree *tree, char *drep)
1621 {
1622         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1623                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
1624                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
1625
1626         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1627                 lsa_dissect_LSA_TRANSLATED_NAMES, NDR_POINTER_REF,
1628                 "LSA_TRANSLATED_NAMES pointer: names", -1);
1629
1630         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1631                 hf_lsa_num_mapped, NULL);
1632
1633         offset = dissect_ntstatus(
1634                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1635
1636         return offset;
1637 }
1638
1639
1640 static int
1641 lsa_dissect_lsasetquotasforaccount_rqst(tvbuff_t *tvb, int offset,
1642         packet_info *pinfo, proto_tree *tree, char *drep)
1643 {
1644         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1645                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1646
1647         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1648                 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO, NDR_POINTER_REF,
1649                 "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1);
1650
1651         return offset;
1652 }
1653
1654
1655 static int
1656 lsa_dissect_lsasetquotasforaccount_reply(tvbuff_t *tvb, int offset,
1657         packet_info *pinfo, proto_tree *tree, char *drep)
1658 {
1659         offset = dissect_ntstatus(
1660                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1661
1662         return offset;
1663 }
1664
1665
1666 static int
1667 lsa_dissect_lsagetquotasforaccount_rqst(tvbuff_t *tvb, int offset,
1668         packet_info *pinfo, proto_tree *tree, char *drep)
1669 {
1670         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1671                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1672
1673         return offset;
1674 }
1675
1676
1677 static int
1678 lsa_dissect_lsagetquotasforaccount_reply(tvbuff_t *tvb, int offset,
1679         packet_info *pinfo, proto_tree *tree, char *drep)
1680 {
1681         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1682                 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO, NDR_POINTER_REF,
1683                 "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1);
1684
1685         offset = dissect_ntstatus(
1686                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1687
1688         return offset;
1689 }
1690
1691
1692 static int
1693 lsa_dissect_lsasetinformationpolicy_rqst(tvbuff_t *tvb, int offset,
1694         packet_info *pinfo, proto_tree *tree, char *drep)
1695 {
1696         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1697                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1698
1699         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1700                 hf_lsa_policy_information_class, NULL);
1701
1702         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1703                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
1704                 "POLICY_INFORMATION pointer: info", -1);
1705
1706         return offset;
1707 }
1708
1709
1710 static int
1711 lsa_dissect_lsasetinformationpolicy_reply(tvbuff_t *tvb, int offset,
1712         packet_info *pinfo, proto_tree *tree, char *drep)
1713 {
1714         offset = dissect_ntstatus(
1715                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1716
1717         return offset;
1718 }
1719
1720
1721 static int
1722 lsa_dissect_lsaclearauditlog_rqst(tvbuff_t *tvb, int offset,
1723         packet_info *pinfo, proto_tree *tree, char *drep)
1724 {
1725         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1726                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1727
1728         offset = dissect_ndr_nt_SID(tvb, offset,
1729                 pinfo, tree, drep, -1);
1730
1731         /* unknown */
1732         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1733                                      hf_lsa_unknown_long, NULL);
1734
1735         return offset;
1736 }
1737
1738
1739 static int
1740 lsa_dissect_lsaclearauditlog_reply(tvbuff_t *tvb, int offset,
1741         packet_info *pinfo, proto_tree *tree, char *drep)
1742 {
1743         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1744                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1745
1746         offset = dissect_ntstatus(
1747                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1748
1749         return offset;
1750 }
1751
1752 static int
1753 lsa_dissect_lsagetsystemaccessaccount_rqst(tvbuff_t *tvb, int offset,
1754         packet_info *pinfo, proto_tree *tree, char *drep)
1755 {
1756         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1757                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1758
1759         return offset;
1760 }
1761
1762
1763 static int
1764 lsa_dissect_lsagetsystemaccessaccount_reply(tvbuff_t *tvb, int offset,
1765         packet_info *pinfo, proto_tree *tree, char *drep)
1766 {
1767         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1768                                      hf_lsa_rid, NULL);
1769
1770         offset = dissect_ntstatus(
1771                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1772
1773         return offset;
1774 }
1775
1776
1777 static int
1778 lsa_dissect_lsasetsystemaccessaccount_rqst(tvbuff_t *tvb, int offset,
1779         packet_info *pinfo, proto_tree *tree, char *drep)
1780 {
1781         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1782                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1783
1784         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1785                 hf_lsa_rid, NULL);
1786
1787         return offset;
1788 }
1789
1790
1791 static int
1792 lsa_dissect_lsasetsystemaccessaccount_reply(tvbuff_t *tvb, int offset,
1793         packet_info *pinfo, proto_tree *tree, char *drep)
1794 {
1795         offset = dissect_ntstatus(
1796                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1797
1798         return offset;
1799 }
1800
1801
1802 static int
1803 lsa_dissect_lsaopentrusteddomain_rqst(tvbuff_t *tvb, int offset,
1804         packet_info *pinfo, proto_tree *tree, char *drep)
1805 {
1806         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1807                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1808
1809         offset = dissect_ndr_nt_SID(tvb, offset,
1810                 pinfo, tree, drep, -1);
1811
1812         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
1813                 pinfo, tree, drep);
1814
1815         return offset;
1816 }
1817
1818
1819 static int
1820 lsa_dissect_lsaopentrusteddomain_reply(tvbuff_t *tvb, int offset,
1821         packet_info *pinfo, proto_tree *tree, char *drep)
1822 {
1823         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1824                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1825
1826         offset = dissect_ntstatus(
1827                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1828
1829         return offset;
1830 }
1831
1832
1833 static int
1834 lsa_dissect_lsadeletetrusteddomain_rqst(tvbuff_t *tvb, int offset,
1835         packet_info *pinfo, proto_tree *tree, char *drep)
1836 {
1837         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1838                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1839
1840         offset = dissect_ndr_nt_SID(tvb, offset,
1841                 pinfo, tree, drep, -1);
1842
1843         return offset;
1844 }
1845
1846
1847 static int
1848 lsa_dissect_lsadeletetrusteddomain_reply(tvbuff_t *tvb, int offset,
1849         packet_info *pinfo, proto_tree *tree, char *drep)
1850 {
1851         offset = dissect_ntstatus(
1852                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1853
1854         return offset;
1855 }
1856
1857 int
1858 dissect_nt_LUID(tvbuff_t *tvb, int offset,
1859         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1860 {
1861         proto_item *item=NULL;
1862         proto_tree *tree=NULL;
1863         int old_offset=offset;
1864
1865         if(parent_tree){
1866                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1867                         "LUID:");
1868                 tree = proto_item_add_subtree(item, ett_LUID);
1869         }
1870
1871         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1872                 hf_nt_luid_low, NULL);
1873
1874         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1875                 hf_nt_luid_high, NULL);
1876
1877         proto_item_set_len(item, offset-old_offset);
1878         return offset;
1879 }
1880
1881 static int
1882 lsa_dissect_LSA_PRIVILEGE(tvbuff_t *tvb, int offset,
1883         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1884 {
1885         proto_item *item=NULL;
1886         proto_tree *tree=NULL;
1887         int old_offset=offset;
1888
1889         if(parent_tree){
1890                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1891                         "LSA_PRIVILEGE:");
1892                 tree = proto_item_add_subtree(item, ett_LSA_PRIVILEGE);
1893         }
1894
1895         /* privilege name */
1896         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1897                         hf_lsa_privilege_name, 0);
1898
1899         /* LUID */
1900         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
1901
1902         proto_item_set_len(item, offset-old_offset);
1903         return offset;
1904 }
1905
1906 static int
1907 lsa_dissect_LSA_PRIVILEGE_array(tvbuff_t *tvb, int offset,
1908         packet_info *pinfo, proto_tree *tree, char *drep)
1909 {
1910         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1911                 lsa_dissect_LSA_PRIVILEGE);
1912
1913         return offset;
1914 }
1915
1916 static int
1917 lsa_dissect_LSA_PRIVILEGES(tvbuff_t *tvb, int offset,
1918         packet_info *pinfo, proto_tree *parent_tree, char *drep)
1919 {
1920         proto_item *item=NULL;
1921         proto_tree *tree=NULL;
1922         int old_offset=offset;
1923
1924         if(parent_tree){
1925                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1926                         "LSA_PRIVILEGES:");
1927                 tree = proto_item_add_subtree(item, ett_LSA_PRIVILEGES);
1928         }
1929
1930         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1931                 hf_lsa_count, NULL);
1932
1933         /* privileges */
1934         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1935                 lsa_dissect_LSA_PRIVILEGE_array, NDR_POINTER_UNIQUE,
1936                 "LSA_PRIVILEGE array:", -1);
1937
1938         proto_item_set_len(item, offset-old_offset);
1939         return offset;
1940 }
1941
1942 static int
1943 lsa_dissect_lsaenumerateprivileges_rqst(tvbuff_t *tvb, int offset,
1944         packet_info *pinfo, proto_tree *tree, char *drep)
1945 {
1946         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1947                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1948
1949         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1950                 hf_lsa_count, NULL);
1951
1952         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1953                 hf_lsa_size, NULL);
1954
1955         return offset;
1956 }
1957
1958 static int
1959 lsa_dissect_lsaenumerateprivileges_reply(tvbuff_t *tvb, int offset,
1960         packet_info *pinfo, proto_tree *tree, char *drep)
1961 {
1962         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1963                 hf_lsa_count, NULL);
1964
1965         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1966                 lsa_dissect_LSA_PRIVILEGES, NDR_POINTER_REF,
1967                 "LSA_PRIVILEGES pointer: privs", -1);
1968
1969         offset = dissect_ntstatus(
1970                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1971
1972         return offset;
1973 }
1974
1975 static int
1976 lsa_dissect_lsalookupprivilegevalue_rqst(tvbuff_t *tvb, int offset,
1977         packet_info *pinfo, proto_tree *tree, char *drep)
1978 {
1979         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1980                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1981
1982         /* privilege name */
1983         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1984                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
1985                 "NAME pointer: ", hf_lsa_privilege_name);
1986
1987         return offset;
1988 }
1989
1990
1991 static int
1992 lsa_dissect_lsalookupprivilegevalue_reply(tvbuff_t *tvb, int offset,
1993         packet_info *pinfo, proto_tree *tree, char *drep)
1994 {
1995
1996         /* LUID */
1997         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
1998
1999         offset = dissect_ntstatus(
2000                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2001
2002         return offset;
2003 }
2004
2005
2006 static int
2007 lsa_dissect_lsalookupprivilegename_rqst(tvbuff_t *tvb, int offset,
2008         packet_info *pinfo, proto_tree *tree, char *drep)
2009 {
2010         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2011                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2012
2013         /* LUID */
2014         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2015                 dissect_nt_LUID, NDR_POINTER_REF,
2016                 "LUID pointer: value", -1);
2017
2018         return offset;
2019 }
2020
2021
2022 static int
2023 lsa_dissect_lsalookupprivilegename_reply(tvbuff_t *tvb, int offset,
2024         packet_info *pinfo, proto_tree *tree, char *drep)
2025 {
2026         /* [out, ref] LSA_UNICODE_STRING **name */
2027         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2028                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
2029                 "PRIVILEGE NAME pointer:", hf_lsa_privilege_name);
2030
2031         offset = dissect_ntstatus(
2032                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2033
2034         return offset;
2035 }
2036
2037
2038 static int
2039 lsa_dissect_lsaenumerateprivilegesaccount_rqst(tvbuff_t *tvb, int offset,
2040         packet_info *pinfo, proto_tree *tree, char *drep)
2041 {
2042         /* [in] LSA_HANDLE hnd */
2043         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2044                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2045
2046         return offset;
2047 }
2048
2049
2050 static int
2051 lsa_dissect_LUID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
2052         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2053 {
2054         proto_item *item=NULL;
2055         proto_tree *tree=NULL;
2056         int old_offset=offset;
2057
2058         if(parent_tree){
2059                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2060                         "LUID_AND_ATTRIBUTES:");
2061                 tree = proto_item_add_subtree(item, ett_LSA_LUID_AND_ATTRIBUTES);
2062         }
2063
2064         /* LUID */
2065         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
2066
2067         /* attr */
2068         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
2069                                      hf_lsa_attr, NULL);
2070
2071         proto_item_set_len(item, offset-old_offset);
2072         return offset;
2073 }
2074
2075 static int
2076 lsa_dissect_LUID_AND_ATTRIBUTES_array(tvbuff_t *tvb, int offset,
2077         packet_info *pinfo, proto_tree *tree, char *drep)
2078 {
2079         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2080                 lsa_dissect_LUID_AND_ATTRIBUTES);
2081
2082         return offset;
2083 }
2084
2085 static int
2086 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
2087         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2088 {
2089         proto_item *item=NULL;
2090         proto_tree *tree=NULL;
2091         int old_offset=offset;
2092
2093         if(parent_tree){
2094                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2095                         "LUID_AND_ATTRIBUTES_ARRAY:");
2096                 tree = proto_item_add_subtree(item, ett_LSA_LUID_AND_ATTRIBUTES_ARRAY);
2097         }
2098
2099         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2100                 hf_lsa_count, NULL);
2101
2102         /* luid and attributes */
2103         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2104                 lsa_dissect_LUID_AND_ATTRIBUTES_array, NDR_POINTER_UNIQUE,
2105                 "LUID_AND_ATTRIBUTES array:", -1);
2106
2107         proto_item_set_len(item, offset-old_offset);
2108         return offset;
2109 }
2110
2111 static int
2112 lsa_dissect_lsaenumerateprivilegesaccount_reply(tvbuff_t *tvb, int offset,
2113         packet_info *pinfo, proto_tree *tree, char *drep)
2114 {
2115         /* [out, ref] LUID_AND_ATTRIBUTES_ARRAY * *privs */
2116         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2117                 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
2118                 "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1);
2119
2120         offset = dissect_ntstatus(
2121                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2122
2123         return offset;
2124 }
2125
2126 static int
2127 lsa_dissect_lsaaddprivilegestoaccount_rqst(tvbuff_t *tvb, int offset,
2128         packet_info *pinfo, proto_tree *tree, char *drep)
2129 {
2130         /* [in] LSA_HANDLE hnd */
2131         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2132                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2133
2134         /* [in, ref] LUID_AND_ATTRIBUTES_ARRAY *privs */
2135         offset = lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY(tvb, offset,
2136                 pinfo, tree, drep);
2137
2138         return offset;
2139 }
2140
2141
2142 static int
2143 lsa_dissect_lsaaddprivilegestoaccount_reply(tvbuff_t *tvb, int offset,
2144         packet_info *pinfo, proto_tree *tree, char *drep)
2145 {
2146         offset = dissect_ntstatus(
2147                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2148
2149         return offset;
2150 }
2151
2152 static int
2153 lsa_dissect_lsaremoveprivilegesfromaccount_rqst(tvbuff_t *tvb, int offset,
2154         packet_info *pinfo, proto_tree *tree, char *drep)
2155 {
2156         /* [in] LSA_HANDLE hnd */
2157         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2158                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2159
2160         /* [in] char unknown */
2161         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
2162                         hf_lsa_unknown_char, NULL);
2163
2164         /* [in, unique] LUID_AND_ATTRIBUTES_ARRAY *privs */
2165         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2166                 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
2167                 "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1);
2168
2169         return offset;
2170 }
2171
2172
2173 static int
2174 lsa_dissect_lsaremoveprivilegesfromaccount_reply(tvbuff_t *tvb, int offset,
2175         packet_info *pinfo, proto_tree *tree, char *drep)
2176 {
2177         offset = dissect_ntstatus(
2178                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2179
2180         return offset;
2181 }
2182
2183 static int
2184 lsa_dissect_lsaenumerateaccounts_rqst(tvbuff_t *tvb, int offset,
2185         packet_info *pinfo, proto_tree *tree, char *drep)
2186 {
2187         /* [in] LSA_HANDLE hnd */
2188         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2189                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2190
2191         /* [in,out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2192         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2193                 hf_lsa_resume_handle, NULL);
2194
2195         /* [in] ULONG pref_maxlen */
2196         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2197                 hf_lsa_max_count, NULL);
2198
2199         return offset;
2200 }
2201
2202 static int
2203 lsa_dissect_lsaenumerateaccounts_reply(tvbuff_t *tvb, int offset,
2204         packet_info *pinfo, proto_tree *tree, char *drep)
2205 {
2206         /* [in,out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2207         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2208                 hf_lsa_resume_handle, NULL);
2209
2210         /* [out, ref] PSID_ARRAY **accounts */
2211         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2212                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
2213                         "PSID_ARRAY", -1);
2214
2215         offset = dissect_ntstatus(
2216                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2217
2218         return offset;
2219 }
2220
2221 static int
2222 lsa_dissect_lsacreatetrusteddomain_rqst(tvbuff_t *tvb, int offset,
2223         packet_info *pinfo, proto_tree *tree, char *drep)
2224 {
2225         /* [in] LSA_HANDLE hnd_pol */
2226         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2227                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2228
2229         /* [in, ref] LSA_TRUST_INFORMATION *domain */
2230         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2231                 lsa_dissect_LSA_TRUST_INFORMATION, NDR_POINTER_REF,
2232                 "LSA_TRUST_INFORMATION pointer: domain", -1);
2233
2234         /* [in] ACCESS_MASK access */
2235         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2236                 pinfo, tree, drep);
2237
2238         return offset;
2239 }
2240
2241 static int
2242 lsa_dissect_lsacreatetrusteddomain_reply(tvbuff_t *tvb, int offset,
2243         packet_info *pinfo, proto_tree *tree, char *drep)
2244 {
2245         /* [out] LSA_HANDLE *hnd */
2246         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2247                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2248
2249         offset = dissect_ntstatus(
2250                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2251
2252         return offset;
2253 }
2254
2255 static int
2256 lsa_dissect_lsaenumeratetrusteddomains_rqst(tvbuff_t *tvb, int offset,
2257         packet_info *pinfo, proto_tree *tree, char *drep)
2258 {
2259         /* [in] LSA_HANDLE hnd */
2260         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2261                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2262
2263         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2264         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2265                 hf_lsa_resume_handle, NULL);
2266
2267         /* [in] ULONG pref_maxlen */
2268         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2269                 hf_lsa_max_count, NULL);
2270
2271         return offset;
2272 }
2273
2274 static int
2275 lsa_dissect_LSA_TRUSTED_DOMAIN(tvbuff_t *tvb, int offset,
2276         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2277 {
2278         proto_item *item=NULL;
2279         proto_tree *tree=NULL;
2280         int old_offset=offset;
2281
2282         if(parent_tree){
2283                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2284                         "TRUSTED_DOMAIN:");
2285                 tree = proto_item_add_subtree(item, ett_LSA_TRUSTED_DOMAIN);
2286         }
2287
2288         /* domain */
2289         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2290                 hf_lsa_domain, 0);
2291
2292         /* sid */
2293         offset = dissect_ndr_nt_PSID(tvb, offset,
2294                 pinfo, tree, drep, -1);
2295
2296         proto_item_set_len(item, offset-old_offset);
2297         return offset;
2298 }
2299
2300 static int
2301 lsa_dissect_LSA_TRUSTED_DOMAIN_array(tvbuff_t *tvb, int offset,
2302         packet_info *pinfo, proto_tree *tree, char *drep)
2303 {
2304         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2305                 lsa_dissect_LSA_TRUSTED_DOMAIN);
2306
2307         return offset;
2308 }
2309
2310 static int
2311 lsa_dissect_LSA_TRUSTED_DOMAIN_LIST(tvbuff_t *tvb, int offset,
2312         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2313 {
2314         proto_item *item=NULL;
2315         proto_tree *tree=NULL;
2316         int old_offset=offset;
2317
2318         if(parent_tree){
2319                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2320                         "TRUSTED_DOMAIN_LIST:");
2321                 tree = proto_item_add_subtree(item, ett_LSA_TRUSTED_DOMAIN_LIST);
2322         }
2323
2324         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2325                 hf_lsa_count, NULL);
2326
2327         /* privileges */
2328         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2329                 lsa_dissect_LSA_TRUSTED_DOMAIN_array, NDR_POINTER_UNIQUE,
2330                 "TRUSTED_DOMAIN array:", -1);
2331
2332         proto_item_set_len(item, offset-old_offset);
2333         return offset;
2334 }
2335
2336 static int
2337 lsa_dissect_lsaenumeratetrusteddomains_reply(tvbuff_t *tvb, int offset,
2338         packet_info *pinfo, proto_tree *tree, char *drep)
2339 {
2340         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2341         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2342                 hf_lsa_resume_handle, NULL);
2343
2344         /* [out, ref] LSA_REFERENCED_DOMAIN_LIST *domains */
2345         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2346                 lsa_dissect_LSA_TRUSTED_DOMAIN_LIST, NDR_POINTER_REF,
2347                 "LSA_TRUSTED_DOMAIN_LIST pointer: domains", -1);
2348
2349         offset = dissect_ntstatus(
2350                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2351
2352         return offset;
2353 }
2354
2355
2356 static int
2357 lsa_dissect_LSA_UNICODE_STRING_item(tvbuff_t *tvb, int offset,
2358         packet_info *pinfo, proto_tree *tree, char *drep)
2359 {
2360         dcerpc_info *di;
2361
2362         di=pinfo->private_data;
2363         if(di->conformant_run){
2364                 /*just a run to handle conformant arrays, nothing to dissect */
2365                 return offset;
2366         }
2367
2368         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2369                         di->hf_index, 0);
2370
2371         return offset;
2372 }
2373
2374 static int
2375 lsa_dissect_LSA_UNICODE_STRING_array(tvbuff_t *tvb, int offset,
2376         packet_info *pinfo, proto_tree *tree, char *drep)
2377 {
2378         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2379                 lsa_dissect_LSA_UNICODE_STRING_item);
2380
2381         return offset;
2382 }
2383
2384 static int
2385 lsa_dissect_LSA_UNICODE_STRING_ARRAY(tvbuff_t *tvb, int offset,
2386         packet_info *pinfo, proto_tree *tree, char *drep)
2387 {
2388         dcerpc_info *di;
2389
2390         di=pinfo->private_data;
2391
2392         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2393                 hf_lsa_count, NULL);
2394         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2395                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_UNIQUE,
2396                 "UNICODE_STRING pointer: ", di->hf_index);
2397
2398         return offset;
2399 }
2400
2401 static int
2402 lsa_dissect_LSA_TRANSLATED_SID(tvbuff_t *tvb, int offset,
2403         packet_info *pinfo, proto_tree *tree, char *drep)
2404 {
2405         /* sid type */
2406         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2407                         hf_lsa_sid_type, NULL);
2408
2409         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2410                                      hf_lsa_rid, NULL);
2411
2412         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2413                                      hf_lsa_index, NULL);
2414
2415         return offset;
2416 }
2417
2418 static int
2419 lsa_dissect_LSA_TRANSLATED_SIDS_array(tvbuff_t *tvb, int offset,
2420         packet_info *pinfo, proto_tree *tree, char *drep)
2421 {
2422         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2423                 lsa_dissect_LSA_TRANSLATED_SID);
2424
2425         return offset;
2426 }
2427
2428 static int
2429 lsa_dissect_LSA_TRANSLATED_SIDS(tvbuff_t *tvb, int offset,
2430         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2431 {
2432         proto_item *item=NULL;
2433         proto_tree *tree=NULL;
2434         int old_offset=offset;
2435
2436         if(parent_tree){
2437                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2438                         "LSA_TRANSLATED_SIDS:");
2439                 tree = proto_item_add_subtree(item, ett_LSA_TRANSLATED_SIDS);
2440         }
2441
2442         /* count */
2443         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2444                                      hf_lsa_count, NULL);
2445
2446         /* settings */
2447         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2448                 lsa_dissect_LSA_TRANSLATED_SIDS_array, NDR_POINTER_UNIQUE,
2449                 "Translated SIDS", -1);
2450
2451         proto_item_set_len(item, offset-old_offset);
2452         return offset;
2453 }
2454
2455 static int
2456 lsa_dissect_lsalookupnames_rqst(tvbuff_t *tvb, int offset,
2457         packet_info *pinfo, proto_tree *tree, char *drep)
2458 {
2459         /* [in] LSA_HANDLE hnd */
2460         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2461                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2462
2463         /* [in] ULONG count */
2464         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2465                 hf_lsa_count, NULL);
2466
2467         /* [in, size_is(count), ref] LSA_UNICODE_STRING *names */
2468         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2469                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_REF,
2470                 "Account pointer: names", hf_lsa_acct);
2471
2472         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
2473         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2474                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
2475                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
2476
2477         /* [in] USHORT level */
2478         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2479                 hf_lsa_info_level, NULL);
2480
2481         /* [in, out, ref] ULONG *num_mapped */
2482         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2483                 hf_lsa_num_mapped, NULL);
2484
2485         return offset;
2486 }
2487
2488
2489 static int
2490 lsa_dissect_lsalookupnames_reply(tvbuff_t *tvb, int offset,
2491         packet_info *pinfo, proto_tree *tree, char *drep)
2492 {
2493         /* [out] LSA_REFERENCED_DOMAIN_LIST *domains */
2494         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2495                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
2496                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
2497
2498         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
2499         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2500                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
2501                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
2502
2503         /* [in, out, ref] ULONG *num_mapped */
2504         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2505                 hf_lsa_num_mapped, NULL);
2506
2507         offset = dissect_ntstatus(
2508                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2509
2510         return offset;
2511 }
2512
2513 static int
2514 lsa_dissect_lsacreatesecret_rqst(tvbuff_t *tvb, int offset,
2515         packet_info *pinfo, proto_tree *tree, char *drep)
2516 {
2517         /* [in] LSA_HANDLE hnd_pol */
2518         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2519                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2520
2521         /* [in, ref] LSA_UNICODE_STRING *name */
2522         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2523                 hf_lsa_name, 0);
2524
2525         /* [in] ACCESS_MASK access */
2526         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2527                 pinfo, tree, drep);
2528
2529         return offset;
2530 }
2531
2532 static int
2533 lsa_dissect_lsacreatesecret_reply(tvbuff_t *tvb, int offset,
2534         packet_info *pinfo, proto_tree *tree, char *drep)
2535 {
2536
2537         /* [out] LSA_HANDLE *hnd */
2538         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2539                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2540
2541         offset = dissect_ntstatus(
2542                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2543
2544         return offset;
2545 }
2546
2547 static int
2548 lsa_dissect_lsaopenaccount_rqst(tvbuff_t *tvb, int offset,
2549         packet_info *pinfo, proto_tree *tree, char *drep)
2550 {
2551         /* [in] LSA_HANDLE hnd_pol */
2552         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2553                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2554
2555         /* [in, ref] SID *account */
2556         offset = dissect_ndr_nt_SID(tvb, offset,
2557                 pinfo, tree, drep, -1);
2558
2559         /* [in] ACCESS_MASK access */
2560         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2561                 pinfo, tree, drep);
2562
2563         return offset;
2564 }
2565
2566
2567 static int
2568 lsa_dissect_lsaopenaccount_reply(tvbuff_t *tvb, int offset,
2569         packet_info *pinfo, proto_tree *tree, char *drep)
2570 {
2571         /* [out] LSA_HANDLE *hnd */
2572         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2573                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2574
2575         offset = dissect_ntstatus(
2576                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2577
2578         return offset;
2579 }
2580
2581 static const value_string trusted_info_level_vals[] = {
2582         {1,     "Domain Name Information"},
2583         {2,     "Controllers Information"},
2584         {3,     "Posix Offset Information"},
2585         {4,     "Password Information"},
2586         {5,     "Domain Information Basic"},
2587         {6,     "Domain Information Ex"},
2588         {7,     "Domain Auth Information"},
2589         {8,     "Domain Full Information"},
2590         {9,     "Domain Security Descriptor"},
2591         {10,    "Domain Private Information"},
2592         {0,     NULL}
2593 };
2594
2595 static int
2596 lsa_dissect_TRUSTED_DOMAIN_INFORMATION(tvbuff_t *tvb, int offset,
2597         packet_info *pinfo, proto_tree *parent_tree, char *drep)
2598 {
2599         proto_item *item=NULL;
2600         proto_tree *tree=NULL;
2601         int old_offset=offset;
2602         guint16 level;
2603
2604         if(parent_tree){
2605                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2606                         "TRUSTED_DOMAIN_INFO:");
2607                 tree = proto_item_add_subtree(item, ett_lsa_trusted_domain_info);
2608         }
2609
2610         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2611                                      hf_lsa_trusted_info_level, &level);
2612
2613         ALIGN_TO_4_BYTES;  /* all union arms aligned to 4 bytes, case 7 and 9 need this  */
2614         switch(level){
2615         case 1:
2616                 offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2617                         hf_lsa_domain, 0);
2618                 break;
2619         case 2:
2620                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2621                         hf_lsa_count, NULL);
2622                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2623                         lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_UNIQUE,
2624                         "Controllers pointer: ", hf_lsa_controller);
2625                 break;
2626         case 3:
2627                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2628                         hf_lsa_rid_offset, NULL);
2629                 break;
2630         case 4:
2631                 offset = lsa_dissect_LSA_SECRET(tvb, offset, pinfo, tree, drep);
2632                 offset = lsa_dissect_LSA_SECRET(tvb, offset, pinfo, tree, drep);
2633                 break;
2634         case 5:
2635                 offset = lsa_dissect_LSA_TRUST_INFORMATION(tvb, offset,
2636                         pinfo, tree, drep);
2637                 break;
2638         case 6:
2639                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2640                         pinfo, tree, drep);
2641                 break;
2642         case 7:
2643                 offset = lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvb, offset, pinfo, tree, drep);
2644                 break;
2645         case 8:
2646                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2647                         pinfo, tree, drep);
2648                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2649                         hf_lsa_rid_offset, NULL);
2650                 offset = lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvb, offset, pinfo, tree, drep);
2651                 break;
2652         case 9:
2653                 offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset, pinfo, tree, drep);
2654                 break;
2655         case 10:
2656                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2657                         pinfo, tree, drep);
2658                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2659                         hf_lsa_rid_offset, NULL);
2660                 offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset, pinfo, tree, drep);
2661                 break;
2662         }
2663
2664         proto_item_set_len(item, offset-old_offset);
2665         return offset;
2666 }
2667
2668 static int
2669 lsa_dissect_lsaqueryinfotrusteddomain_rqst(tvbuff_t *tvb, int offset,
2670         packet_info *pinfo, proto_tree *tree, char *drep)
2671 {
2672         /* [in] LSA_HANDLE hnd */
2673         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2674                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2675
2676         /* [in] TRUSTED_INFORMATION_CLASS level */
2677         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2678                 hf_lsa_trusted_info_level, NULL);
2679
2680         return offset;
2681 }
2682
2683
2684 static int
2685 lsa_dissect_lsaqueryinfotrusteddomain_reply(tvbuff_t *tvb, int offset,
2686         packet_info *pinfo, proto_tree *tree, char *drep)
2687 {
2688         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info */
2689         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2690                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
2691                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
2692
2693         offset = dissect_ntstatus(
2694                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2695
2696         return offset;
2697 }
2698
2699 static int
2700 lsa_dissect_lsasetinformationtrusteddomain_rqst(tvbuff_t *tvb, int offset,
2701         packet_info *pinfo, proto_tree *tree, char *drep)
2702 {
2703         /* [in] LSA_HANDLE hnd */
2704         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2705                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2706
2707         /* [in] TRUSTED_INFORMATION_CLASS level */
2708         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2709                 hf_lsa_trusted_info_level, NULL);
2710
2711         /* [in, ref] TRUSTED_DOMAIN_INFORMATION *info */
2712         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2713                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
2714                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
2715
2716         return offset;
2717 }
2718
2719
2720 static int
2721 lsa_dissect_lsasetinformationtrusteddomain_reply(tvbuff_t *tvb, int offset,
2722         packet_info *pinfo, proto_tree *tree, char *drep)
2723 {
2724         offset = dissect_ntstatus(
2725                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2726
2727         return offset;
2728 }
2729
2730 static int
2731 lsa_dissect_lsaopensecret_rqst(tvbuff_t *tvb, int offset,
2732         packet_info *pinfo, proto_tree *tree, char *drep)
2733 {
2734         /* [in] LSA_HANDLE hnd_pol */
2735         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2736                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2737
2738         /* [in, ref] LSA_UNICODE_STRING *name */
2739         offset = dissect_ndr_counted_string_cb(
2740                 tvb, offset, pinfo, tree, drep, hf_lsa_name,
2741                 cb_wstr_postprocess,
2742                 GINT_TO_POINTER(CB_STR_COL_INFO | 1));
2743
2744         /* [in] ACCESS_MASK access */
2745         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2746                 pinfo, tree, drep);
2747
2748         return offset;
2749 }
2750
2751
2752 static int
2753 lsa_dissect_lsaopensecret_reply(tvbuff_t *tvb, int offset,
2754         packet_info *pinfo, proto_tree *tree, char *drep)
2755 {
2756         /* [out] LSA_HANDLE *hnd */
2757         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2758                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2759
2760         offset = dissect_ntstatus(
2761                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2762
2763         return offset;
2764 }
2765
2766 static int
2767 lsa_dissect_lsasetsecret_rqst(tvbuff_t *tvb, int offset,
2768         packet_info *pinfo, proto_tree *tree, char *drep)
2769 {
2770         /* [in] LSA_HANDLE hnd */
2771         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2772                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2773
2774         /* [in, unique] LSA_SECRET *new_val */
2775         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2776                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2777                 "LSA_SECRET pointer: new_val", -1);
2778
2779         /* [in, unique] LSA_SECRET *old_val */
2780         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2781                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2782                 "LSA_SECRET pointer: old_val", -1);
2783
2784         return offset;
2785 }
2786
2787
2788 static int
2789 lsa_dissect_lsasetsecret_reply(tvbuff_t *tvb, int offset,
2790         packet_info *pinfo, proto_tree *tree, char *drep)
2791 {
2792         offset = dissect_ntstatus(
2793                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2794
2795         return offset;
2796 }
2797
2798 static int
2799 lsa_dissect_lsaquerysecret_rqst(tvbuff_t *tvb, int offset,
2800         packet_info *pinfo, proto_tree *tree, char *drep)
2801 {
2802         /* [in] LSA_HANDLE hnd */
2803         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2804                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2805
2806         /* [in, out, unique] LSA_SECRET **curr_val */
2807         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2808                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
2809                 "LSA_SECRET pointer: curr_val", -1);
2810
2811         /* [in, out, unique] LARGE_INTEGER *curr_mtime */
2812         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2813                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2814                 "NTIME pointer: old_mtime", hf_lsa_cur_mtime);
2815
2816         /* [in, out, unique] LSA_SECRET **old_val */
2817         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2818                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
2819                 "LSA_SECRET pointer: old_val", -1);
2820
2821         /* [in, out, unique] LARGE_INTEGER *old_mtime */
2822         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2823                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2824                 "NTIME pointer: old_mtime", hf_lsa_old_mtime);
2825
2826         return offset;
2827 }
2828
2829
2830 static int
2831 lsa_dissect_lsaquerysecret_reply(tvbuff_t *tvb, int offset,
2832         packet_info *pinfo, proto_tree *tree, char *drep)
2833 {
2834         /* [in, out, unique] LSA_SECRET **curr_val */
2835         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2836                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
2837                 "LSA_SECRET pointer: curr_val", -1);
2838
2839         /* [in, out, unique] LARGE_INTEGER *curr_mtime */
2840         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2841                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2842                 "NTIME pointer: old_mtime", hf_lsa_cur_mtime);
2843
2844         /* [in, out, unique] LSA_SECRET **old_val */
2845         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2846                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
2847                 "LSA_SECRET pointer: old_val", -1);
2848
2849         /* [in, out, unique] LARGE_INTEGER *old_mtime */
2850         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2851                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2852                 "NTIME pointer: old_mtime", hf_lsa_old_mtime);
2853
2854         offset = dissect_ntstatus(
2855                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2856
2857         return offset;
2858 }
2859
2860 static int
2861 lsa_dissect_lsadeleteobject_rqst(tvbuff_t *tvb, int offset,
2862         packet_info *pinfo, proto_tree *tree, char *drep)
2863 {
2864         /* [in] LSA_HANDLE hnd */
2865         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2866                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2867
2868         return offset;
2869 }
2870
2871
2872 static int
2873 lsa_dissect_lsadeleteobject_reply(tvbuff_t *tvb, int offset,
2874         packet_info *pinfo, proto_tree *tree, char *drep)
2875 {
2876         offset = dissect_ntstatus(
2877                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2878
2879         return offset;
2880 }
2881
2882 static int
2883 lsa_dissect_lsaenumerateaccountswithuserright_rqst(tvbuff_t *tvb, int offset,
2884         packet_info *pinfo, proto_tree *tree, char *drep)
2885 {
2886         /* [in] LSA_HANDLE hnd */
2887         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2888                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2889
2890         /* [in, unique] LSA_UNICODE_STRING *rights */
2891         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2892                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
2893                 "LSA_UNICODE_STRING pointer: rights", hf_lsa_rights);
2894
2895         return offset;
2896 }
2897
2898 static int
2899 lsa_dissect_lsaenumerateaccountswithuserright_reply(tvbuff_t *tvb, int offset,
2900         packet_info *pinfo, proto_tree *tree, char *drep)
2901 {
2902         /* [out, ref] LSA_UNICODE_STRING_ARRAY *accounts */
2903         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2904                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2905                 "Account pointer: names", hf_lsa_acct);
2906
2907         offset = dissect_ntstatus(
2908                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2909
2910         return offset;
2911 }
2912
2913 static int
2914 lsa_dissect_lsaenumerateaccountrights_rqst(tvbuff_t *tvb, int offset,
2915         packet_info *pinfo, proto_tree *tree, char *drep)
2916 {
2917         /* [in] LSA_HANDLE hnd */
2918         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2919                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2920
2921         /* [in, ref] SID *account */
2922         offset = dissect_ndr_nt_SID(tvb, offset,
2923                 pinfo, tree, drep, -1);
2924
2925         return offset;
2926 }
2927
2928
2929 static int
2930 lsa_dissect_lsaenumerateaccountrights_reply(tvbuff_t *tvb, int offset,
2931         packet_info *pinfo, proto_tree *tree, char *drep)
2932 {
2933         /* [out, ref] LSA_UNICODE_STRING_ARRAY *rights */
2934         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2935                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2936                 "Account pointer: rights", hf_lsa_rights);
2937
2938         offset = dissect_ntstatus(
2939                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2940
2941         return offset;
2942 }
2943
2944 static int
2945 lsa_dissect_lsaaddaccountrights_rqst(tvbuff_t *tvb, int offset,
2946         packet_info *pinfo, proto_tree *tree, char *drep)
2947 {
2948         /* [in] LSA_HANDLE hnd */
2949         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2950                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2951
2952         /* [in, ref] SID *account */
2953         offset = dissect_ndr_nt_SID(tvb, offset,
2954                 pinfo, tree, drep, -1);
2955
2956         /* [in, ref] LSA_UNICODE_STRING_ARRAY *rights */
2957         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2958                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2959                 "Account pointer: rights", hf_lsa_rights);
2960
2961         return offset;
2962 }
2963
2964
2965 static int
2966 lsa_dissect_lsaaddaccountrights_reply(tvbuff_t *tvb, int offset,
2967         packet_info *pinfo, proto_tree *tree, char *drep)
2968 {
2969         offset = dissect_ntstatus(
2970                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2971
2972         return offset;
2973 }
2974
2975 static int
2976 lsa_dissect_lsaremoveaccountrights_rqst(tvbuff_t *tvb, int offset,
2977         packet_info *pinfo, proto_tree *tree, char *drep)
2978 {
2979         /* [in] LSA_HANDLE hnd */
2980         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2981                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2982
2983         /* [in, ref] SID *account */
2984         offset = dissect_ndr_nt_SID(tvb, offset,
2985                 pinfo, tree, drep, -1);
2986
2987         /* remove all */
2988         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
2989                         hf_lsa_remove_all, NULL);
2990
2991         /* [in, ref] LSA_UNICODE_STRING_ARRAY *rights */
2992         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2993                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2994                 "Account pointer: rights", hf_lsa_rights);
2995
2996         return offset;
2997 }
2998
2999
3000 static int
3001 lsa_dissect_lsaremoveaccountrights_reply(tvbuff_t *tvb, int offset,
3002         packet_info *pinfo, proto_tree *tree, char *drep)
3003 {
3004         offset = dissect_ntstatus(
3005                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3006
3007         return offset;
3008 }
3009
3010
3011 static int
3012 lsa_dissect_lsaquerytrusteddomaininfobyname_rqst(tvbuff_t *tvb, int offset,
3013         packet_info *pinfo, proto_tree *tree, char *drep)
3014 {
3015         /* [in] LSA_HANDLE handle */
3016         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3017                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3018
3019         /* [in, ref] LSA_UNICODE_STRING *name */
3020         /* domain */
3021         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3022                 hf_lsa_domain, 0);
3023
3024         /* [in] TRUSTED_INFORMATION_CLASS level */
3025         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3026                                      hf_lsa_trusted_info_level, NULL);
3027
3028         return offset;
3029 }
3030
3031
3032 static int
3033 lsa_dissect_lsaquerytrusteddomaininfobyname_reply(tvbuff_t *tvb, int offset,
3034         packet_info *pinfo, proto_tree *tree, char *drep)
3035 {
3036         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3037         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3038                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3039                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3040
3041         offset = dissect_ntstatus(
3042                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3043
3044         return offset;
3045 }
3046
3047
3048 static int
3049 lsa_dissect_lsasettrusteddomaininfobyname_rqst(tvbuff_t *tvb, int offset,
3050         packet_info *pinfo, proto_tree *tree, char *drep)
3051 {
3052         /* [in] LSA_HANDLE handle */
3053         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3054                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3055
3056         /* [in, ref] LSA_UNICODE_STRING *name */
3057         /* domain */
3058         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3059                 hf_lsa_domain, 0);
3060
3061         /* [in] TRUSTED_INFORMATION_CLASS level */
3062         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3063                                      hf_lsa_trusted_info_level, NULL);
3064
3065         /* [in, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3066         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3067                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3068                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3069
3070         return offset;
3071 }
3072
3073
3074 static int
3075 lsa_dissect_lsasettrusteddomaininfobyname_reply(tvbuff_t *tvb, int offset,
3076         packet_info *pinfo, proto_tree *tree, char *drep)
3077 {
3078         offset = dissect_ntstatus(
3079                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3080
3081         return offset;
3082 }
3083
3084 static int
3085 lsa_dissect_lsaquerytrusteddomaininfo_rqst(tvbuff_t *tvb, int offset,
3086         packet_info *pinfo, proto_tree *tree, char *drep)
3087 {
3088         /* [in] LSA_HANDLE handle */
3089         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3090                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3091
3092         /* [in, ref] SID *sid */
3093         offset = dissect_ndr_nt_SID(tvb, offset,
3094                 pinfo, tree, drep, -1);
3095
3096         /* [in] TRUSTED_INFORMATION_CLASS level */
3097         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3098                                      hf_lsa_trusted_info_level, NULL);
3099
3100         return offset;
3101 }
3102
3103 static int
3104 lsa_dissect_lsaopentrusteddomainbyname_rqst(tvbuff_t *tvb, int offset,
3105         packet_info *pinfo, proto_tree *tree, char *drep)
3106 {
3107         /* [in] LSA_HANDLE handle */
3108         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3109                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3110
3111         /* [in, ref] LSA_UNICODE_STRING *name */
3112         /* domain */
3113         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3114                 hf_lsa_domain, 0);
3115
3116         /* [in] ACCESS_MASK access */
3117         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3118                 pinfo, tree, drep);
3119
3120         return offset;
3121 }
3122
3123
3124 static int
3125 lsa_dissect_lsaopentrusteddomainbyname_reply(tvbuff_t *tvb, int offset,
3126         packet_info *pinfo, proto_tree *tree, char *drep)
3127 {
3128         /* [out] LSA_HANDLE handle */
3129         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3130                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3131
3132         offset = dissect_ntstatus(
3133                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3134
3135         return offset;
3136 }
3137
3138
3139
3140 static int
3141 lsa_dissect_lsaquerytrusteddomaininfo_reply(tvbuff_t *tvb, int offset,
3142         packet_info *pinfo, proto_tree *tree, char *drep)
3143 {
3144         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3145         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3146                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3147                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3148
3149         offset = dissect_ntstatus(
3150                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3151
3152         return offset;
3153 }
3154
3155 static int
3156 lsa_dissect_lsasettrusteddomaininfo_rqst(tvbuff_t *tvb, int offset,
3157         packet_info *pinfo, proto_tree *tree, char *drep)
3158 {
3159         /* [in] LSA_HANDLE handle */
3160         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3161                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3162
3163         /* [in, ref] SID *sid */
3164         offset = dissect_ndr_nt_SID(tvb, offset,
3165                 pinfo, tree, drep, -1);
3166
3167         /* [in] TRUSTED_INFORMATION_CLASS level */
3168         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3169                                      hf_lsa_trusted_info_level, NULL);
3170
3171         /* [ref, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3172         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3173                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3174                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3175
3176         return offset;
3177 }
3178
3179
3180 static int
3181 lsa_dissect_lsasettrusteddomaininfo_reply(tvbuff_t *tvb, int offset,
3182         packet_info *pinfo, proto_tree *tree, char *drep)
3183 {
3184         offset = dissect_ntstatus(
3185                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3186
3187         return offset;
3188 }
3189
3190 static int
3191 lsa_dissect_lsaqueryinformationpolicy2_rqst(tvbuff_t *tvb, int offset,
3192         packet_info *pinfo, proto_tree *tree, char *drep)
3193 {
3194         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3195                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3196
3197         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3198                 hf_lsa_policy_information_class, NULL);
3199
3200         return offset;
3201 }
3202
3203 static int
3204 lsa_dissect_lsaqueryinformationpolicy2_reply(tvbuff_t *tvb, int offset,
3205         packet_info *pinfo, proto_tree *tree, char *drep)
3206 {
3207         /* This is really a pointer to a pointer though the first level is REF
3208           so we just ignore that one */
3209         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3210                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_UNIQUE,
3211                 "POLICY_INFORMATION pointer: info", -1);
3212
3213         offset = dissect_ntstatus(
3214                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3215
3216         return offset;
3217 }
3218
3219 static int
3220 lsa_dissect_lsasetinformationpolicy2_rqst(tvbuff_t *tvb, int offset,
3221         packet_info *pinfo, proto_tree *tree, char *drep)
3222 {
3223         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3224                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3225
3226         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3227                 hf_lsa_policy_information_class, NULL);
3228
3229         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3230                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3231                 "POLICY_INFORMATION pointer: info", -1);
3232
3233         return offset;
3234 }
3235
3236 static int
3237 lsa_dissect_lsasetinformationpolicy2_reply(tvbuff_t *tvb, int offset,
3238         packet_info *pinfo, proto_tree *tree, char *drep)
3239 {
3240         offset = dissect_ntstatus(
3241                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3242
3243         return offset;
3244 }
3245
3246 static int
3247 lsa_dissect_lsaquerydomaininformationpolicy_rqst(tvbuff_t *tvb, int offset,
3248         packet_info *pinfo, proto_tree *tree, char *drep)
3249 {
3250         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3251                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3252
3253         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3254                 hf_lsa_policy_information_class, NULL);
3255
3256         return offset;
3257 }
3258
3259 static int
3260 lsa_dissect_lsaquerydomaininformationpolicy_reply(tvbuff_t *tvb, int offset,
3261         packet_info *pinfo, proto_tree *tree, char *drep)
3262 {
3263         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3264                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3265                 "POLICY_INFORMATION pointer: info", -1);
3266
3267         offset = dissect_ntstatus(
3268                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3269
3270         return offset;
3271 }
3272
3273 static int
3274 lsa_dissect_lsasetdomaininformationpolicy_rqst(tvbuff_t *tvb, int offset,
3275         packet_info *pinfo, proto_tree *tree, char *drep)
3276 {
3277         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3278                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3279
3280         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3281                 hf_lsa_policy_information_class, NULL);
3282
3283         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3284                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3285                 "POLICY_INFORMATION pointer: info", -1);
3286
3287         return offset;
3288 }
3289
3290 static int
3291 lsa_dissect_lsasetdomaininformationpolicy_reply(tvbuff_t *tvb, int offset,
3292         packet_info *pinfo, proto_tree *tree, char *drep)
3293 {
3294         offset = dissect_ntstatus(
3295                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3296
3297         return offset;
3298 }
3299
3300 static int
3301 lsa_dissect_lsalookupnames2_rqst(tvbuff_t *tvb, int offset,
3302         packet_info *pinfo, proto_tree *tree, char *drep)
3303 {
3304         /* [in] LSA_HANDLE hnd */
3305         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3306                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3307
3308         /* [in] ULONG count */
3309         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3310                 hf_lsa_count, NULL);
3311
3312         /* [in, size_is(count), ref] LSA_UNICODE_STRING *names */
3313         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3314                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_REF,
3315                 "Account pointer: names", hf_lsa_acct);
3316
3317         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
3318         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3319                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
3320                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
3321
3322         /* [in] USHORT level */
3323         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3324                 hf_lsa_info_level, NULL);
3325
3326         /* [in, out, ref] ULONG *num_mapped */
3327         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3328                 hf_lsa_num_mapped, NULL);
3329
3330         /* unknown */
3331         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3332                                      hf_lsa_unknown_long, NULL);
3333
3334         /* unknown */
3335         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3336                                      hf_lsa_unknown_long, NULL);
3337
3338         return offset;
3339 }
3340
3341
3342 static int
3343 lsa_dissect_lsalookupnames2_reply(tvbuff_t *tvb, int offset,
3344         packet_info *pinfo, proto_tree *tree, char *drep)
3345 {
3346         /* [out] LSA_REFERENCED_DOMAIN_LIST *domains */
3347         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3348                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
3349                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
3350
3351         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
3352         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3353                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
3354                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
3355
3356         /* [in, out, ref] ULONG *num_mapped */
3357         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3358                 hf_lsa_num_mapped, NULL);
3359
3360         offset = dissect_ntstatus(
3361                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3362
3363         return offset;
3364 }
3365
3366
3367 static int
3368 lsa_dissect_lsacreateaccount_rqst(tvbuff_t *tvb, int offset,
3369         packet_info *pinfo, proto_tree *tree, char *drep)
3370 {
3371         /* [in] LSA_HANDLE hnd */
3372         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3373                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3374
3375         offset = dissect_ndr_nt_SID(tvb, offset,
3376                 pinfo, tree, drep, -1);
3377
3378         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3379                 pinfo, tree, drep);
3380
3381         return offset;
3382 }
3383
3384 static int
3385 lsa_dissect_lsacreateaccount_reply(tvbuff_t *tvb, int offset,
3386         packet_info *pinfo, proto_tree *tree, char *drep)
3387 {
3388         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3389                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3390
3391         offset = dissect_ntstatus(
3392                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3393
3394         return offset;
3395 }
3396
3397 static int
3398 lsa_dissect_lsalookupprivilegedisplayname_rqst(tvbuff_t *tvb, int offset,
3399         packet_info *pinfo, proto_tree *tree, char *drep)
3400 {
3401         /* [in] LSA_HANDLE hnd */
3402         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3403                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3404
3405         /* [in, ref] LSA_UNICODE_STRING *name */
3406         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3407                 hf_lsa_name, 0);
3408
3409         /* [in] USHORT unknown */
3410         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3411                 hf_lsa_unknown_short, NULL);
3412
3413         /* [in] USHORT size */
3414         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3415                 hf_lsa_size16, NULL);
3416
3417         return offset;
3418 }
3419
3420
3421 static int
3422 lsa_dissect_lsalookupprivilegedisplayname_reply(tvbuff_t *tvb, int offset,
3423         packet_info *pinfo, proto_tree *tree, char *drep)
3424 {
3425         /* [out, ref] LSA_UNICODE_STRING **disp_name */
3426         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3427                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3428                 "NAME pointer: ", hf_lsa_privilege_name);
3429
3430         /* [out, ref] USHORT *size_needed */
3431         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3432                 hf_lsa_size_needed, NULL);
3433
3434         offset = dissect_ntstatus(
3435                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3436
3437         return offset;
3438 }
3439
3440 static int
3441 lsa_dissect_lsastoreprivatedata_rqst(tvbuff_t *tvb, int offset,
3442         packet_info *pinfo, proto_tree *tree, char *drep)
3443 {
3444         /* [in] LSA_HANDLE hnd */
3445         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3446                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3447
3448         /* [in, ref] LSA_UNICODE_STRING *key */
3449         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3450                 hf_lsa_key, 0);
3451
3452         /* [in, unique] LSA_SECRET **data */
3453         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3454                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
3455                 "LSA_SECRET* pointer: data", -1);
3456
3457         return offset;
3458 }
3459
3460
3461 static int
3462 lsa_dissect_lsastoreprivatedata_reply(tvbuff_t *tvb, int offset,
3463         packet_info *pinfo, proto_tree *tree, char *drep)
3464 {
3465         offset = dissect_ntstatus(
3466                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3467
3468         return offset;
3469 }
3470
3471 static int
3472 lsa_dissect_lsaretrieveprivatedata_rqst(tvbuff_t *tvb, int offset,
3473         packet_info *pinfo, proto_tree *tree, char *drep)
3474 {
3475         /* [in] LSA_HANDLE hnd */
3476         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3477                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3478
3479         /* [in, ref] LSA_UNICODE_STRING *key */
3480         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3481                 hf_lsa_key, 0);
3482
3483         /* [in, out, ref] LSA_SECRET **data */
3484         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3485                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_REF,
3486                 "LSA_SECRET* pointer: data", -1);
3487
3488         return offset;
3489 }
3490
3491
3492 static int
3493 lsa_dissect_lsaretrieveprivatedata_reply(tvbuff_t *tvb, int offset,
3494         packet_info *pinfo, proto_tree *tree, char *drep)
3495 {
3496         /* [in, out, ref] LSA_SECRET **data */
3497         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3498                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_REF,
3499                 "LSA_SECRET* pointer: data", -1);
3500
3501         offset = dissect_ntstatus(
3502                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3503
3504         return offset;
3505 }
3506
3507 static int
3508 lsa_dissect_lsaclosetrusteddomainex_rqst(tvbuff_t *tvb, int offset,
3509         packet_info *pinfo, proto_tree *tree, char *drep)
3510 {
3511
3512         /* [in, out] LSA_HANDLE *tdHnd */
3513         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3514                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3515
3516         return offset;
3517 }
3518
3519
3520 static int
3521 lsa_dissect_lsaclosetrusteddomainex_reply(tvbuff_t *tvb, int offset,
3522         packet_info *pinfo, proto_tree *tree, char *drep)
3523 {
3524
3525         /* [in, out] LSA_HANDLE *tdHnd */
3526         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3527                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3528
3529         offset = dissect_ntstatus(
3530                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3531
3532         return offset;
3533 }
3534
3535 static int
3536 lsa_dissect_LSA_TRANSLATED_NAME_EX(tvbuff_t *tvb, int offset,
3537         packet_info *pinfo, proto_tree *parent_tree, char *drep)
3538 {
3539         proto_item *item=NULL;
3540         proto_tree *tree=NULL;
3541         int old_offset=offset;
3542
3543         if(parent_tree){
3544                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3545                         "LSA_TRANSLATED_NAME:");
3546                 tree = proto_item_add_subtree(item, ett_lsa_translated_name);
3547         }
3548
3549         /* sid type */
3550         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3551                         hf_lsa_sid_type, NULL);
3552
3553         /* name */
3554         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3555                 hf_lsa_name, 0);
3556
3557         /* index */
3558         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3559                                      hf_lsa_index, NULL);
3560
3561         /* unknown */
3562         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3563                                      hf_lsa_unknown_long, NULL);
3564
3565         proto_item_set_len(item, offset-old_offset);
3566         return offset;
3567 }
3568
3569 static int
3570 lsa_dissect_LSA_TRANSLATED_NAME_EX_array(tvbuff_t *tvb, int offset,
3571         packet_info *pinfo, proto_tree *tree, char *drep)
3572 {
3573         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3574                 lsa_dissect_LSA_TRANSLATED_NAME_EX);
3575
3576         return offset;
3577 }
3578 static int
3579 lsa_dissect_LSA_TRANSLATED_NAMES_EX(tvbuff_t *tvb, int offset,
3580         packet_info *pinfo, proto_tree *tree, char *drep)
3581 {
3582         /* count */
3583         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3584                                      hf_lsa_count, NULL);
3585
3586         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3587                         lsa_dissect_LSA_TRANSLATED_NAME_EX_array, NDR_POINTER_UNIQUE,
3588                         "LSA_TRANSLATED_NAME_EX: pointer", -1);
3589
3590         return offset;
3591 }
3592
3593
3594 static int
3595 lsa_dissect_lsalookupsids2_rqst(tvbuff_t *tvb, int offset,
3596         packet_info *pinfo, proto_tree *tree, char *drep)
3597 {
3598         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3599                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3600
3601         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3602                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
3603                         "PSID_ARRAY", -1);
3604
3605         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3606                 lsa_dissect_LSA_TRANSLATED_NAMES_EX, NDR_POINTER_REF,
3607                 "LSA_TRANSLATED_NAMES_EX pointer: names", -1);
3608
3609         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3610                 hf_lsa_info_level, NULL);
3611
3612         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3613                 hf_lsa_num_mapped, NULL);
3614
3615         /* unknown */
3616         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3617                                      hf_lsa_unknown_long, NULL);
3618
3619         /* unknown */
3620         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3621                                      hf_lsa_unknown_long, NULL);
3622
3623         return offset;
3624 }
3625
3626 static int
3627 lsa_dissect_lsalookupsids2_reply(tvbuff_t *tvb, int offset,
3628         packet_info *pinfo, proto_tree *tree, char *drep)
3629 {
3630         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3631                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
3632                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
3633
3634         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3635                 lsa_dissect_LSA_TRANSLATED_NAMES_EX, NDR_POINTER_REF,
3636                 "LSA_TRANSLATED_NAMES_EX pointer: names", -1);
3637
3638         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3639                 hf_lsa_num_mapped, NULL);
3640
3641         offset = dissect_ntstatus(
3642                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3643
3644         return offset;
3645 }
3646
3647 static int
3648 lsa_dissect_lsagetusername_rqst(tvbuff_t *tvb, int offset,
3649         packet_info *pinfo, proto_tree *tree, char *drep)
3650 {
3651
3652         /* [in, unique, string] WCHAR *server */
3653         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3654                 dissect_lsa_openpolicy_server, NDR_POINTER_UNIQUE,
3655                 "Server:", hf_lsa_server);
3656
3657         /* [in, out, ref] LSA_UNICODE_STRING **user */
3658         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3659                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3660                 "ACCOUNT pointer: ", hf_lsa_acct);
3661
3662         /* [in, out, unique] LSA_UNICODE_STRING **domain */
3663         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3664                 lsa_dissect_pointer_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3665                 "DOMAIN pointer: ", hf_lsa_domain);
3666
3667         return offset;
3668 }
3669
3670
3671 static int
3672 lsa_dissect_lsagetusername_reply(tvbuff_t *tvb, int offset,
3673         packet_info *pinfo, proto_tree *tree, char *drep)
3674 {
3675         /* [in, out, ref] LSA_UNICODE_STRING **user */
3676         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3677                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3678                 "ACCOUNT pointer: ", hf_lsa_acct);
3679
3680         /* [in, out, unique] LSA_UNICODE_STRING **domain */
3681         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3682                 lsa_dissect_pointer_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3683                 "DOMAIN pointer: ", hf_lsa_domain);
3684
3685         offset = dissect_ntstatus(
3686                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3687
3688         return offset;
3689 }
3690
3691 static int
3692 lsa_dissect_lsacreatetrusteddomainex_rqst(tvbuff_t *tvb, int offset,
3693         packet_info *pinfo, proto_tree *tree, char *drep)
3694 {
3695         /* [in] LSA_HANDLE hnd */
3696         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3697                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3698
3699         /* [in, ref] TRUSTED_DOMAIN_INFORMATION_EX *info */
3700         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3701                 lsa_dissect_LSA_TRUST_INFORMATION_EX, NDR_POINTER_REF,
3702                 "TRUSTED_DOMAIN_INFORMATION_EX pointer: info", -1);
3703
3704         /* [in, ref] TRUSTED_DOMAIN_AUTH_INFORMATION *auth */
3705         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3706                 lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION, NDR_POINTER_REF,
3707                 "TRUSTED_DOMAIN_AUTH_INFORMATION pointer: auth", -1);
3708
3709         /* [in] ACCESS_MASK mask */
3710         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3711                 pinfo, tree, drep);
3712
3713         return offset;
3714 }
3715
3716
3717 static int
3718 lsa_dissect_lsacreatetrusteddomainex_reply(tvbuff_t *tvb, int offset,
3719         packet_info *pinfo, proto_tree *tree, char *drep)
3720 {
3721         /* [out] LSA_HANDLE *tdHnd) */
3722         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3723                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3724
3725         offset = dissect_ntstatus(
3726                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3727
3728         return offset;
3729 }
3730
3731 static int
3732 lsa_dissect_lsaenumeratetrusteddomainsex_rqst(tvbuff_t *tvb, int offset,
3733         packet_info *pinfo, proto_tree *tree, char *drep)
3734 {
3735         /* [in] LSA_HANDLE hnd */
3736         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3737                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3738
3739         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
3740         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3741                 hf_lsa_resume_handle, NULL);
3742
3743         /* [in] ULONG pref_maxlen */
3744         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3745                 hf_lsa_max_count, NULL);
3746
3747         return offset;
3748 }
3749
3750
3751 static int
3752 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_EX_array(tvbuff_t *tvb, int offset,
3753         packet_info *pinfo, proto_tree *tree, char *drep)
3754 {
3755         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3756                 lsa_dissect_LSA_TRUST_INFORMATION_EX);
3757
3758         return offset;
3759 }
3760
3761 static int
3762 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_LIST_EX(tvbuff_t *tvb, int offset,
3763         packet_info *pinfo, proto_tree *tree, char *drep)
3764 {
3765         /* count */
3766         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3767                                      hf_lsa_count, NULL);
3768
3769         /* trust information */
3770         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3771                 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_EX_array, NDR_POINTER_UNIQUE,
3772                 "TRUST INFORMATION array:", -1);
3773
3774         /* max count */
3775         /* The original code here was wrong. It now handles these correctly */
3776         /*offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3777                                      hf_lsa_max_count, NULL);
3778         */
3779
3780         return offset;
3781 }
3782
3783 static int
3784 lsa_dissect_lsaenumeratetrusteddomainsex_reply(tvbuff_t *tvb, int offset,
3785         packet_info *pinfo, proto_tree *tree, char *drep)
3786 {
3787         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
3788         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3789                 hf_lsa_resume_handle, NULL);
3790
3791         /* [out, ref] TRUSTED_DOMAIN_INFORMATION_LIST_EX *domains */
3792         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3793                 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_LIST_EX, NDR_POINTER_REF,
3794                 "TRUSTED_DOMAIN_INFORMATION_LIST_EX pointer: domains", -1);
3795
3796         offset = dissect_ntstatus(
3797                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3798
3799         return offset;
3800 }
3801
3802 static int
3803 lsa_dissect_lsafunction_38_rqst(tvbuff_t *tvb, int offset,
3804         packet_info *pinfo, proto_tree *tree, char *drep)
3805 {
3806         /* [in] LSA_HANDLE handle */
3807         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3808                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3809
3810         /* [in] USHORT flag */
3811         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3812                 hf_lsa_unknown_short, NULL);
3813
3814         /* [in, ref] LSA_SECURITY_DESCRIPTOR *sd */
3815         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3816                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
3817                 "LSA_SECURITY_DESCRIPTOR pointer: sd", -1);
3818
3819         return offset;
3820 }
3821
3822
3823 static int
3824 lsa_dissect_lsafunction_38_reply(tvbuff_t *tvb, int offset,
3825         packet_info *pinfo, proto_tree *tree, char *drep)
3826 {
3827         /* [out, ref] LSA_SECURITY_DESCRIPTOR **psd) */
3828         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3829                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
3830                 "LSA_SECURITY_DESCRIPTOR pointer: psd)", -1);
3831
3832         offset = dissect_ntstatus(
3833                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3834
3835         return offset;
3836 }
3837
3838 static int
3839 lsa_dissect_lsafunction_3b_rqst(tvbuff_t *tvb, int offset,
3840         packet_info *pinfo, proto_tree *tree, char *drep)
3841 {
3842         /* [in] LSA_HANDLE hnd */
3843         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3844                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3845
3846         /* [in, ref] TRUSTED_DOMAIN_INFORMATION_EX *info */
3847         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3848                 lsa_dissect_LSA_TRUST_INFORMATION_EX, NDR_POINTER_REF,
3849                 "TRUSTED_DOMAIN_INFORMATION_EX pointer: info", -1);
3850
3851         /* [in, ref] LSA_SECURITY_DESCRIPTOR *sd */
3852         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3853                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
3854                 "LSA_SECURITY_DESCRIPTOR pointer: sd", -1);
3855
3856         /* [in] ULONG unknown */
3857         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3858                 hf_lsa_unknown_long, NULL);
3859
3860         return offset;
3861 }
3862
3863
3864 static int
3865 lsa_dissect_lsafunction_3b_reply(tvbuff_t *tvb, int offset,
3866         packet_info *pinfo, proto_tree *tree, char *drep)
3867 {
3868         /* [out] LSA_HANDLE *h2) */
3869         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3870                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3871
3872         offset = dissect_ntstatus(
3873                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3874
3875         return offset;
3876 }
3877
3878
3879 static dcerpc_sub_dissector dcerpc_lsa_dissectors[] = {
3880         { LSA_LSACLOSE, "Close",
3881                 lsa_dissect_lsaclose_rqst,
3882                 lsa_dissect_lsaclose_reply },
3883         { LSA_LSADELETE, "Delete",
3884                 lsa_dissect_lsadelete_rqst,
3885                 lsa_dissect_lsadelete_reply },
3886         { LSA_LSAENUMERATEPRIVILEGES, "EnumPrivs",
3887                 lsa_dissect_lsaenumerateprivileges_rqst,
3888                 lsa_dissect_lsaenumerateprivileges_reply },
3889         { LSA_LSAQUERYSECURITYOBJECT, "QuerySecObject",
3890                 lsa_dissect_lsaquerysecurityobject_rqst,
3891                 lsa_dissect_lsaquerysecurityobject_reply },
3892         { LSA_LSASETSECURITYOBJECT, "SetSecObject",
3893                 lsa_dissect_lsasetsecurityobject_rqst,
3894                 lsa_dissect_lsasetsecurityobject_reply },
3895         { LSA_LSACHANGEPASSWORD, "ChangePassword",
3896                 lsa_dissect_lsachangepassword_rqst,
3897                 lsa_dissect_lsachangepassword_reply },
3898         { LSA_LSAOPENPOLICY, "OpenPolicy",
3899                 lsa_dissect_lsaopenpolicy_rqst,
3900                 lsa_dissect_lsaopenpolicy_reply },
3901         { LSA_LSAQUERYINFORMATIONPOLICY, "QueryInfoPolicy",
3902                 lsa_dissect_lsaqueryinformationpolicy_rqst,
3903                 lsa_dissect_lsaqueryinformationpolicy_reply },
3904         { LSA_LSASETINFORMATIONPOLICY, "SetInfoPolicy",
3905                 lsa_dissect_lsasetinformationpolicy_rqst,
3906                 lsa_dissect_lsasetinformationpolicy_reply },
3907         { LSA_LSACLEARAUDITLOG, "ClearAuditLog",
3908                 lsa_dissect_lsaclearauditlog_rqst,
3909                 lsa_dissect_lsaclearauditlog_reply },
3910         { LSA_LSACREATEACCOUNT, "CreateAccount",
3911                 lsa_dissect_lsacreateaccount_rqst,
3912                 lsa_dissect_lsacreateaccount_reply },
3913         { LSA_LSAENUMERATEACCOUNTS, "EnumAccounts",
3914                 lsa_dissect_lsaenumerateaccounts_rqst,
3915                 lsa_dissect_lsaenumerateaccounts_reply },
3916         { LSA_LSACREATETRUSTEDDOMAIN, "CreateTrustedDomain",
3917                 lsa_dissect_lsacreatetrusteddomain_rqst,
3918                 lsa_dissect_lsacreatetrusteddomain_reply },
3919         { LSA_LSAENUMERATETRUSTEDDOMAINS, "EnumTrustedDomains",
3920                 lsa_dissect_lsaenumeratetrusteddomains_rqst,
3921                 lsa_dissect_lsaenumeratetrusteddomains_reply },
3922         { LSA_LSALOOKUPNAMES, "LookupNames",
3923                 lsa_dissect_lsalookupnames_rqst,
3924                 lsa_dissect_lsalookupnames_reply },
3925         { LSA_LSALOOKUPSIDS, "LookupSIDs",
3926                 lsa_dissect_lsalookupsids_rqst,
3927                 lsa_dissect_lsalookupsids_reply },
3928         { LSA_LSACREATESECRET, "CreateSecret",
3929                 lsa_dissect_lsacreatesecret_rqst,
3930                 lsa_dissect_lsacreatesecret_reply },
3931         { LSA_LSAOPENACCOUNT, "OpenAccount",
3932                 lsa_dissect_lsaopenaccount_rqst,
3933                 lsa_dissect_lsaopenaccount_reply },
3934         { LSA_LSAENUMERATEPRIVILEGESACCOUNT, "EnumPrivsAccount",
3935                 lsa_dissect_lsaenumerateprivilegesaccount_rqst,
3936                 lsa_dissect_lsaenumerateprivilegesaccount_reply },
3937         { LSA_LSAADDPRIVILEGESTOACCOUNT, "AddPrivsToAccount",
3938                 lsa_dissect_lsaaddprivilegestoaccount_rqst,
3939                 lsa_dissect_lsaaddprivilegestoaccount_reply },
3940         { LSA_LSAREMOVEPRIVILEGESFROMACCOUNT, "MovePrivsFromAccount",
3941                 lsa_dissect_lsaremoveprivilegesfromaccount_rqst,
3942                 lsa_dissect_lsaremoveprivilegesfromaccount_reply },
3943         { LSA_LSAGETQUOTASFORACCOUNT, "GetQuotasForAccount",
3944                 lsa_dissect_lsagetquotasforaccount_rqst,
3945                 lsa_dissect_lsagetquotasforaccount_reply },
3946         { LSA_LSASETQUOTASFORACCOUNT, "SetQuotasForAccount",
3947                 lsa_dissect_lsasetquotasforaccount_rqst,
3948                 lsa_dissect_lsasetquotasforaccount_reply },
3949         { LSA_LSAGETSYSTEMACCESSACCOUNT, "GetSystemAccessAccount",
3950                 lsa_dissect_lsagetsystemaccessaccount_rqst,
3951                 lsa_dissect_lsagetsystemaccessaccount_reply },
3952         { LSA_LSASETSYSTEMACCESSACCOUNT, "SetSystemAccessAccount",
3953                 lsa_dissect_lsasetsystemaccessaccount_rqst,
3954                 lsa_dissect_lsasetsystemaccessaccount_reply },
3955         { LSA_LSAOPENTRUSTEDDOMAIN, "OpenTrustedDomain",
3956                 lsa_dissect_lsaopentrusteddomain_rqst,
3957                 lsa_dissect_lsaopentrusteddomain_reply },
3958         { LSA_LSAQUERYINFOTRUSTEDDOMAIN, "QueryInfoTrustedDomain",
3959                 lsa_dissect_lsaqueryinfotrusteddomain_rqst,
3960                 lsa_dissect_lsaqueryinfotrusteddomain_reply },
3961         { LSA_LSASETINFORMATIONTRUSTEDDOMAIN, "SetInfoTrustedDomain",
3962                 lsa_dissect_lsasetinformationtrusteddomain_rqst,
3963                 lsa_dissect_lsasetinformationtrusteddomain_reply },
3964         { LSA_LSAOPENSECRET, "OpenSecret",
3965                 lsa_dissect_lsaopensecret_rqst,
3966                 lsa_dissect_lsaopensecret_reply },
3967         { LSA_LSASETSECRET, "SetSecret",
3968                 lsa_dissect_lsasetsecret_rqst,
3969                 lsa_dissect_lsasetsecret_reply },
3970         { LSA_LSAQUERYSECRET, "QuerySecret",
3971                 lsa_dissect_lsaquerysecret_rqst,
3972                 lsa_dissect_lsaquerysecret_reply },
3973         { LSA_LSALOOKUPPRIVILEGEVALUE, "LookupPrivValue",
3974                 lsa_dissect_lsalookupprivilegevalue_rqst,
3975                 lsa_dissect_lsalookupprivilegevalue_reply },
3976         { LSA_LSALOOKUPPRIVILEGENAME, "LookupPrivName",
3977                 lsa_dissect_lsalookupprivilegename_rqst,
3978                 lsa_dissect_lsalookupprivilegename_reply },
3979         { LSA_LSALOOKUPPRIVILEGEDISPLAYNAME, "LookupPrivDispName",
3980                 lsa_dissect_lsalookupprivilegedisplayname_rqst,
3981                 lsa_dissect_lsalookupprivilegedisplayname_reply },
3982         { LSA_LSADELETEOBJECT, "DeleteObject",
3983                 lsa_dissect_lsadeleteobject_rqst,
3984                 lsa_dissect_lsadeleteobject_reply },
3985         { LSA_LSAENUMERATEACCOUNTSWITHUSERRIGHT, "EnumAccountsWithUserRight",
3986                 lsa_dissect_lsaenumerateaccountswithuserright_rqst,
3987                 lsa_dissect_lsaenumerateaccountswithuserright_reply },
3988         { LSA_LSAENUMERATEACCOUNTRIGHTS, "EnumAccountRights",
3989                 lsa_dissect_lsaenumerateaccountrights_rqst,
3990                 lsa_dissect_lsaenumerateaccountrights_reply },
3991         { LSA_LSAADDACCOUNTRIGHTS, "AddAccountRights",
3992                 lsa_dissect_lsaaddaccountrights_rqst,
3993                 lsa_dissect_lsaaddaccountrights_reply },
3994         { LSA_LSAREMOVEACCOUNTRIGHTS, "RemoveAccountRights",
3995                 lsa_dissect_lsaremoveaccountrights_rqst,
3996                 lsa_dissect_lsaremoveaccountrights_reply },
3997         { LSA_LSAQUERYTRUSTEDDOMAININFO, "QueryTrustedDomainInfo",
3998                 lsa_dissect_lsaquerytrusteddomaininfo_rqst,
3999                 lsa_dissect_lsaquerytrusteddomaininfo_reply },
4000         { LSA_LSASETTRUSTEDDOMAININFO, "SetTrustedDomainInfo",
4001                 lsa_dissect_lsasettrusteddomaininfo_rqst,
4002                 lsa_dissect_lsasettrusteddomaininfo_reply },
4003         { LSA_LSADELETETRUSTEDDOMAIN, "DeleteTrsutedDomain",
4004                 lsa_dissect_lsadeletetrusteddomain_rqst,
4005                 lsa_dissect_lsadeletetrusteddomain_reply },
4006         { LSA_LSASTOREPRIVATEDATA, "StorePrivateData",
4007                 lsa_dissect_lsastoreprivatedata_rqst,
4008                 lsa_dissect_lsastoreprivatedata_reply },
4009         { LSA_LSARETRIEVEPRIVATEDATA, "RetrievePrivateData",
4010                 lsa_dissect_lsaretrieveprivatedata_rqst,
4011                 lsa_dissect_lsaretrieveprivatedata_reply },
4012         { LSA_LSAOPENPOLICY2, "OpenPolicy2",
4013                 lsa_dissect_lsaopenpolicy2_rqst,
4014                 lsa_dissect_lsaopenpolicy2_reply },
4015         { LSA_LSAGETUSERNAME, "GetUsername",
4016                 lsa_dissect_lsagetusername_rqst,
4017                 lsa_dissect_lsagetusername_reply },
4018         { LSA_LSAQUERYINFORMATIONPOLICY2, "QueryInformationPolicy2",
4019                 lsa_dissect_lsaqueryinformationpolicy2_rqst,
4020                 lsa_dissect_lsaqueryinformationpolicy2_reply },
4021         { LSA_LSASETINFORMATIONPOLICY2, "SetInformationPolicy2",
4022                 lsa_dissect_lsasetinformationpolicy2_rqst,
4023                 lsa_dissect_lsasetinformationpolicy2_reply },
4024         { LSA_LSAQUERYTRUSTEDDOMAININFOBYNAME, "QueryTrustedDomainInfoByName",
4025                 lsa_dissect_lsaquerytrusteddomaininfobyname_rqst,
4026                 lsa_dissect_lsaquerytrusteddomaininfobyname_reply },
4027         { LSA_LSASETTRUSTEDDOMAININFOBYNAME, "SetTrustedDomainInfoByName",
4028                 lsa_dissect_lsasettrusteddomaininfobyname_rqst,
4029                 lsa_dissect_lsasettrusteddomaininfobyname_reply },
4030         { LSA_LSAENUMERATETRUSTEDDOMAINSEX, "EnumTrustedDomainsEx",
4031                 lsa_dissect_lsaenumeratetrusteddomainsex_rqst,
4032                 lsa_dissect_lsaenumeratetrusteddomainsex_reply },
4033         { LSA_LSACREATETRUSTEDDOMAINEX, "CreateTrustedDomainEx",
4034                 lsa_dissect_lsacreatetrusteddomainex_rqst,
4035                 lsa_dissect_lsacreatetrusteddomainex_reply },
4036         { LSA_LSACLOSETRUSTEDDOMAINEX, "CloseTrustedDomainEx",
4037                 lsa_dissect_lsaclosetrusteddomainex_rqst,
4038                 lsa_dissect_lsaclosetrusteddomainex_reply },
4039         { LSA_LSAQUERYDOMAININFORMATIONPOLICY, "QueryDomainInfoPolicy",
4040                 lsa_dissect_lsaquerydomaininformationpolicy_rqst,
4041                 lsa_dissect_lsaquerydomaininformationpolicy_reply },
4042         { LSA_LSASETDOMAININFORMATIONPOLICY, "SetDomainInfoPolicy",
4043                 lsa_dissect_lsasetdomaininformationpolicy_rqst,
4044                 lsa_dissect_lsasetdomaininformationpolicy_reply },
4045         { LSA_LSAOPENTRUSTEDDOMAINBYNAME, "OpenTrustedDomainByName",
4046                 lsa_dissect_lsaopentrusteddomainbyname_rqst,
4047                 lsa_dissect_lsaopentrusteddomainbyname_reply },
4048         { LSA_LSAFUNCTION_38, "LSAFUNCTION_38",
4049                 lsa_dissect_lsafunction_38_rqst,
4050                 lsa_dissect_lsafunction_38_reply },
4051         { LSA_LSALOOKUPSIDS2, "LookupSIDs2",
4052                 lsa_dissect_lsalookupsids2_rqst,
4053                 lsa_dissect_lsalookupsids2_reply },
4054         { LSA_LSALOOKUPNAMES2, "LookupNames2",
4055                 lsa_dissect_lsalookupnames2_rqst,
4056                 lsa_dissect_lsalookupnames2_reply },
4057         { LSA_LSAFUNCTION_3B, "LSAFUNCTION_3B",
4058                 lsa_dissect_lsafunction_3b_rqst,
4059                 lsa_dissect_lsafunction_3b_reply },
4060         {0, NULL, NULL, NULL}
4061 };
4062
4063 void
4064 proto_register_dcerpc_lsa(void)
4065 {
4066         static hf_register_info hf[] = {
4067
4068         { &hf_lsa_opnum,
4069           { "Operation", "lsa.opnum", FT_UINT16, BASE_DEC, NULL, 0x0, "Operation", HFILL }},
4070
4071         { &hf_lsa_unknown_string,
4072                 { "Unknown string", "lsa.unknown_string", FT_STRING, BASE_NONE,
4073                 NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
4074
4075         { &hf_lsa_hnd,
4076                 { "Context Handle", "lsa.hnd", FT_BYTES, BASE_NONE,
4077                 NULL, 0x0, "LSA policy handle", HFILL }},
4078
4079         { &hf_lsa_server,
4080                 { "Server", "lsa.server", FT_STRING, BASE_NONE,
4081                 NULL, 0, "Name of Server", HFILL }},
4082
4083         { &hf_lsa_controller,
4084                 { "Controller", "lsa.controller", FT_STRING, BASE_NONE,
4085                 NULL, 0, "Name of Domain Controller", HFILL }},
4086
4087         { &hf_lsa_unknown_hyper,
4088                 { "Unknown hyper", "lsa.unknown.hyper", FT_UINT64, BASE_HEX,
4089                 NULL, 0x0, "Unknown hyper. If you know what this is, contact ethereal developers.", HFILL }},
4090
4091         { &hf_lsa_unknown_long,
4092                 { "Unknown long", "lsa.unknown.long", FT_UINT32, BASE_HEX,
4093                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
4094
4095         { &hf_lsa_unknown_short,
4096                 { "Unknown short", "lsa.unknown.short", FT_UINT16, BASE_HEX,
4097                 NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
4098
4099         { &hf_lsa_unknown_char,
4100                 { "Unknown char", "lsa.unknown.char", FT_UINT8, BASE_HEX,
4101                 NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
4102
4103         { &hf_lsa_rc,
4104                 { "Return code", "lsa.rc", FT_UINT32, BASE_HEX,
4105                 VALS (NT_errors), 0x0, "LSA return status code", HFILL }},
4106
4107         { &hf_lsa_obj_attr,
4108                 { "Attributes", "lsa.obj_attr", FT_UINT32, BASE_HEX,
4109                 NULL, 0x0, "LSA Attributes", HFILL }},
4110
4111         { &hf_lsa_obj_attr_len,
4112                 { "Length", "lsa.obj_attr.len", FT_UINT32, BASE_DEC,
4113                 NULL, 0x0, "Length of object attribute structure", HFILL }},
4114
4115         { &hf_lsa_obj_attr_name,
4116                 { "Name", "lsa.obj_attr.name", FT_STRING, BASE_NONE,
4117                 NULL, 0x0, "Name of object attribute", HFILL }},
4118
4119         { &hf_lsa_access_mask,
4120                 { "Access Mask", "lsa.access_mask", FT_UINT32, BASE_HEX,
4121                 NULL, 0x0, "LSA Access Mask", HFILL }},
4122
4123         { &hf_lsa_info_level,
4124                 { "Level", "lsa.info.level", FT_UINT16, BASE_DEC,
4125                 NULL, 0x0, "Information level of requested data", HFILL }},
4126
4127         { &hf_lsa_trusted_info_level,
4128                 { "Info Level", "lsa.trusted.info_level", FT_UINT16, BASE_DEC,
4129                 VALS(trusted_info_level_vals), 0x0, "Information level of requested Trusted Domain Information", HFILL }},
4130
4131         { &hf_lsa_sd_size,
4132                 { "Size", "lsa.sd_size", FT_UINT32, BASE_DEC,
4133                 NULL, 0x0, "Size of lsa security descriptor", HFILL }},
4134
4135         { &hf_lsa_qos_len,
4136                 { "Length", "lsa.qos.len", FT_UINT32, BASE_DEC,
4137                 NULL, 0x0, "Length of quality of service structure", HFILL }},
4138
4139         { &hf_lsa_qos_impersonation_level,
4140                 { "Impersonation level", "lsa.qos.imp_lev", FT_UINT16, BASE_DEC,
4141                 VALS(lsa_impersonation_level_vals), 0x0, "QOS Impersonation Level", HFILL }},
4142
4143         { &hf_lsa_qos_track_context,
4144                 { "Context Tracking", "lsa.qos.track_ctx", FT_UINT8, BASE_DEC,
4145                 NULL, 0x0, "QOS Context Tracking Mode", HFILL }},
4146
4147         { &hf_lsa_qos_effective_only,
4148                 { "Effective only", "lsa.qos.effective_only", FT_UINT8, BASE_DEC,
4149                 NULL, 0x0, "QOS Flag whether this is Effective Only or not", HFILL }},
4150
4151         { &hf_lsa_pali_percent_full,
4152                 { "Percent Full", "lsa.pali.percent_full", FT_UINT32, BASE_DEC,
4153                 NULL, 0x0, "How full audit log is in percentage", HFILL }},
4154
4155         { &hf_lsa_pali_log_size,
4156                 { "Log Size", "lsa.pali.log_size", FT_UINT32, BASE_DEC,
4157                 NULL, 0x0, "Size of audit log", HFILL }},
4158
4159         { &hf_lsa_pali_retention_period,
4160                 { "Retention Period", "lsa.pali.retention_period", FT_RELATIVE_TIME, BASE_NONE,
4161                 NULL, 0x0, "", HFILL }},
4162
4163         { &hf_lsa_pali_time_to_shutdown,
4164                 { "Time to shutdown", "lsa.pali.time_to_shutdown", FT_RELATIVE_TIME, BASE_NONE,
4165                 NULL, 0x0, "Time to shutdown", HFILL }},
4166
4167         { &hf_lsa_pali_shutdown_in_progress,
4168                 { "Shutdown in progress", "lsa.pali.shutdown_in_progress", FT_UINT8, BASE_DEC,
4169                 NULL, 0x0, "Flag whether shutdown is in progress or not", HFILL }},
4170
4171         { &hf_lsa_pali_next_audit_record,
4172                 { "Next Audit Record", "lsa.pali.next_audit_record", FT_UINT32, BASE_HEX,
4173                 NULL, 0x0, "Next audit record", HFILL }},
4174
4175         { &hf_lsa_paei_enabled,
4176                 { "Enabled", "lsa.paei.enabled", FT_UINT8, BASE_DEC,
4177                 NULL, 0x0, "If Audit Events Information is Enabled or not", HFILL }},
4178
4179         { &hf_lsa_paei_settings,
4180                 { "Settings", "lsa.paei.settings", FT_UINT32, BASE_HEX,
4181                 NULL, 0x0, "Audit Events Information settings", HFILL }},
4182
4183         { &hf_lsa_count,
4184                 { "Count", "lsa.count", FT_UINT32, BASE_DEC,
4185                 NULL, 0x0, "Count of objects", HFILL }},
4186
4187         { &hf_lsa_max_count,
4188                 { "Max Count", "lsa.max_count", FT_UINT32, BASE_DEC,
4189                 NULL, 0x0, "", HFILL }},
4190
4191         { &hf_lsa_fqdomain,
4192                 { "FQDN", "lsa.fqdn_domain", FT_STRING, BASE_NONE,
4193                 NULL, 0x0, "Fully Qualified Domain Name", HFILL }},
4194
4195         { &hf_lsa_domain,
4196                 { "Domain", "lsa.domain", FT_STRING, BASE_NONE,
4197                 NULL, 0x0, "Domain", HFILL }},
4198
4199         { &hf_lsa_domain_sid,
4200                 { "Domain SID", "lsa.domain_sid", FT_STRING, BASE_NONE,
4201                 NULL, 0x0, "The Domain SID", HFILL }},
4202
4203         { &hf_lsa_acct,
4204                 { "Account", "lsa.acct", FT_STRING, BASE_NONE,
4205                 NULL, 0x0, "Account", HFILL }},
4206
4207         { &hf_lsa_source,
4208                 { "Source", "lsa.source", FT_STRING, BASE_NONE,
4209                 NULL, 0x0, "Replica Source", HFILL }},
4210
4211         { &hf_lsa_server_role,
4212                 { "Role", "lsa.server_role", FT_UINT16, BASE_DEC,
4213                 VALS(server_role_vals), 0x0, "LSA Server Role", HFILL }},
4214
4215         { &hf_lsa_quota_paged_pool,
4216                 { "Paged Pool", "lsa.quota.paged_pool", FT_UINT32, BASE_DEC,
4217                 NULL, 0x0, "Size of Quota Paged Pool", HFILL }},
4218
4219         { &hf_lsa_quota_non_paged_pool,
4220                 { "Non Paged Pool", "lsa.quota.non_paged_pool", FT_UINT32, BASE_DEC,
4221                 NULL, 0x0, "Size of Quota non-Paged Pool", HFILL }},
4222
4223         { &hf_lsa_quota_min_wss,
4224                 { "Min WSS", "lsa.quota.min_wss", FT_UINT32, BASE_DEC,
4225                 NULL, 0x0, "Size of Quota Min WSS", HFILL }},
4226
4227         { &hf_lsa_quota_max_wss,
4228                 { "Max WSS", "lsa.quota.max_wss", FT_UINT32, BASE_DEC,
4229                 NULL, 0x0, "Size of Quota Max WSS", HFILL }},
4230
4231         { &hf_lsa_quota_pagefile,
4232                 { "Pagefile", "lsa.quota.pagefile", FT_UINT32, BASE_DEC,
4233                 NULL, 0x0, "Size of quota pagefile usage", HFILL }},
4234
4235         { &hf_lsa_mod_seq_no,
4236                 { "Seq No", "lsa.mod.seq_no", FT_UINT64, BASE_DEC,
4237                 NULL, 0x0, "Sequence number for this modification", HFILL }},
4238
4239         { &hf_lsa_mod_mtime,
4240                 { "MTime", "lsa.mod.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4241                 NULL, 0x0, "Time when this modification occured", HFILL }},
4242
4243         { &hf_lsa_cur_mtime,
4244                 { "Current MTime", "lsa.cur.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4245                 NULL, 0x0, "Current MTime to set", HFILL }},
4246
4247         { &hf_lsa_old_mtime,
4248                 { "Old MTime", "lsa.old.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4249                 NULL, 0x0, "Old MTime for this object", HFILL }},
4250
4251         { &hf_lsa_name,
4252                 { "Name", "lsa.name", FT_STRING, BASE_NONE,
4253                 NULL, 0x0, "", HFILL }},
4254
4255         { &hf_lsa_key,
4256                 { "Key", "lsa.key", FT_STRING, BASE_NONE,
4257                 NULL, 0x0, "", HFILL }},
4258
4259         { &hf_lsa_flat_name,
4260                 { "Flat Name", "lsa.flat_name", FT_STRING, BASE_NONE,
4261                 NULL, 0x0, "", HFILL }},
4262
4263         { &hf_lsa_forest,
4264                 { "Forest", "lsa.forest", FT_STRING, BASE_NONE,
4265                 NULL, 0x0, "", HFILL }},
4266
4267         { &hf_lsa_info_type,
4268                 { "Info Type", "lsa.info_type", FT_UINT32, BASE_DEC,
4269                 NULL, 0x0, "", HFILL }},
4270
4271         { &hf_lsa_new_pwd,
4272                 { "New Password", "lsa.new_pwd", FT_BYTES, BASE_HEX,
4273                 NULL, 0x0, "New password", HFILL }},
4274
4275         { &hf_lsa_old_pwd,
4276                 { "Old Password", "lsa.old_pwd", FT_BYTES, BASE_HEX,
4277                 NULL, 0x0, "Old password", HFILL }},
4278
4279         { &hf_lsa_sid_type,
4280                 { "SID Type", "lsa.sid_type", FT_UINT16, BASE_DEC,
4281                 VALS(sid_type_vals), 0x0, "Type of SID", HFILL }},
4282
4283         { &hf_lsa_rid,
4284                 { "RID", "lsa.rid", FT_UINT32, BASE_HEX,
4285                 NULL, 0x0, "RID", HFILL }},
4286
4287         { &hf_lsa_rid_offset,
4288                 { "RID Offset", "lsa.rid.offset", FT_UINT32, BASE_HEX,
4289                 NULL, 0x0, "RID Offset", HFILL }},
4290
4291         { &hf_lsa_index,
4292                 { "Index", "lsa.index", FT_UINT32, BASE_DEC,
4293                 NULL, 0x0, "", HFILL }},
4294
4295         { &hf_lsa_num_mapped,
4296                 { "Num Mapped", "lsa.num_mapped", FT_UINT32, BASE_DEC,
4297                 NULL, 0x0, "", HFILL }},
4298
4299         { &hf_lsa_policy_information_class,
4300                 { "Info Class", "lsa.policy.info", FT_UINT16, BASE_DEC,
4301                 VALS(policy_information_class_vals), 0x0, "Policy information class", HFILL }},
4302
4303         { &hf_lsa_secret,
4304                 { "LSA Secret", "lsa.secret", FT_BYTES, BASE_HEX,
4305                 NULL, 0, "", HFILL }},
4306
4307         { &hf_lsa_auth_blob,
4308                 { "Auth blob", "lsa.auth.blob", FT_BYTES, BASE_HEX,
4309                 NULL, 0, "", HFILL }},
4310
4311         { &hf_nt_luid_high,
4312                 { "High", "nt.luid.high", FT_UINT32, BASE_HEX,
4313                 NULL, 0x0, "LUID High component", HFILL }},
4314
4315         { &hf_nt_luid_low,
4316                 { "Low", "nt.luid.low", FT_UINT32, BASE_HEX,
4317                 NULL, 0x0, "LUID Low component", HFILL }},
4318
4319         { &hf_lsa_size,
4320                 { "Size", "lsa.size", FT_UINT32, BASE_DEC,
4321                 NULL, 0x0, "", HFILL }},
4322
4323         { &hf_lsa_size16,
4324                 { "Size", "lsa.size", FT_UINT16, BASE_DEC,
4325                 NULL, 0x0, "", HFILL }},
4326
4327         { &hf_lsa_size_needed,
4328                 { "Size Needed", "lsa.size_needed", FT_UINT16, BASE_DEC,
4329                 NULL, 0x0, "", HFILL }},
4330
4331         { &hf_lsa_privilege_name,
4332                 { "Name", "lsa.privilege.name", FT_STRING, BASE_NONE,
4333                 NULL, 0x0, "LSA Privilege Name", HFILL }},
4334
4335         { &hf_lsa_rights,
4336                 { "Rights", "lsa.rights", FT_STRING, BASE_NONE,
4337                 NULL, 0x0, "Account Rights", HFILL }},
4338
4339         { &hf_lsa_policy_information,
4340                 { "POLICY INFO", "lsa.policy_information", FT_NONE, BASE_NONE,
4341                 NULL, 0x0, "Policy Information union", HFILL }},
4342
4343         { &hf_lsa_attr,
4344                 { "Attr", "lsa.attr", FT_UINT64, BASE_HEX,
4345                 NULL, 0x0, "LSA Attributes", HFILL }},
4346
4347         { &hf_lsa_auth_update,
4348                 { "Update", "lsa.auth.update", FT_UINT64, BASE_HEX,
4349                 NULL, 0x0, "LSA Auth Info update", HFILL }},
4350
4351         { &hf_lsa_resume_handle,
4352                 { "Resume Handle", "lsa.resume_handle", FT_UINT32, BASE_DEC,
4353                 NULL, 0x0, "Resume Handle", HFILL }},
4354
4355         { &hf_lsa_trust_direction,
4356                 { "Trust Direction", "lsa.trust.direction", FT_UINT32, BASE_DEC,
4357                 VALS(trusted_direction_vals), 0x0, "Trust direction", HFILL }},
4358
4359         { &hf_lsa_trust_type,
4360                 { "Trust Type", "lsa.trust.type", FT_UINT32, BASE_DEC,
4361                 VALS(trusted_type_vals), 0x0, "Trust type", HFILL }},
4362
4363         { &hf_lsa_trust_attr,
4364                 { "Trust Attr", "lsa.trust.attr", FT_UINT32, BASE_HEX,
4365                 NULL, 0x0, "Trust attributes", HFILL }},
4366
4367         { &hf_lsa_trust_attr_non_trans,
4368                 { "Non Transitive", "lsa.trust.attr.non_trans", FT_BOOLEAN, 32,
4369                 TFS(&tfs_trust_attr_non_trans), 0x00000001, "Non Transitive trust", HFILL }},
4370
4371         { &hf_lsa_trust_attr_uplevel_only,
4372                 { "Upleve only", "lsa.trust.attr.uplevel_only", FT_BOOLEAN, 32,
4373                 TFS(&tfs_trust_attr_uplevel_only), 0x00000002, "Uplevel only trust", HFILL }},
4374
4375         { &hf_lsa_trust_attr_tree_parent,
4376                 { "Tree Parent", "lsa.trust.attr.tree_parent", FT_BOOLEAN, 32,
4377                 TFS(&tfs_trust_attr_tree_parent), 0x00400000, "Tree Parent trust", HFILL }},
4378
4379         { &hf_lsa_trust_attr_tree_root,
4380                 { "Tree Root", "lsa.trust.attr.tree_root", FT_BOOLEAN, 32,
4381                 TFS(&tfs_trust_attr_tree_root), 0x00800000, "Tree Root trust", HFILL }},
4382
4383         { &hf_lsa_auth_type,
4384                 { "Auth Type", "lsa.auth.type", FT_UINT32, BASE_DEC,
4385                 NULL, 0x0, "Auth Info type", HFILL }},
4386
4387         { &hf_lsa_auth_len,
4388                 { "Auth Len", "lsa.auth.len", FT_UINT32, BASE_DEC,
4389                 NULL, 0x0, "Auth Info len", HFILL }},
4390
4391         { &hf_lsa_remove_all,
4392                 { "Remove All", "lsa.remove_all", FT_UINT8, BASE_DEC,
4393                 NULL, 0x0, "Flag whether all rights should be removed or only the specified ones", HFILL }},
4394
4395         { &hf_view_local_info,
4396                 { "View local info", "lsa.access_mask.view_local_info",
4397                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_VIEW_LOCAL_INFORMATION,
4398                   "View local info", HFILL }},
4399
4400         { &hf_view_audit_info,
4401                 { "View audit info", "lsa.access_mask.view_audit_info",
4402                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_VIEW_AUDIT_INFORMATION,
4403                   "View audit info", HFILL }},
4404
4405         { &hf_get_private_info,
4406                 { "Get private info", "lsa.access_mask.get_privateinfo",
4407                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_GET_PRIVATE_INFORMATION,
4408                   "Get private info", HFILL }},
4409
4410         { &hf_trust_admin,
4411                 { "Trust admin", "lsa.access_mask.trust_admin",
4412                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_TRUST_ADMIN,
4413                   "Trust admin", HFILL }},
4414
4415         { &hf_create_account,
4416                 { "Create account", "lsa.access_mask.create_account",
4417                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_ACCOUNT,
4418                   "Create account", HFILL }},
4419
4420         { &hf_create_secret,
4421                 { "Create secret", "lsa.access_mask.create_secret",
4422                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_SECRET,
4423                   "Create secret", HFILL }},
4424
4425         { &hf_create_priv,
4426                 { "Create privilege", "lsa.access_mask.create_priv",
4427                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_PRIVILEGE,
4428                   "Create privilege", HFILL }},
4429
4430         { &hf_set_default_quota_limits,
4431                 { "Set default quota limits", "lsa.access_mask.set_default_quota_limits",
4432                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SET_DEFAULT_QUOTA_LIMITS,
4433                   "Set default quota limits", HFILL }},
4434
4435         { &hf_set_audit_requirements,
4436                 { "Set audit requirements", "lsa.access_mask.set_audit_requirements",
4437                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SET_AUDIT_REQUIREMENTS,
4438                   "Set audit requirements", HFILL }},
4439
4440         { &hf_server_admin,
4441                 { "Server admin", "lsa.access_mask.server_admin",
4442                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SERVER_ADMIN,
4443                   "Server admin", HFILL }},
4444
4445         { &hf_lookup_names,
4446                 { "Lookup names", "lsa.access_mask.lookup_names",
4447                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_LOOKUP_NAMES,
4448                   "Lookup names", HFILL }}
4449 };
4450
4451         static gint *ett[] = {
4452                 &ett_dcerpc_lsa,
4453                 &ett_lsa_OBJECT_ATTRIBUTES,
4454                 &ett_LSA_SECURITY_DESCRIPTOR,
4455                 &ett_lsa_policy_info,
4456                 &ett_lsa_policy_audit_log_info,
4457                 &ett_lsa_policy_audit_events_info,
4458                 &ett_lsa_policy_primary_domain_info,
4459                 &ett_lsa_policy_primary_account_info,
4460                 &ett_lsa_policy_server_role_info,
4461                 &ett_lsa_policy_replica_source_info,
4462                 &ett_lsa_policy_default_quota_info,
4463                 &ett_lsa_policy_modification_info,
4464                 &ett_lsa_policy_audit_full_set_info,
4465                 &ett_lsa_policy_audit_full_query_info,
4466                 &ett_lsa_policy_dns_domain_info,
4467                 &ett_lsa_translated_names,
4468                 &ett_lsa_translated_name,
4469                 &ett_lsa_referenced_domain_list,
4470                 &ett_lsa_trust_information,
4471                 &ett_lsa_trust_information_ex,
4472                 &ett_LUID,
4473                 &ett_LSA_PRIVILEGES,
4474                 &ett_LSA_PRIVILEGE,
4475                 &ett_LSA_LUID_AND_ATTRIBUTES_ARRAY,
4476                 &ett_LSA_LUID_AND_ATTRIBUTES,
4477                 &ett_LSA_TRUSTED_DOMAIN_LIST,
4478                 &ett_LSA_TRUSTED_DOMAIN,
4479                 &ett_LSA_TRANSLATED_SIDS,
4480                 &ett_lsa_trusted_domain_info,
4481                 &ett_lsa_trust_attr,
4482                 &ett_lsa_trusted_domain_auth_information,
4483                 &ett_lsa_auth_information
4484         };
4485
4486         proto_dcerpc_lsa = proto_register_protocol(
4487                 "Microsoft Local Security Architecture", "LSA", "lsa");
4488
4489         proto_register_field_array (proto_dcerpc_lsa, hf, array_length (hf));
4490         proto_register_subtree_array(ett, array_length(ett));
4491 }
4492
4493 /* Protocol handoff */
4494
4495 static e_uuid_t uuid_dcerpc_lsa = {
4496         0x12345778, 0x1234, 0xabcd,
4497         { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab}
4498 };
4499
4500 static guint16 ver_dcerpc_lsa = 0;
4501
4502 void
4503 proto_reg_handoff_dcerpc_lsa(void)
4504 {
4505         /* Register protocol as dcerpc */
4506
4507         dcerpc_init_uuid(proto_dcerpc_lsa, ett_dcerpc_lsa, &uuid_dcerpc_lsa,
4508                          ver_dcerpc_lsa, dcerpc_lsa_dissectors, hf_lsa_opnum);
4509 }